monomind v2.27.0

monomind 2.27.0

Changed

• The confined-turn shell scanner is now a strict allow-list (#705; #702/#703: 3e19172, #704: 99853a0). A confined org turn may only run commands made of plain words, single-quoted text and simple double-quoted text. Anything else is refused, and some inputs that were handled differently before are now refused:
  • ls *.ts is refused (globs). Single-quote the argument: ls '*.ts'.
  • cat 'a'$HOME is refused (an expansion glued to quoted text).
  • A lone trailing backslash is refused.
  • A word starting with = is refused.
  • Also refused: $'..', $"..", expansions, braces, tildes, redirections and anything else the scanner does not recognise. (git diff HEAD^ is accepted, as before.)
    This closes the ANSI-C quoting hole ($'\'') that hid a trailing ; command from the old quote-toggle scanner.
• Drill signing is off by default (#699; ce15b59, 8945f04). A role-run QA drill can sign a throwaway org with its own key only when the operator sets org.allowDrillSigning to true in ~/.monomind/operator-settings.json.
• org resume help says it only clears the pause (#709; 6e17c3c).
• The SDK download notice names the opt-out and reads more clearly (#707; 6e17c3c, 27749d4).

Added

• Per-section spend in org status, org costs and org report JSON (#708; 48c8893).

Fixed

• The daemon lock refuses more network filesystems (#706; 28c416c). 9p, virtiofs and FUSE mounts are now refused.
• Docs-scope search matches words from the document body (#698; 7ed0618). @monoes/monograph 2.25.1.
• Registry tests no longer touch the real home when tmp sits under it (#696/#697; 67a0cf1).
• The memory-browser API test has a 120s beforeAll timeout (#700; f62857d).

Docs

• Docs and site updated for 2.27.0 (675d5e1, 4963efd).