fix: stop an = in a flag from disabling the install gate

The env-assignment strip used an unanchored `[A-Za-z_]*=*` case glob, which
matches the WHOLE segment whenever any LATER token carries an `=`. It then ate
the leading words, so `npm install --omit=dev`, `npm ci --loglevel=error` and
`npm install --workspace=packages/core` were all ALLOWED. That is the one
direction that matters, since the gate exists to stop a write, and the last is
an ordinary command in this monorepo. It also made the `--prefix=` branch of
the regexes dead while the space-form test stayed green over it.

The strip is token-wise now, and the assignment test is anchored to the first
token alone.

Walking past arbitrary tokens after a wrapper turned out to re-create the
token-anywhere class one level in: with `command` and `bash` treated as
wrappers, `command -v yarn` blocked and `bash -c "echo yarn"` would have. So
the walk covers a wrapper's own flags and their values only, and `command`,
`exec`, `bash` and `sh` are not wrappers. `bash -c "npm ci"` is a documented
accepted gap rather than a parser for nested shells.

Author: vivek7405

.claude/hooks/block-install-in-linked-worktree.sh

@@ -69,22 +69,58 @@ GLOBAL='(^|[[:space:]])(-g|--global)([[:space:]]|$)'
 eff="$PWD"
 target=""
 while IFS= read -r seg; do
+  # Quotes are dropped so a quoted command body tokenizes (`bash -c "npm ci"`).
+  # This is safe: what keeps `git commit -m "npm ci"` out is the command-position
+  # rule below, never the quoting.
+  seg=$(printf '%s' "$seg" | tr -d '"'"'"'')
   seg="${seg#"${seg%%[![:space:]]*}"}"
   [ -z "$seg" ] && continue
 
-  # Strip leading env assignments and benign wrappers, so `FOO=1 npm ci` and
-  # `sudo npm ci` are still judged on the manager that follows them.
-  while :; do
-    case "$seg" in
-      [A-Za-z_]*=*)
-        rest="${seg#* }"; [ "$rest" = "$seg" ] && break
-        seg="${rest#"${rest%%[![:space:]]*}"}" ;;
-      sudo\ *|env\ *|time\ *|nice\ *)
-        rest="${seg#* }"
-        seg="${rest#"${rest%%[![:space:]]*}"}" ;;
-      *) break ;;
+  # Strip leading env assignments and benign wrappers, so `FOO=1 npm ci`,
+  # `sudo npm ci` and `bash -c "npm ci"` are still judged on the manager that
+  # follows them.
+  #
+  # This is done TOKEN BY TOKEN, and the env-assignment test is anchored to the
+  # first token alone. An unanchored `[A-Za-z_]*=*` case glob matches the WHOLE
+  # segment whenever any LATER token contains `=`, so it ate leading words and
+  # `npm install --omit=dev`, `npm ci --loglevel=error` and
+  # `npm install --workspace=packages/core` all failed OPEN. Failing open is the
+  # one direction that matters here, since the whole point is to stop a write.
+  wrapper_seen=0
+  prev_flag=0
+  for _ in 1 2 3 4 5 6 7 8 9 10; do
+    first="${seg%%[[:space:]]*}"
+    [ -n "$first" ] || break
+    strip=0
+    case "$first" in
+      *=*)
+        # A real env assignment: NAME=..., NAME being a valid shell identifier.
+        name="${first%%=*}"
+        case "$name" in
+          ''|*[!A-Za-z0-9_]*|[0-9]*) ;;
+          *) strip=1 ;;
+        esac ;;
+      sudo|env|time|nice) wrapper_seen=1; prev_flag=0; strip=1 ;;
+      npm|bun|pnpm|yarn|yarnpkg) ;;
+      -*)
+        # A wrapper's OWN flag, e.g. `sudo -u foo npm ci`.
+        [ "$wrapper_seen" = "1" ] && { prev_flag=1; strip=1; } ;;
+      *)
+        # The VALUE of the wrapper flag just stripped, e.g. the `foo` in `-u foo`
+        # or the `10` in `nice -n 10`. Deliberately narrow: walking past ARBITRARY
+        # tokens after a wrapper re-creates the token-anywhere class one level in,
+        # where `bash -c "echo yarn"` would reach the bare-yarn branch and block.
+        # `command`, `exec`, `bash` and `sh` are NOT wrappers here for that reason,
+        # so `command -v yarn` stays allowed and `bash -c "npm ci"` is a known,
+        # accepted gap rather than a parser for nested shells.
+        if [ "$wrapper_seen" = "1" ] && [ "$prev_flag" = "1" ]; then prev_flag=0; strip=1; fi ;;
     esac
+    [ "$strip" = "1" ] || break
+    rest="${seg#*[[:space:]]}"
+    [ "$rest" = "$seg" ] && { seg=""; break; }
+    seg="${rest#"${rest%%[![:space:]]*}"}"
   done
+  [ -n "$seg" ] || continue
 
