samagotchi 0.133.0 → 0.134.0

data/lib/samagotchi/guardrails/pair_command.rb

@@ -4,11 +4,16 @@ require_relative "outside"
 require_relative "path_resolve"
 require_relative "read_only_shell"
 require_relative "review_paths"
+require_relative "shell_git_dirs"
 require_relative "shell_paths"
 require_relative "shell_lex"
 
 module Samagotchi
   module Guardrails
+    # Read only by a pair turn's outside-write check: kept off the load
+    # path of everything that requires PairCommand (the testing kit's budget).
+    autoload :ImplicitWriters, File.expand_path("implicit_writers", __dir__)
+
     # One shell command of a participant's pair turn, read the way
     # PairBoundary needs it (the refusal words are PairBoundary's):
     # - #refusal: why it may not run, nil when it may: chi, something left
@@ -41,10 +46,33 @@ module Samagotchi
       # chi named in a script, a value or an argument.
       CHI_TEXT = %r{(?:\A|[\s;&|(`'"=])(?:[^\s;&|(`'"=]*/)?chi(?=\s|\z|[;&|)`'"])}
       SHELLS = %w[sh bash zsh dash fish ksh].freeze
-      # Other interpreters a script can be handed to (-e/-c, a heredoc).
-      INTERPRETERS = %w[python python3 python2 ruby irb node deno bun perl php lua osascript jshell].freeze
+      # Other interpreters a script can be handed to (-e/-c, a heredoc), by
+      # name in any version's spelling (python3.12, pypy3, ruby3.3, perl5.36).
+      INTERPRETER = /\A(?:python\d*(?:\.\d+)?|pypy\d*(?:\.\d+)?|ruby\d*(?:\.\d+)?|irb|node(?:js)?|deno|bun|
+                      perl\d*(?:\.\d+)*|php\d*(?:\.\d+)?|lua(?:jit|\d*(?:\.\d+)?)|osascript|jshell|Rscript|
+                      tclsh\d*(?:\.\d+)?|wish)\z/x
+      # The options whose next word is an interpreter's code, by its name's
+      # start (a shell's is -c only: its -e and -x are flags); others: -c, -e.
+      CODE_FLAGS = { "python" => %w[-c], "pypy" => %w[-c], "ruby" => %w[-e], "irb" => %w[-e],
+                     "node" => %w[-e -p --eval --print], "bun" => %w[-e -p --eval --print], "perl" => %w[-e -E],
+                     "php" => %w[-r], "lua" => %w[-e], "osascript" => %w[-e], "Rscript" => %w[-e],
+                     "tclsh" => [], "wish" => [], "deno" => [], "jshell" => [] }.freeze
+      # How an interpreter's short-option cluster reads (ruby -we, perl -le,
+      # python3 -Ic), by its name's start: the letters whose value is the
+      # rest of the word (ruby -rset: no code), and those that take digits
+      # (perl -l0e). Any other letter is a flag; the code letter's code is
+      # the rest of the word, or the next word (.cluster_code_at).
+      CLUSTER_VALUES = { "python" => %w[mWX], "pypy" => %w[mWX], "ruby" => %w[CEFiIrx 0W],
+                         "perl" => %w[CdDFiImMx 0l], "node" => %w[r], "bun" => %w[r], "lua" => %w[l] }.freeze
+      # A shell's options whose next word is their value, not its script.
+      SHELL_VALUE_OPTIONS = %w[-o +o -O +O].freeze
       # Options whose next word is code or a command, for any program.
       CODE_OPTIONS = %w[-c -e -exec --exec -execdir --command --eval -x].freeze
+      # A shell's or interpreter's options whose next word is a value, not
+      # its script (#stdin_script?).
+      RUNNER_VALUE_OPTIONS = %w[-o +o -O +O -W -X -I -r --require --import --loader -C].freeze
+      # A redirection of stdin (< file, 0<file), not a heredoc's <<.
+      STDIN_REDIRECT = /\A0?<(?!<)/
       # Programs that detach what they start, or run it later (cron, at).
       DETACHERS = %w[nohup setsid disown daemonize crontab at batch].freeze
       # Programs that print the environment or a keychain's secrets, whatever
@@ -95,6 +123,9 @@ module Samagotchi
                         /\[?(?:0{0,4}:){2,7}0{0,3}1\]?/, /\[?::ffff:127(?:\.\d{1,3}){3}\]?/].freeze
       # An interpreter's script that reads the environment or detaches.
       SCRIPT_ENV_TEXT = /\bos\.environ\b|\bgetenv\b|\bprocess\.env\b|\bENV\b|\bprintenv\b|%ENV\b/
+      # An interpreter's script that runs git config or git -c (by its text:
+      # the script isn't parsed).
+      SCRIPT_GIT_CONFIG_TEXT = /\bgit\b[^\n]{0,40}?(?:\bconfig\b|["'\s]-c\b|--config-env|--template)/
       SCRIPT_BACKGROUND_TEXT = /\b(?:nohup|setsid|disown|daemonize|Process\.daemon|detach(?:ed)?)\b/
       # Programs that read a folder's whole tree: given home (or any folder
       # above a denied one) they reach the secrets in it.
@@ -105,11 +136,53 @@ module Samagotchi
       CP_LINK_OPTION = /\A-[a-zA-Z]*[sl]|\A--(?:symbolic-)?link\z/
       # An interpreter's script that makes a link.
