@blogic-cz/agent-tools 1.6.3 → 1.6.5

package/README.md

@@ -668,6 +668,12 @@ Single literal `echo`/`printf` writes with output redirection and single `cat`/`
 
 Python JSON parsing, dictionary iteration, and printing are not themselves evidence of credential access. They follow the same access and execution rules as other supported inline programs. This intentionally permits ordinary JSON output that older versions refused. Unknown secrets in ordinary files can therefore reach arbitrary shell output; wrapper content checks do not protect that output. A refusal caused by unsupported syntax means the guard could not establish its policy conditions, not that it observed a secret being read.
 
+The bounded Python subprocess proof supports one immutable literal argv binding followed by one `subprocess.run` call. A literal `cwd` is replayed as a quoted, success-gated directory change before the nested argv, so relative reader operands and named directories receive the ordinary path policies. Supported directories are literal relative or absolute paths, including quoted spaces. Empty, dynamic, Unicode, escaped, tilde and other unsupported directory forms refuse rather than dropping the context. Cwd proof recursively unwraps only supported command, RTK proxy and environment wrappers. Environment directory/split-string options and unproved wrapper forms refuse. Only supported passive text, reader, metadata, literal Bun script and blocked CLI roles receive nested replay; shell executors, inline interpreter programs, unproved sed programs, find execution actions and unknown command roles refuse. Nested blocked CLI, environment, sensitive-path and custom-command policies remain active. Outer shell redirects retain their original shell directory. Arbitrary multi-call Python and `check_output` programs remain unsupported; direct Git metadata commands provide index/tree inspection.
+
+Supported runtime script/tool operands form an argument boundary: a later tool `-c` configuration flag is data. Genuine eval and loader flags, Bun exec/repl and unproved startup-option arity still refuse. Literal Herdr prompts can compose with the existing literal agent-get and pane-read forms and passive consumers. One literal `--sql` operand on the supported `bun run db-tool sql/query` shape can contain SQL braces; substitutions, duplicate SQL operands and unknown wrapper options receive no exception. SQL output pipelines require closed passive consumers, so shell, xargs and unknown executors refuse. Numeric `$?` can appear only in passive echo/printf data operands, with passive pipeline consumers. Explicitly approved environment names can appear in quoted equality or blankness tests, including the quoted empty default `${NAME:-}`. This does not add default-approved names or permit shell evaluators. One sed print program with numeric or escaped-regex addresses/ranges and known `-n`/`-E` flags is passive; execution/read/write callbacks, extra programs and script files receive no print proof. Local file bindings use that same closed print proof and never a generic sed-word fallback. Ordinary path and configured command policies still apply to all these forms.
+
+Literal shell bodies receive recursive shared policy replay under exact `sh -c`/`bash -c` and `zsh -f -c` invocations, using only these bare executable names or their `/bin/` and `/usr/bin/` paths and known RTK/command wrappers. Both protected paths and blocked CLIs remain enforced inside the body, along with environment and custom-command policies. A conventional shell-family name or numeric version in an unproved executing operand/control position refuses; proved literal text, reader and file-metadata operands remain data. Only the listed sh/bash/zsh identities receive body replay; rbash/rksh/ksh93 and versioned names refuse, and arbitrary renamed executables are outside this identity proof. Replay permits only existing closed body roles/materializations, at most eight shell levels and 64 KiB per invocation. Unproved options, environment prefixes, active exec/nohup/sudo wrappers, positional/script/stdin forms, executable binders, control flow and outer directory changes around a wrapper refuse. A body-internal proved cd affects body readers; outer redirects retain the outer shell directory. This is a textual body proof, not verification of native binaries or all host startup code. In particular, zsh -f still sources the global zshenv file. For unsupported executable inventories, use separate literal metadata requests and literal candidate invocations; no program name or --version flag receives a special exception.
+
 A separate bounded Node proof supports literal `package.json` inventory loops that print `bin` metadata or use the supported scripts filter. The complete invocation must preserve loader identity through known passive commands, closed literal writers, or proved inventories. Startup/environment mutations, unknown commands, loader changes, and other dynamic loading remain unproved and are refused.
 
