Repository navigation
Merged
Conversation
…d to its folder A pane set to Files: This folder only could write the system Python's bytecode cache, Homebrew's downloads and bootsnap, ccache, sccache, esbuild, Bazelisk and Coursier caches under ~/Library/Caches; what it planted there ran later outside the pane. They join the folders that stay read-only, and the denylist's limit is marked. The plugin sandbox test now tells a refused exec from a program that ran and failed, and its probes start nothing if the profile regresses. Fixes GHSA-ggxm-v286-f48h fix: a folder above a place a pane isolated to its folder may not write cannot be moved away or linked in - Seatbelt checks a rename against the moved path, not its folder: every folder above a denied place now refuses rename, swap and removal, and a link put in its place - the folders above are derived from the denied lists and the regex doors, not listed again, both as written and resolved; a missing fixed one cannot be made either, while agents' data folders stay creatable - a denied place or a folder above one that is a link keeps the link itself - an agent folder that is a link (Stow's ~/.claude, a synced ~/.claude/projects) keeps memory and Qwen's workflow scripts read-only at its target too - hook install and the start of each Folder pane make an agent's missing data folder above a denied place (~/.gemini/tmp), so it cannot be moved in whole - the temp folder's podman folder and the ssh agent's socket join the write denies, so neither can be moved to dodge the socket deny - ceiling: a missing ~/.<agent>/projects or project folder in it can still be moved in whole with memory or Qwen's workflow scripts inside, which docs/isolation.md now says; link chains are followed one link deep - tests: moving or swapping a project folder, moving ~/Library/Caches or $TMPDIR/podman, replacing a linked cache or a linked ~/go, memory under a linked agent folder, a planted link and a folder moved in where one is missing are refused; new project folders, session files and caches still work Part of GHSA-ggxm-v286-f48h fix: a pane isolated to its folder finds its agents' session folders writable and leaves no file in them - the start of a Folder pane asked whether each agent's data folder is writable by making a file there and removing it; the profile now refuses removing a direct child of ~/.<agent>/projects, so the check warned on every start and left .nerd-write-check-<pid> behind - the folder is now asked, not tried: its permissions, then Seatbelt through sandbox_check, so nothing is written - test: a Folder pane prints no warning and leaves nothing in ~/.claude/projects Co-Authored-By: Claude <noreply@anthropic.com>
…atever the repository allows nerd runs git in the folders panes are in. A git without GIT_NO_LAZY_FETCH (before 2.45, unless it carries the CVE-2024-32465 backport) still lazy-fetched for a partial clone, through whichever transport the repository's own config chose, and a pane isolated to its folder can write that config. GIT_ALLOW_PROTOCOL now allows only a helper no repository alias can answer, with autocorrect off, so no transport, helper or alias runs from nerd's git. Fixes GHSA-jr8q-vrww-r6hm Co-Authored-By: Claude <noreply@anthropic.com>
…exhaust its memory The server reads every pane's folder for its branch and previews the files it is shown. A FIFO, device, link or huge file in place of .git/HEAD, a .git or gitdir pointing into an automounted folder, a CSV of empty columns, a long markdown line, or a PDF whose first MediaBox understates its page could stall the loop or fill memory. Branch reads are now small and non-blocking and do not follow into automounts; the loop runs git for a new folder only when its HEAD reads as a file; previews build only what can show, check the size sips drew, and convert in a folder of this instance's own that no isolated pane can write, reading back only plain files within a size bound. The frame also hides the invisible format characters messages already hide. Part of GHSA-jm7r-xvgg-4wq8 (F1, pane output, follows) fix: a link inside a pane's gitdir path into an automounted folder is not followed Part of GHSA-jm7r-xvgg-4wq8 Co-Authored-By: Claude <noreply@anthropic.com>
…rd of another version - publish-binary.sh builds and signs only the release commit on master: a commit that changes the version line of Cargo.toml and Cargo.lock, adds to the changelog and changes nothing else; a draft's target must be a commit id, and the built nerd must report the tag's version before the key is asked for. scripts/publish-binary.test.sh runs the real script with stand-ins, in gates. - install.sh refuses an archive whose nerd does not run or reports another version than the archive's name, from the menu and by hand, and downloads over https only. - The last release check and a skipped release are written 0600; an empty HOME counts as none. - The pr workflow's checkout keeps no credentials. - SECURITY.md, docs/releasing.md and deny.toml say what these checks do. Fixes GHSA-r62r-cp5f-4hq3 fix: the release script runs the release commit's own text after the build, and advisories are checked weekly - publish-binary.sh runs as one function called by its last line: a build that appends to the running script is never read. - The signing script, the formula script and install.sh are read from the release commit in git before the build; the signing and formula steps run that text, and install.sh is written to a folder made only after the build. - After the build PATH is the system's folders only; gh and the formula step get the user's PATH back, after the key. - publish-binary.test.sh gains a build that appends to every script and plants shasum, dirname, basename, awk, tar, codesign, rm and mktemp on PATH; none of them runs. The fixture commits an install.sh; the dead codesign stand-in is gone. - .github/workflows/advisories.yml runs cargo deny check advisories every Monday and by hand, read-only, never in pr; deny.toml says so. - SECURITY.md and docs/releasing.md say what this buys, what build code left running can still do, and what to do if a release run looks wrong. Part of GHSA-r62r-cp5f-4hq3 Co-Authored-By: Claude <noreply@anthropic.com>
nyxene
pushed a commit
that referenced
this pull request
Nov 7, 2026
Release pull request, maintained by release-please. Merging it creates the tag and a draft GitHub release; then run `scripts/publish-binary.sh vX.Y.Z` from a terminal to attach the macOS binary and publish the release. --- ## [0.19.1](v0.19.0...v0.19.1) (2026-11-07) ### Fixed * a preview picture goes while the notice card is drawn over it ([#169](#169)) ([6ca3a7f](6ca3a7f)) * caches whose contents run later stay read-only in a pane isolated to its folder ([#176](#176)) ([dda6fdb](dda6fdb)) * Check for a new release leaves a release already installed to Update ([#175](#175)) ([7552294](7552294)) * isolated panes cannot ask macOS to start programs, and Ctrl+click opens files only in an app chosen at the click ([#181](#181)) ([02d8db3](02d8db3)) * only the release commit is signed, and an installer refuses a nerd of another version ([#178](#178)) ([a74be79](a74be79)) * Servers says why a machine cannot be listed, and offers a terminal only when ssh wanted a prompt ([#171](#171)) ([5519b1e](5519b1e)) * the server's sockets, files, ssh and typed messages hold their limits when a pane pushes on them ([#180](#180)) ([6bcc4cf](6bcc4cf)) * what a pane prints is bounded in the server's memory and time ([#182](#182)) ([126df17](126df17)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security fixes, merged in order with the other ghsa/ steps.
Part of #177
🤖 Generated with Claude Code