## Dicklesworthstone/destructive_command_guard — v0.14.4…v0.15.0

_486+ commits._

### Features
- **feat(core.filesystem): archive extraction wrote protected destinations that every other transfer guarded** (5ed0250)
- **feat(windows.system): fsutil could zero a file and dismount a volume with no rule anywhere** (dba5a85)
- **feat(system.permissions): the pack was POSIX-only, so every Windows spelling of the shapes it claims reached no rule** (3ef242a)
- **feat(agents): first-class Reasonix hook support (#358)** (f6f390c)
- **feat(allow-once): single-use by default, opt-in caller attribution (#378)** (a08cf44)
- **feat(packs): external packs can author their denial banner and trailer (#416)** (656850c)
- **feat(windows): load automatic project config with a reparse-safe open** (8e4c87c)
- **feat(core): rsync had no protected-destination guard (#478)** (c3267d4)
- **feat: wire finished-but-unconnected config and explain features** (a1339c8)

### Fixes
- **fix(heredoc): Windows wrappers and here-strings behind a redirect still hid the payload (review of 6c3a7e6, GH #498)** (036428e)
- **fix(heredoc): shell command strings behind redirects and options, and runner payloads behind &>, >|, {fd}> and mid-word process substitution, ran unjudged (review of 74fa8a6/cbf14e4, GH #498)** (6c3a7e6)
- **fix(hook): thousand-stage pipelines and runs of unclosed brackets held the hook past its deadline (review of 2bd9167/aac4abe, GH #498)** (cbf14e4)
- **fix(hook): command-string runners behind 2>&1, function names, redirects, quoting and process substitution ran unjudged (review of 2bd9167, GH #498)** (74fa8a6)
- **fix(core.filesystem): slash-spanning brace lists inside literal braces, and a quadratic scan (review of df1e779, GH #502)** (aac4abe)
- **fix(hook): command-string runners behind keywords, wrapper values and joined words still ran unjudged (review of 7273b28, GH #498)** (2bd9167)
- **fix(hook): commands handed over as a string, and git behind unmodeled wrappers, ran unjudged (review of 2f1a59f, GH #498)** (7273b28)
- **fix(core.filesystem): bracket, slash-spanning brace and pathological root spellings (review of 90f3ba6, GH #502)** (df1e779)
- **fix(core.filesystem): rm $'-rf' / was allowed; ANSI-C in an rm option was never decoded (review of 90f3ba6)** (e75ef19)
- **fix(core.filesystem): globbed, escaped and unknown-base roots still escaped credential-file-write (review of c8b77a1, GH #502)** (90f3ba6)
- **fix(evaluator): a confidence downgrade still hid a repeat only the evaluator sees; git behind watch/xargs/find -exec (review of 461c65b, GH #498)** (2f1a59f)
- **deps(deps): bump the rust-minor-patch group with 2 updates** (4b326f8)
- **fix(core.filesystem): quoted, escaped and re-rooted home paths still escaped credential-file-write (review of 67b3e2a, GH #502)** (c8b77a1)
- **fix(evaluator): a warn in an alias body or $d invocation still hid a later deny (review of 0dc4d22, GH #498)** (461c65b)
- **fix(evaluator): a warn/log/ask match hid a later deny; repair stale PowerShell profile check (GH #498, GH #503)** (0dc4d22)
- **fix(core.filesystem): credential-file-write knew four home roots (GH #502)** (67b3e2a)
- **fix(evaluator): $IFS word-splitting hid a destructive command** (c0a0755)
- **fix(hook): widen dialect for cmd-assembled executable words** (f5f6b49)
- **fix(hook): a single-file Windows delete carries no switch, so it never widened the dialect** (e1e96c1)
- **fix(dialect): two entry points disagreed about packs, and a dispatch keyed on a dialect the refinement never produces** (3f1a2da)
- **fix(hook): an unparseable JSON payload is scanned before it is allowed** (7316beb)
- **fix(system.permissions): one quote defeated chmod-777, because the non-recursive exemption only knew a leading slash** (9655986)
- **fix(hook): one lone surrogate escape made any command fail open** (d317935)
- **fix(windows): cmd packed switches and piped diskpart scripts** (267a98c)
- **fix(hook): bare Windows-only executables carried no shape signal, so four waiting rules stayed unreachable** (1b81d34)
- **fix(packs): windows.* activation asked the dialect, which a mislabeled Bash payload never satisfies** (2cf4169)
- **fix(install): the Cursor bridges turned dcg's `ask` into `allow`** (4036e33)
- **fix(hook): cmd writer verbs never widened the dialect, so an entire shell's worth of writers was unreachable** (e83572d)
- **fix(windows.system): shadow copies deleted through WMI/CIM and Remove-VirtualDisk were allowed** (7e85180)
- **fix(windows.filesystem): PowerShell `format C:` and parenthesized Remove-Item arguments were allowed** (9956334)
- **fix(core.filesystem): `truncate -s0` and `--size 0` zeroed keys and /etc/passwd unexamined** (7314a7b)
- **fix(evaluator): a POSIX alias body was data, so `alias x='rm -rf ~'; x` was allowed** (9db9058)
- **fix(hook): no envelope field can fail the parse by its type** (cdcaa96)
