failproofai 1.0.0-beta.7 → 1.0.0-beta.8

package/dist/worker.mjs

@@ -990,11 +990,82 @@ function blockEnvFiles(ctx) {
   }
   return allow();
 }
+function quoteAwareSegments(command) {
+  const segments = [];
+  let tokens = [];
+  let token = "";
+  let quote = null;
+  const endToken = () => {
+    if (token)
+      tokens.push(token);
+    token = "";
+  };
+  const endSegment = () => {
+    endToken();
+    if (tokens.length)
+      segments.push(tokens);
+    tokens = [];
+  };
+  for (let i = 0;i < command.length; i++) {
+    const c = command[i];
+    if (quote) {
+      if (c === "\\" && quote === '"' && i + 1 < command.length) {
+        token += command[++i];
+        continue;
+      }
+      if (c === quote) {
+        quote = null;
+        continue;
+      }
+      token += c;
+      continue;
+    }
+    if (c === "\\" && i + 1 < command.length) {
+      token += command[++i];
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (/\s/.test(c)) {
+      endToken();
+      continue;
+    }
+    if (/[;&|\n\r(){}`]/.test(c)) {
+      endSegment();
+      continue;
+    }
+    token += c;
+  }
+  endSegment();
+  return segments;
+}
+function namesElevation(command, depth = 0) {
+  for (const tokens of quoteAwareSegments(command)) {
+    let i = 0;
+    while (i < tokens.length) {
+      const token = tokens[i];
+      const base = token.slice(token.lastIndexOf("/") + 1);
+      if (base === "sudo" || base === "doas")
+        return true;
+      const isSkippable = ENV_ASSIGNMENT_RE.test(token) || token.startsWith("-") || token.startsWith(">") || token.startsWith("<") || RUNNER_OPERAND_RE.test(token) || COMMAND_PREFIX_TOKENS.has(base);
+      if (!isSkippable)
+        break;
+      if (EVAL_FLAG_RE.test(token) && depth < 3 && i + 1 < tokens.length) {
+        if (namesElevation(tokens[i + 1], depth + 1))
+          return true;
+      }
+      i++;
+    }
+  }
+  return false;
+}
 function blockSudo(ctx) {
   if (ctx.toolName !== "Bash")
     return allow();
   const cmd = getCommand(ctx).trimStart();
-  if (SUDO_RE.test(cmd) || cmd.startsWith("sudo ")) {
+  if (namesElevation(cmd)) {
     const allowPatterns = ctx.params?.allowPatterns ?? [];
     if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p)))
       return allow();
@@ -1754,7 +1825,7 @@ function registerBuiltinPolicies(enabledNames) {
     }
   }
 }
-var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, SUDO_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
+var isClaudeInternalPath, isClaudeSettingsFile, SHELL_OPERATORS, SHELL_METACHAR_RE, JWT_RE, API_KEY_PATTERNS, CONNECTION_STRING_RE, PRIVATE_KEY_RE, BEARER_TOKEN_RE, SQL_TOOL_RE, DESTRUCTIVE_SQL_RE, DELETE_NO_WHERE_RE, SQL_WHERE_RE, SCHEMA_ALTER_RE, PUBLISH_CMD_RE, ENV_PRINTENV_RE, ECHO_ENV_RE, EXPORT_RE, PS_ENV_VAR_RE, PS_CHILDITEM_ENV_RE, DOTNET_GETENV_RE, CMD_ECHO_ENV_RE, ENV_FILE_PATH_RE, ENV_CMD_RE, PS_ELEVATION_RE, RUNAS_RE, CURL_PIPE_SH_RE, SEGMENT_SEPARATORS, COMMAND_PREFIX_TOKENS, SELF_BINARY_TOKEN_RE, CONFIG_SUBCOMMAND_RE, PAUSE_FLAG_RE, ENV_ASSIGNMENT_RE, RUNNER_OPERAND_RE, PS_WEB_PIPE_RE, SHORT_FLAG_BUNDLE_RE, SAFE_FORCE_PREFIXES, SECRET_FILE_RE, SECRET_FILE_ID_RSA_RE, SECRET_FILE_CREDENTIALS_RE, GIT_COMMIT_MERGE_RE, FAILPROOFAI_CLI_RE, FAILPROOFAI_UNINSTALL_RE, GIT_AMEND_RE, GIT_STASH_DROP_RE, GIT_ADD_ALL_RE, NPM_GLOBAL_RE, YARN_GLOBAL_RE, PNPM_GLOBAL_RE, BUN_GLOBAL_RE, CARGO_INSTALL_RE, PIP_SYSTEM_RE, PKG_MANAGER_DETECTORS, NOHUP_RE, SCREEN_DETACH_RE, TMUX_DETACH_RE, DISOWN_RE, BACKGROUND_AMPERSAND_RE, KUBECTL_RE, TERRAFORM_RE, AWS_CLI_RE, GCLOUD_RE, AZ_CLI_RE, HELM_RE, GH_PIPELINE_RE, gitBranchCache, GIT_BRANCH_CACHE_MAX_ENTRIES = 500, EVAL_FLAG_RE, HOME_PREFIX_RE, RM_CMD_RE, FIND_CMD_RE, FIND_EXEC_RE, FIND_GLOBAL_OPT_RE, FIND_EXPR_START_RE, SCRATCH_ROOTS, CATASTROPHIC_DEPTH = 2, READ_LIKE_CMDS, TOOL_CALL_TRACKER_MAX_BYTES = 65536, SEGMENT_SPLIT_RE, BUILTIN_POLICIES;
 var init_builtin_policies = __esm(() => {
   init_hook_logger();
   isClaudeInternalPath = isAgentInternalPath;
@@ -1791,7 +1862,6 @@ var init_builtin_policies = __esm(() => {
   CMD_ECHO_ENV_RE = /echo\s+%[A-Za-z_]/i;
   ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
   ENV_CMD_RE = /\.env(?:\b|\s|$|\.)/;
-  SUDO_RE = /(?:^|;|&&|\|\|)\s*sudo\s/;
   PS_ELEVATION_RE = /Start-Process\s+.*-Verb\s+RunAs/i;
   RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
   CURL_PIPE_SH_RE = /(?:curl|wget)\s.*\|\s*(?:sh|bash|zsh|dash|ksh|csh|tcsh|fish|ash)\b/;
@@ -1877,6 +1947,7 @@ var init_builtin_policies = __esm(() => {
   HELM_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*helm(?:\s|$)/;
   GH_PIPELINE_RE = /(?:^|[;\n]|&&|\|\|?|&)\s*gh\s+(?:workflow\s+(?:run|enable|disable)|run\s+(?:rerun|cancel)|pr\s+merge|release\s+(?:create|delete)|cache\s+delete|secret\s+(?:set|delete))\b/;
   gitBranchCache = new Map;
+  EVAL_FLAG_RE = /^-{1,2}c$/;
   HOME_PREFIX_RE = /^(?:~[A-Za-z0-9_.-]*|\$HOME|\$\{HOME\})(?=$|\/)/;
   RM_CMD_RE = /^(?:\/\S*\/)?rm$/;
   FIND_CMD_RE = /^(?:\/\S*\/)?find$/;
@@ -2434,7 +2505,7 @@ var init_builtin_policies = __esm(() => {
 });
 
