@blogic-cz/agent-tools 1.6.11 → 1.6.13

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA2uFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4VrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAjnGD,SAAS,UAAU,UAAU,KAAK,IAinGM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAnnGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAmnGjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aArnGE,MAAM,KAAK,OAqnGgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAvnGE,MAAM,KAAK,OAunGgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAznGC,MAAM,KAAK,OAynG0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA3nGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA2nGf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA7nGC,MAAM,KAAK,OA6nGsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA/nGC,MAAM,KAAK,MAAM,GAAG,IA+nGa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA66FF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA+XrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAt1GD,SAAS,UAAU,UAAU,KAAK,IAs1GM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAx1GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAw1GjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA11GE,MAAM,KAAK,OA01GgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA51GE,MAAM,KAAK,OA41GgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA91GC,MAAM,KAAK,OA81G0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAh2GC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAg2Gf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAl2GC,MAAM,KAAK,OAk2GsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAp2GC,MAAM,KAAK,MAAM,GAAG,IAo2Ga,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.11",
+  "version": "1.6.13",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -226,11 +226,13 @@ function isSafeHerdrTabCreate(argv: string[]): boolean {
 function hasSafeLocalAssignmentCommands(
   command: string,
   assignments: Map<string, { value: string; end: number }>,
+  statusCaptures: Set<string>,
 ): boolean {
   if (!assignments.size) return true;
   const parsed = parseStaticShellCommands(command);
   if (!parsed || typeof parsed === "string") return false;
   return parsed.pipelines.flat().every((words) => {
+    if (words.length === 1 && statusCaptures.has(words[0] ?? "")) return true;
     const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./-]+)$/.exec(words[0] ?? "");
     if (assignment) {
       return (
@@ -420,6 +422,7 @@ function literalBindingText(
   command: string,
   name: string,
   value: string,
+  allowBrackets = false,
 ): { text: string; syntax: string } | undefined {
   let text = "";
   let syntax = "";
@@ -451,7 +454,11 @@ function literalBindingText(
       syntax += quote ? " ".repeat(value.length) : value;
       i += match[0].length - 1;
     } else {
-      if (char === "`" || (!quote && /[(){}*?[\]#]/.test(char))) return undefined;
+      if (
+        char === "`" ||
+        (!quote && (/[(){}*?#]/.test(char) || (!allowBrackets && (char === "[" || char === "]"))))
+      )
+        return undefined;
       text += char;
       syntax += quote ? " " : char;
     }
@@ -606,24 +613,45 @@ function literalShellBodies(command: string): string[] | undefined {
   return bodies;
 }
 
-function isProvedLiteralShellBody(body: string): boolean {
+function isProvedLiteralShellBody(
+  body: string,
+  allowedNames: Set<string>,
+  isPathBlocked: (path: string) => boolean,
+  onProvedPredicate: () => void,
+): boolean {
   if (!body.trim()) return true;
   const materialized = materializeLiteralShell(body)?.command ?? body;
   const parsed = parseStaticShellCommands(materialized);
-  if (!parsed || typeof parsed === "string" || !hasProvedNavigationSequence(materialized))
-    return false;
+  if (!parsed || typeof parsed === "string") {
+    let proved = false;
+    if (
+      hasEnvironmentVariableExpansionRead(body, allowedNames, isPathBlocked, undefined, () => {
+        proved = true;
+      }) ||
+      !proved
+    )
+      return false;
+    onProvedPredicate();
+    return true;
+  }
+  if (!hasProvedNavigationSequence(materialized)) return false;
   if (isStaticHerdrPrompt(materialized)) return true;
   return parsed.pipelines.flat().every((words) => {
     const argv = unwrapProofCommand(words, "\0");
     if (!argv) return false;
     if (argv[0]?.split("/").at(-1) === "env") return false;
