@marcomigozzi/trailhead 0.15.0 → 0.16.1

package/plugins/trailhead/hooks/trailhead-secret-read-guard.js

@@ -86,6 +86,20 @@
 // a link prepared under a non-secret name onto `.env`
 // (`ln -s .env.example l && mv l .env`).
 //
+// #273: a command carried in a git config value (`git -c alias.x="!cat .env" x`,
+// `-c core.pager=...`, `--config-env=core.pager=VAR` with VAR assigned in the same
+// statement) is scanned as a nested command, like `bash -c`; `--config-env` on a
+// command key whose variable is not assigned there denies as unmodelled.
+//
+// The same scan covers the statement's own leading env assignments that inject config or
+// commands: GIT_CONFIG_KEY_<n> / GIT_CONFIG_VALUE_<n> pairs (read whatever GIT_CONFIG_COUNT
+// says), GIT_CONFIG_PARAMETERS (an unparsable one on a command key denies as unmodelled), and
+// the command-valued variables GIT_PAGER, PAGER, GIT_SSH_COMMAND, GIT_SSH, GIT_EXTERNAL_DIFF,
+// GIT_EDITOR, GIT_SEQUENCE_EDITOR, EDITOR, VISUAL, GIT_ASKPASS, SSH_ASKPASS. Only for a git
+// statement; variables exported in an earlier statement are not visible. Backslash escapes in a
+// quoted value follow the shell (shellUnquote). Global options git does not list before -c are
+// walked as flags (walkGitGlobals), never a reason to stop scanning.
+//
 // #227: a construct the guard cannot interpret with certainty (eval, source / `.`, a
 // bash 5.3 `${ cmd; }`, printf -v, a function definition, an alias, a quoted gh api body
 // key, a backslash-newline inside a word) is not emulated. As a FINAL gate, after the
@@ -142,10 +156,17 @@ function isSecretBasename(name) {
   return !NON_SECRET_ENV_SUFFIXES.has(lower.slice(lower.lastIndexOf('.') + 1));
 }
 
+// #276: il token grezzo tiene `\`+char verbatim. Con un backslash la parola si legge come
+// la shell (`\.env` è `.env`); senza, resta il solo strip della coppia di apici esterna
+// (le forme con apici nel mezzo, `.e""nv`, restano al gate dei costrutti non modellati).
+function unquoteWord(t) {
+  return String(t).includes('\\') ? shellUnquote(t) : stripQuotes(t);
+}
+
 // Anche la forma `<rev>:<path>` (`git show HEAD:.env`, `scp host:.env .`):
 // il path dopo il primo `:` è letto quanto un operando nudo.
 function isSecretPathArg(t) {
-  const bare = stripQuotes(t);
+  const bare = unquoteWord(t);
   if (!bare) return false;
   if (isSecretBasename(basename(bare))) return true;
   const colon = bare.indexOf(':');
@@ -201,14 +222,18 @@ const GIT_PATHSPEC_SUBCOMMANDS = new Map([
 
 // Opzioni globali di git (usage line, git 2.49), per trovare il sottocomando.
 // Un'opzione con valore consuma la parola successiva salvo forma
-// `--opt=value`; un'opzione in nessuno dei due set fa fail closed, così un
-// valore non è mai letto come sottocomando (`git -C ls-files show HEAD:.env`
-// esegue `show`).
-const GIT_GLOBAL_VALUE_OPTIONS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env']);
+// `--opt=value`. Un'opzione in nessuno dei due set NON ferma la camminata
+// (vedi walkGitGlobals): per il sottocomando esenta nulla (fail closed, un
+// valore non è mai letto come sottocomando: `git -C ls-files show HEAD:.env`
+// esegue `show`), per gli `-c` successivi li lascia comunque controllati.