 // package.json
-var version = "1.0.0-beta.7";
+var version = "1.0.0-beta.8";
 var init_package = () => {};
 
 // src/posthog-key.ts
@@ -9993,7 +10064,7 @@ function isWorkerHookRequest(msg) {
   if (!msg || typeof msg !== "object")
     return false;
   const m = msg;
-  return m.type === "hook" && typeof m.hookEvent === "string" && typeof m.cli === "string" && typeof m.stdin === "string" && (m.cwd === undefined || typeof m.cwd === "string");
+  return m.type === "hook" && typeof m.hookEvent === "string" && typeof m.cli === "string" && typeof m.stdin === "string" && (m.cwd === undefined || m.cwd === null || typeof m.cwd === "string");
 }
 function encodeFrame(value) {
   const body = Buffer.from(JSON.stringify(value), "utf8");
@@ -10052,7 +10123,7 @@ function handleConnection(socket) {
         try {
           const result = await evaluateHookEvent(request.hookEvent, request.cli, request.stdin, {
             awaitTelemetryFlush: false,
-            fallbackCwd: request.cwd
+            fallbackCwd: request.cwd ?? undefined
           });
           socket.write(encodeFrame({
             type: "hookResult",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.0-beta.7",
+  "version": "1.0.0-beta.8",
   "description": "The easiest way to manage policies that keep your AI agents reliable, on-task, and running autonomously — for Claude Code & the Agents SDK",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -114,9 +114,9 @@
     "sharp": "0.35.0"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.7",
-    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.7",
-    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.7",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.7"
+    "@failproofai/failproofaid-linux-x64": "1.0.0-beta.8",
+    "@failproofai/failproofaid-linux-arm64": "1.0.0-beta.8",
+    "@failproofai/failproofaid-darwin-x64": "1.0.0-beta.8",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.0-beta.8"
   }
 }

