@cratis/pi 7.102.0 → 7.103.1

package/package/corpus/harnesses/copilot/instructions/profiles.instructions.md

@@ -87,11 +87,20 @@ profile includes neither Screenplay nor Stage.
 | Profile ID | Description | Automatically Includes |
 |---|---|---|
 | `cratis/engineering` | Engineering conventions and workflows | `cratis/engineering/core`, `cratis/engineering/csharp`, `cratis/engineering/elixir`, `cratis/engineering/go`, `cratis/engineering/kotlin`, `cratis/engineering/react`, `cratis/engineering/typescript` |
-| `cratis/engineering/csharp` | C# engineering conventions and framework Orleans jobs (`cratis-orleans-jobs`, alongside `orleans.md`) | `cratis/engineering/core` |
+| `cratis/engineering/csharp` | C# engineering conventions, .NET engineering skills, and framework Orleans jobs (`cratis-orleans-jobs`, alongside `orleans.md`) | `cratis/engineering/core`, `cratis/engineering/dotnet` |
+| `cratis/engineering/dotnet` | Upstream .NET engineering workflows | `cratis/engineering/dotnet/performance`, `cratis/engineering/dotnet/diagnostics`, `cratis/engineering/dotnet/msbuild`, `cratis/engineering/dotnet/orleans`, `cratis/engineering/dotnet/testing`, `cratis/engineering/dotnet/refactoring` |
+| `cratis/engineering/dotnet/performance` | Microbenchmarking, performance patterns, SIMD, and profiling | (no child profiles) |
+| `cratis/engineering/dotnet/diagnostics` | Trace and crash-dump collection | (no child profiles) |
+| `cratis/engineering/dotnet/msbuild` | MSBuild troubleshooting, build authoring, output paths, and binlogs | (no child profiles) |
+| `cratis/engineering/dotnet/orleans` | Orleans primitives, hosting, persistence, and runtime behavior | (no child profiles) |
+| `cratis/engineering/dotnet/testing` | Test-platform detection, runner commands, filters, and coverage | (no child profiles) |
+| `cratis/engineering/dotnet/refactoring` | Behavior-preserving C# refactoring and AOT compatibility | (no child profiles) |
 | `cratis/engineering/go` | Go framework parity and immutable module releases | `cratis/engineering/core`, `cratis/language/go` |
 | `cratis/engineering/typescript` | TypeScript engineering conventions | `cratis/engineering/core` |
 | `cratis/engineering/react` | React engineering conventions | `cratis/engineering/core` |
 
+The `cratis/engineering/dotnet` profiles carry upstream skills under MIT, with attribution and changes in each skill's NOTICE. Cratis rules and the `cratis-*` skills win where they differ.
+
 The `cratis/engineering` profile also carries [issue-assignment.md](../../../rules/issue-assignment.md): when an agent starts work on a numbered issue in a known repository and nobody is assigned, it assigns the current `gh` user.
 
 ### Language Profiles

package/package/corpus/harnesses/copilot/instructions/pull-requests.instructions.md

@@ -9,6 +9,8 @@ applyTo: "**/*"
 
 **The PR description is published verbatim as the GitHub release. In repositories released by `cratis/release-action`, it also closes every issue written as `(#n)`; elsewhere, follow the repository's own release and issue-closing process.** Write the note the person upgrading should read, not a development write-up. The same contract applies to release notes typed into a manual workflow run or written straight into a release. Where it is installed, the `policy / verify` check enforces it on release-bound PRs into the default branch carrying `major`/`minor`/`patch` (it re-runs when the label is added); its release-note step warns on `no-release` and unlabelled PRs, which must still be written this way because any of them may become releasable. `release-action` does not run for a `no-release` PR, so `(#n)` closes nothing there. Editing the description re-runs the check. HTML comments are not shown on the release page and the check ignores them for headings, keywords and placeholders, and `release-action` removes them before publishing, so a `(#n)` only inside a comment closes nothing; the check fails it, so never put an issue reference in a comment. The template's own comment can stay: its `(#123)` examples are inline code, and the comment is not published.
 
+**A change to a hook script or its wiring (`.cratis/ai/hooks/**`) needs a release-note line that tells consumers to run `cratis ai update`; a hook fix does not reach a repository until they do.**
+
 ### Allowed shape
 
 - Follow the repository's pull request template (`.github/pull_request_template.md`) within this contract.

package/package/corpus/harnesses/copilot/instructions/secrets.instructions.md

@@ -21,6 +21,10 @@ Every line is tagged **[contract]** (binding) per the Three Levels of Authority
 - **[contract] Project the field you need and say which one:** `-o jsonpath='{.spec.containers[*].image}'`,
   `-o custom-columns=…`, `kubectl get … -o name`, status fields, `kubectl logs`, `docker inspect --format`.
   Read a `.env.example`, never the `.env`.
+- **[contract] The hook reads command text only.** It cannot see a command piped into a shell
+  (`… | sh`, `bash -c "$(…)"`), a recursive search with no named file (`grep -r PASSWORD .`), or a
+  value reached through a variable, alias or script. These stay your rule to keep; output redaction
+  is the only backstop.
 
