Porcupine v0.1.55 (security hardening)
Porcupine v0.1.55 — security hardening release
A deep safety audit found real holes in the trust surface. They are closed, proven by regression tests.
Security
- Write-then-execute is closed: files the agent just wrote are tracked; executing one content-scans it with the danger detector. No more smuggling destructive commands through a script file.
- Auto hardline now complete: path-equivalents of root deletes (double slashes, dot segments, option-terminator form, quoted roots) plus
kill -- -1,init 0,telinit 0. - Serve API: any non-loopback bind requires a token; cross-origin requests rejected (403); permission ids are unguessable.
- Bash output strips ANSI/terminal escapes (no terminal injection through command output).
- Browser: private/internal hosts blocked by default (
PORCUPINE_BROWSER_ALLOW_INTERNAL=1opts out); screenshot paths constrained to the workspace.
Recursive deletes: intent from scope
rm -rf inside the session workspace is the agent's own domain (runs freely in Auto/Normal). Outside the workspace it stays flagged. Protected paths (root, system dirs, plus the new safety.protectedPaths setting) are hardline-blocked in every mode. Deleting the working directory itself is always blocked.
Sub-agent sessions (recallable)
Every sub-agent run persists its full transcript as a normal session file (tagged, same store/format, 4MB cap, retention 100). /resume excludes them; session_search and the new /subagents command recall them; budget-exhausted runs are recoverable.
npm: npm install -g @porcupineai/porcupineai