@gotgenes/pi-permission-system 32.0.2 → 32.0.4

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [32.0.4](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.3...pi-permission-system-v32.0.4) (2026-09-16)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** evaluate bash rules against a command a partial parse dropped ([28cedc4](https://github.com/gotgenes/pi-packages/commit/28cedc45dd4a11ee9189f41ee661a051d2b13936)), closes [#875](https://github.com/gotgenes/pi-packages/issues/875)
+* **pi-permission-system:** gate the paths a command dropped by a partial parse reads ([6f1d032](https://github.com/gotgenes/pi-packages/commit/6f1d0328f8151da8716641f0ee0c25341699cd75)), closes [#875](https://github.com/gotgenes/pi-packages/issues/875)
+* **pi-permission-system:** keep the whole-command deny reachable when a salvage recovers the only units ([ab91a66](https://github.com/gotgenes/pi-packages/commit/ab91a660eafb879a3370104cb6f68353041a7cbb)), closes [#875](https://github.com/gotgenes/pi-packages/issues/875)
+
+### Documentation
+
+* **pi-permission-system:** record the salvage of a bash command a partial parse dropped ([17a3684](https://github.com/gotgenes/pi-packages/commit/17a3684f182467c19e1ca56664e1adf900980f11))
+
+## [32.0.3](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.2...pi-permission-system-v32.0.3) (2026-09-15)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** mask a value bound to a bare or suffixed key name ([f23b8b9](https://github.com/gotgenes/pi-packages/commit/f23b8b93ceafa732ffe9d5484e4a935094d06754)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+* **pi-permission-system:** stop writing a named secret into the permission logs ([cf4f370](https://github.com/gotgenes/pi-packages/commit/cf4f370d192d778e600a253331bbf6e42b3cd758)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+
+### Documentation
+
+* **pi-permission-system:** restate the log-redaction boundary as name-structural ([958cba1](https://github.com/gotgenes/pi-packages/commit/958cba124a1b799a7e6af959440a26d7cf722934)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+* **pi-permission-system:** correct the review-log knob's unredacted claim ([0664a6c](https://github.com/gotgenes/pi-packages/commit/0664a6cf6fbf3e75c4a6864cc582716dd6d15a26)), closes [#920](https://github.com/gotgenes/pi-packages/issues/920)
+
 ## [32.0.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v32.0.1...pi-permission-system-v32.0.2) (2026-09-11)
 
 

package/README.md

@@ -19,7 +19,7 @@ Permission enforcement extension for the [Pi](https://pi.mariozechner.at/) codin
 - **Gates MCP and skill access** at server, tool, and skill-name granularity
 - **Protects sensitive file patterns** — cross-cutting `path` rules deny `.env`, `~/.ssh/*`, etc. across all tools and bash at once, matching both the path as referenced and its symlink-resolved form so a deny cannot be evaded through a symlink alias
 - **Guards external paths** — prompts before file tools or bash commands reach outside `cwd`
-- **Fails closed** — an internal gate error blocks the tool (with a `gate_error` review-log entry and a matching `permissions:decision` broadcast), and a bash command the parser could not resolve, in whole or in part — or an indirection wrapper that hides the gated command (`bash -c`/`eval`, `sudo`, `env`, `xargs`, `find -exec`, …) — prompts (`ask`) rather than passing silently, unless the wrapped command is a pure reader whose direction is provable whatever it is fed (`xargs grep -l foo`)
+- **Fails closed** — an internal gate error blocks the tool (with a `gate_error` review-log entry and a matching `permissions:decision` broadcast), and a bash command the parser could not resolve, in whole or in part — or an indirection wrapper that hides the gated command (`bash -c`/`eval`, `sudo`, `env`, `xargs`, `find -exec`, …) — prompts (`ask`) rather than passing silently, unless the wrapped command is a pure reader whose direction is provable whatever it is fed (`xargs grep -l foo`); where a partial parse failure's own region re-parses cleanly on its own, the commands and paths it holds are recovered and gated rather than merely prompted for
 - **Forwards prompts from subagents** — `ask` policies work even in non-UI execution contexts
 - **Broadcasts UI prompt events** — `permissions:ui_prompt` fires only when the permission system is about to invoke the active user-facing permission UI, and every prompt it announces — including one forwarded up from a subagent — is answered by a `permissions:decision` on the same bus
 - **Native [`@gotgenes/pi-subagents`](https://github.com/gotgenes/pi-subagents) integration** — in-process child sessions register with the permission system automatically, enabling per-agent policy enforcement and `ask`-state forwarding to the parent UI without configuration
@@ -177,7 +177,8 @@ Hardening the gates against bypass, fail-closed corrections (breaking ones inclu
 - _Permissive defaults, trust profiles, or workflow presets._
   Your risk profile is not knowable from here, so defaults are least-privilege and common policies ship as documented recipes rather than preset keywords.
 - _Guessing what is sensitive._
-  No built-in secret denylist, and log redaction is key-name-structural rather than predictive — a redactor that silently misses a key invites treating the log as safe to share.
+  No built-in secret denylist, and log redaction is name-structural rather than predictive: a value is masked because of the name that binds it — a log key, a shell variable, a request header field — never because of what it looks like.
+  A redactor that guesses invites treating the log as safe to share.
 - _Model judgment in the core._
   This package makes no LLM call and holds no model config; model-assisted judging attaches as a chain link over the authorizer seam instead.
   A link decides nothing until you name it in `authorizerChain`, and its `allow` on an excluded surface is downgraded to `defer`.

