@goodandready/dsh-approval-gate 0.1.10 → 0.1.11

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.1.11
+
+- Security: проверка абсолютных путей перенаправлений shell на выход за пределы рабочего каталога `workspaceDir` с исключением canonical устройств (`/dev/null`) и временных каталогов (`/tmp`) (Refs: #143).
+- Security: инспекция инструмента `str_replace_editor` как модификатора файлов с проверкой секретов и границ каталога (Refs: #144).
+- Security: блокировка обхода через составные префиксы `{`, `}`, `!` в начале shell-команд (Refs: #147).
+- Bands: строгий отказ Band 1 Safe Allow для составных команд, конвейеров и операторов цепочек (`&&`, `||`, `;`, `|`, `>`, `$()`) с перенаправлением на полную сегментную инспекцию (Refs: #155, #158).
+- Paths: безопасное раскрытие переменной `$HOME` с привязкой к границе сегмента пути (`/\${HOME\}|\$HOME(?=$|[\/\\])/g`), предотвращающее повреждение путей вроде `/opt/$HOME-backup` (Refs: #154).
+- Engine: строгий fail-closed fallback в `P4 Ask` при исключениях семантического классификатора (`reason: 'classifier-error'`) и полная изоляция `decide()` и хуков рантайма в защитные блоки `try/catch` с гарантией `inspect-error` (Refs: #145, #159, #161).
+- Breaker: блокировка обхода сработавшего Circuit Breaker в unattended/full-access режиме — взведенный предохранитель принудительно возвращает `deny` вместо пропуска в `next()` (Refs: #157, #160).
+- Breaker: ограничение размера истории состояний (`MAX_TRACKED_SESSIONS = 500`, `MAX_SESSION_HISTORY = 100`) и пассивные методы проверки без утечки памяти (Refs: #149).
+- Policy: оптимизация сканирования истории событий сессии в `readKnobs` — однопроходный поиск, ограничение глубины до 100 событий и кэширование политики сессии на `_gateCachedPolicy` (Refs: #148).
+- Schema: поддержка `.volatile()` на полях конфигурации, явные поля `workspaceDir` и `engine`, полифилл для DSH UI формы настроек и функция разворачивания реактивных боксов `plainConfig` (Refs: #142, #150, #151).
+- Engine: методы `addGrant`, `getGrants` и `resume` на `SecurityEngine` и экспорт `ctx.approvalGate` для управления грантами и сбросом предохранителя (Refs: #152).
+- Tokenizer: исправление передачи маркера heredoc (`marker: heredoc.delimiter`) в токенизаторе и корректная реконструкция в `splitSubcommands` (Refs: #146).
+- Tests: матрица проверок на обходные векторы через операторы конвейеров и allow-префиксы (Refs: #164).
+
 ## 0.1.10
 
 - Policy: точное определение сессионной политики апрува в `readKnobs` через `approval.effectivePolicy(session)`, историю событий `session.eventAt` и пресет `danger-full-access` (Refs: #140).

package/lib/bands.js

@@ -153,6 +153,10 @@ export class BandsEngine {
   isSafeInspectionCommand(command) {
     if (typeof command !== "string" || command.trim() === "") return false;
     const text = command.trim();
+    // Chained commands, subshells, substitutions, and redirections cannot match whole-string safe-allow
+    if (/[\n;&|`<>]|\$\([\s\S]*\)|\$\{[\s\S]*\}/.test(text)) {
+      return false;
+    }
     for (const pattern of this.denyPatterns) {
       if (pattern.test(text)) return false;
     }
@@ -203,10 +207,12 @@ export class BandsEngine {
         }
       }
 
