samagotchi 0.121.1 → 0.123.0

data/lib/samagotchi/guardrails/approval.rb

@@ -14,6 +14,16 @@ module Samagotchi
     module Approval
       KIND = "approval"
       HEADER = "Approve tool call?"
+      # A participant's turn's ask (author:): who asks, in the header and as
+      # the question's last line, so a UI that doesn't know the field still
+      # says it.
+      PARTICIPANT_HEADER = "%s's turn asks: approve tool call?"
+      # Who asks, in the plain question (indented) and as the card's line
+      # (approval asked_by:): the one wording every UI shows.
+      ASKED_BY = "asked by: %s's turn (a participant, not you); Allow once only"
+      # The only scope a participant's ask offers: no session, repo or rule
+      # approval is made from a participant's call.
+      PARTICIPANT_SCOPES = %w[once].freeze
       DENY = "Deny"
       ONCE = "Allow once"
 
@@ -28,16 +38,24 @@ module Samagotchi
       #   write: the card shows its diff, the question text one change line
       # @param only [Array<String>, nil] offer no scope beyond these (a
       #   scratch session: once, session); "once" when none is left
+      # @param author [String, nil] a participant's author ("p:<id>") when
+      #   their turn asks: it offers once only (PARTICIPANT_SCOPES), and the
+      #   card names them (approval author:, author_name:, the header)
+      # @param author_name [String, nil] their name (participants.json)
       # @return [Hash] open_question fields; its caller adds user_only:
       #   (ParentApprovals.protected_facts? on approval:, a file that
       #   requires this one)
-      def payload(verdict, label: nil, preview: nil, only: nil)
+      def payload(verdict, label: nil, preview: nil, only: nil, author: nil, author_name: nil)
+        asker = asker(author, author_name)
+        only = PARTICIPANT_SCOPES if asker
         scopes = offered_scopes(verdict, only: only)
         targets = verdict.targets
+        question = question_text(verdict, label: label, preview: preview)
+        question = "#{question}\n  #{format(ASKED_BY, asker)}" if asker
         {
-          question: question_text(verdict, label: label, preview: preview),
+          question: question,
           options: scopes.map { |scope| label(scope, verdict) } + [DENY],
-          header: HEADER,
+          header: asker ? format(PARTICIPANT_HEADER, asker) : HEADER,
           multi_select: false,
           allow_freeform: true,
           effects: effects(scopes),
@@ -63,11 +81,31 @@ module Samagotchi
             source: verdict.source,
             reason: verdict.reason,
             scopes: scopes,
-            preview: preview
+            preview: preview,
+            # A participant's turn asks (nil for the owner's).
+            author: (author.to_s if asker),
+            author_name: (author_name_for(author_name) if asker),
+            asked_by: (format(ASKED_BY, asker) if asker)
           }.compact
         }
       end
 
+      # How a participant's ask names them: their cleaned name, else their
+      # id; nil for the owner's turns.
+      def asker(author, author_name)
+        require_relative "../steer"
+        return nil unless Steer.participant_author?(author)
+
+        name = author_name_for(author_name)
+        name || Steer.participant_id(author.to_s)
+      end
+
+      def author_name_for(author_name)
+        require_relative "../participant_name"
+        name = ParticipantName.clean(author_name)
+        name.empty? ? nil : name
+      end
+
       # Each option's effect for a parent's answer (ParentPolicy): once
       # permits one call, a wider scope more, Deny denies.
       def effects(scopes)

data/lib/samagotchi/guardrails/gate.rb