package/docs/configuration.md

@@ -100,7 +100,7 @@ This clamp is deny-preserving and, like `yoloMode`, applied at composition; when
 | Key                         | Default  | Description                                                                                                                                                                                                                                  |
 | --------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `debugLog`                  | `false`  | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                                                                                                                |
-| `permissionReviewLog`       | `true`   | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`. Records bash command strings unredacted — see [Log file sensitivity](#log-file-sensitivity)                                         |
+| `permissionReviewLog`       | `true`   | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`. Records bash command strings, masked only where a name binds the secret — see [Log file sensitivity](#log-file-sensitivity)         |
 | `yoloMode`                  | `false`  | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                                                                                                                   |
 | `doublePressToConfirm`      | `true`   | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.                                                                                            |
 | `forwardingTimeoutMs`       | `600000` | How long a subagent waits for the parent session to answer a forwarded permission request, in milliseconds. A child whose parent is not draining its inbox gives up in ~2 s regardless, whether that parent runs in this process or its own. |
@@ -429,11 +429,13 @@ The bash gate fails closed: when in doubt it blocks or prompts, never silently a
 - If the permission gate throws an internal error (for example a transient tree-sitter parser-init failure), the tool call is **blocked** rather than passed ungated, and a `gate_error` entry is written to the review log naming the failure.
 - A non-empty command that cannot be parsed into command units resolves to **`ask`** (the synthetic `<unparseable-bash-command>` pattern in the review log) instead of falling through to a permissive top-level `*`.
   A `deny` rule covering the whole command still denies outright — the synthetic `ask` never masks a hard deny into an approvable prompt.
+  That whole-command check runs whenever the parse itself matched nothing, including when the recovery below went on to recover a command from the wreckage, so a rule naming the command in context (`"* rm -rf *"`) is still consulted.
   An empty, whitespace-only, or comment-only command has nothing to gate and is resolved normally.
 - A command the parser could only *partly* resolve is floored the same way (the synthetic `<unparsed-bash-subtree>` pattern in the review log).
   Recovered structure is not evidence of what runs, so any command unit at or beneath the statement holding the unresolved region has its `allow` clamped up to `ask`; an explicit `deny` or `ask` on that unit still decides.
-  The prompt names the **whole** command rather than the unit, because a partial failure can drop a command from the parse entirely and the fragment that did parse is not what you need to see.
+  The prompt names the **whole** command rather than the unit, because the fragment that did parse is not what you need to see.
   A statement beside the failed one keeps its own rule.
+  Where the unresolved region's own text parses cleanly on its own, the commands and paths inside it are recovered and gated too, so a `deny` covering one of them still denies rather than prompting — a region whose own text does not re-parse is left to the floor, since error recovery invents the structure inside one and inventions do not re-parse.
   Most such commands are simply malformed, and the shell would refuse them too — but not all: `git commit -F - <<'MSG' 2>&1 | tail -4` is valid bash that `tree-sitter-bash` cannot parse, because a heredoc redirect combined with `2>&1` **and** a pipe defeats the grammar though each pairing alone is fine.
 - An opaque-payload wrapper — `bash`/`sh`/`dash`/`zsh`/`ksh` invoked with `-c`, or `eval` — carries its inner program in a quoted argument that is not re-parsed, so its decision is floored to at least **`ask`** (the synthetic `<opaque-bash-wrapper>` pattern in the review log).
   An `allow` (including a permissive top-level `*`) is clamped up to `ask`, while an explicit `deny` rule on the wrapper still denies.
@@ -1197,19 +1199,30 @@ Both logs are created **owner-only** (`0600`, in a `0700` directory), and a log
 The permission-forwarding request and response files are written the same way.
 This closes the shared-host case: another user on the same machine cannot read them.
 
-Values bound to a **sensitive key name** — `authorization`, `token`, `secret`, `password`, `credential`, `cookie`, `api_key`, `private_key`, matched case-insensitively — are masked as `[redacted]` before anything is written.
+Values bound to a **sensitive name** — `authorization`, `token`, `secret`, `password`, `credential`, `cookie`, and a bare or suffixed `key` (`api_key`, `private_key`, `OPENROUTER_KEY`, `apiKey`), matched case-insensitively — are masked as `[redacted]` before anything is written.
 So a tool called with `{"authorization": "Bearer …"}` records `{"authorization": "[redacted]"}`.
 
+A bash command binds values to names too, and the same predicate answers for those.
+The command is parsed, and a value is masked when it is bound to a sensitive name by a shell assignment or a request header field:
+
+```text
+KEY="sk-or-v1-…" curl https://x        →  KEY=[redacted] curl https://x
+env MY_KEY=… deploy                    →  env MY_KEY=[redacted] deploy
+curl -H "Authorization: Bearer sk-…"   →  curl -H "Authorization:[redacted]"
+```
+
 The boundary is worth stating exactly, because it is easy to over-read:
 
-> A value bound to a sensitive key name is masked; a secret embedded in a bash command string is not.
+> A value bound to a sensitive name is masked — whether the name is a log key, a shell variable, or a request header field.
+> A secret with no name bound to it, such as one typed as a `grep` pattern, is not.
 
-A command string has no keys, so `deploy --token abc123` is logged unredacted.
+So `grep -r "sk-ant-…" .` and `deploy --token abc123` are both logged unredacted: the first binds the secret to nothing, and the second binds it to a flag rather than a name.
 The extension deliberately does not try to guess which parts of a command look secret-shaped — see [ADR 0010] for the measured reasoning.
+A command the parser could not fully resolve, and a secret inside an inline-shell payload (`bash -c '…'`) or a heredoc body, are masked only as far as the parse reached.
 
 Every value the **review** log writes is narrowed to `reviewLogFieldMaxWidth` (1000 characters by default) and marked with an ellipsis, so a single pathological command cannot put tens of kilobytes in one entry.
 This is a length bound, not redaction: it never inspects a value to decide what to hide, and it applies to every field alike.
-The two compose — a sensitive-keyed value is masked whole however long it was.
+The two compose, and masking runs first — a sensitively-named value is masked whole however long it was, and the cap never shortens one.
 The debug log is left unbounded, since it is opt-in and exists to be read in full.
 
