@blogic-cz/agent-tools 1.6.10 → 1.6.12

package/README.md

@@ -654,7 +654,7 @@ Claude Code uses shell command hooks. The package ships a ready-made wrapper scr
 
 That's it. The hook reads tool input from stdin, runs the guard, and exits with code 2 (blocked + reason on stderr) or 0 (allowed).
 
-The guard permits static `printenv` reads and simple `echo`/`printf` expansions only for exact names in `credentialGuard.allowedEnvironmentVariables`. The default list is empty. Multiple names are allowed only when each name is approved. Approved environment values may be displayed, but redirecting their pipeline or passing them to an executor stays blocked.
+The guard permits static `printenv` reads and simple `echo`/`printf` expansions only for exact names in `credentialGuard.allowedEnvironmentVariables`. Quoted empty defaults such as `"${NAME:-}"` follow the same display rules, including `printf` data arguments with a literal format; unquoted defaults, nonempty defaults, and other parameter operators stay blocked. The default list is empty. Multiple names are allowed only when each name is approved. Approved environment values may be displayed, but redirecting their pipeline or passing them to an executor stays blocked.
 
 Python inline programs and quoted stdin heredocs can also display approved values through `os.getenv("NAME")`, `os.environ.get("NAME", "default")`, or `os.environ["NAME"]`. The complete program must import unaliased `os`, plus `json` for JSON display, followed by `print(...)` statements. `json.dumps(...)` supports dictionaries and lists of approved reads, including comprehensions over a nonempty literal list of approved names. Every dictionary key and environment read must use an approved name. Each projection has at most 16 entries; the program has at most 65,536 characters. Computed or unbounded names, aliases, escaped or interpolated strings, additional statements, and whole-environment output remain unsupported. The same redirection and pipeline restrictions apply.
 

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAsvFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4VrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA5nGD,SAAS,UAAU,UAAU,KAAK,IA4nGM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YA9nGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IA8nGjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAhoGE,MAAM,KAAK,OAgoGgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAloGE,MAAM,KAAK,OAkoGgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YApoGC,MAAM,KAAK,OAooG0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAtoGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAsoGf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAxoGC,MAAM,KAAK,OAwoGsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA1oGC,MAAM,KAAK,MAAM,GAAG,IA0oGa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAg4FF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAoWrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA9wGD,SAAS,UAAU,UAAU,KAAK,IA8wGM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAhxGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAgxGjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAlxGE,MAAM,KAAK,OAkxGgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aApxGE,MAAM,KAAK,OAoxGgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAtxGC,MAAM,KAAK,OAsxG0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAxxGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAwxGf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA1xGC,MAAM,KAAK,OA0xGsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA5xGC,MAAM,KAAK,MAAM,GAAG,IA4xGa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.10",
+  "version": "1.6.12",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -226,11 +226,13 @@ function isSafeHerdrTabCreate(argv: string[]): boolean {
 function hasSafeLocalAssignmentCommands(
   command: string,
   assignments: Map<string, { value: string; end: number }>,
+  statusCaptures: Set<string>,
 ): boolean {
   if (!assignments.size) return true;
   const parsed = parseStaticShellCommands(command);
   if (!parsed || typeof parsed === "string") return false;
   return parsed.pipelines.flat().every((words) => {
+    if (words.length === 1 && statusCaptures.has(words[0] ?? "")) return true;
     const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./-]+)$/.exec(words[0] ?? "");
     if (assignment) {
       return (
@@ -1890,6 +1892,37 @@ function isStaticNavigationCommand(argv: string[]): boolean {
   );
 }
 