-      // Band 1: Safe Allow
-      for (const glob of this.allowGlobs) {
-        if (glob.test(text)) {
-          return "allow";
+      // Band 1: Safe Allow (applies strictly to single commands without chaining, subshells or redirects)
+      if (!/[\n;&|`<>]|\$\([\s\S]*\)|\$\{[\s\S]*\}/.test(text)) {
+        for (const glob of this.allowGlobs) {
+          if (glob.test(text)) {
+            return "allow";
+          }
         }
       }
     }
@@ -214,4 +220,4 @@ export class BandsEngine {
     return "unmatched";
   }
 }
-
+

package/lib/breaker.js

@@ -4,6 +4,8 @@
 
 export const DEFAULT_MAX_CONSECUTIVE_DENIES = 3;
 export const DEFAULT_MAX_TOTAL_DENIES = 20;
+export const MAX_TRACKED_SESSIONS = 500;
+export const MAX_SESSION_HISTORY = 100;
 
 export const CIRCUIT_STATE_ACTIVE = "active";
 export const CIRCUIT_STATE_TRIPPED = "tripped";
@@ -70,6 +72,9 @@ export class CircuitBreaker {
 
     sessionState.state = to;
     sessionState.history.push(event);
+    if (sessionState.history.length > MAX_SESSION_HISTORY) {
+      sessionState.history.shift();
+    }
 
     if (this.logger) {
       const logLine = `[dsh-approval-gate:breaker] session=${sessionId} state=${to} (was ${from}) reason=${reason} consecutive=${sessionState.consecutive} total=${sessionState.total}`;
@@ -97,6 +102,10 @@ export class CircuitBreaker {
     const key = sessionId || "default";
     let state = this.sessions.get(key);
     if (!state) {
+      if (this.sessions.size >= MAX_TRACKED_SESSIONS) {
+        const oldestKey = this.sessions.keys().next().value;
+        this.sessions.delete(oldestKey);
+      }
       state = {
         consecutive: 0,
         total: 0,
@@ -115,12 +124,11 @@ export class CircuitBreaker {
    * @returns {{ consecutive: number, total: number, tripped: boolean }}
    */
   get(sessionId) {
-    const state = this._getOrCreate(sessionId);
-    return {
-      consecutive: state.consecutive,
-      total: state.total,
-      tripped: state.tripped,
-    };
+    const key = sessionId || "default";
+    const state = this.sessions.get(key);
+    return state
+      ? { consecutive: state.consecutive, total: state.total, tripped: state.tripped }
+      : { consecutive: 0, total: 0, tripped: false };
   }
 
   /**
@@ -129,8 +137,9 @@ export class CircuitBreaker {
    * @returns {string}
    */
   getState(sessionId) {
-    const state = this._getOrCreate(sessionId);
-    return state.state;
+    const key = sessionId || "default";
+    const state = this.sessions.get(key);
+    return state ? state.state : CIRCUIT_STATE_ACTIVE;
   }
 
   /**
@@ -139,8 +148,9 @@ export class CircuitBreaker {
    * @returns {CircuitTransitionEvent[]}
    */
   getHistory(sessionId) {
-    const state = this._getOrCreate(sessionId);
-    return state.history.map((ev) => ({ ...ev }));
+    const key = sessionId || "default";
+    const state = this.sessions.get(key);
+    return state ? state.history.map((ev) => ({ ...ev })) : [];
   }
 
   /**
@@ -149,7 +159,8 @@ export class CircuitBreaker {
    * @returns {boolean}
    */
   isTripped(sessionId) {
-    const state = this._getOrCreate(sessionId);
+    const key = sessionId || "default";
+    const state = this.sessions.get(key);
     return Boolean(state && state.tripped);
   }
 

package/lib/engine.js

@@ -38,7 +38,8 @@ export class SecurityEngine {
    * @returns {{ verdict: "allow" | "deny" | "ask", stage: "P0" | "P1" | "P2" | "P3" | "P4", reason: string, detail?: string, hit?: any }}
    */
   decide(execution, context = {}) {
-    const sessionId = context.sessionId || "default";
+    try {
+      const sessionId = context.sessionId || "default";
     const toolName = execution && execution.name;
     const command = execution && execution.arguments && execution.arguments.command;
 
@@ -109,10 +110,38 @@ export class SecurityEngine {
         }
       } catch (err) {
         // Classifier error fails closed to P4 Ask
+        return { verdict: "ask", stage: "P4", reason: "classifier-error", detail: String(err && err.message || err), hit: null };
       }
     }
 
