@marcomigozzi/trailhead 0.14.0 → 0.16.0

package/plugins/trailhead/hooks/trailhead-search-guard.js

@@ -24,6 +24,21 @@
 // cannot see. Blocking a lone `cd` would be far too aggressive (a legitimate,
 // common shape) so it is deliberately left to the prose directive.
 //
+// Redirections are not reads of a relative path: before a verb's args are
+// walked, output redirections (`>`, `>>`, `2>`, `&>`, glued or with a separate
+// target), fd duplications (`2>&1`) and heredoc/herestring introducers are
+// dropped together with their target, so `cat /abs/a > out.txt` or
+// `tail /abs/log 2>/dev/null` are not reported. An input redirection `< f` IS a
+// read: only the operator is dropped and `f` stays in the arg list, so
+// `cd app && cat < rel.txt` still blocks while `wc -l < /abs/a` passes.
+//
+// cwd exemption: when the hook payload carries the session `cwd` (absolute), a
+// joined `cd X`/`pushd X` whose literal target resolves to exactly that cwd is
+// a no-op, so it does not make later relative reads non-static. Dynamic or
+// special targets (`$VAR`, backticks, `~`, `-`, a bare `cd`) always count as a
+// directory change, and an unknown cwd behaves as before. The exemption only
+// avoids ARMING: once a real cd has armed the guard, nothing disarms it.
+//
 // Blocks with exit 2 + {"decision":"block","code":...,"reason":...}; allows
 // everything else. Crash-safe: any error -> exit 0 (never wedge the user's
 // workflow). Self-contained (its own dependency is the sibling lib/ module,
@@ -36,12 +51,14 @@
 // machinery (SEARCH_VERB_CONFIG, scanArgsSkippingPattern) are shared with
 // trailhead-secret-read-guard.js via lib/shell-scan.js (#135 follow-up), so
 // the two guards can never drift into two divergent tokenizers.
+const path = require('path');
 const {
   basename,
   stripQuotes,
   splitStatements,
   tokenize,
   skipEnvPrefix,
+  stripRedirections,
   SEARCH_VERB_CONFIG,
   scanArgsSkippingPattern,
 } = require('./lib/shell-scan.js');
@@ -114,7 +131,7 @@ const VERB_CONFIG = {
 // Walk a verb's argument tokens (verb itself already stripped) for the first
 // relative FILE argument found, via the shared pattern/flag-skipping walker.
 function scanArgsForRelativeFile(args, config) {
-  return scanArgsSkippingPattern(args, config, isRelativeFileArg);
+  return scanArgsSkippingPattern(stripRedirections(args), config, isRelativeFileArg);
 }
 
 // `git grep`/`git log`/`git show`/`git diff` WITHOUT a `-C` (or --work-tree):
@@ -177,6 +194,22 @@ function isCdOrPushdStatement(stmt) {
   return bin === 'cd' || bin === 'pushd';
 }
 
+// Does this cd/pushd statement provably stay in the session cwd? Only with a
+// known absolute cwd and exactly one static literal target resolving to it.
+function cdTargetsSessionCwd(stmt, cwd) {
+  if (typeof cwd !== 'string' || !path.isAbsolute(cwd)) return false;
+  const tokens = normalizeStatementTokens(tokenize(stmt));
+  let i = skipEnvPrefix(tokens) + 1; // past cd/pushd
+  while (i < tokens.length && tokens[i].startsWith('-') && tokens[i] !== '-') {
+    if (tokens[i++] === '--') break; // option flags (-P/-L/--) before the target
+  }
+  if (i !== tokens.length - 1) return false; // bare cd goes to $HOME; extra targets are unsure
+  const target = stripQuotes(tokens[i]);
+  if (!target || target === '-' || target.startsWith('~')) return false;
+  if (target.includes('$') || target.includes('`')) return false;
+  return path.resolve(cwd, target) === path.resolve(cwd);
+}
+
 // `env -C <dir> <cmd> …`: the directory change and the read live in the SAME
 // statement (env execs its argument as a single command with that cwd), so
 // this is checked independently of the cross-statement `cwdChanged` flag.
@@ -215,7 +248,7 @@ function envDashCRelativeRead(stmt) {
 // with no path argument at all implicitly searches the (now-relative) cwd,
 // but adding that case risks false-positiving on legitimate stdin-reading
 // commands, so it is left to the prose directive.
-function detectSearchHygieneViolation(cmd) {
+function detectSearchHygieneViolation(cmd, { cwd } = {}) {
   const statements = splitStatements(cmd);
   let cwdChanged = false;
   for (let idx = 0; idx < statements.length; idx++) {
@@ -233,7 +266,7 @@ function detectSearchHygieneViolation(cmd) {
     // the sole statement) - a lone standalone `cd` is the known limitation
     // above and must never be blocked here.
     if (isCdOrPushdStatement(stmt) && idx < statements.length - 1) {
-      cwdChanged = true;
+      if (!cdTargetsSessionCwd(stmt, cwd)) cwdChanged = true;
     }
   }
   return null;
@@ -251,9 +284,9 @@ function blockVerdict(hit) {
 
