@rmyndharis/aimhooman 0.1.7 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rmyndharis/aimhooman",
-    "version": "0.1.7",
+    "version": "0.2.0",
     "description": "AI works. Hoomans ship. Keep AI session files, secrets, and attribution out of your commits.",
     "homepage": "https://github.com/rmyndharis/aimhooman#readme",
     "repository": {

package/rules/paths.json

@@ -253,7 +253,7 @@
     },
     {
         "id": "secret.private-key",
-        "version": 2,
+        "version": 3,
         "provider": "generic",
         "category": "secret",
         "confidence": "high",
@@ -274,10 +274,11 @@
             "strict": "block",
             "compliance": "block"
         },
-        "reason": "Private key material must never be committed.",
+        "reason": "A path matching a private-key filename (id_rsa, id_ed25519, *.p12, *.pfx, ...) is blocked by name — content is not inspected. If this is a real key, it must never be committed; if the name is coincidental, rename the file.",
         "remediation": [
             "git restore --staged <path>",
-            "rotate the key if it was ever exposed"
+            "if this is a real key, rotate it if it was ever exposed",
+            "if the name is coincidental (a fixture, a doc), rename the file so it no longer matches a private-key pattern"
         ]
     },
     {
@@ -391,10 +392,22 @@
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "path_case": "insensitive", "paths": [".playwright-mcp/**", "**/.playwright-mcp/**"] },
-        "actions": { "clean": "block", "strict": "block", "compliance": "block" },
+        "match": {
+            "path_case": "insensitive",
+            "paths": [
+                ".playwright-mcp/**",
+                "**/.playwright-mcp/**"
+            ]
+        },
+        "actions": {
+            "clean": "block",
+            "strict": "block",
+            "compliance": "block"
+        },
         "reason": "Playwright MCP session artifacts are local, not repository content.",
-        "remediation": ["git restore --staged <path>"]
+        "remediation": [
+            "git restore --staged <path>"
+        ]
     },
     {
         "id": "remember.state",
@@ -403,10 +416,22 @@
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "path_case": "insensitive", "paths": [".remember/**", "**/.remember/**"] },
-        "actions": { "clean": "block", "strict": "block", "compliance": "block" },
+        "match": {
+            "path_case": "insensitive",
+            "paths": [
+                ".remember/**",
+                "**/.remember/**"
+            ]
+        },
+        "actions": {
+            "clean": "block",
+            "strict": "block",
+            "compliance": "block"
+        },
         "reason": "Remember second-brain data is local, not repository content.",
-        "remediation": ["git restore --staged <path>"]
+        "remediation": [
+            "git restore --staged <path>"
+        ]
     },
     {
         "id": "superpowers.state",
@@ -415,10 +440,22 @@
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "path_case": "insensitive", "paths": [".superpowers/**", "**/.superpowers/**"] },
-        "actions": { "clean": "block", "strict": "block", "compliance": "block" },
+        "match": {
+            "path_case": "insensitive",
+            "paths": [
+                ".superpowers/**",
+                "**/.superpowers/**"
+            ]
+        },
+        "actions": {
+            "clean": "block",
+            "strict": "block",
+            "compliance": "block"
+        },
         "reason": "Superpowers plugin state is local, not repository content.",
-        "remediation": ["git restore --staged <path>"]
+        "remediation": [
+            "git restore --staged <path>"
+        ]
     },
     {
         "id": "agent.state",
@@ -427,9 +464,21 @@
         "category": "ephemeral-state",
         "confidence": "high",
         "kind": "path",
-        "match": { "path_case": "insensitive", "paths": [".agent/**", "**/.agent/**"] },
-        "actions": { "clean": "block", "strict": "block", "compliance": "block" },
+        "match": {
+            "path_case": "insensitive",
+            "paths": [
+                ".agent/**",
+                "**/.agent/**"
+            ]
+        },
+        "actions": {
+            "clean": "block",
+            "strict": "block",
+            "compliance": "block"
+        },
         "reason": "Generic agent state is local, not repository content.",
-        "remediation": ["git restore --staged <path>"]
+        "remediation": [
+            "git restore --staged <path>"
+        ]
     }
-]
+]

