Skip to content

v0.7.0

Choose a tag to compare

View all tags
@hampsterx hampsterx released this 31 Jul 04:19
v0.7.0
c5e3966

Upgrade recommended for all users. 0.6.1 and earlier let a crafted query prompt execute arbitrary commands.

What's new

Security

  • Caller-supplied values can no longer inject CLI flags - the prompt is passed after a -- separator, and the session id, model and effort bind with the = form. Previously a query whose prompt was a --settings= payload carrying a SessionStart hook ran an arbitrary command in the caller-supplied workingDirectory, with the CLI reporting an input error only after the hook had already fired.
  • Subprocesses are restricted to a read-only toolset - every spawn passes --tools, so the defaults withhold Bash, Write and Edit on every path. query and structured get Read Glob Grep, search gets WebSearch WebFetch. Previously query and structured passed no restriction at all, and --allowed-tools (used by search and image-query) only grants permission without restricting the toolset.
  • Tool names are validated as identifiers - a dash-prefixed entry would otherwise terminate the variadic --tools list and be parsed as a flag.

Added

  • CLAUDE_QUERY_TOOLS, CLAUDE_STRUCTURED_TOOLS and CLAUDE_SEARCH_TOOLS to override the built-in toolset per tool. Accepts a comma or space separated list, default for the CLI's full set, or an empty value for no tools.

Fixed

  • SECURITY.md claimed query in --bare mode had "no tool access by default". Verified false against CLI 2.1.220: --bare and --setting-sources "" bound what context the subprocess loads and never restricted its tools. The docs now describe the real mechanism and add an Argument Injection section.

Changed

  • spawnClaude rejects argv unless --tools appears before any -- separator and carries a value, enforcing the restriction at the subprocess boundary rather than trusting callers.
  • buildClaudeArgs takes a required tools array in place of the optional allowedTools.
  • @modelcontextprotocol/sdk 1.30.0, vitest 3.2.7 (clears GHSA-5xrq-8626-4rwp).

Upgrading

Subprocesses no longer get the CLI's full toolset. If you relied on query reaching for Bash, Write or Edit, set the matching CLAUDE_*_TOOLS env var to widen the default.

Full Changelog: v0.6.1...v0.7.0

Assets 2
Loading