restrict-bash: a pipe inside quotes is payload, not structure

Read-only agents may not run compound commands. The check asked cmd.includes('|') on the raw string, which cannot tell a shell pipe from a pipe character. So grep -E "a|b" read as two processes and was denied, and since jq uses | as its core operator, the allowlist admitted jq while this check refused nearly every real jq call.

The fix scans quote-blanked text using blankQuotedContent(), a helper this repo already ships for exactly this. Type a command below and compare the two implementations.

Try a command

before (raw substring scan)
?
after (quote-blanked scan)
?

what the new scan actually inspects


    Quoted regions are replaced with empty quotes before the operator scan, so only operators the shell would really act on survive.
  


  
Examples

  

    

      
Was wrongly denied, now allowed

      
      
      
      
    

    

      
Still denied, as it must be

      
      
      
      
    

  


  
Verified end to end

  
Every row below was run through bin/run-hook.mjs agent/restrict-bash against the built bundle, not against the TypeScript source, so it proves the fix is reached in the artifact that actually ships.

  

    

      
commandexpectedresult