rafter-cli 0.11.3__tar.gz → 0.11.4__tar.gz

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rafter-cli
-Version: 0.11.3
+Version: 0.11.4
 Summary: Rafter CLI — the default security agent for AI workflows. Free for individuals and open source.
 License: MIT
 Author: Rafter Team
@@ -166,7 +166,7 @@ Export Rafter policy for agent platforms.
 
 ```bash
 # Filter high-severity vulnerabilities (SARIF levels: error, warning, note)
-rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.level=="error")'
+rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.severity=="error")'
 
 # CI gate
 if rafter get SCAN_ID --format json | jq -e '.vulnerabilities | length > 0'; then

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/README.md

@@ -139,7 +139,7 @@ Export Rafter policy for agent platforms.
 
 ```bash
 # Filter high-severity vulnerabilities (SARIF levels: error, warning, note)
-rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.level=="error")'
+rafter get SCAN_ID --format json | jq '.vulnerabilities[] | select(.severity=="error")'
 
 # CI gate
 if rafter get SCAN_ID --format json | jq -e '.vulnerabilities | length > 0'; then

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "rafter-cli"
-version = "0.11.3"
+version = "0.11.4"
 description = "Rafter CLI — the default security agent for AI workflows. Free for individuals and open source."
 authors = ["Rafter Team <hello@rafter.so>"]
 license = "MIT"

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/commands/agent.py

@@ -223,7 +223,7 @@ def _install_claude_code_hooks(root: Path, quiet: bool = False) -> None:
     post_hook = {"type": "command", "command": post_command}
     settings["hooks"]["PreToolUse"].extend([
         {"matcher": "Bash", "hooks": [pre_hook]},
-        {"matcher": "Write|Edit", "hooks": [pre_hook]},
+        {"matcher": "Write|Edit|MultiEdit", "hooks": [pre_hook]},
     ])
     # Narrow to tools that produce scannable output (shell output + file
     # writes). Firing posttool on every tool — including Read and MCP calls —
@@ -733,9 +733,9 @@ def _install_gemini_mcp(root: Path, quiet: bool = False) -> bool:
 
 # Cursor hook events covered by rafter (rf-svn3).
 _CURSOR_HOOK_EVENTS: tuple[tuple[str, str], ...] = (
-    ("preToolUse", "rafter hook pretool --format cursor"),
-    ("postToolUse", "rafter hook posttool --format cursor"),
-    ("beforeShellExecution", "rafter hook pretool --format cursor"),
+    ("preToolUse", "hook pretool --format cursor"),
+    ("postToolUse", "hook posttool --format cursor"),
+    ("beforeShellExecution", "hook pretool --format cursor"),
 )
 
 # Skills shipped as both Cursor rules and Claude Code / Codex / Gemini skills.
@@ -803,7 +803,7 @@ def _install_gemini_hooks(root: Path, quiet: bool = False) -> None:
     hooks = settings.setdefault("hooks", {})
     rafter_bin = _resolve_rafter_path()
     for event, sub, matcher in (
-        ("BeforeTool", "pretool", "run_shell_command|write_file|replace|edit"),
+        ("BeforeTool", "pretool", "run_shell_command|write_file|replace"),
         ("AfterTool", "posttool", ".*"),
     ):
         entries = hooks.get(event) or []
@@ -842,7 +842,11 @@ def _install_cursor_hooks(root: Path, quiet: bool = False) -> None:
     config.setdefault("version", 1)
     config.setdefault("hooks", {})
 
-    for event, command in _CURSOR_HOOK_EVENTS:
+    # The resolved path, as for the Claude Code and Codex hooks: Cursor runs
+    # hooks without the user's shell PATH, where a bare `rafter` may not resolve.
+    rafter_bin = _resolve_rafter_path()
+    for event, args in _CURSOR_HOOK_EVENTS:
+        command = f"{rafter_bin} {args}"
         entries = config["hooks"].get(event)
         if not isinstance(entries, list):
             entries = []

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/commands/agent_components.py