package/scripts/repro-npm-install.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# Reproduce a REAL user install, in the shape that actually breaks.
+#
+#   sudo npm i -g failproofai      (global prefix owned by root)
+#   then run the CLI as a NORMAL user
+#
+# That split is the whole point. A single-user laptop where npm's prefix is
+# owned by the person running the hooks hides an entire class of bug — it is
+# how the root-owned policy-shim fail-open shipped: every hook run by a non-root
+# user hit EACCES, the policy never loaded, and the hook exited 0 ALLOWING the
+# call, while builtins kept firing so the machine looked protected.
+#
+# systemd is real here (jrei/systemd-ubuntu), so `failproofai config` installs
+# and starts the actual service rather than skipping that half.
+#
+# Usage:
+#   scripts/repro-npm-install.sh              # build, pack, drop into a shell
+#   scripts/repro-npm-install.sh --published  # install the last RELEASE instead
+# ─────────────────────────────────────────────────────────────────────────────
+set -uo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO"
+
+IMAGE=jrei/systemd-ubuntu:24.04
+NAME=fpai-repro
+USER_IN_BOX=dev
+PUBLISHED=0
+[ "${1:-}" = "--published" ] && PUBLISHED=1
+
+VERSION=$(node -p "require('$REPO/package.json').version")
+say() { printf '\n\033[1m── %s\033[0m\n' "$1"; }
+
+# ── 1. Build what a tarball would carry ──────────────────────────────────────
+if [ "$PUBLISHED" -eq 0 ]; then
+  say "Building dist + daemon"
+  [ -f dist/cli.mjs ] || bun run build
+  [ -f target/release/failproofaid ] || cargo build --release --bin failproofaid
+
+  # `dist/cli.mjs` INLINES the version at build time. `npm pack --ignore-scripts`
+  # skips the `prepare` script that would rebuild it, so bumping package.json
+  # without rebuilding packs a bundle that reports the OLD version — and you
+  # spend an afternoon testing code you did not write. A real publish never hits
+  # this (publish.yml builds, and `prepare` runs on a normal pack); this is a
+  # trap of the fast path only, which is exactly why it is checked here.
+  if ! grep -q "$VERSION" dist/cli.mjs 2>/dev/null; then
+    say "dist is stale (built for $(grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+-beta\.[0-9]\+' dist/cli.mjs | head -1)) — rebuilding"
+    bun run build
+  fi
+
+  say "Packing $VERSION"
+  rm -f failproofai-*.tgz
+  npm pack --ignore-scripts >/dev/null 2>&1
+  TARBALL="$REPO/failproofai-$VERSION.tgz"
+  [ -f "$TARBALL" ] || { echo "pack failed"; exit 1; }
+  ls -la "$TARBALL" | awk '{printf "  %s bytes  %s\n", $5, $9}'
+
+  # Belt and braces: assert what is actually IN the tarball, not what we meant
+  # to put there.
+  PACKED=$(tar -xzOf "$TARBALL" package/dist/cli.mjs 2>/dev/null \
+             | grep -o '[0-9]\+\.[0-9]\+\.[0-9]\+-beta\.[0-9]\+' | head -1)
+  if [ "$PACKED" != "$VERSION" ]; then
+    echo "  REFUSING: tarball reports '$PACKED' but package.json says '$VERSION'"
+    exit 1
+  fi
+  echo "  bundled version verified: $PACKED"
+fi
+
+# ── 2. A container with a real init ──────────────────────────────────────────
+say "Starting $IMAGE (real systemd)"
+docker rm -f "$NAME" >/dev/null 2>&1
+# --cgroupns=host + the two tmpfs mounts are REQUIRED on a cgroup v2 host
+# (anything modern). Without them systemd cannot set up its own hierarchy and