 ## Values
 

package/package/corpus/hooks/README.md

@@ -11,7 +11,7 @@ Three layers:
 | Pattern pass | `PostToolUse` on a write | `scripts/cratis-pattern-scan.sh` | zero tokens until a match | appends a one-line reminder to context, never blocks |
 | Hard block | `PreToolUse` on a write | `scripts/cratis-guard-writes.sh` | zero | exits **2** — the write does not happen |
 | Hard block | `PreToolUse` on `Bash` | `scripts/cratis-guard-store-mutations.sh` | zero; parses only commands that mention `cratis` | exits **2** — the store-changing `cratis chronicle` command does not run |
-| Hard block | `PreToolUse` on `Bash` | `scripts/cratis-guard-secrets.sh` | zero; parses only commands that mention a credential-bearing tool or file | exits **2** — a command that prints credentials (full `kubectl` specs and secrets, `env`/`printenv`, `docker inspect`, secret-manager reads, `.env`/kubeconfig/key files) does not run unless it projects a field; see [`secrets.md`](../rules/secrets.md) |
+| Hard block | `PreToolUse` on `Bash` | `scripts/cratis-guard-secrets.sh` | zero; parses only commands that mention a credential-bearing tool or file | exits **2** — a command that prints credentials (full `kubectl` specs and secrets, `env`/`printenv`, `docker inspect`, secret-manager reads, `.env`/kubeconfig/key files; also behind `/usr/bin/env`, `command`, attached options such as `-ePATTERN`, a bare `{.}` projection) does not run unless it projects a field; piped shells and recursive searches with no named file stay uncovered; see [`secrets.md`](../rules/secrets.md) |
 | Hard block | `PreToolUse` on `Bash` | `scripts/cratis-guard-pr-body.sh` | fetches shared rules only for `gh pr create/edit` | exits **2** for inline bodies, invalid notes or conflicting release labels; warns and allows when offline with no cache |
 | Cleanup of delivered work | `PostToolUse` on `Bash` (`gh pr merge`, `git pull/merge/worktree`) and `SessionStart` (Pi: `tool_result` and `session_start`) | `scripts/cratis-cleanup-worktrees.sh --hook` | zero when the command is unrelated | never blocks; removes delivered worktrees and branches, reports what it kept |
 | Quality gate (Claude) | `Stop` | `scripts/cratis-quality-gate.sh` | one build/test run, only when relevant files changed | exits **2** — the turn does not end |
@@ -252,6 +252,16 @@ execution, so it cannot validate a body that the command has yet to write, even
 already exists. Dependabot's generated description remains exempt (including GitHub CLI's
 `app/dependabot` bot identity), but its release-intent label is still checked.
 
