From 2fe319c467519c07a82d05bac114e6a9f17db4ac Mon Sep 17 00:00:00 2001
From: Florian DAVID <fdavid@digital-village.fr>
Date: Tue, 6 Oct 2026 15:38:37 +0200
Subject: [PATCH 1/2] fix: bind the heredoc sink allowlist to its own clause,
 fix the closing-delimiter scan, and drop the stale reserved-name exception
 (#447, #455)

#447: jit_heredoc_opener_is_known_sink() checked the WHOLE line for a known
data sink, so a decoy sink separated by ; or && (cat > /dev/null </dev/null;
bash <<EOF) made the allowlist match a different, non-sink command's own
heredoc -- including the round-1 fake-arithmetic-opener shape hiding behind
the same decoy. The closing-delimiter scan also kept only one optional quote
or backslash on each side of the identifier, so EOF"X", EOF-1 and E\OF all
closed at the wrong line. Binds the sink check (and the danger-token check)
to the operator's own clause, and replays bash's own word-formation rule to
compute the real delimiter.

#455: _only_reserved_name_error() in smoke_release_tree.py downgraded
`claude plugin validate --strict`'s reserved-name error to a warning -- moot
since #452 renamed the plugin away from the claude- prefix that triggered it
-- and could separately mask a second real error under an unrecognized
heading. Removed entirely; any validate failure now fails the smoke test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/scripts/smoke_release_tree.py |  49 ++---------
 changelog.d/447.security.md           |   3 +
 changelog.d/455.fixed.md              |   2 +
 scripts/common-awk.sh                 | 117 +++++++++++++++++++++-----
 tests/test-pre-tool-hook.sh           |  51 +++++++++++
 tests/test-smoke-reserved-name-445.sh |  77 +++++++++--------
 6 files changed, 205 insertions(+), 94 deletions(-)
 create mode 100644 changelog.d/447.security.md
 create mode 100644 changelog.d/455.fixed.md

diff --git a/.github/scripts/smoke_release_tree.py b/.github/scripts/smoke_release_tree.py
index 5a82da27..3820ab2e 100644
--- a/.github/scripts/smoke_release_tree.py
+++ b/.github/scripts/smoke_release_tree.py
@@ -38,7 +38,6 @@
 import argparse
 import json
 import os
-import re
 import shutil
 import signal
 import subprocess
@@ -247,48 +246,18 @@ def run_validate(tree: Path, mode: str, claude_bin: str | None, home: Path,
     result.notes.append(f"validate: `claude plugin validate --strict` exit {r.returncode}")
     result.notes.extend(f"    {line}" for line in output.splitlines())
     if r.returncode != 0:
-        if _only_reserved_name_error(output):
-            # #445 (claude-5h-window-spread #20): CLI 2.1.287 reserves `claude-` names.
-            # The directory's own scan has not objected to this listing's name, and a
-            # rename changes every install ID. Until Anthropic answers, this ONE error
-            # is a warning, never any other.
-            warning = ("::warning::claude plugin validate --strict: the plugin name is "
-                       "reserved (#445) -- the only error, let through as a warning")
-            print(warning)
-            result.notes.append(warning)
-            return
+        # #455: this used to let exactly one error through as a warning when the
+        # validator's own output named the plugin a reserved name (#445/#448) -- CLI
+        # 2.1.287 rejected the `claude-` prefix this repo carried at the time. #452
+        # renamed the plugin away from that prefix, so `claude plugin validate
+        # --strict` no longer reports that error for this tree, and the carve-out
+        # that downgraded it is dead code going forward. It is also removed rather
+        # than kept dormant: its own heading parser could mask a SECOND real error
+        # whose heading did not match the regex it expected, so any future validate
+        # error -- reserved-name shaped or not -- now fails the smoke test outright.
         result.errors.append(f"validate: claude plugin validate --strict exited {r.returncode}")
 