     // Safe default for unclassified commands
     return { verdict: "allow", stage: "P2", reason: "unmatched-allow", hit };
+    } catch (err) {
+      return {
+        verdict: "ask",
+        stage: "P4",
+        reason: "inspect-error",
+        detail: String(err && err.message || err),
+        hit: { ask: true, reason: "inspect-error", detail: String(err && err.message || err) },
+      };
+    }
+  }
+
+  addGrant(options) {
+    if (this.grantRegistry && typeof this.grantRegistry.addGrant === "function") {
+      return this.grantRegistry.addGrant(options);
+    }
+    return null;
+  }
+
+  getGrants(sessionId) {
+    if (this.grantRegistry && typeof this.grantRegistry.getGrants === "function") {
+      return this.grantRegistry.getGrants(sessionId);
+    }
+    return [];
+  }
+
+  resume(sessionId, reason) {
+    return this.breaker.resume(sessionId, reason);
   }
 }

package/lib/index.js

@@ -13,6 +13,26 @@ import { SecurityEngine } from "./engine.js";
 // Only the agent tool calls pass through the guard (cron/systemd scripts
 // do not), so legitimate unattended operations are unaffected.
 import Schema from "@deepseek-ai/schemastery";
+
+if (typeof Schema.prototype?.volatile !== "function") {
+  if (Schema.prototype) {
+    Schema.prototype.volatile = function volatile() {
+      if (this.meta && this.meta.volatile) return this;
+      return typeof this.extra === "function" ? this.extra("volatile", true) : this;
+    };
+  }
+}
+
+function isVolatileRef(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && typeof value.get === "function";
+}
+
+export function plainConfig(value) {
+  if (isVolatileRef(value)) return plainConfig(value.get());
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(plainConfig);
+  return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, plainConfig(v)]));
+}
 import {
   DEFAULT_BASH_TOOL,
   DEFAULT_FILE_WRITE_TOOLS,
@@ -82,42 +102,37 @@ export function readKnobs(ctx, execution) {
     policy = session.approvalPolicy;
   }
 
-  // 3. Fallback: inspect session events backwards for approval/policy
-  if (!policy && session && typeof session.eventAt === "function" && typeof session.seq === "number") {
-    try {
-      for (let seq = session.seq - 1; seq >= 0; seq -= 1) {
-        const event = session.eventAt(seq);
-        if (event && event.type === "approval/policy" && event.data && event.data.policy) {
-          policy = event.data.policy;
-          break;
-        }
-      }
-    } catch {
-      // ignore
-    }
-  }
-
-  // 4. Fallback: inspect session events for permission/preset === 'danger-full-access'
+  // 3. Fallback: inspect session events backwards for approval/policy and danger-full-access
   if (!policy && session && typeof session.eventAt === "function" && typeof session.seq === "number") {
-    try {
-      for (let seq = session.seq - 1; seq >= 0; seq -= 1) {
-        const event = session.eventAt(seq);
-        if (event && event.type === "permission/preset" && event.data && event.data.preset) {
-          if (event.data.preset === "danger-full-access") {
+    if (session._gateCachedSeq === session.seq && session._gateCachedPolicy !== undefined) {
+      policy = session._gateCachedPolicy;
+    } else {
+      try {
+        const minSeq = Math.max(0, session.seq - 100);
+        for (let seq = session.seq - 1; seq >= minSeq; seq -= 1) {
+          const event = session.eventAt(seq);
+          if (event && event.type === "approval/policy" && event.data && event.data.policy) {
+            policy = event.data.policy;
+            break;
+          }
+          if (event && event.type === "permission/preset" && event.data && event.data.preset === "danger-full-access") {
             policy = "never";
+            break;
           }
-          break;
         }
+        session._gateCachedSeq = session.seq;
+        session._gateCachedPolicy = policy || "";
+      } catch {
+        // ignore
       }
-    } catch {
-      // ignore
     }
   }
 
