pi-warden 1.11.0 → 1.11.2

package/CHANGELOG.md

@@ -8,6 +8,28 @@ How to keep this current: add the entry in the same pull request as the change,
 
 <!-- Empty. Next release starts here. -->
 
+## 1.11.2
+
+### Fixed
+
+- The action guard's floor no longer holds a bash call for text the shell never runs. Every pattern check (the built-in rules, the SQL and git state checks, user `commandRules`, and path rules on the command surface) reads a command and a script body without shell comments, the same comment scan the judge request uses. A `#!/bin/sh` first line no longer keeps every quoted `echo`/`printf` message in scope (the data scan read it as a call to `sh`), and a message that holds `;`, `|`, or `&&` inside its quotes is no longer cut into commands. The hit lines of a script body leave out its comment lines.
+- A `grep`, `sed`, or `rtk grep` of a file, with `\|` in its quoted pattern, no longer reads that file as a script that runs. Script detection cut the command at every `|`, also inside quotes, so `down=" scripts/x.py` read as an assignment and the file as the command; it now cuts only where the shell does. A command with a substitution, an unclosed quote, `eval`, or `sh -c` keeps the old cut, so every script read before is still read. ([#190](https://github.com/DevMortimer/pi-warden/issues/190))
+- The floor reads line continuations as bash does. A delete split by a backslash-newline (`r\<newline>m -rf ~`, `rm \<newline>-rf ~`) was not held, and neither was a script run as `sh \<newline>a.sh`. The comment scan now joins each backslash-newline that bash removes: outside quotes, in double quotes and `${...}`, and in a heredoc body with an unquoted delimiter, but not in single quotes, `$'...'`, a quoted heredoc body, or a comment. A backslash-newline before a script run (`cd . && \<newline>  sh a.sh`, also `npm run` and `make`) no longer hides the script from the floor or the ask gate.
+- A delete after a here-string or a partly quoted heredoc delimiter is held again. The data scan found heredocs with a line regex that read `<<<` and a `<<` inside quotes as the start of a heredoc, and took `E` as the delimiter of `<<E"O"F`, so every later line was blanked as heredoc data. It now takes heredocs from the comment scan, which skips here-strings, quotes, and comments, removes quotes from the delimiter, and joins a backslash-newline in an unquoted body before it matches the delimiter; a command that scan cannot read keeps every line in scope.
+- The ask gate reads the command the way the floor does, without shell comments and with quoted messages and heredoc data blanked. A push or a delete that appears only in a comment or in a quoted `echo` message no longer sends a judge request.
+
+### Tests
+
+- A differential test runs each input through `bash -c` with a `touch "$MARK"` twin in place of the delete: the floor holds an input exactly when bash creates the marker (13 inputs it stops holding, 16 it keeps holding, among them a delete inside `$(...)` on a heredoc line that starts with `#`, and a delete on the line after a comment that holds an apostrophe). Unit tests pin the issue 190 command with its user rule, and every way of running a script (`sh`, `bash`, `./`, `.`, `source`, `npm run`), also next to a read of the same file.
+- The differential test adds 28 inputs with backslash-newlines, here-strings, and quoted or split heredoc delimiters, typed and in script bodies with `#!/bin/sh`, `#!/bin/bash`, `#!/usr/bin/env bash`, or no first line; the comment-scan output test adds 8 inputs whose output bash must print unchanged. Unit tests hold each of them through `matchPatterns`, check that the ask gate still asks for a script named after a backslash-newline, and check that the comment, echo message, and `sed` shapes still run.
+- A judge-call count through `evaluateAction` pins that a push only in a comment sends no request, and that the same push as a second command sends one.
+
+## 1.11.1
+
+### Fixed
+
+- `/warden index` now finalizes the entries-only files its own prompt asks the model to write. The entries-only fallback ran only when the strict read had already found a complete file, so an `{ "entries": [...] }` file never got its metadata, its rejections were never reported, and every later session loaded the index as missing and repeated the "run /warden index" nudge. The fallback now runs whenever the strict read finds no file, and rejected entries are reported. ([#185](https://github.com/DevMortimer/pi-warden/issues/185))
+
 ## 1.11.0
 