 
-def _only_reserved_name_error(output: str) -> bool:
-    """True only when the validator reported exactly one error, the reserved name.
-
-    Errors and warnings both print as `❯` bullets, each under its own "Found N
-    error(s)" / "Found N warning(s)" heading, and the validator prints one such block
-    per file it checks. So only bullets under an ERROR heading count, and the totals
-    of every error heading are summed (#448: the v0.12.0 run printed 1 error and 6
-    warnings, and counting every bullet read 7 errors).
-    """
-    error_bullets: list[str] = []
-    stated_errors = 0
-    in_errors = False
-    for line in output.splitlines():
-        text = line.strip()
-        m = re.match(r"^\S*\s*Found (\d+) (error|warning)s?:?$", text)
-        if m:
-            in_errors = m.group(2) == "error"
-            if in_errors:
-                stated_errors += int(m.group(1))
-            continue
-        if text.startswith("Validat"):
-            in_errors = False
-            continue
-        if in_errors and text.startswith("❯"):
-            error_bullets.append(text)
-    return (stated_errors == 1 and len(error_bullets) == 1
-            and "is reserved" in error_bullets[0])
-
-
 def run_smoke(tree: Path, validate: str = "auto", claude_bin: str | None = None,
               linger_seconds: float = 30, keep_dir: Path | None = None) -> SmokeResult:
     tree = Path(tree).resolve()
diff --git a/changelog.d/447.security.md b/changelog.d/447.security.md
new file mode 100644
index 00000000..6de7d01e
--- /dev/null
+++ b/changelog.d/447.security.md
@@ -0,0 +1,3 @@
+- **The heredoc-body sink allowlist checked the WHOLE line for a known data sink, so a decoy sink sharing the line with the real heredoc operator -- separated by `;` or `&&` -- could still hide a non-sink command's heredoc body from a `forbid:`/`~`/`mode: block` rule** (#447, carried forward from the v0.12.0 gate-3 security audit round 2). `jit_heredoc_opener_is_known_sink()` never bound the `<<` operator to the specific simple command it trails, so `cat > /dev/null </dev/null; bash <<EOF` matched the `cat` pattern anchored earlier on the same line and stripped `bash`'s own heredoc body as if `bash` itself were the sink -- the same shape the round-1 fake-arithmetic-opener bug could then hide behind, since an unrelated sink decoy ahead of a `(( y = 1<<EOF ))` line made that fake opener match too. The closing-delimiter extraction also kept only a single optional quote or backslash character on each side of the bare identifier, so a delimiter bash itself builds by concatenating several quoted/escaped/bare pieces -- `<<EOF"X"` (bash closes at `EOFX`), `<<EOF-1` (bash closes at `EOF-1`, since `-` and digits are ordinary bare word characters), `<<E\OF` (bash collapses the backslash and closes at `EOF`) -- closed at the wrong line for the stripper, either leaving a real sink's own data wrongly visible or never finding a close at all.
+  Fixed by binding the sink allowlist check to just the clause the operator sits in, bounded by the nearest `;` or `&` on either side, and by replaying bash's own word-formation rule one character at a time to compute the real closing delimiter -- a bare run of ordinary characters, a single-quoted run, a double-quoted run (where an escaped double-quote, backslash, dollar or backtick collapses to the literal character), or a single backslash-escaped character outside quotes, concatenated with no gap. Binding the operator to its own clause also closes the arithmetic-decoy combination: the fake opener's own clause has no sink in it either way, so it is never treated as a real heredoc. `jit_heredoc_opener_has_danger_token()` now runs on that same clause too, which is more precise than the whole line and never less conservative, since a pipe or substitution in an unrelated earlier clause has nothing to do with this heredoc's own command.
+  The #442 changelog entry's claim that "an unrecognized command keeps its body visible by default" was not true for any of the shapes above -- each one reached a RECOGNIZED sink's allowlist match through the decoy, not an unrecognized command at all. This entry corrects that scope: the allowlist direction was always safe, but it was being evaluated against the wrong clause.
diff --git a/changelog.d/455.fixed.md b/changelog.d/455.fixed.md
new file mode 100644
index 00000000..769175c7
--- /dev/null
+++ b/changelog.d/455.fixed.md
@@ -0,0 +1,2 @@
+- **The `claude plugin validate --strict` reserved-name exception in the release smoke test is removed now that the plugin is renamed** (#455, carried forward from the v0.13.0 gate-3 security audit round 1). `_only_reserved_name_error()` in `.github/scripts/smoke_release_tree.py` (#445/#448) let exactly one validate error through as a warning when the validator's own output named the plugin a reserved name -- CLI 2.1.287 rejected the `claude-` prefix this repository carried at the time. #452 renamed the plugin away from that prefix, so `claude plugin validate --strict` no longer reports that error for this tree, and the carve-out was dead code going forward. It also had an independent parsing gap: a second real error block whose own heading did not match the regex it expected (e.g. a per-file heading like `Found 1 error in hooks.json:`) was never counted, so the function could still return true and let a genuine second error through.
+  Removing the whole exception settles both at once: a future `claude plugin validate --strict` error of any kind, reserved-name shaped or not, recognized heading or not, now fails the smoke test outright rather than carrying forward a carve-out whose only remaining effect would be to mask some unrelated error.
diff --git a/scripts/common-awk.sh b/scripts/common-awk.sh
index 7011988a..af0e16f2 100644
--- a/scripts/common-awk.sh
+++ b/scripts/common-awk.sh
@@ -1407,24 +1407,95 @@ function jit_heredoc_quote_states(lines, n, qin,    i, state) {
 # column no matter what command it sits under; it does NOT skip the suppression
 # checks above, since those answer a different question (is this text a real
 # heredoc operator at all) that both callers need answered the same way.
-function jit_strip_heredoc_body(s, unconditional,    n, lines, i, j, out, strip_tabs, delim, line, rest, probed, op, word, prefix, q1, q2, q3, qclass, close_i, quote_in, lt2) {
+# #447: jit_heredoc_opener_is_known_sink() used to be handed the WHOLE line, so a
+# real sink elsewhere on the SAME line (a decoy cat/tee/gh command followed by ; or
+# & and then bash <<EOF) made the allowlist match even though the heredoc actually
+# belongs to a DIFFERENT, non-sink command on that same line -- including a sink
