fix(secret-guard): peel nested interpreters for secret reads

Quoted -c payloads behind fish, busybox, csh, pwsh, and cmd /c stayed
one token, so auto mode default-allowed secret reads including .env.

Author: TheGreatAxios

src/permission/auto-shell-policy.ts

@@ -512,7 +512,7 @@ export function autoShellRuleForCall(
   const command = call.arguments.command;
   if (typeof command !== "string") return undefined;
 
-  // Peel bash/sh/zsh -c, xargs, env -S/--split-string, and transparent
+  // Peel nested interpreters, xargs, env -S/--split-string, and transparent
   // prefixes so rules see the real payload. `stripQuoted` alone would delete
   // a quoted -c body and miss every rule. Content inside an -S payload is
   // scanned here exactly as if written plainly — never a weaker tier.

src/permission/classify-security.test.ts

@@ -105,6 +105,49 @@ describe("isAutoAllowedShellCall — sensitive-path arguments", () => {
   });
 });
 
+describe("nested interpreter secret reads", () => {
+  const nestedSecrets = [
+    'fish -c "cat .envrc"',
+    'fish -c "cat .env"',
+    'busybox sh -c "cat .envrc"',
+    'csh -c "cat .envrc"',
+    'tcsh -c "cat .envrc"',
+    'pwsh -c "cat .envrc"',
+  ];
+
+  test("does not auto-allow secret reads behind nested interpreters", () => {
+    for (const command of nestedSecrets) {
+      expect(isAutoAllowedShellCall(shellCall(command))).toBe(false);
+      expect(autoShellRuleForCall(shellCall(command))).toMatchObject({
+        name: "sensitive-path",
+        effect: "ask",
+      });
+    }
+  });
+
+  test("auto mode does not allow nested-interpreter secret reads", async () => {
+    for (const command of nestedSecrets) {
+      const gate = createPermissionGate({
+        approvals: [],
+        interactive: false,
+        skipPermissions: false,
+        reactorGated: false,
+        auto: true,
+      });
+      expect((await gate.evaluate(shellCall(command))).allowed).toBe(false);
+    }
+  });
+
+  test("templates behind nested interpreters stay unsensitive", () => {
+    expect(
+      autoShellRuleForCall(shellCall('fish -c "cat .env.example"'))?.name,
+    ).not.toBe("sensitive-path");
+    expect(
+      autoShellRuleForCall(shellCall('busybox sh -c "cat .env.sample"'))?.name,
+    ).not.toBe("sensitive-path");
+  });
+});
+
 describe("clustered shell command options", () => {
   test("classifies clustered command payloads like canonical command payloads", () => {
     for (const options of ["-c", "-lc", "-xec", "-cc", "-cache"]) {

src/permission/gate.test.ts

@@ -146,6 +146,12 @@ describe("expanded secret wrapper guards", () => {
       "ksh -Gc \"cat \\$'.envrc'\"",
       `bash -c "cat "'.envrc'`,
       `sh -cc "cat "'.flaskenv'`,
+      'fish -c "cat .envrc"',
+      'fish -c "cat .env"',
+      'busybox sh -c "cat .envrc"',
+      'csh -c "cat .envrc"',
+      'tcsh -c "cat .envrc"',
+      'pwsh -c "cat .envrc"',
       "cat $'notes\\cQ'",
     ]) {
       const gate = createPermissionGate({
@@ -162,6 +168,23 @@ describe("expanded secret wrapper guards", () => {
     }
   });
 
+  test("star grants do not cover nested-interpreter secret reads", async () => {
+    for (const command of [
+      'fish -c "cat .envrc"',
+      'fish -c "cat .env"',
+      'busybox sh -c "cat .envrc"',
+    ]) {
+      const gate = createPermissionGate({
+        approvals: [{ tool: "run_shell", pattern: "*" }],
+        interactive: false,
+        skipPermissions: false,
+        reactorGated: false,
+        auto: true,
+      });
+      expect((await gate.evaluate(shellCall(command))).allowed).toBe(false);
+    }
+  });
+
   test("ambiguous file-option clusters cannot use a broad grant", async () => {
     const gate = createPermissionGate({
       approvals: [{ tool: "run_shell", pattern: "*" }],

src/plugins/secret-guard-plugin.ts

@@ -477,10 +477,6 @@ export function inspectShellSecretReference(
   cwd: string = process.cwd(),
   dialect: ShellDialect = nativeShellDialect(process.platform),
 ): ShellSecretInspection {
-  if (dialect === "cmd") {
-    return subjectReferencesSensitivePath(command, cwd, dialect);
-  }
-
   const expanded = expandShellSubjects(command);
   let opaque = expanded.opaque;
   for (const subject of expanded.subjects) {

