@blogic-cz/agent-tools 1.6.4 → 1.6.6

package/README.md

@@ -670,7 +670,9 @@ Python JSON parsing, dictionary iteration, and printing are not themselves evide
 
 The bounded Python subprocess proof supports one immutable literal argv binding followed by one `subprocess.run` call. A literal `cwd` is replayed as a quoted, success-gated directory change before the nested argv, so relative reader operands and named directories receive the ordinary path policies. Supported directories are literal relative or absolute paths, including quoted spaces. Empty, dynamic, Unicode, escaped, tilde and other unsupported directory forms refuse rather than dropping the context. Cwd proof recursively unwraps only supported command, RTK proxy and environment wrappers. Environment directory/split-string options and unproved wrapper forms refuse. Only supported passive text, reader, metadata, literal Bun script and blocked CLI roles receive nested replay; shell executors, inline interpreter programs, unproved sed programs, find execution actions and unknown command roles refuse. Nested blocked CLI, environment, sensitive-path and custom-command policies remain active. Outer shell redirects retain their original shell directory. Arbitrary multi-call Python and `check_output` programs remain unsupported; direct Git metadata commands provide index/tree inspection.
 
-Supported runtime script/tool operands form an argument boundary: a later tool `-c` configuration flag is data. Genuine eval and loader flags, Bun exec/repl and unproved startup-option arity still refuse. Literal Herdr prompts can compose with the existing literal agent-get and pane-read forms and passive consumers. One literal `--sql` operand on the supported `bun run db-tool sql/query` shape can contain SQL braces; substitutions, duplicate SQL operands and unknown wrapper options receive no exception. SQL output pipelines require closed passive consumers, so shell, xargs and unknown executors refuse. Numeric `$?` can appear only in passive echo/printf data operands, with passive pipeline consumers. Explicitly approved environment names can appear in quoted equality or blankness tests, including the quoted empty default `${NAME:-}`. This does not add default-approved names or permit shell evaluators. One sed print program with numeric or escaped-regex addresses/ranges and known `-n`/`-E` flags is passive; execution/read/write callbacks, extra programs and script files receive no print proof. Local file bindings use that same closed print proof and never a generic sed-word fallback. Ordinary path and configured command policies still apply to all these forms.
+Supported runtime script/tool operands form an argument boundary: a later tool `-c` configuration flag is data. Genuine eval and loader flags, Bun exec/repl and unproved startup-option arity still refuse. Literal Herdr prompts can compose with literal agent-get, pane-read and agent-read forms and passive consumers. Both read forms require a literal identifier followed by `--source recent-unwrapped --lines N`, with positive integer `N`. A separate `sleep N` command accepts one literal nonnegative integer or decimal duration; delay pipelines, options and extra operands receive no composition proof. Delay redirects receive the ordinary sensitive-path checks. The wrapper sleep-polling guard still applies. One literal `--sql` operand on the supported `bun run db-tool sql/query` shape can contain SQL braces; substitutions, duplicate SQL operands and unknown wrapper options receive no exception. SQL output pipelines require closed passive consumers, so shell, xargs and unknown executors refuse. Numeric `$?` can appear only in passive echo/printf data operands, with passive pipeline consumers. Explicitly approved environment names can appear in quoted equality or blankness tests, including the quoted empty default `${NAME:-}`. This does not add default-approved names or permit shell evaluators. One sed print program with numeric or escaped-regex addresses/ranges and known `-n`/`-E` flags is passive; execution/read/write callbacks, extra programs and script files receive no print proof. Local file bindings use that same closed print proof and never a generic sed-word fallback. Ordinary path and configured command policies still apply to all these forms.
+
+Literal shell bodies receive recursive shared policy replay under exact `sh -c`/`bash -c` and `zsh -f -c` invocations, using only these bare executable names or their `/bin/` and `/usr/bin/` paths and known RTK/command wrappers. Both protected paths and blocked CLIs remain enforced inside the body, along with environment and custom-command policies. A conventional shell-family name or numeric version in an unproved executing operand/control position refuses; proved literal text, reader and file-metadata operands remain data. Only the listed sh/bash/zsh identities receive body replay; rbash/rksh/ksh93 and versioned names refuse, and arbitrary renamed executables are outside this identity proof. Replay permits only existing closed body roles/materializations, at most eight shell levels and 64 KiB per invocation. Unproved options, environment prefixes, active exec/nohup/sudo wrappers, positional/script/stdin forms, executable binders, control flow and outer directory changes around a wrapper refuse. A body-internal proved cd affects body readers; outer redirects retain the outer shell directory. This is a textual body proof, not verification of native binaries or all host startup code. In particular, zsh -f still sources the global zshenv file. For unsupported executable inventories, use separate literal metadata requests and literal candidate invocations; no program name or --version flag receives a special exception.
 
