The command analyzer now resolves more shell-script and source paths before deciding, so fewer safe scripts are blocked as unverifiable and heredoc-written scripts are still inspected when they are run through those paths.
Changed
- Improved heredoc script coverage: a script written by a heredoc and then executed directly by its path (
$DIR/run.sh) is now checked against its recorded body instead of running unexamined. A body with a non-shell shebang such as#!/usr/bin/env python3, a body that cannot be parsed, or a body that exceeds analysis limits is allowed rather than blocked. (#270) - Changed heredoc tracking so an intervening command that only assigns shell variables no longer discards it, which means a script written to
$HOME/cleanup.shand then run asZ=$HOME; bash $Z/cleanup.shis still inspected. (#270)
Fixed
- Fixed
sourceand.operands whose path comes from a literal assignment being blocked as an unverifiable shell execution source, soS=/tmp/work; source $S/env.shis allowed in standard mode. (#270) - Fixed script and
sourcepaths that start with an unquoted~/,$HOME, or$PWDnot resolving, so commands such asK=$PWD/kit; bash $K/run.shandbash ~/bin/setup.share no longer blocked as unverifiable.$PWDstays unresolved when a wrapper changes the working directory. (#270) - Fixed paths built from the macOS per-user temp directory not resolving: an assignment whose value is exactly
$(getconf DARWIN_USER_TEMP_DIR)is now expanded by reading that value once from/usr/bin/getconfon macOS, so scripts under that directory are analyzed instead of blocked. (#270)