kenryu42/cc-safety-net v2.7.13

on GitHub

This release extends protection to local PowerShell scripts, docker compose config, and heredoc text, and fixes Windows execution of launcher paths that contain a space.

Highlights

• Local PowerShell .ps1 and .psm1 scripts are now read and analyzed before they run (#359).
• docker compose config now counts as a read of the project .env (#363).
• Windows .cmd launchers whose path contains a space now run correctly (#357).

Added

• Added analysis of local PowerShell .ps1 and .psm1 files reached through . x, & x, .\x, Import-Module, and pwsh -File: the file is read from disk, only a concrete rule match in its body blocks, and a missing or unreadable file keeps the outer verdict. A dot-source of anything other than such a literal path is still refused as an unverifiable shell source (#359)
• Added docker compose config and convert, and docker-compose config, as a read of the project .env when that file exists, at every safety level. The project directory follows --project-directory, else the directory of the first -f/--file, else the working directory; --env-file is judged by its own path, and options that print no .env values, such as --quiet, --services, --images, and --no-interpolate, stay allowed (#363)
• Added download tracking for the -OutFile value of PowerShell Invoke-WebRequest, Invoke-RestMethod, iwr, and irm, so a downloaded script that is dot-sourced afterwards still blocks (#359)

Fixed

• Fixed running Windows .cmd shims whose path contains a space, which made the DeepSeek Harness Desktop install and update steps fail and also affected shims such as C:\Program Files\nodejs\npx.cmd (#357)
• Fixed a glued PowerShell assignment such as $a=Get-ChildItem . -File being blocked as an unverifiable shell source. It now parses like the spaced form, so $a=git reset --hard blocks the same way $a = git reset --hard does (#358)
• Fixed dot-sourcing a readable local PowerShell helper, such as . .\helpers.ps1, being blocked as an unverifiable shell source (#359)
• Fixed heredoc text being read as commands: the body of a heredoc given to cat, tee, git commit, gh pr create, or gh issue create and not piped onward is now text whether or not its delimiter is quoted, so a commit message mentioning a file name such as .env is allowed. The $(…) and backtick substitutions inside an unquoted body are still checked (#361)
• Fixed search patterns being read as paths: a Select-String -Pattern value, such as Core.KeyRing, is no longer a path at any level, and in standard mode a sed script given as the first operand or an -e/--expression value is treated as data. Strict mode keeps checking the sed script, and -f script files and input files stay checked everywhere (#362)

Security

• Fixed sensitive-path checks being suppressed for a whole command line when an unquoted heredoc body contained an apostrophe, such as Don't, which the parser read as an unclosed quote. A command that wrote such a body and then read a credential file is now blocked (#361)