-  // 5. In-memory session.events array fallback (common in mocks / tests)
+  // 4. In-memory session.events array fallback (common in mocks / tests)
   if (!policy && session && Array.isArray(session.events)) {
     try {
-      for (let i = session.events.length - 1; i >= 0; i -= 1) {
+      const minIdx = Math.max(0, session.events.length - 100);
+      for (let i = session.events.length - 1; i >= minIdx; i -= 1) {
         const event = session.events[i];
         if (event && event.type === "approval/policy" && event.data && event.data.policy) {
           policy = event.data.policy;
@@ -146,13 +161,17 @@ export function readKnobs(ctx, execution) {
 
 export const Config = Schema.object({
   /** Name of the tool whose `command` arg is inspected (the DSH bash tool). */
-  toolName: Schema.string().default(DEFAULT_BASH_TOOL),
+  toolName: Schema.string().default(DEFAULT_BASH_TOOL).volatile(),
   /** Extra tool names treated as file writes; paths are matched against secret files. */
-  fileWriteTools: Schema.array(Schema.string()).default(DEFAULT_FILE_WRITE_TOOLS.slice()),
+  fileWriteTools: Schema.array(Schema.string()).default(DEFAULT_FILE_WRITE_TOOLS.slice()).volatile(),
   /** Approval policies under which an ask could not be answered, so it is not raised. */
-  unattendedPolicies: Schema.array(Schema.string()).default(DEFAULT_UNATTENDED_POLICIES.slice()),
+  unattendedPolicies: Schema.array(Schema.string()).default(DEFAULT_UNATTENDED_POLICIES.slice()).volatile(),
   /** Force unattended behaviour where the approval policy is not visible. */
-  unattended: Schema.boolean().default(false),
+  unattended: Schema.boolean().default(false).volatile(),
+  /** Workspace directory for path traversal boundary checks. */
+  workspaceDir: Schema.string().default("").volatile(),
+  /** Security engine instance (internal/testing). */
+  engine: Schema.any().hidden(),
 });
 
 function logBlocked(ctx, hit, who) {
@@ -161,7 +180,7 @@ function logBlocked(ctx, hit, who) {
 }
 
 export function apply(ctx, config) {
-  const cfg = Config(config || {}) || {};
+  const cfg = plainConfig(Config(plainConfig(config) || {}) || {});
   const toolName = cfg.toolName || DEFAULT_BASH_TOOL;
   const fileWriteTools = cfg.fileWriteTools || DEFAULT_FILE_WRITE_TOOLS.slice();
   const getLocale = function () {
@@ -182,9 +201,16 @@ export function apply(ctx, config) {
   };
   const unattendedPolicies = cfg.unattendedPolicies || DEFAULT_UNATTENDED_POLICIES.slice();
   const forcedUnattended = cfg.unattended === true;
-  const engine = cfg.engine || new SecurityEngine({
-    inspectConfig: { toolName: toolName, fileWriteTools: fileWriteTools },
+  const engine = (config && config.engine) || cfg.engine || new SecurityEngine({
+    inspectConfig: { toolName: toolName, fileWriteTools: fileWriteTools, workspaceDir: cfg.workspaceDir || "" },
   });
+  if (ctx && typeof ctx === "object") {
+    ctx.approvalGate = {
+      engine,
+      addGrant: (options) => engine.addGrant(options),
+      resume: (sessionId, reason) => engine.resume(sessionId, reason),
+    };
+  }
 
   const hasPreExecute = ctx && typeof ctx.on === "function";
   if (hasPreExecute) {
@@ -192,9 +218,30 @@ export function apply(ctx, config) {
       const knobs = readKnobs(ctx, execution);
       const who = sessionTag(execution);
       const sessionId = (execution && execution.agent && (execution.agent.session || execution.agent)) || "default";
-      const decision = engine.decide(execution, { sessionId, knobs });
+      let decision;
+      try {
+        decision = engine.decide(execution, { sessionId, knobs });
+      } catch (err) {
+        const hit = {
+          ask: true,
+          reason: "inspect-error",
+          detail: String(err && err.message || err),
+          snippet: (execution && execution.arguments && execution.arguments.command) || execution.name,
+        };
+        return { kind: "ask", reason: askMessage(hit, who, translate, ctx && ctx.logger) };
+      }
 
