fix(hooks): stop a printer on one line from blocking secrets on the next

[twistedmelonman]

The bug

The detector's bare $VAR and named_dump patterns used [^|;&]* for the gap
between a printing command and a variable. That class does not exclude
newlines, so an echo anywhere earlier in a multi-line command poisoned every
later secret expansion in the same command.

The discriminating pair — identical token usage, differing only in an
unrelated heading:

echo "=== survey ==="
GH_TOKEN="$GH_TOKEN_NOS" gh api repos/x/y     # blocked

GH_TOKEN="$GH_TOKEN_NOS" gh api repos/x/y     # allowed

Nothing on the second line prints. The block came entirely from the line above.

An earlier report attributed this to for loops. That was wrong — the loop is
incidental. The trigger is whether a printing command precedes the expansion
anywhere in the command text.

Why it matters

The fleet work needs per-owner token reads (GH_TOKEN_SWM / GH_TOKEN_NOS /
GH_TOKEN_TWM), and those survey scripts open with a heading nearly every
time. A control that blocks routine safe work trains people to route around
it, which costs more than the false positives.

The fix

Scope the gap to one line, while keeping a backslash-newline as the
continuation it is — echo \<newline> "$SECRET" is one logical command and
must still block.

Scoping the gap would have silently dropped one true positive: an unquoted
heredoc (cat <<EOF … $SECRET) expands and prints, and was caught only
because the old gap spanned newlines. It now has its own rule, so it blocks for
a stated reason rather than as a side effect of a bug. A quoted delimiter
(<<'EOF') disables expansion and is correctly allowed.

Bonus: a false green in the test suite

CDPATH is set to /Users/andrewrich/Developer in this environment. With a
relative argument, cd searches CDPATH before . and prints the resolved
path to stdout on a match — so

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

landed in Developer/scripts, captured pwd doubled and newline-joined, and
left HOOK pointing at a nonexistent file. All 50 checks exited 127.

The suite reported 50/50 when invoked directly and 1/50 when its output was
captured. Invocation-dependent green is the false-green shape this codebase
has been bitten by repeatedly.

Every other suite in scripts/tests already unsets CDPATH; this one had
missed the convention. hook-block-all.sh:6 does too, so production was never
affected — only the test.

Tests

50 pass, up from 44. Six added: the discriminating pair, the for-loop shape,
the backslash-continuation true positive, and both heredoc forms.

Full suite: 10/10 suites, 304 assertions, verified under the exact invocation
that previously produced 49 failures.

Scope note

This is a usability fix, not a security fix. Measured against today's
transcripts, zero leaks arrived through .tool_input.command — the only
channel this hook inspects. 84 leak sites across 12 distinct values all came
through tool results (69), assistant text (9), and attachments (6).

That measurement, and the output-side filter it points to, are being handled
separately. This PR should not be read as closing the leak.

Advances #485.

https://claude.ai/code/session_01PTUKVrdfDTU3ZH149e9pTY

[claude]

No BLOCK criteria found. Changes fix a false-positive bug in the gap pattern (now correctly stops at newlines, allowing backslash-continuations). The continue statement addition after named_dump is correct control flow. New heredoc detection properly distinguishes quoted vs. unquoted delimiters. Test cases are comprehensive and pass the expected exit codes.

VERDICT: PASS