@blogic-cz/agent-tools 1.6.2 → 1.6.4

package/README.md

@@ -656,6 +656,8 @@ Ordinary navigation operands such as `cd "$HOME"` and `git -C "$WORKTREE_ROOT" s
 
 Literal `herdr agent prompt` commands can be composed with independent `cat` readers and passive text pipelines. Prompt text stays data; command substitutions, environment mutation, unknown consumers, and executable pipelines cannot establish the proof. All reader operands and redirects still receive the ordinary sensitive-path checks. Literal loops also support `herdr pane read ID --source recent-unwrapped --lines N`, with the binder restricted to `ID`, and `2>&1` file-descriptor duplication. A bounded Python stdin processor supports only `import json,sys; d=json.load(sys.stdin); print(d["result"].get("text","") if isinstance(d.get("result"),dict) else d)`, including insignificant spacing and single lowercase-letter local renaming. Extra imports, statements, calls, runtime options, arguments, and other Python programs cannot establish this loop proof. The existing loop size and command limits apply.
 
+Prompt composition also supports one `cd [--] PATH` with a literal relative or absolute directory at the start of the final `&&` chain. All subsequent inspection must remain in that chain, so a failed `cd` cannot reach its readers. Directory names may contain quoted spaces. Multiple `cd` commands, later `;` or newline boundaries, tilde or variable expansion, other `cd` options, background jobs, `||`, and navigation in pipelines remain unproved. Supported Git inspection can use literal `-C PATH` prefixes with `grep`, `status`, `rev-parse`, or `rev-list`; execution and startup options remain unsupported. Navigation composition refuses relative file redirects, including redirects on `cd` and Git commands, because those use the shell directory before the command runs. Absolute redirects still receive ordinary path checks. Named directories receive sensitive-path checks with directory-prefix semantics. Only a proved `cd` chain qualifies relative reader operands with that directory; Git `-C` qualifies that command's file operands without changing shell state. Git grep uses the shared grep pattern-versus-file checks. This checks textual operands and does not resolve aliases, symlinks, ambient directories, or command lookup.
+
 The guard recognizes `rtk`, `rtk proxy`, `command`, and supported `env` prefixes and checks commands in pipelines and chains. Quoted filenames, comments, and redirects retain sensitive-path checks. Jq object selectors and inline awk programs qualify only when their actual program and options establish passive behavior. Literal environment-command text in `rg`, `grep`, `git grep`, `echo`, and `printf` is allowed only with supported command roles and passive pipeline consumers. Environment-source evidence and startup identity checks also apply to the complete original invocation. Custom dangerous-command patterns apply to both the original input and proved expansions.
 
 Paths are checked against sensitive filename patterns and configured path rules. Supported proofs apply those checks to their expanded operands. Ordinary parent-directory and absolute paths may be allowed; the guard does not resolve filesystem paths or symlinks, or enforce repository confinement.
@@ -666,6 +668,10 @@ Single literal `echo`/`printf` writes with output redirection and single `cat`/`
 
 Python JSON parsing, dictionary iteration, and printing are not themselves evidence of credential access. They follow the same access and execution rules as other supported inline programs. This intentionally permits ordinary JSON output that older versions refused. Unknown secrets in ordinary files can therefore reach arbitrary shell output; wrapper content checks do not protect that output. A refusal caused by unsupported syntax means the guard could not establish its policy conditions, not that it observed a secret being read.
 