@@ -85,7 +85,7 @@ module Samagotchi
       # answer that allows it beyond this once is stored.
       def settle_ask(verdict)
         approvals = @approvals_lookup.call
-        if (entry = stored(approvals, verdict))
+        if !verdict.fresh_ask? && (entry = stored(approvals, verdict))
           verdict.settle!(:allow, decided_by: "approval")
           verdict.scope = entry["scope"]
           return verdict

data/lib/samagotchi/guardrails/pair_boundary.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+require_relative "review_paths"
+require_relative "shell_paths"
+require_relative "shell_lex"
+require_relative "pair_command"
+require_relative "parent_approvals"
+require_relative "../steer"
+
+module Samagotchi
+  module Guardrails
+    # A participant's pair turn (ParticipantMode :pair, a working session):
+    # it acts with the session's tools under the owner's guardrails, and
+    # their asks go to the owner (GuardrailWiring#request_approval). This
+    # check sits in ReviewBoundary's seat (GuardrailWiring#checks), on in
+    # every guardrails mode and with guardrails.enabled: false, active only
+    # while the running turn's author is a participant. An accident guard
+    # for a trusted team, not containment. It denies, never asks (the
+    # owner's approval would let the participant's text reach what only the
+    # owner should), on:
+    #   - secrets: ReviewPaths' denylist (chi's state and config dirs, the
+    #     web token, grants and every participants.json among them; home
+    #     secret dirs and files: keys, shell startup files, histories,
+    #     credential files; project secret files) on every file tool's path,
+    #     read or written (read, write, edit, a plugin's targets: paths), and
+    #     on what a command does (execute, and any call whose targets carry
+    #     a command: PairCommand, which also refuses chi, background jobs,
+    #     the environment, git settings that run commands and home sweeps);
+    #   - owner-voiced tools (OWNER_VOICED, and any delegate_* tool): what
+    #     speaks or acts in the owner's name beyond this turn (a delegate, a
+    #     reminder, a note to another session, a background task, a
+    #     forgotten output, the session's loaded tools); and memory_write:
+    #     a memory reaches the owner's later sessions;
+    #   - ask_user_question: there is no one on the participant's side to
+    #     answer it here; the model asks in its reply instead.
+    # And it asks the owner, always (Verdict#fresh_ask: no stored approval
+    # answers it, and the rules can't lower it), before a write, an edit or a
+    # command that writes outside the session's project root (the tmp dirs
+    # aside).
+    # Everything else goes on to the owner's checks and rules as for the
+    # owner's turns.
+    class PairBoundary
+      RULE = "pair-boundary"
+      SOURCE = "core"
+      OWNER_VOICED = %w[delegate register_reminder cancel_reminder send_note forget_outputs task_create task_stop
+                        find_tools].freeze
+      OWNER_VOICED_PREFIX = "delegate_"
+      ASK_TOOL = "ask_user_question"
+      WRITE_TOOLS = %w[write edit].freeze
+
+      ADVICE = "This is a participant's turn: work with this session's other tools, and say in your reply what " \
+               "only the owner can do."
+      SECRET = "a participant's turn can't read or write secrets or chi's own files"
+      OWNER_ONLY = "a participant's turn can't use %s: it acts in the owner's name beyond this turn"
+      MEMORY_WRITE = "a participant's turn writes no memories: they reach the owner's later sessions; say in your " \
+                     "reply what to remember"
+      ASK = "a participant's turn can't ask the user: ask in your reply"
+      OUTSIDE_WRITE = "a participant's turn writes outside the session's project"
+      CHI = "a participant's turn can't run chi: its commands act in the owner's name (sessions, shares, answers)"
+      BACKGROUND = "a participant's turn can't leave a command running in the background: it would outlive the turn"
+      ENVIRONMENT = "a participant's turn can't read the environment or the keychain: they hold the owner's secrets"
+      HOME_SWEEP = "a participant's turn can't search or copy a folder that holds secrets or chi's own files"
+      GIT_CONFIG = "a participant's turn can't change git's global config or set what makes git run a command " \
+                   "(core.hooksPath, core.fsmonitor, core.sshCommand, core.pager, core.editor, ! aliases)"
+      UNREADABLE = "a participant's turn runs only commands chi can read: split this command, or write the file " \
+                   "with the write tool"
+      # A pair turn's execute runs without the environment variables whose
+      # names say they hold a secret (Tools::Builtins, PairBoundary.scrubbed_env).
+      SECRET_ENV_NAME = /KEY|TOKEN|SECRET|PASS|CREDENTIAL|AUTH/i
+
+      # The unsets a pair turn's execute adds to its environment: every
+      # variable of +env+ whose name SECRET_ENV_NAME matches.
+      # @return [Hash{String => nil}]
+      def self.scrubbed_env(env = ENV) = env.keys.grep(SECRET_ENV_NAME).to_h { |name| [name, nil] }
+
+      # What a command word that can't be resolved to a path is matched
+      # with: chi's own dirs (ParentApprovals::CHI_TEXT, the state dir,
+      # the web's grants and token), the home secret dirs, and the secret
+      # file names ReviewPaths::SECRET_FILE has.
