@mmerterden/multi-agent-pipeline 20.8.1 → 20.8.2

package/pipeline/scripts/agent-guard.py

@@ -51,12 +51,24 @@ ATTRIBUTION = re.compile(
 )
 
 
+def _strip_set(ranges):
+    out = set()
+    for spec in ranges:
+        first, _, last = str(spec).partition("-")
+        try:
+            lo, hi = int(first, 16), int(last or first, 16)
+        except ValueError:
+            continue
+        out.update(chr(cp) for cp in range(lo, hi + 1))
+    return out
+
+
 def _load_confusables():
     here = os.path.dirname(os.path.abspath(__file__))
     try:
         with open(os.path.join(here, "..", "lib", "confusables.json"), encoding="utf-8") as fh:
             table = json.load(fh)
-        return set(table.get("strip", [])), dict(table.get("map", {}))
+        return _strip_set(table.get("stripRanges", [])), dict(table.get("map", {}))
     except (OSError, ValueError):
         return set(), {}
 
@@ -65,12 +77,14 @@ _STRIP, _MAP = _load_confusables()
 
 
 def normalize_for_match(text: str) -> str:
-    """NFKC, invisible characters removed, look-alike letters mapped to ASCII.
+    """NFKC, Default_Ignorable_Code_Point removed, look-alikes mapped to ASCII.
 
     The same fold lib/normalize-text.mjs applies, from the same table. Rules
     that match text content run on the raw command and on this copy, so a
     trailer written with a zero-width space or a Cyrillic letter still matches.
-    Without the table only NFKC applies.
+    The table's map also carries the compatibility letters newer than this
+    Python's unicodedata, which NFKC here would leave alone. Without the table
+    only NFKC applies.
     """
     return "".join(
         _MAP.get(ch, ch) for ch in unicodedata.normalize("NFKC", text) if ch not in _STRIP
@@ -130,10 +144,23 @@ GIT_FLAG_OPTIONS = {
 SEPARATORS = re.compile(r"&&|\|\||;|\||\n")
 
 
+# shlex grows each token one character at a time, which is quadratic in the
+# token's length: a megabyte argument takes longer than the deadline. A segment
+# longer than this is split on whitespace with its quotes and backslashes
+# removed instead, which keeps every word the segment names in order.
+SHLEX_MAX_CHARS = 16384
+
+
+def coarse_tokens(cmd: str) -> list:
+    return [re.sub(r"[\"'\\]", "", t) for t in cmd.split()]
+
+
 def tokenize(cmd: str) -> list:
     """shlex tokens, or whitespace tokens when shlex cannot parse (an unbalanced
-    quote). Never returns None: a guard has to reason about a segment it cannot
-    parse cleanly, not skip it."""
+    quote) or the segment is too long for it. Never returns None: a guard has to
+    reason about a segment it cannot parse cleanly, not skip it."""
+    if len(cmd) > SHLEX_MAX_CHARS:
+        return coarse_tokens(cmd)
     try:
         return shlex.split(cmd)
     except Exception:
@@ -401,11 +428,12 @@ def _decide_push(cmd: str, toks=None, cwd=None) -> str:
     force_flag = bool(FORCE.search(cmd))
     if not force_flag and not FORCED_REFSPEC.search(cmd) and not PUSH_GATE.search(cmd):
         return "OK"
-    try:
-        shlex.split(cmd)
-    except Exception:
-        # A force-push we can't tokenize -> can't prove it's safe -> block.
-        return "BLOCK_FORCE"
+    if len(cmd) <= SHLEX_MAX_CHARS:
+        try:
+            shlex.split(cmd)
+        except Exception:
+            # A force-push we can't tokenize -> can't prove it's safe -> block.
+            return "BLOCK_FORCE"
     git_dir, opts, positionals = _parse_push(toks)
     keys = {k for k, _ in opts}
     force_flag = any(
@@ -451,17 +479,97 @@ def _decide_push(cmd: str, toks=None, cwd=None) -> str:
     return "OK"
 
