sshlg-skills 1.74.2 → 1.75.0

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+## v1.75.0 (2026-10-23): milestone M3 wave 1, two guards that let defects through
+
+- **B-223 closed:** on 2026-10-17 a review agent's backticked `pi update` inside a double-quoted
+  argument ran an in-place `npm install -g` that hit ENOSPC and removed the `pi` link. The
+  `PreToolUse` hook now refuses a host self-update (`pi update`, `codex update`, `brew upgrade
+  <host>`, `npm i -g <host>` and the bare global upgrades) found inside `$(…)` or backticks: at
+  top level, in double quotes, nested, in an unquoted heredoc body and in a `bash -c` script. The
+  refusal names the remedy (single quotes, escaped backticks, `-F`/`--body-file`, or the update on
+  its own line). Single-quoted text, escaped substitutions and quoted-delimiter heredocs run
+  nothing and pass; a top-level `pi update` stays the operator's call. `hostSelfUpdate()` in
+  `lib/hygiene.js`; `test/hygiene_test.js` three new cases and `test/hooks_e2e_test.js` one, all
+  red on 1.74.2.
+- **B-250 closed:** the labelled-secret detector no longer drops a long token that happens to
+  spell a placeholder word. From 100 characters a word (`dummy`, `fake`, `xxxx`, ...) counts only
+  with a boundary on both sides, and an ascending run must reach 10; shorter values keep the old
+  rules. 36 of 20,000 random 600-character JWTs were missed before, 0 of 130,000 after.
+- **Plan:** `docs/runs/2026-10-23-milestone-m3.md`, gates that cannot lie, with the operator's
+  decisions of 2026-10-22 (B-247 closed by decision; B-248, B-180, B-249 scheduled).
+- **Board:** B-253, `executablePart()` drops an unquoted heredoc body and in-string `#` lines
+  the shell would still run.
+
 ## v1.74.2 (2026-10-22): an unread Codex is not a green step
 
 - **B-252 closed:** the 1.74.1 `update` printed "11 of 11 steps, all green" beside "not read:

package/README.md

@@ -775,7 +775,7 @@ npx sshlg-skills humanizers               # anti-AI-writing skills here, with th
 |---|---|---|
 | `SessionStart` | one note saying the block is not advisory; the session's title and the ledger to watch; **and, since v0.48.0, one line naming any other enabled plugin that also injects here** — silent when there is none, and since v1.56.0 printed only when that set differs from the one recorded in `state.json` — a machine-wide record, so a second session with the same set is not told again | ~90 tokens per session |
 | `UserPromptSubmit` | names the route this prompt asks for — **once per route per session** since v1.56.0 (a route already named is not repeated; `clear` and `compact` reset the record, `resume` keeps it, a fork is a new session id and starts without one; a payload with no session id keeps no turn record at all — its note always prints and it is never escalated). One exception: a facet route printed for the first time on a prompt that writes brings the `task-pipeline` line with it, even when delivery was named earlier | nothing on the turns that don't need it |
-| `PreToolUse` | **copies before any write** to `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md`, `~/.pi/agent/AGENTS.md`, `~/.cursor/rules/sshlg-routing.mdc` and `~/.claude/settings.json` — and **refuses the write** if the copy cannot be taken. Also refuses a bare `npx skills update <member>` | nothing until one of those files is touched |
+| `PreToolUse` | **copies before any write** to `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md`, `~/.pi/agent/AGENTS.md`, `~/.cursor/rules/sshlg-routing.mdc` and `~/.claude/settings.json` — and **refuses the write** if the copy cannot be taken. Also refuses a bare `npx skills update <member>`, a gate piped into a filter and chained into `git`, and a host self-update (`pi update`, `brew upgrade codex`, `npm i -g @openai/codex`) inside `$(…)` or backticks, even in double quotes or nested, with the remedy (single quotes, escaped backticks or a file); single-quoted text runs nothing and passes | nothing until one of those files is touched |
 | `PostToolUse` | on `Bash`, `Read` and `Grep`: names a credential the tool printed — a vendor-shaped key, or a generated-looking value under a label that names one (`x-api-key: …`, `FOO_API_KEY=…`, `Authorization: Bearer …`, `.netrc`, a URL's `user:password@`) — by its label, the tool and the file or program, **never the value**, with the rotation remedy; hashes, ids and fingerprints under neutral names, placeholders, paths and code stay silent. After any skills-CLI run, names the plain copies shadowing a plugin; after `obsidian-wiki setup`, puts back the config keys it truncates | one scan of the output (each field whole up to 1 MiB, else its first 768 KiB and last 256 KiB; it says when a scan was partial), silent when it finds nothing; a local proxy's token (an active loopback `*_BASE_URL` of the same prefix, in the same file, with no other) is not reported; MCP results are not read |
 | `Notification` | a desktop ping when a long run goes idle or a background agent finishes | nothing — it emits a terminal sequence |
 | `ConfigChange` | notices when something else rewrites these entries (a field this pack writes changed; a field you added is not a change, and an entry that is gone looks like one you removed, so `hooks` lists it on demand instead) | nothing — it records; `SessionStart` reports |

