{
 "schema_version": "0.4",
 "id": "REG-0033",
 "title": "destructive_command_guard: a crafted command makes the guard that blocks AI coding agents' destructive shell commands hang, and because agents fail open on a hung hook the destructive command is let through; fixed in 0.6.6 on 13 July 2026, CVE (Common Vulnerabilities and Exposures) record published 16 October 2026",
 "batch": "agent-2026-10-19",
 "family": "software",
 "context": {
  "domain": "Software agent (AI coding agent whose shell commands pass through a PreToolUse safety hook)",
  "autonomy_level": "alone",
  "autonomy_level_text": "The agent runs shell commands itself; the guard, not a person, decides whether a destructive command is blocked",
  "actor_type": "Software: destructive_command_guard (dcg) before 0.6.6, a PreToolUse hook in front of an AI coding agent",
  "actors": {
   "count": 1,
   "text": "1 AI coding agent with dcg as its PreToolUse guard",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "mandate_context_text": "Vulnerability disclosure; no exploitation reported",
  "jurisdiction": [
   "Global (open-source developer tool)"
  ]
 },
 "actor_status": "confirmed",
 "provenance_tier": "disclosure_corroborated",
 "provenance_tier_text": "CVE record assigned by GitHub (the CVE Numbering Authority) and recorded in NVD, naming the fixed version 0.6.6; corroborated by the maintainer's advisory (GHSA-4cfr-w3v5-w5j5), fix commit and changelog",
 "status": "confirmed",
 "status_text": "Confirmed (maintainer advisory; fixed in 0.6.6, 13 July 2026; no exploitation reported)",
 "outcome": {
  "state": "averted_by_disclosure",
  "severity": "none reported (CVSS, the Common Vulnerability Scoring System severity score, version 3.1: 7.1, High, assigned by GitHub as CVE numbering authority; the US National Vulnerability Database has not scored it)",
  "affected_parties": [],
  "cost": "none reported",
  "regime_consequence": "none",
  "as_of": "Oct 2026",
  "derived_by": "agent"
 },
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-77474"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Mandate",
   "facet": "objective",
   "value": "not evidenced in source",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-77474"
   ],
   "confidence": "low",
   "disputed": false
  },
  {
   "layer": "Actor",
   "facet": null,
   "value": "destructive_command_guard (dcg) before 0.6.6, a command-line safety tool that blocks destructive shell commands before AI coding agents run them, invoked as a PreToolUse hook",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-77474"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "A destructive command followed by nested or unclosed $( or $(( sequences",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-77474"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "dcg's scanners, reached through split_command_segments in src/packs/mod.rs, recursively rescan nested or unclosed substitutions after an inner scan returns unterminated, repeatedly rescanning the remaining command suffix and producing exponential-time work, so the hook hangs instead of returning a block decision",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-77474"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "constraints",
   "value": "dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not fire during this preprocessing; by its documented design dcg allows a command that runs past that budget",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-77474",
    "GHSA",
    "DCG-CHANGELOG",
    "DCG-README-065",
    "DCG-ISSUE-189"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "dcg returns no decision, and the advisory states that the agent then proceeds and runs the destructive command, because AI coding agents fail open when a PreToolUse hook times out or errors. The reporter's reproduction, credited by the maintainer, measured the hang; the sources read do not show an agent running a destructive command",
   "assertion_type": "fact",
   "source_ids": [
    "NVD-77474",
    "GHSA"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: averted by disclosure. No exploitation reported in the sources; the US Cybersecurity and Infrastructure Security Agency's enrichment of the CVE record (19 October 2026) records exploitation as 'none'. As of Oct 2026.",
   "assertion_type": "assertion",
   "source_ids": [
    "NVD-77474",
    "CVE-77474"
   ],
   "confidence": "medium",
   "disputed": false
