@blogic-cz/agent-tools 1.6.0 → 1.6.2

package/README.md

@@ -650,10 +650,12 @@ The guard permits static `printenv` reads and simple `echo`/`printf` expansions
 
 Python inline programs and quoted stdin heredocs can also display approved values through `os.getenv("NAME")`, `os.environ.get("NAME", "default")`, or `os.environ["NAME"]`. The complete program must be `import os` followed by `print(...)` statements using these reads and plain string labels or defaults. Dynamic names, aliases, escaped or interpolated strings, additional statements, and whole-environment output remain unsupported. The same redirection and pipeline restrictions apply.
 
-Literal assignments such as `F=README.md; cat "$F"` work in supported static commands. Bounded proofs also support a literal `for` loop over a fixed list, the adjacent `cd PATH && T=LITERAL && git add -- "$T/file"` form, and `rg -n PATTERN src/{a,b}` with a single literal path-brace component. Loop binders are a single lowercase letter or `T`, and their uses must occupy supported data operands. Every body command and expanded path is checked; unsupported control flow, mutations such as `printf -v`, and unknown command roles cannot establish the proof. Other variable assignments and brace expansions retain conservative refusal. Fully quoted literal braces remain usable in static searches.
+Literal assignments such as `F=README.md; cat "$F"` work in supported static commands. Bounded proofs also support a literal `for` loop over a fixed list, a single ASCII-letter path binding such as `cd PATH && A=docs/report.md && shasum -a 256 "$A"` or `F=README.md; cat "$F"`, including the existing `git add -- "$T/file"` form, and literal path braces such as `rg -n -i PATTERN src/{a,b} docs/{guide,api}.md`. Path braces work with supported passive text commands and `cat`, and support one unquoted comma list per path, at most 16 members per list and 32 generated paths per command, within 64 KiB. Nested braces, ranges, empty members, mixed quoting, command positions, and compound commands remain unsupported. Path bindings accept literal values and `;`, newline, or `&&` sequencing; a binding conditional on successful `cd` is proved only for uses in that same `&&` list. Their uses must be supported read-only file operands or explicit `git add --` paths. Rebinding, executable operands, startup-variable names, and uncertain scopes cannot establish this proof. Loop binders are a single lowercase letter or `T`, and their uses must occupy supported data operands. Every body command and expanded path is checked; unsupported control flow, mutations such as `printf -v`, and unknown command roles cannot establish the proof. Other variable assignments and brace expansions retain conservative refusal. Fully quoted literal braces remain usable in static searches.
 
 Ordinary navigation operands such as `cd "$HOME"` and `git -C "$WORKTREE_ROOT" status --short` do not need display permission. This does not authorize printing those values, using them as code/options, or reading unknown file paths. In `printf`, approved values belong in data arguments after a fixed nonmutating format, for example `printf -- '%s' "$WORKSPACE_LABEL"`.
 
+Literal `herdr agent prompt` commands can be composed with independent `cat` readers and passive text pipelines. Prompt text stays data; command substitutions, environment mutation, unknown consumers, and executable pipelines cannot establish the proof. All reader operands and redirects still receive the ordinary sensitive-path checks. Literal loops also support `herdr pane read ID --source recent-unwrapped --lines N`, with the binder restricted to `ID`, and `2>&1` file-descriptor duplication. A bounded Python stdin processor supports only `import json,sys; d=json.load(sys.stdin); print(d["result"].get("text","") if isinstance(d.get("result"),dict) else d)`, including insignificant spacing and single lowercase-letter local renaming. Extra imports, statements, calls, runtime options, arguments, and other Python programs cannot establish this loop proof. The existing loop size and command limits apply.
+
 The guard recognizes `rtk`, `rtk proxy`, `command`, and supported `env` prefixes and checks commands in pipelines and chains. Quoted filenames, comments, and redirects retain sensitive-path checks. Jq object selectors and inline awk programs qualify only when their actual program and options establish passive behavior. Literal environment-command text in `rg`, `grep`, `git grep`, `echo`, and `printf` is allowed only with supported command roles and passive pipeline consumers. Environment-source evidence and startup identity checks also apply to the complete original invocation. Custom dangerous-command patterns apply to both the original input and proved expansions.
 