+The bounded Python subprocess proof supports one immutable literal argv binding followed by one `subprocess.run` call. A literal `cwd` is replayed as a quoted, success-gated directory change before the nested argv, so relative reader operands and named directories receive the ordinary path policies. Supported directories are literal relative or absolute paths, including quoted spaces. Empty, dynamic, Unicode, escaped, tilde and other unsupported directory forms refuse rather than dropping the context. Cwd proof recursively unwraps only supported command, RTK proxy and environment wrappers. Environment directory/split-string options and unproved wrapper forms refuse. Only supported passive text, reader, metadata, literal Bun script and blocked CLI roles receive nested replay; shell executors, inline interpreter programs, unproved sed programs, find execution actions and unknown command roles refuse. Nested blocked CLI, environment, sensitive-path and custom-command policies remain active. Outer shell redirects retain their original shell directory. Arbitrary multi-call Python and `check_output` programs remain unsupported; direct Git metadata commands provide index/tree inspection.
+
+Supported runtime script/tool operands form an argument boundary: a later tool `-c` configuration flag is data. Genuine eval and loader flags, Bun exec/repl and unproved startup-option arity still refuse. Literal Herdr prompts can compose with the existing literal agent-get and pane-read forms and passive consumers. One literal `--sql` operand on the supported `bun run db-tool sql/query` shape can contain SQL braces; substitutions, duplicate SQL operands and unknown wrapper options receive no exception. SQL output pipelines require closed passive consumers, so shell, xargs and unknown executors refuse. Numeric `$?` can appear only in passive echo/printf data operands, with passive pipeline consumers. Explicitly approved environment names can appear in quoted equality or blankness tests, including the quoted empty default `${NAME:-}`. This does not add default-approved names or permit shell evaluators. One sed print program with numeric or escaped-regex addresses/ranges and known `-n`/`-E` flags is passive; execution/read/write callbacks, extra programs and script files receive no print proof. Local file bindings use that same closed print proof and never a generic sed-word fallback. Ordinary path and configured command policies still apply to all these forms.
+
 A separate bounded Node proof supports literal `package.json` inventory loops that print `bin` metadata or use the supported scripts filter. The complete invocation must preserve loader identity through known passive commands, closed literal writers, or proved inventories. Startup/environment mutations, unknown commands, loader changes, and other dynamic loading remain unproved and are refused.
 
 ### Setup for OpenCode

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA6tEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAnkFD,SAAS,UAAU,UAAU,KAAK,IAmkFM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YArkFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAqkFjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAvkFE,MAAM,KAAK,OAukFgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAzkFE,MAAM,KAAK,OAykFgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA3kFC,MAAM,KAAK,OA2kF0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA7kFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA6kFf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA/kFC,MAAM,KAAK,OA+kFsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAjlFC,MAAM,KAAK,MAAM,GAAG,IAilFa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAwhFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA93FD,SAAS,UAAU,UAAU,KAAK,IA83FM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAh4FC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAg4FjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAl4FE,MAAM,KAAK,OAk4FgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAp4FE,MAAM,KAAK,OAo4FgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAt4FC,MAAM,KAAK,OAs4F0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAx4FC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAw4Ff,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA14FC,MAAM,KAAK,OA04FsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA54FC,MAAM,KAAK,MAAM,GAAG,IA44Fa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -262,21 +262,12 @@ function isSafeLocalAssignmentCommand(words: string[]): boolean {
     return !argv.slice(1).some((arg) => /^-(?:exec|ok|delete|fprint|fprintf)/.test(arg));
   }
   if (name === "bun") return argv[1] === "run" && ["db-tool", "gh-tool"].includes(argv[2] ?? "");
+  if (name === "sed") return isReadonlySedPrint(argv);
   return (
     isPassiveTextCommand(argv) ||
     ["ls", "cat", "tail", "wc", "uniq", "cut", "mv"].includes(name) ||
     (name === "sort" &&
-      !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from", "output"], "o")) ||
-    (name === "sed" &&
-      argv
-        .slice(1)
-        .every(
-          (arg) =>
-            /^-[En]+$/.test(arg) ||
-            /^s([/|]).*\1[^/|]*\1[gp]*$/.test(arg) ||
-            /^[A-Za-z0-9_./-]+$/.test(arg),
-        ) &&
-      !argv.includes("-f"))
+      !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from", "output"], "o"))
   );
 }
 
@@ -502,13 +493,7 @@ function isLiteralLoopCommand(words: string[], marker: string, value: string): b
     const format = passivePrintfFormatIndex(argv);
     return format !== undefined && uses.every((index) => index > format);
   }
-  if (name === "herdr")
-    return (
-      ((argv.length === 4 && argv[1] === "agent" && argv[2] === "get") ||
-        isLiteralHerdrPaneRead(argv)) &&
-      /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "") &&
-      uses.every((index) => index === 3)
-    );
+  if (name === "herdr") return isLiteralHerdrRead(argv) && uses.every((index) => index === 3);
   if (name === "bun")
     return (
       argv.length === 9 &&
@@ -537,6 +522,14 @@ function isLiteralHerdrPaneRead(argv: string[]): boolean {
   );
 }
 