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "Maintainer's GitHub security advisory GHSA-4cfr-w3v5-w5j5 published 14 July 2026, crediting reporter @spartan8806 'with a clear reproduction and complexity analysis'; CVE (Common Vulnerabilities and Exposures) record CVE-2026-77474 published 16 October 2026 with GitHub as CVE numbering authority; CVSS (Common Vulnerability Scoring System) version 3.1 score 7.1, High, assigned by GitHub (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H: local access, low complexity, no privileges, user interaction required, high impact on integrity and availability); weaknesses CWE-400 (uncontrolled resource consumption), CWE-407 (inefficient algorithmic complexity) and CWE-693 (protection mechanism failure) in the Common Weakness Enumeration; affected versions before 0.6.6",
   "assertion_type": "fact",
   "source_ids": [
    "GHSA",
    "NVD-77474",
    "CVE-77474"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "Fixed in version 0.6.6, released 13 July 2026 (fix commit ba16bdd of the same day): the command-substitution scanners stop at an unterminated nested construct instead of rescanning the rest of the command, so the work grows linearly, and the maintainer reports that a payload that previously hung now blocks in well under a millisecond. The advisory followed on 14 July 2026 and the CVE record on 16 October 2026. Later releases harden the same failure path: 0.15.0 (29 September 2026) makes other pathological input fail closed quickly instead of stalling the hook, and 0.15.2 and 0.15.3 (1 and 8 October 2026) make the plugins and bridges dcg writes for OpenCode, Oh My Pi and Cursor deny a command when dcg exits without a verdict",
   "assertion_type": "fact",
   "source_ids": [
    "DCG-FIX",
    "DCG-CHANGELOG",
    "GHSA",
    "NVD-77474",
    "CVE-77474"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "According to its own published records, the maintainer (Dicklesworthstone) published GitHub security advisory GHSA-4cfr-w3v5-w5j5 on 14 July 2026 crediting the reporter, @spartan8806, and its 0.6.6 release notes describe the flaw as 'a critical, attacker-triggerable guard-bypass'",
   "assertion_type": "assertion",
   "source_ids": [
    "GHSA",
    "DCG-CHANGELOG"
   ],
   "confidence": "high",
   "disputed": false
  }
 ],
 "inference": {
  "value": "The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own 200-millisecond budget did not fire during the slow step, and by dcg's documented fail-open design a command that runs past that budget is allowed anyway; the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang.",
  "source_ids": [
   "NVD-77474",
   "GHSA",
   "DCG-CHANGELOG",
   "DCG-README-065",
   "DCG-ISSUE-189"
  ],
  "confidence": "medium",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "controls": {
  "failed": [
   {
    "id": "C-E3",
    "note": "Mechanism: dcg is the gate meant to block destructive shell commands before the AI coding agent runs them; a destructive command with nested or unclosed $( or $(( sequences drove its scanner into exponential-time rescanning, so the hook hung without a decision, and the advisory states the agent then proceeds with the command. Why it interrupts: a destructive-action gate that returns a decision on every command would have blocked this destructive command as it blocks others; the maintainer reports that after the fix the same payload 'now blocks in well under a millisecond'. Source shows it failed: the reporter's reproduction measured the hang, and the advisory and CVE record state the hung guard lets the destructive command proceed; the sources read do not show an agent running a destructive command.",
    "confidence": "high",
    "basis": "agent"
   },
   {
    "id": "C-D2",
    "note": "Mechanism: dcg's own 200-millisecond budget did not fire during this preprocessing, so dcg returned no decision (by its documented design dcg allows a command that runs past that budget), and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown.",
    "confidence": "medium",
    "basis": "agent"
   }
  ],
  "succeeded": [],
  "absent": []
 },
 "applicable_rules": [
  "None applicable"
 ],
 "unmapped": [],
 "named_parties": [
  {
   "name": "destructive_command_guard",
   "right_of_reply": {
    "offered": "2026-10-22",
    "response": null
   }
  }
 ],
 "sources": {
  "NVD-77474": {
   "title": "NVD record CVE-2026-77474: destructive_command_guard (dcg) before 0.6.6, exponential-time rescanning of nested or unclosed substitutions; a hung PreToolUse hook fails open, CVSS 7.1",