package/rules/secrets.json

@@ -18,7 +18,8 @@
         },
         "reason": "Private-key material must not enter Git history.",
         "remediation": [
-            "Remove the key from the index, rotate it if exposed, and store it outside the repository."
+            "Remove the key from the index, rotate it if exposed, and store it outside the repository.",
+            "If this is an intentional fixture, run: aimhooman allow <path> --scope secret-path --reason \"test fixture\"."
         ]
     },
     {
@@ -40,19 +41,20 @@
         },
         "reason": "A service-account credential must not enter Git history.",
         "remediation": [
-            "Remove the credential from the index, rotate it if exposed, and use the service's secret store."
+            "Remove the credential from the index, rotate it if exposed, and use the service's secret store.",
+            "If this is an intentional fixture, run: aimhooman allow <path> --scope secret-path --reason \"test fixture\"."
         ]
     },
     {
         "id": "secret.aws-key-content",
-        "version": 2,
+        "version": 3,
         "provider": "aws",
         "category": "secret",
         "confidence": "high",
         "kind": "code",
         "match": {
             "content": [
-                "(?i)\\baws_(?:secret_access_key|session_token)\\b\\s*[:=]\\s*[\\\"']?[A-Za-z0-9/+=]{32,}(?![A-Za-z0-9/+=])",
+                "(?i)\\baws_(?:secret_access_key|session_token)\\b\\s*[:=]\\s*[\\\"']?[A-Za-z0-9/+=]{32,}(?<!EXAMPLEKEY)(?![A-Za-z0-9/+=])",
                 "\\b(?:AKIA|ASIA)(?![A-Z0-9]{9}EXAMPLE\\b)[A-Z0-9]{16}\\b"
             ]
         },
@@ -63,7 +65,8 @@
         },
         "reason": "AWS credential material must not enter Git history.",
         "remediation": [
-            "Remove the credential from the index, rotate it if exposed, and use an AWS credential provider."
+            "Remove the credential from the index, rotate it if exposed, and use an AWS credential provider.",
+            "If this is an intentional fixture, run: aimhooman allow <path> --scope secret-path --reason \"test fixture\"."
         ]
     },
     {
@@ -86,7 +89,8 @@
         },
         "reason": "A provider access token must not enter Git history.",
         "remediation": [
-            "Remove the token from the index, revoke or rotate it, and use the provider's secret store."
+            "Remove the token from the index, revoke or rotate it, and use the provider's secret store.",
+            "If this is an intentional fixture, run: aimhooman allow <path> --scope secret-path --reason \"test fixture\"."
         ]
     }
-]
+]

package/src/exclude.mjs

@@ -74,6 +74,20 @@ export function inspectExclude(file, patterns) {
     return { installed: true, current: missing.length === 0 && actual.size === patterns.length, missing };
 }
 
+// managedPatterns returns the pattern lines currently inside the managed
+// block, or [] when the file or block is absent. Read-only.
+export function managedPatterns(file) {
+    const existing = readExclude(file, null);
+    if (existing === null) return [];
+    const range = managedRange(existing);
+    if (!range) return [];
+    return existing
+        .slice(range.start + BEGIN.length, range.end)
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith('#') && !line.startsWith('!'));
+}
+
 function stripBlock(s) {
     const range = managedRange(s);
     if (!range) return s;

