fix(arg-parser): take the arguments as stdin text, and block a heredoc that closes early

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/hooks/bash-guard.test.mjs

@@ -9,6 +9,7 @@
 
 import { test } from 'node:test';
 import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { runHook } from '../helpers/hook-helper.mjs';
@@ -314,3 +315,70 @@ test('pre-bash-executor fails open on malformed JSON', async () => {
   const { code } = await runHook(PRE_BASH, 'not-json');
   assert.strictEqual(code, 0);
 });
+
+// -----------------------------------------------------------------------
+// ARG / R6 (fix round 4.5b) -- the parser heredoc must not close early.
+// The commands hand $ARGUMENTS to the arg parser through a quoted heredoc
+// closed by VOYAGE_ARGS_EOF_7F3C9E. A typed line equal to that delimiter
+// would end the heredoc there, and the shell would run every line after it
+// as a command. Each blocking case asserts the rule's name on stderr, so it
+// is red on its own assertion where the rule does not exist.
+// -----------------------------------------------------------------------
+const ARGS_DELIM = 'VOYAGE_ARGS_EOF_7F3C9E';
+const ARGS_RULE = /args-heredoc-closed-early/;
+const PARSER_LINE = 'node /plugin/lib/parsers/arg-parser.mjs --command trekendsession --stdin';
+
+async function expectArgsBlocked(command) {
+  const { code, stderr } = await runHook(PRE_BASH, bashInput(command));
+  assert.match(stderr, ARGS_RULE, `the guard did not name args-heredoc-closed-early for: ${JSON.stringify(command)}`);
+  assert.strictEqual(code, 2, `the guard did not block: ${JSON.stringify(command)}`);
+}
+
+async function expectArgsAllowed(command) {
+  const { code, stderr } = await runHook(PRE_BASH, bashInput(command));
+  assert.doesNotMatch(stderr, ARGS_RULE, `the guard refused a well-formed heredoc: ${JSON.stringify(command)}`);
+  assert.strictEqual(code, 0, `the guard refused a well-formed heredoc: ${stderr}`);
+}
+
+test('[ARG] the guard blocks a parser heredoc whose closing line is followed by a command', async () => {
+  await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED`);
+  await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n`);
+});
+
+test('[ARG] the guard blocks a parser heredoc with the closing line twice', async () => {
+  await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
+  // A typed line with spaces around the delimiter still counts as a closing line.
+  await expectArgsBlocked(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md\n  ${ARGS_DELIM}  \ntouch PWNED\n${ARGS_DELIM}\n`);
+});
+
+test('[ARG] the guard allows the parser heredoc as the commands write it', async () => {
+  await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md Session 2 of 3\n${ARGS_DELIM}`);
+  await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md Session 2 of 3\n${ARGS_DELIM}\n`);
+  await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\n\n${ARGS_DELIM}\n\n`);
+  await expectArgsAllowed(`${PARSER_LINE} <<'${ARGS_DELIM}'\nbrief.md ; touch PWNED $(touch PWNED2) *\n${ARGS_DELIM}`);
+});
+
+test('[ARG] the guard blocks an unquoted or spaced opener whose body closes early', async () => {
+  await expectArgsBlocked(`${PARSER_LINE} << '${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
+  await expectArgsBlocked(`${PARSER_LINE} <<"${ARGS_DELIM}"\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
+  await expectArgsBlocked(`${PARSER_LINE} <<-'${ARGS_DELIM}'\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
+  await expectArgsBlocked(`${PARSER_LINE} <<${ARGS_DELIM}\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
+  // Unquoted, the body would expand $( ) even when it closes where it should.
+  await expectArgsBlocked(`${PARSER_LINE} <<${ARGS_DELIM}\nbrief.md $(touch PWNED)\n${ARGS_DELIM}`);
+});
+
+test('[ARG] the guard checks a backslash-quoted <<\\VOYAGE_ARGS_EOF_7F3C9E opener', async () => {
+  await expectArgsBlocked(`${PARSER_LINE} <<\\${ARGS_DELIM}\nbrief.md\n${ARGS_DELIM}\ntouch PWNED\n${ARGS_DELIM}`);
+  await expectArgsBlocked(`${PARSER_LINE} << \\${ARGS_DELIM}\nbrief.md\n${ARGS_DELIM}\ntouch PWNED`);
+  await expectArgsAllowed(`${PARSER_LINE} <<\\${ARGS_DELIM}\nbrief.md Session 2 of 3\n${ARGS_DELIM}`);
+});
+
+test("[ARG] the guard's added lines are ASCII", () => {
+  const src = readFileSync(PRE_BASH, 'utf8');
+  const from = src.indexOf('// BEGIN args-heredoc-closed-early');
+  const to = src.indexOf('// END args-heredoc-closed-early');
+  assert.ok(from >= 0 && to > from, 'the guard marks its args-heredoc-closed-early block with BEGIN/END comments');
+  const block = src.slice(from, to);
+  assert.match(block, /VOYAGE_ARGS_EOF_7F3C9E/);
+  assert.doesNotMatch(block, /[^\x00-\x7f]/, 'a hook script is ASCII (~/.claude/CLAUDE.md, Miljo)');
+});