samagotchi 0.134.0 → 0.136.0

data/lib/samagotchi/guardrails/pair_command.rb

@@ -39,35 +39,70 @@ module Samagotchi
     class PairCommand
       # What runs a command on another's behalf, and the shell's keywords
       # before a command: skipped to find the program.
-      WRAPPERS = %w[env exec command nohup time sudo nice xargs setsid timeout stdbuf caffeinate bundle ruby watch npx
-                    { ! then do else elif if while until].freeze
+      WRAPPERS = %w[env exec command builtin nohup time sudo nice xargs setsid timeout stdbuf caffeinate bundle ruby
+                    watch npx bunx uvx xcrun arch script { ! then do else elif if while until].freeze
+      # Wrappers by two words: the program after `uv run`, `pnpm exec` …
+      SUBCOMMAND_WRAPPERS = { "uv" => %w[run], "poetry" => %w[run], "pdm" => %w[run], "hatch" => %w[run],
+                              "pipx" => %w[run], "pnpm" => %w[exec dlx], "yarn" => %w[exec dlx], "npm" => %w[exec x],
+                              "bun" => %w[x], "mise" => %w[exec x] }.freeze
+      # A wrapper's options whose value is the next word (.program_at): not
+      # the program (env -u X git, sudo -u root git, timeout -s KILL 5 git).
+      WRAPPER_VALUES = { "env" => %w[-u --unset -C --chdir -P -S --split-string], "exec" => %w[-a],
+                         "sudo" => %w[-u -g -h -p -C -D -R -T -U -r -t --user --group --host --prompt --chdir],
+                         "timeout" => %w[-s --signal -k --kill-after], "nice" => %w[--adjustment],
+                         "xargs" => %w[-L -P -s -d -E -a --max-args --max-procs --delimiter --arg-file],
+                         "stdbuf" => %w[-i -o --input --output --error], "caffeinate" => %w[-t -w],
+                         "watch" => %w[--interval], "arch" => %w[-arch -d], "xcrun" => %w[-sdk --sdk --toolchain],
+                         "script" => %w[-t -T -B -I -O -c --command], "npx" => %w[-c --call -p --package],
+                         "npm" => %w[-c --call -p --package -w --workspace] }.freeze
+      # A wrapper's flags the generic -I/-r/-C/-e/-n rule would read as
+      # taking a value (xcrun -r is --run, sudo -n non-interactive; macOS's
+      # script -F is a flag too: not in WRAPPER_VALUES).
+      WRAPPER_FLAGS = { "xcrun" => %w[-r -n -l -v -f -k], "sudo" => %w[-n -E -H -i -s -k -b -P -S -A -e -l -v -K -B],
+                        "env" => %w[-i -0 -v] }.freeze
       # chi's own invocations a pair turn may run: they print and exit.
       CHI_ALLOWED = [%w[--version], %w[--help]].freeze
-      # chi named in a script, a value or an argument.
-      CHI_TEXT = %r{(?:\A|[\s;&|(`'"=])(?:[^\s;&|(`'"=]*/)?chi(?=\s|\z|[;&|)`'"])}
+      # chi named in a script, a value or an argument, in any case (CHI runs
+      # chi on a case-insensitive disk: ShellLex.program_name).
+      CHI_TEXT = %r{(?:\A|[\s;&|(`'"=])(?:[^\s;&|(`'"=]*/)?chi(?=\s|\z|[;&|)`'"])}i
       SHELLS = %w[sh bash zsh dash fish ksh].freeze
       # Other interpreters a script can be handed to (-e/-c, a heredoc), by
       # name in any version's spelling (python3.12, pypy3, ruby3.3, perl5.36).
       INTERPRETER = /\A(?:python\d*(?:\.\d+)?|pypy\d*(?:\.\d+)?|ruby\d*(?:\.\d+)?|irb|node(?:js)?|deno|bun|
-                      perl\d*(?:\.\d+)*|php\d*(?:\.\d+)?|lua(?:jit|\d*(?:\.\d+)?)|osascript|jshell|Rscript|
-                      tclsh\d*(?:\.\d+)?|wish)\z/x
+                      perl\d*(?:\.\d+)*|php\d*(?:\.\d+)?|lua(?:jit|\d*(?:\.\d+)?)|osascript|jshell|rscript|
+                      tclsh\d*(?:\.\d+)?|wish|jruby|raku|julia)\z/x
       # The options whose next word is an interpreter's code, by its name's
       # start (a shell's is -c only: its -e and -x are flags); others: -c, -e.
       CODE_FLAGS = { "python" => %w[-c], "pypy" => %w[-c], "ruby" => %w[-e], "irb" => %w[-e],
                      "node" => %w[-e -p --eval --print], "bun" => %w[-e -p --eval --print], "perl" => %w[-e -E],
-                     "php" => %w[-r], "lua" => %w[-e], "osascript" => %w[-e], "Rscript" => %w[-e],
+                     "php" => %w[-r -B -R -E], "lua" => %w[-e], "osascript" => %w[-e], "rscript" => %w[-e],