 ### Added

package/dist/extension.js

@@ -4013,8 +4013,9 @@ export default function wardenExtension(host) {
                     // Accept both the full format and entries-only; warden always writes the final metadata.
                     let globalResult = rawGlobal ? validateIndex(rawGlobal) : { file: undefined, rejections: [] };
                     let projectResult = rawProject ? validateIndex(rawProject) : { file: undefined, rejections: [] };
-                    // Entries-only fallback: read raw JSON and extract entries array
-                    if (!globalResult.file && rawGlobal) {
+                    // Entries-only fallback: read raw JSON and extract entries array. It must not depend on rawGlobal/rawProject:
+                    // the strict read returns nothing for the entries-only shape the index prompt asks for.
+                    if (!globalResult.file) {
                         try {
                             const parsed = JSON.parse(readFileSync(globalPath, "utf8"));
                             if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
@@ -4027,7 +4028,7 @@ export default function wardenExtension(host) {
                                 record(ctx, config, "conscience", `global entries-only parse: ${msg}`, ["trigger: warden_index"]);
                         }
                     }
-                    if (!projectResult.file && rawProject) {
+                    if (!projectResult.file) {
                         try {
                             const parsed = JSON.parse(readFileSync(projectPath, "utf8"));
                             if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
@@ -4043,9 +4044,9 @@ export default function wardenExtension(host) {
                     }
                     // Collect rejections from both files
                     const allRejections = [];
-                    if (rawGlobal && !globalResult.file)
+                    if (!globalResult.file)
                         allRejections.push(...globalResult.rejections.map(r => `global index: entry ${r}`));
-                    if (rawProject && !projectResult.file)
+                    if (!projectResult.file)
                         allRejections.push(...projectResult.rejections.map(r => `project index: entry ${r}`));
                     if (allRejections.length > 0) {
                         report(`Index rejected:\n${allRejections.map(r => `  ${r}`).join("\n")}\nOld files kept.`, "warning");

package/dist/guard.d.ts

@@ -269,9 +269,11 @@ export interface ScannedCommand {
  */
 export declare function stripDataText(command: string): ScannedCommand;
 /**
- * The command text Jev reads: shell comments removed; quotes, escapes, heredoc bodies, `$#`, `${#…}`, and a `#`
- * mid-word kept. Quote state carries across lines. A construct the scan does not model (backticks, arithmetic, `case`
- * inside `$(…)`, quotes inside `${…}`), or an unclosed quote, returns the command unchanged.
+ * The command text Jev and the pattern floor read: shell comments removed, and each backslash-newline the shell removes
+ * joined (outside quotes, in double quotes and `${…}`, and in a heredoc body with an unquoted delimiter); quotes,
+ * escapes, heredoc bodies, `$#`, `${#…}`, and a `#` mid-word kept. Quote state carries across lines. A construct the
+ * scan does not model (backticks, arithmetic, `case` inside `$(…)`, quotes inside `${…}`), or an unclosed quote,
+ * returns the command unchanged.
  */
 export declare function stripShellComments(command: string): string;
 /**

