Skip to content

v1.3.0

Choose a tag to compare

View all tags
@gmpassos gmpassos released this 29 Jun 08:46
· 2 commits to master since this release
v1.3.0
baa9bf1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Informational-form safety gate. When every argument of a known command is a purely informational token, the invocation is recognized as read-only and safe — even for execute-by-default tools. So dart --version, flutter --version, node --version, python --version, go version, java -version, etc. now classify as readFilesystem/safe instead of executePrograms.
    • New global defaultInformationalTokens (--version, --help, --usage) covers all commands.
    • New CommandKnowledge.informationalTokens field opts entries into tool-specific forms: java -version, python -V, node/php/ruby -v, perl -v/-V, deno/cargo -V, go version/env, dotnet --info/--list-sdks/--list-runtimes.
    • Matching is case-sensitive (-V ≠ -v) and requires the whole invocation to be informational, so a payload defeats the gate: dart --version script.dart and go env -w K=V still report executePrograms.
    • Runs at every recursion depth, so wrapped forms like sudo node --version are handled (and sudo still reports privilegeEscalation).

Changed

  • Bare --version/--help/--usage (and the per-command short forms above) on execute-by-default tools now classify as read-only/safe instead of executePrograms. npm --version moves from an empty capability set to readFilesystem (risk stays safe).

Full changelog: v1.2.0...v1.3.0

Assets 2
Loading