 ### Setup for OpenCode

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAgzEF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAtpFD,SAAS,UAAU,UAAU,KAAK,IAspFM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAxpFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAwpFjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA1pFE,MAAM,KAAK,OA0pFgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA5pFE,MAAM,KAAK,OA4pFgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA9pFC,MAAM,KAAK,OA8pF0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAhqFC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAgqFf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAlqFC,MAAM,KAAK,OAkqFsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YApqFC,MAAM,KAAK,MAAM,GAAG,IAoqFa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA2oFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4VrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAjhGD,SAAS,UAAU,UAAU,KAAK,IAihGM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAnhGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAmhGjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aArhGE,MAAM,KAAK,OAqhGgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAvhGE,MAAM,KAAK,OAuhGgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAzhGC,MAAM,KAAK,OAyhG0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA3hGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA2hGf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA7hGC,MAAM,KAAK,OA6hGsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA/hGC,MAAM,KAAK,MAAM,GAAG,IA+hGa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.3",
+  "version": "1.6.5",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -262,21 +262,12 @@ function isSafeLocalAssignmentCommand(words: string[]): boolean {
     return !argv.slice(1).some((arg) => /^-(?:exec|ok|delete|fprint|fprintf)/.test(arg));
   }
   if (name === "bun") return argv[1] === "run" && ["db-tool", "gh-tool"].includes(argv[2] ?? "");
+  if (name === "sed") return isReadonlySedPrint(argv);
   return (
     isPassiveTextCommand(argv) ||
     ["ls", "cat", "tail", "wc", "uniq", "cut", "mv"].includes(name) ||
     (name === "sort" &&
-      !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from", "output"], "o")) ||
-    (name === "sed" &&
-      argv
-        .slice(1)
-        .every(
-          (arg) =>
-            /^-[En]+$/.test(arg) ||
-            /^s([/|]).*\1[^/|]*\1[gp]*$/.test(arg) ||
-            /^[A-Za-z0-9_./-]+$/.test(arg),
-        ) &&
-      !argv.includes("-f"))
+      !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from", "output"], "o"))
   );
 }
 
@@ -502,13 +493,7 @@ function isLiteralLoopCommand(words: string[], marker: string, value: string): b
     const format = passivePrintfFormatIndex(argv);
     return format !== undefined && uses.every((index) => index > format);
   }
-  if (name === "herdr")
-    return (
-      ((argv.length === 4 && argv[1] === "agent" && argv[2] === "get") ||
-        isLiteralHerdrPaneRead(argv)) &&
-      /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "") &&
-      uses.every((index) => index === 3)
-    );
+  if (name === "herdr") return isLiteralHerdrRead(argv) && uses.every((index) => index === 3);
   if (name === "bun")
     return (
       argv.length === 9 &&
@@ -537,6 +522,122 @@ function isLiteralHerdrPaneRead(argv: string[]): boolean {
   );
 }
 