package/dist/guard.js

@@ -11,7 +11,7 @@ import { resolveRulesFile } from "./rules-file.js";
 import { mergeWrites, shellWrites } from "./shell-writes.js";
 import { COMMAND_TOOLS, commandOf } from "./tools.js";
 import { actionAskGate } from "./ask-gate.js";
-import { scriptSources } from "./script-bodies.js";
+import { scriptSources, shellParts } from "./script-bodies.js";
 import { actionTokens, DEFAULT_TEMPLATES, renderTemplate } from "./widget.js";
 export const SLOP_SYMPTOMS = ["stub", "comments", "dead", "hedging"];
 const LEVEL_RANK = { allow: 0, warn: 1, confirm: 2, deny: 3 };
@@ -88,7 +88,6 @@ const GIT_MESSAGE_SUBCOMMANDS = new Set(["commit", "tag", "notes", "merge", "sta
 /** Interpreters whose stdin script can still run shell commands; their heredoc bodies stay in scope when they do. */
 const INTERPRETERS = /^(?:python[\d.]*|node|ruby|perl|php|deno|bun|tsx|Rscript|lua[\d.]*)$/;
 const EXEC_CALLS = /\b(?:os\.system|os\.popen|os\.exec\w*|subprocess|child_process|execSync|spawnSync|execFileSync|spawn\(|exec\(|system\(|popen\(|shell_exec|passthru|proc_open|Open3|IO\.popen|Deno\.run|Deno\.Command|Bun\.spawn|Bun\.\$|%x[\[{(]|`[^`\n]*\b(?:rm|git|dd|mkfs|kubectl|terraform)\b)/;
-const HEREDOC = /<<-?\s*(?:"(\w+)"|'(\w+)'|(\\)?(\w+))/;
 const SUBSTITUTION = /\$\(|`/;
 function headOf(segment) {
     const tokens = segment.trim().split(/\s+/);
@@ -297,40 +296,31 @@ function blankMessageFlags(command) {
  * (`python3 - <<EOF`) are kept when the script calls out to a shell or process API.
  */
 export function stripDataText(command) {
-    const lines = command.split("\n");
-    const out = [];
     let stripped = false;
-    for (let index = 0; index < lines.length; index++) {
-        const line = lines[index];
-        const heredoc = HEREDOC.exec(line);
-        if (!heredoc) {
-            out.push(line);
-            continue;
-        }
-        const delimiter = heredoc[1] ?? heredoc[2] ?? heredoc[4];
-        // 'EOF', "EOF", and \EOF make the body literal; a bare EOF body is expanded, so a substitution inside it runs.
-        const literal = heredoc[4] === undefined || heredoc[3] !== undefined;
-        const body = [];
-        let close = index + 1;
-        while (close < lines.length && lines[close].replace(/^\t+/, "") !== delimiter)
-            body.push(lines[close]), close++;
-        const bodyText = body.join("\n");
+    // Only a `<<` the shell scan reads as one starts a body: not a here-string `<<<`, nor `<<` in quotes or a comment. A
+    // command the scan cannot read keeps every line in scope.
+    const heredocs = scanShell(command)?.heredocs ?? [];
+    let scanned = "";
+    let cursor = 0;
+    for (const heredoc of heredocs) {
+        const line = command.slice(heredoc.line, heredoc.start - 1);
+        const body = command.slice(heredoc.start, heredoc.end);
+        const bodyText = body.replace(/\n$/, "");
         // The whole pipeline on the heredoc line counts: `cat <<EOF | bash` executes the body as much as `bash <<EOF` does.
         const heads = splitShell(line).map(segment => headOf(segment) ?? "");
-        const consumer = headOf(line.slice(0, heredoc.index)) ?? "";
-        const executed = heads.some(head => SHELL_SINKS.has(head)) || (INTERPRETERS.test(consumer) && EXEC_CALLS.test(bodyText)) || (!literal && SUBSTITUTION.test(bodyText));
-        out.push(line);
-        if (executed)
-            out.push(...body);
-        else if (body.length) {
-            out.push(`[heredoc body: ${body.length} lines of data]`);
-            stripped = true;
-        }
-        if (close < lines.length)
-            out.push(lines[close]);
-        index = close;
-    }
-    const scanned = out.join("\n");
+        const consumer = headOf(line.slice(0, heredoc.operator - heredoc.line)) ?? "";
+        // 'EOF', "EOF", E"O"F, and \EOF make the body literal; a bare EOF body is expanded, so a substitution inside it runs.
+        const executed = heads.some(head => SHELL_SINKS.has(head)) || (INTERPRETERS.test(consumer) && EXEC_CALLS.test(bodyText)) || (!heredoc.literal && SUBSTITUTION.test(bodyText));
+        scanned += command.slice(cursor, heredoc.start);
+        cursor = heredoc.end;
+        if (executed || !body) {
+            scanned += body;
+            continue;
+        }
+        scanned += `[heredoc body: ${bodyText.split("\n").length} lines of data]${body.endsWith("\n") ? "\n" : ""}`;
+        stripped = true;
+    }
+    scanned += command.slice(cursor);
     const joined = blankMessageFlags(scanned);
     const segments = splitShell(joined);
     // A shell sink anywhere may run text written earlier in the same command (`cat <<EOF > run.sh` then `bash run.sh`), so nothing is treated as data.
