manuelschipper/nah v0.4.2 on GitHub

trust_project_config option — when enabled in global config, per-project .nah.yaml can loosen policies (actions, sensitive_paths, classify tables). Without it, project config can only tighten (default: false)
Container destructive taxonomy expansion — podman parity (13 commands), docker subresource prune variants (container/image/volume/network/builder prune), compose (down/rm), buildx (prune/rm), podman-specific (pod prune/rm, machine rm, secret rm). Expands from 7 to 33 entries
find -exec payload classification — extracts the command after -exec/-execdir/-ok/-okdir and recursively classifies it instead of blanket filesystem_delete. find -exec grep → filesystem_read, find -exec rm → filesystem_delete. Falls back to filesystem_delete if payload is empty or unknown (fail-closed)
Stricter project classify overrides — Phase 3 of classify_tokens now evaluates project and builtin tables independently and picks the stricter result. Projects can tighten classifications but not weaken them (unless trust_project_config is enabled)
Beads-specific action types — beads_safe (allow), beads_write (allow), beads_destructive (ask) replace generic db_read/db_write classification for bd commands. Includes prefix-leak guards for flag-dependent mutations (nah-1op)
sensitive_paths: allow policy — removes hardcoded sensitive path entries entirely, giving users full control to desensitize paths like ~/.ssh (nah-9lw)

Global-install flag detection now handles =-joined forms (--target=/path, --global=true, --system=, --root=) and pip/pip3 short -t flag — previously only space-separated forms were caught, allowing pip install --target=/tmp flask to bypass the global-install escalation
Bash token scanner now respects allow_paths exemption — previously only file tools (Read/Write/Edit) checked allow_paths, so SSH commands with -i ~/.ssh/key still prompted even when the path was exempted for the current project (nah-jwk)