@ictechgy/context-guard 0.4.16 → 0.5.1

package/plugins/context-guard/bin/context-guard-rewrite-bash

@@ -12,6 +12,8 @@ from dataclasses import dataclass
 import json
 import os
 import re
+import shutil
+import subprocess
 import sys
 
 ENV_ASSIGNMENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=.*")
@@ -24,6 +26,13 @@ WRAPPER_BASENAMES = frozenset({
     "claude-sanitize-output",
 })
 MINISHELL_ROUTE_POLICY_VERSION = "minishell-route-v1"
+MINISHELL_EXPLICIT_NOOP_ARGV = frozenset({
+    ("kubectl", "get", "pods"),
+    ("kubectl", "version"),
+    ("docker", "ps"),
+    ("docker", "images"),
+    ("docker", "compose", "ps"),
+})
 MINISHELL_MAX_COMMAND_BYTES = 65_536
 MINISHELL_MAX_LEXICAL_ITEMS = 4_096
 MINISHELL_MAX_SEGMENTS = 8
@@ -111,9 +120,12 @@ MINISHELL_ALLOWED_ENV_PREFIX_NAMES = frozenset({
     "NODE_ENV",
 })
 CGW1_MAX_LINES = "220"
-CGW1_SHELL_ARGV = ("bash", "-lc")
+CGW1_SHELL_ARGV = ("bash", "-c")
 CGW1_SENTINEL = "--context-guard-wrapper-v1"
 CGW1_COMMAND_SEARCH_DIFF = "command_search_diff"
+BASH_REFERENCE_FLAG = "--bash-reference-v1"
+BASH_REFERENCE_PUBLIC_COMMAND = "./node_modules/.bin/context-guard"
+BASH_REFERENCE_HANDLE_RE = re.compile(r"^cgr1p_[A-Za-z0-9_-]{43}$", re.ASCII)
 FAIL_OPEN_ENV = "CONTEXT_GUARD_SANITIZER_FAIL_OPEN"
 LEGACY_FAIL_OPEN_ENV = "CLAUDE_TOKEN_SANITIZER_FAIL_OPEN"
 FAIL_OPEN_VALUES = {"1", "true", "yes", "on"}
@@ -124,6 +136,47 @@ UNPARSEABLE_SANITIZER_RISK_RE = re.compile(
     r"(?:$|[\s;&|()])"
 )
 
+
+def _approved_runtime_executable(name: str) -> str:
+    """Resolve only from the fixed OS command path, never inherited PATH."""
+    found = shutil.which(name, path=os.defpath)
+    if not found:
+        raise RuntimeError(f"required runtime {name!r} is unavailable")
+    canonical = os.path.realpath(found)
+    if not os.path.isabs(canonical) or not os.path.isfile(canonical) or not os.access(canonical, os.X_OK):
+        raise RuntimeError(f"required runtime {name!r} is not an executable regular file")
+    return canonical
+
+
+def _approved_python_runtime() -> str:
+    canonical = os.path.realpath(sys.executable)
+    if not canonical or not os.path.isabs(canonical) or not os.path.isfile(canonical) or not os.access(canonical, os.X_OK):
+        raise RuntimeError("approved Python runtime is unavailable")
+    return canonical
+
+
+def _runtime_shell_argv() -> tuple[str, ...]:
+    return (
+        _approved_runtime_executable("env"),
+        "-u", "BASH_ENV",
+        "-u", "ENV",
+        "-u", "PYTHONHOME",
+        "-u", "PYTHONPATH",
+        "-u", "PYTHONSTARTUP",
+        "-u", "SHELLOPTS",
+        "-u", "BASHOPTS",
+        "-u", "PS4",
+        _approved_runtime_executable("bash"),
+        "--noprofile",
+        "--norc",
+        "-p",
+        "-c",
+    )
+
+
+def _isolated_wrapper_prefix(wrapper: str) -> list[str]:
+    return [_approved_python_runtime(), "-I", os.path.realpath(wrapper)]
+
 # kubectl/docker/podman/oc 글로벌 옵션 중 다음 토큰을 value로 소비하는 형태.
 # `-n prod`, `--context=prod`, `-f file.yml` 같은 케이스를 hub로 흡수해
 # `kubectl -n prod logs api`, `docker --context prod logs api`,
@@ -705,7 +758,23 @@ def split_single_safe_command(command: str) -> list[str] | None:
 
