samagotchi 0.133.0 → 0.135.0

data/lib/samagotchi/guardrails/pair_command.rb

@@ -4,11 +4,16 @@ require_relative "outside"
 require_relative "path_resolve"
 require_relative "read_only_shell"
 require_relative "review_paths"
+require_relative "shell_git_dirs"
 require_relative "shell_paths"
 require_relative "shell_lex"
 
 module Samagotchi
   module Guardrails
+    # Read only by a pair turn's outside-write check: kept off the load
+    # path of everything that requires PairCommand (the testing kit's budget).
+    autoload :ImplicitWriters, File.expand_path("implicit_writers", __dir__)
+
     # One shell command of a participant's pair turn, read the way
     # PairBoundary needs it (the refusal words are PairBoundary's):
     # - #refusal: why it may not run, nil when it may: chi, something left
@@ -34,17 +39,75 @@ module Samagotchi
     class PairCommand
       # What runs a command on another's behalf, and the shell's keywords
       # before a command: skipped to find the program.
-      WRAPPERS = %w[env exec command nohup time sudo nice xargs setsid timeout stdbuf caffeinate bundle ruby watch npx
-                    { ! then do else elif if while until].freeze
+      WRAPPERS = %w[env exec command builtin nohup time sudo nice xargs setsid timeout stdbuf caffeinate bundle ruby
+                    watch npx bunx uvx xcrun arch script { ! then do else elif if while until].freeze
+      # Wrappers by two words: the program after `uv run`, `pnpm exec` …
+      SUBCOMMAND_WRAPPERS = { "uv" => %w[run], "poetry" => %w[run], "pdm" => %w[run], "hatch" => %w[run],
+                              "pipx" => %w[run], "pnpm" => %w[exec dlx], "yarn" => %w[exec dlx], "npm" => %w[exec x],
+                              "bun" => %w[x], "mise" => %w[exec x] }.freeze
+      # A wrapper's options whose value is the next word (.program_at): not
+      # the program (env -u X git, sudo -u root git, timeout -s KILL 5 git).
+      WRAPPER_VALUES = { "env" => %w[-u --unset -C --chdir -P -S --split-string], "exec" => %w[-a],
+                         "sudo" => %w[-u -g -h -p -C -D -R -T -U -r -t --user --group --host --prompt --chdir],
+                         "timeout" => %w[-s --signal -k --kill-after], "nice" => %w[--adjustment],
+                         "xargs" => %w[-L -P -s -d -E -a --max-args --max-procs --delimiter --arg-file],
+                         "stdbuf" => %w[-i -o --input --output --error], "caffeinate" => %w[-t -w],
+                         "watch" => %w[--interval], "arch" => %w[-arch -d], "xcrun" => %w[-sdk --sdk --toolchain],
+                         "script" => %w[-t -T -B -I -O -c --command], "npx" => %w[-c --call -p --package],
+                         "npm" => %w[-c --call -p --package -w --workspace] }.freeze
+      # A wrapper's flags the generic -I/-r/-C/-e/-n rule would read as
+      # taking a value (xcrun -r is --run, sudo -n non-interactive; macOS's
+      # script -F is a flag too: not in WRAPPER_VALUES).
+      WRAPPER_FLAGS = { "xcrun" => %w[-r -n -l -v -f -k], "sudo" => %w[-n -E -H -i -s -k -b -P -S -A -e -l -v -K -B],
+                        "env" => %w[-i -0 -v] }.freeze
       # chi's own invocations a pair turn may run: they print and exit.
       CHI_ALLOWED = [%w[--version], %w[--help]].freeze
-      # chi named in a script, a value or an argument.
-      CHI_TEXT = %r{(?:\A|[\s;&|(`'"=])(?:[^\s;&|(`'"=]*/)?chi(?=\s|\z|[;&|)`'"])}
+      # chi named in a script, a value or an argument, in any case (CHI runs
+      # chi on a case-insensitive disk: ShellLex.program_name).
+      CHI_TEXT = %r{(?:\A|[\s;&|(`'"=])(?:[^\s;&|(`'"=]*/)?chi(?=\s|\z|[;&|)`'"])}i
       SHELLS = %w[sh bash zsh dash fish ksh].freeze
-      # Other interpreters a script can be handed to (-e/-c, a heredoc).
-      INTERPRETERS = %w[python python3 python2 ruby irb node deno bun perl php lua osascript jshell].freeze
+      # Other interpreters a script can be handed to (-e/-c, a heredoc), by
+      # name in any version's spelling (python3.12, pypy3, ruby3.3, perl5.36).
+      INTERPRETER = /\A(?:python\d*(?:\.\d+)?|pypy\d*(?:\.\d+)?|ruby\d*(?:\.\d+)?|irb|node(?:js)?|deno|bun|
+                      perl\d*(?:\.\d+)*|php\d*(?:\.\d+)?|lua(?:jit|\d*(?:\.\d+)?)|osascript|jshell|rscript|
+                      tclsh\d*(?:\.\d+)?|wish|jruby|raku|julia)\z/x
+      # The options whose next word is an interpreter's code, by its name's
+      # start (a shell's is -c only: its -e and -x are flags); others: -c, -e.
+      CODE_FLAGS = { "python" => %w[-c], "pypy" => %w[-c], "ruby" => %w[-e], "irb" => %w[-e],
+                     "node" => %w[-e -p --eval --print], "bun" => %w[-e -p --eval --print], "perl" => %w[-e -E],
+                     "php" => %w[-r -B -R -E], "lua" => %w[-e], "osascript" => %w[-e], "rscript" => %w[-e],
+                     "jruby" => %w[-e], "raku" => %w[-e], "julia" => %w[-e],
+                     "tclsh" => [], "wish" => [], "deno" => [], "jshell" => [] }.freeze
+      # How an interpreter's short-option cluster reads (ruby -we, perl -le,
+      # python3 -Ic), by its name's start: the letters whose value is the
+      # rest of the word (ruby -rset: no code), and those that take digits
+      # (perl -l0e). Any other letter is a flag; the code letter's code is
+      # the rest of the word, or the next word (.cluster_code_at).
+      # perl's -d takes only :Module (perl -de: -d -e).
+      CLUSTER_VALUES = { "python" => %w[mWX], "pypy" => %w[mWX], "ruby" => %w[CEFiIrx 0W],
+                         "perl" => %w[CDFiImMx 0l], "node" => %w[r], "bun" => %w[r], "lua" => %w[l] }.freeze
+      # More value letters, told only for where a script comes from
+      # (.script_source: php -dr x.php and osascript -le x run the file x, so
+      # SelfProtect counts it unseen; perl -d… runs .perldb from the dir it
+      # is in); a pair turn still reads the word after them as code too (an
+      # over-read: more refusals, never fewer).
+      SOURCE_CLUSTER_VALUES = CLUSTER_VALUES.merge("php" => %w[cdfz], "osascript" => %w[ls],
+                                                   "perl" => %w[CdDFiImMx 0l]).freeze
+      # A shell's options whose next word is their value, not its script.
+      SHELL_VALUE_OPTIONS = %w[-o +o -O +O].freeze
+      # fish's long options that take a command (the next word, or after =),
+      # with the shortest prefix fish's getopt may take for each (--comm,
+      # --init): its script (--command) or one run before it (--init-command,
+      # and -C anywhere in a cluster, its value attached or the next word;
+      # not where its script comes from: .script_source).
+      FISH_COMMAND_OPTIONS = { "--command" => 3, "--init-command" => 4 }.freeze
       # Options whose next word is code or a command, for any program.
-      CODE_OPTIONS = %w[-c -e -exec --exec -execdir --command --eval -x].freeze
+      CODE_OPTIONS = %w[-c -e -exec --exec -execdir --command --init-command --eval -x].freeze
+      # A shell's or interpreter's options whose next word is a value, not
+      # its script (#stdin_script?).
+      RUNNER_VALUE_OPTIONS = %w[-o +o -O +O -W -X -I -r --require --import --loader -C].freeze
+      # A redirection of stdin (< file, 0<file), not a heredoc's <<.
+      STDIN_REDIRECT = /\A0?<(?!<)/
       # Programs that detach what they start, or run it later (cron, at).
       DETACHERS = %w[nohup setsid disown daemonize crontab at batch].freeze
       # Programs that print the environment or a keychain's secrets, whatever
@@ -54,7 +117,7 @@ module Samagotchi
       # key), by the program and the words that say so in its arguments.
       # Programs that load a project's env files (PairBoundary::ENV_LOADER).
       ENV_LOADERS = %w[mise direnv].freeze
-      ENV_LOADER_TEXT = %r{(?<![\w./-])(?:mise|direnv)(?![\w./-])}
