samagotchi 0.127.0 → 0.129.0

data/lib/samagotchi/guardrails/read_only_shell.rb

@@ -2,6 +2,7 @@
 
 require "strscan"
 require_relative "shell_lex"
+require_relative "shell_paths"
 
 module Samagotchi
   module Guardrails
@@ -17,6 +18,17 @@ module Samagotchi
     # $HOME / the XDG dirs / $TMPDIR / $PWD at a word's start, a brace
     # expansion, a < or << redirection, a path to a verb (/bin/ls), and
     # less/more/vim (they run commands) are all not read-only.
+    #
+    # .read_only_but_writes? (the child boundary's) also lets through the
+    # writes it can name: a > or >> target, cp's destination and tee's
+    # files, each resolved against the dir the command is in by then
+    # (ShellPaths::Walk) and accepted by the caller's block. It trusts
+    # Walk's dir only where the shell's can't differ: a cd or pushd takes
+    # one existing dir, spelt /…, . or .. (no option, +N, -, $, ~ or
+    # CDPATH name), and joins beside it are && only (a failed or skipped
+    # cd can't be followed by a command that still runs); popd is never
+    # accepted, nor is a $ or ~ in a write's target (the call's env may
+    # set it).
     module ReadOnlyShell
       # Operators that join read-only commands (no &, no ;;).
       JOINS = ["&&", "||", ";", "|", "|&", "\n", "(", ")"].freeze
@@ -29,6 +41,49 @@ module Samagotchi
       # target follows).
       NULL_REDIRECT = %r{\A\d*>>?/dev/null\z}
       BARE_REDIRECT = /\A\d*>>?\z/
+      # A redirection with its target in the same word (>out, 2>>out); not
+      # >&file (it is &> spelt the other way).
+      REDIRECT_TO = /\A\d*>>?([^&>].*)\z/m
+      # Pipe operators: each side runs in a subshell.
+      PIPES = ["|", "|&"].freeze
+      # Verbs that change the dir ShellPaths::Walk follows.
+      DIR_VERBS = %w[cd pushd popd].freeze
+      # The joins a group (or the whole command) holding a cd or pushd may
+      # use in write mode: after any other a command can run in a dir the
+      # cd didn't reach (cd failed, or was skipped by ||).
+      DIR_JOINS = ["&&", "|", "|&"].freeze
+      # A dir verb's operand the shell resolves as Walk does: absolute, or
+      # ./ ../ (CDPATH is not searched for these).
+      DIR_OPERAND = %r{\A(?:/|\.\.?(?:/|\z))}
+
+      # The write side of .read_only_but_writes?: the Walk that follows the
+      # command's dir and the caller's test for an absolute path it writes.
+      Writes = Data.define(:walk, :writable) do
+        # +word+ as absolute paths against the current dir (ShellPaths::Walk:
+        # its lexical one, and its physical one when they differ, last); []
+        # when it can't be resolved, or has a $ or ~ (the shell may expand
+        # them from an env Walk doesn't see, as task_create's env: sets).
+        def paths(word) = word.include?("$") || word.start_with?("~") ? [] : walk.paths(word)
+
+        # Whether a cd or pushd with +args+ lands where Walk says: one
+        # operand (DIR_OPERAND) naming an existing dir every way it
+        # resolves. popd never does.
+        def dir_step?(verb, args)
+          return false unless verb != "popd" && args.size == 1 && args.first.match?(DIR_OPERAND)
+
+          dirs = paths(args.first)
+          !dirs.empty? && dirs.all? { |dir| File.directory?(dir) }
+        end
+
+        def ok?(path) = path ? writable.call(path) == true : false
+
+        # Whether +word+ names a file the command may write, every way it
+        # resolves.
+        def file?(word)
+          paths = paths(word)
+          !paths.empty? && paths.all? { |path| ok?(path) }
+        end
+      end
 
       # Verbs that only read whatever their options: → nil. The others
       # check their arguments.
@@ -49,29 +104,104 @@ module Samagotchi
         false
       end
 