 // Pure verdict for one command: {kind:'allow'} or {kind:'block', payload}. Never
 // exits or writes; any internal error falls through to allow.
-function evaluate(cmd) {
+function evaluate(cmd, { cwd } = {}) {
   try {
-    const hit = detectSearchHygieneViolation(cmd);
+    const hit = detectSearchHygieneViolation(cmd, { cwd });
     if (hit) return blockVerdict(hit);
   } catch {
     // fall through to allow: a guard must never wedge the workflow
@@ -263,12 +296,15 @@ function evaluate(cmd) {
 
 function run(data) {
   let cmd = '';
+  let cwd;
   try {
-    cmd = (JSON.parse(data).tool_input || {}).command || '';
+    const input = JSON.parse(data);
+    cmd = (input.tool_input || {}).command || '';
+    cwd = typeof input.cwd === 'string' && input.cwd ? input.cwd : undefined;
   } catch {
     process.exit(0); // unparseable input: nothing to gate
   }
-  const v = evaluate(cmd);
+  const v = evaluate(cmd, { cwd });
   if (v.kind === 'block') {
     process.stdout.write(JSON.stringify(v.payload));
     process.exit(2);

package/plugins/trailhead/hooks/trailhead-search-guard.test.js

@@ -12,8 +12,10 @@ let passed = 0;
 const ok = (name, cond) => { assert.ok(cond, name); passed++; };
 
 // Run the hook end-to-end: pipe tool_input JSON on stdin, capture {code, out}.
-function runHook(command) {
-  const input = JSON.stringify({ tool_input: { command } });
+function runHook(command, cwd) {
+  const payload = { tool_input: { command } };
+  if (cwd !== undefined) payload.cwd = cwd; // optional top-level session cwd
+  const input = JSON.stringify(payload);
   try {
     const out = execFileSync('node', [HOOK], { input });
     return { code: 0, out: out.toString() };
@@ -114,4 +116,66 @@ ok('cd + grep -- -x <relative file> is blocked (exit 2), `--` must not eat the f
 const f1 = runHook('cd app && rg -g "*.js" TODO src/foo.js');
 ok('cd + rg -g <glob> <pattern> <relative file> reports the real file, not the pattern (exit 2)', f1.code === 2 && /search-hygiene/.test(f1.out) && /src\/foo\.js/.test(f1.out) && !/`TODO`/.test(f1.out));
 
