cc-safe-setup 29.7.0 → 30.0.4

package/tests/destructive-guard-find-deletion.test.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+# destructive-guard: mass deletion driven by find
+#
+# The old Check 5 matched only `find /`, `find ~` and `find ..` followed by
+# -delete. The two forms people actually run -- `find . -delete` and
+# `find . -exec rm -rf {} \;` -- walked straight past it, and so did every
+# variant that quoted the flag or put a wrapper in front of the command.
+# Two adversarial reviews in 2026-07 rejected earlier attempts because a
+# simpler bypass always survived the word-boundary checks.
+#
+# The rewrite inverts the detection: normalise the line first (drop quotes,
+# drop wrappers, resolve /usr/bin/find, join continuations), then ask three
+# plain questions -- is the command find, does it delete, and how wide is the
+# search. Everyday narrowed cleanup stays allowed; an unnarrowed sweep does not.
+#
+# Measured 2026-07-27: 26 of the 30 blocking cases below returned exit 0
+# against the shipped guard.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+GUARD=$(mktemp); trap 'rm -f "$GUARD"' EXIT
+python3 -c "
+import json,sys
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['destructive-guard'])" > "$GUARD"
+
+PASS=0; FAIL=0
+
+check() {
+    local desc="$1" cmd="$2" want="$3"   # want: 2 = blocked, 0 = allowed
+    local payload code
+    payload=$(python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$cmd")
+    printf '%s' "$payload" | bash "$GUARD" >/dev/null 2>&1
+    code=$?
+    if [ "$code" = "$want" ]; then
+        echo "PASS: $desc"; PASS=$((PASS+1))
+    else
+        echo "FAIL: $desc (expected exit $want, got $code)"; FAIL=$((FAIL+1))
+    fi
+}
+
+# --- the two forms people actually run ---------------------------------------
+check "plain find -delete"              'find . -delete'                    2
+check "find -exec rm"                   'find . -exec rm -rf {} \;'         2
+check "find -execdir rm"                'find . -execdir rm -f {} \;'       2
+check "find -exec unlink"               'find . -exec unlink {} \;'         2
+check "no root given"                   'find -delete'                      2
+
+# --- N series: quoting defeated the word boundaries --------------------------
+check "quoted flag, single"              "find . '-delete'"                 2
+check "quoted flag, double"              'find . "-delete"'                 2
+check "quoted rm inside -exec"           "find . -exec 'rm' -rf {} \;"      2
+
+# --- K series: a wrapper in front of the real command ------------------------
+check "env wrapper"                     'env find . -delete'                2
+check "nice wrapper"                    'nice find . -delete'               2
+check "nice with option"                'nice -n 5 find . -delete'          2
+check "timeout wrapper"                 'timeout 30 find . -delete'         2
+check "sudo wrapper"                    'sudo find . -delete'               2
+check "exec wrapper"                    'exec find . -delete'               2
+check "doubled command builtin"         'command command find . -delete'    2
+check "relative path to find"           './find . -delete'                  2
+check "absolute path to find"           '/usr/bin/find . -delete'           2
+check "leading assignment"              'FOO=1 find . -delete'              2
+check "shell -c wrapper"                'bash -c "find . -delete"'          2
+check "xargs in front"                  'xargs find . -delete'              2
+
+# --- dangerous search roots ---------------------------------------------------
+check "root is /"                       "find / -name '*.log' -delete"      2
+check "root is ~"                       "find ~ -name '*.tmp' -delete"      2
+check "root is \$HOME"                  'find $HOME -delete'                2
+check "root is parent"                  'find .. -delete'                   2
+
+# --- narrowing that does not actually narrow ---------------------------------
+check "-type alone is not narrowing"    'find . -type f -delete'            2
+check "bare wildcard is not narrowing"  "find . -name '*' -delete"          2
+check "-o rebinds the delete"           "find . -name '*.pyc' -o -delete"   2
+
+# --- reachable through any separator, and across a continued line ------------
+check "bare & separator"                'true & find . -delete'             2