     const name = unwrapStaticCommand(argv)[0]?.split("/").at(-1) ?? "";
-    if (isShellWord(name))
+    if (isShellWord(name)) {
+      const nested = literalShellBodies(
+        words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
+      );
       return (
-        literalShellBodies(
-          words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
-        ) !== undefined
+        nested !== undefined &&
+        nested.every((inner) =>
+          isProvedLiteralShellBody(inner, allowedNames, isPathBlocked, onProvedPredicate),
+        )
       );
+    }
     return (
       isProvedCwdSubprocessRole(unwrapStaticCommand(argv)) ||
       (name === "bun" && isSafeLocalAssignmentCommand(argv) && !isUnsupportedInlineRuntime(argv)) ||
@@ -1890,6 +1918,37 @@ function isStaticNavigationCommand(argv: string[]): boolean {
   );
 }
 
+/** Literal wrappers and exact directory-operation roles; unknown consumers keep refusal. */
+function isProvedDirectoryCommand(words: string[]): boolean {
+  const argv = unwrapStaticCommand(words);
+  if (
+    !words
+      .slice(0, words.length - argv.length)
+      .every((word) => ["rtk", "proxy", "command", "--"].includes(word))
+  )
+    return false;
+  if (argv[0] === "cd") return isStaticNavigationCommand(argv);
+  if (argv[0] !== "git") return false;
+  let index = 1;
+  while (argv[index] === "-C") {
+    if (!isStaticNavigationCommand(["cd", argv[index + 1] ?? ""])) return false;
+    index += 2;
+  }
+  const args = argv.slice(index);
+  if (args[0] === "status")
+    return args.length === 1 || (args.length === 2 && args[1] === "--short");
+  if (args[0] === "fetch")
+    return (
+      args.length >= 2 &&
+      args.length <= 3 &&
+      args.slice(1).every((arg) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*$/.test(arg))
+    );
+  return (
+    (args.length === 2 && args[0] === "rev-parse" && args[1] === "HEAD") ||
+    (args.length === 3 && args[0] === "rev-list" && args[1] === "--count" && args[2] === "HEAD")
+  );
+}
+
 /** Prove a single cd whose uses are gated on success, without simulating shell state. */
 function hasProvedNavigationSequence(command: string): boolean {
   const literal = literalBindingText(command, "", "");
@@ -2279,6 +2338,7 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
   if (parsed && parsed !== "brace-expansion") {
     let directory = "";
     const trackDirectory = hasProvedNavigationSequence(command);
+    const safeDirectorySequence = parsed.pipelines.flat().every(isProvedDirectoryCommand);
     return parsed.pipelines.flat().some((words) => {
       const argv = unwrapStaticCommand(words);
       const inspectedArgv =
@@ -2291,19 +2351,36 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
         path.startsWith("/") ? posix.normalize(path) : posix.join(commandDirectory, path);
       const blockedOperand = (path: string) =>
         [path, inDirectory(path)].some((value) => isPathBlocked(value) || isSensitivePath(value));
-      const blockedDirectory = (path: string) => blockedOperand(path) || blockedOperand(path + "/");
+      // Directory slots use path policies, not the broad credential-file name heuristic.
+      const blockedDirectory = (path: string) =>
+        [path, inDirectory(path)].some(
+          (value) => isPathBlocked(value) || isPathBlocked(value + "/"),
+        );
       if (name === "cd") {
         const path = inspected[inspected[1] === "--" ? 2 : 1];
         if (path === undefined) return false;
         if (blockedDirectory(path)) return true;
+        // A successful cd alone proves neither its later readers nor pipeline consumers safe.
+        if (
+          (!trackDirectory || !safeDirectorySequence) &&
+          (blockedOperand(path) || blockedOperand(path + "/"))
+        )
+          return true;
         if (trackDirectory && isStaticNavigationCommand(inspected)) directory = inDirectory(path);
         return false;
       }
       if (name === "git") {
         let index = 1;
         while (inspected[index] === "-C" && inspected[index + 1]) {
-          if (blockedDirectory(inspected[index + 1] ?? "")) return true;
-          commandDirectory = inDirectory(inspected[index + 1] ?? "");
+          const path = inspected[index + 1] ?? "";
+          if (blockedDirectory(path)) return true;
+          // Git -C affects this command only; following consumers keep the shell directory.