package/src/githooks.mjs

@@ -43,14 +43,25 @@ function hooksDir(repo) {
     // Inside the worktree is not the same as ours. A hooks directory Git tracks
     // (husky, the vanilla .githooks pattern) is repository content: a dispatcher
     // written there stages this machine's absolute CLI, Node, and PATH for
-    // everyone who clones.
-    const tracked = inside && trackedPath(repo, dir);
+    // everyone who clones. An UNTRACKED hooks directory inside the worktree
+    // (a freshly created `.husky` before the first commit, a team-local
+    // `.team-hooks`) is repository content in waiting: the next `git add`
+    // stages it, carrying the same machine-local paths into history. Treat both
+    // as repository content so neither receives a dispatcher — UNLESS the team
+    // has explicitly excluded the path (.gitignore or .git/info/exclude), which
+    // is the opt-in that says "this hooks dir stays local". A hooks path inside
+    // `.git/` (the default, or a custom one) is local Git plumbing and is safe
+    // to install into regardless.
+    const worktreeContent = inside && !insideGitDir(repo, dir) && !gitIgnored(repo, dir);
+    const trackedByGit = inside && trackedPath(repo, dir);
+    const tracked = trackedByGit || worktreeContent;
     const repositoryOwned = inside && !tracked;
     const shared = !repositoryOwned || resolve(dir) === resolve(globalHooksDir());
     if (shared) {
         const where = scope ? `${scope} scope` : 'a non-local scope';
         let reason = where;
-        if (tracked) reason = `${where}, tracked by this repository`;
+        if (trackedByGit) reason = `${where}, tracked by this repository`;
+        else if (worktreeContent) reason = `${where}, inside the worktree so Git will track it on the next add (add it to .gitignore or .git/info/exclude to manage it locally)`;
         else if (localScope && !inside) reason = `${where}, outside this repository`;
         return {
             dir,
@@ -106,10 +117,34 @@ function trackedPath(repo, path) {
     }
 }
 