 
+FALLBACK_SPLIT = re.compile(r"&&|\|\||[;|\n()`]|\\n")
+FALLBACK_FORCE_WORDS = {"-d", "--force", "--force-with-lease", "--force-if-includes", "--mirror", "--delete", "--prune"}
+FALLBACK_TARGET_WORDS = {"head", "@", "--all", "--mirror", "--branches"}
+
+
+def _fallback_forced(tok: str) -> bool:
+    key = tok.split("=", 1)[0]
+    if key in FALLBACK_FORCE_WORDS or tok.startswith("+") or ":+" in tok or tok.startswith(":"):
+        return True
+    return tok.startswith("-") and not tok.startswith("--") and tok[1:].isalpha() and "f" in tok
+
+
+def _fallback_protected(tok: str) -> bool:
+    name = tok.rsplit(":", 1)[-1].lstrip("+")
+    if name.startswith("refs/heads/"):
+        name = name[len("refs/heads/"):]
+    return name in PROTECTED or tok in FALLBACK_TARGET_WORDS
+
+
+def fallback_verdict(text: str) -> str:
+    """The always-on rules as a linear scan, for input the tokenizer could not
+    finish in time. Each piece between shell separators is split on whitespace
+    with its quotes and backslashes removed, and no regex that can backtrack
+    runs over it. A push piece with a force indicator is blocked when it names a
+    protected branch, HEAD / @ or every ref, or when the checkout's own branch
+    is protected or unknown; a line with a git commit is blocked when the
+    attribution pattern matches the raw or the folded text. Stricter than
+    decide() by design: it only runs when decide() could not."""
+    try:
+        folded = normalize_for_match(text)
+    except Exception:
+        folded = text
+    current = os.environ.get("CUR_BRANCH", "")
+    commits = False
+    for t in (text, folded):
+        for piece in FALLBACK_SPLIT.split(t.lower()):
+            toks = coarse_tokens(piece)
+            if not any(os.path.basename(x) == "git" for x in toks):
+                continue
+            words = set(toks)
+            if "commit" in words:
+                commits = True
+            if "push" not in words or not any(_fallback_forced(x) for x in toks):
+                continue
+            if any(_fallback_protected(x) for x in toks) or current in PROTECTED or current in ("", "HEAD"):
+                return "BLOCK_FORCE"
+    if commits and (ATTRIBUTION.search(text) or ATTRIBUTION.search(folded)):
+        return "BLOCK_ATTRIB"
+    return "OK"
+
+
 def unattended() -> bool:
     """MULTI_AGENT_UNATTENDED=1 in the hook's own environment - the launcher's,
     never anything the run wrote (lib/unattended.sh ma_unattended)."""
     return os.environ.get("MULTI_AGENT_UNATTENDED", "") == "1"
 