 A separate bounded Node proof supports literal `package.json` inventory loops that print `bin` metadata or use the supported scripts filter. The complete invocation must preserve loader identity through known passive commands, closed literal writers, or proved inventories. Startup/environment mutations, unknown commands, loader changes, and other dynamic loading remain unproved and are refused.
 

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAwhFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4TrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA93FD,SAAS,UAAU,UAAU,KAAK,IA83FM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAh4FC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAg4FjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAl4FE,MAAM,KAAK,OAk4FgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAp4FE,MAAM,KAAK,OAo4FgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAt4FC,MAAM,KAAK,OAs4F0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAx4FC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAw4Ff,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA14FC,MAAM,KAAK,OA04FsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA54FC,MAAM,KAAK,MAAM,GAAG,IA44Fa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAK5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA8oFF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CA4VrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAphGD,SAAS,UAAU,UAAU,KAAK,IAohGM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAthGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAshGjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAxhGE,MAAM,KAAK,OAwhGgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aA1hGE,MAAM,KAAK,OA0hGgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YA5hGC,MAAM,KAAK,OA4hG0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA9hGC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA8hGf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAhiGC,MAAM,KAAK,OAgiGsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAliGC,MAAM,KAAK,MAAM,GAAG,IAkiGa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.6.4",
+  "version": "1.6.6",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/credential-guard/index.ts

@@ -510,26 +510,130 @@ function isLiteralLoopCommand(words: string[], marker: string, value: string): b
   );
 }
 
-function isLiteralHerdrPaneRead(argv: string[]): boolean {
+function isLiteralHerdrRead(argv: string[]): boolean {
   return (
-    argv.length === 8 &&
-    argv.slice(0, 3).join(" ") === "herdr pane read" &&
+    argv[0] === "herdr" &&
+    !argv[3]?.startsWith("-") &&
     /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "") &&
-    argv[4] === "--source" &&
-    argv[5] === "recent-unwrapped" &&
-    argv[6] === "--lines" &&
-    /^[1-9]\d*$/.test(argv[7] ?? "")
+    ((argv.length === 4 && argv[1] === "agent" && argv[2] === "get") ||
+      (argv.length === 8 &&
+        ["pane", "agent"].includes(argv[1] ?? "") &&
+        argv[2] === "read" &&
+        argv[4] === "--source" &&
+        argv[5] === "recent-unwrapped" &&
+        argv[6] === "--lines" &&
+        /^[1-9]\d*$/.test(argv[7] ?? "")))
   );
 }
 
-function isLiteralHerdrRead(argv: string[]): boolean {
-  return (
-    ((argv.length === 4 && argv.slice(0, 3).join(" ") === "herdr agent get") ||
-      isLiteralHerdrPaneRead(argv)) &&
-    /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "")
+/** Conventional platform shell names and numeric versions; not arbitrary renamed executables. */
+function isShellWord(word: string): boolean {
+  return /^(?:sh|bash|rbash|zsh|dash|ash|ksh|rksh|csh|tcsh|fish)(?:[.-]?[0-9]+(?:[.][0-9]+)*)?$/.test(
+    word.split("/").at(-1) ?? "",
   );
 }
 