+// gitIgnored reports whether Git would ignore path (via .gitignore,
+// .git/info/exclude, or core.excludesfile). This is the opt-in that lets a team
+// keep a worktree hooks dir local: an excluded path will not be staged by the
+// next `git add`, so a dispatcher written there cannot leak machine-local
+// absolute paths into history. Used to decide whether a worktree hooksPath is
+// repository content in waiting (refuse) or intentionally local (install). A
+// Git that cannot answer counts as NOT ignored, so we fail closed and refuse
+// (the safer side for a leak that writes machine paths into shared history).
+function gitIgnored(repo, path) {
+    try {
+        execFileSync(
+            'git',
+            ['check-ignore', '--quiet', '--', String(path)],
+            { cwd: repo.root, encoding: 'utf8', timeout: GIT_TIMEOUT_MS },
+        );
+        // git check-ignore exits 0 when the path IS ignored, 1 when it is not.
+        return true;
+    } catch (error) {
+        // Non-zero exit means "not ignored" (exit 1) or "git failed". Either way,
+        // treat as not-ignored so the worktree-content guard stays on.
+        return false;
+    }
+}
+
 function canonicalPath(path) {
     let current = resolve(path);
     const tail = [];
-    for (;;) {
+    for (; ;) {
         try {
             return resolve(realpathSync(current), ...tail);
         } catch (error) {
@@ -616,6 +651,12 @@ function hookScript(name, cmd, cliPath, chainedPath) {
     const shellPathValue = hookPathForShell(pathValue);
     const nodeMetadata = Buffer.from(nodePath, 'utf8').toString('base64url');
     const pathMetadata = Buffer.from(pathValue, 'utf8').toString('base64url');
+    // chainedPath is <stateDir>/chained/<name> for a repository install and
+    // <globalHooksDir>/chained/<name> for a global one, so its grandparent is
+    // always per-install state. The compile cache lives there rather than in a
+    // shared or temp location: no other repository can pollute it, and
+    // `uninstall --purge-state` removes it along with the rest of the state.
+    const compileCacheDir = join(dirname(dirname(String(chainedPath))), 'compile-cache');
     const captureTree = name === 'commit-msg'
         ? `AIMHOOMAN_COMMIT_TREE=$(PATH="$AIMHOOMAN_PATH" git write-tree) || {
   echo "aimhooman: cannot snapshot the would-be commit tree" >&2
@@ -631,9 +672,19 @@ function hookScript(name, cmd, cliPath, chainedPath) {
 ) || exit $?
 `
         : '';
+    // The chained predecessor is sourced in a subshell, not exec'd. Git runs the
+    // dispatcher with $0 set to the original hook path (the dispatcher replaced
+    // it in place), and a subshell inherits $0, so sourcing lets the predecessor
+    // see the original $0 and resolve $(dirname "$0") to its real directory —
+    // the pattern husky and vanilla .githooks hooks use to find sibling scripts.
+    // Exec'ing "$CHAINED" would set the predecessor's $0 to the backup path and
+    // break that resolution. Sourcing runs the predecessor in this dispatcher's
+    // shell (/bin/sh -p), so its shebang is honoured only for sh-compatible
+    // scripts; bash-only predecessors are out of scope. exit inside the
+    // predecessor exits the subshell and propagates via || exit $?.
     const chainedInvocation = name === 'reference-transaction'
-        ? `  printf '%s\\n' "$AIMHOOMAN_REF_UPDATES" | "$CHAINED" "$@" || exit $?`
-        : `  "$CHAINED" "$@" || exit $?`;
+        ? `  printf '%s\\n' "$AIMHOOMAN_REF_UPDATES" | ( . "$CHAINED" ) || exit $?`
+        : `  ( . "$CHAINED" ) || exit $?`;
     const aimCommand = name === 'commit-msg'
         ? 'commitmsg "$1" --tree "$AIMHOOMAN_COMMIT_TREE"'
         : name === 'reference-transaction'
@@ -645,10 +696,31 @@ function hookScript(name, cmd, cliPath, chainedPath) {
     // committed/aborted fire only after refs are locked in, and refcheck can do
     // nothing but return 0 for them (see cmdRefcheck). Short-circuit in the shell
     // so an ordinary commit no longer pays a Node cold start for the committed
-    // phase. Placed after the chained-hook call, so a chained hook still sees
-    // every phase.
+    // phase. The prepared filter goes further: a transaction that moves neither
+    // a branch nor HEAD (ORIG_HEAD, tags, remote-tracking refs) carries nothing
+    // refcheck scans, so it never spawns at all — but only after proving the
+    // guard is still there to skip. A hook manager that wipes the dispatchers
+    // during a branch-free operation (tag, fetch, stash) would otherwise go
+    // unnoticed, because after a full wipe no later hook exists to raise the
+    // alarm. Presence is exactly what a deletion removes; content integrity
+    // keeps running on every branch transaction via refcheck. Both sit after
+    // the chained-hook call, so a chained hook still sees every phase.
     const phaseShortCircuit = name === 'reference-transaction'
-        ? 'case "$1" in committed|aborted) exit 0 ;; esac\n'
+        ? `case "$1" in committed|aborted) exit 0 ;; esac
+case "$1" in prepared)
+  case "$AIMHOOMAN_REF_UPDATES" in
+    *refs/heads/*|*" HEAD"*) ;;
+    *)
+      for AIMHOOMAN_GUARD in pre-commit pre-merge-commit commit-msg reference-transaction; do
+        [ -x "$(dirname "$0")/$AIMHOOMAN_GUARD" ] || {
+          echo "aimhooman: required Git guards changed while reference-transaction was running; $AIMHOOMAN_GUARD is unavailable. The operation was stopped; run 'aimhooman init' and retry." >&2
+          exit 20
+        }
+      done
+      exit 0 ;;
+  esac ;;
+esac
+`
         : '';
     const template = `#!/bin/sh -p
 ${MARKER} (${name})
@@ -661,6 +733,7 @@ ${MARKER} (${name})
 AIMHOOMAN_CLI=${shq(resolvedCliPath)}
 AIMHOOMAN_NODE=${shq(nodePath)}
 AIMHOOMAN_PATH=${shq(shellPathValue)}
+AIMHOOMAN_COMPILE_CACHE=${shq(compileCacheDir)}
 ${captureTree}${captureTransaction}run_aimhooman() {
   if [ ! -f "$AIMHOOMAN_CLI" ]; then
     echo "aimhooman: guard unavailable (aimhooman CLI is missing); allowing this operation without protection. Reinstall aimhooman or remove the managed hooks." >&2
@@ -686,8 +759,15 @@ ${captureTree}${captureTransaction}run_aimhooman() {
     unset BASH_ENV ENV CDPATH
     PATH=$AIMHOOMAN_PATH
     AIMHOOMAN_ACTIVE_HOOK=${shq(name)}
+    # A V8 compile cache shared by every hook spawn of this installation shaves
+    # the module parse/compile cost off each Node start. Node creates the
+    # directory when it can and silently disables the cache when it cannot, so
+    # an unwritable state directory degrades to the old cold start, never to a
+    # hook failure.
+    NODE_COMPILE_CACHE=$AIMHOOMAN_COMPILE_CACHE
     export PATH
     export AIMHOOMAN_ACTIVE_HOOK
+    export NODE_COMPILE_CACHE
     "$AIMHOOMAN_NODE" "$AIMHOOMAN_CLI" "$@"
   )
 }