+                     "jruby" => %w[-e], "raku" => %w[-e], "julia" => %w[-e],
                      "tclsh" => [], "wish" => [], "deno" => [], "jshell" => [] }.freeze
       # How an interpreter's short-option cluster reads (ruby -we, perl -le,
       # python3 -Ic), by its name's start: the letters whose value is the
       # rest of the word (ruby -rset: no code), and those that take digits
       # (perl -l0e). Any other letter is a flag; the code letter's code is
       # the rest of the word, or the next word (.cluster_code_at).
+      # perl's -d takes only :Module (perl -de: -d -e).
       CLUSTER_VALUES = { "python" => %w[mWX], "pypy" => %w[mWX], "ruby" => %w[CEFiIrx 0W],
-                         "perl" => %w[CdDFiImMx 0l], "node" => %w[r], "bun" => %w[r], "lua" => %w[l] }.freeze
+                         "perl" => %w[CDFiImMx 0l], "node" => %w[r], "bun" => %w[r], "lua" => %w[l] }.freeze
+      # More value letters, told only for where a script comes from
+      # (.script_source: php -dr x.php and osascript -le x run the file x, so
+      # SelfProtect counts it unseen; perl -d… runs .perldb from the dir it
+      # is in); a pair turn still reads the word after them as code too (an
+      # over-read: more refusals, never fewer).
+      SOURCE_CLUSTER_VALUES = CLUSTER_VALUES.merge("php" => %w[cdfz], "osascript" => %w[ls],
+                                                   "perl" => %w[CdDFiImMx 0l]).freeze
       # A shell's options whose next word is their value, not its script.
       SHELL_VALUE_OPTIONS = %w[-o +o -O +O].freeze
+      # fish's long options that take a command (the next word, or after =),
+      # with the shortest prefix fish's getopt may take for each (--comm,
+      # --init): its script (--command) or one run before it (--init-command,
+      # and -C anywhere in a cluster, its value attached or the next word;
+      # not where its script comes from: .script_source).
+      FISH_COMMAND_OPTIONS = { "--command" => 3, "--init-command" => 4 }.freeze
       # Options whose next word is code or a command, for any program.
-      CODE_OPTIONS = %w[-c -e -exec --exec -execdir --command --eval -x].freeze
+      CODE_OPTIONS = %w[-c -e -exec --exec -execdir --command --init-command --eval -x].freeze
       # A shell's or interpreter's options whose next word is a value, not
       # its script (#stdin_script?).
       RUNNER_VALUE_OPTIONS = %w[-o +o -O +O -W -X -I -r --require --import --loader -C].freeze
@@ -82,7 +117,7 @@ module Samagotchi
       # key), by the program and the words that say so in its arguments.
       # Programs that load a project's env files (PairBoundary::ENV_LOADER).
       ENV_LOADERS = %w[mise direnv].freeze
-      ENV_LOADER_TEXT = %r{(?<![\w./-])(?:mise|direnv)(?![\w./-])}
+      ENV_LOADER_TEXT = %r{(?<![\w./-])(?:mise|direnv)(?![\w./-])}i
       CREDENTIAL_PRINTERS = {
         "gh" => [%w[auth token]],
         "git" => [%w[credential], %w[credential-osxkeychain], %w[credential-store], %w[credential-cache],
@@ -122,11 +157,12 @@ module Samagotchi
       LOOPBACK_HOSTS = [/(?:[\w-]+\.)*localhost\.?/, /127(?:\.\d{1,3}){1,3}/, /0\.0\.0\.0/,
                         /\[?(?:0{0,4}:){2,7}0{0,3}1\]?/, /\[?::ffff:127(?:\.\d{1,3}){3}\]?/].freeze
       # An interpreter's script that reads the environment or detaches.
-      SCRIPT_ENV_TEXT = /\bos\.environ\b|\bgetenv\b|\bprocess\.env\b|\bENV\b|\bprintenv\b|%ENV\b/
+      SCRIPT_ENV_TEXT = /\bos\.environ\b|\bgetenv\b|\bprocess\.env\b|\bENV\b|(?i:\bprintenv\b)|%ENV\b/
       # An interpreter's script that runs git config or git -c (by its text:
-      # the script isn't parsed).
-      SCRIPT_GIT_CONFIG_TEXT = /\bgit\b[^\n]{0,40}?(?:\bconfig\b|["'\s]-c\b|--config-env|--template)/
-      SCRIPT_BACKGROUND_TEXT = /\b(?:nohup|setsid|disown|daemonize|Process\.daemon|detach(?:ed)?)\b/
+      # the script isn't parsed); git and the words in any case (GIT config),
+      # -c as it is (git -C dir sets nothing).
+      SCRIPT_GIT_CONFIG_TEXT = /(?i:\bgit\b)[^\n]{0,40}?(?:(?i:\bconfig\b)|["'\s]-c\b|(?i:--config-env|--template))/