src/shell/literal-path-arguments.test.ts

@@ -470,4 +470,42 @@ describe("inspectShellSecretReference", () => {
       });
     }
   });
+
+  test("peels nested interpreters so quoted secret payloads are visible", () => {
+    for (const command of [
+      'fish -c "cat .envrc"',
+      'fish -c "cat .env"',
+      'busybox sh -c "cat .envrc"',
+      'csh -c "cat .envrc"',
+      'tcsh -c "cat .envrc"',
+      'pwsh -c "cat .envrc"',
+    ]) {
+      expect(inspectShellSecretReference(command)).toMatchObject({
+        reference: expect.any(String),
+        opaque: false,
+      });
+    }
+  });
+
+  test("cmd dialect peels interpreter and cmd /c payloads", () => {
+    expect(
+      inspectShellSecretReference('bash -c "cat .envrc"', process.cwd(), "cmd"),
+    ).toMatchObject({ reference: ".envrc", opaque: false });
+    expect(
+      inspectShellSecretReference('cmd /c "type .envrc"', process.cwd(), "cmd"),
+    ).toMatchObject({ reference: ".envrc", opaque: false });
+  });
+
+  test("keeps nested-interpreter template reads unsensitive", () => {
+    for (const command of [
+      'fish -c "cat .env.example"',
+      'busybox sh -c "cat .env.template"',
+      'bash -c "cat .env.sample"',
+    ]) {
+      expect(inspectShellSecretReference(command)).toEqual({
+        reference: undefined,
+        opaque: false,
+      });
+    }
+  });
 });

src/shell/run-shell-authz.test.ts

@@ -194,6 +194,24 @@ describe("clustered shell command options", () => {
     }
   });
 
+  test("peels nested interpreters including busybox applets and cmd /c", () => {
+    expect(expandShellSubjects('fish -c "cat .envrc"').subjects).toContain(
+      "cat .envrc",
+    );
+    expect(
+      expandShellSubjects('busybox sh -c "cat .envrc"').subjects,
+    ).toContain("cat .envrc");
+    expect(expandShellSubjects('csh -c "cat .envrc"').subjects).toContain(
+      "cat .envrc",
+    );
+    expect(expandShellSubjects('pwsh -c "cat .envrc"').subjects).toContain(
+      "cat .envrc",
+    );
+    expect(expandShellSubjects('cmd /c "type .envrc"').subjects).toContain(
+      "type .envrc",
+    );
+  });
+
   test("hard-denies complete adjacent-fragment payloads", () => {
     for (const command of [
       `bash -c "rm "'-rf /'`,

src/shell/run-shell-authz.ts

@@ -359,9 +359,24 @@ const ENV_ASSIGNMENT = /^\w+=/;
 const RM_WRAPPER = /^(sudo|command|env|exec|builtin|time|nice|nohup)$/;
 const RECURSIVE_FLAG = /^(--recursive|-[A-Za-z]*[rR][A-Za-z]*)$/;
 
-// Interpreters whose `-c` / `--command` payload is an independent shell subject.
-// Exported so tests and callers share one explicit list with the peeler.
-export const SHELL_INTERPRETERS = new Set(["bash", "sh", "zsh", "dash", "ksh"]);
+// Interpreters whose `-c` / `--command` / cmd `/c` payload is an independent
+// shell subject. Exported so tests and callers share one explicit list with
+// the peeler. Matching is basename-based and ignores Windows executable
+// suffixes (`cmd.exe` → `cmd`).
+export const SHELL_INTERPRETERS = new Set([
+  "bash",
+  "sh",
+  "zsh",
+  "dash",
+  "ksh",
+  "ash",
+  "fish",
+  "csh",
+  "tcsh",
+  "pwsh",
+  "powershell",
+  "cmd",
+]);
 // Max recursive peel depth for nested wrappers. Exported so the depth cap is a
 // named policy knob tests can assert against, not a magic number.
 export const MAX_PEEL_DEPTH = 4;
@@ -472,10 +487,30 @@ function isSafeShellPositional(token: string): boolean {
   return SAFE_REJOIN_TOKEN.test(token);
 }
 