+/** Literal wrappers and exact directory-operation roles; unknown consumers keep refusal. */
+function isProvedDirectoryCommand(words: string[]): boolean {
+  const argv = unwrapStaticCommand(words);
+  if (
+    !words
+      .slice(0, words.length - argv.length)
+      .every((word) => ["rtk", "proxy", "command", "--"].includes(word))
+  )
+    return false;
+  if (argv[0] === "cd") return isStaticNavigationCommand(argv);
+  if (argv[0] !== "git") return false;
+  let index = 1;
+  while (argv[index] === "-C") {
+    if (!isStaticNavigationCommand(["cd", argv[index + 1] ?? ""])) return false;
+    index += 2;
+  }
+  const args = argv.slice(index);
+  if (args[0] === "status")
+    return args.length === 1 || (args.length === 2 && args[1] === "--short");
+  if (args[0] === "fetch")
+    return (
+      args.length >= 2 &&
+      args.length <= 3 &&
+      args.slice(1).every((arg) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*$/.test(arg))
+    );
+  return (
+    (args.length === 2 && args[0] === "rev-parse" && args[1] === "HEAD") ||
+    (args.length === 3 && args[0] === "rev-list" && args[1] === "--count" && args[2] === "HEAD")
+  );
+}
+
 /** Prove a single cd whose uses are gated on success, without simulating shell state. */
 function hasProvedNavigationSequence(command: string): boolean {
   const literal = literalBindingText(command, "", "");
@@ -2279,6 +2312,7 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
   if (parsed && parsed !== "brace-expansion") {
     let directory = "";
     const trackDirectory = hasProvedNavigationSequence(command);
+    const safeDirectorySequence = parsed.pipelines.flat().every(isProvedDirectoryCommand);
     return parsed.pipelines.flat().some((words) => {
       const argv = unwrapStaticCommand(words);
       const inspectedArgv =
@@ -2291,19 +2325,36 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
         path.startsWith("/") ? posix.normalize(path) : posix.join(commandDirectory, path);
       const blockedOperand = (path: string) =>
         [path, inDirectory(path)].some((value) => isPathBlocked(value) || isSensitivePath(value));
-      const blockedDirectory = (path: string) => blockedOperand(path) || blockedOperand(path + "/");
+      // Directory slots use path policies, not the broad credential-file name heuristic.
+      const blockedDirectory = (path: string) =>
+        [path, inDirectory(path)].some(
+          (value) => isPathBlocked(value) || isPathBlocked(value + "/"),
+        );
       if (name === "cd") {
         const path = inspected[inspected[1] === "--" ? 2 : 1];
         if (path === undefined) return false;
         if (blockedDirectory(path)) return true;
+        // A successful cd alone proves neither its later readers nor pipeline consumers safe.
+        if (
+          (!trackDirectory || !safeDirectorySequence) &&
+          (blockedOperand(path) || blockedOperand(path + "/"))
+        )
+          return true;
         if (trackDirectory && isStaticNavigationCommand(inspected)) directory = inDirectory(path);
         return false;
       }
       if (name === "git") {
         let index = 1;
         while (inspected[index] === "-C" && inspected[index + 1]) {
-          if (blockedDirectory(inspected[index + 1] ?? "")) return true;
-          commandDirectory = inDirectory(inspected[index + 1] ?? "");
+          const path = inspected[index + 1] ?? "";
+          if (blockedDirectory(path)) return true;
+          // Git -C affects this command only; following consumers keep the shell directory.
+          if (
+            !isProvedDirectoryCommand(words) &&
+            (blockedOperand(path) || blockedOperand(path + "/"))
+          )
+            return true;
+          commandDirectory = inDirectory(path);
           index += 2;
         }
         // Git grep has the same pattern-versus-file roles as grep below.
@@ -2483,6 +2534,7 @@ function hasEnvironmentVariableExpansionRead(
   command: string,
   allowedNames: Set<string>,
   isPathBlocked: (path: string) => boolean,
+  onProvedStatus?: (command: string) => void,
 ): boolean {
   let heredoc = boundedHeredoc(command);
   while (heredoc) {
@@ -2494,8 +2546,15 @@ function hasEnvironmentVariableExpansionRead(
   if (!command.includes("$") && !command.includes("`")) return false;
   let invalidExpansion = false;
   const assignments = getLeadingLiteralAssignments(command);
-  const localValues = new Map<string, string>();
   let localIndex = 0;
+  const directCaptures = new Map<string, string>();
+  const statusReferences = new Map<string, { name: string; fallback: string }>();
+  const marker = (prefix: string): string => {
+    let value: string;
+    do value = `${prefix}${localIndex++}END`;
+    while (command.includes(value));
+    return value;
+  };
   let expansions = 0;
   let normalized = "";
   let quote: "'" | '"' | undefined;
@@ -2534,7 +2593,18 @@ function hasEnvironmentVariableExpansionRead(
     }
     if (command[i + 1] === "?") {
       expansions++;
-      normalized += "NUMERICSTATUSVALUE";
+      const value = marker("NUMERICSTATUSVALUE");
+      // Only an exact standalone assignment token captures in the parent shell.
+      // Quoting/escaping the name can instead produce an executable command word.
+      const capture = /(?:^|[;\n])[ \t]*([A-Za-z_][A-Za-z0-9_]*)=("?)$/.exec(command.slice(0, i));
+      const ending = capture?.[2] === '"' ? '"' : "";
+      if (
+        capture &&
+        command.slice(i + 2).startsWith(ending) &&
+        /^[ \t]*(?:[;\n]|$)/.test(command.slice(i + 2 + ending.length))
+      )
+        directCaptures.set(value, capture[1] ?? "");
+      normalized += value;
       i++;
       continue;
     }
@@ -2552,32 +2622,107 @@ function hasEnvironmentVariableExpansionRead(
     const name = variable[1] ?? variable[3] ?? "";
     if (variable[2]) {
       if (quote !== '"' || !allowedNames.has(name)) invalidExpansion = true;
-      normalized += "ENVTESTVALUE";
+      normalized += "ENVVALUE";
       i += variable[0].length - 1;
       continue;
     }
     const assignment = assignments.get(name);
     if (assignment && assignment.end >= i) invalidExpansion = true;
-    if (assignment && assignment.end < i) {
-      const marker = `LOCALVALUE${localIndex++}`;
-      localValues.set(marker, assignment.value);
-      normalized += marker;
-    } else if (allowedNames.has(name)) {
-      normalized += quote ? "ENVVALUE" : "ENVVALUEUNQUOTED";
-    } else {
-      normalized += quote ? "UNKNOWNVALUE" : "UNKNOWNVALUEUNQUOTED";
-    }
+    const reference = marker("STATUSREFERENCE");
+    const fallback =
+      assignment && assignment.end < i
+        ? assignment.value
+        : allowedNames.has(name)
+          ? quote
+            ? "ENVVALUE"
+            : "ENVVALUEUNQUOTED"
+          : quote
+            ? "UNKNOWNVALUE"
+            : "UNKNOWNVALUEUNQUOTED";
+    statusReferences.set(reference, { name, fallback });
+    normalized += reference;
     i += variable[0].length - 1;
   }
   if (!expansions) return invalidExpansion;
   if (invalidExpansion) return true;
 
