Skip to content

v0.2.0a18

Pre-release
Pre-release

Choose a tag to compare

View all tags
@yfxiao16 yfxiao16 released this 13 Oct 20:54
· 21 commits to main since this release
v0.2.0a18
a0c7ec9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A second security release from the kta1kri report (thanks again). The reporter retested 0.2.0a17 through the real sponsio host guard claude-code --stdin path and found three findings not fully closed. If you run the Claude Code hook, upgrade. TypeScript @sponsio/sdk@0.2.0-alpha.8 carries the same fixes, and is the first 0.2 TypeScript build actually published to npm (alpha.5 through alpha.7 never were).

pip install --pre -U sponsio
npm install @sponsio/sdk@alpha

Host hooks

  • sponsio host install claude-code --strict now takes effect. Claude Code's hook payload carries no host field, so the hook routed every call to the legacy _host bucket while --strict had written defaults.unconfigured: deny into _host_claude_code. The posture was on disk and never read; an MCP tool with no library still ran. The hook now names the host it was installed for. If your install only ever had _host/sponsio.yaml, it keeps enforcing through the legacy fallback (with its one-time notice), and trace history starts a new file under the per-host bucket.
  • The hook-wiring protection covers real paths. The rule required .claude/settings.json right after >, so > ~/.claude/settings.json, > $HOME/... and an absolute path were allowed. truncate -s0, ln -sf /dev/null, chmod 000 and rm -rf ~/.claude are now refused too; each leaves the IDE loading no hooks. The rule file gets the same verbs (the hook already fails closed on an empty or unreadable library).
  • The secret-exfiltration rule is order-free in a fresh conversation. a17 fixed the trace-aware rules only; the per-event rule still required sender, then flag, then capture, so SECRETS=$(env); curl -d "$SECRETS", curl -F "data=$(env)" and wget --post-data="$(env)" were denied only after an earlier printenv. A captured dump ($(env)) now also arms the trace-aware window.

Names and numbers

  • MCP__finance__issue_refund and OpenClaw's finance__issue_refund now bind a rule on issue_refund, on both runtimes; a re-cased prefix routes to the server's library instead of the host bucket.
  • European grouping: 5.000,00 and 1.000.000 are read; €5.000 and 5.000 EUR are refused as unevaluable rather than read as 5. A bare 5.000 stays 5.0.

Full list in CHANGELOG.md.

Assets 2
Loading