manuelschipper/nah v0.6.4

on GitHub

Fixed

• Conservative kubectl read classification with global flag support — kubectl -n <ns> logs ..., kubectl --namespace=<ns> get pods, and other known low-risk Kubernetes inspection commands now classify as container_read instead of falling through to unknown. The classifier strips recognized kubectl global flags before matching subcommands, while malformed flags, mutations, exec/copy/port-forward paths, detailed object dumps (-o yaml/json), secrets, configmaps, service accounts, and custom resources remain on the unknown ask path. Tracks #67, superseding the broad prefix-table approach from #51 and the global-flag stripping branch #68.
• Explicit-delimiter mise wrappers preserve payload classification — mise exec -- <cmd>, mise x -- <cmd>, and mise watch -- <cmd> now classify and resolve context from the command after --, so safe Git/GitHub CLI reads allow, script and inline-code inspection use the inner payload, and unknown tools launched through mise still ask. Redirected literal content is inspected through the wrapper while preserving the outer redirect target guard. (nah-878)
• GitHub CLI API reads no longer look like script execution — gh api ... now uses a full-profile flag classifier instead of the generic lang_exec table entry, so read-only API calls such as gh api repos/owner/repo/contributors --jq length classify as git_safe and no longer ask with script not found: .../api. POST-like methods, request bodies, implicit POST field flags, typed --field key=@file payloads, and --input stay on the existing network_write ask path, while gh extension exec remains lang_exec. (nah-32c)
• Direct script arguments no longer resolve as script paths — nah now treats tokens[0] as the inspected script for direct script invocations such as ./bin/release.sh 2.0.0 prerelease --label rc, instead of scanning positional arguments and asking on script not found: <project>/2.0.0. Missing direct scripts still fail closed, but the prompt now names the missing script rather than the first argument. Reported in #70; PR behavior integrated from #72 by @srgvg. (nah-877)
• Windows hook shim and update compatibility — the generated nah_guard.py shim now includes an explicit UTF-8 source cookie and treats old non-UTF-8 hook files as stale during update, rewriting them safely instead of crashing while checking for identical content. nah update now handles both current string-style Claude hook matchers and legacy object-style {"tool_name": [...]} matchers, preserves object-style entries when present, and creates a missing hooks.PreToolUse list before adding new tool matchers. Reported in #58 by @zacbrown.