+      SECRET_TEXT = Regexp.union(
+        ParentApprovals::CHI_TEXT,
+        %r{\.local/state/samagotchi|web-grants|grants\.json|web-token},
+        %r{(?:\A|[\s/'"=])\.(?:ssh|gnupg|aws|kube|docker)(?![\w.-])},
+        %r{(?:\A|[\s/'"=])(?:\.env(?:\.[\w.-]*)?|[._]netrc|\.npmrc|\.pypirc|\.git-credentials)(?![\w-])},
+        /\bid_(?:rsa|dsa|ecdsa|ed25519)\b|credentials|\.(?:pem|p12|pfx|tfstate)\b/
+      )
+
+      # @param author [#call] → String, nil: the running turn's author
+      #   (GuardrailWiring#turn_author); the check is off unless it is a
+      #   participant's (Steer.participant_author?)
+      # @param denied_dirs [#call] → Array<String>: chi's own dirs
+      # @param home [#call] → String, nil
+      # @param root [#call] → String, nil: the session's project root (the
+      #   work tree top of its folder); a write outside it asks the owner
+      #   (none: every write asks)
+      # @param tmp_roots [#call] → Array<String>: where a write neither asks
+      #   nor is denied (PairCommand.tmp_roots)
+      def initialize(author:, root: -> {}, denied_dirs: -> { ReviewPaths.chi_dirs }, home: -> { Dir.home },
+                     tmp_roots: -> { PairCommand.tmp_roots })
+        @author = author
+        @root = root
+        @tmp_roots = tmp_roots
+        @denied_dirs = denied_dirs
+        @home = home
+      end
+
+      # Vote on +verdict+ (its call and targets).
+      def check(verdict)
+        return verdict unless Steer.participant_author?(@author.call)
+
+        if (reason = refusal(verdict))
+          return verdict.deny!(reason, rule: RULE, source: SOURCE, decided_by: "core", advice: ADVICE)
+        end
+
+        if outside_write?(verdict)
+          verdict.ask!(OUTSIDE_WRITE, scopes: %w[once], rule: RULE, source: SOURCE, decided_by: "core")
+          verdict.fresh_ask = true
+        end
+        verdict
+      end
+
+      private
+
+      def refusal(verdict)
+        call = verdict.call || {}
+        tool = call[:name].to_s
+        return ASK if tool == ASK_TOOL
+        return format(OWNER_ONLY, tool) if OWNER_VOICED.include?(tool) || tool.start_with?(OWNER_VOICED_PREFIX)
+        return MEMORY_WRITE if tool == "memory_write"
+
+        targets = verdict.targets
+        return nil unless targets
+
+        paths = denylist
+        return SECRET if paths.secret_refusal(targets.paths.compact)
+        return command(targets, paths).refusal if targets.command
+
+        nil
+      end
+
+      # A write or edit whose path is outside the project root (as given or
+      # as it resolves), or a command that writes there (PairCommand); the
+      # tmp dirs aside.
+      def outside_write?(verdict)
+        targets = verdict.targets
+        return false unless targets
+        return command(targets, nil).outside_writes? if targets.command
+        return false unless WRITE_TOOLS.include?(verdict.call&.dig(:name).to_s)
+
+        paths = targets.paths.to_a.compact
+        root = @root.call.to_s
+        paths.any? do |path|
+          real = ProtectedPaths.real(path)
+          next false if @tmp_roots.call.any? { |tmp| ShellPaths.within?(real, tmp) }
+
+          root.empty? || !ShellPaths.within?(real, ProtectedPaths.real(root))
+        end
+      end
+
+      def command(targets, paths)
+        @command = nil unless @command&.first == targets
+        @command ||= [targets, PairCommand.new(targets.command, cwd: targets.cwd, home: home, root: @root.call,
+                                                                paths: paths || denylist, tmp_roots: @tmp_roots.call)]
+        @command.last
+      end
+
+      def denylist = ReviewPaths.new(root: nil, denied_dirs: @denied_dirs.call, home: @home.call)
+
+      def home = @home.call.to_s
+    end
+  end
+end

data/lib/samagotchi/guardrails/pair_command.rb

@@ -0,0 +1,365 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require_relative "review_paths"
+require_relative "shell_paths"
+require_relative "shell_lex"
+
+module Samagotchi
+  module Guardrails
+    # One shell command of a participant's pair turn, read the way
+    # PairBoundary needs it (the refusal words are PairBoundary's):
+    # - #refusal: why it may not run, nil when it may: chi, something left
+    #   running, the environment or the keychain, git settings that run
+    #   commands, a folder sweep, a secret (a path a word resolves to, a glob
+    #   or a $var whose fixed part leads into one, SECRET_TEXT for the
+    #   rest); a script it hands a shell (sh -c, eval, a heredoc) is read as
+    #   a command of its own, one it hands another interpreter (ruby -e,
+    #   python <<EOF) by its text. A command it can't read is refused
+    #   (UNREADABLE), never let through on a text match;
+    # - #outside_writes?: whether it writes outside the project (a
+    #   redirection's target, tee's files, cp/mv/ln/install/rsync/ditto's
+    #   destination), the tmp dirs and /dev/null aside; a target it can't
+    #   resolve counts as outside.
