kenryu42/cc-safety-net v2.7.1

on GitHub

This release closes several ways a remotely fetched program could reach an interpreter or PowerShell unchecked, and stops a host tool's working-directory argument from moving the boundary that recursive-delete rules protect.

Highlights

• Remote installer commands that hand fetched code to an interpreter or to PowerShell — curl … | python3 -, irm … | iex, curl -o i.sh … && bash i.sh — now stop as an unverifiable shell execution source instead of running. Hosts that can prompt ask for confirmation; non-prompting modes such as bypassPermissions deny.
• Recursive-delete rules anchor at the session workspace rather than the working directory a shell tool passes in, so a tool workdir outside the workspace no longer opens up deletes that a leading cd .. already blocked.

Fixed

• Fixed an interpreter running a program fetched from the network being allowed. python3, node, perl, and ruby reading their program from a remote pipeline stage, a command substitution, or a process substitution — including behind sudo, env, timeout, nice, stdbuf, or exec — are now blocked at both standard and strict. (#312)
• Fixed PowerShell evaluation of remote content being allowed. iex/Invoke-Expression fed by a remote fetch through a pipeline, a $(…) substitution, a parenthesized fetch, or .DownloadString(/.DownloadData( is now blocked, directly or nested in pwsh -c / powershell -Command. irm, iwr, Invoke-RestMethod, and Invoke-WebRequest now count as remote fetchers, so irm … | python3 is caught too. (#313)
• Fixed a file downloaded and then executed in the same command being allowed. The literal output path of curl -o/--output, wget -O/--output-document, or a truncating redirect is tracked for the rest of that command; running it as a shell script (bash, sh, source, ./path) or as an interpreter main script is blocked. Inspecting the download instead — sha256sum, cat, tar, bash -n, node --check, ruby -c — overwriting the path before it runs, or piping remote data into python3 -c, jq, or ConvertFrom-Json stays allowed. (#316)
• Fixed a shell tool's working-directory argument (DeepSeek Harness workdir, Gemini dir_path, OpenCode workdir, a declared tool's cwd) re-anchoring the outside-cwd and cwd-self delete rules, which allowed rm -rf outside and Remove-Item -LiteralPath <dir>\outside -Recurse -Force from a workdir above the workspace. Relative paths, git context, and secret paths still resolve in the workdir. (#318)
• Fixed the home working-directory delete rule not firing when the session directory contains the home directory; it now applies when either the session anchor or the current directory is home. (#318)
• Fixed Remove-Item and cmd rd/del allowing a delete outside the workspace when the home working-directory rule is turned off; they now share the ordered classification rm uses and deny as an outside-workspace delete. (#318)
• Fixed an interpreter syntax-check flag counting when it follows the script operand, where it no longer requests a check: node check.js --check on a downloaded file is now treated as running it, while node --check app.js and ruby -c app.rb stay recognized as checks. (#316)