## Dicklesworthstone/destructive_command_guard — v0.15.1…v0.15.2

_15 commits._

### Fixes
- **fix(bridges): the OpenCode plugin and the Oh My Pi bridge block when dcg gives no verdict (review of 18be8e9)** (8fa6aeb)
- **fix(confidence): score a match only where its span addresses the command; other spans keep the deny (review of 18be8e9)** (42414a6)
- **fix(hook): fail closed when analysis is cut short under load, panics, or skips binary input** (18be8e9)
- **fix(heredoc): walk the parse tree without recursion; a deep list before a heredoc aborted the hook (review of 6976885)** (929cce8)
- **fix(heredoc): an unquoted body is contained only when its owner passes it through (review of 6976885)** (7c9a032)
- **fix(heredoc): mask an unquoted data body only when its output stays put; judge a body whose output may run (review of 6158ee7)** (6976885)
- **fix(tests): bound the project-allowlist path tests to their temp tree; fmt, clippy and a hook-stdin race (review of f1c32fe)** (d4b0e44)
- **fix(evaluator): preserve decoded destructive keywords when unrelated raw keywords exist** (f1c32fe)
- **fix(evaluator): a trap behind builtin/command, a group, a subshell or a function body still ran unjudged (review of e15a560, bd-v9hh)** (03c5121)
- **fix(evaluator): brace lists that make the command, and trap/PROMPT_COMMAND/PS*/BASH_ENV commands, ran unjudged (bd-2bm3, bd-v9hh)** (e15a560)
- **fix(heredoc): unquoted data heredocs judged as live commands; eighth-review spellings that still hid a command** (6158ee7)

### Backend
- **release: dcg v0.15.2** (b6d2bd6)
- **Merge remote-tracking branch 'origin/main'** (a9a9cb7)

### Docs
- **docs(heredoc): the expansion-aware mask's doc now states the output condition (review of 6158ee7)** (3ab9886)

### Chore
- **chore(beads): close bd-2bm3 and bd-v9hh (fixed in e15a560)** (e342567)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/Dicklesworthstone/destructive_command_guard?utm_source=github-action)._