+# the container exits 255 immediately, with an empty `docker logs` — which is
+# a genuinely awful thing to debug, hence the comment.
+docker run -d --name "$NAME" --privileged --cgroupns=host \
+  --network=host \
+  -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run --tmpfs /run/lock \
+  ${TARBALL:+-v "$TARBALL":/pkg.tgz:ro} \
+  -v "$REPO/target/release/failproofaid":/opt/failproofaid:ro \
+  "$IMAGE" >/dev/null
+# Wait for systemd to finish booting, or `systemctl` answers nothing useful.
+until docker exec "$NAME" systemctl is-system-running 2>/dev/null | grep -qE 'running|degraded'; do
+  if ! docker ps --filter "name=$NAME" --format '{{.Names}}' | grep -q "$NAME"; then
+    echo "  container died during boot — cgroup v2 flags wrong for this host?"
+    docker logs "$NAME" 2>&1 | tail -5
+    exit 1
+  fi
+  sleep 1
+done
+echo "  systemd: $(docker exec "$NAME" systemctl is-system-running 2>/dev/null)"
+
+# ── 3. Node, and a NON-ROOT user to run as ───────────────────────────────────
+say "Installing Node + creating an unprivileged user"
+docker exec "$NAME" bash -lc '
+  apt-get update -qq >/dev/null 2>&1
+  apt-get install -y -qq curl ca-certificates sudo >/dev/null 2>&1
+  curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/n.sh 2>/dev/null && bash /tmp/n.sh >/dev/null 2>&1
+  apt-get install -y -qq nodejs >/dev/null 2>&1
+  node --version
+' 2>&1 | sed 's/^/  node /'
+
+docker exec "$NAME" bash -lc "
+  id $USER_IN_BOX >/dev/null 2>&1 || useradd -m -s /bin/bash $USER_IN_BOX
+  # Passwordless sudo: the daemon install needs root, and we are testing the
+  # INSTALL, not whether a human can type a password.
+  echo '$USER_IN_BOX ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/$USER_IN_BOX
+  chmod 440 /etc/sudoers.d/$USER_IN_BOX
+"
+
+# ── 4. Install globally AS ROOT — the shape that exposes ownership bugs ──────
+say "npm install -g (as root)"
+if [ "$PUBLISHED" -eq 1 ]; then
+  docker exec "$NAME" bash -lc "npm install -g failproofai@$VERSION 2>&1 | tail -4"
+else
+  docker exec "$NAME" bash -lc "npm install -g /pkg.tgz 2>&1 | tail -4"
+fi
+
+say "Who owns the global install?"
+docker exec "$NAME" bash -lc '
+  P=$(npm root -g)/failproofai
+  stat -c "  %U:%G %a  %n" "$P" 2>/dev/null
+  stat -c "  %U:%G %a  %n" "$P/dist" 2>/dev/null
+'
+
+# ── 5. Hand over, running as the unprivileged user ───────────────────────────
+say "Ready"
+cat <<EOF
+
+  The box is up as container "$NAME". Everything below runs as the
+  UNPRIVILEGED user, against a root-owned global install — the real shape.
+
+  Shell in:
+    docker exec -it -u $USER_IN_BOX $NAME bash -l
+
+  Then, inside:
+    failproofai --version
+    failproofai config          # real systemd service install
+    systemctl status failproofaid@$USER_IN_BOX
+
+  The daemon binary is mounted at /opt/failproofaid. There is no GitHub
+  release for $VERSION, so point the CLI at it rather than letting it try
+  to download one:
+    export FAILPROOFAI_DAEMON_BINARY=/opt/failproofaid
+
+  Fire a hook exactly as an agent CLI would:
+    printf '{"session_id":"s","cwd":"'"\$PWD"'","hook_event_name":"PreToolUse",
+    "tool_name":"Bash","tool_input":{"command":"sudo rm -rf /"}}' \\
+      | failproofai --hook PreToolUse --cli claude
+
+  Tear down:
+    docker rm -f $NAME
+
+EOF