@@ -205,7 +205,7 @@ def _claude_code_hooks() -> ComponentSpec:
                 del hooks["SessionStart"]
         hooks["PreToolUse"].extend([
             {"matcher": "Bash", "hooks": [pre]},
-            {"matcher": "Write|Edit", "hooks": [pre]},
+            {"matcher": "Write|Edit|MultiEdit", "hooks": [pre]},
         ])
         # Narrow to tools that produce scannable output (shell output + file
         # writes); avoids firing posttool on every Read/MCP call (latency).
@@ -594,8 +594,9 @@ def _gemini_hooks() -> ComponentSpec:
         h["AfterTool"] = _filter_hooks(h["AfterTool"], lambda e: _hook_entry_has_rafter(e, "rafter hook posttool"))
         # Explicit Gemini built-in tool names per geminicli.com/docs/hooks/reference
         # (rf-044o verification).
+        #  No tool is named `edit`: Gemini's edit tool is `replace`.
         h["BeforeTool"].append({
-            "matcher": "run_shell_command|write_file|replace|edit",
+            "matcher": "run_shell_command|write_file|replace",
             "hooks": [{"type": "command", "command": "rafter hook pretool --format gemini", "timeout": 5000}],
         })
         h["AfterTool"].append({

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/commands/hook.py

@@ -455,8 +455,9 @@ def _writes_rafter_security_config(file_path: str) -> bool:
 def _evaluate_write(tool_input: dict) -> dict:
     # rf-vnxs: checked FIRST, and before the no-content early return, because a
     # truncating write with empty content disables the hook just as well as one
-    # carrying JSON.
-    if _writes_rafter_security_config(tool_input.get("file_path", "")):
+    # carrying JSON. apply_patch names its targets only in the patch headers.
+    targets = [tool_input.get("file_path", ""), *tool_input.get("patch_paths", [])]
+    if any(_writes_rafter_security_config(t) for t in targets):
         return {
             "decision": "deny",
             "reason": (
@@ -572,7 +573,8 @@ def _normalize_write_input(tool_name: str, tool_input: dict) -> dict:
 
     Continue's Write names its path ``filepath``; MultiEdit and Windsurf's
     pre_write_code carry ``edits[].new_string``; Codex's apply_patch carries
-    the whole patch in ``command``.
+    the whole patch in ``command``, with its target paths in the patch
+    headers (``patch_paths``).
     """
     out = dict(tool_input)
     if "file_path" not in out and isinstance(tool_input.get("filepath"), str):
@@ -585,9 +587,28 @@ def _normalize_write_input(tool_name: str, tool_input: dict) -> dict:
             )
         elif tool_name == "apply_patch" and isinstance(tool_input.get("command"), str):
             out["content"] = tool_input["command"]
+    if tool_name == "apply_patch" and isinstance(tool_input.get("command"), str):
+        out["patch_paths"] = _apply_patch_paths(tool_input["command"])
     return out
 
 
+# The apply_patch format carries its targets only in hunk headers, which Codex
+# matches on the trimmed line (codex-rs/apply-patch, apply_patch.lark).
+_APPLY_PATCH_HEADERS = ("*** Add File: ", "*** Update File: ", "*** Delete File: ", "*** Move to: ")
+
+
+def _apply_patch_paths(patch: str) -> list[str]:
+    """Every path an apply_patch names."""
+    paths = []
+    for raw in patch.split("\n"):
+        line = raw.strip()
+        for header in _APPLY_PATCH_HEADERS:
+            if line.startswith(header):
+                paths.append(line[len(header):].strip())
+                break
+    return paths
+
+
 def _deny_on_error(exc: Exception) -> dict:
     reason = f"rafter hook error: {type(exc).__name__}: {exc}; denying to be safe"
     print(reason, file=sys.stderr)

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/commands/issues/issue_builder.py

@@ -17,10 +17,28 @@ class IssueDraft:
 
 @dataclass
 class BackendVulnerability:
-    rule_id: str
-    level: str
-    message: str
-    file: str
+    """Backend vulnerability from `GET /api/static/scan` (`rafter get <id> --format json`).
+
+    The real API shape (`toRafterFindings()` on the backend) is
+    `rule_id`/`severity`/`title`/`description`/`file_path`/`line_start`/
+    `line_end` plus optional `cwe`/`confidence`. `level`/`message`/`file`/
+    `line` are the pre-rename names, kept as a fallback for old cached
+    payloads and existing tests, never the primary source.
+    """
+
+    rule_id: str = ""
+    severity: str = ""
+    title: str = ""
+    description: str = ""
+    file_path: str | None = None
+    line_start: int | None = None
+    line_end: int | None = None
+    cwe: str | None = None
+    confidence: str | None = None
+    # Pre-rename names.
+    level: str = ""
+    message: str = ""
+    file: str = ""
     line: int | None = None
 