+      # Whether the command only reads but for writes whose resolved paths
+      # the block accepts: > and >> targets, cp's destination (and the
+      # files it makes in it) and tee's files. Paths resolve against +cwd+
+      # and the dir an earlier cd, pushd or popd moved to; a cd beside a pipe
+      # (a subshell's) isn't one Walk can follow, so it is not.
+      # @param command [String, nil]
+      # @param cwd [String, nil] where the command starts
+      # @yieldparam path [String] an absolute path, symlinks not resolved
+      # @return [Boolean]
+      def read_only_but_writes?(command, cwd:, home: Dir.home, env: ENV, &writable)
+        text = command.to_s
+        return false if text.strip.empty?
+
+        tokens = ShellLex.lex(text)
+        commands = split(tokens, marks: true) or return false
+        return false if commands.none?(Array) || !dir_joins_ok?(tokens)
+
+        writes = Writes.new(walk: ShellPaths::Walk.new(cwd, home, env), writable: writable)
+        commands.all? { |words| words.is_a?(Symbol) ? writes.walk.step(words) : simple_read_only?(words, writes) }
+      rescue ArgumentError, EncodingError
+        false
+      end
+
       # The simple commands as [text, specials] word lists; nil when an
-      # operator isn't one read-only commands may be joined with.
-      def split(tokens)
+      # operator isn't one read-only commands may be joined with. With
+      # +marks+, ( and ) stay as :open / :close, and a cd, pushd or popd
+      # beside a pipe is nil.
+      def split(tokens, marks: false)
         commands = [[]]
+        piped = false
         tokens.each do |kind, value, specials|
           if kind == :op
             return nil unless JOINS.include?(value)
 
+            pipe = PIPES.include?(value)
+            return nil if marks && (piped || pipe) && dir_verb?(commands.last)
+
+            piped = pipe
+            commands << (value == "(" ? :open : :close) if marks && ["(", ")"].include?(value)
             commands << []
           else
             commands.last << [value, specials]
           end
         end
-        commands.reject(&:empty?)
+        return nil if marks && piped && dir_verb?(commands.last)
+
+        commands.reject { |words| words.is_a?(Array) && words.empty? }
+      end
+
+      def dir_verb?(words) = words.is_a?(Array) && DIR_VERBS.include?(verb_of(words))
+
+      # Whether each group holding a dir verb itself (the whole command,
+      # or a ( … ): nested ones are their own) joins with DIR_JOINS only.
+      def dir_joins_ok?(tokens)
+        scopes = [[false, false]] # [holds a dir verb, has another join]
+        words = []
+        tokens.each do |kind, value, specials|
+          next words << [value, specials] unless kind == :op
+
+          scopes.last[0] ||= dir_verb?(words)
+          words = []
+          case value
+          when "(" then scopes << [false, false]
+          when ")"
+            dir, other = scopes.pop
+            return false if scopes.empty? || (dir && other)
+          else scopes.last[1] ||= !DIR_JOINS.include?(value)
+          end
+        end
+        scopes.last[0] ||= dir_verb?(words)
+        scopes.none? { |dir, other| dir && other }
       end
 
-      def simple_read_only?(words)
+      # The first word that is no redirection or its target.
+      def verb_of(words)
+        target = false
+        words.each do |text, specials|
+          if target then target = false
+          elsif specials.include?(">") then target = text.match?(BARE_REDIRECT)
+          else return text
+          end
+        end
+        nil
+      end
+
+      # With +writes+ (.read_only_but_writes?) its redirections may write
+      # what it accepts, cp and tee count, and the walk takes the command.
+      def simple_read_only?(words, writes = nil)
         return false if words.any? { |text, specials| text.include?(ShellLex::SUBST) || !expansion_ok?(text, specials) }
 