package/src/gitx.mjs

@@ -12,7 +12,7 @@ import {
     rmSync,
     symlinkSync,
 } from 'node:fs';
-import { isAbsolute, join } from 'node:path';
+import { isAbsolute, join, resolve } from 'node:path';
 import { gitEnvironment, GIT_TIMEOUT_MS } from './git-environment.mjs';
 
 export class GitRevisionError extends Error {
@@ -99,7 +99,23 @@ function objectMetadata(repo, oids) {
 }
 
 function enrichEntries(repo, entries) {
-    const metadata = objectMetadata(repo, entries.map((entry) => entry.oid));
+    const metadata = objectMetadata(
+        repo,
+        entries.filter((entry) => entry.mode !== '160000').map((entry) => entry.oid),
+    );
+    // Gitlinks (mode 160000) pin a commit of another repository. Enrich them
+    // from the local object store when the pin happens to be there, but never
+    // let the read fail the scan: in a partial clone asking cat-file about a
+    // pin that is not local triggers a promisor fetch that aborts the whole
+    // batch ("not our ref"), surfacing as an EPIPE. A failed read leaves the
+    // mode-derived type in place with no size.
+    try {
+        const gitlinks = objectMetadata(
+            repo,
+            entries.filter((entry) => entry.mode === '160000').map((entry) => entry.oid),
+        );
+        for (const [oid, object] of gitlinks) metadata.set(oid, object);
+    } catch { /* best effort — see above */ }
     return entries.map((entry) => {
         const object = metadata.get(entry.oid) || { type: null, size: null };
         return {
@@ -146,10 +162,45 @@ function diffEntries(repo, args, renameThreshold = null) {
 
 // openRepo resolves the repository containing cwd. Throws if not a repo.
 export function openRepo(cwd = process.cwd()) {
-    const root = gitStr(['rev-parse', '--show-toplevel'], cwd);
-    const gitDir = gitStr(['rev-parse', '--absolute-git-dir'], root);
-    let commonDir = gitStr(['rev-parse', '--git-common-dir'], root);
-    if (!isAbsolute(commonDir)) commonDir = join(root, commonDir);
+    // One rev-parse invocation, not three: this runs inside every Git hook
+    // spawn, and each git subprocess costs ~13ms of the commit-time budget.
+    // The flags print in request order, one value per line.
+    const lines = gitStr(
+        ['rev-parse', '--show-toplevel', '--absolute-git-dir', '--git-common-dir'],
+        cwd,
+    ).split('\n');
+    if (lines.length !== 3) {
+        // A newline inside the repository path breaks the multi-flag output
+        // into extra lines; one flag per call is immune to that.
+        const root = gitStr(['rev-parse', '--show-toplevel'], cwd);
+        const gitDir = gitStr(['rev-parse', '--absolute-git-dir'], root);
+        let commonDir = gitStr(['rev-parse', '--git-common-dir'], root);
+        if (!isAbsolute(commonDir)) commonDir = join(root, commonDir);
+        return {
+            root,
+            gitDir,
+            commonDir,
+            stateDir: join(commonDir, 'aimhooman'),
+            excludeFile: join(commonDir, 'info', 'exclude'),
+        };
+    }
+    const [root, gitDir, commonRaw] = lines;
+    // Only --git-common-dir comes back relative, and it is relative to the cwd
+    // the command ran in, never to the toplevel. Anchor the plain-'.git' case
+    // (a main worktree from any cwd spelling) on git's own canonical root —
+    // the same spelling the three-call version produced — instead of
+    // realpath'ing through the cwd: git lengthens 8.3 names on Windows and
+    // resolves symlinked cwds on macOS, and matching it keeps one spelling
+    // per repository. Anything else (a subdir's ../.git, an uncommon layout)
+    // resolves against the invoking cwd, which is the same directory.
+    let commonDir;
+    if (isAbsolute(commonRaw)) {
+        commonDir = commonRaw;
+    } else if (commonRaw === '.git') {
+        commonDir = join(root, commonRaw);
+    } else {
+        commonDir = resolve(cwd, commonRaw);
+    }
     return {
         root,
         gitDir,
@@ -177,6 +228,27 @@ export function stagedPaths(repo) {
     ], repo.root));
 }
 
