The same dangerous commands, spelled the other ways a shell reads identically.
Takes a battery of hook test cases (shell commands wrapped as PreToolUse
events — DISASTER_CATALOG is the shipped one) and returns MORE test cases:
every command re-spelled with a quoted flag (git push "--force"), the short
form of a flag (-f), an absolute or escaped head (/usr/bin/git, \git), or a
pass-through wrapper (sudo …, env …). The shell runs each rewrite exactly as
it runs the original. Feed them to assertBlocksDisasters alongside the
originals:
WHAT BREAKS WITHOUT IT. A guard whose rule is "the command contains --force"
blocks all seven catalog commands, so the battery is green — and lets
git push "--force" through, because the quotes make it a different string.
Measured 2026-09-02 on the shipped dogfood guard BEFORE this existed: 7/7
originals blocked, 8 of 30 hand-written re-spellings blocked.
WHY THE OUTPUT IS TRUSTWORTHY. Nothing new is judged. "Dangerous" is inherited
from the original a human put in the battery; "the same command" is decided by
the shell parser vigiles already uses for runs()/touches() (see
sameOperation). A rewrite that fails that check throws rather than being
emitted, so the battery can never quietly shrink.
It returns ONLY the rewrites (never the originals), so pass the originals
alongside as above. Each rewrite keeps its original's tool and category
and takes the original's id with an index suffix (force-push~4), so a report
names which spelling got through.
In promptfoo's vocabulary each rewrite rule here is a "strategy"; the difference
is that promptfoo's encodings (base64, leetspeak) may or may not be decoded by the
target, whereas every rewrite here is one the shell provably executes identically
— a miss is a guard bug, never an ambiguous input.
Days old with a single consumer (this repo's own dogfood) and no
external use. The set of rewrite rules and the id-suffix shape are the parts most
likely to move; the prefix says so at every call site, which an import line or a
doc note cannot.
The same dangerous commands, spelled the other ways a shell reads identically.
Takes a battery of hook test cases (shell commands wrapped as
PreToolUseevents —DISASTER_CATALOGis the shipped one) and returns MORE test cases: every command re-spelled with a quoted flag (git push "--force"), the short form of a flag (-f), an absolute or escaped head (/usr/bin/git,\git), or a pass-through wrapper (sudo …,env …). The shell runs each rewrite exactly as it runs the original. Feed them toassertBlocksDisastersalongside the originals:WHAT BREAKS WITHOUT IT. A guard whose rule is "the command contains
--force" blocks all seven catalog commands, so the battery is green — and letsgit push "--force"through, because the quotes make it a different string. Measured 2026-09-02 on the shipped dogfood guard BEFORE this existed: 7/7 originals blocked, 8 of 30 hand-written re-spellings blocked.WHY THE OUTPUT IS TRUSTWORTHY. Nothing new is judged. "Dangerous" is inherited from the original a human put in the battery; "the same command" is decided by the shell parser vigiles already uses for
runs()/touches()(see sameOperation). A rewrite that fails that check throws rather than being emitted, so the battery can never quietly shrink.It returns ONLY the rewrites (never the originals), so pass the originals alongside as above. Each rewrite keeps its original's
toolandcategoryand takes the original's id with an index suffix (force-push~4), so a report names which spelling got through.In promptfoo's vocabulary each rewrite rule here is a "strategy"; the difference is that promptfoo's encodings (base64, leetspeak) may or may not be decoded by the target, whereas every rewrite here is one the shell provably executes identically — a miss is a guard bug, never an ambiguous input.
Days old with a single consumer (this repo's own dogfood) and no external use. The set of rewrite rules and the id-suffix shape are the parts most likely to move; the prefix says so at every call site, which an import line or a doc note cannot.