-        args = strip_redirects(words) or return false
+        args = strip_redirects(words, writes) or return false
+        return false if writes && DIR_VERBS.include?(args.first) && !writes.dir_step?(args.first, args.drop(1))
+
+        writes&.walk&.step(args)
         verb = args.shift
         return false unless verb&.match?(/\A[a-z][\w.-]*\z/)
         return true if PLAIN.include?(verb)
+        return WRITE_CHECKS[verb].call(args, writes) if writes && WRITE_CHECKS[verb]
 
         check = CHECKS[verb] or return false
         check.call(args)
@@ -85,19 +215,20 @@ module Samagotchi
       end
 
       # The words with their redirections taken out; nil when one isn't an
-      # fd dup or to /dev/null.
-      def strip_redirects(words)
+      # fd dup, to /dev/null, or (with +writes+) to a file it accepts.
+      def strip_redirects(words, writes = nil)
         out = []
         pending = false
         words.each do |text, specials|
           if pending
-            return nil unless text == "/dev/null"
+            return nil unless text == "/dev/null" || (writes && specials.delete("$").empty? && writes.file?(text))
 
             pending = false
           elsif specials.include?("<")
             return nil
           elsif specials.include?(">")
             next if text.match?(FD_DUP) || text.match?(NULL_REDIRECT)
+            next if writes && (m = text.match(REDIRECT_TO)) && !m[1].match?(/[<>]/) && writes.file?(m[1])
             return nil unless text.match?(BARE_REDIRECT)
 
             pending = true
@@ -130,6 +261,53 @@ module Samagotchi
       # uniq IN OUT writes OUT.
       def uniq(args) = args.reject { |a| a.start_with?("-") }.size <= 1
 
+      SQLITE_OPTIONS = %w[-readonly -safe -json -csv -header -noheader -line -column -box -list -separator -bail
+                          -batch -noinit].freeze
+
+      # sqlite3 can still write or run programs unless both safety flags are
+      # present. Its options may follow the database name, so check every word.
+      def sqlite3(args)
+        options = []
+        positional = []
+        index = 0
+        while index < args.length
+          arg = args[index]
+          if arg == "-separator"
+            return false if index + 1 == args.length
+
+            index += 2
+          elsif SQLITE_OPTIONS.include?(arg)
+            options << arg
+            index += 1
+          elsif arg.start_with?("-", ".")
+            return false
+          else
+            positional << arg
+            index += 1
+          end
+        end
+
+        options.include?("-readonly") && options.include?("-safe") && positional.size >= 2
+      end
+
+      GH_READS = {
+        "run" => %w[list view],
+        "pr" => %w[list view diff checks],
+        "issue" => %w[list view],
+        "repo" => %w[view]
+      }.freeze
+
+      def gh(args)
+        # -w alone or in a bundle of short flags (-cw) opens a browser.
+        return false if args.any? { |arg| arg.match?(/\A-[a-zA-Z]*w/) || arg.start_with?("--web") }
+
+        group, action = args
+        return false unless GH_READS.fetch(group, []).include?(action)
+        return false if group == "pr" && action == "checks" && args.any? { |arg| arg.start_with?("--watch") }
+
+        true
+      end
+
       SED_FLAGS = /\A-[nErsuz]+\z/
       SED_LONG = %w[--quiet --silent --regexp-extended --separate --unbuffered --null-data --posix --debug
                     --sandbox].freeze
@@ -225,10 +403,62 @@ module Samagotchi
         names.zero? || options.any? { |a| GIT_BRANCH_LISTING.any? { |listing| a == listing || a.start_with?("#{listing}=") } }
       end
 
