Repository navigation

fix(#5255): read ANSI-C quoting ($'…') in the secret-read guard - #5285

Open

0xdhx wants to merge 58 commits into

open-gsd:nextfrom

0xdhx:fix/5255-secret-read-guard-ansi-c-quoting

Open

fix(#5255): read ANSI-C quoting ($'…') in the secret-read guard#5285
0xdhx wants to merge 58 commits into
open-gsd:nextfrom
0xdhx:fix/5255-secret-read-guard-ansi-c-quoting

Commits on Nov 5, 2026
- fix(#5255): read bash ANSI-C quoting in the secret-read guard
  
  0xdhx
  and
  claude
  committed
  6caa205
- chore(#5255): set changeset fragment pr to 5285
  0xdhx
  committed
  646ce23
- fix(#5255): join a `$` run's line continuations as bash does
  
  0xdhx
  and
  claude
  committed
  8ea8fc2
- fix(#5255): end a `${…}` past a `}` inside a `$'…'` span
  
  0xdhx
  and
  claude
  committed
  71b068d
- fix(#5255): read dollar-quoting under zsh's decoding as well as bash's
  
  0xdhx
  and
  claude
  committed
  97e927a
- test(#5255): pin the length and nesting boundaries of the dollar-quoting readings
  
  0xdhx
  and
  claude
  committed
  81bc335
- refactor(#5255): return every Bash block as { code, text }
  
  0xdhx
  and
  claude
  committed
  2936665
- test(#5255): pin a trailing zsh modifier escape with no byte to modify
  
  0xdhx
  and
  claude
  committed
  85b33c8
- fix(#5255): read bytes that are not UTF-8 in bash's $'…' value as written
  
  0xdhx
  and
  claude
  committed
  4dd07b4
- test(#5255): confirm the zsh-only rows in zsh 5.9 and pin the escapes that end a span
  
  0xdhx
  and
  claude
  committed
  620fd78
- docs(#5255): shorten the changeset fragment
  
  0xdhx
  and
  claude
  committed
  6710e6c
- fix(#5255): pair a `$` run before `{` and `(` left to right
  
  0xdhx
  and
  claude
  committed
  f7458a7
- fix(#5255): open a `$'…'` span after any `$` run under zsh's reading
  
  0xdhx
  and
  claude
  committed
  22b6e6c
- test(#5255): pin where the `$( )` scanner ends zsh's span and heredoc tag
  
  0xdhx
  and
  claude
  committed
  2f746ca
- fix(#5255): leave zsh's `$${` to its brace rule, and scan a run before `{` or `(` under every reading
  
  0xdhx
  and
  claude
  committed
  6e5e2e3
- fix(#5255): pair a `$` run inside double quotes under zsh's reading
  
  0xdhx
  and
  claude
  committed
  fca158a
- fix(#5255): pair a `$` run in an unquoted heredoc body under the ANSI-C readings
  
  0xdhx
  and
  claude
  committed
  ac36c1c
- fix(#5255): pair a `$` run inside double quotes under bash's reading too
  
  0xdhx
  and
  claude
  committed
  d8f6fd6
- refactor(#5255): name the scanners' reading parameter `reading`
  
  0xdhx
  and
  claude
  committed
  512e9a4
- fix(#5255): read a command the way dash does, pairing a `$` run with plain quotes
  
  0xdhx
  and
  claude
  committed
  b4bdb9f
- fix(#5255): open a `$(` past a line continuation inside "…" and a heredoc body
  
  0xdhx
  and
  claude
  committed
  a909ce9
- fix(#5255): deny a command the scan cannot finish instead of failing open
  
  0xdhx
  and
  claude
  committed
  f24771f
- fix(#5255): bound the scan's total work, denying past it as command-too-complex
  
  0xdhx
  and
  claude
  committed
  a105376
- docs(#5255): list the shapes the decoded-value check does not reach, and pin them
  
  0xdhx
  and
  claude
  committed
  c17fca7
- docs(#5255): name dash's reading and command-too-complex in the changeset
  
  0xdhx
  and
  claude
  committed
  27f68e3
- test(#5255): pin the scan budget's boundary at budget - 1, budget and budget + 1
  
  0xdhx
  and
  claude
  committed
  1b0247b
- docs(#5255): say how the scan budget's reach shrinks with each nested level
  
  0xdhx
  and
  claude
  committed
  23e2448
- fix(#5255): read past the quotes and substitutions inside a ${…}, and allow nothing the earlier scan blocked
  