+          if (
+            !isProvedDirectoryCommand(words) &&
+            (blockedOperand(path) || blockedOperand(path + "/"))
+          )
+            return true;
+          commandDirectory = inDirectory(path);
           index += 2;
         }
         // Git grep has the same pattern-versus-file roles as grep below.
@@ -2483,7 +2560,10 @@ function hasEnvironmentVariableExpansionRead(
   command: string,
   allowedNames: Set<string>,
   isPathBlocked: (path: string) => boolean,
+  onProvedStatus?: (command: string) => void,
+  onProvedPredicate?: () => void,
 ): boolean {
+  const originalCommand = command;
   let heredoc = boundedHeredoc(command);
   while (heredoc) {
     // In an unquoted heredoc, # and quote characters are data, not shell syntax.
@@ -2492,10 +2572,18 @@ function hasEnvironmentVariableExpansionRead(
     heredoc = boundedHeredoc(command);
   }
   if (!command.includes("$") && !command.includes("`")) return false;
+  let predicateSyntaxIntact = command === originalCommand;
   let invalidExpansion = false;
   const assignments = getLeadingLiteralAssignments(command);
-  const localValues = new Map<string, string>();
   let localIndex = 0;
+  const directCaptures = new Map<string, string>();
+  const statusReferences = new Map<string, { name: string; fallback: string }>();
+  const marker = (prefix: string): string => {
+    let value: string;
+    do value = `${prefix}${localIndex++}END`;
+    while (command.includes(value));
+    return value;
+  };
   let expansions = 0;
   let normalized = "";
   let quote: "'" | '"' | undefined;
@@ -2503,6 +2591,7 @@ function hasEnvironmentVariableExpansionRead(
   for (let i = 0; i < command.length; i++) {
     const char = command[i] ?? "";
     if (!quote && char === "#" && !wordStarted) {
+      predicateSyntaxIntact = false;
       while (i + 1 < command.length && command[i + 1] !== "\n") i++;
       continue;
     }
@@ -2534,7 +2623,18 @@ function hasEnvironmentVariableExpansionRead(
     }
     if (command[i + 1] === "?") {
       expansions++;
-      normalized += "NUMERICSTATUSVALUE";
+      const value = marker("NUMERICSTATUSVALUE");
+      // Only an exact standalone assignment token captures in the parent shell.
+      // Quoting/escaping the name can instead produce an executable command word.
+      const capture = /(?:^|[;\n])[ \t]*([A-Za-z_][A-Za-z0-9_]*)=("?)$/.exec(command.slice(0, i));
+      const ending = capture?.[2] === '"' ? '"' : "";
+      if (
+        capture &&
+        command.slice(i + 2).startsWith(ending) &&
+        /^[ \t]*(?:[;\n]|$)/.test(command.slice(i + 2 + ending.length))
+      )
+        directCaptures.set(value, capture[1] ?? "");
+      normalized += value;
       i++;
       continue;
     }
@@ -2558,26 +2658,101 @@ function hasEnvironmentVariableExpansionRead(
     }
     const assignment = assignments.get(name);
     if (assignment && assignment.end >= i) invalidExpansion = true;
-    if (assignment && assignment.end < i) {
-      const marker = `LOCALVALUE${localIndex++}`;
-      localValues.set(marker, assignment.value);
-      normalized += marker;
-    } else if (allowedNames.has(name)) {
-      normalized += quote ? "ENVVALUE" : "ENVVALUEUNQUOTED";
-    } else {
-      normalized += quote ? "UNKNOWNVALUE" : "UNKNOWNVALUEUNQUOTED";
-    }
+    const reference = marker("STATUSREFERENCE");
+    const fallback =
+      assignment && assignment.end < i
+        ? assignment.value
+        : allowedNames.has(name)
+          ? quote
+            ? "ENVVALUE"
+            : "ENVVALUEUNQUOTED"
+          : quote
+            ? "UNKNOWNVALUE"
+            : "UNKNOWNVALUEUNQUOTED";
+    statusReferences.set(reference, { name, fallback });
+    normalized += reference;
     i += variable[0].length - 1;
   }
   if (!expansions) return invalidExpansion;
   if (invalidExpansion) return true;
 
-  const localMaterialized = [...localValues].reduce(
-    (text, [marker, value]) => text.replaceAll(marker, () => value),
-    normalized,
-  );
+  // Resolve every reference at its command position; a later capture cannot prove
+  // an earlier read, and only proved passive intermediates preserve the binding.