       SCRIPT_LINK_TEXT = /symlink|\blink\(|\bln\s|\bmklink\b|FileUtils\.ln|hardlink/i
-      # git settings that make git run a command (or show one), and git
-      # config's scopes beyond the repository.
-      GIT_RUNNING_KEYS = %w[core.fsmonitor core.sshcommand core.hookspath core.pager core.editor].freeze
-      GIT_WIDE_SCOPES = %w[--global --system].freeze
-      GIT_VALUE_OPTIONS = %w[-C --git-dir --work-tree --namespace --exec-path].freeze
+      # A pair turn writes no git config at all (any key may run a command
+      # later in the owner's name: hooks, fsmonitor, a driver, a helper, an
+      # include): only reads, parsed strictly. git config's read actions,
+      # the flags and value options a read may carry (exact spellings: git
+      # takes a long option's unique prefix too, and such a word counts as
+      # a write here), and its read subcommands.
+      GIT_CONFIG_READ_ACTIONS = %w[--get --get-all --get-regexp --get-urlmatch --get-color --get-colorbool -l
+                                   --list].freeze
+      GIT_CONFIG_READ_FLAGS = %w[--show-origin --show-scope --name-only -z --null --includes --no-includes --local
+                                 --worktree --all --regexp --fixed-value --bool --int --bool-or-int --path
+                                 --expiry-date --no-type].freeze
+      GIT_CONFIG_READ_VALUES = %w[-f --file --blob --type --default --value --url].freeze
+      GIT_CONFIG_READS = %w[get list].freeze
+      GIT_CONFIG_WRITES = %w[set unset rename-section remove-section edit].freeze
+      # How many words a read action takes after it (a key, a value pattern…).
+      GIT_CONFIG_READ_ARITY = { "--get-urlmatch" => 2..2, "-l" => 0..0, "--list" => 0..0, "get" => 1..1,
+                                "list" => 0..0 }.freeze
+      # A clone's, an init's or a submodule's -c/--config (the new repository's
+      # config) or --template (its hooks), in any prefix git takes.
+      GIT_SEEDING = %w[clone init submodule].freeze
+      GIT_SEED_CONFIG = /\A(?:-c.*|--c(?:o(?:n(?:f(?:i(?:g)?)?)?)?)?(?:=.*)?)\z/
+      GIT_SEED_TEMPLATE = /\A--t(?:e(?:m(?:p(?:l(?:a(?:t(?:e)?)?)?)?)?)?)?(?:=.*)?\z/
+      # git's options whose value is a command it runs now (filter-branch's
+      # filters, rebase --exec, difftool --extcmd, --upload-pack, …), and the
+      # subcommands whose -x / -u is one.
+      GIT_COMMAND_OPTIONS = %w[--exec --upload-pack --receive-pack --extcmd --tree-filter --index-filter --msg-filter
+                               --env-filter --commit-filter --parent-filter --tag-name-filter].freeze
+      GIT_COMMAND_SHORT = %w[rebase difftool clone fetch ls-remote pull].freeze
+      # Programs that install git hooks (or set core.hooksPath), by the
+      # arguments that do it (nil: any).
+      HOOK_INSTALLERS = { "pre-commit" => %w[install], "husky" => nil, "lefthook" => %w[install add],
+                          "simple-git-hooks" => nil, "overcommit" => %w[--install], "git-hooks" => %w[install] }.freeze
+      # git's own options before its subcommand: the flags, and those whose
+      # value may be the next word. Any other option (one git knows and this
+      # list doesn't: --exec-path alone, a newer one) may or may not take
+      # the next word, and both readings are judged (.git_command_starts):
+      # an unknown option never hides the config, -c or template after it.
+      GIT_FLAG_OPTIONS = %w[-p --paginate -P --no-pager --no-replace-objects --no-lazy-fetch --no-optional-locks
+                            --no-advice --bare --literal-pathspecs --glob-pathspecs --noglob-pathspecs
+                            --icase-pathspecs -v --version -h --help --html-path --man-path --info-path].freeze
+      GIT_VALUE_OPTIONS = %w[-C --git-dir --work-tree --namespace --attr-source --shallow-file].freeze
+      # Variables whose value is a command a program runs through a shell
+      # (git's diff driver, editor, pager, ssh, proxy, askpass; the editors
+      # and pagers others run): read as an sh -c script, wherever the
+      # assignment stands (a prefix, export's, env's).
+      COMMAND_ENV = %w[GIT_EXTERNAL_DIFF GIT_EDITOR EDITOR VISUAL GIT_SEQUENCE_EDITOR GIT_SSH_COMMAND GIT_SSH
+                       GIT_PROXY_COMMAND GIT_PAGER PAGER MANPAGER GIT_ASKPASS SSH_ASKPASS].freeze
       # Devices a command may name in the project's stead.
       DEVICES = %w[/dev/null /dev/stdout /dev/stderr /dev/tty /dev/zero /dev/random /dev/urandom].freeze
       # A word that starts with $TMPDIR or ${TMPDIR}.
@@ -143,11 +216,13 @@ module Samagotchi
       end
 