  0xdhx
  and
  claude
  committed
  a8606b2
- docs(#5255): say how a ${…} is read under the readings, and what is still not covered
  
  0xdhx
  and
  claude
  committed
  fd699e4
- docs(#5255): say command-too-complex means a parser overflow or the work budget
  
  0xdhx
  and
  claude
  committed
  a56608c
- docs(#5255): say zsh takes only `\\` and `\'` as escapes in a span after an even run of `$`
  
  0xdhx
  and
  claude
  committed
  5544c22
- test(#5255): read a heredoc tag that holds a substitution under the dollar-quoting readings
  
  0xdhx
  and
  claude
  committed
  a08b494
- fix(#5255): charge the dollar-quoting readers for every character they pass, so no unclosed run can outlast the hook
  
  0xdhx
  and
  claude
  committed
  9dac999
- docs(#5255): count #5513's heredoc passes in the scan-budget figures
  
  0xdhx
  and
  claude
  committed
  f187842
- fix(#5255): cut an operand's trailing separators with a loop, not `/[\\/]+$/`
  
  0xdhx
  and
  claude
  committed
  dc405f7
- fix(#5255): let an even `$` run before an unclosed span pass, as the issue requires
  
  0xdhx
  and
  claude
  committed
  f68ef3f
- refactor(#5255): stop reading comments in `$( )`, as the maintainer's scope ruling asks
  
  0xdhx
  and
  claude
  committed
  81635ea
- fix(#5255): read a brace, or a `${` that never closes, as a heredoc tag
  
  0xdhx
  and
  claude
  committed
  ded44e1
- fix(#5255): read zsh's arithmetic, in which a quote is not a quote
  
  0xdhx
  and
  claude
  committed
  0e4c988
- fix(#5255): find a pattern operator and a `${` past dash's line continuations
  
  0xdhx
  and
  claude
  committed
  44b8870
- refactor(#5255): name `glob-too-complex` only for an overflow in the glob itself
  
  0xdhx
  and
  claude
  committed
  43d988f
- fix(#5255): surface a bug in a reading, and read a tag under #5513's earlier reading
  
  0xdhx
  and
  claude
  committed
  fe14b84
- test(#5255): hold the claim that nothing denied before is allowed against a frozen scanner
  
  0xdhx
  and
  claude
  committed
  73177db
- docs(#5255): drop the review history from the code and its tests
  
  0xdhx
  and
  claude
  committed
  025c4c1
- docs(#5255): shorten the hook's user-guide entry and the changeset
  
  0xdhx
  and
  claude
  committed
  b3c5d49
- test(#5255): make the tag and frozen-scanner tests fail when their fixes are reverted
  
  0xdhx
  and
  claude
  committed
  37bd5ae
- fix(#5255): keep a heredoc tag's unclosed `${` linear
  
  0xdhx
  and
  claude
  committed
  f8bae7d
- refactor(#5255): stop opening `$(` past a line continuation, which no Major 3 shape needs
  
  0xdhx
  and
  claude
  committed
  61cb559
- fix(#5255): scan a brace in a heredoc tag the earlier way too, so nothing denied is allowed
  
  0xdhx
  and
  claude
  committed
  fc67167
- fix(#5255): report a bug in a reading on stderr, and lose no denial to it
  
  0xdhx
  and
  claude
  committed
  1e1b382
- fix(#5255): rank a secret read over a word with no value at every depth
  
  0xdhx
  and
  claude
  committed
  4279f47
- fix(#5255): treat `'` in zsh's arithmetic as `"`, and scan what a skipped body runs
  
  0xdhx
  and
  claude
  committed
  827cfe1
- docs(#5255): name the reader the budget comment means, and what a `((` costs
  
  0xdhx
  and
  claude
  committed
  58b620c
- fix(#5255): run the earlier brace passes for a tag only a nested scan meets
  
  0xdhx
  and
  claude
  committed
  dadd987
- fix(#5255): hold a nested word with no value where every scanner enters a body
  
  0xdhx
  and
  claude
  committed
  a880a9a
- fix(#5255): scan a substitution in a `$[ ]` the `${…}` reader or "…" skips
  
  0xdhx
  and
  claude
  committed
  c8b2146
- docs(#5255): say what the arithmetic gaps and a held word actually cover
  
  0xdhx
  and
  claude
  committed
  a970f23
- docs(#5255): list the arithmetic gaps by example, with the shells that run each
  
  0xdhx
  and
  claude
  committed
  18f963b

Commits

Commits on Nov 5, 2026