 
+def _arm_deadline(on_deadline) -> None:
+    """Run on_deadline (which must end the process) once deadline_seconds()
+    have passed. Where SIGALRM is unavailable the call simply runs to the end."""
+
+    def _fire(_signum, _frame):
+        try:
+            signal.setitimer(signal.ITIMER_REAL, 0)
+        except (ValueError, AttributeError, OSError):
+            pass
+        on_deadline()
+
+    try:
+        signal.signal(signal.SIGALRM, _fire)
+        signal.setitimer(signal.ITIMER_REAL, deadline_seconds())
+    except (ValueError, AttributeError, OSError):
+        pass
+
+
+def _exit_with(line: str) -> None:
+    # os._exit skips the stdio flush, so the line is flushed first or the
+    # caller reads nothing.
+    if line:
+        print(line, flush=True)
+    os._exit(0)
+
+
 def git_subcommand_mode() -> None:
     """`agent-guard.py --git-subcommand`: read a Bash payload (or a raw command
     on argv) and print each git subcommand it runs, one per line, using the same
     tokenizer the guard uses. pre-commit-check.sh reads this to detect a commit
-    without a regex. Never executes anything."""
+    without a regex. Never executes anything. At the deadline it prints
+    `commit`, so the caller scans rather than skipping a commit it could not
+    rule out."""
+    _arm_deadline(lambda: _exit_with("commit"))
     if len(sys.argv) > 2:
         cmd = sys.argv[2]
     else:
@@ -490,8 +598,9 @@ def commit_dir_mode() -> None:
     """`agent-guard.py --commit-dir`: read a Bash payload and print the
     directory the first commit-writing git command on the line runs in, after
     any `cd` / `git -C`, resolved from the payload's cwd. Prints nothing when
-    there is no commit or the directory cannot be read literally, so the caller
-    keeps its own cwd. Never executes anything."""
+    there is no commit, the directory cannot be read literally, or the deadline
+    passes, so the caller keeps its own cwd. Never executes anything."""
+    _arm_deadline(lambda: _exit_with(""))
     try:
         data = json.load(sys.stdin)
         cmd = (data.get("tool_input") or {}).get("command", "")
@@ -519,21 +628,37 @@ def main() -> None:
         commit_dir_mode()
         return
     strict = unattended()
-
-    def _deadline(_signum, _frame):
-        # os._exit skips the stdio flush, so the verdict is flushed first or
-        # the wrapper reads nothing.
-        print("BLOCK_UNATTENDED\tthe guard hit its internal deadline" if strict else "OK", flush=True)
-        os._exit(0)
+    seen = {"text": "", "raw": True}
+
+    def _unjudged(default: str) -> str:
+        # The always-on rules still hold when the full decision could not be
+        # reached: a linear scan of whatever text is at hand decides them.
+        text = seen["text"]
+        if seen.get("raw"):
+            try:
+                cmd = (json.loads(text).get("tool_input") or {}).get("command", "")
+                text = cmd if isinstance(cmd, str) else text
+            except Exception:
+                pass
+        try:
+            verdict = fallback_verdict(text)
+        except Exception:
+            verdict = "OK"
+        return verdict if verdict != "OK" else default
 
     try:
-        signal.signal(signal.SIGALRM, _deadline)
-        signal.setitimer(signal.ITIMER_REAL, deadline_seconds())
-    except (ValueError, AttributeError, OSError):
-        pass
+        seen["text"] = sys.stdin.read()
+    except Exception:
+        seen["text"] = ""
+    # Armed once the payload is in hand, so the fallback always has the text.
+    _arm_deadline(
+        lambda: _exit_with(_unjudged("BLOCK_UNATTENDED\tthe guard hit its internal deadline" if strict else "OK"))
+    )
     try:
-        data = json.load(sys.stdin)
+        data = json.loads(seen["text"])
         cmd = (data.get("tool_input") or {}).get("command", "")
+        if isinstance(cmd, str):
+            seen["text"], seen["raw"] = cmd, False
         verdict = decide(cmd) if isinstance(cmd, str) and cmd else "OK"
         if verdict == "OK" and strict:
             sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
@@ -547,7 +672,7 @@ def main() -> None:
         # Attended: a guard bug must not break a legitimate tool call.
         # Unattended: nobody is there to notice a gap, so an input the guard
         # cannot judge is refused.
-        print("BLOCK_PARSE" if strict else "OK")
+        print(_unjudged("BLOCK_PARSE" if strict else "OK"))
 
 
 if __name__ == "__main__":

package/pipeline/scripts/audit-log.sh

@@ -56,10 +56,9 @@ hash_url() {
   elif command -v shasum >/dev/null 2>&1; then
     printf '%s' "$url" | shasum -a 256 | awk '{print $1}'
   else
-    # The previous fallback printed `unhashed:<url>`, writing the plaintext remote into
-    # the audit log - the exact thing this hashing exists to prevent, and it would have
-    # carried any credentials embedded in the remote URL with it. Losing one field beats
-    # leaking one.
+    # No hash tool: record a fixed marker, never the URL itself. The plaintext
+    # remote is what the hashing keeps out of the log, and a remote URL can
+    # carry embedded credentials.
     echo "unhashable-no-sha256-tool"
   fi
 }

