The Bleep 4.0.2

Housekeeping. The tool itself is unchanged from 4.0.1 — upgrade only if the
PyPI page bothered you.

• The build badge is off the PyPI page. Its image is served live from the default
  branch, so every version's page read out whatever master happened to be doing
  that day: a red master put "build failing" on the page of a release that was
  green when it was made. It stays on the README, where it tells a contributor
  something true.
• The test matrix no longer runs twice for every release. A tag push is a push
  event and the concurrency group is keyed on the ref, so the same commit was
  tested once when it landed on master and again when it was tagged.
• Some tests of release.py's own printed output are gone. They asserted the
  shape of strings a developer script prints, at the cost of a CI cycle whenever
  anybody touched it.

If you are still on 4.0.0, upgrade. It has the command-injection bug fixed in
4.0.1 and has been removed from PyPI — see the
4.0.1 notes.

The Bleep 4.0.1 — security release

Security release

If you are on 4.0.0, upgrade. 4.0.0 has been removed from PyPI.

A branch name, a filename or a git alias could run a command. Seven rules read a
name out of the failed command's own output and spliced it into the suggestion
without shell-quoting it — and a suggestion is evaluated by your shell once you
accept it. Only whitespace, control characters and ~^:?*[\ are illegal in a
git ref name, so ;, $(), a backtick, &, | and # were all available to
whoever named the branch. You do not choose the branch when you are reviewing
somebody else's work or have just cloned a repository.

• git_push, git_pull, git_push_different_branch_names — the branch out of git's own hint
• git_merge — a branch name from the remote
• git_help_aliased — an alias out of the repository's .git/config
• fix_file — a filename off disk, which needs no git at all: unpacking an archive is enough
• yarn_alias, rails_migrations_pending — a whole command line repeated out of the tool's output

All of them quote what they read now, and all of them are in
tests/test_injection.py,
which runs every suggestion through a real shell against seven metacharacter
payloads and fails if anything executes.

This also settles a crash of long standing: a branch called
swteam/#486/general_contact_info produced a suggestion that broke zsh's eval
(nvbn/thefuck#782, and #600 and #762 before it). The upstream fix for that was
.replace("'", r"\'"), which only ever covered the apostrophe.

Reported by @robkorv in #2, with a working proof of concept for three of them;
the other four came out of the sweep that followed.

Full detail in CHANGELOG.md.

The Bleep 4.0.0 — the maintained successor to The Fuck

The first release of The Bleep, and the first maintained release of this codebase since The Fuck 3.32.

The idea is still the same:

Type the command wrong. Type bleep. Run the right one.

The Bleep carries The Fuck forward rather than replacing it with a different kind of tool: the familiar rule-based corrections, settings and workflow are still here, with four years of compatibility, safety, performance and usability work on top.

Get it

curl -fsSL https://raw.githubusercontent.com/stamparm/thebleep/master/install.sh | sh

Or:

uv tool install thebleep
# or
pipx install thebleep

The installer does not use sudo or modify your shell files. It prints the one line needed to enable bleep.

What's new

• Maintained on current Python and current tools. Python 3.9–3.14, modern Linux/macOS/Windows, Bash, Zsh, Fish, tcsh, PowerShell and Nushell.
• Safer by default. Corrections are confirmed before execution, replay of a previous command is explicit, and multiple command-generation and command-injection problems inherited from the old codebase are fixed.
• Edit before running. Press tab on a suggestion and, where the shell supports it, the corrected command is handed back to your command line for editing instead of being executed.
• Ask why. Press ? or use --explain to see which rule produced a suggestion, what matched, and what accepting it will do.
• thebleep --doctor. One safe-to-paste diagnostic for shell integration, configuration, PATH, rule packs, cache and other common installation issues.
• Nushell support. Including shell integration, history, quoting, command chaining and edit-in-buffer behaviour.
• Wrapped commands work properly. Commands behind sudo, doas, env, nice, nohup, setsid, stdbuf, command and builtin can be corrected without losing the wrapper.
• A lot less waiting. On the reproducible Linux benchmark used for this release, opening a shell dropped from 210 ms to 28 ms, a normal mistyped command from 246 ms to 56 ms, and correction after 1 MB of output from 3.25 s to 117 ms.

There are 173 bundled rules, including fixes and updates for years of drift in Git, pip, npm, Docker, Homebrew, pacman/AUR helpers and many others.

Coming from The Fuck

You do not have to relearn it.

Your settings and custom rules can be copied over, and if four years of muscle memory have made fuck permanent:

thebleep --alias-loader fuck >> ~/.bashrc

works too.

The Bleep is based on the original codebase by Vladimir Iakovlev and its contributors. Their work and Git history remain credited.

For the full list of fixes, compatibility work, upstream issues and pull requests addressed in 4.0.0, see the changelog:

https://github.com/stamparm/thebleep/blob/4.0.0/CHANGELOG.md