damage-control: hidden input behind same-line openers and wrapper -c (#1144)

agentwire/hooks/damage-control/bash-tool-damage-control.py

@@ -34,7 +34,7 @@ def log_escape(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "dfd26d6da44441566c101a5c8abc2e2767eb2d03188e93a749eacb60d9978fca", "generated_at": "2026-10-19T11:35:13Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -4000,6 +4000,25 @@ def _sftp_batch_commands(text: str, consumer_words: List[str]) -> List[str]:
     return out
 
 
+def _producer_commands(producer: str) -> List[List[str]]:
+    """Word lists of the commands a pipe stage's text may end in, past openers and prefix wrappers.
+
+    ``if t; then sudo cat <<< X`` feeds the pipe from ``cat``: each tail after a segment break
+    is stripped of compound openers, then of ``sudo``/``env``/``nohup``/``timeout N``.
+    """
+    words = _words(producer)
+    tails = [words] + [words[i + 1 :] for i, w in enumerate(words) if w in ("&&", "||", "&") or w.endswith(";")]
+    out: List[List[str]] = []
+    for tail in tails:
+        tail = strip_command_opener_words(tail)
+        k = _wrapped_command_index(tail) if tail else None
+        if k is not None:
+            tail = tail[k:]
+        if tail:
+            out.append(tail)
+    return out
+
+
 def _stdin_program_commands(command: str, rules: bool = False) -> List[str]:
     """Text that a stdin-reading runner will execute as commands (#1099).
 
@@ -4027,22 +4046,23 @@ def emit(text: str, words: List[str]) -> None:
         visible = _hide_heredoc_bodies(command, keep_programs=True)
         for m in _here_strings(visible):  # ``'lua <<< x'`` in a message body is text
             line = visible[visible.rfind("\n", 0, m.start()) + 1 : m.start()]
-            words = _feed_words(line)
+            cut = [b.end() for b in _SEGMENT_BREAK.finditer(line)]  # ``then sh <<< X``: the command after the last break
+            words = _feed_words(line[cut[-1] :] if cut else line)
             emit(" ".join(_words(m.group(1))), words)
     if "|" in command:
         stages = _pipe_stages(_hide_heredoc_bodies(command, keep_programs=False))
         for (_, producer), (op, consumer) in zip(stages, stages[1:]):
             consumer_words = _feed_words(consumer)
             if op != "|":
                 continue
-            words = strip_command_opener_words(_words(producer))
-            if words and os.path.basename(words[0]) in ("echo", "printf"):
-                text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
-                emit(text, consumer_words)
-                if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
-                    emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
-            elif words and os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
-                emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
+            for words in _producer_commands(producer):
+                if os.path.basename(words[0]) in ("echo", "printf"):
+                    text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
+                    emit(text, consumer_words)
+                    if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
+                        emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
+                elif os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
+                    emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
     return out
 
 
@@ -4419,6 +4439,9 @@ def _exec_payload_commands(command: str, rules: bool = False, _depth: int = 0) -
         # A shell's ``-c`` text and an ssh remote command are judged by their own
         # rules where they sit; a hidden command INSIDE them is still hidden.
         k = next((j for j, w in enumerate(words) if not _ASSIGN_TOKEN_RE.match(w)), None)
+        if k is not None:  # ``sudo|env|nohup|timeout N bash -c '…'``: the wrapped shell's payload is hidden too
+            w = _wrapped_command_index(words[k:])
+            k = k + w if w is not None else k
         head = words[k].rsplit("/", 1)[-1] if k is not None else ""
         if head in _SHELL_NAMES and head != "su":
             inner, _rest = _eval_shell_invocation(words[k + 1 :], False)

agentwire/hooks/damage-control/edit-tool-damage-control.py

@@ -30,7 +30,7 @@ def log_disabled(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "dfd26d6da44441566c101a5c8abc2e2767eb2d03188e93a749eacb60d9978fca", "generated_at": "2026-10-19T11:35:13Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -3996,6 +3996,25 @@ def _sftp_batch_commands(text: str, consumer_words: List[str]) -> List[str]:
     return out
 
 
+def _producer_commands(producer: str) -> List[List[str]]:
+    """Word lists of the commands a pipe stage's text may end in, past openers and prefix wrappers.
+
+    ``if t; then sudo cat <<< X`` feeds the pipe from ``cat``: each tail after a segment break
+    is stripped of compound openers, then of ``sudo``/``env``/``nohup``/``timeout N``.
+    """
+    words = _words(producer)
+    tails = [words] + [words[i + 1 :] for i, w in enumerate(words) if w in ("&&", "||", "&") or w.endswith(";")]
+    out: List[List[str]] = []
+    for tail in tails:
+        tail = strip_command_opener_words(tail)
+        k = _wrapped_command_index(tail) if tail else None
+        if k is not None:
+            tail = tail[k:]
+        if tail:
+            out.append(tail)
+    return out
+
+
 def _stdin_program_commands(command: str, rules: bool = False) -> List[str]:
     """Text that a stdin-reading runner will execute as commands (#1099).
 