 
 def command_basename(command: str) -> str:
-    return os.path.basename(command)
+    """Return a trusted routing identity only for a bare ASCII command token.
+
+    Route predicates describe standard command identities, not arbitrary files
+    that happen to share a basename.  Normalizing ``./rg`` or
+    ``/tmp/evil/grep`` to a trusted name would let a caller-selected executable
+    inherit that route.  Non-ASCII tokens are also rejected here so Unicode
+    separator lookalikes cannot create a visually ambiguous identity.
+    """
+    if (
+        not command
+        or not command.isascii()
+        or not command.isprintable()
+        or "/" in command
+        or "\\" in command
+    ):
+        return ""
+    return command
 
 
 def strip_env_prefix(argv: list[str]) -> list[str]:
@@ -782,9 +851,9 @@ def is_noisy_command(argv: list[str]) -> bool:
         return True
     if first == "cargo" and "test" in rest:
         return True
-    if first in {"mvn", "mvnw", "./mvnw"} and "test" in rest:
+    if first in {"mvn", "mvnw"} and "test" in rest:
         return True
-    if first in {"gradle", "gradlew", "./gradlew"} and "test" in rest:
+    if first in {"gradle", "gradlew"} and "test" in rest:
         return True
     if first == "make" and any(arg in {"test", "build", "lint"} for arg in rest):
         return True
@@ -1041,15 +1110,25 @@ def _routing_argv(parsed: MiniShellParse) -> tuple[str, ...]:
 def _wrapper_invocation(argv: tuple[str, ...]) -> tuple[str, int] | None:
     if not argv:
         return None
-    head_basename = command_basename(argv[0])
+    # Incoming wrappers are recognized before the general command-identity
+    # gate.  Their generated envelopes intentionally contain absolute helper
+    # paths, so this narrow recursion guard must inspect the real basename.
+    head_basename = os.path.basename(argv[0])
     if head_basename in WRAPPER_BASENAMES:
         return head_basename, 0
     if (
         re.fullmatch(r"python(?:\d+(?:\.\d+)?)?", head_basename)
         and len(argv) > 1
-        and command_basename(argv[1]) in WRAPPER_BASENAMES
+        and os.path.basename(argv[1]) in WRAPPER_BASENAMES
     ):
-        return command_basename(argv[1]), 1
+        return os.path.basename(argv[1]), 1
+    if (
+        re.fullmatch(r"python(?:\d+(?:\.\d+)?)?", head_basename)
+        and len(argv) > 2
+        and argv[1] == "-I"
+        and os.path.basename(argv[2]) in WRAPPER_BASENAMES
+    ):
+        return os.path.basename(argv[2]), 2
     return None
 
 
@@ -1070,6 +1149,21 @@ def _expected_cgw1_prefix(kind: str) -> tuple[str, ...]:
     return (os.path.join(script_dir, helper),)
 
 
+def _is_expected_direct_wrapper_path(argv: tuple[str, ...]) -> bool:
+    """Whether argv starts with this package's exact generated helper path.
+
+    Direct helper CLI use predates F-11 and remains ordinary.  The exception
+    is deliberately limited to the helper beside this entrypoint; an
+    attacker-chosen path that merely shares its basename is not trusted.
+    """
+    invocation = _wrapper_invocation(argv)
+    if invocation is None or invocation[1] != 0:
+        return False
+    basename, _wrapper_index = invocation
+    expected = _expected_cgw1_prefix(_wrapper_kind(basename))
+    return len(expected) == 1 and argv[0] == expected[0]
+
+
 def classify_incoming_wrapper(
     parsed: MiniShellParse,
 ) -> tuple[str, str | None, str | None] | None:
@@ -1108,13 +1202,15 @@ def classify_incoming_wrapper(
         (CGW1_COMMAND_SEARCH_DIFF,),
         ("--mode", CGW1_COMMAND_SEARCH_DIFF),
     )
+    shell_argvs = (CGW1_SHELL_ARGV, _runtime_shell_argv())
     for prefix in legacy_prefixes:
-        fixed = (*prefix, "--", *CGW1_SHELL_ARGV)
-        if (
-            len(envelope_argv) == len(fixed) + 1
-            and envelope_argv[:-1] == fixed
-        ):
-            return ("incoming_wrapper_denied", kind, envelope_argv[-1])
+        for shell_argv in shell_argvs:
+            fixed = (*prefix, "--", *shell_argv)
+            if (
+                len(envelope_argv) == len(fixed) + 1
+                and envelope_argv[:-1] == fixed
+            ):
+                return ("incoming_wrapper_denied", kind, envelope_argv[-1])
     return None
 
 
@@ -1338,7 +1434,12 @@ def _cut_is_safe(argv: tuple[str, ...]) -> bool:
     return selector is not None and (not delimiter or selector == "-f")
 