-  const localMaterialized = [...localValues].reduce(
-    (text, [marker, value]) => text.replaceAll(marker, () => value),
-    normalized,
-  );
+  // Resolve every reference at its command position; a later capture cannot prove
+  // an earlier read, and only proved passive intermediates preserve the binding.
+  const initial = parseStaticShellCommands(normalized);
+  if (!initial || typeof initial === "string") return true;
+  const captures = new Map<string, string>();
+  for (const words of initial.pipelines.flat()) {
+    const capture = /^([A-Za-z_][A-Za-z0-9_]*)=(.+)$/.exec(words[0] ?? "");
+    if (capture && directCaptures.get(capture[2] ?? "") === capture[1])
+      captures.set(words[0] ?? "", capture[1] ?? "");
+  }
+  const statusCaptures = new Set<string>();
+  const localStatuses = new Set<string>();
+  const resolutions = new Map<string, string>();
+  const capturedNames = new Set(captures.values());
+  const bound = new Set<string>();
+  if (captures.size) {
+    const syntax = literalBindingText(normalized, "", "")?.syntax;
+    if (syntax === undefined || /&&|\|\||&/.test(syntax.replace(/[<>]&[0-9-]+/g, ""))) return true;
+  }
+  for (const [index, pipeline] of initial.pipelines.entries()) {
+    for (const words of pipeline) {
+      for (const arg of words) {
+        for (const [reference, { name, fallback }] of statusReferences) {
+          if (!arg.includes(reference)) continue;
+          if (bound.has(name)) {
+            const value = marker("NUMERICSTATUSVALUE");
+            localStatuses.add(value);
+            resolutions.set(reference, value);
+          } else {
+            if (capturedNames.has(name)) return true;
+            resolutions.set(reference, fallback);
+          }
+        }
+      }
+      const capture = captures.get(words[0] ?? "");
+      if (capture) {
+        if (
+          pipeline.length !== 1 ||
+          words.length !== 1 ||
+          initial.redirects.some((redirect) => redirect.pipeline === index) ||
+          // Inherited export attributes can make a numeric value select code or paths.
+          /^(?:LD_|DYLD_|_RLD_|LDR_|GIT_CONFIG_(?:KEY|VALUE)_)/.test(capture) ||
+          /^(?:PATH|IFS|CDPATH|BASH_ENV|ENV|FPATH|ZDOTDIR|SHELLOPTS|BASHOPTS|PROMPT_COMMAND|PS[0-4]|GLOBIGNORE|RANDOM|SECONDS|PIPESTATUS|UID|EUID|BASH_XTRACEFD|HOME|XDG_CONFIG_HOME|LIBPATH|SHLIB_PATH|NODE_OPTIONS|NODE_PATH|BUN_OPTIONS|BUN_PRELOAD|PYTHONPATH|PYTHONSTARTUP|PYTHONHOME|RUBYOPT|RUBYLIB|GEM_HOME|GEM_PATH|PERL5OPT|PERL5LIB|PERLLIB|JAVA_TOOL_OPTIONS|JDK_JAVA_OPTIONS|CLASSPATH|_JAVA_OPTIONS|JAVA_HOME|GIT_SSH_COMMAND|GIT_SSH|GIT_PROXY_COMMAND|GIT_EXEC_PATH|GIT_CONFIG|GIT_CONFIG_GLOBAL|GIT_CONFIG_SYSTEM|GIT_CONFIG_PARAMETERS|GIT_CONFIG_COUNT|GIT_ASKPASS|SSH_ASKPASS|GIT_EDITOR|GIT_SEQUENCE_EDITOR|GIT_PAGER|PAGER|EDITOR|VISUAL)$/.test(
+            capture,
+          )
+        )
+          return true;
+        bound.add(capture);
+        statusCaptures.add(words[0] ?? "");
+        continue;
+      }
+      const argv = unwrapStaticCommand(words);
+      const name = argv[0]?.split("/").at(-1) ?? "";
+      if (
+        captures.size &&
+        /^(?:alias|unalias|readonly|declare|typeset|local|export|eval|source|\.|trap|set|read|unset|let)$/.test(
+          name,
+        )
+      )
+        return true;
+      if (!isPassiveTextCommand(argv) && name !== "cat") bound.clear();
+    }
+    for (const redirect of initial.redirects.filter((value) => value.pipeline === index)) {
+      if (
+        [...statusReferences].some(
+          ([reference, { name }]) => capturedNames.has(name) && redirect.target.includes(reference),
+        )
+      )
+        return true;
+    }
+  }
+  for (const [reference, { fallback }] of statusReferences) {
+    normalized = normalized.replaceAll(reference, () => resolutions.get(reference) ?? fallback);
+  }
+  const localMaterialized = normalized;
   // Options must be checked after local literals become actual argv, never as placeholders.
-  if (!hasSafeLocalAssignmentCommands(localMaterialized, assignments)) return true;
+  if (!hasSafeLocalAssignmentCommands(localMaterialized, assignments, statusCaptures)) return true;
   const parsed = parseStaticShellCommands(localMaterialized);
   if (!parsed || typeof parsed === "string") return true;
   for (const [index, pipeline] of parsed.pipelines.entries()) {
@@ -2586,6 +2731,7 @@ function hasEnvironmentVariableExpansionRead(
     if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
     if (
       pipeline.some((words) => {
+        if (words.length === 1 && statusCaptures.has(words[0] ?? "")) return false;
         const argv = unwrapStaticCommand(words);
         if (!words.some((arg) => arg.includes("NUMERICSTATUSVALUE")))
           return !isPassiveTextCommand(argv);
@@ -2594,6 +2740,9 @@ function hasEnvironmentVariableExpansionRead(
         return (
           !["echo", "printf"].includes(name ?? "") ||
           !isPassiveTextCommand(argv) ||
+          argv.some(
+            (arg) => arg.startsWith("-") && [...localStatuses].some((value) => arg.includes(value)),
+          ) ||
           words
             .slice(0, words.length - argv.length)
             .some((arg) => arg.includes("NUMERICSTATUSVALUE")) ||
@@ -2606,13 +2755,6 @@ function hasEnvironmentVariableExpansionRead(
     )
       return true;
   }
-  for (const words of parsed.pipelines.flat()) {
-    if (
-      words.some((arg) => arg.includes("ENVTESTVALUE")) &&
-      !isApprovedEnvironmentPredicate(unwrapStaticCommand(words))
-    )
-      return true;
-  }
   for (const words of parsed.pipelines.flat()) {
     if (!words.some((arg) => arg.includes("UNKNOWNVALUE"))) continue;
     if (words.some((arg) => arg.includes("UNKNOWNVALUEUNQUOTED"))) return true;
@@ -2623,17 +2765,18 @@ function hasEnvironmentVariableExpansionRead(
     )
       return true;
   }
-  if (!localMaterialized.includes("ENVVALUE") && !localMaterialized.includes("ENVTESTVALUE")) {
-    return (
+  if (!localMaterialized.includes("ENVVALUE")) {
+    const blocked =
       hasSensitiveFileRead(localMaterialized, isPathBlocked) ||
       hasSensitivePathRedirect(localMaterialized, isPathBlocked) ||
-      hasEnvironmentRead(localMaterialized, allowedNames)
-    );
+      hasEnvironmentRead(localMaterialized, allowedNames);
+    if (!blocked && statusCaptures.size) onProvedStatus?.(localMaterialized);
+    return blocked;
   }
 