+const GIT_GLOBAL_VALUE_OPTIONS = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env', '--attr-source', '--super-prefix']);
 const GIT_GLOBAL_FLAGS = new Set([
   '-p', '--paginate', '-P', '--no-pager', '--no-replace-objects', '--no-lazy-fetch',
-  '--no-optional-locks', '--no-advice', '--bare',
+  '--no-optional-locks', '--no-advice', '--bare', '--literal-pathspecs', '--glob-pathspecs',
+  '--noglob-pathspecs', '--icase-pathspecs', '--exec-path', '--html-path', '--man-path', '--info-path',
 ]);
+// Flag che accetta anche la forma `--opt=value` ma mai un valore separato.
+const GIT_GLOBAL_EQ_FLAGS = new Set(['--exec-path', '--list-cmds']);
 
 // `cp`/`mv` scrivono la destinazione e non la stampano: un nome segreto che è
 // SOLO la destinazione di una copia/spostamento a sorgente singola è un nome
@@ -318,19 +343,52 @@ function isListedFlag(text, flags) {
   return /^-[A-Za-z]+$/.test(text) && [...text.slice(1)].every((ch) => flags.has(`-${ch}`));
 }
 
-// Indice del sottocomando git oltre le opzioni globali, o -1 se lo precede
-// un'opzione fuori da GIT_GLOBAL_VALUE_OPTIONS / GIT_GLOBAL_FLAGS.
-function gitSubcommandIndex(operands) {
+// UNICA camminata sulle opzioni globali di git, condivisa da gitSubcommandIndex
+// e da extractGitConfigCommands così le due non divergono. Restituisce
+// { sub, known, configs }: `sub` = indice del primo operando non-opzione (-1 se
+// assente), `known` = false se la camminata ha incontrato un'opzione fuori dai
+// set (allora nessuna esenzione per il sottocomando), `configs` = i valori
+// `-c` / `-ckey=value` / `--config-env` visti prima del sottocomando.
+// Un'opzione sconosciuta non interrompe la camminata: si tratta come flag fino al
+// primo operando non-opzione (fail toward scanning).
+function walkGitGlobals(operands) {
+  const out = { sub: -1, known: true, configs: [] };
   for (let k = 0; k < operands.length; k++) {
     const t = operands[k];
-    if (!t.startsWith('-')) return k;
-    if (GIT_GLOBAL_VALUE_OPTIONS.has(t)) { k++; continue; }
-    if (GIT_GLOBAL_FLAGS.has(t)) continue;
-    const eq = t.indexOf('=');
-    const isLongValueForm = t.startsWith('--') && eq !== -1 && GIT_GLOBAL_VALUE_OPTIONS.has(t.slice(0, eq));
-    if (!isLongValueForm) return -1;
+    if (!t.startsWith('-') || t === '-') { out.sub = k; return out; }
+    if (t === '-c' || t === '--config-env') {
+      if (k + 1 >= operands.length) { out.known = false; return out; }
+      out.configs.push({ kind: t === '-c' ? 'c' : 'env', value: operands[++k], sample: `${t} ${operands[k]}` });
+    } else if (t.startsWith('--config-env=')) {
+      out.configs.push({ kind: 'env', value: t.slice('--config-env='.length), sample: t });
+    } else if (isGluedGitConfig(t)) {
+      out.configs.push({ kind: 'c', value: t.slice(2), sample: t }); // #273: `-ckey=value`
+    } else if (GIT_GLOBAL_VALUE_OPTIONS.has(t)) {
+      if (k + 1 >= operands.length) { out.known = false; return out; }
+      k++; // `-C <path>` and friends: the value is not a config
+    } else if (GIT_GLOBAL_FLAGS.has(t)) {
+      // known flag
+    } else {
+      const eq = t.indexOf('=');
+      const name = eq === -1 ? t : t.slice(0, eq);
+      const longForm = t.startsWith('--') && eq !== -1 && (GIT_GLOBAL_VALUE_OPTIONS.has(name) || GIT_GLOBAL_EQ_FLAGS.has(name));
+      if (!longForm) out.known = false; // unknown option: treated as a flag, no exemption
+    }
   }
-  return -1;
+  return out;
+}
+
+// Indice del sottocomando git oltre le opzioni globali, o -1 se lo precede
+// un'opzione sconosciuta o manca.