 
-_SED_SCRIPT_RE = re.compile(r"(?:[1-9]\d*|[1-9]\d*,(?:[1-9]\d*|\$))p")
+_SED_SEGMENT_PATTERN = r"(?:[1-9]\d*|[1-9]\d*,(?:[1-9]\d*|\$))p"
+_SED_MAX_SEGMENTS = 8
+_SED_SCRIPT_RE = re.compile(
+    rf"{_SED_SEGMENT_PATTERN}(?:;{_SED_SEGMENT_PATTERN})"
+    rf"{{0,{_SED_MAX_SEGMENTS - 1}}}"
+)
 
 
 def _sed_route_shape(argv: tuple[str, ...]) -> tuple[bool, int]:
@@ -1356,8 +1457,9 @@ def _sed_route_shape(argv: tuple[str, ...]) -> tuple[bool, int]:
          전부 거부하고 정확한 토큰만 허용한다.
 
     스크립트 본문 자체의 안전 경계(`w`/`W`/`s///w`/`e`/`s///e`/`r`/`R` 배제)는
-    `_SED_SCRIPT_RE` 의 `re.fullmatch` 가 담당하며 이번 변경으로 절대
-    느슨해지지 않는다 — 이 함수는 그 정규식이 실제로 검사하는 대상이 진짜
+    `_SED_SCRIPT_RE` 의 `re.fullmatch` 가 담당한다. S009는 기존의 안전한
+    p-only SEG를 `;`로 최대 `_SED_MAX_SEGMENTS` 개 조합할 뿐 SEG 자체를
+    넓히지 않는다 — 이 함수는 그 정규식이 실제로 검사하는 대상이 진짜
     스크립트임을 보장하는 역할만 한다.
     """
     quiet_seen = False
@@ -1505,7 +1607,7 @@ def _head_tail_is_safe(argv: tuple[str, ...], *, allow_files: bool) -> bool:
     `-n`/`--lines`(및 `-N`/`-nN`/`--lines=N` 축약형)는 최대 1회만 허용하며 유효한
     양의 정수여야 한다. **`-n` 미지정도 허용한다** — bare `head`/`tail`은 기본
     10줄 상한이 이미 적용되므로 무제한 출력 위험이 없다. `tail -f`/`-F`는 무제한
-    스트림이므로 allow_files 여부와 무관하게 항상 거부한다(`bash -lc` 내부에서
+    스트림이므로 allow_files 여부와 무관하게 항상 거부한다(`bash -c` 내부에서
     프로세스가 종결되지 않는 것을 방지). `-c`(바이트 단위)는 지원하지 않는다 —
     trim 예산 단위는 줄(line)이라 바이트 상한과 섞일 수 없다.
     """
@@ -1549,18 +1651,15 @@ def _head_tail_is_safe(argv: tuple[str, ...], *, allow_files: bool) -> bool:
 #: 이 저장소에서 결함이 전파되는 경로다. `-s`를 허용하기로 결정한다면 짧은 옵션
 #: 쪽을 먼저 넓히고 그 다음 이 표에 롱 형태를 추가한다.
 #:
-#: 값 형태를 취하는 옵션(`--include=`, `--exclude=`, `--exclude-dir=`, `--devices=`,
+#: 값 형태를 취하는 옵션(`--exclude=`, `--exclude-dir=`, `--devices=`,
 #: `--directories=`, `--label=`, `--binary-files=`, `-D/-U/-z/-Z/--null` 계열)은
 #: 의도적으로 제외한다. 이유는 값이 동작을 바꾸기 때문이다(예: `--directories=read`).
 #:
-#: 주의 — 이 제외를 "어차피 파서 단계(`active_2a`)에서 글롭으로 거부된다"로
-#: 정당화하면 **틀린다.** 비인용 `--include=*.py`는 확실히 `active_2a`로 죽지만,
-#: 인용된 `--include='*.py'`는 셸이 확장하지 않아 롱플래그로 여기까지 도달하며
-#: `route_policy_denied`를 받는다(리뷰 라운드 실측: 그런 명령이 코퍼스에 66건).
-#: 즉 이들은 여기서 다루면 실제로 열린다. 다루지 않는 이유는 `--flag=value` 형태를
-#: 담으려면 값 문법을 갖춘 접두 규칙이 필요한데, 그 첫 접두 규칙을 "접두사 매칭
-#: 금지" 규율을 세우는 바로 이 변경에 함께 넣으면 규율 자체가 무너지기 때문이다.
-#: 별도 변경으로 다룬다.
+#: S010은 incidence gate를 통과한 bare recursive `grep`의 정확히 한 개
+#: `--include=<glob>`만 아래 별도 값 문법으로 다룬다. 이 옵션은 정확 일치 이름,
+#: 제한된 ASCII basename grammar, recursive/file-operand 조건을 모두 만족해야 하며
+#: 이 별칭 표에는 들어오지 않는다. 다른 값 옵션과 `--include*` 근접 철자는 계속
+#: exact-match fail-closed 규칙을 따른다.
 _GREP_LONG_ALIASES = frozenset(
     {
         "--only-matching",
@@ -1589,10 +1688,29 @@ _GREP_LONG_ALIASES = frozenset(
     }
 )
 