 Paths are checked against sensitive filename patterns and configured path rules. Supported proofs apply those checks to their expanded operands. Ordinary parent-directory and absolute paths may be allowed; the guard does not resolve filesystem paths or symlinks, or enforce repository confinement.

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAimEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAv8ED,SAAS,UAAU,UAAU,KAAK,IAu8EM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAz8EC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAy8EjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA38EE,MAAM,KAAK,OA28EgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA78EE,MAAM,KAAK,OA68EgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA/8EC,MAAM,KAAK,OA+8E0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAj9EC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAi9Ef,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAn9EC,MAAM,KAAK,OAm9EsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAr9EC,MAAM,KAAK,MAAM,GAAG,IAq9Ea,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA6tEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAnkFD,SAAS,UAAU,UAAU,KAAK,IAmkFM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YArkFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAqkFjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAvkFE,MAAM,KAAK,OAukFgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAzkFE,MAAM,KAAK,OAykFgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA3kFC,MAAM,KAAK,OA2kF0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA7kFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA6kFf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA/kFC,MAAM,KAAK,OA+kFsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAjlFC,MAAM,KAAK,MAAM,GAAG,IAilFa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -190,11 +190,11 @@ function getLeadingLiteralAssignments(
   const assignments = new Map<string, { value: string; end: number }>();
   let offset = 0;
   while (offset === 0 || command[offset - 1] === ";" || command[offset - 1] === "\n") {
-    while (/\s/.test(command[offset] ?? "")) offset++;
+    while (/[ \t\n]/.test(command[offset] ?? "")) offset++;
     const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./-]+)/.exec(command.slice(offset));
     if (!assignment) break;
     const end = offset + assignment[0].length;
-    const next = command.slice(end).match(/^\s*/)?.[0].length ?? 0;
+    const next = command.slice(end).match(/^[ \t]*/)?.[0].length ?? 0;
     const separator = command[end + next];
     if (separator !== ";" && separator !== "\n") break;
     assignments.set(assignment[1] ?? "", { value: assignment[2] ?? "", end });
@@ -239,39 +239,45 @@ function hasSafeLocalAssignmentCommands(
         assignments.get(assignment[1] ?? "")?.value === assignment[2]
       );
     }
-    const argv = unwrapStaticCommand(words);
-    if (isSafeHerdrTabCreate(argv)) return true;
-    const name = argv[0]?.split("/").at(-1) ?? "";
-    if (name === "cd") return isNavigationOperand(argv, "LOCALVALUE");
-    if (name === "git") {
-      let index = 1;
-      while (argv[index] === "-C" && argv[index + 1]) index += 2;
-      return (
-        ["branch", "diff", "log", "rev-parse", "rev-list", "show", "status"].includes(
-          argv[index] ?? "",
-        ) && !hasExecutionOption(argv.slice(index + 1), ["exec", "ext-diff", "textconv"])
-      );
-    }
-    if (name === "find") {
-      return !argv.slice(1).some((arg) => /^-(?:exec|ok|delete|fprint|fprintf)/.test(arg));
-    }
-    if (name === "bun") return argv[1] === "run" && ["db-tool", "gh-tool"].includes(argv[2] ?? "");
+    return isSafeLocalAssignmentCommand(words);
+  });
+}
+
+function isSafeLocalAssignmentCommand(words: string[]): boolean {
+  const argv = unwrapStaticCommand(words);
+  if (isSafeHerdrTabCreate(argv)) return true;
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (name === "wc" && hasExecutionOption(argv.slice(1), ["files0-from"])) return false;
+  if (name === "cd") return isNavigationOperand(argv, "LOCALVALUE");
+  if (name === "git") {
+    let index = 1;
+    while (argv[index] === "-C" && argv[index + 1]) index += 2;
     return (
-      isPassiveTextCommand(argv) ||
-      ["ls", "cat", "tail", "wc", "uniq", "cut", "mv"].includes(name) ||
-      (name === "sort" && !hasExecutionOption(argv.slice(1), ["compress-program"])) ||
-      (name === "sed" &&
-        argv
-          .slice(1)
-          .every(
-            (arg) =>
-              /^-[En]+$/.test(arg) ||
-              /^s([/|]).*\1[^/|]*\1[gp]*$/.test(arg) ||
-              /^[A-Za-z0-9_./-]+$/.test(arg),
-          ) &&
-        !argv.includes("-f"))
+      ["branch", "diff", "log", "rev-parse", "rev-list", "show", "status"].includes(
+        argv[index] ?? "",
+      ) && !hasExecutionOption(argv.slice(index + 1), ["exec", "ext-diff", "textconv"])
     );
-  });
+  }
+  if (name === "find") {
+    return !argv.slice(1).some((arg) => /^-(?:exec|ok|delete|fprint|fprintf)/.test(arg));
+  }
+  if (name === "bun") return argv[1] === "run" && ["db-tool", "gh-tool"].includes(argv[2] ?? "");
+  return (
+    isPassiveTextCommand(argv) ||
+    ["ls", "cat", "tail", "wc", "uniq", "cut", "mv"].includes(name) ||
+    (name === "sort" &&
+      !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from", "output"], "o")) ||
+    (name === "sed" &&
+      argv
+        .slice(1)
+        .every(
+          (arg) =>
+            /^-[En]+$/.test(arg) ||
+            /^s([/|]).*\1[^/|]*\1[gp]*$/.test(arg) ||
+            /^[A-Za-z0-9_./-]+$/.test(arg),
+        ) &&
+      !argv.includes("-f"))
+  );
 }
 
