@pareto4/pp-core 1.17.1 → 1.19.0

package/scripts/lint-test-file-count.cjs

@@ -80,12 +80,11 @@ function prodPrefix(filename) {
 // stamps. Five forms are stripped: `.integration`, `.slow`, `.security`,
 // `.install` and the bare `.test`.
 //
-// `.property` is DELIBERATELY NOT stripped. The `vault` entry in
-// scripts/lint-test-file-count.allowlist.json documents
-// vault-practices.property.test.cjs as parked in that bucket precisely because
-// this function leaves the suffix on — stripping it would re-cluster the file
-// into `vault-practices` and turn that entry's own explanation into a false
-// statement. Changing it is a deliberate allowlist migration, not a tidy-up.
+// `.property` is DELIBERATELY NOT stripped: a `<name>.property.test.cjs` keeps
+// the suffix in its prefix, so the hyphen-prefix matcher clusters it under the
+// shortest matching module rather than under `<name>`. Stripping it would
+// re-cluster every property test the allowlist has already counted. Changing
+// it is a deliberate allowlist migration, not a tidy-up.
 function testEffectivePrefix(testName) {
   const bare = testName
     .replace(/\.(integration|slow|security|install)\.test\.(ts|cjs)$/, '')

package/scripts/prompt-injection-scan.sh

@@ -84,7 +84,7 @@ PATTERNS=(
 ALLOWLIST=(
   'scripts/prompt-injection-scan.sh::the PATTERNS array above is the literal source of every phrase this scanner looks for, so the file matches itself by construction; measured 4 pattern hits at HEAD on 2026-09-19'
   'scripts/base64-scan.sh::decodes base64 blobs and re-scans the recovered plaintext against the same injection vocabulary, so it names those phrases inline; measured 2 pattern hits at HEAD on 2026-09-19'
-  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the security_scan job of .github/workflows/ci.yml; measured 0 pattern hits at HEAD on 2026-09-19, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
+  'scripts/secret-scan.sh::third of the three diff-mode scan scripts CI runs together in the pr_gates job of .github/workflows/ci.yml; measured 0 pattern hits at HEAD on 2026-09-19, retained because its own exemption list at line 223 already names security-prompt-injection.security.test.cjs and grows with that vocabulary'
   'tests/security-scan.security.test.cjs::the behavioural suite for this very scanner, so every positive case embeds a real injection phrase as fixture input; measured 28 pattern hits at HEAD on 2026-09-19'
   'tests/security.test.cjs::the adversarial suite for the library sanitisers, whose fixtures are real override and role-manipulation strings asserted to be neutralised; measured 54 pattern hits at HEAD on 2026-09-19'
   'tests/prompt-injection-scan.security.test.cjs::drives scanForInjection in the compiled security library with crafted payloads, and carries a second allowlist of its own for that separate scanner; measured 11 pattern hits at HEAD on 2026-09-19'
@@ -95,9 +95,6 @@ ALLOWLIST=(
   'tests/fixtures/adversarial/security/::a directory of adversarial corpus files whose entire purpose is to BE injection payloads for the suites above; measured 20 pattern hits across its 7 tracked files at HEAD on 2026-09-19'
   'tests/discovery-vault-context.test.cjs::the DISCO-03/SC4 suite plants a real role-manipulation line (the PLANTED constant) into a fixture vault document and asserts the shipped scanner FINDS it, which is the non-vacuity partner for the assertion that the subflow itself scans clean; the payload has to be a literal for that half to mean anything, so the file matches the vocabulary it exists to prove is caught'
   'tests/vault-status-check.test.cjs::sanitisation seeds for the vault status message carry a real instruction and a real control character on purpose, each paired with a non-vacuity assertion that the RENDERED message does not carry it intact; measured 5 pattern hits at HEAD on 2026-09-19'
-  'tests/vault-practices-matcher.test.cjs::the CR-01 fence-spoof suite plants a real instruction-override line and a forged end-fence marker inside practice bodies on purpose, each paired with an assertion that the RENDERED practices block keeps the planted text inside the fence and leaves exactly one genuine closer, so the payload must be a literal for the defang proof to mean anything; measured 3 pattern hits at HEAD b4dd6b3 on 2026-10-04'
-  'tests/vault-review.security.test.cjs::the CR-02 suite seeds a practice body with directive-shaped text aimed at the practice judge (the DIRECTIVE_TEXT constant) and asserts the rendered review entry carries it only between the fence markers, after the reference-data preamble, so the judge reads it as data; the text must be a literal for that assertion to mean anything; measured 1 pattern hit at HEAD b4dd6b3 on 2026-10-04'
-  'tests/practices-review-check-property.test.cjs::a false positive rather than a payload, since the fence-parsing invariance property builds a never-closed fence whose second-opener line is ordinary English about whether the client line becomes a cut point, and one role-pattern regex matches that plain wording; the fixture text stays as written; measured 1 pattern hit at HEAD b4dd6b3 on 2026-10-04'
   'tests/vault-index.integration.test.cjs::the fence-spoof suite seeds a vault document heading and an INDEX description that carry a forged end-fence marker followed by an instruction-override phrase, and asserts the rendered SUMMARY keeps exactly one live end marker with the planted line defanged inside the fence, so the phrase must be a literal for the defang proof to mean anything; measured 4 pattern hits at HEAD 5ddb0b3 on 2026-10-12'
   'tests/vault-seal.integration.test.cjs::the uncovered-commit suite builds a commit whose subject is an instruction-override phrase padded past the cap, modelling a hostile commit message, and asserts the subject leaving the seal leaf is controls-collapsed and bounded to SEAL_SUBJECT_CAP before it can reach a record; measured 1 pattern hit at HEAD 5ddb0b3 on 2026-10-12'
   'tests/vault-standards.integration.test.cjs::the D-14 suites plant instruction-override lines in a standards document and in its INDEX description, each tagged with a random token, and assert that neither the token nor the phrase appears in any output of vault standards block or consulted, so the phrase must be a literal for the absence proof to mean anything; measured 6 pattern hits at HEAD 5ddb0b3 on 2026-10-12'