   "type": "public_record",
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77474",
   "date": "2026-10-16",
   "tier": "public_regulatory",
   "interest": null,
   "primary": true,
   "checked": "2026-10-21"
  },
  "CVE-77474": {
   "title": "CVE record CVE-2026-77474 (assigner GitHub, advisory GHSA-4cfr-w3v5-w5j5) as mirrored by OpenCVE: dates, CVSS vector, CWE-400/407/693, affected range, references",
   "type": "public_record",
   "url": "https://app.opencve.io/cve/CVE-2026-77474",
   "date": "2026-10-16",
   "tier": "public_regulatory",
   "interest": null,
   "primary": false,
   "checked": "2026-10-21"
  },
  "GHSA": {
   "title": "Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard)",
   "type": "company",
   "url": "https://github.com/Dicklesworthstone/destructive_command_guard/security/advisories/GHSA-4cfr-w3v5-w5j5",
   "date": "2026-07-14",
   "tier": "company",
   "interest": "maintainer describing its own software",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "DCG-FIX": {
   "title": "Dicklesworthstone/destructive_command_guard on GitHub: commit ba16bdd, 'fix: triage batch — exponential-hang guard bypass, path-scoped allowlists, heredoc/pack false positives, pack display', 13 July 2026; first released in tag v0.6.6 (13 July 2026)",
   "type": "company",
   "url": "https://github.com/Dicklesworthstone/destructive_command_guard/commit/ba16bdd074b045329dc0ca6ec9a08c44403cfe1b",
   "date": "2026-07-13",
   "tier": "company",
   "interest": "maintainer describing its own software",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "DCG-CHANGELOG": {
   "title": "CHANGELOG.md, Dicklesworthstone/destructive_command_guard: maintainer's release notes, v0.6.6 entry (13 July 2026) and later entries to v0.15.3 (8 October 2026), as of commit 39f6857 (20 October 2026)",
   "type": "company",
   "url": "https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/CHANGELOG.md",
   "date": "2026-10-20",
   "tier": "company",
   "interest": "maintainer describing its own software",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "DCG-README-065": {
   "title": "README.md at tag v0.6.5 (the last affected release), Dicklesworthstone/destructive_command_guard: 'Any command exceeding this threshold is immediately allowed with a warning logged'",
   "type": "company",
   "url": "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/v0.6.5/README.md",
   "date": null,
   "tier": "company",
   "interest": "maintainer describing its own software",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  },
  "DCG-ISSUE-189": {
   "title": "Issue #189, Dicklesworthstone/destructive_command_guard: reporter's timings of the exponential hang and the maintainer's reply ('dcg's documented design is fail-open for workflow continuity')",
   "type": "company",
   "url": "https://github.com/Dicklesworthstone/destructive_command_guard/issues/189",
   "date": null,
   "tier": "company",
   "interest": "reporter's reproduction (spartan8806), with the maintainer's reply describing its own software",
   "primary": true,
   "checked": "2026-10-21",
   "via_press": false
  }
 },
 "corrections": [
  {
   "date": "2026-10-21",
   "field": "sources.GHSA",
   "old": null,
   "new": "{\"title\": \"Exponential-time command-substitution preprocessing lets a crafted command hang dcg and bypass the guard via hook-timeout fail-open (GitHub security advisory GHSA-4cfr-w3v5-w5j5, Dicklesworthstone/destructive_command_guard)\", \"type\": \"company\", \"url\": \"https://github.com/Dicklesworthstone/destructive_command_guard/security/advisories/GHSA-4cfr-w3v5-w5j5\", \"date\": \"2026-07-14\", \"tier\": \"company\", \"interest\": \"maintainer describing its own software\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's advisory, cited by the CVE record but not opened in the drafting run, was read; it was published 14 July 2026, credits reporter @spartan8806 'with a clear reproduction and complexity analysis', and says AI coding agents fail open on a hook timeout"
  },
  {
   "date": "2026-10-21",
   "field": "sources.DCG-FIX",
   "old": null,
   "new": "{\"title\": \"Dicklesworthstone/destructive_command_guard on GitHub: commit ba16bdd, 'fix: triage batch — exponential-hang guard bypass, path-scoped allowlists, heredoc/pack false positives, pack display', 13 July 2026; first released in tag v0.6.6 (13 July 2026)\", \"type\": \"company\", \"url\": \"https://github.com/Dicklesworthstone/destructive_command_guard/commit/ba16bdd074b045329dc0ca6ec9a08c44403cfe1b\", \"date\": \"2026-07-13\", \"tier\": \"company\", \"interest\": \"maintainer describing its own software\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the fix commit named in the CVE record's references; read in a clone of the repository, it is dated 13 July 2026 and is contained in tag v0.6.6 (13 July 2026) and not in v0.6.5"