+function gitSubcommandIndex(operands) {
+  const w = walkGitGlobals(operands);
+  return w.known ? w.sub : -1;
+}
+
+// #275: come gitSubcommandIndex ma anche dopo un'opzione globale sconosciuta
+// (fail toward scanning: l'esenzione no, la scansione sì).
+function gitSubcommandIndexLoose(operands) {
+  return walkGitGlobals(operands).sub;
 }
 
 // Indici dei pathspec di un sottocomando in GIT_PATHSPEC_SUBCOMMANDS. git
@@ -374,7 +432,7 @@ function copyDestinationIndices(operands) {
 // controllo; ogni altro token resta controllato, quindi l'esenzione non può
 // riciclare una lettura altrove nello statement.
 function nameOnlyTokenIndices(bin, tokens) {
-  const operands = tokens.slice(1).map((t) => stripQuotes(stripTrailingPunct(t)));
+  const operands = tokens.slice(1).map((t) => unquoteWord(stripTrailingPunct(t)));
   let indices = NO_SKIP;
   if (bin === 'git') indices = gitPathspecIndices(operands);
   else if (bin === 'cp' || bin === 'mv') indices = copyDestinationIndices(operands);
@@ -386,22 +444,259 @@ function nameOnlyTokenIndices(bin, tokens) {
 // yet re-tokenized) so the caller can recurse into it as a nested command.
 // Best-effort: only the common single-quoted-argument idiom, not every way a
 // shell can be told to execute a string.
+// #276: ogni token si legge come la shell esterna (`\\` dentro apici doppi diventa `\`)
+// prima del join, così la shell interna vede lo stesso testo.
 function extractNestedCommand(stmtTokens) {
   if (!stmtTokens.length) return null;
   const bin = basename(stmtTokens[0]);
   if (bin === 'eval') {
     const rest = stmtTokens.slice(1);
     if (!rest.length) return null;
-    return stripQuotes(rest.join(' '));
+    return rest.map(unquoteWord).join(' ');
   }
   if (SHELL_DASH_C_VERBS.has(bin)) {
     const cIdx = stmtTokens.indexOf('-c');
     if (cIdx === -1 || cIdx + 1 >= stmtTokens.length) return null;
-    return stripQuotes(stmtTokens.slice(cIdx + 1).join(' '));
+    return stmtTokens.slice(cIdx + 1).map(unquoteWord).join(' ');
   }
   return null;
 }
 
+// #273: `git -c key=value` / `--config-env=key=ENV` can name a COMMAND git runs
+// (an alias with `!`, a pager, an editor, an ssh command, ...), which the plain
+// token walk only tests as a file name. The key families git runs as a command,
+// matched on the lowercased key (section and variable are case-insensitive; a
+// lowercased middle segment only widens a wildcard). `bang` = the value is a
+// command only when it starts with `!` (the `!` is not part of the command).
+const GIT_COMMAND_KEYS = [
+  { re: /^alias\..+$/, bang: true },
+  { re: /^core\.(pager|editor|sshcommand|fsmonitor)$/ },
+  { re: /^pager\..+$/ },
+  { re: /^sequence\.editor$/ },
+  { re: /^diff\.external$/ },
+  { re: /^diff\..+\.textconv$/ },
+  { re: /^filter\..+\.(clean|smudge|process)$/ },
+  { re: /^credential\.(.+\.)?helper$/, bang: true },
+  { re: /^gpg\.(.+\.)?program$/ },
+  // #275: more keys git runs as a command.