+function isLiteralHerdrRead(argv: string[]): boolean {
+  return (
+    ((argv.length === 4 && argv.slice(0, 3).join(" ") === "herdr agent get") ||
+      isLiteralHerdrPaneRead(argv)) &&
+    /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "")
+  );
+}
+
+/** Conventional platform shell names and numeric versions; not arbitrary renamed executables. */
+function isShellWord(word: string): boolean {
+  return /^(?:sh|bash|rbash|zsh|dash|ash|ksh|rksh|csh|tcsh|fish)(?:[.-]?[0-9]+(?:[.][0-9]+)*)?$/.test(
+    word.split("/").at(-1) ?? "",
+  );
+}
+
+/** Shell-named operands are data only under an existing non-executing argument role. */
+function hasProvedShellDataOperands(argv: string[]): boolean {
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (isPassiveTextCommand(argv) || isLiteralHerdrRead(argv) || isStaticNavigationCommand(argv))
+    return true;
+  if (["cat", "ls", "uniq", "cut"].includes(name)) return true;
+  if (["find", "wc", "sort"].includes(name)) return isProvedCwdSubprocessRole(argv);
+  return name === "test" && argv.length === 3 && argv[1] === "-e" && !/[$`]/.test(argv[2] ?? "");
+}
+
+const SHELL_IDENTITIES = new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "/bin/sh",
+  "/usr/bin/sh",
+  "/bin/bash",
+  "/usr/bin/bash",
+  "/bin/zsh",
+  "/usr/bin/zsh",
+]);
+
+/** Literal argv only. Undefined means a shell was found without a complete invocation proof. */
+function literalShellBodies(command: string): string[] | undefined {
+  const parsed = parseStaticShellCommands(command);
+  const operands = parsed ?? parseStaticShellCommands(command, true);
+  if (!operands || typeof operands === "string") return [];
+  const commands = operands.pipelines.flat();
+  if (
+    commands.some((words) =>
+      ["exec", "nohup", "sudo"].includes(unwrapStaticCommand(words)[0]?.split("/").at(-1) ?? ""),
+    )
+  )
+    return undefined;
+  for (const words of commands) {
+    const argv = unwrapStaticCommand(words);
+    if (
+      !isShellWord(argv[0] ?? "") &&
+      argv.some(
+        (word, index) =>
+          index !== inlineProgramIndex(argv) &&
+          (isShellWord(word) ||
+            (/^--?[A-Za-z0-9-]+=/.test(word) && isShellWord(word.slice(word.indexOf("=") + 1)))),
+      ) &&
+      !hasProvedShellDataOperands(argv) &&
+      !isStaticHerdrPrompt(command)
+    )
+      return undefined;
+  }
+  const shells = commands.filter((words) => isShellWord(unwrapStaticCommand(words)[0] ?? ""));
+  if (!shells.length) return [];
+  if (
+    !parsed ||
+    typeof parsed === "string" ||
+    !literalBindingText(command, "", "") ||
+    new TextEncoder().encode(command).byteLength > 65_536 ||
+    commands.some((words) => unwrapStaticCommand(words)[0]?.split("/").at(-1) === "cd")
+  )
+    return undefined;
+  const bodies: string[] = [];
+  for (const words of shells) {
+    const argv = unwrapProofCommand(words, "\0");
+    if (!argv || !SHELL_IDENTITIES.has(argv[0] ?? "")) return undefined;
+    const name = argv[0]?.split("/").at(-1);
+    if (argv.length === 2 && ["--version", "--help"].includes(argv[1] ?? "")) continue;
+    const index = name === "zsh" && argv[1] === "-f" ? 2 : 1;
+    if ((name === "zsh" && index !== 2) || argv[index] !== "-c" || argv.length !== index + 2)
+      return undefined;
+    bodies.push(argv[index + 1] ?? "");
+  }
+  return bodies;
+}
+
+function isProvedLiteralShellBody(body: string): boolean {
+  if (!body.trim()) return true;
+  const materialized = materializeLiteralShell(body)?.command ?? body;
+  const parsed = parseStaticShellCommands(materialized);
+  if (!parsed || typeof parsed === "string" || !hasProvedNavigationSequence(materialized))
+    return false;
+  if (isStaticHerdrPrompt(materialized)) return true;
+  return parsed.pipelines.flat().every((words) => {
+    const argv = unwrapProofCommand(words, "\0");
+    if (!argv) return false;
+    if (argv[0]?.split("/").at(-1) === "env") return false;
+    const name = unwrapStaticCommand(argv)[0]?.split("/").at(-1) ?? "";
+    if (isShellWord(name))
+      return (
+        literalShellBodies(
+          words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
+        ) !== undefined
+      );
+    return (
+      isProvedCwdSubprocessRole(unwrapStaticCommand(argv)) ||
+      (name === "bun" && isSafeLocalAssignmentCommand(argv) && !isUnsupportedInlineRuntime(argv)) ||
+      isStaticNavigationCommand(argv) ||
+      isLiteralHerdrRead(argv) ||
+      (argv.length === 1 && ["true", "false", "pwd"].includes(name))
+    );
+  });
+}
+
 /** A complete stdin-only JSON projection, with no suffix, imports or executable input. */
 function isLiteralStdinJsonDisplay(argv: string[]): boolean {
   if (argv.length !== 3 || !["python", "python3"].includes(argv[0] ?? "") || argv[1] !== "-c")
@@ -852,15 +953,54 @@ function inlineProgramIndex(argv: string[]): number | undefined {
 }
 
