ccsniff 1.1.15 → 1.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccsniff",
-  "version": "1.1.15",
+  "version": "1.1.16",
   "description": "Watch Claude Code JSONL output files and emit structured events as a Node.js EventEmitter",
   "type": "module",
   "main": "./src/index.js",

package/src/cli.js

@@ -380,6 +380,9 @@ if (opts['git-discipline']) {
 if (opts['search-discipline']) {
   const includeSubagents = opts['include-subagents'];
   const BASH_SEARCH = /(^|[|&;]|\s)(rg|grep|find|ag|ack|fd|fgrep|egrep)\s/;
+  // A search-tool token inside a quoted string (echo/printf/node -e payloads) is text, not a shell
+  // invocation; blank quoted bodies before matching, like git-discipline strips commit-message bodies.
+  const stripQuoted = (s) => s.replace(/"(?:\\.|[^"\\])*"/g, '""').replace(/'(?:\\.|[^'\\])*'/g, "''");
   const violations = [];
   for (const ev of all) {
     if (!filter(ev)) continue;
@@ -404,7 +407,7 @@ if (opts['search-discipline']) {
       // not searching the codebase tree — codesearch has no equivalent for that and it is not the
       // bypass the rule targets. Flag only a search tool that STARTS a pipeline segment (reads the
       // tree directly), never one immediately downstream of a pipe.
-      const isTreeSearchLine = (line) => BASH_SEARCH.test(line.split('|')[0]);
+      const isTreeSearchLine = (line) => BASH_SEARCH.test(stripQuoted(line).split('|')[0]);
       const hitLine = cmd.split('\n').find(isTreeSearchLine);
       if (hitLine) {
         kind = 'native-search-bash';