fix(plugins): close 13 sentinel-hook allow bypasses

Three independent adversarial reviewers over two passes found thirteen false-ALLOW bypasses in sentinel-read-allow.js — five introduced by the comment-skip and traversal changes that prompted the review, eight pre-existing and surviving from the earlier review round. All are closed and pinned by regression cases. Every PoC was run through the hook and its shell effect confirmed in real bash.

Arbitrary command execution, three distinct routes:

A function definition with a subshell body — `cat () ( touch x ); cat` — has no top-level separator inside the body, so segmentation saw one segment whose first token was the safe name `cat` and never vetted the body; the following call ran it. The `$(`/`<(`/`>(` guards all require a sigil, so bare parens slipped past every one. Now rejected, tested on comment-stripped text so that prose parens in a `# Reload X (Check 41)` line stay inert.

maskQuotes ate a backslash-newline, merging a `# comment \` line with the line after it, so the comment skip swallowed a payload the shell still ran — bash ends a comment at the physical newline and does not continue it. Escaped newlines now survive as newlines in both the plain and double-quote branches.

Setting a sensitive variable had three routes that never produce the literal `NAME=` the assignment pattern looks for: `printf -v PATH` uses the builtin's variable-write flag, `read PATH < file` writes its target name through the deliberately-permitted input redirect, and `export PA${X}H=` is expanded only after the text has been inspected. Each hijacked PATH end to end, with a planted binary running as a whitelisted read-only token. The control now gates the variable write itself rather than the assignment syntax.

Command-boundary desync: bash unescapes `\'` inside `$'...'`, so the string ends at a different quote than the masker believes and the toggle count drifts — a `;` and a following command were masked into a single `echo` segment. No blueprint idiom uses ANSI-C quoting, so it is refused outright.

File write via a whitelisted token: `uniq IN OUT` writes its second positional operand, truncating a two-line file to zero bytes. Same class as the already-excluded `sort -o`, but positional rather than a flag. Removed from SAFE_TOKENS.

Write redirect via prefix match: the redirect stripper consumed the `>/dev/null` prefix of `>/dev/nullpwned`, leaving no `>` for the check that follows. Each stripped form is now anchored to a token boundary.

Traversal, two ways: an allow-list of neighbour characters let every unlisted separator through, so `cat {a,../etc/passwd}` brace-expanded into a parent-directory read. The check is now default-reject, exempting only a `..` beside a word character or dot. It also tests a backslash-collapsed copy, since `cat \.\./etc/passwd` carries no literal `..` bytes yet the shell resolves the parent directory.

Anchor forgery: the anchor test ran against the raw command, so a commented-out sentinel read matched READ_FORM and vouched for a live command with no blueprint idiom in it. stripComments gates the anchor test only; every other check still inspects the full command, so a comment can cost an allow but never grant one.

Assignment-operator and name coverage: the patterns matched only `=` and `+=`, so bash's `${VAR:=word}` form assigned a sensitive variable — and kept an existing export attribute, so a child process inherits it — without ever producing `VAR=`. Both patterns now cover `:=`, and NONEMPTY_IFS gains `{` in its boundary class, which `${IFS=x}` had been using to evade it. Quoting and escaping the name no longer helps either: the guard tests a quote-stripped copy alongside the raw text, with empty quotes preserved so the blueprint's own `IFS=""` stays empty. Added LD_AUDIT, the four missing DYLD siblings and PROMPT_COMMAND; dropped BASH_FUNC, which could never match its own real form and only gave false coverage.

The two changes that prompted the review stay: whole-line comments no longer reject an otherwise read-only block, and `...` ellipsis and `v1.2..v1.3` are no longer read as traversal.

Coverage held at 46 of 790 blueprint blocks through every fix — none of the hardening cost an allow. The one guard that did cost coverage, rejecting bare parens, was narrowed to live text after measuring 14 lost blocks. Hook suite 44 to 137 tests. Documented and left unfixed: the traversal guard sees only literal text, so dots the shell materialises at runtime stay invisible; every such case lands inside the read-only disclosure residual the header already accepts.