package/hooks/pre-tool-use.js

@@ -15,6 +15,10 @@
  *    truncate. Nothing is denied here; `hooks/post-tool-use.js` puts back what
  *    the tool drops.
  *
+ * Between 2 and 3, two shell-shape refusals from the same pure module: a gate piped
+ * into a filter and chained into `git`, and a host self-update (`pi update`,
+ * `brew upgrade codex`, `npm i -g @openai/codex`) inside `$(…)` or backticks (B-223).
+ *
  * All deciding is in `lib/guard.js` and `lib/hygiene.js`, both pure and fixtured.
  * This file moves bytes and touches the filesystem exactly where a backup happens.
  *
@@ -233,6 +237,22 @@ process.stdin.on('end', () => {
       return process.exit(0);
     }
 
+    // 1c. A host self-update inside `$(…)` or backticks (hygiene.js #5, B-223): prose the
+    //     shell reads as code, and an in-place upgrade that can remove the host it updates.
+    const selfUpdate = command && hygiene.hostSelfUpdate(command);
+    if (selfUpdate) {
+      say('deny',
+        `\`${selfUpdate.command}\` sits inside a command substitution (${selfUpdate.form}), so the shell ` +
+        'runs it before the command around it starts. A host that updates itself in place can fail ' +
+        'halfway (ENOSPC, a dropped download) and remove its own link: on 2026-10-17 a backticked ' +
+        '`pi update` in a double-quoted argument did exactly that.\n' +
+        'If this is text (a commit message, a PR body, a comment), put it in single quotes, escape the ' +
+        'backticks as \\`, or pass it through a file (`git commit -F <file>`, `gh ... --body-file <file>`).\n' +
+        'If you mean to update the host, run that command on its own, outside `$(...)` and backticks, ' +
+        'after checking free disk space (`df -h`).');
+      return process.exit(0);
+    }
+
     // 2. The config `setup` is about to truncate.
     if (command && hygiene.isObsidianSetup(command)) {
       try {

package/lib/hygiene.js

@@ -347,8 +347,276 @@ function maskedGate(command) {
   return { gate: m[1].trim(), filter: m[2], git: m[3] };
 }
 