+function isLiteralHerdrRead(argv: string[]): boolean {
+  return (
+    ((argv.length === 4 && argv.slice(0, 3).join(" ") === "herdr agent get") ||
+      isLiteralHerdrPaneRead(argv)) &&
+    /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "")
+  );
+}
+
 /** A complete stdin-only JSON projection, with no suffix, imports or executable input. */
 function isLiteralStdinJsonDisplay(argv: string[]): boolean {
   if (argv.length !== 3 || !["python", "python3"].includes(argv[0] ?? "") || argv[1] !== "-c")
@@ -852,15 +845,54 @@ function inlineProgramIndex(argv: string[]): number | undefined {
 }
 
 function isUnsupportedInlineRuntime(argv: string[]): boolean {
-  if (!inlineRuntimeKind(argv[0])) return false;
+  const runtime = inlineRuntimeKind(argv[0]);
+  if (!runtime) return false;
   if (inlineProgramIndex(argv) !== undefined) return false;
-  return argv
-    .slice(1)
-    .some((arg) =>
+  let index = 1;
+  for (; index < argv.length; index++) {
+    const arg = argv[index] ?? "";
+    if (arg === "--" || !arg.startsWith("-")) break;
+    if (
       /^(?:-[A-Za-z]*[cep]|-[rmp]|--(?:eval|print|require|import|loader|preload|experimental-loader))(?:$|=|[^-])/.test(
         arg,
-      ),
-    );
+      )
+    )
+      return true;
+    if (
+      (runtime === "python" && arg === "--check-hash-based-pycs") ||
+      (runtime === "node" &&
+        ["--conditions", "-C", "--icu-data-dir", "--dns-result-order"].includes(arg))
+    ) {
+      if (argv[index + 1] === undefined) return true;
+      index++;
+      continue;
+    }
+    // Unknown startup-option arity cannot establish where the script/tool begins.
+    if (
+      !(
+        (runtime === "python" && /^-[uBISsEOqvV]+$/.test(arg)) ||
+        (runtime === "node" &&
+          /^(?:--(?:trace-warnings|no-warnings|version|help)|--(?:conditions|icu-data-dir|dns-result-order)=.+)$/.test(
+            arg,
+          )) ||
+        (runtime === "bun" && ["--no-env-file", "--version", "--help"].includes(arg)) ||
+        ["--version", "--help", "-h"].includes(arg)
+      )
+    )
+      return true;
+  }
+  if (runtime === "bun" && ["exec", "repl"].includes(argv[index] ?? "")) return true;
+  // Bun retains eval/loader controls around its tool operand; only a later -c is tool data.
+  return (
+    runtime === "bun" &&
+    argv
+      .slice(index)
+      .some((arg) =>
+        /^(?:-[A-Za-z]*[ep]|-[rmp]|--(?:eval|print|require|import|loader|preload|experimental-loader))(?:$|=|[^-])/.test(
+          arg,
+        ),
+      )
+  );
 }
 