+_GREP_INCLUDE_GLOB_RE = re.compile(r"[A-Za-z0-9._*?-]+\Z", re.ASCII)
+
+
+def _grep_include_glob_is_safe(value: str) -> bool:
+    return (
+        1 <= len(value) <= 96
+        and not value.startswith("-")
+        and _GREP_INCLUDE_GLOB_RE.fullmatch(value) is not None
+        and re.search(r"[A-Za-z0-9._]", value, re.ASCII) is not None
+    )
 
-def _grep_is_safe(argv: tuple[str, ...], *, allow_files: bool) -> bool:
+
+def _grep_is_safe(
+    argv: tuple[str, ...],
+    *,
+    allow_files: bool,
+    allow_include: bool = False,
+) -> bool:
     pattern_seen = False
     files = 0
+    include_seen = False
+    recursive_seen = False
+    stdin_operand_seen = False
     allowed_flags = set("nHhivEFGPwxcolLrRq".replace(" ", ""))
     index = 1
     while index < len(argv):
@@ -1600,6 +1718,17 @@ def _grep_is_safe(argv: tuple[str, ...], *, allow_files: bool) -> bool:
         if argument == "--":
             index += 1
             break
+        if argument.startswith("--include"):
+            if (
+                not allow_include
+                or include_seen
+                or not argument.startswith("--include=")
+                or not _grep_include_glob_is_safe(argument.split("=", 1)[1])
+            ):
+                return False
+            include_seen = True
+            index += 1
+            continue
         if argument in {"-f", "--file"} or argument.startswith(("--file=", "--binary-files=")):
             return False
         if argument == "-e":
@@ -1624,9 +1753,12 @@ def _grep_is_safe(argv: tuple[str, ...], *, allow_files: bool) -> bool:
             index += 1
             continue
         if argument == "--recursive":
+            recursive_seen = True
             index += 1
             continue
         if argument in _GREP_LONG_ALIASES:
+            if argument == "--dereference-recursive":
+                recursive_seen = True
             index += 1
             continue
         if argument.startswith("-") and argument != "-":
@@ -1636,19 +1768,31 @@ def _grep_is_safe(argv: tuple[str, ...], *, allow_files: bool) -> bool:
                 or not set(argument[1:]).issubset(allowed_flags)
             ):
                 return False
+            if "r" in argument[1:] or "R" in argument[1:]:
+                recursive_seen = True
             index += 1
             continue
         if not pattern_seen:
             pattern_seen = True
         else:
             files += 1
+            stdin_operand_seen = stdin_operand_seen or argument == "-"
         index += 1
     while index < len(argv):
         if not pattern_seen:
             pattern_seen = True
         else:
             files += 1
+            stdin_operand_seen = stdin_operand_seen or argv[index] == "-"
         index += 1
+    if include_seen:
+        return (
+            allow_files
+            and recursive_seen
+            and pattern_seen
+            and files > 0
+            and not stdin_operand_seen
+        )
     return pattern_seen and (allow_files or files == 0)
 
 
@@ -1960,6 +2104,24 @@ _GIT_DIFF_SHOW_BOOLEAN_FLAGS = frozenset({
     "--color=never", "--cached", "--staged", "--oneline",
 })
 
+_GIT_CONFIG_EXECUTION_GUARD = (
+    "GIT_CONFIG_COUNT=1",
+    "GIT_CONFIG_KEY_0=core.fsmonitor",
+    "GIT_CONFIG_VALUE_0=false",
+)
+_GIT_ORIGINAL_COMMAND_ENV = "CONTEXT_GUARD_ORIGINAL_COMMAND"
+_GIT_GUARD_MODE = "--context-guard-exec-git"
+_GIT_DIFF_EXECUTION_FLAGS = ("--no-ext-diff", "--no-textconv")
+_GIT_TEXTCONV_EXECUTION_FLAGS = ("--no-textconv",)
+_GIT_FILTER_CONFIG_KEY_RE = re.compile(
+    r"^filter\..+\.(?:clean|smudge|process|required)$",
+    re.IGNORECASE,
+)
+_GIT_FILTER_CONFIG_QUERY = r"^filter\..*\.(clean|smudge|process|required)$"
+_GIT_FILTER_CONFIG_MAX_KEYS = 128
+_GIT_FILTER_CONFIG_MAX_BYTES = 65_536
+_GIT_FILTER_CONFIG_TIMEOUT_SECONDS = 5
+
 