+// ignoredByPatterns lists untracked, ignored paths under the given pathspecs.
+// Passing pathspecs keeps git's directory pruning effective: a bare
+// `ls-files --others --ignored` walks the whole worktree and costs ~150ms on
+// a large one, while anchored pathspecs answer in ~15ms.
+export function ignoredByPatterns(repo, pathspecs) {
+    if (!pathspecs.length) return [];
+    return nulStrings(gitBuf([
+        'ls-files', '--others', '--ignored', '--exclude-standard', '-z', '--', ...pathspecs,
+    ], repo.root));
+}
+
+// stagedTreeSha writes the index to a tree object and returns its SHA, the same
+// value `git write-tree` produces in the commit-msg dispatcher. Used by the
+// pre-commit/commit-msg marker dedup (W5): pre-commit records this sha when it
+// scans clean, and commit-msg skips its duplicate tree scan when the sha still
+// matches. The index is unchanged between the two hooks in a normal commit, so
+// the sha is stable; any staging mutation invalidates it automatically.
+export function stagedTreeSha(repo) {
+    return gitStr(['write-tree'], repo.root);
+}
+
 // Unmerged index entries have only stages 1-3 and are omitted by the ordinary
 // cached diff. Expose their paths so callers cannot mistake a conflicted index
 // for a complete, clean staged snapshot.

package/src/hook.mjs

@@ -447,10 +447,16 @@ function hookPreToolUse(input) {
     // stdin) can hide a commit or run arbitrary commands, and there is no argv
     // to read a --no-verify out of. The earlier message reused the commit text
     // above, which told a developer to "retry the commit" for a command that
-    // was not a commit at all — this names the real shape instead.
+    // was not a commit at all — this names the real shape instead. The message
+    // is conditional on whether a pipe is actually present: opaque syntax
+    // without a pipe (a subshell, a brace group, command substitution) should
+    // not tell the developer to "drop the `| bash` segment" on a command that
+    // has no `|`.
     const opaquePipelineReason = commit
         ? unmodelledPrefixReason
-        : 'aimhooman cannot prove this pipeline is read-only: a shell or code-executing segment can hide a commit or run arbitrary commands. Drop that segment (for example the `| bash`) and run the pieces separately.';
+        : hasUnquotedPipe(executorCommand)
+            ? 'aimhooman cannot prove this pipeline is read-only: a shell or code-executing segment can hide a commit or run arbitrary commands. Drop that segment (for example the `| bash`) and run the pieces separately.'
+            : 'aimhooman cannot prove this command is read-only: it uses shell syntax (a subshell, command substitution, script-feed redirect, background job, or brace group) that can hide a commit or run arbitrary commands. Run the pieces separately.';
     const blocks = [];
     // potentialCommit treats a command as leading to a commit. uncertainShell
     // was too broad: it flagged any pipe, so a benign read-only pipeline
@@ -1961,7 +1967,18 @@ function hasUncertainShellSyntax(command) {
             quote = char;
             continue;
         }
-        if (char === '`' || char === '(' || char === ')' || char === '{' || char === '}' || char === '<' || char === '>') return true;
+        // `{`/`}` are ambiguous: brace expansion (`{a,b}`, `{owner}`, `x.{js,ts}`)
+        // is argument-level and cannot hide a commit or feed code into a pipe
+        // sink, while a brace group (`{ list; }`) is control flow and can. Brace
+        // expansion touches the surrounding word (no separator before the `{`, no
+        // space/`;` after it); a brace-group `{` stands as its own token. PowerShell
+        // `{ }` script blocks are handled separately via the non-POSIX executor
+        // path, so this POSIX distinction never loosens that.
+        if (char === '{' || char === '}') {
+            if (isBraceGroupToken(command, i)) return true;
+            continue;
+        }
+        if (char === '`' || char === '(' || char === ')' || char === '<' || char === '>') return true;
         if (char === '|' && command[i + 1] !== '|') return true;
         if (char === '&' && command[i + 1] !== '&' && command[i - 1] !== '&') return true;
     }
@@ -1971,6 +1988,57 @@ function hasUncertainShellSyntax(command) {
     });
 }
 