 /** Move a complete, literal Python stdin program into the existing inline argv boundary. */
@@ -1045,7 +1077,64 @@ function staticSubprocessCommand(program: string): string | undefined {
     (match) => match[1] ?? match[2] ?? "",
   );
   if (!values.length) return undefined;
-  return values.map((value) => "'" + value.replaceAll("'", "'\"'\"'") + "'").join(" ");
+  const quote = (value: string) => "'" + value.replaceAll("'", "'\"'\"'") + "'";
+  const command = values.map(quote).join(" ");
+  const directories = [...call[0].matchAll(/\bcwd\s*=\s*(?:"([^"\\]*)"|'([^'\\]*)')/g)];
+  if (!directories.length) return command;
+  const cwd = directories[0]?.[1] ?? directories[0]?.[2] ?? "";
+  // Never replay a cwd-bearing call as if it ran in the original shell directory.
+  if (directories.length !== 1 || !isStaticNavigationCommand(["cd", "--", cwd])) return undefined;
+  const argv = unwrapCwdSubprocessCommand(values);
+  if (!argv || !isProvedCwdSubprocessRole(argv)) return undefined;
+  // Keep wrapper assignments/options in policy replay after proving the nested command role.
+  const replay = `cd -- ${quote(cwd)} && ${command}`;
+  return hasProvedNavigationSequence(replay) ? replay : undefined;
+}
+
+function unwrapCwdSubprocessCommand(words: string[]): string[] | undefined {
+  let argv = words;
+  // Each successful wrapper removes words; the original word count bounds recursion.
+  for (let depth = 0; depth < words.length; depth++) {
+    const unwrapped = unwrapProofCommand(argv, "\0");
+    if (!unwrapped) return undefined;
+    argv = unwrapped;
+    if (argv[0]?.split("/").at(-1) !== "env") return argv;
+    const nested = unwrapEnvironmentCommand(argv);
+    if (!nested) return undefined;
+    // Inspect only env's prefix, not options belonging to its child command.
+    // env directory, split-string and unknown options do not preserve the proved context.
+    if (
+      argv
+        .slice(1, argv.length - nested.length)
+        .some(
+          (arg) =>
+            arg.startsWith("-") && arg !== "--" && arg !== "-i" && arg !== "--ignore-environment",
+        )
+    )
+      return undefined;
+    argv = nested;
+  }
+  return undefined;
+}
+
+function isProvedCwdSubprocessRole(argv: string[]): boolean {
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (inlineProgramIndex(argv) !== undefined || isUnsupportedInlineRuntime(argv)) return false;
+  if (isPassiveTextCommand(argv)) return true;
+  if (name === "find") return isSafeLocalAssignmentCommand(argv);
+  if (["ls", "cat", "uniq", "cut"].includes(name)) return true;
+  if (name === "wc") return !hasExecutionOption(argv.slice(1), ["files0-from"]);
+  if (name === "sort")
+    return !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from"]);
+  if (name === "git") {
+    let index = 1;
+    while (argv[index] === "-C" && argv[index + 1]) index += 2;
+    return ["ls-files", "ls-tree", "status", "rev-parse", "rev-list"].includes(argv[index] ?? "");
+  }
+  // A literal Bun script keeps the existing supported test-runner route.
+  if (name === "bun") return /^[A-Za-z0-9_./-]+\.(?:[cm]?[jt]s)$/.test(argv[1] ?? "");
+  // Retain extraction so the nested CLI policy returns its ordinary descriptor.
+  return DEFAULT_BLOCKED_CLI_TOOLS.some((tool) => tool.name === name);
 }
 
 function inlineSubprocessCommands(command: string): string[] {
@@ -1207,6 +1296,9 @@ function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
     argv[4] === "query"
   )
     return false;
+  const sql = literalSqlArgumentIndex(argv);
+  if (sql !== undefined)
+    return argv.some((arg, index) => index !== sql && hasArgumentBraceExpansion(arg));
   return (argv[0]?.split("/").at(-1) === "awk" && !isAwkExecution(argv)) ||
     inlineProgramIndex(argv) !== undefined ||
     isJqObjectConstruction(argv)
@@ -1214,6 +1306,32 @@ function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
     : hasArgumentBraceExpansion(argv.join(" "));
 }
 
+function literalSqlArgumentIndex(argv: string[]): number | undefined {
+  if (
+    argv[0]?.split("/").at(-1) !== "bun" ||
+    argv[1] !== "run" ||
+    argv[2] !== "db-tool" ||
+    !["sql", "query"].includes(argv[3] ?? "")
+  )
+    return undefined;
+  let sql: number | undefined;
+  const seen = new Set<string>();
+  for (let index = 4; index < argv.length; index++) {
+    const [option = "", ...attached] = (argv[index] ?? "").split("=");
+    if (
+      !["--sql", "--env", "--profile", "--limit", "--format"].includes(option) ||
+      seen.has(option)
+    )
+      return undefined;
+    seen.add(option);
+    const value = attached.length ? attached.join("=") : argv[++index];
+    if (!value || value.startsWith("--")) return undefined;
+    if (option === "--sql") sql = index;
+    else if (!/^[A-Za-z0-9_./-]+$/.test(value)) return undefined;
+  }
+  return sql;
+}
+
 /** echo and printf print their arguments; grep -o, rg and git grep print matched pattern text. */
 function isLiteralTextProducer(argv: string[]): boolean {
   return isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head";
@@ -1548,6 +1666,57 @@ function isNavigationOperand(argv: string[], marker: string): boolean {
   );
 }
 