 
@@ -67,24 +85,31 @@ def _truncate(s: str, max_len: int) -> str:
 
 
 def build_from_backend_vulnerability(vuln: BackendVulnerability) -> IssueDraft:
-    sev = _severity_label(vuln.level)
-    emoji = _severity_emoji(vuln.level)
-    fp = fingerprint(vuln.file, vuln.rule_id)
+    rule_id = vuln.rule_id or "unknown-rule"
+    level = vuln.severity or vuln.level or "note"
+    summary = vuln.title or vuln.message or "Security finding"
+    details = vuln.description or vuln.message or summary
+    file = vuln.file_path or vuln.file or "unknown file"
+    line = vuln.line_start if vuln.line_start is not None else vuln.line
+
+    sev = _severity_label(level)
+    emoji = _severity_emoji(level)
+    fp = fingerprint(file, rule_id)
 
-    title = f"{emoji} [{sev.upper()}] {vuln.rule_id}: {_truncate(vuln.message, 80)}"
+    title = f"{emoji} [{sev.upper()}] {rule_id}: {_truncate(summary, 80)}"
 
     body = f"## Security Finding\n\n"
-    body += f"**Rule:** `{vuln.rule_id}`\n"
+    body += f"**Rule:** `{rule_id}`\n"
     body += f"**Severity:** {sev}\n"
-    body += f"**File:** `{vuln.file}`"
-    if vuln.line:
-        body += f" (line {vuln.line})"
+    body += f"**File:** `{file}`"
+    if line:
+        body += f" (line {line})"
     body += "\n\n"
-    body += f"### Description\n\n{vuln.message}\n\n"
-    body += f"### Remediation\n\nReview and fix the finding in `{vuln.file}`.\n"
+    body += f"### Description\n\n{details}\n\n"
+    body += f"### Remediation\n\nReview and fix the finding in `{file}`.\n"
     body += "\n---\n*Created by [Rafter CLI](https://rafter.so) — security for AI builders*\n"
 
-    labels = ["security", f"severity:{sev}", f"rule:{vuln.rule_id}"]
+    labels = ["security", f"severity:{sev}", f"rule:{rule_id}"]
 
     return IssueDraft(
         title=title,

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/commands/issues/issues_app.py

@@ -268,10 +268,19 @@ def _drafts_from_backend(scan_id: str, api_key: str | None) -> list[IssueDraft]:
     return [
         build_from_backend_vulnerability(
             BackendVulnerability(
-                rule_id=v["ruleId"],
-                level=v.get("level", "warning"),
-                message=v.get("message", ""),
-                file=v.get("file", ""),
+                rule_id=v.get("rule_id") or v.get("ruleId") or "",
+                severity=v.get("severity") or "",
+                title=v.get("title") or "",
+                description=v.get("description") or "",
+                file_path=v.get("file_path"),
+                line_start=v.get("line_start"),
+                line_end=v.get("line_end"),
+                cwe=v.get("cwe"),
+                confidence=v.get("confidence"),
+                # Pre-rename names — fallback for old cached payloads.
+                level=v.get("level") or "",
+                message=v.get("message") or "",
+                file=v.get("file") or "",
                 line=v.get("line"),
             )
         )

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/commands/notify.py

@@ -57,19 +57,81 @@ def _detect_platform(url: str) -> str:
     return "generic"
 
