v0.4.4: security release — 24 issues found by reviewing v0.4.3 and then v0.4.4 itself

[deva0x]

Follows #1. Fixes 24 issues, every one reproduced by execution before being fixed and pinned by a regression test that was mutation-tested (revert the fix → confirm the test fails: 42/42 caught). Suite 129 → 227.

Two-thirds of these were found not in the original code but in the fix batches themselves — the first review round found 16 issues in v0.4.3, and re-attacking those fixes before publishing found 8 more, including a worse bug than any of them.

Root causes, not just symptoms

• Every prior audit round hardened the snapshot boundary; diff-time enrichment had no isolation and no input validation. Collectors are individually failure-isolated; _enrich was not, and main catches only KeyboardInterrupt.
• redact()'s "show" decisions exempted the entire rest of the line; its =/: branch redacted unconditionally.
• Undo hints were quoted for the shell but not for the invoked program's own option parser.
• A guard that suppresses noise silently becomes a suppression primitive for an attacker.

CRITICAL

The tool's own remediation advice executed attacker code. osascript re-parsed the login-item name as its options, so an item named -e property zz : (do shell script "…") ran at load: the "delete this login item" hint executed the malware author's command while the delete silently no-opped on an empty argv (verified with a benign marker file). Every hint whose value can begin with - now ends option parsing with --, verified per tool — systemctl/modprobe/apt-get in a throwaway ubuntu:24.04 container, rm/npm/pip3/osascript natively.

The redact() rework introduced an unprivileged kill switch (round 2). Its tail rescan recursed once per credential-ish key, so a 2.5 KB comment of repeated _pwd — under the 4 KB cap — raised RecursionError. Nothing catches it: the digest died before saving a snapshot, so the planted line stayed "added" and every later run died identically. One line appended to ~/.zshrc disabled the tool forever.

HIGH

• One malformed plist killed the daily digest permanently. A valid plist with a non-dict root made plutil emit ["x"]; .get on that raised, unisolated, saving no snapshot — so it recurred every day.
• The daily job was blind to software changes, and the flood hid real installs. launchd's PATH lacks /opt/homebrew/bin, so brew went 192 → 0 with no error recorded: 212 phantom findings, and a genuine new package was pushed past the 40-line render cap and never shown.
• A skipped category became its own baseline — an install during the blind window was never reported by any run while the report said "Nothing changed. 🎉".
• Losing sight of a category was silent. Neither the flood nor a note ever reached the notify threshold, so breaking brew — or planting ~/.local/bin/brew, which the pinned job PATH must include — bought silence. It is now an ORANGE LOST VISIBILITY finding that ranks and notifies.
• difflib was quadratic on a planted rc file (32 s from a 0.74 MB ~/.zshrc), and the malicious-pattern scan was quadratic too (55 s at 375 KB, hours at 8 MB, at snapshot time).
• redact() concealed path-valued env hijacks (SSH_AUTH_SOCK, *_ASKPASS, PGPASSFILE) and, after the first fix round, leaked ;-chained secrets and /-leading ones.
• Cleartext leaks in tracked files: sshpass -p 'secret', https://<token>@github.com/, MYSQL_PWD=, mysql -u root -pX.

MEDIUM / LOW

codesign blocked 10 s per planted FIFO .app · three state-dir reads hung on a FIFO · a malicious LaunchAgent was labelled "signature: Apple-signed" because ["/bin/sh","-c","curl …|sh"] resolves to /bin/sh · an overwritten existing plist was a quiet YELLOW hash change · every cask undo hint named a nonexistent formula · /Library/LaunchAgents got an rm that cannot succeed · wrong-typed snapshot fields crashed the diff (twice) · plutil handed 500 MB → 2.27 GB RSS · blobs capped (9.6 GB → 293 MB) · sudoers PASSWD:NOEXEC: and ALL, !/usr/bin/su were redacted away.

How it was verified

• 227 tests; 42/42 mutations caught. Three of my own new tests were theater and the matrix caught them — two asserted behaviour a different fix also provided, one tested a helper without pinning that callers use it.
• 43/43 adversarial redaction cases pass in both directions (leak and hide), diffed against v0.4.3 as control to separate regressions from pre-existing gaps.
• The kill-switch, blind-job, three-day-blind-window, FIFO and sparse-file scenarios all reproduced first, then re-run after the fix.
• Snapshot parity: 0 collector differences against the previous commit, so none of the read-path changes altered output.
• Every subcommand end-to-end on a real machine; py_compile; bash -n install.sh; py3.9 syntax checked.

Upgrade note

Snapshots predating this release carry no tool-identity stamp, so brew/npm/pip comparisons are skipped once, with a note, until a new baseline exists — the same fail-closed transition the privilege stamp used. Schema 3 → 5.

🤖 Generated with Claude Code