kenryu42/cc-safety-net v2.6.11

on GitHub

This release closes host-integration gaps found by a drift audit: several tool calls that previously reached a shell without analysis are now checked, and doctor no longer reports a host as protected while that host is skipping the hook.

Highlights

• Analyzed tool calls that previously ran unchecked: Devin exec working directories and write_to_process key input, Antigravity CLI manage_task input, Grok Build's run_terminal_cmd, bash, and Shell tools, and OpenCode's forced opencode_worktree_remove.
• doctor now reports disabled instead of configured when the host skips the hook: a Grok Build disabled-hooks entry, an invalid Kimi Code [[hooks]] entry that makes Kimi drop every hook, or a Pi extensions filter that does not load the extension.

Added

• Added Kimi Code plugin detection: doctor reads plugins/installed.json and reports the plugin configured, or disabled when it is installed but not enabled. update skips the plugin and names the in-host step (/plugins, Installed tab) because it cannot run Kimi's own plugin update. (#257)

Changed

• Changed Claude Code to ask instead of deny in the auto permission mode when standard mode cannot verify a command; the permission prompt still reaches a person there, and Claude Code's classifier cannot approve the call without it. (#254)
• Changed Factory Droid denials to print the reason to stderr and exit 2 in addition to the JSON decision, so a co-installed allow or ask hook can no longer drop the block. (#253)
• Changed install --droid seeding: when ~/.factory/hooks.json does not exist yet, it now carries over every event from the legacy ~/.factory/hooks/hooks.json and only PreToolUse from settings.json, instead of freezing every settings.json event. (#253)
• Changed Grok Build command-tool coverage, so rule tool add now refuses run_terminal_cmd, bash, and Shell as Grok Build built-ins. A bash workdir or Shell working_directory outside the workspace root is denied, and a blank or non-string value fails closed. (#248)

Fixed

• Fixed Devin exec calls ignoring workdir, so a command is analyzed against the directory it runs in. (#247)
• Fixed Devin write_to_process analysis: bytes_input is analyzed as typed text with <CR> and <LF> ending lines, and a call whose text is combined with line-editing keys, an undocumented key token, or text in both text_input and bytes_input is denied rather than analyzed as a line the receiving program would not run. (#247)
• Fixed Antigravity CLI manage_task with Action: "send_input" reaching a running process without analysis; its Input is now analyzed as a command. (#247)
• Fixed grep-style tool calls skipping path checks on their filter arguments; glob_pattern, dir_path, and include_pattern are now checked, closing secret-file reads through Droid, Devin, and Gemini CLI grep filters. (#250)
• Fixed Gemini CLI file paths being analyzed only as sent; file_path is now also analyzed as the host rewrites it, with NUL bytes removed and a leading @ stripped when the literal path does not exist. (#250)
• Fixed OpenCode Code Mode opencode_worktree_remove with force: true discarding untracked files without analysis; it is now checked as git worktree remove --force, matching the verdict for the shell form. (#251)
• Fixed the OpenCode v1 shell dialect on Windows: with no configured shell, the adapter now follows SHELL as the host does, instead of always assuming PowerShell. (#251)
• Fixed install --opencode and update failing with Plugin is not configured when the OpenCode v2 service was not running. (#251)
• Fixed doctor and update missing a Claude Code plugin install when CLAUDE_CODE_PLUGIN_CACHE_DIR is set. (#254)
• Fixed the Cursor check following CLAUDE_CONFIG_DIR, which could advise removing Cursor's only working hook; Cursor imports the Claude Code plugin from ~/.claude only. (#254)
• Fixed install --droid and doctor failing on a comment in hooks.json or settings.json; both files are now parsed as JSONC, as Droid parses them. (#253)
• Fixed GitHub Copilot CLI disableAllHooks handling: a hook file that disables hooks for itself is no longer counted as active, disableAllHooks in the user settings.json now drops only that file's inline hooks instead of every method, and ~/.copilot/config.json is no longer read for hooks. (#256)
• Fixed the Kimi Code plugin install instructions and method prompt omitting the double-hook caution when the detected global hook was reported disabled by an invalid sibling hooks entry. (#257)
• Fixed unreadable host state aborting detection: an unreadable Grok Build disabled-hooks file or Kimi Code plugins/installed.json is now reported as an error naming the file instead of stopping doctor, install, and update discovery. (#257)

Security

• Documented four host behaviors CC Safety Net cannot correct: openclaw agent exec loads no plugin hook, Kimi Code kimi web and ACP sessions report the server's directory as the session cwd, OpenCode v1 on Windows can convert a POSIX-rooted workdir differently than the adapter resolves it, and install --deepseek-harness covers the web and desktop profiles only. See SECURITY.md.
• Clarified reporting guidance: a redaction gap for a value the tool call itself supplied, appearing only in that caller's denial message or the local audit log, is an ordinary public bug, while disclosure of a secret the caller did not supply remains private disclosure.