+/** Literal directory operands only; navigation is never a pipeline consumer. */
+function isStaticNavigationCommand(argv: string[]): boolean {
+  const path = (value: string | undefined) => /^[A-Za-z0-9_./][A-Za-z0-9_./ -]*$/.test(value ?? "");
+  if (argv[0] === "cd")
+    return isNavigationOperand(argv, "\0") && path(argv[argv[1] === "--" ? 2 : 1]);
+  if (argv[0] !== "git") return false;
+  let index = 1;
+  while (argv[index] === "-C") {
+    if (!path(argv[index + 1])) return false;
+    index += 2;
+  }
+  return (
+    isNavigationOperand(argv, "\0") ||
+    (index > 1 && isPassiveTextCommand(["git", ...argv.slice(index)]))
+  );
+}
+
+/** Prove a single cd whose uses are gated on success, without simulating shell state. */
+function hasProvedNavigationSequence(command: string): boolean {
+  const literal = literalBindingText(command, "", "");
+  const parsed = parseStaticShellCommands(command);
+  if (!literal || !parsed || typeof parsed === "string") return false;
+  const commands = parsed.pipelines.flat().map((words) => unwrapProofCommand(words, "\0"));
+  const changesDirectory = commands.filter((argv) => argv?.[0] === "cd");
+  if (
+    !commands.some((argv) => argv && (argv[0] === "cd" || (argv[0] === "git" && argv[1] === "-C")))
+  )
+    return true;
+  if (
+    /\|\||(^|[^&])&(?!&)/.test(literal.syntax.replace(/[<>]&[0-9-]+/g, "")) ||
+    parsed.redirects.some(({ target }) => !target.startsWith("/")) ||
+    changesDirectory.length > 1
+  )
+    return false;
+  if (!changesDirectory.length) return true;
+  // Only the final AND list can use this directory. A failing cd never reaches its readers.
+  // Trim real trailing whitespace, not the spaces masking final quoted argv words.
+  const syntax = literal.syntax.slice(0, command.replace(/[ \t\n]+$/g, "").length);
+  const boundary = Math.max(syntax.lastIndexOf(";"), syntax.lastIndexOf("\n"));
+  const tail = parseStaticShellCommands(command.slice(boundary + 1, syntax.length));
+  if (!tail || typeof tail === "string" || tail.pipelines.length < 2) return false;
+  const first = tail.pipelines[0];
+  const argv = unwrapProofCommand(first?.[0] ?? [], "\0");
+  return (
+    first?.length === 1 &&
+    argv?.[0] === "cd" &&
+    isStaticNavigationCommand(argv) &&
+    syntax.slice(boundary + 1).match(/&&|[;&|\n]/)?.[0] === "&&"
+  );
+}
+
 function isPassiveTextCommand(argv: string[]): boolean {
   const name = argv[0]?.split("/").at(-1) ?? "";
   const args = argv.slice(1);
@@ -1558,6 +1727,7 @@ function isPassiveTextCommand(argv: string[]): boolean {
   }
   if (name === "rg") return !hasExecutionOption(args, ["pre", "hostname-bin"]);
   if (name === "awk") return !isAwkExecution(argv);
+  if (name === "sed") return isReadonlySedPrint(argv);
   if (name === "jq") return isJqObjectConstruction(argv);
   return (
     (name === "git" && args[0] === "status") ||
@@ -1567,6 +1737,19 @@ function isPassiveTextCommand(argv: string[]): boolean {
   );
 }
 
+/** One print program with optional numeric or escaped-regex addresses; no callbacks. */
+function isReadonlySedPrint(argv: string[]): boolean {
+  if (argv[0]?.split("/").at(-1) !== "sed") return false;
+  let index = 1;
+  while (/^-[nE]+$/.test(argv[index] ?? "")) index++;
+  if (argv[index] === "--") index++;
+  const address = String.raw`(?:[0-9]+|\$|/(?:\\[^\r\n]|[^/\\\r\n])*/)`;
+  return (
+    new RegExp(`^(?:${address}(?:,${address})?)?p$`).test(argv[index] ?? "") &&
+    argv.slice(index + 1).every((arg) => !arg.startsWith("-"))
+  );
+}
+
 function hasStaticEnvironmentRead(
   argv: string[],
   allowedNames: Set<string>,
@@ -1627,13 +1810,15 @@ function hasStaticEnvironmentRead(
 