@@ -4023,22 +4042,23 @@ def emit(text: str, words: List[str]) -> None:
         visible = _hide_heredoc_bodies(command, keep_programs=True)
         for m in _here_strings(visible):  # ``'lua <<< x'`` in a message body is text
             line = visible[visible.rfind("\n", 0, m.start()) + 1 : m.start()]
-            words = _feed_words(line)
+            cut = [b.end() for b in _SEGMENT_BREAK.finditer(line)]  # ``then sh <<< X``: the command after the last break
+            words = _feed_words(line[cut[-1] :] if cut else line)
             emit(" ".join(_words(m.group(1))), words)
     if "|" in command:
         stages = _pipe_stages(_hide_heredoc_bodies(command, keep_programs=False))
         for (_, producer), (op, consumer) in zip(stages, stages[1:]):
             consumer_words = _feed_words(consumer)
             if op != "|":
                 continue
-            words = strip_command_opener_words(_words(producer))
-            if words and os.path.basename(words[0]) in ("echo", "printf"):
-                text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
-                emit(text, consumer_words)
-                if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
-                    emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
-            elif words and os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
-                emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
+            for words in _producer_commands(producer):
+                if os.path.basename(words[0]) in ("echo", "printf"):
+                    text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
+                    emit(text, consumer_words)
+                    if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
+                        emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
+                elif os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
+                    emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
     return out
 
 
@@ -4415,6 +4435,9 @@ def _exec_payload_commands(command: str, rules: bool = False, _depth: int = 0) -
         # A shell's ``-c`` text and an ssh remote command are judged by their own
         # rules where they sit; a hidden command INSIDE them is still hidden.
         k = next((j for j, w in enumerate(words) if not _ASSIGN_TOKEN_RE.match(w)), None)
+        if k is not None:  # ``sudo|env|nohup|timeout N bash -c '…'``: the wrapped shell's payload is hidden too
+            w = _wrapped_command_index(words[k:])
+            k = k + w if w is not None else k
         head = words[k].rsplit("/", 1)[-1] if k is not None else ""
         if head in _SHELL_NAMES and head != "su":
             inner, _rest = _eval_shell_invocation(words[k + 1 :], False)

agentwire/hooks/damage-control/mcp-tool-damage-control.py

@@ -49,7 +49,7 @@ def log_escape(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "dfd26d6da44441566c101a5c8abc2e2767eb2d03188e93a749eacb60d9978fca", "generated_at": "2026-10-19T11:35:13Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -4015,6 +4015,25 @@ def _sftp_batch_commands(text: str, consumer_words: List[str]) -> List[str]:
     return out
 
 
+def _producer_commands(producer: str) -> List[List[str]]:
+    """Word lists of the commands a pipe stage's text may end in, past openers and prefix wrappers.
+
+    ``if t; then sudo cat <<< X`` feeds the pipe from ``cat``: each tail after a segment break
+    is stripped of compound openers, then of ``sudo``/``env``/``nohup``/``timeout N``.
+    """
+    words = _words(producer)
+    tails = [words] + [words[i + 1 :] for i, w in enumerate(words) if w in ("&&", "||", "&") or w.endswith(";")]
+    out: List[List[str]] = []
+    for tail in tails:
+        tail = strip_command_opener_words(tail)
+        k = _wrapped_command_index(tail) if tail else None
+        if k is not None:
+            tail = tail[k:]
+        if tail:
+            out.append(tail)
+    return out
+
+
 def _stdin_program_commands(command: str, rules: bool = False) -> List[str]:
     """Text that a stdin-reading runner will execute as commands (#1099).
 
@@ -4042,22 +4061,23 @@ def emit(text: str, words: List[str]) -> None:
         visible = _hide_heredoc_bodies(command, keep_programs=True)
         for m in _here_strings(visible):  # ``'lua <<< x'`` in a message body is text
             line = visible[visible.rfind("\n", 0, m.start()) + 1 : m.start()]
-            words = _feed_words(line)
+            cut = [b.end() for b in _SEGMENT_BREAK.finditer(line)]  # ``then sh <<< X``: the command after the last break
+            words = _feed_words(line[cut[-1] :] if cut else line)
             emit(" ".join(_words(m.group(1))), words)
     if "|" in command:
         stages = _pipe_stages(_hide_heredoc_bodies(command, keep_programs=False))
         for (_, producer), (op, consumer) in zip(stages, stages[1:]):
             consumer_words = _feed_words(consumer)
             if op != "|":
                 continue
-            words = strip_command_opener_words(_words(producer))
-            if words and os.path.basename(words[0]) in ("echo", "printf"):
-                text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
-                emit(text, consumer_words)
-                if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
-                    emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
-            elif words and os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
-                emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
+            for words in _producer_commands(producer):
+                if os.path.basename(words[0]) in ("echo", "printf"):
+                    text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
+                    emit(text, consumer_words)
+                    if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
+                        emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
+                elif os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
+                    emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
     return out
 