+  { re: /^core\.(askpass|gitproxy)$/ },
+  { re: /^(mergetool|difftool|browser|man)\..+\.cmd$/ },
+  { re: /^merge\..+\.driver$/ },
+  { re: /^uploadpack\.packobjectshook$/ },
+  { re: /^diff\..+\.command$/ },
+];
+
+// `-ckey=value` (value glued on, no space).
+function isGluedGitConfig(t) {
+  return t.length > 2 && t.startsWith('-c') && !t.startsWith('--');
+}
+
+// The word as the shell hands it over: quote pairs removed, their content kept
+// (`alias.x="!cat .env"` -> `alias.x=!cat .env`). Backslashes follow the shell:
+// outside quotes one escapes the next char (backslash-newline vanishes), inside
+// double quotes only before `"`, `\`, `$`, a backtick or a newline, and inside
+// single quotes nothing is special. No expansions: best-effort like the rest.
+function shellUnquote(word) {
+  const chars = [...String(word)];
+  let out = '';
+  let q = null;
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i];
+    if (q === "'") { if (ch === "'") q = null; else out += ch; continue; }
+    if (ch === '\\' && i + 1 < chars.length) {
+      const nx = chars[i + 1];
+      if (q === null || '"\\$`\n'.includes(nx)) {
+        i++;
+        if (nx !== '\n') out += nx;
+        continue;
+      }
+    }
+    if (q === '"') { if (ch === '"') q = null; else out += ch; }
+    else if (ch === '"' || ch === "'") q = ch;
+    else out += ch;
+  }
+  return out;
+}
+
+// The command text a git config value carries for `key`, or null when the key
+// is not command-valued (or `!`-less where the `!` is required).
+function isGitCommandKey(key) {
+  return GIT_COMMAND_KEYS.some((k) => k.re.test(key.toLowerCase()));
+}
+
+function gitConfigCommand(key, value) {
+  const spec = GIT_COMMAND_KEYS.find((k) => k.re.test(key.toLowerCase()));
+  if (!spec) return null;
+  if (spec.bang) return value.startsWith('!') && value.length > 1 ? value.slice(1) : null;
+  return value ? value : null;
+}
+
+// #273: environment variables whose value git (or ssh under it) runs as a command.
+const GIT_COMMAND_ENV_VARS = [
+  'GIT_PAGER', 'PAGER', 'GIT_SSH_COMMAND', 'GIT_SSH', 'GIT_EXTERNAL_DIFF', 'GIT_EDITOR',
+  'GIT_SEQUENCE_EDITOR', 'EDITOR', 'VISUAL', 'GIT_ASKPASS', 'SSH_ASKPASS',
+];
+
+// Entries of a GIT_CONFIG_PARAMETERS value (space-separated `'key=value'` or
+// `'key'='value'`) as [key, value] pairs, or null when the quoting is unbalanced.
+function parseGitConfigParameters(text) {
+  const entries = [];
+  for (const word of tokenize(text)) {
+    const kv = splitAssignment(shellUnquote(word));
+    if (kv) entries.push(kv);
+  }
+  const quotes = (text.match(/'/g) || []).length;
+  return quotes % 2 === 0 ? entries : null;
+}
+
+// Splits `NAME=value` at the first `=` (null when there is none or the name is empty).
+function splitAssignment(kv) {
+  const eq = kv.indexOf('=');
+  return eq <= 0 ? null : [kv.slice(0, eq), kv.slice(eq + 1)];
+}
+
+// #275: `git config` options that take a separate value, and the ones that only read.