 Practical guidance:

package/docs/troubleshooting.md

@@ -54,8 +54,9 @@ This makes it easy to verify which files the extension actually loaded:
 - This is a permission decision layer, not a sandbox — for true isolation see [Agent Sandboxes](https://engine.build/lab/agent-sandboxes).
   The two are complementary rather than alternatives: a sandbox enforces which paths are in scope and in which direction, while this package decides whether a particular action on an in-scope path may proceed.
   [ADR 0013] §8 records that division and the seam that exports this package's scope decisions to a sandbox launcher.
-- The review log records bash command strings unredacted.
-  Log files are created owner-only (`0600`), and values bound to a sensitive key name (`authorization`, `token`, `password`, …) are masked — but a secret embedded in a command string is not.
+- The review log records bash command strings, masked only where a name binds the secret.
+  Log files are created owner-only (`0600`), and a value bound to a sensitive name (`authorization`, `token`, `password`, a bare or suffixed `key`, …) is masked — whether the name is a log key, a shell variable, or a request header field.
+  A secret with no name bound to it, such as one typed as a `grep` pattern, is not.
   Review-log values are shortened at `reviewLogFieldMaxWidth` (1000 characters by default), which bounds the file's growth but is a length cap, not redaction.
   See [Log file sensitivity](configuration.md#log-file-sensitivity) and [ADR 0010].
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "32.0.2",
+  "version": "32.0.4",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/bash-path-resolver.ts

@@ -127,13 +127,31 @@ export class BashPathResolver {
    * itself is added to the external paths when it resolves outside the cwd.
    * Containment is always measured against the session cwd baked into the
    * normalizer, so a `workdir` outside the cwd does not widen the sandbox.
+   *
+   * `salvagedRoots` are regions the primary parse could not resolve, re-parsed
+   * cleanly on their own (`unresolved-salvage.ts`, #875). Their candidates are
+   * collected into the same array before projection runs, so a path both a
+   * salvaged region and the primary parse name folds to one entry rather than
+   * showing twice in the prompt. Each is walked under the **unknown** base: a
+   * fragment carries no record of the `cd` in force where it sat, and
+   * resolving `cat rel.txt` against the session cwd after `cd /outside` would
+   * name a different file than the one that runs — a rule for that other path
+   * could then allow this access. #393's unknown base declines the claim
+   * instead, keeping an absolute token literal-only and unconditionally
+   * external while a relative one is not projected at all.
    */
-  resolve(rootNode: TSNode): ResolvedBashPaths {
+  resolve(
+    rootNode: TSNode,
+    salvagedRoots: readonly TSNode[] = [],
+  ): ResolvedBashPaths {
     const initialBase =
       this.workdir === undefined
         ? CWD_BASE
         : this.deriveBaseFromCdTarget(CWD_BASE, this.workdir);
     const candidates = this.collectPathCandidates(rootNode, initialBase);
+    for (const salvaged of salvagedRoots) {
+      this.walkForCandidates(salvaged, UNKNOWN_BASE, candidates);
+    }
     return {
       externalAccesses: this.withWorkdirExternal(
         this.projectExternalPaths(candidates),

package/src/access-intent/bash/command-enumeration.ts

@@ -57,6 +57,19 @@ export interface BashCommand {
    * 0013 §10's fail-closed base case (#840).
    */
   readonly parseUnresolved?: true;
+  /**
+   * Set when this unit came from a region re-parsed out of a subtree the
+   * primary parse could not resolve, rather than from the primary parse
+   * itself (#875).
+   *
+   * Narrower than {@link parseUnresolved}, which a primary unit also carries
+   * when its enclosing statement failed. The verdict fold needs the
+   * distinction to tell whether the *primary* parse found anything: when it
+   * found nothing, the whole command string is the only surface an explicit
+   * `deny` can reach (#452), and salvaging a unit must not make that check
+   * unreachable.
+   */
+  readonly salvaged?: true;
 }
 
 /**
@@ -83,12 +96,34 @@ interface UnitScope {
    * resolve, so every unit beneath it is floored rather than trusted (#840).
    */
   readonly parseUnresolved: boolean;
+  /**
+   * True when the walk started from a salvaged region rather than the primary
+   * parse tree (#875). Relayed unchanged, including into nested executions:
+   * everything found inside a salvaged region is salvaged.
+   */
+  readonly salvaged: boolean;
 }
 
 /** A top-level command in the current shell, writing no file, fully parsed. */
 const TOP_LEVEL_SCOPE: UnitScope = {
   writesViaRedirect: false,
   parseUnresolved: false,
+  salvaged: false,
+};
+
+/**
+ * The scope a salvaged region's own units run under.
+ *
+ * Marked unresolved because the region reached the salvage only by failing in
+ * the primary parse, so the verdict fold floors what it recovers rather than
+ * trusting it. `writesViaRedirect` starts false for the same reason
+ * {@link collectHostedCommands} resets it: a redirect established outside the
+ * region is the enclosing statement's, not the region's.
+ */
+const SALVAGED_SCOPE: UnitScope = {
+  writesViaRedirect: false,
+  parseUnresolved: true,
+  salvaged: true,
 };
 
 // ── Node-type vocabulary ─────────────────────────────────────────────────────
@@ -212,6 +247,22 @@ export function collectCommands(node: TSNode): BashCommand[] {
   return out;
 }
 
+/**
+ * Enumerate the command units of a region the primary parse could not resolve,
+ * re-parsed cleanly on its own (`unresolved-salvage.ts`, #875).
+ *
+ * The same walk as {@link collectCommands}, differing only in the scope it
+ * starts from: every unit is marked {@link BashCommand.parseUnresolved}, so a
+ * command the primary parse dropped is matched against the bash rules — an
+ * explicit `deny` fires — while its `allow` is still floored to `ask` by the
+ * verdict fold (#840).
+ */
+export function collectSalvagedCommands(node: TSNode): BashCommand[] {
+  const out: BashCommand[] = [];
+  collectCommandsInto(node, SALVAGED_SCOPE, out);
+  return out;
+}
+
 function collectCommandsInto(
   node: TSNode,
   inherited: UnitScope,
@@ -228,7 +279,7 @@ function collectCommandsInto(
     out.push(makeCommandUnit(node, scope));
     // A command's text already contains any substitution; descend its subtree
     // to ALSO emit the inner commands of command/process substitutions.
-    collectHostedCommands(node, out);
+    collectHostedCommands(node, scope, out);
     return;
   }
 
@@ -240,7 +291,7 @@ function collectCommandsInto(
   if (EXECUTION_HOST_TYPES.has(node.type)) {
     // Not a command itself, but its subtree can host one that really runs
     // (`> $(rm x)`, `< <(rm c)`). Emit only what it hosts (#741).
-    collectHostedCommands(node, out);
+    collectHostedCommands(node, scope, out);
     return;
   }
 