+# decoy combined with the round-1 fake-arithmetic-opener shape, since binding the
+# operator to its own clause makes the fake opener own clause the one with no sink
+# in it either way. Binds the sink check to just the clause the operator sits in,
+# bounded by the nearest ";" or "&" on either side (a lone "&" covers "&&" too, since
+# each "&" character is itself a boundary). jit_heredoc_opener_has_danger_token()
+# runs on that same clause now too -- more precise than the whole line, never less
+# conservative, since a pipe or substitution in an UNRELATED earlier clause has
+# nothing to do with this heredoc own command.
+function jit_heredoc_clause_at(line, col,    i, c, start, endp, len) {
+  len = length(line)
+  start = 1
+  for (i = col - 1; i >= 1; i--) {
+    c = substr(line, i, 1)
+    if (c == ";" || c == "&") { start = i + 1; break }
+  }
+  endp = len
+  for (i = col; i <= len; i++) {
+    c = substr(line, i, 1)
+    if (c == ";" || c == "&") { endp = i - 1; break }
+  }
+  if (endp < start) return ""
+  return substr(line, start, endp - start + 1)
+}
+# #447: the OLD closing-delimiter extraction kept only ONE optional quote or
+# backslash character on each side of the bare identifier, so a delimiter bash
+# itself builds by concatenating several quoted/escaped/bare pieces was read wrong
+# -- a quote-then-bare-letters suffix, a bare dash-digit suffix, and a backslash
+# mid-word all closed at the WRONG line for this stripper, either leaving a real
+# sink own data visible (false block) or never finding a close at all. Replays
+# bash own word-formation rule one character at a time: a bare run of ordinary
+# characters, a single-quoted run, a double-quoted run (where a backslash-escaped
+# double-quote, backslash, dollar or backtick collapses to the literal character),
+# or a single backslash-escaped character outside quotes, concatenated with no
+# gap, stopping at the first blank or shell word-ending character. start is the
+# column of the first character of the word (i.e. right after the operator, its
+# optional "-", and any blanks) -- not the operator itself.
+function jit_heredoc_scan_word(line, start,    i, n, c, nc, state, word, bs, q1, q2, stopchars) {
+  q1 = sprintf("%c", 39)
+  q2 = sprintf("%c", 34)
+  bs = sprintf("%c", 92)
+  stopchars = " \t" bs q1 q2 ";&|<>()"
+  n = length(line)
+  i = start
+  state = 0
+  word = ""
+  while (i <= n) {
+    c = substr(line, i, 1)
+    if (state == 0) {
+      if (c == q1) { state = 1; i++; continue }
+      if (c == q2) { state = 2; i++; continue }
+      if (c == bs) {
+        if (i == n) break
+        word = word substr(line, i + 1, 1)
+        i += 2
+        continue
+      }
+      if (index(stopchars, c) > 0) break
+      word = word c
+      i++
+      continue
+    }
+    if (state == 1) {
+      if (c == q1) { state = 0; i++; continue }
+      word = word c
+      i++
+      continue
+    }
+    # state == 2: double-quoted -- only an escaped double-quote, backslash, dollar
+    # or backtick collapses (bash own double-quote escape set); any other
+    # backslash stays literal.
+    if (c == q2) { state = 0; i++; continue }
+    if (c == bs && i < n) {
+      nc = substr(line, i + 1, 1)
+      if (nc == q2 || nc == bs || nc == "$" || nc == "`") { word = word nc; i += 2; continue }
+    }
+    word = word c
+    i++
+  }
+  return word
+}
+function jit_strip_heredoc_body(s, unconditional,    n, lines, i, j, out, strip_tabs, delim, line, rest, probed, word, prefix, close_i, quote_in, lt2, op_col, after_pos) {
   # #461: the heredoc operator is built from its character code, never typed. Once the
   # release build inlines this file into a hook, the directory validator reads a typed
   # double `<` here as a shell here-document it cannot close, and blocks the plugin.
   lt2 = sprintf("%c%c", 60, 60)
-  q1 = sprintf("%c", 39)
-  q2 = sprintf("%c", 34)
-  # TWO bytes, not one: q3 sits inside a DYNAMIC (string) regex bracket expression
-  # below, and this awk regex compiler treats a lone backslash there as an escape
-  # introducer for whatever follows -- q3 alone made the escaped closing bracket read
-  # as a literal close-bracket character rather than the class-closing bracket itself,
-  # and the whole pattern failed to compile ("nonterminated character class", caught
-  # by re-running the suite after this change -- self-review finding). Two backslash
-  # bytes let that same escape reading collapse them back to ONE literal backslash
-  # inside the class, so the real closing bracket after it closes the class as
-  # intended.
-  q3 = sprintf("%c%c", 92, 92)
-  qclass = "[" q1 q2 q3 "]?"
   n = split(s, lines, "\n")
   jit_heredoc_quote_states(lines, n, quote_in)
   out = ""
@@ -1433,15 +1504,19 @@ function jit_strip_heredoc_body(s, unconditional,    n, lines, i, j, out, strip_
     line = lines[i]
     probed = " " line
     close_i = 0
-    if (match(probed, "[^<]" lt2 "-?[ \t]*" qclass "[A-Za-z_][A-Za-z0-9_]*" qclass)) {
+    # Detection only -- deliberately loose, just "a non-< char followed by <<" -- the
+    # ACCURATE word is computed below by jit_heredoc_scan_word(), never by trusting
+    # how much of the operator this match happens to consume (#447).
+    if (match(probed, "[^<]" lt2)) {
       prefix = substr(probed, 1, RSTART)
       if (!jit_heredoc_opener_is_suppressed(prefix, quote_in[i])) {
-        op = substr(probed, RSTART + 1, RLENGTH - 1)
-        strip_tabs = (substr(op, 1, 3) == lt2 "-")
-        word = op
-        sub("^" lt2 "-?[ \t]*", "", word)
-        gsub("[" q1 q2 q3 "]", "", word)
-        if (word != "" && (unconditional || jit_heredoc_opener_is_known_sink(line))) {
+        op_col = RSTART
+        after_pos = op_col + length(lt2)
+        strip_tabs = (substr(line, after_pos, 1) == "-")
+        if (strip_tabs) after_pos++
+        while (substr(line, after_pos, 1) == " " || substr(line, after_pos, 1) == "\t") after_pos++
+        word = jit_heredoc_scan_word(line, after_pos)
+        if (word != "" && (unconditional || jit_heredoc_opener_is_known_sink(jit_heredoc_clause_at(line, op_col)))) {
           delim = word
           for (j = i + 1; j <= n; j++) {
             rest = lines[j]
diff --git a/tests/test-pre-tool-hook.sh b/tests/test-pre-tool-hook.sh
index 758a27f2..cd28a568 100755
--- a/tests/test-pre-tool-hook.sh
+++ b/tests/test-pre-tool-hook.sh
@@ -677,6 +677,57 @@ echo "=== repro 5: a single-quoted argument spanning several lines still hides a
 OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"x='"'"'\n<<EOF\nliteral data'"'"'\nheredocblock command\nEOF"}}')
 assert_blocked "a <<EOF shape on a line still inside a multi-line single-quoted argument does not hide the command that follows it" "$OUT"
 