+      ENV_LOADER_TEXT = %r{(?<![\w./-])(?:mise|direnv)(?![\w./-])}i
       CREDENTIAL_PRINTERS = {
         "gh" => [%w[auth token]],
         "git" => [%w[credential], %w[credential-osxkeychain], %w[credential-store], %w[credential-cache],
@@ -94,8 +157,12 @@ module Samagotchi
       LOOPBACK_HOSTS = [/(?:[\w-]+\.)*localhost\.?/, /127(?:\.\d{1,3}){1,3}/, /0\.0\.0\.0/,
                         /\[?(?:0{0,4}:){2,7}0{0,3}1\]?/, /\[?::ffff:127(?:\.\d{1,3}){3}\]?/].freeze
       # An interpreter's script that reads the environment or detaches.
-      SCRIPT_ENV_TEXT = /\bos\.environ\b|\bgetenv\b|\bprocess\.env\b|\bENV\b|\bprintenv\b|%ENV\b/
-      SCRIPT_BACKGROUND_TEXT = /\b(?:nohup|setsid|disown|daemonize|Process\.daemon|detach(?:ed)?)\b/
+      SCRIPT_ENV_TEXT = /\bos\.environ\b|\bgetenv\b|\bprocess\.env\b|\bENV\b|(?i:\bprintenv\b)|%ENV\b/
+      # An interpreter's script that runs git config or git -c (by its text:
+      # the script isn't parsed); git and the words in any case (GIT config),
+      # -c as it is (git -C dir sets nothing).
+      SCRIPT_GIT_CONFIG_TEXT = /(?i:\bgit\b)[^\n]{0,40}?(?:(?i:\bconfig\b)|["'\s]-c\b|(?i:--config-env|--template))/
+      SCRIPT_BACKGROUND_TEXT = /\b(?:(?i:nohup|setsid|disown|daemonize)|Process\.daemon|detach(?:ed)?)\b/
       # Programs that read a folder's whole tree: given home (or any folder
       # above a denied one) they reach the secrets in it.
       # A link to such a folder reaches them too (ln, link).
@@ -105,11 +172,75 @@ module Samagotchi
       CP_LINK_OPTION = /\A-[a-zA-Z]*[sl]|\A--(?:symbolic-)?link\z/
       # An interpreter's script that makes a link.
       SCRIPT_LINK_TEXT = /symlink|\blink\(|\bln\s|\bmklink\b|FileUtils\.ln|hardlink/i
-      # git settings that make git run a command (or show one), and git
-      # config's scopes beyond the repository.
-      GIT_RUNNING_KEYS = %w[core.fsmonitor core.sshcommand core.hookspath core.pager core.editor].freeze
-      GIT_WIDE_SCOPES = %w[--global --system].freeze
-      GIT_VALUE_OPTIONS = %w[-C --git-dir --work-tree --namespace --exec-path].freeze
+      # A pair turn writes no git config at all (any key may run a command
+      # later in the owner's name: hooks, fsmonitor, a driver, a helper, an
+      # include): only reads, parsed strictly. git config's read actions,
+      # the flags and value options a read may carry (exact spellings: git
+      # takes a long option's unique prefix too, and such a word counts as
+      # a write here), and its read subcommands.
+      GIT_CONFIG_READ_ACTIONS = %w[--get --get-all --get-regexp --get-urlmatch --get-color --get-colorbool -l
+                                   --list].freeze
+      GIT_CONFIG_READ_FLAGS = %w[--show-origin --show-scope --name-only -z --null --includes --no-includes --local
+                                 --worktree --all --regexp --fixed-value --bool --int --bool-or-int --path
+                                 --expiry-date --no-type].freeze
+      GIT_CONFIG_READ_VALUES = %w[-f --file --blob --type --default --value --url].freeze
+      GIT_CONFIG_READS = %w[get list].freeze
+      GIT_CONFIG_WRITES = %w[set unset rename-section remove-section edit].freeze
+      # How many words a read action takes after it (a key, a value pattern…).
+      GIT_CONFIG_READ_ARITY = { "--get-urlmatch" => 2..2, "-l" => 0..0, "--list" => 0..0, "get" => 1..1,
+                                "list" => 0..0 }.freeze
+      # A clone's, an init's or a submodule's -c/--config (the new repository's
+      # config) or --template (its hooks), in any prefix git takes.
+      GIT_SEEDING = %w[clone init submodule].freeze
+      GIT_SEED_CONFIG = /\A(?:-c.*|--c(?:o(?:n(?:f(?:i(?:g)?)?)?)?)?(?:=.*)?)\z/
+      GIT_SEED_TEMPLATE = /\A--t(?:e(?:m(?:p(?:l(?:a(?:t(?:e)?)?)?)?)?)?)?(?:=.*)?\z/
+      # git's options whose value is a command it runs now (filter-branch's
+      # filters, rebase --exec, difftool --extcmd, --upload-pack, …), and the
+      # subcommands whose -x / -u is one.
+      GIT_COMMAND_OPTIONS = %w[--exec --upload-pack --receive-pack --extcmd --tree-filter --index-filter --msg-filter
+                               --env-filter --commit-filter --parent-filter --tag-name-filter].freeze
+      GIT_COMMAND_SHORT = %w[rebase difftool clone fetch ls-remote pull].freeze
+      # Programs that install git hooks (or set core.hooksPath), by the
+      # arguments that do it (nil: any).
+      HOOK_INSTALLERS = { "pre-commit" => %w[install], "husky" => nil, "lefthook" => %w[install add],
+                          "simple-git-hooks" => nil, "overcommit" => %w[--install], "git-hooks" => %w[install] }.freeze
+      # git's own options before its subcommand: the flags, and those whose
+      # value may be the next word. Any other option (one git knows and this
+      # list doesn't: --exec-path alone, a newer one) may or may not take
+      # the next word, and both readings are judged (.git_command_starts):
+      # an unknown option never hides the config, -c or template after it.
+      GIT_FLAG_OPTIONS = %w[-p --paginate -P --no-pager --no-replace-objects --no-lazy-fetch --no-optional-locks
+                            --no-advice --bare --literal-pathspecs --glob-pathspecs --noglob-pathspecs
+                            --icase-pathspecs -v --version -h --help --html-path --man-path --info-path].freeze
+      GIT_VALUE_OPTIONS = %w[-C --git-dir --work-tree --namespace --attr-source --shallow-file].freeze
+      # Variables whose value is a command a program runs through a shell
+      # (git's diff driver, editor, pager, ssh, proxy, askpass; the editors
+      # and pagers others run): read as an sh -c script, wherever the
+      # assignment stands (a prefix, export's, env's); bash's PROMPT_COMMAND.
+      COMMAND_ENV = %w[GIT_EXTERNAL_DIFF GIT_EDITOR EDITOR VISUAL GIT_SEQUENCE_EDITOR GIT_SSH_COMMAND GIT_SSH
+                       GIT_PROXY_COMMAND GIT_PAGER PAGER MANPAGER GIT_ASKPASS SSH_ASKPASS PROMPT_COMMAND].freeze
+      # A $(…) or backticks left as text in an assigned value (quoted: one
+      # that runs now is a SUBST): a shell expands it later, where the value
+      # is used (PS4 under bash -x, PS0/PS1, a prompt), so the value is read
+      # as a script too. Only a real assignment's: a prefix, a command of
+      # assignments, or ASSIGNERS' words (not grep 'X=$(…)').
+      DEFERRED_SUBST = /\$\(|`|\$\{[\s|]|\\(?:x24|044|x60|140)/
+      # A deferred value's escapes ($'\x24(…)') and the parts that open or
+      # close what it runs, cut into separators to read the commands inside.
+      DEFERRED_ESCAPES = /\\(?:x24|044|x60|140)/
+      DEFERRED_PARTS = /\$\(|\$\{(?=[\s|])|`|\)|\}/
+      ASSIGNERS = %w[export declare typeset readonly local env].freeze
+      # How many words naming git or chi the net reads (#net_hit?).
+      NET_GITS = 16
+      # Runners whose arguments are command lines they run through a shell,
+      # and every program #text_commands reads a command line of.
+      TEXT_RUNNERS = %w[hyperfine parallel watch].freeze
+      TEXT_TAKERS = (TEXT_RUNNERS + %w[env script npx npm rsync ssh scp sftp]).freeze
+      # chi's commands, for the net (#net_hit?): chi cp'd or listed isn't run.
+      CHI_COMMANDS = %w[sessions note broadcast context send answer share review bootstrap update models desktop
+                        memory bundle guardrails toolkit remote home web self].freeze
+      # An ssh -o option that runs a command on this machine, and its value.
+      SSH_COMMAND_OPTION = /\A\s*(?:ProxyCommand|LocalCommand|KnownHostsCommand)\s*[=\s]\s*(.+)\z/im
       # Devices a command may name in the project's stead.
       DEVICES = %w[/dev/null /dev/stdout /dev/stderr /dev/tty /dev/zero /dev/random /dev/urandom].freeze
       # A word that starts with $TMPDIR or ${TMPDIR}.
@@ -143,11 +274,13 @@ module Samagotchi
       end
 