   for (const [index, pipeline] of parsed.pipelines.entries()) {
     const hasEnvironmentValue = pipeline.some((argv) =>
-      argv.some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE")),
+      argv.some((arg) => arg.includes("ENVVALUE")),
     );
     if (!hasEnvironmentValue) continue;
     if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
@@ -2641,12 +2784,8 @@ function hasEnvironmentVariableExpansionRead(
       pipeline.some((argv) => {
         const unwrapped = unwrapStaticCommand(argv);
         const name = unwrapped[0]?.split("/").at(-1) ?? "";
-        if (argv.some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE"))) {
-          if (
-            argv
-              .slice(0, argv.length - unwrapped.length)
-              .some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE"))
-          )
+        if (argv.some((arg) => arg.includes("ENVVALUE"))) {
+          if (argv.slice(0, argv.length - unwrapped.length).some((arg) => arg.includes("ENVVALUE")))
             return true;
           if (isApprovedEnvironmentPredicate(unwrapped)) return false;
           if (isNavigationOperand(unwrapped, "ENVVALUE")) {
@@ -2668,11 +2807,10 @@ function hasEnvironmentVariableExpansionRead(
       return true;
     }
   }
-  const materialized = [...localValues].reduce(
-    (text, [marker, value]) => text.replaceAll(marker, () => value),
-    normalized.replaceAll("ENVVALUE", "SAFEENVVALUE"),
-  );
-  return hasSensitiveFileRead(materialized, isPathBlocked);
+  const materialized = normalized.replaceAll("ENVVALUE", "SAFEENVVALUE");
+  const blocked = hasSensitiveFileRead(materialized, isPathBlocked);
+  if (!blocked && statusCaptures.size) onProvedStatus?.(materialized);
+  return blocked;
 }
 