+
+// --- #238: redirections are not relative reads; a cd to the session cwd is static ---
+const blocked = (r) => r.code === 2 && /search-hygiene/.test(r.out);
+const allowed = (r) => r.code === 0 && r.out.trim() === '';
+
+for (const [name, cmd] of [
+  ['heredoc-fed cat > abs', 'cd /x && cat > /abs/file <<EOF\nhi\nEOF'],
+  ['append redirect target', 'cd /x && cat /abs/a >> out.txt'],
+  ['output redirect target', 'cd /x && cat /abs/a > out.txt'],
+  ['glued 2>/dev/null', 'cd /x && tail -5 /abs/log 2>/dev/null'],
+  ['separate 2> target', 'cd /x && tail -5 /abs/log 2> err.log'],
+  ['&> target', 'cd /x && cat /abs/a &> out.txt'],
+  ['2>&1 duplication', 'cd /x && cat /abs/a 2>&1'],
+  ['absolute input redirect', 'cd /x && wc -l < /abs/a'],
+  ['grep with 2>/dev/null', 'cd /x && grep -n foo /abs/a 2>/dev/null'],
+  ['herestring', 'cd /x && cat <<<hello'],
+]) ok(`#238 allow: ${name}`, allowed(runHook(cmd)));
+
+for (const [name, cmd, file] of [
+  ['input redirect from relative file', 'cd app && cat < rel.txt', 'rel.txt'],
+  ['relative read before output redirect', 'cd app && cat rel.txt > /abs/out', 'rel.txt'],
+  ['relative read before 2>/dev/null', 'cd app && tail -5 rel.log 2>/dev/null', 'rel.log'],
+  ['relative read before 2>&1', 'cd app && grep -n x rel.txt 2>&1', 'rel.txt'],
+]) {
+  const r = runHook(cmd);
+  ok(`#238 block: ${name}`, blocked(r) && r.out.includes('`' + file + '`'));
+}
+
+const CWD = '/home/u/p';
+for (const [name, cmd] of [
+  ['cd to session cwd', 'cd /home/u/p && cat rel.txt'],
+  ['cd to session cwd with trailing slash', 'cd /home/u/p/ && grep -n x rel.txt'],
+  ['cd .', 'cd . && cat rel.txt'],
+]) ok(`#238 allow with cwd: ${name}`, allowed(runHook(cmd, CWD)));
+
+for (const [name, cmd] of [
+  ['cd elsewhere', 'cd /home/u/other && cat rel.txt'],
+  ['cd relative subdir', 'cd sub && cat rel.txt'],
+  ['cd $HOME', 'cd $HOME && cat rel.txt'],
+  ['cd ~', 'cd ~ && cat rel.txt'],
+  ['cd -', 'cd - && cat rel.txt'],
+]) ok(`#238 block with cwd: ${name}`, blocked(runHook(cmd, CWD)));
+ok('#238 block: cd to would-be cwd without payload cwd', blocked(runHook('cd /home/u/p && cat rel.txt')));
+
+// pure unit checks on the exported detector
+const { detectSearchHygieneViolation } = require('./trailhead-search-guard.js');
+ok('#238 unit: cd <cwd> is static when cwd is known',
+  detectSearchHygieneViolation('cd "/home/u/p" && cat rel.txt', { cwd: CWD }) === null);
+ok('#238 unit: cd <cwd> still violates when cwd unknown',
+  detectSearchHygieneViolation('cd /home/u/p && cat rel.txt').file === 'rel.txt');
+ok('#238 unit: relative cd after a real cd stays armed',
+  detectSearchHygieneViolation('cd sub && cd . && cat rel.txt', { cwd: CWD }).file === 'rel.txt');
+// once armed by a real cd, nothing disarms: a cd to the session cwd only avoids arming
+for (const cmd of [
+  'cd sub || cd /home/u/p && cat rel.txt',
+  'cd sub && (cd /home/u/p) && cat rel.txt',
+  'cd sub && cd /home/u/p && cat rel.txt',
+]) ok(`#238 unit: stays armed: ${cmd}`, detectSearchHygieneViolation(cmd, { cwd: CWD }).file === 'rel.txt');
+ok('#238 unit: cd with an extra target is not a no-op',
+  detectSearchHygieneViolation('cd /home/u/p /other && cat rel.txt', { cwd: CWD }).file === 'rel.txt');
+ok('#238 allow: separate-token >& target', allowed(runHook('cd app && cat /abs/a >& out.txt')));
+
 console.log(`✓ search-guard: ${passed} assertions passed`);

package/plugins/trailhead/hooks/trailhead-secret-read-guard.js

@@ -86,6 +86,20 @@
 // a link prepared under a non-secret name onto `.env`
 // (`ln -s .env.example l && mv l .env`).
 //
+// #273: a command carried in a git config value (`git -c alias.x="!cat .env" x`,
+// `-c core.pager=...`, `--config-env=core.pager=VAR` with VAR assigned in the same
+// statement) is scanned as a nested command, like `bash -c`; `--config-env` on a
+// command key whose variable is not assigned there denies as unmodelled.
+//
+// The same scan covers the statement's own leading env assignments that inject config or
+// commands: GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n> pairs (read whatever GIT_CONFIG_COUNT
+// says), GIT_CONFIG_PARAMETERS (an unparsable one on a command key denies as unmodelled), and
+// the command-valued variables GIT_PAGER, PAGER, GIT_SSH_COMMAND, GIT_SSH, GIT_EXTERNAL_DIFF,
+// GIT_EDITOR, GIT_SEQUENCE_EDITOR, EDITOR, VISUAL, GIT_ASKPASS, SSH_ASKPASS. Only for a git
+// statement; variables exported in an earlier statement are not visible. Backslash escapes in a
+// quoted value follow the shell (shellUnquote). Global options git does not list before -c are
+// walked as flags (walkGitGlobals), never a reason to stop scanning.
+//
 // #227: a construct the guard cannot interpret with certainty (eval, source / `.`, a
 // bash 5.3 `${ cmd; }`, printf -v, a function definition, an alias, a quoted gh api body
 // key, a backslash-newline inside a word) is not emulated. As a FINAL gate, after the
@@ -142,10 +156,17 @@ function isSecretBasename(name) {
   return !NON_SECRET_ENV_SUFFIXES.has(lower.slice(lower.lastIndexOf('.') + 1));
 }
 
