Close three safety gaps, tidy two phrases, prepare 0.4.0 - #5
Merged
Merged
Conversation
- Safety: flag mv of home/system folders, command names hidden in a variable set on the same line (x=rm; $x -rf /), and inline interpreter code (python -c, perl -e, ruby -e, node -e, php -r) that deletes files or runs a risky shell command. - "what's my ip" answers offline with hostname -I; drop the "check disk speed" phrase that ran sudo hdparm. - Bump to 0.4.0 and date the changelog. - Add demo.tape for recording the README GIF with VHS. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Safety check: three gaps closed
Each of these used to run with no warning:
mv ~ /tmp/x,sudo mv /etc /tmp/oldx=rm; $x -rf /,cmd=reboot && sudo $cmdpython3 -c "shutil.rmtree('/')",perl -e 'unlink …',node -e "fs.rmSync(…)"python3 -c "os.system('rm -rf ~')"These are still not flagged:
mv notes.txt ~,$EDITOR notes.txt(the variable is unknown, so there's nothing to judge),python3 -c "print(1+1)", a list's.remove(), andpython3 -m http.server.Phrases
hostname -I, so it works offline. "what's my public ip" still usescurl ifconfig.me.sudo hdparmon a disk.Release prep
pyproject.tomlandclishe.sh, and the changelog entry is dated.demo.tape. Runvhs demo.tapeon Linux to recorddemo.giffor the README. It uses temporary config and data folders and needs no AI provider.Tests
23 new safety cases (dangerous and safe). All 429 pytest tests pass locally. Shell tests need bash 4+, so CI runs them.
🤖 Generated with Claude Code