package/scripts/sync-runtime-launcher.cjs

@@ -12,6 +12,13 @@
  *      (document order) that contains a pp_run call. All other bash blocks
  *      keep their pp_run calls with NO preamble. (Define once per file,
  *      use across blocks — original footprint.)
+ *   4. Start every bash/sh/shell/zsh block that zsh would run differently
+ *      from bash with ZSH_GUARD (right after the preamble where the block
+ *      carries one), and drop the guard from a block that no longer needs it.
+ *      Each block may run in its own shell, and an agent's shell is often zsh:
+ *      the guard makes zsh read the block as sh (unmatched globs stay literal,
+ *      `====` is a word, unquoted words split, arrays index from 0) and is a
+ *      no-op under bash. See needsZshGuard for what counts.
  *
  * Run: node scripts/sync-runtime-launcher.cjs
  */
@@ -28,6 +35,57 @@ const SNIPPET_FILE = path.join(WORKFLOWS_DIR, '_runtime-launcher.snippet.sh');
  */
 const LAUNCHER_HEAD = '_PP_SHIM_NAME="pp-tools.cjs"; ';
 
+/**
+ * The first line of every shell block (issue #12 items 2-4). Exits 0 under
+ * bash, so a block's status never depends on it.
+ */
+const ZSH_GUARD = '[ -z "${ZSH_VERSION:-}" ] || emulate -R sh';
+const GUARDED_LANGS = Object.freeze(['bash', 'sh', 'shell', 'zsh']);
+
+/**
+ * True when zsh would run `lines` differently from bash: an unquoted glob
+ * character, a word starting with `=` plus more (`====`, `==`), an unquoted
+ * `$var` (zsh does not split it), or array syntax (zsh indexes from 1). Errs
+ * towards true — a needless guard costs a line, a missing one breaks a run.
+ * The launcher preamble is zsh-safe and is never inspected.
+ */
+function needsZshGuard(lines) {
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (line === '' || line.startsWith('#') || isLauncherLine(line) || line === ZSH_GUARD) continue;
+    if (/\$\{#?\w+\[/.test(line) || /\b\w+\+?=\(/.test(line)) return true;
+    // Neither shell globs, splits or `=`-expands inside `[[ … ]]` (syntax, not
+    // a command), in a case pattern (`*)`), or on an assignment's right side.
+    const bare = line
+      .replace(/'[^']*'/g, "''")
+      .replace(/"(?:\\.|[^"\\])*"/g, '""')
+      .replace(/\[\[\s.*?\s\]\]/g, '[[ ]]')
+      .replace(/(^|[\s;(|])\*\)/g, '$1)')
+      .replace(/(^|[\s;&|])([A-Za-z_]\w*)=\$(?=[{\w])/g, '$1$2=');
+    if (/(^|[\s;|&(])=[^\s]/.test(bare)) return true;
+    if (/\$(\w|\{)/.test(bare)) return true;
+    if (/[*?]/.test(bare.replace(/\$[*?#@!$-]/g, ''))) return true;
+    if (/[^\s\[]\[[^\]\s]*\]/.test(bare)) return true;
+  }
+  return false;
+}
+
+/**
+ * Make `lines` carry ZSH_GUARD exactly when needsZshGuard says so: at the top
+ * (after leading blanks, and after the preamble when the block starts with
+ * it), indented like the fence. Idempotent.
+ */
+function insertZshGuard(lines, preamble, indent) {
+  const rest = lines.filter((l) => l.trim() !== ZSH_GUARD);
+  if (!needsZshGuard(rest)) return rest.length === lines.length ? lines : rest;
+  let at = 0;
+  while (at < rest.length && rest[at].trim() === '') at++;
+  if (at === rest.length) return lines;
+  if (preamble.length > 0 && preamble.every((p, k) => rest[at + k] === p)) at += preamble.length;
+  const out = [...rest.slice(0, at), indent + ZSH_GUARD, ...rest.slice(at)];
+  return out.join('\n') === lines.join('\n') ? lines : out;
+}
+
 /**
  * Launcher carriers that live OUTSIDE this script's two roots
  * (pp-core/workflows/ and agents/).
@@ -387,7 +445,7 @@ function transformFile(content, preamble) {
     if (i < allLines.length) i++;
 