package/pipeline/scripts/autopilot-runner.mjs

@@ -263,10 +263,11 @@ const GUARD_MATCHERS = [
     ],
   ],
 ];
-// The hook command install/claude.mjs writes. Only this command, with $HOME
-// written literally or expanded, counts as the guard: a command that merely
-// mentions the script path can run anything and still look registered.
-const GUARD_COMMAND = "bash $HOME/.claude/scripts/agent-guard.sh";
+// The hook command install/claude.mjs writes (the path quoted, so a HOME with a
+// space still runs it). Only this command, quoted or not, with $HOME written
+// literally or expanded, counts as the guard: a command that merely mentions
+// the script path can run anything and still look registered.
+const GUARD_COMMAND = 'bash "$HOME/.claude/scripts/agent-guard.sh"';
 const MANAGED_SETTINGS = "/Library/Application Support/ClaudeCode/managed-settings.json";
 // A phase record without a model is priced at the most expensive tier: an
 // over-estimate stops the spend ceiling early, an under-estimate stops it late.
@@ -1334,7 +1335,15 @@ function matcherCovers(matcher, tool) {
 /** The guard script, when the hook command is exactly the installer's and the script exists. */
 function guardScriptOf(command, home) {
   const script = join(home, ".claude", "scripts", "agent-guard.sh");
-  const forms = [GUARD_COMMAND, GUARD_COMMAND.replace("$HOME", "${HOME}"), `bash ${script}`];
+  const unquoted = GUARD_COMMAND.replaceAll('"', "");
+  const forms = [
+    GUARD_COMMAND,
+    GUARD_COMMAND.replace("$HOME", "${HOME}"),
+    unquoted,
+    unquoted.replace("$HOME", "${HOME}"),
+    `bash "${script}"`,
+    `bash ${script}`,
+  ];
   return forms.includes(String(command || "").trim()) && existsSync(script) ? script : null;
 }
 

package/pipeline/scripts/doctor.mjs

@@ -465,8 +465,14 @@ function checkHookCoverage() {
       for (const h of entry.hooks || []) if (h.command) wantedCmds.add(h.command);
     }
   }
-  const haveStr = JSON.stringify(have?.hooks || {});
-  const absent = [...wantedCmds].filter((c) => !haveStr.includes(c));
+  const haveCmds = new Set();
+  for (const group of Object.values(have?.hooks || {})) {
+    for (const entry of Array.isArray(group) ? group : []) {
+      for (const h of entry?.hooks || [])
+        if (typeof h?.command === "string") haveCmds.add(h.command);
+    }
+  }
+  const absent = [...wantedCmds].filter((c) => !haveCmds.has(c));
   if (absent.length) {
     report(
       "hook-coverage",

package/pipeline/scripts/log-metric.sh

@@ -55,6 +55,12 @@ mkdir -p "$METRICS_DIR" 2>/dev/null || {
   exit 0
 }
 
+# Same escaping as audit-log.sh: backslash, quote, tab and CR escaped, and a
+# newline written as \n, so any caller text stays inside one JSON string.
+json_escape() {
+  printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g; s/\r/\\r/g' | awk 'NR > 1 { printf "\\n" } { printf "%s", $0 }'
+}
+
 # Build details object from key=value args. Keep it shell-portable: no jq required.
 DETAILS="{"
 SEP=""
@@ -65,10 +71,10 @@ for kv in "$@"; do
   # int or true/false becomes a JSON string.
   case "$VAL" in
     true|false) JSON_VAL="$VAL" ;;
-    ''|*[!0-9]*) JSON_VAL="\"$(printf '%s' "$VAL" | tr -d '\n\r' | sed 's/\\/\\\\/g; s/"/\\"/g; s/	/\\t/g')\"" ;;
+    ''|*[!0-9]*) JSON_VAL="\"$(json_escape "$VAL")\"" ;;
     *) JSON_VAL="$VAL" ;;
   esac
-  DETAILS="${DETAILS}${SEP}\"${KEY}\":${JSON_VAL}"
+  DETAILS="${DETAILS}${SEP}\"$(json_escape "$KEY")\":${JSON_VAL}"
   SEP=","
 done
 DETAILS="${DETAILS}}"
@@ -79,7 +85,7 @@ PHASE_SCHEMA="$(node -e 'const c=require("'"$(cd "$(dirname "$0")" && pwd)"'/../
 [ -n "$PHASE_SCHEMA" ] || PHASE_SCHEMA=2
 