@@ -341,7 +331,12 @@ export function stripDataText(command) {
     let text = joined;
     if (joined !== scanned)
         stripped = true;
-    for (const segment of segments) {
+    // A printed or searched message is cut where the shell cuts, so `echo "a; b"` stays one argument. git and gh keep the
+    // wider cut: `blankMessageFlags` already blanked the flags that take a message, and `gh pr view --body` takes none.
+    const parts = shellParts(joined);
+    const printsData = (segment) => DATA_HEADS.has(headOf(segment) ?? "");
+    const dataSegments = parts === undefined ? segments : [...parts.filter(printsData), ...segments.filter(segment => !printsData(segment))];
+    for (const segment of dataSegments) {
         if (!isDataSegment(segment) || !/["']/.test(segment))
             continue;
         const blanked = blankQuotes(segment);
@@ -352,29 +347,49 @@ export function stripDataText(command) {
     }
     return { text, stripped };
 }
-// A shell comment can carry text the agent wrote to sway Jev; the request state must read only what the shell runs.
+// A shell comment can carry text the agent wrote to sway Jev, or delete text that never runs; Jev and the floor read only
+// what the shell runs.
 /**
- * The command text Jev reads: shell comments removed; quotes, escapes, heredoc bodies, `$#`, `${#…}`, and a `#`
- * mid-word kept. Quote state carries across lines. A construct the scan does not model (backticks, arithmetic, `case`
- * inside `$(…)`, quotes inside `${…}`), or an unclosed quote, returns the command unchanged.
+ * The command text Jev and the pattern floor read: shell comments removed, and each backslash-newline the shell removes
+ * joined (outside quotes, in double quotes and `${…}`, and in a heredoc body with an unquoted delimiter); quotes,
+ * escapes, heredoc bodies, `$#`, `${#…}`, and a `#` mid-word kept. Quote state carries across lines. A construct the
+ * scan does not model (backticks, arithmetic, `case` inside `$(…)`, quotes inside `${…}`), or an unclosed quote,
+ * returns the command unchanged.
  */
 export function stripShellComments(command) {
+    return scanShell(command)?.text ?? command;
+}
+/** Whether a line ends in a backslash that escapes the new line after it, not one that a backslash before it escapes. */
+function continues(line) {
+    let count = 0;
+    while (count < line.length && line[line.length - 1 - count] === "\\")
+        count++;
+    return count % 2 === 1;
+}
+/** `stripShellComments` with the heredocs it read; undefined where it returns the command unchanged. */
+function scanShell(command) {
     const stack = [];
     const depths = [];
     const heredocs = [];
+    const found = [];
     let out = "";
     // Text before this length is not trailing blank space, so a removed comment takes only the blanks before it.
     let kept = 0;
     let wordStart = true;
     let index = 0;
+    // Where the current logical line starts: a backslash-newline continues it.
+    let lineStart = 0;
     const emit = (text, blank = false) => { out += text; if (!blank)
         kept = out.length; };
+    // The offset of the next character bash reads at `at`: a backslash-newline before it is gone, so `<\<nl><` is `<<`.
+    const after = (at) => { while (command.startsWith("\\\n", at))
+        at += 2; return at; };
     // A heredoc delimiter word, quotes and backslashes removed; undefined when it is not a plain word.
     const delimiterWord = () => {
         let word = "";
         let raw = "";
-        while (index < command.length && /[ \t]/.test(command[index]))
-            raw += command[index++];
+        for (index = after(index); index < command.length && /[ \t]/.test(command[index]); index = after(index + 1))
+            raw += command[index];
         while (index < command.length && !/[\s;|&<>()]/.test(command[index])) {
             const char = command[index];
             if (char === "'" || char === "\"") {
@@ -386,8 +401,12 @@ export function stripShellComments(command) {
                 index = close + 1;
                 continue;
             }
+            if (char === "\\" && command[index + 1] === "\n") {
+                index += 2;
+                continue;
+            }
             if (char === "\\") {
-                if (index + 1 >= command.length || command[index + 1] === "\n")
+                if (index + 1 >= command.length)
                     return undefined;
                 word += command[index + 1];
                 raw += command.slice(index, index + 2);
@@ -403,7 +422,7 @@ export function stripShellComments(command) {
         if (!word)
             return undefined;
         emit(raw);
-        return word;
+        return { word, literal: /['"\\]/.test(raw) };