  },
  {
   "date": "2026-10-21",
   "field": "sources.DCG-CHANGELOG",
   "old": null,
   "new": "{\"title\": \"CHANGELOG.md, Dicklesworthstone/destructive_command_guard: maintainer's release notes, v0.6.6 entry (13 July 2026) and later entries to v0.15.3 (8 October 2026), as of commit 39f6857 (20 October 2026)\", \"type\": \"company\", \"url\": \"https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/CHANGELOG.md\", \"date\": \"2026-10-20\", \"tier\": \"company\", \"interest\": \"maintainer describing its own software\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's release notes give the v0.6.6 release date (13 July 2026), the 200 ms hook budget, the fix and its effect, and later releases that harden the same fail-open path"
  },
  {
   "date": "2026-10-21",
   "field": "title",
   "old": "destructive_command_guard: a crafted command makes the guard that blocks AI coding agents' destructive shell commands hang, and the hung hook fails open so the command runs; CVE published 16 October 2026, fixed in 0.6.6",
   "new": "destructive_command_guard: a crafted command makes the guard that blocks AI coding agents' destructive shell commands hang, and because agents fail open on a hung hook the destructive command is let through; fixed in 0.6.6 on 13 July 2026, CVE (Common Vulnerabilities and Exposures) record published 16 October 2026",
   "reason": "Found in the editor's source check of 21 October 2026: the fix shipped in v0.6.6 on 13 July 2026 (commit ba16bdd, in tag v0.6.6; maintainer's release notes) and the maintainer's advisory GHSA-4cfr-w3v5-w5j5 was published 14 July 2026, three months before the CVE record of 16 October 2026; the advisory places the fail-open in the agents ('AI coding agents fail open when a PreToolUse hook times out or errors'), not in dcg; abbreviation spelled out"
  },
  {
   "date": "2026-10-21",
   "field": "outcome.severity",
   "old": "none reported (CVSS 3.1 7.1)",
   "new": "none reported (CVSS, the Common Vulnerability Scoring System severity score, version 3.1: 7.1, High, assigned by GitHub as CVE numbering authority; the US National Vulnerability Database has not scored it)",
   "reason": "Found in the editor's source check of 21 October 2026: the US National Vulnerability Database record lists the 7.1 under source security-advisories@github.com (type Secondary) and its status as 'Deferred', with no score of its own; abbreviation spelled out"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints",
   "old": "dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; a hung PreToolUse hook fails open",
   "new": "dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not cover this preprocessing",
   "reason": "Found in the editor's source check of 21 October 2026: the advisory GHSA-4cfr-w3v5-w5j5 says 'AI coding agents fail open when a PreToolUse hook times out or errors', and the maintainer's v0.6.6 release notes say the payload hung dcg 'far past its 200 ms hook budget; because agents fail open on a hung hook, the destructive command then executed'; the fail-open is the agents', not dcg's"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints.source_ids",
   "old": "[\"NVD-77474\"]",
   "new": "[\"NVD-77474\", \"GHSA\", \"DCG-CHANGELOG\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's advisory (GHSA) and release notes (DCG-CHANGELOG) now cited for who fails open and for dcg's own budget"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action",
   "old": "The destructive command proceeds",
   "new": "dcg returns no decision, and the advisory states that the agent then proceeds and runs the destructive command, because AI coding agents fail open when a PreToolUse hook times out or errors. The reporter's reproduction, credited by the maintainer, measured the hang; the sources read do not show an agent running a destructive command",
   "reason": "Found in the editor's source check of 21 October 2026: the CVE record and advisory describe the consequence ('allowing the destructive command to proceed'; a hung dcg 'causes the agent to proceed and execute the very destructive command'); the reporter's issue #189 measured dcg's response time (no answer after 8 seconds at 30 openers) and, as read, does not show an agent running the command; no exploitation is reported"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Action.source_ids",