- **fix(system.disk): ddrescue --force onto a device was allowed** (e2894b4)
- **fix(hook): every native Copilot CLI payload failed open on its numeric timestamp** (08f4329)
- **fix(heredoc): the Ruby delete backstop let a harmless call launder a catastrophic one** (7e07cb7)
- **fix(heredoc): deleting the home directory spelled as an expression was allowed** (91bbfeb)
- **fix(core.git): git read-tree --reset -u was allowed while reset --hard was Critical** (35e21d6)
- **fix(system.permissions): the home shorthands escaped the recursive-root rules, and chgrp had no rule at all** (83b2a73)
- **fix(packs): terragrunt, sfdisk, podman compose, gem yank and nuget delete were allowed** (c7986c4)
- **fix(reasonix): unparseable payloads and REASONIX_HOME normalization (#358)** (f374466)
- **fix(reasonix): review fixes for the #358 integration** (46d0999)
- **fix(fuzz): link the patched grammar in the fuzz workspace too (#442)** (90c74e1)
- **fix(credential-files): cmd `mklink` could replace a protected file with a link** (2ac8968)
- **fix(snowflake): the legacy SnowSQL client reached no layer (bd-w53v)** (db38933)
- **fix(core.filesystem): a bare redirect to a Windows-spelled relative anchor selected no pack** (3e4e9df)
- **fix(packs): rabbitmqctl queue delete/purge, az keyvault purge and REST repo deletion were allowed** (677dbbe)
- **fix(packs): quoting the URL skipped every curl-keyed API pack** (0136823)
- **fix(credential-files): moving a protected file away was allowed in both Windows dialects** (9fcdbfb)
- **fix(core.filesystem): a cmd `del` of a protected file was allowed everywhere** (42afb98)
- **fix(core.filesystem): a PowerShell delete of a protected file was allowed everywhere** (171de9a)
- **fix(packs): kubectl resource aliases, MySQL DROP SCHEMA and podman system reset were allowed** (3f35f09)
- **fix(hook): expose execution confidence and disclose inert policy settings** (234449f)
- **fix(strict_git): remote ref deletion passed strict mode unless it named main/master** (e33d4b2)
- **fix(ast): one temp policy across exec sinks, and a runtime suffix is not temp (#485)** (4c683f6)
- **fix(core.git): trailing and abbreviated long options bypassed six rules** (097caa8)
- **fix(core.filesystem): protect the common token stores the credential table omitted** (6833b43)
- **fix(credential-files): five languages were missing whole transfer families (#484)** (d09c5db)
- **fix(ast): Go and PHP argv-split exec sinks reached no layer at all (#483)** (a56a020)
- **fix(hook): deny unverified commands when the payload declares bypassPermissions/dontAsk (bd-l9jf)** (e8a21cf)
- **fix(heredoc): an unquoted dynamic `sh -c $CMD` operand was still allowed** (8ba4478)
- **fix(hook): Claude Code's Windows PowerShell denials lost ruleId, allow-once and remediation** (0996745)
- **fix(heredoc): a wholly dynamic `sh -c` script, and dash/ksh/mksh payloads, were allowed** (97522b2)
- **fix(core.filesystem): a literal brace alternation names each protected file (#482)** (b16966a)
- **fix(install): re-running hook setup rewrote unchanged Cursor and Crush configs** (d74ecc9)
- **fix(core.filesystem): env -C / sudo -D and globs in a cd'd-into protected dir (#480)** (417325b)
- **fix(core.filesystem): a literal cd now decides what relative operands name (#480)** (0010a88)
- **fix(agent): Claude Code was never detected; Windows paid ~1 s per hook for it** (50b4d1f)
- **fix(core.filesystem): honor the real GNU rm -I prompt threshold** (57c2292)
- **fix(core.filesystem): allow find -exec rm {} inside literal temp roots, as -delete is** (11c547a)
- **fix(heredoc): deno eval payloads, Deno.removeSync, and Start-Process argument lists were never inspected** (b7de797)
- **fix(evaluator): a declaration keyword defeated variable resolution (#479)** (980a81f)
- **fix(windows): directory-scoped allowlist grants never matched; e2e_test.ps1** (0dd50e1)
- **fix(windows.system): `-WhatIf:$false` passed the preview carve-out** (5161054)
- **fix(database): unscoped UPDATE, DROP COLUMN and updateMany({}) in every SQL/Mongo pack** (8a250fb)
- **fix(windows): TOML keys and paths the native test run exposed** (2fc2583)
- **fix(powershell): inspect ForEach-Object blocks fed by recursive listings** (7b53ae2)
- **fix(kubectl): catch directory deletes and apply pruning** (cc0875c)
- **fix(postgresql): deny unscoped UPDATE and column removal** (b877b97)
- **fix(allowlist): say when a base embedded-code rule grant may never match (#470)** (2c9257b)
- **fix(disk): classify direct filesystem formatters as destructive** (2983c3f)
- **fix(filesystem): detect recursive PowerShell listings piped to deletion** (4ffa740)
- **fix(core.git): a '+' refspec force push was allowed** (75e9b1b)
- **fix(core): force-checkout/switch, forced git rm, update-ref -d, find -exec rm were allowed** (01ad4da)