package/src/hooks/builtin-policies.ts

@@ -164,7 +164,6 @@ const ENV_FILE_PATH_RE = /(?:^|[\\/])\.env(?:\.|$)/;
 const ENV_CMD_RE = /\.env(?:\b|\s|$|\.)/;
 
 // blockSudo
-const SUDO_RE = /(?:^|;|&&|\|\|)\s*sudo\s/;
 const PS_ELEVATION_RE = /Start-Process\s+.*-Verb\s+RunAs/i;
 const RUNAS_RE = /(?:^|;|&&|\|\|)\s*runas\s/i;
 
@@ -749,10 +748,163 @@ function blockEnvFiles(ctx: PolicyContext): PolicyResult {
   return allow();
 }
 
+/**
+ * True when a segment runs an elevation binary IN COMMAND POSITION.
+ *
+ * Anchored structurally rather than by token, for the reason `namesSelfPause`
+ * is: `SUDO_RE` required the literal token `sudo` at a command boundary, so
+ * **`/usr/bin/sudo rm -rf /` was ALLOWED** — a direct invocation, no
+ * obfuscation, one absolute path away from root on a `defaultEnabled` guard.
+ * Every other form the shell resolves before settling on the binary — prefix
+ * assignments, redirections, runners and their flags — is walked off first, and
+ * the comparison is on the BASENAME so a path cannot hide the name.
+ *
+ * `doas` is included because it is the same capability under a different name;
+ * a machine with `doas` installed and only `sudo` blocked is not blocked.
+ *
+ * This raises the bar; it does not close the class. `bash -c "sudo …"`, a
+ * variable (`S=sudo; $S …`) and base64-through-a-pipe all still reach root,
+ * because static inspection of one command string cannot follow them. Closing
+ * that properly needs enforcement below the shell, not a better regex.
+ */
+/**
+ * Split a command into per-segment TOKEN LISTS the way a shell reads it.
+ *
+ * Distinct from `shellSegments` below, which returns raw segment STRINGS and is
+ * what the deletion policies want. Named apart deliberately: defining a second
+ * `shellSegments` here shadowed that one, silently broke every `rm -rf` check,
+ * and disabled this matcher too — caught only because `tsc` reports duplicate
+ * implementations.
+ *
+ * Segmentation happens on the RAW string and skips separators inside quotes,
+ * which is the whole point: stripping quoting FIRST turns `\|` — a literal pipe
+ * in a grep alternation — into a real separator, so `grep "a\|sudo b"` parses
+ * as a command called `sudo` and gets denied. That is a common enough pattern
+ * that over-blocking it is worse than the evasion it would catch.
+ *
+ * Each token is unquoted individually afterwards, which still defeats `\sudo`
+ * and `"sudo"` without ever letting quote removal change where the boundaries
+ * are. Quoted tokens are returned separately so a caller can decide whether
+ * their CONTENTS deserve a second look — see `EVAL_FLAG_RE`.
+ */
+function quoteAwareSegments(command: string): Array<string[]> {
+  const segments: Array<string[]> = [];
+  let tokens: string[] = [];
+  let token = "";
+  let quote: '"' | "'" | null = null;
+  const endToken = () => {
+    if (token) tokens.push(token);
+    token = "";
+  };
+  const endSegment = () => {
+    endToken();
+    if (tokens.length) segments.push(tokens);
+    tokens = [];
+  };
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (quote) {
+      // Inside single quotes a backslash is literal; inside double quotes it escapes.
+      if (c === "\\" && quote === '"' && i + 1 < command.length) {
+        token += command[++i];
+        continue;
+      }
+      if (c === quote) {
+        quote = null;
+        continue;
+      }
+      token += c;
+      continue;
+    }
+    if (c === "\\" && i + 1 < command.length) {
+      // An escaped character is literal — `\sudo` is still sudo, and `\|` is a
+      // pipe CHARACTER rather than a separator.
+      token += command[++i];
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (/\s/.test(c)) {
