From e43df62c0f24f46042c948274cf4d45d4399d4e2 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 03:53:52 +0100
Subject: [PATCH 01/39] fix(hooks): strip heredoc bodies before classifying, so
 a file body that mentions git flags is not a command

A Bash heredoc that wrote a doc mentioning git commit and a shell wrapper was blocked. Heredoc bodies are data bash never executes, so they are now dropped line by line up to the terminator before the quote strip runs. A <<WORD marker counts only when it sits outside quotes on its line (even number of unescaped double and single quotes before it); a marker inside a string is text, and stripping past it would let a real command hide behind a fake terminator line. Nine cases added: four allowed forms (quoted and unquoted markers, commit -F - <<EOF, <<- with a tab-indented end) and five that must still block (a real command after the terminator, fake markers inside double and single quotes, a here-string).
---
 hooks/guard-commit.sh            | 30 +++++++++++++++++++++++-------
 tests/hooks/test-guard-commit.sh | 31 +++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 7 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index bd40ade..8cd08ca 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -32,13 +32,29 @@ fi
 CMD=${CMD//\\$'\n'/ }
 
 # Classify per command segment, not per Bash call: `git commit -m ok && git push -f` is a commit
-# AND a force-push, and each segment is judged on its own. Quoted text is stripped first so a
-# commit MESSAGE that merely mentions `push --force` or `--no-verify` (or contains `;`) can't
-# trip a flag check or split a segment. The strip is multi-line aware (newlines are hidden as
-# \001 during sed) so a heredoc message `-m "$(cat <<'EOF' ... EOF)"` is one quoted span, and
-# escaped \" are dropped first so they cannot flip quote parity. A `git commit -F - <<EOF` body
-# is not quoted and is therefore not stripped (a false block at worst).
-STRIPPED=$(printf '%s' "$CMD" | tr '\n' '\001' | sed -e 's/\\"//g' -e 's/"[^"]*"//g' -e "s/'[^']*'//g" | tr '\001' '\n')
+# AND a force-push, and each segment is judged on its own. Data is stripped first so a commit
+# MESSAGE or a file body that merely mentions `push --force` or `--no-verify` (or contains `;`)
+# can't trip a flag check or split a segment:
+#  - heredoc bodies (`cat > f <<'EOF' ... EOF`, `git commit -F - <<EOF ...`) are dropped line by
+#    line up to the terminator. A `<<WORD` marker counts only when it sits outside quotes on its
+#    line (an even number of unescaped " and ' before it): a `<<EOF` inside a string is text, and
+#    stripping past it would let a real command hide behind a fake terminator line;
+#  - quoted spans are dropped, multi-line aware (newlines are hidden as \001 during sed) so a
+#    `-m "$(cat <<'EOF' ... EOF)"` message is one span; escaped \" go first so they cannot flip parity.
+strip_heredocs() {
+  awk '
+    skip { if ($0 ~ "^[ \t]*" word "$") skip = 0; next }
+    match($0, /<<-?[ \t]*[\047"]?[A-Za-z_][A-Za-z0-9_]*[\047"]?/) {
+      pre = substr($0, 1, RSTART - 1); gsub(/\\"/, "", pre)
+      if (gsub(/"/, "", pre) % 2 == 0 && gsub(/\047/, "", pre) % 2 == 0) {
+        word = substr($0, RSTART, RLENGTH); sub(/^<<-?[ \t]*/, "", word); gsub(/[\047"]/, "", word)
+        skip = 1
+      }
+    }
+    { print }
+  '
+}
+STRIPPED=$(printf '%s' "$CMD" | strip_heredocs | tr '\n' '\001' | sed -e 's/\\"//g' -e 's/"[^"]*"//g' -e "s/'[^']*'//g" | tr '\001' '\n')
 
 # A shell wrapper runs its quoted argument as a command, which the strip above just hid.
 # Refuse rather than guess: the unwrapped form is always available to the agent.
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 1215297..b38baa3 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -113,6 +113,37 @@ run "multi-line -m message"                  0 'git commit -m "docs: x
 
 why git push -f is blocked"'
 
+# --- heredoc bodies are data, not commands -----------------------------------------------------
+run "heredoc file write mentioning the hook" 0 'cat > notes.md <<'"'"'EOF'"'"'
+The hook refuses sh -c "git commit" wrappers and blocks git push -f and --no-verify.
+EOF'
+run "heredoc file write, unquoted marker"    0 'cat > notes.md <<EOF
+never run git push --force or git commit --no-verify
+EOF'
+run "commit -F - with a heredoc body"        0 'git commit -F - <<EOF
+feat: x
+
+mentions git push -f and --no-verify in the body
+EOF'
+run "<<- heredoc with a tab-indented end"    0 'cat <<-EOF
+	git push -f is documented here
+	EOF'
+run "real heredoc then force-push after it"  2 'cat <<EOF
+harmless body
+EOF
+git push -f origin main'
+run "real heredoc then --no-verify after it" 2 'cat > x.md <<EOF
+harmless body
+EOF
+git commit --no-verify -m x'
+run "fake marker inside quotes hides a push" 2 'git commit -m "a <<EOF
+b" && git push -f origin main
+EOF'
+run "fake marker inside single quotes"       2 'git commit -m '"'"'a <<EOF
+b'"'"' && git push --force origin main
+EOF'
+run "here-string is not a heredoc"           2 'cat <<<"x" && git push -f origin main'
+
 # --- chained commands: every segment is classified on its own ---------------------------------
 run "commit then force-push"                 2 'git commit -m "ok" && git push -f origin feat/x'
 run "commit; force-push"                     2 'git commit -m "ok"; git push --force origin feat/x'

From 28ce2c96ee35af3a507f84f10de01fb7367ad283 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 04:02:42 +0100
Subject: [PATCH 02/39] fix(hooks): one quote model for the data strip, carried
 across lines

The first heredoc strip judged quote parity per line, so a marker on line 2 of a multi-line quoted message was honored and everything after it, including a chained force-push, was stripped. Replaced the awk heredoc pass plus the sed quote strip with a single character walk that keeps state across lines: single and double quotes with backslash escapes, $( ) and backtick substitutions that reopen code inside double quotes, comments, and heredoc bodies with any delimiter, an EOF) terminator inside $( ), <<- tab stripping, and unterminated bodies running to end of input as bash does. Here-strings are no longer mistaken for markers. Ten cases added (92 total), eight of them bypass attempts from review.
---
 hooks/guard-commit.sh            | 77 +++++++++++++++++++++++++-------
 tests/hooks/test-guard-commit.sh | 39 +++++++++++++++-
 2 files changed, 98 insertions(+), 18 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 8cd08ca..79b143f 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -34,27 +34,70 @@ CMD=${CMD//\\$'\n'/ }
 # Classify per command segment, not per Bash call: `git commit -m ok && git push -f` is a commit
 # AND a force-push, and each segment is judged on its own. Data is stripped first so a commit
 # MESSAGE or a file body that merely mentions `push --force` or `--no-verify` (or contains `;`)
-# can't trip a flag check or split a segment:
-#  - heredoc bodies (`cat > f <<'EOF' ... EOF`, `git commit -F - <<EOF ...`) are dropped line by
-#    line up to the terminator. A `<<WORD` marker counts only when it sits outside quotes on its
-#    line (an even number of unescaped " and ' before it): a `<<EOF` inside a string is text, and
-#    stripping past it would let a real command hide behind a fake terminator line;
-#  - quoted spans are dropped, multi-line aware (newlines are hidden as \001 during sed) so a
-#    `-m "$(cat <<'EOF' ... EOF)"` message is one span; escaped \" go first so they cannot flip parity.
-strip_heredocs() {
+# can't trip a flag check or split a segment. One quote model does all of it, a character walk
+# that keeps its state across lines: single- and double-quoted spans (with \ escapes), `$(...)`
+# and backtick substitutions that reopen code inside double quotes, `#` comments, and heredoc
+# bodies (`cat > f <<'EOF' ... EOF`, `git commit -F - <<EOF ...`), which are data bash never
+# runs. A `<<WORD` marker counts only in code, never inside a string or a comment: honoring one
+# inside a string would let a real command hide behind a fake terminator line. Every divergence
+# from bash is meant to err toward stripping LESS (a false block at worst), never more.
+strip_data() {
   awk '
-    skip { if ($0 ~ "^[ \t]*" word "$") skip = 0; next }
-    match($0, /<<-?[ \t]*[\047"]?[A-Za-z_][A-Za-z0-9_]*[\047"]?/) {
-      pre = substr($0, 1, RSTART - 1); gsub(/\\"/, "", pre)
-      if (gsub(/"/, "", pre) % 2 == 0 && gsub(/\047/, "", pre) % 2 == 0) {
-        word = substr($0, RSTART, RLENGTH); sub(/^<<-?[ \t]*/, "", word); gsub(/[\047"]/, "", word)
-        skip = 1
+  BEGIN { q = 0; depth = 0; npend = 0; body = 0 }
+  {
+    line = $0
+    if (body) {                                  # inside a heredoc body: drop lines up to the terminator
+      t = line
+      if (pdash[1]) sub(/^\t+/, "", t)
+      tail = ""
+      while (t ~ /\)$/) { t = substr(t, 1, length(t) - 1); tail = tail ")" }   # `EOF)` closes a $( too
+      if (t != pword[1]) next
+      for (k = 1; k < npend; k++) { pword[k] = pword[k + 1]; pdash[k] = pdash[k + 1] }
+      npend--
+      if (npend == 0) body = 0
+      line = tail
+    }
+    n = split(line, c, "")
+    o = ""
+    i = 1
+    while (i <= n) {
+      ch = c[i]
+      if (q == 1) { if (ch == "\047") q = 0; i++; continue }              # inside single quotes
+      if (q == 2) {                                                        # inside double quotes
+        if (ch == "\\") { i += 2; continue }
+        if (ch == "\"") { q = 0; i++; continue }
+        if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = 2; q = 0; o = o " "; i += 2; continue }
+        if (ch == "`") { kind[++depth] = "`"; save[depth] = 2; q = 0; o = o " "; i++; continue }
+        i++; continue
+      }
+      if (ch == "\\") { o = o ch c[i + 1]; i += 2; continue }              # code from here on
+      if (ch == "\047") { q = 1; i++; continue }
+      if (ch == "\"") { q = 2; i++; continue }
+      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|(]/)) break         # comment to end of line
+      if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = 0; o = o "$("; i += 2; continue }
+      if (ch == "(") { kind[++depth] = "("; save[depth] = 0; o = o ch; i++; continue }
+      if (ch == ")" && depth > 0 && kind[depth] == "(") { q = save[depth--]; o = o ch; i++; continue }
+      if (ch == "`") {
+        if (depth > 0 && kind[depth] == "`") q = save[depth--]; else { kind[++depth] = "`"; save[depth] = 0 }
+        o = o " "; i++; continue
+      }
+      if (ch == "<" && c[i + 1] == "<" && c[i + 2] != "<" && (i == 1 || c[i - 1] != "<")) {
+        j = i + 2; dash = 0
+        if (c[j] == "-") { dash = 1; j++ }
+        while (c[j] == " " || c[j] == "\t") j++
+        w = ""
+        while (j <= n && c[j] !~ /[ \t;&|<>()]/) { w = w c[j]; j++ }
+        gsub(/[\047"\\]/, "", w)
+        if (w != "") { pword[++npend] = w; pdash[npend] = dash }
+        o = o "<<"; i = j; continue
       }
+      o = o ch; i++
     }
-    { print }
-  '
+    print o
+    if (npend > 0) body = 1
+  }'
 }
-STRIPPED=$(printf '%s' "$CMD" | strip_heredocs | tr '\n' '\001' | sed -e 's/\\"//g' -e 's/"[^"]*"//g' -e "s/'[^']*'//g" | tr '\001' '\n')
+STRIPPED=$(printf '%s' "$CMD" | strip_data)
 
 # A shell wrapper runs its quoted argument as a command, which the strip above just hid.
 # Refuse rather than guess: the unwrapped form is always available to the agent.
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index b38baa3..984c704 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -142,7 +142,44 @@ EOF'
 run "fake marker inside single quotes"       2 'git commit -m '"'"'a <<EOF
 b'"'"' && git push --force origin main
 EOF'
-run "here-string is not a heredoc"           2 'cat <<<"x" && git push -f origin main'
+run "here-string is not a heredoc"           2 'read -r a b <<<"hello world"
+git push -f origin main'
+run "marker on line 2 of a quoted message"   2 'git commit -m "$(cat <<'"'"'EOF'"'"'
+fix(hooks): strip heredoc bodies
+
+A <<WORD marker counts only when it sits outside quotes on its line.
+EOF
+)" && git push -f origin main'
+run "fake terminator after a quoted marker"  2 'git commit -m "docs: x
+see <<EOF
+b" && git push -f origin main
+EOF'
+run "EOF) terminator inside \$( ) then push" 2 'x=$(cat <<EOF
+body
+EOF)
+git push -f origin main'
+run "delimiter with dashes then push"        2 'cat > x.md <<'"'"'END-OF-FILE'"'"'
+body
+END-OF-FILE
+git push -f origin main'
+run "marker inside a comment"                2 '# see <<EOF
+git push -f origin main'
+run "double quote inside a heredoc message"  2 'git commit -m "$(cat <<'"'"'EOF'"'"'
+say "hi"
+EOF
+)" && git push -f origin main'
+run "backslash-quoted delimiter"             0 'cat > x.md <<\EOF
+never git push -f
+EOF'
+run "apostrophe in a quoted arg before a heredoc" 0 'echo "don'"'"'t" && cat > x.md <<EOF
+never git push -f
+EOF'
+run "unterminated heredoc: tail is body"     0 'cat <<EOF
+git push -f origin main'
+run "heredoc body then a chained plain push" 0 'cat > x.md <<EOF
+body mentions git push -f
+EOF
+git commit -m "x" && git push origin feat/x'
 
 # --- chained commands: every segment is classified on its own ---------------------------------
 run "commit then force-push"                 2 'git commit -m "ok" && git push -f origin feat/x'

From 3eb4d537bc5f79988f4de0bd22d624423473188c Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 04:12:52 +0100
Subject: [PATCH 03/39] fix(hooks): the walker never treats bash code as data:
 arithmetic, comments after ), ANSI-C strings; fail closed if the strip fails

Security review of the character walk found three ways an innocuous first line hid a plain force-push: $((1<<2)) read as a heredoc marker, a # comment directly after ) not recognized, and an escaped quote inside $'...' flipping the quote state for the rest of the input. Arithmetic frames ($(( )), (( )), $[ ]) now suppress marker detection, the comment-start class includes ) and backtick, and $'...' is its own state with backslash escapes. The strip runs under pipefail and an awk failure blocks; LC_ALL=C keeps every tool byte-oriented so an invalid UTF-8 byte cannot drop the rest of the input; commands over 256 KB are refused. Nine cases added (101 total).
---
 hooks/guard-commit.sh            | 39 ++++++++++++++++++++++++--------
 tests/hooks/test-guard-commit.sh | 19 ++++++++++++++++
 2 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 79b143f..435f89b 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -6,6 +6,7 @@
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
 # and flags spelled with quoting tricks (`--no-veri"fy"`, `$'--no-verify'`, unique-prefix `--no-veri`).
+export LC_ALL=C   # byte-oriented grep/awk/tr: an invalid UTF-8 byte must not make a tool drop the rest of the input
 INPUT=$(cat)
 
 # Fast path: this guard only concerns `git commit` / `git push`. If the payload mentions
@@ -28,6 +29,12 @@ if [ -z "$CMD" ]; then
   exit 2
 fi
 
+# No agent-realistic command is this long; past this size the strip below gets slow, so stop here.
+if [ ${#CMD} -gt 262144 ]; then
+  echo "Blocked: guard-commit.sh will not inspect a git commit/push command over 256 KB. Split it up." >&2
+  exit 2
+fi
+
 # Join backslash-newline continuations so a flag on its own line stays with its subcommand.
 CMD=${CMD//\\$'\n'/ }
 
@@ -35,12 +42,14 @@ CMD=${CMD//\\$'\n'/ }
 # AND a force-push, and each segment is judged on its own. Data is stripped first so a commit
 # MESSAGE or a file body that merely mentions `push --force` or `--no-verify` (or contains `;`)
 # can't trip a flag check or split a segment. One quote model does all of it, a character walk
-# that keeps its state across lines: single- and double-quoted spans (with \ escapes), `$(...)`
-# and backtick substitutions that reopen code inside double quotes, `#` comments, and heredoc
-# bodies (`cat > f <<'EOF' ... EOF`, `git commit -F - <<EOF ...`), which are data bash never
-# runs. A `<<WORD` marker counts only in code, never inside a string or a comment: honoring one
-# inside a string would let a real command hide behind a fake terminator line. Every divergence
-# from bash is meant to err toward stripping LESS (a false block at worst), never more.
+# that keeps its state across lines: single-, double-, and ANSI-C ($'...') quoted spans (with
+# \ escapes), `$(...)` and backtick substitutions that reopen code inside double quotes,
+# `$((...))` / `((...))` arithmetic (where `<<` is a shift, not a heredoc), `#` comments, and
+# heredoc bodies (`cat > f <<'EOF' ... EOF`, `git commit -F - <<EOF ...`), which are data bash
+# never runs. A `<<WORD` marker counts only in code, never inside a string, a comment, or
+# arithmetic: honoring one there would let a real command hide behind a fake terminator line.
+# Every divergence from bash is meant to err toward stripping LESS (a false block at worst),
+# never more. If the walk itself fails, the hook fails closed (pipefail below).
 strip_data() {
   awk '
   BEGIN { q = 0; depth = 0; npend = 0; body = 0 }
@@ -63,25 +72,34 @@ strip_data() {
     while (i <= n) {
       ch = c[i]
       if (q == 1) { if (ch == "\047") q = 0; i++; continue }              # inside single quotes
+      if (q == 3) { if (ch == "\\") { i += 2; continue } if (ch == "\047") q = 0; i++; continue }   # inside $'...'
       if (q == 2) {                                                        # inside double quotes
         if (ch == "\\") { i += 2; continue }
         if (ch == "\"") { q = 0; i++; continue }
+        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { kind[++depth] = "(("; save[depth] = 2; q = 0; o = o " "; i += 3; continue }
         if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = 2; q = 0; o = o " "; i += 2; continue }
         if (ch == "`") { kind[++depth] = "`"; save[depth] = 2; q = 0; o = o " "; i++; continue }
         i++; continue
       }
+      arith = (depth > 0 && (kind[depth] == "((" || kind[depth] == "["))
       if (ch == "\\") { o = o ch c[i + 1]; i += 2; continue }              # code from here on
+      if (ch == "$" && c[i + 1] == "\047") { q = 3; i += 2; continue }
       if (ch == "\047") { q = 1; i++; continue }
       if (ch == "\"") { q = 2; i++; continue }
-      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|(]/)) break         # comment to end of line
+      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|()`]/)) break        # comment to end of line
+      if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { kind[++depth] = "(("; save[depth] = 0; o = o " "; i += 3; continue }
+      if (ch == "$" && c[i + 1] == "[") { kind[++depth] = "["; save[depth] = 0; o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = 0; o = o "$("; i += 2; continue }
+      if (ch == "(" && c[i + 1] == "(" && !arith) { kind[++depth] = "(("; save[depth] = 0; o = o " "; i += 2; continue }
       if (ch == "(") { kind[++depth] = "("; save[depth] = 0; o = o ch; i++; continue }
+      if (ch == ")" && c[i + 1] == ")" && depth > 0 && kind[depth] == "((") { q = save[depth--]; o = o " "; i += 2; continue }
+      if (ch == "]" && depth > 0 && kind[depth] == "[") { q = save[depth--]; o = o " "; i++; continue }
       if (ch == ")" && depth > 0 && kind[depth] == "(") { q = save[depth--]; o = o ch; i++; continue }
       if (ch == "`") {
         if (depth > 0 && kind[depth] == "`") q = save[depth--]; else { kind[++depth] = "`"; save[depth] = 0 }
         o = o " "; i++; continue
       }
-      if (ch == "<" && c[i + 1] == "<" && c[i + 2] != "<" && (i == 1 || c[i - 1] != "<")) {
+      if (ch == "<" && c[i + 1] == "<" && c[i + 2] != "<" && (i == 1 || c[i - 1] != "<") && !arith) {
         j = i + 2; dash = 0
         if (c[j] == "-") { dash = 1; j++ }
         while (c[j] == " " || c[j] == "\t") j++
@@ -97,7 +115,10 @@ strip_data() {
     if (npend > 0) body = 1
   }'
 }
-STRIPPED=$(printf '%s' "$CMD" | strip_data)
+if ! STRIPPED=$(set -o pipefail; printf '%s' "$CMD" | strip_data); then
+  echo "Blocked: guard-commit.sh could not parse the command (awk failed). Failing closed." >&2
+  exit 2
+fi
 
 # A shell wrapper runs its quoted argument as a command, which the strip above just hid.
 # Refuse rather than guess: the unwrapped form is always available to the agent.
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 984c704..00c1b14 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -181,6 +181,25 @@ body mentions git push -f
 EOF
 git commit -m "x" && git push origin feat/x'
 
+# --- the walker must never think it is in data where bash is in code ---------------------------
+run "arithmetic shift is not a heredoc"      2 'echo $((1<<2))
+git push --force origin main'
+run "arithmetic command shift"               2 '((x<<2))
+git push --force origin main'
+run "arithmetic shift inside double quotes"  2 'echo "$((1<<2))"
+git push --force origin main'
+run "legacy \$[ ] arithmetic shift"          2 'echo $[1<<2]
+git push --force origin main'
+run "comment right after a paren"            2 '( : )#c <<EOF
+git push --force origin main'
+# shellcheck disable=SC1003  # the \' is part of the command under test, not an escape in this file
+run "ANSI-C quote with an escaped quote"     2 'git commit -m $'"'"'a\'"'"'b'"'"'
+git push --force origin main'
+run "ANSI-C message mentioning a flag"       0 'git commit -m $'"'"'docs: x\nnever git push -f'"'"''
+run "invalid UTF-8 byte before a push"       2 "$(printf 'cat \377\377 x\ngit push --force origin main')"
+BIG=$(head -c 300000 /dev/zero | tr '\0' 'a')
+run "oversized command fails closed"         2 "git commit -m $BIG"
+
 # --- chained commands: every segment is classified on its own ---------------------------------
 run "commit then force-push"                 2 'git commit -m "ok" && git push -f origin feat/x'
 run "commit; force-push"                     2 'git commit -m "ok"; git push --force origin feat/x'

From 843f28a6856bfe630b065758315cf002c943cd99 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 04:18:24 +0100
Subject: [PATCH 04/39] fix(hooks): unquoted heredoc bodies still expand
 substitutions; join continuations inside the walker; parens inside arithmetic

Second code review found two regressions against main: bash expands $(...) and backticks inside an unquoted-delimiter heredoc body, and the global backslash-newline join ran before the walker knew which lines were a body, so a body line ending in a backslash could swallow the terminator. Unquoted bodies are now walked in a data mode that reopens code for substitutions; quoted bodies stay inert; the continuation join happens in the walker for code only. A paren nested inside $(( )) or (( )) keeps the arithmetic context, and a quoted delimiter may contain spaces. Ten cases added (111 total); the suite passes on macOS awk, mawk 1.3.4, and busybox awk.
---
 hooks/guard-commit.sh            | 84 +++++++++++++++++++-------------
 tests/hooks/test-guard-commit.sh | 36 ++++++++++++++
 2 files changed, 85 insertions(+), 35 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 435f89b..2d3f9b5 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -5,7 +5,8 @@
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
-# and flags spelled with quoting tricks (`--no-veri"fy"`, `$'--no-verify'`, unique-prefix `--no-veri`).
+# flags spelled with quoting tricks (`--no-veri"fy"`, `$'--no-verify'`, unique-prefix `--no-veri`),
+# and a `case` pattern's `)` inside a double-quoted `$(...)`, which closes the substitution early.
 export LC_ALL=C   # byte-oriented grep/awk/tr: an invalid UTF-8 byte must not make a tool drop the rest of the input
 INPUT=$(cat)
 
@@ -35,64 +36,70 @@ if [ ${#CMD} -gt 262144 ]; then
   exit 2
 fi
 
-# Join backslash-newline continuations so a flag on its own line stays with its subcommand.
-CMD=${CMD//\\$'\n'/ }
-
 # Classify per command segment, not per Bash call: `git commit -m ok && git push -f` is a commit
 # AND a force-push, and each segment is judged on its own. Data is stripped first so a commit
 # MESSAGE or a file body that merely mentions `push --force` or `--no-verify` (or contains `;`)
 # can't trip a flag check or split a segment. One quote model does all of it, a character walk
-# that keeps its state across lines: single-, double-, and ANSI-C ($'...') quoted spans (with
-# \ escapes), `$(...)` and backtick substitutions that reopen code inside double quotes,
-# `$((...))` / `((...))` arithmetic (where `<<` is a shift, not a heredoc), `#` comments, and
-# heredoc bodies (`cat > f <<'EOF' ... EOF`, `git commit -F - <<EOF ...`), which are data bash
-# never runs. A `<<WORD` marker counts only in code, never inside a string, a comment, or
-# arithmetic: honoring one there would let a real command hide behind a fake terminator line.
+# that keeps its state across lines:
+#  - single-, double-, and ANSI-C ($'...') quoted spans, with \ escapes; a backslash-newline in
+#    code joins the next line, so a flag on its own line stays with its subcommand;
+#  - `$(...)` and backticks reopen code inside double quotes and inside unquoted heredoc bodies
+#    (bash expands them there: `cat <<EOF` + `$(git push -f)` runs the push);
+#  - `$((...))`, `((...))`, `$[...]` arithmetic, where `<<` is a shift, not a heredoc;
+#  - `#` comments to end of line;
+#  - heredoc bodies, dropped line by line up to the terminator (`EOF)` also closes a `$(`,
+#    `<<-` allows leading tabs, an unterminated body runs to end of input as in bash). A `<<WORD`
+#    marker counts only in code, never inside a string, a comment, or arithmetic: honoring one
+#    there would let a real command hide behind a fake terminator line.
 # Every divergence from bash is meant to err toward stripping LESS (a false block at worst),
 # never more. If the walk itself fails, the hook fails closed (pipefail below).
 strip_data() {
   awk '
-  BEGIN { q = 0; depth = 0; npend = 0; body = 0 }
+  # q: 0 code, 1 single quotes, 2 double quotes, 3 $'"'"'...'"'"', 4 unquoted heredoc body, 5 quoted heredoc body
+  BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0 }
   {
     line = $0
-    if (body) {                                  # inside a heredoc body: drop lines up to the terminator
+    if (body) {
       t = line
       if (pdash[1]) sub(/^\t+/, "", t)
       tail = ""
-      while (t ~ /\)$/) { t = substr(t, 1, length(t) - 1); tail = tail ")" }   # `EOF)` closes a $( too
-      if (t != pword[1]) next
-      for (k = 1; k < npend; k++) { pword[k] = pword[k + 1]; pdash[k] = pdash[k + 1] }
-      npend--
-      if (npend == 0) body = 0
-      line = tail
+      while (t ~ /\)$/) { t = substr(t, 1, length(t) - 1); tail = tail ")" }
+      if (t == pword[1]) {                       # terminator: leave this body, walk any `)` tail as code
+        for (k = 1; k < npend; k++) { pword[k] = pword[k + 1]; pdash[k] = pdash[k + 1]; pq[k] = pq[k + 1] }
+        npend--
+        if (npend == 0) { body = 0; q = bodyq } else q = (pq[1] ? 5 : 4)
+        line = tail
+      } else if (q == 5) next                    # quoted-delimiter body: inert, drop the line
     }
     n = split(line, c, "")
     o = ""
     i = 1
     while (i <= n) {
       ch = c[i]
-      if (q == 1) { if (ch == "\047") q = 0; i++; continue }              # inside single quotes
-      if (q == 3) { if (ch == "\\") { i += 2; continue } if (ch == "\047") q = 0; i++; continue }   # inside $'...'
-      if (q == 2) {                                                        # inside double quotes
+      if (q == 1) { if (ch == "\047") q = 0; i++; continue }
+      if (q == 3) { if (ch == "\\") { i += 2; continue } if (ch == "\047") q = 0; i++; continue }
+      if (q == 2 || q == 4) {                    # data that still expands substitutions
         if (ch == "\\") { i += 2; continue }
-        if (ch == "\"") { q = 0; i++; continue }
-        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { kind[++depth] = "(("; save[depth] = 2; q = 0; o = o " "; i += 3; continue }
-        if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = 2; q = 0; o = o " "; i += 2; continue }
-        if (ch == "`") { kind[++depth] = "`"; save[depth] = 2; q = 0; o = o " "; i++; continue }
+        if (q == 2 && ch == "\"") { q = 0; i++; continue }
+        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { kind[++depth] = "(("; save[depth] = q; q = 0; o = o " "; i += 3; continue }
+        if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = q; q = 0; o = o " "; i += 2; continue }
+        if (ch == "`") { kind[++depth] = "`"; save[depth] = q; q = 0; o = o " "; i++; continue }
         i++; continue
       }
-      arith = (depth > 0 && (kind[depth] == "((" || kind[depth] == "["))
-      if (ch == "\\") { o = o ch c[i + 1]; i += 2; continue }              # code from here on
+      arith = (depth > 0 && (kind[depth] == "((" || kind[depth] == "[" || kind[depth] == "(a"))
+      if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o ch c[i + 1]; i += 2; continue }
       if (ch == "$" && c[i + 1] == "\047") { q = 3; i += 2; continue }
       if (ch == "\047") { q = 1; i++; continue }
       if (ch == "\"") { q = 2; i++; continue }
-      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|()`]/)) break        # comment to end of line
+      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|()`]/)) break
       if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { kind[++depth] = "(("; save[depth] = 0; o = o " "; i += 3; continue }
       if (ch == "$" && c[i + 1] == "[") { kind[++depth] = "["; save[depth] = 0; o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = 0; o = o "$("; i += 2; continue }
-      if (ch == "(" && c[i + 1] == "(" && !arith) { kind[++depth] = "(("; save[depth] = 0; o = o " "; i += 2; continue }
+      if (ch == "(" && arith) { kind[++depth] = "(a"; save[depth] = 0; o = o " "; i++; continue }
+      if (ch == "(" && c[i + 1] == "(") { kind[++depth] = "(("; save[depth] = 0; o = o " "; i += 2; continue }
       if (ch == "(") { kind[++depth] = "("; save[depth] = 0; o = o ch; i++; continue }
       if (ch == ")" && c[i + 1] == ")" && depth > 0 && kind[depth] == "((") { q = save[depth--]; o = o " "; i += 2; continue }
+      if (ch == ")" && depth > 0 && kind[depth] == "(a") { q = save[depth--]; o = o " "; i++; continue }
       if (ch == "]" && depth > 0 && kind[depth] == "[") { q = save[depth--]; o = o " "; i++; continue }
       if (ch == ")" && depth > 0 && kind[depth] == "(") { q = save[depth--]; o = o ch; i++; continue }
       if (ch == "`") {
@@ -103,16 +110,23 @@ strip_data() {
         j = i + 2; dash = 0
         if (c[j] == "-") { dash = 1; j++ }
         while (c[j] == " " || c[j] == "\t") j++
-        w = ""
-        while (j <= n && c[j] !~ /[ \t;&|<>()]/) { w = w c[j]; j++ }
-        gsub(/[\047"\\]/, "", w)
-        if (w != "") { pword[++npend] = w; pdash[npend] = dash }
+        w = ""; quoted = 0
+        while (j <= n && c[j] !~ /[ \t;&|<>()]/) {
+          if (c[j] == "\047" || c[j] == "\"") {  # a quoted delimiter may contain anything up to its closing quote
+            qc = c[j]; quoted = 1; j++
+            while (j <= n && c[j] != qc) { w = w c[j]; j++ }
+            j++; continue
+          }
+          if (c[j] == "\\") { quoted = 1; j++; if (j <= n) { w = w c[j]; j++ }; continue }
+          w = w c[j]; j++
+        }
+        if (w != "") { pword[++npend] = w; pdash[npend] = dash; pq[npend] = quoted }
         o = o "<<"; i = j; continue
       }
       o = o ch; i++
     }
-    print o
-    if (npend > 0) body = 1
+    if (cont) { printf "%s ", o; cont = 0 } else print o
+    if (!body && npend > 0) { body = 1; bodyq = q; q = (pq[1] ? 5 : 4) }
   }'
 }
 if ! STRIPPED=$(set -o pipefail; printf '%s' "$CMD" | strip_data); then
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 00c1b14..5649ffd 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -197,6 +197,42 @@ run "ANSI-C quote with an escaped quote"     2 'git commit -m $'"'"'a\'"'"'b'"'"
 git push --force origin main'
 run "ANSI-C message mentioning a flag"       0 'git commit -m $'"'"'docs: x\nnever git push -f'"'"''
 run "invalid UTF-8 byte before a push"       2 "$(printf 'cat \377\377 x\ngit push --force origin main')"
+run "substitution in an unquoted heredoc"    2 'cat <<EOF
+$(git push -f origin main)
+EOF'
+run "backticks in an unquoted heredoc"       2 'cat > notes.md <<EOF
+`git push --force origin main`
+EOF'
+run "substitution in an unquoted -m heredoc" 2 'git commit -m "$(cat <<EOF
+feat: x $(git push -f origin main)
+EOF
+)"'
+run "substitution in a quoted heredoc is text" 0 'cat > notes.md <<'"'"'EOF'"'"'
+$(git push -f origin main) is not run here
+EOF'
+run "body line ending in backslash"          2 'cat <<'"'"'EOF'"'"'
+foo\
+EOF
+git push -f origin main'
+run "paren nested inside arithmetic"         2 'echo $(( (1<<2) ))
+git push -f origin main'
+run "paren nested inside (( )) command"      2 '(( x = (1<<2) ))
+git push -f origin main'
+run "two heredocs on one line, push after"   2 'cat <<A <<B
+git push -f in body A
+A
+git push -f in body B
+B
+git push -f origin main'
+run "two heredocs on one line, nothing after" 0 'cat <<A <<B
+git push -f in body A
+A
+git push -f in body B
+B'
+run "quoted delimiter with a space"          2 'cat <<"E OF"
+body
+E OF
+git push -f origin main'
 BIG=$(head -c 300000 /dev/zero | tr '\0' 'a')
 run "oversized command fails closed"         2 "git commit -m $BIG"
 

From 2e607aee8c8e2e934fb3361ef8d71156f03b100f Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 04:30:24 +0100
Subject: [PATCH 05/39] fix(hooks): comments start only at a word start; frames
 for ${ } and [ ]; case patterns; continuations joined with nothing; delimiter
 continuation refused

Security re-audit found four more places the walker took bash code for data: a # directly after $(...) or a backtick is part of the word, not a comment; a backslash-newline inside a heredoc delimiter was eaten as an escape and armed a phantom body; << inside ${...} and inside an array subscript was read as a heredoc marker. Continuations are now joined with nothing, as bash does, and the fast path joins JSON-escaped continuations before matching, so a word or flag split across lines cannot dodge it. case ... esac is tracked so a pattern's ) no longer closes an enclosing $(...); that limit is gone from the header. The fast path fails closed if sed or grep errors, and pipefail is on for the whole hook. Fourteen cases added (125 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 89 ++++++++++++++++++++++----------
 tests/hooks/test-guard-commit.sh | 24 +++++++++
 2 files changed, 85 insertions(+), 28 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 2d3f9b5..977f9f7 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -5,16 +5,22 @@
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
-# flags spelled with quoting tricks (`--no-veri"fy"`, `$'--no-verify'`, unique-prefix `--no-veri`),
-# and a `case` pattern's `)` inside a double-quoted `$(...)`, which closes the substitution early.
+# and flags spelled with quoting tricks (`--no-veri"fy"`, `$'--no-verify'`, unique-prefix `--no-veri`).
 export LC_ALL=C   # byte-oriented grep/awk/tr: an invalid UTF-8 byte must not make a tool drop the rest of the input
+set -o pipefail   # a failing tool anywhere in a pipeline must surface, never read as "no match"
 INPUT=$(cat)
 
 # Fast path: this guard only concerns `git commit` / `git push`. If the payload mentions
 # neither, allow immediately — so a missing jq (below) never blocks unrelated Bash (ls/cat/grep).
 # Match loosely (no quote-class): a quoted arg before the subcommand (`git -C "x" commit`)
-# must NOT slip past into a silent allow.
-printf '%s' "$INPUT" | grep -qiE 'git.*(commit|push)' || exit 0
+# must NOT slip past into a silent allow. JSON-escaped backslash-newlines (`git pu\` + `sh`) are
+# joined first so a split word cannot dodge the match. grep exit 1 = no match; anything else = error.
+printf '%s' "$INPUT" | sed 's/\\\\\\n//g' | grep -qiE 'git.*(commit|push)'
+case $? in
+  0) ;;
+  1) exit 0 ;;
+  *) echo "Blocked: guard-commit.sh could not run its fast-path check (sed/grep failed). Failing closed." >&2; exit 2 ;;
+esac
 
 # The command plausibly commits/pushes — jq is needed to inspect it. Fail loud and closed.
 if ! command -v jq >/dev/null 2>&1; then
@@ -42,11 +48,15 @@ fi
 # can't trip a flag check or split a segment. One quote model does all of it, a character walk
 # that keeps its state across lines:
 #  - single-, double-, and ANSI-C ($'...') quoted spans, with \ escapes; a backslash-newline in
-#    code joins the next line, so a flag on its own line stays with its subcommand;
+#    code joins the next line with nothing in between, as bash does, so a flag on its own line
+#    (or a word split across lines) stays with its subcommand;
 #  - `$(...)` and backticks reopen code inside double quotes and inside unquoted heredoc bodies
 #    (bash expands them there: `cat <<EOF` + `$(git push -f)` runs the push);
-#  - `$((...))`, `((...))`, `$[...]` arithmetic, where `<<` is a shift, not a heredoc;
-#  - `#` comments to end of line;
+#  - `$((...))`, `((...))`, `$[...]`, `${...}`, and `[...]` frames, where `<<` is a shift or
+#    text, not a heredoc;
+#  - `#` comments to end of line, only where bash starts one: at the start of a word, which a
+#    `)` closing `$(...)` or a closing backtick is not;
+#  - `case ... esac`: a pattern's `)` does not close an enclosing `$(...)`;
 #  - heredoc bodies, dropped line by line up to the terminator (`EOF)` also closes a `$(`,
 #    `<<-` allows leading tabs, an unterminated body runs to end of input as in bash). A `<<WORD`
 #    marker counts only in code, never inside a string, a comment, or arithmetic: honoring one
@@ -56,7 +66,11 @@ fi
 strip_data() {
   awk '
   # q: 0 code, 1 single quotes, 2 double quotes, 3 $'"'"'...'"'"', 4 unquoted heredoc body, 5 quoted heredoc body
-  BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0 }
+  # kind[]: "(" subshell, "$(" substitution, "`", "((" arithmetic, "(a" paren inside arithmetic,
+  #         "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
+  function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0 }
+  function pop() { q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i }
+  BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = "" }
   {
     line = $0
     if (body) {
@@ -74,6 +88,7 @@ strip_data() {
     n = split(line, c, "")
     o = ""
     i = 1
+    poppos = -1
     while (i <= n) {
       ch = c[i]
       if (q == 1) { if (ch == "\047") q = 0; i++; continue }
@@ -81,32 +96,40 @@ strip_data() {
       if (q == 2 || q == 4) {                    # data that still expands substitutions
         if (ch == "\\") { i += 2; continue }
         if (q == 2 && ch == "\"") { q = 0; i++; continue }
-        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { kind[++depth] = "(("; save[depth] = q; q = 0; o = o " "; i += 3; continue }
-        if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = q; q = 0; o = o " "; i += 2; continue }
-        if (ch == "`") { kind[++depth] = "`"; save[depth] = q; q = 0; o = o " "; i++; continue }
+        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("((", q); q = 0; o = o " "; i += 3; continue }
+        if (ch == "$" && c[i + 1] == "(") { push("$(", q); q = 0; o = o " "; i += 2; continue }
+        if (ch == "$" && c[i + 1] == "{") { push("${", q); q = 0; o = o " "; i += 2; continue }
+        if (ch == "`") { push("`", q); q = 0; o = o " "; i++; continue }
         i++; continue
       }
-      arith = (depth > 0 && (kind[depth] == "((" || kind[depth] == "[" || kind[depth] == "(a"))
+      top = (depth > 0) ? kind[depth] : ""
+      noheredoc = (top == "((" || top == "[" || top == "(a" || top == "${")
       if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o ch c[i + 1]; i += 2; continue }
       if (ch == "$" && c[i + 1] == "\047") { q = 3; i += 2; continue }
       if (ch == "\047") { q = 1; i++; continue }
       if (ch == "\"") { q = 2; i++; continue }
-      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|()`]/)) break
-      if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { kind[++depth] = "(("; save[depth] = 0; o = o " "; i += 3; continue }
-      if (ch == "$" && c[i + 1] == "[") { kind[++depth] = "["; save[depth] = 0; o = o " "; i += 2; continue }
-      if (ch == "$" && c[i + 1] == "(") { kind[++depth] = "("; save[depth] = 0; o = o "$("; i += 2; continue }
-      if (ch == "(" && arith) { kind[++depth] = "(a"; save[depth] = 0; o = o " "; i++; continue }
-      if (ch == "(" && c[i + 1] == "(") { kind[++depth] = "(("; save[depth] = 0; o = o " "; i += 2; continue }
-      if (ch == "(") { kind[++depth] = "("; save[depth] = 0; o = o ch; i++; continue }
-      if (ch == ")" && c[i + 1] == ")" && depth > 0 && kind[depth] == "((") { q = save[depth--]; o = o " "; i += 2; continue }
-      if (ch == ")" && depth > 0 && kind[depth] == "(a") { q = save[depth--]; o = o " "; i++; continue }
-      if (ch == "]" && depth > 0 && kind[depth] == "[") { q = save[depth--]; o = o " "; i++; continue }
-      if (ch == ")" && depth > 0 && kind[depth] == "(") { q = save[depth--]; o = o ch; i++; continue }
+      # a comment starts only where a word starts: after whitespace, a control operator, or the `)`
+      # of a subshell. The `)` of `$(...)`, a closing backtick, or `))` end a word, not a command.
+      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|(]/ || (c[i - 1] == ")" && poppos == i - 1 && poppedkind == "("))) break
+      if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("((", 0); o = o " "; i += 3; continue }
+      if (ch == "$" && c[i + 1] == "[") { push("[", 0); o = o " "; i += 2; continue }
+      if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
+      if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$("; i += 2; continue }
+      if (ch == "[") { push("[", 0); o = o " "; i++; continue }
+      if (ch == "(" && noheredoc && top != "${") { push("(a", 0); o = o " "; i++; continue }
+      if (ch == "(" && c[i + 1] == "(") { push("((", 0); o = o " "; i += 2; continue }
+      if (ch == "(") { push("(", 0); o = o ch; i++; continue }
+      if (ch == ")" && c[i + 1] == ")" && top == "((") { pop(); o = o " "; i += 2; continue }
+      if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
+      if (ch == "]" && top == "[") { pop(); o = o " "; i++; continue }
+      if (ch == "}" && top == "${") { pop(); o = o " "; i++; continue }
+      if (ch == ")" && casec[depth] > 0) { o = o ch; i++; continue }         # a case pattern terminator
+      if (ch == ")" && (top == "(" || top == "$(")) { pop(); o = o ch; i++; continue }
       if (ch == "`") {
-        if (depth > 0 && kind[depth] == "`") q = save[depth--]; else { kind[++depth] = "`"; save[depth] = 0 }
+        if (top == "`") pop(); else push("`", 0)
         o = o " "; i++; continue
       }
-      if (ch == "<" && c[i + 1] == "<" && c[i + 2] != "<" && (i == 1 || c[i - 1] != "<") && !arith) {
+      if (ch == "<" && c[i + 1] == "<" && c[i + 2] != "<" && (i == 1 || c[i - 1] != "<") && !noheredoc) {
         j = i + 2; dash = 0
         if (c[j] == "-") { dash = 1; j++ }
         while (c[j] == " " || c[j] == "\t") j++
@@ -117,19 +140,29 @@ strip_data() {
             while (j <= n && c[j] != qc) { w = w c[j]; j++ }
             j++; continue
           }
-          if (c[j] == "\\") { quoted = 1; j++; if (j <= n) { w = w c[j]; j++ }; continue }
+          if (c[j] == "\\") {
+            if (j == n) exit 3                   # a delimiter continued on the next line: refuse to guess
+            quoted = 1; j++; w = w c[j]; j++; continue
+          }
           w = w c[j]; j++
         }
         if (w != "") { pword[++npend] = w; pdash[npend] = dash; pq[npend] = quoted }
         o = o "<<"; i = j; continue
       }
+      if (ch ~ /[A-Za-z_]/ && (i == 1 || c[i - 1] !~ /[A-Za-z0-9_]/)) {   # a word: track case ... esac
+        j = i; w = ""
+        while (j <= n && c[j] ~ /[A-Za-z0-9_]/) { w = w c[j]; j++ }
+        if (w == "case") casec[depth]++
+        else if (w == "esac" && casec[depth] > 0) casec[depth]--
+        o = o w; i = j; continue
+      }
       o = o ch; i++
     }
-    if (cont) { printf "%s ", o; cont = 0 } else print o
+    if (cont) { printf "%s", o; cont = 0 } else print o
     if (!body && npend > 0) { body = 1; bodyq = q; q = (pq[1] ? 5 : 4) }
   }'
 }
-if ! STRIPPED=$(set -o pipefail; printf '%s' "$CMD" | strip_data); then
+if ! STRIPPED=$(printf '%s' "$CMD" | strip_data); then
   echo "Blocked: guard-commit.sh could not parse the command (awk failed). Failing closed." >&2
   exit 2
 fi
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 5649ffd..f9ca91c 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -233,6 +233,30 @@ run "quoted delimiter with a space"          2 'cat <<"E OF"
 body
 E OF
 git push -f origin main'
+run "# right after \$( ) is not a comment"   2 'echo $(date)#x; git push --force origin main'
+run "# right after a backtick is not a comment" 2 'echo `date`#x; git push --force origin main'
+run "# after \$( ) in a chained commit"      2 'git commit -m x && echo $(date)#c && git push --force origin main'
+run "# after a subshell is a comment"        0 '( : )#c git push --force origin main'
+run "delimiter split by a continuation"      2 'cat <<E\
+OF
+body
+EOF
+git push --force origin main'
+run "<< inside \${ } is not a heredoc"       2 'echo ${x:-<<EOF}
+git push --force origin main'
+run "<< inside an array subscript"           2 'a[1<<2]=1
+git push --force origin main'
+run "test brackets then a force-push"        2 '[ -f x ] && git push -f origin main'
+run "word split across a continuation"       2 'git pu\
+sh --force origin main'
+run "flag split across a continuation"       2 'git push --for\
+ce origin main'
+run "case pattern inside a quoted \$( )"     2 'x="$(case a in a) git push --force origin main;; esac)"'
+run "case pattern then a chained push"       2 'git commit -m "$(case a in a) echo x;; esac)" && git push -f origin main'
+run "case statement in plain code"           2 'case x in x) echo hi;; esac
+git push -f origin main'
+run "case statement then plain push"         0 'case x in x) echo hi;; esac
+git push origin feat/x'
 BIG=$(head -c 300000 /dev/zero | tr '\0' 'a')
 run "oversized command fails closed"         2 "git commit -m $BIG"
 

From 51ea0c57fd19aadffd649d720f5188e26b5da877 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 04:33:09 +0100
Subject: [PATCH 06/39] fix(hooks): bodies start and end on parser state, not
 the physical line; nested and same-line markers fail closed; segment cap

Third code review: an EOF) terminator followed by a quote or an operator was not recognized, a marker registered inside a body's substitution was queued behind the outer terminator, and a body started at the end of the marker line even when a quote or continuation was still open. Now a terminator may be followed by ) and the rest of that line is walked as code; a body starts only at a newline reached in code state with no continuation; frames left open inside a body die with it; a marker nested inside a body, or one registered inside a substitution that closes on the same line, makes the walk fail closed. A backslash before a flag character is dropped as bash does. The per-segment loop refuses over 500 separators so it cannot outlast the hook timeout, and a missing awk is tested to fail closed. Fourteen cases added (139 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 43 ++++++++++++++++++-------
 tests/hooks/test-guard-commit.sh | 55 +++++++++++++++++++++++++++++++-
 2 files changed, 85 insertions(+), 13 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 977f9f7..478749d 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -36,7 +36,8 @@ if [ -z "$CMD" ]; then
   exit 2
 fi
 
