cc-safety-net

A fix for standard mode, which blocked ssh commands that authenticate with an identity file passed through -i.

Fixed

• Fixed standard mode treating the identity file of ssh -i as a sensitive-file read, so a command such as ssh -i ~/.ssh/deploy_key host.example uptime is no longer blocked by a built-in rule. ssh uses the key only to authenticate and never prints it. Clustered forms like -vi and an -i placed after options that take a value are both recognized. (#334)
  • -F, -o values such as IdentityFile= or ProxyCommand=, the remote command, an -i after the destination, and configured denyPaths entries all stay checked, and strict and paranoid modes still block the identity file.

Restores user and project policy configuration on Windows, where reading and writing policy files failed on affected Node.js versions.

Fixed

• Fixed user and project policy files failing to read and write on Windows with Unable to access user policy filesystem safely.. rule init, rule tool add, rule tool list, and rule verify now work, and the hook no longer degrades to a fallback configuration. The path-versus-handle file identity check still requires a matching file ID, but no longer compares the volume serial on Windows, where path and handle stats disagree on Node.js 22.12–22.17, 23.x, and 24.0–24.3. (#332)

Shell tools that run their commands on another machine, such as a plugin tool backed by adb shell or ssh, can now be declared so their commands are analyzed instead of going unchecked.

Added

• Added --no-cwd-arg to cc-safety-net rule tool add, and the equivalent { "name": "phone_shell", "cwd": false } form in command_tools, for declaring a shell tool whose working directory is not on this machine. Commands from such a tool are analyzed like a built-in shell command, no working-directory argument is read, and a relative path is judged against the session directory. (#331, #330)
• Added an error when cc-safety-net rule tool add is given both --cwd-arg and --no-cwd-arg.

Changed

• Changed the OpenCode and Cursor adapters to ignore the workdir and working_directory arguments for a tool declared with cwd: false, so a remote working directory that does not exist locally no longer makes the call unusable.
• Changed the DeepSeek Harness notice about an undeclared shell tool to recommend rule tool add <name> --no-cwd-arg when the tool runs its commands on a remote host or the location cannot be determined, instead of advising against declaring it at all.
• Changed cc-safety-net rule tool list to report Cwd argument: none for a tool declared with cwd: false.
• Changed the published JSON Schema (assets/cc-safety-net.schema.json) to accept false for a command_tools entry's cwd, and the rule.json validation message for an invalid cwd now states that false is allowed.

This release teaches the PowerShell parser about here-strings (@'…'@ and @"…"@), which fixes both a false positive on quoted source text and several destructive commands that slipped through unchecked.

Fixed

• Fixed a false positive where the body of a PowerShell here-string was analyzed as code, so piping source text such as s = 'var x = originalArmy.Key;' through @'…'@ | python - was blocked as sensitive-path access. This applies when the command is analyzed as PowerShell — the powershell route or a powershell -Command wrapper; the auto route still denies the bare form. (#327)
• Fixed missed detections after a here-string whose body contains an apostrophe. Commands like @'…don't…'@; Remove-Item -Recurse -Force C:\ and @'…don't…'@; Get-Content id.key were allowed and are now blocked.
• Fixed detection of destructive commands handed to Invoke-Expression as a here-string.
• Improved here-string handling for carriage-return line endings and for expandable @"…"@ bodies, so a path such as $env:USERPROFILE\.ssh\config written in a here-string is resolved and blocked.
• Fixed a PowerShell double-quoted string ending in a backslash, such as Get-Content "C:\tmp\" ; Get-Content id.key, leaving the rest of the command unchecked by the secret guard.
• Allowed a here-string that only mentions a destructive command in its text, such as a Makefile body containing rm -rf piped to Set-Content.