v2.0.7

This release blocks forced git rm working-tree removal, closes several audit-found analyzer bypasses, and removes common false denials such as ls -la ~/.ssh and eval "$(ssh-agent -s)" at the standard level. Note two breaking --json output changes in doctor and explain.

Highlights

• Added a git.rm-force rule that blocks forced git rm working-tree removal (e.g. git rm -rf .) at every safety level, motivated by a real-world incident that destroyed a project (anthropics/claude-code#70687).
• Closed analyzer fail-opens found in a security audit: rm -rf * at a home working directory is now blocked at all levels, and strict mode now catches variable-provenance command heads and substitution-derived rm flags.
• Reduced standard-level false denials: metadata-only ls/stat discovery and verifiable local generator sources like eval "$(ssh-agent -s)" and source <(kubectl completion bash) are now allowed.

Added

• Added the default-enabled git.rm-force rule: git rm with an effective --force/-f is blocked unless --cached or --dry-run/-n is present; non-forced git rm and git rm -r --cached . stay allowed. The standard preset now enables 45 rules.

Changed

• Allowed eval "$(CMD)" and source <(CMD) at the standard level when CMD is a single fully literal local command; remote fetchers (curl, wget, ...), shells, command wrappers, and env-assignment-prefixed bodies stay denied, and strict/paranoid still deny every dynamic shell source. Note that the generator's emitted shell itself runs unverified (see SECURITY.md).
• Allowed metadata-only discovery with ls and stat heads (e.g. ls -la ~/.ssh, stat .env) at the standard level; content access such as cat ~/.ssh/id_rsa stays blocked, and strict/paranoid still block both.
• Changed the Kimi Code plugin manifest to intercept all tools instead of only Bash, so the native plugin install protects Read/Write/Edit like the global-hook install already did.

Fixed

• Fixed rm -rf * with the working directory at home being allowed at standard: a bare * now classifies as a root-or-home target and is blocked at all levels, while a quoted literal rm -rf '*' (a single file named *) is classified by its actual target.
• Fixed strict-mode fail-opens where c=rm; "$c" -rf dir, $CMD --version, and rm $(printf -- '-rf') dir were allowed at every level; strict and paranoid now block them while standard verdicts are unchanged.
• Fixed statement-level env assignments with space-containing values (e.g. TMPDIR="/tmp/safe /Users"; rm -rf $TMPDIR/x) escaping shell-state tracking; strict and paranoid now block the word-splitting rm target.
• Fixed Kimi Code ignoring the per-call Bash tool_input.cwd: it is now contained against the session directory and used as the execution directory, failing closed on invalid or escaping values.
• Fixed Pi tool calls being analyzed under the raw context cwd instead of the validated, canonicalized one, and routed Pi's built-in find tool as a read-only glob so searches under protected directories are no longer falsely denied.
• Fixed OpenClaw Code Mode JavaScript exec events being parsed as shell commands and falsely denied, and expanded a leading tilde in OPENCLAW_STATE_DIR and OPENCLAW_CONFIG_PATH.
• Fixed OpenCode integration gaps: slash-rooted Windows workdirs pass through instead of failing closed, config and cache roots follow XDG_CONFIG_HOME/XDG_CACHE_HOME, install now verifies the plugin actually loads, and a non-string configured shell falls back to a sane platform default.
• Fixed doctor misreporting a never-installed Codex plugin as disabled, missing Copilot CLI hooks defined in ~/.copilot/settings.json and the repo's .claude/settings.json/settings.local.json, and probing codex plugin list with a shorter timeout than install, which could report Codex as not installed where install saw it.
• Fixed the Copilot CLI powershell runtime tool being analyzed with the wrong shell dialect, and the Hermes Agent plugin now resolves the working directory in the host's own order.
• Fixed a successful GUI install rendering an empty status box instead of the success report.
• Fixed explain crashing with a stack trace and empty stdout on analysis-limit inputs (e.g. a recursion bomb); it now prints a bounded JSON error under --json or a plain message on stderr and exits 1. Piped explain output is also no longer truncated at 64 KiB under the packaged Node binary.
• Fixed explain trace steps naming functions that do not exist and the env -S denial reason claiming an unreachable condition; the reason now names the real 16,384-token expansion-limit trigger.

Breaking Changes

• Changed doctor --json to report integration versions under a single versions map keyed by integration id instead of twelve flat fields such as claudeCodeVersion.
  • Migration: Read versions.<integration-id> instead of the per-integration *Version keys.
• Changed explain --json trace output: rule-check steps emit one rule string in place of ruleModule/ruleFunction, and env-strip.envVars is an array of variable names instead of an object.
  • Migration: Read rule for the rule identity and treat envVars as a string array.

Removed

• Removed the Pi Shell tool adapter; the tool no longer exists on the Pi host, and the built-in bash route is unchanged.