fix(gate): classify the scripts an agent runs, not just the command line (v0.448.7)

[vikasprogrammer]

Problem

On globex, billing-ops wrote a Stripe teardown (card detach, subscription cancel, customer delete) into fsNNNN-execute-stripe-teardown.sh and ran CONFIRM=EXECUTE bash <file>. The gate classifies the command line only, saw bash <file>, and allowed it green. Two live customer accounts were changed with no human approval. The same php sdel.php … typed directly would have matched the tenant's guardrail.

Fix

• New src/governance/script-bodies.ts finds the script operands a shell call executes (bash x.sh, ./x.sh, php x.php, python3 x.py, source x, bash -c "…", tracking cd). It reads them server-side, bounded, and follows nested scripts.
• enrichArgs takes those bodies. It checks them against the workspace's custom patterns (line by line) and the unambiguous destructive ops (DROP/TRUNCATE TABLE, mkfs, dd, terraform destroy, kubectl delete, force-push). The audit row gets scriptsInspected.
• Wired into TerminalManager.gate and policyCheck, so the preview matches the gate.

Scoping, measured on a week of real globex traffic (39.5k shell calls)

version	decision flips
all built-in facts, all scripts	1,754 (every tool's rm -rf "$tmp", generic "delete/prod" words)
narrowed facts	16 (stable tools' help text, e.g. freescout-manager.php … reply denied FreeScout reads)
+ only scripts changed in this run / last 24h	5 (tenant patterns on fresh test files)

Performance: an unanchored (?=[\s\S]*…) operator pattern over a 30 KB blob cost ~0.6 s of blocked event loop per call. Script bodies are now pattern-matched line by line, so the same case takes 4 ms. A perf check in the test pins this.

Limits (documented in the module)

This is text matching, not a sandbox. download-and-run, base64 and eval still hide intent. The hard stop for money is a read-only credential. For the incident tenant, that change is pending in Stripe.

Test

scripts/script-body-gate-test.cjs (added to test:governance): parser, bounded/fresh reading, enricher facts, noise regressions, a perf guard, and end to end through TerminalManager.gate. The full test:governance suite and the web build pass.

🤖 Generated with Claude Code