 function hasSensitivePathRedirect(
@@ -429,6 +435,7 @@ function literalBindingText(
   let quote: "'" | '"' | undefined;
   for (let i = 0; i < command.length; i++) {
     const char = command[i] ?? "";
+    if (!quote && /[^\S \t\n]/.test(char)) return undefined;
     if (char === "\\" && quote !== "'") {
       const next = command[++i];
       if (next === undefined || /[\r\n]/.test(next)) return undefined;
@@ -497,9 +504,8 @@ function isLiteralLoopCommand(words: string[], marker: string, value: string): b
   }
   if (name === "herdr")
     return (
-      argv.length === 4 &&
-      argv[1] === "agent" &&
-      argv[2] === "get" &&
+      ((argv.length === 4 && argv[1] === "agent" && argv[2] === "get") ||
+        isLiteralHerdrPaneRead(argv)) &&
       /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "") &&
       uses.every((index) => index === 3)
     );
@@ -513,7 +519,36 @@ function isLiteralLoopCommand(words: string[], marker: string, value: string): b
       uses.every((index) => index === 8)
     );
   return (
-    ["grep", "head", "tail"].includes(name ?? "") && uses.length === 0 && isPassiveTextCommand(argv)
+    uses.length === 0 &&
+    ((["grep", "head", "tail"].includes(name ?? "") && isPassiveTextCommand(argv)) ||
+      isLiteralStdinJsonDisplay(argv))
+  );
+}
+
+function isLiteralHerdrPaneRead(argv: string[]): boolean {
+  return (
+    argv.length === 8 &&
+    argv.slice(0, 3).join(" ") === "herdr pane read" &&
+    /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "") &&
+    argv[4] === "--source" &&
+    argv[5] === "recent-unwrapped" &&
+    argv[6] === "--lines" &&
+    /^[1-9]\d*$/.test(argv[7] ?? "")
+  );
+}
+
+/** A complete stdin-only JSON projection, with no suffix, imports or executable input. */
+function isLiteralStdinJsonDisplay(argv: string[]): boolean {
+  if (argv.length !== 3 || !["python", "python3"].includes(argv[0] ?? "") || argv[1] !== "-c")
+    return false;
+  const program = argv[2] ?? "";
+  if (program.length > 65_536) return false;
+  const parts = programParts(program, true);
+  if (!parts || parts.literals.join("\0") !== "result\0text\0\0result") return false;
+  // ponytail: one JSON projection with a single-letter local; extend only with another complete grammar.
+  const code = parts.code.replace(/[ \t]+/g, " ").trim();
+  return /^import json\s*,\s*sys\s*(?:;|\r?\n)\s*([a-z])\s*=\s*json\s*\.\s*load\s*\(\s*sys\s*\.\s*stdin\s*\)\s*(?:;|\r?\n)\s*print\s*\(\s*\1\s*\[\s*STRING\s*\]\s*\.\s*get\s*\(\s*STRING\s*,\s*STRING\s*\)\s+if isinstance\s*\(\s*\1\s*\.\s*get\s*\(\s*STRING\s*\)\s*,\s*dict\s*\)\s+else \1\s*\)\s*;?$/.test(
+    code,
   );
 }
 
