Independent review of the first fix found two defects. Bounding the grep lexer
removed the old "malformed payload" floor, and that floor had been the ONLY thing
blocking a hardline command hidden after a newline inside a double-quoted
$(grep ...) substitution: _mask_quoted_newlines treated the newline as quoted
DATA and replaced it with a space, so the later command-start pass saw
`/dev/null reboot` as an operand and the public guards approved a hardline
command with no callback. A substitution body inside double quotes is
executable; the masker now recurses into $(...) and backtick bodies with a fresh
quote state so a newline there stays a command boundary. The witness now blocks
as "system shutdown/reboot" (the correct verdict), as do the ; / && / | / nested
/ backtick variants.
Second: the lexer stopped at ANY backtick as if it closed an enclosing
substitution, so a grep with a backtick OPERAND lost its operands and was
reported malformed (a new false positive). A backtick opened after the grep is
an operand substitution; only an unmatched one closes the enclosing command.
Tests: the six hardline-inside-substitution shapes block as themselves; the
public guard blocks with zero approval callbacks; the backtick operand, a data
pattern and a quoted-newline commit message stay allowed. Approval/hardline
suites: 637 passed; the one failure (real-binary sort payload probe) fails
identically on main.
Teknium
98bf8b2073