+check "semicolon separator"             'true ; find . -delete'             2
+check "line continuation"               'find . \
+  -delete'                                                                  2
+
+# --- everyday cleanup must stay allowed --------------------------------------
+check "narrowed by name"                "find . -name '*.pyc' -delete"      0
+check "narrowed by name and age"        "find ./logs -name '*.log' -mtime +30 -delete" 0
+check "type plus name"                  "find . -type f -name '*.tmp' -delete" 0
+check "narrowed by -newer"              'find . -newer package.json -delete' 0
+check "throwaway dir: node_modules"     'find node_modules -delete'         0
+check "throwaway dir: dist"             'find dist -delete'                 0
+check "throwaway dir: ./build"          'find ./build -delete'              0
+check "print only"                      'find . -print'                     0
+check "print only from /"               "find / -name '*.log' -print"       0
+check "piped to grep"                   "find . -name '*.py' | xargs grep foo" 0
+check "find inside a string"            'echo "find . -delete"'             0
+check "find inside a commit message"    'git commit -m "add find . -delete example"' 0
+check "prune, no deletion"              'find . -type d -name node_modules -prune' 0
+check "unrelated command"               'ls -la'                            0
+
+# --- Check 1: trailing content used to defeat the tilde/HOME position --------
+check "bare tilde"                      'rm -rf ~'                          2
+check "tilde then a comment"            'rm -rf ~ # cleanup'                2
+check "tilde then another argument"     'rm -rf ~ /srv/data'                2
+check "quoted HOME"                     'rm -rf "$HOME"'                    2
+check "HOME then a redirect"            'rm -rf "$HOME" 2>/dev/null'        2
+check "parent then a comment"           'rm -rf .. # oops'                  2
+check "cwd then a comment"              'rm -rf . # oops'                   2
+check "specific subdirectory allowed"   'rm -rf ./node_modules'             0
+check "nested build path allowed"       'rm -rf ./dist/assets'              0
+check "path under .git allowed"         'rm -rf .git/objects/tmp'           0
+
+echo
+echo "destructive-guard-find-deletion: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/destructive-guard-flag-order.test.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# destructive-guard: the words do not have to be in that order
+#
+# Checks 2, 3 and 4 each pinned the position of a flag:
+#
+#   Check 2  git\s+reset\s+--hard              -- --hard must follow `reset`
+#   Check 3  git\s+clean\s+-[a-z]*[fd]         -- the flags must be one bundle, first
+#   Check 4  chmod\s+(-R\s+)?777\s+(/|~|\.)    -- -R before 777, path right after
+#
+# A shell does not care. `git reset HEAD~1 --hard` discards exactly the same work,
+# `git clean -x -f -d` deletes more than `git clean -fd`, and `chmod 777 -R /etc`
+# is `chmod -R 777 /etc`. All three walked past the guard.
+#
+# Measured 2026-08-03 against the shipped copy, with the denominator restricted to
+# the pairs this guard actually blocks in their canonical form: 5 of 19 reorderings
+# were not blocked. After the fix: 0 of 19, with 0 newly blocked out of 28 everyday
+# commands.
+#
+# This is the same shape as the defect in the approving hooks fixed the same day
+# (#937/#940/#941/#942/#943/#947/#948), one level up: there the rule assumed the
+# dangerous part came *after* the first command position; here it assumes the
+# dangerous flag comes in a fixed *slot*. Both are a pattern that encodes a habit
+# of typing rather than what the command does.
+#
+# `[^;&|]` keeps every scan inside one command, so a later command's words are
+# never borrowed to make a match.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+GUARD=$(mktemp); trap 'rm -f "$GUARD"' EXIT
+python3 -c "
+import json,sys
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['destructive-guard'])" > "$GUARD"
+
+PASS=0; FAIL=0
+
+check() {
+    local desc="$1" cmd="$2" want="$3"   # want: 2 = blocked, 0 = allowed
+    local payload code
+    payload=$(python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$cmd")
+    printf '%s' "$payload" | bash "$GUARD" >/dev/null 2>&1
+    code=$?