+    # A data heredoc (cat, tee, git commit -F - read it: ShellLex::HEREDOC)
+    # is not looked into: it's text being written, not run.
+    class PairCommand
+      # What runs a command on another's behalf, and the shell's keywords
+      # before a command: skipped to find the program.
+      WRAPPERS = %w[env exec command nohup time sudo nice xargs setsid timeout stdbuf caffeinate bundle ruby watch npx
+                    { ! then do else elif if while until].freeze
+      # chi's own invocations a pair turn may run: they print and exit.
+      CHI_ALLOWED = [%w[--version], %w[--help]].freeze
+      # chi named in a script, a value or an argument.
+      CHI_TEXT = %r{(?:\A|[\s;&|(`'"=])(?:[^\s;&|(`'"=]*/)?chi(?=\s|\z|[;&|)`'"])}
+      SHELLS = %w[sh bash zsh dash fish ksh].freeze
+      # Other interpreters a script can be handed to (-e/-c, a heredoc).
+      INTERPRETERS = %w[python python3 python2 ruby irb node deno bun perl php lua osascript jshell].freeze
+      # Options whose next word is code or a command, for any program.
+      CODE_OPTIONS = %w[-c -e -exec --exec -execdir --command --eval -x].freeze
+      # Programs that detach what they start.
+      DETACHERS = %w[nohup setsid disown daemonize].freeze
+      # Programs that print the environment or a keychain's secrets, whatever
+      # their arguments.
+      ENV_READERS = %w[printenv security].freeze
+      ENV_TEXT = %r{/proc/[^\s]*/environ}
+      # An interpreter's script that reads the environment or detaches.
+      SCRIPT_ENV_TEXT = /\bos\.environ\b|\bgetenv\b|\bprocess\.env\b|\bENV\b|\bprintenv\b|%ENV\b/
+      SCRIPT_BACKGROUND_TEXT = /\b(?:nohup|setsid|disown|daemonize|Process\.daemon|detach(?:ed)?)\b/
+      # Programs that read a folder's whole tree: given home (or any folder
+      # above a denied one) they reach the secrets in it.
+      SWEEPERS = %w[find tar cp rsync scp zip 7z cpio grep egrep fgrep rg ag ack fd ditto].freeze
+      # git settings that make git run a command (or show one), and git
+      # config's scopes beyond the repository.
+      GIT_RUNNING_KEYS = %w[core.fsmonitor core.sshcommand core.hookspath core.pager core.editor].freeze
+      GIT_WIDE_SCOPES = %w[--global --system].freeze
+      GIT_VALUE_OPTIONS = %w[-C --git-dir --work-tree --namespace --exec-path].freeze
+      # Writers whose last argument (or -t DIR) is the destination.
+      COPIERS = %w[cp mv ln install rsync ditto].freeze
+      REDIRECTS = %w[> >> &> &>> 1> 1>> 2> 2>>].freeze
+      REDIRECT_WORD = /\A\d*(?:&>>?|>>?)(?!&)(.+)\z/
+      DEVICES = %w[/dev/null /dev/stdout /dev/stderr /dev/tty].freeze
+      GLOB = /[*?\[\]{}]/
+      # How many matches of a glob are checked against the denylist.
+      GLOB_LIMIT = 500
+      # How deep scripts handed to a shell are read; deeper is UNREADABLE.