+/**
+ * 5. **A host self-update inside a command substitution (B-223).** On 2026-10-17 a review
+ *    agent wrote `pi update` in backticks inside a double-quoted argument. The shell ran it
+ *    before the command around it started; the in-place `npm install -g` hit ENOSPC and
+ *    removed the `pi` link. Nobody typed `pi update` as a command: it was prose that the
+ *    shell read as code.
+ *
+ * `executablePart` cannot see this and is not meant to: it keeps quoted strings whole and
+ * the other rules read them as words, so `"run \`pi update\`"` is one argument to them. This
+ * rule reads the payload the way the shell does, with a small lexer of its own:
+ *
+ * - `$(…)` and backticks are code, at top level, inside double quotes, nested, inside an
+ *   unquoted heredoc body (the shell expands those for `cat` too) and inside the script of
+ *   `bash -c '…'` (literal to the outer shell, code to the inner one).
+ * - Single quotes, `$'…'`, an escaped `\$(` or `` \` ``, a quoted-delimiter heredoc fed to a
+ *   non-shell, and a comment are literal: none of them runs.
+ * - Inside a substitution, only the COMMAND position counts: `$(echo pi update)` runs `echo`.
+ *
+ * Only a substitution is refused. `pi update` typed as its own command is a deliberate act
+ * and stays the operator's call.
+ *
+ * Returns `{command, host, form}` (`form` is `$(…)` or `backticks`) or `null`. Pure, and it
+ * never throws: a payload the lexer cannot follow ends at end of input.
+ */
+const HOSTS = new Set([
+  'pi', 'pi-coding-agent', 'codex', 'claude', 'claude-code', 'gemini', 'gemini-cli',
+  'opencode', 'opencode-ai', 'cursor-agent', 'amp', 'goose', 'crush', 'droid', 'qwen',
+  'qwen-code', 'kimi', 'kimi-cli', 'copilot', 'hermes', 'hermes-agent',
+]);
+const HOST_VERBS = new Set(['update', 'upgrade', 'self-update']);
+const SCRIPT_SHELLS = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh']);
+const PREFIXES = new Set(['sudo', 'env', 'command', 'exec', 'nohup', 'time', 'nice', 'builtin',
+  '{', '!', 'if', 'then', 'elif', 'else', 'while', 'until', 'do']);
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const SUB = '\u0000';
+
+/** `@openai/codex@1.2` -> `codex`; `openai/tap/codex` -> `codex`. */
+function packageName(spec) {
+  return String(spec || '').replace(/(.)@.*$/, '$1').replace(/^.*\//, '');
+}
+
+/** Text the shell expands (`"…"`, an unquoted heredoc body): `$(` and backticks run. */
+function expandable(src, i, stop, subs, add) {
+  const n = src.length;
+  while (i < n) {
+    const c = src[i];
+    if (stop !== null && c === stop) return i + 1;
+    if (c === '\\') {
+      const d = src[i + 1];
+      if (d === '\n') { i += 2; continue; }
+      if (d === '$' || d === '`' || d === '\\' || (stop !== null && d === stop)) { add(d); i += 2; continue; }
+      add(c); i += 1; continue;
+    }
+    if (c === '$' && src[i + 1] === '(') { i = substitution(src, i + 2, subs); add(SUB); continue; }
+    if (c === '`') { i = backtick(src, i + 1, subs); add(SUB); continue; }
+    add(c); i += 1;
+  }
+  return n;
+}
+
+function substitution(src, i, subs) {
+  const r = lex(src, i, ')', subs);
+  subs.push({ form: '$(…)', commands: r.commands });
+  return r.end;
+}
+
+function backtick(src, i, subs) {
+  // Inside backticks a backslash escapes only `$`, a backtick and itself; the body is
+  // unescaped once and read as a script, which is how nested backticks are written.
+  let body = '';
+  let j = i;
+  while (j < src.length && src[j] !== '`') {
+    if (src[j] === '\\' && ['`', '\\', '$'].includes(src[j + 1])) { body += src[j + 1]; j += 2; continue; }
+    body += src[j]; j += 1;
+  }
+  const r = lex(body, 0, null, subs);
+  subs.push({ form: 'backticks', commands: r.commands });
+  return j + 1;
+}
+