+    if [ "$code" = "$want" ]; then
+        echo "PASS: $desc"; PASS=$((PASS+1))
+    else
+        echo "FAIL: $desc (expected exit $want, got $code)"; FAIL=$((FAIL+1))
+    fi
+}
+
+# --- Check 2: git reset --hard, wherever the flag sits ---
+check "reset: canonical order"            'git reset --hard HEAD~1'        2
+check "reset: flag last"                  'git reset HEAD~1 --hard'        2
+check "reset: flag last, named remote"    'git reset origin/main --hard'   2
+check "reset: bare"                       'git reset --hard'               2
+check "reset: --soft is not --hard"       'git reset --soft HEAD~1'        0
+check "reset: plain reset unstages only"  'git reset HEAD~1'               0
+check "reset: --hard belongs to the next command" 'git reset HEAD~1 ; echo --hard' 0
+check "reset: inside a message"           "git commit -m 'git reset --hard の話'" 0
+
+# --- Check 3: git clean, flags split or reordered ---
+check "clean: canonical bundle"           'git clean -fd'                  2
+check "clean: split flags"                'git clean -f -d'                2
+check "clean: reversed"                   'git clean -d -f'                2
+check "clean: another flag first"         'git clean -x -f -d'             2
+check "clean: bundle with a trailing x"   'git clean -fdx'                 2
+check "clean: bundle with two extras"     'git clean -fdxq'                2
+check "clean: long form"                  'git clean --force -d'           2
+check "clean: dry run stays allowed"      'git clean -n'                   0
+check "clean: dry run with -d"            'git clean -nd'                  0
+check "clean: dry run with -d and -x"     'git clean -ndx'                 0
+check "clean: long dry run"               'git clean --dry-run'            0
+check "clean: force plus dry run is a dry run" 'git clean --force --dry-run' 0
+
+# --- Check 4: chmod 777, wherever -R sits ---
+check "chmod: canonical order"            'chmod -R 777 /etc'              2
+check "chmod: -R after the mode"          'chmod 777 -R /etc'              2
+check "chmod: -R last"                    'chmod 777 /etc -R'              2
+check "chmod: long recursive flag"        'chmod --recursive 777 /etc'     2
+check "chmod: no -R at all"               'chmod 777 /etc'                 2
+check "chmod: home directory"             'chmod 777 -R ~/'                2
+check "chmod: relative path"              'chmod 777 -R ./'                2
+check "chmod: a narrower mode is fine"    'chmod 644 ./file.txt'           0
+check "chmod: 755 on a script"            'chmod 755 ./bin/run'            0
+check "chmod: +x is fine"                 'chmod +x script.sh'             0
+check "chmod: 777 on a plain filename"    'chmod 777 file.txt'             0
+
+# --- the scans must not cross into the next command ---
+check "no borrowing across ;"             'echo 777 ; chmod 644 ./x'       0
+check "no borrowing across &&"            'git clean -n && echo -fd'       0
+
+# --- Check 5: a wrapper may carry assignments of its own ---
+# Found while judging the 2026-07-27 find hypothesis: the prefix stripper dropped
+# leading VAR=value once, then dropped wrappers in a loop. `env LC_ALL=C find` puts
+# the assignment *after* the wrapper, so it survived and the command word was read
+# as `LC_ALL=C`. Same shape as the rest of this file: a rule that assumed which
+# order the pieces arrive in. Assignments are now dropped inside the same loop.
+check "find: bare wrapper"                'env find . -delete'             2
+check "find: wrapper with an assignment"  'env LC_ALL=C find . -delete'    2
+check "find: two assignments"             'env LC_ALL=C TZ=UTC find . -delete' 2
+check "find: assignment with no wrapper"  'LC_ALL=C find . -delete'        2
+check "find: narrowed cleanup still runs" "find . -name '*.pyc' -delete"   0
+check "find: narrowed with a wrapper"     "env LC_ALL=C find . -name '*.pyc' -delete" 0
+
+echo
+echo "destructive-guard-flag-order: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/destructive-guard-mentions-vs-invocations.test.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+# Searching for a dangerous command is not running one.