+const GIT_CONFIG_VALUE_OPTIONS = new Set(['-f', '--file', '--blob', '-t', '--type', '--default', '--comment', '--value']);
+const GIT_CONFIG_FLAGS = new Set([
+  '--global', '--system', '--local', '--worktree', '--add', '--replace-all', '--append', '--all',
+  '--bool', '--int', '--bool-or-int', '--path', '--expiry-date', '--includes', '--no-includes',
+  '--null', '-z', '--fixed-value', '--show-origin', '--show-scope', '--name-only', '--no-type',
+]);
+const GIT_CONFIG_READ_OPTIONS = new Set([
+  '--get', '--get-all', '--get-regexp', '--get-urlmatch', '--get-color', '--get-colorbool', '-l',
+  '--list', '--unset', '--unset-all', '-e', '--edit', '--rename-section', '--remove-section',
+]);
+const GIT_CONFIG_READ_WORDS = new Set([
+  'get', 'list', 'unset', 'edit', 'rename-section', 'remove-section',
+]);
+
+// #275: the [key, value] pairs a `git config` invocation writes. `args` = the words after
+// `config`. The first positional is the key and the second the value (a leading `set`
+// is the mode word); read verbs write nothing. An option the walk does not know could
+// hide which word is the value, so each positional after a command-valued key is also
+// taken as its value (fail toward scanning). A single `key=value` token is not a write.
+function gitConfigWritePairs(args) {
+  const positional = [];
+  let unknown = false;
+  for (let k = 0; k < args.length; k++) {
+    const t = args[k];
+    // #275: `--` ends the options, every later word is a positional (`-n; cat .env` too).
+    if (t === '--') { positional.push(...args.slice(k + 1)); break; }
+    if (GIT_CONFIG_READ_OPTIONS.has(t)) return [];
+    if (!t.startsWith('-') || t === '-') {
+      if (positional.length === 0 && GIT_CONFIG_READ_WORDS.has(t)) return [];
+      if (positional.length === 0 && t === 'set') continue;
+      positional.push(t);
+    } else if (GIT_CONFIG_VALUE_OPTIONS.has(t)) k++;
+    else if (!GIT_CONFIG_FLAGS.has(t) && !/^--(file|blob|type|default|comment|value)=/.test(t)) unknown = true;
+  }
+  const pairs = positional.length >= 2 ? [[positional[0], positional[1]]] : [];
+  if (unknown) {
+    positional.forEach((key, i) => {
+      if (i + 1 < positional.length && isGitCommandKey(key)) pairs.push([key, positional[i + 1]]);
+    });
+  }
+  return pairs;
+}
+
+// Every command text carried in the git global options of a statement, from
+// `-c key=value`, `-ckey=value` and `--config-env[=| ]key=ENV`, plus the
+// `--config-env` forms on a command-valued key whose ENV the statement does not
+// assign (`unresolved`: the guard cannot see the value, so it fails closed).
+// ENV is resolved from the statement's own leading NAME=value assignments.
+function extractGitConfigCommands(tokens) {
+  const found = { commands: [], unresolved: [], unparsed: [] };
+  const first = skipEnvPrefix(tokens);
+  if (first >= tokens.length || basename(shellUnquote(tokens[first])) !== 'git') return found;
+  const env = new Map();
+  for (const a of tokens.slice(0, first)) {
+    const kv = splitAssignment(shellUnquote(a));
+    if (kv) env.set(kv[0], kv[1]);
+  }
+  const add = (key, value) => {
+    const cmd = gitConfigCommand(key, value);
+    if (cmd) found.commands.push(cmd);
+  };
+  // #273: config injected through the statement's own leading assignments. Pairs
+  // are read regardless of GIT_CONFIG_COUNT (fail toward scanning).
