kenryu42/cc-safety-net v2.6.17

on GitHub

This release closes a gap that let remote install one-liners such as bash -c "$(curl -fsSL …)" through unchecked, and replaces the misleading failure message that malformed tool calls used to produce.

Highlights

• Blocked remote install one-liners of the form bash -c "$(curl -fsSL https://…)" in every mode, matching the existing treatment of curl … | bash and eval "$(curl …)". (#276)
• Replaced the analysis.failed-closed denial for malformed tool calls with a dedicated tool-call.malformed denial that tells the agent to resend the call instead of reporting CC Safety Net as broken. (#279)

Added

• Added an install and update notice for DeepSeek Harness that names the other plugins found in each profile and prints the command to declare their shell tools, npx -y cc-safety-net rule tool add <tool-name>, so commands those tools run are checked. The notice is printed in English and Chinese, and is omitted for profiles that hold only cc-safety-net. (#281)

Changed

• Changed the denial for a tool call the model sent malformed — a missing or blank tool name, non-object arguments, a blank command, or a blank, non-string, or conflicting working-directory argument — to the new tool-call.malformed rule with the use_alternative intent. The call is still blocked and still recorded in the audit log. This covers the hook hosts (Kimi, Gemini, Devin, Hermes, Cursor, Antigravity, Grok) and the plugin hosts (DeepSeek Harness, OpenClaw, Amp, Pi, OpenCode). (#284, #282)
• Kept analysis.failed-closed for problems that come from the host rather than the model, including a non-object payload, a blank session working directory, a missing workspace root or path, input-size limits, and analysis faults. (#282)
• Improved the audit record for a nameless DeepSeek Harness tool call, which now carries the session working directory instead of no working directory. (#282)

Fixed

• Fixed the analyzer treating a remote fetch inside a shell -c script's command substitution as an ordinary dynamic first word, which only strict mode caught. A -c script whose substitution runs a remote fetcher such as curl, wget, xh, or nc is now a dynamic shell source in every mode, including through sudo, env, and -lc wrappers. Everyday substitutions such as bash -c "cd $(git rev-parse --show-toplevel) && bun test" and bash -c "$(cat x.sh)" are unaffected. (#276)