@blogic-cz/agent-tools 1.6.0 → 1.6.1

package/README.md

@@ -650,7 +650,7 @@ The guard permits static `printenv` reads and simple `echo`/`printf` expansions
 
 Python inline programs and quoted stdin heredocs can also display approved values through `os.getenv("NAME")`, `os.environ.get("NAME", "default")`, or `os.environ["NAME"]`. The complete program must be `import os` followed by `print(...)` statements using these reads and plain string labels or defaults. Dynamic names, aliases, escaped or interpolated strings, additional statements, and whole-environment output remain unsupported. The same redirection and pipeline restrictions apply.
 
-Literal assignments such as `F=README.md; cat "$F"` work in supported static commands. Bounded proofs also support a literal `for` loop over a fixed list, the adjacent `cd PATH && T=LITERAL && git add -- "$T/file"` form, and `rg -n PATTERN src/{a,b}` with a single literal path-brace component. Loop binders are a single lowercase letter or `T`, and their uses must occupy supported data operands. Every body command and expanded path is checked; unsupported control flow, mutations such as `printf -v`, and unknown command roles cannot establish the proof. Other variable assignments and brace expansions retain conservative refusal. Fully quoted literal braces remain usable in static searches.
+Literal assignments such as `F=README.md; cat "$F"` work in supported static commands. Bounded proofs also support a literal `for` loop over a fixed list, a single ASCII-letter path binding such as `cd PATH && A=docs/report.md && shasum -a 256 "$A"` or `F=README.md; cat "$F"`, including the existing `git add -- "$T/file"` form, and literal path braces such as `rg -n -i PATTERN src/{a,b} docs/{guide,api}.md`. Path braces work with supported passive text commands and `cat`, and support one unquoted comma list per path, at most 16 members per list and 32 generated paths per command, within 64 KiB. Nested braces, ranges, empty members, mixed quoting, command positions, and compound commands remain unsupported. Path bindings accept literal values and `;`, newline, or `&&` sequencing; a binding conditional on successful `cd` is proved only for uses in that same `&&` list. Their uses must be supported read-only file operands or explicit `git add --` paths. Rebinding, executable operands, startup-variable names, and uncertain scopes cannot establish this proof. Loop binders are a single lowercase letter or `T`, and their uses must occupy supported data operands. Every body command and expanded path is checked; unsupported control flow, mutations such as `printf -v`, and unknown command roles cannot establish the proof. Other variable assignments and brace expansions retain conservative refusal. Fully quoted literal braces remain usable in static searches.
 
 Ordinary navigation operands such as `cd "$HOME"` and `git -C "$WORKTREE_ROOT" status --short` do not need display permission. This does not authorize printing those values, using them as code/options, or reading unknown file paths. In `printf`, approved values belong in data arguments after a fixed nonmutating format, for example `printf -- '%s' "$WORKSPACE_LABEL"`.
 

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAimEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAv8ED,SAAS,UAAU,UAAU,KAAK,IAu8EM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAz8EC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAy8EjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA38EE,MAAM,KAAK,OA28EgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA78EE,MAAM,KAAK,OA68EgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA/8EC,MAAM,KAAK,OA+8E0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAj9EC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAi9Ef,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAn9EC,MAAM,KAAK,OAm9EsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAr9EC,MAAM,KAAK,MAAM,GAAG,IAq9Ea,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA6qEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAnhFD,SAAS,UAAU,UAAU,KAAK,IAmhFM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YArhFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAqhFjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAvhFE,MAAM,KAAK,OAuhFgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAzhFE,MAAM,KAAK,OAyhFgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA3hFC,MAAM,KAAK,OA2hF0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA7hFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA6hFf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA/hFC,MAAM,KAAK,OA+hFsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAjiFC,MAAM,KAAK,MAAM,GAAG,IAiiFa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -190,11 +190,11 @@ function getLeadingLiteralAssignments(
   const assignments = new Map<string, { value: string; end: number }>();
   let offset = 0;
   while (offset === 0 || command[offset - 1] === ";" || command[offset - 1] === "\n") {
-    while (/\s/.test(command[offset] ?? "")) offset++;
+    while (/[ \t\n]/.test(command[offset] ?? "")) offset++;
     const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./-]+)/.exec(command.slice(offset));
     if (!assignment) break;
     const end = offset + assignment[0].length;
-    const next = command.slice(end).match(/^\s*/)?.[0].length ?? 0;
+    const next = command.slice(end).match(/^[ \t]*/)?.[0].length ?? 0;
     const separator = command[end + next];
     if (separator !== ";" && separator !== "\n") break;
     assignments.set(assignment[1] ?? "", { value: assignment[2] ?? "", end });
@@ -239,39 +239,45 @@ function hasSafeLocalAssignmentCommands(
         assignments.get(assignment[1] ?? "")?.value === assignment[2]
       );
     }
-    const argv = unwrapStaticCommand(words);
-    if (isSafeHerdrTabCreate(argv)) return true;
-    const name = argv[0]?.split("/").at(-1) ?? "";
-    if (name === "cd") return isNavigationOperand(argv, "LOCALVALUE");
-    if (name === "git") {
-      let index = 1;
-      while (argv[index] === "-C" && argv[index + 1]) index += 2;
-      return (
-        ["branch", "diff", "log", "rev-parse", "rev-list", "show", "status"].includes(
-          argv[index] ?? "",
-        ) && !hasExecutionOption(argv.slice(index + 1), ["exec", "ext-diff", "textconv"])
-      );
-    }
-    if (name === "find") {
-      return !argv.slice(1).some((arg) => /^-(?:exec|ok|delete|fprint|fprintf)/.test(arg));
-    }
-    if (name === "bun") return argv[1] === "run" && ["db-tool", "gh-tool"].includes(argv[2] ?? "");
+    return isSafeLocalAssignmentCommand(words);
+  });
+}
+
+function isSafeLocalAssignmentCommand(words: string[]): boolean {
+  const argv = unwrapStaticCommand(words);
+  if (isSafeHerdrTabCreate(argv)) return true;
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (name === "wc" && hasExecutionOption(argv.slice(1), ["files0-from"])) return false;
+  if (name === "cd") return isNavigationOperand(argv, "LOCALVALUE");
+  if (name === "git") {
+    let index = 1;
+    while (argv[index] === "-C" && argv[index + 1]) index += 2;
     return (
-      isPassiveTextCommand(argv) ||
-      ["ls", "cat", "tail", "wc", "uniq", "cut", "mv"].includes(name) ||
-      (name === "sort" && !hasExecutionOption(argv.slice(1), ["compress-program"])) ||
-      (name === "sed" &&
-        argv
-          .slice(1)
-          .every(
-            (arg) =>
-              /^-[En]+$/.test(arg) ||
-              /^s([/|]).*\1[^/|]*\1[gp]*$/.test(arg) ||
-              /^[A-Za-z0-9_./-]+$/.test(arg),
-          ) &&
-        !argv.includes("-f"))
+      ["branch", "diff", "log", "rev-parse", "rev-list", "show", "status"].includes(