### Backend
- **release: dcg v0.15.0** (2926271)
- **merge(main): preserve concurrent bd-v9hh issue records** (c6b804c)
- **revert(install): restore crates.io as a channel (undo the #411 publish = false)** (745f072)
- **Merge branch 'main' of https://github.com/Dicklesworthstone/destructive_command_guard** (43e26de)
- **Merge branch 'main' of https://github.com/Dicklesworthstone/destructive_command_guard** (f0cb94f)
- **Merge branch 'main' of https://github.com/Dicklesworthstone/destructive_command_guard** (ae78eb3)
- **Merge remote-tracking branch 'origin/main'** (15d42cd)

### Tests
- **test: two suites pinned behavior that later deliberate changes replaced** (a50a406)
- **test(scanner-safety): accept any nonzero UBSan exit, so the gate test passes on macOS** (8cf2cf6)
- **test: resolve the dcg under test at compile time so nextest runs are green** (c47f75b)
- **test(e2e_real_service): expect the confidence field 234449f now emits** (5ff4fa2)
- **test(core.filesystem): pin the brace-expansion bound and the shapes around it (#482)** (7e938b9)
- **test(windows): judge the corpus and goldens under one pack set on every host** (dec3219)
- **test: stop three #476 tests from doubling as deadline tests** (936bc73)
- **test(repro-290): pin the salvage budget so the deny path is deterministic** (979639d)
- **test(windows): repro_387 put \\?\ paths into POSIX cd commands** (1511a2b)
- **test(packs): drop the postgresql `update` exemption, the pack no longer declares it** (dc33deb)
- **test(packs): register the lowercase `update` twin as dead-but-covered** (28a4866)
- **test: settle 8a250fb against the registry and evaluator suites** (f1ecfd3)
- **test(pattern_audit): register the lookaheads of update-without-where, drop-column, apply-prune** (a76267a)
- **test(golden): record the direct-formatter keywords in explain artifacts and pack docs** (f93bd67)
- **test(pattern audit): register git rm-force backtracking requirement** (55d7c64)
- **test(corpus): turn seven stale known-gap markers into live cases** (4bd4240)
- **test(windows): three test suites asserted POSIX-host facts on Windows** (884aea9)