 function isStaticHerdrPrompt(command: string): boolean {
   // Preserve shell word boundaries and executable identity before proving composition.
-  if (!literalBindingText(command, "", "")) return false;
+  const literal = literalBindingText(command, "", "");
+  if (!literal) return false;
   const parsed = parseStaticShellCommands(command);
   if (!parsed || typeof parsed === "string") return false;
   const commands = parsed.pipelines.flat().map((words) => unwrapProofCommand(words, "\0"));
   const prompts = commands.filter(
     (argv) => argv?.[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt",
   );
+  if (!hasProvedNavigationSequence(command)) return false;
   return (
     prompts.length > 0 &&
     parsed.pipelines.every((pipeline) =>
@@ -1649,7 +1834,11 @@ function isStaticHerdrPrompt(command: string): boolean {
             argv.length > 1 &&
             argv.slice(1).every((arg) => arg === "--" || !arg.startsWith("-"))
           );
-        return isPassiveTextCommand(argv);
+        if (isPassiveTextCommand(argv)) return true;
+        if (isLiteralHerdrRead(argv)) return index === 0;
+        if (isStaticNavigationCommand(argv))
+          return index === 0 && (argv[0] !== "cd" || pipeline.length === 1);
+        return false;
       }),
     )
   );
@@ -1677,6 +1866,26 @@ function hasEnvironmentRead(
   const parsed = parseStaticShellCommands(command);
   if (parsed === "brace-expansion") return true;
   if (!parsed) {
+    const operands = parseStaticShellCommands(command, true);
+    if (
+      operands &&
+      typeof operands !== "string" &&
+      operands.pipelines.flat().some((words) => {
+        const argv = unwrapStaticCommand(words);
+        return (
+          argv[0]?.split("/").at(-1) === "bun" &&
+          argv[1] === "run" &&
+          argv[2] === "db-tool" &&
+          ["sql", "query"].includes(argv[3] ?? "") &&
+          argv.some(
+            (arg, index) =>
+              (arg === "--sql" && /\$\(|`/.test(argv[index + 1] ?? "")) ||
+              (arg.startsWith("--sql=") && /\$\(|`/.test(arg)),
+          )
+        );
+      })
+    )
+      return true;
     const unquoted = command.replace(/'(?:\\.|[^'])*'/g, " ").replace(/"(?:\\.|[^"$`])*"/g, " ");
     const hasExecutor =
       /\|\s*(?:sh|bash|zsh|xargs)|\b(?:sh|bash|zsh)\b|\$\(|`|\b(?:eval|source)\b|\bfind\b.*\b-exec\b/i.test(
@@ -1690,6 +1899,16 @@ function hasEnvironmentRead(
   }
   const pipelines = parsed.pipelines.map((commands) => commands.map(unwrapStaticCommand));
   const unwrapped = pipelines.flat();
+  if (
+    pipelines.some((pipeline) =>
+      pipeline.some(
+        (argv, index) =>
+          literalSqlArgumentIndex(argv) !== undefined &&
+          pipeline.slice(index + 1).some((consumer) => !isPassiveTextCommand(consumer)),
+      ),
+    )
+  )
+    return true;
   if (
     parsed.redirects.length > 0 &&
     unwrapped.some((argv) => isAllowedEnvironmentRead(argv, allowedNames))
@@ -1836,13 +2055,41 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
   const readers =
     /\b(?:cat|cp|grep|rg|sed|awk|jq|head|tail|less|more|source|ls|sort|uniq|cut|wc|mv|find|shasum|sha1sum|sha256sum|sha512sum|md5sum|cksum)\b/i;
   if (parsed && parsed !== "brace-expansion") {
+    let directory = "";
+    const trackDirectory = hasProvedNavigationSequence(command);
     return parsed.pipelines.flat().some((words) => {
       const argv = unwrapStaticCommand(words);
       const inspectedArgv =
         argv[0]?.split("/").at(-1) === "env" ? unwrapEnvironmentCommand(argv) : argv;
       if (inspectedArgv === null) return false;
-      const inspected = unwrapStaticCommand(inspectedArgv);
-      const name = inspected[0]?.split("/").at(-1) ?? "";
+      let inspected = unwrapStaticCommand(inspectedArgv);
+      let name = inspected[0]?.split("/").at(-1) ?? "";
+      let commandDirectory = directory;
+      const inDirectory = (path: string) =>
+        path.startsWith("/") ? posix.normalize(path) : posix.join(commandDirectory, path);
+      const blockedOperand = (path: string) =>
+        [path, inDirectory(path)].some((value) => isPathBlocked(value) || isSensitivePath(value));
+      const blockedDirectory = (path: string) => blockedOperand(path) || blockedOperand(path + "/");
+      if (name === "cd") {
+        const path = inspected[inspected[1] === "--" ? 2 : 1];
+        if (path === undefined) return false;
+        if (blockedDirectory(path)) return true;
+        if (trackDirectory && isStaticNavigationCommand(inspected)) directory = inDirectory(path);
+        return false;
+      }