+// #276: il token grezzo tiene `\`+char verbatim. Con un backslash la parola si legge come
+// la shell (`\.env` è `.env`); senza, resta il solo strip della coppia di apici esterna
+// (le forme con apici nel mezzo, `.e""nv`, restano al gate dei costrutti non modellati).
+function unquoteWord(t) {
+  return String(t).includes('\\') ? shellUnquote(t) : stripQuotes(t);
+}
+
 // Anche la forma `<rev>:<path>` (`git show HEAD:.env`, `scp host:.env .`):
 // il path dopo il primo `:` è letto quanto un operando nudo.
 function isSecretPathArg(t) {
-  const bare = stripQuotes(t);
+  const bare = unquoteWord(t);
   if (!bare) return false;
   if (isSecretBasename(basename(bare))) return true;
   const colon = bare.indexOf(':');
@@ -201,14 +222,18 @@ const GIT_PATHSPEC_SUBCOMMANDS = new Map([
 
 // Opzioni globali di git (usage line, git 2.49), per trovare il sottocomando.
 // Un'opzione con valore consuma la parola successiva salvo forma
-// `--opt=value`; un'opzione in nessuno dei due set fa fail closed, così un
-// valore non è mai letto come sottocomando (`git -C ls-files show HEAD:.env`
-// esegue `show`).
-const GIT_GLOBAL_VALUE_OPTIONS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env']);
+// `--opt=value`. Un'opzione in nessuno dei due set NON ferma la camminata
+// (vedi walkGitGlobals): per il sottocomando esenta nulla (fail closed, un
+// valore non è mai letto come sottocomando: `git -C ls-files show HEAD:.env`
+// esegue `show`), per gli `-c` successivi li lascia comunque controllati.
+const GIT_GLOBAL_VALUE_OPTIONS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env', '--attr-source', '--super-prefix']);
 const GIT_GLOBAL_FLAGS = new Set([
   '-p', '--paginate', '-P', '--no-pager', '--no-replace-objects', '--no-lazy-fetch',
-  '--no-optional-locks', '--no-advice', '--bare',
+  '--no-optional-locks', '--no-advice', '--bare', '--literal-pathspecs', '--glob-pathspecs',
+  '--noglob-pathspecs', '--icase-pathspecs', '--exec-path', '--html-path', '--man-path', '--info-path',
 ]);
+// Flag che accetta anche la forma `--opt=value` ma mai un valore separato.
+const GIT_GLOBAL_EQ_FLAGS = new Set(['--exec-path', '--list-cmds']);
 
 // `cp`/`mv` scrivono la destinazione e non la stampano: un nome segreto che è
 // SOLO la destinazione di una copia/spostamento a sorgente singola è un nome
@@ -318,19 +343,52 @@ function isListedFlag(text, flags) {
   return /^-[A-Za-z]+$/.test(text) && [...text.slice(1)].every((ch) => flags.has(`-${ch}`));
 }
 