+function heredocBodies(src, i, list, subs) {
+  for (const h of list) {
+    let body = '';
+    while (i < src.length) {
+      let e = src.indexOf('\n', i);
+      if (e < 0) e = src.length;
+      const line = src.slice(i, e);
+      i = e + 1;
+      if (line.trim() === h.delim) break;
+      body += line + '\n';
+    }
+    if (!h.quoted) expandable(body, 0, null, subs, () => {});
+    if (h.shell) lex(body, 0, null, subs);
+  }
+  return i;
+}
+
+/**
+ * Simple commands as word lists, quotes removed, a substitution left as a marker. With
+ * `close === ')'` it reads the body of `$(…)` and returns where it ended.
+ */
+function lex(src, start, close, subs) {
+  const commands = [];
+  const pending = [];
+  let words = [];
+  let word = null;
+  let depth = 0;
+  let i = start;
+  const n = src.length;
+  const add = (s) => { word = (word === null ? '' : word) + s; };
+  const endWord = () => { if (word !== null) { words.push(word); word = null; } };
+  const endCommand = () => { endWord(); if (words.length) commands.push(words); words = []; };
+  while (i < n) {
+    const c = src[i];
+    if (c === ')' && close === ')' && depth === 0) { endCommand(); return { end: i + 1, commands }; }
+    if (c === ' ' || c === '\t' || c === '\r') { endWord(); i += 1; continue; }
+    if (c === '\n') {
+      endCommand(); i += 1;
+      if (pending.length) i = heredocBodies(src, i, pending.splice(0), subs);
+      continue;
+    }
+    if (c === '&' && src[i + 1] === '>') { endWord(); i += 2; continue; }
+    if (c === ';' || c === '&' || c === '|') { endCommand(); i += 1; continue; }
+    if (c === '(') { endCommand(); depth += 1; i += 1; continue; }
+    if (c === ')') { endCommand(); if (depth > 0) depth -= 1; i += 1; continue; }
+    if (c === '#' && word === null) { while (i < n && src[i] !== '\n') i += 1; continue; }
+    if (c === '\\') {
+      if (src[i + 1] !== '\n') add(src[i + 1] || '');
+      i += 2; continue;
+    }
+    if (c === "'") {
+      const j = src.indexOf("'", i + 1);
+      const stop = j < 0 ? n : j;
+      add(src.slice(i + 1, stop)); i = stop + 1; continue;
+    }
+    if (c === '$' && src[i + 1] === "'") {
+      let j = i + 2; let s = '';
+      while (j < n && src[j] !== "'") {
+        if (src[j] === '\\') { s += src[j + 1] || ''; j += 2; } else { s += src[j]; j += 1; }
+      }
+      add(s); i = j + 1; continue;
+    }
+    if (c === '"') { add(''); i = expandable(src, i + 1, '"', subs, add); continue; }
+    if (c === '$' && src[i + 1] === '(') { i = substitution(src, i + 2, subs); add(SUB); continue; }
+    if (c === '`') { i = backtick(src, i + 1, subs); add(SUB); continue; }
+    if (c === '<' && src[i + 1] === '<' && src[i + 2] === '<') { endWord(); i += 3; continue; }
+    if (c === '<' && src[i + 1] === '<') {
+      endWord();
+      let j = i + 2;
+      if (src[j] === '-') j += 1;
+      while (src[j] === ' ' || src[j] === '\t') j += 1;
+      let delim = '';
+      let quoted = false;
+      while (j < n && !/[\s;&|<>()]/.test(src[j])) {
+        const d = src[j];
+        if (d === "'" || d === '"') {
+          quoted = true;
+          const k = src.indexOf(d, j + 1);
+          const stop = k < 0 ? n : k;
+          delim += src.slice(j + 1, stop); j = stop + 1; continue;
+        }
+        if (d === '\\') { quoted = true; delim += src[j + 1] || ''; j += 2; continue; }
+        delim += d; j += 1;
+      }
+      const cmd = words.find((w) => !ASSIGNMENT.test(w)) || '';
+      if (delim) pending.push({ delim, quoted, shell: HEREDOC_SHELLS.has(bareName(cmd)) });
+      i = j; continue;
+    }
+    if (c === '<' || c === '>') {
+      endWord(); i += 1;
+      if (src[i] === '&' || src[i] === '|' || src[i] === '>') i += 1;
+      continue;
+    }
+    add(c); i += 1;
+  }