+      SCRIPT_BACKGROUND_TEXT = /\b(?:(?i:nohup|setsid|disown|daemonize)|Process\.daemon|detach(?:ed)?)\b/
       # Programs that read a folder's whole tree: given home (or any folder
       # above a denied one) they reach the secrets in it.
       # A link to such a folder reaches them too (ln, link).
@@ -180,9 +216,31 @@ module Samagotchi
       # Variables whose value is a command a program runs through a shell
       # (git's diff driver, editor, pager, ssh, proxy, askpass; the editors
       # and pagers others run): read as an sh -c script, wherever the
-      # assignment stands (a prefix, export's, env's).
+      # assignment stands (a prefix, export's, env's); bash's PROMPT_COMMAND.
       COMMAND_ENV = %w[GIT_EXTERNAL_DIFF GIT_EDITOR EDITOR VISUAL GIT_SEQUENCE_EDITOR GIT_SSH_COMMAND GIT_SSH
-                       GIT_PROXY_COMMAND GIT_PAGER PAGER MANPAGER GIT_ASKPASS SSH_ASKPASS].freeze
+                       GIT_PROXY_COMMAND GIT_PAGER PAGER MANPAGER GIT_ASKPASS SSH_ASKPASS PROMPT_COMMAND].freeze
+      # A $(…) or backticks left as text in an assigned value (quoted: one
+      # that runs now is a SUBST): a shell expands it later, where the value
+      # is used (PS4 under bash -x, PS0/PS1, a prompt), so the value is read
+      # as a script too. Only a real assignment's: a prefix, a command of
+      # assignments, or ASSIGNERS' words (not grep 'X=$(…)').
+      DEFERRED_SUBST = /\$\(|`|\$\{[\s|]|\\(?:x24|044|x60|140)/
+      # A deferred value's escapes ($'\x24(…)') and the parts that open or
+      # close what it runs, cut into separators to read the commands inside.
+      DEFERRED_ESCAPES = /\\(?:x24|044|x60|140)/
+      DEFERRED_PARTS = /\$\(|\$\{(?=[\s|])|`|\)|\}/
+      ASSIGNERS = %w[export declare typeset readonly local env].freeze
+      # How many words naming git or chi the net reads (#net_hit?).
+      NET_GITS = 16
+      # Runners whose arguments are command lines they run through a shell,
+      # and every program #text_commands reads a command line of.
+      TEXT_RUNNERS = %w[hyperfine parallel watch].freeze
+      TEXT_TAKERS = (TEXT_RUNNERS + %w[env script npx npm rsync ssh scp sftp]).freeze
+      # chi's commands, for the net (#net_hit?): chi cp'd or listed isn't run.
+      CHI_COMMANDS = %w[sessions note broadcast context send answer share review bootstrap update models desktop
+                        memory bundle guardrails toolkit remote home web self].freeze
+      # An ssh -o option that runs a command on this machine, and its value.
+      SSH_COMMAND_OPTION = /\A\s*(?:ProxyCommand|LocalCommand|KnownHostsCommand)\s*[=\s]\s*(.+)\z/im
       # Devices a command may name in the project's stead.
       DEVICES = %w[/dev/null /dev/stdout /dev/stderr /dev/tty /dev/zero /dev/random /dev/urandom].freeze
       # A word that starts with $TMPDIR or ${TMPDIR}.
@@ -241,21 +299,37 @@ module Samagotchi
       # Where the program is in +words+: past assignments, wrappers, shell
       # keywords and their options (and an option's value: ruby -I lib,
       # timeout 10).
+      # A wrapper's options whose value is the next word (WRAPPER_VALUES, and
+      # -I/-r/-C/-e/-n for any), a two-word wrapper (uv run, pnpm exec:
+      # SUBCOMMAND_WRAPPERS), and script's typescript file before its command.
       def self.program_at(words)
         at = 0
-        at += 1 while at < words.size && skipped?(words, at)
+        wrapper = nil
+        file = false
+        while at < words.size
+          word = words[at]
+          if word.match?(/\A[A-Za-z_]\w*=/) || word.match?(/\A\d+[smhd]?\z/) then at += 1
+          elsif word.start_with?("-") then at += option_width(wrapper, word)
+          elsif wrapper == "script" && !file
+            at += 1
+            file = true
+          else
+            name = ShellLex.program_name(word)
+            if SUBCOMMAND_WRAPPERS.fetch(name, []).include?(words[at + 1]) then at += 2
+            elsif WRAPPERS.include?(name) then at += 1
+            else break
+            end
+            wrapper = name
+          end
+        end
         at < words.size ? at : nil
       end
 