   "old": "[\"NVD-77474\"]",
   "new": "[\"NVD-77474\", \"GHSA\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's advisory (GHSA) now cited for the agent's behaviour and the credited reproduction"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No exploitation reported in the sources. As of Oct 2026.",
   "new": "State: averted by disclosure. No exploitation reported in the sources; the US Cybersecurity and Infrastructure Security Agency's enrichment of the CVE record (19 October 2026) records exploitation as 'none'. As of Oct 2026.",
   "reason": "Found in the editor's source check of 21 October 2026: later development: the CVE record and the US National Vulnerability Database record carry an enrichment of 19 October 2026 by the Cybersecurity and Infrastructure Security Agency (as Authorized Data Publisher) using its Stakeholder-Specific Vulnerability Categorization: 'Exploitation: none', 'Automatable: no', 'Technical Impact: partial'"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event",
   "old": "CVE-2026-77474 published 16 October 2026 by the GitHub CNA (advisory GHSA-4cfr-w3v5-w5j5); CVSS 3.1 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H); CWE-400, CWE-407 and CWE-693 (protection mechanism failure); affected versions before 0.6.6",
   "new": "Maintainer's GitHub security advisory GHSA-4cfr-w3v5-w5j5 published 14 July 2026, crediting reporter @spartan8806 'with a clear reproduction and complexity analysis'; CVE (Common Vulnerabilities and Exposures) record CVE-2026-77474 published 16 October 2026 with GitHub as CVE numbering authority; CVSS (Common Vulnerability Scoring System) version 3.1 score 7.1, High, assigned by GitHub (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H: local access, low complexity, no privileges, user interaction required, high impact on integrity and availability); weaknesses CWE-400 (uncontrolled resource consumption), CWE-407 (inefficient algorithmic complexity) and CWE-693 (protection mechanism failure) in the Common Weakness Enumeration; affected versions before 0.6.6",
   "reason": "Found in the editor's source check of 21 October 2026: the advisory GHSA-4cfr-w3v5-w5j5 shows it was published 14 July 2026 and credits the reporter; the CVE record (assigner GitHub_M) confirms the other values; abbreviations spelled out"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Evidence event.source_ids",
   "old": "[\"NVD-77474\", \"CVE-77474\"]",
   "new": "[\"GHSA\", \"NVD-77474\", \"CVE-77474\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's advisory (GHSA) now cited for its own date and reporter credit"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical",
   "old": "Fixed in version 0.6.6",
   "new": "Fixed in version 0.6.6, released 13 July 2026 (fix commit ba16bdd of the same day): the command-substitution scanners stop at an unterminated nested construct instead of rescanning the rest of the command, so the work grows linearly, and the maintainer reports that a payload that previously hung now blocks in well under a millisecond. The advisory followed on 14 July 2026 and the CVE record on 16 October 2026. Later releases harden the same failure path: 0.15.0 (29 September 2026) makes other pathological input fail closed quickly instead of stalling the hook, and 0.15.2 and 0.15.3 (1 and 8 October 2026) make the plugins and bridges dcg writes for OpenCode, Oh My Pi and Cursor deny a command when dcg exits without a verdict",
   "reason": "Found in the editor's source check of 21 October 2026: commit ba16bdd (13 July 2026) is in tag v0.6.6 (13 July 2026) and not in v0.6.5; the maintainer's release notes describe the fix ('2^n -> linear', 'a payload that previously hung now blocks in well under a millisecond') and the later releases 0.15.0, 0.15.2 and 0.15.3; the advisory is dated 14 July 2026"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery technical.source_ids",
   "old": "[\"NVD-77474\", \"CVE-77474\"]",
   "new": "[\"DCG-FIX\", \"DCG-CHANGELOG\", \"GHSA\", \"NVD-77474\", \"CVE-77474\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the fix commit (DCG-FIX), release notes (DCG-CHANGELOG) and advisory (GHSA) now cited"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery accountability",
   "old": "not evidenced in source",