+A release that changes a hook script or its wiring must say in its release notes that consumers run
+`cratis ai update`: hooks are managed files, so a fix reaches a repository only once it updates.
+
+The direct checker exits non-zero, with remediation text, in a `github.com/Cratis/` repository whose
+workflows hold no policy caller (none of the recognized callers above): without one, nothing enforces the
+pull-request contract there, and a pass would claim otherwise. A repository outside Cratis still falls back to
+the reviewed pin below, and the Bash guard stays a no-op where there is no caller. A contract spec in the AI corpus's own
+verification runs the checker over vendored copies of the callers Cratis/Workflows publishes; with
+`CRATIS_CONTRACT_LIVE=1` it compares them with Cratis/Workflows `main`.
+
 Run the same checker directly:
 
 ```bash

package/package/corpus/hooks/scripts/cratis-check-pr.mjs

@@ -71,6 +71,13 @@ function callers(cwd = process.cwd()) {
     } catch { return []; }
 }
 
+function missingCaller(repository) {
+    return `No Cratis/Workflows policy caller found for ${repository}, so its pull-request contract is not enforced and this check cannot vouch for it. `
+        + 'Add .github/workflows/verify-pull-request-policy.yml calling Cratis/Workflows/.github/workflows/verify-pull-request-policy.yml '
+        + '(a legacy verify-release-notes, verify-semver-label or verify-release-intent caller also counts), then run this check again. '
+        + 'Cratis/Workflows bootstrap-common-workflows installs the caller; if the repository is meant to have none, do not use this check there.';
+}
+
 function repositoryName(value) {
     return value?.replace(/^(?:https?:\/\/github\.com\/|(?:ssh:\/\/)?git@github\.com[:/])/i, '')
         .replace(/^github\.com\//i, '').replace(/\/$/, '').replace(/\.git$/i, '');
@@ -216,7 +223,11 @@ function check(argv, repositoryCallers, lookupOptions) {
     // The release-intent check above still applies to bot-authored pull requests.
     if (author === 'dependabot[bot]') return 0;
     const base = values.base || pull?.baseRefName || defaultBranch;
-    const file = rules(warn, repositoryCallers || targetCallers(repository, process.cwd(), warn));
+    const found = repositoryCallers || targetCallers(repository, process.cwd(), warn);
+    // A Cratis repository without a policy caller has no enforced pull-request contract; passing here would
+    // let the author believe it has one. A fetch failure is not this case: targetCallers falls back to a caller.
+    if (!found.length && /^Cratis\/[^/]+$/i.test(repository)) throw new Error(missingCaller(repository));
+    const file = rules(warn, found);
     if (!file) return 3;
     const env = { PATH: process.env.PATH, HOME: homedir(), LANG: 'C.UTF-8',
         PR_BODY: body, PR_LABELS: JSON.stringify([...labels]),

package/package/corpus/hooks/scripts/cratis-guard-secrets.sh

@@ -10,8 +10,9 @@
 # Exit 2 blocks the tool call and sends stderr back to the model; every other command exits 0.
 #
 # What it sees is the command text. A credential reached through a variable, an alias, a function, a script
-# file or a pipe into a shell is invisible to it; a projection it cannot see through (`-o jsonpath` that dumps
-# `{.}`) is trusted. See .cratis/ai/hooks/README.md.
+# file or a pipe into a shell is invisible to it, as is a recursive search with no named file; a projection it
+# cannot see through (a template or `-o jsonpath` that is not a bare `{.}`) is trusted. A redirect does not
+# exempt anything: `env > f` is blocked like `env`. See .cratis/ai/hooks/README.md.
 #
 # Escape hatch for a human who authorized the read — set in the environment the agent harness was started
 # from, never inside the command (an assignment in the command is ignored):
@@ -54,13 +55,26 @@ function base(word) { word = tolower(word); sub(/.*\//, "", word); return word }
 
 # ── tokenizer: splits text into simple commands, queueing nested command text ──
 function flush_word() {
-    if (inword) W[++nw] = word
-    word = ""; inword = 0
+    if (inword) { W[++nw] = word; WP[nw] = wplain }
+    word = ""; inword = 0; wquoted = 0; wplain = 0
 }
-function end_cmd() {
+# Output redirections are removed before a command is analyzed, so a redirect never shifts a CLI's subcommand
+# or operands (`kubectl get > /dev/stdout secrets`). Nothing is exempted: the command itself is still analyzed.
+# A word is a redirection only when its whole operator lies in the word's unquoted prefix (WP: characters before
+# the first quoted or escaped one), so `1">"b` and `">x"` stay operands; input redirections (`< file`) stay too.
+function end_cmd(    k, m, w) {
     flush_word()
-    if (nw > 0) analyze(W, 1, nw)
-    split("", W); nw = 0
+    m = 0
+    for (k = 1; k <= nw; k++) {
+        w = W[k]
+        if (match(w, /^([0-9]*|&)>[>|]?/) && RLENGTH <= WP[k]) {