+      endToken();
+      continue;
+    }
+    if (/[;&|\n\r(){}`]/.test(c)) {
+      endSegment();
+      continue;
+    }
+    token += c;
+  }
+  endSegment();
+  return segments;
+}
+
+/** `-c` and friends: the flags whose ARGUMENT is a command, not data. */
+const EVAL_FLAG_RE = /^-{1,2}c$/;
+
+/**
+ * True when a command runs an elevation binary IN COMMAND POSITION.
+ *
+ * Anchored structurally rather than by token, for the reason `namesSelfPause`
+ * is: `SUDO_RE` required the literal token `sudo` at a command boundary, so
+ * **`/usr/bin/sudo rm -rf /` was ALLOWED** — a direct invocation, no
+ * obfuscation, one absolute path away from root on a `defaultEnabled` guard.
+ * Every other form the shell resolves before settling on the binary — prefix
+ * assignments, redirections, runners and their flags — is walked off first, and
+ * the comparison is on the BASENAME so a path cannot hide the name.
+ *
+ * `doas` is included because it is the same capability under a different name;
+ * a machine with `doas` installed and only `sudo` blocked is not blocked.
+ *
+ * A quoted argument is re-examined ONLY when the command that owns it is a
+ * shell runner invoked with an eval flag (`bash -c "sudo …"`). That distinction
+ * is load-bearing: `bash -c "sudo x"` and `grep "a|sudo x"` are identical from
+ * the outside, and the only thing separating an execution from a search string
+ * is whether the receiving binary evaluates its argument.
+ *
+ * This raises the bar; it does not close the class. A variable (`S=sudo; $S …`),
+ * base64 through a pipe, and a wrapper script on disk all still reach root,
+ * because static inspection of one command string cannot follow them. Closing
+ * that properly needs enforcement below the shell, not a better matcher.
+ */
+function namesElevation(command: string, depth = 0): boolean {
+  for (const tokens of quoteAwareSegments(command)) {
+    let i = 0;
+    while (i < tokens.length) {
+      const token = tokens[i];
+      const base = token.slice(token.lastIndexOf("/") + 1);
+      // `sudo`/`doas` are themselves in COMMAND_PREFIX_TOKENS (they legitimately
+      // stand in front of another binary), so they must be tested BEFORE the
+      // skip list or the walk would step straight over the thing being looked for.
+      if (base === "sudo" || base === "doas") return true;
+      const isSkippable =
+        ENV_ASSIGNMENT_RE.test(token) ||
+        token.startsWith("-") ||
+        token.startsWith(">") ||
+        token.startsWith("<") ||
+        RUNNER_OPERAND_RE.test(token) ||
+        COMMAND_PREFIX_TOKENS.has(base);
+      if (!isSkippable) break;
+      // `sh -c "…"` / `bash -c "…"`: the next token is a COMMAND. Bounded
+      // recursion so a nested `bash -c "bash -c …"` cannot spin.
+      if (EVAL_FLAG_RE.test(token) && depth < 3 && i + 1 < tokens.length) {
+        if (namesElevation(tokens[i + 1], depth + 1)) return true;
+      }
+      i++;
+    }
+  }
+  return false;
+}
+
 function blockSudo(ctx: PolicyContext): PolicyResult {
   if (ctx.toolName !== "Bash") return allow();
   const cmd = getCommand(ctx).trimStart();
-  if (SUDO_RE.test(cmd) || cmd.startsWith("sudo ")) {
+  // ONE pass. `shellSegments` unquotes each token individually, so `\sudo` and
+  // `"sudo"` are still caught — without a whole-string strip, which is what
+  // turned an escaped pipe in `grep "a\|sudo b"` into a segment separator and
+  // denied an ordinary search.
+  if (namesElevation(cmd)) {
     // Check allowPatterns — match against parsed tokens, not raw string
     const allowPatterns = ((ctx.params?.allowPatterns ?? []) as string[]);
     if (allowPatterns.some((p) => matchesAllowedPattern(cmd, p))) return allow();