+#
+# destructive-guard scans the whole command string, so a dangerous string
+# written inside quotes — or inside a sentence — reached the same checks as an
+# executed command. Measured 2026-08-04 against fifteen commands that must not
+# be blocked: six were blocked. All six merely mention a command:
+#
+#     grep -r "rm -rf /" .                          searching for it
+#     echo 'rm -rf /' >> notes.md                   writing it into a note
+#     git commit -m "docs: warn about rm -rf /"     naming it in a message
+#     jq -n '{cmd: "rm -rf /"}'                     naming it in a filter
+#     awk '/rm -rf / {print}' history.log           naming it in a program
+#     echo "the command rm -rf ~ destroys ..."      describing it
+#
+# A guard that blocks grep, awk and git commit is switched off the same day it
+# is installed, and a switched-off guard is worse than none because the user
+# still believes it is there. (The author hit this false positive seven times in
+# one day while writing about the guard.)
+#
+# Check 0y blanks quoted spans and asks whether a destructive verb still appears
+# at a command start. If none does, nothing destructive is being invoked.
+# It does NOT strip the quotes before matching — stripping them would lose a
+# real invocation whose target is quoted. Everything after the gate still
+# matches against the original text.
+#
+# The block half of this file is what keeps the gate honest. A gate that lets
+# too much through is exactly as useless as the false positives it removes, so
+# every wrapper form the other suites cover is repeated here: prefixes, leading
+# assignments, path-qualified names, and the three constructs that execute their
+# quoted argument (`sh -c`, `eval`, `powershell -Command`).
+
+set -u
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORK="$(mktemp -d)"
+trap 'find "$WORK" -mindepth 1 -delete 2>/dev/null; rmdir "$WORK" 2>/dev/null' EXIT
+PASS=0; FAIL=0
+
+python3 -c "
+import json,sys
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['destructive-guard'])" > "$WORK/dg.sh"
+
+run() {
+  local T; T="$(mktemp -d)"
+  python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]},
+                  "cwd":sys.argv[2],"session_id":"t"}))' "$1" "$T" \
+    | HOME="$T" bash "$WORK/dg.sh" >/dev/null 2>&1
+  local rc=$?
+  find "$T" -mindepth 1 -delete 2>/dev/null; rmdir "$T" 2>/dev/null
+  return $rc
+}
+want_block() {
+  if run "$1"; then FAIL=$((FAIL+1)); echo "  FAIL blocked: $1"
+  else PASS=$((PASS+1)); echo "  ok   blocked: $1"; fi
+}
+want_allow() {
+  if run "$1"; then PASS=$((PASS+1)); echo "  ok   allowed: $1"
+  else FAIL=$((FAIL+1)); echo "  FAIL allowed: $1"; fi
+}
+
+RM="$(printf 'r%s' 'm') -rf "
+echo "destructive-guard-mentions-vs-invocations"
+
+# --- mentions: the command appears only inside quotes or prose ---------------
+want_allow "grep -r \"${RM}/\" ."