+/** Shell-named operands are data only under an existing non-executing argument role. */
+function hasProvedShellDataOperands(argv: string[]): boolean {
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  if (isPassiveTextCommand(argv) || isLiteralHerdrRead(argv) || isStaticNavigationCommand(argv))
+    return true;
+  if (["cat", "ls", "uniq", "cut"].includes(name)) return true;
+  if (["find", "wc", "sort"].includes(name)) return isProvedCwdSubprocessRole(argv);
+  return name === "test" && argv.length === 3 && argv[1] === "-e" && !/[$`]/.test(argv[2] ?? "");
+}
+
+const SHELL_IDENTITIES = new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "/bin/sh",
+  "/usr/bin/sh",
+  "/bin/bash",
+  "/usr/bin/bash",
+  "/bin/zsh",
+  "/usr/bin/zsh",
+]);
+
+/** Literal argv only. Undefined means a shell was found without a complete invocation proof. */
+function literalShellBodies(command: string): string[] | undefined {
+  const parsed = parseStaticShellCommands(command);
+  const operands = parsed ?? parseStaticShellCommands(command, true);
+  if (!operands || typeof operands === "string") return [];
+  const commands = operands.pipelines.flat();
+  if (
+    commands.some((words) =>
+      ["exec", "nohup", "sudo"].includes(unwrapStaticCommand(words)[0]?.split("/").at(-1) ?? ""),
+    )
+  )
+    return undefined;
+  for (const words of commands) {
+    const argv = unwrapStaticCommand(words);
+    if (
+      !isShellWord(argv[0] ?? "") &&
+      argv.some(
+        (word, index) =>
+          index !== inlineProgramIndex(argv) &&
+          (isShellWord(word) ||
+            (/^--?[A-Za-z0-9-]+=/.test(word) && isShellWord(word.slice(word.indexOf("=") + 1)))),
+      ) &&
+      !hasProvedShellDataOperands(argv) &&
+      !isStaticHerdrPrompt(command)
+    )
+      return undefined;
+  }
+  const shells = commands.filter((words) => isShellWord(unwrapStaticCommand(words)[0] ?? ""));
+  if (!shells.length) return [];
+  if (
+    !parsed ||
+    typeof parsed === "string" ||
+    !literalBindingText(command, "", "") ||
+    new TextEncoder().encode(command).byteLength > 65_536 ||
+    commands.some((words) => unwrapStaticCommand(words)[0]?.split("/").at(-1) === "cd")
+  )
+    return undefined;
+  const bodies: string[] = [];
+  for (const words of shells) {
+    const argv = unwrapProofCommand(words, "\0");
+    if (!argv || !SHELL_IDENTITIES.has(argv[0] ?? "")) return undefined;
+    const name = argv[0]?.split("/").at(-1);
+    if (argv.length === 2 && ["--version", "--help"].includes(argv[1] ?? "")) continue;
+    const index = name === "zsh" && argv[1] === "-f" ? 2 : 1;
+    if ((name === "zsh" && index !== 2) || argv[index] !== "-c" || argv.length !== index + 2)
+      return undefined;
+    bodies.push(argv[index + 1] ?? "");
+  }
+  return bodies;
+}
+
+function isProvedLiteralShellBody(body: string): boolean {
+  if (!body.trim()) return true;
+  const materialized = materializeLiteralShell(body)?.command ?? body;
+  const parsed = parseStaticShellCommands(materialized);
+  if (!parsed || typeof parsed === "string" || !hasProvedNavigationSequence(materialized))
+    return false;
+  if (isStaticHerdrPrompt(materialized)) return true;
+  return parsed.pipelines.flat().every((words) => {
+    const argv = unwrapProofCommand(words, "\0");
+    if (!argv) return false;
+    if (argv[0]?.split("/").at(-1) === "env") return false;
+    const name = unwrapStaticCommand(argv)[0]?.split("/").at(-1) ?? "";
+    if (isShellWord(name))
+      return (
+        literalShellBodies(
+          words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
+        ) !== undefined
+      );
+    return (
+      isProvedCwdSubprocessRole(unwrapStaticCommand(argv)) ||
+      (name === "bun" && isSafeLocalAssignmentCommand(argv) && !isUnsupportedInlineRuntime(argv)) ||
+      isStaticNavigationCommand(argv) ||
+      isLiteralHerdrRead(argv) ||
+      (argv.length === 1 && ["true", "false", "pwd"].includes(name))
+    );
+  });
+}
+
 /** A complete stdin-only JSON projection, with no suffix, imports or executable input. */
 function isLiteralStdinJsonDisplay(argv: string[]): boolean {
   if (argv.length !== 3 || !["python", "python3"].includes(argv[0] ?? "") || argv[1] !== "-c")
@@ -1836,6 +1940,13 @@ function isStaticHerdrPrompt(command: string): boolean {
           );
         if (isPassiveTextCommand(argv)) return true;
         if (isLiteralHerdrRead(argv)) return index === 0;
+        if (argv[0] === "sleep")
+          return (
+            index === 0 &&
+            pipeline.length === 1 &&
+            argv.length === 2 &&
+            /^\d+(?:\.\d+)?$/.test(argv[1] ?? "")
+          );
         if (isStaticNavigationCommand(argv))
           return index === 0 && (argv[0] !== "cd" || pipeline.length === 1);
         return false;
@@ -1858,6 +1969,7 @@ function hasEnvironmentRead(
   command: string,
   allowedNames: Set<string>,
   allowInventory = hasProvedPackageInventoryInvocation(command),
+  replayedShellBodies: string[] = [],
 ): boolean {
   if (isStaticHerdrPrompt(command)) return false;
   if (isHerdrPrompt(command)) return true;
@@ -1926,7 +2038,13 @@ function hasEnvironmentRead(
   ) {
     return true;
   }
-  if (unwrapped.some((argv) => hasStaticEnvironmentRead(argv, allowedNames, allowInventory))) {
+  if (
+    unwrapped.some(
+      (argv) =>
+        !(SHELL_IDENTITIES.has(argv[0] ?? "") && replayedShellBodies.includes(argv.at(-1) ?? "")) &&
+        hasStaticEnvironmentRead(argv, allowedNames, allowInventory),
+    )
+  ) {
     return true;
   }
 