+      MAX_DEPTH = 3
+
+      # The tmp dirs a pair turn writes into freely (neither asked nor
+      # denied): Dir.tmpdir, $TMPDIR, /tmp, /private/tmp.
+      def self.tmp_roots
+        [Dir.tmpdir, ENV.fetch("TMPDIR", nil), "/tmp", "/private/tmp"].compact.reject(&:empty?)
+                                                                      .map { |dir| ProtectedPaths.real(dir) }.uniq
+      end
+
+      # @param paths [ReviewPaths] the denylist
+      # @param root [String, nil] the project root (outside writes)
+      def initialize(text, cwd:, paths:, home:, root: nil, depth: 0, tmp_roots: nil)
+        @tmp_roots = tmp_roots
+        @text = text.to_s
+        @cwd = cwd
+        @paths = paths
+        @home = home.to_s
+        @root = root.to_s
+        @depth = depth
+      end
+
+      # @return [String, nil] a PairBoundary refusal
+      def refusal
+        return @refusal if defined?(@refusal)
+
+        @refusal = read
+      rescue StandardError
+        @refusal = PairBoundary::UNREADABLE
+      end
+
+      # Whether it writes outside the project (asked about, never denied).
+      def outside_writes?
+        refusal
+        @targets.to_a.any? { |path| outside?(path) }
+      end
+
+      private
+
+      def read
+        return PairBoundary::UNREADABLE if @depth > MAX_DEPTH
+
+        tokens = ShellLex.lex(@text)
+        code = ShellLex.code_text(@text, keep_written: false)
+        subst = tokens.any? { |_, value| value.include?(ShellLex::SUBST) }
+        return PairBoundary::CHI if subst && code.match?(CHI_TEXT)
+        return PairBoundary::BACKGROUND if tokens.any? { |type, value| type == :op && value == "&" }
+        return PairBoundary::ENVIRONMENT if code.match?(ENV_TEXT)
+        return PairBoundary::SECRET if subst && code.match?(PairBoundary::SECRET_TEXT)
+
+        @targets = []
+        walk = ShellPaths::Walk.new(@cwd, @home, ENV)
+        ShellLex.simple_commands(tokens).each do |words|
+          next walk.step(words) if words.is_a?(Symbol)
+
+          @targets.concat(write_targets(words, walk))
+          reason = words_refusal(words) || scripts_refusal(words) || paths_refusal(words, walk.step(words))
+          return reason if reason
+        end
+        nil
+      end
+
+      # A simple command's own refusal, by its program and arguments.
+      def words_refusal(words)
+        at = program_at(words)
+        program = at && File.basename(words[at])
+        args = at ? words[(at + 1)..] : []
+        return PairBoundary::CHI if program == "chi" && !CHI_ALLOWED.include?(args)
+        return PairBoundary::CHI if chi_in_values?(words)
+
+        upto = at ? words[0..at] : words
+        return PairBoundary::BACKGROUND if upto.any? { |w| DETACHERS.include?(File.basename(w)) } || detached_session?(program, args)
+        return PairBoundary::ENVIRONMENT if env_reader?(program, args) || bare_env?(words)
+        return PairBoundary::GIT_CONFIG if program == "git" && git_runs_commands?(args)
+
+        nil
+      end
+
+      # chi in an assignment's value (FOO=chi, alias x='chi …') or in the
+      # word after an option that takes code or a command (-exec, -c, -e).
+      def chi_in_values?(words)
+        words.each_with_index.any? do |word, i|
+          value = word[/\A[A-Za-z_][\w-]*=(.*)\z/m, 1]
+          (value && value.match?(CHI_TEXT)) || (i.positive? && CODE_OPTIONS.include?(words[i - 1]) && word.match?(CHI_TEXT))
+        end
+      end
+
+      # The scripts the command hands on: a shell's (-c, eval, a heredoc or
+      # here-string) read as a command; an interpreter's (-e/-c, a heredoc)
+      # by its text.
