kenryu42/cc-safety-net v2.7.0

on GitHub

This release blocks cloud metadata requests, remote data uploads, and unshare user namespaces, and starts analyzing shell scripts a command runs from disk. It also raises the minimum supported Node.js version to 22, which is a breaking change for Node.js 18 and 20 users.

Highlights

• Blocked the command shapes reported in Cohere's write-up of an open-weight model: reading cloud instance credentials, uploading data to a remote host, and gaining root inside a private user namespace.
• Analyzed shell scripts a command runs by path, so a destructive command saved to a file and run as sh evil.sh is caught instead of allowed.

Added

• Added the network.cloud-metadata rule, which blocks HTTP clients, raw socket tools, and code interpreters that name a cloud metadata host (169.254.169.254, 169.254.170.2, 169.254.170.23, fd00:ec2::254, fd00:ec2::23, metadata.google.internal, metadata.goog, 100.100.100.200). Commands that only mention such an address, such as grep, sed, or iptables, stay allowed. (#299)
• Added the network.upload-remote rule, which blocks curl requests that send a body or upload a file (-d, --data*, --json, -F, --form*, -T, --upload-file) and wget --post-data, --post-file, --body-data, and --body-file, unless every URL is loopback (localhost, *.localhost, 127.0.0.0/8, 0.0.0.0, [::1]). Query-string requests (-G, --get) and --unix-socket calls stay allowed. (#300)
• Added the unshare.user-namespace rule, which blocks unshare options that create a user namespace (-U, --user, -r, --map-root-user, -c, --map-current-user, --map-user(s), --map-group(s), --map-auto), including short clusters such as -Urm and invocations behind sudo or timeout. Other namespaces, such as unshare -n true, stay allowed. (#302)
• Added analysis of shell scripts read from disk for sh, bash, zsh, dash, and ksh run with a file argument, source <file>, . <file>, and ./<file>, including scripts checked out with CRLF line endings. Only a concrete rule match inside the body blocks; an uncertain result keeps the previous verdict. Reads are limited to regular files of at most 256 KB, skip any path the same command may have written, and are capped per command. (#303)
• Added the script path and line number to a denial that comes from a script body, for example evil.sh:3: This uploads data to a remote host..., and a Read script file step to explain that shows the path and byte size. No script text reaches the denial, the explain trace, or the audit log. (#306)

Changed

• Changed manual-only denial messages to ask the user to run the command rather than reading as an instruction the agent itself could retry. This covers the new network and unshare rules and the dd device-write, mkfs, disk-erase, device-redirect, and shred rules.
• Commands that send non-secret data to a remote host, such as curl -F file=@notes.txt https://example.com or tar czf - src | curl -T - https://example.com, now block where they were previously allowed. Turn network.upload-remote off with the existing per-rule override if this is not wanted.

Fixed

• Fixed a backslash line continuation between words being parsed as an empty command, which let the command after && \, || \, | \, or ; \ and a newline skip every rule. (#308)
• Fixed a literal heredoc that a shell runs as its program, such as bash <<'EOF', receiving only the raw-text scan. Upload, cloud metadata, and unshare bodies now block at the standard level, and bodies that already blocked report a specific rule instead of raw-text.dangerous-command. (#309)

Breaking Changes

• Raised the minimum supported Node.js version to 22. Node.js 18 and 20, both past end of life, are no longer supported. (#305)
  • Migration: Upgrade to Node.js 22 or newer before installing or updating. Installing on Node.js 20 currently fails with Cannot read properties of null (reading 'edgesOut') because of an upstream optional peer dependency.