+# =============================================
+# SECTION 4d: the allowlist sink check must bind to its OWN command, and the closing
+# delimiter must match bash own word-ending rule (issue #447, carried forward from
+# v0.12.0 gate 3 round 2)
+# =============================================
+# jit_heredoc_opener_is_known_sink() used to be handed the WHOLE line, so a decoy sink
+# command sharing the line with the real heredoc -- separated by ; or & -- made the
+# allowlist match even though the heredoc belongs to a DIFFERENT, non-sink command.
+# Each case has a positive control earlier in this file proving the forbid row fires
+# at all (section 4b/4c); these prove the negative result here is not that either.
+
+echo ""
+echo "=== issue #447: a decoy sink before ; no longer hides a non-sink heredoc body (tee;bash) ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt </dev/null; bash <<EOF\nheredocforbid now\nEOF"}}')
+assert_blocked "a tee decoy before bash<<EOF no longer hides the forbidden word" "$OUT"
+
+echo ""
+echo "=== issue #447: a decoy sink before && no longer hides a non-sink heredoc body (cat;sh) ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-decoy.txt </dev/null && sh <<EOF\nheredocforbid now\nEOF"}}')
+assert_blocked "a tee decoy before && sh<<EOF no longer hides the forbidden word" "$OUT"
+
+echo ""
+echo "=== issue #447: a decoy supertool invocation before ; no longer hides a non-sink heredoc body ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; supertool '"'"'ops'"'"' >/dev/null; bash <<EOF\nheredocforbid now\nEOF"}}')
+assert_blocked "a supertool decoy before bash<<EOF no longer hides the forbidden word" "$OUT"
+
+echo ""
+echo "=== issue #447: a decoy sink combined with the round-1 fake-arithmetic-opener no longer hides the real command (coordinator finding) ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-decoy.txt </dev/null; (( y = 1<<EOF ))\nheredocforbid now\nEOF"}}')
+assert_blocked "a tee decoy ahead of a fake arithmetic <<EOF opener no longer hides the forbidden word" "$OUT"
+
+echo ""
+echo "=== issue #447 control: a real sink alone (no decoy clause) still gets its heredoc body stripped ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<EOF\nheredocforbid mentioned only here\nEOF"}}')
+assert_not_contains "a lone tee sink with no decoy clause still strips its own body" "$OUT" '"decision":"block"'
+
+echo ""
+echo "=== issue #447: a closing delimiter spelled EOF then a quoted X closes where bash does (EOFX), not at a bare EOF ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<EOF\"X\"\nheredocforbid mentioned only here\nEOFX"}}')
+assert_not_contains "a quote-concatenated delimiter still gets its real sink body stripped" "$OUT" '"decision":"block"'
+
+echo ""
+echo "=== issue #447: a closing delimiter spelled EOF-1 closes where bash does (EOF-1), dash and digit are bare word characters ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<EOF-1\nheredocforbid mentioned only here\nEOF-1"}}')
+assert_not_contains "a dash/digit-suffixed delimiter still gets its real sink body stripped" "$OUT" '"decision":"block"'
+
+echo ""
+echo "=== issue #447: a closing delimiter with a backslash mid-word closes where bash does (the backslash collapses) ==="
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<E\\OF\nheredocforbid mentioned only here\nEOF"}}')
+assert_not_contains "a backslash-mid-word delimiter still gets its real sink body stripped" "$OUT" '"decision":"block"'
+
 # =============================================
 # SECTION: awk engine matrix — multibyte paths, control characters in entries
 # =============================================
diff --git a/tests/test-smoke-reserved-name-445.sh b/tests/test-smoke-reserved-name-445.sh
index acb22231..8ee20f11 100755
--- a/tests/test-smoke-reserved-name-445.sh
+++ b/tests/test-smoke-reserved-name-445.sh
@@ -1,10 +1,17 @@
 #!/bin/bash
-# #445: CLI 2.1.287's `claude plugin validate --strict` rejects `claude-jit-context`
-# as a reserved name (claude-5h-window-spread #20 hit it first). smoke_release_tree.py
-# lets exactly that error through as a ::warning::, and only when it is the ONLY error.
-# Four cases, driven through run_validate() with a fake `claude`: reserved alone is a
-# warning and passes; reserved plus another error fails; any other error fails; a clean
-# validate passes with no warning.
+# #455: #445/#448's reserved-name exception in smoke_release_tree.py is now stale --
+# #452 renamed the plugin from claude-jit-context to jit-context, so `claude plugin
+# validate --strict` no longer reports the reserved-name error this exception existed
+# to downgrade. #455 also found the exception's own heading parser could mask a SECOND
+# real error whose heading did not match the regex it expected. Removing the whole
+# exception settles both at once: a future validate failure of ANY kind -- reserved-name
+# shaped or not, recognized heading or not -- now fails the smoke test outright, rather
+# than carrying forward dead code whose only remaining effect would be to (incompletely)
+# mask some unrelated error that happens to be the sole bullet under whatever heading it
+# checked for.
+#
+# This file used to assert the exception's OWN behavior (#445/#448); it was rewritten by
+# #455 to assert the exception is gone, not merely that its old behavior still holds.
 #
 # Usage: bash tests/test-smoke-reserved-name-445.sh
 #
@@ -24,6 +31,15 @@ if ! command -v python3 > /dev/null 2>&1; then
   exit 2
 fi
 