-// Indice del sottocomando git oltre le opzioni globali, o -1 se lo precede
-// un'opzione fuori da GIT_GLOBAL_VALUE_OPTIONS / GIT_GLOBAL_FLAGS.
-function gitSubcommandIndex(operands) {
+// UNICA camminata sulle opzioni globali di git, condivisa da gitSubcommandIndex
+// e da extractGitConfigCommands così le due non divergono. Restituisce
+// { sub, known, configs }: `sub` = indice del primo operando non-opzione (-1 se
+// assente), `known` = false se la camminata ha incontrato un'opzione fuori dai
+// set (allora nessuna esenzione per il sottocomando), `configs` = i valori
+// `-c` / `-ckey=value` / `--config-env` visti prima del sottocomando.
+// Un'opzione sconosciuta non interrompe la camminata: si tratta come flag fino al
+// primo operando non-opzione (fail toward scanning).
+function walkGitGlobals(operands) {
+  const out = { sub: -1, known: true, configs: [] };
   for (let k = 0; k < operands.length; k++) {
     const t = operands[k];
-    if (!t.startsWith('-')) return k;
-    if (GIT_GLOBAL_VALUE_OPTIONS.has(t)) { k++; continue; }
-    if (GIT_GLOBAL_FLAGS.has(t)) continue;
-    const eq = t.indexOf('=');
-    const isLongValueForm = t.startsWith('--') && eq !== -1 && GIT_GLOBAL_VALUE_OPTIONS.has(t.slice(0, eq));
-    if (!isLongValueForm) return -1;
+    if (!t.startsWith('-') || t === '-') { out.sub = k; return out; }
+    if (t === '-c' || t === '--config-env') {
+      if (k + 1 >= operands.length) { out.known = false; return out; }
+      out.configs.push({ kind: t === '-c' ? 'c' : 'env', value: operands[++k], sample: `${t} ${operands[k]}` });
+    } else if (t.startsWith('--config-env=')) {
+      out.configs.push({ kind: 'env', value: t.slice('--config-env='.length), sample: t });
+    } else if (isGluedGitConfig(t)) {
+      out.configs.push({ kind: 'c', value: t.slice(2), sample: t }); // #273: `-ckey=value`
+    } else if (GIT_GLOBAL_VALUE_OPTIONS.has(t)) {
+      if (k + 1 >= operands.length) { out.known = false; return out; }
+      k++; // `-C <path>` and friends: the value is not a config
+    } else if (GIT_GLOBAL_FLAGS.has(t)) {
+      // known flag
+    } else {
+      const eq = t.indexOf('=');
+      const name = eq === -1 ? t : t.slice(0, eq);
+      const longForm = t.startsWith('--') && eq !== -1 && (GIT_GLOBAL_VALUE_OPTIONS.has(name) || GIT_GLOBAL_EQ_FLAGS.has(name));
+      if (!longForm) out.known = false; // unknown option: treated as a flag, no exemption
+    }
   }
-  return -1;
+  return out;
+}
+
+// Indice del sottocomando git oltre le opzioni globali, o -1 se lo precede
+// un'opzione sconosciuta o manca.
+function gitSubcommandIndex(operands) {
+  const w = walkGitGlobals(operands);
+  return w.known ? w.sub : -1;
+}
+
+// #275: come gitSubcommandIndex ma anche dopo un'opzione globale sconosciuta
+// (fail toward scanning: l'esenzione no, la scansione sì).
+function gitSubcommandIndexLoose(operands) {
+  return walkGitGlobals(operands).sub;
 }
 
 // Indici dei pathspec di un sottocomando in GIT_PATHSPEC_SUBCOMMANDS. git
@@ -374,7 +432,7 @@ function copyDestinationIndices(operands) {
 // controllo; ogni altro token resta controllato, quindi l'esenzione non può
 // riciclare una lettura altrove nello statement.
 function nameOnlyTokenIndices(bin, tokens) {
-  const operands = tokens.slice(1).map((t) => stripQuotes(stripTrailingPunct(t)));
+  const operands = tokens.slice(1).map((t) => unquoteWord(stripTrailingPunct(t)));
   let indices = NO_SKIP;
   if (bin === 'git') indices = gitPathspecIndices(operands);
   else if (bin === 'cp' || bin === 'mv') indices = copyDestinationIndices(operands);
@@ -386,22 +444,225 @@ function nameOnlyTokenIndices(bin, tokens) {
 // yet re-tokenized) so the caller can recurse into it as a nested command.
 // Best-effort: only the common single-quoted-argument idiom, not every way a
 // shell can be told to execute a string.
+// #276: ogni token si legge come la shell esterna (`\\` dentro apici doppi diventa `\`)
+// prima del join, così la shell interna vede lo stesso testo.
 function extractNestedCommand(stmtTokens) {
   if (!stmtTokens.length) return null;
   const bin = basename(stmtTokens[0]);
   if (bin === 'eval') {
     const rest = stmtTokens.slice(1);
     if (!rest.length) return null;
-    return stripQuotes(rest.join(' '));
+    return rest.map(unquoteWord).join(' ');
   }
   if (SHELL_DASH_C_VERBS.has(bin)) {
     const cIdx = stmtTokens.indexOf('-c');
     if (cIdx === -1 || cIdx + 1 >= stmtTokens.length) return null;
-    return stripQuotes(stmtTokens.slice(cIdx + 1).join(' '));
+    return stmtTokens.slice(cIdx + 1).map(unquoteWord).join(' ');
   }
   return null;
 }
 