+  const initial = parseStaticShellCommands(normalized);
+  if (!initial || typeof initial === "string") return true;
+  const captures = new Map<string, string>();
+  for (const words of initial.pipelines.flat()) {
+    const capture = /^([A-Za-z_][A-Za-z0-9_]*)=(.+)$/.exec(words[0] ?? "");
+    if (capture && directCaptures.get(capture[2] ?? "") === capture[1])
+      captures.set(words[0] ?? "", capture[1] ?? "");
+  }
+  const statusCaptures = new Set<string>();
+  const localStatuses = new Set<string>();
+  const resolutions = new Map<string, string>();
+  const capturedNames = new Set(captures.values());
+  const bound = new Set<string>();
+  if (captures.size) {
+    const syntax = literalBindingText(normalized, "", "")?.syntax;
+    if (syntax === undefined || /&&|\|\||&/.test(syntax.replace(/[<>]&[0-9-]+/g, ""))) return true;
+  }
+  for (const [index, pipeline] of initial.pipelines.entries()) {
+    for (const words of pipeline) {
+      for (const arg of words) {
+        for (const [reference, { name, fallback }] of statusReferences) {
+          if (!arg.includes(reference)) continue;
+          if (bound.has(name)) {
+            const value = marker("NUMERICSTATUSVALUE");
+            localStatuses.add(value);
+            resolutions.set(reference, value);
+          } else {
+            if (capturedNames.has(name)) return true;
+            resolutions.set(reference, fallback);
+          }
+        }
+      }
+      const capture = captures.get(words[0] ?? "");
+      if (capture) {
+        if (
+          pipeline.length !== 1 ||
+          words.length !== 1 ||
+          initial.redirects.some((redirect) => redirect.pipeline === index) ||
+          // Inherited export attributes can make a numeric value select code or paths.
+          /^(?:LD_|DYLD_|_RLD_|LDR_|GIT_CONFIG_(?:KEY|VALUE)_)/.test(capture) ||
+          /^(?:PATH|IFS|CDPATH|BASH_ENV|ENV|FPATH|ZDOTDIR|SHELLOPTS|BASHOPTS|PROMPT_COMMAND|PS[0-4]|GLOBIGNORE|RANDOM|SECONDS|PIPESTATUS|UID|EUID|BASH_XTRACEFD|HOME|XDG_CONFIG_HOME|LIBPATH|SHLIB_PATH|NODE_OPTIONS|NODE_PATH|BUN_OPTIONS|BUN_PRELOAD|PYTHONPATH|PYTHONSTARTUP|PYTHONHOME|RUBYOPT|RUBYLIB|GEM_HOME|GEM_PATH|PERL5OPT|PERL5LIB|PERLLIB|JAVA_TOOL_OPTIONS|JDK_JAVA_OPTIONS|CLASSPATH|_JAVA_OPTIONS|JAVA_HOME|GIT_SSH_COMMAND|GIT_SSH|GIT_PROXY_COMMAND|GIT_EXEC_PATH|GIT_CONFIG|GIT_CONFIG_GLOBAL|GIT_CONFIG_SYSTEM|GIT_CONFIG_PARAMETERS|GIT_CONFIG_COUNT|GIT_ASKPASS|SSH_ASKPASS|GIT_EDITOR|GIT_SEQUENCE_EDITOR|GIT_PAGER|PAGER|EDITOR|VISUAL)$/.test(
+            capture,
+          )
+        )
+          return true;
+        bound.add(capture);
+        statusCaptures.add(words[0] ?? "");
+        continue;
+      }
+      const argv = unwrapStaticCommand(words);
+      const name = argv[0]?.split("/").at(-1) ?? "";
+      if (
+        captures.size &&
+        /^(?:alias|unalias|readonly|declare|typeset|local|export|eval|source|\.|trap|set|read|unset|let)$/.test(
+          name,
+        )
+      )
+        return true;
+      if (!isPassiveTextCommand(argv) && name !== "cat") bound.clear();
+    }