 function isUnsupportedInlineRuntime(argv: string[]): boolean {
-  if (!inlineRuntimeKind(argv[0])) return false;
+  const runtime = inlineRuntimeKind(argv[0]);
+  if (!runtime) return false;
   if (inlineProgramIndex(argv) !== undefined) return false;
-  return argv
-    .slice(1)
-    .some((arg) =>
+  let index = 1;
+  for (; index < argv.length; index++) {
+    const arg = argv[index] ?? "";
+    if (arg === "--" || !arg.startsWith("-")) break;
+    if (
       /^(?:-[A-Za-z]*[cep]|-[rmp]|--(?:eval|print|require|import|loader|preload|experimental-loader))(?:$|=|[^-])/.test(
         arg,
-      ),
-    );
+      )
+    )
+      return true;
+    if (
+      (runtime === "python" && arg === "--check-hash-based-pycs") ||
+      (runtime === "node" &&
+        ["--conditions", "-C", "--icu-data-dir", "--dns-result-order"].includes(arg))
+    ) {
+      if (argv[index + 1] === undefined) return true;
+      index++;
+      continue;
+    }
+    // Unknown startup-option arity cannot establish where the script/tool begins.
+    if (
+      !(
+        (runtime === "python" && /^-[uBISsEOqvV]+$/.test(arg)) ||
+        (runtime === "node" &&
+          /^(?:--(?:trace-warnings|no-warnings|version|help)|--(?:conditions|icu-data-dir|dns-result-order)=.+)$/.test(
+            arg,
+          )) ||
+        (runtime === "bun" && ["--no-env-file", "--version", "--help"].includes(arg)) ||
+        ["--version", "--help", "-h"].includes(arg)
+      )
+    )
+      return true;
+  }
+  if (runtime === "bun" && ["exec", "repl"].includes(argv[index] ?? "")) return true;
+  // Bun retains eval/loader controls around its tool operand; only a later -c is tool data.
+  return (
+    runtime === "bun" &&
+    argv
+      .slice(index)
+      .some((arg) =>
+        /^(?:-[A-Za-z]*[ep]|-[rmp]|--(?:eval|print|require|import|loader|preload|experimental-loader))(?:$|=|[^-])/.test(
+          arg,
+        ),
+      )
+  );
 }
 
 /** Move a complete, literal Python stdin program into the existing inline argv boundary. */
@@ -1045,7 +1185,64 @@ function staticSubprocessCommand(program: string): string | undefined {
     (match) => match[1] ?? match[2] ?? "",
   );
   if (!values.length) return undefined;
-  return values.map((value) => "'" + value.replaceAll("'", "'\"'\"'") + "'").join(" ");
+  const quote = (value: string) => "'" + value.replaceAll("'", "'\"'\"'") + "'";
+  const command = values.map(quote).join(" ");
+  const directories = [...call[0].matchAll(/\bcwd\s*=\s*(?:"([^"\\]*)"|'([^'\\]*)')/g)];
+  if (!directories.length) return command;
+  const cwd = directories[0]?.[1] ?? directories[0]?.[2] ?? "";
+  // Never replay a cwd-bearing call as if it ran in the original shell directory.
+  if (directories.length !== 1 || !isStaticNavigationCommand(["cd", "--", cwd])) return undefined;
+  const argv = unwrapCwdSubprocessCommand(values);
+  if (!argv || !isProvedCwdSubprocessRole(argv)) return undefined;
+  // Keep wrapper assignments/options in policy replay after proving the nested command role.
+  const replay = `cd -- ${quote(cwd)} && ${command}`;
+  return hasProvedNavigationSequence(replay) ? replay : undefined;
+}
+
+function unwrapCwdSubprocessCommand(words: string[]): string[] | undefined {
+  let argv = words;
+  // Each successful wrapper removes words; the original word count bounds recursion.
+  for (let depth = 0; depth < words.length; depth++) {
+    const unwrapped = unwrapProofCommand(argv, "\0");
+    if (!unwrapped) return undefined;
+    argv = unwrapped;
+    if (argv[0]?.split("/").at(-1) !== "env") return argv;
+    const nested = unwrapEnvironmentCommand(argv);
+    if (!nested) return undefined;
+    // Inspect only env's prefix, not options belonging to its child command.
+    // env directory, split-string and unknown options do not preserve the proved context.
+    if (
+      argv
+        .slice(1, argv.length - nested.length)
+        .some(
+          (arg) =>
+            arg.startsWith("-") && arg !== "--" && arg !== "-i" && arg !== "--ignore-environment",
+        )
+    )
+      return undefined;
+    argv = nested;
+  }
+  return undefined;
+}
+
+function isProvedCwdSubprocessRole(argv: string[]): boolean {
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (inlineProgramIndex(argv) !== undefined || isUnsupportedInlineRuntime(argv)) return false;
+  if (isPassiveTextCommand(argv)) return true;
+  if (name === "find") return isSafeLocalAssignmentCommand(argv);
+  if (["ls", "cat", "uniq", "cut"].includes(name)) return true;
+  if (name === "wc") return !hasExecutionOption(argv.slice(1), ["files0-from"]);
+  if (name === "sort")
+    return !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from"]);
+  if (name === "git") {
+    let index = 1;
+    while (argv[index] === "-C" && argv[index + 1]) index += 2;
+    return ["ls-files", "ls-tree", "status", "rev-parse", "rev-list"].includes(argv[index] ?? "");
+  }
+  // A literal Bun script keeps the existing supported test-runner route.
+  if (name === "bun") return /^[A-Za-z0-9_./-]+\.(?:[cm]?[jt]s)$/.test(argv[1] ?? "");
+  // Retain extraction so the nested CLI policy returns its ordinary descriptor.
+  return DEFAULT_BLOCKED_CLI_TOOLS.some((tool) => tool.name === name);
 }
 