+      if (name === "git") {
+        let index = 1;
+        while (inspected[index] === "-C" && inspected[index + 1]) {
+          if (blockedDirectory(inspected[index + 1] ?? "")) return true;
+          commandDirectory = inDirectory(inspected[index + 1] ?? "");
+          index += 2;
+        }
+        // Git grep has the same pattern-versus-file roles as grep below.
+        if (inspected[index] === "grep") {
+          inspected = ["grep", ...inspected.slice(index + 1)];
+          name = "grep";
+        }
+      }
       if (name === "bun" && inspected[1] === "run" && inspected[2] === "gh-tool") {
         return inspected.some((arg, index) => {
           const path =
@@ -1982,10 +2229,10 @@ function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) =>
           }
           paths.push(arg);
         }
-        return paths.some((path) => isPathBlocked(path) || isSensitivePath(path));
+        return paths.some(blockedOperand);
       }
       const paths = name === "jq" ? jqFileArguments(inspected) : inspected.slice(1);
-      return paths.some((path) => isPathBlocked(path) || isSensitivePath(path));
+      return paths.some(blockedOperand);
     });
   }
   const operands = parseStaticShellCommands(command, true);
@@ -2063,7 +2310,13 @@ function hasEnvironmentVariableExpansionRead(
       normalized += char;
       continue;
     }
-    const variable = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}|^\$([A-Za-z_][A-Za-z0-9_]*)/.exec(
+    if (command[i + 1] === "?") {
+      expansions++;
+      normalized += "NUMERICSTATUSVALUE";
+      i++;
+      continue;
+    }
+    const variable = /^\$\{([A-Za-z_][A-Za-z0-9_]*)(:-)?\}|^\$([A-Za-z_][A-Za-z0-9_]*)/.exec(
       command.slice(i),
     );
     if (!variable) {
@@ -2074,7 +2327,13 @@ function hasEnvironmentVariableExpansionRead(
       continue;
     }
     expansions++;
-    const name = variable[1] ?? variable[2] ?? "";
+    const name = variable[1] ?? variable[3] ?? "";
+    if (variable[2]) {
+      if (quote !== '"' || !allowedNames.has(name)) invalidExpansion = true;
+      normalized += "ENVTESTVALUE";
+      i += variable[0].length - 1;
+      continue;
+    }
     const assignment = assignments.get(name);
     if (assignment && assignment.end >= i) invalidExpansion = true;
     if (assignment && assignment.end < i) {
@@ -2099,6 +2358,39 @@ function hasEnvironmentVariableExpansionRead(
   if (!hasSafeLocalAssignmentCommands(localMaterialized, assignments)) return true;
   const parsed = parseStaticShellCommands(localMaterialized);
   if (!parsed || typeof parsed === "string") return true;
+  for (const [index, pipeline] of parsed.pipelines.entries()) {
+    if (!pipeline.some((words) => words.some((arg) => arg.includes("NUMERICSTATUSVALUE"))))
+      continue;
+    if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
+    if (
+      pipeline.some((words) => {
+        const argv = unwrapStaticCommand(words);
+        if (!words.some((arg) => arg.includes("NUMERICSTATUSVALUE")))
+          return !isPassiveTextCommand(argv);
+        const name = argv[0]?.split("/").at(-1);
+        const format = name === "printf" ? passivePrintfFormatIndex(argv) : undefined;
+        return (
+          !["echo", "printf"].includes(name ?? "") ||
+          !isPassiveTextCommand(argv) ||
+          words
+            .slice(0, words.length - argv.length)
+            .some((arg) => arg.includes("NUMERICSTATUSVALUE")) ||
+          argv[0]?.includes("NUMERICSTATUSVALUE") === true ||
+          (name === "printf" &&
+            (format === undefined ||
+              argv.slice(0, format + 1).some((arg) => arg.includes("NUMERICSTATUSVALUE"))))
+        );
+      })
+    )
+      return true;
+  }
+  for (const words of parsed.pipelines.flat()) {
+    if (
+      words.some((arg) => arg.includes("ENVTESTVALUE")) &&
+      !isApprovedEnvironmentPredicate(unwrapStaticCommand(words))
+    )
+      return true;
+  }
   for (const words of parsed.pipelines.flat()) {
     if (!words.some((arg) => arg.includes("UNKNOWNVALUE"))) continue;
     if (words.some((arg) => arg.includes("UNKNOWNVALUEUNQUOTED"))) return true;
@@ -2109,7 +2401,7 @@ function hasEnvironmentVariableExpansionRead(
     )
       return true;
   }
-  if (!localMaterialized.includes("ENVVALUE")) {
+  if (!localMaterialized.includes("ENVVALUE") && !localMaterialized.includes("ENVTESTVALUE")) {
     return (
       hasSensitiveFileRead(localMaterialized, isPathBlocked) ||
       hasSensitivePathRedirect(localMaterialized, isPathBlocked) ||
@@ -2119,7 +2411,7 @@ function hasEnvironmentVariableExpansionRead(
 
