가드를 도구 호출 앞에 앉혀

import shlex

FORBIDDEN = ".source.json"          # the pattern that must not print
PRINTERS = {"cat", "head", "tail", "less", "grep", "rg", "ag",
            "jq", "python", "python3", "awk", "sed"}

# NOT here, and this is the honest gap: `ls`, `find`, `tree`.
# The previous lesson called a bare directory listing a breach,
# and this guard does not close it. Naming the gap in the code
# is worth more than a set that claims coverage nobody has.


def breaches(command: str, target_dir: str) -> bool:
    """True if any PIPE SEGMENT could print forbidden content.

    Each segment is judged alone. A `cd` in segment 1 does not make
    segment 2 safe, and `| head` narrows nothing - it is a second
    command that inherits the first one's output.
    """
    cwd = ""                               # a `cd` in an earlier
    for segment in split_pipeline(command):  # segment still counts
        try:
            argv = shlex.split(segment, comments=True)   # comments are
        except ValueError:                               # NOT scope
            return True                                  # unparseable
        if not argv:                                     # -> refuse
            continue
        tool = argv[0].rsplit("/", 1)[-1]
        if tool == "cd" and len(argv) > 1:
            cwd = argv[1]                    # carried into later segments
            continue
        if tool not in PRINTERS:
            continue
        args = argv[1:]
        if any(FORBIDDEN in a for a in args):
            return True
        # An unscoped sweep at the target directory is the real shape
        # every incident took. A narrowing glob is the only exemption.
        touches_target = (target_dir in cwd
                          or any(target_dir in a for a in args))
        narrowed = any(a.startswith("--glob") or a.endswith(".target.json")
                       for a in args)
        if touches_target and not narrowed:
            return True
    return False


# The block message matters as much as the block. It must name the
# legitimate way through, or the next person disables the hook:
#
#   "blocked: unscoped read at the sealed directory.
#    Add --glob '*.target.json', or read the engine log instead."