# pi-guardrails: v0.18.0

release · 2026-09-18 · #pi-guardrails · v0.18.0

### Minor Changes

- 92efa3d: Upgrade `@aliou/sh` to 0.3.1 and adapt the AST walker to its compound-redirect model.

  **Fixed**

  - **Heredoc command evasion** (permission gate): a dangerous command placed after a heredoc body (`cat <<EOF\n…\nEOF\nrm -rf …`) was folded into the heredoc command's words by `@aliou/sh` 0.2.x, so the structural matcher never saw it. 0.3.1 emits it as its own `SimpleCommand`, and the gate now matches it.
  - **Compound-redirect extraction** (path access, guardrails targets): `@aliou/sh` 0.3.x attaches trailing redirects (`{ …; } > out`, `( … ) > out`, `while … done < in`, `if … fi > out`) to the compound node instead of an anonymous `SimpleCommand`. `walkCommands` now reports those redirects via an optional second callback argument, and both path extractors consume them — without this, upgrading would have silently stopped protecting compound-command redirect targets.
  - **Fd-duplication noise**: `2>&1`, `3<&0`, `>&-` and friends target file descriptors, not files. New `isFdDuplicationRedirect` helper skips them during path extraction, so `echo hi 2>&1` no longer produces a bogus `./1` candidate. `&>`/`&>>` still resolve to a real file and are kept.

  **Compatibility**

  - `walkCommands` now passes `undefined` as the command for compound-redirect callbacks, so existing single-argument callbacks need a `cmd` guard before reading `cmd.words`.

### Patch Changes

- 31b466c: Bump `@aliou/sh` from 0.2.2 to 0.3.2. Picks up parser fixes for redirects on compound commands and named fd redirects; keeps the Node.js >=22 engine requirement.

- [GitHub release](https://github.com/aliou/pi-guardrails/releases/tag/v0.18.0)
- [npm](https://www.npmjs.com/package/@aliou/pi-guardrails/v/0.18.0)