 def _git_diff_show_is_safe(arguments: tuple[str, ...]) -> bool:
     """`git diff`/`git show`: 기존 `_git_is_safe` 경로를 그대로 보존한다
@@ -2176,7 +2338,13 @@ def _npx_route(argv: tuple[str, ...]) -> str:
             index += 1
             continue
         return "deny"
-    if index < len(argv) and command_basename(argv[index]) in {"jest", "vitest"}:
+    if index >= len(argv):
+        return "noop"
+    delegated_command = argv[index]
+    delegated_basename = command_basename(delegated_command)
+    if delegated_basename != delegated_command:
+        return "deny"
+    if delegated_basename in {"jest", "vitest"}:
         return "trim"
     return "noop"
 
@@ -2206,6 +2374,27 @@ def _make_route(argv: tuple[str, ...]) -> str:
     return "noop"
 
 
+def _is_explicit_noop_command(argv: tuple[str, ...]) -> bool:
+    """Match only the pre-existing short-command controls kept by S011.
+
+    Tool basenames are deliberately insufficient: e.g. `kubectl get secrets`
+    and `docker run` still reach the fail-closed fallback. The one variable
+    shape is a read-only pod description with a static Kubernetes-style name.
+    """
+    if argv in MINISHELL_EXPLICIT_NOOP_ARGV:
+        return True
+    return (
+        len(argv) == 4
+        and argv[:3] == ("kubectl", "describe", "pod")
+        and re.fullmatch(
+            r"[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?",
+            argv[3],
+            re.ASCII,
+        )
+        is not None
+    )
+
+
 def command_search_diff(
     argv: tuple[str, ...],
     *,
@@ -2285,7 +2474,11 @@ def command_search_diff(
     if first in {"grep", "egrep", "fgrep"}:
         return (
             "sanitize"
-            if _grep_is_safe(argv, allow_files=role != "filter")
+            if _grep_is_safe(
+                argv,
+                allow_files=role != "filter",
+                allow_include=first == "grep" and role != "filter",
+            )
             else "deny"
         )
     if first == "rg":
@@ -2300,7 +2493,20 @@ def command_search_diff(
             if role != "filter" and _git_is_safe(argv)
             else "deny"
         )
-    if first in {"npm", "pnpm", "yarn", "bun"}:
+    if first == "echo" or _is_explicit_noop_command(argv):
+        # `echo` is the explicit side-effect-free noop used by the shell
+        # contract and hook-envelope controls. The exact kubectl/docker rows
+        # are the pre-existing short-command controls. Keep both distinct from
+        # the unregistered-command fallback so closing F-1 does not turn a
+        # broad tool basename into an allowlist.
+        route = "noop"
+    elif _wrapper_invocation(argv) is not None:
+        # A direct ContextGuard helper CLI is not an incoming CGW1/v0
+        # execution envelope. `classify_incoming_wrapper` already denied the
+        # exact envelope shapes before route classification; preserve the
+        # established direct-CLI compatibility contract here explicitly.
+        route = "noop"
+    elif first in {"npm", "pnpm", "yarn", "bun"}:
         route = _package_script_route(argv)
     elif first == "npx":
         route = _npx_route(argv)
@@ -2331,7 +2537,11 @@ def command_search_diff(
     elif is_log_streaming_command(list(argv)):
         route = "sanitize"
     else:
-        route = "noop"
+        # F-1: an unregistered executable identity (including execution-prefix
+        # wrappers such as nice/command/xargs/stdbuf/nohup) has no modeled
+        # semantics.  It must not inherit standalone `noop` merely because it
+        # contains no pipeline.
+        route = "deny"
     if role == "standalone":
         return route
     if role == "first":
@@ -2358,7 +2568,10 @@ def _prefix_overrides_path(
 def _forbidden_command_basename(argv: tuple[str, ...]) -> bool:
     if not argv:
         return False
-    basename = command_basename(argv[0])
+    # Forbidden identities may be recognized through a path because this gate
+    # can only narrow behavior.  Unlike positive route predicates, a basename
+    # match here never grants a wrapper or noop route.
+    basename = os.path.basename(argv[0])
     if basename in MINISHELL_DENIED_COMMAND_BASENAMES:
         return True
     if basename not in MINISHELL_DENIED_SHELL_BASENAMES:
@@ -2369,6 +2582,43 @@ def _forbidden_command_basename(argv: tuple[str, ...]) -> bool:
     )
 