+  endCommand();
+  return { end: n, commands };
+}
+
+/** The words from the command name on, past `sudo`, `env`, assignments and keywords. */
+function commandWords(words) {
+  let k = 0;
+  while (k < words.length) {
+    const w = words[k];
+    if (ASSIGNMENT.test(w)) { k += 1; continue; }
+    if (PREFIXES.has(bareName(w))) {
+      k += 1;
+      while (k < words.length && /^-/.test(words[k])) k += 1;
+      continue;
+    }
+    break;
+  }
+  return words.slice(k);
+}
+
+/** Is this simple command a coding-agent host updating itself? `'pi update'` or null. */
+function hostCall(words) {
+  const cw = commandWords(words);
+  if (!cw.length) return null;
+  const tool = bareName(cw[0]);
+  const rest = cw.slice(1);
+  const pos = rest.filter((w) => !/^-/.test(w));
+  const said = () => cw.join(' ');
+  if (HOSTS.has(tool)) {
+    return pos.length && HOST_VERBS.has(pos[0]) ? { command: `${tool} ${pos[0]}`, host: tool } : null;
+  }
+  if (['npm', 'pnpm', 'bun', 'yarn'].includes(tool)) {
+    let global = rest.some((w) => w === '-g' || w === '--global' || w === '--location=global');
+    let args = pos;
+    if (rest.includes('--location') && pos.includes('global')) {
+      global = true; args = pos.filter((w, k) => !(w === 'global' && k === pos.indexOf('global')));
+    }
+    if (tool === 'yarn' && args[0] === 'global') { global = true; args = args.slice(1); }
+    if (!global) return null;
+    const verbs = tool === 'yarn' ? ['add', 'upgrade', 'up'] : ['i', 'install', 'add', 'update', 'up', 'upgrade'];
+    if (!verbs.includes(args[0])) return null;
+    const pkgs = args.slice(1);
+    const host = pkgs.map(packageName).find((p) => HOSTS.has(p));
+    if (host) return { command: said(), host };
+    if (!pkgs.length && ['update', 'up', 'upgrade'].includes(args[0])) return { command: said(), host: 'every global package' };
+    return null;
+  }
+  if (tool === 'brew') {
+    if (!['upgrade', 'reinstall', 'install'].includes(pos[0])) return null;
+    const formulae = pos.slice(1);
+    const host = formulae.map(packageName).find((p) => HOSTS.has(p));
+    if (host) return { command: said(), host };
+    if (!formulae.length && pos[0] === 'upgrade') return { command: said(), host: 'every outdated formula' };
+    return null;
+  }
+  return null;
+}
+
+/** `bash -c '<script>'` / `sh -lc "<script>"`: the script, or null. */
+function shellScript(words) {
+  const cw = commandWords(words);
+  if (!cw.length || !SCRIPT_SHELLS.has(bareName(cw[0]))) return null;
+  const at = cw.findIndex((w, k) => k > 0 && /^-[A-Za-z]*c[A-Za-z]*$/.test(w));
+  return at > 0 && at + 1 < cw.length ? cw[at + 1] : null;
+}
+
+function hostSelfUpdate(command) {
+  try {
+    const text = command == null ? '' : String(command);
+    const all = [];
+    const top = lex(text, 0, null, all);
+    all.push({ form: null, commands: top.commands });
+    // Bounded, so a pathological payload costs a fixed amount of work and nothing else.
+    for (let p = 0; p < all.length && p < 512; p += 1) {
+      const { form, commands } = all[p];
+      for (const words of commands) {
+        if (form) {
+          const hit = hostCall(words);
+          if (hit) return Object.assign(hit, { form });
+        }
+        const script = shellScript(words);
+        if (script !== null) {
+          const r = lex(script, 0, null, all);
+          all.push({ form, commands: r.commands });
+        }
+      }
+    }
+  } catch (e) {
+    /* Pure and silent: an input this lexer cannot follow is not a reason to break a turn. */
+  }
+  return null;
+}
+
 module.exports = {
-  maskedGate,
+  maskedGate, hostSelfUpdate,
   skillsCli, familyIds, bareFamilyInstall, launcherRunning, executablePart,
   isObsidianSetup, parseConfig, reapply, bareName, REMEDY,
 };