-# No agent-realistic command is this long; past this size the strip below gets slow, so stop here.
+# No agent-realistic command is this long; past this size the character walk below gets slow, so
+# stop here (the per-segment loop further down has its own cap for the same reason).
 if [ ${#CMD} -gt 262144 ]; then
   echo "Blocked: guard-commit.sh will not inspect a git commit/push command over 256 KB. Split it up." >&2
   exit 2
@@ -68,21 +69,26 @@ strip_data() {
   # q: 0 code, 1 single quotes, 2 double quotes, 3 $'"'"'...'"'"', 4 unquoted heredoc body, 5 quoted heredoc body
   # kind[]: "(" subshell, "$(" substitution, "`", "((" arithmetic, "(a" paren inside arithmetic,
   #         "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
-  function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0 }
-  function pop() { q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i }
+  function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend }
+  function pop() {
+    if (npend > pendat[depth]) exit 3            # a marker inside a substitution closed on its own line: refuse to guess
+    q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i
+  }
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = "" }
   {
     line = $0
     if (body) {
       t = line
       if (pdash[1]) sub(/^\t+/, "", t)
-      tail = ""
-      while (t ~ /\)$/) { t = substr(t, 1, length(t) - 1); tail = tail ")" }
-      if (t == pword[1]) {                       # terminator: leave this body, walk any `)` tail as code
+      w1 = pword[1]; rest = ""; term = 0
+      if (t == w1) term = 1
+      else if (depth > 0 && substr(t, 1, length(w1) + 1) == w1 ")") { term = 1; rest = substr(t, length(w1) + 1) }   # `EOF)...` closes a $( too
+      if (term) {                                # terminator: leave this body, walk the rest of the line as code
         for (k = 1; k < npend; k++) { pword[k] = pword[k + 1]; pdash[k] = pdash[k + 1]; pq[k] = pq[k + 1] }
         npend--
+        depth = bodydepth                        # anything left open inside the body dies with it, as in bash
         if (npend == 0) { body = 0; q = bodyq } else q = (pq[1] ? 5 : 4)
-        line = tail
+        line = rest
       } else if (q == 5) next                    # quoted-delimiter body: inert, drop the line
     }
     n = split(line, c, "")
@@ -97,14 +103,14 @@ strip_data() {
         if (ch == "\\") { i += 2; continue }
         if (q == 2 && ch == "\"") { q = 0; i++; continue }
         if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("((", q); q = 0; o = o " "; i += 3; continue }
-        if (ch == "$" && c[i + 1] == "(") { push("$(", q); q = 0; o = o " "; i += 2; continue }
+        if (ch == "$" && c[i + 1] == "(") { push("$(", q); q = 0; o = o "$("; i += 2; continue }
         if (ch == "$" && c[i + 1] == "{") { push("${", q); q = 0; o = o " "; i += 2; continue }
         if (ch == "`") { push("`", q); q = 0; o = o " "; i++; continue }
         i++; continue
       }
       top = (depth > 0) ? kind[depth] : ""
       noheredoc = (top == "((" || top == "[" || top == "(a" || top == "${")
-      if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o ch c[i + 1]; i += 2; continue }
+      if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o c[i + 1]; i += 2; continue }   # `\-f` is `-f`
       if (ch == "$" && c[i + 1] == "\047") { q = 3; i += 2; continue }
       if (ch == "\047") { q = 1; i++; continue }
       if (ch == "\"") { q = 2; i++; continue }
@@ -146,7 +152,10 @@ strip_data() {
           }
           w = w c[j]; j++
         }
-        if (w != "") { pword[++npend] = w; pdash[npend] = dash; pq[npend] = quoted }
+        if (w != "") {
+          if (body) exit 3                       # a heredoc nested inside another body: refuse to guess
+          pword[++npend] = w; pdash[npend] = dash; pq[npend] = quoted
+        }
         o = o "<<"; i = j; continue
       }
       if (ch ~ /[A-Za-z_]/ && (i == 1 || c[i - 1] !~ /[A-Za-z0-9_]/)) {   # a word: track case ... esac
@@ -158,8 +167,10 @@ strip_data() {
       }
       o = o ch; i++
     }
+    # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash
+    enter = (!body && npend > 0 && q == 0 && !cont)
     if (cont) { printf "%s", o; cont = 0 } else print o
-    if (!body && npend > 0) { body = 1; bodyq = q; q = (pq[1] ? 5 : 4) }
+    if (enter) { body = 1; bodyq = q; bodydepth = depth; q = (pq[1] ? 5 : 4) }
   }'
 }
 if ! STRIPPED=$(printf '%s' "$CMD" | strip_data); then
@@ -173,6 +184,14 @@ if printf '%s' "$STRIPPED" | grep -qE '(^|[^[:alnum:]_./-])((ba|z|da)?sh[[:space
   echo "Blocked: git commit/push inside a shell wrapper (sh -c / bash -c / eval) cannot be inspected. Run the git command directly." >&2; exit 2
 fi
 
+# Each segment costs a few greps; thousands of `;`-separated segments could outlast the hook
+# timeout, and a timed-out PreToolUse hook does not block. No real command has hundreds.
+SEGMENTS=$(printf '%s' "$STRIPPED" | tr ';&|' '\n')
+if [ "$(printf '%s' "$STRIPPED" | tr -cd ';&|\n' | wc -c)" -gt 500 ]; then
+  echo "Blocked: guard-commit.sh will not inspect a git commit/push command with over 500 segments. Split it up." >&2
+  exit 2
+fi
+
 IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""
 while IFS= read -r SEG; do
   [ -z "$SEG" ] && continue
@@ -199,7 +218,7 @@ while IFS= read -r SEG; do
   if [ -n "$SEG_COMMIT" ] && printf '%s' "$SEG" | grep -qiE '[[:space:]]commit.*[[:space:]]-[A-Za-z]*n[A-Za-z]*([^[:alnum:]]|$)'; then
     echo "Blocked: git commit -n is --no-verify (CLAUDE.md §14). Fix the hook failure instead." >&2; exit 2
   fi
-done <<<"$(printf '%s' "$STRIPPED" | tr ';&|' '\n')"
+done <<<"$SEGMENTS"
 
 [ -z "$IS_COMMIT$HAS_PUSH" ] && exit 0
 
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index f9ca91c..04fc98c 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -257,6 +257,45 @@ run "case statement in plain code"           2 'case x in x) echo hi;; esac
 git push -f origin main'
 run "case statement then plain push"         0 'case x in x) echo hi;; esac
 git push origin feat/x'
+run "case inside a substitution in a body"   2 'cat <<EOF
+$(case x in x) git push -f origin main;; esac)
+EOF'
+run "multi-line here-string then push"       2 'read -r a <<<"hello
+world"
+git push -f origin main'
+run "EOF)\" terminator then a chained push"  2 'git commit -m "$(cat <<EOF
+body
+EOF)" && git push -f origin main'
+run "EOF) && terminator"                     2 'x=$(cat <<EOF
+body
+EOF) && git push -f origin main'
+run "EOF)\" terminator then push on next line" 2 'git commit -m "$(cat <<EOF
+body
+EOF)"
+git push -f origin main'
+run "heredoc nested inside a body substitution" 2 'cat <<EOF
+$(cat <<INNER
+hello
+INNER
+)
+EOF
+git push -f origin main'
+run "marker line continued then push"        2 'cat <<EOF \
+; git push -f origin main
+EOF'
+run "marker line with an open quote"         2 'cat <<EOF "x
+" ; git push -f origin main
+EOF'
+run "unclosed \$( inside a body, then case"  2 'cat <<EOF
+$(echo hi
+EOF
+case x in x) git push -f origin main;; esac'
+run "substitution with marker closed on its line" 2 'x=$(cat <<EOF)
+git push -f origin main
+EOF'
+run "backslash-escaped -f"                   2 'git push \-f origin main'
+BIGSEG=$(head -c 1200 /dev/zero | tr '\0' ';')
+run "too many segments fails closed"         2 "git commit -m x $BIGSEG"
 BIG=$(head -c 300000 /dev/zero | tr '\0' 'a')
 run "oversized command fails closed"         2 "git commit -m $BIG"
 
@@ -361,8 +400,22 @@ run_nojq() {
 run_nojq "no jq: commit fails closed"        2 'git commit -m "x"'
 run_nojq "no jq: unrelated command allowed"  0 'ls'
 
+# --- missing awk: the strip cannot run, so a git commit/push fails closed ---------------------
+NOAWK="$TMP/noawk"
+mkdir -p "$NOAWK"
+for t in bash sh grep git sed tr printf cat jq wc; do
+  p=$(command -v "$t") && ln -s "$p" "$NOAWK/$t"
+done
+run_noawk() {
+  printf '%s' "$3" | jq -Rs '{tool_input:{command:.}}' >"$TMP/payload"
+  PATH="$NOAWK" bash "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
+  record "$1" "$2" $? "$3"
+}
+run_noawk "no awk: commit fails closed"      2 'git commit -m "x"'
+run_noawk "no awk: unrelated command allowed" 0 'ls'
+
 # Every case in this file must have been counted: a case that ran in a subshell would be lost.
-EXPECTED=$(grep -cE '^(run|run_raw|run_nojq) ' "$SELF")
+EXPECTED=$(grep -cE '^(run|run_raw|run_nojq|run_noawk) ' "$SELF")
 if [ "$((PASS + FAIL))" -ne "$EXPECTED" ]; then
   echo "FAIL: $EXPECTED cases defined, $((PASS + FAIL)) counted"
   FAIL=$((FAIL + 1))

From 2fa95ccb7db344382120cc11f3c8857db1475850 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 04:48:02 +0100
Subject: [PATCH 07/39] fix(hooks): case counted only in command position; a )
 unwinds to the frame it closes; no comments inside ${ }; open frame or quote
 at end fails closed; here-strings instead of pipes

Final security pass: the word case anywhere (docs/use-case.md inside a substitution) stuck the pattern counter, so the ) closing $( ) never popped and the closing quote read as an opening one, hiding a chained force-push; an unbalanced [ or ${ leaked the same way; # inside ${ } was taken as a comment; and global pipefail turned grep -q's early exit into a SIGPIPE upstream, silently disabling the secrets scan on staged diffs over a pipe buffer. Now case and esac count only in command position, a ) the top frame cannot close unwinds to the substitution it does close, [ frames die at command boundaries, comments are not recognized inside expansion frames, a frame or quote still open at end of input fails closed (which also covers a case with no esac), and every whole-input check reads through a here-string. The fast path joins continuations with a bash substitution instead of sed. Fifteen cases added (154 total), including a secret at the top of a 200 KB staged diff and 80 KB of padding before a wrapper and a hooksPath override; green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 97 ++++++++++++++++++++------------
 tests/hooks/test-guard-commit.sh | 31 ++++++++++
 2 files changed, 93 insertions(+), 35 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 478749d..cc2ac2a 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -6,6 +6,9 @@
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
 # and flags spelled with quoting tricks (`--no-veri"fy"`, `$'--no-verify'`, unique-prefix `--no-veri`).
+#
+# Every check reads its whole input through a here-string, never a pipe: `grep -q` exits on the
+# first match, and under pipefail the upstream writer's SIGPIPE would read as "no match".
 export LC_ALL=C   # byte-oriented grep/awk/tr: an invalid UTF-8 byte must not make a tool drop the rest of the input
 set -o pipefail   # a failing tool anywhere in a pipeline must surface, never read as "no match"
 INPUT=$(cat)
@@ -15,11 +18,12 @@ INPUT=$(cat)
 # Match loosely (no quote-class): a quoted arg before the subcommand (`git -C "x" commit`)
 # must NOT slip past into a silent allow. JSON-escaped backslash-newlines (`git pu\` + `sh`) are
 # joined first so a split word cannot dodge the match. grep exit 1 = no match; anything else = error.
-printf '%s' "$INPUT" | sed 's/\\\\\\n//g' | grep -qiE 'git.*(commit|push)'
+JOINED=${INPUT//\\\\\\n/}
+grep -qiE 'git.*(commit|push)' <<<"$JOINED"
 case $? in
   0) ;;
   1) exit 0 ;;
-  *) echo "Blocked: guard-commit.sh could not run its fast-path check (sed/grep failed). Failing closed." >&2; exit 2 ;;
+  *) echo "Blocked: guard-commit.sh could not run its fast-path check (grep failed). Failing closed." >&2; exit 2 ;;
 esac
 
 # The command plausibly commits/pushes — jq is needed to inspect it. Fail loud and closed.
@@ -30,7 +34,7 @@ fi
 
 # The payload mentions git commit/push, so an empty command here means the payload did not parse
 # (or its shape changed). Fail closed rather than silently turning into a no-op.
-CMD=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+CMD=$(jq -r '.tool_input.command // empty' <<<"$INPUT" 2>/dev/null)
 if [ -z "$CMD" ]; then
   echo "Blocked: guard-commit.sh could not read .tool_input.command from the PreToolUse payload. Failing closed." >&2
   exit 2
@@ -54,27 +58,33 @@ fi
 #  - `$(...)` and backticks reopen code inside double quotes and inside unquoted heredoc bodies
 #    (bash expands them there: `cat <<EOF` + `$(git push -f)` runs the push);
 #  - `$((...))`, `((...))`, `$[...]`, `${...}`, and `[...]` frames, where `<<` is a shift or
-#    text, not a heredoc;
+#    text and `#` is not a comment; an unbalanced `[` dies at the next command boundary;
 #  - `#` comments to end of line, only where bash starts one: at the start of a word, which a
 #    `)` closing `$(...)` or a closing backtick is not;
-#  - `case ... esac`: a pattern's `)` does not close an enclosing `$(...)`;
+#  - `case ... esac`, counted only in command position: a pattern's `)` does not close an
+#    enclosing `$(...)`; a `)` that the top frame cannot close unwinds to the `(` it does close;
+#    a frame or quote still open at the end of the input fails closed;
 #  - heredoc bodies, dropped line by line up to the terminator (`EOF)` also closes a `$(`,
 #    `<<-` allows leading tabs, an unterminated body runs to end of input as in bash). A `<<WORD`
 #    marker counts only in code, never inside a string, a comment, or arithmetic: honoring one
-#    there would let a real command hide behind a fake terminator line.
+#    there would let a real command hide behind a fake terminator line. A body starts at the
+#    newline that ends the command, and anything left open inside it dies with it.
 # Every divergence from bash is meant to err toward stripping LESS (a false block at worst),
-# never more. If the walk itself fails, the hook fails closed (pipefail below).
+# never more. Where the walk would have to guess (a heredoc nested in a body, a marker inside a
+# substitution that closes on its own line, a delimiter continued on the next line) it exits 3
+# and the hook fails closed.
 strip_data() {
   awk '
   # q: 0 code, 1 single quotes, 2 double quotes, 3 $'"'"'...'"'"', 4 unquoted heredoc body, 5 quoted heredoc body
   # kind[]: "(" subshell, "$(" substitution, "`", "((" arithmetic, "(a" paren inside arithmetic,
   #         "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
-  function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend }
+  function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend; cmdpos = 1 }
   function pop() {
     if (npend > pendat[depth]) exit 3            # a marker inside a substitution closed on its own line: refuse to guess
-    q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i
+    q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i; cmdpos = 0
   }
-  BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = "" }
+  function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
+  BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1 }
   {
     line = $0
     if (body) {
@@ -95,6 +105,7 @@ strip_data() {
     o = ""
     i = 1
     poppos = -1
+    if (q == 0 && !cont) cmdpos = 1
     while (i <= n) {
       ch = c[i]
       if (q == 1) { if (ch == "\047") q = 0; i++; continue }
@@ -116,7 +127,9 @@ strip_data() {
       if (ch == "\"") { q = 2; i++; continue }
       # a comment starts only where a word starts: after whitespace, a control operator, or the `)`
       # of a subshell. The `)` of `$(...)`, a closing backtick, or `))` end a word, not a command.
-      if (ch == "#" && (i == 1 || c[i - 1] ~ /[ \t;&|(]/ || (c[i - 1] == ")" && poppos == i - 1 && poppedkind == "("))) break
+      if (ch == "#" && !noheredoc && (i == 1 || c[i - 1] ~ /[ \t;&|(]/ || (c[i - 1] == ")" && poppos == i - 1 && poppedkind == "("))) break
+      if (ch == ";" || ch == "&" || ch == "|") { droptests(); cmdpos = 1; o = o ch; i++; continue }
+      if (ch == "{" || ch == "!") { cmdpos = 1; o = o ch; i++; continue }
       if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("((", 0); o = o " "; i += 3; continue }
       if (ch == "$" && c[i + 1] == "[") { push("[", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
@@ -129,8 +142,15 @@ strip_data() {
       if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
       if (ch == "]" && top == "[") { pop(); o = o " "; i++; continue }
       if (ch == "}" && top == "${") { pop(); o = o " "; i++; continue }
-      if (ch == ")" && casec[depth] > 0) { o = o ch; i++; continue }         # a case pattern terminator
-      if (ch == ")" && (top == "(" || top == "$(")) { pop(); o = o ch; i++; continue }
+      if (ch == ")") {
+        if (top == "[" || top == "${") {         # a frame `)` cannot close: unwind to the `(` it does close
+          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "`" && kind[depth] != "((") depth--
+          top = (depth > 0) ? kind[depth] : ""
+        }
+        if (casec[depth] > 0) { o = o ch; i++; cmdpos = 1; continue }   # a case pattern terminator
+        if (top == "(" || top == "$(") { pop(); o = o ch; i++; continue }
+        o = o ch; i++; continue
+      }
       if (ch == "`") {
         if (top == "`") pop(); else push("`", 0)
         o = o " "; i++; continue
@@ -156,38 +176,44 @@ strip_data() {
           if (body) exit 3                       # a heredoc nested inside another body: refuse to guess
           pword[++npend] = w; pdash[npend] = dash; pq[npend] = quoted
         }
-        o = o "<<"; i = j; continue
+        o = o "<<"; i = j; cmdpos = 0; continue
       }
-      if (ch ~ /[A-Za-z_]/ && (i == 1 || c[i - 1] !~ /[A-Za-z0-9_]/)) {   # a word: track case ... esac
+      if (ch ~ /[A-Za-z_]/ && (i == 1 || c[i - 1] !~ /[A-Za-z0-9_]/)) {   # a word: track case ... esac in command position
         j = i; w = ""
         while (j <= n && c[j] ~ /[A-Za-z0-9_]/) { w = w c[j]; j++ }
-        if (w == "case") casec[depth]++
-        else if (w == "esac" && casec[depth] > 0) casec[depth]--
+        if (cmdpos && w == "case") casec[depth]++
+        else if (cmdpos && w == "esac" && casec[depth] > 0) casec[depth]--
+        cmdpos = (w == "if" || w == "then" || w == "else" || w == "elif" || w == "while" || w == "until" || w == "do" || w == "time")
         o = o w; i = j; continue
       }
+      if (ch != " " && ch != "\t") cmdpos = 0
       o = o ch; i++
     }
+    if (q == 0 && !cont) droptests()
     # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash
     enter = (!body && npend > 0 && q == 0 && !cont)
     if (cont) { printf "%s", o; cont = 0 } else print o
     if (enter) { body = 1; bodyq = q; bodydepth = depth; q = (pq[1] ? 5 : 4) }
-  }'
+  }
+  # A frame or quote still open at the end means bash would reject the whole input (or the walk
+  # lost track of it, e.g. a `case` with no `esac`). Either way: refuse to guess.
+  END { if (depth > 0 || q == 1 || q == 2 || q == 3) exit 3 }'
 }
-if ! STRIPPED=$(printf '%s' "$CMD" | strip_data); then
+if ! STRIPPED=$(strip_data <<<"$CMD"); then
   echo "Blocked: guard-commit.sh could not parse the command (awk failed). Failing closed." >&2
   exit 2
 fi
 
 # A shell wrapper runs its quoted argument as a command, which the strip above just hid.
 # Refuse rather than guess: the unwrapped form is always available to the agent.
-if printf '%s' "$STRIPPED" | grep -qE '(^|[^[:alnum:]_./-])((ba|z|da)?sh[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)'; then
+if grep -qE '(^|[^[:alnum:]_./-])((ba|z|da)?sh[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' <<<"$STRIPPED"; then
   echo "Blocked: git commit/push inside a shell wrapper (sh -c / bash -c / eval) cannot be inspected. Run the git command directly." >&2; exit 2
 fi
 
 # Each segment costs a few greps; thousands of `;`-separated segments could outlast the hook
 # timeout, and a timed-out PreToolUse hook does not block. No real command has hundreds.
-SEGMENTS=$(printf '%s' "$STRIPPED" | tr ';&|' '\n')
-if [ "$(printf '%s' "$STRIPPED" | tr -cd ';&|\n' | wc -c)" -gt 500 ]; then
+SEGMENTS=$(tr ';&|' '\n' <<<"$STRIPPED")
+if [ "$(tr -cd ';&|\n' <<<"$STRIPPED" | wc -c)" -gt 500 ]; then
   echo "Blocked: guard-commit.sh will not inspect a git commit/push command with over 500 segments. Split it up." >&2
   exit 2
 fi
@@ -196,9 +222,9 @@ IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""
 while IFS= read -r SEG; do
   [ -z "$SEG" ] && continue
   SEG_COMMIT=""; SEG_PUSH=""
-  printf '%s' "$SEG" | grep -qiE 'git.*[[:space:]]commit([^[:alnum:]]|$)' && SEG_COMMIT=1
-  printf '%s' "$SEG" | grep -qiE 'git.*[[:space:]]push([^[:alnum:]]|$)' && SEG_PUSH=1
-  printf '%s' "$SEG" | grep -qiE 'git.*[[:space:]]add([^[:alnum:]]|$)' && HAS_ADD=1
+  grep -qiE 'git.*[[:space:]]commit([^[:alnum:]]|$)' <<<"$SEG" && SEG_COMMIT=1
+  grep -qiE 'git.*[[:space:]]push([^[:alnum:]]|$)' <<<"$SEG" && SEG_PUSH=1
+  grep -qiE 'git.*[[:space:]]add([^[:alnum:]]|$)' <<<"$SEG" && HAS_ADD=1
   [ -n "$SEG_COMMIT" ] && IS_COMMIT=1
   [ -n "$SEG_PUSH" ] && HAS_PUSH=1
   [ -z "$SEG_COMMIT$SEG_PUSH" ] && continue
@@ -206,16 +232,16 @@ while IFS= read -r SEG; do
   # force-push: --force / --force-with-lease / --mirror, -f alone or inside a flag cluster (-uf),
   # or a `+refspec` (the refspec form of --force). `--force-if-includes` alone is also caught;
   # it is a no-op without --force-with-lease, so nothing legitimate is lost.
-  if [ -n "$SEG_PUSH" ] && printf '%s' "$SEG" | grep -qiE '[[:space:]]push.*[[:space:]](--force-with-lease|--force|--mirror)([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]-[A-Za-z]*f[A-Za-z]*([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]\+[^[:space:]]'; then
+  if [ -n "$SEG_PUSH" ] && grep -qiE '[[:space:]]push.*[[:space:]](--force-with-lease|--force|--mirror)([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]-[A-Za-z]*f[A-Za-z]*([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]\+[^[:space:]]' <<<"$SEG"; then
     echo "Blocked: force-push. Protected-branch discipline (CLAUDE.md §9)." >&2; exit 2
   fi
 
   # --no-verify skips the pre-commit / pre-push hooks the repo installed on purpose (CLAUDE.md §14),
   # as does `git commit -n` (the short form, alone or in a cluster like -anm). Fix the hook failure instead.
-  if printf '%s' "$SEG" | grep -qiE '[[:space:]]--no-verify([^[:alnum:]-]|$)'; then
+  if grep -qiE '[[:space:]]--no-verify([^[:alnum:]-]|$)' <<<"$SEG"; then
     echo "Blocked: --no-verify bypasses the repo's git hooks (CLAUDE.md §14). Fix the hook failure instead." >&2; exit 2
   fi
-  if [ -n "$SEG_COMMIT" ] && printf '%s' "$SEG" | grep -qiE '[[:space:]]commit.*[[:space:]]-[A-Za-z]*n[A-Za-z]*([^[:alnum:]]|$)'; then
+  if [ -n "$SEG_COMMIT" ] && grep -qiE '[[:space:]]commit.*[[:space:]]-[A-Za-z]*n[A-Za-z]*([^[:alnum:]]|$)' <<<"$SEG"; then
     echo "Blocked: git commit -n is --no-verify (CLAUDE.md §14). Fix the hook failure instead." >&2; exit 2
   fi
 done <<<"$SEGMENTS"
@@ -224,7 +250,7 @@ done <<<"$SEGMENTS"
 
 # Re-pointing core.hooksPath anywhere in the same call (`git -c core.hooksPath=x commit`,
 # `git config core.hooksPath x; git commit`, GIT_CONFIG_PARAMETERS=...) is the same bypass.
-if printf '%s' "$STRIPPED" | grep -qiE 'core\.hooksPath|GIT_CONFIG_(PARAMETERS|COUNT|KEY_)'; then
+if grep -qiE 'core\.hooksPath|GIT_CONFIG_(PARAMETERS|COUNT|KEY_)' <<<"$STRIPPED"; then
   echo "Blocked: core.hooksPath override bypasses the repo's git hooks (CLAUDE.md §14)." >&2; exit 2
 fi
 
@@ -233,14 +259,14 @@ fi
 
 # committer must be a human — match whole tokens / known bot identities, not substrings
 NAME=$(git config user.name 2>/dev/null || echo "")
-if printf '%s' "$NAME" | grep -qiE '(^|[^[:alnum:]])(claude|chatgpt|copilot|cursor|cursoragent|github-actions|assistant|bot|ai[-_ ]?(agent|assistant|bot))([^[:alnum:]]|$)'; then
+if grep -qiE '(^|[^[:alnum:]])(claude|chatgpt|copilot|cursor|cursoragent|github-actions|assistant|bot|ai[-_ ]?(agent|assistant|bot))([^[:alnum:]]|$)' <<<"$NAME"; then
   echo "Blocked: git user.name '$NAME' is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
 
 # no AI attribution in the commit message — scan the command only, not the staged diff.
 # (This is a repo *about* Claude Code; legit messages will say "Claude Code". Only
 #  attribution-SHAPED phrases are blocked, not bare mentions of a tool.)
-if printf '%s' "$CMD" | grep -qiE 'co-authored-by:.*(claude|gpt|copilot|cursor)|generated with (claude|chatgpt|copilot|ai)|🤖|AI[- ](assisted|generated)'; then
+if grep -qiE 'co-authored-by:.*(claude|gpt|copilot|cursor)|generated with (claude|chatgpt|copilot|ai)|🤖|AI[- ](assisted|generated)' <<<"$CMD"; then
   echo "Blocked: AI attribution detected in commit message (CLAUDE.md §2). Remove it." >&2; exit 2
 fi
 
@@ -254,21 +280,22 @@ EXCL=(':(exclude)*.example' ':(exclude)*.sample' ':(exclude)*.dist' ':(exclude)*
 # `--no-ext-diff` and `core.fsmonitor=false` so a repo-local config cannot make the guard run a program.
 GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff)
 DIFF=$("${GIT_DIFF[@]}" --cached 2>/dev/null -- "${EXCL[@]}")
-if [ -n "$HAS_ADD" ] || printf '%s' "$STRIPPED" | grep -qiE '[[:space:]](--all|-[A-Za-z]*a[A-Za-z]*)([[:space:]]|$)'; then
+if [ -n "$HAS_ADD" ] || grep -qiE '[[:space:]](--all|-[A-Za-z]*a[A-Za-z]*)([[:space:]]|$)' <<<"$STRIPPED"; then
   DIFF="$DIFF"$'\n'"$("${GIT_DIFF[@]}" 2>/dev/null -- "${EXCL[@]}")"
 fi
 if [ -n "$HAS_ADD" ]; then
   # (a plain function, not `case` inside $(...): bash 3.2 cannot parse the `)` of a case pattern there)
   scan_untracked() {
     git ls-files --others --exclude-standard 2>/dev/null | while IFS= read -r f; do
-      printf '%s' "$f" | grep -qE '\.(example|sample|dist|tmpl)$' && continue
+      grep -qE '\.(example|sample|dist|tmpl)$' <<<"$f" && continue
       grep -sIE "$SECRETS" -- "$f" | sed 's/^/+/'
     done
   }
   DIFF="$DIFF"$'\n'"$(scan_untracked)"
 fi
-# Only ADDED lines count: removing a leaked secret from a file must stay committable (§11: rotate, then scrub).
-if printf '%s' "$DIFF" | grep '^+' | grep -v '^+++' | grep -qiE "$SECRETS"; then
+# Only ADDED lines count (`+` but not the `+++` file header): removing a leaked secret from a file
+# must stay committable (§11: rotate, then scrub). One grep, one pass, no pipe.
+if grep -qiE "^\+([^+]|\+[^+]|$).*($SECRETS)" <<<"$DIFF"; then
   echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2
 fi
 exit 0
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 04fc98c..1a90187 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -296,6 +296,31 @@ EOF'
 run "backslash-escaped -f"                   2 'git push \-f origin main'
 BIGSEG=$(head -c 1200 /dev/zero | tr '\0' ';')
 run "too many segments fails closed"         2 "git commit -m x $BIGSEG"
+
+# --- a leaked frame must never turn the closing quote into an opening one ---------------------
+run "word case inside \$( ) then push"       2 'x="$(echo case)" ; git push --force origin main'
+run "use-case.md inside \$( ) then push"     2 'git commit -m "$(cat docs/use-case.md)" && git push --force origin main'
+run "edge-case inside \$( ) then --no-verify" 2 'git commit -m "$(basename feat/edge-case)" ; git commit --no-verify -m x'
+run "unbalanced [ inside \$( ) then push"    2 'x="$(echo [)" ; git push --force origin main'
+run "unclosed \${ inside \$( ) then push"    2 'x="$(echo ${a)" ; git push --force origin main'
+run "# inside \${ } is not a comment"        2 'echo ${x:-a #b} ; git push --force origin main'
+run "# inside quoted \${ } is not a comment" 2 'echo "${BRANCH:-main #default}" ; git push --force origin main'
+run "case without esac inside \$( )"         2 'x="$(case a in a) echo hi )"
+git push -f origin main'
+run "case without esac, echo form"           2 'echo "$(case a in a) x )"
+git push -f origin main'
+run "unbalanced quote inside \${ }"          2 'echo ${x//"/} ; git push --force origin main'
+run "unclosed \$( at end of input"           2 'x=$(echo hi
+git push -f origin main'
+run "unbalanced [ then a benign heredoc"     0 'echo [
+cat > n.md <<EOF
+never git push -f
+EOF'
+PAD=$(for _ in $(seq 1 400); do printf 'echo %s\n' "$(head -c 190 /dev/zero | tr '\0' 'a')"; done)
+run "wrapper after 80 KB of padding"         2 "$PAD
+bash -c \"git push --force origin main\""
+run "hooksPath after 80 KB of padding"       2 "$PAD
+git -c core.hooksPath=/dev/null commit -m x"
 BIG=$(head -c 300000 /dev/zero | tr '\0' 'a')
 run "oversized command fails closed"         2 "git commit -m $BIG"
 
@@ -376,6 +401,12 @@ git add key.txt
 run "staged private key header"              2 'git commit -m "x"'
 git rm -q --cached key.txt && rm key.txt
 
+# A secret on line 1 of a staged diff far larger than a pipe buffer must still be seen.
+{ printf 'aws_key=%s\n' "$AWS_KEY"; head -c 200000 /dev/zero | tr '\0' 'b' | fold -w 80; } >big.txt
+git add big.txt
+run "secret at the top of a 200 KB staged diff" 2 'git commit -m "x"'
+git rm -q --cached big.txt && rm big.txt
+
 # Scrubbing a leaked secret (a removed line) must stay committable; git is called directly here,
 # the hook is not involved in seeding the leak.
 printf 'aws_key=%s\n' "$AWS_KEY" >leaked.txt

From 0d94b8e6a5d77b05ab1558e940b151817dc7223f Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 05:04:13 +0100
Subject: [PATCH 08/39] fix(hooks): separators are text inside expansion and
 arithmetic frames; # after (( )) is a comment; secrets scan reads every added
 line

Fifth code review: a ; & or | inside ${x:-;} split git push from --force across segments, and # directly after an ((...)) command was not a comment though bash treats it as one. $(( is now a distinct frame from ((, separators inside ${ }, (( )), $(( )) and their parens are emitted as text, and the comment rule accepts the )) of an arithmetic command but not of an expansion. The secrets scan drops -q and excludes only the +++ b/ and +++ /dev/null headers, so an added line that itself starts with ++ is scanned. Seven cases added (161 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 39 ++++++++++++++++++++------------
 tests/hooks/test-guard-commit.sh | 13 +++++++++++
 2 files changed, 37 insertions(+), 15 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index cc2ac2a..07e2cbd 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -76,8 +76,8 @@ fi
 strip_data() {
   awk '
   # q: 0 code, 1 single quotes, 2 double quotes, 3 $'"'"'...'"'"', 4 unquoted heredoc body, 5 quoted heredoc body
-  # kind[]: "(" subshell, "$(" substitution, "`", "((" arithmetic, "(a" paren inside arithmetic,
-  #         "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
+  # kind[]: "(" subshell, "$(" substitution, "`", "((" arithmetic command, "$((" arithmetic expansion,
+  #         "(a" paren inside arithmetic, "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
   function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend; cmdpos = 1 }
   function pop() {
     if (npend > pendat[depth]) exit 3            # a marker inside a substitution closed on its own line: refuse to guess
@@ -113,24 +113,29 @@ strip_data() {
       if (q == 2 || q == 4) {                    # data that still expands substitutions
         if (ch == "\\") { i += 2; continue }
         if (q == 2 && ch == "\"") { q = 0; i++; continue }
-        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("((", q); q = 0; o = o " "; i += 3; continue }
+        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("$((", q); q = 0; o = o " "; i += 3; continue }
         if (ch == "$" && c[i + 1] == "(") { push("$(", q); q = 0; o = o "$("; i += 2; continue }
         if (ch == "$" && c[i + 1] == "{") { push("${", q); q = 0; o = o " "; i += 2; continue }
         if (ch == "`") { push("`", q); q = 0; o = o " "; i++; continue }
         i++; continue
       }
       top = (depth > 0) ? kind[depth] : ""
-      noheredoc = (top == "((" || top == "[" || top == "(a" || top == "${")
+      noheredoc = (top == "((" || top == "$((" || top == "[" || top == "(a" || top == "${")
       if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o c[i + 1]; i += 2; continue }   # `\-f` is `-f`
       if (ch == "$" && c[i + 1] == "\047") { q = 3; i += 2; continue }
       if (ch == "\047") { q = 1; i++; continue }
       if (ch == "\"") { q = 2; i++; continue }
       # a comment starts only where a word starts: after whitespace, a control operator, or the `)`
-      # of a subshell. The `)` of `$(...)`, a closing backtick, or `))` end a word, not a command.
-      if (ch == "#" && !noheredoc && (i == 1 || c[i - 1] ~ /[ \t;&|(]/ || (c[i - 1] == ")" && poppos == i - 1 && poppedkind == "("))) break
-      if (ch == ";" || ch == "&" || ch == "|") { droptests(); cmdpos = 1; o = o ch; i++; continue }
+      # that ends a subshell or an `((...))` command. The `)` of `$(...)` / `$((...))` or a closing
+      # backtick ends a word, and `#` after it is part of that word.
+      if (ch == "#" && !noheredoc && (i == 1 || c[i - 1] ~ /[ \t;&|(]/ || (c[i - 1] == ")" && poppos == i - 1 && (poppedkind == "(" || poppedkind == "((")))) break
+      # `;` `&` `|` separate commands only in code; inside an expansion or arithmetic they are text
+      if (ch == ";" || ch == "&" || ch == "|") {
+        if (top == "${" || top == "((" || top == "$((" || top == "(a") { o = o " "; i++; continue }
+        droptests(); cmdpos = 1; o = o ch; i++; continue
+      }
       if (ch == "{" || ch == "!") { cmdpos = 1; o = o ch; i++; continue }
-      if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("((", 0); o = o " "; i += 3; continue }
+      if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("$((", 0); o = o " "; i += 3; continue }
       if (ch == "$" && c[i + 1] == "[") { push("[", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$("; i += 2; continue }
@@ -138,13 +143,13 @@ strip_data() {
       if (ch == "(" && noheredoc && top != "${") { push("(a", 0); o = o " "; i++; continue }
       if (ch == "(" && c[i + 1] == "(") { push("((", 0); o = o " "; i += 2; continue }
       if (ch == "(") { push("(", 0); o = o ch; i++; continue }
-      if (ch == ")" && c[i + 1] == ")" && top == "((") { pop(); o = o " "; i += 2; continue }
+      if (ch == ")" && c[i + 1] == ")" && (top == "((" || top == "$((")) { pop(); poppos = i + 1; o = o " "; i += 2; continue }
       if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
       if (ch == "]" && top == "[") { pop(); o = o " "; i++; continue }
       if (ch == "}" && top == "${") { pop(); o = o " "; i++; continue }
       if (ch == ")") {
         if (top == "[" || top == "${") {         # a frame `)` cannot close: unwind to the `(` it does close
-          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "`" && kind[depth] != "((") depth--
+          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--
           top = (depth > 0) ? kind[depth] : ""
         }
         if (casec[depth] > 0) { o = o ch; i++; cmdpos = 1; continue }   # a case pattern terminator
@@ -293,9 +298,13 @@ if [ -n "$HAS_ADD" ]; then
   }
   DIFF="$DIFF"$'\n'"$(scan_untracked)"
 fi
-# Only ADDED lines count (`+` but not the `+++` file header): removing a leaked secret from a file
-# must stay committable (§11: rotate, then scrub). One grep, one pass, no pipe.
-if grep -qiE "^\+([^+]|\+[^+]|$).*($SECRETS)" <<<"$DIFF"; then
-  echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2
-fi
+# Only ADDED lines count (`+` but not the `+++ b/file` header): removing a leaked secret from a
+# file must stay committable (§11: rotate, then scrub). No `-q` anywhere: every stage reads all of
+# its input, so an early exit can never SIGPIPE a writer into "no match". grep 1 = clean.
+grep -E '^\+' <<<"$DIFF" | grep -vE '^\+\+\+ (b/|/dev/null)' | grep -iE "$SECRETS" >/dev/null
+case $? in
+  0) echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2 ;;
+  1) ;;
+  *) echo "Blocked: guard-commit.sh could not scan the staged diff for secrets (grep failed). Failing closed." >&2; exit 2 ;;
+esac
 exit 0
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 1a90187..1140e30 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -312,6 +312,14 @@ git push -f origin main'
 run "unbalanced quote inside \${ }"          2 'echo ${x//"/} ; git push --force origin main'
 run "unclosed \$( at end of input"           2 'x=$(echo hi
 git push -f origin main'
+run "; inside \${ } does not split a push"   2 'git push ${x:-;} --force origin main'
+run "| inside \${ } does not split a commit" 2 'git commit ${x:-a|} --no-verify -m x'
+run "; inside \${ } in a -c value"           2 'git -c ${x:-x.y=z;} push --force origin main'
+run "; inside a real \$( ) still splits"     2 'x=$(echo hi; git push -f origin main)'
+run "# after (( )) is a comment"             2 '((1))#c <<EOF
+git push --force origin main'
+run "# after \$(( )) is part of the word"    0 'echo $((1))#c <<EOF
+git push --force origin main is body here'
 run "unbalanced [ then a benign heredoc"     0 'echo [
 cat > n.md <<EOF
 never git push -f
@@ -407,6 +415,11 @@ git add big.txt
 run "secret at the top of a 200 KB staged diff" 2 'git commit -m "x"'
 git rm -q --cached big.txt && rm big.txt
 
+printf '++aws_key=%s\n' "$AWS_KEY" >plus.txt
+git add plus.txt
+run "secret on an added line starting with ++" 2 'git commit -m "x"'
+git rm -q --cached plus.txt && rm plus.txt
+
 # Scrubbing a leaked secret (a removed line) must stay committable; git is called directly here,
 # the hook is not involved in seeding the leak.
 printf 'aws_key=%s\n' "$AWS_KEY" >leaked.txt

From 1c26efbce90f217e04b20d0c139f3dfe27c26b50 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 05:31:43 +0100
Subject: [PATCH 09/39] fix(hooks): glue short quoted fragments back into their
 word; fast path retries dequoted; every tool status-checked; heredoc queue
 capped; function definitions and coproc set command position

Final security audit: the fast path could be dodged by splitting the subcommand word itself (git pu"sh", git pus\h, git $'push'), which made every later check moot; a missing tr failed open; a pending-heredoc queue with thousands of terminators was quadratic and could outlast the hook timeout; and case after a function definition or coproc was not in command position, which on bash 4+ let a pattern's ) close the enclosing substitution. A quoted span with no whitespace inside is now glued back into its word as bash does, which also closes the old --no-veri"fy", $'--no-verify', and push "-f" limits; the fast path retries with quotes, backslashes, $ and continuations removed when the plain grep finds nothing, refusing payloads over 512 KB; tr and wc are status-checked and the secrets pipeline inspects every stage's status; more than sixteen pending heredocs fails closed. Eighteen cases added (179 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 89 +++++++++++++++++++++-----------
 tests/hooks/test-guard-commit.sh | 37 ++++++++++++-
 2 files changed, 95 insertions(+), 31 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 07e2cbd..997574d 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -5,7 +5,8 @@
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
-# and flags spelled with quoting tricks (`--no-veri"fy"`, `$'--no-verify'`, unique-prefix `--no-veri`).
+# unique-prefix long options (`--no-veri`), and the committer check reading the current
+# directory's git config (`git -C elsewhere commit`).
 #
 # Every check reads its whole input through a here-string, never a pipe: `grep -q` exits on the
 # first match, and under pipefail the upstream writer's SIGPIPE would read as "no match".
@@ -16,11 +17,22 @@ INPUT=$(cat)
 # Fast path: this guard only concerns `git commit` / `git push`. If the payload mentions
 # neither, allow immediately — so a missing jq (below) never blocks unrelated Bash (ls/cat/grep).
 # Match loosely (no quote-class): a quoted arg before the subcommand (`git -C "x" commit`)
-# must NOT slip past into a silent allow. JSON-escaped backslash-newlines (`git pu\` + `sh`) are
-# joined first so a split word cannot dodge the match. grep exit 1 = no match; anything else = error.
-JOINED=${INPUT//\\\\\\n/}
-grep -qiE 'git.*(commit|push)' <<<"$JOINED"
-case $? in
+# must NOT slip past into a silent allow. grep exit 1 = no match; anything else = error.
+grep -qiE 'git.*(commit|push)' <<<"$INPUT"
+RC=$?
+if [ "$RC" -eq 1 ]; then
+  # No plain mention. A split word (`git pu"sh"`, `git pus\h`, `git $'push'`, `git pu\` + `sh`)
+  # could still be one: retry with quotes, backslashes, `$`, and JSON-escaped continuations removed.
+  # That only joins text, it can never destroy a real mention. Past 512 KB the substitutions get
+  # slow, and nothing legitimate is that big, so refuse instead.
+  if [ ${#INPUT} -gt 524288 ]; then
+    echo "Blocked: guard-commit.sh will not inspect a Bash payload over 512 KB. Split it up." >&2; exit 2
+  fi
+  J=${INPUT//\\\\\\n/}; J=${J//\\\"/}; J=${J//\'/}; J=${J//\\\\/}; J=${J//\$/}
+  grep -qiE 'git.*(commit|push)' <<<"$J"
+  RC=$?
+fi
+case $RC in
   0) ;;
   1) exit 0 ;;
   *) echo "Blocked: guard-commit.sh could not run its fast-path check (grep failed). Failing closed." >&2; exit 2 ;;
@@ -52,9 +64,10 @@ fi
 # MESSAGE or a file body that merely mentions `push --force` or `--no-verify` (or contains `;`)
 # can't trip a flag check or split a segment. One quote model does all of it, a character walk
 # that keeps its state across lines:
-#  - single-, double-, and ANSI-C ($'...') quoted spans, with \ escapes; a backslash-newline in
-#    code joins the next line with nothing in between, as bash does, so a flag on its own line
-#    (or a word split across lines) stays with its subcommand;
+#  - single-, double-, and ANSI-C ($'...') quoted spans, with \ escapes. A quoted span with no
+#    whitespace inside is glued back into its word, as bash does (`pu"sh"` is `push`, `"-f"` is
+#    `-f`, `--no-veri"fy"` is `--no-verify`); anything longer is data. A backslash-newline in code
+#    joins the next line with nothing in between, so a word or flag split across lines stays whole;
 #  - `$(...)` and backticks reopen code inside double quotes and inside unquoted heredoc bodies
 #    (bash expands them there: `cat <<EOF` + `$(git push -f)` runs the push);
 #  - `$((...))`, `((...))`, `$[...]`, `${...}`, and `[...]` frames, where `<<` is a shift or
@@ -78,11 +91,14 @@ strip_data() {
   # q: 0 code, 1 single quotes, 2 double quotes, 3 $'"'"'...'"'"', 4 unquoted heredoc body, 5 quoted heredoc body
   # kind[]: "(" subshell, "$(" substitution, "`", "((" arithmetic command, "$((" arithmetic expansion,
   #         "(a" paren inside arithmetic, "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
-  function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend; cmdpos = 1 }
+  function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend; pushnr[depth] = NR; pushpos[depth] = i; cmdpos = 1 }
   function pop() {
     if (npend > pendat[depth]) exit 3            # a marker inside a substitution closed on its own line: refuse to guess
-    q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i; cmdpos = 0
+    # `name()` is a function definition: what follows is a command (`f() case ...`)
+    cmdpos = (kind[depth] == "(" && pushnr[depth] == NR && substr(line, pushpos[depth], i - pushpos[depth] + 1) ~ /^\([ \t]*\)$/)
+    q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i
   }
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t]/) o = o qb }   # a short quoted fragment is part of its word
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1 }
   {
@@ -108,23 +124,28 @@ strip_data() {
     if (q == 0 && !cont) cmdpos = 1
     while (i <= n) {
       ch = c[i]
-      if (q == 1) { if (ch == "\047") q = 0; i++; continue }
-      if (q == 3) { if (ch == "\\") { i += 2; continue } if (ch == "\047") q = 0; i++; continue }
+      if (q == 1) { if (ch == "\047") { q = 0; closeq() } else qb = qb ch; i++; continue }
+      if (q == 3) {
+        if (ch == "\\") { qb = qb c[i + 1]; i += 2; continue }
+        if (ch == "\047") { q = 0; closeq() } else qb = qb ch
+        i++; continue
+      }
       if (q == 2 || q == 4) {                    # data that still expands substitutions
-        if (ch == "\\") { i += 2; continue }
-        if (q == 2 && ch == "\"") { q = 0; i++; continue }
-        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("$((", q); q = 0; o = o " "; i += 3; continue }
-        if (ch == "$" && c[i + 1] == "(") { push("$(", q); q = 0; o = o "$("; i += 2; continue }
-        if (ch == "$" && c[i + 1] == "{") { push("${", q); q = 0; o = o " "; i += 2; continue }
-        if (ch == "`") { push("`", q); q = 0; o = o " "; i++; continue }
+        if (ch == "\\") { if (q == 2) qb = qb c[i + 1]; i += 2; continue }
+        if (q == 2 && ch == "\"") { q = 0; closeq(); i++; continue }
+        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { qbad = 1; push("$((", q); q = 0; o = o " "; i += 3; continue }
+        if (ch == "$" && c[i + 1] == "(") { qbad = 1; push("$(", q); q = 0; o = o "$("; i += 2; continue }
+        if (ch == "$" && c[i + 1] == "{") { qbad = 1; push("${", q); q = 0; o = o " "; i += 2; continue }
+        if (ch == "`") { qbad = 1; push("`", q); q = 0; o = o " "; i++; continue }
+        if (q == 2) qb = qb ch
         i++; continue
       }
       top = (depth > 0) ? kind[depth] : ""
       noheredoc = (top == "((" || top == "$((" || top == "[" || top == "(a" || top == "${")
       if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o c[i + 1]; i += 2; continue }   # `\-f` is `-f`
-      if (ch == "$" && c[i + 1] == "\047") { q = 3; i += 2; continue }
-      if (ch == "\047") { q = 1; i++; continue }
-      if (ch == "\"") { q = 2; i++; continue }
+      if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; i += 2; continue }
+      if (ch == "\047") { q = 1; qb = ""; qbad = 0; i++; continue }
+      if (ch == "\"") { q = 2; qb = ""; qbad = 0; i++; continue }
       # a comment starts only where a word starts: after whitespace, a control operator, or the `)`
       # that ends a subshell or an `((...))` command. The `)` of `$(...)` / `$((...))` or a closing
       # backtick ends a word, and `#` after it is part of that word.
@@ -179,6 +200,7 @@ strip_data() {
         }
         if (w != "") {
           if (body) exit 3                       # a heredoc nested inside another body: refuse to guess
+          if (npend >= 16) exit 3                # no real command opens this many heredocs at once
           pword[++npend] = w; pdash[npend] = dash; pq[npend] = quoted
         }
         o = o "<<"; i = j; cmdpos = 0; continue
@@ -188,7 +210,7 @@ strip_data() {
         while (j <= n && c[j] ~ /[A-Za-z0-9_]/) { w = w c[j]; j++ }
         if (cmdpos && w == "case") casec[depth]++
         else if (cmdpos && w == "esac" && casec[depth] > 0) casec[depth]--
-        cmdpos = (w == "if" || w == "then" || w == "else" || w == "elif" || w == "while" || w == "until" || w == "do" || w == "time")
+        cmdpos = (w == "if" || w == "then" || w == "else" || w == "elif" || w == "while" || w == "until" || w == "do" || w == "time" || w == "coproc")
         o = o w; i = j; continue
       }
       if (ch != " " && ch != "\t") cmdpos = 0
@@ -217,8 +239,11 @@ fi
 