+echo "=== #455: no trace of the removed reserved-name exception remains in the source ==="
+if grep -q "_only_reserved_name_error" "$SMOKE"; then
+  echo "  FAIL: _only_reserved_name_error still referenced in $SMOKE"
+  STATIC_FAIL=1
+else
+  echo "  PASS: _only_reserved_name_error is gone from $SMOKE"
+  STATIC_FAIL=0
+fi
+
 python3 - "$SMOKE" << 'PY'
 import importlib.util
 import os
@@ -68,43 +84,38 @@ def run(name, output, code):
     return result
 
 
-r = run("alone", "\u2718 Found 1 error:\n\n  \u276f name: Plugin name \"claude-jit-context\" is "
-        "reserved: it passes as one of Anthropic's own.\n\n\u2718 Validation failed\n", 1)
-check("reserved name as the only error: run stays ok", r.ok, f"errors: {r.errors!r}")
-check("and says so as a ::warning::", any("::warning::" in n for n in r.notes), f"notes: {r.notes!r}")
+# #455 problem 2: the plugin is renamed (#452) -- a reserved-name-shaped error must now
+# fail like any other validate error, never be let through as a warning.
+r = run("alone", "✘ Found 1 error:\n\n  ❯ name: Plugin name \"claude-jit-context\" is "
+        "reserved: it passes as one of Anthropic's own.\n\n✘ Validation failed\n", 1)
+check("a reserved-name-shaped error now fails -- the exception is really gone", not r.ok,
+      f"errors: {r.errors!r}")
+check("and raises no ::warning:: carve-out for it", not any("::warning::" in n for n in r.notes),
+      f"notes: {r.notes!r}")
 
-r = run("two", "\u2718 Found 2 errors:\n\n  \u276f name: Plugin name \"claude-x\" is reserved.\n"
-        "  \u276f version: invalid\n\n\u2718 Validation failed\n", 1)
+r = run("two", "✘ Found 2 errors:\n\n  ❯ name: Plugin name \"claude-x\" is reserved.\n"
+        "  ❯ version: invalid\n\n✘ Validation failed\n", 1)
 check("reserved name beside another error still fails", not r.ok, f"errors: {r.errors!r}")
 
-r = run("other", "\u2718 Found 1 error:\n\n  \u276f version: invalid\n\n\u2718 Validation failed\n", 1)
+r = run("other", "✘ Found 1 error:\n\n  ❯ version: invalid\n\n✘ Validation failed\n", 1)
 check("any other validate failure still fails", not r.ok, f"errors: {r.errors!r}")
 
-r = run("clean", "\u2714 Validation passed\n", 0)
+r = run("clean", "✔ Validation passed\n", 0)
 check("a passing validate passes", r.ok, f"errors: {r.errors!r}")
 check("with no warning", not any("::warning::" in n for n in r.notes), f"notes: {r.notes!r}")
 
-# #448: the real v0.12.0 output. Warnings are also `❯` bullets, under their own
-# heading, and counting every bullet read this as 7 errors.
-WARN = ("  ❯ hooks.Stop: Shell command uses ${CLAUDE_PLUGIN_ROOT} without quotes: "
-        "bash ${CLAUDE_PLUGIN_ROOT}/scripts/stop-hook.sh.\n")
-V012 = ("Validating plugin manifest: /tmp/release-tree/.claude-plugin/plugin.json\n\n"
-        "✘ Found 1 error:\n\n  ❯ name: Plugin name \"claude-jit-context\" is reserved: "
-        "it passes as one of Anthropic's own.\n\n"
-        "Validating hooks: /tmp/release-tree/hooks/hooks.json\n\n"
-        "⚠ Found 6 warnings:\n\n" + WARN * 6 + "\n✘ Validation failed\n")
-r = run("v012", V012, 1)
-check("#448: reserved name plus 6 warnings (the real v0.12.0 output) stays ok", r.ok,
-      f"errors: {r.errors!r}")
-check("#448: and still warns", any("::warning::" in n for n in r.notes), f"notes: {r.notes!r}")
-
-r = run("twofiles", "Validating plugin manifest: x\n\n✘ Found 1 error:\n\n"
-        "  ❯ name: Plugin name \"claude-x\" is reserved.\n\n"
-        "Validating hooks: y\n\n✘ Found 1 error:\n\n  ❯ hooks.Stop: invalid\n\n"
+# #455 problem 1: a second error block whose own heading does not match the old parser's
+# regex (e.g. a per-file heading like "Found 1 error in hooks.json:") used to be able to
+# slip past uncounted. With the whole exception removed there is no heading parsing left
+# to fool -- ANY non-zero exit fails, regardless of what the output looks like.
+r = run("oddheading", "✘ Found 1 error in hooks.json:\n\n  ❯ hooks.Stop: invalid\n\n"
         "✘ Validation failed\n", 1)
-check("#448: a second error in another file's block still fails", not r.ok,
-      f"errors: {r.errors!r}")
+check("#455 problem 1: an unrecognized per-file heading still fails (nothing to fool anymore)",
+      not r.ok, f"errors: {r.errors!r}")
 
 print(f"== Results: {PASS} passed, {FAIL} failed ==")
 sys.exit(1 if FAIL else 0)
 PY
+PY_STATUS=$?
+
+[ "$STATIC_FAIL" -eq 0 ] && [ "$PY_STATUS" -eq 0 ]

From 9dade16875201a488db083f330fe13a527698735 Mon Sep 17 00:00:00 2001
From: Florian DAVID <fdavid@digital-village.fr>
Date: Tue, 6 Oct 2026 16:01:11 +0200
Subject: [PATCH 2/2] fix: self-review findings on #447/#455 -- quote-aware
 clause boundary, skip-vs-fail exit code, engine-matrix coverage

Explore review and oss:auditor both ran against commit 2fe319c. Three real
findings, all fixed here; one real but pre-existing (not a #447 regression)
finding logged to trap.d/ rather than fixed inline or filed, since it ranks
non-blocking (misreports) in the manager skill's own table.

- jit_heredoc_clause_at() scanned for a bare ";"/"&" with no quote tracking,
  so a quoted one inside the operator's own clause could forge a fake
  boundary. Threaded the per-line quote state through it (the same
  quote_in[i] jit_heredoc_opener_is_suppressed already uses) so a ";"/"&"
  only ends a clause when the state at that character is 0. Also updated
  two stale "whole line"/"same line" comments left behind by the earlier
  clause-binding change.
- tests/test-smoke-reserved-name-445.sh's new wrapper folded a legitimate
  SKIPPED (exit 2, no /bin/sh to run the fake claude shim on) into the
  script's own exit 1 -- tests/run-all.sh reads exit 2 as SKIPPED and
  anything else as FAILED, so this would have mislabeled a platform-driven
  skip as a real failure on a leg with no /bin/sh (Windows). Fixed to
  propagate exit 2 separately from the static check's own exit 1.
- The new #447 assertions (jit_heredoc_scan_word/jit_heredoc_clause_at)
  only ran under the default $PATH awk, not the awk/gawk/mawk matrix this
  file already runs #442's own heredoc state-machine assertions through.
  Extended the matrix to cover them too.