@@ -281,7 +332,7 @@ function collectCommandsInto(
   // really run (`local x=$(rm y)`, `[[ $(rm x) ]]`), so those are enumerated
   // in addition to the statement (#742).
   out.push(makeUnit(node.text, scope));
-  collectHostedCommands(node, out);
+  collectHostedCommands(node, scope, out);
 }
 
 /**
@@ -328,9 +379,10 @@ function makeUnit(
     executedUnit === undefined ? flagged : { ...flagged, executedUnit };
   const exempted =
     floorExemption === undefined ? named : { ...named, floorExemption };
-  return scope.parseUnresolved
+  const marked: BashCommand = scope.parseUnresolved
     ? { ...exempted, parseUnresolved: true }
     : exempted;
+  return scope.salvaged ? { ...marked, salvaged: true } : marked;
 }
 
 /**
@@ -450,7 +502,7 @@ function descendStatementChildren(
     const child = node.child(i);
     if (!child?.isNamed) continue;
     if (STATEMENT_TYPES.has(child.type)) collectCommandsInto(child, scope, out);
-    else collectHostedCommands(child, out);
+    else collectHostedCommands(child, scope, out);
   }
 }
 
@@ -465,7 +517,11 @@ function descendStatementChildren(
  * `node` may be a context outright or merely host one, so the traversal is the
  * root-inclusive `forEachExecutionIn`.
  */
-function collectHostedCommands(node: TSNode, out: BashCommand[]): void {
+function collectHostedCommands(
+  node: TSNode,
+  scope: UnitScope,
+  out: BashCommand[],
+): void {
   forEachExecutionIn(node, (contextNode, context) => {
     // A nested execution starts fresh: an enclosing statement's redirect is
     // that statement's, not the substitution's, exactly as #807 attributes a
@@ -475,7 +531,12 @@ function collectHostedCommands(node: TSNode, out: BashCommand[]): void {
     // units carry the mark regardless, so the verdict is unchanged (#840).
     descendCommandChildren(
       contextNode,
-      { context, writesViaRedirect: false, parseUnresolved: false },
+      {
+        context,
+        writesViaRedirect: false,
+        parseUnresolved: false,
+        salvaged: scope.salvaged,
+      },
       out,
     );
   });

package/src/access-intent/bash/parser.ts

@@ -15,6 +15,8 @@ export interface TSNode {
   readonly text: string;
   /** Absolute byte offset of this node's start in the parsed source. */
   readonly startIndex: number;
+  /** Absolute byte offset one past this node's end in the parsed source. */
+  readonly endIndex: number;
   readonly childCount: number;
   /** False for anonymous tokens (operators, delimiters); true for named nodes. */
   readonly isNamed: boolean;
@@ -77,16 +79,32 @@ export function parseUnresolvedAt(node: TSNode): boolean {
  * fact about redirects, not about statements: a statement whose *predecessor*
  * failed is not itself unparsed, and borrowing the wider predicate here would
  * condemn every statement following a failed one.
+ *
+ * `unresolved-salvage.ts` asks the same question twice over: to locate the
+ * innermost region worth re-parsing, and to refuse the re-parse's own result
+ * when it failed too (#875).
  */
 export function parseUnresolvedWithin(node: TSNode): boolean {
   return node.hasError;
 }
 
 /**
- * Minimal subset of web-tree-sitter's Parser used by this module.
+ * The one parse capability a consumer needs to re-parse a fragment of a
+ * command on its own.
+ *
+ * Narrower than {@link TSParser} on purpose: that interface also carries the
+ * parser's own `delete()`, which destroys the process-wide memoized parser for
+ * every later command. A consumer re-parsing a fragment has no business
+ * holding that, so it takes this instead (`unresolved-salvage.ts`, #875).
  */
-interface TSParser {
+export interface BashReparser {
   parse(input: string): { rootNode: TSNode; delete(): void } | null;
+}
+
+/**
+ * Minimal subset of web-tree-sitter's Parser used by this module.
+ */
+interface TSParser extends BashReparser {
   delete(): void;
 }
 

package/src/access-intent/bash/program.ts

@@ -4,8 +4,13 @@ import {
   BashPathResolver,
   type BashPathRuleCandidate,
 } from "./bash-path-resolver";
-import { type BashCommand, collectCommands } from "./command-enumeration";
+import {
+  type BashCommand,
+  collectCommands,
+  collectSalvagedCommands,
+} from "./command-enumeration";
 import { getParser } from "./parser";
+import { withSalvagedRoots } from "./unresolved-salvage";
 
 export type { BashCommand, BashExternalPath, BashPathRuleCandidate };
 
@@ -56,16 +61,21 @@ export class BashProgram {
     if (!tree) return new BashProgram(command, [], [], []);
 
     try {
-      const { externalAccesses, ruleCandidates } = new BashPathResolver(
-        normalizer,
-        options?.workdir,
-      ).resolve(tree.rootNode);
-      return new BashProgram(
-        command,
-        collectCommands(tree.rootNode),
-        externalAccesses,
-        ruleCandidates,
-      );
+      return withSalvagedRoots(tree.rootNode, parser, (salvaged) => {
+        const { externalAccesses, ruleCandidates } = new BashPathResolver(
+          normalizer,
+          options?.workdir,
+        ).resolve(tree.rootNode, salvaged);
+        return new BashProgram(
+          command,
+          [
+            ...collectCommands(tree.rootNode),
+            ...salvaged.flatMap(collectSalvagedCommands),
+          ],
+          externalAccesses,
+          ruleCandidates,
+        );
+      });
     } finally {
       tree.delete();
     }

package/src/access-intent/bash/sync-commands.ts

@@ -1,5 +1,10 @@
-import { type BashCommand, collectCommands } from "./command-enumeration";
+import {
+  type BashCommand,
+  collectCommands,
+  collectSalvagedCommands,
+} from "./command-enumeration";
 import { getWarmBashParser } from "./parser";
+import { withSalvagedRoots } from "./unresolved-salvage";
 
