[dotdevdotdev]

Text another program RUNS is now judged as a command in its own right, so a payload's decision inside a carrier equals its decision alone.

What changed (agentwire/safety/_core.py, no rule YAML, no baseline change)

• _hidden_commands: stdin programs, <(…)/>(…) bodies, and executed option values/embedded programs (sed e/s///e, awk system/getline/pipe, tar --to-command/--checkpoint-action/-I, git difftool -x/--upload-pack/--receive-pack/grep -O/filter-branch/submodule foreach/bisect run/set-form config <exec-key>, npm exec -c, ssh/scp/sftp -o ProxyCommand).
• _decide_command recurses over them (strictest verdict wins, outer escape/kill switch ends the walk); _derived_commands feeds the same list to the protected-path scan.
• stdin rescan now applies to ALL rules (was control-plane paths only); xargs -I{} sh -c '{}'; sftp beside scp (+ stdin get/!); lua/luajit/tclsh/wish/R/Rscript/julia/groovy/osascript/expect in the interpreter net (stdin-as-program only when bare); mosh as ssh; remote interpreter stdin re-scanned as that interpreter's inline program.
• eval check: parallel … :::, flock LOCK cmd, docker|podman run|exec IMAGE cmd have grammars, so the verb is the command (the eval word only; docker run still asks by its own rule).
• Wiki: new section + residuals deleted/narrowed.

Verification

• New tests/unit/test_damage_control_hidden_commands.py: differential over 4 payloads × ~47 carriers, benign-payload and plain-form controls, remote-interpreter, sftp, interpreter net, escape/kill-switch, bounded nesting, launcher grammar. Mutation-checked: disabling the recursion, procsub, tar/sed/git extractors, inline-program wrap, sftp batch, or tool detection each turns it red.
• Two existing pins updated on purpose: parallel … grep eval / flock … grep eval now allow; | lua -e is no longer the "non-interpreter" control (now | jq .).
• Full fast suite (-m "not requires_tmux and not slow"): 5901 passed pre-merge; damage/safety subset 1487 passed after merging main. Hooks regenerated; gen_rule_baselines --check clean.
• Not verifiable in-worktree: the live installed hook (needs hooks install after merge).

Declared residuals: a here-string after a compound keyword on the SAME line (if true; then sh <<< 'rm -rf xx'; fi, for…do bash <<<…; done); wrapper + -c + nested here-string (sudo|env|nohup|timeout N bash -c 'sh <<< "rm -rf xx"'); local interpreter stdin (see wiki).

Closes #1136

Built by dotdev.dev