       # mise's config files (mise.toml, .mise.toml, mise.<env>.toml, .config/mise.toml,
-      # anything under .config/mise/, mise/ or .mise/ config*.toml): mise runs
-      # their [env] at the next worker start (ProjectEnv).
+      # anything under .config/mise/, mise/ or .mise/ config*.toml, and the
+      # .tool-versions it reads too): mise runs their [env] at the next worker
+      # start (ProjectEnv), and installs the tools they pin.
       MISE_CONFIG_PATH = %r{(?:\A|/)(?:\.?mise(?:\.[^/]+)?\.toml|\.config/mise\.toml|\.config/mise/.+|
-                             \.?mise/config[^/]*\.toml)\z}x
-      MISE_CONFIG_TEXT = %r{(?<![\w-])(?:\.?mise(?:\.[\w.-]+)?\.toml|\.config/mise|\.?mise/config[\w.-]*\.toml)}
+                             \.?mise/config[^/]*\.toml|\.tool-versions)\z}x
+      MISE_CONFIG_TEXT = %r{(?<![\w-])(?:\.?mise(?:\.[\w.-]+)?\.toml|\.config/mise|\.?mise/config[\w.-]*\.toml|
+                            \.tool-versions(?![\w.-]))}x
 
       # Whether +path+ is one of mise's config files (MISE_CONFIG_PATH), as
       # given or as it resolves.
@@ -163,6 +238,193 @@ module Samagotchi
           (path.to_s.start_with?("/") && PathResolve.reals(path).any? { |real| real.match?(ShellPaths::HOOKS_PART) })
       end
 