+        argv[index] ?? "",
+      ) && !hasExecutionOption(argv.slice(index + 1), ["exec", "ext-diff", "textconv"])
     );
-  });
+  }
+  if (name === "find") {
+    return !argv.slice(1).some((arg) => /^-(?:exec|ok|delete|fprint|fprintf)/.test(arg));
+  }
+  if (name === "bun") return argv[1] === "run" && ["db-tool", "gh-tool"].includes(argv[2] ?? "");
+  return (
+    isPassiveTextCommand(argv) ||
+    ["ls", "cat", "tail", "wc", "uniq", "cut", "mv"].includes(name) ||
+    (name === "sort" &&
+      !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from", "output"], "o")) ||
+    (name === "sed" &&
+      argv
+        .slice(1)
+        .every(
+          (arg) =>
+            /^-[En]+$/.test(arg) ||
+            /^s([/|]).*\1[^/|]*\1[gp]*$/.test(arg) ||
+            /^[A-Za-z0-9_./-]+$/.test(arg),
+        ) &&
+      !argv.includes("-f"))
+  );
 }
 
 function hasSensitivePathRedirect(
@@ -429,6 +435,7 @@ function literalBindingText(
   let quote: "'" | '"' | undefined;
   for (let i = 0; i < command.length; i++) {
     const char = command[i] ?? "";
+    if (!quote && /[^\S \t\n]/.test(char)) return undefined;
     if (char === "\\" && quote !== "'") {
       const next = command[++i];
       if (next === undefined || /[\r\n]/.test(next)) return undefined;
@@ -524,7 +531,7 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
   if (new TextEncoder().encode(command).byteLength > 65_536) return undefined;
   const marker = "GUARDLITERALBINDING";
   if (command.includes(marker)) return undefined;
-  let script = command.trim();
+  let script = command.replace(/^[ \t\n]+|[ \t\n]+$/g, "");
   const wrapped = parseStaticShellCommands(script);
   if (
     wrapped &&
@@ -534,7 +541,10 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
     wrapped.redirects.length === 0
   ) {
     const argv = unwrapProofCommand(wrapped.pipelines[0]?.[0] ?? [], marker);
-    if (argv?.[0] === "sh" && argv[1] === "-c" && argv.length === 3) script = argv[2] ?? "";
+    if (argv?.[0] === "sh" && argv[1] === "-c" && argv.length === 3) {
+      if (!literalBindingText(script, "", "")) return undefined;
+      script = argv[2] ?? "";
+    }
   }
   const loop =
     /^for[ \t]+([A-Za-z_]\w*)[ \t]+in[ \t]+([^;\n]+);[ \t\r\n]*do[ \t\r\n]+([\s\S]*);[ \t\r\n]*done[ \t\r\n]*$/.exec(
@@ -587,64 +597,135 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
       paths: [],
     };
   }
+  // Single ASCII-letter names avoid shell startup/special variables such as PATH and IFS.
   const assignment =
-    /^cd[ \t]+(~?\/?[A-Za-z0-9_./-]+)[ \t]+&&[ \t]+([A-Za-z_]\w*)=([A-Za-z0-9_./][A-Za-z0-9_./-]*)[ \t]+&&[ \t]+/.exec(
-      command,
+    /^(?:cd[ \t]+(~?\/?[A-Za-z0-9_./-]+)[ \t]*(;|\n|&&)[ \t]*)?([A-Za-z])=([A-Za-z0-9_./][A-Za-z0-9_./-]*)[ \t]*(;|\n|&&)[ \t]*/.exec(
+      script,
     );
-  if (assignment && isLiteralBinder(assignment[2] ?? "")) {
+  if (assignment) {
     const rest = literalBindingText(
-      command.slice(assignment[0].length),
-      assignment[2] ?? "",
+      script.slice(assignment[0].length),
+      assignment[3] ?? "",
       marker,
     );
-    if (!rest) return undefined;
-    const end = rest.syntax.search(/[;&|\r\n]/);
-    const use = rest.text.slice(0, end < 0 ? undefined : end);
-    const suffix = end < 0 ? "" : rest.text.slice(end);
-    if (suffix.includes(marker)) return undefined;
-    const parsed = parseStaticShellCommands(use);
-    const argv =
-      parsed &&
-      typeof parsed !== "string" &&
-      parsed.pipelines.length === 1 &&
-      parsed.pipelines[0]?.length === 1 &&
-      parsed.redirects.length === 0
-        ? parsed.pipelines[0]?.[0]
-        : undefined;
+    if (!rest || !rest.text.includes(marker)) return undefined;
+    // No branches, background jobs or pipeline-local state. FD duplication stays inert.