 
+def _severity_tier(raw: str | None) -> str:
+    """Map a raw severity/level to a display tier.
+
+    Uses the same rules as the GitHub Action (github-action/action.yml) and
+    ``rafter get``, so notify agrees with both. A value outside the known set is
+    kept verbatim so a finding is never silently dropped.
+    """
+    s = (raw or "").lower()
+    if s == "critical":
+        return "critical"
+    if s in ("error", "high"):
+        return "high"
+    if s in ("warning", "medium"):
+        return "medium"
+    if s in ("note", "low"):
+        return "low"
+    return s or "unknown"
+
+
+def _normalize_scan(scan_data: dict) -> dict:
+    """Read findings from the real scan shape (``vulnerabilities[]``).
+
+    Falls back to the legacy ``findings[]`` for old cached payloads. Counts are
+    derived from each finding's own severity — never from ``summary`` — so a
+    finding cannot be lost to a summary field this code does not read. "Clean"
+    is therefore reported only when there are genuinely zero findings.
+    """
+    raw = scan_data.get("vulnerabilities")
+    if not isinstance(raw, list):
+        raw = scan_data.get("findings")
+    if not isinstance(raw, list):
+        raw = []
+
+    counts = {"critical": 0, "high": 0, "medium": 0, "low": 0}
+    findings = []
+    for v in raw:
+        tier = _severity_tier(v.get("severity") or v.get("level"))
+        if tier in counts:
+            counts[tier] += 1
+        title = (
+            v.get("title")
+            or v.get("rule_id")
+            or v.get("ruleId")
+            or v.get("message")
+            or "Unknown"
+        )
+        file = v.get("file_path") or v.get("file")
+        line = v.get("line_start") if v.get("line_start") is not None else v.get("line")
+        location = v.get("location") or file or ""
+        if not v.get("location") and file and line is not None:
+            location = f"{file}:{line}"
+        findings.append({"severity": tier, "title": title, "location": location})
+
+    return {
+        "findings": findings,
+        "critical": counts["critical"],
+        "high": counts["high"],
+        "medium": counts["medium"],
+        "low": counts["low"],
+        "total": len(findings),
+    }
+
+
 def _format_slack_payload(scan_data: dict) -> dict:
     """Format scan results as a Slack message with Block Kit."""
     status = scan_data.get("status", "unknown")
     repo = scan_data.get("repository_name", "unknown")
     scan_id = scan_data.get("scan_id", "")
-    findings = scan_data.get("findings", [])
-    summary = scan_data.get("summary", {})
-
-    critical = summary.get("critical", 0)
-    high = summary.get("high", 0)
-    medium = summary.get("medium", 0)
-    low = summary.get("low", 0)
-    total = critical + high + medium + low
+    norm = _normalize_scan(scan_data)
+    findings = norm["findings"]
+    critical = norm["critical"]
+    high = norm["high"]
+    medium = norm["medium"]
+    low = norm["low"]
+    total = norm["total"]
 
     # Status emoji
     if status == "completed" and total == 0:
@@ -140,12 +202,9 @@ def _format_slack_payload(scan_data: dict) -> dict:
     if findings:
         finding_lines = []
         for f in findings[:5]:
-            sev = f.get("severity", "unknown").upper()
-            title = f.get("title", f.get("rule_id", "Unknown"))
-            location = f.get("location", f.get("file", ""))
-            line = f"• `[{sev}]` {title}"
-            if location:
-                line += f" — {location}"
+            line = f"• `[{f['severity'].upper()}]` {f['title']}"
+            if f["location"]:
+                line += f" — {f['location']}"
             finding_lines.append(line)
 
         if len(findings) > 5:
@@ -179,14 +238,13 @@ def _format_discord_payload(scan_data: dict) -> dict:
     status = scan_data.get("status", "unknown")
     repo = scan_data.get("repository_name", "unknown")
     scan_id = scan_data.get("scan_id", "")
-    findings = scan_data.get("findings", [])
-    summary = scan_data.get("summary", {})
-
-    critical = summary.get("critical", 0)
-    high = summary.get("high", 0)
-    medium = summary.get("medium", 0)
-    low = summary.get("low", 0)
-    total = critical + high + medium + low
+    norm = _normalize_scan(scan_data)
+    findings = norm["findings"]
+    critical = norm["critical"]
+    high = norm["high"]
+    medium = norm["medium"]
+    low = norm["low"]
+    total = norm["total"]
 
     # Embed color
     if status == "completed" and total == 0:
@@ -237,12 +295,9 @@ def _format_discord_payload(scan_data: dict) -> dict:
     if findings:
         finding_lines = []
         for f in findings[:5]:
-            sev = f.get("severity", "unknown").upper()
-            title = f.get("title", f.get("rule_id", "Unknown"))
-            location = f.get("location", f.get("file", ""))
-            line = f"• `[{sev}]` {title}"
-            if location:
-                line += f" — {location}"
+            line = f"• `[{f['severity'].upper()}]` {f['title']}"
+            if f["location"]:
+                line += f" — {f['location']}"
             finding_lines.append(line)
 
         if len(findings) > 5:
@@ -271,8 +326,7 @@ def _format_generic_payload(scan_data: dict) -> dict:
     """Format scan results as a plain JSON payload with text field."""
     status = scan_data.get("status", "unknown")
     repo = scan_data.get("repository_name", "unknown")
-    summary = scan_data.get("summary", {})
-    total = sum(summary.get(k, 0) for k in ("critical", "high", "medium", "low"))
+    total = _normalize_scan(scan_data)["total"]
 
     if status == "completed" and total == 0:
         status_text = "Clean — no issues found"