 
@@ -4434,6 +4454,9 @@ def _exec_payload_commands(command: str, rules: bool = False, _depth: int = 0) -
         # A shell's ``-c`` text and an ssh remote command are judged by their own
         # rules where they sit; a hidden command INSIDE them is still hidden.
         k = next((j for j, w in enumerate(words) if not _ASSIGN_TOKEN_RE.match(w)), None)
+        if k is not None:  # ``sudo|env|nohup|timeout N bash -c '…'``: the wrapped shell's payload is hidden too
+            w = _wrapped_command_index(words[k:])
+            k = k + w if w is not None else k
         head = words[k].rsplit("/", 1)[-1] if k is not None else ""
         if head in _SHELL_NAMES and head != "su":
             inner, _rest = _eval_shell_invocation(words[k + 1 :], False)

agentwire/hooks/damage-control/read-tool-damage-control.py

@@ -36,7 +36,7 @@ def log_disabled(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "dfd26d6da44441566c101a5c8abc2e2767eb2d03188e93a749eacb60d9978fca", "generated_at": "2026-10-19T11:35:13Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -4002,6 +4002,25 @@ def _sftp_batch_commands(text: str, consumer_words: List[str]) -> List[str]:
     return out
 
 
+def _producer_commands(producer: str) -> List[List[str]]:
+    """Word lists of the commands a pipe stage's text may end in, past openers and prefix wrappers.
+
+    ``if t; then sudo cat <<< X`` feeds the pipe from ``cat``: each tail after a segment break
+    is stripped of compound openers, then of ``sudo``/``env``/``nohup``/``timeout N``.
+    """
+    words = _words(producer)
+    tails = [words] + [words[i + 1 :] for i, w in enumerate(words) if w in ("&&", "||", "&") or w.endswith(";")]
+    out: List[List[str]] = []
+    for tail in tails:
+        tail = strip_command_opener_words(tail)
+        k = _wrapped_command_index(tail) if tail else None
+        if k is not None:
+            tail = tail[k:]
+        if tail:
+            out.append(tail)
+    return out
+
+
 def _stdin_program_commands(command: str, rules: bool = False) -> List[str]:
     """Text that a stdin-reading runner will execute as commands (#1099).
 
@@ -4029,22 +4048,23 @@ def emit(text: str, words: List[str]) -> None:
         visible = _hide_heredoc_bodies(command, keep_programs=True)
         for m in _here_strings(visible):  # ``'lua <<< x'`` in a message body is text
             line = visible[visible.rfind("\n", 0, m.start()) + 1 : m.start()]
-            words = _feed_words(line)
+            cut = [b.end() for b in _SEGMENT_BREAK.finditer(line)]  # ``then sh <<< X``: the command after the last break
+            words = _feed_words(line[cut[-1] :] if cut else line)
             emit(" ".join(_words(m.group(1))), words)
     if "|" in command:
         stages = _pipe_stages(_hide_heredoc_bodies(command, keep_programs=False))
         for (_, producer), (op, consumer) in zip(stages, stages[1:]):
             consumer_words = _feed_words(consumer)
             if op != "|":
                 continue
-            words = strip_command_opener_words(_words(producer))
-            if words and os.path.basename(words[0]) in ("echo", "printf"):
-                text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
-                emit(text, consumer_words)
-                if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
-                    emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
-            elif words and os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
-                emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
+            for words in _producer_commands(producer):
+                if os.path.basename(words[0]) in ("echo", "printf"):
+                    text = " ".join(w for w in words[1:] if not re.fullmatch(r"-[neE]+", w))
+                    emit(text, consumer_words)
+                    if os.path.basename(words[0]) == "printf" and len(words) > 2 and "%" in words[1]:
+                        emit(" ".join(words[2:]), consumer_words)  # ``printf '%s' X``: X is the text
+                elif os.path.basename(words[0]) == "cat" and "<<<" in words[1:-1]:
+                    emit(words[words.index("<<<") + 1], consumer_words)  # ``cat <<< X | sh``
     return out
 
 
@@ -4421,6 +4441,9 @@ def _exec_payload_commands(command: str, rules: bool = False, _depth: int = 0) -
         # A shell's ``-c`` text and an ssh remote command are judged by their own
         # rules where they sit; a hidden command INSIDE them is still hidden.
         k = next((j for j, w in enumerate(words) if not _ASSIGN_TOKEN_RE.match(w)), None)
+        if k is not None:  # ``sudo|env|nohup|timeout N bash -c '…'``: the wrapped shell's payload is hidden too
+            w = _wrapped_command_index(words[k:])
+            k = k + w if w is not None else k
         head = words[k].rsplit("/", 1)[-1] if k is not None else ""
         if head in _SHELL_NAMES and head != "su":
             inner, _rest = _eval_shell_invocation(words[k + 1 :], False)