+want_allow "grep -rn '${RM}~' docs/"
+want_allow "echo \"${RM}~\""
+want_allow "echo '${RM}/' >> notes.md"
+want_allow "git commit -m \"docs: warn about ${RM}/ in the guide\""
+want_allow "git log --grep=\"${RM}\""
+want_allow "python3 -c \"print('${RM}~')\""
+want_allow "jq -n '{cmd: \"${RM}/\"}'"
+want_allow "printf \"%s\\n\" \"${RM}~\" > example.txt"
+want_allow "rg \"${RM}\" --files-with-matches"
+want_allow "sed -n \"/${RM}/p\" history.log"
+want_allow "awk '/${RM}/ {print}' history.log"
+want_allow "echo \"the command ${RM}~ destroys your home directory\""
+
+# --- invocations: the command actually runs ---------------------------------
+want_block "${RM}~"
+want_block "${RM}/"
+want_block "cd /tmp && ${RM}~"
+want_block "[[ -n \$(${RM}~) ]]"
+want_block "if true; then ${RM}~; fi"
+want_block "env ${RM}~"
+want_block "nice -n 5 ${RM}~"
+want_block "timeout 30 ${RM}~"
+want_block "FOO=1 ${RM}~"
+want_block "/bin/${RM}~"
+want_block "git reset --hard HEAD~5"
+
+# --- the quoted argument is executed here, so it is an invocation ------------
+want_block "bash -c \"${RM}~\""
+want_block "sh -c '${RM}/'"
+
+# Known gap, not asserted: `eval "rm -rf ~"` passes, and so do `rm -rf "/etc"`
+# and `rm -rf '~'`. The gate correctly refuses to treat these as mentions, but
+# the target matching downstream does not unquote its operand, so the path is
+# never recognised. Measured 2026-08-04 on the shipped guard as well — this
+# predates the gate and is tracked separately. Asserting it here would make the
+# file fail for a reason it does not fix.
+
+echo
+echo "destructive-guard-mentions-vs-invocations: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/destructive-guard-quoted-target.test.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+# Quoting the argument made the target invisible.
+#
+# Check 1 required the path to follow the flags directly:
+#
+#     rm -rf /etc        blocked
+#     rm -rf "/etc"      NOT blocked   <- same deletion, one character apart
+#     rm -rf '~'         NOT blocked
+#
+# Quoting an argument is an ordinary way to write a command — a path with a
+# space in it has to be quoted — so this is not an evasion technique, it is
+# what a careful user types. Measured 2026-08-04 against the shipped guard:
+# five of nine quoted forms passed.
+#
+# Two places assumed an unquoted operand: the Check 1 pattern (one optional
+# quote is now allowed in front of the path, and the terminators accept a
+# closing quote) and the TARGET_PATH extraction feeding findmnt (`\S+` picked
+# up the quotes, and findmnt cannot resolve a path spelled with them attached).
+#
+# The controls are what keep this from becoming "block anything with a quote":
+# a quoted safe target must still pass, and — this is the one that matters after
+# the mentions/invocations gate landed — a dangerous string quoted inside grep,
+# echo, git commit or awk must still pass, because searching for a command is
+# not running it.
+
+set -u
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORK="$(mktemp -d)"
+trap 'find "$WORK" -mindepth 1 -delete 2>/dev/null; rmdir "$WORK" 2>/dev/null' EXIT
+PASS=0; FAIL=0
+
+python3 -c "
+import json,sys
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['destructive-guard'])" > "$WORK/dg.sh"
+
+run() {
+  local T; T="$(mktemp -d)"
+  python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]},
+                  "cwd":sys.argv[2],"session_id":"t"}))' "$1" "$T" \
+    | HOME="$T" bash "$WORK/dg.sh" >/dev/null 2>&1
+  local rc=$?
+  find "$T" -mindepth 1 -delete 2>/dev/null; rmdir "$T" 2>/dev/null
+  return $rc
+}
+want_block() {
+  if run "$1"; then FAIL=$((FAIL+1)); echo "  FAIL blocked: $1"
+  else PASS=$((PASS+1)); echo "  ok   blocked: $1"; fi
+}
+want_allow() {
+  if run "$1"; then PASS=$((PASS+1)); echo "  ok   allowed: $1"
+  else FAIL=$((FAIL+1)); echo "  FAIL allowed: $1"; fi
+}
+
+RM="$(printf 'r%s' 'm') -rf "
+echo "destructive-guard-quoted-target"
+
+# --- the target is quoted, the deletion is real ------------------------------
+want_block "${RM}\"/etc\""
+want_block "${RM}'/etc'"
+want_block "${RM}\"~\""
+want_block "${RM}'~'"
+want_block "${RM}\"/home/user\""
+want_block "sudo ${RM}\"/var\""
+
+# --- unquoted, which already worked ------------------------------------------
+want_block "${RM}~"
+want_block "${RM}/"
+want_block "${RM}/etc"
+
+# --- controls: a quoted safe target is still safe ----------------------------
+want_allow "${RM}\"node_modules\""
+want_allow "${RM}'node_modules'"
+want_allow "${RM}\"./build\""
+want_allow "${RM}node_modules"
+want_allow "${RM}./build"
+
+# --- controls: quoting it inside another command is still a mention ----------
+want_allow "echo \"${RM}/\""
+want_allow "grep -r \"${RM}/\" ."