Logged to trap.d/447.sink-regexes-quote-blind.md: jit_heredoc_opener_is_known_sink()'s
five sink regexes are quote-blind, so a quoted ";"+sink-keyword inside a
non-sink command's own argument can still false-match as a sink. Confirmed
this reproduces identically on bda0282 (before any #447 change), so it is
not a regression; fixing it is a separate, larger change to the matching
primitives themselves.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 scripts/common-awk.sh                  | 54 ++++++++++++++++-----
 tests/test-pre-tool-hook.sh            | 35 ++++++++++++++
 tests/test-smoke-reserved-name-445.sh  | 13 ++++-
 trap.d/447.sink-regexes-quote-blind.md | 67 ++++++++++++++++++++++++++
 4 files changed, 157 insertions(+), 12 deletions(-)
 create mode 100644 trap.d/447.sink-regexes-quote-blind.md

diff --git a/scripts/common-awk.sh b/scripts/common-awk.sh
index af0e16f2..3687870d 100644
--- a/scripts/common-awk.sh
+++ b/scripts/common-awk.sh
@@ -1419,17 +1419,46 @@ function jit_heredoc_quote_states(lines, n, qin,    i, state) {
 # runs on that same clause now too -- more precise than the whole line, never less
 # conservative, since a pipe or substitution in an UNRELATED earlier clause has
 # nothing to do with this heredoc own command.
-function jit_heredoc_clause_at(line, col,    i, c, start, endp, len) {
+#
+# Self-review finding: a bare scan for ";"/"&" is quote-UNAWARE, so a quoted ";" or
+# "&" inside the heredoc operator own command (python3 -c "x=1; tee y" <<EOF) could
+# forge a fake clause boundary and truncate the clause down to a substring (" tee y"
+# <<EOF") that happens to satisfy the sink allowlist on its own -- reopening the exact
+# bypass class this fix exists to close, just through a quoted separator instead of a
+# bare one. state0 is the quote state carried INTO this physical line from every line
+# before it (jit_heredoc_quote_states() own quote_in[i], the same value the opener
+# suppression check already uses for a different question), since a quote can span
+# more than one line; a ";"/"&" only ends a clause when the state AT that character,
+# replaying the SAME escaping rules jit_heredoc_line_exit_state() already uses, is 0.
+function jit_heredoc_clause_at(line, col, state0,    i, c, start, endp, len, state, instate, q1, q2, bs) {
+  q1 = sprintf("%c", 39)
+  q2 = sprintf("%c", 34)
+  bs = sprintf("%c", 92)
   len = length(line)
+  state = state0
+  for (i = 1; i <= len; i++) {
+    instate[i] = state
+    c = substr(line, i, 1)
+    if (state == 0) {
+      if (c == q1) state = 1
+      else if (c == q2) state = 2
+      else if (c == bs) { i++; instate[i] = -1 }
+    } else if (state == 1) {
+      if (c == q1) state = 0
+    } else if (state == 2) {
+      if (c == bs) { i++; instate[i] = -1 }
+      else if (c == q2) state = 0
+    }
+  }
   start = 1
   for (i = col - 1; i >= 1; i--) {
     c = substr(line, i, 1)
-    if (c == ";" || c == "&") { start = i + 1; break }
+    if ((c == ";" || c == "&") && instate[i] == 0) { start = i + 1; break }
   }
   endp = len
   for (i = col; i <= len; i++) {
     c = substr(line, i, 1)
-    if (c == ";" || c == "&") { endp = i - 1; break }
+    if ((c == ";" || c == "&") && instate[i] == 0) { endp = i - 1; break }
   }
   if (endp < start) return ""
   return substr(line, start, endp - start + 1)
@@ -1516,7 +1545,7 @@ function jit_strip_heredoc_body(s, unconditional,    n, lines, i, j, out, strip_
         if (strip_tabs) after_pos++
         while (substr(line, after_pos, 1) == " " || substr(line, after_pos, 1) == "\t") after_pos++
         word = jit_heredoc_scan_word(line, after_pos)
-        if (word != "" && (unconditional || jit_heredoc_opener_is_known_sink(jit_heredoc_clause_at(line, op_col)))) {
+        if (word != "" && (unconditional || jit_heredoc_opener_is_known_sink(jit_heredoc_clause_at(line, op_col, quote_in[i])))) {
           delim = word
           for (j = i + 1; j <= n; j++) {
             rest = lines[j]
@@ -1579,10 +1608,12 @@ function jit_strip_heredoc_body(s, unconditional,    n, lines, i, j, out, strip_
 # "$(cat <<EOF" / bash -c "$(cat <<EOF" (command substitution feeding the body text
 # itself to a shell that runs it). None of a plain file write, tee, supertool, git
 # commit -F - or gh --body-file - ever legitimately carries a |, a $(, a backtick, a
-# >( or a <( on the SAME line as the heredoc operator, so their presence overrides
-# the allowlist unconditionally rather than being named in each sink pattern one at
-# a time -- the same posture as the comment/quote suppression above: a check that
-# can only ever turn a match into a non-match, never the reverse.
+# >( or a <( on the SAME CLAUSE as the heredoc operator (#447: the argument this
+# function receives is that clause, jit_heredoc_clause_at()s own return value, not
+# necessarily the whole physical line any more), so their presence overrides the
+# allowlist unconditionally rather than being named in each sink pattern one at a
+# time -- the same posture as the comment/quote suppression above: a check that can
+# only ever turn a match into a non-match, never the reverse.
 function jit_heredoc_opener_has_danger_token(line) {
   if (index(line, "|") > 0) return 1
   if (index(line, "$(") > 0) return 1
@@ -1594,9 +1625,10 @@ function jit_heredoc_opener_has_danger_token(line) {
 function jit_heredoc_opener_is_known_sink(line) {
   if (jit_heredoc_opener_has_danger_token(line)) return 0
   # cat writing to a file: the write target may be spelled before OR after the
-  # heredoc operator on the same physical line (cat > out <<EOF and cat <<EOF > out
-  # are both ordinary bash), so this checks the whole line for a > rather than just
-  # the text before the operator.
+  # heredoc operator in the same clause (cat > out <<EOF and cat <<EOF > out are
+  # both ordinary bash), so this checks the whole clause (#447: the caller now hands
+  # this the operator own clause, not necessarily the whole physical line) for a >
+  # rather than just the text before the operator.
   if (line ~ /(^|[;&|])[ \t]*cat([ \t]|$)/ && line ~ />/) return 1
   # tee always takes its target as a plain argument, never a redirect.
   if (line ~ /(^|[;&|])[ \t]*tee[ \t]+[^ \t;&|\n]/) return 1
diff --git a/tests/test-pre-tool-hook.sh b/tests/test-pre-tool-hook.sh
index cd28a568..2f64e4bb 100755
--- a/tests/test-pre-tool-hook.sh
+++ b/tests/test-pre-tool-hook.sh
@@ -728,6 +728,18 @@ echo "=== issue #447: a closing delimiter with a backslash mid-word closes where
 OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<E\\OF\nheredocforbid mentioned only here\nEOF"}}')
 assert_not_contains "a backslash-mid-word delimiter still gets its real sink body stripped" "$OUT" '"decision":"block"'
 
