gm-gc 2.0.57 → 2.0.59

package/agents/gm.md

@@ -90,12 +90,12 @@ All execution via Bash tool or `agent-browser` skill. Every hypothesis proven by
 
 **CODESEARCH EFFICIENCY TIP**: Multiple semantic queries cost <$0.01 total and take <1 second each. Use `code-search` skill liberally — it's designed for this. Try:"What does this function do?" → "Where is error handling implemented?" → "Show database connection setup" → each returns ranked file locations.
 
-**BASH WHITELIST** (only acceptable bash uses):
-- `git` commands (status, add, commit, push, pull, log, diff)
-- `npm publish`, `npm pack`, `npm install -g`
-- `docker` commands
-- Starting/stopping system services
-- Everything else → Bash tool
+**BASH WHITELIST** — Bash allows ONLY these prefixes (hook enforces this):
+- Code interpreters: `node`, `python`, `python3`, `bun`, `npx`, `ruby`, `go`, `deno`, `tsx`, `ts-node`
+- Package/version tools: `npm`, `npx`
+- VCS: `git`, `gh`
+- Containers/services: `docker`, `systemctl`, `sudo systemctl`
+- **Everything else is blocked.** Do NOT use shell builtins (ls, cat, grep, find, echo, cp, mv, rm, sed, awk). Instead: write logic as inline code and run it — `node -e "..."`, `python -c "..."`, `bun -e "..."`. Use Read/Write/Edit for file ops. Use code-search skill for exploration.
 
 **CODE EXECUTION PATTERNS** (use Bash tool):
 

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.57",
+  "version": "2.0.59",
   "description": "State machine agent with hooks, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "homepage": "https://github.com/AnEntrypoint/gm",

package/hooks/pre-tool-use-hook.js

@@ -57,9 +57,9 @@ const run = () => {
 
     if (tool_name === 'Bash') {
       const command = (tool_input?.command || '').trim();
-      const allowed = /^(git |gh |npm publish|npm pack|docker |sudo systemctl|systemctl )/.test(command);
+      const allowed = /^(git |gh |npm |npx |bun |node |python |python3 |ruby |go |deno |tsx |ts-node |docker |sudo systemctl|systemctl )/.test(command);
       if (!allowed) {
-        return { block: true, reason: 'Bash is blocked for non-git/npm/docker commands. Use Read/Write/Edit tools for file operations, or code-search skill for exploration.' };
+        return { block: true, reason: 'Bash only allows: git, node, python, bun, npx, ruby, go, deno, docker, npm, systemctl. Write all logic as code and execute it via Bash (e.g. node -e "...", python -c "...", bun -e "..."). Use Read/Write/Edit for file ops. Use code-search skill for exploration.' };
       }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-gc",
-  "version": "2.0.57",
+  "version": "2.0.59",
   "description": "State machine agent with hooks, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",