+      CP_SHORT = "afinpvrRPLHxT"
+      CP_LONG = %w[--archive --force --interactive --no-clobber --recursive --verbose --dereference
+                   --no-dereference --one-file-system --no-target-directory].freeze
+      CP_PRESERVE = /\A--(?:no-)?preserve(?:=[\w,]+)?\z/
+
+      # cp whose destination (the last argument, or -t / --target-directory)
+      # and the files it makes in it, when it is a dir, the caller accepts.
+      # Only options that copy: no -l/-s (links into the source), --parents
+      # or --backup; anything unknown is not.
+      def cp(args, writes)
+        target = nil
+        no_target = false
+        positional = []
+        rest = args.dup
+        until rest.empty?
+          arg = rest.shift
+          if !arg.start_with?("-") || arg == "-" then positional << arg
+          elsif arg == "--" then positional.concat(rest.shift(rest.size))
+          elsif (m = arg.match(/\A-([#{CP_SHORT}]*)t(.*)\z/m))
+            no_target ||= m[1].include?("T")
+            target = m[2].empty? ? rest.shift : m[2]
+            return false unless target
+          elsif arg == "--target-directory" then target = rest.shift or return false
+          elsif (m = arg.match(/\A--target-directory=(.+)\z/m)) then target = m[1]
+          elsif arg.match?(/\A-[#{CP_SHORT}]+\z/) then no_target ||= arg.include?("T")
+          elsif CP_LONG.include?(arg) || arg.match?(CP_PRESERVE) then no_target ||= arg == "--no-target-directory"
+          else return false
+          end
+        end
+        into = !target.nil?
+        target ||= positional.pop
+        return false if positional.empty? || (into && no_target)
+
+        dests = writes.paths(target)
+        return false if dests.empty?
+
+        into ||= !no_target && File.directory?(dests.last)
+        made = into ? dests.product(positional).map { |dest, src| File.join(dest, File.basename(src)) } : []
+        [*dests, *made].all? { |path| writes.ok?(path) }
+      end
+
+      TEE_OPTIONS = %w[-a --append -i --ignore-interrupts -p].freeze
+
+      # tee whose every file the caller accepts.
+      def tee(args, writes)
+        files = args.reject { |arg| TEE_OPTIONS.include?(arg) }
+        files.all? { |file| !file.start_with?("-") && writes.file?(file) }
+      end
+
+      # The verbs that write, for .read_only_but_writes? only: → (args, writes).
+      WRITE_CHECKS = { "cp" => method(:cp), "tee" => method(:tee) }.freeze
+
       CHECKS = {
         "rg" => method(:rg), "find" => method(:find), "tree" => method(:tree), "file" => method(:file),
         "sort" => method(:sort), "uniq" => method(:uniq), "sed" => method(:sed), "awk" => method(:awk),
-        "git" => method(:git)
+        "git" => method(:git), "sqlite3" => method(:sqlite3), "gh" => method(:gh)
       }.freeze
 
       # A sed script parsed far enough to tell that it only reads: its

data/lib/samagotchi/guardrails/review_paths.rb

@@ -10,9 +10,11 @@ module Samagotchi
     # under the session's project root that isn't on the read denylist
     # (chi's state and config dirs, home secret dirs, project secret files),
     # checked on the path as given and as it resolves (a symlink in the
-    # project to ~/.ssh is ~/.ssh). ReviewBoundary asks it for every read of
-    # a participant's turn; a review session's subjects (chi review, the
-    # participant page's Plan) go through the same check.
+    # project to ~/.ssh is ~/.ssh; a `..` after a symlinked dir climbs out
+    # of its target, as the kernel opens it: ProtectedPaths.reals).
+    # ReviewBoundary asks it for every read of a participant's turn; a
+    # review session's subjects (chi review, the participant page's Plan)
+    # go through the same check.
     class ReviewPaths
       # Home folders that hold keys and tokens, never read in a review turn
       # (nor read or written in a pair turn).
@@ -46,6 +48,17 @@ module Samagotchi
       # chi's state dir and config dir, as Paths has them now.
       def self.chi_dirs = [Paths.state_dir, File.join(Paths.config_home, Paths::APP_DIR)]
 
+      # Whether +root+ is the home folder or a folder above it (symlinks
+      # resolved on both): no project to keep a participant's turn in. A
+      # review turn reads nothing there (#refusal: HOME_ROOT); a pair turn
+      # asks the owner before every write (PairBoundary).
+      # @param root [String] @param home [String, nil]
+      def self.home_root?(root, home)
+        return false if home.to_s.empty? || root.to_s.empty?
+
+        ShellPaths.within?(ProtectedPaths.real(home.to_s), ProtectedPaths.real(root.to_s))
+      end
+
       # @param root [String, nil] the session's project root (the work tree
       #   top of its folder); nil or blank refuses every path
       # @param denied_dirs [Array<String>] chi's own dirs (state, config:
@@ -66,14 +79,15 @@ module Samagotchi
       def refusal(paths)
         return OUTSIDE if paths.empty? || @root.empty?
 
