Detect Command Obfuscation and Parser-Mismatch Attacks

PROJECT CONTEXT:
My agent's command checks parse a command one way, but bash executes it another - quote tricks and expansions smuggle flags and operators straight past validation. Claude Code dedicates its most complex validators to exactly this gap, using multi-view quote extraction and layered pattern checks.

GOAL:
Build obfuscation defenses: multi-view quote extraction, detection for quote-trick flag smuggling, and checks for parser-vs-shell divergence (brace expansion, escaped operators).

REQUIREMENTS:
- Quote extraction producing at least three views: double-quotes kept, fully unquoted, quote characters preserved
- Detection of flag-smuggling tricks: ANSI-C quoting, empty-quote concatenation, quote chains, triple quotes
- Detection of parser-mismatch primitives: brace expansion and backslash-escaped operators
- A quote-state tracker handling the escape-before-toggle ordering correctly
- A regression corpus of obfuscation variants that grows with every new discovery

CONSTRAINTS:
- When a pattern is ambiguous, ask - a rare extra confirmation beats a missed attack
- Detect on the ORIGINAL command string as well as parsed forms; normalization destroys evidence

DEFINITION OF DONE:
- Each documented obfuscation family has a firing detector with tests
- A command that bash would split differently than the parser triggers a misparse-severity ask
- The quote-state tracker passes escape-sequence edge cases (escaped quote inside double quotes)
- New variants can be added to the corpus and covered without rewriting existing detectors

COMMON FAILURES TO AVOID:
- Checking only the parsed token list, which is precisely what the attack bypasses
- One clever regex expected to catch all quoting tricks - each family needs its own detector
- A quote tracker that toggles state on escaped quotes, desyncing permanently mid-command
- Treating the checks as done - obfuscation is an arms race, and the corpus is the memory