plugin-catalog: airlock 0.2.3 → 0.2.4 (Windows security fix)

plugin-catalog/airlock.yaml

@@ -1,9 +1,9 @@
 name: airlock
 title: airlock
 repo: https://github.com/otsoa-dubief/airlock
-sha: 9252291d28135f40c718e7dbe0abe33ed2515927
+sha: 37ba4551176e3247a636f2a2c4334043bcf1fe87
 subdir: airlock
-version: "0.2.3"
+version: "0.2.4"
 description: >-
   Guardrails that follow what a conversation has read. Once a session reads untrusted content (a web page, a
   browser snapshot, an MCP or third-party plugin's output, a customer's message), airlock seals it: messages to
@@ -18,13 +18,15 @@ description: >-
   session; lookalike Unicode in commands is refused. A file behind a wall cannot leave as a message
   attachment, and attached files are checked for secrets. A call that names a cloud metadata service is
   refused. Plugin and MCP tools nobody admitted need approval. Observe mode, stop switch,
-  `hermes airlock check|demo|log`. Tested on a corpus of 362 attacks and everyday commands, and end to end in
-  the official image.
+  `hermes airlock check|demo|log`. On Windows, paths are read in every form Windows and Git Bash give them, and
+  a path on another machine is refused without being opened. Tested on a corpus of 362 attacks and everyday
+  commands, on Linux, macOS and Windows, and end to end in the official image.
   Disclosure — hooks only (pre_tool_call, post_tool_call, pre_llm_call, subagent_start, on_session_reset,
   post_approval_response), no tools. No network, no LLM call, runs no command. Reads the profile's config.yaml
   (home channels, approvals mode) and its own policy file (<HERMES_HOME>/airlock.yaml); lists directories to
   expand wildcards in commands it checks; reads the first 200 KB of each file a send_message attaches, locally, to
-  look for secrets. Imports Hermes's attachment reader (gateway.platforms.base.BasePlatformAdapter.extract_media)
+  look for secrets. On Windows, reads the machine's own name (no lookup), tests which drive letters exist, and
+  imports tools.environments.local._find_bash to know Git Bash's root. Imports Hermes's attachment reader (gateway.platforms.base.BasePlatformAdapter.extract_media)
   to see exactly what a message would attach, with its own reader as a fallback.
   Writes under plugin-data/airlock: a journal of decisions, taints and
   approvals that includes tool arguments, truncated (journal.args: none leaves them out), the taint state and the
@@ -40,11 +42,11 @@ tier: community
 category: tools
 requires_hermes: ">=0.21.6"
 docs_url: https://github.com/otsoa-dubief/airlock#readme
-image: https://raw.githubusercontent.com/otsoa-dubief/airlock/9252291d28135f40c718e7dbe0abe33ed2515927/docs/images/social-preview.png
+image: https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/social-preview.png
 screenshots:
-  - https://raw.githubusercontent.com/otsoa-dubief/airlock/9252291d28135f40c718e7dbe0abe33ed2515927/docs/images/live-session.gif
-  - https://raw.githubusercontent.com/otsoa-dubief/airlock/9252291d28135f40c718e7dbe0abe33ed2515927/docs/images/how-it-works.png
-  - https://raw.githubusercontent.com/otsoa-dubief/airlock/9252291d28135f40c718e7dbe0abe33ed2515927/docs/images/check.png
+  - https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/live-session.gif
+  - https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/how-it-works.png
+  - https://raw.githubusercontent.com/otsoa-dubief/airlock/37ba4551176e3247a636f2a2c4334043bcf1fe87/docs/images/check.png
 platforms: []
 known_issues:
   - "Built for in-process plugins (Hermes's default): under plugins.isolation: host it cannot tell third-party plugin tools from Hermes's own."