       # mise's config files (mise.toml, .mise.toml, mise.<env>.toml, .config/mise.toml,
-      # anything under .config/mise/, mise/ or .mise/ config*.toml): mise runs
-      # their [env] at the next worker start (ProjectEnv).
+      # anything under .config/mise/, mise/ or .mise/ config*.toml, and the
+      # .tool-versions it reads too): mise runs their [env] at the next worker
+      # start (ProjectEnv), and installs the tools they pin.
       MISE_CONFIG_PATH = %r{(?:\A|/)(?:\.?mise(?:\.[^/]+)?\.toml|\.config/mise\.toml|\.config/mise/.+|
-                             \.?mise/config[^/]*\.toml)\z}x
-      MISE_CONFIG_TEXT = %r{(?<![\w-])(?:\.?mise(?:\.[\w.-]+)?\.toml|\.config/mise|\.?mise/config[\w.-]*\.toml)}
+                             \.?mise/config[^/]*\.toml|\.tool-versions)\z}x
+      MISE_CONFIG_TEXT = %r{(?<![\w-])(?:\.?mise(?:\.[\w.-]+)?\.toml|\.config/mise|\.?mise/config[\w.-]*\.toml|
+                            \.tool-versions(?![\w.-]))}x
 
       # Whether +path+ is one of mise's config files (MISE_CONFIG_PATH), as
       # given or as it resolves.
@@ -163,6 +296,243 @@ module Samagotchi
           (path.to_s.start_with?("/") && PathResolve.reals(path).any? { |real| real.match?(ShellPaths::HOOKS_PART) })
       end
 