     };
     while (index < command.length) {
         const char = command[index];
@@ -417,7 +436,9 @@ export function stripShellComments(command) {
         }
         if (context === "ansi" || context === "double" || context === "brace") {
             if (char === "\\") {
-                emit(command.slice(index, index + 2));
+                // bash keeps a backslash-newline inside `$'…'` (measured, bash 3.2) and removes it in `"…"` and `${…}`.
+                if (command[index + 1] !== "\n" || context === "ansi")
+                    emit(command.slice(index, index + 2));
                 index += 2;
                 continue;
             }
@@ -429,10 +450,10 @@ export function stripShellComments(command) {
                 continue;
             }
             if (char === "`")
-                return command;
+                return undefined;
             if (context === "brace") {
                 if (char === "'" || char === "\"" || char === "$")
-                    return command;
+                    return undefined;
                 emit(char);
                 index++;
                 if (char === "}")
@@ -445,33 +466,36 @@ export function stripShellComments(command) {
                 stack.pop();
                 continue;
             }
-            if (char === "$" && command[index + 1] === "(") {
-                if (command[index + 2] === "(")
-                    return command;
+            const next = char === "$" ? after(index + 1) : index;
+            if (char === "$" && command[next] === "(") {
+                if (command[after(next + 1)] === "(")
+                    return undefined;
                 emit("$(");
-                index += 2;
+                index = next + 1;
                 stack.push("subshell");
                 depths.push(0);
                 wordStart = true;
                 continue;
             }
-            if (char === "$" && command[index + 1] === "{") {
+            if (char === "$" && command[next] === "{") {
                 emit("${");
-                index += 2;
+                index = next + 1;
                 stack.push("brace");
                 continue;
             }
-            if (char === "$" && command[index + 1] === "[")
-                return command;
+            if (char === "$" && command[next] === "[")
+                return undefined;
             emit(char);
             index++;
             continue;
         }
         // Unquoted: the top level or inside `$(…)`.
         if (char === "\\") {
-            emit(command.slice(index, index + 2));
-            if (command[index + 1] !== "\n")
+            // A backslash-newline is gone before bash reads words: `r\<nl>m` runs `rm`, and `true &&\<nl>sh a.sh` runs `sh`.
+            if (command[index + 1] !== "\n") {
+                emit(command.slice(index, index + 2));
                 wordStart = false;
+            }
             index += 2;
             continue;
         }
@@ -485,16 +509,33 @@ export function stripShellComments(command) {
             emit(char);
             index++;
             wordStart = true;
-            for (const { delimiter, tabs } of heredocs.splice(0)) {
+            for (const { delimiter, tabs, literal, line: operatorLine, operator } of heredocs.splice(0)) {
+                const start = index;
+                let end = command.length;
                 while (index < command.length) {
-                    const lineEnd = command.indexOf("\n", index);
-                    const line = command.slice(index, lineEnd < 0 ? command.length : lineEnd);
+                    const bodyLine = index;
+                    let line = "";
+                    let lineEnd;
+                    // An unquoted body joins a backslash-newline before bash matches the delimiter (measured, bash 3.2): `EO\<nl>F` ends it.
+                    for (;;) {
+                        lineEnd = command.indexOf("\n", index);
+                        const piece = command.slice(index, lineEnd < 0 ? command.length : lineEnd);
+                        index = lineEnd < 0 ? command.length : lineEnd + 1;
+                        if (literal || lineEnd < 0 || !continues(piece)) {
+                            line += piece;
+                            break;
+                        }
+                        line += piece.slice(0, -1);
+                    }
                     emit(lineEnd < 0 ? line : `${line}\n`);
-                    index = lineEnd < 0 ? command.length : lineEnd + 1;
-                    if ((tabs ? line.replace(/^\t+/, "") : line) === delimiter)
+                    if ((tabs ? line.replace(/^\t+/, "") : line) === delimiter) {
+                        end = bodyLine;