 /**
  * Synchronously enumerate the command-pattern units of a bash command using the
@@ -21,7 +26,10 @@ export function parseBashCommandsSync(command: string): BashCommand[] | null {
   const tree = parser.parse(command);
   if (!tree) return [];
   try {
-    return collectCommands(tree.rootNode);
+    return withSalvagedRoots(tree.rootNode, parser, (salvaged) => [
+      ...collectCommands(tree.rootNode),
+      ...salvaged.flatMap(collectSalvagedCommands),
+    ]);
   } finally {
     tree.delete();
   }

package/src/access-intent/bash/unresolved-salvage.ts

@@ -0,0 +1,97 @@
+import {
+  type BashReparser,
+  parseUnresolvedWithin,
+  type TSNode,
+} from "./parser";
+
+/**
+ * Run `use` over the roots of every region the primary parse could not resolve
+ * but which re-parses cleanly on its own, then delete the trees it created.
+ *
+ * `tree-sitter-bash` 0.25.1 cannot parse a heredoc redirect combined with
+ * `2>&1` **and** a pipe, though each pairing alone is fine. Its recovery hangs
+ * an `ERROR` node holding only the `|` under `heredoc_redirect → file_redirect`
+ * and leaves the piped command's words as plain siblings of it — and
+ * `heredoc_redirect` is an execution host, descended for the substitutions it
+ * may carry and never read for text. So `git commit -F - <<'MSG' 2>&1 | rm -rf
+ * /tmp/x` enumerates `git commit -F` and nothing else, and a configured
+ * `bash: {"rm -rf *": "deny"}` is never evaluated against a command that
+ * really runs (#875).
+ *
+ * Re-parsing the dropped region's own source text recovers it, because the
+ * grammar gap is in the *combination* — `2>&1 | rm -rf /tmp/x` parses
+ * perfectly on its own.
+ *
+ * The roots are handed to a callback rather than returned because each belongs
+ * to a tree that must outlive its use and be released afterwards, exactly as
+ * the primary parse's caller already does for its own tree.
+ *
+ * Salvaging is purely additive: a caller enumerates these roots *in addition
+ * to* the primary one, so the result can only ever be more restrictive.
+ */
+export function withSalvagedRoots<T>(
+  primary: TSNode,
+  reparser: BashReparser,
+  use: (salvaged: readonly TSNode[]) => T,
+): T {
+  const trees: { rootNode: TSNode; delete(): void }[] = [];
+  try {
+    for (const candidate of unresolvedRegionsWithin(primary)) {
+      const tree = reparser.parse(candidate.text);
+      if (!tree) continue;
+      // The whole safety argument: tree-sitter's error recovery *invents* the
+      // structure inside an unresolved region (#742), and invented structure
+      // does not re-parse. Without this check `cat <> rw.txt` salvages a
+      // command unit whose text is `">"`, matched against the bash rules like
+      // any real command.
+      if (parseUnresolvedWithin(tree.rootNode)) {
+        tree.delete();
+        continue;
+      }
+      trees.push(tree);
+    }
+    return use(trees.map(({ rootNode }) => rootNode));
+  } finally {
+    for (const tree of trees) tree.delete();
+  }
+}
+
+/**
+ * The innermost nodes beneath `root` whose subtree the parser could not
+ * resolve, in source order.
+ *
+ * Three exclusions shape the answer.
+ *
+ * An `ERROR` node is never a candidate and is never descended in search of
+ * one: its interior is recovery's invention rather than anything observed
+ * (#742), so the region worth re-parsing is the node that *holds* it.
+ *
+ * Only the innermost such node is offered. An enclosing statement reports the
+ * error too, and its text re-parses to the same failure, so offering it
+ * salvages nothing while burying the fragment that would have worked.
+ *
+ * `root` itself is never a candidate, for the same reason taken to its limit:
+ * re-parsing the whole source reproduces the whole failure by construction.
+ */
+function unresolvedRegionsWithin(root: TSNode): TSNode[] {
+  const found: TSNode[] = [];
+  collectInnermostUnresolved(root, root, found);
+  return found;
+}
+
+function collectInnermostUnresolved(
+  node: TSNode,
+  root: TSNode,
+  found: TSNode[],
+): void {
+  if (!parseUnresolvedWithin(node)) return;
+  const before = found.length;
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (child && child.type !== "ERROR") {
+      collectInnermostUnresolved(child, root, found);
+    }
+  }
+  const foundDeeper = found.length > before;
+  if (!foundDeeper && node !== root && node.type !== "ERROR") found.push(node);
+}