+    const syntax = rest.syntax.replace(/[<>]&[0-9-]+/g, "");
+    if (/\|\||(^|[^&])&(?!&)|[^\S \t\n]/.test(syntax)) return undefined;
+    if (assignment[2] === "&&") {
+      if (assignment[5] !== "&&") return undefined;
+      const boundary = rest.syntax.search(/[;\r\n]/);
+      if (boundary >= 0 && rest.text.slice(boundary).includes(marker)) return undefined;
+    }
+    const parsed = parseStaticShellCommands(rest.text);
     if (
-      !argv ||
-      argv.length < 4 ||
-      argv.slice(0, 3).join(" ") !== "git add --" ||
-      argv.slice(3).some((word) => !/^[A-Za-z0-9_./-]+$/.test(word))
+      !parsed ||
+      typeof parsed === "string" ||
+      parsed.redirects.some(({ target }) => target.includes(marker)) ||
+      !parsed.pipelines.flat().length ||
+      parsed.pipelines.flat().length > 32
     )
       return undefined;
-    const value = assignment[3] ?? "";
+    const value = assignment[4] ?? "";
+    const paths: string[] = [];
+    for (const words of parsed.pipelines.flat()) {
+      const marked = unwrapProofCommand(words, marker);
+      if (!marked) return undefined;
+      const argv = marked.map((word) => word.replaceAll(marker, () => value));
+      const name = argv[0]?.split("/").at(-1) ?? "";
+      const uses = marked.flatMap((word, index) => (word.includes(marker) ? [index] : []));
+      const checksum =
+        ["shasum", "sha1sum", "sha256sum", "sha512sum", "md5sum", "cksum"].includes(name) &&
+        !hasExecutionOption(argv.slice(1), ["check"], "c");
+      if (!uses.length) {
+        if (
+          !isSafeLocalAssignmentCommand(argv) &&
+          inlineProgramIndex(argv) === undefined &&
+          !(argv[0] === "git" && argv[1] === "commit") &&
+          !checksum
+        )
+          return undefined;
+        continue;
+      }
+      if (
+        uses.some(
+          (index) => index === 0 || !/^[A-Za-z0-9_./][A-Za-z0-9_./-]*$/.test(argv[index] ?? ""),
+        )
+      )
+        return undefined;
+      const gitAdd =
+        argv.slice(0, 3).join(" ") === "git add --" && uses.every((index) => index >= 3);
+      const reader =
+        ["cat", "ls", "head", "tail", "wc", "uniq", "cut", "sort", "grep", "rg"].includes(name) &&
+        isSafeLocalAssignmentCommand(argv);
+      if (!gitAdd && !reader && !checksum) return undefined;
+      paths.push(...uses.map((index) => argv[index] ?? ""));
+    }
+    const prefix = assignment[1] ? `cd ${assignment[1]}${assignment[2]} ` : "";
     const size =
-      new TextEncoder().encode(rest.text).byteLength +
-      (use.split(marker).length - 1) * (value.length - marker.length) +
-      (assignment[1]?.length ?? 0) +
-      7;
-    if (size > 65_536) return undefined;
-    const paths = argv.slice(3).map((word) => word.replaceAll(marker, () => value));
-    return {
-      command: `cd ${assignment[1]} && ${use.replaceAll(marker, () => value)}${suffix}`,
-      paths,
-    };
+      new TextEncoder().encode(prefix + rest.text).byteLength +
+      (rest.text.split(marker).length - 1) * (value.length - marker.length);
+    if (paths.length > 32 || size > 65_536) return undefined;
+    return { command: prefix + rest.text.replaceAll(marker, () => value), paths };
   }
-  // Only the observed rg -n PATTERN PATH form; marker position proves a real file operand.
-  const brace =
-    /(?:^|\s)([A-Za-z0-9_./-]*\/[A-Za-z0-9_./-]*\{[A-Za-z_]\w*(?:,[A-Za-z_]\w*){1,7}\}[A-Za-z0-9_./-]*)$/.exec(
-      command,
-    );
-  if (!brace) return undefined;
-  const path = brace[1] ?? "";
-  const start = command.length - path.length;
-  const marked = command.slice(0, start) + marker;
-  const lexical = literalBindingText(marked, "", "");
+  // Expand only complete, unquoted path words. Keep all other source text intact.
+  const paths: string[] = [];
+  let expanded = "";
+  let marked = "";
+  let start = 0;
+  let quote: "'" | '"' | undefined;
+  let braces = false;
+  const finishWord = (end: number): boolean => {
+    const word = command.slice(start, end);
+    if (!braces) {
+      expanded += word;
+      marked += word;
+      return true;
+    }
+    // ponytail: one comma-list per path, no nesting; extend only with a bounded shell parser.