 # Each segment costs a few greps; thousands of `;`-separated segments could outlast the hook
 # timeout, and a timed-out PreToolUse hook does not block. No real command has hundreds.
-SEGMENTS=$(tr ';&|' '\n' <<<"$STRIPPED")
-if [ "$(tr -cd ';&|\n' <<<"$STRIPPED" | wc -c)" -gt 500 ]; then
+if ! SEGMENTS=$(tr ';&|' '\n' <<<"$STRIPPED") || ! NSEP=$(tr -cd ';&|\n' <<<"$STRIPPED" | wc -c) || ! [ "$NSEP" -eq "$NSEP" ] 2>/dev/null; then
+  echo "Blocked: guard-commit.sh could not split the command into segments (tr/wc failed). Failing closed." >&2
+  exit 2
+fi
+if [ "$NSEP" -gt 500 ]; then
   echo "Blocked: guard-commit.sh will not inspect a git commit/push command with over 500 segments. Split it up." >&2
   exit 2
 fi
@@ -302,9 +327,13 @@ fi
 # file must stay committable (§11: rotate, then scrub). No `-q` anywhere: every stage reads all of
 # its input, so an early exit can never SIGPIPE a writer into "no match". grep 1 = clean.
 grep -E '^\+' <<<"$DIFF" | grep -vE '^\+\+\+ (b/|/dev/null)' | grep -iE "$SECRETS" >/dev/null
-case $? in
-  0) echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2 ;;
-  1) ;;
-  *) echo "Blocked: guard-commit.sh could not scan the staged diff for secrets (grep failed). Failing closed." >&2; exit 2 ;;
-esac
+STAGES=("${PIPESTATUS[@]}")
+if [ "${STAGES[2]}" -eq 0 ]; then
+  echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2
+fi
+for ST in "${STAGES[@]}"; do   # 0 or 1 is an answer from every stage; anything else is a tool failure
+  if [ "$ST" -gt 1 ]; then
+    echo "Blocked: guard-commit.sh could not scan the staged diff for secrets (grep failed). Failing closed." >&2; exit 2
+  fi
+done
 exit 0
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 1140e30..1cee8be 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -320,6 +320,25 @@ run "# after (( )) is a comment"             2 '((1))#c <<EOF
 git push --force origin main'
 run "# after \$(( )) is part of the word"    0 'echo $((1))#c <<EOF
 git push --force origin main is body here'
+run "function definition then case"          2 'x="$(f() case a in a) git push --force origin main;; esac
+f)"'
+run "function def then case, --no-verify"    2 'git commit -m "$(f() case a in a) git commit --no-verify -m x;; esac
+f)"'
+run "coproc then case"                       2 'x="$(coproc case a in a) git push --force origin main;; esac)"'
+run "subcommand split by quotes"             2 'git pu"sh" --force origin main'
+run "subcommand split by quotes, other cut"  2 'git p"ush" --force origin main'
+run "subcommand as an ANSI-C string"         2 'git $'"'"'push'"'"' --force origin main'
+run "subcommand split by a backslash"        2 'git pus\h --force origin main'
+run "commit split by empty quotes"           2 'git commi""t --no-verify -m x'
+run "commit split by a backslash"            2 'git com\mit --no-verify -m x'
+run "flag in quotes"                         2 'git push "-f" origin main'
+run "flag split by quotes"                   2 'git commit --no-veri"fy" -m x'
+run "flag as an ANSI-C string"               2 'git commit $'"'"'--no-verify'"'"' -m x'
+run "one-word quoted message is harmless"    0 'git commit -m "tidy"'
+run "quoted message with spaces stays data"  0 'git commit -m "never git push -f"'
+MANY=$(for _ in $(seq 1 20); do printf ' <<A'; done)
+run "twenty heredocs on one line fail closed" 2 ": $MANY
+git push -f origin main"
 run "unbalanced [ then a benign heredoc"     0 'echo [
 cat > n.md <<EOF
 never git push -f
@@ -458,8 +477,24 @@ run_noawk() {
 run_noawk "no awk: commit fails closed"      2 'git commit -m "x"'
 run_noawk "no awk: unrelated command allowed" 0 'ls'
 
+# --- missing tr or wc: the segment split cannot run, so a git commit/push fails closed ----------
+mktoolbox() { # mktoolbox <dir> <tools...>
+  mkdir -p "$1"; d=$1; shift
+  for t in "$@"; do p=$(command -v "$t") && ln -s "$p" "$d/$t"; done
+}
+mktoolbox "$TMP/notr" bash sh grep git sed awk printf cat jq wc
+mktoolbox "$TMP/nowc" bash sh grep git sed awk printf cat jq tr
+run_without() { # run_without <toolbox> <name> <expected-exit> <command>
+  printf '%s' "$4" | jq -Rs '{tool_input:{command:.}}' >"$TMP/payload"
+  PATH="$1" bash "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
+  record "$2" "$3" $? "$4"
+}
+run_without "$TMP/notr" "no tr: push fails closed"      2 'git push --force origin main'
+run_without "$TMP/nowc" "no wc: commit fails closed"    2 'git commit --no-verify -m x'
+run_without "$TMP/notr" "no tr: unrelated command allowed" 0 'ls'
+
 # Every case in this file must have been counted: a case that ran in a subshell would be lost.
-EXPECTED=$(grep -cE '^(run|run_raw|run_nojq|run_noawk) ' "$SELF")
+EXPECTED=$(grep -cE '^(run|run_raw|run_nojq|run_noawk|run_without) ' "$SELF")
 if [ "$((PASS + FAIL))" -ne "$EXPECTED" ]; then
   echo "FAIL: $EXPECTED cases defined, $((PASS + FAIL)) counted"
   FAIL=$((FAIL + 1))

From 02845b7decd1fc8fc9f6630ae493ff312d27fac2 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 05:58:35 +0100
Subject: [PATCH 10/39] fix(hooks): quoted separators are data; ANSI-C numeric
 escapes fail closed; linear fast-path retry; -F is not a force flag

Sixth code review: a one-word quoted message ending in ; was glued into its word and then split by the segment loop, moving --no-verify or --force into a git-less segment; $'\x70ush' was glued verbatim where bash decodes it; and the fast-path retry used bash substitutions that are quadratic on bash 3.2, stalling unrelated quote-dense commands. The glue rule now treats separators, newlines, and any substitution inside the span as data, a numeric escape inside $'...' fails closed in the walker and routes to it from the fast path, the retry runs sed once and only when the payload contains the word git, and the short force flag is matched case-sensitively so git commit -F is not a force-push. Eleven cases added (190 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 37 +++++++++++++++++++-------------
 tests/hooks/test-guard-commit.sh | 16 ++++++++++++++
 2 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 997574d..6dcb794 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -5,8 +5,9 @@
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
-# unique-prefix long options (`--no-veri`), and the committer check reading the current
-# directory's git config (`git -C elsewhere commit`).
+# unique-prefix long options (`--no-veri`), a word spliced by an empty expansion
+# (`git pu${x}sh`, `git pu$(:)sh`), and the committer check reading the current directory's
+# git config (`git -C elsewhere commit`).
 #
 # Every check reads its whole input through a here-string, never a pipe: `grep -q` exits on the
 # first match, and under pipefail the upstream writer's SIGPIPE would read as "no match".
@@ -20,17 +21,18 @@ INPUT=$(cat)
 # must NOT slip past into a silent allow. grep exit 1 = no match; anything else = error.
 grep -qiE 'git.*(commit|push)' <<<"$INPUT"
 RC=$?
-if [ "$RC" -eq 1 ]; then
-  # No plain mention. A split word (`git pu"sh"`, `git pus\h`, `git $'push'`, `git pu\` + `sh`)
-  # could still be one: retry with quotes, backslashes, `$`, and JSON-escaped continuations removed.
-  # That only joins text, it can never destroy a real mention. Past 512 KB the substitutions get
-  # slow, and nothing legitimate is that big, so refuse instead.
-  if [ ${#INPUT} -gt 524288 ]; then
-    echo "Blocked: guard-commit.sh will not inspect a Bash payload over 512 KB. Split it up." >&2; exit 2
+if [ "$RC" -eq 1 ] && grep -qi git <<<"$INPUT"; then
+  # No plain mention, but the word `git` is there. A split subcommand (`git pu"sh"`, `git pus\h`,
+  # `git $'push'`, `git pu\` + `sh`) could still be one: retry with quotes, backslashes, `$`, and
+  # JSON-escaped continuations removed (sed: linear; a bash substitution is quadratic on 3.2).
+  # That only joins text, it can never destroy a real mention. An ANSI-C numeric escape
+  # (`$'\x70ush'`) decodes to text no dequoting can reveal, so it goes to the walker, which refuses it.
+  if ! J=$(sed -e 's/\\\\\\n//g' -e 's/\\"//g' -e "s/['\$\\\\]//g" <<<"$INPUT"); then
+    echo "Blocked: guard-commit.sh could not run its fast-path check (sed failed). Failing closed." >&2; exit 2
   fi
-  J=${INPUT//\\\\\\n/}; J=${J//\\\"/}; J=${J//\'/}; J=${J//\\\\/}; J=${J//\$/}
   grep -qiE 'git.*(commit|push)' <<<"$J"
   RC=$?
+  if [ "$RC" -eq 1 ] && grep -qE "\\\$'[^']*\\\\\\\\[xuU0-7]" <<<"$INPUT"; then RC=0; fi
 fi
 case $RC in
   0) ;;
@@ -65,9 +67,11 @@ fi
 # can't trip a flag check or split a segment. One quote model does all of it, a character walk
 # that keeps its state across lines:
 #  - single-, double-, and ANSI-C ($'...') quoted spans, with \ escapes. A quoted span with no
-#    whitespace inside is glued back into its word, as bash does (`pu"sh"` is `push`, `"-f"` is
-#    `-f`, `--no-veri"fy"` is `--no-verify`); anything longer is data. A backslash-newline in code
-#    joins the next line with nothing in between, so a word or flag split across lines stays whole;
+#    whitespace, separator, newline, or substitution inside is glued back into its word, as bash
+#    does (`pu"sh"` is `push`, `"-f"` is `-f`, `--no-veri"fy"` is `--no-verify`); anything else is
+#    data. A numeric escape in $'...' decodes to text the walk cannot see, so it fails closed. A
+#    backslash-newline in code joins the next line with nothing in between, so a word or flag
+#    split across lines stays whole;
 #  - `$(...)` and backticks reopen code inside double quotes and inside unquoted heredoc bodies
 #    (bash expands them there: `cat <<EOF` + `$(git push -f)` runs the push);
 #  - `$((...))`, `((...))`, `$[...]`, `${...}`, and `[...]` frames, where `<<` is a shift or
@@ -97,8 +101,9 @@ strip_data() {
     # `name()` is a function definition: what follows is a command (`f() case ...`)
     cmdpos = (kind[depth] == "(" && pushnr[depth] == NR && substr(line, pushpos[depth], i - pushpos[depth] + 1) ~ /^\([ \t]*\)$/)
     q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i
+    if (q == 2) qbad = 1                         # the enclosing string held a substitution: never glue it
   }
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t]/) o = o qb }   # a short quoted fragment is part of its word
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb }   # a short quoted fragment is part of its word
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1 }
   {
@@ -126,6 +131,7 @@ strip_data() {
       ch = c[i]
       if (q == 1) { if (ch == "\047") { q = 0; closeq() } else qb = qb ch; i++; continue }
       if (q == 3) {
+        if (ch == "\\" && c[i + 1] ~ /[xuU0-7]/) exit 3   # \x70 / \160 / \u0070: decodes to text we cannot see
         if (ch == "\\") { qb = qb c[i + 1]; i += 2; continue }
         if (ch == "\047") { q = 0; closeq() } else qb = qb ch
         i++; continue
@@ -216,6 +222,7 @@ strip_data() {
       if (ch != " " && ch != "\t") cmdpos = 0
       o = o ch; i++
     }
+    if (q == 1 || q == 2 || q == 3) qbad = 1    # a quoted span crossing a line is never glued
     if (q == 0 && !cont) droptests()
     # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash
     enter = (!body && npend > 0 && q == 0 && !cont)
@@ -262,7 +269,7 @@ while IFS= read -r SEG; do
   # force-push: --force / --force-with-lease / --mirror, -f alone or inside a flag cluster (-uf),
   # or a `+refspec` (the refspec form of --force). `--force-if-includes` alone is also caught;
   # it is a no-op without --force-with-lease, so nothing legitimate is lost.
-  if [ -n "$SEG_PUSH" ] && grep -qiE '[[:space:]]push.*[[:space:]](--force-with-lease|--force|--mirror)([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]-[A-Za-z]*f[A-Za-z]*([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]\+[^[:space:]]' <<<"$SEG"; then
+  if [ -n "$SEG_PUSH" ] && { grep -qiE '[[:space:]]push.*[[:space:]](--force-with-lease|--force|--mirror)([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]\+[^[:space:]]' <<<"$SEG" || grep -qE '[[:space:]]push.*[[:space:]]-[A-Za-z]*f[A-Za-z]*([^[:alnum:]]|$)' <<<"$SEG"; }; then
     echo "Blocked: force-push. Protected-branch discipline (CLAUDE.md §9)." >&2; exit 2
   fi
 
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 1cee8be..a6b967b 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -335,6 +335,22 @@ run "flag in quotes"                         2 'git push "-f" origin main'
 run "flag split by quotes"                   2 'git commit --no-veri"fy" -m x'
 run "flag as an ANSI-C string"               2 'git commit $'"'"'--no-verify'"'"' -m x'
 run "one-word quoted message is harmless"    0 'git commit -m "tidy"'
+run "quoted ; is data, flag stays with git"  2 'git commit -m "x;" --no-verify'
+run "quoted ; in a -c value"                 2 'git -c "a.b=y;" push --force origin main'
+run "quoted | in a -c value"                 2 'git -c '"'"'a.b=y|'"'"' push -f origin main'
+run "ANSI-C & in a -c value"                 2 'git -c $'"'"'a.b=y&'"'"' push -f origin main'
+run "message with ; then a plain push"       0 'git commit -m "a;b" && git push origin feat/x'
+run "ANSI-C hex escape in the subcommand"    2 'git $'"'"'\x70ush'"'"' --force origin main'
+run "ANSI-C octal escape in the subcommand"  2 'git $'"'"'\160ush'"'"' --force origin main'
+run "ANSI-C hex escape in the flag"          2 'git push $'"'"'\x2d\x66'"'"' origin main'
+run "ANSI-C unicode escape"                  2 'git $'"'"'push'"'"' --force origin main'
+run "commit -F is not a force flag"          0 'git commit -m "push" -F /dev/null'
+DENSE=$(for _ in $(seq 1 600); do printf '  "key": "value",\n'; done)
+run "quote-dense non-git heredoc is fast"    0 "cat > package.json <<'EOF'
+{
+$DENSE
+}
+EOF"
 run "quoted message with spaces stays data"  0 'git commit -m "never git push -f"'
 MANY=$(for _ in $(seq 1 20); do printf ' <<A'; done)
 run "twenty heredocs on one line fail closed" 2 ": $MANY

From fb4540a1ad093cbb50e254c5f53b4d206614b45f Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 05:59:14 +0100
Subject: [PATCH 11/39] test(hooks): the unicode-escape case actually uses a
 unicode escape

---
 tests/hooks/test-guard-commit.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index a6b967b..7d1eb18 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -343,7 +343,7 @@ run "message with ; then a plain push"       0 'git commit -m "a;b" && git push
 run "ANSI-C hex escape in the subcommand"    2 'git $'"'"'\x70ush'"'"' --force origin main'
 run "ANSI-C octal escape in the subcommand"  2 'git $'"'"'\160ush'"'"' --force origin main'
 run "ANSI-C hex escape in the flag"          2 'git push $'"'"'\x2d\x66'"'"' origin main'
-run "ANSI-C unicode escape"                  2 'git $'"'"'push'"'"' --force origin main'
+run "ANSI-C unicode escape"                  2 'git $'"'"'\u0070ush'"'"' --force origin main'
 run "commit -F is not a force flag"          0 'git commit -m "push" -F /dev/null'
 DENSE=$(for _ in $(seq 1 600); do printf '  "key": "value",\n'; done)
 run "quote-dense non-git heredoc is fast"    0 "cat > package.json <<'EOF'

From b36ad836e4f17537730cfd667a030fae0952cab1 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 06:22:32 +0100
Subject: [PATCH 12/39] fix(hooks): the fast-path retry runs for any unmatched
 payload; every walker refusal names its construct

Seventh code review: gating the retry on the substring git meant that splitting the word git itself (g"it" push --force) skipped every later check, a regression from the previous commit. The retry now runs whenever the plain grep finds nothing; sed is linear so the gate bought nothing. Each fail-closed exit in the walker prints which construct it refused, so an agent that hits one (a numeric escape in $'...', a nested heredoc, an open quote) knows what to rewrite. Seven cases added (197 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 26 +++++++++++++++-----------
 tests/hooks/test-guard-commit.sh |  7 +++++++
 2 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 6dcb794..6e76df5 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -7,7 +7,10 @@
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
 # unique-prefix long options (`--no-veri`), a word spliced by an empty expansion
 # (`git pu${x}sh`, `git pu$(:)sh`), and the committer check reading the current directory's
-# git config (`git -C elsewhere commit`).
+# git config (`git -C elsewhere commit`). Known false blocks (safe direction): a one-word quoted
+# argument that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`),
+# `--force-if-includes` on its own, and an ANSI-C numeric escape (`$'\033[0m'`) anywhere in a
+# call that also commits or pushes.
 #
 # Every check reads its whole input through a here-string, never a pipe: `grep -q` exits on the
 # first match, and under pipefail the upstream writer's SIGPIPE would read as "no match".
@@ -21,10 +24,10 @@ INPUT=$(cat)
 # must NOT slip past into a silent allow. grep exit 1 = no match; anything else = error.
 grep -qiE 'git.*(commit|push)' <<<"$INPUT"
 RC=$?
-if [ "$RC" -eq 1 ] && grep -qi git <<<"$INPUT"; then
-  # No plain mention, but the word `git` is there. A split subcommand (`git pu"sh"`, `git pus\h`,
-  # `git $'push'`, `git pu\` + `sh`) could still be one: retry with quotes, backslashes, `$`, and
-  # JSON-escaped continuations removed (sed: linear; a bash substitution is quadratic on 3.2).
+if [ "$RC" -eq 1 ]; then
+  # No plain mention. A split word (`g"it" push`, `git pu"sh"`, `git pus\h`, `git $'push'`,
+  # `git pu\` + `sh`) could still be one: retry with quotes, backslashes, `$`, and JSON-escaped
+  # continuations removed (sed: linear, ~25 ms on 400 KB; a bash substitution is quadratic on 3.2).
   # That only joins text, it can never destroy a real mention. An ANSI-C numeric escape
   # (`$'\x70ush'`) decodes to text no dequoting can reveal, so it goes to the walker, which refuses it.
   if ! J=$(sed -e 's/\\\\\\n//g' -e 's/\\"//g' -e "s/['\$\\\\]//g" <<<"$INPUT"); then
@@ -97,12 +100,13 @@ strip_data() {
   #         "(a" paren inside arithmetic, "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
   function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend; pushnr[depth] = NR; pushpos[depth] = i; cmdpos = 1 }
   function pop() {
-    if (npend > pendat[depth]) exit 3            # a marker inside a substitution closed on its own line: refuse to guess
+    if (npend > pendat[depth]) refuse("a heredoc marker inside a substitution that closes on the same line")
     # `name()` is a function definition: what follows is a command (`f() case ...`)
     cmdpos = (kind[depth] == "(" && pushnr[depth] == NR && substr(line, pushpos[depth], i - pushpos[depth] + 1) ~ /^\([ \t]*\)$/)
     q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i
     if (q == 2) qbad = 1                         # the enclosing string held a substitution: never glue it
   }
+  function refuse(why) { refused = 1; print "guard-commit.sh cannot classify this command: " why ". Rewrite it without that construct." > "/dev/stderr"; exit 3 }
   function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb }   # a short quoted fragment is part of its word
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1 }
@@ -131,7 +135,7 @@ strip_data() {
       ch = c[i]
       if (q == 1) { if (ch == "\047") { q = 0; closeq() } else qb = qb ch; i++; continue }
       if (q == 3) {
-        if (ch == "\\" && c[i + 1] ~ /[xuU0-7]/) exit 3   # \x70 / \160 / \u0070: decodes to text we cannot see
+        if (ch == "\\" && c[i + 1] ~ /[xuU0-7]/) refuse("a numeric escape (\\x, \\u, octal) inside $'"'"'...'"'"'")
         if (ch == "\\") { qb = qb c[i + 1]; i += 2; continue }
         if (ch == "\047") { q = 0; closeq() } else qb = qb ch
         i++; continue
@@ -199,14 +203,14 @@ strip_data() {
             j++; continue
           }
           if (c[j] == "\\") {
-            if (j == n) exit 3                   # a delimiter continued on the next line: refuse to guess
+            if (j == n) refuse("a heredoc delimiter continued on the next line")
             quoted = 1; j++; w = w c[j]; j++; continue
           }
           w = w c[j]; j++
         }
         if (w != "") {
-          if (body) exit 3                       # a heredoc nested inside another body: refuse to guess
-          if (npend >= 16) exit 3                # no real command opens this many heredocs at once
+          if (body) refuse("a heredoc nested inside another heredoc body")
+          if (npend >= 16) refuse("more than 16 heredocs pending at once")
           pword[++npend] = w; pdash[npend] = dash; pq[npend] = quoted
         }
         o = o "<<"; i = j; cmdpos = 0; continue
@@ -231,7 +235,7 @@ strip_data() {
   }
   # A frame or quote still open at the end means bash would reject the whole input (or the walk
   # lost track of it, e.g. a `case` with no `esac`). Either way: refuse to guess.
-  END { if (depth > 0 || q == 1 || q == 2 || q == 3) exit 3 }'
+  END { if (refused) exit 3; if (depth > 0 || q == 1 || q == 2 || q == 3) refuse("a quote, $(...), ((...)), ${...} or [ left open at the end (or a case with no esac)") }'
 }
 if ! STRIPPED=$(strip_data <<<"$CMD"); then
   echo "Blocked: guard-commit.sh could not parse the command (awk failed). Failing closed." >&2
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 7d1eb18..31f9c18 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -345,6 +345,13 @@ run "ANSI-C octal escape in the subcommand"  2 'git $'"'"'\160ush'"'"' --force o
 run "ANSI-C hex escape in the flag"          2 'git push $'"'"'\x2d\x66'"'"' origin main'
 run "ANSI-C unicode escape"                  2 'git $'"'"'\u0070ush'"'"' --force origin main'
 run "commit -F is not a force flag"          0 'git commit -m "push" -F /dev/null'
+run "git split by quotes"                    2 'g"it" push --force origin main'
+run "git split by single quotes"             2 'gi'"'"'t'"'"' push -f origin main'
+run "git split by empty quotes"              2 'gi'"'"''"'"'t push -f origin main'
+run "git split by a backslash"               2 'gi\t push -f origin main'
+run "git split, --no-verify"                 2 'g"it" commit --no-verify -m x'
+run "git as an ANSI-C hex string"            2 '$'"'"'\x67it'"'"' push -f origin main'
+run "refusal names the construct"            2 'git commit -m x; echo $'"'"'\033[0m'"'"''
 DENSE=$(for _ in $(seq 1 600); do printf '  "key": "value",\n'; done)
 run "quote-dense non-git heredoc is fast"    0 "cat > package.json <<'EOF'
 {

From 3617ab9d233a65f1be7cfadac695266c03c71a8b Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 06:42:50 +0100
Subject: [PATCH 13/39] fix(hooks): a newline separates commands only at the
 top level; continuation state carries into the next line; command position
 after coproc and time; quoted hooksPath; every grep and git call
 status-checked

Closing security audit and eighth code review. The walker printed a newline at the end of every line, but inside $(...) that newline does not end the enclosing command, so the repo's own multi-line heredoc commit message followed by --no-verify split into separate segments and passed; and a continuation line starting with # was read as a comment. A newline is now a segment boundary only in code at depth zero, a space inside a substitution, and nothing inside a quoted span; continuation state persists into the next line. Also: coproc NAME and time -p keep the following word in command position; a quoted core.hooksPath value with a space is caught on the raw command; the fast path flattens pretty-printed payloads and routes JSON unicode escapes to the walker; the ANSI-C router no longer stops at an escaped quote; the committer name is sanitized before it reaches the model; every grep and git call treats a tool failure as a block; the untracked scan is case-insensitive, NUL-safe, and fails closed on an unreadable file; a commit with -i, -o, or a pathspec-looking token scans the working tree; the refusal test asserts the reason text. Twenty-one cases added (218 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 111 ++++++++++++++++++++-----------
 tests/hooks/test-guard-commit.sh |  67 ++++++++++++++++++-
 2 files changed, 137 insertions(+), 41 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 6e76df5..e455128 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -1,19 +1,23 @@
 #!/usr/bin/env bash
-# PreToolUse(Bash) — block AI attribution, secrets, force-push, and hook-skipping (--no-verify)
-# before they happen. Exit 2 + a stderr reason is the documented blocking contract; stdout is unused.
+# PreToolUse(Bash) — block force-push, hook-skipping (--no-verify, core.hooksPath), shell wrappers
+# around git, non-human committers, AI attribution, and staged secrets before they happen.
+# Exit 2 + a stderr reason is the documented blocking contract; stdout is unused.
 #
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
-# unique-prefix long options (`--no-veri`), a word spliced by an empty expansion
-# (`git pu${x}sh`, `git pu$(:)sh`), and the committer check reading the current directory's
-# git config (`git -C elsewhere commit`). Known false blocks (safe direction): a one-word quoted
-# argument that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`),
-# `--force-if-includes` on its own, and an ANSI-C numeric escape (`$'\033[0m'`) anywhere in a
-# call that also commits or pushes.
+# unique-prefix long options (`--no-veri`), a word spliced by any expansion or substitution
+# (`git pu${x}sh`, `git pu$(echo s)h`), a bare pathspec on `git commit` (only `-a`, `-i`, `-o`
+# and pathspec-looking tokens trigger the working-tree scan), and the committer and secrets
+# checks reading the current directory's repo (`git -C elsewhere commit`). Known false blocks
+# (safe direction): a one-word quoted argument that spells a flag or subcommand (`-m "--no-verify"`,
+# `-m "eval"`, `tag -m "push" -f`), `--force-if-includes` on its own, `-S<keyid>` with an `n` in
+# the key id, a commit message mentioning `-c core.hooksPath`, and an ANSI-C numeric escape
+# (`$'\033[0m'`) anywhere in a call that also commits or pushes.
 #
-# Every check reads its whole input through a here-string, never a pipe: `grep -q` exits on the
-# first match, and under pipefail the upstream writer's SIGPIPE would read as "no match".
+# No `grep -q` ever reads from a pipe: it exits on the first match, and under pipefail the
+# upstream writer's SIGPIPE would read as "no match". Checks read here-strings, and every grep
+# treats an exit status over 1 as a tool failure that blocks.
 export LC_ALL=C   # byte-oriented grep/awk/tr: an invalid UTF-8 byte must not make a tool drop the rest of the input
 set -o pipefail   # a failing tool anywhere in a pipeline must surface, never read as "no match"
 INPUT=$(cat)
@@ -22,7 +26,8 @@ INPUT=$(cat)
 # neither, allow immediately — so a missing jq (below) never blocks unrelated Bash (ls/cat/grep).
 # Match loosely (no quote-class): a quoted arg before the subcommand (`git -C "x" commit`)
 # must NOT slip past into a silent allow. grep exit 1 = no match; anything else = error.
-grep -qiE 'git.*(commit|push)' <<<"$INPUT"
+FLAT=${INPUT//$'\n'/ }   # a pretty-printed payload must not split the match across lines (no tool needed: raw newlines are rare in JSON)
+grep -qiE 'git.*(commit|push)' <<<"$FLAT"
 RC=$?
 if [ "$RC" -eq 1 ]; then
   # No plain mention. A split word (`g"it" push`, `git pu"sh"`, `git pus\h`, `git $'push'`,
@@ -30,12 +35,14 @@ if [ "$RC" -eq 1 ]; then
   # continuations removed (sed: linear, ~25 ms on 400 KB; a bash substitution is quadratic on 3.2).
   # That only joins text, it can never destroy a real mention. An ANSI-C numeric escape
   # (`$'\x70ush'`) decodes to text no dequoting can reveal, so it goes to the walker, which refuses it.
-  if ! J=$(sed -e 's/\\\\\\n//g' -e 's/\\"//g' -e "s/['\$\\\\]//g" <<<"$INPUT"); then
+  if ! J=$(sed -e 's/\\\\\\n//g' -e 's/\\"//g' -e "s/['\$\\\\]//g" <<<"$FLAT"); then
     echo "Blocked: guard-commit.sh could not run its fast-path check (sed failed). Failing closed." >&2; exit 2
   fi
   grep -qiE 'git.*(commit|push)' <<<"$J"
   RC=$?
-  if [ "$RC" -eq 1 ] && grep -qE "\\\$'[^']*\\\\\\\\[xuU0-7]" <<<"$INPUT"; then RC=0; fi
+  # Text no dequoting can reveal goes to the walker: an ANSI-C numeric escape (`$'\x70ush'`, the
+  # walker refuses it) or a JSON \u escape for an ASCII letter (jq decodes it; the walker sees it).
+  if [ "$RC" -eq 1 ] && { grep -qE "\\\$'" <<<"$FLAT" && grep -qE '\\\\[xuU0-7]' <<<"$FLAT" || grep -qE '\\u00[0-9a-fA-F]{2}' <<<"$FLAT"; }; then RC=0; fi
 fi
 case $RC in
   0) ;;
@@ -57,6 +64,11 @@ if [ -z "$CMD" ]; then
   exit 2
 fi
 
+# has <ERE> <text> (case-insensitive) / hasc (case-sensitive): grep that treats any status over 1
+# as a tool failure and fails closed, so a broken grep can never read as "no match".
+has()  { grep -qiE "$1" <<<"$2"; RC=$?; [ "$RC" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$RC"; }
+hasc() { grep -qE  "$1" <<<"$2"; RC=$?; [ "$RC" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$RC"; }
+
 # No agent-realistic command is this long; past this size the character walk below gets slow, so
 # stop here (the per-segment loop further down has its own cap for the same reason).
 if [ ${#CMD} -gt 262144 ]; then
@@ -109,7 +121,7 @@ strip_data() {
   function refuse(why) { refused = 1; print "guard-commit.sh cannot classify this command: " why ". Rewrite it without that construct." > "/dev/stderr"; exit 3 }
   function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb }   # a short quoted fragment is part of its word
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
-  BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1 }
+  BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1; kwlead = 0 }
   {
     line = $0
     if (body) {
@@ -130,7 +142,8 @@ strip_data() {
     o = ""
     i = 1
     poppos = -1
-    if (q == 0 && !cont) cmdpos = 1
+    joined = cont; cont = 0                    # this line continues the previous one: no word starts at column 1
+    if (q == 0 && !joined) cmdpos = 1
     while (i <= n) {
       ch = c[i]
       if (q == 1) { if (ch == "\047") { q = 0; closeq() } else qb = qb ch; i++; continue }
@@ -159,7 +172,7 @@ strip_data() {
       # a comment starts only where a word starts: after whitespace, a control operator, or the `)`
       # that ends a subshell or an `((...))` command. The `)` of `$(...)` / `$((...))` or a closing
       # backtick ends a word, and `#` after it is part of that word.
-      if (ch == "#" && !noheredoc && (i == 1 || c[i - 1] ~ /[ \t;&|(]/ || (c[i - 1] == ")" && poppos == i - 1 && (poppedkind == "(" || poppedkind == "((")))) break
+      if (ch == "#" && !noheredoc && ((i == 1 && !joined) || (i > 1 && c[i - 1] ~ /[ \t;&|(]/) || (c[i - 1] == ")" && poppos == i - 1 && (poppedkind == "(" || poppedkind == "((")))) break
       # `;` `&` `|` separate commands only in code; inside an expansion or arithmetic they are text
       if (ch == ";" || ch == "&" || ch == "|") {
         if (top == "${" || top == "((" || top == "$((" || top == "(a") { o = o " "; i++; continue }
@@ -215,22 +228,31 @@ strip_data() {
         }
         o = o "<<"; i = j; cmdpos = 0; continue
       }
-      if (ch ~ /[A-Za-z_]/ && (i == 1 || c[i - 1] !~ /[A-Za-z0-9_]/)) {   # a word: track case ... esac in command position
+      if (ch ~ /[A-Za-z_]/ && ((i == 1 && !joined) || (i > 1 && c[i - 1] !~ /[A-Za-z0-9_]/))) {   # a word: track case ... esac in command position
         j = i; w = ""
         while (j <= n && c[j] ~ /[A-Za-z0-9_]/) { w = w c[j]; j++ }
         if (cmdpos && w == "case") casec[depth]++
         else if (cmdpos && w == "esac" && casec[depth] > 0) casec[depth]--
-        cmdpos = (w == "if" || w == "then" || w == "else" || w == "elif" || w == "while" || w == "until" || w == "do" || w == "time" || w == "coproc")
+        if (w == "if" || w == "then" || w == "else" || w == "elif" || w == "while" || w == "until" || w == "do") { cmdpos = 1; kwlead = 0 }
+        else if (w == "time" || w == "coproc") { cmdpos = 1; kwlead = 2 }   # `time -p cmd`, `coproc NAME cmd`: the command may be two words on
+        else if (kwlead > 0) kwlead--
+        else cmdpos = 0
         o = o w; i = j; continue
       }
-      if (ch != " " && ch != "\t") cmdpos = 0
+      if (ch != " " && ch != "\t" && kwlead == 0) cmdpos = 0
       o = o ch; i++
     }
     if (q == 1 || q == 2 || q == 3) qbad = 1    # a quoted span crossing a line is never glued
     if (q == 0 && !cont) droptests()
     # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash
     enter = (!body && npend > 0 && q == 0 && !cont)
-    if (cont) { printf "%s", o; cont = 0 } else print o
+    # A newline separates commands only at the top level in code. Inside `$(...)` or a subshell it
+    # separates commands of the substitution but not the enclosing one (`-m "$(cat <<EOF ... )" --no-verify`
+    # is ONE command), so it becomes a space; inside a quoted span or a body line it is part of a word.
+    if (cont) printf "%s", o
+    else if (q == 0 && depth == 0) print o
+    else if (q == 0 || q == 4) printf "%s ", o
+    else printf "%s", o
     if (enter) { body = 1; bodyq = q; bodydepth = depth; q = (pq[1] ? 5 : 4) }
   }
   # A frame or quote still open at the end means bash would reject the whole input (or the walk
@@ -244,7 +266,7 @@ fi
 
 # A shell wrapper runs its quoted argument as a command, which the strip above just hid.
 # Refuse rather than guess: the unwrapped form is always available to the agent.
-if grep -qE '(^|[^[:alnum:]_./-])((ba|z|da)?sh[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' <<<"$STRIPPED"; then
+if hasc '(^|[^[:alnum:]_./-])((ba|z|da)?sh[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' "$STRIPPED"; then
   echo "Blocked: git commit/push inside a shell wrapper (sh -c / bash -c / eval) cannot be inspected. Run the git command directly." >&2; exit 2
 fi
 
@@ -259,13 +281,15 @@ if [ "$NSEP" -gt 500 ]; then
   exit 2
 fi
 
-IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""
+IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""; HAS_WORKTREE=""
 while IFS= read -r SEG; do
   [ -z "$SEG" ] && continue
   SEG_COMMIT=""; SEG_PUSH=""
-  grep -qiE 'git.*[[:space:]]commit([^[:alnum:]]|$)' <<<"$SEG" && SEG_COMMIT=1
-  grep -qiE 'git.*[[:space:]]push([^[:alnum:]]|$)' <<<"$SEG" && SEG_PUSH=1
-  grep -qiE 'git.*[[:space:]]add([^[:alnum:]]|$)' <<<"$SEG" && HAS_ADD=1
+  has 'git.*[[:space:]]commit([^[:alnum:]]|$)' "$SEG" && SEG_COMMIT=1
+  has 'git.*[[:space:]]push([^[:alnum:]]|$)' "$SEG" && SEG_PUSH=1
+  has 'git.*[[:space:]]add([^[:alnum:]]|$)' "$SEG" && HAS_ADD=1
+  # a commit with -a/-i/-o or a pathspec-looking token commits working-tree content, not just the index
+  if [ -n "$SEG_COMMIT" ] && has '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aio][A-Za-z]*|--all|--include|--only|[^-[:space:]][^[:space:]]*[./][^[:space:]]*)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
   [ -n "$SEG_COMMIT" ] && IS_COMMIT=1
   [ -n "$SEG_PUSH" ] && HAS_PUSH=1
   [ -z "$SEG_COMMIT$SEG_PUSH" ] && continue
@@ -273,16 +297,16 @@ while IFS= read -r SEG; do
   # force-push: --force / --force-with-lease / --mirror, -f alone or inside a flag cluster (-uf),
   # or a `+refspec` (the refspec form of --force). `--force-if-includes` alone is also caught;
   # it is a no-op without --force-with-lease, so nothing legitimate is lost.
-  if [ -n "$SEG_PUSH" ] && { grep -qiE '[[:space:]]push.*[[:space:]](--force-with-lease|--force|--mirror)([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]\+[^[:space:]]' <<<"$SEG" || grep -qE '[[:space:]]push.*[[:space:]]-[A-Za-z]*f[A-Za-z]*([^[:alnum:]]|$)' <<<"$SEG"; }; then
+  if [ -n "$SEG_PUSH" ] && { has '[[:space:]]push.*[[:space:]](--force-with-lease|--force|--mirror)([^[:alnum:]]|$)|[[:space:]]push.*[[:space:]]\+[^[:space:]]' "$SEG" || hasc '[[:space:]]push.*[[:space:]]-[A-Za-z]*f[A-Za-z]*([^[:alnum:]]|$)' "$SEG"; }; then
     echo "Blocked: force-push. Protected-branch discipline (CLAUDE.md §9)." >&2; exit 2
   fi
 
   # --no-verify skips the pre-commit / pre-push hooks the repo installed on purpose (CLAUDE.md §14),
   # as does `git commit -n` (the short form, alone or in a cluster like -anm). Fix the hook failure instead.
-  if grep -qiE '[[:space:]]--no-verify([^[:alnum:]-]|$)' <<<"$SEG"; then
+  if has '[[:space:]]--no-verify([^[:alnum:]-]|$)' "$SEG"; then
     echo "Blocked: --no-verify bypasses the repo's git hooks (CLAUDE.md §14). Fix the hook failure instead." >&2; exit 2
   fi
-  if [ -n "$SEG_COMMIT" ] && grep -qiE '[[:space:]]commit.*[[:space:]]-[A-Za-z]*n[A-Za-z]*([^[:alnum:]]|$)' <<<"$SEG"; then
+  if [ -n "$SEG_COMMIT" ] && has '[[:space:]]commit.*[[:space:]]-[A-Za-z]*n[A-Za-z]*([^[:alnum:]]|$)' "$SEG"; then
     echo "Blocked: git commit -n is --no-verify (CLAUDE.md §14). Fix the hook failure instead." >&2; exit 2
   fi
 done <<<"$SEGMENTS"
@@ -291,7 +315,8 @@ done <<<"$SEGMENTS"
 
 # Re-pointing core.hooksPath anywhere in the same call (`git -c core.hooksPath=x commit`,
 # `git config core.hooksPath x; git commit`, GIT_CONFIG_PARAMETERS=...) is the same bypass.
-if grep -qiE 'core\.hooksPath|GIT_CONFIG_(PARAMETERS|COUNT|KEY_)' <<<"$STRIPPED"; then
+# (checked on the raw command as well: a quoted value with a space in it is stripped as data)
+if has 'core\.hooksPath|GIT_CONFIG_(PARAMETERS|COUNT|KEY_)' "$STRIPPED" || has '(-c[[:space:]]*["'"'"']?core\.hooksPath|config[^;&|]*core\.hooksPath|GIT_CONFIG_PARAMETERS)' "$CMD"; then
   echo "Blocked: core.hooksPath override bypasses the repo's git hooks (CLAUDE.md §14)." >&2; exit 2
 fi
 
@@ -300,14 +325,15 @@ fi
 
 # committer must be a human — match whole tokens / known bot identities, not substrings
 NAME=$(git config user.name 2>/dev/null || echo "")
-if grep -qiE '(^|[^[:alnum:]])(claude|chatgpt|copilot|cursor|cursoragent|github-actions|assistant|bot|ai[-_ ]?(agent|assistant|bot))([^[:alnum:]]|$)' <<<"$NAME"; then
-  echo "Blocked: git user.name '$NAME' is not a human (CLAUDE.md §2)." >&2; exit 2
+if has '(^|[^[:alnum:]])(claude|chatgpt|copilot|cursor|cursoragent|github-actions|assistant|bot|ai[-_ ]?(agent|assistant|bot))([^[:alnum:]]|$)' "$NAME"; then
+  SAFE_NAME=$(tr -d '\n\r' <<<"$NAME" | cut -c1-40)   # repo-controlled text: one line, short, before it reaches the model
+  echo "Blocked: git user.name '$SAFE_NAME' is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
 
 # no AI attribution in the commit message — scan the command only, not the staged diff.
 # (This is a repo *about* Claude Code; legit messages will say "Claude Code". Only
 #  attribution-SHAPED phrases are blocked, not bare mentions of a tool.)
-if grep -qiE 'co-authored-by:.*(claude|gpt|copilot|cursor)|generated with (claude|chatgpt|copilot|ai)|🤖|AI[- ](assisted|generated)' <<<"$CMD"; then
+if has 'co-authored-by:.*(claude|gpt|copilot|cursor)|generated with (claude|chatgpt|copilot|ai)|🤖|AI[- ](assisted|generated)' "$CMD"; then
   echo "Blocked: AI attribution detected in commit message (CLAUDE.md §2). Remove it." >&2; exit 2
 fi
 
@@ -320,19 +346,26 @@ SECRETS='(api[_-]?key|secret[_-]?key|access[_-]?key|private[_-]?key|password|tok
 EXCL=(':(exclude)*.example' ':(exclude)*.sample' ':(exclude)*.dist' ':(exclude)*.tmpl')
 # `--no-ext-diff` and `core.fsmonitor=false` so a repo-local config cannot make the guard run a program.
 GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff)
-DIFF=$("${GIT_DIFF[@]}" --cached 2>/dev/null -- "${EXCL[@]}")
-if [ -n "$HAS_ADD" ] || grep -qiE '[[:space:]](--all|-[A-Za-z]*a[A-Za-z]*)([[:space:]]|$)' <<<"$STRIPPED"; then
-  DIFF="$DIFF"$'\n'"$("${GIT_DIFF[@]}" 2>/dev/null -- "${EXCL[@]}")"
+gitfail() { echo "Blocked: guard-commit.sh could not read the diff ($1 failed). Failing closed." >&2; exit 2; }
+DIFF=$("${GIT_DIFF[@]}" --cached 2>/dev/null -- "${EXCL[@]}") || gitfail "git diff --cached"
+if [ -n "$HAS_ADD$HAS_WORKTREE" ]; then
+  WT=$("${GIT_DIFF[@]}" 2>/dev/null -- "${EXCL[@]}") || gitfail "git diff"
+  DIFF="$DIFF"$'\n'"$WT"
 fi
 if [ -n "$HAS_ADD" ]; then
   # (a plain function, not `case` inside $(...): bash 3.2 cannot parse the `)` of a case pattern there)
+  # NUL-separated paths so a newline in a filename cannot hide a file; a grep failure marks the scan.
   scan_untracked() {
-    git ls-files --others --exclude-standard 2>/dev/null | while IFS= read -r f; do
-      grep -qE '\.(example|sample|dist|tmpl)$' <<<"$f" && continue
-      grep -sIE "$SECRETS" -- "$f" | sed 's/^/+/'
+    git ls-files -z --others --exclude-standard 2>/dev/null | while IFS= read -r -d '' f; do
+      hasc '\.(example|sample|dist|tmpl)$' "$f" && continue
+      grep -siIE "$SECRETS" -- "$f" | sed 's/^/+/'
+      [ "${PIPESTATUS[0]}" -gt 1 ] && printf '+GUARD_SCAN_FAILED %s\n' "$f"
     done
+    [ "${PIPESTATUS[0]}" -eq 0 ] || printf '+GUARD_SCAN_FAILED ls-files\n'
   }
-  DIFF="$DIFF"$'\n'"$(scan_untracked)"
+  UT=$(scan_untracked)
+  if hasc '^\+GUARD_SCAN_FAILED' "$UT"; then gitfail "scanning an untracked file"; fi
+  DIFF="$DIFF"$'\n'"$UT"
 fi
 # Only ADDED lines count (`+` but not the `+++ b/file` header): removing a leaked secret from a
 # file must stay committable (§11: rotate, then scrub). No `-q` anywhere: every stage reads all of
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 31f9c18..b4d4f33 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -42,6 +42,17 @@ run_raw() {
   record "$1" "$2" $? "$3"
 }
 