 TS="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
-LINE="{\"ts\":\"${TS}\",\"task_id\":\"${TASK_ID}\",\"phase\":\"${PHASE}\",\"event\":\"${EVENT}\",\"details\":${DETAILS},\"phaseSchema\":${PHASE_SCHEMA}}"
+LINE="{\"ts\":\"${TS}\",\"task_id\":\"$(json_escape "$TASK_ID")\",\"phase\":\"$(json_escape "$PHASE")\",\"event\":\"$(json_escape "$EVENT")\",\"details\":${DETAILS},\"phaseSchema\":${PHASE_SCHEMA}}"
 
 # Caller-supplied values can carry a credential copied out of an error.
 # redact.mjs replaces it with a marker; without node the line is written as is.

package/pipeline/scripts/migrate-prefs.mjs

@@ -522,10 +522,23 @@ function migrateReportChannels(out, changes) {
   }
 }
 
+// Writes through a symlinked prefs file to its target, so a prefs file kept in
+// a dotfiles repo stays a link and the repo copy receives the migration.
 function atomicWrite(filePath, data) {
-  withFileLockSync(filePath, () => writeJsonAtomicSync(filePath, data, { mode: 0o600 }), {
-    timeoutMs: lockTimeoutFrom(process.env),
-  });
+  withFileLockSync(
+    filePath,
+    () => writeJsonAtomicSync(filePath, data, { mode: 0o600, followSymlink: true }),
+    { timeoutMs: lockTimeoutFrom(process.env) },
+  );
+}
+
+// The document as it was before this migration, beside the path given, so a
+// migration that went wrong can be undone by hand.
+function writeBackup(filePath, raw) {
+  const bak = `${filePath}.bak`;
+  fs.writeFileSync(bak, raw, { mode: 0o600 });
+  fs.chmodSync(bak, 0o600);
+  return bak;
 }
 
 function main() {
@@ -560,8 +573,9 @@ function main() {
     process.exit(0);
   }
 
+  const bak = writeBackup(args.file, raw);
   atomicWrite(args.file, out);
-  console.log(`✓ wrote migrated prefs to ${args.file}`);
+  console.log(`✓ wrote migrated prefs to ${args.file} (previous version: ${bak})`);
 }
 
 runMain("migrate-prefs", main);

package/pipeline/scripts/pre-commit-check.sh

@@ -85,6 +85,13 @@ process.stdin.on("end", () => {
 });
 ' 2>/dev/null || true)"
     fi
+    # A command that never spells git, even with its quotes and backslashes
+    # removed (g'i't, "git", \git), cannot run it through any path the helper
+    # below would recognise, so it returns before paying for the parse.
+    if [ -n "$HOOK_COMMAND" ] \
+      && ! printf '%s' "$HOOK_COMMAND" | tr -d "\"'\\\\" | grep -qi 'git'; then
+      exit 0
+    fi
     if [ -n "$HOOK_COMMAND" ]; then
       # Commit detection is a tokenizer, not a regex: agent-guard.py shares its
       # shell parser through `--git-subcommand`, so an absolute git path, a
@@ -156,7 +163,7 @@ is_binary() {
 # a diff, or the whole file for something not yet tracked at all - every line
 # of a brand-new file is an addition).
 scan_file() {
-  local file="$1" content="$2"
+  local file="$1" content="$2" folded="${3:-}"
 
