prae-cli 0.6.1 → 0.6.2

package/lib/docs/pilot-dsh.md

@@ -172,9 +172,9 @@ Prefer the interactive UI? Swap `@deepseek-ai/dsh-headless` for
 | Attempt | Expected | Why |
 | --- | --- | --- |
 | Ask for the file by another relative spelling, `../pilot-target/docs/…`, an absolute path | **deny** | Paths are normalized and anchored; the content rule has no path condition anyway |
-| Ask it to `cat` / `head` / `tail` the file through the shell | **held (ask)** by `SEC-005` | Shell output is not content-inspected; the pilot pack holds the known dumpers for a human. In headless mode there is no approver, so expect the call to fail closed rather than run |
-| Ask it to `python3 -c "print(open(...).read())"`, `node -e`, `awk`, or a here-doc | **not caught** by this pack | Shell is governed by *command* rules, not by content inspection — the list of programs that can print a file is unbounded. The honest control is scope: deny or hold `proc:spawn` for agents that should not need a shell |
-| Ask it to `grep AKIA docs/` or search the directory | **not caught** by this pack | Search tools return matched *lines*; content inspection runs on whole-file reads. A pilot pack can hold `grep`/`glob` by tool name (`"tool": ["grep"]` → `ask`) if that matters to you — say so and we will ship it as an option |
+| Ask it to `cat` / `head` / `tail` the file through the shell | **held (ask)** by `SEC-005` before it runs; and from `prae-gate 0.6.0`, if it does run, the **output is withheld** (`SEC-004`, `phase: output`) | Two doors: the pilot pack holds the known dumpers for a human, and the result of any shell command is content-inspected before the model sees it. The command runs; the model gets a structured refusal saying so |
+| Ask it to `python3 -c "print(open(...).read())"`, `node -e`, `awk`, or a here-doc | **output withheld** (`SEC-004`) from `prae-gate 0.6.0` | No program list is involved: the result is scanned, not the command. Say it precisely — the process ran, the model saw nothing of what it printed. To stop the process itself, scope `proc:spawn` |
+| Ask it to `grep AKIA docs/` or search the directory | **output withheld** from `prae-gate 0.6.0` | Search results are lines, so nothing is inspected before the call; the lines it returns are, under the read rules |
 | Copy the file under `tests/fixtures/` first, then read it | **allowed, recorded** | That is the carve-out working as designed (`SEC-003` still writes a warn row). Tighten or remove the carve-out in the pack if your repos keep real secrets in fixtures |
 | Edit the ledger to hide the refusal | **chain breaks** on `prae verify` | And with a signing key configured, the signature fails without the private key — `prae keygen`, then `signingKey` in the plugin config |
 

package/lib/docs/secret-catcher.md

@@ -116,14 +116,23 @@ counterparty can check without trusting the machine it came from.
   it; the dsh plugin covers the harness's `read` tool. An agent with direct
   filesystem access outside both is covered only where its harness routes
   those calls through a gated seam.
-- **The shell is governed by scope, not by content.** `cat`, `python -c`,
-  `node -e`, a here-doc — the set of programs that can print a file is
-  unbounded, so shell output is never content-inspected. The pilot pack holds
-  the common dumpers (`SEC-005`, `ask`); the honest control for agents that
-  should not need a shell is to deny or hold `proc:spawn`.
-- **Search tools return lines, not files.** `grep`/`glob` results are not
-  content-inspected. Hold them by tool name (`"tool": ["grep"]` → `ask`) where
-  that matters; `docs/pilot-dsh.md` §4 lists this with the rest.
+- **The shell is content-inspected on the way out, not the way in.** `cat`,
+  `python -c`, `node -e`, `sed`, a here-doc — the set of programs that can
+  print a file is unbounded, so no list of them is a control. What is bounded
+  is the result: every tool result is scanned with the same detector before
+  the model sees it, and a result carrying a credential is withheld (`SEC-004`
+  in the shipped pack, `prae-gate ≥ 0.6.0`). Be exact about what that means:
+  **the command ran**; the model never saw what it printed. The ledger row says
+  `phase: output`, and the refusal the agent gets says `executed: true`. If a
+  process must not run at all, that is a scope rule on `proc:spawn`, not a
+  content rule.
+- **Search tools are covered by the same door.** `grep`/`glob` return lines,
+  not files, so nothing is inspected before they run; their output is, and a
+  matched line that carries a credential is withheld under the read rules.
+- **Shell rows carry a fingerprint, never the line.** `command: { program,
+  hash }` — the program word and a hash of the whole line — so an auditor can
+  see what ran and match repeats, while a line that carried a secret is never
+  quoted into the log.
 - **Detection is regex + entropy.** Same floor the mature at-rest scanners
   stand on; novel unformatted secrets can pass. The engine is an interface,
   not a ceiling.

package/lib/secret-catcher.prae.json

@@ -59,6 +59,23 @@
         "kind": "warn",
         "because": "a possible credential was noticed in this file; where no stronger rule fired, the read proceeded and this row is the record"
       }
+    },
+    {
+      "id": "SEC-004",
+      "title": "Shell output carrying credentials is withheld",
+      "when": {
+        "capability": "proc:spawn",
+        "secrets": {
+          "minConfidence": 0.8
+        }
+      },
+      "effect": {
+        "kind": "deny",
+        "because": "the command ran and its output contained a protected credential; the output was withheld from the model"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
+      }
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",