+# run_err <name> <expected-exit> <stderr must contain> <command>: also asserts exactly one "cannot classify" line
+run_err() {
+  printf '%s' "$4" | jq -Rs '{tool_input:{command:.}}' | bash "$HOOK" >"$TMP/out" 2>"$TMP/err"
+  rc=$?
+  if grep -qF -- "$3" "$TMP/err" && [ "$(grep -c 'cannot classify' "$TMP/err")" -eq 1 ] && [ ! -s "$TMP/out" ]; then
+    record "$1" "$2" "$rc" "$4"
+  else
+    FAIL=$((FAIL + 1)); echo "FAIL: $1 (stderr lacks '$3', or not exactly one reason line, or stdout not empty): $4"; sed 's/^/      stderr: /' "$TMP/err"
+  fi
+}
+
 # A throwaway repo with the given committer, one tracked file, and a clean tree.
 mkrepo() {
   d=$(mktemp -d "$TMP/repo.XXXXXX")
@@ -351,7 +362,48 @@ run "git split by empty quotes"              2 'gi'"'"''"'"'t push -f origin mai
 run "git split by a backslash"               2 'gi\t push -f origin main'
 run "git split, --no-verify"                 2 'g"it" commit --no-verify -m x'
 run "git as an ANSI-C hex string"            2 '$'"'"'\x67it'"'"' push -f origin main'
-run "refusal names the construct"            2 'git commit -m x; echo $'"'"'\033[0m'"'"''
+run_err "refusal names the construct" 2 "numeric escape" 'git commit -m x; echo $'"'"'\033[0m'"'"''
+run_err "refusal names an open quote"  2 "left open" 'x=$(echo hi
+git push -f origin main'
+
+# --- a newline is a command boundary only at the top level in code ------------------------------
+run "newline inside a quoted push argument"  2 'git push "multi
+line" --force origin main'
+run "newline inside a quoted commit message" 2 'git commit -m "line one
+line two" --no-verify'
+run "heredoc message then --no-verify"       2 'git commit -m "$(cat <<EOF
+feat: x
+
+body
+EOF
+)" --no-verify'
+run "newline inside a -c value"              2 'git -c "a
+b" commit --no-verify -m x'
+run "backslash-newline inside double quotes" 2 'git push "x\
+y" --force origin main'
+run "heredoc message then a plain push"      0 'git commit -m "$(cat <<'"'"'EOF'"'"'
+feat: x
+
+body
+EOF
+)"
+git push origin feat/x'
+run "# on a continuation line is not a comment" 2 'git commit -m x\
+#; git push -f origin main'
+run "# on a continuation after echo"         2 'echo a\
+#; git push --force origin main'
+run_raw "JSON unicode escape in the subcommand" 2 '{"tool_input":{"command":"git push --force origin main"}}'
+run_raw "JSON unicode escape in git"         2 '{"tool_input":{"command":"git push --force origin main"}}'
+run_raw "pretty-printed payload"             2 '{
+  "tool_input": {
+    "command": "git push --force origin main"
+  }
+}'
+# shellcheck disable=SC1003  # the \' is part of the command under test
+run "ANSI-C with an escaped quote before a hex escape" 2 'git $'"'"'a\'"'"'\x70ush'"'"' --force origin main'
+run "coproc NAME case"                       2 'x="$(coproc nm case a in a) git push --force origin main;; esac)"'
+run "time -p case"                           2 'x="$( { time -p case a in a) git push --force origin main;; esac; } )"'
+run "hooksPath value with a space"           2 'git -c "core.hooksPath=/no such" commit -m x'
 DENSE=$(for _ in $(seq 1 600); do printf '  "key": "value",\n'; done)
 run "quote-dense non-git heredoc is fast"    0 "cat > package.json <<'EOF'
 {
@@ -425,9 +477,20 @@ printf 'aws_key=%s\n' "$AWS_KEY" >>tracked.txt
 run "dirty tracked secret, plain commit"     0 'git commit -m "x"'
 run "dirty tracked secret, commit -am"       2 'git commit -am "x"'
 run "dirty tracked secret, commit --all"     2 'git commit --all -m "x"'
+run "dirty tracked secret, -a then ;"        2 'git commit -m x -a;git push origin x'
+run "dirty tracked secret, pathspec commit"  2 'git commit -m "x" tracked.txt'
+run "dirty tracked secret, --include"        2 'git commit --include tracked.txt -m "x"'
 run "dirty tracked secret, add && commit"    2 'git add tracked.txt && git commit -m "x"'
 git checkout -q -- tracked.txt
 
+printf 'PASSWORD=%s\n' "$(printf 'B%.0s' $(seq 1 26))" >shout.txt
+run "untracked uppercase secret, add && commit" 2 'git add shout.txt && git commit -m "x"'
+rm shout.txt
+
+git config diff.algorithm bogus
+run "git diff failure fails closed"          2 'git commit -m "x"'
+git config --unset diff.algorithm
+
 printf 'aws_key=%s\n' "$AWS_KEY" >config.txt
 git add config.txt
 run "staged secret"                          2 'git commit -m "x"'
@@ -517,7 +580,7 @@ run_without "$TMP/nowc" "no wc: commit fails closed"    2 'git commit --no-verif
 run_without "$TMP/notr" "no tr: unrelated command allowed" 0 'ls'
 
 # Every case in this file must have been counted: a case that ran in a subshell would be lost.
-EXPECTED=$(grep -cE '^(run|run_raw|run_nojq|run_noawk|run_without) ' "$SELF")
+EXPECTED=$(grep -cE '^(run|run_raw|run_err|run_nojq|run_noawk|run_without) ' "$SELF")
 if [ "$((PASS + FAIL))" -ne "$EXPECTED" ]; then
   echo "FAIL: $EXPECTED cases defined, $((PASS + FAIL)) counted"
   FAIL=$((FAIL + 1))

From 7a2f4cdb09b3e1e131a535e0b6b5da03ab7419ef Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 07:14:50 +0100
Subject: [PATCH 14/39] fix(hooks): separators inside $( ) never split the
 enclosing command; absolute-path shell wrappers; --no-color on the diff;
 symlinks, $'EOF' delimiters, and numeric escapes without git

Ninth code review: a ; or | inside a $(...) used as an argument (git push origin "$(git branch --show-current | tr -d ' ')" --force) split the enclosing command so the flag lost its git; /bin/sh -c was not recognized as a wrapper; color.ui=always hid the + prefix from the secrets scan. Separators and newlines inside a substitution now become spaces (a newline in a bare subshell stays a separator), the wrapper class admits an absolute path, git diff runs with --no-color, the untracked scan skips symlinks and non-regular files and matches exclusions on the whole name, a $'EOF' delimiter is quoted, an ANSI-C numeric escape is refused only when git, commit, or push is also mentioned, stdin read failure blocks, and has/hasc use a local status. Fifteen cases added (233 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 44 +++++++++++++++++++-------------
 tests/hooks/test-guard-commit.sh | 38 ++++++++++++++++++++++++++-
 2 files changed, 63 insertions(+), 19 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index e455128..5ae7dc6 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -13,20 +13,26 @@
 # (safe direction): a one-word quoted argument that spells a flag or subcommand (`-m "--no-verify"`,
 # `-m "eval"`, `tag -m "push" -f`), `--force-if-includes` on its own, `-S<keyid>` with an `n` in
 # the key id, a commit message mentioning `-c core.hooksPath`, and an ANSI-C numeric escape
-# (`$'\033[0m'`) anywhere in a call that also commits or pushes.
+# (`$'\033[0m'`) in a call that also mentions git, commit, or push. A call whose every one of
+# those words is itself numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
 #
 # No `grep -q` ever reads from a pipe: it exits on the first match, and under pipefail the
 # upstream writer's SIGPIPE would read as "no match". Checks read here-strings, and every grep
 # treats an exit status over 1 as a tool failure that blocks.
 export LC_ALL=C   # byte-oriented grep/awk/tr: an invalid UTF-8 byte must not make a tool drop the rest of the input
 set -o pipefail   # a failing tool anywhere in a pipeline must surface, never read as "no match"
-INPUT=$(cat)
+INPUT=$(cat) || { echo "Blocked: guard-commit.sh could not read its stdin. Failing closed." >&2; exit 2; }
+
+# has <ERE> <text> (case-insensitive) / hasc (case-sensitive): grep that treats any status over 1
+# as a tool failure and fails closed, so a broken grep can never read as "no match".
+has()  { grep -qiE "$1" <<<"$2"; local rc=$?; [ "$rc" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$rc"; }
+hasc() { grep -qE  "$1" <<<"$2"; local rc=$?; [ "$rc" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$rc"; }
 
 # Fast path: this guard only concerns `git commit` / `git push`. If the payload mentions
 # neither, allow immediately — so a missing jq (below) never blocks unrelated Bash (ls/cat/grep).
 # Match loosely (no quote-class): a quoted arg before the subcommand (`git -C "x" commit`)
 # must NOT slip past into a silent allow. grep exit 1 = no match; anything else = error.
-FLAT=${INPUT//$'\n'/ }   # a pretty-printed payload must not split the match across lines (no tool needed: raw newlines are rare in JSON)
+FLAT=$(tr '\n' ' ' <<<"$INPUT") || FLAT=$INPUT   # a pretty-printed payload must not split the match across lines
 grep -qiE 'git.*(commit|push)' <<<"$FLAT"
 RC=$?
 if [ "$RC" -eq 1 ]; then
@@ -42,7 +48,7 @@ if [ "$RC" -eq 1 ]; then
   RC=$?
   # Text no dequoting can reveal goes to the walker: an ANSI-C numeric escape (`$'\x70ush'`, the
   # walker refuses it) or a JSON \u escape for an ASCII letter (jq decodes it; the walker sees it).
-  if [ "$RC" -eq 1 ] && { grep -qE "\\\$'" <<<"$FLAT" && grep -qE '\\\\[xuU0-7]' <<<"$FLAT" || grep -qE '\\u00[0-9a-fA-F]{2}' <<<"$FLAT"; }; then RC=0; fi
+  if [ "$RC" -eq 1 ] && has 'git|commit|push' "$J" && { hasc "\\\$'" "$FLAT" && hasc '\\\\[xuU0-7]' "$FLAT" || hasc '\\u00[0-9a-fA-F]{2}' "$FLAT"; }; then RC=0; fi
 fi
 case $RC in
   0) ;;
@@ -64,11 +70,6 @@ if [ -z "$CMD" ]; then
   exit 2
 fi
 
-# has <ERE> <text> (case-insensitive) / hasc (case-sensitive): grep that treats any status over 1
-# as a tool failure and fails closed, so a broken grep can never read as "no match".
-has()  { grep -qiE "$1" <<<"$2"; RC=$?; [ "$RC" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$RC"; }
-hasc() { grep -qE  "$1" <<<"$2"; RC=$?; [ "$RC" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$RC"; }
-
 # No agent-realistic command is this long; past this size the character walk below gets slow, so
 # stop here (the per-segment loop further down has its own cap for the same reason).
 if [ ${#CMD} -gt 262144 ]; then
@@ -121,6 +122,7 @@ strip_data() {
   function refuse(why) { refused = 1; print "guard-commit.sh cannot classify this command: " why ". Rewrite it without that construct." > "/dev/stderr"; exit 3 }
   function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb }   # a short quoted fragment is part of its word
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
+  function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`") return 1; return 0 }
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1; kwlead = 0 }
   {
     line = $0
@@ -134,7 +136,7 @@ strip_data() {
         for (k = 1; k < npend; k++) { pword[k] = pword[k + 1]; pdash[k] = pdash[k + 1]; pq[k] = pq[k + 1] }
         npend--
         depth = bodydepth                        # anything left open inside the body dies with it, as in bash
-        if (npend == 0) { body = 0; q = bodyq } else q = (pq[1] ? 5 : 4)
+        if (npend == 0) { body = 0; q = 0 } else q = (pq[1] ? 5 : 4)
         line = rest
       } else if (q == 5) next                    # quoted-delimiter body: inert, drop the line
     }
@@ -176,6 +178,9 @@ strip_data() {
       # `;` `&` `|` separate commands only in code; inside an expansion or arithmetic they are text
       if (ch == ";" || ch == "&" || ch == "|") {
         if (top == "${" || top == "((" || top == "$((" || top == "(a") { o = o " "; i++; continue }
+        # inside `$(...)` a separator ends a command OF THE SUBSTITUTION, never the enclosing one
+        # (`git push origin "$(a | b)" --force` is one push): a space keeps the flag with its git
+        if (insubst()) { droptests(); cmdpos = 1; o = o " "; i++; continue }
         droptests(); cmdpos = 1; o = o ch; i++; continue
       }
       if (ch == "{" || ch == "!") { cmdpos = 1; o = o ch; i++; continue }
@@ -210,6 +215,7 @@ strip_data() {
         while (c[j] == " " || c[j] == "\t") j++
         w = ""; quoted = 0
         while (j <= n && c[j] !~ /[ \t;&|<>()]/) {
+          if (c[j] == "$" && (c[j + 1] == "\047" || c[j + 1] == "\"")) j++   # a $-prefixed quoted delimiter is quoted too
           if (c[j] == "\047" || c[j] == "\"") {  # a quoted delimiter may contain anything up to its closing quote
             qc = c[j]; quoted = 1; j++
             while (j <= n && c[j] != qc) { w = w c[j]; j++ }
@@ -246,14 +252,14 @@ strip_data() {
     if (q == 0 && !cont) droptests()
     # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash
     enter = (!body && npend > 0 && q == 0 && !cont)
-    # A newline separates commands only at the top level in code. Inside `$(...)` or a subshell it
-    # separates commands of the substitution but not the enclosing one (`-m "$(cat <<EOF ... )" --no-verify`
-    # is ONE command), so it becomes a space; inside a quoted span or a body line it is part of a word.
+    # A newline separates commands in code, except inside `$(...)` where it separates commands of
+    # the substitution but not the enclosing one (`-m "$(cat <<EOF ... )" --no-verify` is ONE
+    # command), so there it becomes a space; inside a quoted span or a body line it is part of a word.
     if (cont) printf "%s", o
-    else if (q == 0 && depth == 0) print o
+    else if (q == 0 && !insubst()) print o
     else if (q == 0 || q == 4) printf "%s ", o
     else printf "%s", o
-    if (enter) { body = 1; bodyq = q; bodydepth = depth; q = (pq[1] ? 5 : 4) }
+    if (enter) { body = 1; bodydepth = depth; q = (pq[1] ? 5 : 4) }
   }
   # A frame or quote still open at the end means bash would reject the whole input (or the walk
   # lost track of it, e.g. a `case` with no `esac`). Either way: refuse to guess.
@@ -266,7 +272,7 @@ fi
 
 # A shell wrapper runs its quoted argument as a command, which the strip above just hid.
 # Refuse rather than guess: the unwrapped form is always available to the agent.
-if hasc '(^|[^[:alnum:]_./-])((ba|z|da)?sh[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' "$STRIPPED"; then
+if hasc '(^|[^[:alnum:]_.-])((ba|z|da)?sh[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' "$STRIPPED"; then
   echo "Blocked: git commit/push inside a shell wrapper (sh -c / bash -c / eval) cannot be inspected. Run the git command directly." >&2; exit 2
 fi
 
@@ -345,7 +351,7 @@ SECRETS='(api[_-]?key|secret[_-]?key|access[_-]?key|private[_-]?key|password|tok
 # explicitly whitelisted for commit (e.g. `!.env.example` in the scaffolder .gitignore).
 EXCL=(':(exclude)*.example' ':(exclude)*.sample' ':(exclude)*.dist' ':(exclude)*.tmpl')
 # `--no-ext-diff` and `core.fsmonitor=false` so a repo-local config cannot make the guard run a program.
-GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff)
+GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff --no-color)   # color.ui=always would hide the `+` prefix
 gitfail() { echo "Blocked: guard-commit.sh could not read the diff ($1 failed). Failing closed." >&2; exit 2; }
 DIFF=$("${GIT_DIFF[@]}" --cached 2>/dev/null -- "${EXCL[@]}") || gitfail "git diff --cached"
 if [ -n "$HAS_ADD$HAS_WORKTREE" ]; then
@@ -357,7 +363,9 @@ if [ -n "$HAS_ADD" ]; then
   # NUL-separated paths so a newline in a filename cannot hide a file; a grep failure marks the scan.
   scan_untracked() {
     git ls-files -z --others --exclude-standard 2>/dev/null | while IFS= read -r -d '' f; do
-      hasc '\.(example|sample|dist|tmpl)$' "$f" && continue
+      case "$f" in *.example|*.sample|*.dist|*.tmpl) continue ;; esac   # (a whole-name match: a newline in the name cannot fool it)
+      [ -L "$f" ] && continue                # git stores a symlink's target text, never the target
+      [ -f "$f" ] || continue
       grep -siIE "$SECRETS" -- "$f" | sed 's/^/+/'
       [ "${PIPESTATUS[0]}" -gt 1 ] && printf '+GUARD_SCAN_FAILED %s\n' "$f"
     done
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index b4d4f33..b256387 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -404,8 +404,33 @@ run "ANSI-C with an escaped quote before a hex escape" 2 'git $'"'"'a\'"'"'\x70u
 run "coproc NAME case"                       2 'x="$(coproc nm case a in a) git push --force origin main;; esac)"'
 run "time -p case"                           2 'x="$( { time -p case a in a) git push --force origin main;; esac; } )"'
 run "hooksPath value with a space"           2 'git -c "core.hooksPath=/no such" commit -m x'
+
+# --- a separator inside $( ) ends a command of the substitution, never the enclosing one --------
+run "pipe inside a refspec substitution"     2 'git push origin "$(git branch --show-current | tr -d '"'"' '"'"')" --force'
+run "pipe inside a message substitution"     2 'git commit -m "$(git log -1 --pretty=%s | cut -c1-50)" --no-verify'
+run "; inside a message substitution"        2 'git commit -m "$(echo a; echo b)" --no-verify'
+run "&& inside a message substitution"       2 'git commit -m "$(date && echo)" -n'
+run "backtick substitution with a pipe"      2 'git commit -m "`echo a | cat`" --no-verify'
+run "; inside \$( ) still separates there"   2 'x=$(echo hi; git push -f origin main)'
+run "multi-line subshell with a plain push"  0 '(
+cd sub
+git push origin main
+rm -f tmp
+)'
+run "multi-line subshell with ls -n"         0 '(
+git commit -m x
+ls -n
+)'
+run "absolute-path sh -c wrapper"            2 '/bin/sh -c "git push --force origin main"'
+run "absolute-path bash -c wrapper"          2 '/bin/bash -c "git commit --no-verify -m x"'
+run "\$'EOF' quoted delimiter then push"     2 'cat <<$'"'"'EOF'"'"'
+body
+EOF
+git push -f origin main'
+run "numeric escape with no git is allowed"  0 'find . -print0 | while IFS= read -r -d $'"'"'\0'"'"' f; do echo "$f"; done'
+run "numeric escape with a commit still refused" 2 'git commit -m x; echo $'"'"'\033[0m'"'"''
 DENSE=$(for _ in $(seq 1 600); do printf '  "key": "value",\n'; done)
-run "quote-dense non-git heredoc is fast"    0 "cat > package.json <<'EOF'
+run "quote-dense non-git heredoc is allowed" 0 "cat > package.json <<'EOF'
 {
 $DENSE
 }
@@ -491,6 +516,17 @@ git config diff.algorithm bogus
 run "git diff failure fails closed"          2 'git commit -m "x"'
 git config --unset diff.algorithm
 
+printf 'aws_key=%s\n' "$AWS_KEY" >color.txt
+git add color.txt
+git config color.ui always
+run "color.ui=always does not hide a staged secret" 2 'git commit -m "x"'
+git config --unset color.ui
+git rm -q --cached color.txt && rm color.txt
+
+ln -s /nonexistent-target dangling
+run "dangling symlink does not break add && commit" 0 'git add dangling && git commit -m "x"'
+rm dangling
+
 printf 'aws_key=%s\n' "$AWS_KEY" >config.txt
 git add config.txt
 run "staged secret"                          2 'git commit -m "x"'

From 1bd05770460bda670815b71e811257106236f759 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 07:26:48 +0100
Subject: [PATCH 15/39] fix(hooks): a newline ends the enclosing command only
 outside every expansion frame; the secrets diff is read as text without
 textconv or relative paths; wrapper flags before -c

Tenth code review: a newline inside ${...}, $((...)) or $[...] split the enclosing command so a flag lost its git; a -diff attribute or a NUL byte made git call the file binary and the secrets scan saw no + lines; bash -x -c and ksh -c were not recognized as wrappers. A newline is now a command boundary only when every open frame is a bare subshell; $[ has its own frame kind so it survives the end-of-line test-bracket drop; the guard's git diff runs with --text --no-textconv --no-color --no-relative and a diff over 16 MB fails closed; the untracked scan reads binaries; the wrapper regex accepts flags before -c and ksh, csh, tcsh, fish. Header lists interpreter wrappers, filter.*.clean, and the -n-inside-substitution false block. Twelve cases added (245 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 49 ++++++++++++++++++++------------
 tests/hooks/test-guard-commit.sh | 35 +++++++++++++++++++++++
 2 files changed, 66 insertions(+), 18 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 5ae7dc6..af0b0d5 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -9,12 +9,17 @@
 # unique-prefix long options (`--no-veri`), a word spliced by any expansion or substitution
 # (`git pu${x}sh`, `git pu$(echo s)h`), a bare pathspec on `git commit` (only `-a`, `-i`, `-o`
 # and pathspec-looking tokens trigger the working-tree scan), and the committer and secrets
-# checks reading the current directory's repo (`git -C elsewhere commit`). Known false blocks
-# (safe direction): a one-word quoted argument that spells a flag or subcommand (`-m "--no-verify"`,
-# `-m "eval"`, `tag -m "push" -f`), `--force-if-includes` on its own, `-S<keyid>` with an `n` in
-# the key id, a commit message mentioning `-c core.hooksPath`, and an ANSI-C numeric escape
-# (`$'\033[0m'`) in a call that also mentions git, commit, or push. A call whose every one of
-# those words is itself numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
+# checks reading the current directory's repo (`git -C elsewhere commit`), a `filter.*.clean`
+# set in an earlier call (it rewrites the working-tree diff the guard reads), and git run from
+# another interpreter (`python3 -c "os.system('git push -f')"`, `perl -e`, `node -e`, awk's
+# `system()`), whose program is data to this walk. Known false blocks (safe direction): a one-word
+# quoted argument that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`,
+# `tag -m "push" -f`), a `-n` or `-f` on another command inside the same `$(...)` as a commit or
+# push (`-m "$(git log -1 | head -n 1)"`), `--force-if-includes` on its own, `-S<keyid>` with an
+# `n` in the key id, a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
+# large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
+# that also mentions git, commit, or push. A call whose every one of those words is itself
+# numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
 #
 # No `grep -q` ever reads from a pipe: it exits on the first match, and under pipefail the
 # upstream writer's SIGPIPE would read as "no match". Checks read here-strings, and every grep
@@ -123,6 +128,7 @@ strip_data() {
   function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb }   # a short quoted fragment is part of its word
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`") return 1; return 0 }
+  function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1; kwlead = 0 }
   {
     line = $0
@@ -166,7 +172,7 @@ strip_data() {
         i++; continue
       }
       top = (depth > 0) ? kind[depth] : ""
-      noheredoc = (top == "((" || top == "$((" || top == "[" || top == "(a" || top == "${")
+      noheredoc = (top == "((" || top == "$((" || top == "[" || top == "$[" || top == "(a" || top == "${")
       if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o c[i + 1]; i += 2; continue }   # `\-f` is `-f`
       if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; i += 2; continue }
       if (ch == "\047") { q = 1; qb = ""; qbad = 0; i++; continue }
@@ -177,7 +183,7 @@ strip_data() {
       if (ch == "#" && !noheredoc && ((i == 1 && !joined) || (i > 1 && c[i - 1] ~ /[ \t;&|(]/) || (c[i - 1] == ")" && poppos == i - 1 && (poppedkind == "(" || poppedkind == "((")))) break
       # `;` `&` `|` separate commands only in code; inside an expansion or arithmetic they are text
       if (ch == ";" || ch == "&" || ch == "|") {
-        if (top == "${" || top == "((" || top == "$((" || top == "(a") { o = o " "; i++; continue }
+        if (top == "${" || top == "((" || top == "$((" || top == "(a" || top == "$[") { o = o " "; i++; continue }
         # inside `$(...)` a separator ends a command OF THE SUBSTITUTION, never the enclosing one
         # (`git push origin "$(a | b)" --force` is one push): a space keeps the flag with its git
         if (insubst()) { droptests(); cmdpos = 1; o = o " "; i++; continue }
@@ -185,7 +191,7 @@ strip_data() {
       }
       if (ch == "{" || ch == "!") { cmdpos = 1; o = o ch; i++; continue }
       if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("$((", 0); o = o " "; i += 3; continue }
-      if (ch == "$" && c[i + 1] == "[") { push("[", 0); o = o " "; i += 2; continue }
+      if (ch == "$" && c[i + 1] == "[") { push("$[", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$("; i += 2; continue }
       if (ch == "[") { push("[", 0); o = o " "; i++; continue }
@@ -194,11 +200,11 @@ strip_data() {
       if (ch == "(") { push("(", 0); o = o ch; i++; continue }
       if (ch == ")" && c[i + 1] == ")" && (top == "((" || top == "$((")) { pop(); poppos = i + 1; o = o " "; i += 2; continue }
       if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
-      if (ch == "]" && top == "[") { pop(); o = o " "; i++; continue }
+      if (ch == "]" && (top == "[" || top == "$[")) { pop(); o = o " "; i++; continue }
       if (ch == "}" && top == "${") { pop(); o = o " "; i++; continue }
       if (ch == ")") {
         if (top == "[" || top == "${") {         # a frame `)` cannot close: unwind to the `(` it does close
-          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--
+          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--   # drops [ $[ ${ (a
           top = (depth > 0) ? kind[depth] : ""
         }
         if (casec[depth] > 0) { o = o ch; i++; cmdpos = 1; continue }   # a case pattern terminator
@@ -252,11 +258,13 @@ strip_data() {
     if (q == 0 && !cont) droptests()
     # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash
     enter = (!body && npend > 0 && q == 0 && !cont)
-    # A newline separates commands in code, except inside `$(...)` where it separates commands of
-    # the substitution but not the enclosing one (`-m "$(cat <<EOF ... )" --no-verify` is ONE
-    # command), so there it becomes a space; inside a quoted span or a body line it is part of a word.
+    # A newline separates commands in code at the top level or inside a bare subshell. Inside any
+    # other frame it does not end the ENCLOSING command: in `$(...)` it separates commands of the
+    # substitution (`-m "$(cat <<EOF ... )" --no-verify` is ONE command), in `${...}` / `$((...))`
+    # / `$[...]` it is just whitespace; so there it becomes a space. Inside a quoted span or a body
+    # line it is part of a word.
     if (cont) printf "%s", o
-    else if (q == 0 && !insubst()) print o
+    else if (q == 0 && !inframe()) print o
     else if (q == 0 || q == 4) printf "%s ", o
     else printf "%s", o
     if (enter) { body = 1; bodydepth = depth; q = (pq[1] ? 5 : 4) }
@@ -272,7 +280,7 @@ fi
 
 # A shell wrapper runs its quoted argument as a command, which the strip above just hid.
 # Refuse rather than guess: the unwrapped form is always available to the agent.
-if hasc '(^|[^[:alnum:]_.-])((ba|z|da)?sh[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' "$STRIPPED"; then
+if hasc '(^|[^[:alnum:]_.-])((ba|z|da|k|c|tc|fi)?sh([[:space:]]+[^;&|[:space:]]+)*[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' "$STRIPPED"; then
   echo "Blocked: git commit/push inside a shell wrapper (sh -c / bash -c / eval) cannot be inspected. Run the git command directly." >&2; exit 2
 fi
 
@@ -351,7 +359,9 @@ SECRETS='(api[_-]?key|secret[_-]?key|access[_-]?key|private[_-]?key|password|tok
 # explicitly whitelisted for commit (e.g. `!.env.example` in the scaffolder .gitignore).
 EXCL=(':(exclude)*.example' ':(exclude)*.sample' ':(exclude)*.dist' ':(exclude)*.tmpl')
 # `--no-ext-diff` and `core.fsmonitor=false` so a repo-local config cannot make the guard run a program.
-GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff --no-color)   # color.ui=always would hide the `+` prefix
+# Repo config must not reshape what the guard reads: no external diff, no textconv, no color,
+# no relative paths, and binary-looking content (a `-diff` attribute, a NUL byte) still as text.
+GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff --no-textconv --no-color --no-relative --text)
 gitfail() { echo "Blocked: guard-commit.sh could not read the diff ($1 failed). Failing closed." >&2; exit 2; }
 DIFF=$("${GIT_DIFF[@]}" --cached 2>/dev/null -- "${EXCL[@]}") || gitfail "git diff --cached"
 if [ -n "$HAS_ADD$HAS_WORKTREE" ]; then
@@ -366,7 +376,7 @@ if [ -n "$HAS_ADD" ]; then
       case "$f" in *.example|*.sample|*.dist|*.tmpl) continue ;; esac   # (a whole-name match: a newline in the name cannot fool it)
       [ -L "$f" ] && continue                # git stores a symlink's target text, never the target
       [ -f "$f" ] || continue
-      grep -siIE "$SECRETS" -- "$f" | sed 's/^/+/'
+      grep -saE -i "$SECRETS" -- "$f" | sed 's/^/+/'   # -a: a NUL byte must not make grep skip the file
       [ "${PIPESTATUS[0]}" -gt 1 ] && printf '+GUARD_SCAN_FAILED %s\n' "$f"
     done
     [ "${PIPESTATUS[0]}" -eq 0 ] || printf '+GUARD_SCAN_FAILED ls-files\n'
@@ -375,6 +385,9 @@ if [ -n "$HAS_ADD" ]; then
   if hasc '^\+GUARD_SCAN_FAILED' "$UT"; then gitfail "scanning an untracked file"; fi
   DIFF="$DIFF"$'\n'"$UT"
 fi
+if [ ${#DIFF} -gt 16777216 ]; then
+  echo "Blocked: guard-commit.sh will not scan a diff over 16 MB for secrets. Commit large binaries separately (or via LFS)." >&2; exit 2
+fi
 # Only ADDED lines count (`+` but not the `+++ b/file` header): removing a leaked secret from a
 # file must stay committable (§11: rotate, then scrub). No `-q` anywhere: every stage reads all of
 # its input, so an early exit can never SIGPIPE a writer into "no match". grep 1 = clean.
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index b256387..7ab138d 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -429,6 +429,20 @@ EOF
 git push -f origin main'
 run "numeric escape with no git is allowed"  0 'find . -print0 | while IFS= read -r -d $'"'"'\0'"'"' f; do echo "$f"; done'
 run "numeric escape with a commit still refused" 2 'git commit -m x; echo $'"'"'\033[0m'"'"''
+
+# --- a newline inside ${ }, $(( )) or $[ ] does not end the enclosing command --------------------
+run "newline inside \${ } before --force"    2 'git push origin main ${x:-
+} --force'
+run "newline inside quoted \${ } before --no-verify" 2 'git commit -m "${x:-
+}" --no-verify'
+run "newline inside \$(( )) before --force"  2 'git push origin main $((1+
+1)) --force'
+run "newline inside \$[ ] before --force"    2 'git push origin main $[1+
+1] --force'
+run "bash -x -c wrapper"                     2 'bash -x -c "git push --force origin main"'
+run "bash --norc -c wrapper"                 2 'bash --norc -c "git commit --no-verify -m x"'
+run "bash -o pipefail -c wrapper"            2 'bash -o pipefail -c "git commit --no-verify -m x"'
+run "ksh -c wrapper"                         2 'ksh -c "git push --force origin main"'
 DENSE=$(for _ in $(seq 1 600); do printf '  "key": "value",\n'; done)
 run "quote-dense non-git heredoc is allowed" 0 "cat > package.json <<'EOF'
 {
@@ -527,6 +541,27 @@ ln -s /nonexistent-target dangling
 run "dangling symlink does not break add && commit" 0 'git add dangling && git commit -m "x"'
 rm dangling
 
+printf '*.txt -diff\n' >.gitattributes
+printf 'aws_key=%s\n' "$AWS_KEY" >nodiff.txt
+git add .gitattributes nodiff.txt
+run "-diff attribute does not hide a staged secret" 2 'git commit -m "x"'
+git rm -q --cached .gitattributes nodiff.txt && rm .gitattributes nodiff.txt
+
+printf 'aws_key=%s\n\0\n' "$AWS_KEY" >nul.txt
+git add nul.txt
+run "NUL byte does not hide a staged secret" 2 'git commit -m "x"'
+git rm -q --cached nul.txt
+run "NUL byte does not hide an untracked secret" 2 'git add nul.txt && git commit -m "x"'
+rm nul.txt
+
+printf '*.txt diff=hide\n' >.gitattributes
+git config diff.hide.textconv 'sed s/AKIA/XXXX/'
+printf 'aws_key=%s\n' "$AWS_KEY" >conv.txt
+git add .gitattributes conv.txt
+run "textconv does not rewrite the staged secret" 2 'git commit -m "x"'
+git config --unset diff.hide.textconv
+git rm -q --cached .gitattributes conv.txt && rm .gitattributes conv.txt
+
 printf 'aws_key=%s\n' "$AWS_KEY" >config.txt
 git add config.txt
 run "staged secret"                          2 'git commit -m "x"'

From 50bbd77fb90eecf4b987b0b2feb653ef720ead23 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 07:39:16 +0100
Subject: [PATCH 16/39] fix(hooks): stdin-fed shells, trap, and -c clusters are
 wrappers; process substitution is a word; added lines come from git's own
 indicator

Eleventh code review and third security audit: a shell fed on stdin (bash <<'EOF', bash <<<, ... | sh, bash -s) was not a wrapper so its body was stripped as data; bash -cx and -ceu clusters slipped the -c test; trap runs text at exit; ash, mksh, yash were unlisted. Process substitution <(...) was pushed as a bare subshell, so a separator inside it split the enclosing command and detached --force or --no-verify from its git; it is now its own frame that merges like $(...). A staged line whose content starts with ++ b/ evaded the diff-header filter; git now marks added lines with its own --output-indicator-new, so header shape is irrelevant, and the secrets scan is one grep. Twenty-two cases added (267 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 73 +++++++++++++++++---------------
 tests/hooks/test-guard-commit.sh | 35 +++++++++++++++
 2 files changed, 74 insertions(+), 34 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index af0b0d5..193446e 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -6,16 +6,19 @@
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
-# unique-prefix long options (`--no-veri`), a word spliced by any expansion or substitution
-# (`git pu${x}sh`, `git pu$(echo s)h`), a bare pathspec on `git commit` (only `-a`, `-i`, `-o`
+# unique-prefix long options (`--no-veri`), a word or flag spliced by any expansion or substitution
+# (`git pu${x}sh`, `git pu$(echo s)h`, `--for$(echo c)e`), a bare pathspec on `git commit` (only `-a`, `-i`, `-o`
 # and pathspec-looking tokens trigger the working-tree scan), and the committer and secrets
 # checks reading the current directory's repo (`git -C elsewhere commit`), a `filter.*.clean`
-# set in an earlier call (it rewrites the working-tree diff the guard reads), and git run from
-# another interpreter (`python3 -c "os.system('git push -f')"`, `perl -e`, `node -e`, awk's
-# `system()`), whose program is data to this walk. Known false blocks (safe direction): a one-word
-# quoted argument that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`,
-# `tag -m "push" -f`), a `-n` or `-f` on another command inside the same `$(...)` as a commit or
-# push (`-m "$(git log -1 | head -n 1)"`), `--force-if-includes` on its own, `-S<keyid>` with an
+# set in an earlier call (it rewrites the working-tree diff the guard reads), a script body run
+# by name (`bash run.sh`, `source ./run.sh`), and git run from another interpreter
+# (`python3 -c "os.system('git push -f')"`, `perl -e`, `node -e`, awk's `system()`), whose
+# program is data to this walk. Known false blocks (safe direction): a shell wrapper anywhere in
+# the same call as a plain commit or push (`git commit -m x && bash -c "echo done"`,
+# `bash build.sh -c release && git commit -m x`), a one-word quoted argument that spells a flag or
+# subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a `-n` or `-f` on another
+# command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
+# `--force-if-includes` on its own, `-S<keyid>` with an
 # `n` in the key id, a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
@@ -94,7 +97,8 @@ fi
 #    backslash-newline in code joins the next line with nothing in between, so a word or flag
 #    split across lines stays whole;
 #  - `$(...)` and backticks reopen code inside double quotes and inside unquoted heredoc bodies
-#    (bash expands them there: `cat <<EOF` + `$(git push -f)` runs the push);
+#    (bash expands them there: `cat <<EOF` + `$(git push -f)` runs the push); `<(...)` and `>(...)`
+#    are words of the enclosing command, so separators inside them never split it;
 #  - `$((...))`, `((...))`, `$[...]`, `${...}`, and `[...]` frames, where `<<` is a shift or
 #    text and `#` is not a comment; an unbalanced `[` dies at the next command boundary;
 #  - `#` comments to end of line, only where bash starts one: at the start of a word, which a
@@ -127,7 +131,7 @@ strip_data() {
   function refuse(why) { refused = 1; print "guard-commit.sh cannot classify this command: " why ". Rewrite it without that construct." > "/dev/stderr"; exit 3 }
   function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb }   # a short quoted fragment is part of its word
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
-  function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`") return 1; return 0 }
+  function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1; kwlead = 0 }
   {
@@ -195,6 +199,7 @@ strip_data() {
       if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$("; i += 2; continue }
       if (ch == "[") { push("[", 0); o = o " "; i++; continue }
+      if ((ch == "<" || ch == ">") && c[i + 1] == "(") { push("<(", 0); o = o " "; i += 2; continue }   # process substitution: a word
       if (ch == "(" && noheredoc && top != "${") { push("(a", 0); o = o " "; i++; continue }
       if (ch == "(" && c[i + 1] == "(") { push("((", 0); o = o " "; i += 2; continue }
       if (ch == "(") { push("(", 0); o = o ch; i++; continue }
@@ -204,11 +209,11 @@ strip_data() {
       if (ch == "}" && top == "${") { pop(); o = o " "; i++; continue }
       if (ch == ")") {
         if (top == "[" || top == "${") {         # a frame `)` cannot close: unwind to the `(` it does close
-          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--   # drops [ $[ ${ (a
+          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "<(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--   # drops [ $[ ${ (a
           top = (depth > 0) ? kind[depth] : ""
         }
         if (casec[depth] > 0) { o = o ch; i++; cmdpos = 1; continue }   # a case pattern terminator
-        if (top == "(" || top == "$(") { pop(); o = o ch; i++; continue }
+        if (top == "(" || top == "$(" || top == "<(") { pop(); o = o ch; i++; continue }
         o = o ch; i++; continue
       }
       if (ch == "`") {
@@ -278,10 +283,13 @@ if ! STRIPPED=$(strip_data <<<"$CMD"); then
   exit 2
 fi
 
-# A shell wrapper runs its quoted argument as a command, which the strip above just hid.
-# Refuse rather than guess: the unwrapped form is always available to the agent.
-if hasc '(^|[^[:alnum:]_.-])((ba|z|da|k|c|tc|fi)?sh([[:space:]]+[^;&|[:space:]]+)*[[:space:]]+-[a-z]*c|eval)([^[:alnum:]_./-]|$)' "$STRIPPED"; then
-  echo "Blocked: git commit/push inside a shell wrapper (sh -c / bash -c / eval) cannot be inspected. Run the git command directly." >&2; exit 2
+# A shell wrapper runs text as a command, and the strip above just hid that text: `sh -c "..."`
+# (any flag cluster containing c, any flags before it), a shell fed on stdin (`bash <<'EOF'`,
+# `bash <<<"..."`, `bash < f`, `... | sh`), `eval`, and `trap`. Refuse rather than guess: the
+# unwrapped form, in its own call, is always available to the agent.
+SH='(ba|z|da|k|c|tc|fi|a|mk|ya)?sh'
+if hasc "(^|[^[:alnum:]_.-])$SH([[:space:]]+[^;&|[:space:]]+)*[[:space:]]+-[a-z]*c[a-z]*([^[:alnum:]_./-]|\$)|(^|[^[:alnum:]_.-])$SH([[:space:]]+-[a-z]+)*[[:space:]]*<|\|[[:space:]]*$SH([[:space:]]+-[a-z]+)*([[:space:]]|\$)|(^|[^[:alnum:]_./-])(eval|trap)([^[:alnum:]_./-]|\$)" "$STRIPPED"; then
+  echo "Blocked: a shell wrapper (sh -c, bash <<EOF, ... | sh, eval, trap) in the same call as a git commit/push cannot be inspected. Run the git command directly, in its own call." >&2; exit 2
 fi
 
 # Each segment costs a few greps; thousands of `;`-separated segments could outlast the hook
@@ -361,7 +369,9 @@ EXCL=(':(exclude)*.example' ':(exclude)*.sample' ':(exclude)*.dist' ':(exclude)*
 # `--no-ext-diff` and `core.fsmonitor=false` so a repo-local config cannot make the guard run a program.
 # Repo config must not reshape what the guard reads: no external diff, no textconv, no color,
 # no relative paths, and binary-looking content (a `-diff` attribute, a NUL byte) still as text.
-GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff --no-textconv --no-color --no-relative --text)
+# Added lines are marked `>` by git itself (--output-indicator-new), so a content line that merely
+# looks like a `+++ b/file` header cannot be mistaken for one.
+GIT_DIFF=(git -c core.fsmonitor=false diff --no-ext-diff --no-textconv --no-color --no-relative --text --output-indicator-new='>')
 gitfail() { echo "Blocked: guard-commit.sh could not read the diff ($1 failed). Failing closed." >&2; exit 2; }
 DIFF=$("${GIT_DIFF[@]}" --cached 2>/dev/null -- "${EXCL[@]}") || gitfail "git diff --cached"
 if [ -n "$HAS_ADD$HAS_WORKTREE" ]; then
@@ -376,29 +386,24 @@ if [ -n "$HAS_ADD" ]; then
       case "$f" in *.example|*.sample|*.dist|*.tmpl) continue ;; esac   # (a whole-name match: a newline in the name cannot fool it)
       [ -L "$f" ] && continue                # git stores a symlink's target text, never the target
       [ -f "$f" ] || continue
-      grep -saE -i "$SECRETS" -- "$f" | sed 's/^/+/'   # -a: a NUL byte must not make grep skip the file
-      [ "${PIPESTATUS[0]}" -gt 1 ] && printf '+GUARD_SCAN_FAILED %s\n' "$f"
+      grep -saE -i "$SECRETS" -- "$f" | sed 's/^/>/'   # -a: a NUL byte must not make grep skip the file
+      [ "${PIPESTATUS[0]}" -gt 1 ] && printf '>GUARD_SCAN_FAILED %s\n' "$f"
     done
-    [ "${PIPESTATUS[0]}" -eq 0 ] || printf '+GUARD_SCAN_FAILED ls-files\n'
+    [ "${PIPESTATUS[0]}" -eq 0 ] || printf '>GUARD_SCAN_FAILED ls-files\n'
   }
   UT=$(scan_untracked)
-  if hasc '^\+GUARD_SCAN_FAILED' "$UT"; then gitfail "scanning an untracked file"; fi
+  if hasc '^>GUARD_SCAN_FAILED' "$UT"; then gitfail "scanning an untracked file"; fi
   DIFF="$DIFF"$'\n'"$UT"
 fi
 if [ ${#DIFF} -gt 16777216 ]; then
   echo "Blocked: guard-commit.sh will not scan a diff over 16 MB for secrets. Commit large binaries separately (or via LFS)." >&2; exit 2
 fi
-# Only ADDED lines count (`+` but not the `+++ b/file` header): removing a leaked secret from a
-# file must stay committable (§11: rotate, then scrub). No `-q` anywhere: every stage reads all of
-# its input, so an early exit can never SIGPIPE a writer into "no match". grep 1 = clean.
-grep -E '^\+' <<<"$DIFF" | grep -vE '^\+\+\+ (b/|/dev/null)' | grep -iE "$SECRETS" >/dev/null
-STAGES=("${PIPESTATUS[@]}")
-if [ "${STAGES[2]}" -eq 0 ]; then
-  echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2
-fi
-for ST in "${STAGES[@]}"; do   # 0 or 1 is an answer from every stage; anything else is a tool failure
-  if [ "$ST" -gt 1 ]; then
-    echo "Blocked: guard-commit.sh could not scan the staged diff for secrets (grep failed). Failing closed." >&2; exit 2
-  fi
-done
+# Only ADDED lines (`>`) count: removing a leaked secret from a file must stay committable
+# (§11: rotate, then scrub). One grep, no `-q`, so it reads everything; 1 = clean.
+grep -iE "^>.*($SECRETS)" <<<"$DIFF" >/dev/null
+case $? in
+  0) echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2 ;;
+  1) ;;
+  *) echo "Blocked: guard-commit.sh could not scan the staged diff for secrets (grep failed). Failing closed." >&2; exit 2 ;;
+esac
 exit 0
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 7ab138d..e22e239 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -443,6 +443,36 @@ run "bash -x -c wrapper"                     2 'bash -x -c "git push --force ori
 run "bash --norc -c wrapper"                 2 'bash --norc -c "git commit --no-verify -m x"'
 run "bash -o pipefail -c wrapper"            2 'bash -o pipefail -c "git commit --no-verify -m x"'
 run "ksh -c wrapper"                         2 'ksh -c "git push --force origin main"'
+run "ash -c wrapper"                         2 'ash -c "git push --force origin main"'
+run "bash -cx cluster"                       2 'bash -cx "git push --force origin main"'
+run "bash -ceu cluster"                      2 'bash -ceu "git commit --no-verify -m x"'
+run "bash fed by a heredoc"                  2 'bash <<'"'"'EOF'"'"'
+git push --force origin main
+EOF'
+run "bash -s fed by a heredoc"               2 'bash -s <<'"'"'EOF'"'"'
+git commit --no-verify -m x
+EOF'
+run "bash fed by a here-string"              2 'bash <<<"git push --force origin main"'
+run "bash fed by a pipe"                     2 'echo "git push --force origin main" | bash'
+run "sh -s fed by a heredoc pipe"            2 'cat <<'"'"'EOF'"'"' | sh -s
+git push --force origin main
+EOF'
+run "bash fed by a file"                     2 'bash < run.sh; git push origin main'
+run "trap runs text at exit"                 2 'trap "git push --force origin main" EXIT; true'
+run "wrapper elsewhere in the call (documented false block)" 2 'git commit -m "x" && bash -c "echo done"'
+run "script taking -c (documented false block)" 2 'bash build.sh -c release && git commit -m x'
+run "ssh -c cipher is not a wrapper"         0 'ssh -c aes256-ctr host git commit -m x'
+
+# --- process substitution is a word of the enclosing command ------------------------------------
+run "pipe inside <( ) before --force-with-lease" 2 'git push origin main <(git log --oneline | head -5) --force-with-lease'
+run "; inside <( ) before --force"           2 'git push origin main <(echo a;echo b) --force'
+run "; inside <( ) before +refspec"          2 'git push origin <(echo a;echo b) +main'
+run "; inside <( ) before --no-verify"       2 'git commit -m x <(echo a;echo b) --no-verify'
+run "&& inside <( ) before -n"               2 'git commit -m x <(echo a&&echo b) -n'
+run "newline inside >( ) before --force"     2 'git push origin main >(cat
+) --force'
+run "<( ) control without a separator"       2 'git push origin main <(echo a) --force'
+run "<( ) in a plain diff then commit"       0 'diff <(sort a) <(sort b); git commit -m "x"'
 DENSE=$(for _ in $(seq 1 600); do printf '  "key": "value",\n'; done)
 run "quote-dense non-git heredoc is allowed" 0 "cat > package.json <<'EOF'
 {
@@ -596,6 +626,11 @@ git add plus.txt
 run "secret on an added line starting with ++" 2 'git commit -m "x"'
 git rm -q --cached plus.txt && rm plus.txt
 
+printf '++ b/x aws_key=%s\n' "$AWS_KEY" >header.txt
+git add header.txt
+run "secret on a line shaped like a diff header" 2 'git commit -m "x"'
+git rm -q --cached header.txt && rm header.txt
+
 # Scrubbing a leaked secret (a removed line) must stay committable; git is called directly here,
 # the hook is not involved in seeding the leak.
 printf 'aws_key=%s\n' "$AWS_KEY" >leaked.txt

From 31273da51e8270096f2500bd4597cad549039ab2 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 07:54:10 +0100
Subject: [PATCH 17/39] fix(hooks): the wrapper rule is stated, not enumerated;
 same-call git aliases refused; env -S; git 2.28 floor; JSON-escape tests
 really contain escapes