 
+def _reference_route_argv(parsed: MiniShellParse) -> tuple[str, ...] | None:
+    """Recognize only the static standalone command emitted by the digest."""
+
+    if (
+        parsed.heredoc_delimiter is not None
+        or len(parsed.segments) != 1
+        or len(parsed.segments[0]) not in {3, 5}
+    ):
+        return None
+    words = parsed.segments[0]
+    if any(
+        word.source_value != word.value
+        or not all(word.active)
+        or word.barriers
+        or word.assignment_index is not None
+        for word in words
+    ):
+        return None
+    argv = tuple(word.value for word in words)
+    if (
+        argv[0] != BASH_REFERENCE_PUBLIC_COMMAND
+        or argv[1] != "reference"
+        or BASH_REFERENCE_HANDLE_RE.fullmatch(argv[2]) is None
+    ):
+        return None
+    if len(argv) == 3:
+        return argv
+    offset = argv[4]
+    if (
+        argv[3] != "--offset"
+        or len(offset) > 20
+        or re.fullmatch(r"(?:0|[1-9][0-9]*)", offset, re.ASCII) is None
+    ):
+        return None
+    return argv
+
+
 def classify_command(command: str, *, allow_cgw1: bool = True) -> CommandDecision:
     """Make a side-effect-free shell-boundary and routing decision."""
     parsed = parse_minishell(command)
@@ -2387,6 +2637,13 @@ def classify_command(command: str, *, allow_cgw1: bool = True) -> CommandDecisio
             reason_code="active_shell_expansion_denied",
         )
 
+    if _reference_route_argv(parsed) is not None:
+        return CommandDecision(
+            action="reference",
+            parsed=parsed,
+            route_code="reference_expand",
+        )
+
     wrapper = classify_incoming_wrapper(parsed)
     if wrapper is not None:
         wrapper_status, _wrapper_kind_name, _payload = wrapper
@@ -2443,6 +2700,19 @@ def classify_command(command: str, *, allow_cgw1: bool = True) -> CommandDecisio
                 reason="Forbidden command denied (forbidden_command_denied).",
                 reason_code="forbidden_command_denied",
             )
+        if (
+            command_basename(route_argv[0]) != route_argv[0]
+            and not (
+                len(parsed.segments) == 1
+                and _is_expected_direct_wrapper_path(route_argv)
+            )
+        ):
+            return CommandDecision(
+                action="deny",
+                parsed=parsed,
+                reason="Non-bare command identity denied (command_identity_denied).",
+                reason_code="command_identity_denied",
+            )
         if parsed.heredoc_delimiter is not None and (
             len(parsed.segments) != 1
             or command_basename(route_argv[0])
@@ -2519,25 +2789,185 @@ def shell_join(argv: list[str] | tuple[str, ...]) -> str:
     return " ".join(shell_quote(value) for value in argv)
 