+      # Where the program is in +words+: past assignments, wrappers, shell
+      # keywords and their options (and an option's value: ruby -I lib,
+      # timeout 10).
+      # A wrapper's options whose value is the next word (WRAPPER_VALUES, and
+      # -I/-r/-C/-e/-n for any), a two-word wrapper (uv run, pnpm exec:
+      # SUBCOMMAND_WRAPPERS), and script's typescript file before its command.
+      def self.program_at(words)
+        at = 0
+        wrapper = nil
+        file = false
+        while at < words.size
+          word = words[at]
+          if word.match?(/\A[A-Za-z_]\w*=/) || word.match?(/\A\d+[smhd]?\z/) then at += 1
+          elsif word.start_with?("-") then at += option_width(wrapper, word)
+          elsif wrapper == "script" && !file
+            at += 1
+            file = true
+          else
+            name = ShellLex.program_name(word)
+            if SUBCOMMAND_WRAPPERS.fetch(name, []).include?(words[at + 1]) then at += 2
+            elsif WRAPPERS.include?(name) then at += 1
+            else break
+            end
+            wrapper = name
+          end
+        end
+        at < words.size ? at : nil
+      end
+
+      def self.option_width(wrapper, word)
+        return 1 if WRAPPER_FLAGS.fetch(wrapper, []).include?(word)
+
+        WRAPPER_VALUES.fetch(wrapper, []).include?(word) || word.match?(/\A-[IrCen]\z/) ? 2 : 1
+      end
+
+      # Where git's subcommand may start in its +args+ (indices): past its
+      # own options (GIT_FLAG_OPTIONS, GIT_VALUE_OPTIONS and their value,
+      # an option=value), every reading of an option it doesn't know (with
+      # its next word as a value and without). :config_option among them
+      # when one of those options is a -c or --config-env.
+      def self.git_command_starts(args)
+        starts = []
+        todo = [0]
+        seen = {}
+        until todo.empty?
+          i = todo.shift
+          next if seen[i]
+
+          seen[i] = true
+          word = args[i]
+          next starts << i if word.nil? || !word.start_with?("-")
+          next starts << :config_option if word.start_with?("-c", "--config-env")
+
+          if GIT_FLAG_OPTIONS.include?(word) || word.include?("=") then todo << (i + 1)
+          elsif GIT_VALUE_OPTIONS.include?(word) then todo << (i + 2)
+          else todo.push(i + 1, i + 2)
+          end
+        end
+        starts
+      end
+
+      # A git builtin by its dashed name (git-config, …/git-core/git-submodule,
+      # a +program+ word's basename) as git runs it: ["git", [sub, *args]];
+      # any other program as it is.
+      def self.git_form(program, args)
+        sub = program.to_s[/\Agit-([a-z][\w-]*)\z/, 1]
+        sub ? ["git", [sub, *args]] : [program, args]
+      end
+
+      # A shell, another interpreter or eval: what runs a script it is given.
+      def self.runner?(word)
+        return false if word.include?("\0")
+
+        name = ShellLex.program_name(word)
+        SHELLS.include?(name) || interpreter?(name) || name == "eval"
+      end
+
+      # Whether +name+ (a word's basename) is an interpreter's (INTERPRETER).
+      def self.interpreter?(name) = name.to_s.match?(INTERPRETER)
+
+      # The options whose next word is +name+'s code (CODE_FLAGS); fish's
+      # --command too.
+      # With +source+ (.script_source) fish's --command is left out: what its
+      # script runs (a sourced file) SelfProtect can't see, as on a file.
+      def self.code_flags(name, source: false)
+        return source ? %w[-c] : %w[-c --command] if name == "fish"
+        return %w[-c] if SHELLS.include?(name)
+
+        CODE_FLAGS.find { |start, _| name.start_with?(start) }&.last || %w[-c -e]
+      end
+
+      # Whether +word+ is +name+'s code option: one of .code_flags, a long
+      # one with its code after = (node --eval=…), or a short-option
+      # cluster holding its code letter (.cluster_code_at: sh -ec, bash -cx,
+      # ruby -we, perl -le, node -pe, python3 -Ic).
+      def self.code_flag?(name, word, source: false)
+        flags = code_flags(name, source: source)
+        flags.include?(word) || !long_code(name, word, source: source).nil? ||
+          !cluster_code_at(name, word, source: source).nil?
+      end
+
+      # The code a long code option carries after = (--eval=…), nil for
+      # another word.
+      def self.long_code(name, word, source: false)
+        flag = code_flags(name, source: source).find { |option| option.start_with?("--") && word.start_with?("#{option}=") }
+        flag && word.delete_prefix("#{flag}=")
+      end
+
+      # Where +word+, a short-option cluster, holds +name+'s code letter
+      # (a shell's c, python's c, ruby's e, node's e and p…): its index, the
+      # letters before it read as CLUSTER_VALUES says (SOURCE_CLUSTER_VALUES
+      # with +source+); nil when it holds none, or a letter before it takes
+      # the rest as its value.
+      def self.cluster_code_at(name, word, source: false)
+        return nil unless word.match?(/\A-[A-Za-z0-9]/)
+
+        letters = code_flags(name, source: source).filter_map { |flag| flag[1] if flag.match?(/\A-[A-Za-z]\z/) }.join
+        return nil if letters.empty?
+
+        rest, digits = if SHELLS.include?(name)
+                         ["", ""]
+                       else
+                         cluster_values(name, source ? SOURCE_CLUSTER_VALUES : CLUSTER_VALUES)
+                       end
+        i = 1
+        while i < word.size
+          char = word[i]
+          return i if letters.include?(char)
+          return nil if rest.include?(char)
+
+          i += 1
+          if digits.include?(char) then i += 1 while word[i]&.match?(/\d/)
+          elsif !char.match?(/[A-Za-z]/) then return nil
+          end
+        end
+        nil
+      end
+
+      def self.cluster_values(name, table)
+        values = table.find { |start, _| name.start_with?(start) }&.last || []
+        [values[0].to_s, values[1].to_s]
+      end
+      private_class_method :cluster_values
+
+      # The scripts +name+ (a shell or an interpreter, not eval) is handed
+      # in +rest+, the words after it: a shell's is the first word that
+      # isn't an option after its -c cluster (sh -c -- S, bash -c -x S, its
+      # -o's value skipped); an interpreter's is each code option's (one of
+      # .code_flags, a long one's after =, a cluster's rest and the next
+      # word: both are read when the rest isn't empty).
+      def self.code_scripts(name, rest)
+        return shell_scripts(name, rest) if SHELLS.include?(name)
+
+        found = []
+        rest.each_with_index do |word, i|
+          next unless code_flag?(name, word)
+
+          if (code = long_code(name, word)) then found << code
+          elsif (at = cluster_code_at(name, word)) && at + 1 < word.size then found << word[(at + 1)..]
+          end
+          found << rest[i + 1] if rest[i + 1] && long_code(name, word).nil?
+        end
+        found
+      end
+
+      # A shell's scripts: the one after its -c cluster (.shell_script_after),
+      # and fish's commands given by an option that takes one (FISH_COMMAND_OPTIONS:
+      # --command S, --comm=S, --init S, -C S, -C'S', -lC S).
+      def self.shell_scripts(name, rest)
+        found = name == "fish" ? fish_commands(rest) : []
+        start = rest.index { |word| cluster_code_at(name, word) }
+        found.concat(shell_script_after(rest, start)) if start
+        found.compact
+      end
+      private_class_method :shell_scripts
+
+      def self.fish_commands(rest)
+        rest.each_with_index.filter_map do |word, i|
+          option, value = word.split("=", 2)
+          if option.start_with?("--")
+            long = FISH_COMMAND_OPTIONS.any? { |full, min| option.size >= min && full.start_with?(option) }
+            value || rest[i + 1] if long
+          elsif (at = word.index("C")) && word.match?(/\A-[A-Za-z]*C/)
+            tail = word[(at + 1)..]
+            tail.empty? ? rest[i + 1] : tail
+          end
+        end
+      end
+      private_class_method :fish_commands
+
+      def self.shell_script_after(rest, start)
+        i = start + 1
+        while i < rest.size
+          word = rest[i]
+          return rest[i + 1] ? [rest[i + 1]] : [] if word == "--"
+          return [word] unless word.start_with?("-", "+")
+
+          i += SHELL_VALUE_OPTIONS.include?(word) ? 2 : 1
+        end
+        []
+      end
+      private_class_method :shell_script_after
+
+      # Where a simple command's shell or interpreter (.runner?) gets its
+      # script: nil without one; :inline for its code option's script
+      # (.code_flag?: a shell's -c, python's -c, node's -e/-p…), eval's
+      # words, a heredoc or here-string (#scripts reads them); :file for a
+      # script file or a module (-m) it names (not read); :stdin when it
+      # reads a pipe (+piped+, whatever its options: a -c script may read
+      # stdin too, exec(input())), a < file, -s, -, or no script at all.
+      # Other flags (a shell's -e, -x, -o x; python's -x) are flags.
+      def self.script_source(words, piped: false)
+        limit = program_at(words) || (words.size - 1)
+        at = (0..limit).find { |i| runner?(words[i]) } or return nil
+        name = ShellLex.program_name(words[at])
+        return :inline if name == "eval"
+        return :stdin if piped
+
+        rest = words[(at + 1)..]
+        return :inline if rest.any? { |word| word.start_with?("<<") }
+        return :stdin if rest.any? { |word| word.match?(STDIN_REDIRECT) }
+
+        skip = false
+        rest.each do |word|
+          next skip = false if skip
+          return :stdin if ["-", "-s"].include?(word) || (SHELLS.include?(name) && word.match?(/\A-[a-zA-Z]*s[a-zA-Z]*\z/))
+          return :inline if code_flag?(name, word, source: true)
+          return :file if word == "-m" || word.match?(/\A-m\w/)
+          # a redirection's operator alone: its target is the next word
+          next skip = word.sub(ShellPaths::REDIRECT_PREFIX, "").empty? if word.match?(ShellPaths::REDIRECT_PREFIX)
+          next skip = RUNNER_VALUE_OPTIONS.include?(word) if word.start_with?("-", "+")
+
+          return :file
+        end
+        :stdin
+      end
+
       # A command's text naming chi web's endpoint on this machine: a
       # loopback name (LOOPBACK_HOSTS) or one of +hostnames+, and one of
       # +ports+, anywhere in it (a URL's host:port, nc's host port, a
@@ -211,9 +581,20 @@ module Samagotchi
         @refusal = read
       rescue StandardError
         @mise_config = true
+        @net = true
         @refusal = PairBoundary::UNREADABLE
       end
 