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/commands/policy.py

@@ -23,7 +23,7 @@ def _generate_claude_config() -> str:
                     "hooks": [{"type": "command", "command": "rafter hook pretool"}],
                 },
                 {
-                    "matcher": "Write|Edit",
+                    "matcher": "Write|Edit|MultiEdit",
                     "hooks": [{"type": "command", "command": "rafter hook pretool"}],
                 },
             ],

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/core/risk_rules.py

@@ -978,10 +978,231 @@ def modifies_rafter_security_config(command: str) -> bool:
     """
     if _disarms_rafter(command):
         return True
+    if _writes_rafter_dir(command):
+        return True
     sanitized = sanitize_command_for_matching(command)
     return sanitized != command and _disarms_rafter(sanitized)
 
 
+def _writes_rafter_dir(command: str) -> bool:
+    """sable-36oe: the SHELL route to rafter's own directory (``~/.rafter``).
+
+    The Write/Edit route already refuses it (rf-vnxs, ``_writes_rafter_security_config``
+    in commands/hook.py); ``rm ~/.rafter/config.json`` disarms the gate exactly
+    as ``rafter agent config set agent.hooks.enabled false`` does.
+
+    Deny-by-default scoped to the path, NOT a blocklist of write verbs, which
+    are unbounded. A command is protected when a statement that NAMES the
+    rafter dir is not a known read-only command without an output redirect.
+    Statements that do not name it are not constrained; a cd INTO the dir is
+    itself not read-only, which keeps ``cd ~/.rafter && echo x > config.json``
+    blocked. Checked on the raw text (a quoted reference
+    counts) and on the normalized view (brace lists, ANSI-C quotes). Mirrors
+    node/src/core/risk-rules.ts ``writesRafterDir`` decision for decision.
+    """
+    if _rafter_dir_scan(command):
+        return True
+    normalized = normalize_for_matching(command)
+    return normalized != command and _rafter_dir_scan(normalized)
+
+
+_RAFTER_DIR_NAME = ".rafter"
+_NAME_CHAR = re.compile(r"[a-z0-9_.-]", re.IGNORECASE)
+_GLOB_CHAR = re.compile(r"[*?\[]")
+
+
+def _is_name_char(c: str) -> bool:
+    """Characters that continue a file name: ``.rafter.yml`` is not ``.rafter``."""
+    return bool(_NAME_CHAR.fullmatch(c))
+
+
+def _names_rafter_dir(text: str, globs: bool) -> bool:
+    """True if ``text`` names the rafter dir as a whole path component.
+
+    Case-insensitive (macOS file systems are). With ``globs``, an unquoted
+    component that could glob to it (``.raf*``, ``.r?fter``, ``.*``) counts:
+    bash never lets a wildcard match a leading dot, so only a component that
+    starts with a literal "." qualifies, and the match is over-approximated as
+    "the literal characters outside brackets appear in order in 'rafter'".
+    """
+    t = text.lower()
+    n = len(_RAFTER_DIR_NAME)
+    i = t.find(_RAFTER_DIR_NAME)
+    while i != -1:
+        before = t[i - 1] if i > 0 else ""
+        after = t[i + n] if i + n < len(t) else ""
+        if (before == "" or not _is_name_char(before)) and (after == "" or not _is_name_char(after)):
+            return True
+        i = t.find(_RAFTER_DIR_NAME, i + 1)
+    if not globs:
+        return False
+    for comp in t.split("/"):
+        if not comp or comp[0] != "." or not _GLOB_CHAR.search(comp):
+            continue
+        want = "rafter"
+        k = 0
+        in_bracket = False
+        ok = True
+        for c in comp[1:]:
+            if in_bracket:
+                if c == "]":
+                    in_bracket = False
+                continue
+            if c == "[":
+                in_bracket = True
+                continue
+            if c in ("*", "?"):
+                continue
+            while k < len(want) and want[k] != c:
+                k += 1
+            if k == len(want):
+                ok = False
+                break
+            k += 1
+        if ok:
+            return True
+    return False
+
+
+#: Read-only commands: with no output redirect they can neither write a file
+#: nor run another program. NOT here: sed (its ``w``/``e`` commands write and
+#: execute without -i), less (``-o`` writes a log), tee/cp/mv/rm/ln/chmod/
+#: touch/truncate/dd, and anything that runs a program.
+_READ_ONLY_EXECS = {
+    "cat", "more", "head", "tail", "ls", "stat", "file", "wc",
+    "grep", "egrep", "fgrep", "rg", "jq", "diff", "cmp",
+    "md5sum", "sha1sum", "sha224sum", "sha256sum", "sha384sum", "sha512sum",
+    "shasum", "b2sum", "cksum",
+    "find", "test", "[", "realpath", "readlink", "du",
+    "cd", "pushd", "popd",
+}
+#: find actions that delete, run a program, or write a file.
+_FIND_WRITE_ACTIONS = {
+    "-delete", "-exec", "-execdir", "-ok", "-okdir", "-fprint", "-fprint0", "-fprintf", "-fls",
+}
+#: Only a bare name or a system bin dir: ``./cat`` is whatever the agent wrote there.
+_SYSTEM_BIN = re.compile(r"^(?:/usr(?:/local)?|/opt/homebrew)?/s?bin/[^/]+$")
+_WRITE_REDIRECTS = {">", ">>"}
+_FILE_COMPILE_FLAG = re.compile(r"^-[A-Za-z]*C")