 function inlineSubprocessCommands(command: string): string[] {
@@ -1207,6 +1404,9 @@ function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
     argv[4] === "query"
   )
     return false;
+  const sql = literalSqlArgumentIndex(argv);
+  if (sql !== undefined)
+    return argv.some((arg, index) => index !== sql && hasArgumentBraceExpansion(arg));
   return (argv[0]?.split("/").at(-1) === "awk" && !isAwkExecution(argv)) ||
     inlineProgramIndex(argv) !== undefined ||
     isJqObjectConstruction(argv)
@@ -1214,6 +1414,32 @@ function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
     : hasArgumentBraceExpansion(argv.join(" "));
 }
 
+function literalSqlArgumentIndex(argv: string[]): number | undefined {
+  if (
+    argv[0]?.split("/").at(-1) !== "bun" ||
+    argv[1] !== "run" ||
+    argv[2] !== "db-tool" ||
+    !["sql", "query"].includes(argv[3] ?? "")
+  )
+    return undefined;
+  let sql: number | undefined;
+  const seen = new Set<string>();
+  for (let index = 4; index < argv.length; index++) {
+    const [option = "", ...attached] = (argv[index] ?? "").split("=");
+    if (
+      !["--sql", "--env", "--profile", "--limit", "--format"].includes(option) ||
+      seen.has(option)
+    )
+      return undefined;
+    seen.add(option);
+    const value = attached.length ? attached.join("=") : argv[++index];
+    if (!value || value.startsWith("--")) return undefined;
+    if (option === "--sql") sql = index;
+    else if (!/^[A-Za-z0-9_./-]+$/.test(value)) return undefined;
+  }
+  return sql;
+}
+
 /** echo and printf print their arguments; grep -o, rg and git grep print matched pattern text. */
 function isLiteralTextProducer(argv: string[]): boolean {
   return isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head";
@@ -1584,7 +1810,8 @@ function hasProvedNavigationSequence(command: string): boolean {
     return false;
   if (!changesDirectory.length) return true;
   // Only the final AND list can use this directory. A failing cd never reaches its readers.
-  const syntax = literal.syntax.replace(/[ \t\n]+$/g, "");
+  // Trim real trailing whitespace, not the spaces masking final quoted argv words.
+  const syntax = literal.syntax.slice(0, command.replace(/[ \t\n]+$/g, "").length);
   const boundary = Math.max(syntax.lastIndexOf(";"), syntax.lastIndexOf("\n"));
   const tail = parseStaticShellCommands(command.slice(boundary + 1, syntax.length));
   if (!tail || typeof tail === "string" || tail.pipelines.length < 2) return false;
@@ -1608,6 +1835,7 @@ function isPassiveTextCommand(argv: string[]): boolean {
   }
   if (name === "rg") return !hasExecutionOption(args, ["pre", "hostname-bin"]);
   if (name === "awk") return !isAwkExecution(argv);
+  if (name === "sed") return isReadonlySedPrint(argv);
   if (name === "jq") return isJqObjectConstruction(argv);
   return (
     (name === "git" && args[0] === "status") ||
@@ -1617,6 +1845,19 @@ function isPassiveTextCommand(argv: string[]): boolean {
   );
 }
 