+    const match =
+      /^([A-Za-z0-9_./-]*\/[A-Za-z0-9_./-]*)\{([A-Za-z0-9_./-]+(?:,[A-Za-z0-9_./-]+)+)\}([A-Za-z0-9_./-]*)$/.exec(
+        word,
+      );
+    if (!match) return false;
+    const members = (match[2] ?? "").split(",");
+    if (members.length > 16 || paths.length + members.length > 32) return false;
+    const values = members.map((member) => (match[1] ?? "") + member + (match[3] ?? ""));
+    const text = values.join(" ");
+    if (expanded.length + text.length + command.length - end > 65_536) return false;
+    paths.push(...values);
+    expanded += text;
+    marked += marker;
+    return true;
+  };
+  for (let i = 0; i <= command.length; i++) {
+    const char = command[i];
+    if (quote === "'") {
+      if (char === quote) quote = undefined;
+    } else if (char === "\\") {
+      if (command[i + 1] === undefined || /[\r\n]/.test(command[i + 1] ?? "")) return undefined;
+      i++;
+    } else if (quote === '"') {
+      if (char === quote) quote = undefined;
+    } else if (char === "'" || char === '"') {
+      quote = char;
+    } else if (char === "{" || char === "}") {
+      braces = true;
+    } else if (char === undefined || /[ \t\n]/.test(char)) {
+      if (!finishWord(i)) return undefined;
+      expanded += char ?? "";
+      marked += char ?? "";
+      start = i + 1;
+      braces = false;
+    } else if (/[\s;&|<>#]/.test(char)) {
+      // Other JS whitespace is a literal shell word character, not a token boundary.
+      return undefined;
+    }
+  }
+  if (quote || !paths.length || new TextEncoder().encode(expanded).byteLength > 65_536)
+    return undefined;
   const parsed = parseStaticShellCommands(marked);
   if (
-    !lexical ||
-    /[;&|<>\r\n]/.test(lexical.syntax) ||
     !parsed ||
     typeof parsed === "string" ||
     parsed.redirects.length ||
@@ -653,24 +734,19 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
   )
     return undefined;
   const argv = unwrapProofCommand(parsed.pipelines[0]?.[0] ?? [], marker);
+  const expandedCommands = parseStaticShellCommands(expanded);
+  const expandedArgv =
+    expandedCommands && typeof expandedCommands !== "string"
+      ? unwrapProofCommand(expandedCommands.pipelines[0]?.[0] ?? [], marker)
+      : undefined;
+  // Classify actual options too: a marked path can hide an executor such as git grep -O/path.
   if (
     !argv ||
-    argv.length !== 4 ||
-    argv[0] !== "rg" ||
-    argv[1] !== "-n" ||
-    argv[2]?.startsWith("-") ||
-    argv[3] !== marker
+    !expandedArgv ||
+    (!isPassiveTextCommand(expandedArgv) && expandedArgv[0]?.split("/").at(-1) !== "cat")
   )
     return undefined;
-  const members = /\{([^{}]+)\}/.exec(path);
-  if (!members) return undefined;
-  const values = (members[1] ?? "").split(",");
-  const size =
-    new TextEncoder().encode(command.slice(0, start)).byteLength +
-    values.reduce((total, value) => total + path.length - members[0].length + value.length + 1, -1);
-  if (size > 65_536) return undefined;
-  const paths = values.map((member) => path.replace(members[0], () => member));
-  return { command: command.slice(0, start) + paths.join(" "), paths };
+  return { command: expanded, paths };
 }
 
 /** Complete package metadata loops: no prelude, loader shadowing, mutation or arbitrary suffix. */
@@ -1710,7 +1786,7 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
   if (/\bcat\b[^;&|]*<<-?\s*\S+[\s\S]*\b(?:secret|credential)\b/i.test(command)) return true;
   const parsed = parseStaticShellCommands(command);
   const readers =
-    /\b(?:cat|cp|grep|rg|sed|awk|jq|head|tail|less|more|source|ls|sort|uniq|cut|wc|mv|find)\b/i;
+    /\b(?:cat|cp|grep|rg|sed|awk|jq|head|tail|less|more|source|ls|sort|uniq|cut|wc|mv|find|shasum|sha1sum|sha256sum|sha512sum|md5sum|cksum)\b/i;
   if (parsed && parsed !== "brace-expansion") {
     return parsed.pipelines.flat().some((words) => {
       const argv = unwrapStaticCommand(words);