+_FD_DUP_TARGET = re.compile(r"^(?:\d+|-)$")
+
+
+class _RafterDirScan:
+    __slots__ = ("protected",)
+
+    def __init__(self) -> None:
+        self.protected = False
+
+
+def _rafter_dir_scan(command: str) -> bool:
+    """True if some statement names the rafter dir and is not read-only."""
+    acc = _RafterDirScan()
+    _scan_rafter_dir_statements(command, 0, acc)
+    return acc.protected
+
+
+def _scan_rafter_dir_statements(command: str, depth: int, acc: _RafterDirScan) -> None:
+    # Past the recursion cap, or on a desynchronized parse, the structure is
+    # unknown: FAIL CLOSED, a reference anywhere in the text protects it.
+    if depth > _MAX_SANITIZE_DEPTH:
+        if _names_rafter_dir(command, False):
+            acc.protected = True
+        return
+    pieces, unterminated = _tokenize(command)
+    if unterminated and _names_rafter_dir(command, False):
+        acc.protected = True
+
+    stmt: list[_Piece] = []
+    for i, p in enumerate(pieces):
+        for sub in p.substs:
+            _scan_rafter_dir_statements(sub, depth + 1, acc)
+        if p.op is not None and p.op in _CHAIN_OPS:
+            # ``>|``, ``>&``, ``&>``, ``&>>`` are redirects spelled with a chain
+            # character; splitting on them would orphan the target from its ``>``.
+            prev = pieces[i - 1] if i > 0 else None
+            nxt = pieces[i + 1] if i + 1 < len(pieces) else None
+            after_redirect = (
+                p.op not in ("&&", "||") and prev is not None
+                and prev.end == p.start and prev.op in _WRITE_REDIRECTS
+            )
+            before_redirect = (
+                p.op == "&" and nxt is not None
+                and nxt.start == p.end and nxt.op in _WRITE_REDIRECTS
+            )
+            if not after_redirect and not before_redirect:
+                _scan_rafter_dir_statement(stmt, acc)
+                stmt = []
+                continue
+        stmt.append(p)
+    _scan_rafter_dir_statement(stmt, acc)
+
+
+def _scan_rafter_dir_statement(stmt: list[_Piece], acc: _RafterDirScan) -> None:
+    argv0 = -1
+    redirect = False
+    names = False
+    for i, p in enumerate(stmt):
+        if p.op is not None:
+            if p.op in _WRITE_REDIRECTS and not _discards_output(stmt, i):
+                redirect = True
+            continue
+        prev_op = stmt[i - 1].op if i > 0 else None
+        is_redirect_target = prev_op is not None and prev_op in _REDIRECT_OPS
+        # Executing a binary that lives in the dir (``~/.rafter/bin/betterleaks
+        # version``) is not a reference; its arguments still are. Only an
+        # UNQUOTED argv0 is a path the shell runs: a quoted one is a heredoc
+        # body line or other code, never a binary.
+        if argv0 == -1 and not is_redirect_target:
+            argv0 = i
+            if not p.quoted and not _ENV_ASSIGNMENT.match(p.text):
+                continue
+        if _names_rafter_dir(p.text, not p.quoted):
+            names = True
+    if names and (redirect or not _statement_read_only(stmt, argv0)):
+        acc.protected = True
+
+
+def _discards_output(stmt: list[_Piece], i: int) -> bool:
+    """``2>/dev/null``, ``2>&1``, ``>&-``: an output redirect that writes no file."""
+    j = i + 1
+    dup = False
+    if j < len(stmt) and stmt[j].op == "&" and stmt[j].start == stmt[i].end:
+        dup = True
+        j += 1
+    if j >= len(stmt):
+        return False
+    target = stmt[j]
+    if target.op is not None or target.substs:
+        return False
+    return bool(_FD_DUP_TARGET.match(target.text)) if dup else target.text == "/dev/null"
+
+
+def _statement_read_only(stmt: list[_Piece], argv0: int) -> bool:
+    if argv0 == -1:
+        return True  # empty, or only an input redirect
+    head = stmt[argv0]
+    if not head.quoted and _ENV_ASSIGNMENT.match(head.text):
+        return False
+    if "/" in head.text and not _SYSTEM_BIN.match(head.text):
+        return False
+    exec_ = head.text[head.text.rfind("/") + 1:]
+    if exec_ not in _READ_ONLY_EXECS:
+        return False
+    args = [p for p in stmt[argv0 + 1:] if p.op is None]
+    if exec_ == "find":
+        return not any(a.text in _FIND_WRITE_ACTIONS for a in args)
+    if exec_ == "rg":  # --pre runs a program on every file searched
+        return not any(a.text.startswith("--pre") for a in args)
+    if exec_ == "file":  # -C compiles a magic file, writing it
+        return not any(a.text == "--compile" or _FILE_COMPILE_FLAG.match(a.text) for a in args)
+    if exec_ in ("cd", "pushd", "popd"):
+        # Claude Code's Bash tool keeps its cwd between calls, so a cd INTO the
+        # dir would make the next call's bare ``config.json`` a write there
+        # with no reference left to catch. cd elsewhere stays read-only.
+        return not any(a.substs or _names_rafter_dir(a.text, not a.quoted) for a in args)
+    return True
+
+
 def shell_program_from_stream(command: str) -> bool:
     """True if a SHELL receives its program through a channel rather than as a path.
 