+    for (const redirect of initial.redirects.filter((value) => value.pipeline === index)) {
+      if (
+        [...statusReferences].some(
+          ([reference, { name }]) => capturedNames.has(name) && redirect.target.includes(reference),
+        )
+      )
+        return true;
+    }
+  }
+  for (const [reference, { fallback }] of statusReferences) {
+    normalized = normalized.replaceAll(reference, () => resolutions.get(reference) ?? fallback);
+  }
+  const localMaterialized = normalized;
   // Options must be checked after local literals become actual argv, never as placeholders.
-  if (!hasSafeLocalAssignmentCommands(localMaterialized, assignments)) return true;
+  if (!hasSafeLocalAssignmentCommands(localMaterialized, assignments, statusCaptures)) return true;
   const parsed = parseStaticShellCommands(localMaterialized);
   if (!parsed || typeof parsed === "string") return true;
   for (const [index, pipeline] of parsed.pipelines.entries()) {
@@ -2586,6 +2761,7 @@ function hasEnvironmentVariableExpansionRead(
     if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
     if (
       pipeline.some((words) => {
+        if (words.length === 1 && statusCaptures.has(words[0] ?? "")) return false;
         const argv = unwrapStaticCommand(words);
         if (!words.some((arg) => arg.includes("NUMERICSTATUSVALUE")))
           return !isPassiveTextCommand(argv);
@@ -2594,6 +2770,9 @@ function hasEnvironmentVariableExpansionRead(
         return (
           !["echo", "printf"].includes(name ?? "") ||
           !isPassiveTextCommand(argv) ||
+          argv.some(
+            (arg) => arg.startsWith("-") && [...localStatuses].some((value) => arg.includes(value)),
+          ) ||
           words
             .slice(0, words.length - argv.length)
             .some((arg) => arg.includes("NUMERICSTATUSVALUE")) ||
@@ -2617,11 +2796,12 @@ function hasEnvironmentVariableExpansionRead(
       return true;
   }
   if (!localMaterialized.includes("ENVVALUE")) {
-    return (
+    const blocked =
       hasSensitiveFileRead(localMaterialized, isPathBlocked) ||
       hasSensitivePathRedirect(localMaterialized, isPathBlocked) ||
-      hasEnvironmentRead(localMaterialized, allowedNames)
-    );
+      hasEnvironmentRead(localMaterialized, allowedNames);
+    if (!blocked && statusCaptures.size) onProvedStatus?.(localMaterialized);
+    return blocked;
   }
 
   for (const [index, pipeline] of parsed.pipelines.entries()) {
@@ -2657,11 +2837,25 @@ function hasEnvironmentVariableExpansionRead(
       return true;
     }
   }
-  const materialized = [...localValues].reduce(
-    (text, [marker, value]) => text.replaceAll(marker, () => value),
-    normalized.replaceAll("ENVVALUE", "SAFEENVVALUE"),
-  );
-  return hasSensitiveFileRead(materialized, isPathBlocked);
+  const materialized = normalized.replaceAll("ENVVALUE", "SAFEENVVALUE");
+  const blocked = hasSensitiveFileRead(materialized, isPathBlocked);
+  if (!blocked && statusCaptures.size) onProvedStatus?.(materialized);
+  // This is a complete command proof, not merely a recursively safe shell body.