@@ -524,7 +559,7 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
   if (new TextEncoder().encode(command).byteLength > 65_536) return undefined;
   const marker = "GUARDLITERALBINDING";
   if (command.includes(marker)) return undefined;
-  let script = command.trim();
+  let script = command.replace(/^[ \t\n]+|[ \t\n]+$/g, "");
   const wrapped = parseStaticShellCommands(script);
   if (
     wrapped &&
@@ -534,7 +569,10 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
     wrapped.redirects.length === 0
   ) {
     const argv = unwrapProofCommand(wrapped.pipelines[0]?.[0] ?? [], marker);
-    if (argv?.[0] === "sh" && argv[1] === "-c" && argv.length === 3) script = argv[2] ?? "";
+    if (argv?.[0] === "sh" && argv[1] === "-c" && argv.length === 3) {
+      if (!literalBindingText(script, "", "")) return undefined;
+      script = argv[2] ?? "";
+    }
   }
   const loop =
     /^for[ \t]+([A-Za-z_]\w*)[ \t]+in[ \t]+([^;\n]+);[ \t\r\n]*do[ \t\r\n]+([\s\S]*);[ \t\r\n]*done[ \t\r\n]*$/.exec(
@@ -557,7 +595,8 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
     const values = rawValues.map((item) => item.replace(/^['"]|['"]$/g, ""));
     if (!values.length || values.length > 16) return undefined;
     const marked = literalBindingText(loop[3] ?? "", name, marker);
-    if (!marked || /&&|\|\||[<>]|&/.test(marked.syntax.replace(/\b2>&1\b/g, ""))) return undefined;
+    if (!marked || /&&|\|\||[<>]|&/.test(marked.syntax.replace(/\b2>&1(?=[ \t\n;|]|$)/g, "")))
+      return undefined;
     const parsed = parseStaticShellCommands(marked.text);
     if (
       !parsed ||
@@ -587,64 +626,135 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
       paths: [],
     };
   }
+  // Single ASCII-letter names avoid shell startup/special variables such as PATH and IFS.
   const assignment =
-    /^cd[ \t]+(~?\/?[A-Za-z0-9_./-]+)[ \t]+&&[ \t]+([A-Za-z_]\w*)=([A-Za-z0-9_./][A-Za-z0-9_./-]*)[ \t]+&&[ \t]+/.exec(
-      command,
+    /^(?:cd[ \t]+(~?\/?[A-Za-z0-9_./-]+)[ \t]*(;|\n|&&)[ \t]*)?([A-Za-z])=([A-Za-z0-9_./][A-Za-z0-9_./-]*)[ \t]*(;|\n|&&)[ \t]*/.exec(
+      script,
     );
-  if (assignment && isLiteralBinder(assignment[2] ?? "")) {
+  if (assignment) {
     const rest = literalBindingText(
-      command.slice(assignment[0].length),
-      assignment[2] ?? "",
+      script.slice(assignment[0].length),
+      assignment[3] ?? "",
       marker,
     );
-    if (!rest) return undefined;
-    const end = rest.syntax.search(/[;&|\r\n]/);
-    const use = rest.text.slice(0, end < 0 ? undefined : end);
-    const suffix = end < 0 ? "" : rest.text.slice(end);
-    if (suffix.includes(marker)) return undefined;
-    const parsed = parseStaticShellCommands(use);
-    const argv =
-      parsed &&
-      typeof parsed !== "string" &&
-      parsed.pipelines.length === 1 &&
-      parsed.pipelines[0]?.length === 1 &&
-      parsed.redirects.length === 0
-        ? parsed.pipelines[0]?.[0]
-        : undefined;
+    if (!rest || !rest.text.includes(marker)) return undefined;
+    // No branches, background jobs or pipeline-local state. FD duplication stays inert.
+    const syntax = rest.syntax.replace(/[<>]&[0-9-]+/g, "");
+    if (/\|\||(^|[^&])&(?!&)|[^\S \t\n]/.test(syntax)) return undefined;
+    if (assignment[2] === "&&") {
+      if (assignment[5] !== "&&") return undefined;
+      const boundary = rest.syntax.search(/[;\r\n]/);
+      if (boundary >= 0 && rest.text.slice(boundary).includes(marker)) return undefined;
+    }
+    const parsed = parseStaticShellCommands(rest.text);
     if (
-      !argv ||
-      argv.length < 4 ||
-      argv.slice(0, 3).join(" ") !== "git add --" ||
-      argv.slice(3).some((word) => !/^[A-Za-z0-9_./-]+$/.test(word))
+      !parsed ||
+      typeof parsed === "string" ||
+      parsed.redirects.some(({ target }) => target.includes(marker)) ||
+      !parsed.pipelines.flat().length ||
+      parsed.pipelines.flat().length > 32
     )
       return undefined;
-    const value = assignment[3] ?? "";
+    const value = assignment[4] ?? "";
+    const paths: string[] = [];
+    for (const words of parsed.pipelines.flat()) {
+      const marked = unwrapProofCommand(words, marker);
+      if (!marked) return undefined;
+      const argv = marked.map((word) => word.replaceAll(marker, () => value));
+      const name = argv[0]?.split("/").at(-1) ?? "";
+      const uses = marked.flatMap((word, index) => (word.includes(marker) ? [index] : []));
+      const checksum =
+        ["shasum", "sha1sum", "sha256sum", "sha512sum", "md5sum", "cksum"].includes(name) &&
+        !hasExecutionOption(argv.slice(1), ["check"], "c");
+      if (!uses.length) {
+        if (
+          !isSafeLocalAssignmentCommand(argv) &&
+          inlineProgramIndex(argv) === undefined &&
+          !(argv[0] === "git" && argv[1] === "commit") &&
+          !checksum
+        )
+          return undefined;
+        continue;
+      }
+      if (
+        uses.some(
+          (index) => index === 0 || !/^[A-Za-z0-9_./][A-Za-z0-9_./-]*$/.test(argv[index] ?? ""),
+        )
+      )
+        return undefined;
+      const gitAdd =
+        argv.slice(0, 3).join(" ") === "git add --" && uses.every((index) => index >= 3);
+      const reader =