+      def scripts_refusal(words)
+        limit = program_at(words) || (words.size - 1)
+        at = (0..limit).find { |i| runner?(words[i]) } or return nil
+        program = File.basename(words[at])
+        scripts(words, at).each do |script|
+          reason = if SHELLS.include?(program) || program == "eval"
+                     PairCommand.new(script, cwd: @cwd, paths: @paths, home: @home, root: @root, depth: @depth + 1,
+                                             tmp_roots: @tmp_roots).refusal
+                   elsif INTERPRETERS.include?(program)
+                     script_text_refusal(script)
+                   end
+          return reason if reason
+        end
+        nil
+      end
+
+      def runner?(word)
+        name = File.basename(word)
+        SHELLS.include?(name) || INTERPRETERS.include?(name) || name == "eval"
+      end
+
+      def scripts(words, at)
+        found = []
+        found << words[(at + 1)..].join(" ") if File.basename(words[at]) == "eval"
+        words.each_with_index do |word, i|
+          next if i.zero? || word == ShellLex::HEREDOC
+
+          previous = words[i - 1]
+          found << word if previous.start_with?("<<") || (i > at && %w[-c -e].include?(previous))
+        end
+        found
+      end
+
+      def script_text_refusal(script)
+        return PairBoundary::CHI if script.match?(CHI_TEXT)
+        return PairBoundary::SECRET if script.match?(PairBoundary::SECRET_TEXT)
+        return PairBoundary::ENVIRONMENT if script.match?(SCRIPT_ENV_TEXT) || script.match?(ENV_TEXT)
+        return PairBoundary::BACKGROUND if script.match?(SCRIPT_BACKGROUND_TEXT)
+
+        nil
+      end
+
+      # Where the program is in +words+: past assignments, wrappers, shell
+      # keywords and their options (and an option's value: ruby -I lib,
+      # timeout 10).
+      def program_at(words)
+        at = 0
+        at += 1 while at < words.size && skipped?(words, at)
+        at < words.size ? at : nil
+      end
+
+      def skipped?(words, at)
+        word = words[at]
+        return true if word.match?(/\A[A-Za-z_]\w*=/) || word.start_with?("-") || word.match?(/\A\d+[smhd]?\z/)
+        return true if WRAPPERS.include?(File.basename(word))
+
+        previous = at.positive? ? words[at - 1] : nil
+        !previous.nil? && previous.match?(/\A-[IrCen]\z/)
+      end
+
+      # screen -d…, tmux new -d: a session left running.
+      def detached_session?(program, args)
+        (program == "screen" && args.any? { |arg| arg.match?(/\A-\w*d/) }) ||
+          (program == "tmux" && args.any? { |arg| arg.match?(/\Anew(-session)?\z/) } && args.include?("-d"))
+      end
+
+      # printenv, security; set, export, declare and typeset that list
+      # (no assignment); launchctl getenv/export; ps with a BSD e (ps e, eww).
+      def env_reader?(program, args)
+        return true if ENV_READERS.include?(program)
+
+        listing = args.none? { |arg| !arg.start_with?("-", "+") }
+        case program
+        when "set" then args.empty?
+        when "export", "declare", "typeset" then listing
+        when "launchctl" then %w[getenv export].include?(args.first)
+        when "ps" then args.any? { |arg| arg.match?(/\A[a-zA-Z]*e[a-zA-Z]*\z/) }
+        else false
+        end
+      end
+
+      # env with no command after it prints the environment.
+      def bare_env?(words)
+        assignment = ->(word) { word.start_with?("-") || word.match?(/\A[A-Za-z_]\w*=/) }
+        at = words.index { |word| !assignment.call(word) }
+        return false unless at && File.basename(words[at]) == "env"
+
+        words[(at + 1)..].all?(&assignment)
+      end
+
+      # git config beyond the repository (--global, --system), or a setting
+      # that runs a command (core.hooksPath, core.fsmonitor, core.sshCommand,
+      # core.pager, core.editor, a "!" alias), set with git config or git -c.
+      def git_runs_commands?(args)
+        i = 0
+        while i < args.size && args[i].start_with?("-")
+          if args[i] == "-c"
+            return true if running_setting?(*args[i + 1].to_s.split("=", 2))
+
+            i += 2
+          elsif GIT_VALUE_OPTIONS.include?(args[i])
+            i += 2
+          else
+            i += 1
+          end
+        end
+        return false unless args[i] == "config"
+
+        rest = args[(i + 1)..]
+        return true if rest.any? { |arg| GIT_WIDE_SCOPES.include?(arg) }
+
+        key, value = rest.reject { |arg| arg.start_with?("-") }
+        running_setting?(key, value)
+      end
+
+      def running_setting?(key, value)
+        key = key.to_s.downcase
+        GIT_RUNNING_KEYS.include?(key) || (key.start_with?("alias.") && value.to_s.lstrip.start_with?("!"))