                         break;
+                    }
                 }
+                found.push({ line: operatorLine, operator, start, end, literal });
             }
+            lineStart = index;
             continue;
         }
         if (char === " " || char === "\t") {
@@ -504,7 +545,7 @@ export function stripShellComments(command) {
             continue;
         }
         if (char === "`")
-            return command;
+            return undefined;
         if (char === "'") {
             emit(char);
             index++;
@@ -520,26 +561,27 @@ export function stripShellComments(command) {
             continue;
         }
         if (char === "$") {
-            const next = command[index + 1];
+            const at = after(index + 1);
+            const next = command[at];
             if (next === "'") {
                 emit("$'");
-                index += 2;
+                index = at + 1;
                 stack.push("ansi");
                 wordStart = false;
                 continue;
             }
             if (next === "\"") {
                 emit("$\"");
-                index += 2;
+                index = at + 1;
                 stack.push("double");
                 wordStart = false;
                 continue;
             }
-            if (next === "(" && command[index + 2] === "(")
-                return command;
+            if (next === "(" && command[after(at + 1)] === "(")
+                return undefined;
             if (next === "(") {
                 emit("$(");
-                index += 2;
+                index = at + 1;
                 stack.push("subshell");
                 depths.push(0);
                 wordStart = true;
@@ -547,40 +589,42 @@ export function stripShellComments(command) {
             }
             if (next === "{") {
                 emit("${");
-                index += 2;
+                index = at + 1;
                 stack.push("brace");
                 wordStart = false;
                 continue;
             }
             if (next === "[")
-                return command;
+                return undefined;
             emit(char);
             index++;
             wordStart = false;
             continue;
         }
-        if (char === "(" && command[index + 1] === "(")
-            return command;
-        if (char === "<" && command.startsWith("<<<", index)) {
-            emit("<<<");
-            index += 3;
-            wordStart = true;
-            continue;
-        }
-        if (char === "<" && command[index + 1] === "<") {
-            const tabs = command[index + 2] === "-";
+        if (char === "(" && command[after(index + 1)] === "(")
+            return undefined;
+        if (char === "<" && command[after(index + 1)] === "<") {
+            const third = after(after(index + 1) + 1);
+            if (command[third] === "<") {
+                emit("<<<");
+                index = third + 1;
+                wordStart = true;
+                continue;
+            }
+            const tabs = command[third] === "-";
+            const operator = index;
             emit(tabs ? "<<-" : "<<");
-            index += tabs ? 3 : 2;
+            index = tabs ? third + 1 : third;
             const delimiter = delimiterWord();
             if (delimiter === undefined)
-                return command;
-            heredocs.push({ delimiter, tabs });
+                return undefined;
+            heredocs.push({ delimiter: delimiter.word, tabs, literal: delimiter.literal, line: lineStart, operator });
             wordStart = false;
             continue;
         }
         if (context === "subshell") {
             if (wordStart && /^case\b/.test(command.slice(index)))
-                return command;
+                return undefined;
             if (char === "(")
                 depths[depths.length - 1]++;
             if (char === ")" && depths.at(-1) === 0) {
@@ -599,8 +643,8 @@ export function stripShellComments(command) {
         wordStart = /[;|&()<>]/.test(char);
     }
     if (stack.length || heredocs.length)
-        return command;
-    return out;
+        return undefined;
+    return { text: out, heredocs: found };
 }
 /** The shell's own working directory, as a `DirPath`. */
 const cwdPath = (cwd) => (cwd === undefined ? { kind: "unknown" } : { kind: "path", path: cwd });
@@ -2022,8 +2066,8 @@ function compileUserRule(raw, defaultSeverity) {
         return undefined;
     }
 }
-/** The built-in shell rules and user command rules for one command body. `raw` is the text as written; `stripDataText`
- * blanks the data that is not a command. Deduplicated by id. */
+/** The built-in shell rules and user command rules for one command body. `raw` is the text without shell comments