+      # Whether the owner approves it for what chi can't read for sure
+      # (PairBoundary::NET): git or chi behind a program no list knows
+      # (#net_hit?), or a $(…) kept in an assigned value that the shell
+      # expands later (#deferred_values), a script it hands on included.
+      # True for one it can't read.
+      def net_ask?
+        refusal
+        @net ||= false
+      end
+
       # Whether it makes a link (ln, link, cp -s/-l, a script's symlink): a
       # path through a link it makes now is judged before the link exists,
       # so the owner approves it (asked about; a link to a folder above a
@@ -255,7 +636,8 @@ module Samagotchi
       def outside_writes?
         return @outside_writes if defined?(@outside_writes)
 
-        @outside_writes = !(ReadOnlyShell.read_only?(@text) || writes_inside? || stays_inside?)
+        @outside_writes = handed_command_outside? ||
+                          !(ReadOnlyShell.read_only?(@text) || writes_inside? || stays_inside?)
       rescue StandardError
         @outside_writes = true
       end
@@ -274,11 +656,14 @@ module Samagotchi
         return PairBoundary::CHI_WEB if @web && code.match?(@web)
         return PairBoundary::SECRET if subst && code.match?(PairBoundary::SECRET_TEXT)
 
-        @read_only = ReadOnlyShell.read_only?(@text)
+        read_only = ReadOnlyShell.read_only_parts(tokens)
         walk = ShellPaths::Walk.new(@cwd, @home, ENV)
         ShellLex.simple_commands(tokens).each do |words|
           next walk.step(words) if words.is_a?(Symbol)
 
+          # A path the command names counts as written (mise's config, git's
+          # hooks) unless the part of it holding this command only reads.
+          @read_only = read_only.shift
           reason = words_refusal(words) || scripts_refusal(words) || paths_refusal(words, walk.step(words))
           return reason if reason
         end
@@ -291,20 +676,60 @@ module Samagotchi
         return PairBoundary::CHI if chi_in_values?(words)
         return PairBoundary::VERB if at && unplain_program?(words[at])
 
-        program = at && File.basename(words[at])
+        program = at && ShellLex.program_name(words[at])
         args = at ? words[(at + 1)..] : []
         return PairBoundary::CHI if program == "chi" && !CHI_ALLOWED.include?(args)
 
         upto = at ? words[0..at] : words
-        return PairBoundary::BACKGROUND if upto.any? { |w| DETACHERS.include?(File.basename(w)) } || detached_session?(program, args)
+        return PairBoundary::BACKGROUND if upto.any? { |w| DETACHERS.include?(ShellLex.program_name(w)) } || detached_session?(program, args)
         return PairBoundary::ENVIRONMENT if env_reader?(program, args) || bare_env?(words)
-        return PairBoundary::GIT_CONFIG if program == "git" && git_runs_commands?(args)
+
+        program, args = PairCommand.git_form(program, args)
+        return PairBoundary::GIT_CONFIG if git_config_env?(words) || git_alias?(program, args)
+
+        handed_commands(words).each do |script|
+          reason = nested_refusal(script)
+          return reason if reason
+        end
+        reason = deferred_refusal(words)
+        return reason if reason
+
+        if program == "git"
+          # xargs adds words of its input: a git config it runs may write
+          xargs = words[0...at].any? { |word| ShellLex.program_name(word) == "xargs" }
+          reason = git_refusal(args, appended: xargs) || git_command_refusal(args)
+          return reason if reason
+        end
+        unless @read_only
+          net = net_hit?(words, at, program == "git")
+          return PairBoundary::UNREADABLE if net == :too_many
+
+          @net ||= net
+        end
+        return PairBoundary::GIT_HOOKS if hook_installer?(words)
         return PairBoundary::OPENER if opener?(program, args)
         return PairBoundary::LISTENER if listener?(program, args)
 
+        exec_commands(args).each do |command|
+          reason = words_refusal(command)
+          return reason if reason
+        end
         nil
       end
 
+      # The commands find runs (-exec, -execdir, -ok, -okdir … ; or +):
+      # judged as commands of their own.
+      def exec_commands(args)
+        found = []
+        args.each_with_index do |arg, at|
+          next unless %w[-exec -execdir -ok -okdir].include?(arg)
+
+          command = args[(at + 1)..].take_while { |word| !%w[; \\; +].include?(word) }
+          found << command unless command.empty?
+        end
+        found
+      end
+
       # open, xdg-open, a browser, gio open; osascript's open location is
       # its script's (#script_text_refusal).
       def opener?(program, args)
@@ -350,12 +775,11 @@ module Samagotchi
       def scripts_refusal(words)
         limit = program_at(words) || (words.size - 1)
         at = (0..limit).find { |i| runner?(words[i]) } or return nil
-        program = File.basename(words[at])
+        program = ShellLex.program_name(words[at])
         scripts(words, at).each do |script|
           reason = if SHELLS.include?(program) || program == "eval"
-                     inner = nested(script)
-                     inner.refusal.tap { @mise_config = true if inner.mise_config_write? }
-                   elsif INTERPRETERS.include?(program)
+                     nested_refusal(script)
+                   elsif PairCommand.interpreter?(program)
                      @mise_config = true if script.match?(MISE_CONFIG_TEXT)
                      script_text_refusal(script)
                    end
@@ -364,20 +788,18 @@ module Samagotchi
         nil
       end
 
-      def runner?(word)
-        name = File.basename(word)
-        SHELLS.include?(name) || INTERPRETERS.include?(name) || name == "eval"
-      end
+      def runner?(word) = PairCommand.runner?(word)
 
       def scripts(words, at)
+        name = ShellLex.program_name(words[at])
         found = []
-        found << words[(at + 1)..].join(" ") if File.basename(words[at]) == "eval"
+        found << words[(at + 1)..].join(" ") if name == "eval"
         words.each_with_index do |word, i|
           next if i.zero? || word == ShellLex::HEREDOC
 
-          previous = words[i - 1]
-          found << word if previous.start_with?("<<") || (i > at && %w[-c -e].include?(previous))
+          found << word if words[i - 1].start_with?("<<")
         end
+        found.concat(PairCommand.code_scripts(name, words[(at + 1)..])) unless name == "eval"
         found
       end
 
@@ -388,27 +810,12 @@ module Samagotchi
         return PairBoundary::BACKGROUND if script.match?(SCRIPT_BACKGROUND_TEXT)
         return PairBoundary::OPENER if script.match?(SCRIPT_OPENER_TEXT)
         return PairBoundary::LISTENER if script.match?(SCRIPT_LISTEN_TEXT)
+        return PairBoundary::GIT_CONFIG if script.match?(SCRIPT_GIT_CONFIG_TEXT)
 
         nil
       end
 
-      # Where the program is in +words+: past assignments, wrappers, shell
-      # keywords and their options (and an option's value: ruby -I lib,
-      # timeout 10).
-      def program_at(words)
-        at = 0
-        at += 1 while at < words.size && skipped?(words, at)
-        at < words.size ? at : nil
-      end
-
-      def skipped?(words, at)
-        word = words[at]
-        return true if word.match?(/\A[A-Za-z_]\w*=/) || word.start_with?("-") || word.match?(/\A\d+[smhd]?\z/)
-        return true if WRAPPERS.include?(File.basename(word))
-
-        previous = at.positive? ? words[at - 1] : nil
-        !previous.nil? && previous.match?(/\A-[IrCen]\z/)
-      end
+      def program_at(words) = PairCommand.program_at(words)
 