+      # Where the program is in +words+: past assignments, wrappers, shell
+      # keywords and their options (and an option's value: ruby -I lib,
+      # timeout 10).
+      def self.program_at(words)
+        at = 0
+        at += 1 while at < words.size && skipped?(words, at)
+        at < words.size ? at : nil
+      end
+
+      def self.skipped?(words, at)
+        word = words[at]
+        return true if word.match?(/\A[A-Za-z_]\w*=/) || word.start_with?("-") || word.match?(/\A\d+[smhd]?\z/)
+        return true if WRAPPERS.include?(File.basename(word))
+
+        previous = at.positive? ? words[at - 1] : nil
+        !previous.nil? && previous.match?(/\A-[IrCen]\z/)
+      end
+      private_class_method :skipped?
+
+      # Where git's subcommand may start in its +args+ (indices): past its
+      # own options (GIT_FLAG_OPTIONS, GIT_VALUE_OPTIONS and their value,
+      # an option=value), every reading of an option it doesn't know (with
+      # its next word as a value and without). :config_option among them
+      # when one of those options is a -c or --config-env.
+      def self.git_command_starts(args)
+        starts = []
+        todo = [0]
+        seen = {}
+        until todo.empty?
+          i = todo.shift
+          next if seen[i]
+
+          seen[i] = true
+          word = args[i]
+          next starts << i if word.nil? || !word.start_with?("-")
+          next starts << :config_option if word.start_with?("-c", "--config-env")
+
+          if GIT_FLAG_OPTIONS.include?(word) || word.include?("=") then todo << (i + 1)
+          elsif GIT_VALUE_OPTIONS.include?(word) then todo << (i + 2)
+          else todo.push(i + 1, i + 2)
+          end
+        end
+        starts
+      end
+
+      # A git builtin by its dashed name (git-config, …/git-core/git-submodule,
+      # a +program+ word's basename) as git runs it: ["git", [sub, *args]];
+      # any other program as it is.
+      def self.git_form(program, args)
+        sub = program.to_s[/\Agit-([a-z][\w-]*)\z/, 1]
+        sub ? ["git", [sub, *args]] : [program, args]
+      end
+
+      # A shell, another interpreter or eval: what runs a script it is given.
+      def self.runner?(word)
+        return false if word.include?("\0")
+
+        name = File.basename(word)
+        SHELLS.include?(name) || interpreter?(name) || name == "eval"
+      end
+
+      # Whether +name+ (a word's basename) is an interpreter's (INTERPRETER).
+      def self.interpreter?(name) = name.to_s.match?(INTERPRETER)
+
+      # The options whose next word is +name+'s code (CODE_FLAGS).
+      def self.code_flags(name)
+        return %w[-c] if SHELLS.include?(name)
+
+        CODE_FLAGS.find { |start, _| name.start_with?(start) }&.last || %w[-c -e]
+      end
+
+      # Whether +word+ is +name+'s code option: one of .code_flags, a long
+      # one with its code after = (node --eval=…), or a short-option
+      # cluster holding its code letter (.cluster_code_at: sh -ec, bash -cx,
+      # ruby -we, perl -le, node -pe, python3 -Ic).
+      def self.code_flag?(name, word)
+        flags = code_flags(name)
+        flags.include?(word) || !long_code(name, word).nil? || !cluster_code_at(name, word).nil?
+      end
+
+      # The code a long code option carries after = (--eval=…), nil for
+      # another word.
+      def self.long_code(name, word)
+        flag = code_flags(name).find { |option| option.start_with?("--") && word.start_with?("#{option}=") }
+        flag && word.delete_prefix("#{flag}=")
+      end
+
+      # Where +word+, a short-option cluster, holds +name+'s code letter
+      # (a shell's c, python's c, ruby's e, node's e and p…): its index, the
+      # letters before it read as CLUSTER_VALUES says; nil when it holds
+      # none, or a letter before it takes the rest as its value.
+      def self.cluster_code_at(name, word)
+        return nil unless word.match?(/\A-[A-Za-z0-9]/)
+
+        letters = code_flags(name).filter_map { |flag| flag[1] if flag.match?(/\A-[A-Za-z]\z/) }.join
+        return nil if letters.empty?
+
+        rest, digits = SHELLS.include?(name) ? ["", ""] : cluster_values(name)
+        i = 1
+        while i < word.size
+          char = word[i]
+          return i if letters.include?(char)
+          return nil if rest.include?(char)
+
+          i += 1
+          if digits.include?(char) then i += 1 while word[i]&.match?(/\d/)
+          elsif !char.match?(/[A-Za-z]/) then return nil
+          end
+        end
+        nil
+      end
+
+      def self.cluster_values(name)
+        values = CLUSTER_VALUES.find { |start, _| name.start_with?(start) }&.last || []
+        [values[0].to_s, values[1].to_s]
+      end
+      private_class_method :cluster_values
+
+      # The scripts +name+ (a shell or an interpreter, not eval) is handed
+      # in +rest+, the words after it: a shell's is the first word that
+      # isn't an option after its -c cluster (sh -c -- S, bash -c -x S, its
+      # -o's value skipped); an interpreter's is each code option's (one of
+      # .code_flags, a long one's after =, a cluster's rest and the next
+      # word: both are read when the rest isn't empty).
+      def self.code_scripts(name, rest)
+        return shell_scripts(rest) if SHELLS.include?(name)
+
+        found = []
+        rest.each_with_index do |word, i|
+          next unless code_flag?(name, word)
+
+          if (code = long_code(name, word)) then found << code
+          elsif (at = cluster_code_at(name, word)) && at + 1 < word.size then found << word[(at + 1)..]
+          end
+          found << rest[i + 1] if rest[i + 1] && long_code(name, word).nil?
+        end
+        found
+      end
+
+      def self.shell_scripts(rest)
+        start = rest.index { |word| cluster_code_at("sh", word) } or return []
+        i = start + 1
+        while i < rest.size
+          word = rest[i]
+          return rest[i + 1] ? [rest[i + 1]] : [] if word == "--"
+          return [word] unless word.start_with?("-", "+")
+
+          i += SHELL_VALUE_OPTIONS.include?(word) ? 2 : 1
+        end
+        []
+      end
+      private_class_method :shell_scripts
+
+      # Where a simple command's shell or interpreter (.runner?) gets its
+      # script: nil without one; :inline for its code option's script
+      # (.code_flag?: a shell's -c, python's -c, node's -e/-p…), eval's
+      # words, a heredoc or here-string (#scripts reads them); :file for a
+      # script file or a module (-m) it names (not read); :stdin when it
+      # reads a pipe (+piped+, whatever its options: a -c script may read
+      # stdin too, exec(input())), a < file, -s, -, or no script at all.
+      # Other flags (a shell's -e, -x, -o x; python's -x) are flags.
+      def self.script_source(words, piped: false)
+        limit = program_at(words) || (words.size - 1)
+        at = (0..limit).find { |i| runner?(words[i]) } or return nil
+        name = File.basename(words[at])
+        return :inline if name == "eval"
+        return :stdin if piped
+
+        rest = words[(at + 1)..]
+        return :inline if rest.any? { |word| word.start_with?("<<") }
+        return :stdin if rest.any? { |word| word.match?(STDIN_REDIRECT) }
+
+        skip = false
+        rest.each do |word|
+          next skip = false if skip
+          return :stdin if ["-", "-s"].include?(word) || (SHELLS.include?(name) && word.match?(/\A-[a-zA-Z]*s[a-zA-Z]*\z/))
+          return :inline if code_flag?(name, word)
+          return :file if word == "-m" || word.match?(/\A-m\w/)
+          # a redirection's operator alone: its target is the next word
+          next skip = word.sub(ShellPaths::REDIRECT_PREFIX, "").empty? if word.match?(ShellPaths::REDIRECT_PREFIX)
+          next skip = RUNNER_VALUE_OPTIONS.include?(word) if word.start_with?("-", "+")
+
+          return :file
+        end
+        :stdin
+      end
+
       # A command's text naming chi web's endpoint on this machine: a
       # loopback name (LOOPBACK_HOSTS) or one of +hostnames+, and one of
       # +ports+, anywhere in it (a URL's host:port, nc's host port, a
@@ -255,7 +517,8 @@ module Samagotchi
       def outside_writes?
         return @outside_writes if defined?(@outside_writes)
 
