NurCLI v0.43.3

NurCLI v0.43.3 - security pass

A deeper review of the trust boundaries. Clippy is clean with and without default features; all unit tests, the E2E suite and the regression and startup suites pass.

nur gateway fails closed

Without --chat / TELEGRAM_CHAT_ID the Telegram gateway answered anyone who found the bot, and every turn runs with tools auto-approved, bash included. It now runs nothing until a chat is allowed: it replies to each sender with their own chat id, so pairing is nur gateway --chat <id>.

Permission rules see the whole shell command

bash rules matched the command string from its start, so allow = ["bash:git *"] also approved git status && curl … | sh, and deny = ["bash:rm -rf *"] missed cd . && rm -rf /. Commands are now split at ; & && | ||, newlines and subshells (quotes respected):

• deny and ask fire when any command in the chain matches, including text inside $(…) and backticks;
• allow applies only when every command is allowed, and never to a substitution or a redirect into a file (2>&1 and >/dev/null are fine).

The rule matcher is also linear now. A project's deny/ask rules apply before trust, and the old recursive glob let a pattern like *a*a*a*a*b stall every tool call.

Plan mode

VCS and install blocks no longer miss git commit, git -C . commit, git -c k=v commit, --git-dir=…, or a full path to git.

Secrets and atomic writes

• Credential stores (auth.json, provider keys and sessions) and penecho's config.env are created owner-only and replaced with a real atomic replace on Windows. The old path deleted the file first, so a crash in between read as signed out.
• Three hand-rolled atomic writers folded into one.

Streaming

• SSE data: framing strips exactly one space, per the spec, so plain-text streams keep their leading spaces.
• A large event arriving in small chunks is no longer rescanned from its start on every chunk.