Twelfth code review: the stdin-fed-shell detection caught a few shapes and missed many (bash --norc <<EOF, bash 0<<EOF, | bash;, a pipe into bash on the next line, exec-redirected stdin then bare bash, bash <(...), source <(...)); a git alias defined in the same call (git -c alias.fp=push fp --force) renamed the subcommand out of reach of every check; env -S splits a string into a command; and the two JSON unicode-escape tests had lost their backslashes in transit and asserted nothing. The wrapper check now runs per segment with one rule: a shell by name or path is a wrapper when given leading options, when anything is redirected into it, or when it has no arguments at all; a shell given a script path and the script's own arguments is not. Process substitution keeps its < in the stripped text. alias. anywhere in a call that commits or pushes is refused. The header states the git 2.28 floor. Nineteen cases added (286 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 36 +++++++++++++++++++++---------
 tests/hooks/test-guard-commit.sh | 38 +++++++++++++++++++++++++++++---
 2 files changed, 61 insertions(+), 13 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 193446e..b5f9477 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -3,6 +3,8 @@
 # around git, non-human committers, AI attribution, and staged secrets before they happen.
 # Exit 2 + a stderr reason is the documented blocking contract; stdout is unused.
 #
+# Needs jq and git 2.28+ (for --no-relative and --output-indicator-new on the diff it reads).
+#
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
@@ -15,7 +17,9 @@
 # (`python3 -c "os.system('git push -f')"`, `perl -e`, `node -e`, awk's `system()`), whose
 # program is data to this walk. Known false blocks (safe direction): a shell wrapper anywhere in
 # the same call as a plain commit or push (`git commit -m x && bash -c "echo done"`,
-# `bash build.sh -c release && git commit -m x`), a one-word quoted argument that spells a flag or
+# `bash -x build.sh && git commit -m x`), `source`/`.` of a process substitution, an alias
+# defined in the same call as a commit or push (`git config alias.st status; git commit`), a
+# one-word quoted argument that spells a flag or
 # subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a `-n` or `-f` on another
 # command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
 # `--force-if-includes` on its own, `-S<keyid>` with an
@@ -199,7 +203,7 @@ strip_data() {
       if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$("; i += 2; continue }
       if (ch == "[") { push("[", 0); o = o " "; i++; continue }
-      if ((ch == "<" || ch == ">") && c[i + 1] == "(") { push("<(", 0); o = o " "; i += 2; continue }   # process substitution: a word
+      if ((ch == "<" || ch == ">") && c[i + 1] == "(") { push("<(", 0); o = o ch " "; i += 2; continue }   # process substitution: a word
       if (ch == "(" && noheredoc && top != "${") { push("(a", 0); o = o " "; i++; continue }
       if (ch == "(" && c[i + 1] == "(") { push("((", 0); o = o " "; i += 2; continue }
       if (ch == "(") { push("(", 0); o = o ch; i++; continue }
@@ -283,14 +287,6 @@ if ! STRIPPED=$(strip_data <<<"$CMD"); then
   exit 2
 fi
 
-# A shell wrapper runs text as a command, and the strip above just hid that text: `sh -c "..."`
-# (any flag cluster containing c, any flags before it), a shell fed on stdin (`bash <<'EOF'`,
-# `bash <<<"..."`, `bash < f`, `... | sh`), `eval`, and `trap`. Refuse rather than guess: the
-# unwrapped form, in its own call, is always available to the agent.
-SH='(ba|z|da|k|c|tc|fi|a|mk|ya)?sh'
-if hasc "(^|[^[:alnum:]_.-])$SH([[:space:]]+[^;&|[:space:]]+)*[[:space:]]+-[a-z]*c[a-z]*([^[:alnum:]_./-]|\$)|(^|[^[:alnum:]_.-])$SH([[:space:]]+-[a-z]+)*[[:space:]]*<|\|[[:space:]]*$SH([[:space:]]+-[a-z]+)*([[:space:]]|\$)|(^|[^[:alnum:]_./-])(eval|trap)([^[:alnum:]_./-]|\$)" "$STRIPPED"; then
-  echo "Blocked: a shell wrapper (sh -c, bash <<EOF, ... | sh, eval, trap) in the same call as a git commit/push cannot be inspected. Run the git command directly, in its own call." >&2; exit 2
-fi
 
 # Each segment costs a few greps; thousands of `;`-separated segments could outlast the hook
 # timeout, and a timed-out PreToolUse hook does not block. No real command has hundreds.
@@ -303,9 +299,29 @@ if [ "$NSEP" -gt 500 ]; then
   exit 2
 fi
 
+# A shell wrapper runs text as a command, and the strip above just hid that text. The rule, per
+# segment of a call that commits or pushes: a shell (`sh`, `bash`, `zsh`, ... by name or path) is a
+# wrapper when it is given leading options (`bash -c`, `bash -x script`, `bash -s`), when anything
+# is redirected into it (`bash <<'EOF'`, `bash <<<"..."`, `bash < f`, `bash <(...)`), or when it has
+# no arguments at all (`... | bash`, `bash` after `exec <`). A shell given a script path and the
+# script's own arguments is not (`bash build.sh -c release`); the script body is a listed limit.
+# `eval` and `trap` run text by definition; `source`/`.` of a process substitution reads text;
+# `env -S` splits a string into a command. Refuse rather than guess: the unwrapped form, in its
+# own call, is always available to the agent.
+SHW='(^|[[:space:]])([^[:space:]]*/)?(ba|z|da|k|c|tc|fi|a|mk|ya)?sh'
+WRAPPER="${SHW}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}[[:space:]]+-|${SHW}[[:space:]].*<|(^|[[:space:]])(eval|trap)([[:space:]]|\$)|(^|[[:space:]])(source|\.)[[:space:]].*<|(^|[[:space:]])env[[:space:]]+-[A-Za-z]*S"
+
+# An alias defined in the same call renames a subcommand out of reach of every check below.
+if has '(^|[^[:alnum:]_])alias\.' "$CMD"; then
+  echo "Blocked: a git alias defined in the same call as a commit/push cannot be inspected. Define it separately, or use the full subcommand." >&2; exit 2
+fi
+
 IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""; HAS_WORKTREE=""
 while IFS= read -r SEG; do
   [ -z "$SEG" ] && continue
+  if hasc "$WRAPPER" "$SEG"; then
+    echo "Blocked: a shell wrapper (sh -c, bash <<EOF, ... | sh, eval, trap) in the same call as a git commit/push cannot be inspected. Run the git command directly, in its own call." >&2; exit 2
+  fi
   SEG_COMMIT=""; SEG_PUSH=""
   has 'git.*[[:space:]]commit([^[:alnum:]]|$)' "$SEG" && SEG_COMMIT=1
   has 'git.*[[:space:]]push([^[:alnum:]]|$)' "$SEG" && SEG_PUSH=1
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index e22e239..696e734 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -392,8 +392,9 @@ run "# on a continuation line is not a comment" 2 'git commit -m x\
 #; git push -f origin main'
 run "# on a continuation after echo"         2 'echo a\
 #; git push --force origin main'
-run_raw "JSON unicode escape in the subcommand" 2 '{"tool_input":{"command":"git push --force origin main"}}'
-run_raw "JSON unicode escape in git"         2 '{"tool_input":{"command":"git push --force origin main"}}'
+BS="\\"   # a literal backslash, so the JSON below really contains backslash-u escapes
+run_raw "JSON unicode escape in the subcommand" 2 '{"tool_input":{"command":"git pu'"$BS"'u0073h --force origin main"}}'
+run_raw "JSON unicode escape in git"         2 '{"tool_input":{"command":"g'"$BS"'u0069t push --force origin main"}}'
 run_raw "pretty-printed payload"             2 '{
   "tool_input": {
     "command": "git push --force origin main"
@@ -460,8 +461,39 @@ EOF'
 run "bash fed by a file"                     2 'bash < run.sh; git push origin main'
 run "trap runs text at exit"                 2 'trap "git push --force origin main" EXIT; true'
 run "wrapper elsewhere in the call (documented false block)" 2 'git commit -m "x" && bash -c "echo done"'
-run "script taking -c (documented false block)" 2 'bash build.sh -c release && git commit -m x'
+run "shell with leading option before a script (documented false block)" 2 'bash -x build.sh && git commit -m x'
+run "script with its own -c argument is allowed" 0 'bash build.sh -c release && git commit -m x'
+run "script with its own --check is allowed"  0 'bash scripts/publish.sh --check && git commit -m x'
+run "sourcing a venv is allowed"             0 '. ./venv/bin/activate && git commit -m x'
 run "ssh -c cipher is not a wrapper"         0 'ssh -c aes256-ctr host git commit -m x'
+run "bash --norc fed by a heredoc"           2 'bash --norc <<'"'"'EOF'"'"'
+git push --force origin main
+EOF'
+run "bash -o pipefail fed by a heredoc"      2 'bash -o pipefail <<'"'"'EOF'"'"'
+git push --force origin main
+EOF'
+run "bash /dev/stdin fed by a heredoc"       2 'bash /dev/stdin <<'"'"'EOF'"'"'
+git push --force origin main
+EOF'
+run "bash 0<< fed by a heredoc"              2 'bash 0<<'"'"'EOF'"'"'
+git push --force origin main
+EOF'
+run "pipe into bash then ;"                  2 'echo "git push --force origin main" | bash; true'
+run "pipe into sh inside a subshell"         2 '(echo "git push --force origin main" | sh)'
+run "pipe into bash on the next line"        2 'printf "git push --force origin main" |
+bash'
+run "exec-redirected stdin then bare bash"   2 'exec <<'"'"'EOF'"'"'
+git push --force origin main
+EOF
+bash'
+run "bash fed by a process substitution"     2 'bash <(echo "git push --force origin main")'
+run "source of a process substitution"       2 'source <(echo "git push --force origin main")'
+run "env -S splits a string into a command"  2 'env -S "bash -c '"'"'git push --force origin main'"'"'"'
+run "alias defined with -c, same call"       2 'git -c alias.fp=push fp --force origin main'
+run "alias with the flag inside, same call"  2 'git -c alias.fp="push --force" fp origin main'
+run "alias via git config, same call"        2 'git config alias.fp "push --force"; git fp origin main'
+run "alias for a no-verify commit"           2 'git -c alias.nv="commit --no-verify" nv -m x'
+run "alias lookup next to a commit (documented false block)" 2 'git config --get alias.st; git commit -m x'
 
 # --- process substitution is a word of the enclosing command ------------------------------------
 run "pipe inside <( ) before --force-with-lease" 2 'git push origin main <(git log --oneline | head -5) --force-with-lease'

From 17b47e6719c4571339e82de6d1144c68923f4219 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 08:09:45 +0100
Subject: [PATCH 18/39] fix(hooks): real command boundaries are a sentinel
 byte; redirection operators and escaped separators are text; wrappers next to
 parens, after redirections, and glued to redirects; env options before -S;
 alias rule on stripped text

Fourth security audit and thirteenth code review. The stripped text reused ; & | as its own segment delimiter, so an escaped \; or the & of 2>&1 became a command boundary bash never has and a flag after it lost its git. The walker now emits a \001 byte for a real boundary, escaped separators and redirection operators are text, and segments split only on the sentinel. $( and ( emit a trailing space so a wrapper right after them is at a word start (a regression from the previous commit); the wrapper rule adopts a reviewer-verified regex set: a bare shell followed only by redirections, a redirect glued to the shell word, env options before -S, and a path prefix that ignores shebang writes and assignments. The alias rule reads the stripped text plus the inline -c form, so a message mentioning alias.md is data. Any bare token after commit that is not a message-like option value triggers the working-tree scan. Patterns are passed to grep with -e. The suite pins /bin/bash when present. Fifty-six cases added (342 total); green on macOS awk, mawk, busybox awk.
---
 hooks/guard-commit.sh            | 66 +++++++++++++++++++---------
 tests/hooks/test-guard-commit.sh | 75 ++++++++++++++++++++++++++++++--
 2 files changed, 117 insertions(+), 24 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index b5f9477..fc09208 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -9,16 +9,16 @@
 # accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
 # unique-prefix long options (`--no-veri`), a word or flag spliced by any expansion or substitution
-# (`git pu${x}sh`, `git pu$(echo s)h`, `--for$(echo c)e`), a bare pathspec on `git commit` (only `-a`, `-i`, `-o`
-# and pathspec-looking tokens trigger the working-tree scan), and the committer and secrets
+# (`git pu${x}sh`, `git pu$(echo s)h`, `--for$(echo c)e`), and the committer and secrets
 # checks reading the current directory's repo (`git -C elsewhere commit`), a `filter.*.clean`
 # set in an earlier call (it rewrites the working-tree diff the guard reads), a script body run
 # by name (`bash run.sh`, `source ./run.sh`), and git run from another interpreter
 # (`python3 -c "os.system('git push -f')"`, `perl -e`, `node -e`, awk's `system()`), whose
 # program is data to this walk. Known false blocks (safe direction): a shell wrapper anywhere in
 # the same call as a plain commit or push (`git commit -m x && bash -c "echo done"`,
-# `bash -x build.sh && git commit -m x`), `source`/`.` of a process substitution, an alias
-# defined in the same call as a commit or push (`git config alias.st status; git commit`), a
+# `bash -x build.sh && git commit -m x`, `which bash && git commit -m x`, `git add zsh bash fish`
+# in a dotfiles repo), `source`/`.` of a process substitution, any alias definition in the same
+# call as a commit or push (`git config alias.st status; git commit`), a
 # one-word quoted argument that spells a flag or
 # subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a `-n` or `-f` on another
 # command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
@@ -37,8 +37,8 @@ INPUT=$(cat) || { echo "Blocked: guard-commit.sh could not read its stdin. Faili
 
 # has <ERE> <text> (case-insensitive) / hasc (case-sensitive): grep that treats any status over 1
 # as a tool failure and fails closed, so a broken grep can never read as "no match".
-has()  { grep -qiE "$1" <<<"$2"; local rc=$?; [ "$rc" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$rc"; }
-hasc() { grep -qE  "$1" <<<"$2"; local rc=$?; [ "$rc" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$rc"; }
+has()  { grep -qiE -e "$1" <<<"$2"; local rc=$?; [ "$rc" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$rc"; }
+hasc() { grep -qE  -e "$1" <<<"$2"; local rc=$?; [ "$rc" -gt 1 ] && { echo "Blocked: guard-commit.sh grep failed. Failing closed." >&2; exit 2; }; return "$rc"; }
 
 # Fast path: this guard only concerns `git commit` / `git push`. If the payload mentions
 # neither, allow immediately — so a missing jq (below) never blocks unrelated Bash (ls/cat/grep).
@@ -173,7 +173,7 @@ strip_data() {
         if (ch == "\\") { if (q == 2) qb = qb c[i + 1]; i += 2; continue }
         if (q == 2 && ch == "\"") { q = 0; closeq(); i++; continue }
         if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { qbad = 1; push("$((", q); q = 0; o = o " "; i += 3; continue }
-        if (ch == "$" && c[i + 1] == "(") { qbad = 1; push("$(", q); q = 0; o = o "$("; i += 2; continue }
+        if (ch == "$" && c[i + 1] == "(") { qbad = 1; push("$(", q); q = 0; o = o "$( "; i += 2; continue }
         if (ch == "$" && c[i + 1] == "{") { qbad = 1; push("${", q); q = 0; o = o " "; i += 2; continue }
         if (ch == "`") { qbad = 1; push("`", q); q = 0; o = o " "; i++; continue }
         if (q == 2) qb = qb ch
@@ -181,7 +181,10 @@ strip_data() {
       }
       top = (depth > 0) ? kind[depth] : ""
       noheredoc = (top == "((" || top == "$((" || top == "[" || top == "$[" || top == "(a" || top == "${")
-      if (ch == "\\") { if (i == n) { cont = 1; i++; continue } o = o c[i + 1]; i += 2; continue }   # `\-f` is `-f`
+      if (ch == "\\") {                       # `\-f` is `-f`; an escaped separator is text, never a boundary
+        if (i == n) { cont = 1; i++; continue }
+        o = o ((c[i + 1] ~ /[;&|]/) ? " " : c[i + 1]); i += 2; continue
+      }
       if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; i += 2; continue }
       if (ch == "\047") { q = 1; qb = ""; qbad = 0; i++; continue }
       if (ch == "\"") { q = 2; qb = ""; qbad = 0; i++; continue }
@@ -190,23 +193,25 @@ strip_data() {
       # backtick ends a word, and `#` after it is part of that word.
       if (ch == "#" && !noheredoc && ((i == 1 && !joined) || (i > 1 && c[i - 1] ~ /[ \t;&|(]/) || (c[i - 1] == ")" && poppos == i - 1 && (poppedkind == "(" || poppedkind == "((")))) break
       # `;` `&` `|` separate commands only in code; inside an expansion or arithmetic they are text
+      # `&` in `2>&1` `>&` `&>` `<&-` and `|` in `>|` belong to a redirection operator, not a boundary
+      if ((ch == "&" && (c[i - 1] == "<" || c[i - 1] == ">" || c[i + 1] == ">")) || (ch == "|" && c[i - 1] == ">")) { o = o " "; i++; continue }
       if (ch == ";" || ch == "&" || ch == "|") {
         if (top == "${" || top == "((" || top == "$((" || top == "(a" || top == "$[") { o = o " "; i++; continue }
         # inside `$(...)` a separator ends a command OF THE SUBSTITUTION, never the enclosing one
         # (`git push origin "$(a | b)" --force` is one push): a space keeps the flag with its git
         if (insubst()) { droptests(); cmdpos = 1; o = o " "; i++; continue }
-        droptests(); cmdpos = 1; o = o ch; i++; continue
+        droptests(); cmdpos = 1; o = o "\001"; i++; continue   # a REAL boundary: a byte no command contains
       }
       if (ch == "{" || ch == "!") { cmdpos = 1; o = o ch; i++; continue }
       if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("$((", 0); o = o " "; i += 3; continue }
       if (ch == "$" && c[i + 1] == "[") { push("$[", 0); o = o " "; i += 2; continue }
       if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
-      if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$("; i += 2; continue }
+      if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$( "; i += 2; continue }
       if (ch == "[") { push("[", 0); o = o " "; i++; continue }
       if ((ch == "<" || ch == ">") && c[i + 1] == "(") { push("<(", 0); o = o ch " "; i += 2; continue }   # process substitution: a word
       if (ch == "(" && noheredoc && top != "${") { push("(a", 0); o = o " "; i++; continue }
       if (ch == "(" && c[i + 1] == "(") { push("((", 0); o = o " "; i += 2; continue }
-      if (ch == "(") { push("(", 0); o = o ch; i++; continue }
+      if (ch == "(") { push("(", 0); o = o "( "; i++; continue }
       if (ch == ")" && c[i + 1] == ")" && (top == "((" || top == "$((")) { pop(); poppos = i + 1; o = o " "; i += 2; continue }
       if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
       if (ch == "]" && (top == "[" || top == "$[")) { pop(); o = o " "; i++; continue }
@@ -216,9 +221,9 @@ strip_data() {
           while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "<(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--   # drops [ $[ ${ (a
           top = (depth > 0) ? kind[depth] : ""
         }
-        if (casec[depth] > 0) { o = o ch; i++; cmdpos = 1; continue }   # a case pattern terminator
-        if (top == "(" || top == "$(" || top == "<(") { pop(); o = o ch; i++; continue }
-        o = o ch; i++; continue
+        if (casec[depth] > 0) { o = o ch " "; i++; cmdpos = 1; continue }   # a case pattern terminator
+        if (top == "(" || top == "$(" || top == "<(") { pop(); o = o ch " "; i++; continue }
+        o = o ch " "; i++; continue
       }
       if (ch == "`") {
         if (top == "`") pop(); else push("`", 0)
@@ -290,7 +295,8 @@ fi
 
 # Each segment costs a few greps; thousands of `;`-separated segments could outlast the hook
 # timeout, and a timed-out PreToolUse hook does not block. No real command has hundreds.
-if ! SEGMENTS=$(tr ';&|' '\n' <<<"$STRIPPED") || ! NSEP=$(tr -cd ';&|\n' <<<"$STRIPPED" | wc -c) || ! [ "$NSEP" -eq "$NSEP" ] 2>/dev/null; then
+# The walker marks every real command boundary with \001 (a `;` `&` `|` it emits as text is not one).
+if ! SEGMENTS=$(tr '\001' '\n' <<<"$STRIPPED") || ! NSEP=$(tr -cd '\001\n' <<<"$STRIPPED" | wc -c) || ! [ "$NSEP" -eq "$NSEP" ] 2>/dev/null; then
   echo "Blocked: guard-commit.sh could not split the command into segments (tr/wc failed). Failing closed." >&2
   exit 2
 fi
@@ -308,11 +314,15 @@ fi
 # `eval` and `trap` run text by definition; `source`/`.` of a process substitution reads text;
 # `env -S` splits a string into a command. Refuse rather than guess: the unwrapped form, in its
 # own call, is always available to the agent.
-SHW='(^|[[:space:]])([^[:space:]]*/)?(ba|z|da|k|c|tc|fi|a|mk|ya)?sh'
-WRAPPER="${SHW}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}[[:space:]]+-|${SHW}[[:space:]].*<|(^|[[:space:]])(eval|trap)([[:space:]]|\$)|(^|[[:space:]])(source|\.)[[:space:]].*<|(^|[[:space:]])env[[:space:]]+-[A-Za-z]*S"
+SHW='(^|[[:space:]()])([^[:space:]#!=]*/)?(ba|z|da|k|c|tc|fi|a|mk|ya)?sh'   # a shell, by name or path; `#!/bin/bash` and `x=/bin/sh` are not commands
+RD='([[:space:]]*[0-9]*[<>]+[[:space:]]*[^[:space:]<>]*)*'                          # redirection words are not arguments
+ENVOPT='([[:space:]]+(-[A-Za-z]*|-u[[:space:]]+[^[:space:]]+|--[A-Za-z-]+(=[^[:space:]]*)?|[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*))*'
+# every alternative supplies its own right boundary, so `shasum`, `shellcheck`, `bashful` never match
+WRAPPER="${SHW}${RD}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}${RD}[[:space:]]+-|${SHW}[[:space:]]*[0-9]*<|${SHW}[[:space:]].*<|(^|[[:space:]()])(eval|trap)([[:space:]]|\$)|(^|[[:space:]()])(source|\.)[[:space:]].*<|(^|[[:space:]()])env${ENVOPT}[[:space:]]+(-[A-Za-z]*S|--split-string)"
 
-# An alias defined in the same call renames a subcommand out of reach of every check below.
-if has '(^|[^[:alnum:]_])alias\.' "$CMD"; then
+# An alias defined in the same call renames a subcommand out of reach of every check below
+# (`git -c alias.fp=push fp --force`; the `-c` value is quoted data, so the raw command is read too).
+if has '(^|[^[:alnum:]_])alias\.' "$STRIPPED" || has '-c[[:space:]]*["'"'"']?alias\.' "$CMD"; then
   echo "Blocked: a git alias defined in the same call as a commit/push cannot be inspected. Define it separately, or use the full subcommand." >&2; exit 2
 fi
 
@@ -326,8 +336,22 @@ while IFS= read -r SEG; do
   has 'git.*[[:space:]]commit([^[:alnum:]]|$)' "$SEG" && SEG_COMMIT=1
   has 'git.*[[:space:]]push([^[:alnum:]]|$)' "$SEG" && SEG_PUSH=1
   has 'git.*[[:space:]]add([^[:alnum:]]|$)' "$SEG" && HAS_ADD=1
-  # a commit with -a/-i/-o or a pathspec-looking token commits working-tree content, not just the index
-  if [ -n "$SEG_COMMIT" ] && has '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aio][A-Za-z]*|--all|--include|--only|[^-[:space:]][^[:space:]]*[./][^[:space:]]*)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
+  # a commit with -a/-i/-o, or any bare token after the subcommand that is not the value of a
+  # message-like option, commits working-tree content, not just the index: scan it
+  if [ -n "$SEG_COMMIT" ]; then
+    if has '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aio][A-Za-z]*|--all|--include|--only)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
+    PREV=""; SEEN=""
+    for T in $SEG; do   # (unquoted on purpose: the walker already removed every quote)
+      if [ -n "$SEEN" ]; then
+        case "$T" in
+          -*) ;;
+          *) case "$PREV" in -m|-F|-C|-c|-S|-t|--message|--file|--author|--date|--trailer|--template|--fixup|--squash|--reedit-message|--reuse-message|--cleanup|--gpg-sign) ;; *) HAS_WORKTREE=1 ;; esac ;;
+        esac
+      fi
+      [ "$T" = commit ] && SEEN=1
+      PREV=$T
+    done
+  fi
   [ -n "$SEG_COMMIT" ] && IS_COMMIT=1
   [ -n "$SEG_PUSH" ] && HAS_PUSH=1
   [ -z "$SEG_COMMIT$SEG_PUSH" ] && continue
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 696e734..da96f87 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -8,6 +8,7 @@ set -u
 HERE=$(cd "$(dirname "$0")" && pwd)
 SELF="$HERE/$(basename "$0")"
 HOOK="$HERE/../../hooks/guard-commit.sh"
+BASH=/bin/bash; [ -x "$BASH" ] || BASH=bash   # the macOS system bash 3.2 when present, whatever is on PATH otherwise
 PASS=0
 FAIL=0
 TMP=$(mktemp -d)
@@ -32,19 +33,19 @@ record() {
 # run <name> <expected-exit> <bash command the agent is about to run>
 # Never call this inside a subshell: PASS/FAIL must be counted in this shell.
 run() {
-  printf '%s' "$3" | jq -Rs '{tool_input:{command:.}}' | bash "$HOOK" >/dev/null 2>"$TMP/err"
+  printf '%s' "$3" | jq -Rs '{tool_input:{command:.}}' | "$BASH" "$HOOK" >/dev/null 2>"$TMP/err"
   record "$1" "$2" $? "$3"
 }
 
 # run_raw <name> <expected-exit> <raw stdin for the hook>
 run_raw() {
-  printf '%s' "$3" | bash "$HOOK" >/dev/null 2>"$TMP/err"
+  printf '%s' "$3" | "$BASH" "$HOOK" >/dev/null 2>"$TMP/err"
   record "$1" "$2" $? "$3"
 }
 
 # run_err <name> <expected-exit> <stderr must contain> <command>: also asserts exactly one "cannot classify" line
 run_err() {
-  printf '%s' "$4" | jq -Rs '{tool_input:{command:.}}' | bash "$HOOK" >"$TMP/out" 2>"$TMP/err"
+  printf '%s' "$4" | jq -Rs '{tool_input:{command:.}}' | "$BASH" "$HOOK" >"$TMP/out" 2>"$TMP/err"
   rc=$?
   if grep -qF -- "$3" "$TMP/err" && [ "$(grep -c 'cannot classify' "$TMP/err")" -eq 1 ] && [ ! -s "$TMP/out" ]; then
     record "$1" "$2" "$rc" "$4"
@@ -495,6 +496,69 @@ run "alias via git config, same call"        2 'git config alias.fp "push --forc
 run "alias for a no-verify commit"           2 'git -c alias.nv="commit --no-verify" nv -m x'
 run "alias lookup next to a commit (documented false block)" 2 'git config --get alias.st; git commit -m x'
 
+# --- only a real command boundary splits a segment ---------------------------------------------
+run "escaped ; in a -c value"                2 'git -c a.b=x\;y push -f origin main'
+run "escaped ; in an unquoted message"       2 'git commit -m msg\;more --no-verify'
+run "escaped & in a -c value"                2 'git -c a.b=x\&y push -f origin main'
+run "escaped | in a -c value"                2 'git -c a.b=x\|y push -f origin main'
+run "2>&1 before --force"                    2 'git push origin main 2>&1 --force'
+run "2>&1 before --force-with-lease"         2 'git push origin main 2>&1 --force-with-lease'
+run "2>&1 before +refspec"                   2 'git push origin 2>&1 +main'
+run ">& before --force"                      2 'git push origin main >&/dev/null --force'
+run "<&- before --force"                     2 'git push origin main <&- --force'
+run "3>&2 before --force"                    2 'git push origin main 3>&2 --force'
+run "&> before --force"                      2 'git push origin main &>/dev/null --force'
+run ">| before --force"                      2 'git push origin main >|/tmp/log --force'
+run "2>&1 before --no-verify"                2 'git commit -m x 2>&1 --no-verify'
+run "2>&1 before -n"                         2 'git commit -m x 2>&1 -n'
+run ">| before --no-verify"                  2 'git commit -m x >|/tmp/log --no-verify'
+run "2>&1 then a real ; then plain push"     0 'git commit -m x 2>&1; git push origin feat/x'
+run "wrapper directly inside a subshell"     2 '(eval "git push -f origin main")'
+run "bash -c directly inside a subshell"     2 '(bash -c "git push -f origin main")'
+run "trap directly inside a subshell"        2 '(trap "git push -f origin main" EXIT; true)'
+run "eval directly inside \$( )"             2 'x=$(eval "git push -f origin main")'
+run "bash -c directly inside \$( )"          2 'x=$(bash -c "git push -f origin main")'
+run "bash heredoc directly inside \$( )"     2 'x=$(bash <<'"'"'EOF'"'"'
+git push -f origin main
+EOF
+)'
+run "bash 2>&1 -c wrapper"                   2 'bash 2>&1 -c "git push -f origin main"'
+run "bash 3>&2 -c wrapper"                   2 'bash 3>&2 -c "git commit --no-verify -m x"'
+run "sh -c right after ("                    2 '(sh -c "git push --force origin main")'
+run "bash heredoc right after ("             2 '(bash <<'"'"'EOF'"'"'
+git push --force origin main
+EOF
+)'
+run "pipe into (bash)"                       2 'echo "git push --force origin main" | (bash)'
+run "sh -c right after \$("                  2 'x=$(sh -c "git push --force origin main")'
+run "here-string bash inside a message substitution" 2 'git commit -m "$(bash <<<"git push --force origin main")"'
+run "eval inside a message substitution"     2 'git commit -m "$(eval "git push --force origin main")"'
+run "bash -c right after a case pattern"     2 'case x in x)bash -c "git push --force origin main";; esac'
+run "bare bash then 2>/dev/null"             2 'echo "git push --force origin main" | bash 2>/dev/null'
+run "bare bash then >/dev/null 2>&1"         2 'echo "git push --force origin main" | bash >/dev/null 2>&1'
+run "bare bash then > log"                   2 'echo "git push --force origin main" | bash > log'
+run "bare bash then 2>&1 | tee"              2 'echo "git push --force origin main" | bash 2>&1 | tee log'
+run "heredoc glued to bash"                  2 'bash<<'"'"'EOF'"'"'
+git push --force origin main
+EOF'
+run "here-string glued to bash"              2 'bash<<<"git push --force origin main"'
+run "file glued to sh then commit"           2 'sh<run.sh; git commit -m x'
+run "env -i -S"                              2 'env -i -S "bash -c '"'"'git push --force origin main'"'"'"'
+run "env -u X -S"                            2 'env -u X -S "bash -c '"'"'git push --force origin main'"'"'"'
+run "env FOO=1 -S"                           2 'env FOO=1 -S "bash -c '"'"'git push --force origin main'"'"'"'
+run "env --split-string"                     2 'env --split-string="bash -c '"'"'git push --force origin main'"'"'"'
+run "env with an assignment then a signed commit" 0 'env GIT_EDITOR=true git commit -S -m x'
+run "shebang write then commit is allowed"   0 'echo '"'"'#!/bin/bash'"'"' > run.sh && git add run.sh && git commit -m x'
+run "SHELL assignment then commit is allowed" 0 'export SHELL=/bin/zsh && git commit -m x'
+run "bash >out script.sh is allowed"         0 'bash >out script.sh && git commit -m x'
+run "which bash then commit (documented false block)" 2 'which bash && git commit -m x'
+run "git add zsh bash fish (documented false block)" 2 'git add fish bash zsh && git commit -m "add shell configs"'
+run "message mentioning alias.md is allowed" 0 'git commit -m "add alias.md"'
+run "heredoc body mentioning an alias then commit" 0 'cat > notes.md <<'"'"'EOF'"'"'
+use git config alias.co checkout once
+EOF
+git commit -m x'
+
 # --- process substitution is a word of the enclosing command ------------------------------------
 run "pipe inside <( ) before --force-with-lease" 2 'git push origin main <(git log --oneline | head -5) --force-with-lease'
 run "; inside <( ) before --force"           2 'git push origin main <(echo a;echo b) --force'
@@ -581,6 +645,11 @@ run "dirty tracked secret, commit --all"     2 'git commit --all -m "x"'
 run "dirty tracked secret, -a then ;"        2 'git commit -m x -a;git push origin x'
 run "dirty tracked secret, pathspec commit"  2 'git commit -m "x" tracked.txt'
 run "dirty tracked secret, --include"        2 'git commit --include tracked.txt -m "x"'
+run "dirty tracked secret, 2>&1 then -a"     2 'git commit -m x 2>&1 -a'
+run "dirty tracked secret, 2>&1 then --all"  2 'git commit -m x 2>&1 --all'
+run "dirty tracked secret, escaped ; then -a" 2 'git commit -m x\;y -a'
+run "dirty tracked secret, extension-less pathspec" 2 'git commit -m "x" tracked'
+run "dirty tracked secret, -m value is not a pathspec" 0 'git commit -m fix'
 run "dirty tracked secret, add && commit"    2 'git add tracked.txt && git commit -m "x"'
 git checkout -q -- tracked.txt
 

From d60b5d9f32ab553fc92881844ce528fe9a82420c Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 08:29:01 +0100
Subject: [PATCH 19/39] fix(hooks): keep a dropped quoted span as one argument;
 refuse a raw boundary byte

A quoted span with whitespace inside is data and is dropped, but it was
dropped without a trace, so `-m "fix: two words" tracked.txt` made the
pathspec look like the message value and skipped the working-tree secret
scan. A dropped span now leaves an empty "" in its place; an empty pair
spliced into a word (commi""t) still vanishes, as in bash.

The pathspec loop now consumes exactly the next token after a
value-taking option, whatever its shape (-m -F file), no longer treats
-S/--gpg-sign as value-taking (they are not), and skips redirection
targets (2>&1). Globbing is off for the whole hook so an unquoted token
can never expand against the working directory.

The walk refuses a raw \001 byte in the command (its own segment mark).
env -C/-u/-P/-a/--unset/--chdir/--argv0 with a separate argument, and
versioned shell names (ksh93, bash5), are recognized as wrappers.
---
 hooks/guard-commit.sh            | 23 +++++++++++++++--------
 tests/hooks/test-guard-commit.sh | 16 ++++++++++++++++
 2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index fc09208..78c0388 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -33,6 +33,7 @@
 # treats an exit status over 1 as a tool failure that blocks.
 export LC_ALL=C   # byte-oriented grep/awk/tr: an invalid UTF-8 byte must not make a tool drop the rest of the input
 set -o pipefail   # a failing tool anywhere in a pipeline must surface, never read as "no match"
+set -f            # no pathname expansion anywhere: the hook never globs, and an unquoted token must stay a token
 INPUT=$(cat) || { echo "Blocked: guard-commit.sh could not read its stdin. Failing closed." >&2; exit 2; }
 
 # has <ERE> <text> (case-insensitive) / hasc (case-sensitive): grep that treats any status over 1
@@ -133,13 +134,17 @@ strip_data() {
     if (q == 2) qbad = 1                         # the enclosing string held a substitution: never glue it
   }
   function refuse(why) { refused = 1; print "guard-commit.sh cannot classify this command: " why ". Rewrite it without that construct." > "/dev/stderr"; exit 3 }
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb }   # a short quoted fragment is part of its word
+  # a short quoted fragment is part of its word; a dropped span leaves an empty "" so the
+  # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is);
+  # an empty pair (`commi""t`) is nothing, as in bash
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb; else if (qbad || qb != "") o = o "\"\"" }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1; kwlead = 0 }
   {
     line = $0
+    if (index(line, "\001")) refuse("a control byte in the command")   # \001 is the walk'"'"'s own boundary mark
     if (body) {
       t = line
       if (pdash[1]) sub(/^\t+/, "", t)
@@ -314,9 +319,9 @@ fi
 # `eval` and `trap` run text by definition; `source`/`.` of a process substitution reads text;
 # `env -S` splits a string into a command. Refuse rather than guess: the unwrapped form, in its
 # own call, is always available to the agent.
-SHW='(^|[[:space:]()])([^[:space:]#!=]*/)?(ba|z|da|k|c|tc|fi|a|mk|ya)?sh'   # a shell, by name or path; `#!/bin/bash` and `x=/bin/sh` are not commands
+SHW='(^|[[:space:]()])([^[:space:]#!=]*/)?(ba|z|da|k|c|tc|fi|a|mk|ya)?sh[0-9]*'   # a shell, by name or path (`ksh93`, `bash5` too); `#!/bin/bash` and `x=/bin/sh` are not commands
 RD='([[:space:]]*[0-9]*[<>]+[[:space:]]*[^[:space:]<>]*)*'                          # redirection words are not arguments
-ENVOPT='([[:space:]]+(-[A-Za-z]*|-u[[:space:]]+[^[:space:]]+|--[A-Za-z-]+(=[^[:space:]]*)?|[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*))*'
+ENVOPT='([[:space:]]+(-[uCPa][[:space:]]+[^[:space:]]+|--(unset|chdir|argv0)[[:space:]]+[^[:space:]]+|-[A-Za-z]*|--[A-Za-z-]+(=[^[:space:]]*)?|[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*))*'
 # every alternative supplies its own right boundary, so `shasum`, `shellcheck`, `bashful` never match
 WRAPPER="${SHW}${RD}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}${RD}[[:space:]]+-|${SHW}[[:space:]]*[0-9]*<|${SHW}[[:space:]].*<|(^|[[:space:]()])(eval|trap)([[:space:]]|\$)|(^|[[:space:]()])(source|\.)[[:space:]].*<|(^|[[:space:]()])env${ENVOPT}[[:space:]]+(-[A-Za-z]*S|--split-string)"
 
@@ -340,16 +345,18 @@ while IFS= read -r SEG; do
   # message-like option, commits working-tree content, not just the index: scan it
   if [ -n "$SEG_COMMIT" ]; then
     if has '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aio][A-Za-z]*|--all|--include|--only)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
-    PREV=""; SEEN=""
-    for T in $SEG; do   # (unquoted on purpose: the walker already removed every quote)
+    SEEN=""; WANT=""
+    for T in $SEG; do   # (unquoted on purpose: the walker removed every quote and set -f is on)
       if [ -n "$SEEN" ]; then
+        if [ -n "$WANT" ]; then WANT=""; continue; fi   # the value of the previous option, whatever its shape
         case "$T" in
-          -*) ;;
-          *) case "$PREV" in -m|-F|-C|-c|-S|-t|--message|--file|--author|--date|--trailer|--template|--fixup|--squash|--reedit-message|--reuse-message|--cleanup|--gpg-sign) ;; *) HAS_WORKTREE=1 ;; esac ;;
+          -m|-F|-C|-c|-t|--message|--file|--author|--date|--trailer|--template|--fixup|--squash|--reedit-message|--reuse-message|--cleanup) WANT=1 ;;
+          *[\<\>]) WANT=1 ;;                          # `2>` from `2>&1`: the next token is its target, not a pathspec
+          -*|*[\<\>]*) ;;
+          *) HAS_WORKTREE=1 ;;
         esac
       fi
       [ "$T" = commit ] && SEEN=1
-      PREV=$T
     done
   fi
   [ -n "$SEG_COMMIT" ] && IS_COMMIT=1
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index da96f87..14c5735 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -547,6 +547,10 @@ run "env -i -S"                              2 'env -i -S "bash -c '"'"'git push
 run "env -u X -S"                            2 'env -u X -S "bash -c '"'"'git push --force origin main'"'"'"'
 run "env FOO=1 -S"                           2 'env FOO=1 -S "bash -c '"'"'git push --force origin main'"'"'"'
 run "env --split-string"                     2 'env --split-string="bash -c '"'"'git push --force origin main'"'"'"'
+run "env -C dir -S"                          2 'env -C /tmp -S "bash -c '"'"'git push --force origin main'"'"'"'
+run "ksh93 -c wrapper"                       2 'ksh93 -c "git push --force origin main"'
+run "bash5 -c wrapper"                       2 'bash5 -c "git push --force origin main"'
+run_raw "control byte in the command is refused" 2 '{"tool_input":{"command":"git commit -m x'"$BS"'u0001 --no-verify"}}'
 run "env with an assignment then a signed commit" 0 'env GIT_EDITOR=true git commit -S -m x'
 run "shebang write then commit is allowed"   0 'echo '"'"'#!/bin/bash'"'"' > run.sh && git add run.sh && git commit -m x'
 run "SHELL assignment then commit is allowed" 0 'export SHELL=/bin/zsh && git commit -m x'
@@ -650,6 +654,18 @@ run "dirty tracked secret, 2>&1 then --all"  2 'git commit -m x 2>&1 --all'
 run "dirty tracked secret, escaped ; then -a" 2 'git commit -m x\;y -a'
 run "dirty tracked secret, extension-less pathspec" 2 'git commit -m "x" tracked'
 run "dirty tracked secret, -m value is not a pathspec" 0 'git commit -m fix'
+run "dirty tracked secret, two-word message then pathspec" 2 'git commit -m "fix: two words" tracked.txt'
+run "dirty tracked secret, multi-line message then pathspec" 2 'git commit -m "$(cat <<'"'"'EOF'"'"'
+fix: x
+
+body
+EOF
+)" tracked.txt'
+run "dirty tracked secret, -S then pathspec" 2 'git commit -S tracked.txt -m x'
+run "dirty tracked secret, --gpg-sign then pathspec" 2 'git commit --gpg-sign tracked.txt -m x'
+run "dirty tracked secret, -m -F then pathspec" 2 'git commit -m -F tracked.txt'
+run "dirty tracked secret, plain commit with 2>&1" 0 'git commit -m x 2>&1'
+run "dirty tracked secret, plain commit to /dev/null" 0 'git commit -m x >/dev/null 2>&1'
 run "dirty tracked secret, add && commit"    2 'git add tracked.txt && git commit -m "x"'
 git checkout -q -- tracked.txt
 

From b6c768042ac2022057d2a7f66966804aea641f68 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 08:44:23 +0100
Subject: [PATCH 20/39] fix(hooks): subscripts are text, expansions leave a
 mark, run-time patterns and identity overrides are checked

An array subscript inside an expansion or arithmetic (${a[1|2]}) was
treated as a test bracket, so its `|` or `&` split the command where
bash does not; the pieces then dodged every per-segment check. The walk
now opens a subscript frame there, whose separators are text.

A word holding an expansion may be nothing at all when bash runs it, so
`bash $a -c "..."` was not seen as a wrapper. The walk now leaves a `$`
(or backtick) in every such word and the wrapper rule steps over them.

An unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push is expanded at
run time into words the walk never sees (`-*` with a file named
`--no-verify`; `--{force,}`), so it is refused; a quoted or escaped one
is data.

The committer check read only the repo config. It now also reads an
override on the command itself: -c user.name=, GIT_COMMITTER_NAME=,
GIT_AUTHOR_NAME=, and --author.