-        @outside_writes = !(ReadOnlyShell.read_only?(@text) || writes_inside? || stays_inside?)
+        @outside_writes = env_command_outside? ||
+                          !(ReadOnlyShell.read_only?(@text) || writes_inside? || stays_inside?)
       rescue StandardError
         @outside_writes = true
       end
@@ -274,11 +537,14 @@ module Samagotchi
         return PairBoundary::CHI_WEB if @web && code.match?(@web)
         return PairBoundary::SECRET if subst && code.match?(PairBoundary::SECRET_TEXT)
 
-        @read_only = ReadOnlyShell.read_only?(@text)
+        read_only = ReadOnlyShell.read_only_parts(tokens)
         walk = ShellPaths::Walk.new(@cwd, @home, ENV)
         ShellLex.simple_commands(tokens).each do |words|
           next walk.step(words) if words.is_a?(Symbol)
 
+          # A path the command names counts as written (mise's config, git's
+          # hooks) unless the part of it holding this command only reads.
+          @read_only = read_only.shift
           reason = words_refusal(words) || scripts_refusal(words) || paths_refusal(words, walk.step(words))
           return reason if reason
         end
@@ -298,13 +564,45 @@ module Samagotchi
         upto = at ? words[0..at] : words
         return PairBoundary::BACKGROUND if upto.any? { |w| DETACHERS.include?(File.basename(w)) } || detached_session?(program, args)
         return PairBoundary::ENVIRONMENT if env_reader?(program, args) || bare_env?(words)
-        return PairBoundary::GIT_CONFIG if program == "git" && git_runs_commands?(args)
+
+        program, args = PairCommand.git_form(program, args)
+        return PairBoundary::GIT_CONFIG if git_config_env?(words) || git_alias?(program, args)
+
+        env_commands(words).each do |script|
+          reason = nested(script).refusal
+          return reason if reason
+        end
+
+        if program == "git"
+          # xargs adds words of its input: a git config it runs may write
+          xargs = words[0...at].any? { |word| File.basename(word) == "xargs" }
+          reason = git_refusal(args, appended: xargs) || git_command_refusal(args)
+          return reason if reason
+        end
+        return PairBoundary::GIT_HOOKS if hook_installer?(words)
         return PairBoundary::OPENER if opener?(program, args)
         return PairBoundary::LISTENER if listener?(program, args)
 