+        return HOME_ROOT if ReviewPaths.home_root?(@root, @home)
+
         real_root = ProtectedPaths.real(@root)
-        return HOME_ROOT if !@home.empty? && ShellPaths.within?(ProtectedPaths.real(@home), real_root)
 
         paths.each do |path|
           given = File.expand_path(path)
-          real = ProtectedPaths.real(given)
-          return OUTSIDE unless ShellPaths.within?(real, real_root)
-          return SECRET if secret?(given) || secret?(real)
+          reals = ProtectedPaths.reals(path)
+          return OUTSIDE unless reals.all? { |real| ShellPaths.within?(real, real_root) }
+          return SECRET if secret?(given) || reals.any? { |real| secret?(real) }
         end
         nil
       end
@@ -86,7 +100,7 @@ module Samagotchi
       def secret_refusal(paths)
         paths.each do |path|
           given = File.expand_path(path)
-          return SECRET if secret?(given) || secret?(ProtectedPaths.real(given))
+          return SECRET if secret?(given) || ProtectedPaths.reals(path).any? { |real| secret?(real) }
         end
         nil
       end

data/lib/samagotchi/guardrails/rm_targets.rb

@@ -61,9 +61,10 @@ module Samagotchi
         return false unless options.any? { |o| o.match?(RECURSIVE) } && options.any? { |o| o.match?(FORCE) }
 
         targets.empty? || targets.any? do |target|
-          path = walk.path(target)
-          real = path && ProtectedPaths.real(path)
-          real.nil? || roots.none? { |tmp| real.start_with?(File.join(tmp, "")) }
+          paths = walk.paths(target)
+          paths.empty? || paths.flat_map { |path| ProtectedPaths.reals(path) }.any? do |real|
+            roots.none? { |tmp| real.start_with?(File.join(tmp, "")) }
+          end
         end
       end
 

data/lib/samagotchi/guardrails/scratch_writes.rb

@@ -33,7 +33,9 @@ module Samagotchi
         targets = verdict.targets
         return false unless targets && %w[write edit].include?(targets.tool)
 
-        targets.paths.any? { |path| ProtectedPaths.within?(ProtectedPaths.real(path), @memories_dir.call) }
+        targets.paths.flat_map { |path| ProtectedPaths.reals(path) }.any? do |real|
+          ProtectedPaths.within?(real, @memories_dir.call)
+        end
       end
     end
   end

data/lib/samagotchi/guardrails/shell_git_dirs.rb

@@ -1,16 +1,24 @@
 # frozen_string_literal: true
 
 require_relative "shell_lex"
+require_relative "protected_paths"
 