+/** One print program with optional numeric or escaped-regex addresses; no callbacks. */
+function isReadonlySedPrint(argv: string[]): boolean {
+  if (argv[0]?.split("/").at(-1) !== "sed") return false;
+  let index = 1;
+  while (/^-[nE]+$/.test(argv[index] ?? "")) index++;
+  if (argv[index] === "--") index++;
+  const address = String.raw`(?:[0-9]+|\$|/(?:\\[^\r\n]|[^/\\\r\n])*/)`;
+  return (
+    new RegExp(`^(?:${address}(?:,${address})?)?p$`).test(argv[index] ?? "") &&
+    argv.slice(index + 1).every((arg) => !arg.startsWith("-"))
+  );
+}
+
 function hasStaticEnvironmentRead(
   argv: string[],
   allowedNames: Set<string>,
@@ -1702,6 +1943,7 @@ function isStaticHerdrPrompt(command: string): boolean {
             argv.slice(1).every((arg) => arg === "--" || !arg.startsWith("-"))
           );
         if (isPassiveTextCommand(argv)) return true;
+        if (isLiteralHerdrRead(argv)) return index === 0;
         if (isStaticNavigationCommand(argv))
           return index === 0 && (argv[0] !== "cd" || pipeline.length === 1);
         return false;
@@ -1724,6 +1966,7 @@ function hasEnvironmentRead(
   command: string,
   allowedNames: Set<string>,
   allowInventory = hasProvedPackageInventoryInvocation(command),
+  replayedShellBodies: string[] = [],
 ): boolean {
   if (isStaticHerdrPrompt(command)) return false;
   if (isHerdrPrompt(command)) return true;
@@ -1732,6 +1975,26 @@ function hasEnvironmentRead(
   const parsed = parseStaticShellCommands(command);
   if (parsed === "brace-expansion") return true;
   if (!parsed) {
+    const operands = parseStaticShellCommands(command, true);
+    if (
+      operands &&
+      typeof operands !== "string" &&
+      operands.pipelines.flat().some((words) => {
+        const argv = unwrapStaticCommand(words);
+        return (
+          argv[0]?.split("/").at(-1) === "bun" &&
+          argv[1] === "run" &&
+          argv[2] === "db-tool" &&
+          ["sql", "query"].includes(argv[3] ?? "") &&
+          argv.some(
+            (arg, index) =>
+              (arg === "--sql" && /\$\(|`/.test(argv[index + 1] ?? "")) ||
+              (arg.startsWith("--sql=") && /\$\(|`/.test(arg)),
+          )
+        );
+      })
+    )
+      return true;
     const unquoted = command.replace(/'(?:\\.|[^'])*'/g, " ").replace(/"(?:\\.|[^"$`])*"/g, " ");
     const hasExecutor =
       /\|\s*(?:sh|bash|zsh|xargs)|\b(?:sh|bash|zsh)\b|\$\(|`|\b(?:eval|source)\b|\bfind\b.*\b-exec\b/i.test(
@@ -1745,6 +2008,16 @@ function hasEnvironmentRead(
   }
   const pipelines = parsed.pipelines.map((commands) => commands.map(unwrapStaticCommand));
   const unwrapped = pipelines.flat();
+  if (
+    pipelines.some((pipeline) =>
+      pipeline.some(
+        (argv, index) =>
+          literalSqlArgumentIndex(argv) !== undefined &&
+          pipeline.slice(index + 1).some((consumer) => !isPassiveTextCommand(consumer)),
+      ),
+    )
+  )
+    return true;
   if (
     parsed.redirects.length > 0 &&
     unwrapped.some((argv) => isAllowedEnvironmentRead(argv, allowedNames))
@@ -1762,7 +2035,13 @@ function hasEnvironmentRead(
   ) {
     return true;
   }
-  if (unwrapped.some((argv) => hasStaticEnvironmentRead(argv, allowedNames, allowInventory))) {
+  if (
+    unwrapped.some(
+      (argv) =>
+        !(SHELL_IDENTITIES.has(argv[0] ?? "") && replayedShellBodies.includes(argv.at(-1) ?? "")) &&
+        hasStaticEnvironmentRead(argv, allowedNames, allowInventory),
+    )
+  ) {
     return true;
   }
 