+      end
+
+      # The secrets a simple command's words reach: a resolved path on the
+      # denylist; a glob that matches one or whose fixed part leads into a
+      # denied dir; a $var word whose fixed part does; a sweeper given a
+      # folder above a denied one; SECRET_TEXT for a word it can't read.
+      def paths_refusal(words, resolved)
+        program_word = (at = program_at(words)) && File.basename(words[at])
+        resolved.each do |word, path|
+          if path
+            return PairBoundary::SECRET if @paths.secret_refusal([path])
+            return PairBoundary::HOME_SWEEP if SWEEPERS.include?(program_word) && above_denied?(path)
+          elsif unresolved_secret?(word) || (!data?(word) && word.match?(PairBoundary::SECRET_TEXT))
+            return PairBoundary::SECRET
+          end
+        end
+        nil
+      end
+
+      def data?(word) = word == ShellLex::HEREDOC
+
+      # A word Walk can't resolve: a glob checked by what it matches and by
+      # its fixed part, a $var by its fixed part (the text before the first
+      # glob character or $, with ~ and $HOME expanded). A script body
+      # (spaces, quotes), a data heredoc or a $(…) is left to the other checks.
+      def unresolved_secret?(word)
+        return false if word.include?("\0") || word.match?(ShellPaths::SCRIPT)
+
+        expanded = word.sub(%r{\A~(?=/|\z)}, @home).sub(/\A\$(?:\{HOME\}|HOME\b)/, @home)
+        fixed = expanded[/\A[^*?\[\]{}$]*/]
+        dir = @cwd || Dir.pwd
+        if !expanded.include?("$") && expanded.match?(GLOB)
+          matches = Dir.glob(File.expand_path(expanded, dir)).first(GLOB_LIMIT)
+          return true unless @paths.secret_refusal(matches).nil?
+        end
+        return false if fixed.empty?
+
+        leads_into_denied?(File.expand_path(fixed, dir))
+      end
+
+      # Whether a path's text is the start of a denied root's (its parent,
+      # or part of its name: ~/.ss) or inside one.
+      def leads_into_denied?(prefix)
+        @paths.denied_roots.any? { |root| root.start_with?(prefix) || ShellPaths.within?(prefix, root) }
+      end
+
+      # Whether +path+ is a denied root's folder or one above it.
+      def above_denied?(path)
+        real = ProtectedPaths.real(path)
+        @paths.denied_roots.any? { |root| ShellPaths.within?(root, real) }
+      end
+
+      # The paths a simple command writes (nil for one it can't resolve), from
+      # the dir it runs in (before a cd in it takes effect).
+      def write_targets(words, walk)
+        targets = []
+        words.each_with_index do |word, i|
+          if REDIRECTS.include?(word) && words[i + 1]
+            targets << walk.path(words[i + 1])
+          elsif (target = word[REDIRECT_WORD, 1]) && !word.start_with?("<")
+            targets << walk.path(target)
+          end
+        end
+        at = program_at(words) or return targets
+        program = File.basename(words[at])
+        args = words[(at + 1)..].reject { |w| REDIRECTS.include?(w) || w.match?(REDIRECT_WORD) }
+        plain = args.reject { |arg| arg.start_with?("-") }
+        if program == "tee"
+          targets.concat(plain.map { |arg| walk.path(arg) })
+        elsif COPIERS.include?(program)
+          dir = args[args.index("-t") + 1] if args.include?("-t")
+          dir ||= args.find { |arg| arg.start_with?("--target-directory=") }&.split("=", 2)&.last
+          dir ||= plain.last if plain.size >= 2
+          targets << walk.path(dir) if dir
+        end
+        targets
+      end
+
+      def outside?(path)
+        return true if path.nil?
+        return false if DEVICES.include?(path)
+
+        real = ProtectedPaths.real(path)
+        return false if tmp_roots.any? { |tmp| ShellPaths.within?(real, tmp) }
+        return true if @root.empty?
+
+        !ShellPaths.within?(real, ProtectedPaths.real(@root))
+      end
+
+      def tmp_roots = @tmp_roots ||= PairCommand.tmp_roots
+    end
+  end
+end