v0.5.5

v0.5.5

Security

• Closed a workspace sandbox escape: compound shell commands could previously sidestep the path guard with cd <outside> && <command>, letting the agent read or write files outside the workspace — confirmed live against OS files and the user's SSH directory. The fix adds two independent confinement layers: cd targets are bounds-checked statically before the shell starts, and the interpreter's actual working directory is verified at runtime before any command executes or file opens. Heredoc bodies and herestring operands are now masked as data during validation, so file content can neither fake its way past the guard nor get corrupted by path rewriting. Ships with regression tests pinning every red-team vector as refused and legitimate in-workspace operations as allowed.

Fixes

• Memory tool refusals now guide recovery: refusals for a missing entry id or an unknown op name previously offered no way forward, so agents would guess invalid ops and give up. The refusals now name op=add and list the valid op menu, and the tool description states the op=add default and the retire-without-id contradiction path up front.

Full diff: v0.5.4...v0.5.5