@@ -2146,7 +2425,13 @@ function hasEnvironmentVariableExpansionRead(
       normalized += char;
       continue;
     }
-    const variable = /^\$\{([A-Za-z_][A-Za-z0-9_]*)\}|^\$([A-Za-z_][A-Za-z0-9_]*)/.exec(
+    if (command[i + 1] === "?") {
+      expansions++;
+      normalized += "NUMERICSTATUSVALUE";
+      i++;
+      continue;
+    }
+    const variable = /^\$\{([A-Za-z_][A-Za-z0-9_]*)(:-)?\}|^\$([A-Za-z_][A-Za-z0-9_]*)/.exec(
       command.slice(i),
     );
     if (!variable) {
@@ -2157,7 +2442,13 @@ function hasEnvironmentVariableExpansionRead(
       continue;
     }
     expansions++;
-    const name = variable[1] ?? variable[2] ?? "";
+    const name = variable[1] ?? variable[3] ?? "";
+    if (variable[2]) {
+      if (quote !== '"' || !allowedNames.has(name)) invalidExpansion = true;
+      normalized += "ENVTESTVALUE";
+      i += variable[0].length - 1;
+      continue;
+    }
     const assignment = assignments.get(name);
     if (assignment && assignment.end >= i) invalidExpansion = true;
     if (assignment && assignment.end < i) {
@@ -2182,6 +2473,39 @@ function hasEnvironmentVariableExpansionRead(
   if (!hasSafeLocalAssignmentCommands(localMaterialized, assignments)) return true;
   const parsed = parseStaticShellCommands(localMaterialized);
   if (!parsed || typeof parsed === "string") return true;
+  for (const [index, pipeline] of parsed.pipelines.entries()) {
+    if (!pipeline.some((words) => words.some((arg) => arg.includes("NUMERICSTATUSVALUE"))))
+      continue;
+    if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
+    if (
+      pipeline.some((words) => {
+        const argv = unwrapStaticCommand(words);
+        if (!words.some((arg) => arg.includes("NUMERICSTATUSVALUE")))
+          return !isPassiveTextCommand(argv);
+        const name = argv[0]?.split("/").at(-1);
+        const format = name === "printf" ? passivePrintfFormatIndex(argv) : undefined;
+        return (
+          !["echo", "printf"].includes(name ?? "") ||
+          !isPassiveTextCommand(argv) ||
+          words
+            .slice(0, words.length - argv.length)
+            .some((arg) => arg.includes("NUMERICSTATUSVALUE")) ||
+          argv[0]?.includes("NUMERICSTATUSVALUE") === true ||
+          (name === "printf" &&
+            (format === undefined ||
+              argv.slice(0, format + 1).some((arg) => arg.includes("NUMERICSTATUSVALUE"))))
+        );
+      })
+    )
+      return true;
+  }
+  for (const words of parsed.pipelines.flat()) {
+    if (
+      words.some((arg) => arg.includes("ENVTESTVALUE")) &&
+      !isApprovedEnvironmentPredicate(unwrapStaticCommand(words))
+    )
+      return true;
+  }
   for (const words of parsed.pipelines.flat()) {
     if (!words.some((arg) => arg.includes("UNKNOWNVALUE"))) continue;
     if (words.some((arg) => arg.includes("UNKNOWNVALUEUNQUOTED"))) return true;
@@ -2192,7 +2516,7 @@ function hasEnvironmentVariableExpansionRead(
     )
       return true;
   }
-  if (!localMaterialized.includes("ENVVALUE")) {
+  if (!localMaterialized.includes("ENVVALUE") && !localMaterialized.includes("ENVTESTVALUE")) {
     return (
       hasSensitiveFileRead(localMaterialized, isPathBlocked) ||
       hasSensitivePathRedirect(localMaterialized, isPathBlocked) ||
@@ -2202,7 +2526,7 @@ function hasEnvironmentVariableExpansionRead(
 
   for (const [index, pipeline] of parsed.pipelines.entries()) {
     const hasEnvironmentValue = pipeline.some((argv) =>
-      argv.some((arg) => arg.includes("ENVVALUE")),
+      argv.some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE")),
     );
     if (!hasEnvironmentValue) continue;
     if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
@@ -2210,9 +2534,14 @@ function hasEnvironmentVariableExpansionRead(
       pipeline.some((argv) => {
         const unwrapped = unwrapStaticCommand(argv);
         const name = unwrapped[0]?.split("/").at(-1) ?? "";
-        if (argv.some((arg) => arg.includes("ENVVALUE"))) {
-          if (argv.slice(0, argv.length - unwrapped.length).some((arg) => arg.includes("ENVVALUE")))
+        if (argv.some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE"))) {
+          if (
+            argv
+              .slice(0, argv.length - unwrapped.length)
+              .some((arg) => arg.includes("ENVVALUE") || arg.includes("ENVTESTVALUE"))
+          )
             return true;
+          if (isApprovedEnvironmentPredicate(unwrapped)) return false;
           if (isNavigationOperand(unwrapped, "ENVVALUE")) {
             return unwrapped.some((arg) => arg.includes("ENVVALUEUNQUOTED"));
           }
@@ -2239,6 +2568,24 @@ function hasEnvironmentVariableExpansionRead(
   return hasSensitiveFileRead(materialized, isPathBlocked);
 }
 
+/** Quoted approved metadata can be compared or checked for blankness, never evaluated. */
+function isApprovedEnvironmentPredicate(argv: string[]): boolean {
+  let args = argv.slice(1);
+  if (argv[0] === "[") {
+    if (args.at(-1) !== "]") return false;
+    args = args.slice(0, -1);
+  } else if (argv[0] !== "test") return false;
+  const value = (arg: string | undefined) => arg === "ENVVALUE" || arg === "ENVTESTVALUE";
+  const literal = (arg: string | undefined) =>
+    /^[A-Za-z0-9_.:-]*$/.test(arg ?? "") && arg !== undefined;
+  return (
+    (args.length === 2 && ["-n", "-z"].includes(args[0] ?? "") && value(args[1])) ||
+    (args.length === 3 &&
+      args[1] === "=" &&
+      ((value(args[0]) && literal(args[2])) || (literal(args[0]) && value(args[2]))))
+  );
+}
+
 function mentionsEnvironmentSource(command: string): boolean {
   return /\b(?:os\s*\.\s*(?:environ|getenv)|process\s*\.\s*env|Environment\s*\.\s*GetEnvironmentVariable)\b/.test(
     command,
@@ -2511,7 +2858,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     return getDangerousBashReason(command) !== null;
   }
 