 module Samagotchi
   module Guardrails
     # Where a shell command runs a git subcommand that changes a checkout
     # (commit, add, reset, …): the directories, or :unknown for one that
-    # can't be read from the text ($VAR, $(…), `cd -`). Pure text: it
-    # follows cd/pushd/popd, ( … ) subshells, git -C/--git-dir/--work-tree
-    # and GIT_DIR/GIT_WORK_TREE. It catches honest mistakes (cd into
-    # another checkout and commit there); sh -c, scripts, aliases and
-    # $(…) bodies get through. Never raises on odd input.
+    # can't be read from the text ($VAR, $(…), `cd -`). Read from the text:
+    # it follows cd/pushd/popd, ( … ) subshells, git -C/--git-dir/--work-tree
+    # and GIT_DIR/GIT_WORK_TREE. Where a `..` climbs out of a symlinked
+    # dir's target, its lexical path and its physical one
+    # (ProtectedPaths.expand, the only look at the disk) both count: a cd
+    # may land at either (the shell's logical cd chdirs to the physical
+    # path when the logical one doesn't exist, and always with -P), so the
+    # walk keeps every dir the command may be in, and git's -C and dir
+    # options are opened the kernel's way; such a git counts from each. It
+    # catches honest mistakes (cd into another checkout and commit
+    # there); sh -c, scripts, aliases and $(…) bodies get through. Never
+    # raises on odd input.
     module ShellGitDirs
       MUTATING = %w[commit add reset checkout switch rebase merge push stash rm mv
                     cherry-pick revert pull restore am].freeze
@@ -22,9 +30,11 @@ module Samagotchi
       # @param command [String] the shell command
       # @param cwd [String] where it starts (the call's cwd:, else the session's)
       # @param home [String] for ~, $HOME, ${HOME} and a bare cd
+      # @param env [Hash{String=>String}] the call's env: (task_create's):
+      #   its GIT_DIR / GIT_WORK_TREE hold for each git unless it sets its own
       # @return [Array<String, Symbol>] absolute dirs and :unknown, unique
-      def self.for(command, cwd:, home: Dir.home)
-        Walk.new(cwd, home).run(ShellLex.simple_commands(ShellLex.lex(command.to_s)))
+      def self.for(command, cwd:, home: Dir.home, env: {})
+        Walk.new(cwd, home, env).run(ShellLex.simple_commands(ShellLex.lex(command.to_s)))
       rescue ArgumentError, EncodingError
         [] # a NUL byte, invalid UTF-8: the shell would refuse it too
       end
@@ -32,9 +42,13 @@ module Samagotchi
       # Follows the current dir through the simple commands and records
       # where each mutating git runs.
       class Walk
-        def initialize(cwd, home)
-          @dir = cwd
+        # More dirs than this after a cd: the dir is unknown.
+        MAX_DIRS = 8
+
+        def initialize(cwd, home, env = {})
+          @dirs = [cwd]
           @home = home
+          @env = env.slice("GIT_DIR", "GIT_WORK_TREE")
           @subshells = []
           @pushed = []
           @found = []
@@ -43,8 +57,8 @@ module Samagotchi
         def run(commands)
           commands.each do |words|
             case words
-            when :open then @subshells << @dir
-            when :close then @dir = @subshells.pop || @dir
+            when :open then @subshells << @dirs
+            when :close then @dirs = @subshells.pop || @dirs
             else simple(words.dup)
             end
           end
@@ -54,7 +68,7 @@ module Samagotchi
         private
 
         def simple(words)
-          env = {}
+          env = @env.dup
           while (word = words.first)
             if word.match?(/\A[A-Za-z_]\w*=/)
               key, value = word.split("=", 2)
@@ -69,46 +83,63 @@ module Samagotchi
           case verb
           when "cd" then cd(args)
           when "pushd"
-            @pushed << @dir
-            @dir = args.first ? expand(args.first, @dir) : nil
-          when "popd" then @dir = @pushed.pop unless @pushed.empty?
+            @pushed << @dirs
+            @dirs = args.first ? dirs_after(args.first) : [nil]
+          when "popd" then @dirs = @pushed.pop unless @pushed.empty?
           else git(args, env) if verb == "git" || verb.end_with?("/git")
           end
         end
 
         def cd(args)
           target = args.reject { |a| %w[-P -L -e -@].include?(a) }.first
-          @dir = if target.nil? then @home
-                 elsif target == "-" then nil
-                 else expand(target, @dir)
-                 end
+          @dirs = if target.nil? then [@home]
+                  elsif target == "-" then [nil]
+                  else dirs_after(target)
+                  end
+        end
+
+        # Every dir a cd to +target+ may land at from each current one: its
+        # lexical path and its physical one (nil for one it can't tell);
+        # [nil] past MAX_DIRS.
+        def dirs_after(target)
+          dirs = @dirs.flat_map { |dir| [false, true].map { |physical| expand(target, dir, physical: physical) } }.uniq
+          dirs.size > MAX_DIRS ? [nil] : dirs
         end
 