       # screen -d…, tmux new -d: a session left running.
       def detached_session?(program, args)
@@ -442,43 +849,330 @@ module Samagotchi
         end
       end
 
-      # env with no command after it prints the environment.
+      # env with no command after it prints the environment, wherever it
+      # stands among the wrappers (sudo env, mise exec -- env, env -u X);
+      # env -S S runs S (#text_commands), but env followed by options and
+      # assignments only still counts (env -S 'X=1 git log' too).
       def bare_env?(words)
         assignment = ->(word) { word.start_with?("-") || word.match?(/\A[A-Za-z_]\w*=/) }
         at = words.index { |word| !assignment.call(word) }
-        return false unless at && File.basename(words[at]) == "env"
+        return true if at && ShellLex.program?(words[at], "env") && words[(at + 1)..].all?(&assignment)
+
+        return false unless program_at(words).nil? && text_commands(words).empty?
+
+        # the last env, followed by its options and assignments only: no program
+        # (a wrapper that is a program of its own counts: env X=1 ruby -e …)
+        at = words.rindex { |word| ShellLex.program?(word, "env") } or return false
+        i = at + 1
+        while i < words.size
+          word = words[i]
+          if word.match?(/\A[A-Za-z_]\w*=/) then i += 1
+          elsif word.start_with?("-") then i += PairCommand.option_width("env", word)
+          else return false
+          end
+        end
+        true
+      end
+
+      # Why a git command is refused: a config write (anything but a read
+      # .git_config_read? holds for, git -c and --config-env whatever they
+      # set, a clone's, init's or submodule's -c/--config: GIT_CONFIG) or a
+      # template (--template: its hooks, GIT_HOOKS); nil for the rest.
+      def git_refusal(args, appended: false)
+        starts = PairCommand.git_command_starts(args)
+        return PairBoundary::GIT_CONFIG if starts.include?(:config_option)
+
+        starts.each do |i|
+          reason = git_command_refusal_at(args[i], args[(i + 1)..] || [], appended: appended)
+          return reason if reason
+        end
+        nil
+      end
+
+      def git_command_refusal_at(command, rest, appended:)
+        return (!appended && git_config_read?(rest) ? nil : PairBoundary::GIT_CONFIG) if command == "config"
+        return nil unless GIT_SEEDING.include?(command)
+        return PairBoundary::GIT_CONFIG if rest.any? { |arg| arg.match?(GIT_SEED_CONFIG) }
+
+        rest.any? { |arg| arg.match?(GIT_SEED_TEMPLATE) } ? PairBoundary::GIT_HOOKS : nil
+      end
+
+      # Whether git config's arguments (+rest+) only read, every word
+      # accounted for: a read action or subcommand (GIT_CONFIG_READ_ACTIONS,
+      # GIT_CONFIG_READS) or a lone key, the flags and value options a read
+      # may carry (exact spellings), and as many words as the action takes.
+      # Anything else (an unknown or abbreviated option, a value option at
+      # the end, a word too many) is a write.
+      def git_config_read?(rest)
+        actions = []
+        positional = []
+        skip = false
+        rest.each do |arg|
+          next skip = false if skip
+
+          if arg.start_with?("-") && arg != "-"
+            if GIT_CONFIG_READ_ACTIONS.include?(arg) then actions << arg
+            elsif GIT_CONFIG_READ_VALUES.include?(arg) then skip = true
+            elsif !GIT_CONFIG_READ_FLAGS.include?(arg) && !GIT_CONFIG_READ_VALUES.include?(arg[/\A[^=]+(?==)/])
+              return false
+            end
+          else
+            positional << arg
+          end
+        end
+        return false if skip
+
+        if GIT_CONFIG_READS.include?(positional.first)
+          return false unless actions.empty?
+
+          actions << positional.shift
+        end
+        return positional.size == 1 && !GIT_CONFIG_WRITES.include?(positional.first) if actions.empty?
+        return false unless actions.size == 1
+
+        GIT_CONFIG_READ_ARITY.fetch(actions.first, 1..2).cover?(positional.size)
+      end
+
+      # The commands a git command runs now, handed to it as text (a
+      # submodule foreach's, a rebase --exec's, a filter's, an --upload-pack,
+      # an ext:: URL…; GIT_COMMAND_OPTIONS): read as commands of their own.
+      def git_commands(args)
+        PairCommand.git_command_starts(args).grep(Integer).flat_map do |i|
+          git_commands_at(args[i], args[(i + 1)..] || [])
+        end
+      end
+
+      def git_commands_at(command, rest)
+        found = rest.filter_map { |arg| arg.delete_prefix("ext::") if arg.start_with?("ext::") }
+        found << rest.drop_while { |arg| arg != "foreach" }.drop(1).reject { |arg| arg.start_with?("-") }.join(" ") if
+          command == "submodule" && rest.include?("foreach")
+        found << rest.drop_while { |arg| arg != "run" }.drop(1).join(" ") if command == "bisect" && rest.include?("run")
+        rest.each_with_index do |arg, at|
+          name, value = arg.split("=", 2)
+          next unless GIT_COMMAND_OPTIONS.include?(name) || (%w[-x -u].include?(name) && GIT_COMMAND_SHORT.include?(command))
+
+          found << (value || rest[at + 1].to_s)
+        end
+        found
+      end
+
+      # A command a git command runs now (.git_commands), refused as its
+      # own command would be.
+      def git_command_refusal(args)
+        git_commands(args).each do |script|
+          reason = nested_refusal(script)
+          return reason if reason
+        end
+        nil
+      end
+
+      # alias g=git (or a function's body naming git), then `g config …`:
+      # git under another name; an alias naming git is refused.
+      def git_alias?(program, args)
+        program == "alias" && args.any? { |arg| arg.match?(%r{=['"]?(?:\S*/)?git(?:\s|['"]?\z)}i) }
+      end
+
+      # An assignment (a prefix, export's, env's) of a variable that hands
+      # git config or a template of its own (ShellGitDirs::CONFIG_ENV): what
+      # it sets may run a command, as git -c's may.
+      def git_config_env?(words)
+        words.any? { |word| word[/\A([A-Za-z_]\w*)=/, 1].to_s.match?(ShellGitDirs::CONFIG_ENV) }
+      end
+
+      # The commands a simple command's assignments hand a program
+      # (COMMAND_ENV: GIT_EDITOR='…' git commit, export GIT_PAGER=…).
+      def env_commands(words)
+        words.filter_map do |word|
+          name, value = word.match(/\A([A-Za-z_]\w*)=(.+)\z/m)&.captures
+          value if COMMAND_ENV.include?(name)
+        end
+      end
+
+      # The values a real assignment gives (a prefix, a command of
+      # assignments, ASSIGNERS' words) that keep a $(…), ${ …; } or
+      # backticks as text (DEFERRED_SUBST, $'\x24(…)' too): the shell expands
+      # them later (PS4 under bash -x, PS0/PS1, a prompt).
+      def deferred_values(words)
+        at = program_at(words)
+        assigns = at.nil? || ASSIGNERS.include?(ShellLex.program_name(words[at]))
+        words.each_with_index.filter_map do |word, i|
+          name, value = word.match(/\A([A-Za-z_]\w*)=(.+)\z/m)&.captures
+          value if name && !COMMAND_ENV.include?(name) && value.match?(DEFERRED_SUBST) && (assigns || i < at)
+        end
+      end
+
+      # A deferred value (#deferred_values) read as the commands its $(…)
+      # would run (DEFERRED_PARTS cut into separators): refused for what that
+      # read finds (git config, chi, a secret…), else the owner approves it
+      # (#net_ask?): a value the shell expands later is no command chi can
+      # read for sure.
+      def deferred_refusal(words)
+        deferred_values(words).each do |value|
+          @net = true
+          script = value.sub(/\A\$(?=\\)/, "").gsub(DEFERRED_ESCAPES) { |escape| escape.end_with?("4") ? "$" : "`" }
+          reason = nested_refusal(script.gsub(DEFERRED_PARTS, " ; "))
+          return reason if reason && ![PairBoundary::UNREADABLE, PairBoundary::VERB].include?(reason)
+        end
+        nil
+      end
+
+      # A nested command's refusal (#nested), what it asks (#net_ask?,
+      # #mise_config_write?) carried to this one.
+      def nested_refusal(script)
+        inner = nested(script)
+        inner.refusal.tap do
+          @mise_config = true if inner.mise_config_write?
+          @net = true if inner.net_ask?
+        end
+      end
 