 /** Quoted approved metadata can be compared or checked for blankness, never evaluated. */
@@ -2682,7 +2820,7 @@ function isApprovedEnvironmentPredicate(argv: string[]): boolean {
     if (args.at(-1) !== "]") return false;
     args = args.slice(0, -1);
   } else if (argv[0] !== "test") return false;
-  const value = (arg: string | undefined) => arg === "ENVVALUE" || arg === "ENVTESTVALUE";
+  const value = (arg: string | undefined) => arg === "ENVVALUE";
   const literal = (arg: string | undefined) =>
     /^[A-Za-z0-9_.:-]*$/.test(arg ?? "") && arg !== undefined;
   return (
@@ -3010,16 +3148,24 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
       hasSensitivePathRedirect(command, isPathBlocked)
     )
       return "blocked by the file-access policy; a sensitive path matched or this command form could not be verified";
+    let environmentCommand = command;
     if (
       !isLiteralTextWrite(command) &&
-      hasEnvironmentVariableExpansionRead(command, allowedEnvironmentVariables, isPathBlocked)
+      hasEnvironmentVariableExpansionRead(
+        command,
+        allowedEnvironmentVariables,
+        isPathBlocked,
+        (proved) => {
+          environmentCommand = proved;
+        },
+      )
     ) {
       return "expands an unapproved or executable environment variable value";
     }
     if (
       hasEnvironmentSourceAccess(command, rawEnvironmentSource, allowedEnvironmentVariables) ||
       hasEnvironmentRead(
-        command,
+        environmentCommand,
         allowedEnvironmentVariables,
         allowPackageInventory,
         shellBodies.filter((body) => {