+// #273: `git -c key=value` / `--config-env=key=ENV` can name a COMMAND git runs
+// (an alias with `!`, a pager, an editor, an ssh command, ...), which the plain
+// token walk only tests as a file name. The key families git runs as a command,
+// matched on the lowercased key (section and variable are case-insensitive; a
+// lowercased middle segment only widens a wildcard). `bang` = the value is a
+// command only when it starts with `!` (the `!` is not part of the command).
+const GIT_COMMAND_KEYS = [
+  { re: /^alias\..+$/, bang: true },
+  { re: /^core\.(pager|editor|sshcommand|fsmonitor)$/ },
+  { re: /^pager\..+$/ },
+  { re: /^sequence\.editor$/ },
+  { re: /^diff\.external$/ },
+  { re: /^diff\..+\.textconv$/ },
+  { re: /^filter\..+\.(clean|smudge|process)$/ },
+  { re: /^credential\.(.+\.)?helper$/, bang: true },
+  { re: /^gpg\.(.+\.)?program$/ },
+  // #275: more keys git runs as a command.
+  { re: /^core\.(askpass|gitproxy)$/ },
+  { re: /^(mergetool|difftool|browser|man)\..+\.cmd$/ },
+  { re: /^merge\..+\.driver$/ },
+  { re: /^uploadpack\.packobjectshook$/ },
+  { re: /^diff\..+\.command$/ },
+];
+
+// `-ckey=value` (value glued on, no space).
+function isGluedGitConfig(t) {
+  return t.length > 2 && t.startsWith('-c') && !t.startsWith('--');
+}
+
+// The word as the shell hands it over: quote pairs removed, their content kept
+// (`alias.x="!cat .env"` -> `alias.x=!cat .env`). Backslashes follow the shell:
+// outside quotes one escapes the next char (backslash-newline vanishes), inside
+// double quotes only before `"`, `\`, `$`, a backtick or a newline, and inside
+// single quotes nothing is special. No expansions: best-effort like the rest.
+function shellUnquote(word) {
+  const chars = [...String(word)];
+  let out = '';
+  let q = null;
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i];
+    if (q === "'") { if (ch === "'") q = null; else out += ch; continue; }
+    if (ch === '\\' && i + 1 < chars.length) {
+      const nx = chars[i + 1];
+      if (q === null || '"\\$`\n'.includes(nx)) {
+        i++;
+        if (nx !== '\n') out += nx;
+        continue;
+      }
+    }
+    if (q === '"') { if (ch === '"') q = null; else out += ch; }
+    else if (ch === '"' || ch === "'") q = ch;
+    else out += ch;
+  }
+  return out;
+}
+
+// The command text a git config value carries for `key`, or null when the key
+// is not command-valued (or `!`-less where the `!` is required).
+function isGitCommandKey(key) {
+  return GIT_COMMAND_KEYS.some((k) => k.re.test(key.toLowerCase()));
+}
+
+function gitConfigCommand(key, value) {
+  const spec = GIT_COMMAND_KEYS.find((k) => k.re.test(key.toLowerCase()));
+  if (!spec) return null;
+  if (spec.bang) return value.startsWith('!') && value.length > 1 ? value.slice(1) : null;
+  return value ? value : null;
+}
+
+// #273: environment variables whose value git (or ssh under it) runs as a command.
+const GIT_COMMAND_ENV_VARS = [
+  'GIT_PAGER', 'PAGER', 'GIT_SSH_COMMAND', 'GIT_SSH', 'GIT_EXTERNAL_DIFF', 'GIT_EDITOR',
+  'GIT_SEQUENCE_EDITOR', 'EDITOR', 'VISUAL', 'GIT_ASKPASS', 'SSH_ASKPASS',
+];
+
+// Entries of a GIT_CONFIG_PARAMETERS value (space-separated `'key=value'` or
+// `'key'='value'`) as [key, value] pairs, or null when the quoting is unbalanced.
+function parseGitConfigParameters(text) {
+  const entries = [];
+  for (const word of tokenize(text)) {
+    const kv = splitAssignment(shellUnquote(word));
+    if (kv) entries.push(kv);
+  }
+  const quotes = (text.match(/'/g) || []).length;
+  return quotes % 2 === 0 ? entries : null;
+}
+
+// Splits `NAME=value` at the first `=` (null when there is none or the name is empty).
+function splitAssignment(kv) {
+  const eq = kv.indexOf('=');
+  return eq <= 0 ? null : [kv.slice(0, eq), kv.slice(eq + 1)];
+}
+
+// #275: `git config` options that take a separate value, and the ones that only read.
+const GIT_CONFIG_VALUE_OPTIONS = new Set(['-f', '--file', '--blob', '-t', '--type', '--default', '--comment', '--value']);
+const GIT_CONFIG_FLAGS = new Set([
+  '--global', '--system', '--local', '--worktree', '--add', '--replace-all', '--append', '--all',
+  '--bool', '--int', '--bool-or-int', '--path', '--expiry-date', '--includes', '--no-includes',
+  '--null', '-z', '--fixed-value', '--show-origin', '--show-scope', '--name-only', '--no-type',
+]);
+const GIT_CONFIG_READ_OPTIONS = new Set([
+  '--get', '--get-all', '--get-regexp', '--get-urlmatch', '--get-color', '--get-colorbool', '-l',
+  '--list', '--unset', '--unset-all', '-e', '--edit', '--rename-section', '--remove-section',
+]);
+const GIT_CONFIG_READ_WORDS = new Set([
+  'get', 'list', 'unset', 'edit', 'rename-section', 'remove-section',
+]);
+
+// #275: the [key, value] pairs a `git config` invocation writes. `args` = the words after
+// `config`. The first positional is the key and the second the value (a leading `set`
