fix: the guard classifies an arithmetic shift correctly, not as a heredoc (iss-184) - #199

Fixes iss-184 (critical), one of four bugs surfaced by this round's multi-angle bug-hunt sweep and independently verified with failing tests. The other three (iss-185, iss-186, iss-187) are captured to the ledger but not fixed here.

The bug

internal/core/guard/tokenize.go's << handling already special-cased the literal-digit arithmetic-shift form ($((1<<20)) is not a heredoc — isDelimStart rejects a delimiter word starting with a digit). But isDelimStart accepts any identifier-shaped word, so $((1<<shift)) — an identifier operand — still read as a heredoc delimiter. skipHeredocBodies (tokenize.go:264) then scanned for a line equal to the bogus delimiter and, whether or not one existed, consumed every line up to it as unchecked body text — dropping a later dangerous command (git push --force, rm -rf, etc.) from ever reaching command position. Registry.Check returned VerdictAllow with no error and no signal: a silent guard bypass, reachable through both CLI front doors (guard check and guard hook).

How it was reproduced and verified

An independent fresh subagent, blind to the finder, wrote a failing test and confirmed it failed on main for the claimed reason (not a compile error or unrelated failure):

$ printf '{"tool_name":"Bash","tool_input":{"command":"shift=8\necho $((1<<shift))\ngit push --force origin main"}}' | abcd guard hook
exit 0, no stderr   ← the force-push runs UNGUARDED

What changed and why

Two commits, because the first pass under-fixed it and a pre-PR adversarial security review (mandatory here — this touches the guard trust boundary) caught it:

1. First pass made skipHeredocBodies report whether it actually found each pending heredoc's terminator, turning a miss into ErrUnparsableCommand (the guard's existing fail-open-loud contract). This closed the case where no matching line exists — but the security review constructed the exploit it missed: an attacker who appends a line that happens to equal the misread "delimiter" (e.g. a bare shift, a harmless no-op) still gets a match, so the swallow still succeeds silently. The independent correctness review, reviewing the same commit separately, converged on the identical finding.
2. Second pass (the actual fix): a real heredoc delimiter word is never immediately followed by a bare ( or ) with no separator — its body and terminator line have to come first. $((expr<<ident)) always produces exactly that shape (readHeredocDelim stops at the arithmetic expression's own closing paren), so << in that position is now classified correctly at tokenize time, the same way the literal-digit case already was. The rest of the command is read and matched normally, regardless of what any later line contains. The first pass's unterminated-body-to-error path is kept as defense in depth for a distinct, narrower gap: a genuinely malformed heredoc (cat <<EOF with no closing EOF line) previously also silently swallowed the rest of the input with no signal at all.

Evidence

• internal/core/guard/tokenize.go:156-181 — the << classification, before and after.
• internal/core/guard/tokenize.go:264-296 — skipHeredocBodies's terminator-found signal.
• internal/core/guard/tokenize_test.go — TestArithmeticShiftByIdentifierIsNotAHeredoc, TestArithmeticShiftCoincidentalDelimiterStillBlocks (the exact adversarial payload from the security review), TestTokenizeRejectsUnterminatedHeredoc — each watched failing against the pre-fix code for the claimed reason, and passing after.
• internal/surface/cli/guard.go:80-124 — confirms ErrUnparsableCommand surfaces visibly through both guard check (exit 2, printed message) and guard hook (failOpen, exit 1, NOT CHECKED … runs UNGUARDED on stderr) rather than being swallowed.

Ledger

• iss-184 resolved (impact: fix) via abcd capture resolve.
• iss-185 (critical), iss-186 (minor), iss-187 (minor) captured as open, unfixed — left for a future round, highest severity first.
• .abcd/work/DECISIONS.md gains one dated round-summary line; CHANGELOG.md gains a ### Fixed entry under [Unreleased].

Gates

make preflight exit 0 (build, vet, go test ./..., go test -race ./internal/...); gofmt -l . clean; go run ./cmd/record-lint exit 0, 0 blockers (pre-existing WARNs only, baseline unchanged). Pre-PR reviews: one adversarial correctness review and one adversarial security review (required — this PR touches the guard trust boundary), each in its own fresh subagent. Both independently found the first pass's gap; both findings are fixed in the second commit, with regression tests reproducing the exact adversarial payload the security review demonstrated.