The two secrets greps take their pattern through -e like the rest.
---
 hooks/guard-commit.sh            | 52 +++++++++++++++++++++-----------
 tests/hooks/test-guard-commit.sh | 34 +++++++++++++++++++++
 2 files changed, 69 insertions(+), 17 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 78c0388..45972a1 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -23,7 +23,10 @@
 # subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a `-n` or `-f` on another
 # command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
 # `--force-if-includes` on its own, `-S<keyid>` with an
-# `n` in the key id, a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
+# `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
+# when the command runs; quote it, or list the files), an expansion between a shell and its
+# option (`bash $a -c`: bash may see nothing there), an unquoted commit message naming a tool
+# after a committer override on the same line, a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
 # numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
@@ -137,7 +140,7 @@ strip_data() {
   # a short quoted fragment is part of its word; a dropped span leaves an empty "" so the
   # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is);
   # an empty pair (`commi""t`) is nothing, as in bash
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|]/) o = o qb; else if (qbad || qb != "") o = o "\"\"" }
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{]/) o = o qb; else if (qbad || qb != "") o = o "\"\"" }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
@@ -185,10 +188,10 @@ strip_data() {
         i++; continue
       }
       top = (depth > 0) ? kind[depth] : ""
-      noheredoc = (top == "((" || top == "$((" || top == "[" || top == "$[" || top == "(a" || top == "${")
+      noheredoc = (top == "((" || top == "$((" || top == "[" || top == "[s" || top == "$[" || top == "(a" || top == "${")
       if (ch == "\\") {                       # `\-f` is `-f`; an escaped separator is text, never a boundary
         if (i == n) { cont = 1; i++; continue }
-        o = o ((c[i + 1] ~ /[;&|]/) ? " " : c[i + 1]); i += 2; continue
+        o = o ((c[i + 1] ~ /[;&|]/) ? " " : (c[i + 1] ~ /[*?\[{]/) ? "\"\"" : c[i + 1]); i += 2; continue
       }
       if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; i += 2; continue }
       if (ch == "\047") { q = 1; qb = ""; qbad = 0; i++; continue }
@@ -201,7 +204,7 @@ strip_data() {
       # `&` in `2>&1` `>&` `&>` `<&-` and `|` in `>|` belong to a redirection operator, not a boundary
       if ((ch == "&" && (c[i - 1] == "<" || c[i - 1] == ">" || c[i + 1] == ">")) || (ch == "|" && c[i - 1] == ">")) { o = o " "; i++; continue }
       if (ch == ";" || ch == "&" || ch == "|") {
-        if (top == "${" || top == "((" || top == "$((" || top == "(a" || top == "$[") { o = o " "; i++; continue }
+        if (top == "${" || top == "((" || top == "$((" || top == "(a" || top == "$[" || top == "[s") { o = o " "; i++; continue }
         # inside `$(...)` a separator ends a command OF THE SUBSTITUTION, never the enclosing one
         # (`git push origin "$(a | b)" --force` is one push): a space keeps the flag with its git
         if (insubst()) { droptests(); cmdpos = 1; o = o " "; i++; continue }
@@ -210,19 +213,21 @@ strip_data() {
       if (ch == "{" || ch == "!") { cmdpos = 1; o = o ch; i++; continue }
       if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("$((", 0); o = o " "; i += 3; continue }
       if (ch == "$" && c[i + 1] == "[") { push("$[", 0); o = o " "; i += 2; continue }
-      if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " "; i += 2; continue }
+      if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " $"; i += 2; continue }   # the `$` marks a word that may expand to nothing
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$( "; i += 2; continue }
-      if (ch == "[") { push("[", 0); o = o " "; i++; continue }
+      # `[` in code opens a test bracket; inside an expansion or arithmetic it is an array subscript
+      # (`${a[1|2]}`), whose `|` and `&` are text, never a command boundary
+      if (ch == "[") { push((noheredoc && top != "[") ? "[s" : "[", 0); o = o " "; i++; continue }
       if ((ch == "<" || ch == ">") && c[i + 1] == "(") { push("<(", 0); o = o ch " "; i += 2; continue }   # process substitution: a word
       if (ch == "(" && noheredoc && top != "${") { push("(a", 0); o = o " "; i++; continue }
       if (ch == "(" && c[i + 1] == "(") { push("((", 0); o = o " "; i += 2; continue }
       if (ch == "(") { push("(", 0); o = o "( "; i++; continue }
       if (ch == ")" && c[i + 1] == ")" && (top == "((" || top == "$((")) { pop(); poppos = i + 1; o = o " "; i += 2; continue }
       if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
-      if (ch == "]" && (top == "[" || top == "$[")) { pop(); o = o " "; i++; continue }
+      if (ch == "]" && (top == "[" || top == "[s" || top == "$[")) { pop(); o = o " "; i++; continue }
       if (ch == "}" && top == "${") { pop(); o = o " "; i++; continue }
       if (ch == ")") {
-        if (top == "[" || top == "${") {         # a frame `)` cannot close: unwind to the `(` it does close
+        if (top == "[" || top == "[s" || top == "${") {   # a frame `)` cannot close: unwind to the `(` it does close
           while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "<(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--   # drops [ $[ ${ (a
           top = (depth > 0) ? kind[depth] : ""
         }
@@ -231,8 +236,8 @@ strip_data() {
         o = o ch " "; i++; continue
       }
       if (ch == "`") {
-        if (top == "`") pop(); else push("`", 0)
-        o = o " "; i++; continue
+        if (top == "`") { pop(); o = o " " } else { push("`", 0); o = o " `" }   # the backtick marks a word that may expand to nothing
+        i++; continue
       }
       if (ch == "<" && c[i + 1] == "<" && c[i + 2] != "<" && (i == 1 || c[i - 1] != "<") && !noheredoc) {
         j = i + 2; dash = 0
@@ -321,9 +326,10 @@ fi
 # own call, is always available to the agent.
 SHW='(^|[[:space:]()])([^[:space:]#!=]*/)?(ba|z|da|k|c|tc|fi|a|mk|ya)?sh[0-9]*'   # a shell, by name or path (`ksh93`, `bash5` too); `#!/bin/bash` and `x=/bin/sh` are not commands
 RD='([[:space:]]*[0-9]*[<>]+[[:space:]]*[^[:space:]<>]*)*'                          # redirection words are not arguments
-ENVOPT='([[:space:]]+(-[uCPa][[:space:]]+[^[:space:]]+|--(unset|chdir|argv0)[[:space:]]+[^[:space:]]+|-[A-Za-z]*|--[A-Za-z-]+(=[^[:space:]]*)?|[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*))*'
+XW='([[:space:]]+([^[:space:]]*[$`][^[:space:]]*|\$\(.*\)))*'                        # words holding an expansion may be nothing at all (`bash $a -c`, `sh $(:) -c`)
+ENVOPT='([[:space:]]+(-[uCPa][[:space:]]+[^[:space:]]+|--(unset|chdir|argv0)[[:space:]]+[^[:space:]]+|-[A-Za-z]*|--[A-Za-z-]+(=[^[:space:]]*)?|[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*|[^[:space:]]*[$`][^[:space:]]*))*'
 # every alternative supplies its own right boundary, so `shasum`, `shellcheck`, `bashful` never match
-WRAPPER="${SHW}${RD}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}${RD}[[:space:]]+-|${SHW}[[:space:]]*[0-9]*<|${SHW}[[:space:]].*<|(^|[[:space:]()])(eval|trap)([[:space:]]|\$)|(^|[[:space:]()])(source|\.)[[:space:]].*<|(^|[[:space:]()])env${ENVOPT}[[:space:]]+(-[A-Za-z]*S|--split-string)"
+WRAPPER="${SHW}${RD}${XW}${RD}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}${RD}${XW}${RD}[[:space:]]+-|${SHW}[[:space:]]*[0-9]*<|${SHW}[[:space:]].*<|(^|[[:space:]()])(eval|trap)([[:space:]]|\$)|(^|[[:space:]()])(source|\.)[[:space:]].*<|(^|[[:space:]()])env${ENVOPT}[[:space:]]+(-[A-Za-z]*S|--split-string)"
 
 # An alias defined in the same call renames a subcommand out of reach of every check below
 # (`git -c alias.fp=push fp --force`; the `-c` value is quoted data, so the raw command is read too).
@@ -341,6 +347,11 @@ while IFS= read -r SEG; do
   has 'git.*[[:space:]]commit([^[:alnum:]]|$)' "$SEG" && SEG_COMMIT=1
   has 'git.*[[:space:]]push([^[:alnum:]]|$)' "$SEG" && SEG_PUSH=1
   has 'git.*[[:space:]]add([^[:alnum:]]|$)' "$SEG" && HAS_ADD=1
+  # an unquoted `*`, `?`, `[`, or `{a,b}` is expanded by bash when the command runs, into words this
+  # walk never sees (`-*` with a file named `--no-verify` in the directory; `--{force,}`)
+  if [ -n "$SEG_COMMIT$SEG_PUSH" ] && hasc '[*?[]|\{[^[:space:]{}]*(,|\.\.)[^[:space:]{}]*\}' "$SEG"; then
+    echo "Blocked: an unquoted *, ?, [, or {a,b} pattern in a git commit/push is expanded when it runs, so it cannot be inspected. Quote it, or list the files." >&2; exit 2
+  fi
   # a commit with -a/-i/-o, or any bare token after the subcommand that is not the value of a
   # message-like option, commits working-tree content, not just the index: scan it
   if [ -n "$SEG_COMMIT" ]; then
@@ -392,12 +403,19 @@ fi
 # only inspect commit operations further
 [ -z "$IS_COMMIT" ] && exit 0
 
-# committer must be a human — match whole tokens / known bot identities, not substrings
+# committer must be a human — match whole tokens / known bot identities, not substrings.
+# The identity is the repo config, or an override on the command itself (`-c user.name=`,
+# `GIT_COMMITTER_NAME=`, `GIT_AUTHOR_NAME=`, `--author`); the override's value runs to its closing
+# quote, or to the end of the line when it is unquoted.
+IDENT='(claude|chatgpt|copilot|cursor|cursoragent|github-actions|assistant|bot|ai[-_ ]?(agent|assistant|bot))'
 NAME=$(git config user.name 2>/dev/null || echo "")
-if has '(^|[^[:alnum:]])(claude|chatgpt|copilot|cursor|cursoragent|github-actions|assistant|bot|ai[-_ ]?(agent|assistant|bot))([^[:alnum:]]|$)' "$NAME"; then
+if has "(^|[^[:alnum:]])${IDENT}([^[:alnum:]]|\$)" "$NAME"; then
   SAFE_NAME=$(tr -d '\n\r' <<<"$NAME" | cut -c1-40)   # repo-controlled text: one line, short, before it reaches the model
   echo "Blocked: git user.name '$SAFE_NAME' is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
+if has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}([^[:alnum:]]|\$)" "$CMD"; then
+  echo "Blocked: the commit sets a committer or author that is not a human (CLAUDE.md §2)." >&2; exit 2
+fi
 
 # no AI attribution in the commit message — scan the command only, not the staged diff.
 # (This is a repo *about* Claude Code; legit messages will say "Claude Code". Only
@@ -433,7 +451,7 @@ if [ -n "$HAS_ADD" ]; then
       case "$f" in *.example|*.sample|*.dist|*.tmpl) continue ;; esac   # (a whole-name match: a newline in the name cannot fool it)
       [ -L "$f" ] && continue                # git stores a symlink's target text, never the target
       [ -f "$f" ] || continue
-      grep -saE -i "$SECRETS" -- "$f" | sed 's/^/>/'   # -a: a NUL byte must not make grep skip the file
+      grep -saE -i -e "$SECRETS" -- "$f" | sed 's/^/>/'   # -a: a NUL byte must not make grep skip the file
       [ "${PIPESTATUS[0]}" -gt 1 ] && printf '>GUARD_SCAN_FAILED %s\n' "$f"
     done
     [ "${PIPESTATUS[0]}" -eq 0 ] || printf '>GUARD_SCAN_FAILED ls-files\n'
@@ -447,7 +465,7 @@ if [ ${#DIFF} -gt 16777216 ]; then
 fi
 # Only ADDED lines (`>`) count: removing a leaked secret from a file must stay committable
 # (§11: rotate, then scrub). One grep, no `-q`, so it reads everything; 1 = clean.
-grep -iE "^>.*($SECRETS)" <<<"$DIFF" >/dev/null
+grep -iE -e "^>.*($SECRETS)" <<<"$DIFF" >/dev/null
 case $? in
   0) echo "Blocked: a secret appears to be staged (CLAUDE.md §11). Unstage it." >&2; exit 2 ;;
   1) ;;
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 14c5735..b24a7b8 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -550,6 +550,40 @@ run "env --split-string"                     2 'env --split-string="bash -c '"'"
 run "env -C dir -S"                          2 'env -C /tmp -S "bash -c '"'"'git push --force origin main'"'"'"'
 run "ksh93 -c wrapper"                       2 'ksh93 -c "git push --force origin main"'
 run "bash5 -c wrapper"                       2 'bash5 -c "git push --force origin main"'
+run "bash \$a -c wrapper"                    2 'bash $a -c "git push --force origin main"'
+run "bash \${a} -c wrapper"                  2 'bash ${a} -c "git push --force origin main"'
+run "bash \"\$a\" -c wrapper"                2 'bash "$a" -c "git push --force origin main"'
+run "sh \$(:) -c wrapper"                    2 'sh $(:) -c "git push --force origin main"'
+run "sh backtick -c wrapper"                 2 'sh `:` -c "git push --force origin main"'
+run "env \${a} -S wrapper"                   2 'env ${a} -S "bash -c '"'"'git push --force origin main'"'"'"'
+run "pipe into bash \$a"                     2 'echo "git push --force origin main" | bash $a'
+run "push with an array subscript pipe"      2 'git push origin main ${a[1|2]} --force'
+run "push with an array subscript ampersand" 2 'git push origin main ${a[1&2]} --force'
+run "push with a quoted array subscript"     2 'git push origin main "${a[1|2]}" --force'
+run "push with an arithmetic subscript"      2 'git push origin main $((a[1|2])) --force'
+run "push with a nested subscript"           2 'git push origin main ${a[${b[1|2]}]} --force'
+run "commit with a subscript then --no-verify" 2 'git commit ${a[1|2]} --no-verify -m x'
+run "subscript between git and commit, bad committer" 2 'git -c user.name=Claude ${a[1|2]} commit -m x'
+run "-c user.name override to a bot"          2 'git -c user.name=Claude commit -m x'
+run "-c user.name override, quoted two words" 2 'git -c user.name="Claude Bot" commit -m x'
+run "GIT_COMMITTER_NAME override to a bot"    2 'GIT_COMMITTER_NAME=Claude git commit -m x'
+run "GIT_AUTHOR_NAME override to a bot"       2 'GIT_AUTHOR_NAME=Cursor git commit -m x'
+run "--author override to a bot"              2 'git commit --author="Claude <c@example.com>" -m x'
+run "--author space form to a bot"            2 'git commit --author "github-actions <a@b>" -m x'
+run "-c user.name override to a human"        0 'git -c user.name="Dennis Vorobyov" commit -m "docs: Claude Code hooks"'
+run "GIT_COMMITTER_NAME human then a quoted message naming a tool" 0 'GIT_COMMITTER_NAME=Dennis git commit -m "docs: Claude Code hooks"'
+run "--author human with a tool in the message" 0 'git commit --author="Dennis V <d@example.com>" -m "explain Claude Code"'
+run "test bracket then push -f still blocks" 2 '[ -f x ] && git push -f origin main'
+run "double bracket then push -f still blocks" 2 '[[ -n x && -n y ]] && git push -f origin main'
+run "commit with an unquoted glob flag"      2 'git commit -m x -*'
+run "commit with an unquoted ? word"         2 'git commit -m x ?'
+run "push with a brace-expanded flag"        2 'git push origin main --{force,}'
+run "push with a brace range"                2 'git push origin main --{f..f}'
+run "quoted * message is allowed"            0 'git commit -m "*"'
+run "quoted brace message is allowed"        0 'git commit -m "fix {a,b}"'
+run "escaped * message is allowed"           0 'git commit -m \*'
+run "brace group around a plain push"        0 '{ git push origin feat/x; }'
+run "git add * in its own segment then commit" 0 'git add * && git commit -m x'
 run_raw "control byte in the command is refused" 2 '{"tool_input":{"command":"git commit -m x'"$BS"'u0001 --no-verify"}}'
 run "env with an assignment then a signed commit" 0 'env GIT_EDITOR=true git commit -S -m x'
 run "shebang write then commit is allowed"   0 'echo '"'"'#!/bin/bash'"'"' > run.sh && git add run.sh && git commit -m x'

From 192a225e6b8d1ecec2429632d05349ecd7356ff1 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 08:45:34 +0100
Subject: [PATCH 21/39] docs: say the guard strips data before checking and
 refuses what it cannot classify; note the git 2.28 floor

---
 README.md | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/README.md b/README.md
index b29cac8..f1f7e67 100644
--- a/README.md
+++ b/README.md
@@ -6,20 +6,20 @@ Most people publish a single `CLAUDE.md` and call it a setup. The thing that act
 
 ## What's inside
 
-| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                        |
-| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                      |
-| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                     |
-| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                  |
-| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                |
-| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
-| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                   |
-| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                          |
-| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                       |
-| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                          |
-| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                      |
-| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                              |
-| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                    |
+| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                                                                                                                                                                                                                                                                                                                            |
+| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. Quoted text, heredoc bodies, substitutions, and arithmetic are stripped as data first, so a commit message or a file body that merely mentions a blocked flag never trips it; a shape the check cannot classify (a shell wrapper, an expansion that may become a flag) is refused rather than guessed. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
+| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 
 ## The idea in one paragraph
 
@@ -27,7 +27,7 @@ Two tiers. The **global** tier (`~/.claude/CLAUDE.md` + `rules/` + `agents/` + `
 