+        ["cat", "ls", "head", "tail", "wc", "uniq", "cut", "sort", "grep", "rg"].includes(name) &&
+        isSafeLocalAssignmentCommand(argv);
+      if (!gitAdd && !reader && !checksum) return undefined;
+      paths.push(...uses.map((index) => argv[index] ?? ""));
+    }
+    const prefix = assignment[1] ? `cd ${assignment[1]}${assignment[2]} ` : "";
     const size =
-      new TextEncoder().encode(rest.text).byteLength +
-      (use.split(marker).length - 1) * (value.length - marker.length) +
-      (assignment[1]?.length ?? 0) +
-      7;
-    if (size > 65_536) return undefined;
-    const paths = argv.slice(3).map((word) => word.replaceAll(marker, () => value));
-    return {
-      command: `cd ${assignment[1]} && ${use.replaceAll(marker, () => value)}${suffix}`,
-      paths,
-    };
+      new TextEncoder().encode(prefix + rest.text).byteLength +
+      (rest.text.split(marker).length - 1) * (value.length - marker.length);
+    if (paths.length > 32 || size > 65_536) return undefined;
+    return { command: prefix + rest.text.replaceAll(marker, () => value), paths };
   }
-  // Only the observed rg -n PATTERN PATH form; marker position proves a real file operand.
-  const brace =
-    /(?:^|\s)([A-Za-z0-9_./-]*\/[A-Za-z0-9_./-]*\{[A-Za-z_]\w*(?:,[A-Za-z_]\w*){1,7}\}[A-Za-z0-9_./-]*)$/.exec(
-      command,
-    );
-  if (!brace) return undefined;
-  const path = brace[1] ?? "";
-  const start = command.length - path.length;
-  const marked = command.slice(0, start) + marker;
-  const lexical = literalBindingText(marked, "", "");
+  // Expand only complete, unquoted path words. Keep all other source text intact.
+  const paths: string[] = [];
+  let expanded = "";
+  let marked = "";
+  let start = 0;
+  let quote: "'" | '"' | undefined;
+  let braces = false;
+  const finishWord = (end: number): boolean => {
+    const word = command.slice(start, end);
+    if (!braces) {
+      expanded += word;
+      marked += word;
+      return true;
+    }
+    // ponytail: one comma-list per path, no nesting; extend only with a bounded shell parser.
+    const match =
+      /^([A-Za-z0-9_./-]*\/[A-Za-z0-9_./-]*)\{([A-Za-z0-9_./-]+(?:,[A-Za-z0-9_./-]+)+)\}([A-Za-z0-9_./-]*)$/.exec(
+        word,
+      );
+    if (!match) return false;
+    const members = (match[2] ?? "").split(",");
+    if (members.length > 16 || paths.length + members.length > 32) return false;
+    const values = members.map((member) => (match[1] ?? "") + member + (match[3] ?? ""));
+    const text = values.join(" ");
+    if (expanded.length + text.length + command.length - end > 65_536) return false;
+    paths.push(...values);
+    expanded += text;
+    marked += marker;
+    return true;
+  };
+  for (let i = 0; i <= command.length; i++) {
+    const char = command[i];
+    if (quote === "'") {
+      if (char === quote) quote = undefined;
+    } else if (char === "\\") {
+      if (command[i + 1] === undefined || /[\r\n]/.test(command[i + 1] ?? "")) return undefined;
+      i++;
+    } else if (quote === '"') {
+      if (char === quote) quote = undefined;
+    } else if (char === "'" || char === '"') {
+      quote = char;
+    } else if (char === "{" || char === "}") {
+      braces = true;
+    } else if (char === undefined || /[ \t\n]/.test(char)) {
+      if (!finishWord(i)) return undefined;
+      expanded += char ?? "";
+      marked += char ?? "";
+      start = i + 1;
+      braces = false;
+    } else if (/[\s;&|<>#]/.test(char)) {
+      // Other JS whitespace is a literal shell word character, not a token boundary.
+      return undefined;
+    }
+  }
+  if (quote || !paths.length || new TextEncoder().encode(expanded).byteLength > 65_536)
+    return undefined;
   const parsed = parseStaticShellCommands(marked);
   if (
-    !lexical ||
-    /[;&|<>\r\n]/.test(lexical.syntax) ||
     !parsed ||
     typeof parsed === "string" ||
     parsed.redirects.length ||
@@ -653,24 +763,19 @@ function materializeLiteralShell(command: string): LiteralShellProof | undefined
   )
     return undefined;
   const argv = unwrapProofCommand(parsed.pipelines[0]?.[0] ?? [], marker);
+  const expandedCommands = parseStaticShellCommands(expanded);
+  const expandedArgv =
+    expandedCommands && typeof expandedCommands !== "string"
+      ? unwrapProofCommand(expandedCommands.pipelines[0]?.[0] ?? [], marker)
+      : undefined;
+  // Classify actual options too: a marked path can hide an executor such as git grep -O/path.
   if (
     !argv ||
-    argv.length !== 4 ||
-    argv[0] !== "rg" ||
-    argv[1] !== "-n" ||
-    argv[2]?.startsWith("-") ||
-    argv[3] !== marker
+    !expandedArgv ||
+    (!isPassiveTextCommand(expandedArgv) && expandedArgv[0]?.split("/").at(-1) !== "cat")
   )
     return undefined;
-  const members = /\{([^{}]+)\}/.exec(path);
-  if (!members) return undefined;
-  const values = (members[1] ?? "").split(",");
-  const size =
-    new TextEncoder().encode(command.slice(0, start)).byteLength +
-    values.reduce((total, value) => total + path.length - members[0].length + value.length + 1, -1);
-  if (size > 65_536) return undefined;
-  const paths = values.map((member) => path.replace(members[0], () => member));
-  return { command: command.slice(0, start) + paths.join(" "), paths };
+  return { command: expanded, paths };
 }
 
