From ca1fbc99b0d1d2f07d7cde4ff392b60f15af5411 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 11 Oct 2026 10:46:24 +0100
Subject: [PATCH 1/2] test: pin the home refusal and the brace left as text in
 shell strings

Pairing a shell string's word on its written text also lets the home's own
entry read `sh -c "rm -rf ${X:-\${HOME}}/"` and `${X:+\${HOME}}`, which main
allows; nothing pinned that, so a later narrowing of the pairing could
reopen it silently. A brace the default leaves as text
(`${X:-\$HOME}}/`, which hands the string `$HOME}/`) stays allowed.

Refs: iss-2610110025455728

Assisted-by: Claude:claude-opus-5-5
---
 internal/core/guard/unguardedvar_test.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/internal/core/guard/unguardedvar_test.go b/internal/core/guard/unguardedvar_test.go
index 014485eef..4da239804 100644
--- a/internal/core/guard/unguardedvar_test.go
+++ b/internal/core/guard/unguardedvar_test.go
@@ -257,6 +257,14 @@ func TestRmEmptyTextInAShellStringLeads(t *testing.T) {
 		{`sh -c "rm -rf ${X:-\${Y}}/y"`, VerdictBlock, id},
 		{`sh -c "rm -rf ${X:-\${Y:-}}/y"`, VerdictBlock, id},
 		{`sh -c "rm -rf ${X:-\${HOME}}/y"`, VerdictAllow, ""},
+		// Pairing on the written text reaches the home's own entry too: the
+		// string deletes the home.
+		{`sh -c "rm -rf ${X:-\${HOME}}/"`, VerdictBlock, "rm-rf-root-or-home"},
+		{`sh -c "rm -rf ${X:+\${HOME}}"`, VerdictBlock, "rm-rf-root-or-home"},
+		// A brace the default leaves as text is not taken into a reference:
+		// `${X:-\$HOME}}/` hands the string `$HOME}/`, a directory under
+		// the working one.
+		{`sh -c "rm -rf ${X:-\$HOME}}/"`, VerdictAllow, ""},
 		{`sh -c "rm -rf ${X:?}${Y:+z}/y"`, VerdictAllow, ""},
 		{`sh -c "rm -rf ./${X:+x}/y"`, VerdictAllow, ""},
 		{`sh -c "rm -f ${X:+--force} /tmp/a"`, VerdictAllow, ""},

From f4cd90cdd9c7c852a8c7b4e77d2a5c921c17f4fc Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Sun, 11 Oct 2026 10:46:55 +0100
Subject: [PATCH 2/2] chore: capture the search a shell string's default hides
 from kill

Refs: iss-2610110946486757

Assisted-by: Claude:claude-opus-5-5
---
 ...10946486757-kill-search-in-a-string-default.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)
 create mode 100644 .abcd/work/issues/open/iss-2610110946486757-kill-search-in-a-string-default.md

diff --git a/.abcd/work/issues/open/iss-2610110946486757-kill-search-in-a-string-default.md b/.abcd/work/issues/open/iss-2610110946486757-kill-search-in-a-string-default.md
new file mode 100644
index 000000000..03555af80
--- /dev/null
+++ b/.abcd/work/issues/open/iss-2610110946486757-kill-search-in-a-string-default.md
@@ -0,0 +1,15 @@
+---
+schema_version: 1
+id: "iss-2610110946486757"
+slug: "kill-search-in-a-string-default"
+severity: "minor"
+category: "bug"
+source: "impl-review"
+found_during: "Fable review of the shell-string re-read fix (fix/guard-string-reread-gaps)"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "internal/core/guard/payload.go"
+remedy: "Feed a substitution the string's own shell runs inside a default the enclosing shell wrote as text (${X:-\\$(pgrep make)}) to the string's commands as the substitution's output, as payloadInput already does for a substitution in the string's own words; one fixture per entry it reaches, watched fail first."
+---
+
+The kill-by-search guard entry allows a search inside a double-quoted shell string's default: sh -c "kill ${X:-\$(pgrep make)}" is allowed, although with X unset the string's shell runs kill $(pgrep make). The same search written straight into the string, sh -c "kill \$(pgrep make)", refuses, and so does the direct kill ${X:-$(pgrep make)}. The string's re-read takes only spellings and varLead from the written string, never the feeds of the substitutions it holds (payload.go namedPayloads, payloadInput), so the search's output never reaches kill. main allows it too; it was found by the review of the fix for iss-2610110025455728.