-        words[(at + 1)..].all?(&assignment)
+      # The commands a simple command hands on as text, read as commands of
+      # their own: its assignments' (#env_commands) and the wrappers' and
+      # runners' that take a command line (#text_commands).
+      def handed_commands(words) = env_commands(words) + text_commands(words)
+
+      # The command lines the wrappers and the program take as text: env -S
+      # S, script -c S, ssh's (scp's, sftp's) -o ProxyCommand=S (and
+      # LocalCommand, KnownHostsCommand: run here), and the runners that run
+      # their arguments as command lines (TEXT_RUNNERS: hyperfine, parallel,
+      # watch).
+      def text_commands(words)
+        upto = program_at(words) || (words.size - 1)
+        (0..upto).flat_map do |i|
+          next [] if words[i].include?("\0")
+
+          name = ShellLex.program_name(words[i])
+          next [] unless TEXT_TAKERS.include?(name)
+
+          rest = words[(i + 1)..]
+          case name
+          when "env" then option_values(rest, %w[-S --split-string], cluster: "S")
+          when "script" then option_values(rest, %w[-c --command])
+          when "npx" then option_values(rest, %w[-c --call])
+          when "npm" then %w[exec x].include?(rest.first) ? option_values(rest.drop(1), %w[-c --call]) : []
+          when "rsync" then rsync_commands(rest)
+          when "ssh", "scp", "sftp" then ssh_commands(rest)
+          else text_runner_commands(name, rest)
+          end
+        end
       end
 
-      # git config beyond the repository (--global, --system), or a setting
-      # that runs a command (core.hooksPath, core.fsmonitor, core.sshCommand,
-      # core.pager, core.editor, a "!" alias), set with git config or git -c.
-      def git_runs_commands?(args)
-        i = 0
-        while i < args.size && args[i].start_with?("-")
-          if args[i] == "-c"
-            return true if running_setting?(*args[i + 1].to_s.split("=", 2))
+      # The values of +options+ among the options at +rest+'s start (the next
+      # word, after = for a long one, the rest of a -S… word for +cluster+).
+      def option_values(rest, options, cluster: nil)
+        found = []
+        rest.each_with_index do |word, i|
+          break unless word.start_with?("-")
+
+          option, value = word.split("=", 2)
+          if options.include?(word) then found << rest[i + 1]
+          elsif option.start_with?("--") && options.include?(option) then found << value
+          elsif cluster && !word.start_with?("--") && (at = word.index(cluster, 1))
+            tail = word[(at + 1)..]
+            found << (tail.empty? ? rest[i + 1] : tail)
+          end
+        end
+        found.compact
+      end
+
+      # rsync's remote shell (-e S, a cluster ending in it -avze S, --rsh=S):
+      # it runs here.
+      def rsync_commands(rest)
+        rest.each_with_index.filter_map do |word, i|
+          if word.start_with?("--rsh=") then word.delete_prefix("--rsh=")
+          elsif word == "--rsh" then rest[i + 1]
+          elsif (cluster = word[/\A-[A-Za-z]*?e(.*)\z/m, 1]) && !word.start_with?("--")
+            cluster.empty? ? rest[i + 1] : cluster
+          end
+        end
+      end
+
+      # ssh's -o options that run a command on this machine.
+      def ssh_commands(rest)
+        rest.each_with_index.filter_map do |word, i|
+          option = if word == "-o" then rest[i + 1].to_s
+                   elsif word.start_with?("-o") then word[2..]
+                   end
+          option.to_s[SSH_COMMAND_OPTION, 1]
+        end
+      end
+
+      # hyperfine's arguments, each a command line (its options' values
+      # too: harmless as commands); parallel's and watch's words before
+      # parallel's ::: as one command line.
+      def text_runner_commands(name, rest)
+        words = rest.take_while { |word| !word.start_with?(":::") }.reject { |word| word.start_with?("-") }
+        return words if name == "hyperfine"
+
+        words.empty? ? [] : [words.join(" ")]
+      end
 
-            i += 2
-          elsif GIT_VALUE_OPTIONS.include?(args[i])
-            i += 2
+      # A fail-closed net for a runner no table knows (a wrapper's option
+      # read wrong, a package runner): any word but the program's (a
+      # wrapper's or an option's value too) that names git is read as git
+      # from there, one naming chi with a chi command after it (CHI_COMMANDS)
+      # counts, and a command line starting with git or chi (the program
+      # word too) is read as a command. A hit asks the owner (#net_ask?),
+      # never refuses: chi can't tell such a word runs. A git command
+      # (+git+) is read as git; only the words before it are netted.
+      # More than NET_GITS such words is :too_many (UNREADABLE): each is
+      # read through the rest of the words.
+      def net_hit?(words, at, git)
+        gits = 0
+        last = git ? at - 1 : words.size - 1
+        (0..last).any? do |i|
+          word = words[i]
+          next false if word.include?("\0")
+
+          if word.match?(/\s/)
+            head = word.strip.split(/\s+/).first.to_s
+            next false unless ShellLex.program?(head, "git") || ShellLex.program?(head, "chi")
+            return :too_many if (gits += 1) > NET_GITS
+
+            next !nested_refusal(word).nil?
+          end
+          next false if i == at
+
+          program, = PairCommand.git_form(ShellLex.program_name(word), [])
+          if program == "git"
+            return :too_many if (gits += 1) > NET_GITS
+
+            _, rest = PairCommand.git_form(ShellLex.program_name(word), words[(i + 1)..])
+            !(git_refusal(rest) || git_command_refusal(rest)).nil?
           else
-            i += 1
+            program == "chi" && chi_call?(words[i + 1])
           end
         end
-        return false unless args[i] == "config"
+      end
 
-        rest = args[(i + 1)..]
-        return true if rest.any? { |arg| GIT_WIDE_SCOPES.include?(arg) }
+      # Whether the word after a chi word makes a chi call: a chi command
+      # (CHI_COMMANDS) or an option but --version/--help (chi -p "…").
+      def chi_call?(first)
+        return false if first.nil?
+        return !CHI_ALLOWED.flatten.include?(first) if first.start_with?("-")
 
-        key, value = rest.reject { |arg| arg.start_with?("-") }
-        running_setting?(key, value)
+        CHI_COMMANDS.include?(first)
       end
 