   "new": "According to its own published records, the maintainer (Dicklesworthstone) published GitHub security advisory GHSA-4cfr-w3v5-w5j5 on 14 July 2026 crediting the reporter, @spartan8806, and its 0.6.6 release notes describe the flaw as 'a critical, attacker-triggerable guard-bypass'",
   "reason": "Found in the editor's source check of 21 October 2026: the advisory (published by Dicklesworthstone, 14 July 2026, 'Reported by @spartan8806') and the maintainer's v0.6.6 release notes ('Closes a critical, attacker-triggerable guard-bypass') show the maintainer's acknowledgement"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery accountability.confidence",
   "old": "low",
   "new": "high",
   "reason": "Found in the editor's source check of 21 October 2026: stated directly in the maintainer's advisory and release notes"
  },
  {
   "date": "2026-10-21",
   "field": "fields.Recovery accountability.source_ids",
   "old": "[\"NVD-77474\"]",
   "new": "[\"GHSA\", \"DCG-CHANGELOG\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the maintainer's advisory and release notes now cited"
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-E3",
   "old": "Mechanism: dcg is the gate meant to block destructive shell commands before the AI coding agent runs them; a destructive command with nested or unclosed $( or $(( sequences drove its scanner into exponential-time rescanning, the hook hung, and the command proceeded. Why it interrupts: a destructive-action gate that returns a decision on every command would have blocked this destructive command as it blocks others. Source shows it failed: the record states the destructive command proceeds.",
   "new": "Mechanism: dcg is the gate meant to block destructive shell commands before the AI coding agent runs them; a destructive command with nested or unclosed $( or $(( sequences drove its scanner into exponential-time rescanning, so the hook hung without a decision, and the advisory states the agent then proceeds with the command. Why it interrupts: a destructive-action gate that returns a decision on every command would have blocked this destructive command as it blocks others; the maintainer reports that after the fix the same payload 'now blocks in well under a millisecond'. Source shows it failed: the reporter's reproduction measured the hang, and the advisory and CVE record state the hung guard lets the destructive command proceed; the sources read do not show an agent running a destructive command.",
   "reason": "Found in the editor's source check of 21 October 2026: the reproduction in issue #189 measured the hang, and the CVE record and advisory GHSA-4cfr-w3v5-w5j5 describe the command proceeding as the consequence rather than an observed run; the counterfactual is shown by the maintainer's v0.6.6 release notes ('a payload that previously hung now blocks in well under a millisecond') and fix commit ba16bdd ('the destructive segment still blocks')"
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-D2",
   "old": "Mechanism: when the guard could not reach a decision (the hook hung), the hung PreToolUse hook failed open and the command ran. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the record states a hung PreToolUse hook fails open. The source does not show a fail-closed configuration being tried, so the counterfactual is not shown.",
   "new": "Mechanism: dcg's own 200-millisecond budget did not cover this preprocessing, so dcg returned no decision, and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown.",
   "reason": "Found in the editor's source check of 21 October 2026: the advisory GHSA-4cfr-w3v5-w5j5 places the fail-open in the agents ('AI coding agents fail open when a PreToolUse hook times out or errors') and says 'There is no configuration-level workaround for affected versions', DCG_FAIL_CLOSED 'changes only unparseable-input handling'; the maintainer's release notes say dcg hung 'far past its 200 ms hook budget'"
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "A guard that fails open when it stalls can be beaten by a command that makes it slow rather than one that fools it; the gate's timeout path decided the outcome, not its rules.",
   "new": "The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers kept dcg from answering at all, and the AI coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang.",