   for (const [index, pipeline] of parsed.pipelines.entries()) {
     const hasEnvironmentValue = pipeline.some((argv) =>
-      argv.some((arg) => arg.includes("ENVVALUE")),
+      argv.some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE")),
     );
     if (!hasEnvironmentValue) continue;
     if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
@@ -2127,9 +2419,14 @@ function hasEnvironmentVariableExpansionRead(
       pipeline.some((argv) => {
         const unwrapped = unwrapStaticCommand(argv);
         const name = unwrapped[0]?.split("/").at(-1) ?? "";
-        if (argv.some((arg) => arg.includes("ENVVALUE"))) {
-          if (argv.slice(0, argv.length - unwrapped.length).some((arg) => arg.includes("ENVVALUE")))
+        if (argv.some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE"))) {
+          if (
+            argv
+              .slice(0, argv.length - unwrapped.length)
+              .some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE"))
+          )
             return true;
+          if (isApprovedEnvironmentPredicate(unwrapped)) return false;
           if (isNavigationOperand(unwrapped, "ENVVALUE")) {
             return unwrapped.some((arg) => arg.includes("ENVVALUEUNQUOTED"));
           }
@@ -2156,6 +2453,24 @@ function hasEnvironmentVariableExpansionRead(
   return hasSensitiveFileRead(materialized, isPathBlocked);
 }
 
+/** Quoted approved metadata can be compared or checked for blankness, never evaluated. */
+function isApprovedEnvironmentPredicate(argv: string[]): boolean {
+  let args = argv.slice(1);
+  if (argv[0] === "[") {
+    if (args.at(-1) !== "]") return false;
+    args = args.slice(0, -1);
+  } else if (argv[0] !== "test") return false;
+  const value = (arg: string | undefined) => arg === "ENVVALUE" || arg === "ENVTESTVALUE";
+  const literal = (arg: string | undefined) =>
+    /^[A-Za-z0-9_.:-]*$/.test(arg ?? "") && arg !== undefined;
+  return (
+    (args.length === 2 && ["-n", "-z"].includes(args[0] ?? "") && value(args[1])) ||
+    (args.length === 3 &&
+      args[1] === "=" &&
+      ((value(args[0]) && literal(args[2])) || (literal(args[0]) && value(args[2]))))
+  );
+}
+
 function mentionsEnvironmentSource(command: string): boolean {
   return /\b(?:os\s*\.\s*(?:environ|getenv)|process\s*\.\s*env|Environment\s*\.\s*GetEnvironmentVariable)\b/.test(
     command,