+            if (RLENGTH == length(w)) k++
+            continue
+        }
+        V[++m] = w
+    }
+    if (m > 0) analyze(V, 1, m)
+    split("", W); split("", WP); split("", V); nw = 0
 }
 function cmdsub(s, i, n,    start, depth, c, j) {
     start = i; depth = 1
@@ -97,23 +111,23 @@ function read_heredocs(s, i, n,    h, e, line, cmp, body) {
     return i
 }
 function tokenize(s,    i, n, c, c2, j, dash, delim) {
-    n = length(s); i = 1; nw = 0; word = ""; inword = 0; nheredoc = 0; hd_shell = 0
-    split("", W)
+    n = length(s); i = 1; nw = 0; word = ""; inword = 0; wquoted = 0; wplain = 0; nheredoc = 0; hd_shell = 0
+    split("", W); split("", WP)
     while (i <= n) {
         c = substr(s, i, 1)
         if (c == "\\") {
             c2 = substr(s, i + 1, 1)
             if (c2 == "\n") { i += 2; continue }
-            word = word c2; inword = 1; i += 2; continue
+            wquoted = 1; word = word c2; inword = 1; i += 2; continue
         }
         if (c == "\047") {
-            inword = 1
+            wquoted = 1; inword = 1
             j = index(substr(s, i + 1), "\047")
             if (j == 0) { word = word substr(s, i + 1); i = n + 1; continue }
             word = word substr(s, i + 1, j - 1); i += j + 1; continue
         }
         if (c == "\"") {
-            inword = 1; i++
+            wquoted = 1; inword = 1; i++
             while (i <= n) {
                 c = substr(s, i, 1)
                 if (c == "\\") { word = word substr(s, i + 1, 1); i += 2; continue }
@@ -128,9 +142,9 @@ function tokenize(s,    i, n, c, c2, j, dash, delim) {
             }
             continue
         }
-        if (c == "$" && substr(s, i + 1, 1) == "(") { inword = 1; i = cmdsub(s, i + 2, n); word = word "x"; continue }
+        if (c == "$" && substr(s, i + 1, 1) == "(") { wquoted = 1; inword = 1; i = cmdsub(s, i + 2, n); word = word "x"; continue }
         if (c == "`") {
-            inword = 1
+            wquoted = 1; inword = 1
             j = index(substr(s, i + 1), "`")
             if (j == 0) { i = n + 1; continue }
             enqueue(substr(s, i + 1, j - 1)); i += j + 1; word = word "x"; continue
@@ -146,6 +160,9 @@ function tokenize(s,    i, n, c, c2, j, dash, delim) {
             if (nheredoc > 0) i = read_heredocs(s, i, n)
             continue
         }
+        # `>&`, `>|` and `&>` are parts of a redirection operator, not command separators.
+        if ((c == "&" || c == "|") && inword && !wquoted && word ~ />$/) { word = word c; wplain++; i++; continue }
+        if (c == "&" && substr(s, i + 1, 1) == ">") { flush_word(); word = c; inword = 1; wplain = 1; i++; continue }
         if (c == ";" || c == "&" || c == "|" || c == "(" || c == ")") { end_cmd(); i++; continue }
         if (substr(s, i, 2) == "<<" && substr(s, i, 3) != "<<<") {
             flush_word(); i += 2; dash = 0
@@ -161,6 +178,7 @@ function tokenize(s,    i, n, c, c2, j, dash, delim) {
             nheredoc++; HD[nheredoc] = delim; HDDASH[nheredoc] = dash
             continue
         }
+        if (!wquoted) wplain++
         word = word c; inword = 1; i++
     }
     end_cmd()
@@ -169,7 +187,7 @@ function tokenize(s,    i, n, c, c2, j, dash, delim) {
 # ── option parsing shared by the CLIs: positionals P/PI, output format, -f/--format value, --raw ──
 function kparse(A, s, n, shortvals,    i, w, eq, key, val, f, rest) {
     split("", P); split("", PI)
-    np = 0; outfmt = ""; fmtval = ""; dd = 0; raw = 0
+    np = 0; outfmt = ""; fmtval = ""; tmpl = ""; dd = 0; raw = 0
     for (i = s; i <= n; i++) {
         w = A[i]
         if (w == "--") { dd = i; break }
@@ -178,6 +196,7 @@ function kparse(A, s, n, shortvals,    i, w, eq, key, val, f, rest) {
             if (eq) { key = substr(w, 1, eq - 1); val = substr(w, eq + 1) }
             if (key == "--output") { if (!eq) { i++; val = A[i] } outfmt = tolower(val) }
             else if (key == "--format") { if (!eq) { i++; val = A[i] } fmtval = val }
+            else if (key == "--template") { if (!eq) { i++; val = A[i] } tmpl = val }
             else if (key == "--raw") raw = 1
             else if (!eq && (key in LV)) i++
             continue
@@ -196,6 +215,11 @@ function kparse(A, s, n, shortvals,    i, w, eq, key, val, f, rest) {
         np++; P[np] = w; PI[np] = i
     }
 }
+# `-o jsonpath={.}` and `-o go-template={{.}}` print the whole object, exactly like -o json.
+function proj_leaks(t) {
+    t = tolower(t); gsub(/[ \t]/, "", t)
+    return t ~ /[{](\.|@|\.items|\.items\[\*\])[}]/
+}
 function skipopts(A, s, n, vals) {
     while (s <= n && substr(A[s], 1, 1) == "-") {
         if (length(A[s]) == 2 && index(vals, substr(A[s], 2, 1))) s += 2
@@ -257,6 +281,8 @@ function kube(A, s, n,    verb, m, parts, k, r, rlist) {