+        exec_commands(args).each do |command|
+          reason = words_refusal(command)
+          return reason if reason
+        end
         nil
       end
 
+      # The commands find runs (-exec, -execdir, -ok, -okdir … ; or +):
+      # judged as commands of their own.
+      def exec_commands(args)
+        found = []
+        args.each_with_index do |arg, at|
+          next unless %w[-exec -execdir -ok -okdir].include?(arg)
+
+          command = args[(at + 1)..].take_while { |word| !%w[; \\; +].include?(word) }
+          found << command unless command.empty?
+        end
+        found
+      end
+
       # open, xdg-open, a browser, gio open; osascript's open location is
       # its script's (#script_text_refusal).
       def opener?(program, args)
@@ -355,7 +653,7 @@ module Samagotchi
           reason = if SHELLS.include?(program) || program == "eval"
                      inner = nested(script)
                      inner.refusal.tap { @mise_config = true if inner.mise_config_write? }
-                   elsif INTERPRETERS.include?(program)
+                   elsif PairCommand.interpreter?(program)
                      @mise_config = true if script.match?(MISE_CONFIG_TEXT)
                      script_text_refusal(script)
                    end
@@ -364,20 +662,18 @@ module Samagotchi
         nil
       end
 
-      def runner?(word)
-        name = File.basename(word)
-        SHELLS.include?(name) || INTERPRETERS.include?(name) || name == "eval"
-      end
+      def runner?(word) = PairCommand.runner?(word)
 
       def scripts(words, at)
+        name = File.basename(words[at])
         found = []
-        found << words[(at + 1)..].join(" ") if File.basename(words[at]) == "eval"
+        found << words[(at + 1)..].join(" ") if name == "eval"
         words.each_with_index do |word, i|
           next if i.zero? || word == ShellLex::HEREDOC
 
-          previous = words[i - 1]
-          found << word if previous.start_with?("<<") || (i > at && %w[-c -e].include?(previous))
+          found << word if words[i - 1].start_with?("<<")
         end
+        found.concat(PairCommand.code_scripts(name, words[(at + 1)..])) unless name == "eval"
         found
       end
 
@@ -388,27 +684,12 @@ module Samagotchi
         return PairBoundary::BACKGROUND if script.match?(SCRIPT_BACKGROUND_TEXT)
         return PairBoundary::OPENER if script.match?(SCRIPT_OPENER_TEXT)
         return PairBoundary::LISTENER if script.match?(SCRIPT_LISTEN_TEXT)
+        return PairBoundary::GIT_CONFIG if script.match?(SCRIPT_GIT_CONFIG_TEXT)
 
         nil
       end
 
-      # Where the program is in +words+: past assignments, wrappers, shell
-      # keywords and their options (and an option's value: ruby -I lib,
-      # timeout 10).
-      def program_at(words)
-        at = 0
-        at += 1 while at < words.size && skipped?(words, at)
-        at < words.size ? at : nil
-      end
-
-      def skipped?(words, at)
-        word = words[at]
-        return true if word.match?(/\A[A-Za-z_]\w*=/) || word.start_with?("-") || word.match?(/\A\d+[smhd]?\z/)
-        return true if WRAPPERS.include?(File.basename(word))
-
-        previous = at.positive? ? words[at - 1] : nil
-        !previous.nil? && previous.match?(/\A-[IrCen]\z/)
-      end
+      def program_at(words) = PairCommand.program_at(words)
 
       # screen -d…, tmux new -d: a session left running.
       def detached_session?(program, args)
@@ -451,34 +732,139 @@ module Samagotchi
         words[(at + 1)..].all?(&assignment)
       end
 
-      # git config beyond the repository (--global, --system), or a setting
-      # that runs a command (core.hooksPath, core.fsmonitor, core.sshCommand,
-      # core.pager, core.editor, a "!" alias), set with git config or git -c.
-      def git_runs_commands?(args)
-        i = 0
-        while i < args.size && args[i].start_with?("-")
-          if args[i] == "-c"
-            return true if running_setting?(*args[i + 1].to_s.split("=", 2))
+      # Why a git command is refused: a config write (anything but a read
+      # .git_config_read? holds for, git -c and --config-env whatever they
+      # set, a clone's, init's or submodule's -c/--config: GIT_CONFIG) or a
+      # template (--template: its hooks, GIT_HOOKS); nil for the rest.
+      def git_refusal(args, appended: false)
+        starts = PairCommand.git_command_starts(args)
+        return PairBoundary::GIT_CONFIG if starts.include?(:config_option)
+
+        starts.each do |i|
+          reason = git_command_refusal_at(args[i], args[(i + 1)..] || [], appended: appended)
+          return reason if reason
+        end
+        nil
+      end
+
+      def git_command_refusal_at(command, rest, appended:)
+        return (!appended && git_config_read?(rest) ? nil : PairBoundary::GIT_CONFIG) if command == "config"
+        return nil unless GIT_SEEDING.include?(command)
+        return PairBoundary::GIT_CONFIG if rest.any? { |arg| arg.match?(GIT_SEED_CONFIG) }
 
