lshed 0.17.0 → 0.17.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.17.1 — 2026-09-09
+
+- Security: a shed you `restore` could reach outside the agent's own root. A component `id` or a package `into` of `../../.bashrc` passed the manifest check, because the id pattern allowed a `..` path segment and `into` only forbade a leading slash, so `restore` would overwrite files anywhere under the home directory (a login file, an SSH `authorized_keys`, an autostart entry). The manifest now rejects `.` and `..` path segments in ids and in `into`, and the git installer refuses a package path that resolves outside the agent root. Everything a shed places stays under the root it targets.
+- Security: a `git:` package source was passed to `git ls-remote`/`git clone` as the first positional word, so a URL beginning with `-` became a git option — `git:--upload-pack=<command>#main` ran that command during `restore` or `update --dry-run`. lshed now rejects a `git:` URL that starts with `-`, and passes the URL after a `--` separator so git can never read it as an option.
+- Security: rewriting an entry file (`~/.claude.json`, a Codex `config.toml`) replaced it through a fresh temp file, which took the process umask and widened the mode — a `~/.claude.json` kept at `600` for its OAuth token came back at `664`, readable by the group. The write now preserves the existing file's mode, and creates a new one owner-only (`600`).
+- The README gains a **Trust** section: a shed is executable, not just data — `restore` places configs, fills `${VAR}` from your shell, and with `--yes` runs each package's `install:` — so restore only a shed you trust as much as your own dotfiles, and keep yours private.
+
 ## 0.17.0 — 2026-09-09
 
 - A Codex, Gemini, Copilot, Cursor or Antigravity user who followed the quick start without `--agent` got two quiet failures: `init` scanned a `~/.claude` that did not exist and wrote a shed with zero parts, and after `restore --agent codex` on another machine, `status`, `diff` and `save` without flags looked at `~/.claude` again and reported nothing applied. Now `init` refuses to scan a root that is not there and names the agent folders it did find (`Found here: codex (~/.codex). Try: lshed init --agent codex`), and when neither `--agent`, `LSHED_AGENT` nor a shed says which agent, lshed uses the one agent on the machine that has lshed state; Claude Code keeps precedence when it has state, and with several candidates the command asks you to say which. The README's quick start and loop are written for any agent, and the smoke suite walks them on a home folder that has only `~/.codex`.

package/README.ko.md

@@ -509,6 +509,10 @@ lshed report [--open | --url]                   이슈에 붙여 넣을 이 설
 
 직접 만든 부품의 진실은 창고입니다. `save`는 `file:` 부품의 로컬 편집을 창고로 되가져오고, 링크된 부품은 곧 창고입니다. 패키지의 주인은 upstream입니다. `update`가 당겨 오고, `save`는 건드리지 않습니다.
 
+### 신뢰
+
+창고는 그냥 데이터가 아니라 실행됩니다. `restore`는 에이전트 설정에 파일을 놓고, 자신이 쓰는 설정의 `${VAR}`를 당신 셸의 값으로 채우며, `--yes`면 각 패키지의 `install:` 셸 명령을 실행합니다. 그러니 자신의 dotfiles만큼 신뢰하는 창고만 `restore`하고, 당신 것은 비공개로(비공개 git 저장소) 두세요. 남의 창고를 `restore`하는 것은 그 사람에게 당신의 기계를 내주는 것에 가깝습니다 — 매니페스트에 `install:` 명령이 있을 수 있고, 그것이 쓰는 설정이 MCP 서버를 어떤 URL로 향하게 해 당신의 비밀 하나를 그리로 보낼 수 있습니다. lshed는 자신이 놓는 것을 에이전트 루트 안으로 가두고 git 옵션을 몰래 넣을 수 있는 패키지 출처를 거부하지만, 창고의 `install:`이 무엇을 돌리는지, 설정이 비밀을 어디로 보내는지까지 보증하지는 못합니다. 당신이 쓰지 않은 창고는 곧 돌리려는 남의 코드처럼 다루세요.
+
 ## 어디에 무엇이 있나
 
 ```

package/README.md

@@ -509,6 +509,10 @@ On a conflict it aborts the rebase, leaves the shed clean with your commit intac
 
 The shed is the source of truth for authored parts: `save` copies local edits back for `file:` components, and a linked part is the shed. Packages are owned by their upstream: `update` pulls them, `save` ignores them.
 
+### Trust
+
+A shed is executable, not just data. `restore` places files into your agent's config, fills `${VAR}` from your shell into the configs it writes, and with `--yes` runs each package's `install:` shell command. So restore only a shed you trust as much as your own dotfiles, and keep yours private (a private git repo). Restoring someone else's shed is close to handing them your machine: its manifest can carry an `install:` command, and a config it writes can point an MCP server at a URL that then receives one of your secrets. lshed confines what it places to the agent's own root and rejects a package source that could smuggle a git option, but it cannot vouch for what a shed's `install:` runs or where a config sends a secret. Treat a shed you did not write like any other code you are about to run.
+
 ## Where things live
 
 ```