package/lib/labelledsecrets.js

@@ -258,8 +258,17 @@ function labelIsSecret(label) {
 
 const PLACEHOLDER = /redacted|placeholder|example|changeme|change_me|your[_-]|xxxx|dummy|fake|sample|replace|todo|\*\*\*|\.\.\./i;
 
+// From this length a value is a generated token (a JWT, a session token), and random
+// base64 spells a placeholder word often enough to drop a real one: 36 of 20,000 random
+// 600-character JWTs (B-250). `-` and `_` are base64url letters too, so there a word counts
+// only with a boundary on both sides (`….REDACTED`, `<YOUR_TOKEN>`), and an ascending run
+// must reach 10. Shorter values keep the substring rule (`...EXAMPLEKEY` in docs) and 6.
+const LONG_VALUE = 100;
+const PLACEHOLDER_WORD = /(?:^|[^A-Za-z0-9])(?:redacted|placeholder|example|changeme|change_me|xxxx|dummy|fake|sample|replace|todo)(?=$|[^A-Za-z0-9])|(?:^|[^A-Za-z0-9])your[_-]|\*\*\*|\.\.\./i;
+const ascendingLimit = (v) => (v.length >= LONG_VALUE ? 10 : 6);
 function isPlaceholder(v) {
-  return PLACEHOLDER.test(String(v));
+  const s = String(v);
+  return s.length >= LONG_VALUE ? PLACEHOLDER_WORD.test(s) : PLACEHOLDER.test(s);
 }
 
 /** The longest run of consecutive ascending characters (`3456`, `cdef`): an example, typed. */
@@ -337,7 +346,7 @@ function userinfoLooksSecret(raw) {
   if (!/[A-Za-z]/.test(v) || !/\d/.test(v)) return false;
   if (/^[$%{<*]/.test(v) || /\$\{|\{\{/.test(v)) return false;
   if (isPlaceholder(v) || /^(?:pass(?:word)?|secret|token)\d*$/i.test(v)) return false;
-  if (ascendingRun(v) >= 6) return false;
+  if (ascendingRun(v) >= ascendingLimit(v)) return false;
   if (/^(?:[a-z]+|[A-Z][a-z]*|[A-Z]+)(?:[_-](?:[a-z]+|[A-Z][a-z]*|[A-Z]+))*[_-]?\d{0,4}$/.test(v)) {
     return false;                                                        // WORDS_LIKE_THIS_2026
   }
@@ -380,7 +389,7 @@ function valueLooksSecret(v) {
   if (/^(?:pk|pub|public)[_.]/.test(v)) return false;
   if (/^[a-z][a-z0-9]{0,15}(?:_[a-z][a-z0-9]{0,15})+$/.test(v)
     && (v.match(/\d/g) || []).length <= 3) return false;               // a snake_case name
-  if (ascendingRun(v) >= 6) return false;                                // `…123456`, `abcdef…`
+  if (ascendingRun(v) >= ascendingLimit(v)) return false;                                // `…123456`, `abcdef…`
   if (looksLikeSlug(v)) return false;                                    // a k8s object name
   if (/^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/.test(v)) return false;          // an ENV_VAR_NAME_2
   if (v.includes('/') && v.split('/').every((seg) => /^[A-Za-z][A-Za-z_-]*\d{0,3}$/.test(seg))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sshlg-skills",
-  "version": "1.74.2",
+  "version": "1.75.0",
   "skillsCli": "skills@1.7.2",
   "description": "The ssheleg harness skill layer: routing, delivery gates, specialist skills and durable handoffs for coding agents.",
   "bin": {