-            i += 2
-          elsif GIT_VALUE_OPTIONS.include?(args[i])
-            i += 2
+        rest.any? { |arg| arg.match?(GIT_SEED_TEMPLATE) } ? PairBoundary::GIT_HOOKS : nil
+      end
+
+      # Whether git config's arguments (+rest+) only read, every word
+      # accounted for: a read action or subcommand (GIT_CONFIG_READ_ACTIONS,
+      # GIT_CONFIG_READS) or a lone key, the flags and value options a read
+      # may carry (exact spellings), and as many words as the action takes.
+      # Anything else (an unknown or abbreviated option, a value option at
+      # the end, a word too many) is a write.
+      def git_config_read?(rest)
+        actions = []
+        positional = []
+        skip = false
+        rest.each do |arg|
+          next skip = false if skip
+
+          if arg.start_with?("-") && arg != "-"
+            if GIT_CONFIG_READ_ACTIONS.include?(arg) then actions << arg
+            elsif GIT_CONFIG_READ_VALUES.include?(arg) then skip = true
+            elsif !GIT_CONFIG_READ_FLAGS.include?(arg) && !GIT_CONFIG_READ_VALUES.include?(arg[/\A[^=]+(?==)/])
+              return false
+            end
           else
-            i += 1
+            positional << arg
           end
         end
-        return false unless args[i] == "config"
+        return false if skip
 
-        rest = args[(i + 1)..]
-        return true if rest.any? { |arg| GIT_WIDE_SCOPES.include?(arg) }
+        if GIT_CONFIG_READS.include?(positional.first)
+          return false unless actions.empty?
+
+          actions << positional.shift
+        end
+        return positional.size == 1 && !GIT_CONFIG_WRITES.include?(positional.first) if actions.empty?
+        return false unless actions.size == 1
 
-        key, value = rest.reject { |arg| arg.start_with?("-") }
-        running_setting?(key, value)
+        GIT_CONFIG_READ_ARITY.fetch(actions.first, 1..2).cover?(positional.size)
       end
 
-      def running_setting?(key, value)
-        key = key.to_s.downcase
-        GIT_RUNNING_KEYS.include?(key) || (key.start_with?("alias.") && value.to_s.lstrip.start_with?("!"))
+      # The commands a git command runs now, handed to it as text (a
+      # submodule foreach's, a rebase --exec's, a filter's, an --upload-pack,
+      # an ext:: URL…; GIT_COMMAND_OPTIONS): read as commands of their own.
+      def git_commands(args)
+        PairCommand.git_command_starts(args).grep(Integer).flat_map do |i|
+          git_commands_at(args[i], args[(i + 1)..] || [])
+        end
+      end
+
+      def git_commands_at(command, rest)
+        found = rest.filter_map { |arg| arg.delete_prefix("ext::") if arg.start_with?("ext::") }
+        found << rest.drop_while { |arg| arg != "foreach" }.drop(1).reject { |arg| arg.start_with?("-") }.join(" ") if
+          command == "submodule" && rest.include?("foreach")
+        found << rest.drop_while { |arg| arg != "run" }.drop(1).join(" ") if command == "bisect" && rest.include?("run")
+        rest.each_with_index do |arg, at|
+          name, value = arg.split("=", 2)
+          next unless GIT_COMMAND_OPTIONS.include?(name) || (%w[-x -u].include?(name) && GIT_COMMAND_SHORT.include?(command))
+
+          found << (value || rest[at + 1].to_s)
+        end
+        found
+      end
+
+      # A command a git command runs now (.git_commands), refused as its
+      # own command would be.
+      def git_command_refusal(args)
+        git_commands(args).each do |script|
+          reason = nested(script).refusal
+          return reason if reason
+        end
+        nil
+      end
+
+      # alias g=git (or a function's body naming git), then `g config …`:
+      # git under another name; an alias naming git is refused.
+      def git_alias?(program, args)
+        program == "alias" && args.any? { |arg| arg.match?(%r{=['"]?(?:\S*/)?git(?:\s|['"]?\z)}) }
+      end
+
+      # An assignment (a prefix, export's, env's) of a variable that hands
+      # git config or a template of its own (ShellGitDirs::CONFIG_ENV): what
+      # it sets may run a command, as git -c's may.
+      def git_config_env?(words)
+        words.any? { |word| word[/\A([A-Za-z_]\w*)=/, 1].to_s.match?(ShellGitDirs::CONFIG_ENV) }
+      end
+
+      # The commands a simple command's assignments hand a program
+      # (COMMAND_ENV: GIT_EDITOR='…' git commit, export GIT_PAGER=…).
+      def env_commands(words)
+        words.filter_map do |word|
+          name, value = word.match(/\A([A-Za-z_]\w*)=(.+)\z/m)&.captures
+          value if COMMAND_ENV.include?(name)
+        end
+      end
+
+      # Whether a command an assignment hands a program (#env_commands)
+      # may write outside, read as a command of its own.
+      def env_command_outside?
+        ShellLex.simple_commands(ShellLex.lex(@text)).any? do |words|
+          words.is_a?(Array) && env_commands(words).any? { |script| nested(script).outside_writes? }
+        end
+      end
+
+      # A hook installer (HOOK_INSTALLERS: pre-commit install, husky,
+      # lefthook install…), wherever it stands among the wrappers (npx husky).
+      def hook_installer?(words)
+        at = program_at(words) or return false
+        (0..at).any? do |i|
+          name = File.basename(words[i])
+          next false unless HOOK_INSTALLERS.key?(name)
+
+          verbs = HOOK_INSTALLERS[name]
+          verbs.nil? || words[(i + 1)..].intersect?(verbs)
+        end
       end
 