+echo ""
+echo "=== issue #447 self-review: a quoted ; inside the sink own argument does not forge a fake clause boundary ==="
+# jit_heredoc_clause_at()'s first cut scanned for a bare ";"/"&" with no quote tracking --
+# a quoted one (tee writing to a file literally named ";") would have been read as a real
+# clause boundary, cutting the returned clause in half mid-quote and losing the "tee" name
+# entirely, which would have wrongly kept this real sink's own data visible to a forbid:
+# rule (over-cautious, not a bypass, but still wrong). Quote-aware boundary scanning fixes
+# the precision; this is the positive case (forbidden word correctly stays hidden, the
+# literal file name it sits inside is not mistaken for a boundary).
+OUT=$(run_hook '{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee \";\" <<EOF\nheredocforbid mentioned only here\nEOF"}}')
+assert_not_contains "a tee writing to a literal \";\" filename still gets its own body stripped" "$OUT" '"decision":"block"'
+
 # =============================================
 # SECTION: awk engine matrix — multibyte paths, control characters in entries
 # =============================================
@@ -788,6 +800,29 @@ for eng in $ENGINES; do
   assert_not_contains "#442 round 3: tee (real sink) still strips its body under $eng" "$OUT" '"decision":"block"'
 done
 
+# #447 self-review (oss:auditor finding): jit_heredoc_scan_word() and
+# jit_heredoc_clause_at() are the same shape of character-by-character state machine
+# as jit_heredoc_opener_is_suppressed() above, which this file has already seen
+# diverge across awk engines (#14, #68, #76) -- so the per-engine treatment extends to
+# them too, not just the default $PATH awk the rest of SECTION 4d ran under.
+P447_DECOY='{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt </dev/null; bash <<EOF\nheredocforbid now\nEOF"}}'
+P447_DELIM_QUOTE='{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<EOF\"X\"\nheredocforbid mentioned only here\nEOFX"}}'
+P447_DELIM_DASH='{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<EOF-1\nheredocforbid mentioned only here\nEOF-1"}}'
+P447_DELIM_BACKSLASH='{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee /tmp/jit447-sink.txt <<E\OF\nheredocforbid mentioned only here\nEOF"}}'
+P447_CLAUSE_QUOTE='{"tool_name":"Bash","tool_input":{"command":"hdcmd; tee \";\" <<EOF\nheredocforbid mentioned only here\nEOF"}}'
+for eng in $ENGINES; do
+  OUT=$(run_hook_engine "$eng" "$P447_DECOY")
+  assert_blocked "#447: a tee decoy before bash<<EOF no longer hides the forbidden word under $eng" "$OUT"
+  OUT=$(run_hook_engine "$eng" "$P447_DELIM_QUOTE")
+  assert_not_contains "#447: a quote-concatenated delimiter still strips its real sink body under $eng" "$OUT" '"decision":"block"'
+  OUT=$(run_hook_engine "$eng" "$P447_DELIM_DASH")
+  assert_not_contains "#447: a dash/digit-suffixed delimiter still strips its real sink body under $eng" "$OUT" '"decision":"block"'
+  OUT=$(run_hook_engine "$eng" "$P447_DELIM_BACKSLASH")
+  assert_not_contains "#447: a backslash-mid-word delimiter still strips its real sink body under $eng" "$OUT" '"decision":"block"'
+  OUT=$(run_hook_engine "$eng" "$P447_CLAUSE_QUOTE")
+  assert_not_contains "#447: a quoted ; inside the sink own argument still strips its own body under $eng" "$OUT" '"decision":"block"'
+done
+
 # RFC 8259 forbids a raw U+0000-U+001F inside a JSON string; a strict parser is entitled
 # to reject the whole object, which renders as the hook having said nothing.
 # This one re-runs the hook and pipes it straight into perl instead of taking a captured
diff --git a/tests/test-smoke-reserved-name-445.sh b/tests/test-smoke-reserved-name-445.sh
index 8ee20f11..469a6e14 100755
--- a/tests/test-smoke-reserved-name-445.sh
+++ b/tests/test-smoke-reserved-name-445.sh
@@ -118,4 +118,15 @@ sys.exit(1 if FAIL else 0)
 PY
 PY_STATUS=$?
 