-  function getDangerousBashReason(command: string): string | null {
+  function getDangerousBashReason(command: string, shellDepth = 0): string | null {
     const originalCommand = command;
     const allowPackageInventory = hasProvedPackageInventoryInvocation(originalCommand);
     const rawEnvironmentSource =
@@ -2525,20 +2872,30 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     if (rawEnvironmentSource && hasEnvironmentMutationPrefix(originalCommand))
       return "blocked by the environment/execution policy after an unproved environment mutation";
     command = normalizeProgramHeredocs(command);
+    const shellBodies = literalShellBodies(command);
+    if (!shellBodies || (shellBodies.length && shellDepth >= 8))
+      return "cannot prove a bounded literal shell invocation";
+    for (const body of shellBodies) {
+      const reason = getDangerousBashReason(body, shellDepth + 1);
+      if (reason || getBlockedCliTool(body, true, shellDepth + 1))
+        return reason ?? "invokes a blocked CLI from a shell body";
+      if (!isProvedLiteralShellBody(body)) return "cannot prove a closed literal shell body";
+    }
     const proof = materializeLiteralShell(command);
     if (!proof && /^\s*for\b/.test(command)) return "cannot prove a bounded literal shell loop";
     if (proof) {
       if (proof.paths.some((path) => hasSensitiveFileRead("cat " + path, isPathBlocked)))
         return "accesses a sensitive file path";
       command = proof.command;
-      if (getBlockedCliTool(command)) return "invokes a blocked CLI from a literal expansion";
+      if (getBlockedCliTool(command, true, shellDepth))
+        return "invokes a blocked CLI from a literal expansion";
     }
     for (const nested of [
       ...inlineSubprocessCommands(command),
       ...inlinePackageCommands(command, allowPackageInventory),
     ]) {
-      const reason = getDangerousBashReason(nested);
-      if (reason || getBlockedCliTool(nested))
+      const reason = getDangerousBashReason(nested, shellDepth);
+      if (reason || getBlockedCliTool(nested, true, shellDepth))
         return reason ?? "invokes a blocked CLI from a script";
     }
     if (
@@ -2554,7 +2911,21 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     }
     if (
       hasEnvironmentSourceAccess(command, rawEnvironmentSource, allowedEnvironmentVariables) ||
-      hasEnvironmentRead(command, allowedEnvironmentVariables, allowPackageInventory)
+      hasEnvironmentRead(
+        command,
+        allowedEnvironmentVariables,
+        allowPackageInventory,
+        shellBodies.filter((body) => {
+          const parsed = parseStaticShellCommands(body);
+          return (
+            parsed &&
+            typeof parsed !== "string" &&
+            parsed.pipelines
+              .flat()
+              .every((words) => isPassiveTextCommand(unwrapStaticCommand(words)))
+          );
+        }),
+      )
     ) {
       return "blocked by the environment/execution policy; permitted access or non-execution could not be established for this command form";
     }
@@ -2596,16 +2967,24 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
   function getBlockedCliTool(
     command: string,
     expand = true,
+    shellDepth = 0,
   ): { name: string; wrapper: string } | null {
     command = normalizeProgramHeredocs(command);
+    const shellBodies = literalShellBodies(command);
+    if (shellBodies && shellDepth < 8) {
+      for (const body of shellBodies) {
+        const blocked = getBlockedCliTool(body, true, shellDepth + 1);
+        if (blocked) return blocked;
+      }
+    }
     const proof = expand ? materializeLiteralShell(command) : undefined;
     if (proof) {
-      const originalBlocked = getBlockedCliTool(command, false);
+      const originalBlocked = getBlockedCliTool(command, false, shellDepth);
       if (originalBlocked) return originalBlocked;
       command = proof.command;
     }
     for (const nested of inlineSubprocessCommands(command)) {
-      const blocked = getBlockedCliTool(nested);
+      const blocked = getBlockedCliTool(nested, true, shellDepth);
       if (blocked) return blocked;
     }
     const staticCommands = parseStaticShellCommands(command);