Close wrapper, deferred-command and stack-overflow bypasses in deniedBy

[devmaxxx]

Summary

An audit of deniedBy found about 65 command lines that run a denied command while the guard returned null, and one input that made it throw instead of returning a verdict.

• Stack overflow fails closed. A deeply nested line ('$('.repeat(20000)) threw a RangeError. A PreToolUse hook that treats an error as "no decision" would have let the command run. The line is now reported as unreadable ('unbalanced quoting').
• More wrappers come off. chrt, taskset, caffeinate, arch, strace, ltrace, nsenter, chroot, pkexec, run0, runuser, su -c, systemd-run, script, parallel, fd -x, ssh host …, yarn exec, bun x/bun exec, gtimeout, fakeroot, unshare, sandbox-exec, coproc and function bodies. The zsh-only forms =cmd, noglob, nocorrect, - and [[ … ]] cmd are read in strict mode only.
• Commands set up to run later are read. trap actions, alias values, git rebase -x, git difftool -x, git bisect run, git submodule foreach, git filter-branch filters, and git -c values such as a pager, editor or ssh command. git config alias.* is denied.
• Words xargs and parallel add count as expansions. This covers echo push | xargs git and xargs -I{} sh -c {}, including a replace-string inside an option cluster.
• source of stdin or a process substitution is denied. source of a regular file is still allowed, as ./script is, so that source .venv/bin/activate keeps working.
• Interpreter inline code is searched. The inline program of python -c, node -e, perl -e, ruby -e, php -r, osascript -e, awk and similar is searched for a pattern's words. This is a heuristic and the README says so.
• rm operands are folded. //, /./, a trailing / or /., and .. are folded before matching.
• Option parsing is fixed. Values attached to their option (-c'code') are read, ssh options after the host are skipped, and GNU time -f/-o and env -a/-P take their value.
• DEFAULT_DENY grows. It adds pkexec, run0 and rm -rf ~/*.
• Code is reorganized. The option tables move to src/wrappers.ts.

The README now compares against agent hooks (git-guardrails, dcg). It also documents the new limits.

Known gaps

• Launchers not in the table still return null: setpriv, xcrun, direnv exec, op run, mise exec.
• rm -rf ~/.. is denied as ~. That is stricter than needed, because resolving above ~ would need the real home path.

Test plan

• pnpm test: 477 pass. Each closed bypass has a regression test, and the allowed everyday commands have tests too.
• pnpm typecheck, pnpm lint and pnpm build pass, and publint is clean.
• No false positives against DEFAULT_DENY for these common commands: source .venv/bin/activate, xargs wc -l, python -c "print(1)", ssh host uptime, git rebase -i, trap "rm -f $tmp" EXIT, alias ll='ls -la'.