package/src/handlers/gates/bash-command.ts

@@ -30,15 +30,19 @@ import type { PermissionCheckResult } from "#src/types";
  * from riding a permissive rule; an explicit `deny`/`ask` on the wrapper is left
  * untouched (`deny > ask > allow`).
  *
- * When `commands` is empty there are two cases. A trivially-empty command (an
- * empty, whitespace-only, or comment-only line) has genuinely nothing to gate,
- * so the whole `command` is resolved as before. A non-empty command that parsed
- * to zero command units (a parse anomaly or an opaque program) fails closed to
- * a synthetic `ask` so a permissive top-level `*` cannot silently allow an
+ * A trivially-empty command (an empty, whitespace-only, or comment-only line)
+ * has genuinely nothing to gate, so the whole `command` is resolved as before.
+ *
+ * When the *primary* parse matched nothing, the whole command string is the
+ * only surface an explicit `deny` can reach, so it is resolved first and a
+ * `deny` covering it denies outright rather than being masked into an
+ * approvable prompt (#712). With no units at all the result also fails closed
+ * to a synthetic `ask`, so a permissive top-level `*` cannot silently allow an
  * unparseable command (e.g. `cd /repo && git push` riding a top-level allow on
- * the empty-parse path) — #452. The whole command is still resolved first so an
- * explicit `deny` covering it denies outright rather than being masked into an
- * approvable prompt (#712).
+ * the empty-parse path) — #452. A command whose units are *all* salvaged
+ * (#875) takes the same whole-string check, because its primary parse matched
+ * nothing either; only the synthetic `ask` is skipped, since the recovered
+ * units now carry the verdict.
  *
  * A *partial* parse failure is the other half of that clause: the units the
  * recovery produced are enumerated normally, and any one the enumerator marked
@@ -70,22 +74,32 @@ export function resolveBashCommandCheck(
   agentName: string | undefined,
   resolver: ScopedPermissionResolver,
 ): PermissionCheckResult {
-  if (commands.length === 0) {
-    if (isTriviallyEmptyCommand(command)) {
-      return resolveOnBashSurface(command, agentName, resolver);
-    }
+  if (isTriviallyEmptyCommand(command)) {
+    return resolveOnBashSurface(command, agentName, resolver);
+  }
+
+  if (!commands.some((cmd) => cmd.salvaged !== true)) {
+    // The primary parse matched nothing, so the whole command string is the
+    // only surface an explicit `deny` can reach (#452, #712) — a rule naming
+    // the command in context (`"* rm -rf *"`) matches the string and not the
+    // fragment. This runs whether or not the salvage went on to recover units
+    // from the wreckage: `> f <<'M' 2>&1 | rm -rf /tmp/x` has zero primary
+    // units and one salvaged one, and keying the check on the combined list
+    // would silently drop a `deny` the pre-salvage gate reached (#875).
     const whole = resolveOnBashSurface(command, agentName, resolver);
     if (whole.state === "deny") {
       return whole;
     }
-    return {
-      state: "ask",
-      toolName: "bash",
-      source: "bash",
-      origin: "builtin",
-      command,
-      matchedPattern: "<unparseable-bash-command>",
-    };
+    if (commands.length === 0) {
+      return {
+        state: "ask",
+        toolName: "bash",
+        source: "bash",
+        origin: "builtin",
+        command,
+        matchedPattern: "<unparseable-bash-command>",
+      };
+    }
   }
 