   # .env files
   if echo "$file" | grep -qE '\.env($|\.)'; then
@@ -174,21 +181,11 @@ scan_file() {
 
   [ -z "$content" ] && return 0
 
-  # A token written with an invisible character or a look-alike letter: scan a
-  # folded copy too. Only non-ASCII content pays for the node call.
-  if printf '%s' "$content" | LC_ALL=C grep -q '[^ -~[:space:]]' 2>/dev/null \
-     && { ! command -v node >/dev/null 2>&1 || [ ! -f "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" ]; }; then
-    echo "pre-commit-check: node or lib/normalize-text.mjs unavailable - non-ASCII content scanned without look-alike folding" >&2
-  fi
-  if printf '%s' "$content" | LC_ALL=C grep -q '[^ -~[:space:]]' 2>/dev/null \
-     && command -v node >/dev/null 2>&1 \
-     && [ -f "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" ]; then
-    local folded
-    folded=$(printf '%s' "$content" | node "$PRE_COMMIT_DIR/../lib/normalize-text.mjs" 2>/dev/null) || folded=""
-    if [ -n "$folded" ] && [ "$folded" != "$content" ]; then
-      content="$content
+  # A token written with an invisible character or a look-alike letter: the
+  # folded copy (see fold_and_scan) is scanned together with the raw text.
+  if [ -n "$folded" ] && [ "$folded" != "$content" ]; then
+    content="$content
 $folded"
-    fi
   fi
 
   # API keys / tokens (key = "long_string" pattern)
@@ -285,15 +282,50 @@ $folded"
     if [ -n "$candidates" ]; then
       entropy_hit=$(printf '%s\n' "$candidates" | awk '
         # Word-shaped identifier: letters and _ or - only, split into segments at
-        # separators and case boundaries (UIApplication -> UI, Application), where
-        # the segments read like words: average length 4+, none longer than 24,
-        # and at least 70 percent carrying a vowel. Random letters-only tokens
-        # flip case every one or two characters, so their segments average about
-        # two characters with few vowels; a long lowercase run is one oversized
-        # segment. Neither shape passes.
-        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, voweled, split_here) {
+        # separators and case boundaries (UIApplication -> UI, Application),
+        # where the segments average 4+ letters, none is longer than 24, and the
+        # letter pairs inside them read like English. PAIR scores every pair as
+        # log2 of how often it occurs across a 235k-word English word list
+        # relative to a uniform draw, rounded and clipped to -4..4 (stored +4,
+        # one row per first letter). Identifiers made of words average above
+        # +0.5 per pair even with an abbreviation or two (Qr, Ffp, Otp, Kg);
+        # uniformly random letters average below +0.1, so the mean must reach
+        # +0.25. Clipping keeps one unusual pair from outweighing the rest. An
+        # all-caps segment of up to five letters inside a token that also has
+        # lowercase letters is an acronym (URL, HTTP, JSON) and is not scored.
+        BEGIN {
+          rows = "06655352403757150767433232 52015000500600400421400010 " \
+            "60306006504400600515500040 50026021600313500420301030 " \
+            "63564442401657452876433420 40004300400400400302400020 " \
+            "50005033500423400510400030 60006000600322600403301050 " \
+            "64764551103657651577350105 20002000000000200000200000 " \
+            "30005001400201200010100010 71237220701622630024520060 " \
+            "64006000600032650010400040 62667462613324631357422031 " \
+            "44553352403667560766644321 60006006500501630644400030 " \
+            "00000000000000000000400000 73447233703354740445432050 " \
+            "51506105602453552067502040 61307106700421600624502050 " \
+            "44443230401657240665000000 40006000400000300000100000 " \
+            "40004002400102400100000000 20102000300000220002000020 " \
+            "31332020200433340343000000 30004000200000300000000011";
+          split(rows, row, " ");
+          alpha = "abcdefghijklmnopqrstuvwxyz";
+          for (r = 1; r <= 26; r++)
+            for (k = 1; k <= 26; k++)
+              PAIR[substr(alpha, r, 1) substr(alpha, k, 1)] = substr(row[r], k, 1) - 4;
+        }
+        function score_segment(seg, has_lower,    l, j) {
+          if (has_lower && seg ~ /^[A-Z]+$/ && length(seg) <= 5) return;
+          l = tolower(seg);
+          for (j = 2; j <= length(l); j++) {
+            pairs++;
+            pair_score += PAIR[substr(l, j - 1, 2)];
+          }
+        }
+        function wordlike(t,    n, i, c, p, nx, seg, nseg, total, maxlen, split_here, has_lower) {
           if (t !~ /^[A-Za-z_-]+$/) return 0;
-          n = length(t); seg = ""; nseg = 0; total = 0; maxlen = 0; voweled = 0;
+          has_lower = (t ~ /[a-z]/);
+          pairs = 0; pair_score = 0;
+          n = length(t); seg = ""; nseg = 0; total = 0; maxlen = 0;
           for (i = 1; i <= n + 1; i++) {
             c = (i <= n) ? substr(t, i, 1) : "_";
             split_here = 0;
@@ -306,13 +338,13 @@ $folded"
             if (split_here && seg != "") {
               nseg++; total += length(seg);
               if (length(seg) > maxlen) maxlen = length(seg);
-              if (tolower(seg) ~ /[aeiouy]/) voweled++;
+              score_segment(seg, has_lower);
               seg = "";
             }
             if (c != "_" && c != "-") seg = seg c;
           }
-          if (nseg == 0) return 0;
-          return (total / nseg >= 4 && maxlen <= 24 && voweled * 10 >= nseg * 7);
+          if (nseg == 0 || pairs == 0) return 0;
+          return (total / nseg >= 4 && maxlen <= 24 && pair_score * 4 >= pairs);
         }
         {
           s=$0;
@@ -361,9 +393,63 @@ $folded"
   fi
 }
 