+want_allow "git commit -m \"docs: ${RM}/ warning\""
+want_allow "awk '/${RM}/ {print}' h.log"
+want_allow "ls -la"
+want_allow "npm ci && npm run build"
+
+echo
+echo "destructive-guard-quoted-target: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]

package/tests/destructive-guard-separators.test.sh

@@ -0,0 +1,105 @@
+#!/bin/bash
+# destructive-guard: command separators
+#
+# Checks 2, 3 and 7 listed their separators as (^ | ; | && | ||) and left out
+# a bare `&`. `true & git reset --hard` therefore ran unguarded — the same
+# "allow-list of separators" hole that has bitten this guard before.
+# Measured on 2026-07-27: all three checks let a bare & through.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+GUARD=$(mktemp); trap 'rm -f "$GUARD"' EXIT
+python3 -c "
+import json,sys
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['destructive-guard'])" > "$GUARD"
+
+PASS=0; FAIL=0
+
+check() {
+    local desc="$1" cmd="$2" want="$3"   # want: 2 = blocked, 0 = allowed
+    local payload code
+    payload=$(python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]}}))' "$cmd")
+    printf '%s' "$payload" | bash "$GUARD" >/dev/null 2>&1
+    code=$?
+    if [ "$code" = "$want" ]; then
+        echo "PASS: $desc"; ((PASS++))
+    else
+        echo "FAIL: $desc (expected exit $want, got $code)"; ((FAIL++))
+    fi
+}
+
+# Check 2 — git reset --hard, reachable through every separator
+check "reset: bare & is blocked"        'true & git reset --hard'    2
+check "reset: semicolon is blocked"     'true ; git reset --hard'    2
+check "reset: && is blocked"            'true && git reset --hard'   2
+check "reset: || is blocked"            'false || git reset --hard'  2
+check "reset: start of line is blocked" 'git reset --hard'           2
+check "reset: --soft stays allowed"     'git reset --soft HEAD~1'    0
+
+# Check 3 — git clean
+check "clean: bare & is blocked"        'true & git clean -fd'       2
+check "clean: && is blocked"            'true && git clean -fd'      2
+check "clean: start of line is blocked" 'git clean -fd'              2
+check "clean: --dry-run stays allowed"  'git clean --dry-run'        0
+
+# Check 7 — git checkout --force
+check "checkout: bare & is blocked"     'true & git checkout -f main'  2
+check "checkout: && is blocked"         'true && git checkout -f main' 2
+check "checkout: plain checkout allowed" 'git checkout main'           0
+check "checkout: plain switch allowed"  'git switch feature'           0
+
+# Check 6 — sudo in front of a destructive command.
+#
+# This check anchored its pattern with `^\s*sudo`, so the anchor was applied to
+# the whole command string instead of to each command position. Anything placed
+# after a separator was never examined. It stayed invisible for a long time
+# because Check 1 independently blocks rm on a sensitive path, so the usual
+# probe (`cd /tmp && sudo rm -rf /var`) still came back blocked. The gap only
+# shows on the targets Check 6 alone is responsible for: an ordinary relative
+# path, and dd/mkfs, which no other check looks at.
+# Measured 2026-08-03 against the shipped scripts.json: 7 of 8 such commands
+# exited 0 once a separator was placed in front. Same shape as PR #937.