 
-def build_wrapped_command(wrapper: str, command: str) -> str:
-    if wrapper.endswith(".py"):
-        prefix = ["python3", wrapper]
-    else:
-        prefix = [wrapper]
-    wrapped_argv = prefix + ["--max-lines", CGW1_MAX_LINES, "--", *CGW1_SHELL_ARGV, command]
+def _render_minishell_word(word: MiniShellWord) -> str:
+    assignment_name = _env_prefix_name(word)
+    if assignment_name is None:
+        return shell_quote(word.value)
+    assignment_value = word.value[len(assignment_name) + 1 :]
+    return f"{assignment_name}={shell_quote(assignment_value)}"
+
+
+def _git_execution_guard_spec(git_argv: tuple[str, ...]) -> tuple[int, tuple[str, ...]]:
+    if len(git_argv) < 2:
+        return (len(git_argv), ())
+    subcommand = git_argv[1]
+    if subcommand in {"diff", "show", "log"}:
+        return (2, _GIT_DIFF_EXECUTION_FLAGS)
+    if subcommand in {"grep", "blame"}:
+        return (2, _GIT_TEXTCONV_EXECUTION_FLAGS)
+    if len(git_argv) >= 3 and git_argv[:3] == ("git", "stash", "show"):
+        return (3, _GIT_DIFF_EXECUTION_FLAGS)
+    return (2, ())
+
+
+def _validated_guarded_git_argv(argv: tuple[str, ...]) -> tuple[str, ...] | None:
+    """Accept only the exact guarded form of an independently safe Git command."""
+    if not argv or command_basename(argv[0]) != "git":
+        return None
+    flag_index, expected_flags = _git_execution_guard_spec(argv)
+    if tuple(argv[flag_index : flag_index + len(expected_flags)]) != expected_flags:
+        return None
+    original_argv = (
+        argv[:flag_index]
+        + argv[flag_index + len(expected_flags) :]
+    )
+    if not _git_is_safe(original_argv):
+        return None
+    return argv
+
+
+def _clear_git_command_scope_config(environment: dict[str, str]) -> None:
+    environment.pop("GIT_CONFIG_COUNT", None)
+    environment.pop("GIT_CONFIG_PARAMETERS", None)
+    for name in tuple(environment):
+        if re.fullmatch(r"GIT_CONFIG_(?:KEY|VALUE)_\d+", name):
+            environment.pop(name, None)
+
+
+def _discover_git_filter_config_keys() -> tuple[str, ...]:
+    discovery_env = os.environ.copy()
+    _clear_git_command_scope_config(discovery_env)
+    discovery_env.update(
+        {
+            "GIT_CONFIG_COUNT": "1",
+            "GIT_CONFIG_KEY_0": "core.fsmonitor",
+            "GIT_CONFIG_VALUE_0": "false",
+        }
+    )
+    result = subprocess.run(
+        [
+            "git",
+            "config",
+            "--null",
+            "--name-only",
+            "--get-regexp",
+            _GIT_FILTER_CONFIG_QUERY,
+        ],
+        env=discovery_env,
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.DEVNULL,
+        timeout=_GIT_FILTER_CONFIG_TIMEOUT_SECONDS,
+        check=False,
+    )
+    if result.returncode not in {0, 1}:
+        raise RuntimeError("git config discovery failed")
+    if len(result.stdout) > _GIT_FILTER_CONFIG_MAX_BYTES:
+        raise RuntimeError("git filter config exceeded the discovery limit")
+
+    keys: list[str] = []
+    seen: set[str] = set()
+    for raw_key in result.stdout.split(b"\0"):
+        if not raw_key:
+            continue
+        key = os.fsdecode(raw_key)
+        if not _GIT_FILTER_CONFIG_KEY_RE.fullmatch(key):
+            raise RuntimeError("git config discovery returned an unexpected key")
+        if key in seen:
+            continue
+        seen.add(key)
+        keys.append(key)
+    if len(keys) > _GIT_FILTER_CONFIG_MAX_KEYS:
+        raise RuntimeError("too many git filter config keys")
+    return tuple(keys)
+
+
+def _guarded_git_environment(filter_keys: tuple[str, ...]) -> dict[str, str]:
+    environment = os.environ.copy()
+    _clear_git_command_scope_config(environment)
+    environment.pop("GIT_EXTERNAL_DIFF", None)
+    config_pairs: list[tuple[str, str]] = [("core.fsmonitor", "false")]
+    for key in filter_keys:
+        value = "false" if key.casefold().endswith(".required") else ""
+        config_pairs.append((key, value))
+    environment["GIT_CONFIG_COUNT"] = str(len(config_pairs))
+    for index, (key, value) in enumerate(config_pairs):
+        environment[f"GIT_CONFIG_KEY_{index}"] = key
+        environment[f"GIT_CONFIG_VALUE_{index}"] = value
+    return environment
+
+
+def run_guarded_git(argv: tuple[str, ...]) -> int:
+    guarded_argv = _validated_guarded_git_argv(argv)
+    if guarded_argv is None:
+        print("ContextGuard denied an invalid guarded Git invocation.", file=sys.stderr)
+        return 126
+    try:
+        filter_keys = _discover_git_filter_config_keys()
+        environment = _guarded_git_environment(filter_keys)
+        os.execvpe(guarded_argv[0], list(guarded_argv), environment)
+    except (OSError, RuntimeError, subprocess.SubprocessError):
+        print("ContextGuard could not neutralize Git execution configuration.", file=sys.stderr)
+        return 126
+    raise AssertionError("os.execvpe returned unexpectedly")
+
+
+def neutralize_git_config_execution(command: str, parsed: MiniShellParse) -> str:
+    """Disable config helpers while retaining the original command for inspection."""
+    guarded_segments: list[str] = []
+    changed = False
+    for segment in parsed.segments:
+        segment_argv = tuple(word.value for word in segment)
+        route_start = _routing_start(segment, segment_argv)
+        rendered_words = [_render_minishell_word(word) for word in segment]
+        if (
+            route_start >= 0
+            and route_start + 1 < len(segment_argv)
+            and command_basename(segment_argv[route_start]) == "git"
+        ):
+            git_argv = segment_argv[route_start:]
+            relative_flag_index, flags = _git_execution_guard_spec(git_argv)
+            flag_index = route_start + relative_flag_index
+            rendered_words[flag_index:flag_index] = flags
+            rendered_words[route_start : route_start + 1] = (
+                shell_quote(_approved_python_runtime()),
+                "-I",
+                shell_quote(os.path.realpath(__file__)),
+                _GIT_GUARD_MODE,
+                "--",
+                "git",
+            )
+            # Existing wrapper consumers inspect the rewritten string for the
+            # admitted source command. Keep it as one quoted, namespaced
+            # assignment; Git ignores the value and the shell cannot execute it.
+            original_command_marker = (
+                f"{_GIT_ORIGINAL_COMMAND_ENV}={shell_quote(command)}"
+            )
+            rendered_words[route_start:route_start] = (
+                original_command_marker,
+                *_GIT_CONFIG_EXECUTION_GUARD,
+            )
+            changed = True
+        guarded_segments.append(" ".join(rendered_words))
+    return " | ".join(guarded_segments) if changed else command
+
+
+def build_wrapped_command(wrapper: str, command: str, *, bash_reference_v1: bool = False) -> str:
+    prefix = _isolated_wrapper_prefix(wrapper)
+    wrapped_argv = prefix + ["--max-lines", CGW1_MAX_LINES]
+    if bash_reference_v1:
+        wrapped_argv += ["--digest", "json", BASH_REFERENCE_FLAG]
+    wrapped_argv += ["--", *_runtime_shell_argv(), command]
     return shell_join(wrapped_argv)
 