         def git(args, env)
-          dir = @dir
-          work_tree = env["GIT_WORK_TREE"] && expand(env["GIT_WORK_TREE"], dir)
-          git_dir = env["GIT_DIR"] && expand(env["GIT_DIR"], dir)
+          @found.concat(@dirs.product([false, true]).filter_map do |dir, physical|
+            where_git(args.dup, env, dir, physical)
+          end)
+        end
+
+        # Where a mutating git run from +dir+ runs (a dir or :unknown), nil
+        # for another git; +physical+: its dir options' `..` taken the
+        # kernel's way.
+        def where_git(args, env, dir, physical)
+          expand = ->(arg, base) { expand(arg, base, physical: physical) }
+          work_tree = env["GIT_WORK_TREE"] && expand.call(env["GIT_WORK_TREE"], dir)
+          git_dir = env["GIT_DIR"] && expand.call(env["GIT_DIR"], dir)
           sub = nil
           until args.empty?
             arg = args.shift
             case arg
             when *VALUE_OPTIONS
               value = args.shift.to_s
-              dir = expand(value, dir) if arg == "-C"
-              git_dir = expand(value, dir) if arg == "--git-dir"
-              work_tree = expand(value, dir) if arg == "--work-tree"
-            when /\A--git-dir=(.*)\z/m then git_dir = expand(Regexp.last_match(1), dir)
-            when /\A--work-tree=(.*)\z/m then work_tree = expand(Regexp.last_match(1), dir)
+              dir = expand.call(value, dir) if arg == "-C"
+              git_dir = expand.call(value, dir) if arg == "--git-dir"
+              work_tree = expand.call(value, dir) if arg == "--work-tree"
+            when /\A--git-dir=(.*)\z/m then git_dir = expand.call(Regexp.last_match(1), dir)
+            when /\A--work-tree=(.*)\z/m then work_tree = expand.call(Regexp.last_match(1), dir)
             when /\A-/ then next
             else
               sub = arg
               break
             end
           end
-          return unless MUTATING.include?(sub)
-          return if sub == "stash" && STASH_READS.include?(args.first)
+          return nil unless MUTATING.include?(sub)
+          return nil if sub == "stash" && STASH_READS.include?(args.first)
 
-          @found << (work_tree || repo_of(git_dir) || dir || :unknown)
+          work_tree || repo_of(git_dir) || dir || :unknown
         end
 
         def repo_of(git_dir)
@@ -117,17 +148,18 @@ module Samagotchi
           File.basename(git_dir) == ".git" ? File.dirname(git_dir) : git_dir
         end
 
-        # An absolute path for +arg+ against +dir+; nil when it can't be
-        # told from the text (a variable, a substitution, a relative path
+        # An absolute path for +arg+ against +dir+ (`..` lexical, or
+        # +physical+: ProtectedPaths.expand); nil when it can't
+        # be told from the text (a variable, a substitution, a relative path
         # against an unknown dir).
-        def expand(arg, dir)
+        def expand(arg, dir, physical: false)
           return nil if arg.include?(ShellLex::SUBST)
 
           arg = arg.sub(%r{\A(~|\$HOME|\$\{HOME\})(?=/|\z)}) { @home }
           return nil if arg.include?("$") || arg.start_with?("~")
-          return File.expand_path(arg) if arg.start_with?("/")
+          return nil unless arg.start_with?("/") || dir
 
-          dir && File.expand_path(arg, dir)
+          physical ? ProtectedPaths.expand(arg, dir) : File.expand_path(arg, dir)
         end
       end
     end

data/lib/samagotchi/guardrails/shell_lex.rb

@@ -114,7 +114,7 @@ module Samagotchi
           end
           redirected ||= exec_redirect?(tokens, indices, words)
         end
-        cuts.sort_by { |span, _| -span.begin }.each_with_object(+text) do |(span, replacement), out|
+        cuts.sort_by { |span, _| -span.begin }.each_with_object(text.dup) do |(span, replacement), out|
           out[span] = replacement
         end
       rescue ArgumentError, EncodingError