@@ -2743,7 +2861,7 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     return getDangerousBashReason(command) !== null;
   }
 
-  function getDangerousBashReason(command: string): string | null {
+  function getDangerousBashReason(command: string, shellDepth = 0): string | null {
     const originalCommand = command;
     const allowPackageInventory = hasProvedPackageInventoryInvocation(originalCommand);
     const rawEnvironmentSource =
@@ -2757,20 +2875,30 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     if (rawEnvironmentSource && hasEnvironmentMutationPrefix(originalCommand))
       return "blocked by the environment/execution policy after an unproved environment mutation";
     command = normalizeProgramHeredocs(command);
+    const shellBodies = literalShellBodies(command);
+    if (!shellBodies || (shellBodies.length && shellDepth >= 8))
+      return "cannot prove a bounded literal shell invocation";
+    for (const body of shellBodies) {
+      const reason = getDangerousBashReason(body, shellDepth + 1);
+      if (reason || getBlockedCliTool(body, true, shellDepth + 1))
+        return reason ?? "invokes a blocked CLI from a shell body";
+      if (!isProvedLiteralShellBody(body)) return "cannot prove a closed literal shell body";
+    }
     const proof = materializeLiteralShell(command);
     if (!proof && /^\s*for\b/.test(command)) return "cannot prove a bounded literal shell loop";
     if (proof) {
       if (proof.paths.some((path) => hasSensitiveFileRead("cat " + path, isPathBlocked)))
         return "accesses a sensitive file path";
       command = proof.command;
-      if (getBlockedCliTool(command)) return "invokes a blocked CLI from a literal expansion";
+      if (getBlockedCliTool(command, true, shellDepth))
+        return "invokes a blocked CLI from a literal expansion";
     }
     for (const nested of [
       ...inlineSubprocessCommands(command),
       ...inlinePackageCommands(command, allowPackageInventory),
     ]) {
-      const reason = getDangerousBashReason(nested);
-      if (reason || getBlockedCliTool(nested))
+      const reason = getDangerousBashReason(nested, shellDepth);
+      if (reason || getBlockedCliTool(nested, true, shellDepth))
         return reason ?? "invokes a blocked CLI from a script";
     }
     if (
@@ -2786,7 +2914,21 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
     }
     if (
       hasEnvironmentSourceAccess(command, rawEnvironmentSource, allowedEnvironmentVariables) ||
-      hasEnvironmentRead(command, allowedEnvironmentVariables, allowPackageInventory)
+      hasEnvironmentRead(
+        command,
+        allowedEnvironmentVariables,
+        allowPackageInventory,
+        shellBodies.filter((body) => {
+          const parsed = parseStaticShellCommands(body);
+          return (
+            parsed &&
+            typeof parsed !== "string" &&
+            parsed.pipelines
+              .flat()
+              .every((words) => isPassiveTextCommand(unwrapStaticCommand(words)))
+          );
+        }),
+      )
     ) {
       return "blocked by the environment/execution policy; permitted access or non-execution could not be established for this command form";
     }
@@ -2828,16 +2970,24 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
   function getBlockedCliTool(
     command: string,
     expand = true,
+    shellDepth = 0,
   ): { name: string; wrapper: string } | null {
     command = normalizeProgramHeredocs(command);
+    const shellBodies = literalShellBodies(command);
+    if (shellBodies && shellDepth < 8) {
+      for (const body of shellBodies) {
+        const blocked = getBlockedCliTool(body, true, shellDepth + 1);
+        if (blocked) return blocked;
+      }
+    }
     const proof = expand ? materializeLiteralShell(command) : undefined;
     if (proof) {
-      const originalBlocked = getBlockedCliTool(command, false);
+      const originalBlocked = getBlockedCliTool(command, false, shellDepth);
       if (originalBlocked) return originalBlocked;
       command = proof.command;
     }
     for (const nested of inlineSubprocessCommands(command)) {
-      const blocked = getBlockedCliTool(nested);
+      const blocked = getBlockedCliTool(nested, true, shellDepth);
       if (blocked) return blocked;
     }
     const staticCommands = parseStaticShellCommands(command);