+  if (
+    !blocked &&
+    parsed.pipelines.length === 1 &&
+    parsed.pipelines[0]?.length === 1 &&
+    !parsed.redirects.length
+  ) {
+    const argv = unwrapProofCommand(parsed.pipelines[0]?.[0] ?? [], "ENVVALUE");
+    if (argv && isApprovedEnvironmentPredicate(argv) && predicateSyntaxIntact) {
+      // Roles alone cannot prove original shell boundaries or discarded controls.
+      // Brackets are enabled only for the completely proved bracket builtin.
+      const binding = literalBindingText(normalized, "", "", argv[0] === "[");
+      if (binding && !/[;&|<>\r\n]/.test(binding.syntax.trim())) onProvedPredicate?.();
+    }
+  }
+  return blocked;
 }
 
 /** Quoted approved metadata can be compared or checked for blankness, never evaluated. */
@@ -2971,11 +3165,37 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     const shellBodies = literalShellBodies(command);
     if (!shellBodies || (shellBodies.length && shellDepth >= 8))
       return "cannot prove a bounded literal shell invocation";
+    const provedPredicateShellBodies: string[] = [];
     for (const body of shellBodies) {
       const reason = getDangerousBashReason(body, shellDepth + 1);
       if (reason || getBlockedCliTool(body, true, shellDepth + 1))
         return reason ?? "invokes a blocked CLI from a shell body";
-      if (!isProvedLiteralShellBody(body)) return "cannot prove a closed literal shell body";
+      if (
+        !isProvedLiteralShellBody(body, allowedEnvironmentVariables, isPathBlocked, () => {
+          provedPredicateShellBodies.push(body);
+        })
+      )
+        return "cannot prove a closed literal shell body";
+    }
+    if (provedPredicateShellBodies.length) {
+      const context = parseStaticShellCommands(command);
+      const binding = literalBindingText(command, "", "");
+      const argv =
+        context && typeof context !== "string"
+          ? unwrapProofCommand(context.pipelines[0]?.[0] ?? [], "\0")
+          : undefined;
+      if (
+        !context ||
+        typeof context === "string" ||
+        context.pipelines.length !== 1 ||
+        context.pipelines[0]?.length !== 1 ||
+        context.redirects.length !== 0 ||
+        !binding ||
+        /[;&|<>\r\n]/.test(binding.syntax.trim()) ||
+        !argv ||
+        !SHELL_IDENTITIES.has(argv[0] ?? "")
+      )
+        return "cannot prove a single literal shell predicate invocation";
     }
     const proof = materializeLiteralShell(command);
     if (!proof && /^\s*for\b/.test(command)) return "cannot prove a bounded literal shell loop";
@@ -2999,19 +3219,28 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
       hasSensitivePathRedirect(command, isPathBlocked)
     )
       return "blocked by the file-access policy; a sensitive path matched or this command form could not be verified";
+    let environmentCommand = command;
     if (
       !isLiteralTextWrite(command) &&
-      hasEnvironmentVariableExpansionRead(command, allowedEnvironmentVariables, isPathBlocked)
+      hasEnvironmentVariableExpansionRead(
+        command,
+        allowedEnvironmentVariables,
+        isPathBlocked,
+        (proved) => {
+          environmentCommand = proved;
+        },
+      )
     ) {
       return "expands an unapproved or executable environment variable value";
     }
     if (
       hasEnvironmentSourceAccess(command, rawEnvironmentSource, allowedEnvironmentVariables) ||
       hasEnvironmentRead(
-        command,
+        environmentCommand,
         allowedEnvironmentVariables,
         allowPackageInventory,
         shellBodies.filter((body) => {
+          if (provedPredicateShellBodies.includes(body)) return true;
           const parsed = parseStaticShellCommands(body);
           return (
             parsed &&