+# Files are queued and scanned together so that the look-alike fold runs in
+# one node process for every non-ASCII file of the run rather than one per
+# file. ASCII content folds to itself and is not sent.
+Q_FILES=()
+Q_CONTENTS=()
+queue_file() {
+  Q_FILES+=("$1")
+  Q_CONTENTS+=("$2")
+}
+
+FOLD_WARNED=0
+fold_warn() {
+  [ "$FOLD_WARNED" = "1" ] && return 0
+  FOLD_WARNED=1
+  echo "pre-commit-check: $1 - non-ASCII content scanned without look-alike folding" >&2
+}
+
+fold_and_scan() {
+  local i n=${#Q_FILES[@]} lib="$PRE_COMMIT_DIR/../lib/normalize-text.mjs" out rec
+  local -a idx=() folded=()
+  for ((i = 0; i < n; i++)); do
+    folded[i]=""
+    if printf '%s' "${Q_CONTENTS[i]}" | LC_ALL=C grep -q '[^ -~[:space:]]' 2>/dev/null; then
+      idx+=("$i")
+    fi
+  done
+  if [ "${#idx[@]}" -gt 0 ]; then
+    if ! command -v node >/dev/null 2>&1 || [ ! -f "$lib" ]; then
+      fold_warn "node or lib/normalize-text.mjs unavailable"
+    else
+      out=$(mktemp "${TMPDIR:-/tmp}/pre-commit-fold.XXXXXX") || out=""
+      if [ -n "$out" ] && for i in "${idx[@]}"; do printf '%s\0' "${Q_CONTENTS[i]}"; done \
+        | node "$lib" --nul >"$out" 2>/dev/null; then
+        local -a recs=()
+        while IFS= read -r -d '' rec; do recs+=("$rec"); done <"$out"
+        if [ "${#recs[@]}" -eq "${#idx[@]}" ]; then
+          for ((i = 0; i < ${#idx[@]}; i++)); do folded[idx[i]]="${recs[i]}"; done
+        else
+          fold_warn "the look-alike fold returned ${#recs[@]} of ${#idx[@]} records"
+        fi
+      else
+        fold_warn "the look-alike fold (node lib/normalize-text.mjs) failed"
+      fi
+      [ -n "$out" ] && rm -f "$out"
+    fi
+  fi
+  for ((i = 0; i < n; i++)); do
+    scan_file "${Q_FILES[i]}" "${Q_CONTENTS[i]}" "${folded[i]}"
+  done
+  Q_FILES=()
+  Q_CONTENTS=()
+}
+
 if [ -n "$SCAN_FILE_TARGET" ]; then
   is_binary "$SCAN_FILE_TARGET" && exit 0
-  scan_file "$SCAN_FILE_TARGET" "$(cat "$SCAN_FILE_TARGET" 2>/dev/null)"
+  queue_file "$SCAN_FILE_TARGET" "$(cat "$SCAN_FILE_TARGET" 2>/dev/null)"
+  fold_and_scan
   if [ "$FOUND" -eq 1 ]; then
     echo "" >&2
     echo "Secret check failed on $SCAN_FILE_TARGET." >&2
@@ -406,10 +492,11 @@ if [ -n "$SCAN_RANGE" ]; then
         # blob at this commit so a NUL-laden file cannot hide a key.
         content=$(gitscan show --text --no-textconv "${commit}:${file}" 2>/dev/null || true)
       fi
-      scan_file "$file" "$content"
+      queue_file "$file" "$content"
     done < <(gitscan diff-tree --no-commit-id -r --root -m --first-parent \
       --name-only -z --diff-filter=d "$commit" 2>/dev/null)
   done
+  fold_and_scan
   if [ "$FOUND" -eq 1 ]; then
     echo "" >&2
     echo "Secret check failed on $SCAN_RANGE." >&2
@@ -428,7 +515,7 @@ while IFS= read -r -d '' file; do
   [ ! -f "$file" ] && continue
   is_binary "$file" && continue
   content=$(git diff --cached -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
-  scan_file "$file" "$content"
+  queue_file "$file" "$content"
 done < <(git diff --cached --name-only -z 2>/dev/null)
 