-      def self.skipped?(words, at)
-        word = words[at]
-        return true if word.match?(/\A[A-Za-z_]\w*=/) || word.start_with?("-") || word.match?(/\A\d+[smhd]?\z/)
-        return true if WRAPPERS.include?(File.basename(word))
+      def self.option_width(wrapper, word)
+        return 1 if WRAPPER_FLAGS.fetch(wrapper, []).include?(word)
 
-        previous = at.positive? ? words[at - 1] : nil
-        !previous.nil? && previous.match?(/\A-[IrCen]\z/)
+        WRAPPER_VALUES.fetch(wrapper, []).include?(word) || word.match?(/\A-[IrCen]\z/) ? 2 : 1
       end
-      private_class_method :skipped?
 
       # Where git's subcommand may start in its +args+ (indices): past its
       # own options (GIT_FLAG_OPTIONS, GIT_VALUE_OPTIONS and their value,
@@ -295,15 +369,19 @@ module Samagotchi
       def self.runner?(word)
         return false if word.include?("\0")
 
-        name = File.basename(word)
+        name = ShellLex.program_name(word)
         SHELLS.include?(name) || interpreter?(name) || name == "eval"
       end
 
       # Whether +name+ (a word's basename) is an interpreter's (INTERPRETER).
       def self.interpreter?(name) = name.to_s.match?(INTERPRETER)
 
-      # The options whose next word is +name+'s code (CODE_FLAGS).
-      def self.code_flags(name)
+      # The options whose next word is +name+'s code (CODE_FLAGS); fish's
+      # --command too.
+      # With +source+ (.script_source) fish's --command is left out: what its
+      # script runs (a sourced file) SelfProtect can't see, as on a file.
+      def self.code_flags(name, source: false)
+        return source ? %w[-c] : %w[-c --command] if name == "fish"
         return %w[-c] if SHELLS.include?(name)
 
         CODE_FLAGS.find { |start, _| name.start_with?(start) }&.last || %w[-c -e]
@@ -313,29 +391,35 @@ module Samagotchi
       # one with its code after = (node --eval=…), or a short-option
       # cluster holding its code letter (.cluster_code_at: sh -ec, bash -cx,
       # ruby -we, perl -le, node -pe, python3 -Ic).
-      def self.code_flag?(name, word)
-        flags = code_flags(name)
-        flags.include?(word) || !long_code(name, word).nil? || !cluster_code_at(name, word).nil?
+      def self.code_flag?(name, word, source: false)
+        flags = code_flags(name, source: source)
+        flags.include?(word) || !long_code(name, word, source: source).nil? ||
+          !cluster_code_at(name, word, source: source).nil?
       end
 