 ## Install
 
-Mac/Linux, with Claude Code already installed. Full steps and the per-repo install are in [`STRUCTURE.md`](./STRUCTURE.md). First install the hook prerequisite `jq` (`guard-commit.sh` fails closed without it): `brew install jq` (macOS) / `sudo apt-get install jq` (Debian/Ubuntu). Then:
+Mac/Linux, with Claude Code already installed. Full steps and the per-repo install are in [`STRUCTURE.md`](./STRUCTURE.md). First install the hook prerequisite `jq` (`guard-commit.sh` fails closed without it): `brew install jq` (macOS) / `sudo apt-get install jq` (Debian/Ubuntu); the guard also needs git 2.28 or newer. Then:
 
 ```bash
 git clone https://github.com/roadhero/claude-code-setup.git && cd claude-code-setup

From 18324934b8d0fe1ba0c06e7b35fe103a8e3752d0 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 09:02:36 +0100
Subject: [PATCH 22/39] fix(hooks): a ${...} word is its `$`; `)` inside it is
 text; `[` outside command position is a pattern

A `)` inside `${...}` unwound the frame without restoring the quote it
was opened in, so `: "${x:-)}" ; git push -f origin main #"` hid the
push as quoted data. Inside `${...}` a `)` is now text, the unwind
refuses to drop a frame opened in a quote, and a `${ cmd; }` or a
substitution inside `${...}` is refused rather than guessed.

The interior of a `${...}` word is dropped and a lone `$` stands for it,
in code and in double quotes, so `bash ${a[@]} -c`, `bash "${@}" -c`,
and `bash `echo` -c` are seen as wrappers, and `${BRANCH##*/}` no longer
trips the pattern refusal. A dropped quoted span that held a
substitution leaves `"$"`, for the same reason.

A `[` opens a test bracket only where a command starts; glued to a word
it is a subscript, and anywhere else it is a pattern character, so
`-[n]` is refused like `-*`.

The committer override check reads the stripped text as well as the raw
one (`user.name=Cla'ude'`, `$'Claude'`) and no longer fires on a quoted
message that mentions `user.name=`. Config passed through the
environment (`--config-env`, `GIT_CONFIG_*`) in a commit call is refused.
A short cluster ending in an option that takes a value (`-qm fix`) no
longer makes the value a pathspec; parentheses and angle brackets are
no longer glued back into a word.
---
 hooks/guard-commit.sh            | 70 +++++++++++++++++++++++---------
 tests/hooks/test-guard-commit.sh | 41 +++++++++++++++++--
 2 files changed, 89 insertions(+), 22 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 45972a1..a3f9bdf 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -17,16 +17,17 @@
 # program is data to this walk. Known false blocks (safe direction): a shell wrapper anywhere in
 # the same call as a plain commit or push (`git commit -m x && bash -c "echo done"`,
 # `bash -x build.sh && git commit -m x`, `which bash && git commit -m x`, `git add zsh bash fish`
-# in a dotfiles repo), `source`/`.` of a process substitution, any alias definition in the same
-# call as a commit or push (`git config alias.st status; git commit`), a
-# one-word quoted argument that spells a flag or
-# subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a `-n` or `-f` on another
+# in a dotfiles repo), `source`/`.` of a process substitution, any mention of `alias.` outside quotes
+# in the same call as a commit or push (`git config alias.st status; git commit`, `git commit -m x
+# alias.md`), a substitution inside `${...}` (`${v:-$(git describe)}`), a one-word quoted argument
+# that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a quoted
+# identity inside a message (`-m "set user.name='claude'"`), a `-n` or `-f` on another
 # command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
 # `--force-if-includes` on its own, `-S<keyid>` with an
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
-# option (`bash $a -c`: bash may see nothing there), an unquoted commit message naming a tool
-# after a committer override on the same line, a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
+# option (`bash $a -c`: bash may see nothing there), git config passed through the environment in
+# a commit call (`--config-env`, `GIT_CONFIG_*`), a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
 # numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
@@ -126,8 +127,11 @@ fi
 strip_data() {
   awk '
   # q: 0 code, 1 single quotes, 2 double quotes, 3 $'"'"'...'"'"', 4 unquoted heredoc body, 5 quoted heredoc body
-  # kind[]: "(" subshell, "$(" substitution, "`", "((" arithmetic command, "$((" arithmetic expansion,
-  #         "(a" paren inside arithmetic, "[" subscript/test, "${" parameter expansion. save[]: the q to restore on pop.
+  # kind[]: "(" subshell, "$(" substitution, "`", "<(" process substitution, "((" arithmetic command,
+  #         "$((" arithmetic expansion, "(a" paren inside arithmetic, "[" test bracket, "[s" array
+  #         subscript, "${" parameter expansion. save[]: the q to restore on pop.
+  # A `${...}` is one word whose text bash may replace with nothing at all, so its interior is
+  # dropped and a lone `$` stands for it (`${a[@]}` is `$`); a substitution inside it is refused.
   function push(k, sq) { kind[++depth] = k; save[depth] = sq; casec[depth] = 0; pendat[depth] = npend; pushnr[depth] = NR; pushpos[depth] = i; cmdpos = 1 }
   function pop() {
     if (npend > pendat[depth]) refuse("a heredoc marker inside a substitution that closes on the same line")
@@ -140,10 +144,11 @@ strip_data() {
   # a short quoted fragment is part of its word; a dropped span leaves an empty "" so the
   # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is);
   # an empty pair (`commi""t`) is nothing, as in bash
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{]/) o = o qb; else if (qbad || qb != "") o = o "\"\"" }
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>]/) o = o qb; else if (qbad) o = o "\"$\""; else if (qb != "") o = o "\"\"" }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
+  function inbrace(   k) { for (k = depth; k > 0; k--) if (kind[k] == "${") return 1; return 0 }   # inside a `${...}` word
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1; kwlead = 0 }
   {
     line = $0
@@ -164,6 +169,7 @@ strip_data() {
     }
     n = split(line, c, "")
     o = ""
+    bmark = 0                                  # where the current `${...}` word began on this line
     i = 1
     poppos = -1
     joined = cont; cont = 0                    # this line continues the previous one: no word starts at column 1
@@ -182,8 +188,11 @@ strip_data() {
         if (q == 2 && ch == "\"") { q = 0; closeq(); i++; continue }
         if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { qbad = 1; push("$((", q); q = 0; o = o " "; i += 3; continue }
         if (ch == "$" && c[i + 1] == "(") { qbad = 1; push("$(", q); q = 0; o = o "$( "; i += 2; continue }
-        if (ch == "$" && c[i + 1] == "{") { qbad = 1; push("${", q); q = 0; o = o " "; i += 2; continue }
-        if (ch == "`") { qbad = 1; push("`", q); q = 0; o = o " "; i++; continue }
+        if (ch == "$" && c[i + 1] == "{") {
+          if (c[i + 2] ~ /[ \t|]/) refuse("a ${ command; } substitution")
+          outer = !inbrace(); qbad = 1; push("${", q); q = 0; o = o " $"; if (outer) bmark = length(o); i += 2; continue
+        }
+        if (ch == "`") { qbad = 1; push("`", q); q = 0; o = o " `"; i++; continue }
         if (q == 2) qb = qb ch
         i++; continue
       }
@@ -211,13 +220,23 @@ strip_data() {
         droptests(); cmdpos = 1; o = o "\001"; i++; continue   # a REAL boundary: a byte no command contains
       }
       if (ch == "{" || ch == "!") { cmdpos = 1; o = o ch; i++; continue }
+      if (inbrace() && ((ch == "$" && c[i + 1] == "(") || ch == "`")) refuse("a substitution inside ${...}")
       if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { push("$((", 0); o = o " "; i += 3; continue }
       if (ch == "$" && c[i + 1] == "[") { push("$[", 0); o = o " "; i += 2; continue }
-      if (ch == "$" && c[i + 1] == "{") { push("${", 0); o = o " $"; i += 2; continue }   # the `$` marks a word that may expand to nothing
+      if (ch == "$" && c[i + 1] == "{") {                  # the `$` stands for the whole word, which may expand to nothing
+        if (c[i + 2] ~ /[ \t|]/) refuse("a ${ command; } substitution")
+        outer = !inbrace(); push("${", 0); o = o " $"; if (outer) bmark = length(o); i += 2; continue
+      }
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$( "; i += 2; continue }
       # `[` in code opens a test bracket; inside an expansion or arithmetic it is an array subscript
       # (`${a[1|2]}`), whose `|` and `&` are text, never a command boundary
-      if (ch == "[") { push((noheredoc && top != "[") ? "[s" : "[", 0); o = o " "; i++; continue }
+      if (ch == "[") {
+        if (noheredoc && top != "[") { push("[s", 0); o = o " " }
+        else if (cmdpos) { push("[", 0); o = o " " }
+        else if (c[i - 1] ~ /[A-Za-z0-9_]/) { push("[s", 0); o = o ch }   # `a[1<<2]=1`: a subscript, its `<<` a shift; kept visible as a pattern too
+        else o = o ch                         # `-[n]` is a pattern bash expands when it runs
+        i++; continue
+      }
       if ((ch == "<" || ch == ">") && c[i + 1] == "(") { push("<(", 0); o = o ch " "; i += 2; continue }   # process substitution: a word
       if (ch == "(" && noheredoc && top != "${") { push("(a", 0); o = o " "; i++; continue }
       if (ch == "(" && c[i + 1] == "(") { push("((", 0); o = o " "; i += 2; continue }
@@ -225,10 +244,14 @@ strip_data() {
       if (ch == ")" && c[i + 1] == ")" && (top == "((" || top == "$((")) { pop(); poppos = i + 1; o = o " "; i += 2; continue }
       if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
       if (ch == "]" && (top == "[" || top == "[s" || top == "$[")) { pop(); o = o " "; i++; continue }
-      if (ch == "}" && top == "${") { pop(); o = o " "; i++; continue }
+      if (ch == "}" && top == "${") { pop(); if (!inbrace()) o = substr(o, 1, bmark) " "; i++; continue }   # the word is its `$`
+      if (ch == ")" && inbrace()) { o = o ch; i++; continue }   # text inside `${...}`, like `;` `&` `|`
       if (ch == ")") {
-        if (top == "[" || top == "[s" || top == "${") {   # a frame `)` cannot close: unwind to the `(` it does close
-          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "<(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") depth--   # drops [ $[ ${ (a
+        if (top == "[" || top == "[s") {         # a frame `)` cannot close: unwind to the `(` it does close
+          while (depth > 0 && kind[depth] != "(" && kind[depth] != "$(" && kind[depth] != "<(" && kind[depth] != "`" && kind[depth] != "((" && kind[depth] != "$((") {
+            if (save[depth]) refuse("a `)` that unwinds a frame opened inside a quoted string")
+            depth--                            # drops [ [s $[ (a
+          }
           top = (depth > 0) ? kind[depth] : ""
         }
         if (casec[depth] > 0) { o = o ch " "; i++; cmdpos = 1; continue }   # a case pattern terminator
@@ -236,7 +259,7 @@ strip_data() {
         o = o ch " "; i++; continue
       }
       if (ch == "`") {
-        if (top == "`") { pop(); o = o " " } else { push("`", 0); o = o " `" }   # the backtick marks a word that may expand to nothing
+        if (top == "`") { pop(); o = o "` " } else { push("`", 0); o = o " `" }   # the backticks mark a word that may expand to nothing
         i++; continue
       }
       if (ch == "<" && c[i + 1] == "<" && c[i + 2] != "<" && (i == 1 || c[i - 1] != "<") && !noheredoc) {
@@ -326,7 +349,8 @@ fi
 # own call, is always available to the agent.
 SHW='(^|[[:space:]()])([^[:space:]#!=]*/)?(ba|z|da|k|c|tc|fi|a|mk|ya)?sh[0-9]*'   # a shell, by name or path (`ksh93`, `bash5` too); `#!/bin/bash` and `x=/bin/sh` are not commands
 RD='([[:space:]]*[0-9]*[<>]+[[:space:]]*[^[:space:]<>]*)*'                          # redirection words are not arguments
-XW='([[:space:]]+([^[:space:]]*[$`][^[:space:]]*|\$\(.*\)))*'                        # words holding an expansion may be nothing at all (`bash $a -c`, `sh $(:) -c`)
+# shellcheck disable=SC2016  # the backtick is a literal in the pattern
+XW='([[:space:]]+([^[:space:]]*[$`][^[:space:]]*|\$\(.*\)|`.*`))*'                   # words holding an expansion may be nothing at all (`bash $a -c`, `sh $(:) -c`)
 ENVOPT='([[:space:]]+(-[uCPa][[:space:]]+[^[:space:]]+|--(unset|chdir|argv0)[[:space:]]+[^[:space:]]+|-[A-Za-z]*|--[A-Za-z-]+(=[^[:space:]]*)?|[A-Za-z_][A-Za-z0-9_]*=[^[:space:]]*|[^[:space:]]*[$`][^[:space:]]*))*'
 # every alternative supplies its own right boundary, so `shasum`, `shellcheck`, `bashful` never match
 WRAPPER="${SHW}${RD}${XW}${RD}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}${RD}${XW}${RD}[[:space:]]+-|${SHW}[[:space:]]*[0-9]*<|${SHW}[[:space:]].*<|(^|[[:space:]()])(eval|trap)([[:space:]]|\$)|(^|[[:space:]()])(source|\.)[[:space:]].*<|(^|[[:space:]()])env${ENVOPT}[[:space:]]+(-[A-Za-z]*S|--split-string)"
@@ -362,6 +386,7 @@ while IFS= read -r SEG; do
         if [ -n "$WANT" ]; then WANT=""; continue; fi   # the value of the previous option, whatever its shape
         case "$T" in
           -m|-F|-C|-c|-t|--message|--file|--author|--date|--trailer|--template|--fixup|--squash|--reedit-message|--reuse-message|--cleanup) WANT=1 ;;
+          -[A-Za-z]*[mFCct]) WANT=1 ;;                 # `-qm fix`: the cluster ends in an option that takes the next word
           *[\<\>]) WANT=1 ;;                          # `2>` from `2>&1`: the next token is its target, not a pathspec
           -*|*[\<\>]*) ;;
           *) HAS_WORKTREE=1 ;;
@@ -413,9 +438,16 @@ if has "(^|[^[:alnum:]])${IDENT}([^[:alnum:]]|\$)" "$NAME"; then
   SAFE_NAME=$(tr -d '\n\r' <<<"$NAME" | cut -c1-40)   # repo-controlled text: one line, short, before it reaches the model
   echo "Blocked: git user.name '$SAFE_NAME' is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
-if has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}([^[:alnum:]]|\$)" "$CMD"; then
+# The stripped text has the unquoted forms with every quote splice undone (`user.name=Cla'ude'`); the
+# raw text has the quoted values (`--author="Claude Bot <...>"`), whose closing quote bounds them.
+if has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])([^[:space:]]*[^[:alnum:][:space:]])?${IDENT}([^[:alnum:]]|\$)" "$STRIPPED" ||
+   has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])[\"']([^\"']*[^[:alnum:]\"'])?${IDENT}([^[:alnum:]]|\$)" "$CMD"; then
   echo "Blocked: the commit sets a committer or author that is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
+# git can also take config from the environment, where the value is out of this check's sight
+if has '--config-env|GIT_CONFIG_(COUNT|KEY_[0-9]+|VALUE_[0-9]+|PARAMETERS)=' "$STRIPPED"; then
+  echo "Blocked: git config passed through the environment (--config-env, GIT_CONFIG_*) in the same call as a commit cannot be inspected. Set it with -c or in the repo config." >&2; exit 2
+fi
 
 # no AI attribution in the commit message — scan the command only, not the staged diff.
 # (This is a repo *about* Claude Code; legit messages will say "Claude Code". Only
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index b24a7b8..4e7753e 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -584,6 +584,38 @@ run "quoted brace message is allowed"        0 'git commit -m "fix {a,b}"'
 run "escaped * message is allowed"           0 'git commit -m \*'
 run "brace group around a plain push"        0 '{ git push origin feat/x; }'
 run "git add * in its own segment then commit" 0 'git add * && git commit -m x'
+run "commit with a bracket pattern flag"     2 'git commit -m x -[n]'
+run "push with a bracket pattern flag"       2 'git push origin main -[f]'
+run "commit with a word-glued bracket pattern" 2 'git commit -m x f[ab]'
+run "array assignment then a plain commit"   0 'a[1]=x; git commit -m y'
+run ") inside a quoted default then push -f" 2 ': "${x:-)}" ; git push -f origin main #"'
+run ") inside a quoted replacement then --no-verify" 2 ': "${x/)/y}" ; git commit --no-verify -m x #"'
+run ") inside a default, echo form"          2 'echo "${x:-)}"; git push origin main --force; echo "x <<EOF
+more text"'
+run ") inside an unquoted default in a push" 2 'git push origin main ${a:-)} --force'
+run "bash \${a[@]} -c wrapper"               2 'bash ${a[@]} -c "git push --force origin main"'
+run "bash \${a[0]} -c wrapper"               2 'bash ${a[0]} -c "git push --force origin main"'
+run "bash \"\${a[@]}\" -c wrapper"           2 'bash "${a[@]}" -c "git push --force origin main"'
+run "bash \"\${@}\" -c wrapper"              2 'bash "${@}" -c "git push --force origin main"'
+run "bash \"backtick\" -c wrapper"           2 'bash "`:`" -c "git push --force origin main"'
+run "bash backtick echo -c wrapper"          2 'bash `echo` -c "git push --force origin main"'
+run "bash \${a[1 | 2]} -c wrapper"           2 'bash ${a[1 | 2]} -c "git push --force origin main"'
+run "env \${a[@]} -S wrapper"                2 'env ${a[@]} -S "bash -c '"'"'git push --force origin main'"'"'"'
+run "bash 5.3 funsub is refused"             2 '${ git push -f origin main; }'
+run "substitution inside \${ } is refused"   2 'git commit -m "${v:-$(git describe)}"'
+run "push with a quoted \${BRANCH##*/}"      0 'git commit -m "fix" && git push origin "HEAD:refs/heads/${BRANCH##*/}"'
+run "push with an unquoted \${REF##*/}"      0 'git push origin HEAD:${REF##*/}'
+run "push with \${BRANCH:?}"                 0 'git push origin ${BRANCH:?}'
+run "commit then echo \${a[0]}"              0 'git commit -m x && echo "${a[0]}"'
+run "message with parens naming a shell"     0 'git commit -m "fix(bash): x"'
+run "message that is (sh)"                   0 'git commit -m "(sh)"'
+run "quoted message mentioning user.name=claude" 0 'git commit -m "docs: never set user.name=claude"'
+run "quoted message mentioning --author claude" 0 'git commit -m "fix: the --author claude check"'
+run "-c user.name with an ANSI-C spliced bot" 2 'git -c user.name=$'"'"'Claude'"'"' commit -m x'
+run "-c user.name with a quote-spliced bot"  2 'git -c user.name=Cla'"'"'ude'"'"' commit -m x'
+run "--config-env user.name is refused"      2 'UN=ClaudeBot git --config-env=user.name=UN commit -m x'
+run "GIT_CONFIG_KEY user.name is refused"    2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.name GIT_CONFIG_VALUE_0=Claude git commit -m x'
+run "message mentioning --config-env is allowed" 0 'git commit -m "docs: explain --config-env"'
 run_raw "control byte in the command is refused" 2 '{"tool_input":{"command":"git commit -m x'"$BS"'u0001 --no-verify"}}'
 run "env with an assignment then a signed commit" 0 'env GIT_EDITOR=true git commit -S -m x'
 run "shebang write then commit is allowed"   0 'echo '"'"'#!/bin/bash'"'"' > run.sh && git add run.sh && git commit -m x'
@@ -700,6 +732,9 @@ run "dirty tracked secret, --gpg-sign then pathspec" 2 'git commit --gpg-sign tr
 run "dirty tracked secret, -m -F then pathspec" 2 'git commit -m -F tracked.txt'
 run "dirty tracked secret, plain commit with 2>&1" 0 'git commit -m x 2>&1'
 run "dirty tracked secret, plain commit to /dev/null" 0 'git commit -m x >/dev/null 2>&1'
+run "dirty tracked secret, -qm cluster takes a value" 0 'git commit -qm fix'
+run "dirty tracked secret, -sm cluster takes a value" 0 'git commit -sm fix'
+run "dirty tracked secret, quoted a>b is a pathspec" 2 'git commit -m x "a>b"'
 run "dirty tracked secret, add && commit"    2 'git add tracked.txt && git commit -m "x"'
 git checkout -q -- tracked.txt
 
@@ -800,7 +835,7 @@ for t in bash sh grep git sed tr printf cat; do
 done
 run_nojq() {
   printf '%s' "$3" | jq -Rs '{tool_input:{command:.}}' >"$TMP/payload"
-  PATH="$NOJQ" bash "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
+  PATH="$NOJQ" "$BASH" "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
   record "$1" "$2" $? "$3"
 }
 run_nojq "no jq: commit fails closed"        2 'git commit -m "x"'
@@ -814,7 +849,7 @@ for t in bash sh grep git sed tr printf cat jq wc; do
 done
 run_noawk() {
   printf '%s' "$3" | jq -Rs '{tool_input:{command:.}}' >"$TMP/payload"
-  PATH="$NOAWK" bash "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
+  PATH="$NOAWK" "$BASH" "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
   record "$1" "$2" $? "$3"
 }
 run_noawk "no awk: commit fails closed"      2 'git commit -m "x"'
@@ -829,7 +864,7 @@ mktoolbox "$TMP/notr" bash sh grep git sed awk printf cat jq wc
 mktoolbox "$TMP/nowc" bash sh grep git sed awk printf cat jq tr
 run_without() { # run_without <toolbox> <name> <expected-exit> <command>
   printf '%s' "$4" | jq -Rs '{tool_input:{command:.}}' >"$TMP/payload"
-  PATH="$1" bash "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
+  PATH="$1" "$BASH" "$HOOK" <"$TMP/payload" >/dev/null 2>"$TMP/err"
   record "$2" "$3" $? "$4"
 }
 run_without "$TMP/notr" "no tr: push fails closed"      2 'git push --force origin main'

From 90d648a372aa4be3380d1333de19bf30e744d12a Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 09:10:29 +0100
Subject: [PATCH 23/39] fix(hooks): `[` inside ${...} is text; a `}` over an
 open inner frame is refused

A lone `[` in a `${...}` value (`${x:-[}`) opened a subscript frame that
swallowed the word's own `}`, so the word stayed open across real
command separators, and a later `]}` truncated away every command bash
had run in between. Inside `${...}` a `[` is now text, as `)` already
was; a `}` that arrives with a paren or bracket still open inside the
braces is refused rather than absorbed.
---
 hooks/guard-commit.sh            | 2 ++
 tests/hooks/test-guard-commit.sh | 7 +++++++
 2 files changed, 9 insertions(+)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index a3f9bdf..e0893ac 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -230,6 +230,7 @@ strip_data() {
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$( "; i += 2; continue }
       # `[` in code opens a test bracket; inside an expansion or arithmetic it is an array subscript
       # (`${a[1|2]}`), whose `|` and `&` are text, never a command boundary
+      if (ch == "[" && top == "${") { o = o ch; i++; continue }   # text inside `${...}`, like `)`: `${x:-[}` is a value, not a subscript
       if (ch == "[") {
         if (noheredoc && top != "[") { push("[s", 0); o = o " " }
         else if (cmdpos) { push("[", 0); o = o " " }
@@ -245,6 +246,7 @@ strip_data() {
       if (ch == ")" && top == "(a") { pop(); o = o " "; i++; continue }
       if (ch == "]" && (top == "[" || top == "[s" || top == "$[")) { pop(); o = o " "; i++; continue }
       if (ch == "}" && top == "${") { pop(); if (!inbrace()) o = substr(o, 1, bmark) " "; i++; continue }   # the word is its `$`
+      if (ch == "}" && inbrace()) refuse("a `}` with a paren or bracket still open inside ${...}")   # the word must never outlive its `}`
       if (ch == ")" && inbrace()) { o = o ch; i++; continue }   # text inside `${...}`, like `;` `&` `|`
       if (ch == ")") {
         if (top == "[" || top == "[s") {         # a frame `)` cannot close: unwind to the `(` it does close
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 4e7753e..6abe587 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -588,6 +588,13 @@ run "commit with a bracket pattern flag"     2 'git commit -m x -[n]'
 run "push with a bracket pattern flag"       2 'git push origin main -[f]'
 run "commit with a word-glued bracket pattern" 2 'git commit -m x f[ab]'
 run "array assignment then a plain commit"   0 'a[1]=x; git commit -m y'
+run "[ in a brace default then push -f"      2 'echo ${x:-[} ; git push -f origin main ; : ]}'
+run "[ in a brace default then push --force" 2 'echo ${x:-[} && git push --force origin main && : ]}'
+run "[ in a brace replacement then --no-verify" 2 'echo ${x/a/[} ; git commit --no-verify -m x ; : ]}'
+run "[ in a brace default then a bot committer" 2 'git status ${x:-[} ; git -c user.name=Claude commit -m x ; : ]}'
+run "[ in a subscripted brace default then push -f" 2 'echo ${a[0]:-[} ; git push -f origin main ; : ]}'
+run "[] in a brace default then a plain commit" 0 'echo ${x:-[]}; git commit -m x'
+run "( left open inside a brace is refused"  2 'echo ${x:-(} ; git commit -m x'
 run ") inside a quoted default then push -f" 2 ': "${x:-)}" ; git push -f origin main #"'
 run ") inside a quoted replacement then --no-verify" 2 ': "${x/)/y}" ; git commit --no-verify -m x #"'
 run ") inside a default, echo form"          2 'echo "${x:-)}"; git push origin main --force; echo "x <<EOF

From 7642359f8941ab017417d41a5483ab649505a1b7 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 09:15:53 +0100
Subject: [PATCH 24/39] fix(hooks): a ${...} spanning lines emits nothing; case
 patterns end at their `)`; config through the environment is one rule

A `${...}` word spanning lines printed its earlier lines as plain
tokens, so a three-line `bash ${a-` ... `} -c` was not seen as a
wrapper. Every line of such a word is now cut back to the word's mark.

A case pattern's `)` is a command boundary, so the pattern no longer
lands in the next command's segment and trips the pattern refusal.

The pathspec loop skips the words of a `$(...)` or backtick
substitution, a `-S<keyid>` consumes nothing, and a short cluster is
read as value-taking only when its other letters are no-value flags
(`-SDEADBEEF` is a key, not `-F`). A dropped quoted span holding a
substitution emits nothing, since the substitution's own mark is
already there. The `-a/-i/-o` check is case-sensitive.

Config passed through the environment (`--config-env`, `GIT_CONFIG_*`)
is refused by one rule for commits and pushes alike, ahead of the
hooks-path rule, which now names only that key. The quoted path
refuses a substitution inside `${...}` with the same reason as code.
README names what the guard refuses instead of a claim it did not keep.
---
 README.md                        | 28 ++++++++++++-------------
 hooks/guard-commit.sh            | 35 +++++++++++++++++++++-----------
 tests/hooks/test-guard-commit.sh | 24 ++++++++++++++++++++++
 3 files changed, 61 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index f1f7e67..37b2147 100644
--- a/README.md
+++ b/README.md
@@ -6,20 +6,20 @@ Most people publish a single `CLAUDE.md` and call it a setup. The thing that act
 
 ## What's inside
 
-| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                                                                                                                                                                                                                                                                                                                            |
-| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. Quoted text, heredoc bodies, substitutions, and arithmetic are stripped as data first, so a commit message or a file body that merely mentions a blocked flag never trips it; a shape the check cannot classify (a shell wrapper, an expansion that may become a flag) is refused rather than guessed. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
-| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. Quoted text, heredoc bodies, substitutions, and arithmetic are stripped as data first, so a commit message or a file body that merely mentions a blocked flag never trips it; a shape the check cannot classify (a shell wrapper of any form, a substitution inside `${…}`, an unquoted pattern in a commit or push, git config passed through the environment) is refused rather than guessed. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
+| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 
 ## The idea in one paragraph
 
diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index e0893ac..a7dd35b 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -27,7 +27,7 @@
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
 # option (`bash $a -c`: bash may see nothing there), git config passed through the environment in
-# a commit call (`--config-env`, `GIT_CONFIG_*`), a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
+# a commit or push call (`--config-env`, `GIT_CONFIG_*`), a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
 # numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
@@ -144,7 +144,7 @@ strip_data() {
   # a short quoted fragment is part of its word; a dropped span leaves an empty "" so the
   # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is);
   # an empty pair (`commi""t`) is nothing, as in bash
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>]/) o = o qb; else if (qbad) o = o "\"$\""; else if (qb != "") o = o "\"\"" }
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>]/) o = o qb; else if (!qbad && qb != "") o = o "\"\"" }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
@@ -186,6 +186,7 @@ strip_data() {
       if (q == 2 || q == 4) {                    # data that still expands substitutions
         if (ch == "\\") { if (q == 2) qb = qb c[i + 1]; i += 2; continue }
         if (q == 2 && ch == "\"") { q = 0; closeq(); i++; continue }
+        if (inbrace() && ((ch == "$" && c[i + 1] == "(") || ch == "`")) refuse("a substitution inside ${...}")
         if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { qbad = 1; push("$((", q); q = 0; o = o " "; i += 3; continue }
         if (ch == "$" && c[i + 1] == "(") { qbad = 1; push("$(", q); q = 0; o = o "$( "; i += 2; continue }
         if (ch == "$" && c[i + 1] == "{") {
@@ -256,7 +257,7 @@ strip_data() {
           }
           top = (depth > 0) ? kind[depth] : ""
         }
-        if (casec[depth] > 0) { o = o ch " "; i++; cmdpos = 1; continue }   # a case pattern terminator
+        if (casec[depth] > 0) { droptests(); o = o ch (insubst() ? " " : "\001"); i++; cmdpos = 1; continue }   # a case pattern terminator ends the pattern, as `;;` ends the command
         if (top == "(" || top == "$(" || top == "<(") { pop(); o = o ch " "; i++; continue }
         o = o ch " "; i++; continue
       }
@@ -312,6 +313,7 @@ strip_data() {
     # substitution (`-m "$(cat <<EOF ... )" --no-verify` is ONE command), in `${...}` / `$((...))`
     # / `$[...]` it is just whitespace; so there it becomes a space. Inside a quoted span or a body
     # line it is part of a word.
+    if (inbrace()) o = substr(o, 1, bmark)      # a `${...}` word spanning lines: none of it reaches the output
     if (cont) printf "%s", o
     else if (q == 0 && !inframe()) print o
     else if (q == 0 || q == 4) printf "%s ", o
@@ -381,14 +383,22 @@ while IFS= read -r SEG; do
   # a commit with -a/-i/-o, or any bare token after the subcommand that is not the value of a
   # message-like option, commits working-tree content, not just the index: scan it
   if [ -n "$SEG_COMMIT" ]; then
-    if has '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aio][A-Za-z]*|--all|--include|--only)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
-    SEEN=""; WANT=""
+    if hasc '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aio][A-Za-z]*|--all|--include|--only)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
+    SEEN=""; WANT=""; SUB=0
     for T in $SEG; do   # (unquoted on purpose: the walker removed every quote and set -f is on)
       if [ -n "$SEEN" ]; then
+        # the words of a `$(...)` or `...` are the substitution's, never pathspecs (`-m "$(cat <<EOF ...)"`)
+        # shellcheck disable=SC2016  # `$(` is a literal pattern
+        case "$T" in
+          *'$('*) SUB=$((SUB + 1)); WANT=""; continue ;;
+          *'`'*) B=${T//[!\`]/}; if [ $((${#B} % 2)) -eq 1 ]; then if [ "$SUB" -gt 0 ]; then SUB=$((SUB - 1)); else SUB=$((SUB + 1)); fi; fi; WANT=""; continue ;;
+        esac
+        if [ "$SUB" -gt 0 ]; then case "$T" in *')'*) SUB=$((SUB - 1)) ;; esac; continue; fi
         if [ -n "$WANT" ]; then WANT=""; continue; fi   # the value of the previous option, whatever its shape
         case "$T" in
           -m|-F|-C|-c|-t|--message|--file|--author|--date|--trailer|--template|--fixup|--squash|--reedit-message|--reuse-message|--cleanup) WANT=1 ;;
-          -[A-Za-z]*[mFCct]) WANT=1 ;;                 # `-qm fix`: the cluster ends in an option that takes the next word
+          -S*) ;;                                      # `-S<keyid>`: the key is attached, nothing follows
+          -[aiosvqnepz]*[mFCct]) WANT=1 ;;             # `-qm fix`: no-value flags then an option that takes the next word
           *[\<\>]) WANT=1 ;;                          # `2>` from `2>&1`: the next token is its target, not a pathspec
           -*|*[\<\>]*) ;;
           *) HAS_WORKTREE=1 ;;
@@ -420,10 +430,15 @@ done <<<"$SEGMENTS"
 
 [ -z "$IS_COMMIT$HAS_PUSH" ] && exit 0
 
+# git can take config from the environment (`--config-env`, `GIT_CONFIG_COUNT`/`KEY_n`/`VALUE_n`,
+# `GIT_CONFIG_PARAMETERS`), where the key or the value is out of every check's sight: refuse.
+if has '--config-env|GIT_CONFIG_(COUNT|KEY_[0-9]+|VALUE_[0-9]+|PARAMETERS)=' "$STRIPPED"; then
+  echo "Blocked: git config passed through the environment (--config-env, GIT_CONFIG_*) in the same call as a commit/push cannot be inspected. Set it with -c or in the repo config." >&2; exit 2
+fi
 # Re-pointing core.hooksPath anywhere in the same call (`git -c core.hooksPath=x commit`,
-# `git config core.hooksPath x; git commit`, GIT_CONFIG_PARAMETERS=...) is the same bypass.
+# `git config core.hooksPath x; git commit`) is the same bypass as --no-verify.
 # (checked on the raw command as well: a quoted value with a space in it is stripped as data)
-if has 'core\.hooksPath|GIT_CONFIG_(PARAMETERS|COUNT|KEY_)' "$STRIPPED" || has '(-c[[:space:]]*["'"'"']?core\.hooksPath|config[^;&|]*core\.hooksPath|GIT_CONFIG_PARAMETERS)' "$CMD"; then
+if has 'core\.hooksPath' "$STRIPPED" || has '(-c[[:space:]]*["'"'"']?core\.hooksPath|config[^;&|]*core\.hooksPath)' "$CMD"; then
   echo "Blocked: core.hooksPath override bypasses the repo's git hooks (CLAUDE.md §14)." >&2; exit 2
 fi
 
@@ -446,10 +461,6 @@ if has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])([^[:space:]]*[^[
    has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])[\"']([^\"']*[^[:alnum:]\"'])?${IDENT}([^[:alnum:]]|\$)" "$CMD"; then
   echo "Blocked: the commit sets a committer or author that is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
-# git can also take config from the environment, where the value is out of this check's sight
-if has '--config-env|GIT_CONFIG_(COUNT|KEY_[0-9]+|VALUE_[0-9]+|PARAMETERS)=' "$STRIPPED"; then
-  echo "Blocked: git config passed through the environment (--config-env, GIT_CONFIG_*) in the same call as a commit cannot be inspected. Set it with -c or in the repo config." >&2; exit 2
-fi
 
 # no AI attribution in the commit message — scan the command only, not the staged diff.
 # (This is a repo *about* Claude Code; legit messages will say "Claude Code". Only
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 6abe587..3c672b0 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -595,6 +595,18 @@ run "[ in a brace default then a bot committer" 2 'git status ${x:-[} ; git -c u
 run "[ in a subscripted brace default then push -f" 2 'echo ${a[0]:-[} ; git push -f origin main ; : ]}'
 run "[] in a brace default then a plain commit" 0 'echo ${x:-[]}; git commit -m x'
 run "( left open inside a brace is refused"  2 'echo ${x:-(} ; git commit -m x'
+run "bash with a three-line \${ } then -c"    2 'a=; bash ${a-
+foo
+bar} -c "git push -f origin main"'
+run "bash with a continued \${ } then -c"     2 'bash ${x:-a\
+b} -c "git push -f origin main"'
+run "case pattern then a plain commit"       0 'case "$1" in build) make;; *) git commit -m y;; esac'
+run "case pattern with ? then a plain push"  0 'case x in a?) git push origin main;; esac'
+run "case pattern inside a message substitution" 0 'git commit -m "$(case x in a) echo y;; esac)"'
+run "GIT_CONFIG_VALUE user.name is refused"  2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.email GIT_CONFIG_VALUE_0=bot@example.com git commit -m x'
+run "GIT_CONFIG_COUNT on a push is refused"  2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/tmp git push origin main'
+run "GIT_CONFIG_GLOBAL on a commit is allowed" 0 'GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 git commit -m x'
+run "substitution inside a quoted \${ } is refused" 2 'git commit -m "${v:-"$(git describe)"}"'
 run ") inside a quoted default then push -f" 2 ': "${x:-)}" ; git push -f origin main #"'
 run ") inside a quoted replacement then --no-verify" 2 ': "${x/)/y}" ; git commit --no-verify -m x #"'
 run ") inside a default, echo form"          2 'echo "${x:-)}"; git push origin main --force; echo "x <<EOF
@@ -742,6 +754,18 @@ run "dirty tracked secret, plain commit to /dev/null" 0 'git commit -m x >/dev/n
 run "dirty tracked secret, -qm cluster takes a value" 0 'git commit -qm fix'
 run "dirty tracked secret, -sm cluster takes a value" 0 'git commit -sm fix'
 run "dirty tracked secret, quoted a>b is a pathspec" 2 'git commit -m x "a>b"'
+run "dirty tracked secret, heredoc message, no pathspec" 0 'git commit -m "$(cat <<'"'"'EOF'"'"'
+fix: x
+
+body
+EOF
+)"'
+run "dirty tracked secret, \${msg} message, no pathspec" 0 'git commit -m "${msg}"'
+run "dirty tracked secret, prefixed \${x} message, no pathspec" 0 'git commit -m "fix: ${x}"'
+run "dirty tracked secret, backtick message, no pathspec" 0 'git commit -m "`date`"'
+run "dirty tracked secret, backtick message then pathspec" 2 'git commit -m "`date`" tracked.txt'
+run "dirty tracked secret, substitution message then pathspec" 2 'git commit -m "$(date)" tracked.txt'
+run "dirty tracked secret, -SDEADBEEF is not -a" 0 'git commit -SDEADBEEF -m x'
 run "dirty tracked secret, add && commit"    2 'git add tracked.txt && git commit -m "x"'
 git checkout -q -- tracked.txt
 

From b5c5f02fffa0a5ae75d021002575c04a0b8dbce5 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 09:27:29 +0100
Subject: [PATCH 25/39] fix(hooks): a heredoc pending inside an open ${...} is
 refused; backticks and redirects in the pathspec loop

Bash keeps reading a `${...}` word across newlines and starts a heredoc
body only after the line holding the `}`; the walk entered the body at
the first newline, then cut the following lines to the word's mark, so
a command bash ran on one of them reached no rule. A heredoc marker on
a line that ends inside `${...}` is now refused.

In the pathspec loop backticks are their own flag, toggled by an odd
count in a token, so a `)` inside a backtick pair is no longer counted
twice and the pathspec after it is scanned. A redirection glued to a
word (`tracked.txt>log`, `tracked.txt2>&1`) leaves the word an
argument; `--pathspec-from-file`, `-p`, `--patch`, and `--interactive`
commit working-tree content and scan it. Header and README wording
follow the code.
---
 README.md                        | 28 +++++++++++------------
 hooks/guard-commit.sh            | 38 ++++++++++++++++++++------------
 tests/hooks/test-guard-commit.sh | 18 +++++++++++++++
 3 files changed, 56 insertions(+), 28 deletions(-)

diff --git a/README.md b/README.md
index 37b2147..04a02bc 100644
--- a/README.md
+++ b/README.md
@@ -6,20 +6,20 @@ Most people publish a single `CLAUDE.md` and call it a setup. The thing that act
 
 ## What's inside
 
-| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. Quoted text, heredoc bodies, substitutions, and arithmetic are stripped as data first, so a commit message or a file body that merely mentions a blocked flag never trips it; a shape the check cannot classify (a shell wrapper of any form, a substitution inside `${…}`, an unquoted pattern in a commit or push, git config passed through the environment) is refused rather than guessed. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
-| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
-| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
-| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Path                                                             | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `CLAUDE.md`                                                      | The universal spine — a lean (~220-line) always-loaded core: workflow, git rules, coding guidelines, secrets, anti-patterns. Stack-agnostic. Longer reference material lives in `docs/` and loads on demand.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `rules/{web,android,ios,compute}.md`                             | Platform rule packs. Each carries a `paths:` frontmatter glob; Claude Code loads a pack when it reads a file matching that glob (`*.kt` → android, `*.swift` → ios, `*.ts`/`*.py` → web, `*.cpp`/`*.cu` → compute). Path-triggered, so packs whose files you never touch stay out of context.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `agents/` (15)                                                   | The default subagent roster: the four-hat chain (architect → senior-swe → code-reviewer → qa), plus specialists (security, performance, db-migration, debugger, devops, docs, design), release-engineer + tech-writer, and a delivery layer (TPM, scrum-master).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `agents-android/` (7), `agents-ios/` (7), `agents-compute/` (13) | Per-stack overrides. Drop them into a repo's `.claude/agents/` and they override the generic ones of the same name with platform-brained versions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `hooks/guard-commit.sh`                                          | A Claude Code Bash hook (PreToolUse) that blocks the _agent_ from force-pushing, skipping git hooks with `--no-verify`, committing as a non-human, writing AI attribution into a commit message, or staging obvious secrets. Every segment of a chained command is checked on its own. Quoted text, heredoc bodies, substitutions, and arithmetic are stripped as data first, so a commit message or a file body that merely mentions a blocked flag never trips it; a shape the check cannot classify (a shell wrapper of any form, a substitution inside `${...}`, an unquoted pattern in a commit or push, git config passed through the environment) is refused rather than guessed. It guards Claude's git commands — not a human typing `git` directly in their own terminal. |
+| `hooks/format.sh`                                                | Auto-formats edited files by extension across every stack. Missing formatter is a silent no-op, never an error.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `tests/hooks/`                                                   | Behavioral tests for both hooks: a JSON payload on stdin, an exit code out, one case per rule and per past regression. Plain bash 3.2 + `jq`. CI (`.github/workflows/gate.yml`) runs them with the rest of the quality gate on every PR.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `skills/new-repo/`                                               | A scaffolder skill: spins up a new repo with the right `CLAUDE.md`, `.gitignore`, quality gate, and release workflow. Scaffolds **web + Android**; iOS and compute ship as rule + agent packs (no scaffolder for them yet).                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `docs/`                                                          | On-demand reference the spine points to (full roster tables, the Phase-3 review checklist, the error-recovery table, PR template, scaling notes). Installed to `~/.claude/docs/`; loaded only when a stub references it.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `templates/`                                                     | Blank project `CLAUDE.md` templates (generic + compute) to copy into a new repo and fill in.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `examples/CLAUDE.example-web.md`                                 | A filled-in example so you can see what "done" looks like before you write your own.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `STRUCTURE.md`                                                   | The full layout, install steps, and how the two-settings-file swap works. **Read this first.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
 
 ## The idea in one paragraph
 
diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index a7dd35b..5898b5b 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -112,8 +112,9 @@ fi
 #    text and `#` is not a comment; an unbalanced `[` dies at the next command boundary;
 #  - `#` comments to end of line, only where bash starts one: at the start of a word, which a
 #    `)` closing `$(...)` or a closing backtick is not;
-#  - `case ... esac`, counted only in command position: a pattern's `)` does not close an
-#    enclosing `$(...)`; a `)` that the top frame cannot close unwinds to the `(` it does close;
+#  - `case ... esac`, counted only in command position: a pattern's `)` is a command boundary and
+#    does not close an enclosing `$(...)`; a `)` that the top frame cannot close unwinds to the `(`
+#    it does close;
 #    a frame or quote still open at the end of the input fails closed;
 #  - heredoc bodies, dropped line by line up to the terminator (`EOF)` also closes a `$(`,
 #    `<<-` allows leading tabs, an unterminated body runs to end of input as in bash). A `<<WORD`
@@ -142,8 +143,9 @@ strip_data() {
   }
   function refuse(why) { refused = 1; print "guard-commit.sh cannot classify this command: " why ". Rewrite it without that construct." > "/dev/stderr"; exit 3 }
   # a short quoted fragment is part of its word; a dropped span leaves an empty "" so the
-  # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is);
-  # an empty pair (`commi""t`) is nothing, as in bash
+  # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is),
+  # unless it held a substitution, whose own mark already stands there; an empty pair
+  # (`commi""t`) is nothing, as in bash
   function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>]/) o = o qb; else if (!qbad && qb != "") o = o "\"\"" }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
@@ -306,7 +308,9 @@ strip_data() {
     }
     if (q == 1 || q == 2 || q == 3) qbad = 1    # a quoted span crossing a line is never glued
     if (q == 0 && !cont) droptests()
-    # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash
+    # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash;
+    # a `${...}` still open means the command has not ended, and the walk will not guess where it does
+    if (!body && npend > 0 && inbrace()) refuse("a heredoc marker on a line that ends inside ${...}")
     enter = (!body && npend > 0 && q == 0 && !cont)
     # A newline separates commands in code at the top level or inside a bare subshell. Inside any
     # other frame it does not end the ENCLOSING command: in `$(...)` it separates commands of the
@@ -383,24 +387,30 @@ while IFS= read -r SEG; do
   # a commit with -a/-i/-o, or any bare token after the subcommand that is not the value of a
   # message-like option, commits working-tree content, not just the index: scan it
   if [ -n "$SEG_COMMIT" ]; then
-    if hasc '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aio][A-Za-z]*|--all|--include|--only)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
-    SEEN=""; WANT=""; SUB=0
+    if hasc '[[:space:]]commit.*[[:space:]](-[A-Za-z]*[aiop][A-Za-z]*|--all|--include|--only|--patch|--interactive|--pathspec-from-file)([^[:alnum:]]|$)' "$SEG"; then HAS_WORKTREE=1; fi
+    SEEN=""; WANT=""; SUB=0; BT=0
     for T in $SEG; do   # (unquoted on purpose: the walker removed every quote and set -f is on)
       if [ -n "$SEEN" ]; then
-        # the words of a `$(...)` or `...` are the substitution's, never pathspecs (`-m "$(cat <<EOF ...)"`)
+        # the words of a `$(...)` or `...` are the substitution's, never pathspecs (`-m "$(cat <<EOF ...)"`):
+        # backticks toggle on an odd count per token; `$(` and `)` are counted while no backtick is open
+        case "$T" in *'`'*) B=${T//[!\`]/}; [ $((${#B} % 2)) -eq 1 ] && BT=$((1 - BT)); WANT=""; continue ;; esac
+        [ "$BT" -eq 1 ] && continue
         # shellcheck disable=SC2016  # `$(` is a literal pattern
-        case "$T" in
-          *'$('*) SUB=$((SUB + 1)); WANT=""; continue ;;
-          *'`'*) B=${T//[!\`]/}; if [ $((${#B} % 2)) -eq 1 ]; then if [ "$SUB" -gt 0 ]; then SUB=$((SUB - 1)); else SUB=$((SUB + 1)); fi; fi; WANT=""; continue ;;
-        esac
+        case "$T" in *'$('*) SUB=$((SUB + 1)); WANT=""; continue ;; esac
         if [ "$SUB" -gt 0 ]; then case "$T" in *')'*) SUB=$((SUB - 1)) ;; esac; continue; fi
         if [ -n "$WANT" ]; then WANT=""; continue; fi   # the value of the previous option, whatever its shape
+        case "$T" in
+          *[\<\>]*)                                  # a redirection glued to a word (`tracked.txt>log`, `2>`): the word stays an argument
+            case "$T" in *[\<\>]) WANT=1 ;; esac    # the operator's target is the next token, not a pathspec
+            P=${T%%[<>]*}
+            case "$P" in ''|[0-9]*) continue ;; esac   # nothing, or a descriptor number, before the operator
+            T=$P ;;
+        esac
         case "$T" in
           -m|-F|-C|-c|-t|--message|--file|--author|--date|--trailer|--template|--fixup|--squash|--reedit-message|--reuse-message|--cleanup) WANT=1 ;;
           -S*) ;;                                      # `-S<keyid>`: the key is attached, nothing follows
           -[aiosvqnepz]*[mFCct]) WANT=1 ;;             # `-qm fix`: no-value flags then an option that takes the next word
-          *[\<\>]) WANT=1 ;;                          # `2>` from `2>&1`: the next token is its target, not a pathspec
-          -*|*[\<\>]*) ;;
+          -*) ;;
           *) HAS_WORKTREE=1 ;;
         esac
       fi
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 3c672b0..5e934a0 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -607,6 +607,16 @@ run "GIT_CONFIG_VALUE user.name is refused"  2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KE
 run "GIT_CONFIG_COUNT on a push is refused"  2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/tmp git push origin main'
 run "GIT_CONFIG_GLOBAL on a commit is allowed" 0 'GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 git commit -m x'
 run "substitution inside a quoted \${ } is refused" 2 'git commit -m "${v:-"$(git describe)"}"'
+run "heredoc marker on a line ending inside \${ }" 2 'cat <<EOF ${x:-
+}
+EOF
+git push -f origin main
+: }'
+run "heredoc marker inside an open \${ } then --no-verify" 2 'cat <<EOF ${x:-
+}
+EOF
+git commit --no-verify -m x
+: }'
 run ") inside a quoted default then push -f" 2 ': "${x:-)}" ; git push -f origin main #"'
 run ") inside a quoted replacement then --no-verify" 2 ': "${x/)/y}" ; git commit --no-verify -m x #"'
 run ") inside a default, echo form"          2 'echo "${x:-)}"; git push origin main --force; echo "x <<EOF
@@ -766,6 +776,14 @@ run "dirty tracked secret, backtick message, no pathspec" 0 'git commit -m "`dat
 run "dirty tracked secret, backtick message then pathspec" 2 'git commit -m "`date`" tracked.txt'
 run "dirty tracked secret, substitution message then pathspec" 2 'git commit -m "$(date)" tracked.txt'
 run "dirty tracked secret, -SDEADBEEF is not -a" 0 'git commit -SDEADBEEF -m x'
+run "dirty tracked secret, backtick with parens then pathspec" 2 'git commit -m "`(echo x)`" tracked.txt'
+run "dirty tracked secret, backtick with <( ) then pathspec" 2 'git commit -m "`cat <(date)`" tracked.txt'
+run "dirty tracked secret, pathspec glued to a redirect" 2 'git commit -m x tracked.txt>log'
+run "dirty tracked secret, pathspec glued to 2>&1" 2 'git commit -m x tracked.txt2>&1'
+run "dirty tracked secret, --pathspec-from-file" 2 'git commit -m x --pathspec-from-file=list'
+run "dirty tracked secret, --patch"          2 'git commit -p -m x'
+run "dirty tracked secret, redirect to a file, no pathspec" 0 'git commit -m x >log 2>&1'
+run "dirty tracked secret, -m \$(date) then -- pathspec" 2 'git commit -m "$(date)" -- tracked.txt'
 run "dirty tracked secret, add && commit"    2 'git add tracked.txt && git commit -m "x"'
 git checkout -q -- tracked.txt
 

From b6e750994912b21a0d45b7914d713d58ba6f6051 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 09:43:23 +0100
Subject: [PATCH 26/39] fix(hooks): a heredoc before a substitution is refused;
 whole-arg-quoted committer, empty-arg and literal-mark pathspecs

A `<<WORD` marker registered before a `$(...)`, backtick, or `<(...)`
that opens on the same line let bash defer the body past the
substitution's close and run the lines between as its commands, which
the walk dropped as data. That interleave is now refused, alongside the
`${...}` case it mirrors.

The committer override check now also catches a key quoted with its
whole argument (`-c "user.name=Claude Bot"`, `"--author=Claude Bot"`)
and a bot name with a trailing digit.

In the pathspec loop a `$(` mark is matched exactly, so a literal
`x$(y` word is not mistaken for a substitution and no longer hides the
pathspec after it; a quoted backtick is dropped as data so it cannot do
the same; and an empty quoted argument that is a whole word
(`-m "" file`) is kept as one, so its pathspec is still scanned.

Config read from a file the guard cannot see (`include.path`,
`includeIf.`, `GIT_CONFIG_GLOBAL`/`SYSTEM`, `HOME=`) in a commit or
push call is refused, the same as the environment routes.
---
 hooks/guard-commit.sh            | 39 ++++++++++++++++++++------------
 tests/hooks/test-guard-commit.sh | 26 ++++++++++++++++++++-
 2 files changed, 49 insertions(+), 16 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 5898b5b..9d0773c 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -27,7 +27,8 @@
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
 # option (`bash $a -c`: bash may see nothing there), git config passed through the environment in
-# a commit or push call (`--config-env`, `GIT_CONFIG_*`), a commit message mentioning `-c core.hooksPath`, a diff over 16 MB (commit
+# a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`), a commit message
+# mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
 # numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
@@ -146,11 +147,13 @@ strip_data() {
   # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is),
   # unless it held a substitution, whose own mark already stands there; an empty pair
   # (`commi""t`) is nothing, as in bash
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>]/) o = o qb; else if (!qbad && qb != "") o = o "\"\"" }
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>`]/) o = o qb; else if (!qbad && (qb != "" || qfresh)) o = o "\"\"" }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
   function inbrace(   k) { for (k = depth; k > 0; k--) if (kind[k] == "${") return 1; return 0 }   # inside a `${...}` word
+  function fresh() { return (o == "" || o ~ /[ \t]$/ || substr(o, length(o), 1) == "\001") }   # a quote at the start of a word
+  function heredocbeforesubst(   k) { for (k = depth; k > 0; k--) if ((kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") && pendat[k] > 0) return 1; return 0 }
   BEGIN { q = 0; depth = 0; npend = 0; body = 0; cont = 0; casec[0] = 0; poppos = -1; poppedkind = ""; cmdpos = 1; kwlead = 0 }
   {
     line = $0
@@ -205,9 +208,9 @@ strip_data() {
         if (i == n) { cont = 1; i++; continue }
         o = o ((c[i + 1] ~ /[;&|]/) ? " " : (c[i + 1] ~ /[*?\[{]/) ? "\"\"" : c[i + 1]); i += 2; continue
       }
-      if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; i += 2; continue }
-      if (ch == "\047") { q = 1; qb = ""; qbad = 0; i++; continue }
-      if (ch == "\"") { q = 2; qb = ""; qbad = 0; i++; continue }
+      if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; qfresh = fresh(); i += 2; continue }
+      if (ch == "\047") { q = 1; qb = ""; qbad = 0; qfresh = fresh(); i++; continue }
+      if (ch == "\"") { q = 2; qb = ""; qbad = 0; qfresh = fresh(); i++; continue }
       # a comment starts only where a word starts: after whitespace, a control operator, or the `)`
       # that ends a subshell or an `((...))` command. The `)` of `$(...)` / `$((...))` or a closing
       # backtick ends a word, and `#` after it is part of that word.
@@ -309,8 +312,10 @@ strip_data() {
     if (q == 1 || q == 2 || q == 3) qbad = 1    # a quoted span crossing a line is never glued
     if (q == 0 && !cont) droptests()
     # a body starts at the newline that ends the COMMAND (code state, no continuation), as in bash;
-    # a `${...}` still open means the command has not ended, and the walk will not guess where it does
+    # a `${...}` still open, or a `<<WORD` registered before a substitution opened on the line, means
+    # the command has not ended where the walk would start the body: it will not guess, it refuses
     if (!body && npend > 0 && inbrace()) refuse("a heredoc marker on a line that ends inside ${...}")
+    if (!body && npend > 0 && heredocbeforesubst()) refuse("a heredoc marker before a substitution that opens on the same line")
     enter = (!body && npend > 0 && q == 0 && !cont)
     # A newline separates commands in code at the top level or inside a bare subshell. Inside any
     # other frame it does not end the ENCLOSING command: in `$(...)` it separates commands of the
@@ -392,12 +397,15 @@ while IFS= read -r SEG; do
     for T in $SEG; do   # (unquoted on purpose: the walker removed every quote and set -f is on)
       if [ -n "$SEEN" ]; then
         # the words of a `$(...)` or `...` are the substitution's, never pathspecs (`-m "$(cat <<EOF ...)"`):
-        # backticks toggle on an odd count per token; `$(` and `)` are counted while no backtick is open
+        # the words of the substitution are never pathspecs. A backtick opens/closes a span and glues
+        # to its word, so count it by parity; a quoted backtick is already dropped by closeq, so the
+        # only backticks here are real marks. `$(` is emitted standalone, so match it exactly (a
+        # literal `x$(y` must NOT count); its `)` glues to a word, so match that by containment.
         case "$T" in *'`'*) B=${T//[!\`]/}; [ $((${#B} % 2)) -eq 1 ] && BT=$((1 - BT)); WANT=""; continue ;; esac
         [ "$BT" -eq 1 ] && continue
-        # shellcheck disable=SC2016  # `$(` is a literal pattern
-        case "$T" in *'$('*) SUB=$((SUB + 1)); WANT=""; continue ;; esac
-        if [ "$SUB" -gt 0 ]; then case "$T" in *')'*) SUB=$((SUB - 1)) ;; esac; continue; fi
+        # shellcheck disable=SC2016  # `$(` is a literal mark
+        case "$T" in '$(') SUB=$((SUB + 1)); WANT=""; continue ;; esac
+        if [ "$SUB" -gt 0 ]; then case "$T" in *')'*) SUB=$((SUB - 1)) ;; esac; continue; fi   # `)` glues to its word (`date)`)
         if [ -n "$WANT" ]; then WANT=""; continue; fi   # the value of the previous option, whatever its shape
         case "$T" in
           *[\<\>]*)                                  # a redirection glued to a word (`tracked.txt>log`, `2>`): the word stays an argument
@@ -442,8 +450,8 @@ done <<<"$SEGMENTS"
 
 # git can take config from the environment (`--config-env`, `GIT_CONFIG_COUNT`/`KEY_n`/`VALUE_n`,
 # `GIT_CONFIG_PARAMETERS`), where the key or the value is out of every check's sight: refuse.
-if has '--config-env|GIT_CONFIG_(COUNT|KEY_[0-9]+|VALUE_[0-9]+|PARAMETERS)=' "$STRIPPED"; then
-  echo "Blocked: git config passed through the environment (--config-env, GIT_CONFIG_*) in the same call as a commit/push cannot be inspected. Set it with -c or in the repo config." >&2; exit 2
+if has '--config-env|GIT_CONFIG_(COUNT|KEY_[0-9]+|VALUE_[0-9]+|PARAMETERS|GLOBAL|SYSTEM)=|include\.path=|includeIf\.|(^|[[:space:]])HOME=' "$STRIPPED"; then
+  echo "Blocked: git config from the environment or an unreadable file (--config-env, GIT_CONFIG_*, include.path, HOME) in the same call as a commit/push cannot be inspected. Set it with -c or in the repo config." >&2; exit 2
 fi
 # Re-pointing core.hooksPath anywhere in the same call (`git -c core.hooksPath=x commit`,
 # `git config core.hooksPath x; git commit`) is the same bypass as --no-verify.
@@ -461,14 +469,15 @@ fi
 # quote, or to the end of the line when it is unquoted.
 IDENT='(claude|chatgpt|copilot|cursor|cursoragent|github-actions|assistant|bot|ai[-_ ]?(agent|assistant|bot))'
 NAME=$(git config user.name 2>/dev/null || echo "")
-if has "(^|[^[:alnum:]])${IDENT}([^[:alnum:]]|\$)" "$NAME"; then
+if has "(^|[^[:alnum:]])${IDENT}[0-9]*([^[:alnum:]]|\$)" "$NAME"; then
   SAFE_NAME=$(tr -d '\n\r' <<<"$NAME" | cut -c1-40)   # repo-controlled text: one line, short, before it reaches the model
   echo "Blocked: git user.name '$SAFE_NAME' is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
 # The stripped text has the unquoted forms with every quote splice undone (`user.name=Cla'ude'`); the
 # raw text has the quoted values (`--author="Claude Bot <...>"`), whose closing quote bounds them.
-if has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])([^[:space:]]*[^[:alnum:][:space:]])?${IDENT}([^[:alnum:]]|\$)" "$STRIPPED" ||
-   has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])[\"']([^\"']*[^[:alnum:]\"'])?${IDENT}([^[:alnum:]]|\$)" "$CMD"; then
+if has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])([^[:space:]]*[^[:alnum:][:space:]])?${IDENT}[0-9]*([^[:alnum:]]|\$)" "$STRIPPED" ||
+   has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])[\"']([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|\$)" "$CMD" ||
+   has "[\"'](user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author=)([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|\$)" "$CMD"; then
   echo "Blocked: the commit sets a committer or author that is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
 
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 5e934a0..38e3166 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -566,6 +566,11 @@ run "commit with a subscript then --no-verify" 2 'git commit ${a[1|2]} --no-veri
 run "subscript between git and commit, bad committer" 2 'git -c user.name=Claude ${a[1|2]} commit -m x'
 run "-c user.name override to a bot"          2 'git -c user.name=Claude commit -m x'
 run "-c user.name override, quoted two words" 2 'git -c user.name="Claude Bot" commit -m x'
+run "-c whole-arg quoted user.name to a bot" 2 'git -c "user.name=Claude Bot" commit -m x'
+run "-c whole-arg single-quoted user.name to a bot" 2 'git -c '"'"'user.name=Claude Bot'"'"' commit -m x'
+run "whole-arg quoted --author to a bot"     2 'git commit "--author=Claude Bot <c@e.com>" -m x'
+run "-c whole-arg quoted user.name to a human" 0 'git -c "user.name=Dennis Vorobyov" commit -m x'
+run "bot name with a trailing digit"         2 'git -c user.name=Claude2 commit -m x'
 run "GIT_COMMITTER_NAME override to a bot"    2 'GIT_COMMITTER_NAME=Claude git commit -m x'
 run "GIT_AUTHOR_NAME override to a bot"       2 'GIT_AUTHOR_NAME=Cursor git commit -m x'
 run "--author override to a bot"              2 'git commit --author="Claude <c@example.com>" -m x'
@@ -605,7 +610,11 @@ run "case pattern with ? then a plain push"  0 'case x in a?) git push origin ma
 run "case pattern inside a message substitution" 0 'git commit -m "$(case x in a) echo y;; esac)"'
 run "GIT_CONFIG_VALUE user.name is refused"  2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=user.email GIT_CONFIG_VALUE_0=bot@example.com git commit -m x'
 run "GIT_CONFIG_COUNT on a push is refused"  2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=core.hooksPath GIT_CONFIG_VALUE_0=/tmp git push origin main'
-run "GIT_CONFIG_GLOBAL on a commit is allowed" 0 'GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 git commit -m x'
+run "GIT_CONFIG_GLOBAL inline on a commit is refused" 2 'GIT_CONFIG_GLOBAL=/tmp/cfg git commit -m x'
+run "include.path on a commit is refused"    2 'git -c include.path=/tmp/cfg commit -m x'
+run "includeIf on a commit is refused"       2 'git -c includeIf.gitdir:/x.path=/tmp/cfg commit -m x'
+run "HOME= on a commit is refused"           2 'HOME=/tmp git commit -m x'
+run "GIT_CONFIG_GLOBAL exported by the harness is invisible" 0 'git commit -m x'
 run "substitution inside a quoted \${ } is refused" 2 'git commit -m "${v:-"$(git describe)"}"'
 run "heredoc marker on a line ending inside \${ }" 2 'cat <<EOF ${x:-
 }
@@ -784,6 +793,21 @@ run "dirty tracked secret, --pathspec-from-file" 2 'git commit -m x --pathspec-f
 run "dirty tracked secret, --patch"          2 'git commit -p -m x'
 run "dirty tracked secret, redirect to a file, no pathspec" 0 'git commit -m x >log 2>&1'
 run "dirty tracked secret, -m \$(date) then -- pathspec" 2 'git commit -m "$(date)" -- tracked.txt'
+run "dirty tracked secret, quoted backtick word then pathspec" 2 'git commit -m '"'"'a`b'"'"' tracked.txt'
+run "dirty tracked secret, literal \$( in a word then pathspec" 2 'git commit -m x$\(y tracked.txt'
+run "dirty tracked secret, empty message then pathspec" 2 'git commit -m "" tracked.txt'
+run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
+git push -f origin main
+EOF
+)'
+run "heredoc marker before a backtick substitution" 2 'cat <<EOF `:
+git push --force origin main
+EOF
+`'
+run "legit heredoc message substitution still allowed" 0 'git commit -m "$(cat <<'"'"'EOF'"'"'
+feat: x
+EOF
+)"'
 run "dirty tracked secret, add && commit"    2 'git add tracked.txt && git commit -m "x"'
 git checkout -q -- tracked.txt
 

From 0f7b305ef04c7127346749649f20a1f5ea31bba6 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 10:00:23 +0100
Subject: [PATCH 27/39] fix(hooks): an empty quote is an argument only when it
 is a whole word; XDG_CONFIG_HOME is a config route; anchor includeIf

The empty-argument fix from the previous commit emitted a placeholder
for a quote at the start of a word, but bash elides an empty quote glued
to the characters after it (`git ""commit` is `git commit`,
`push ""--force` is `push --force`). The placeholder was then a phantom
only the guard saw, and it broke every word-anchored check: a two-byte
`""` prefix on a subcommand, flag, or shell name slipped a force-push,
`--no-verify`, a secret-bearing or bot-authored commit, or a `bash -c`
wrapper straight through. The placeholder is now emitted only when the
quote is a whole word, proven by the character before it and a one-char
lookahead at the character after.

XDG_CONFIG_HOME points git at a config file the guard cannot read, the
same hooks-path bypass as HOME, so it is refused in a commit or push
call. The includeIf config route now requires its `.path=` so a file
literally named includeIf.md is not blocked. The header names the
secret-scan reach of the expansion limit.
---
 hooks/guard-commit.sh            | 13 +++++++------
 tests/hooks/test-guard-commit.sh | 13 +++++++++++++
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 9d0773c..1140da7 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -14,7 +14,8 @@
 # set in an earlier call (it rewrites the working-tree diff the guard reads), a script body run
 # by name (`bash run.sh`, `source ./run.sh`), and git run from another interpreter
 # (`python3 -c "os.system('git push -f')"`, `perl -e`, `node -e`, awk's `system()`), whose
-# program is data to this walk. Known false blocks (safe direction): a shell wrapper anywhere in