                 report("kubectl describe " r " prints the full container spec, including inline credentials", "kubectl get " r " -o jsonpath=" SQ "{.items[*].spec.containers[*].image}" SQ ", -o custom-columns=NAME:.metadata.name,STATUS:.status.phase, -o name, or kubectl get events / kubectl logs; say which field you need")
             else if (outfmt == "json" || outfmt == "yaml")
                 report("kubectl get " r " -o " outfmt " prints the full container spec, including inline credentials", "-o jsonpath=" SQ "{.items[*].spec.containers[*].image}" SQ ", -o custom-columns=NAME:.metadata.name,STATUS:.status.phase, -o name, -o wide, or the status fields you need")
+            else if ((outfmt ~ /^(jsonpath|go-template|jsonpath-as-json)=/ || tmpl != "") && proj_leaks(tmpl outfmt))
+                report("kubectl get " r " with a projection that selects the whole object prints the full container spec, including inline credentials", "-o jsonpath=" SQ "{.items[*].spec.containers[*].image}" SQ ", -o custom-columns=NAME:.metadata.name,STATUS:.status.phase, -o name, -o wide, or the status fields you need")
         }
     }
 }
@@ -323,19 +349,36 @@ function gcloud(A, s, n,    k) {
     if (P[1] == "secrets" && P[2] == "versions" && P[3] == "access") report("gcloud secrets versions access prints the secret", "gcloud secrets versions list, or gcloud secrets describe (metadata only)")
     if (P[1] == "auth") for (k = 2; k <= np; k++) if (P[k] ~ /^print-(access|identity)-token$/) report("gcloud auth " P[k] " prints a token", "gcloud auth list")
 }
-function reader(A, s, n,    b, k, w, mode, havepat, need, afterdd, kind, valued, valued2) {
-    b = base(A[s]); mode = ""; valued = " "; valued2 = " "
-    if (b ~ /^(grep|egrep|fgrep|rg|ag)$/) { mode = "pattern"; valued = " -m -A -B -C -g -t -T -d -D --glob --type --type-not --max-count --include --exclude --exclude-dir --context --after-context --before-context --max-depth --threads " }
-    else if (b ~ /^(sed|awk|gawk|jq|yq)$/) { mode = "script"; valued = " -v -F --indent "; valued2 = " --arg --argjson --slurpfile --rawfile " }
+# Scans one attached or clustered short option (-ePATTERN, -nePATTERN, -m5, -F:) of a pattern or script tool:
+# sc_pat is set when it supplies the pattern or script, sc_skip when its value is the next word.
+function scan_short(w, shortvals, sed_like,    i, c, last) {
+    sc_pat = 0; sc_skip = 0; last = length(w)
+    for (i = 2; i <= last; i++) {
+        c = substr(w, i, 1)
+        if (c == "e" || c == "f") { sc_pat = 1; sc_skip = (i == last); return }
+        if (index(shortvals, c)) { sc_skip = (i == last); return }
+        if (sed_like && c == "i") return
+    }
+}
+function reader(A, s, n,    b, k, w, mode, havepat, need, afterdd, kind, valued, valued2, shortvals) {
+    b = base(A[s]); mode = ""; valued = " "; valued2 = " "; shortvals = ""
+    if (b ~ /^(grep|egrep|fgrep|rg|ag)$/) { mode = "pattern"; shortvals = (b ~ /^(grep|egrep|fgrep)$/) ? "mABCdD" : (b == "rg") ? "mABCdjEMrgtT" : "ABCGgmpW"; valued = " --glob --type --type-not --max-count --include --exclude --exclude-dir --context --after-context --before-context --max-depth --threads " }
+    else if (b ~ /^(sed|awk|gawk|jq|yq)$/) { mode = "script"; shortvals = "vF"; valued = " --indent "; valued2 = " --arg --argjson --slurpfile --rawfile " }
     # The first operand is the pattern or script unless -e/-f/--regexp/--file/--expression supplies it; only the rest are files.
     havepat = 0
-    if (mode != "") for (k = s + 1; k <= n; k++) if (A[k] ~ /^-[a-zA-Z]*[ef]$/ || A[k] ~ /^--(regexp|file|expression|from-file)(=|$)/) havepat = 1
+    if (mode != "") for (k = s + 1; k <= n; k++) {
+        w = A[k]
+        if (w == "--") break
+        if (w ~ /^--(regexp|file|expression|from-file)(=|$)/) havepat = 1
+        else if (w ~ /^-[a-zA-Z]/) { scan_short(w, shortvals, b == "sed"); if (sc_pat) havepat = 1 }
+    }
     need = (mode != "" && !havepat); afterdd = 0
     for (k = s + 1; k <= n; k++) {
         w = A[k]
         if (w == "--" && !afterdd) { afterdd = 1; continue }
         if (!afterdd && substr(w, 1, 1) == "-" && length(w) > 1) {
-            if (mode != "" && (w ~ /^-[a-zA-Z]*[ef]$/ || w ~ /^--(regexp|file|expression|from-file)$/ || index(valued, " " w " "))) k++
+            if (mode != "" && w ~ /^-[a-zA-Z]/) { scan_short(w, shortvals, b == "sed"); if (sc_skip) k++ }
+            else if (mode != "" && (w ~ /^--(regexp|file|expression|from-file)$/ || index(valued, " " w " "))) k++
             else if (index(valued2, " " w " ")) k += 2
             continue
         }
@@ -345,13 +388,22 @@ function reader(A, s, n,    b, k, w, mode, havepat, need, afterdd, kind, valued,
     }
 }
 
+function drop_redirects(A, s, n,    k, m, w) {
+    m = s
+    for (k = s + 1; k <= n; k++) {
+        w = A[k]
+        if (w ~ /^[0-9]*[<>]/) { if (w ~ /^[0-9]*[<>]+&?-?$/) k++; continue }
+        A[++m] = w
+    }
+    return m
+}
 function analyze(A, s, n,    w, b, k, names, p) {