   case "$seg" in
     cd|cd\ *)

test/hooks/block-install-in-linked-worktree.test.mjs

@@ -154,12 +154,55 @@ test('never blocks a GLOBAL install, which writes to the npm prefix not the link
 test('still sees the install through env assignments and benign wrappers', () => {
   const { root, worktree } = makeLinkedPair();
   try {
-    for (const cmd of ['WEBJS_X=1 npm ci', 'sudo npm ci', 'time npm install', 'FOO=a BAR=b bun install']) {
+    for (const cmd of [
+      'WEBJS_X=1 npm ci', 'sudo npm ci', 'time npm install', 'FOO=a BAR=b bun install',
+      // A wrapper carrying its OWN flags, which the strip must walk past.
+      'sudo -u foo npm ci', 'nice -n 10 npm install',
+    ]) {
+      assert.equal(runHook(cmd, worktree).status, 2, `expected block for \`${cmd}\``);
+    }
+    // `command`, `exec`, `bash` and `sh` are deliberately NOT wrappers. Walking
+    // into a nested shell command re-creates the token-anywhere class one level
+    // in, where `bash -c "echo yarn"` reaches the bare-yarn branch. So a lookup
+    // stays allowed, and `bash -c "npm ci"` is a known accepted gap.
+    assert.equal(runHook('command -v yarn', worktree).status, 0);
+    assert.equal(runHook('bash -c "echo yarn"', worktree).status, 0);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test('an `=` in a FLAG does not disable the gate (fail-open regression)', () => {
+  // The env-assignment strip is anchored to the FIRST token. An unanchored
+  // `[A-Za-z_]*=*` case glob matches the WHOLE segment whenever any LATER token
+  // carries an `=`, so it ate the leading words and every one of these was
+  // ALLOWED, which is the one direction that actually matters: the gate exists
+  // to stop a write, and `npm install --workspace=packages/core` is an ordinary
+  // command in this monorepo that corrupts the primary.
+  const { root, worktree } = makeLinkedPair();
+  try {
+    for (const cmd of [
+      'npm install --omit=dev',
+      'npm ci --loglevel=error',
+      'npm install --workspace=packages/core',
+      'bun install --backend=hardlink',
+      'yarn add x --registry=https://r',
+      'pnpm add x --dir=/y',
+      'npm i -D esbuild --foreground-scripts=true',
+    ]) {
       assert.equal(runHook(cmd, worktree).status, 2, `expected block for \`${cmd}\``);
     }
   } finally { rmSync(root, { recursive: true, force: true }); }
 });
 
+test('the --prefix= EQUALS form is reachable, not just the space form', () => {
+  // The regexes carry `[[:space:]=]+` deliberately, and the pre-existing prefix
+  // test used only the space form, so the equals branch was dead while green.
+  const { root, primary, worktree } = makeLinkedPair();
+  try {
+    assert.equal(runHook(`npm --prefix=${worktree} install`, primary).status, 2);
+    assert.equal(runHook(`npm install --prefix=${worktree}`, primary).status, 2);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
 test('bare `yarn` blocks only in COMMAND position, never as a trailing word', () => {
   // The bare-yarn branch first lived inside the generic VERBS pattern, whose
   // prefix any space satisfies, so it matched the token ANYWHERE and blocked