+// is the mode word); read verbs write nothing. An option the walk does not know could
+// hide which word is the value, so each positional after a command-valued key is also
+// taken as its value (fail toward scanning). A single `key=value` token is not a write.
+function gitConfigWritePairs(args) {
+  const positional = [];
+  let unknown = false;
+  for (let k = 0; k < args.length; k++) {
+    const t = args[k];
+    // #275: `--` ends the options, every later word is a positional (`-n; cat .env` too).
+    if (t === '--') { positional.push(...args.slice(k + 1)); break; }
+    if (GIT_CONFIG_READ_OPTIONS.has(t)) return [];
+    if (!t.startsWith('-') || t === '-') {
+      if (positional.length === 0 && GIT_CONFIG_READ_WORDS.has(t)) return [];
+      if (positional.length === 0 && t === 'set') continue;
+      positional.push(t);
+    } else if (GIT_CONFIG_VALUE_OPTIONS.has(t)) k++;
+    else if (!GIT_CONFIG_FLAGS.has(t) && !/^--(file|blob|type|default|comment|value)=/.test(t)) unknown = true;
+  }
+  const pairs = positional.length >= 2 ? [[positional[0], positional[1]]] : [];
+  if (unknown) {
+    positional.forEach((key, i) => {
+      if (i + 1 < positional.length && isGitCommandKey(key)) pairs.push([key, positional[i + 1]]);
+    });
+  }
+  return pairs;
+}
+
+// Every command text carried in the git global options of a statement, from
+// `-c key=value`, `-ckey=value` and `--config-env[=| ]key=ENV`, plus the
+// `--config-env` forms on a command-valued key whose ENV the statement does not
+// assign (`unresolved`: the guard cannot see the value, so it fails closed).
+// ENV is resolved from the statement's own leading NAME=value assignments.
+function extractGitConfigCommands(tokens) {
+  const found = { commands: [], unresolved: [], unparsed: [] };
+  const first = skipEnvPrefix(tokens);
+  if (first >= tokens.length || basename(shellUnquote(tokens[first])) !== 'git') return found;
+  const env = new Map();
+  for (const a of tokens.slice(0, first)) {
+    const kv = splitAssignment(shellUnquote(a));
+    if (kv) env.set(kv[0], kv[1]);
+  }
+  const add = (key, value) => {
+    const cmd = gitConfigCommand(key, value);
+    if (cmd) found.commands.push(cmd);
+  };
+  // #273: config injected through the statement's own leading assignments. Pairs
+  // are read regardless of GIT_CONFIG_COUNT (fail toward scanning).
+  for (const [name, value] of env) {
+    const m = /^GIT_CONFIG_KEY_(\d+)$/.exec(name);
+    if (m && env.has(`GIT_CONFIG_VALUE_${m[1]}`)) add(value, env.get(`GIT_CONFIG_VALUE_${m[1]}`));
+    if (GIT_COMMAND_ENV_VARS.includes(name) && value) found.commands.push(value);
+  }
+  if (env.has('GIT_CONFIG_PARAMETERS')) {
+    const text = env.get('GIT_CONFIG_PARAMETERS');
+    const entries = parseGitConfigParameters(text);
+    if (entries) entries.forEach(([k, v]) => add(k, v));
+    else if ((text.match(/[A-Za-z0-9._-]+(?==)/g) || []).some(isGitCommandKey)) found.unparsed.push(`GIT_CONFIG_PARAMETERS=${text}`);
+  }
+  const operands = tokens.slice(first + 1).map(shellUnquote);
+  for (const cfg of walkGitGlobals(operands).configs) {
+    const kv = splitAssignment(cfg.value);
+    if (!kv) continue;
+    if (cfg.kind === 'c') { add(kv[0], kv[1]); continue; }
+    if (!isGitCommandKey(kv[0])) continue;
+    if (env.has(kv[1])) add(kv[0], env.get(kv[1])); else found.unresolved.push(cfg.sample);
+  }
+  // #275: `git config <key> <value>` writes a command into the config.
+  const sub = gitSubcommandIndexLoose(operands);
+  if (sub !== -1 && operands[sub] === 'config') {
+    gitConfigWritePairs(operands.slice(sub + 1)).forEach(([k, v]) => add(k, v));
+  }
+  return found;
+}
+
+// The unmodelled-hit shape (lib/unmodelled.js) for a `--config-env` on a command key whose
+// variable the statement does not assign.
+const GIT_CONFIG_ENV_UNMODELLED = (sample) => ({
+  id: 'git-config-env',
+  label: 'a git --config-env on a command-valued key whose variable is not assigned in the same statement',
+  hint: 'assign it in the same statement (`VAR="cmd" git --config-env=key=VAR ...`) or pass the command with `git -c key=cmd`',
+  sample,
+});
+
+// The unmodelled-hit shape for a GIT_CONFIG_PARAMETERS value the guard cannot parse.
+const GIT_CONFIG_PARAMETERS_UNMODELLED = (sample) => ({
+  id: 'git-config-parameters',
+  label: 'a GIT_CONFIG_PARAMETERS value with unbalanced quoting that names a command-valued key',
+  hint: 'pass the command with `git -c key=cmd` or a well-quoted GIT_CONFIG_PARAMETERS',
+  sample,
+});
+
 // Scan a single top-level statement for a secret path. Recurses into a
 // bash -c/eval quoted sub-command first (finding #1), routes grep/rg/ag/sed/
 // awk through the shared pattern-skipping walk (finding #4), and falls back
@@ -419,6 +680,19 @@ function scanStatementForSecretPath(stmt) {
     // stray `-f .env` on the wrapper itself) for defence in depth.
   }
 