   const results = commands.map((cmd) =>

package/src/logging/command-redaction.ts

@@ -0,0 +1,241 @@
+import {
+  ARG_NODE_TYPES,
+  resolveNodeText,
+} from "#src/access-intent/bash/node-text";
+import { getWarmBashParser, type TSNode } from "#src/access-intent/bash/parser";
+import { isPlainRecord } from "#src/value-guards";
+import { isSensitiveName, REDACTED_PLACEHOLDER } from "./log-redaction";
+
+/**
+ * Grammar-anchored masking of a secret bound to a sensitive name *inside* a
+ * bash command string.
+ *
+ * Key-name redaction (`log-redaction.ts`) masks a value because of the key it
+ * is bound to, and a command string is one opaque value under the key
+ * `command`. This module asks the same question of the names a command binds
+ * values to — a shell variable and an HTTP header field — so one predicate
+ * answers for all three binding forms.
+ *
+ * Every rule matches a **parse node**, never a substring of the command text.
+ * That is what keeps it usable: measured against a 12 MB review log (7146
+ * unique commands), a raw-string scan for a sensitively-named assignment
+ * matched ten commands and every one was embedded Python (`key=lambda x: x[1]`)
+ * or a `sed` pattern; the same rule anchored to a `variable_assignment` node
+ * matched none. See `docs/decisions/0010-permission-log-secret-exposure.md`.
+ *
+ * A value with no name bound to it — a secret typed as a `grep` pattern — is
+ * out of reach of a structural rule and stays unmasked.
+ */
+
+/** The log keys whose value is a bash command string. */
+export const COMMAND_BEARING_LOG_KEYS: ReadonlySet<string> = new Set([
+  "command",
+  "executedUnit",
+]);
+
+/** A range of the command to replace, and what to put in its place. */
+interface MaskSpan {
+  readonly start: number;
+  readonly end: number;
+  readonly replacement: string;
+}
+
+/**
+ * Mask every sensitively-named value in a bash command string.
+ *
+ * Best-effort by design: a cold parser, a parse that throws, and a parse that
+ * recovered from a syntax error all yield whatever the walk did resolve rather
+ * than blanking the field, because the command text is the main reason the
+ * review log is read. It never throws — the writer sits under the fail-closed
+ * `tool_call` boundary, where a raised mask would cost the whole log line.
+ */
+export function redactCommandSecrets(command: string): string {
+  if (!command) return command;
+
+  try {
+    const parser = getWarmBashParser();
+    if (!parser) return command;
+    const tree = parser.parse(command);
+    if (!tree) return command;
+    try {
+      const spans: MaskSpan[] = [];
+      collectMaskSpans(tree.rootNode, spans);
+      return applyMaskSpans(command, spans);
+    } finally {
+      tree.delete();
+    }
+  } catch {
+    return command;
+  }
+}
+
+/**
+ * Apply {@link redactCommandSecrets} to every command-bearing key in a log
+ * record.
+ *
+ * Recurses through plain objects and arrays, like the width cap beside it: all
+ * of today's producers write `command` and `executedUnit` at the top level, but
+ * a writer stage that only looks at the top level is one a later nested
+ * producer escapes without anyone noticing.
+ */
+export function maskCommandFields<T>(details: T): T {
+  return maskValue(details, false) as T;
+}
+
+function maskValue(value: unknown, bindsCommand: boolean): unknown {
+  if (typeof value === "string") {
+    return bindsCommand ? redactCommandSecrets(value) : value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => maskValue(entry, bindsCommand));
+  }
+  if (isPlainRecord(value)) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [
+        key,
+        maskValue(entry, COMMAND_BEARING_LOG_KEYS.has(key)),
+      ]),
+    );
+  }
+  return value;
+}
+
+function collectMaskSpans(node: TSNode, spans: MaskSpan[]): void {
+  const span = maskSpanOf(node);
+  if (span) spans.push(span);
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (child) collectMaskSpans(child, spans);
+  }
+}
+
+function maskSpanOf(node: TSNode): MaskSpan | null {
+  return (
+    assignmentValueSpan(node) ??
+    wordAssignmentSpan(node) ??
+    headerValueSpan(node)
+  );
+}
+
+/**
+ * `KEY="sk-…" curl …`, `KEY=sk-…`, `export OPENROUTER_KEY="sk-…"`.
+ *
+ * The span runs to the assignment node's own end rather than the value node's,
+ * so a value the grammar splits across several children is covered whole.
+ */
+function assignmentValueSpan(node: TSNode): MaskSpan | null {
+  if (node.type !== "variable_assignment") return null;
+  const name = node.child(0);
+  if (!name || !isSensitiveName(name.text)) return null;
+  const value = node.child(2);
+  if (!value) return null;
+  return maskSpan(value.startIndex, node.endIndex, REDACTED_PLACEHOLDER);
+}
+
+/**
+ * `env MY_KEY=abc deploy`, which tree-sitter classifies as a plain `word`
+ * rather than an assignment because it follows a command name.
+ *
+ * The name must open with a letter or underscore, so a long option
+ * (`--my-key=abc`) cannot match: an option binds its value to a flag, and the
+ * flag forms are deliberately out of scope.
+ */
+const WORD_ASSIGNMENT = /^([A-Za-z_][A-Za-z0-9_]*)=/;
+
+function wordAssignmentSpan(node: TSNode): MaskSpan | null {
+  if (node.type !== "word") return null;
+  const match = WORD_ASSIGNMENT.exec(node.text);
+  if (!match || !isSensitiveName(match[1])) return null;
+  return maskSpan(
+    node.startIndex + match[0].length,
+    node.endIndex,
+    REDACTED_PLACEHOLDER,
+  );
+}
+
+/** `curl -H "Authorization: Bearer sk-…"`, in any of its quoting forms. */
+const HEADER_FIELD = /^([A-Za-z][A-Za-z0-9_-]*)[ \t]*:[ \t]*\S/;
+
+function headerValueSpan(node: TSNode): MaskSpan | null {
+  if (!ARG_NODE_TYPES.has(node.type)) return null;
+  const match = HEADER_FIELD.exec(resolveNodeText(node));
+  const field = match?.[1];
+  if (!field || !isSensitiveName(field) || isCamelCased(field)) return null;
+  const colon = node.text.indexOf(":");
+  if (colon < 0) return null;
+  // The span swallows a closing quote, so the replacement puts one back and
+  // the masked argument stays quoted the way it was written.
+  return maskSpan(
+    node.startIndex + colon + 1,
+    node.endIndex,
+    REDACTED_PLACEHOLDER + openQuoteAt(node.text, colon),
+  );
+}
+
+/**
+ * An HTTP field name is hyphenated (`X-Api-Key`), never camel-cased.
+ *
+ * Without this the only false positives in the measured corpus were two
+ * records of `grep "legalDirectionalKeys: readonly"` — a search pattern over
+ * TypeScript source, which names a field of nothing.
+ */
+function isCamelCased(field: string): boolean {
+  return /[a-z][A-Z]/.test(field);
+}
+
+/**
+ * The quote character still open at `index`, or the empty string.
+ *
+ * Read at the mask's own position rather than off the argument's first
+ * character: a field name can straddle a quote boundary (`Auth"orization: "$T`),
+ * and the quote the mask swallowed is the one open where it begins.
+ */
+function openQuoteAt(text: string, index: number): string {
+  let quote = "";
+  for (let i = 0; i < index; i++) {
+    const char = text[i];
+    if (quote === "") {
+      if (char === '"' || char === "'") quote = char;
+    } else if (quote === '"' && char === "\\") {
+      i += 1;
+    } else if (char === quote) {
+      quote = "";
+    }
+  }
+  return quote;
+}
+
+function maskSpan(
+  start: number,
+  end: number,
+  replacement: string,
+): MaskSpan | null {
+  return start < end ? { start, end, replacement } : null;
+}
+
+/**
+ * Replace each span, outermost-wins and right to left.
+ *
+ * A sensitive assignment whose value is itself a header argument yields two
+ * spans, one inside the other; masking both would nest a placeholder inside a
+ * region already replaced. Working right to left keeps the earlier offsets
+ * valid as the string shortens.
+ */
+function applyMaskSpans(command: string, spans: MaskSpan[]): string {
+  if (spans.length === 0) return command;
+
+  const ordered = [...spans].sort((a, b) => a.start - b.start || b.end - a.end);
+  const disjoint: MaskSpan[] = [];
+  for (const span of ordered) {
+    const previous = disjoint.at(-1);
+    if (previous && span.start < previous.end) continue;
+    disjoint.push(span);
+  }
+
+  let masked = command;
+  for (const span of disjoint.toReversed()) {
+    masked =
+      masked.slice(0, span.start) + span.replacement + masked.slice(span.end);
+  }
+  return masked;
+}

package/src/logging/log-field-cap.ts

@@ -1,3 +1,5 @@
+import { isPlainRecord } from "#src/value-guards";
+
 /**
  * The permission review log's width bound (ADR 0011 §6).
  *
@@ -57,7 +59,7 @@ function capValue(value: unknown, maxWidth: number): unknown {
   if (Array.isArray(value)) {
     return value.map((entry) => capValue(entry, maxWidth));
   }
-  if (isPlainObject(value)) {
+  if (isPlainRecord(value)) {
     return Object.fromEntries(
       Object.entries(value).map(([key, entry]) => [
         key,
@@ -67,16 +69,3 @@ function capValue(value: unknown, maxWidth: number): unknown {
   }
   return value;
 }
-
-/**
- * Whether a value is a record this cap should descend into.
- *
- * A class instance (a `Date`, an `Error`) is left alone: rebuilding it as a
- * plain object would change what the writer serializes, and the cap's job is
- * to shorten strings, not to reshape a value.
- */
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  if (typeof value !== "object" || value === null) return false;
-  const prototype: unknown = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}

package/src/logging/log-redaction.ts

@@ -1,7 +1,7 @@
 import { createJsonSafeReplacer } from "./json-safe-stringify";
 