     while (s <= n) {
         w = A[s]; b = base(w)
         if (is_assign(w)) { s++; continue }
         if (w ~ /^[0-9]*[<>]/) { s += (w ~ /^[0-9]*[<>]+&?-?$/) ? 2 : 1; continue }
         if (b in KW) { s++; continue }
-        if (b == "command" || b == "builtin") { s++; if (s <= n && (A[s] == "-v" || A[s] == "-V")) return; continue }
+        if (b == "command" || b == "builtin") { s++; if (s <= n && (A[s] == "-v" || A[s] == "-V")) return; if (s <= n && A[s] == "-p") s++; continue }
         if (b == "sudo" || b == "doas") { s = skipopts(A, s + 1, n, "ugChprtUD"); continue }
         if (b == "xargs") { s = skipopts(A, s + 1, n, "IniPLdsEa"); continue }
         if (b == "timeout") { s = skipopts(A, s + 1, n, "ks") + 1; continue }
@@ -363,6 +415,7 @@ function analyze(A, s, n,    w, b, k, names, p) {
             while (s <= n) {
                 w = A[s]
                 if (is_assign(w)) s++
+                else if (w ~ /^[0-9]*[<>]/) s += (w ~ /^[0-9]*[<>]+&?-?$/) ? 2 : 1
                 else if (w == "-u" || w == "-C" || w == "-S" || w == "--unset" || w == "--chdir" || w == "--split-string") s += 2
                 else if (substr(w, 1, 1) == "-") s++
                 else break
@@ -393,6 +446,8 @@ function analyze(A, s, n,    w, b, k, names, p) {
         for (k = s + 1; k <= n; k++) if (A[k] ~ /^--show-secrets/) report("pulumi --show-secrets prints decrypted secrets", "pulumi config / pulumi stack output without --show-secrets (secrets stay masked)")
         return
     }
+    # A redirect is not a variable name: `printenv > f` and `export > f` still dump the whole environment.
+    if (b == "printenv" || b == "export" || b == "declare" || b == "typeset") n = drop_redirects(A, s, n)
     if (b == "printenv") {
         names = 0
         for (k = s + 1; k <= n; k++) {
@@ -426,7 +481,8 @@ BEGIN {
     for (i in L) KW[L[i]] = 1
     split("pods po pod deployments deployment deploy statefulsets statefulset sts daemonsets daemonset ds jobs job cronjobs cronjob cj configmaps configmap cm replicasets replicaset rs replicationcontrollers rc all", L, " ")
     for (i in L) SENS[L[i]] = 1
-    enqueue(ENVIRON["GS_COMMAND"])
+    CMD = ENVIRON["GS_COMMAND"]
+    enqueue(CMD)
     while (qi < queued) { qi++; tokenize(queue[qi]) }
 }
 AWK

package/package/corpus/hooks/scripts/cratis-guard-writes.sh

@@ -18,23 +18,74 @@ set -euo pipefail
 
 # SCRIPTDIR, not a path relative to the caller: shellcheck resolves a plain relative `source=`
 # against the current working directory, and these hooks are linted from wherever CI happens to run.
+script_directory="${BASH_SOURCE[0]%/*}"
+[ "$script_directory" != "${BASH_SOURCE[0]}" ] || script_directory=.
 # shellcheck source=SCRIPTDIR/hook-lib.sh
-. "$(dirname "${BASH_SOURCE[0]}")/hook-lib.sh"
+. "$script_directory/hook-lib.sh"
 
 [ "${CRATIS_HOOKS_ALLOW_PROTECTED_WRITES:-0}" = "1" ] && exit 0
 
-input="$(hook_read_stdin)"
+# This guard runs before every write, so it avoids subprocesses where a builtin does the same job:
+# the helpers below return through REPLY instead of printing into a command substitution.
+# Read stdin with the read builtin: opening /dev/stdin fails with ENXIO when stdin is a socket (Linux, Node pipes).
+input=""
+IFS= read -r -d '' input || true
 [ -n "$input" ] || exit 0
 hook_have jq || exit 0
 
-root="$(hook_repo_root)"
-cwd="$(hook_json "$input" '.cwd')"
-[ -n "$cwd" ] || cwd="$root"
+# One jq call reads every field the guard uses. Fields are NUL-terminated (embedded NULs are dropped,
+# as a command substitution would drop them); a missing, null, false or unreadable path is empty.
+cwd="" file="" notebook="" new_content="" new_string=""
+{
+    IFS= read -r -d '' cwd
+    IFS= read -r -d '' file
+    IFS= read -r -d '' notebook
+    IFS= read -r -d '' new_content
+    IFS= read -r -d '' new_string
+} < <(jq -j '
+    def field(path): ([try (path // empty) catch empty] | first // "")
+        | if type == "string" then . else tojson end
+        | gsub("\u0000"; "");
+    [field(.cwd), field(.tool_input.file_path), field(.tool_input.notebook_path),
+     field(.tool_input.content), field(.tool_input.new_string)]
+    | .[] | ., "\u0000"
+' <<<"$input" 2>/dev/null) || true
+# Command substitution stripped trailing newlines from each field; keep that behaviour.
+for field_name in cwd file notebook new_content new_string; do
+    while [[ "${!field_name}" == *$'\n' ]]; do printf -v "$field_name" '%s' "${!field_name%$'\n'}"; done
+done
 
-file="$(hook_json "$input" '.tool_input.file_path')"
-[ -n "$file" ] || file="$(hook_json "$input" '.tool_input.notebook_path')"
+[ -n "$cwd" ] || cwd="$(hook_repo_root)"
+[ -n "$file" ] || file="$notebook"
 [ -n "$file" ] || exit 0
 
+# dir_of / base_of / relative_to mirror dirname, basename and hook_relpath for the absolute,
+# normalized paths used here. abspath mirrors hook_abspath. All return through REPLY.
+dir_of() {