+const INTERPRETER_SUFFIX = /\.(?:exe|cmd|com|bat)$/i;
+const CMD_INTERPRETERS = new Set(["cmd"]);
+const PWSH_INTERPRETERS = new Set(["pwsh", "powershell"]);
+
+function shellInterpreterName(token: string): string {
+  return programBasename(token).replace(INTERPRETER_SUFFIX, "").toLowerCase();
+}
+
+function isInterpreterCommandSwitch(
+  interpreter: string,
+  token: string,
+): boolean {
+  if (token === "-c" || token === "--command") return true;
+  if (CMD_INTERPRETERS.has(interpreter) && /^\/[ck]$/i.test(token)) return true;
+  if (PWSH_INTERPRETERS.has(interpreter) && /^-command$/i.test(token))
+    return true;
+  return false;
+}
+
 // `\bash` / `\sh` — tokenize artifact from peeling through an escaped quote.
 function isBackslashInterpreterToken(token: string): boolean {
   const base = programBasename(token);
-  return base.startsWith("\\") && SHELL_INTERPRETERS.has(base.slice(1));
+  if (!base.startsWith("\\")) return false;
+  return SHELL_INTERPRETERS.has(shellInterpreterName(base.slice(1)));
 }
 
 function shellPayloadReferencesPositional(payload: string): boolean {
@@ -593,6 +628,7 @@ function peelShellDashC(
   tokens: string[],
   start: number,
   rawSegment: string,
+  interpreter: string,
 ): PeelOutcome {
   let i = start;
   while (i < tokens.length) {
@@ -602,7 +638,7 @@ function peelShellDashC(
       i++;
       break;
     }
-    if (t === "-c" || t === "--command") {
+    if (isInterpreterCommandSwitch(interpreter, t)) {
       const tokenPayload = tokens[i + 1];
       if (tokenPayload === undefined) return { kind: "opaque" };
       const optionOccurrence = tokens
@@ -955,7 +991,7 @@ function peelOnce(segment: string): PeelOutcome {
   const current = tokens[i];
   if (current === undefined)
     return strippedPrefix ? { kind: "opaque" } : { kind: "none" };
-  const prog = programBasename(current);
+  const prog = shellInterpreterName(current);
   if (SHELL_INTERPRETERS.has(prog)) {
     // A backtick or `$(` anywhere in the raw segment means the -c payload may
     // contain command substitution. tokenize() surfaces substitution content as
@@ -966,7 +1002,7 @@ function peelOnce(segment: string): PeelOutcome {
     // wrapper as opaque rather than risk peeling a truncated, misleading payload.
     if (segment.includes("`") || segment.includes("$("))
       return { kind: "opaque" };
-    const shellPeel = peelShellDashC(tokens, i + 1, segment);
+    const shellPeel = peelShellDashC(tokens, i + 1, segment, prog);
     if (shellPeel.kind !== "none") return shellPeel;
     // Interpreter without -c (e.g. `bash script.sh`) — not a peelable wrapper.
     return { kind: "none" };
@@ -990,8 +1026,9 @@ export interface ShellExpandResult {
 }
 
 // Expand a shell command into subjects the auto-shell policy, hard-deny, and
-// recursive-rm checks should scan. Peels bash/sh/zsh/dash/ksh -c, xargs
-// utility tails, env -S/--split-string payloads, and transparent prefixes
+// recursive-rm checks should scan. Peels nested interpreters (`bash`/`fish`/
+// `cmd` `/c` and the rest of SHELL_INTERPRETERS), xargs utility tails, env
+// -S/--split-string payloads, busybox applets, and transparent prefixes
 // (env/nice/timeout/…), recursing with a depth cap so nested wrappers cannot
 // hide a dangerous payload.
 //

src/shell/transparent-command.test.ts

@@ -166,6 +166,12 @@ describe("peelTransparentCommand", () => {
       executableIndex: 2,
       wrapperIndexes: [0],
     },
+    {
+      name: "peels busybox so the applet is the executable",
+      tokens: ["busybox", "sh", "-c", "cat .envrc"],
+      executableIndex: 1,
+      wrapperIndexes: [0],
+    },
   ];
 
   for (const entry of cases) {

src/shell/transparent-command.ts

@@ -391,7 +391,10 @@ export function peelTransparentCommand(
       index = parsed.executableIndex;
       continue;
     }
-    if (["builtin", "nohup"].includes(program)) {
+    if (
+      ["builtin", "nohup", "busybox"].includes(program) ||
+      program.toLowerCase() === "busybox.exe"
+    ) {
       wrapperIndexes.push(index);
       index++;
       continue;