Judged-script-body reader: four holes the gate found in the merged code (stdin redirect, wrapper arity, body heredocs, late-SAFE flags)

Start in index.ts at the wrapper, stdin, heredoc, and late-verdict locations named in the issue, then run tests/script-body.test.ts and tests/late-verdict.test.ts. Trace how judgedCommand and riskFlags are built. Done means all four acceptance sections have regression coverage, including the stated behavior for unreadable redirects, unknown wrapper options, and body heredocs.

This was generated by AI during triage.

The review gate found four holes in the judged-script-body reader (merged in e99d240, PR #121). Each is filed here rather than dismissed as out of scope, because the code, not the docs PR that surfaced them, is what needs changing; they are grouped in one issue because they share a surface and a fix round can take them together.

1. A redirected stdin script is not read

bash < installer          # installer contains: rm -rf ./out

< stays a token, so the reader takes it as the program and then skips the extensionless installer as a load operand (index.ts:3355), and bash -s < installer returns no refs at the -s (index.ts:3309). The deterministic stdin scan covers pipe stages (index.ts:3944) while the direct-interpreter overlay checks only -c/-e (index.ts:4004). A SAFE answer can therefore allow the body to run with no risk flag, where the same bytes read from disk are flagged (tests/script-body.test.ts:41-46, :91-98). Bash executes the redirected file's contents as code.

Acceptance: the body of a file redirected into an interpreter is read and judged; a flagged body raises the same flag as the on-disk spelling; a redirect of something that is not a readable file fails closed or is left alone, one of the two, stated.

2. A wrapper option's value hides the interpreter

env -u FOO python3 payload.py

The parser skips env, then -u, then stops at FOO because the wrapper-value check skips numeric values only (index.ts:3054-3063); FOO is not an interpreter, so payload.py is never read (index.ts:3066). env -u consumes its variable name, so Python is what runs.

Acceptance: env -u FOO python3 payload.py reads payload.py; the arity of the wrappers this repo recognizes is read from a table per wrapper, not from "is it a number"; an unknown wrapper option fails closed by making the command opaque rather than by guessing which word is the program.

3. A script body can hide a heredoc it later executes

A script whose body feeds a heredoc into another interpreter (or writes and runs one) has that inner payload stripped as inert, because the heredoc handling assumes a heredoc in the command text is data: the body's own heredocs never reach the risk scan (index.ts:6460, :6467). The reader's own model — "the bytes that were judged are the bytes that run" — needs the same treatment here, or the body's heredocs need to be scanned as executed text.

Acceptance: a body containing cat <<'EOF' > x.sh plus a later bash x.sh, or a heredoc piped into an interpreter, is flagged; the fix states which of the two models it takes (scan body heredocs as executed, or refuse the shape), and the regression fails before the change.

4. A late SAFE omits the script-body risk flags

The late-verdict guard (added with #62) builds its riskFlags from command rather than judgedCommand (index.ts:6552), so when a late SAFE dismisses a timeout dialog the guard is deciding on flags computed from the raw command text — the spliced script body's flags are absent. A body that trips matchModerateRiskTokens (or the interpreter-code markers) can therefore have its dialog dismissed by a late SAFE, which is exactly the case the guard exists to prevent.

Acceptance: the late-SAFE guard reads the same text the verdict was derived from (judgedCommand), with a regression that a body carrying a flagged operation keeps the dialog open under a late SAFE — driven through the real plugin with the late-verdict fixture (tests/late-verdict.test.ts).

Related

These sit beside the two residuals already recorded for this work: a script swapped between the read and execution (docs/plans/2026-09-19-intent-aware-judgment.md:307, accepted) and a sourced file that changes the directory (#130).