       if (decision.verdict === "ask") {
+        if (decision.reason === "circuit-breaker-tripped") {
+          const hit = decision.hit || {
+            deny: true,
+            reason: "circuit-breaker-tripped",
+            detail: decision.detail,
+            snippet: (execution && execution.arguments && execution.arguments.command) || execution.name,
+          };
+          logBlocked(ctx, hit, who);
+          return denyMessage(hit, who, translate, ctx && ctx.logger);
+        }
         if (forcedUnattended || isUnattended({ policy: knobs.policy, unattendedPolicies })) {
           return next();
         }
@@ -213,7 +260,19 @@ export function apply(ctx, config) {
   const guard = function (execution) {
     const who = sessionTag(execution);
     const sessionId = (execution && execution.agent && (execution.agent.session || execution.agent)) || "default";
-    const decision = engine.decide(execution, { sessionId });
+    let decision;
+    try {
+      decision = engine.decide(execution, { sessionId });
+    } catch (err) {
+      const hit = {
+        deny: true,
+        reason: "inspect-error",
+        detail: String(err && err.message || err),
+        snippet: (execution && execution.arguments && execution.arguments.command) || execution.name,
+      };
+      logBlocked(ctx, hit, who);
+      return denyMessage(hit, who, translate, ctx && ctx.logger);
+    }
 
     if (decision.verdict === "deny" || (decision.verdict === "ask" && !hasPreExecute)) {
       const hit = decision.hit || {

package/lib/inspect.js

@@ -17,11 +17,12 @@ export const DEFAULT_FILE_WRITE_TOOLS = Object.freeze([
   "edit",
   "Write",
   "Edit",
+  "str_replace_editor",
   "str_replace",
   "apply_patch",
 ]);
 
-const PREFIXES = new Set(["then", "do"]);
+const PREFIXES = new Set(["then", "do", "{", "}", "!"]);
 const SHELLS = new Set(["bash", "sh", "dash", "zsh", "ksh", "ash"]);
 const INTERPRETERS = new Set(["python", "python2", "python3", "node", "nodejs", "perl", "ruby", "php"]);
 const DB_CLIENTS = new Set([
@@ -81,7 +82,7 @@ function splitSegments(tokens) {
 }
 
 function stripPrefixes(argv) {
-  const out = argv.slice();
+  const out = argv.filter(function (a) { return a !== "}" && a !== ";"; });
   while (out.length) {
     const head = out[0];
     if (PREFIXES.has(head)) { out.shift(); continue; }
@@ -175,7 +176,7 @@ function inspectInterpreterPayload(cmd, payload) {
   return allow();
 }
 
-function inspectArgv(argv, depth, hasHeredoc) {
+function inspectArgv(argv, depth, hasHeredoc, config = {}) {
   if (!argv.length) return allow();
   const cmd = basename(argv[0]);
   const rest = argv.slice(1);
@@ -188,7 +189,7 @@ function inspectArgv(argv, depth, hasHeredoc) {
   if (cmd === "env") {
     const sub = rest.filter(a => !a.startsWith("-") && !a.includes("="));
     if (sub.length > 0) {
-      return inspectArgv(sub, depth, hasHeredoc);
+      return inspectArgv(sub, depth, hasHeredoc, config);
     }
   }
 
@@ -197,7 +198,7 @@ function inspectArgv(argv, depth, hasHeredoc) {
     let next = skipWrapper(rest, arity);
     if (cmd === "timeout" && next.length) next = next.slice(1);
     if (cmd === "nice" && next.length && /^[0-9-]+$/.test(next[0])) next = next.slice(1);
-    return inspectArgv(next, depth, hasHeredoc);
+    return inspectArgv(next, depth, hasHeredoc, config);
   }
 
   if (cmd === "eval") return deny("eval", argv.join(" "));
@@ -256,7 +257,7 @@ function inspectArgv(argv, depth, hasHeredoc) {
     const script = scriptAfterDashC(rest);
     if (typeof script === "string") {
       if (depth > 4) return deny("nested-shell", script);
-      return inspectBashCommand(script, depth + 1);
+      return inspectBashCommand(script, depth + 1, config);
     }
     const scriptFile = rest.find(function (a) { return a && a[0] !== "-"; });
     if (scriptFile) return ask("script-file", "shell script contents are not available to the guard", scriptFile);
@@ -359,7 +360,7 @@ function commandNameFromSegment(seg) {
   return token ? basename(token.value) : "";
 }
 