+ * (`stripShellComments`); `stripDataText` blanks the data that is not a command. Deduplicated by id. */
 function commandPatternHits(raw, cwd, options, exempt) {
     const hits = new Map();
     const add = (hit) => { if (hit && !hits.has(hit.id))
@@ -2119,17 +2163,19 @@ export function matchPatterns(tool, input, cwd, options) {
     const view = commandOf(tool, input);
     const raw = view?.command;
     if (raw) {
-        merge(commandPatternHits(raw, cwd, options, exempt));
+        const code = stripShellComments(raw);
+        merge(commandPatternHits(code, cwd, options, exempt));
         // The bodies of scripts the command runs are read one level deep: a script the body calls is not read again.
         if (view?.shell) {
-            const sources = options?.scripts ?? scriptSources(stripDataText(raw).text, cwd);
+            const sources = options?.scripts ?? scriptSources(stripDataText(code).text, cwd);
             for (const source of sources) {
                 if (source.kind !== "shell")
                     continue;
-                const bodyHits = commandPatternHits(source.body, cwd, options, exempt);
+                const body = stripShellComments(source.body);
+                const bodyHits = commandPatternHits(body, cwd, options, exempt);
                 if (!bodyHits.length)
                     continue;
-                const lines = matchingLines(source.body, options, exempt);
+                const lines = matchingLines(body, options, exempt);
                 merge(bodyHits.map(hit => ({ ...hit, lines })), source.source);
             }
         }
@@ -2292,7 +2338,7 @@ export function matchPathRules(tool, input, cwd, rules, exempt) {
     };
     const raw = commandOf(tool, input)?.command;
     if (raw) {
-        const text = stripDataText(raw).text;
+        const text = stripDataText(stripShellComments(raw)).text;
         const sinks = writeSinkTargets(text);
         const mentioned = (rule) => mentionRegex(rule).some(re => re.test(text));
         const sinkWrite = (rule) => sinks.some(target => pathRuleMatches(rule, target));
@@ -2933,12 +2979,14 @@ async function judgeAction(action, options) {
     const withPlan = (verdict) => (plan ? { ...verdict, plan } : verdict);
     const view = commandOf(action.tool, action.input);
     // Read the script bodies once: the floor labels their hits and the ask gate reads their shapes from the same list.
-    const scriptBodies = view?.shell ? scriptSources(stripDataText(view.command).text, action.cwd) : [];
+    // The text the shell runs, as the floor reads it: comments removed and backslash-newlines joined, then data blanked.
+    const shellText = view?.shell ? stripDataText(stripShellComments(view.command)).text : undefined;
+    const scriptBodies = shellText === undefined ? [] : scriptSources(shellText, action.cwd);
     const patterns = matchPatterns(action.tool, action.input, action.cwd, { commandRules: config.commandRules, commandDenyRules: config.commandDenyRules, exemptRules: config.exemptRules, pathRules: config.pathRules, scripts: scriptBodies, scratch: options.scratch, scratchPaths: options.scratchPaths, movedIn: options.movedIn });
     // A script body the command runs that hit the floor: its lines ride the request, and the call is worth a judge even
     // when the gate would have left the outer command offline.
-    // The floor's hit lines keep the body's comments; Jev reads lines of the whole body with its comments stripped, so a
-    // multi-line string keeps its quote state and a code line that starts with `#` inside it stays.
+    // Lines of the whole body with its comments stripped, as the floor reads them, so a multi-line string keeps its quote
+    // state and a code line that starts with `#` inside it stays.
     const hitSources = new Set(patterns.flatMap(hit => hit.via ?? []));
     const lineOptions = { commandRules: config.commandRules, commandDenyRules: config.commandDenyRules };
     const scriptLines = capScriptLines(scriptBodies
@@ -3044,7 +3092,7 @@ async function judgeAction(action, options) {
     };
     // Ask gate: a call that cannot change anything the agent sees is decided by the pattern pass and the floor alone.
     if (config.ask?.enabled !== false) {
-        const decision = actionAskGate(action.tool, action.input, view?.shell ? stripDataText(view.command).text : undefined, action.cwd, scriptBodies);
+        const decision = actionAskGate(action.tool, action.input, shellText, action.cwd, scriptBodies);
         if (!decision.ask && !bodyHit) {
             applyFloor();
             return withPlan({ level, source: "pattern", summary, patterns, reasons, notAsked: decision.why });