 /** Complete package metadata loops: no prelude, loader shadowing, mutation or arbitrary suffix. */
@@ -1521,24 +1626,43 @@ function hasStaticEnvironmentRead(
 }
 
 function isStaticHerdrPrompt(command: string): boolean {
+  // Preserve shell word boundaries and executable identity before proving composition.
+  if (!literalBindingText(command, "", "")) return false;
   const parsed = parseStaticShellCommands(command);
   if (!parsed || typeof parsed === "string") return false;
-  const commands = parsed.pipelines.flat().map(unwrapStaticCommand);
+  const commands = parsed.pipelines.flat().map((words) => unwrapProofCommand(words, "\0"));
   const prompts = commands.filter(
-    (argv) => argv[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt",
+    (argv) => argv?.[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt",
   );
   return (
     prompts.length > 0 &&
-    commands.every((argv) =>
-      argv[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt"
-        ? argv.length >= 5
-        : isPassiveTextCommand(argv),
+    parsed.pipelines.every((pipeline) =>
+      pipeline.every((words, index) => {
+        const argv = unwrapProofCommand(words, "\0");
+        if (!argv) return false;
+        if (argv[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt")
+          return index === 0 && argv.length >= 5;
+        // cat is a reader at the start of an independent pipeline, never a consumer.
+        if (argv[0] === "cat")
+          return (
+            index === 0 &&
+            argv.length > 1 &&
+            argv.slice(1).every((arg) => arg === "--" || !arg.startsWith("-"))
+          );
+        return isPassiveTextCommand(argv);
+      }),
     )
   );
 }
 