-function inspectEmbeddedExpansions(source, depth) {
+function inspectEmbeddedExpansions(source, depth, config = {}) {
   if (depth > 8) return ask("unparseable", "nesting-depth", source);
   for (let i = 0; i < source.length; i += 1) {
     if (source[i] === "\\") { i += 1; continue; }
@@ -368,7 +369,7 @@ function inspectEmbeddedExpansions(source, depth) {
         ? readCommandSubstitution(source, i)
         : readBacktick(source, i);
       if (!sub) return ask("unparseable", "unclosed-command-substitution", source.slice(i));
-      const nested = inspectBashCommand(sub.script, depth + 1);
+      const nested = inspectBashCommand(sub.script, depth + 1, config);
       if (nested.deny || nested.ask) return nested;
       i = sub.end - 1;
       continue;
@@ -377,7 +378,7 @@ function inspectEmbeddedExpansions(source, depth) {
       const expansion = readParameterExpansion(source, i);
       if (!expansion) return ask("unparseable", "unclosed-parameter-expansion", source.slice(i));
       if (expansion.body !== undefined) {
-        const nested = inspectEmbeddedExpansions(expansion.body, depth + 1);
+        const nested = inspectEmbeddedExpansions(expansion.body, depth + 1, config);
         if (nested.deny || nested.ask) return nested;
       }
       i = expansion.end - 1;
@@ -386,7 +387,7 @@ function inspectEmbeddedExpansions(source, depth) {
   return allow();
 }
 
-function inspectPipelineHeredocs(tokens, depth) {
+function inspectPipelineHeredocs(tokens, depth, config = {}) {
   let group = [];
   let segment = [];
   function finishGroup() {
@@ -395,7 +396,7 @@ function inspectPipelineHeredocs(tokens, depth) {
     if (hasShell) {
       for (const part of group) {
         for (const heredoc of part.filter(function (t) { return t.kind === "heredoc"; })) {
-          const nested = inspectBashCommand(heredoc.body, depth + 1);
+          const nested = inspectBashCommand(heredoc.body, depth + 1, config);
           if (nested.deny || nested.ask) return nested;
         }
       }
@@ -440,7 +441,7 @@ function inspectUnparsedDanger(command) {
   return null;
 }
 
-export function inspectBashCommand(command, depth) {
+export function inspectBashCommand(command, depth = 0, config = {}) {
   if (depth === undefined) depth = 0;
   if (depth > 8) return ask("unparseable", "nesting-depth", String(command || ""));
   if (typeof command !== "string") return ask("unknown-format", "command is not a string", "non-string command");
@@ -453,7 +454,7 @@ export function inspectBashCommand(command, depth) {
   }
   if (hasDangerousPipeline(tokens)) return deny("curl-pipe", command);
   if (hasDestructiveSqlPipeline(tokens)) return deny("destructive-sql", command);
-  const pipelineHeredocHit = inspectPipelineHeredocs(tokens, depth);
+  const pipelineHeredocHit = inspectPipelineHeredocs(tokens, depth, config);
   if (pipelineHeredocHit.deny || pipelineHeredocHit.ask) return pipelineHeredocHit;
 
   const segs = splitSegments(tokens);
@@ -472,19 +473,19 @@ export function inspectBashCommand(command, depth) {
     for (const token of wordTokens) {
       for (const substitution of token.substitutions || []) {
         const nested = substitution.kind === "parameter-expansion"
-          ? inspectEmbeddedExpansions(substitution.script, depth + 1)
-          : inspectBashCommand(substitution.script, depth + 1);
+          ? inspectEmbeddedExpansions(substitution.script, depth + 1, config)
+          : inspectBashCommand(substitution.script, depth + 1, config);
         if (nested.deny || nested.ask) return nested;
       }
     }
 