   "reason": "Found in the editor's source check of 21 October 2026: the timeout path that let the command through is the agents' ('AI coding agents fail open when a PreToolUse hook times out or errors', advisory GHSA-4cfr-w3v5-w5j5), not the gate's: dcg's own 200 ms budget did not fire (maintainer's v0.6.6 release notes); no realised outcome is shown, and the interpretation now says what the record does not show. Not signed, so no sign-off was reset"
  },
  {
   "date": "2026-10-21",
   "field": "inference.source_ids",
   "old": "[\"NVD-77474\"]",
   "new": "[\"NVD-77474\", \"GHSA\", \"DCG-CHANGELOG\"]",
   "reason": "Found in the editor's source check of 21 October 2026: the advisory and release notes now cited for the mechanism"
  },
  {
   "date": "2026-10-21",
   "field": "sources.DCG-README-065",
   "old": null,
   "new": "{\"title\": \"README.md at tag v0.6.5 (the last affected release), Dicklesworthstone/destructive_command_guard: 'Any command exceeding this threshold is immediately allowed with a warning logged'\", \"type\": \"company\", \"url\": \"https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/v0.6.5/README.md\", \"date\": null, \"tier\": \"company\", \"interest\": \"maintainer describing its own software\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the maintainer's README for the affected release documents that dcg allows a command whose check runs past the 200-millisecond budget; added to support the corrected interpretation and Envelope field."
  },
  {
   "date": "2026-10-21",
   "field": "sources.DCG-ISSUE-189",
   "old": null,
   "new": "{\"title\": \"Issue #189, Dicklesworthstone/destructive_command_guard: reporter's timings of the exponential hang and the maintainer's reply ('dcg's documented design is fail-open for workflow continuity')\", \"type\": \"company\", \"url\": \"https://github.com/Dicklesworthstone/destructive_command_guard/issues/189\", \"date\": null, \"tier\": \"company\", \"interest\": \"maintainer describing its own software\", \"primary\": true, \"checked\": \"2026-10-21\", \"via_press\": false}",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the issue records the timings (finite but growing roughly twofold per opener) and the maintainer's statement that dcg's design is fail-open; read through the fetch tool (summary plus short exact quotes)."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers kept dcg from answering at all, and the AI coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang.",
   "new": "The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the delay is finite (issue #189: past an 8-second cut-off at 30 openers, about 30 minutes extrapolated at 40); 'hang' is the word every source uses; abbreviations spelled out."
  },
  {
   "date": "2026-10-21",
   "field": "inference.value",
   "old": "The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own time budget did not cover the slow step, and the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang.",
   "new": "The record shows a guard defeated by making it slow, not by fooling its rules: once the scan was made linear, the same payload is blocked, but before 0.6.6 a short run of unclosed $( openers made destructive_command_guard (dcg) hang, and the AI (artificial intelligence) coding agents it sits in front of treat a hook that times out as permission to proceed. dcg's own 200-millisecond budget did not fire during the slow step, and by dcg's documented fail-open design a command that runs past that budget is allowed anyway; the advisory names no setting that would have closed the gap. The record does not show the bypass used in an attack, or an agent actually running a destructive command; the reproduction measured the hang.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: the README for v0.6.5 says 'Any command exceeding this threshold is immediately allowed with a warning logged', and the maintainer calls the design fail-open (issue #189); the earlier wording implied the budget would have blocked the command."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints",
   "old": "dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not cover this preprocessing",
   "new": "dcg as the PreToolUse hook that is meant to block destructive shell commands before the agent runs them; the AI coding agents that call the hook fail open when it times out or errors, and dcg's own 200-millisecond hook budget did not fire during this preprocessing; by its documented design dcg allows a command that runs past that budget",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: README v0.6.5: 'Any command exceeding this threshold is immediately allowed'; issue #189 (maintainer): the design is fail-open."