     if (isShellBlock) {
-      shellBlockRanges.push({ openLineIdx, contentStart, contentEnd, closingLineIdx });
+      shellBlockRanges.push({ openLineIdx, contentStart, contentEnd, closingLineIdx, lang, indent });
     }
   }
 
@@ -418,10 +476,9 @@ function transformFile(content, preamble) {
 
   // Insert preamble into the first pp_run block only
   const finalBlocks = strippedBlocks.map((stripped, bi) => {
-    if (bi === firstPpRunBlockIdx) {
-      return insertPreamble(stripped, preamble);
-    }
-    return stripped;
+    const withPreamble = bi === firstPpRunBlockIdx ? insertPreamble(stripped, preamble) : stripped;
+    const range = shellBlockRanges[bi];
+    return GUARDED_LANGS.includes(range.lang) ? insertZshGuard(withPreamble, preamble, range.indent) : withPreamble;
   });
 
   // --- Pass 3: splice back into output (reverse order to preserve indices) ---
@@ -443,6 +500,43 @@ function transformFile(content, preamble) {
   return outputLines.join('\n');
 }
 
+/**
+ * Guard-only pass for the roots whose launcher lines are kept in place
+ * (commands/, pp-core/references/): every non-empty bash/sh/shell/zsh block
+ * gets ZSH_GUARD, after a launcher line that opens it. pp-core/templates/ is
+ * never passed here — its blocks are text written into the user's project.
+ * Returns new content, or null when nothing changes.
+ */
+function guardOnlyTransform(content) {
+  const lines = content.split('\n');
+  const out = [];
+  let changed = false;
+  let i = 0;
+  while (i < lines.length) {
+    const open = lines[i].match(/^(\s*)```(\w+)?\s*$/);
+    out.push(lines[i]);
+    i++;
+    if (!open) continue;
+    const indent = open[1];
+    const lang = (open[2] || '').toLowerCase();
+    const closing = new RegExp('^' + escapeRegExp(indent) + '```\\s*$');
+    const body = [];
+    while (i < lines.length && !closing.test(lines[i])) body.push(lines[i++]);
+    let next = body;
+    if (GUARDED_LANGS.includes(lang)) {
+      const first = body.find((l) => l.trim() !== '');
+      next = insertZshGuard(body, first !== undefined && isLauncherLine(first) ? [first] : [], indent);
+      if (next !== body) changed = true;
+    }
+    out.push(...next);
+    if (i < lines.length) out.push(lines[i++]);
+  }
+  return changed ? out.join('\n') : null;
+}
+
+/** The roots that get only the guard pass. */
+const GUARD_ONLY_DIRS = Object.freeze(['commands', path.join('pp-core', 'references')]);
+
 function escapeRegExp(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
@@ -511,6 +605,18 @@ function main() {
     }
   }
 
+  for (const dir of GUARD_ONLY_DIRS) {
+    for (const f of collectFiles(path.join(repoRoot, dir))) {
+      const content = fs.readFileSync(f, 'utf8');
+      const result = guardOnlyTransform(content);
+      if (result !== null) {
+        fs.writeFileSync(f, result, 'utf8');
+        transformedCount++;
+        console.log(`transformed (guard): ${path.relative(repoRoot, f)}`);
+      }
+    }
+  }
+
   console.log(`\nDone. ${transformedCount} files transformed, ${unchangedCount} unchanged.`);
 }
 
@@ -523,6 +629,10 @@ module.exports = {
   replaceCanonicalLines,
   EXTRA_CARRIERS,
   LAUNCHER_HEAD,
+  ZSH_GUARD,
+  needsZshGuard,
+  guardOnlyTransform,
+  GUARD_ONLY_DIRS,
 };
 
 if (require.main === module) {