       # The secrets a simple command's words reach: a resolved path on the
@@ -591,14 +977,61 @@ module Samagotchi
         return false if tokens.any? { |_, value| value.include?(ShellLex::SUBST) } && !substs_messages_only?
 
         walk = ShellPaths::Walk.new(@cwd, @home, ENV)
+        piped = ShellLex.piped_flags(tokens)
         ShellLex.simple_commands(tokens).all? do |words|
           next walk.step(words) if words.is_a?(Symbol)
 
+          stdin = PairCommand.script_source(words, piped: piped.shift) == :stdin || git_hands_command?(words)
           walk.dirs.all? { |dir| dir && writable?(dir) } && words_inside?(words, walk) &&
-            scripts_inside?(words).tap { walk.step(words) }
+            !implicit_outside?(words, walk) && !stdin && scripts_inside?(words).tap { walk.step(words) }
         end
       end
 
+      # A program that writes to its own place outside with no word naming
+      # it (ImplicitWriters: npm -g, gem install, brew, defaults write, …),
+      # wherever it stands among the wrappers (sudo npm, bundle config),
+      # python -m's module as the program, under the assignments before it
+      # (npm_config_global=true).
+      def implicit_outside?(words, walk)
+        at = program_at(words) or return false
+        assigned = words[0...at].filter_map { |word| word.split("=", 2) if word.match?(/\A[A-Za-z_]\w*=/) }.to_h
+        (0..at).any? do |i|
+          program = words[i]
+          args = words[(i + 1)..]
+          local = project_program?(walk, program)
+          if PairCommand.interpreter?(File.basename(program)) && (module_args = module_run(args))
+            program, args = module_args
+          end
+          ImplicitWriters.outside?(program, args, local: local, assigned: assigned)
+        end
+      end
+
+      # An interpreter's -m module and the words after it ([name, args]):
+      # -m pip, -mpip; nil without one.
+      def module_run(args)
+        args.each_with_index do |arg, i|
+          return [args[i + 1], args[(i + 2)..]] if arg == "-m" && args[i + 1]
+          return [arg.delete_prefix("-m"), args[(i + 1)..]] if arg.match?(/\A-m\w/)
+        end
+        nil
+      end
+
+      # Whether a git command runs a command now that it is handed as text
+      # (.git_commands): where it writes isn't placed, so it asks.
+      def git_hands_command?(words)
+        at = program_at(words) or return false
+        program, args = PairCommand.git_form(File.basename(words[at]), words[(at + 1)..])
+        program == "git" && !git_commands(args).empty?
+      end
+
+      # Whether a program's word is a path into the project (.venv/bin/pip).
+      def project_program?(walk, word)
+        return false unless word.include?("/")
+
+        paths = walk.paths(word)
+        !paths.empty? && paths.all? { |path| Outside.inside?(path, root: @root) }
+      end
+
       # Whether every $(…) is a message's heredoc (its body cut as data).
       def substs_messages_only?
         rest = ShellLex.code_text(@text, keep_written: false).gsub(MESSAGE_SUBST, "")