package/dist/script-bodies.d.ts

@@ -9,6 +9,14 @@ export interface ScriptSource {
 }
 /** The most of a body that is read; a larger file is left alone. */
 export declare const MAX_SCRIPT_BYTES: number;
+/**
+ * The parts of a command, cut where the shell cuts them: at a new line, `;`, `&`, and `|` outside quotes, comments, and
+ * heredoc bodies, and never at a backslash-escaped character. A heredoc body is cut at every separator, as a body fed to
+ * a shell runs. `joined` drops each backslash-newline the shell removes (outside quotes and in double quotes), so a part
+ * reads as bash runs it; without it each part is a slice of the command. Undefined when the scan cannot be sure: an
+ * unclosed quote or heredoc, a substitution, or arithmetic.
+ */
+export declare function shellParts(command: string, joined?: boolean): string[] | undefined;
 /**
  * The bodies a shell command runs from disk: shell scripts, `source`/`.`, package managers, make, interpreter files,
  * and executable paths. One level only: this function is never called on a body it reads.

package/dist/script-bodies.js

@@ -41,9 +41,152 @@ function segmentOf(part) {
         return undefined;
     return { head: basename(rawHead), rawHead, args: tokens.slice(index + 1) };
 }
-function partsOf(command) {
+function separatorParts(command) {
     return command.split(/\n|;|&&|\|\||\||&/).map(part => part.trim()).filter(Boolean);
 }
+/**
+ * The parts of a command, cut where the shell cuts them: at a new line, `;`, `&`, and `|` outside quotes, comments, and
+ * heredoc bodies, and never at a backslash-escaped character. A heredoc body is cut at every separator, as a body fed to
+ * a shell runs. `joined` drops each backslash-newline the shell removes (outside quotes and in double quotes), so a part
+ * reads as bash runs it; without it each part is a slice of the command. Undefined when the scan cannot be sure: an
+ * unclosed quote or heredoc, a substitution, or arithmetic.
+ */
+export function shellParts(command, joined = false) {
+    const parts = [];
+    const heredocs = [];
+    /** Offsets of the backslash of each backslash-newline the shell removes, in order. */
+    const joins = [];
+    let nextJoin = 0;
+    let start = 0;
+    let wordStart = true;
+    let index = 0;
+    const slice = (from, to) => {
+        if (!joined)
+            return command.slice(from, to);
+        let text = "";
+        let at = from;
+        for (; nextJoin < joins.length && joins[nextJoin] < to; nextJoin++) {
+            if (joins[nextJoin] < from)
+                continue;
+            text += command.slice(at, joins[nextJoin]);
+            at = joins[nextJoin] + 2;
+        }
+        return text + command.slice(at, to);
+    };
+    const cut = (end, next) => { parts.push(slice(start, end)); start = next; };
+    // The end of a quoted run that starts at `open`, or -1 when it does not close; `escapes` honours a backslash inside.
+    const closing = (open, quote, escapes) => {
+        for (let at = open; at < command.length; at++) {
+            const char = command[at];
+            if (escapes && char === "\\") {
+                if (quote === "\"" && command[at + 1] === "\n")
+                    joins.push(at);
+                at++;
+                continue;
+            }
+            if (char === quote)
+                return at;
+            if (quote === "\"" && (char === "`" || (char === "$" && command[at + 1] === "(")))
+                return -1;
+        }
+        return -1;
+    };
+    while (index < command.length) {
+        const char = command[index];
+        if (char === "\\") {
+            if (command[index + 1] === "\n")
+                joins.push(index);
+            else
+                wordStart = false;
+            index += 2;
+            continue;
+        }
+        if (char === "`" || (char === "$" && command[index + 1] === "(") || (char === "(" && command[index + 1] === "("))
+            return undefined;
+        if (char === "'" || char === "\"" || (char === "$" && (command[index + 1] === "'" || command[index + 1] === "\""))) {
+            const open = char === "$" ? index + 1 : index;
+            const quote = command[open];
+            const end = closing(open + 1, quote, quote === "\"" || char === "$");
+            if (end < 0)
+                return undefined;
+            index = end + 1;
+            wordStart = false;
+            continue;
+        }
+        if (char === "$" && command[index + 1] === "{") {
+            const end = command.indexOf("}", index + 2);
+            if (end < 0 || /['"`\n]|\$[({]/.test(command.slice(index + 2, end)))
+                return undefined;
+            index = end + 1;
+            wordStart = false;
+            continue;
+        }
+        if (char === "#" && wordStart) {
+            const end = command.indexOf("\n", index);
+            cut(index, end < 0 ? command.length : end);
+            index = end < 0 ? command.length : end;
+            continue;
+        }
+        if (char === "\n") {
+            cut(index, index + 1);
+            index++;
+            wordStart = true;
+            for (const { delimiter, tabs } of heredocs.splice(0)) {
+                let closed = false;
+                while (index < command.length && !closed) {
+                    const lineEnd = command.indexOf("\n", index);
+                    const line = command.slice(index, lineEnd < 0 ? command.length : lineEnd);
+                    index = lineEnd < 0 ? command.length : lineEnd + 1;
+                    closed = (tabs ? line.replace(/^\t+/, "") : line) === delimiter;
+                    if (!closed)
+                        parts.push(...separatorParts(line));
+                }
+                if (!closed)
+                    return undefined;
+            }
+            start = index;
+            continue;
+        }
+        if (char === ";" || char === "&" || char === "|") {
+            cut(index, index + 1);
+            index++;
+            wordStart = true;
+            continue;
+        }
+        if (char === "<" && command.startsWith("<<<", index)) {
+            index += 3;
+            wordStart = true;
+            continue;
+        }
+        if (char === "<" && command[index + 1] === "<") {
+            const tabs = command[index + 2] === "-";
+            index += tabs ? 3 : 2;
+            while (command[index] === " " || command[index] === "\t")
+                index++;
+            const word = /^[^\s;|&<>()]+/.exec(command.slice(index))?.[0];
+            if (word === undefined || /[$`]/.test(word))
+                return undefined;
+            const delimiter = word.replace(/'([^']*)'|"([^"]*)"|\\(.)/g, "$1$2$3");
+            if (/['"\\]/.test(delimiter))
+                return undefined;
+            heredocs.push({ delimiter, tabs });
+            index += word.length;
+            wordStart = false;
+            continue;
+        }
+        wordStart = char === " " || char === "\t" || /[()<>]/.test(char);
+        index++;
+    }
+    if (heredocs.length)
+        return undefined;
+    cut(command.length, command.length);
+    return parts.map(part => part.trim()).filter(Boolean);
+}
+/** Code a shell runs again from a quoted word: a script named inside it is found by cutting at every separator, as before. */
+const RUNS_QUOTED_CODE = /\beval\b|\b(?:ba|z|da|k)?sh\s+-[a-zA-Z]*c\b/;
+function partsOf(command) {
+    return (RUNS_QUOTED_CODE.test(command) ? undefined : shellParts(command, true)) ?? separatorParts(command);
+}
 /** The literal texts that name a temp root, before any resolution: no file system call is made for a path outside these. */
 let tempTextCache;
 function tempTextRoots() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-warden",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Makes the Pi agent follow your project's rules. Jev judges every write against your pi-warden.md and quotes the broken rule back to the agent, names slop, breaks stuck loops, calls out unverified done claims, compresses large tool output, and holds the rare destructive command. Built on pi-typesafe.",
   "type": "module",
   "license": "MIT",