READMEs synced across the four plugins; patch bumps on each.

---
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: OpenAI Codex <codex@openai.com>

Author: 3 people

plugins/cc_develop/.claude-plugin/plugin.json

@@ -7,5 +7,5 @@
   "license": "Apache-2.0",
   "name": "develop",
   "repository": "https://github.com/Borda/AI-Rig",
-  "version": "0.25.0"
+  "version": "0.25.1"
 }

plugins/cc_develop/README.md

@@ -640,7 +640,7 @@ Hooks register automatically from `hooks/hooks.json` when the plugin is enabled
 | Hook                       | Event                                          | Behaviour                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | -------------------------- | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `agent-router.js`          | `PreToolUse` (`Agent`)                         | Reroutes `Agent()` calls when the requested agent is not installed: exact match → semantic match → `general-purpose`.                                                                                                                                                                                                                                                                                                             |
-| `sentinel-read-allow.js`   | `PreToolUse` (`Bash`)                          | Auto-allows the pre-canned TMPDIR sentinel-read and `$(date +FMT)` idioms inside read-only commands, so skill bash blocks stop raising "Contains expansion" prompts. Everything else falls through to normal checks.                                                                                                                                                                                                              |
+| `sentinel-read-allow.js`   | `PreToolUse` (`Bash`)                          | Auto-allows the pre-canned TMPDIR sentinel-read and `$(date +FMT)` idioms inside read-only commands, so skill bash blocks stop raising "Contains expansion" prompts. Everything else falls through to normal checks. Whole-line `# …` comments inside a block are skipped rather than blocking it, and `..` is matched as a path component so ellipsis and version ranges are not mistaken for traversal.                         |
 | `blueprint-allow.js`       | `PreToolUse` (`Bash`)                          | Byte-identical copy of the cc_foundry canonical (propagated via `propagate_shared.py`); normalizes the command, hashes it, and exact-matches it against this plugin's committed `blueprint-manifest.json`, so verbatim bash shipped in its own skills runs without a prompt. Any deviation from the blueprint text misses and falls through to a normal prompt.                                                                   |
 | `write-guard.js`           | `PreToolUse` (`Edit`, `Write`, `NotebookEdit`) | Byte-identical copy of the cc_foundry canonical (propagated via `propagate_shared.py`); grants nothing — forces a confirmation on writes to `.github/**`, `CLAUDE.md`/`AGENTS.md`, `.claude/settings*.json`, `.pre-commit-config.yaml`, `CHANGELOG.md`, dependency lockfiles and `pyproject.toml`. Source and tests are deliberately unprotected; everything else is silent passthrough.                                          |
 | `enforce-review-header.js` | `PreToolUse` (`AskUserQuestion`)               | Denies `/develop:review`'s follow-up question until the consolidated `review-report.md` exists, so the report header always reaches the terminal first. Silent unless a review run is in flight. Once the report exists, additionally nudges (never blocks) via `additionalContext` when the reply never rendered the header as a table — see `report-header-table.js`.                                                           |

plugins/cc_develop/blueprint-manifest.json

@@ -3001,6 +3001,6 @@
       "src": "skills/debug/SKILL.md:346"
     }
   },
-  "plugin": "cc_develop@0.25.0",
+  "plugin": "cc_develop@0.25.1",
   "schema": 1
 }

plugins/cc_develop/hooks/sentinel-read-allow.js

@@ -15,5 +15,5 @@
   "license": "Apache-2.0",
   "name": "foundry",
   "repository": "https://github.com/Borda/AI-Rig",
-  "version": "0.49.0"
+  "version": "0.49.1"
 }

plugins/cc_foundry/.claude-plugin/plugin.json

@@ -5573,6 +5573,6 @@
       "src": "skills/investigate/SKILL.md:100"
     }
   },
-  "plugin": "cc_foundry@0.49.0",
+  "plugin": "cc_foundry@0.49.1",
   "schema": 1
 }