 
 def build_sanitized_command(wrapper: str, command: str) -> str:
-    if wrapper.endswith(".py"):
-        prefix = ["python3", wrapper]
-    else:
-        prefix = [wrapper]
+    prefix = _isolated_wrapper_prefix(wrapper)
     wrapped_argv = prefix + [
         CGW1_SENTINEL,
         CGW1_COMMAND_SEARCH_DIFF,
         "--",
-        *CGW1_SHELL_ARGV,
+        *_runtime_shell_argv(),
         command,
     ]
     return shell_join(wrapped_argv)
@@ -2560,9 +2990,15 @@ def print_updated_command(wrapped: str, tool_input: dict[str, object]) -> None:
 
 
 def main() -> int:
+    if sys.argv[1:3] == [_GIT_GUARD_MODE, "--"]:
+        return run_guarded_git(tuple(sys.argv[3:]))
+    if _GIT_GUARD_MODE in sys.argv[1:]:
+        print("ContextGuard denied a malformed guarded Git invocation.", file=sys.stderr)
+        return 126
     if any(arg in {"-h", "--help"} for arg in sys.argv[1:]):
         print("ContextGuard helper: context-guard-rewrite-bash")
         return 0
+    bash_reference_v1 = BASH_REFERENCE_FLAG in sys.argv[1:]
     try:
         payload = load_hook_payload()
         tool_input = select_tool_input(payload)
@@ -2595,7 +3031,7 @@ def main() -> int:
                 f"{FAIL_OPEN_ENV}=1 to run untrimmed intentionally."
             )
             return 0
-        wrapped = build_wrapped_command(wrapper, command)
+        wrapped = build_wrapped_command(wrapper, command, bash_reference_v1=bash_reference_v1)
     elif decision.action == "sanitize":
         wrapper = find_wrapper("sanitize")
         if wrapper is None:
@@ -2606,7 +3042,23 @@ def main() -> int:
             )
             deny(reason)
             return 0
-        wrapped = build_sanitized_command(wrapper, command)
+        guarded_command = neutralize_git_config_execution(command, decision.parsed)
+        wrapped = build_sanitized_command(wrapper, guarded_command)
+    elif decision.action == "reference":
+        wrapper = find_wrapper("trim")
+        if wrapper is None:
+            deny(
+                "Reference expansion blocked because the package-local trim helper "
+                "is unavailable. Reinstall ContextGuard."
+            )
+            return 0
+        reference_argv = _reference_route_argv(decision.parsed)
+        if reference_argv is None:
+            raise AssertionError("reference route lost its closed grammar")
+        prefix = ["python3", wrapper] if wrapper.endswith(".py") else [wrapper]
+        wrapped = shell_join(
+            [*prefix, "--expand-bash-reference", *reference_argv[2:]]
+        )
     else:
         raise AssertionError(f"unknown command action: {decision.action}")