     for (const redirect of redirectsOf(seg)) {
       if (redirect.dynamic) return ask("dynamic-redirect", "expanded redirect target cannot be verified", redirect.path);
-      const isRel = !/^(?:\/|[A-Za-z]:\/|\/\/)/.test(normalizeSeparators(redirect.path));
-      if (isRel && isPathTraversal(redirect.path, process.cwd())) {
-        return deny("path-traversal", redirect.path);
-      }
-      if (!isRel && isPathTraversal(redirect.path, "/")) {
+      const baseDir = (config && config.workspaceDir) || process.cwd();
+      const norm = normalizeSeparators(redirect.path);
+      const isRel = !/^(?:\/|[A-Za-z]:\/|\/\/)/.test(norm);
+      const isExempt = !isRel && (/^\/dev\/(?:null|zero|stdout|stderr|fd\/\d+)$/.test(norm) || /^(?:\/tmp|\/var\/tmp)(?:\/|$)/i.test(norm));
+      if (!isExempt && isPathTraversal(redirect.path, baseDir)) {
         return deny("path-traversal", redirect.path);
       }
       if (isProtectedPath(redirect.path)) return deny("secret-write", redirect.path);
@@ -504,13 +505,13 @@ export function inspectBashCommand(command, depth) {
     if (heredocs.length) {
       for (const heredoc of heredocs) {
         if (!heredoc.quoted) {
-          const expansionHit = inspectEmbeddedExpansions(heredoc.body, depth);
+          const expansionHit = inspectEmbeddedExpansions(heredoc.body, depth, config);
           if (expansionHit.deny || expansionHit.ask) return expansionHit;
         }
       }
       if (SHELLS.has(commandName)) {
         for (const heredoc of heredocs) {
-          const nested = inspectBashCommand(heredoc.body, depth + 1);
+          const nested = inspectBashCommand(heredoc.body, depth + 1, config);
           if (nested.deny || nested.ask) return nested;
         }
       } else if (INTERPRETERS.has(commandName)) {
@@ -527,7 +528,7 @@ export function inspectBashCommand(command, depth) {
       }
     }
 
-    const hit = inspectArgv(argv, depth, heredocs.length > 0);
+    const hit = inspectArgv(argv, depth, heredocs.length > 0, config);
     if (hit.deny || hit.ask) return hit;
   }
 
@@ -556,7 +557,7 @@ export function inspectExecution(execution, config) {
     const command = args && typeof args === "object" ? args.command : undefined;
     if (command === undefined || command === null || command === "") return allow();
     if (typeof command !== "string") return ask("unknown-format", "command is not a string", "non-string command");
-    return inspectBashCommand(command);
+    return inspectBashCommand(command, 0, config);
   }
   if (typeof name === "string" && fileTools.has(name)) {
     const path = pathFromArgs(args);

package/lib/paths.js

@@ -69,7 +69,7 @@ export function expandHome(p, env = process.env) {
   // Expand leading ~ or ~/ or ~\
   res = res.replace(/^~(?=$|[/\\])/, cleanHome);
   // Expand ${HOME} and $HOME
-  res = res.replace(/\$\{HOME\}|\$HOME/g, cleanHome);
+  res = res.replace(/\$\{HOME\}|\$HOME(?=\$|[\/\\])/g, cleanHome);
   // Expand %USERPROFILE% (Windows)
   res = res.replace(/%USERPROFILE%/gi, cleanHome);
   return res;

package/lib/tokenizer.js

@@ -170,7 +170,7 @@ export function tokenize(src) {
             i = lineEnd + 1;
           }
           if (!found) return lexFail(src, i, "unterminated-heredoc", tokens);
-          tokens.push({ kind: "heredoc", body: body, quoted: heredoc.quoted });
+          tokens.push({ kind: "heredoc", body: body, quoted: heredoc.quoted, marker: heredoc.delimiter });
         }
         pendingHeredocs.length = 0;
         tokens.push({ kind: "op", value: ";" });
@@ -340,7 +340,7 @@ export function splitSubcommands(command) {
       .map((t) => t.value);
     const subStr = tokens
       .map((t) => {
-        if (t.kind === "heredoc") return `<<${t.marker}`;
+        if (t.kind === "heredoc") return `<<${t.marker || t.body || ""}`;
         return t.value;
       })
       .join(" ")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-approval-gate",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Host-only command safety gate for DeepSeek Harness: blocks recognized dangerous operations and requests DSH approval when a command cannot be inspected.",
   "type": "module",
   "main": "lib/index.js",