manuelschipper/nah v0.5.4 on GitHub

LLM credential scrubbing — secrets (private keys, AWS keys, GitHub tokens, sk- keys, hardcoded API keys) are now redacted from transcript context and Write/Edit/MultiEdit/NotebookEdit content before sending to LLM providers. Reuses content.py secret patterns (nah-pfd)
MultiEdit + NotebookEdit tool guard — both tools now get the same protection as Write/Edit: path checks, boundary enforcement, hook self-protection (hard block), content inspection, and LLM veto gate. Closes bypass where these tools had zero guards. nah update now adds missing tool matchers on upgrade (nah-06p)
Symlink regression tests — 8 test cases confirming realpath() resolution catches symlinks to sensitive targets across all tools: direct, chained, relative, broken, and allow_paths interaction (#57)
/tmp trusted by default — /tmp and /private/tmp are now default trusted paths for profile: full. Writes to /tmp no longer prompt. Standard scratch space with no security value (nah-f08)
Hook directory reads allowed — reading ~/.claude/hooks/ no longer prompts for any tool. Write/Edit still hard-blocked for self-protection. Reduces friction when inspecting installed hooks (#44, nah-arn)
/etc/shadow added to sensitive paths as block (#54)

LLM response parser hardened — removed find("{")/rfind("}") fallback in _parse_response that allowed echo attacks where injected JSON in transcript/file content could be extracted as the real decision. Now only accepts clean JSON or markdown-fenced JSON; prose-wrapped responses fail-safe to human review (nah-pfd)
nah update now adds missing tool matchers on upgrade (previously only patched the hook command path — new tools were invisible until nah install)
LLM metadata (provider, model, latency, reasoning) now always logged for Write/Edit/NotebookEdit, even when LLM agrees with the deterministic decision