+  // #273: a command carried in a git config value (`-c core.pager="cat .env"`).
+  const git = extractGitConfigCommands(tokens);
+  for (const text of git.commands) {
+    const hit = scanBashForSecretPath(text);
+    if (hit) return hit;
+  }
+  if (git.unresolved.length) {
+    return { path: git.unresolved[0], unmodelled: GIT_CONFIG_ENV_UNMODELLED(git.unresolved[0]) };
+  }
+  if (git.unparsed.length) {
+    return { path: git.unparsed[0], unmodelled: GIT_CONFIG_PARAMETERS_UNMODELLED(git.unparsed[0]) };
+  }
+
   const bin = basename(tokens[0]);
   if (SEARCH_VERBS.has(bin)) {
     return scanArgsSkippingPattern(tokens.slice(1), SEARCH_VERB_CONFIG[bin], isSecretPathArg);
@@ -462,13 +736,13 @@ function invokesInterpreter(stmt) {
   let i = 0;
   while (i < tokens.length && LEADING_KEYWORDS.has(tokens[i])) i++;
   i += skipEnvPrefix(tokens.slice(i));
-  if (i < tokens.length && basename(stripQuotes(tokens[i])) === 'env') {
+  if (i < tokens.length && basename(unquoteWord(tokens[i])) === 'env') {
     i++;
     while (i < tokens.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i]) || tokens[i].startsWith('-'))) {
       i += ENV_VALUE_OPTIONS.has(tokens[i]) ? 2 : 1;
     }
   }
-  return i < tokens.length && STDIN_SCRIPT_INTERPRETERS.has(basename(stripQuotes(tokens[i])));
+  return i < tokens.length && STDIN_SCRIPT_INTERPRETERS.has(basename(unquoteWord(tokens[i])));
 }
 
 // Walk the command's top-level statements (quote-aware; `|`, `;`, `&&`,
@@ -570,7 +844,7 @@ function detectSecretRead(toolName, toolInput) {
   if (toolName === 'Bash') {
     const cmd = input.command || '';
     const hit = scanBashForSecretPath(cmd);
-    if (hit) return { path: hit };
+    if (hit) return typeof hit === 'object' ? hit : { path: hit }; // object: an unmodelled hit (#273)
     const um = unmodelledSecretPiece(cmd); // a final gate: the precise scan keeps priority
     return um ? { path: um.piece, unmodelled: um.hit } : null;
   }