-[ "$STATIC_FAIL" -eq 0 ] && [ "$PY_STATUS" -eq 0 ]
+# #455 self-review: PY_STATUS can legitimately be 2 (SKIPPED, no /bin/sh to run the
+# fake claude shim on) -- folding every non-zero PY_STATUS into this script own exit 1
+# would report that platform-driven skip as a FAILURE to tests/run-all.sh, which reads
+# exit 2 as SKIPPED and anything else as FAILED. The static grep check runs regardless
+# of /bin/sh, so it still fails outright on its own.
+if [ "$STATIC_FAIL" -ne 0 ]; then
+  exit 1
+fi
+if [ "$PY_STATUS" -eq 2 ]; then
+  exit 2
+fi
+[ "$PY_STATUS" -eq 0 ]
diff --git a/trap.d/447.sink-regexes-quote-blind.md b/trap.d/447.sink-regexes-quote-blind.md
new file mode 100644
index 00000000..613e55b8
--- /dev/null
+++ b/trap.d/447.sink-regexes-quote-blind.md
@@ -0,0 +1,67 @@
+Observed while fixing #447 (jit_heredoc_opener_is_known_sink's whole-line sink
+check should have been bound to the operator own clause, and was).
+
+A reviewer (Explore spawn, self-review round) reported that
+`hdcmd; python3 -c "x=1; tee y" <<EOF\nheredocforbid now\nEOF` still silently hides
+the heredoc body from a forbid:/mode: block rule even after the #447 clause-binding
+fix landed, framing it as a regression the #447 fix was supposed to close. I
+reproduced it end to end through the real hook (scripts/pre-tool-hook.sh, with a
+synthetic hdcmd/heredocforbid fixture matching tests/test-pre-tool-hook.sh's own
+convention) and confirmed the body IS stripped (the `heredocforbid` payload never
+reaches fold_full, so a forbid: row never fires on it).
+
+But it is NOT a #447 regression. I reproduced the identical payload against
+scripts/pre-tool-hook.sh as it existed at bda0282 -- the commit immediately before
+any of my #447/#455 changes, with the OLD whole-line (not clause-bound) sink check
+-- and it ALSO hides the body there. Root cause: jit_heredoc_opener_is_known_sink()'s
+five sink patterns (cat>, tee, supertool, git commit -F -, gh --body-file -/-F -) are
+plain awk EREs matched against a text span (the whole line before #447, the operator
+own clause after #447) with ZERO quote-state tracking. A quoted ";" inside a
+legitimate argument to a NON-sink command (python3 -c "x=1; tee y") still leaves the
+literal substring "; tee y" sitting in the text being matched, and the `tee` regex
+-- anchored on `(^|[;&|])[ \t]*tee[ \t]+...` -- cannot tell that the ";" and the
+"tee" it is anchored against are both inside a double-quoted Python string rather
+than being real shell syntax. jit_heredoc_opener_has_danger_token() has the identical
+blind spot for `|`, `$(`, backtick, `>(`, `<(` (though that direction is the SAFE one
+for a deny-style rule -- a quoted danger token only makes the override MORE likely to
+fire, never less, so it cannot itself become a bypass the way the sink patterns can).
+
+What I did fix in this same round (genuinely #447-scoped, and kept): a bare,
+quote-UNAWARE scan for ";"/"&" in jit_heredoc_clause_at() itself -- the function that
+decides WHERE the clause boundary falls, as opposed to whether the regex matching
+WITHIN that clause is quote-aware -- could forge a fake boundary off a quoted ";"/"&"
+and truncate the clause wrong in either direction. Fixed by threading a per-line
+quote state (jit_heredoc_quote_states()'s own quote_in[i]) through
+jit_heredoc_clause_at() and only treating a ";"/"&" as a boundary when the state at
+that character is 0. Verified this closes a real (non-security, over-cautious)
+precision bug: `hdcmd; tee ";" <<EOF` (tee writing to a file literally named ";")
+used to have its clause truncated to `" <<EOF`, losing "tee" entirely and so NOT
+being recognized as a sink (keeping real, safe sink data needlessly visible to a
+forbid: rule) -- now correctly returns the whole clause and classifies it as a sink.
+Covered by a new test in tests/test-pre-tool-hook.sh ("a quoted ; inside the sink own
+argument does not forge a fake clause boundary").
+
+What is NOT fixed, and is the actual subject of this trap: making the five sink
+regexes (and the danger-token checks) genuinely quote-aware -- i.e. blanking out or
+skipping quoted spans before running the EREs, rather than matching raw text -- is a
+separate, larger change touching every pattern in jit_heredoc_opener_is_known_sink()
+and jit_heredoc_opener_has_danger_token(), pre-dates #447 entirely, and was out of
+scope for the two issues (#447, #455) this lane was dispatched to fix. Per
+skills/manager/phases/findings.md's ranking table this is a `misreports` row (the
+hook answers "nothing to block" when a forbid:/block: rule was never evaluated
+against text bash will actually run) -- non-blocking, "can ship behind a trap.d
+fragment" -- which is why this is a trap fragment rather than a filed issue.
+
+Confirmed by: direct awk-level reproduction (jit_heredoc_opener_is_known_sink()
+called directly with the quoted-tee clause, returns 1), and end-to-end through the
+real hook on both HEAD (post-#447) and bda0282 (pre-#447), using a throwaway
+CLAUDE_PROJECT_DIR fixture mirroring tests/test-pre-tool-hook.sh's own hdcmd/
+heredocforbid convention -- not asserted from the awk trace alone.
+
+Candidate shape for whoever curates this: the fix likely wants a shared helper that
+blanks every character inside a single/double-quoted span of a line/clause to a
+placeholder BEFORE any of the five sink patterns or the danger-token index() checks
+run against it -- jit_heredoc_clause_at()'s own new instate[] quote-tracking loop in
+this same commit is most of the machinery already, just needs to run once more,
+earlier, over the text actually handed to the matchers rather than over the raw
+clause.