 /**
- * Key-name redaction for the permission logs.
+ * Name-based redaction for the permission logs.
  *
  * The technique is deliberately structural rather than predictive: a value is
  * masked because of the *name* it is bound to, never because of what it looks
@@ -9,19 +9,41 @@ import { createJsonSafeReplacer } from "./json-safe-stringify";
  * was measured against a real 6.7 MB review log and declined — see
  * `docs/decisions/0010-permission-log-secret-exposure.md`.
  *
- * The boundary that follows from this, stated once: a value bound to a
- * sensitive key name is masked; a secret embedded in a bash command string is
- * not, because a command string has no keys.
+ * This module owns the predicate and the log-key binding form.
+ * `command-redaction.ts` asks the same predicate about the names a bash
+ * command binds values to.
+ *
+ * The boundary that follows, stated once: a value bound to a sensitive name is
+ * masked — whether the name is a log key, a shell variable, or a request
+ * header field. A secret with no name bound to it, such as one typed as a
+ * `grep` pattern, is not.
  */
 
 export const REDACTED_PLACEHOLDER = "[redacted]";
 
-const SENSITIVE_KEY_PATTERN =
-  /authorization|api[-_]?key|secret|token|password|passwd|credential|cookie|private[-_]?key/i;
+/**
+ * Names that bind a credential, matched case-insensitively.
+ *
+ * `api[-_]?keys?` and `private[-_]?keys?` are kept alongside the general
+ * name-boundary `key` rule rather than subsumed by it, so the whole predicate
+ * is a union with the pattern it replaced and can add a name but never drop
+ * one — the separator-less `apikey` matches only via the specific alternative.
+ */
+const SENSITIVE_NAME_PATTERN =
+  /authorization|api[-_]?keys?|private[-_]?keys?|secret|token|password|passwd|credential|cookie|(?:^|[-_])keys?(?:$|[-_])/i;
+
+/**
+ * A `key` bound as the tail of a camel-cased name (`apiKey`, `sortKeys`).
+ *
+ * Deliberately case-sensitive and separate from the pattern above: under `/i`
+ * the leading `[a-z0-9]` would match an uppercase letter and `Key` would match
+ * `key`, so `monkey` would read as sensitive.
+ */
+const CAMEL_KEY_PATTERN = /[a-z0-9](?:Key|Keys)(?:$|[A-Z_-])/;
 
-/** True when a log key names a credential-bearing value. */
-export function isSensitiveLogKey(key: string): boolean {
-  return SENSITIVE_KEY_PATTERN.test(key);
+/** True when a name binds a credential-bearing value. */
+export function isSensitiveName(name: string): boolean {
+  return SENSITIVE_NAME_PATTERN.test(name) || CAMEL_KEY_PATTERN.test(name);
 }
 
 /**
@@ -36,7 +58,7 @@ export function redactedJsonStringify(value: unknown): string | undefined {
   return JSON.stringify(
     value,
     createJsonSafeReplacer((key, currentValue) =>
-      currentValue != null && isSensitiveLogKey(key)
+      currentValue != null && isSensitiveName(key)
         ? REDACTED_PLACEHOLDER
         : currentValue,
     ),

package/src/logging/logging.ts

@@ -4,6 +4,7 @@ import {
   EXTENSION_ID,
   type PermissionSystemExtensionConfig,
 } from "#src/config/extension-config";
+import { maskCommandFields } from "./command-redaction";
 import { capLogFieldWidths, resolveReviewLogFieldWidth } from "./log-field-cap";
 import {
   OWNER_ONLY_FILE_MODE,
@@ -39,13 +40,41 @@ export function createPermissionSystemLogger(
   const hardened = new Set<string>();
 
   /**
-   * The only place a log line is produced.
+   * The transform stages every log line passes through, in the order they must
+   * run.
+   *
+   * Command masking runs first, and it runs for both streams. Capping a command
+   * before masking it would hand the masker a truncated command — a parse of
+   * something the agent never ran — and the debug stream carries the same
+   * payload as the review stream, so a mask that skipped it would only move the
+   * exposure rather than close it.
    *
    * `maxFieldWidth` bounds every string the line carries; it is supplied for
    * the review stream and withheld for the debug stream, which is opt-in and
-   * exists to be read in full. Capping happens before redaction, which masks
-   * by key name and so still masks a sensitive value whole.
+   * exists to be read in full. Capping happens before key-name redaction, which
+   * masks by name and so still masks a sensitive value whole.
    */
+  const prepareLogLine = (
+    stream: "debug" | "review",
+    event: string,
+    details: Record<string, unknown>,
+    maxFieldWidth?: number,
+  ): string | undefined => {
+    const masked = maskCommandFields(details);
+    const bounded =
+      maxFieldWidth === undefined
+        ? masked
+        : capLogFieldWidths(masked, maxFieldWidth);
+    return redactedJsonStringify({
+      timestamp: new Date().toISOString(),
+      extension: EXTENSION_ID,
+      stream,
+      event,
+      ...bounded,
+    });
+  };
+
+  /** The only place a log line is produced. */
   const writeLine = (
     stream: "debug" | "review",
     path: string,
@@ -59,17 +88,7 @@ export function createPermissionSystemLogger(
     }
 
     try {
-      const bounded =
-        maxFieldWidth === undefined
-          ? details
-          : capLogFieldWidths(details, maxFieldWidth);
-      const line = redactedJsonStringify({
-        timestamp: new Date().toISOString(),
-        extension: EXTENSION_ID,
-        stream,
-        event,
-        ...bounded,
-      });
+      const line = prepareLogLine(stream, event, details, maxFieldWidth);
       if (!line) {
         return `Failed to write permission-system ${stream} log '${path}': event could not be serialized.`;
       }

package/src/value-guards.ts

@@ -6,6 +6,22 @@ export function toRecord(value: unknown): Record<string, unknown> {
   return value as Record<string, unknown>;
 }
 
+/**
+ * Whether a value is a record a structural walk should descend into.
+ *
+ * A class instance (a `Date`, an `Error`) is not: rebuilding one as a plain
+ * object would change what a serializer downstream writes. Distinct from
+ * {@link toRecord}, which reads a value as a record without asking how it was
+ * built.
+ */
+export function isPlainRecord(
+  value: unknown,
+): value is Record<string, unknown> {
+  if (typeof value !== "object" || value === null) return false;
+  const prototype: unknown = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
 export function getNonEmptyString(value: unknown): string | null {
   if (typeof value !== "string") {
     return null;