### Docs
- **docs(hook): Codex and Hermes now document exit 2 as a block** (9f203e9)
- **docs(allow-once): state that the default grant is consumed on first use** (9d9cc24)
- **docs(install): a verifiable manual install, and crates.io stated as unsupported (#411)** (4a3f6f0)
- **docs(packs): drop the redundant lowercase `update` keyword from database.md** (3f6b942)
- **docs(packs): describe new PostgreSQL and kubectl destruction guards** (d212d1d)

### Chore
- **ci(deps): integrate credential workflow action updates** (a61024b)
- **chore(deps): integrate smallvec and rand lockfile updates** (925cb7d)
- **ci(deps): bump the actions group with 2 updates** (6dc1abf)
- **chore(beads): record deferred shell-hook command bypass (bd-v9hh)** (74bf810)
- **chore(beads): file bd-v9hh (deferred-execution trap/PROMPT_COMMAND bypass)** (9a387b0)
- **chore(beads): record archive-extraction scope review in progress** (b34e6e5)
- **chore(beads): track command-position brace expansion bypass (bd-2bm3)** (26d3ce2)
- **chore(beads): file bd-hgm5 (agent self-approval via allow-once --yes is a default-posture decision)** (033099c)
- **chore(beads): latency-gate evidence on the release-readiness decision** (18e5def)
- **chore(beads): release-readiness evidence (Copilot/surrogate fail-opens fixed since v0.14.4)** (6595a33)
- **chore(beads): split the permission scope bead after one row proved to be a defect** (bd11bc9)
- **chore(beads): close bd-paes (fsutil rules landed in dba5a85)** (72b9042)
- **chore(beads): close the Windows permissions bead, file the fsutil/schtasks gap** (30c0aea)
- **chore(beads): retain Windows permission and rule-gap findings** (8140a70)
- **chore(beads): close the two beads converted to GitHub issues** (928da81)
- **chore(beads): close the Windows-native epic (shipped first-class since v0.10.0)** (ddff7bf)
- **build(crates.io): depend on published forks carrying the #442/#461 grammar fixes** (484e89b)
- **chore(beads): close bd-w53v (db38933)** (a3a1901)
- **chore(beads): file bd-w53v (legacy SnowSQL client reaches no snowflake layer)** (931a786)
- **chore(beads): close bd-tmu1 (v0.14.4 Sigstore bundles backfilled and verified)** (778f8f5)
- **chore(beads): retain launcher verification outcome and release-signature discussion** (fcb9256)
- **chore(beads): bd-l9jf note — unattended permission modes deny unverified (e8a21cf)** (6adb149)
- **chore(beads): close bd-vweh (8ba4478)** (d1d9706)
- **chore(beads): close bd-bl3b (native Windows suite green), file bd-vweh, l9jf/capstone evidence** (1847296)
- **chore(beads): close bd-kcdr (#482)** (efcf83c)
- **chore(beads): close bd-j6s4 (#480)** (c8b9415)
- **chore(beads): close bd-b2b1 (native Windows evidence); capstone progress** (4acef54)
- **chore(beads): record the current Windows and parser work graph** (408b2d0)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/Dicklesworthstone/destructive_command_guard?utm_source=github-action)._