+    REPLY="${1%/*}"
+    [ -n "$REPLY" ] || REPLY=/
+}
+
+base_of() {
+    REPLY="${1##*/}"
+    [ -n "$REPLY" ] || REPLY=/
+}
+
+abspath() {
+    case "$1" in
+        /*) REPLY="$1" ;;
+        *) REPLY="${2%/}/$1" ;;
+    esac
+}
+
+relative_to() {
+    local root="${2%/}"
+    case "$1" in
+        "$root"/*) REPLY="${1#"$root"/}" ;;
+        *) REPLY="$1" ;;
+    esac
+}
+
 # Lexically normalize before any Git lookup or parent walk, including nonexistent segments.
 # Component parsing preserves spaces and glob characters without depending on realpath.
 normalize_target_path() {
@@ -52,17 +103,22 @@ normalize_target_path() {
             *) normalized="$normalized/$component" ;;
         esac
     done
-    printf '%s\n' "${normalized:-/}"
+    REPLY="${normalized:-/}"
 }
 
-file="$(hook_abspath "$file" "$cwd")"
-file="$(normalize_target_path "$file")"
-# Pi can run the bundled script in a consumer checkout; this root is only for diagnostics.
-root="$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null || printf '%s\n' "$cwd")"
-rel="$(hook_relpath "$file" "$root")"
-base="$(basename "$file")"
+abspath "$file" "$cwd"
+normalize_target_path "$REPLY"
+file="$REPLY"
+base_of "$file"
+base="$REPLY"
 
 block() {
+    # Pi can run the bundled script in a consumer checkout; this root is only for diagnostics,
+    # so it is looked up only when a write is actually refused.
+    local root rel
+    root="$(git -C "$cwd" rev-parse --show-toplevel 2>/dev/null || printf '%s\n' "$cwd")"
+    relative_to "$file" "$root"
+    rel="$REPLY"
     printf 'BLOCKED by cratis-guard-writes: %s\n\n%s\n\n%s\n' "$rel" "$1" "$2" >&2
     exit 2
 }
@@ -70,36 +126,70 @@ block() {
 # Check both the addressed path and its physical destination: settings may be symlinks to
 # templates, and an innocently named link may target a protected file. Preserve missing suffixes.
 physical_target_path() {
-    local target="$1" directory suffix="" link hops=0
+    local target="$1" directory suffix="" link hops=0 start="$PWD"
+    physical_file=""
     while [ -L "$target" ]; do
         hops=$((hops + 1))
         [ "$hops" -le 40 ] || return 1
         link="$(readlink "$target")" || return 1
-        target="$(hook_abspath "$link" "$(dirname "$target")")"
+        dir_of "$target"
+        abspath "$link" "$REPLY"
+        target="$REPLY"
     done
-    directory="$(dirname "$target")"
-    suffix="/$(basename "$target")"
+    dir_of "$target"
+    directory="$REPLY"
+    base_of "$target"
+    suffix="/$REPLY"
     while [ ! -d "$directory" ]; do
         [ "$directory" != "/" ] || return 1
-        suffix="/$(basename "$directory")$suffix"
-        directory="$(dirname "$directory")"
+        base_of "$directory"
+        suffix="/$REPLY$suffix"
+        dir_of "$directory"
+        directory="$REPLY"
     done
-    directory="$(cd -P "$directory" 2>/dev/null && pwd -P)" || return 1
-    printf '%s\n' "${directory%/}$suffix"
+    cd -P "$directory" 2>/dev/null || return 1
+    directory="$PWD"
+    cd "$start" 2>/dev/null || true
+    physical_file="${directory%/}$suffix"
+}
+
+# The origin URL, looked up once per repository per run.
+origin_cache_root=""
+origin_cache_value=""
+repository_origin() {
+    if [ "$origin_cache_root" != "$1" ]; then
+        origin_cache_value="$(git -C "$1" remote get-url origin 2>/dev/null || true)"
+        origin_cache_root="$1"
+    fi
+    REPLY="$origin_cache_value"
+}
+
+# Case-insensitive ASCII match of the origin URL, equivalent to grep -Eiq on a single line.
+origin_matches() {
+    # C locale, as the grep it replaced ran: a non-ASCII letter (the Kelvin sign) must not match [a-z].
+    local LC_ALL=C pattern="$1" matched=1
+    shopt -s nocasematch
+    # shellcheck disable=SC2034
+    [[ "$REPLY" =~ $pattern ]] && matched=0
+    shopt -u nocasematch
+    return "$matched"
 }
 
 # ── 4. Agent controls and installed managed trees ─────────────────────────────
 agent_control_target() {
-    local target="$1" directory policy_root target_rel origin
-    directory="$(dirname "$target")"
+    local target="$1" directory policy_root target_rel
+    dir_of "$target"
+    directory="$REPLY"
     # Keep the addressed spelling here, even when an adapter directory is a symlink.
     # .git is a directory in a checkout and a file in a linked worktree.
     while [ ! -e "$directory/.git" ]; do
         [ "$directory" != "/" ] || return 1
-        directory="$(dirname "$directory")"
+        dir_of "$directory"
+        directory="$REPLY"
     done
     policy_root="$directory"
-    target_rel="$(hook_relpath "$target" "$policy_root")"
+    relative_to "$target" "$policy_root"
+    target_rel="$REPLY"
     if [ -f "$policy_root/.cratis/ai.manifest.json" ]; then
         case "$target_rel" in
             .cratis/ai/*) return 0 ;;
@@ -122,8 +212,8 @@ agent_control_target() {
         esac
     else