+// BRACE_GROUP_LEAD chars may appear immediately before a brace-group token.
+// `:` is included so `cmd: { ... }` is handled, though it is not POSIX shell.
+const BRACE_GROUP_LEAD = new Set(['', ' ', '\t', '\n', ';', '&', '|', '(', ')']);
+// BRACE_GROUP_OPEN_TRAIL chars may follow a `{` that opens a brace group: the
+// reserved word `{` must be followed by whitespace, `;`, or end of string.
+const BRACE_GROUP_OPEN_TRAIL = new Set([' ', '\t', '\n', ';', '']);
+// BRACE_GROUP_CLOSE_LEAD chars precede a `}` that closes a brace group: the
+// closer must follow `;` or whitespace (the end of the group body).
+const BRACE_GROUP_CLOSE_LEAD = new Set([' ', '\t', '\n', ';', '']);
+
+// isBraceGroupToken reports whether `{`/`}` at position i in command is a
+// POSIX brace-group token (reserved-word `{` or its closer `}`) rather than a
+// brace-expansion character. Brace expansion `{a,b}` / `{owner}` / `x.{js,ts}`
+// is argument-level and cannot feed code into a pipe sink or run a subcommand,
+// so it must not make a command "opaque". A brace group `{ list; }` is
+// control flow and can, so it stays opaque. PowerShell script blocks are
+// handled by the non-POSIX executor path, not here.
+function isBraceGroupToken(command, i) {
+    const char = command[i];
+    const prev = command[i - 1] ?? '';
+    const next = command[i + 1] ?? '';
+    if (char === '{') {
+        if (!BRACE_GROUP_LEAD.has(prev)) return false;
+        if (!BRACE_GROUP_OPEN_TRAIL.has(next)) return false;
+        return true;
+    }
+    // `}` closer: must follow `;` or whitespace.
+    return BRACE_GROUP_CLOSE_LEAD.has(prev);
+}
+
+// hasUnquotedPipe reports whether command contains a pipe `|` that is not
+// `||`, outside of any quote. Used to decide whether the opaque-pipeline deny
+// message should mention a pipe at all — the original message always named
+// `| bash` even for commands with no pipe.
+function hasUnquotedPipe(command) {
+    let quote = '';
+    let escaped = false;
+    for (let i = 0; i < command.length; i += 1) {
+        const char = command[i];
+        if (escaped) { escaped = false; continue; }
+        if (char === '\\' && quote !== "'") { escaped = true; continue; }
+        if (quote) {
+            if (char === quote) quote = '';
+            continue;
+        }
+        if (char === "'" || char === '"') { quote = char; continue; }
+        if (char === '|' && command[i + 1] !== '|') return true;
+    }
+    return false;
+}
+
 function shellUnits(s) {
     const out = [];
     let segment = '';
@@ -2146,7 +2214,14 @@ function containsOpaquePipeLexeme(command) {
             continue;
         }
         if (char === "'" || char === '"') { quote = char; continue; }
-        if (char === '`' || char === '(' || char === ')' || char === '{' || char === '}') return true;
+        // Brace expansion (`{a,b}`, `{owner}`) is not opaque: it only expands to
+        // arguments for the same command and cannot feed code into a pipe sink.
+        // Brace groups (`{ list; }`) are opaque. See isBraceGroupToken.
+        if (char === '{' || char === '}') {
+            if (isBraceGroupToken(command, i)) return true;
+            continue;
+        }
+        if (char === '`' || char === '(' || char === ')') return true;
         if (char === '$' && (next === '(' || next === '{')) return true;
         if (char === '<' || char === ';') return true;
         if (char === '&' && next !== '&' && prev !== '&' && prev !== '>' && prev !== '<') return true;