+  for (const [name, value] of env) {
+    const m = /^GIT_CONFIG_KEY_(\d+)$/.exec(name);
+    if (m && env.has(`GIT_CONFIG_VALUE_${m[1]}`)) add(value, env.get(`GIT_CONFIG_VALUE_${m[1]}`));
+    if (GIT_COMMAND_ENV_VARS.includes(name) && value) found.commands.push(value);
+  }
+  if (env.has('GIT_CONFIG_PARAMETERS')) {
+    const text = env.get('GIT_CONFIG_PARAMETERS');
+    const entries = parseGitConfigParameters(text);
+    if (entries) entries.forEach(([k, v]) => add(k, v));
+    else if ((text.match(/[A-Za-z0-9._-]+(?==)/g) || []).some(isGitCommandKey)) found.unparsed.push(`GIT_CONFIG_PARAMETERS=${text}`);
+  }
+  const operands = tokens.slice(first + 1).map(shellUnquote);
+  for (const cfg of walkGitGlobals(operands).configs) {
+    const kv = splitAssignment(cfg.value);
+    if (!kv) continue;
+    if (cfg.kind === 'c') { add(kv[0], kv[1]); continue; }
+    if (!isGitCommandKey(kv[0])) continue;
+    if (env.has(kv[1])) add(kv[0], env.get(kv[1])); else found.unresolved.push(cfg.sample);
+  }
+  // #275: `git config <key> <value>` writes a command into the config.
+  const sub = gitSubcommandIndexLoose(operands);
+  if (sub !== -1 && operands[sub] === 'config') {
+    gitConfigWritePairs(operands.slice(sub + 1)).forEach(([k, v]) => add(k, v));
+  }
+  return found;
+}
+
+// The unmodelled-hit shape (lib/unmodelled.js) for a `--config-env` on a command key whose
+// variable the statement does not assign.
+const GIT_CONFIG_ENV_UNMODELLED = (sample) => ({
+  id: 'git-config-env',
+  label: 'a git --config-env on a command-valued key whose variable is not assigned in the same statement',
+  hint: 'assign it in the same statement (`VAR="cmd" git --config-env=key=VAR ...`) or pass the command with `git -c key=cmd`',
+  sample,
+});
+
+// The unmodelled-hit shape for a GIT_CONFIG_PARAMETERS value the guard cannot parse.
+const GIT_CONFIG_PARAMETERS_UNMODELLED = (sample) => ({
+  id: 'git-config-parameters',
+  label: 'a GIT_CONFIG_PARAMETERS value with unbalanced quoting that names a command-valued key',
+  hint: 'pass the command with `git -c key=cmd` or a well-quoted GIT_CONFIG_PARAMETERS',
+  sample,
+});
+
+// #316: the unmodelled-hit shape for a nested shell / eval behind a command wrapper
+// (`nice bash -c '...'`), whose inner text the guard does not follow.
+const WRAPPED_SHELL_UNMODELLED = (sample) => ({
+  id: 'wrapped-nested-shell',
+  label: 'a command wrapper in front of a nested shell (`bash -c`) or eval',
+  hint: 'run the inner command directly, without the wrapper and the nested shell',
+  sample,
+});
+
+// #316: wrappers this gate also knows that lib/unmodelled.js does not skip. A word list
+// only: the gate never walks a wrapper's options, so no option values are needed here.
+const EXTRA_WRAPPER_WORDS = new Set(['stdbuf', 'time', 'setsid', 'doas']);
+
+// #316: a statement whose command word (after NAME=value prefixes) is a known wrapper
+// (lib/unmodelled.js) and that carries a nested shell word or `eval` later on. The
+// wrapper's own options are not walked: any such word fails closed. Null when not.
+function wrappedNestedShell(tokens) {
+  let lib;
+  try {
+    lib = require('./lib/unmodelled.js');
+  } catch {
+    return null; // a missing lib only switches this gate off, like unmodelledSecretPiece
+  }
+  const first = skipEnvPrefix(tokens);
+  if (first >= tokens.length) return null;
+  const word = unquoteWord(tokens[first]);
+  if (!lib.isWrapperWord(word) && !EXTRA_WRAPPER_WORDS.has(word)) return null;
+  const nested = tokens.slice(first + 1).some((t) => {
+    const w = basename(unquoteWord(t));
+    return w === 'eval' || SHELL_DASH_C_VERBS.has(w);
+  });
+  return nested ? tokens.join(' ') : null;
+}
+
 // Scan a single top-level statement for a secret path. Recurses into a
 // bash -c/eval quoted sub-command first (finding #1), routes grep/rg/ag/sed/
 // awk through the shared pattern-skipping walk (finding #4), and falls back
@@ -419,6 +714,19 @@ function scanStatementForSecretPath(stmt) {
     // stray `-f .env` on the wrapper itself) for defence in depth.