package/src/hooks/configure-wizard.ts

@@ -72,6 +72,7 @@ import {
   daemonVersionSkew,
   primeElevation,
   setDaemonConfigured,
+  probeDaemon,
   probeDaemonEndToEnd,
   uninstallDaemonService,
 } from "./daemon-service";
@@ -1189,16 +1190,25 @@ export async function runConfigureWizard(io: WizardIO = {}): Promise<WizardResul
     // Checked HERE rather than inside `installDaemonService`, which can only
     // honestly report on the service: keeping them apart is also what lets the
     // install mechanics be tested against a stub binary.
-    if (!(await probeDaemonEndToEnd())) {
-      hookLogWarn("failproofaid was installed and running but did not answer a policy evaluation");
+    const probe = await probeDaemon();
+    if (!probe.ok) {
+      hookLogWarn(
+        `failproofaid was installed and running but did not answer a policy evaluation (${probe.reason})`,
+      );
+      // Two different faults, two different things to go and look at. Saying
+      // "your worker will not start" at a machine whose socket simply never
+      // came up sends someone to inspect a process that is fine.
       stdout.write(
-        "\nfailproofaid started but cannot evaluate policies — its worker process\n" +
-          "could not be run. Setup stopped before changing anything, because a machine\n" +
-          "configured to require a daemon that cannot answer denies every tool call.\n\n" +
+        (probe.reason === "worker"
+          ? "\nfailproofaid started but cannot evaluate policies — it is listening, and\n" +
+            "its worker process could not be run.\n"
+          : "\nfailproofaid started but could not be reached on its socket.\n") +
+          "Setup stopped before changing anything, because a machine configured to\n" +
+          "require a daemon that cannot answer denies every tool call.\n\n" +
           `  Check it with:  ${daemonStatusCommand() ?? "systemctl status failproofaid"}\n` +
           "  Then re-run:    failproofai config\n\n",
       );
-      void emit("configure_aborted", { reason: "daemon_not_answering" });
+      void emit("configure_aborted", { reason: `daemon_not_answering_${probe.reason}` });
       outro("Nothing was changed.", { ok: false }, stdout);
       return { applied: false, abort: "daemon_failed" };
     }

package/src/hooks/daemon-client.ts

@@ -107,6 +107,41 @@ export function daemonSocketPresent(): boolean {
   }
 }
 
+/**
+ * Whether the daemon socket accepts a connection *right now*.
+ *
+ * Narrower than `daemonSocketPresent()` (a stale socket file outlives the
+ * process that made it) and narrower than `attemptDaemonHook`, which reports
+ * `"unreachable"` for BOTH a refused connection and a request that was accepted
+ * and then never answered. Those two have different causes and different
+ * remedies — a socket that is not up yet versus a worker that cannot run — and
+ * telling them apart is the whole point of this function.
+ *
+ * Connect budget only; nothing is sent. Used by the health probe, never on the
+ * hook path.
+ */
+export async function daemonAcceptsConnections(
+  timeoutMs = DAEMON_CONNECT_TIMEOUT_MS,
+): Promise<boolean> {
+  if (process.platform === "win32") return false;
+  return new Promise<boolean>((resolve) => {
+    let settled = false;
+    const done = (v: boolean) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve(v);
+    };
+    const socket = createConnection({ path: socketPath() });
+    const timer = setTimeout(() => done(false), timeoutMs);
+    timer.unref?.();
+    socket.on("connect", () => done(true));
+    socket.on("error", () => done(false));
+  });
+}
+
 function socketPath(): string {
   if (process.env.FAILPROOFAI_DAEMON_SOCKET) return process.env.FAILPROOFAI_DAEMON_SOCKET;
   return daemonSocketPath();