         # The corpus is authored source in Cratis/AI, not a managed installation.
-        origin="$(git -C "$policy_root" remote get-url origin 2>/dev/null || true)"
-        if printf '%s\n' "$origin" | LC_ALL=C grep -Eiq '^(https://github\.com/|git@github\.com:|ssh://git@github\.com(:[0-9]+)?/)cratis/ai(\.git)?/?$'; then
+        repository_origin "$policy_root"
+        if origin_matches '^(https://github\.com/|git@github\.com:|ssh://git@github\.com(:[0-9]+)?/)cratis/ai(\.git)?/?$'; then
             return 1
         fi
     fi
@@ -134,7 +224,7 @@ agent_control_target() {
     return 1
 }
 
-physical_file="$(physical_target_path "$file" || true)"
+physical_target_path "$file" || physical_file=""
 if agent_control_target "$file" || { [ -n "$physical_file" ] && agent_control_target "$physical_file"; }; then
     block \
         "This target controls the agent's permissions or extensions, or belongs to an installed managed corpus/adapter tree. Agent Write/Edit calls may not alter their own controls or managed instructions." \
@@ -146,19 +236,30 @@ fi
 # Merely *mentioning* the string — documentation, a rule file, this corpus — is not a match.
 marker='^[[:space:]]*(//|/\*|#|<!--)[[:space:]]*@generated by Cratis'
 
+# True when one of the first five lines of stdin carries the marker (head -n 5 | grep -E, without forks).
+first_lines_carry_marker() {
+    local LC_ALL=C line count=0
+    while [ "$count" -lt 5 ] && { IFS= read -r line || [ -n "$line" ]; }; do
+        count=$((count + 1))
+        # shellcheck disable=SC2034
+        [[ "$line" =~ $marker ]] && return 0
+    done
+    return 1
+}
+
+# The cheap in-shell header test runs first; grep -I then confirms the file is text, as before.
 if [ -f "$file" ] \
-    && LC_ALL=C grep -Iq . "$file" 2>/dev/null \
-    && head -n 5 "$file" 2>/dev/null | LC_ALL=C grep -Eq "$marker"; then
+    && first_lines_carry_marker 2>/dev/null <"$file" \
+    && LC_ALL=C grep -Iq . "$file" 2>/dev/null; then
     block \
         "This file is generated output (its header marks it as generated by Cratis). Rule 15 [contract] in .cratis/ai/rules/general.md: never edit a generated file — the next build overwrites it." \
         "Instead: change the C# source it is generated from (the [Command] / [ReadModel] record) and rebuild with 'dotnet build -c Debug' to regenerate the proxy."
 fi
 
 # The same guard for authoring a *new* file that pretends to be generated output.
-new_content="$(hook_json "$input" '.tool_input.content')"
-[ -n "$new_content" ] || new_content="$(hook_json "$input" '.tool_input.new_string')"
+[ -n "$new_content" ] || new_content="$new_string"
 if [ -n "$new_content" ] \
-    && printf '%s\n' "$new_content" | head -n 5 | LC_ALL=C grep -Eq "$marker"; then
+    && first_lines_carry_marker <<<"$new_content"; then
     block \
         "The content being written opens with a Cratis generated-file header. Proxies are produced by the Cratis proxy generator, never hand-written." \
         "Instead: write the C# source and run 'dotnet build -c Debug' to generate the proxy."
@@ -166,16 +267,20 @@ fi
 
 # ── 2. Dependency manifests, lockfiles, SDK and NuGet configuration ───────────
 manifest_writes_allowed() {
-    local setting="" origin directory policy_root
+    local setting="" directory policy_root start="$PWD"
     # Authorization belongs to the write target, which may be outside the session's checkout.
     # New files can have nonexistent parents; find their nearest existing directory first.
-    directory="$(dirname "$file")"
+    dir_of "$file"
+    directory="$REPLY"
     while [ ! -d "$directory" ]; do
         [ "$directory" != "/" ] || return 1
-        directory="$(dirname "$directory")"
+        dir_of "$directory"
+        directory="$REPLY"
     done
     # Follow existing directory symlinks before asking Git which repository owns the target.
-    directory="$(cd -P "$directory" 2>/dev/null && pwd -P)" || return 1
+    cd -P "$directory" 2>/dev/null || return 1
+    directory="$PWD"
+    cd "$start" 2>/dev/null || true
     policy_root="$(git -C "$directory" rev-parse --show-toplevel 2>/dev/null)" || return 1
     if [ -f "$policy_root/.cratis/ai.json" ]; then
         # Only actual booleans override the default; jq's `// empty` would discard false.
@@ -185,9 +290,9 @@ manifest_writes_allowed() {
         true) return 0 ;;
         false) return 1 ;;
     esac
-    origin="$(git -C "$policy_root" remote get-url origin 2>/dev/null || true)"
+    repository_origin "$policy_root"
     # Anchor host, owner and the single repository segment; never infer ownership from profiles.
-    printf '%s\n' "$origin" | LC_ALL=C grep -Eiq '^(https://github\.com/|git@github\.com:|ssh://git@github\.com(:[0-9]+)?/)cratis/[a-z0-9_.-]+/?$'
+    origin_matches '^(https://github\.com/|git@github\.com:|ssh://git@github\.com(:[0-9]+)?/)cratis/[a-z0-9_.-]+/?$'
 }
 
 case "$base" in