   }
 
+  // #273: a command carried in a git config value (`-c core.pager="cat .env"`).
+  const git = extractGitConfigCommands(tokens);
+  for (const text of git.commands) {
+    const hit = scanBashForSecretPath(text);
+    if (hit) return hit;
+  }
+  if (git.unresolved.length) {
+    return { path: git.unresolved[0], unmodelled: GIT_CONFIG_ENV_UNMODELLED(git.unresolved[0]) };
+  }
+  if (git.unparsed.length) {
+    return { path: git.unparsed[0], unmodelled: GIT_CONFIG_PARAMETERS_UNMODELLED(git.unparsed[0]) };
+  }
+
   const bin = basename(tokens[0]);
   if (SEARCH_VERBS.has(bin)) {
     return scanArgsSkippingPattern(tokens.slice(1), SEARCH_VERB_CONFIG[bin], isSecretPathArg);
@@ -427,7 +735,12 @@ function scanStatementForSecretPath(stmt) {
   // standalone docker-compose/podman-compose binaries) get --env-file's value
   // exempted; every other verb keeps today's behaviour unchanged.
   const exempt = ENV_FILE_EXEMPT_VERBS.has(bin) ? ENV_FILE_EXEMPT_FLAGS : NO_EXEMPT_FLAGS;
-  return scanTokensForSecretPath(tokens, exempt, nameOnlyTokenIndices(bin, tokens));
+  const plain = scanTokensForSecretPath(tokens, exempt, nameOnlyTokenIndices(bin, tokens));
+  if (plain) return plain;
+  // #316: only when a secret-looking piece sits in the statement (`timeout 5 bash -c 'echo hi'` stays allowed).
+  const wrapped = wrappedNestedShell(tokens);
+  const piece = wrapped && crudeSecretPiece(wrapped);
+  return piece ? { path: piece, unmodelled: WRAPPED_SHELL_UNMODELLED(wrapped) } : null;
 }
 
 // #214: substitution bodies are scanned off an explicit work-list (no
@@ -462,13 +775,13 @@ function invokesInterpreter(stmt) {
   let i = 0;
   while (i < tokens.length && LEADING_KEYWORDS.has(tokens[i])) i++;
   i += skipEnvPrefix(tokens.slice(i));
-  if (i < tokens.length && basename(stripQuotes(tokens[i])) === 'env') {
+  if (i < tokens.length && basename(unquoteWord(tokens[i])) === 'env') {
     i++;
     while (i < tokens.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[i]) || tokens[i].startsWith('-'))) {
       i += ENV_VALUE_OPTIONS.has(tokens[i]) ? 2 : 1;
     }
   }
-  return i < tokens.length && STDIN_SCRIPT_INTERPRETERS.has(basename(stripQuotes(tokens[i])));
+  return i < tokens.length && STDIN_SCRIPT_INTERPRETERS.has(basename(unquoteWord(tokens[i])));
 }
 
 // Walk the command's top-level statements (quote-aware; `|`, `;`, `&&`,
@@ -570,7 +883,7 @@ function detectSecretRead(toolName, toolInput) {
   if (toolName === 'Bash') {
     const cmd = input.command || '';
     const hit = scanBashForSecretPath(cmd);
-    if (hit) return { path: hit };
+    if (hit) return typeof hit === 'object' ? hit : { path: hit }; // object: an unmodelled hit (#273)
     const um = unmodelledSecretPiece(cmd); // a final gate: the precise scan keeps priority
     return um ? { path: um.piece, unmodelled: um.hit } : null;
   }