 function isHerdrPrompt(command: string): boolean {
-  return /^herdr\s+agent\s+prompt\b/.test(command.trim());
+  if (/^herdr\s+agent\s+prompt\b/.test(command.trim())) return true;
+  const parsed = parseStaticShellCommands(command, true);
+  if (!parsed || typeof parsed === "string") return false;
+  return parsed.pipelines.flat().some((words) => {
+    const argv = unwrapStaticCommand(words);
+    return argv[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt";
+  });
 }
 
 function hasEnvironmentRead(
@@ -1710,7 +1834,7 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
   if (/\bcat\b[^;&|]*<<-?\s*\S+[\s\S]*\b(?:secret|credential)\b/i.test(command)) return true;
   const parsed = parseStaticShellCommands(command);
   const readers =
-    /\b(?:cat|cp|grep|rg|sed|awk|jq|head|tail|less|more|source|ls|sort|uniq|cut|wc|mv|find)\b/i;
+    /\b(?:cat|cp|grep|rg|sed|awk|jq|head|tail|less|more|source|ls|sort|uniq|cut|wc|mv|find|shasum|sha1sum|sha256sum|sha512sum|md5sum|cksum)\b/i;
   if (parsed && parsed !== "brace-expansion") {
     return parsed.pipelines.flat().some((words) => {
       const argv = unwrapStaticCommand(words);