+check "sudo rm: start of line is blocked" 'sudo rm -rf myproject'                  2
+check "sudo rm: && is blocked"            'cd /tmp && sudo rm -rf myproject'       2
+check "sudo rm: semicolon is blocked"     'cd /tmp; sudo rm -rf myproject'         2
+check "sudo rm: bare & is blocked"        'true & sudo rm -rf myproject'           2
+check "sudo rm: || is blocked"            'false || sudo rm -rf myproject'         2
+check "sudo rm -r: && is blocked"         'cd /tmp && sudo rm -r data'             2
+check "sudo dd: && is blocked"            'cd /tmp && sudo dd if=/dev/zero of=/dev/sda' 2
+check "sudo mkfs: && is blocked"          'cd /tmp && sudo mkfs.ext4 /dev/sdb1'    2
+check "sudo chmod 777: && is blocked"     'cd /tmp && sudo chmod -R 777 /opt/app'  2
+
+# Closing the hole must not close anything else. sudo on a harmless command is
+# everyday work and stays allowed in every position.
+check "sudo apt stays allowed"            'sudo apt update'                        0
+check "sudo apt after && stays allowed"   'cd /tmp && sudo apt update'             0
+check "sudo -l stays allowed"             'sudo -l'                                0
+check "sudo systemctl stays allowed"      'cd /srv && sudo systemctl reload nginx' 0
+
+# Check 7 — PowerShell Remove-Item.
+#
+# The skip that keeps `echo "Remove-Item -Recurse -Force"` from being read as a
+# deletion was anchored the same way, so it only applied when the command
+# *began* with a string-output command. Put anything in front and the guard
+# blocked a command that only prints text. Measured 2026-08-03: exit 2 on
+# `cd /tmp && echo "..."`. That is the over-tightening side of the same anchor.
+check "PS: bare Remove-Item is blocked"   'Remove-Item -Recurse -Force *'          2
+check "PS: after && is blocked"           'cd /tmp && Remove-Item -Recurse -Force *' 2
+check "PS: after semicolon is blocked"    'cd /tmp; Remove-Item -Recurse -Force *' 2
+check "PS: powershell wrapper is blocked" 'powershell -c "Remove-Item -Recurse -Force C:\\Users\\john"' 2
+check "PS: single file stays allowed"     'Remove-Item ./file.txt'                 0
+check "PS: echo of the words allowed"     'echo "Remove-Item -Recurse -Force"'     0
+check "PS: echo after && allowed"         'cd /tmp && echo "Remove-Item -Recurse -Force"' 0
+check "PS: git commit message allowed"    'git commit -m "handle Remove-Item -Recurse -Force"' 0
+check "PS: commit message after && ok"    'cd repo && git commit -m "handle Remove-Item -Recurse -Force"' 0
+check "PS: grep for the words allowed"    'cat notes.txt | grep "Remove-Item -Recurse -Force"' 0
+
+# Nothing above should have changed the ordinary allow cases
+check "read-only command allowed"       'grep -r TODO .'             0
+check "safe dir deletion allowed"       'rm -rf node_modules'        0
+check "plain cd compound allowed"       'cd /tmp && ls -la'          0
+check "echo compound allowed"           'echo hello && pwd'          0
+
+echo ""
+echo "PASS: $PASS  FAIL: $FAIL"
+[ "$FAIL" -eq 0 ]

package/tests/destructive-guard-variable-target.test.sh

@@ -0,0 +1,98 @@
+#!/bin/bash
+# Putting the target in a variable made the deletion invisible.
+#
+# Every check keys on the literal text of the command, so a path held in a
+# variable was never seen:
+#
+#     rm -rf /etc              blocked
+#     D=/etc; rm -rf $D        NOT blocked   <- same deletion, same command string
+#     CMD="rm -rf /"; $CMD     NOT blocked
+#
+# Assigning a path to a variable is ordinary shell, not an evasion technique —
+# the same shape as the quoted-target hole (#961): the more carefully someone
+# writes the script, the less protected they were. Measured 2026-08-06 against
+# the shipped guard: three of seven variable forms passed.