 if [ "$SCAN_UNSTAGED" = "1" ]; then
@@ -439,7 +526,7 @@ if [ "$SCAN_UNSTAGED" = "1" ]; then
     [ ! -f "$file" ] && continue
     is_binary "$file" && continue
     content=$(git diff HEAD -- "$file" 2>/dev/null | grep "^+" | grep -v "^+++" || true)
-    scan_file "$file" "$content"
+    queue_file "$file" "$content"
   done < <(git diff HEAD --name-only -z 2>/dev/null)
 
   # Untracked (brand-new) files - there is no diff to take yet, so every line
@@ -449,9 +536,10 @@ if [ "$SCAN_UNSTAGED" = "1" ]; then
     [ ! -f "$file" ] && continue
     is_binary "$file" && continue
     content=$(sed 's/^/+/' "$file" 2>/dev/null || true)
-    scan_file "$file" "$content"
+    queue_file "$file" "$content"
   done < <(git ls-files --others --exclude-standard -z 2>/dev/null)
 fi
+fold_and_scan
 
 if [ $FOUND -eq 1 ]; then
   echo "" >&2

package/pipeline/scripts/scan-agent-config.sh

@@ -123,16 +123,16 @@ for _event, entries in (t.get("hooks") or {}).items():
     for e in entries:
         for h in e.get("hooks", []):
             c = h.get("command", "")
-            # Allow only `bash $HOME/.claude/scripts/<name>` plus plain long
-            # flags. Flags had to be admitted because a hook that cannot take
-            # one cannot be correct: SessionEnd runs capture-flush with
-            # --if-stale, and without it every session end would re-flush a run
-            # that already finished. What stays banned is everything that could
-            # turn a flag into a second command - no spaces inside a token, no
-            # quotes, no metacharacters, and the eval/substitution check below
-            # still runs on the whole string.
+            # Allow only `bash "$HOME/.claude/scripts/<name>"` (the path quoted
+            # so a HOME with a space still runs it, or unquoted) plus plain long
+            # flags. SessionEnd needs one: capture-flush takes --if-stale so a
+            # session end does not re-flush a run that already finished. What
+            # stays banned is everything that could turn a flag into a second
+            # command - no spaces inside a token, no quotes beyond the pair
+            # around the path, no metacharacters, and the eval/substitution
+            # check below still runs on the whole string.
             if not re.fullmatch(
-                r'bash \$HOME/\.claude/scripts/[A-Za-z0-9._-]+(?: --[a-z0-9][a-z0-9-]*)*',
+                r'bash (?:"\$HOME/\.claude/scripts/[A-Za-z0-9._-]+"|\$HOME/\.claude/scripts/[A-Za-z0-9._-]+)(?: --[a-z0-9][a-z0-9-]*)*',
                 c.strip()):
                 bad.append(c)
             if re.search(r'\beval\b|\$\(|`|[;&|><]', c):