ccsniff 1.1.14 → 1.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccsniff",
-  "version": "1.1.14",
+  "version": "1.1.16",
   "description": "Watch Claude Code JSONL output files and emit structured events as a Node.js EventEmitter",
   "type": "module",
   "main": "./src/index.js",

package/src/cli.js

@@ -380,6 +380,9 @@ if (opts['git-discipline']) {
 if (opts['search-discipline']) {
   const includeSubagents = opts['include-subagents'];
   const BASH_SEARCH = /(^|[|&;]|\s)(rg|grep|find|ag|ack|fd|fgrep|egrep)\s/;
+  // A search-tool token inside a quoted string (echo/printf/node -e payloads) is text, not a shell
+  // invocation; blank quoted bodies before matching, like git-discipline strips commit-message bodies.
+  const stripQuoted = (s) => s.replace(/"(?:\\.|[^"\\])*"/g, '""').replace(/'(?:\\.|[^'\\])*'/g, "''");
   const violations = [];
   for (const ev of all) {
     if (!filter(ev)) continue;
@@ -400,11 +403,15 @@ if (opts['search-discipline']) {
       }
     } else if (name === 'Bash') {
       const cmd = ev.block?.input?.command || '';
-      if (BASH_SEARCH.test(cmd)) {
+      // A search tool fed by a pipe (`<cmd> | grep ...`) is filtering another command's stdout,
+      // not searching the codebase tree — codesearch has no equivalent for that and it is not the
+      // bypass the rule targets. Flag only a search tool that STARTS a pipeline segment (reads the
+      // tree directly), never one immediately downstream of a pipe.
+      const isTreeSearchLine = (line) => BASH_SEARCH.test(stripQuoted(line).split('|')[0]);
+      const hitLine = cmd.split('\n').find(isTreeSearchLine);
+      if (hitLine) {
         kind = 'native-search-bash';
-        // show the line that actually invokes the search tool, not line 1 (often a cd)
-        const hit = cmd.split('\n').find(l => BASH_SEARCH.test(l)) || cmd;
-        detail = hit.trim().slice(0, 120);
+        detail = (hitLine.split('|')[0]).trim().slice(0, 120);
       }
     }
     if (kind) violations.push({ ts, sid, project, kind, detail });