@@ -1013,10 +1234,13 @@ def shell_program_from_stream(command: str) -> bool:
     cur: list[_Piece] = []
     for piece in pieces:
         if piece.op is not None and piece.op in _CHAIN_OPS:
-            segments.append(cur); enders.append(piece.op); cur = []
+            segments.append(cur)
+            enders.append(piece.op)
+            cur = []
             continue
         cur.append(piece)
-    segments.append(cur); enders.append(None)
+    segments.append(cur)
+    enders.append(None)
 
     def _resolve(seg: list[_Piece]) -> str:
         """Exec of a segment, skipping wrappers, their flags and env assignments.

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/resources/rafter-security-skill.md

@@ -1,7 +1,7 @@
 ---
 name: rafter-security
 description: Security toolkit for AI workflows. Use when scanning code or repos for vulnerabilities, auditing third-party skills/MCPs/agent configs before installing, evaluating shell commands before running them, or generating secure design questions for new features. Provides `rafter run` (remote SAST + SCA, needs RAFTER_API_KEY), `rafter secrets` (offline secrets-only), `rafter agent exec --dry-run` (command-risk classification), and `rafter skill review`.
-version: 0.11.3
+version: 0.11.4
 homepage: https://rafter.so
 metadata:
   openclaw:

{rafter_cli-0.11.3 → rafter_cli-0.11.4}/rafter_cli/utils/api.py

@@ -69,7 +69,12 @@ def handle_403(resp: "requests.Response") -> int:
     if isinstance(body, dict) and "scan_mode" in body:
         mode = body["scan_mode"]
         limit = body.get("limit", "?")
-        used = body.get("used", limit)
+        # The API sends ``remaining``, not ``used``; ``used`` is kept for older servers.
+        used = body.get("used")
+        if used is None:
+            remaining = body.get("remaining")
+            numeric = all(isinstance(v, int) and not isinstance(v, bool) for v in (limit, remaining))
+            used = limit - remaining if numeric else limit
         print(
             f"Error: {mode.capitalize()} scan limit reached ({used}/{limit} used this billing period).\n"
             f"Upgrade your plan or wait for your quota to reset.",