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-D2",
   "old": "Mechanism: dcg's own 200-millisecond budget did not cover this preprocessing, so dcg returned no decision, and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown.",
   "new": "Mechanism: dcg's own 200-millisecond budget did not fire during this preprocessing, so dcg returned no decision (by its documented design dcg allows a command that runs past that budget), and the AI coding agents that call it as a PreToolUse hook fail open when a hook times out or errors. Why it interrupts: halting the command when the check does not complete, instead of proceeding, would have stopped it even with the scanner flaw present. Source shows it failed: the advisory states that agents fail open on a hook timeout. The advisory also states there was no configuration-level workaround for affected versions: dcg's DCG_FAIL_CLOSED=1 setting changes only unparseable-input handling and does not bound the slow loop. No source shows a fail-closed hook timeout in the agent being tried, so the counterfactual is not shown.",
   "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: README v0.6.5 and issue #189: dcg's budget is fail-open by design."
  },
  {
   "date": "2026-10-21",
   "field": "fields.Envelope constraints.source_ids",
   "old": "[\"NVD-77474\", \"GHSA\", \"DCG-CHANGELOG\"]",
   "new": "[\"NVD-77474\", \"GHSA\", \"DCG-CHANGELOG\", \"DCG-README-065\", \"DCG-ISSUE-189\"]",
   "reason": "Found in the editor's checks of the interpretations, 21 October 2026: third check: the corrected Envelope text rests on the README for v0.6.5 and issue #189, now cited."
  },
  {
   "date": "2026-10-21",
   "field": "sources.DCG-ISSUE-189.interest",
   "old": "maintainer describing its own software",
   "new": "reporter's reproduction (spartan8806), with the maintainer's reply describing its own software",
   "reason": "Found in the editor's checks of the interpretations, 21 October 2026: third check: the timings in the issue are the reporter's (spartan8806); the maintainer's reply describes its own software."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier",
   "old": "disclosure_uncorroborated",
   "new": "disclosure_corroborated",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the maintainer's own records (advisory, documentation or code) confirm the mechanism."
  },
  {
   "date": "2026-10-21",
   "field": "provenance_tier_text",
   "old": "CVE record assigned by GitHub (CNA) and recorded in NVD, naming the fixed version 0.6.6 and a maintainer advisory (GHSA-4cfr-w3v5-w5j5) that could not be opened in this run",
   "new": "CVE record assigned by GitHub (the CVE Numbering Authority) and recorded in NVD, naming the fixed version 0.6.6; corroborated by the maintainer's advisory (GHSA-4cfr-w3v5-w5j5), fix commit and changelog",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): tier text updated to name the corroborating records."
  },
  {
   "date": "2026-10-21",
   "field": "status",
   "old": "provisional",
   "new": "confirmed",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): the glossary defines 'provisional' as awaiting independent corroboration; with the maintainer's own records corroborating the mechanism, the case is confirmed."
  },
  {
   "date": "2026-10-21",
   "field": "status_text",
   "old": "Provisional (maintainer advisory not read in this run; no exploitation reported)",
   "new": "Confirmed (maintainer advisory; fixed in 0.6.6, 13 July 2026; no exploitation reported)",
   "reason": "Editor's call H2 of 21 October 2026 (accepted as amended, pull request #79): status wording follows the corroboration; every fact in it is already in the case."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[destructive_command_guard].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-22\", \"response\": null}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-19",
 "last_reviewed": "2026-10-22",
 "reviewed_by": null,
 "derived_by": "agent"
}