-      def running_setting?(key, value)
-        key = key.to_s.downcase
-        GIT_RUNNING_KEYS.include?(key) || (key.start_with?("alias.") && value.to_s.lstrip.start_with?("!"))
+      # Whether a command a simple command hands on (#handed_commands) may
+      # write outside, read as a command of its own.
+      def handed_command_outside?
+        ShellLex.simple_commands(ShellLex.lex(@text)).any? do |words|
+          words.is_a?(Array) && handed_commands(words).any? { |script| nested(script).outside_writes? }
+        end
+      end
+
+      # A hook installer (HOOK_INSTALLERS: pre-commit install, husky,
+      # lefthook install…), wherever it stands among the wrappers (npx husky).
+      def hook_installer?(words)
+        at = program_at(words) or return false
+        (0..at).any? do |i|
+          name = ShellLex.program_name(words[i])
+          next false unless HOOK_INSTALLERS.key?(name)
+
+          verbs = HOOK_INSTALLERS[name]
+          verbs.nil? || words[(i + 1)..].intersect?(verbs)
+        end
       end
 
       # The secrets a simple command's words reach: a resolved path on the
@@ -486,7 +1180,7 @@ module Samagotchi
       # denied dir; a $var word whose fixed part does; a sweeper given a
       # folder above a denied one; SECRET_TEXT for a word it can't read.
       def paths_refusal(words, resolved)
-        program_word = (at = program_at(words)) && File.basename(words[at])
+        program_word = (at = program_at(words)) && ShellLex.program_name(words[at])
         resolved.each do |word, path|
           return PairBoundary::GIT_HOOKS if !@read_only && PairCommand.git_hook?(path || word)
 
@@ -544,13 +1238,13 @@ module Samagotchi
 
       def link_command?(words)
         at = program_at(words)
-        program = at && File.basename(words[at])
+        program = at && ShellLex.program_name(words[at])
         return true if LINKERS.include?(program)
         return true if program == "cp" && words[(at + 1)..].any? { |arg| arg.match?(CP_LINK_OPTION) }
-        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && LINKERS.include?(File.basename(word)) }
+        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && LINKERS.include?(ShellLex.program_name(word)) }
 
         runner = (0..(at || (words.size - 1))).find { |i| runner?(words[i]) } or return false
-        name = File.basename(words[runner])
+        name = ShellLex.program_name(words[runner])
         scripts(words, runner).any? do |script|
           SHELLS.include?(name) || name == "eval" ? nested(script).links? : script.match?(SCRIPT_LINK_TEXT)
         end
@@ -558,11 +1252,12 @@ module Samagotchi
 
       def env_loader_command?(words)
         at = program_at(words)
-        return true if at && ENV_LOADERS.include?(File.basename(words[at]))
-        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && ENV_LOADERS.include?(File.basename(word)) }
+        # wherever it stands among the wrappers too (mise exec -- env)
+        return true if words[0..at].any? { |word| ENV_LOADERS.any? { |name| ShellLex.program?(word, name) } }
+        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && ENV_LOADERS.include?(ShellLex.program_name(word)) }
 
         runner = (0..(at || (words.size - 1))).find { |i| runner?(words[i]) } or return false
-        name = File.basename(words[runner])
+        name = ShellLex.program_name(words[runner])
         scripts(words, runner).any? do |script|
           SHELLS.include?(name) || name == "eval" ? nested(script).loads_env? : script.match?(ENV_LOADER_TEXT)
         end
@@ -591,12 +1286,59 @@ module Samagotchi
         return false if tokens.any? { |_, value| value.include?(ShellLex::SUBST) } && !substs_messages_only?
 
         walk = ShellPaths::Walk.new(@cwd, @home, ENV)
+        piped = ShellLex.piped_flags(tokens)
         ShellLex.simple_commands(tokens).all? do |words|
           next walk.step(words) if words.is_a?(Symbol)
 
+          stdin = PairCommand.script_source(words, piped: piped.shift) == :stdin || git_hands_command?(words)
           walk.dirs.all? { |dir| dir && writable?(dir) } && words_inside?(words, walk) &&
-            scripts_inside?(words).tap { walk.step(words) }
+            !implicit_outside?(words, walk) && !stdin && scripts_inside?(words).tap { walk.step(words) }
+        end
+      end
+
+      # A program that writes to its own place outside with no word naming
+      # it (ImplicitWriters: npm -g, gem install, brew, defaults write, …),
+      # wherever it stands among the wrappers (sudo npm, bundle config),
+      # python -m's module as the program, under the assignments before it
+      # (npm_config_global=true).
+      def implicit_outside?(words, walk)
+        at = program_at(words) or return false
+        assigned = words[0...at].filter_map { |word| word.split("=", 2) if word.match?(/\A[A-Za-z_]\w*=/) }.to_h
+        (0..at).any? do |i|
+          program = words[i]
+          args = words[(i + 1)..]
+          local = project_program?(walk, program)
+          if PairCommand.interpreter?(ShellLex.program_name(program)) && (module_args = module_run(args))
+            program, args = module_args
+          end
+          ImplicitWriters.outside?(program, args, local: local, assigned: assigned)
+        end
+      end
+
+      # An interpreter's -m module and the words after it ([name, args]):
+      # -m pip, -mpip; nil without one.
+      def module_run(args)
+        args.each_with_index do |arg, i|
+          return [args[i + 1], args[(i + 2)..]] if arg == "-m" && args[i + 1]
+          return [arg.delete_prefix("-m"), args[(i + 1)..]] if arg.match?(/\A-m\w/)
         end
+        nil
+      end
+
+      # Whether a git command runs a command now that it is handed as text
+      # (.git_commands): where it writes isn't placed, so it asks.
+      def git_hands_command?(words)
+        at = program_at(words) or return false
+        program, args = PairCommand.git_form(ShellLex.program_name(words[at]), words[(at + 1)..])
+        program == "git" && !git_commands(args).empty?
+      end
+
+      # Whether a program's word is a path into the project (.venv/bin/pip).
+      def project_program?(walk, word)
+        return false unless word.include?("/")
+
+        paths = walk.paths(word)
+        !paths.empty? && paths.all? { |path| Outside.inside?(path, root: @root) }
       end
 
       # Whether every $(…) is a message's heredoc (its body cut as data).
@@ -610,10 +1352,10 @@ module Samagotchi
       def words_inside?(words, walk)
         at = program_at(words)
         # xargs runs its program on paths it reads from its input
-        return false if at && words[0...at].any? { |word| File.basename(word) == "xargs" }
+        return false if at && words[0...at].any? { |word| ShellLex.program_name(word) == "xargs" }
 
         words.each_with_index.all? do |word, i|
-          next true if at && (i == at || (i < at && WRAPPERS.include?(File.basename(word))))
+          next true if at && (i == at || (i < at && WRAPPERS.include?(ShellLex.program_name(word))))
           next true if LIST_VARIABLES.any? { |name| word.start_with?("#{name}=") }
 
           word_inside?(walk, word)
@@ -657,7 +1399,7 @@ module Samagotchi
       def scripts_inside?(words)
         limit = program_at(words) || (words.size - 1)
         at = (0..limit).find { |i| runner?(words[i]) } or return true
-        program = File.basename(words[at])
+        program = ShellLex.program_name(words[at])
         scripts(words, at).all? do |script|
           if SHELLS.include?(program) || program == "eval"
             !nested(script).outside_writes?