Skip to content

v0.1.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 08:27
· 14 commits to main since this release
v0.1.3
e9b9cac
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A security-hardening release for the built-in permission gate: dangerous commands can no longer hide inside chained or wrapped shell commands, and file tools now ask before touching anything outside your project.

Highlights

  • Chained commands can't smuggle danger — bash approval used to only match the command string as a whole, so cd xx && ls && rm -rf xxx slipped through without a prompt. The gate now splits on &&, ||, ;, |, & and newlines, evaluates every segment, and applies the strictest verdict (deny > ask > allow). Splitting is quote-aware: echo "a && rm -rf x" stays a harmless string literal, and 2>&1 redirections aren't mistaken for separators
  • No hiding in substitutions or wrappers — $( ) and backtick command substitutions (including nested ones and those inside double quotes) plus sh -c / bash -lc / eval wrappers are unwrapped layer by layer and evaluated too. echo $(rm -rf x) and bash -c 'rm -rf x' now prompt just like the bare command
  • Project boundary for file tools — read/edit/write/ls with paths that resolve outside the session's project directory (including ../../ relative escapes) now escalate to an approval prompt instead of passing silently. Paths inside the project stay approval-free as before. Note: bash itself isn't path-constrained (a cd can go anywhere), so the boundary applies to file tools only
  • "Always allow" remembers less — the session whitelist key for bash now includes flag-shaped second tokens, so approving rm -rf xxx remembers rm -rf* instead of rm*. Granting always-allow no longer whitelists every possible rm invocation for the rest of the session
  • Approval dialogs for chained commands now title themselves with the actual dangerous segment, so you see at a glance which part of the chain triggered the prompt

Known limits of the pattern-based gate (unchanged): wrappers like xargs, find -exec, python -c, and symlink escapes can't be caught by string matching.

Download

Platform File
macOS (Apple Silicon) pi-desktop-mac-arm64.dmg
macOS (Intel) pi-desktop-mac-x64.dmg
Windows pi-desktop-windows-x64.exe (installer) or pi-desktop-windows-x64.zip

Builds are currently unsigned. On macOS, the first launch may show "Pi Desktop is damaged and can't be opened" — that's Gatekeeper blocking an unsigned download, not actual damage. Fix it by removing the quarantine flag: xattr -cr "/Applications/Pi Desktop.app", then open normally. On Windows, click "More info" → "Run anyway" when SmartScreen appears.

Full Changelog: v0.1.2...v0.1.3

Assets 16
Loading