+# program is data to this walk; likewise an expansion that produces a pathspec (`git commit -m x
+# $(echo f)`), whose unseen word is not scanned for secrets. Known false blocks (safe direction): a shell wrapper anywhere in
 # the same call as a plain commit or push (`git commit -m x && bash -c "echo done"`,
 # `bash -x build.sh && git commit -m x`, `which bash && git commit -m x`, `git add zsh bash fish`
 # in a dotfiles repo), `source`/`.` of a process substitution, any mention of `alias.` outside quotes
@@ -27,8 +28,8 @@
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
 # option (`bash $a -c`: bash may see nothing there), git config passed through the environment in
-# a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`), a commit message
-# mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`, a diff over 16 MB (commit
+# a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`, `XDG_CONFIG_HOME=`),
+# a commit message mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
 # numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
@@ -147,7 +148,7 @@ strip_data() {
   # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is),
   # unless it held a substitution, whose own mark already stands there; an empty pair
   # (`commi""t`) is nothing, as in bash
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>`]/) o = o qb; else if (!qbad && (qb != "" || qfresh)) o = o "\"\"" }
+  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>`]/) o = o qb; else if (!qbad && (qb != "" || (qfresh && (i >= n || c[i + 1] ~ /[ \t;&|()<>`]/)))) o = o "\"\"" }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
@@ -450,8 +451,8 @@ done <<<"$SEGMENTS"
 
 # git can take config from the environment (`--config-env`, `GIT_CONFIG_COUNT`/`KEY_n`/`VALUE_n`,
 # `GIT_CONFIG_PARAMETERS`), where the key or the value is out of every check's sight: refuse.
-if has '--config-env|GIT_CONFIG_(COUNT|KEY_[0-9]+|VALUE_[0-9]+|PARAMETERS|GLOBAL|SYSTEM)=|include\.path=|includeIf\.|(^|[[:space:]])HOME=' "$STRIPPED"; then
-  echo "Blocked: git config from the environment or an unreadable file (--config-env, GIT_CONFIG_*, include.path, HOME) in the same call as a commit/push cannot be inspected. Set it with -c or in the repo config." >&2; exit 2
+if has '--config-env|GIT_CONFIG_(COUNT|KEY_[0-9]+|VALUE_[0-9]+|PARAMETERS|GLOBAL|SYSTEM)=|include\.path=|includeIf\.[^[:space:]]*\.path=|(^|[[:space:]])(HOME|XDG_CONFIG_HOME)=' "$STRIPPED"; then
+  echo "Blocked: git config from the environment or an unreadable file (--config-env, GIT_CONFIG_*, include.path, HOME, XDG_CONFIG_HOME) in the same call as a commit/push cannot be inspected. Set it with -c or in the repo config." >&2; exit 2
 fi
 # Re-pointing core.hooksPath anywhere in the same call (`git -c core.hooksPath=x commit`,
 # `git config core.hooksPath x; git commit`) is the same bypass as --no-verify.
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 38e3166..140c118 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -613,6 +613,10 @@ run "GIT_CONFIG_COUNT on a push is refused"  2 'GIT_CONFIG_COUNT=1 GIT_CONFIG_KE
 run "GIT_CONFIG_GLOBAL inline on a commit is refused" 2 'GIT_CONFIG_GLOBAL=/tmp/cfg git commit -m x'
 run "include.path on a commit is refused"    2 'git -c include.path=/tmp/cfg commit -m x'
 run "includeIf on a commit is refused"       2 'git -c includeIf.gitdir:/x.path=/tmp/cfg commit -m x'
+run "a file named includeIf.md is allowed"   0 'git commit -m x includeIf.md'
+run "XDG_CONFIG_HOME on a commit is refused"  2 'XDG_CONFIG_HOME=/tmp/evil git commit -m x'
+run "XDG_CONFIG_HOME on a push is refused"    2 'XDG_CONFIG_HOME=/tmp/evil git push origin main'
+run "a message mentioning XDG_CONFIG_HOME with spaces is allowed" 0 'git commit -m "set XDG_CONFIG_HOME first"'
 run "HOME= on a commit is refused"           2 'HOME=/tmp git commit -m x'
 run "GIT_CONFIG_GLOBAL exported by the harness is invisible" 0 'git commit -m x'
 run "substitution inside a quoted \${ } is refused" 2 'git commit -m "${v:-"$(git describe)"}"'
@@ -796,6 +800,15 @@ run "dirty tracked secret, -m \$(date) then -- pathspec" 2 'git commit -m "$(dat
 run "dirty tracked secret, quoted backtick word then pathspec" 2 'git commit -m '"'"'a`b'"'"' tracked.txt'
 run "dirty tracked secret, literal \$( in a word then pathspec" 2 'git commit -m x$\(y tracked.txt'
 run "dirty tracked secret, empty message then pathspec" 2 'git commit -m "" tracked.txt'
+run "empty quote glued before push"          2 'git ""push --force origin main'
+run "empty quote glued before the force flag" 2 'git push ""--force origin main'
+run "empty quote glued before commit"        2 'git ""commit --no-verify -m x'
+run "empty quote glued before commit, dirty secret" 2 'git ""commit -am x'
+run "single empty quote glued before commit" 2 "git ''commit --no-verify -m x"
+run "empty quote glued before a bash wrapper" 2 '""bash -c "git push --force origin main"'
+run "empty quote before commit, then chained force-push" 2 'git commit -m x && git ""push --force origin main'
+run "empty quote glued before a word is not a phantom" 0 'git ""status'
+run "standalone empty arg then a plain commit" 0 'echo "" && git commit -m x'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From a24c28a58afcc2a6b18fdf64e7c18fb194c19dba Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 10:18:36 +0100
Subject: [PATCH 28/39] fix(hooks): a bare $name expansion leaves a mark, like
 ${...}, so an empty one cannot glue to a flag

A braced `${x}`, a substitution, and an empty quote all leave a `$` or a
space in the walk, so a flag or subcommand after them keeps its word
boundary. A bare unbraced `$x` did not: it fell through to the default
copy and was emitted verbatim. Unset, bash drops it and applies the
literal next to it, so `git push origin $x--force` force-pushed while
the guard read `$x--force` as one unknown word and allowed it. The same
held for `$x--no-verify`, `$x-n`, and a `$x`-prefixed shell wrapper.

A bare `$name`, `$1`, or `$@` now emits a `$` mark set off by spaces,
the same treatment `${...}` already gets, so the boundary is restored
and the flag is seen. Also add XDG_CONFIG_HOME to the header's
false-block list for parity with the rule.
---
 hooks/guard-commit.sh            | 7 ++++++-
 tests/hooks/test-guard-commit.sh | 9 +++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 1140da7..b7f8365 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -29,7 +29,7 @@
 # when the command runs; quote it, or list the files), an expansion between a shell and its
 # option (`bash $a -c`: bash may see nothing there), git config passed through the environment in
 # a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`, `XDG_CONFIG_HOME=`),
-# a commit message mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`, a diff over 16 MB (commit
+# a commit message mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`/`XDG_CONFIG_HOME=`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
 # numerically encoded (`$'\x67it' $'\x70ush'`) is the splice limit above.
@@ -235,6 +235,11 @@ strip_data() {
         outer = !inbrace(); push("${", 0); o = o " $"; if (outer) bmark = length(o); i += 2; continue
       }
       if (ch == "$" && c[i + 1] == "(") { push("$(", 0); o = o "$( "; i += 2; continue }
+      # a bare `$name` / `$1` / `$@` parameter expansion may expand to nothing, so it is a word that,
+      # like `${...}`, must not glue the literal next to it (`git push origin $x--force`): emit a `$`
+      # mark set off by spaces so a flag or subcommand after it keeps its boundary.
+      if (ch == "$" && c[i + 1] ~ /[A-Za-z_]/) { i += 2; while (i <= n && c[i] ~ /[A-Za-z0-9_]/) i++; o = o " $ "; continue }
+      if (ch == "$" && c[i + 1] ~ /[0-9@*#?!$-]/) { o = o " $ "; i += 2; continue }
       # `[` in code opens a test bracket; inside an expansion or arithmetic it is an array subscript
       # (`${a[1|2]}`), whose `|` and `&` are text, never a command boundary
       if (ch == "[" && top == "${") { o = o ch; i++; continue }   # text inside `${...}`, like `)`: `${x:-[}` is a value, not a subscript
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 140c118..d277c6e 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -809,6 +809,15 @@ run "empty quote glued before a bash wrapper" 2 '""bash -c "git push --force ori
 run "empty quote before commit, then chained force-push" 2 'git commit -m x && git ""push --force origin main'
 run "empty quote glued before a word is not a phantom" 0 'git ""status'
 run "standalone empty arg then a plain commit" 0 'echo "" && git commit -m x'
+run "bare \$x glued before the force flag"    2 'git push origin $x--force'
+run "bare \$x glued before -f"               2 'git push origin $x-f'
+run "bare \$x glued before --mirror"         2 'git push $x--mirror'
+run "bare \$x glued before --no-verify"      2 'git commit $x--no-verify -m x'
+run "bare \$x glued before -n"               2 'git commit -a $x-n -m x'
+run "bare \$x then empty quote before --force" 2 'git push origin $x""--force'
+run "bare \$x before a bash wrapper flag"    2 'bash $x-c "git push --force origin main"'
+run "bare \$x in a normal push is allowed"   0 'git push origin $branch'
+run "bare \$1 glued before --force"          2 'git push origin $1--force'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From e9864535d0cda3c812b7180e4c945908c272e0dc Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 10:41:38 +0100
Subject: [PATCH 29/39] fix(hooks): a possibly-empty expansion inside double
 quotes cannot glue to or hide a flag

The empty-expansion fix reached code state but not the inside of a double
quote, so `git push origin "$x--force"` and `"${x}--force"` (x unset)
still force-pushed: the walk kept `$x` glued to the flag, and a `${x}`
dropped the literal after it, so the flag was invisible to the anchored
checks. The same hid `-f`, `--no-verify`, `-n`, and a shell wrapper
(`bash "$a" -c`).

The double-quote walk now treats a substitution and a possibly-empty
parameter differently. A substitution keeps its marks; a bare `$name`,
`$1`, `$@`, or `${...}` contributes nothing to the word, so a flag glued
after it stays a visible, bounded token, and an expansion-only span
collapses to a single `$` word: spaced at a word start so a following
flag still shows, glued after `=` so `--author=$x` stays one token. A
substitution in the span no longer leaves a phantom empty argument, so a
`$(...)` or `${...}` message is not mistaken for a pathspec.

A committer or author name split across two concatenated quoted spans
(`--author="$x""Claude"`) stays a documented limit: closing it would
block ordinary commit messages that mention these config keys, and the
enforced committer from repo config is still checked.
---
 hooks/guard-commit.sh            | 32 ++++++++++++++++++++++----------
 tests/hooks/test-guard-commit.sh | 16 ++++++++++++++++
 2 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index b7f8365..e376ae7 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -22,7 +22,9 @@
 # in the same call as a commit or push (`git config alias.st status; git commit`, `git commit -m x
 # alias.md`), a substitution inside `${...}` (`${v:-$(git describe)}`), a one-word quoted argument
 # that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a quoted
-# identity inside a message (`-m "set user.name='claude'"`), a `-n` or `-f` on another
+# identity inside a message (`-m "set user.name='claude'"`), a committer/author name split
+# across concatenated quoted spans (`--author="$x""Claude"`; the enforced committer from repo
+# config is still checked), a `-n` or `-f` on another
 # command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
 # `--force-if-includes` on its own, `-S<keyid>` with an
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
@@ -141,14 +143,19 @@ strip_data() {
     # `name()` is a function definition: what follows is a command (`f() case ...`)
     cmdpos = (kind[depth] == "(" && pushnr[depth] == NR && substr(line, pushpos[depth], i - pushpos[depth] + 1) ~ /^\([ \t]*\)$/)
     q = save[depth]; poppedkind = kind[depth]; depth--; poppos = i
-    if (q == 2) qbad = 1                         # the enclosing string held a substitution: never glue it
   }
   function refuse(why) { refused = 1; print "guard-commit.sh cannot classify this command: " why ". Rewrite it without that construct." > "/dev/stderr"; exit 3 }
   # a short quoted fragment is part of its word; a dropped span leaves an empty "" so the
   # argument still counts as one (`-m "two words" file` keeps `file` as the pathspec it is),
   # unless it held a substitution, whose own mark already stands there; an empty pair
   # (`commi""t`) is nothing, as in bash
-  function closeq() { if (!qbad && qb != "" && qb !~ /[ \t;&|*?\[{()<>`]/) o = o qb; else if (!qbad && (qb != "" || (qfresh && (i >= n || c[i + 1] ~ /[ \t;&|()<>`]/)))) o = o "\"\"" }
+  function closeq() {
+    if (qbad) return
+    if (qb != "" && qb !~ /[ \t;&|*?\[{()<>`]/) o = o qb          # a clean literal fragment glues to its word
+    else if (qb != "") o = o "\"\""                             # a fragment with a space/special: a placeholder word
+    else if (qdollar) o = o (qfresh ? "$ " : "$")               # a possibly-empty parameter: `$` word, spaced only at a word start
+    else if (!qmark && qfresh && (i >= n || c[i + 1] ~ /[ \t;&|()<>`]/)) o = o "\"\""   # truly empty quotes
+  }
   function droptests() { while (depth > 0 && kind[depth] == "[") depth-- }   # a test bracket cannot span a command
   function insubst(   k) { for (k = depth; k > 0; k--) if (kind[k] == "$(" || kind[k] == "`" || kind[k] == "<(") return 1; return 0 }
   function inframe(   k) { for (k = depth; k > 0; k--) if (kind[k] != "(") return 1; return 0 }   # anything but a bare subshell
@@ -193,13 +200,17 @@ strip_data() {
         if (ch == "\\") { if (q == 2) qb = qb c[i + 1]; i += 2; continue }
         if (q == 2 && ch == "\"") { q = 0; closeq(); i++; continue }
         if (inbrace() && ((ch == "$" && c[i + 1] == "(") || ch == "`")) refuse("a substitution inside ${...}")
-        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { qbad = 1; push("$((", q); q = 0; o = o " "; i += 3; continue }
-        if (ch == "$" && c[i + 1] == "(") { qbad = 1; push("$(", q); q = 0; o = o "$( "; i += 2; continue }
+        if (ch == "$" && c[i + 1] == "(" && c[i + 2] == "(") { qmark = 1; push("$((", q); q = 0; o = o " "; i += 3; continue }
+        if (ch == "$" && c[i + 1] == "(") { qmark = 1; push("$(", q); q = 0; o = o "$( "; i += 2; continue }
         if (ch == "$" && c[i + 1] == "{") {
           if (c[i + 2] ~ /[ \t|]/) refuse("a ${ command; } substitution")
-          outer = !inbrace(); qbad = 1; push("${", q); q = 0; o = o " $"; if (outer) bmark = length(o); i += 2; continue
+          outer = !inbrace(); qdollar = 1; push("${", q); q = 0; if (outer) bmark = length(o); i += 2; continue
         }
-        if (ch == "`") { qbad = 1; push("`", q); q = 0; o = o " `"; i++; continue }
+        if (ch == "`") { qmark = 1; push("`", q); q = 0; o = o " `"; i++; continue }
+        # a bare `$name` / `$1` / special param inside "..." may expand to nothing, so it contributes
+        # nothing to the word: a flag glued after it (`"$x--force"`) stays a visible, bounded token
+        if (q == 2 && ch == "$" && c[i + 1] ~ /[A-Za-z_]/) { qdollar = 1; i += 2; while (i <= n && c[i] ~ /[A-Za-z0-9_]/) i++; continue }
+        if (q == 2 && ch == "$" && c[i + 1] ~ /[0-9@*#?!$-]/) { qdollar = 1; i += 2; continue }
         if (q == 2) qb = qb ch
         i++; continue
       }
@@ -209,9 +220,9 @@ strip_data() {
         if (i == n) { cont = 1; i++; continue }
         o = o ((c[i + 1] ~ /[;&|]/) ? " " : (c[i + 1] ~ /[*?\[{]/) ? "\"\"" : c[i + 1]); i += 2; continue
       }
-      if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; qfresh = fresh(); i += 2; continue }
-      if (ch == "\047") { q = 1; qb = ""; qbad = 0; qfresh = fresh(); i++; continue }
-      if (ch == "\"") { q = 2; qb = ""; qbad = 0; qfresh = fresh(); i++; continue }
+      if (ch == "$" && c[i + 1] == "\047") { q = 3; qb = ""; qbad = 0; qmark = 0; qdollar = 0; qfresh = fresh(); i += 2; continue }
+      if (ch == "\047") { q = 1; qb = ""; qbad = 0; qmark = 0; qdollar = 0; qfresh = fresh(); i++; continue }
+      if (ch == "\"") { q = 2; qb = ""; qbad = 0; qmark = 0; qdollar = 0; qfresh = fresh(); i++; continue }
       # a comment starts only where a word starts: after whitespace, a control operator, or the `)`
       # that ends a subshell or an `((...))` command. The `)` of `$(...)` / `$((...))` or a closing
       # backtick ends a word, and `#` after it is part of that word.
@@ -413,6 +424,7 @@ while IFS= read -r SEG; do
         case "$T" in '$(') SUB=$((SUB + 1)); WANT=""; continue ;; esac
         if [ "$SUB" -gt 0 ]; then case "$T" in *')'*) SUB=$((SUB - 1)) ;; esac; continue; fi   # `)` glues to its word (`date)`)
         if [ -n "$WANT" ]; then WANT=""; continue; fi   # the value of the previous option, whatever its shape
+        [ "$T" = '$' ] && continue                     # a possibly-empty expansion word is not a definite pathspec
         case "$T" in
           *[\<\>]*)                                  # a redirection glued to a word (`tracked.txt>log`, `2>`): the word stays an argument
             case "$T" in *[\<\>]) WANT=1 ;; esac    # the operator's target is the next token, not a pathspec
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index d277c6e..dc729f8 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -818,6 +818,22 @@ run "bare \$x then empty quote before --force" 2 'git push origin $x""--force'
 run "bare \$x before a bash wrapper flag"    2 'bash $x-c "git push --force origin main"'
 run "bare \$x in a normal push is allowed"   0 'git push origin $branch'
 run "bare \$1 glued before --force"          2 'git push origin $1--force'
+run "quoted \$x glued before --force"        2 'git push origin "$x--force"'
+run "quoted \${x} glued before --force"      2 'git push origin "${x}--force"'
+run "quoted \$x, two spans, before --force"  2 'git push origin "$x""--force"'
+run "quoted \$x span then unquoted --force"  2 'git push origin "$x"--force'
+run "quoted \$@ glued before --force"        2 'git push origin "$@--force"'
+run "quoted \$x glued before -f"             2 'git push "$x-f" origin'
+run "quoted \$x glued before --no-verify"    2 'git push "$x--no-verify"'
+run "quoted \$x after -m ok before --no-verify" 2 'git commit -m ok "$x--no-verify"'
+run "quoted \$x glued before -n"             2 'git commit "$x-n" -m ok'
+run "quoted \${x} split-span bot author is a documented limit" 0 'git commit --author="$x""Claude Bot <a@b.c>" -m x'
+run "single-span quoted bot author is still caught" 2 'git commit --author="Claude Bot <a@b.c>" -m x'
+run "quoted \$x normal refspec is allowed"   0 'git push origin "$branch"'
+run "quoted \${x} prefix message is allowed" 0 'git commit -m "${x} done"'
+run "quoted substitution message, no pathspec, dirty secret" 0 'git commit -m "$(date)"'
+run "quoted \${x} message then pathspec, dirty secret" 2 'git commit -m "${x}" tracked.txt'
+run "quoted \$x message then pathspec, dirty secret" 2 'git commit -m "$x" tracked.txt'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From 991fc08577fd275283ba2c3537a5274bc0fd7b70 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 10:46:19 +0100
Subject: [PATCH 30/39] fix(hooks): refuse a ${parameter:-default} whose
 default value is a flag

A `${x:---force}` or `${x:=--no-verify}` expands to that flag when the
parameter is unset, which is the default state, so unlike variable
indirection it needs no prior assignment. The walk drops a `${...}`
interior, so it never saw the flag, and `git push origin "${x:---force}"`
force-pushed while the guard allowed it, quoted or not.

A `${...}` whose `:-`, `-`, `:=`, or `=` default begins with a dash is
now refused: the walk cannot tell whether it expands to that flag. A
normal default is a value, not a flag, so `${VERSION:-0.0.0}`,
`${BRANCH:-main}`, `${x:-HEAD}`, a length `${#x}`, and a replacement
`${x//a/b}` are unaffected.
---
 hooks/guard-commit.sh            | 9 ++++++++-
 tests/hooks/test-guard-commit.sh | 9 +++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index e376ae7..a281094 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -29,7 +29,8 @@
 # `--force-if-includes` on its own, `-S<keyid>` with an
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
-# option (`bash $a -c`: bash may see nothing there), git config passed through the environment in
+# option (`bash $a -c`: bash may see nothing there), a `${x:-default}` in a commit or push whose
+# default value is itself a flag (`${x:---force}`; refused, since it may expand to that flag), git config passed through the environment in
 # a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`, `XDG_CONFIG_HOME=`),
 # a commit message mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`/`XDG_CONFIG_HOME=`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
@@ -390,6 +391,12 @@ WRAPPER="${SHW}${RD}${XW}${RD}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}${RD}${XW}${
 if has '(^|[^[:alnum:]_])alias\.' "$STRIPPED" || has '-c[[:space:]]*["'"'"']?alias\.' "$CMD"; then
   echo "Blocked: a git alias defined in the same call as a commit/push cannot be inspected. Define it separately, or use the full subcommand." >&2; exit 2
 fi
+# A ${param:-WORD} / ${param=WORD} default (or := ) whose value begins with a dash expands to that
+# flag when the parameter is unset — with no prior assignment, unlike variable indirection — and the
+# walk drops the interior, so it cannot see it. Refuse it (a normal default is a value, not a flag).
+if has '\$\{[A-Za-z0-9_#!]*:?[-=]-' "$CMD"; then
+  echo "Blocked: a \${parameter:-default} whose default value is a flag cannot be inspected (it may expand to that flag). Pass the flag directly, or set the variable first in its own call." >&2; exit 2
+fi
 
 IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""; HAS_WORKTREE=""
 while IFS= read -r SEG; do
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index dc729f8..6aba584 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -834,6 +834,15 @@ run "quoted \${x} prefix message is allowed" 0 'git commit -m "${x} done"'
 run "quoted substitution message, no pathspec, dirty secret" 0 'git commit -m "$(date)"'
 run "quoted \${x} message then pathspec, dirty secret" 2 'git commit -m "${x}" tracked.txt'
 run "quoted \$x message then pathspec, dirty secret" 2 'git commit -m "$x" tracked.txt'
+run "quoted \${x:-} default is a flag"       2 'git push origin "${x:---force}"'
+run "unquoted \${x:-} default is a flag"     2 'git push origin ${x:---force}'
+run "\${x:=} default is --no-verify"         2 'git commit "${x:=--no-verify}" -m x'
+run "\${x=} default is a flag"               2 'git push origin ${x=--force}'
+run "\${VERSION:-0.0.0} default is allowed"  0 'git commit -m "${VERSION:-0.0.0}"'
+run "\${BRANCH:-main} default is allowed"    0 'git push origin "${BRANCH:-main}"'
+run "\${x:-HEAD} default is allowed"         0 'git push origin ${x:-HEAD}'
+run "\${#files} length is allowed"           0 'git commit -m "count ${#files}"'
+run "\${x//a/b} replacement is allowed"      0 'git commit -m "${x//a/b}"'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From e1a97c4a2e5da3fb574d60accf31b7b67ca28f94 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 10:56:41 +0100
Subject: [PATCH 31/39] fix(hooks): the flag-default refuse also covers
 alternate operators and a space before the dash

The previous refuse caught only `:-`, `-`, `:=`, `=`. It missed the
alternate operators `:+` and `+`, which produce their value when the
parameter is set: `${HOME:+--force}` fires deterministically, since HOME
is always set, with no prior assignment. It also missed a space between
the operator and the dash (`${x:- --force}`), which an unquoted
expansion word-splits into the flag. Both are now refused, and an array
subscript before the operator (`${a[0]:---force}`) is handled.

A `${x/pat/--force}` replacement producing a flag needs the variable set
to a controlled value first, so it is folded into the documented
variable-indirection limit rather than guessed at.

The concatenated-quoted-span identity form (`--author="$x""Claude"`)
moves from the false-block list to the accepted-limits list: it is a
false allow mitigated by the enforced repo-config committer check, not
an over-block, and the header now says so.
---
 hooks/guard-commit.sh            | 18 ++++++++++--------
 tests/hooks/test-guard-commit.sh |  9 +++++++++
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index a281094..449fa81 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -6,7 +6,10 @@
 # Needs jq and git 2.28+ (for --no-relative and --output-indicator-new on the diff it reads).
 #
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
-# accepted limits: variable indirection (`p=push; git $p -f`), git aliases defined in an earlier
+# accepted limits: variable indirection (`p=push; git $p -f`, or a `${x/pat/--force}` replacement,
+# both of which need the variable set to a controlled value first), a committer or author name split
+# across concatenated quoted spans (`--author="$x""Claude"`; the enforced committer from repo config
+# is still checked), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
 # unique-prefix long options (`--no-veri`), a word or flag spliced by any expansion or substitution
 # (`git pu${x}sh`, `git pu$(echo s)h`, `--for$(echo c)e`), and the committer and secrets
@@ -22,15 +25,14 @@
 # in the same call as a commit or push (`git config alias.st status; git commit`, `git commit -m x
 # alias.md`), a substitution inside `${...}` (`${v:-$(git describe)}`), a one-word quoted argument
 # that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a quoted
-# identity inside a message (`-m "set user.name='claude'"`), a committer/author name split
-# across concatenated quoted spans (`--author="$x""Claude"`; the enforced committer from repo
-# config is still checked), a `-n` or `-f` on another
+# identity inside a message (`-m "set user.name='claude'"`), a `-n` or `-f` on another
 # command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
 # `--force-if-includes` on its own, `-S<keyid>` with an
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
-# option (`bash $a -c`: bash may see nothing there), a `${x:-default}` in a commit or push whose
-# default value is itself a flag (`${x:---force}`; refused, since it may expand to that flag), git config passed through the environment in
+# option (`bash $a -c`: bash may see nothing there), a `${x}` in a commit or push whose default
+# or alternate value is itself a flag (`${x:---force}`, `${x:+--force}`; refused, since it may expand
+# to that flag), git config passed through the environment in
 # a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`, `XDG_CONFIG_HOME=`),
 # a commit message mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`/`XDG_CONFIG_HOME=`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
@@ -394,8 +396,8 @@ fi
 # A ${param:-WORD} / ${param=WORD} default (or := ) whose value begins with a dash expands to that
 # flag when the parameter is unset — with no prior assignment, unlike variable indirection — and the
 # walk drops the interior, so it cannot see it. Refuse it (a normal default is a value, not a flag).
-if has '\$\{[A-Za-z0-9_#!]*:?[-=]-' "$CMD"; then
-  echo "Blocked: a \${parameter:-default} whose default value is a flag cannot be inspected (it may expand to that flag). Pass the flag directly, or set the variable first in its own call." >&2; exit 2
+if has '\$\{[A-Za-z0-9_!#]*(\[[^]]*\])?:?[-=+][[:space:]]*-' "$CMD"; then
+  echo "Blocked: a \${parameter} whose default or alternate value is a flag cannot be inspected (it may expand to that flag). Pass the flag directly, or set the variable first in its own call." >&2; exit 2
 fi
 
 IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""; HAS_WORKTREE=""
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 6aba584..89a28d1 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -843,6 +843,15 @@ run "\${BRANCH:-main} default is allowed"    0 'git push origin "${BRANCH:-main}
 run "\${x:-HEAD} default is allowed"         0 'git push origin ${x:-HEAD}'
 run "\${#files} length is allowed"           0 'git commit -m "count ${#files}"'
 run "\${x//a/b} replacement is allowed"      0 'git commit -m "${x//a/b}"'
+run "\${HOME:+--force} alternate is a flag"   2 'git push origin "${HOME:+--force}"'
+run "\${x:+-n} alternate is a flag"          2 'git commit -m ok "${x:+-n}"'
+run "\${x+--force} bare alternate is a flag" 2 'git push origin ${x+--force}'
+run "\${x:- space then flag} default is a flag" 2 'git push origin ${x:- --force}'
+run "\${a[0]:---force} subscript default is a flag" 2 'git push origin "${a[0]:---force}"'
+run "\${x:+value} alternate value is allowed" 0 'git commit -m "${x:+ready}"'
+run "\${x/a/b} replacement is allowed (indirection limit)" 0 'git commit -m "${x/a/b}"'
+run "\${x//-/_} dash-strip replacement is allowed" 0 'git commit -m "${x//-/_}"'
+run "\${x:-a-b} hyphenated default value is allowed" 0 'git commit -m "${x:-a-b}"'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From 1ae042efccf503384eb6a556a9ed828d9fbba587 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 11:11:01 +0100
Subject: [PATCH 32/39] fix(hooks): a brace-default value that is a flag, a
 +refspec, or a config/identity token is refused

A brace default whose value the walk drops was only partly covered. The
value could be quoted or escaped past the check (`${x:-"--force"}`,
`${x:-\-\-force}`), so the dash test now steps over a run of
non-alphanumerics before the flag. The value could also be a `+refspec`,
the other force-push form (`git push origin ${x:-+main}`), so the value
class is now a dash or a plus.

The same dropped interior hid a config or identity token fed to a slot
that only a raw-command check guards: `git -c ${x:-core.hooksPath=/tmp}`
disabled the repo hooks, and `git -c ${x:-user.name=Claude}`,
`git -c user.name=${x:-Claude}`, `GIT_AUTHOR_NAME=${x:-Claude}`,
`--author=${x:-Claude}`, and `core.hooksPath=$HOME` set a non-human
committer or re-pointed the hooks path, all while the guard allowed it.
A `-c`, `--config`, committer, author, or hooksPath value taken from a
shell expansion is now refused, since the walk cannot see it. A literal
override (`-c user.name="Dennis"`) is unaffected.

This also closes the concatenated-quoted-span author form
(`--author="$x""Claude"`), which was a documented limit: its `--author="$`
is a value from an expansion, so it is now caught rather than tolerated.
---
 hooks/guard-commit.sh            | 19 ++++++++++++-------
 tests/hooks/test-guard-commit.sh | 20 +++++++++++++++++++-
 2 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 449fa81..0c63ae2 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -7,9 +7,7 @@
 #
 # This is a backstop behind the settings.json deny rules and plan mode, not a sandbox. Known,
 # accepted limits: variable indirection (`p=push; git $p -f`, or a `${x/pat/--force}` replacement,
-# both of which need the variable set to a controlled value first), a committer or author name split
-# across concatenated quoted spans (`--author="$x""Claude"`; the enforced committer from repo config
-# is still checked), git aliases defined in an earlier
+# both of which need the variable set to a controlled value first), git aliases defined in an earlier
 # call, `git config core.hooksPath` set in an earlier call, flags fed through a pipe (`xargs`),
 # unique-prefix long options (`--no-veri`), a word or flag spliced by any expansion or substitution
 # (`git pu${x}sh`, `git pu$(echo s)h`, `--for$(echo c)e`), and the committer and secrets
@@ -31,9 +29,10 @@
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
 # option (`bash $a -c`: bash may see nothing there), a `${x}` in a commit or push whose default
-# or alternate value is itself a flag (`${x:---force}`, `${x:+--force}`; refused, since it may expand
+# or alternate value is itself a flag or a `+refspec` (`${x:---force}`, `${x:-+main}`, `${x:-"--force"}`; refused, since it may expand
 # to that flag), git config passed through the environment in
-# a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`, `XDG_CONFIG_HOME=`),
+# a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`, `XDG_CONFIG_HOME=`), a
+# `-c`/committer/author value taken from an expansion (`git -c ${x:-user.name=Claude}`; refused),
 # a commit message mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`/`XDG_CONFIG_HOME=`, a diff over 16 MB (commit
 # large binaries separately, or via LFS), and an ANSI-C numeric escape (`$'\033[0m'`) in a call
 # that also mentions git, commit, or push. A call whose every one of those words is itself
@@ -396,8 +395,14 @@ fi
 # A ${param:-WORD} / ${param=WORD} default (or := ) whose value begins with a dash expands to that
 # flag when the parameter is unset — with no prior assignment, unlike variable indirection — and the
 # walk drops the interior, so it cannot see it. Refuse it (a normal default is a value, not a flag).
-if has '\$\{[A-Za-z0-9_!#]*(\[[^]]*\])?:?[-=+][[:space:]]*-' "$CMD"; then
-  echo "Blocked: a \${parameter} whose default or alternate value is a flag cannot be inspected (it may expand to that flag). Pass the flag directly, or set the variable first in its own call." >&2; exit 2
+if has '\$\{[A-Za-z0-9_!#]*(\[[^]]*\])?:?[-=+][^A-Za-z0-9]*[-+]' "$CMD"; then
+  echo "Blocked: a \${parameter} whose default or alternate value is a flag or a +refspec cannot be inspected (it may expand to that). Pass it directly, or set the variable first in its own call." >&2; exit 2
+fi
+# A -c / --config / committer / author / hooksPath value taken from an expansion is out of the walk's
+# sight (`git -c ${x:-user.name=Claude}`, `GIT_AUTHOR_NAME=${x:-Claude}`), so the identity/hooksPath
+# checks below never see it: refuse. A legitimate override is a literal, not an expansion.
+if has '(-c|--config)[[:space:]]+["'"'"']?\$|(user\.name|user\.email|core\.hooksPath|--author|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL))=["'"'"']?\$' "$CMD"; then
+  echo "Blocked: a git config, committer, or author value taken from a shell expansion cannot be inspected (CLAUDE.md §2). Set it to a literal, or set the variable first in its own call." >&2; exit 2
 fi
 
 IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""; HAS_WORKTREE=""
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 89a28d1..9b8aeff 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -827,7 +827,7 @@ run "quoted \$x glued before -f"             2 'git push "$x-f" origin'
 run "quoted \$x glued before --no-verify"    2 'git push "$x--no-verify"'
 run "quoted \$x after -m ok before --no-verify" 2 'git commit -m ok "$x--no-verify"'
 run "quoted \$x glued before -n"             2 'git commit "$x-n" -m ok'
-run "quoted \${x} split-span bot author is a documented limit" 0 'git commit --author="$x""Claude Bot <a@b.c>" -m x'
+run "quoted \${x} split-span bot author is refused (value from an expansion)" 2 'git commit --author="$x""Claude Bot <a@b.c>" -m x'
 run "single-span quoted bot author is still caught" 2 'git commit --author="Claude Bot <a@b.c>" -m x'
 run "quoted \$x normal refspec is allowed"   0 'git push origin "$branch"'
 run "quoted \${x} prefix message is allowed" 0 'git commit -m "${x} done"'
@@ -852,6 +852,24 @@ run "\${x:+value} alternate value is allowed" 0 'git commit -m "${x:+ready}"'
 run "\${x/a/b} replacement is allowed (indirection limit)" 0 'git commit -m "${x/a/b}"'
 run "\${x//-/_} dash-strip replacement is allowed" 0 'git commit -m "${x//-/_}"'
 run "\${x:-a-b} hyphenated default value is allowed" 0 'git commit -m "${x:-a-b}"'
+run "\${x:-\"--force\"} quoted default is a flag" 2 'git push origin ${x:-"--force"}'
+run "\${x:-'"'"'--force'"'"'} single-quoted default is a flag" 2 'git push origin ${x:-'"'"'--force'"'"'}'
+run "\${x:-\\-\\-force} backslashed default is a flag" 2 'git push origin ${x:-\-\-force}'
+run "\${x:-\"0.0.0\"} quoted non-flag default is allowed" 0 'git commit -m "${x:-"0.0.0"}"'
+run "\${x:-v1.0} versiony default is allowed"  0 'git commit -m "${x:-v1.0}"'
+run "\${x:-+main} refspec default is force"   2 'git push origin ${x:-+main}'
+run "\${x:-\"+main\"} quoted refspec default is force" 2 'git push origin ${x:-"+main"}'
+run "\${x:-+HEAD:main} refspec default is force" 2 'git push origin ${x:-+HEAD:main}'
+run "-c value from an expansion is refused"   2 'git -c ${x:-core.hooksPath=/tmp} commit -m x'
+run "-c user.name from an expansion is refused" 2 'git -c ${x:-user.name=Claude} commit -m x'
+run "user.name= value from an expansion is refused" 2 'git -c user.name=${x:-Claude} commit -m x'
+run "GIT_AUTHOR_NAME from an expansion is refused" 2 'GIT_AUTHOR_NAME=${x:-Claude} git commit -m x'
+run "GIT_COMMITTER_EMAIL from an expansion is refused" 2 'GIT_COMMITTER_EMAIL=${x} git commit -m x'
+run "--author from an expansion is refused"   2 'git commit --author=${x:-Claude} -m x'
+run "core.hooksPath from an expansion is refused" 2 'git -c core.hooksPath=$HOME commit -m x'
+run "-c with a literal human name is allowed" 0 'git -c user.name="Dennis Vorobyov" commit -m x'
+run "commit -c reuse-message sha is allowed"  0 'git commit -c abc1234 -m x'
+run "message mentioning user.name in prose is allowed" 0 'git commit -m "note about user.name settings"'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From ff4bf184d4a9fd736a4e425180c011dc34af7dad Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 11:28:05 +0100
Subject: [PATCH 33/39] fix(hooks): a config or identity value built from an
 expansion is caught even when the key is split

The previous refuse anchored the expansion to the character right after
-c or after the key's =, so a value built by concatenation slipped past:
git -c c"$(printf 'ore.hooksPath=/tmp')" commit set core.hooksPath (an
attacker-writable hooks path is code execution), and
GIT_AUTHOR_NAME=C"$(printf laude)" set a non-human committer, both while
the guard allowed them. The literal key itself was split across a
literal prefix and a substitution, so no contiguous key matched either.

Three checks replace the one anchored rule:

- A brace default or alternate whose value carries an `=` is a possible
  config token and is refused (`${x:-user.name=Claude}`), alongside the
  existing flag and +refspec values.
- On the stripped text, an identity, author, or hooksPath `KEY=` value
  that carries any expansion is refused. The stripped text has already
  dropped a quoted message, so a commit message that mentions such a key
  is exempt; a real override keeps its literal key and the value's mark.
- In the segment loop, a config-position `-c`/`--config` (before the
  subcommand) whose value carries an expansion is refused, which catches
  a key split across a substitution. A reuse-message `commit -c $sha`
  (value after the subcommand) and a `-C <dir>` change-directory
  (uppercase) are not that and stay allowed.
---
 hooks/guard-commit.sh            | 29 +++++++++++++++++++----------
 tests/hooks/test-guard-commit.sh | 13 +++++++++++++
 2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 0c63ae2..5f6e5b7 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -392,17 +392,19 @@ WRAPPER="${SHW}${RD}${XW}${RD}[[:space:]]*[)}]*[[:space:]]*\$|${SHW}${RD}${XW}${
 if has '(^|[^[:alnum:]_])alias\.' "$STRIPPED" || has '-c[[:space:]]*["'"'"']?alias\.' "$CMD"; then
   echo "Blocked: a git alias defined in the same call as a commit/push cannot be inspected. Define it separately, or use the full subcommand." >&2; exit 2
 fi
-# A ${param:-WORD} / ${param=WORD} default (or := ) whose value begins with a dash expands to that
-# flag when the parameter is unset — with no prior assignment, unlike variable indirection — and the
-# walk drops the interior, so it cannot see it. Refuse it (a normal default is a value, not a flag).
-if has '\$\{[A-Za-z0-9_!#]*(\[[^]]*\])?:?[-=+][^A-Za-z0-9]*[-+]' "$CMD"; then
-  echo "Blocked: a \${parameter} whose default or alternate value is a flag or a +refspec cannot be inspected (it may expand to that). Pass it directly, or set the variable first in its own call." >&2; exit 2
+# A ${param:-WORD} default/alternate whose value the walk drops can expand, with no prior assignment,
+# to a flag, a +refspec, or a config token (`${x:---force}`, `${x:-+main}`, `${x:-user.name=Claude}`).
+# A normal default is a plain value; refuse one that is a dash/plus-led flag or that carries an `=`.
+if has '\$\{[A-Za-z0-9_!#]*(\[[^]]*\])?:?[-=+]([^A-Za-z0-9]*[-+]|[^}]*=)' "$CMD"; then
+  echo "Blocked: a \${parameter} default/alternate that is a flag, a +refspec, or a config token cannot be inspected (it may expand to that). Pass it directly, or set the variable first in its own call." >&2; exit 2
 fi
-# A -c / --config / committer / author / hooksPath value taken from an expansion is out of the walk's
-# sight (`git -c ${x:-user.name=Claude}`, `GIT_AUTHOR_NAME=${x:-Claude}`), so the identity/hooksPath
-# checks below never see it: refuse. A legitimate override is a literal, not an expansion.
-if has '(-c|--config)[[:space:]]+["'"'"']?\$|(user\.name|user\.email|core\.hooksPath|--author|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL))=["'"'"']?\$' "$CMD"; then
-  echo "Blocked: a git config, committer, or author value taken from a shell expansion cannot be inspected (CLAUDE.md §2). Set it to a literal, or set the variable first in its own call." >&2; exit 2
+# A committer, author, or hooksPath value built from an expansion (`GIT_AUTHOR_NAME=C$(printf laude)`,
+# `-c user.name=$x`, `--author=A${y}`) is out of the walk's sight, so the identity/hooksPath checks
+# below never see it. Scan the stripped text (a quoted message is already dropped there, so a prose
+# mention is exempt); a real override keeps its literal `KEY=` and the value's expansion mark.
+# shellcheck disable=SC2016  # $ and ` are literal regex chars
+if hasc '(user\.name=|user\.email=|core\.hooksPath=|--author=|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL)=)[^[:space:]$`]*[[:space:]]*[$`]' "$STRIPPED"; then
+  echo "Blocked: a committer, author, or hooksPath value built from a shell expansion cannot be inspected (CLAUDE.md §2). Set it to a literal, or set the variable first in its own call." >&2; exit 2
 fi
 
 IS_COMMIT=""; HAS_PUSH=""; HAS_ADD=""; HAS_WORKTREE=""
@@ -415,6 +417,13 @@ while IFS= read -r SEG; do
   has 'git.*[[:space:]]commit([^[:alnum:]]|$)' "$SEG" && SEG_COMMIT=1
   has 'git.*[[:space:]]push([^[:alnum:]]|$)' "$SEG" && SEG_PUSH=1
   has 'git.*[[:space:]]add([^[:alnum:]]|$)' "$SEG" && HAS_ADD=1
+  # a config-position -c/--config (before the subcommand) whose value carries an expansion cannot be
+  # inspected (`git -c c$(printf ore.hooksPath=x) commit`); a reuse-message `commit -c $sha` (value
+  # after the subcommand) and a `-C <dir>` chdir (uppercase) are not this and stay allowed.
+  # shellcheck disable=SC2016  # $ and ` are literal regex chars
+  if [ -n "$SEG_COMMIT$SEG_PUSH" ] && hasc '(^|[[:space:]])(-c|--config)[[:space:]]+[^[:space:]$`]*[[:space:]]*[$`].*[[:space:]](commit|push)([^[:alnum:]]|$)' "$SEG"; then
+    echo "Blocked: a git -c/--config value built from a shell expansion cannot be inspected (it may set core.hooksPath or a committer). Pass a literal, or set it separately." >&2; exit 2
+  fi
   # an unquoted `*`, `?`, `[`, or `{a,b}` is expanded by bash when the command runs, into words this
   # walk never sees (`-*` with a file named `--no-verify` in the directory; `--{force,}`)
   if [ -n "$SEG_COMMIT$SEG_PUSH" ] && hasc '[*?[]|\{[^[:space:]{}]*(,|\.\.)[^[:space:]{}]*\}' "$SEG"; then
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 9b8aeff..ff59637 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -870,6 +870,19 @@ run "core.hooksPath from an expansion is refused" 2 'git -c core.hooksPath=$HOME
 run "-c with a literal human name is allowed" 0 'git -c user.name="Dennis Vorobyov" commit -m x'
 run "commit -c reuse-message sha is allowed"  0 'git commit -c abc1234 -m x'
 run "message mentioning user.name in prose is allowed" 0 'git commit -m "note about user.name settings"'
+run "hooksPath key split across a substitution" 2 'git -c c"$(printf ore.hooksPath=/tmp/h)" commit -m x'
+run "user.name key split across a substitution" 2 'git -c u"$(printf ser.name=Claude)" commit -m x'
+run "hooksPath key split across a brace default" 2 'git -c c"${x:-ore.hooksPath=/tmp/h}" commit -m x'
+run "GIT_AUTHOR_NAME value split across a substitution" 2 'GIT_AUTHOR_NAME=C"$(printf laude)" git commit -m x'
+run "GIT_COMMITTER_NAME value split across a substitution" 2 'GIT_COMMITTER_NAME=C"$(printf laude)" git commit -m x'
+run "--author value split across a substitution" 2 'git commit --author=A"$(printf laude)" -m x'
+run "--config value from a substitution"      2 'git --config c"$(printf ore.hooksPath=/tmp)" commit -m x'
+run "user.email value from an expansion is refused" 2 'git -c user.email=${x:-bot@example.com} commit -m x'
+run "prose message mentioning core.hooksPath= is allowed" 0 'git commit -m "docs: core.hooksPath=$HOME is risky"'
+run "reuse-message commit -c with a variable sha is allowed" 0 'git commit -c ${sha} -m x'
+run "reuse-message commit -C with a substitution sha is allowed" 0 'git commit -C "$(git rev-parse HEAD)" -m x'
+run "git -C chdir from a variable is allowed"  0 'git -C "$repo" push origin main'
+run "commit then chained push, reuse sha, allowed" 0 'git commit -c ${sha} -m x && git push origin main'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From 1126b900113a9e4158e106503bfe1e634803390d Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 11:37:33 +0100
Subject: [PATCH 34/39] fix(hooks): a same-call `git config user.name/email` to
 a bot is refused, mirroring the hooksPath rule
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The committer check reads the repo config as it stands before the
command runs. A `git config user.name Claude && git commit` in the same
call sets the bot identity first, so the commit lands as Claude while
the guard, having read the pre-execution human name, allowed it. The
same-call `core.hooksPath` write was already refused; this is its
identity twin, and it was the last unguarded §2 committer channel.

A `git config` (with any flags, or the `set` subcommand) that writes
user.name or user.email to a known bot identity, in a call that also
commits, is now refused. A literal human name (`git config user.name
"Dennis" && git commit`) and an unrelated key (`core.editor`) are
unaffected. As with the other identity checks, a commit message that
quotes such a config line is a documented false block.

The header now records that a brace default carrying `=` is refused as
a possible config token, and that a case-insensitive `-c` key from an
expansion is caught by the config-position refuse.
---
 hooks/guard-commit.sh            | 17 ++++++++++++-----
 tests/hooks/test-guard-commit.sh | 13 +++++++++++++
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 5f6e5b7..5cd0aa0 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -23,14 +23,14 @@
 # in the same call as a commit or push (`git config alias.st status; git commit`, `git commit -m x
 # alias.md`), a substitution inside `${...}` (`${v:-$(git describe)}`), a one-word quoted argument
 # that spells a flag or subcommand (`-m "--no-verify"`, `-m "eval"`, `tag -m "push" -f`), a quoted
-# identity inside a message (`-m "set user.name='claude'"`), a `-n` or `-f` on another
+# identity inside a message (`-m "set user.name='claude'"`, `-m "run git config user.name claude"`), a `-n` or `-f` on another
 # command inside the same `$(...)` as a commit or push (`-m "$(git log -1 | head -n 1)"`),
 # `--force-if-includes` on its own, `-S<keyid>` with an
 # `n` in the key id, an unquoted `*`, `?`, `[`, or `{a,b}` in a commit or push (bash expands it
 # when the command runs; quote it, or list the files), an expansion between a shell and its
-# option (`bash $a -c`: bash may see nothing there), a `${x}` in a commit or push whose default
-# or alternate value is itself a flag or a `+refspec` (`${x:---force}`, `${x:-+main}`, `${x:-"--force"}`; refused, since it may expand
-# to that flag), git config passed through the environment in
+# option (`bash $a -c`: bash may see nothing there), a `${x}` in a commit or push whose default or
+# alternate value is a flag, a `+refspec`, or a config token carrying `=` (`${x:---force}`, `${x:-+main}`,
+# `${x:-"--force"}`, `${x:-user.name=Claude}`; refused, since it may expand to that), git config passed through the environment in
 # a commit or push call (`--config-env`, `GIT_CONFIG_*`, `include.path`, `HOME=`, `XDG_CONFIG_HOME=`), a
 # `-c`/committer/author value taken from an expansion (`git -c ${x:-user.name=Claude}`; refused),
 # a commit message mentioning `-c core.hooksPath` or an unquoted `include.path`/`HOME=`/`XDG_CONFIG_HOME=`, a diff over 16 MB (commit
@@ -401,7 +401,8 @@ fi
 # A committer, author, or hooksPath value built from an expansion (`GIT_AUTHOR_NAME=C$(printf laude)`,
 # `-c user.name=$x`, `--author=A${y}`) is out of the walk's sight, so the identity/hooksPath checks
 # below never see it. Scan the stripped text (a quoted message is already dropped there, so a prose
-# mention is exempt); a real override keeps its literal `KEY=` and the value's expansion mark.
+# mention is exempt); a real override keeps its literal `KEY=` and the value's expansion mark. A
+# case-insensitive key (`User.Name=$x`) is caught by the config-position `-c` refuse in the loop below.
 # shellcheck disable=SC2016  # $ and ` are literal regex chars
 if hasc '(user\.name=|user\.email=|core\.hooksPath=|--author=|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL)=)[^[:space:]$`]*[[:space:]]*[$`]' "$STRIPPED"; then
   echo "Blocked: a committer, author, or hooksPath value built from a shell expansion cannot be inspected (CLAUDE.md §2). Set it to a literal, or set the variable first in its own call." >&2; exit 2
@@ -521,6 +522,12 @@ if has "(user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author[= ])([^[:space:]]*[^[
    has "[\"'](user\.name=|GIT_(AUTHOR|COMMITTER)_NAME=|--author=)([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|\$)" "$CMD"; then
   echo "Blocked: the commit sets a committer or author that is not a human (CLAUDE.md §2)." >&2; exit 2
 fi
+# A same-call `git config [--flags] [set] user.name|user.email <bot>` write lands after this hook has
+# read the pre-execution repo config, so it evades the committer check above — the identity twin of the
+# same-call core.hooksPath write. Refuse a config write of a non-human name/email.
+if has "(^|[^[:alnum:]])config([[:space:]]+(--[A-Za-z-]+|set))*[[:space:]]+user\\.(name|email)[[:space:]]+[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$CMD"; then
+  echo "Blocked: a same-call 'git config user.name/email' sets a committer that is not a human (CLAUDE.md §2). Set the identity to a literal human name, in its own call." >&2; exit 2
+fi
 
 # no AI attribution in the commit message — scan the command only, not the staged diff.
 # (This is a repo *about* Claude Code; legit messages will say "Claude Code". Only
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index ff59637..9d92ee2 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -883,6 +883,19 @@ run "reuse-message commit -c with a variable sha is allowed" 0 'git commit -c ${
 run "reuse-message commit -C with a substitution sha is allowed" 0 'git commit -C "$(git rev-parse HEAD)" -m x'
 run "git -C chdir from a variable is allowed"  0 'git -C "$repo" push origin main'
 run "commit then chained push, reuse sha, allowed" 0 'git commit -c ${sha} -m x && git push origin main'
+run "git config user.name to a bot then commit" 2 'git config user.name Claude && git commit -am x'
+run "git config user.name quoted bot then commit" 2 'git config user.name "Claude" && git commit -m x'
+run "git config user.name two-word bot then commit" 2 'git config user.name "Claude Bot" && git commit -m x'
+run "git config --local user.name bot then commit" 2 'git config --local user.name Cursor && git commit -am x'
+run "git config set user.name bot then commit" 2 'git config set user.name Claude && git commit -m x'
+run "git config user.email bot then commit"   2 'git config user.email bot@anthropic.com && git commit -m x'
+run "git config user.name github-actions then commit" 2 'git config user.name "github-actions" && git commit -m x'
+run "case-mismatched -c User.Name from expansion" 2 'git -c User.Name=${x:-Claude} commit -m x'
+run "git config user.name human then commit"  0 'git config user.name "Dennis Vorobyov" && git commit -m x'
+run "git config core.editor then commit"      0 'git config core.editor vim && git commit -m x'
+run "git config user.email human then commit" 0 'git config user.email denny@example.com && git commit -m x'
+run "git config commit.gpgsign then commit"   0 'git config commit.gpgsign true && git commit -m x'
+run "brace default carrying = is a config token" 2 'git commit --trailer ${x:-Acked-by=me} -m x'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From 8d9c3722260f3b811898aec22eb1c0a793d7c877 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 11:43:47 +0100
Subject: [PATCH 35/39] fix(hooks): the config-identity check reads the
 stripped text and refuses a value built from an expansion

The same-call config-identity refuse only read the raw command and
needed a contiguous bot name, so two shapes slipped through: a split
key (`git config user.na"me" Claude`, whose key glues back only in the
stripped text) and a value built from an expansion (`git config
user.name C"$(printf laude)"`, `git config user.name $BOT`), where the
bot name is never a literal.

The literal-identity check now also scans the stripped text, so a split
key is seen. And a config write of user.name or user.email whose value
carries any expansion is refused, since the walk cannot read what it
becomes. A quoted commit message is already dropped in the stripped
text, so a prose mention stays exempt, and a config write of an
unrelated key from a variable (`core.editor $EDITOR`) is unaffected.
---
 hooks/guard-commit.sh            | 11 ++++++++++-
 tests/hooks/test-guard-commit.sh |  6 ++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 5cd0aa0..91dc4cf 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -525,9 +525,18 @@ fi
 # A same-call `git config [--flags] [set] user.name|user.email <bot>` write lands after this hook has
 # read the pre-execution repo config, so it evades the committer check above — the identity twin of the
 # same-call core.hooksPath write. Refuse a config write of a non-human name/email.
-if has "(^|[^[:alnum:]])config([[:space:]]+(--[A-Za-z-]+|set))*[[:space:]]+user\\.(name|email)[[:space:]]+[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$CMD"; then
+CFG_ID="(^|[^[:alnum:]])config([[:space:]]+(--[A-Za-z-]+|set))*[[:space:]]+user\\.(name|email)[[:space:]]+"
+if has "${CFG_ID}[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$CMD" ||
+   has "${CFG_ID}[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$STRIPPED"; then
   echo "Blocked: a same-call 'git config user.name/email' sets a committer that is not a human (CLAUDE.md §2). Set the identity to a literal human name, in its own call." >&2; exit 2
 fi
+# The value can also be built from an expansion (`git config user.name C$(printf laude)`, `... $BOT`),
+# which the literal check cannot read. On the stripped text the value keeps a `$`/backtick mark; a
+# quoted message is dropped there, so a prose mention is exempt.
+# shellcheck disable=SC2016  # $ and ` are literal regex chars
+if hasc "${CFG_ID}[^[:space:]$\`]*[[:space:]]*[$\`]" "$STRIPPED"; then
+  echo "Blocked: a same-call 'git config user.name/email' whose value is built from a shell expansion cannot be inspected (CLAUDE.md §2). Set it to a literal human name, in its own call." >&2; exit 2
+fi
 
 # no AI attribution in the commit message — scan the command only, not the staged diff.
 # (This is a repo *about* Claude Code; legit messages will say "Claude Code". Only
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 9d92ee2..5145881 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -896,6 +896,12 @@ run "git config core.editor then commit"      0 'git config core.editor vim && g
 run "git config user.email human then commit" 0 'git config user.email denny@example.com && git commit -m x'
 run "git config commit.gpgsign then commit"   0 'git config commit.gpgsign true && git commit -m x'
 run "brace default carrying = is a config token" 2 'git commit --trailer ${x:-Acked-by=me} -m x'
+run "git config user.name value from a substitution" 2 'git config user.name C"$(printf laude)" && git commit -m x'
+run "git config user.name value from a bare var" 2 'git config user.name $BOT && git commit -m x'
+run "git config user.name value from a brace default" 2 'git config user.name ${x:-Claude} && git commit -m x'
+run "git config user.name split key then bot value" 2 'git config user.na"me" Claude && git commit -m x'
+run "git config user.name value from a var, human intent, still refused" 2 'git config user.name "$USER" && git commit -m x'
+run "git config core.editor from a var is allowed" 0 'git config core.editor $EDITOR && git commit -m x'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From d398035d0c4c7f8917ca85c27e51b317504142da Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 11:46:31 +0100
Subject: [PATCH 36/39] fix(hooks): the config-identity refuse skips short
 option flags too (git config -f <file> user.name)

A git config write can carry its target file with the short -f flag, not
only --file, so the skip between config and the key now covers a short
flag and its argument as well as long flags and set. A -f write of
user.name or user.email to a bot is refused; a -f write of an unrelated
key stays allowed.
---
 hooks/guard-commit.sh            | 2 +-
 tests/hooks/test-guard-commit.sh | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 91dc4cf..9e718ef 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -525,7 +525,7 @@ fi
 # A same-call `git config [--flags] [set] user.name|user.email <bot>` write lands after this hook has
 # read the pre-execution repo config, so it evades the committer check above — the identity twin of the
 # same-call core.hooksPath write. Refuse a config write of a non-human name/email.
-CFG_ID="(^|[^[:alnum:]])config([[:space:]]+(--[A-Za-z-]+|set))*[[:space:]]+user\\.(name|email)[[:space:]]+"
+CFG_ID="(^|[^[:alnum:]])config([[:space:]]+(--?[A-Za-z][A-Za-z-]*([[:space:]]+[^[:space:]-][^[:space:]]*)?|set))*[[:space:]]+user\\.(name|email)[[:space:]]+"
 if has "${CFG_ID}[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$CMD" ||
    has "${CFG_ID}[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$STRIPPED"; then
   echo "Blocked: a same-call 'git config user.name/email' sets a committer that is not a human (CLAUDE.md §2). Set the identity to a literal human name, in its own call." >&2; exit 2
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 5145881..844f737 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -902,6 +902,9 @@ run "git config user.name value from a brace default" 2 'git config user.name ${
 run "git config user.name split key then bot value" 2 'git config user.na"me" Claude && git commit -m x'
 run "git config user.name value from a var, human intent, still refused" 2 'git config user.name "$USER" && git commit -m x'
 run "git config core.editor from a var is allowed" 0 'git config core.editor $EDITOR && git commit -m x'
+run "git config -f file user.name bot then commit" 2 'git config -f cfg user.name Claude && git commit -m x'
+run "git config --file user.name bot then commit" 2 'git config --file cfg user.name Claude && git commit -m x'
+run "git config -f file core.editor is allowed" 0 'git config -f cfg core.editor vim && git commit -m x'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From 38ccdbac9aa6c560a8715c47689fdf12f9ad99fb Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 11:52:09 +0100
Subject: [PATCH 37/39] fix(hooks): the config-identity refuse also skips an
 equals-glued option flag (git config --type=path user.name)

A git config flag can attach its value with = (`--type=path`,
`--file=cfg`), which left the =value between the flag and the key and
broke the prefix, so `git config --type=path user.name Claude` set a bot
committer while the guard allowed it. The skipped flag token now takes an
optional =value, so the equals-glued forms are covered for both the
literal bot name and a value built from an expansion; an equals-glued
flag on an unrelated key (`--file=.git/config core.editor`) stays
allowed.
---
 hooks/guard-commit.sh            | 2 +-
 tests/hooks/test-guard-commit.sh | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index 9e718ef..f19b561 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -525,7 +525,7 @@ fi
 # A same-call `git config [--flags] [set] user.name|user.email <bot>` write lands after this hook has
 # read the pre-execution repo config, so it evades the committer check above — the identity twin of the
 # same-call core.hooksPath write. Refuse a config write of a non-human name/email.
-CFG_ID="(^|[^[:alnum:]])config([[:space:]]+(--?[A-Za-z][A-Za-z-]*([[:space:]]+[^[:space:]-][^[:space:]]*)?|set))*[[:space:]]+user\\.(name|email)[[:space:]]+"
+CFG_ID="(^|[^[:alnum:]])config([[:space:]]+(--?[A-Za-z][A-Za-z-]*(=[^[:space:]]*)?([[:space:]]+[^[:space:]-][^[:space:]]*)?|set))*[[:space:]]+user\\.(name|email)[[:space:]]+"
 if has "${CFG_ID}[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$CMD" ||
    has "${CFG_ID}[\"']?([^\"']*[^[:alnum:]\"'])?${IDENT}[0-9]*([^[:alnum:]]|[\"']|$)" "$STRIPPED"; then
   echo "Blocked: a same-call 'git config user.name/email' sets a committer that is not a human (CLAUDE.md §2). Set the identity to a literal human name, in its own call." >&2; exit 2
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 844f737..5d7fbfd 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -905,6 +905,11 @@ run "git config core.editor from a var is allowed" 0 'git config core.editor $ED
 run "git config -f file user.name bot then commit" 2 'git config -f cfg user.name Claude && git commit -m x'
 run "git config --file user.name bot then commit" 2 'git config --file cfg user.name Claude && git commit -m x'
 run "git config -f file core.editor is allowed" 0 'git config -f cfg core.editor vim && git commit -m x'
+run "git config --type=path user.name bot then commit" 2 'git config --type=path user.name Claude && git commit -m x'
+run "git config --type=path user.email bot then commit" 2 'git config --type=path user.email bot@evil.com && git commit -m x'
+run "git config --file= user.name value from a substitution" 2 'git config --file=cfg user.name C"$(printf laude)" && git commit -m x'
+run "git config --file=.git/config core.editor is allowed" 0 'git config --file=.git/config core.editor vim && git commit -m x'
+run "git config --replace-all user.name human is allowed" 0 'git config --replace-all user.name Dennis && git commit -m x'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From 9794db5924d1393dc60a5789b2d7ad38d6415252 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 11:53:50 +0100
Subject: [PATCH 38/39] fix(hooks): the config-identity expansion refuse is
 case-insensitive, like git config keys

git treats a config key case-insensitively (User.name == user.name), and
the literal identity check already matched case-insensitively, but the
expansion-value refuse did not, so git config User.name C$(printf laude)
set a bot committer while the guard allowed it. That refuse now matches
case-insensitively too. The key scoping to user.name/user.email is
unchanged, so an uppercase unrelated key (Core.editor $EDITOR) stays
allowed. The config-position -c refuse stays case-sensitive on purpose,
to tell -c (config) from -C (chdir).
---
 hooks/guard-commit.sh            | 2 +-
 tests/hooks/test-guard-commit.sh | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/hooks/guard-commit.sh b/hooks/guard-commit.sh
index f19b561..eac370a 100644
--- a/hooks/guard-commit.sh
+++ b/hooks/guard-commit.sh
@@ -534,7 +534,7 @@ fi
 # which the literal check cannot read. On the stripped text the value keeps a `$`/backtick mark; a
 # quoted message is dropped there, so a prose mention is exempt.
 # shellcheck disable=SC2016  # $ and ` are literal regex chars
-if hasc "${CFG_ID}[^[:space:]$\`]*[[:space:]]*[$\`]" "$STRIPPED"; then
+if has "${CFG_ID}[^[:space:]$\`]*[[:space:]]*[$\`]" "$STRIPPED"; then
   echo "Blocked: a same-call 'git config user.name/email' whose value is built from a shell expansion cannot be inspected (CLAUDE.md §2). Set it to a literal human name, in its own call." >&2; exit 2
 fi
 
diff --git a/tests/hooks/test-guard-commit.sh b/tests/hooks/test-guard-commit.sh
index 5d7fbfd..9d123df 100755
--- a/tests/hooks/test-guard-commit.sh
+++ b/tests/hooks/test-guard-commit.sh
@@ -910,6 +910,9 @@ run "git config --type=path user.email bot then commit" 2 'git config --type=pat
 run "git config --file= user.name value from a substitution" 2 'git config --file=cfg user.name C"$(printf laude)" && git commit -m x'
 run "git config --file=.git/config core.editor is allowed" 0 'git config --file=.git/config core.editor vim && git commit -m x'
 run "git config --replace-all user.name human is allowed" 0 'git config --replace-all user.name Dennis && git commit -m x'
+run "git config uppercase key bot literal then commit" 2 'git config User.name Claude && git commit -m x'
+run "git config uppercase key value from a substitution" 2 'git config User.name C"$(printf laude)" && git commit -m x'
+run "git config uppercase key core.editor is allowed" 0 'git config Core.editor $EDITOR && git commit -m x'
 run "heredoc marker before a substitution on the same line" 2 'cat <<EOF $(:
 git push -f origin main
 EOF

From b0d8a8e4fa0afc9c3fb60e6c5bbf24f68834ae80 Mon Sep 17 00:00:00 2001
From: Dennis Vorobyov <roadhero@gmail.com>
Date: Sun, 6 Sep 2026 12:01:58 +0100
Subject: [PATCH 39/39] =?UTF-8?q?docs:=20set=20=C2=A719.4=20live=20version?=
 =?UTF-8?q?=20to=20v1.0.7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CLAUDE.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index bf0c002..3af97ed 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -190,7 +190,7 @@ Requires `shellcheck`, `jq`, and `git` (the hooks need `jq` at runtime too) —
 
 ### 19.4 Current release pointers
 
-- **Live version:** v1.0.6 (annotated tag, latest on `main`).
+- **Live version:** v1.0.7 (annotated tag, latest on `main`).
 - **In flight:** none (set per session).
 - **CHANGELOG:** none — release notes are the GitHub Release body, generated from `git log` between tags.
 - **Spec / PRD:** `README.md` + `STRUCTURE.md` are canonical.