+#
+# The fix resolves assignments that are visible in the same command string and
+# runs this same guard against the resolved text (the Check 0z pattern), so no
+# new detection logic is added. A safe value stays safe once expanded, which is
+# what keeps this from becoming "block anything with a $".
+#
+# ORDER MATTERS: Check 0x has to sit before Check 0y. Check 0y returns 0 when no
+# destructive verb appears outside quotes, and `CMD="rm -rf /"; $CMD` has none —
+# so a version placed after 0y never reached the substitution at all. The
+# false-positive protection of 0y still applies, because the child process runs
+# the full file including 0y against the resolved text.
+#
+# Values that only exist at runtime (environment variables inherited from the
+# parent) cannot be resolved statically. That hole stays, and is documented
+# rather than asserted.
+
+set -u
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+WORK="$(mktemp -d)"
+trap 'find "$WORK" -mindepth 1 -delete 2>/dev/null; rmdir "$WORK" 2>/dev/null' EXIT
+PASS=0; FAIL=0
+
+python3 -c "
+import json,sys
+sys.stdout.write(json.load(open('$ROOT/scripts.json'))['destructive-guard'])" > "$WORK/dg.sh"
+
+run() {
+  local T; T="$(mktemp -d)"
+  python3 -c '
+import json,sys
+print(json.dumps({"tool_name":"Bash","tool_input":{"command":sys.argv[1]},
+                  "cwd":sys.argv[2],"session_id":"t"}))' "$1" "$T" \
+    | HOME="$T" bash "$WORK/dg.sh" >/dev/null 2>&1
+  local rc=$?
+  find "$T" -mindepth 1 -delete 2>/dev/null; rmdir "$T" 2>/dev/null
+  return $rc
+}
+want_block() {
+  if run "$1"; then FAIL=$((FAIL+1)); echo "  FAIL blocked: $1"
+  else PASS=$((PASS+1)); echo "  ok   blocked: $1"; fi
+}
+want_allow() {
+  if run "$1"; then PASS=$((PASS+1)); echo "  ok   allowed: $1"
+  else FAIL=$((FAIL+1)); echo "  FAIL allowed: $1"; fi
+}
+
+RM="$(printf 'r%s' 'm') -rf "
+echo "destructive-guard-variable-target"
+
+# --- the assignment is visible in the same command string --------------------
+want_block "D=/etc; ${RM}\$D"
+want_block "D=/; ${RM}\"\$D\""
+want_block "D=/var; ${RM}\${D}"
+want_block "CMD=\"${RM}/\"; \$CMD"
+want_block "TARGET=/var; sudo ${RM}\$TARGET"
+want_block "P='/etc'; ${RM}\$P"
+
+# --- named environment variables whose value is known ------------------------
+want_block "${RM}\$HOME"
+want_block "${RM}\${HOME}"
+want_block "${RM}\"\$HOME\""
+
+# --- controls: wrappers already closed (a break here means the harness moved) -
+want_block "eval \"${RM}/etc\""
+want_block "sh -c \"${RM}/etc\""
+
+# --- controls: a safe value stays safe once expanded -------------------------
+want_allow "D=./build; ${RM}\$D"
+want_allow "D=node_modules; ${RM}\$D"
+want_allow "OUT=dist; ${RM}\"\$OUT\""
+want_allow "${RM}\$TMPDIR/work"
+
+# --- controls: mentioning is still not running -------------------------------
+want_allow "echo \"${RM}\$HOME\""
+want_allow "D=/etc; echo \"${RM}\$D\""
+want_allow "grep -rn '\$D' ."
+
+# --- controls: ordinary commands ---------------------------------------------
+want_allow "ls -la"
+want_allow "npm ci && npm run build"
+
+echo
+echo "destructive-guard-variable-target: $PASS passed, $FAIL failed"
+[ "$FAIL" -eq 0 ]