       # The code a long code option carries after = (--eval=…), nil for
       # another word.
-      def self.long_code(name, word)
-        flag = code_flags(name).find { |option| option.start_with?("--") && word.start_with?("#{option}=") }
+      def self.long_code(name, word, source: false)
+        flag = code_flags(name, source: source).find { |option| option.start_with?("--") && word.start_with?("#{option}=") }
         flag && word.delete_prefix("#{flag}=")
       end
 
       # Where +word+, a short-option cluster, holds +name+'s code letter
       # (a shell's c, python's c, ruby's e, node's e and p…): its index, the
-      # letters before it read as CLUSTER_VALUES says; nil when it holds
-      # none, or a letter before it takes the rest as its value.
-      def self.cluster_code_at(name, word)
+      # letters before it read as CLUSTER_VALUES says (SOURCE_CLUSTER_VALUES
+      # with +source+); nil when it holds none, or a letter before it takes
+      # the rest as its value.
+      def self.cluster_code_at(name, word, source: false)
         return nil unless word.match?(/\A-[A-Za-z0-9]/)
 
-        letters = code_flags(name).filter_map { |flag| flag[1] if flag.match?(/\A-[A-Za-z]\z/) }.join
+        letters = code_flags(name, source: source).filter_map { |flag| flag[1] if flag.match?(/\A-[A-Za-z]\z/) }.join
         return nil if letters.empty?
 
-        rest, digits = SHELLS.include?(name) ? ["", ""] : cluster_values(name)
+        rest, digits = if SHELLS.include?(name)
+                         ["", ""]
+                       else
+                         cluster_values(name, source ? SOURCE_CLUSTER_VALUES : CLUSTER_VALUES)
+                       end
         i = 1
         while i < word.size
           char = word[i]
@@ -350,8 +434,8 @@ module Samagotchi
         nil
       end
 
-      def self.cluster_values(name)
-        values = CLUSTER_VALUES.find { |start, _| name.start_with?(start) }&.last || []
+      def self.cluster_values(name, table)
+        values = table.find { |start, _| name.start_with?(start) }&.last || []
         [values[0].to_s, values[1].to_s]
       end
       private_class_method :cluster_values
@@ -363,7 +447,7 @@ module Samagotchi
       # .code_flags, a long one's after =, a cluster's rest and the next
       # word: both are read when the rest isn't empty).
       def self.code_scripts(name, rest)
-        return shell_scripts(rest) if SHELLS.include?(name)
+        return shell_scripts(name, rest) if SHELLS.include?(name)
 
         found = []
         rest.each_with_index do |word, i|
@@ -377,8 +461,32 @@ module Samagotchi
         found
       end
 
-      def self.shell_scripts(rest)
-        start = rest.index { |word| cluster_code_at("sh", word) } or return []
+      # A shell's scripts: the one after its -c cluster (.shell_script_after),
+      # and fish's commands given by an option that takes one (FISH_COMMAND_OPTIONS:
+      # --command S, --comm=S, --init S, -C S, -C'S', -lC S).
+      def self.shell_scripts(name, rest)
+        found = name == "fish" ? fish_commands(rest) : []
+        start = rest.index { |word| cluster_code_at(name, word) }
+        found.concat(shell_script_after(rest, start)) if start
+        found.compact
+      end
+      private_class_method :shell_scripts
+
+      def self.fish_commands(rest)
+        rest.each_with_index.filter_map do |word, i|
+          option, value = word.split("=", 2)
+          if option.start_with?("--")
+            long = FISH_COMMAND_OPTIONS.any? { |full, min| option.size >= min && full.start_with?(option) }
+            value || rest[i + 1] if long
+          elsif (at = word.index("C")) && word.match?(/\A-[A-Za-z]*C/)
+            tail = word[(at + 1)..]
+            tail.empty? ? rest[i + 1] : tail
+          end
+        end
+      end
+      private_class_method :fish_commands
+
+      def self.shell_script_after(rest, start)
         i = start + 1
         while i < rest.size
           word = rest[i]
@@ -389,7 +497,7 @@ module Samagotchi
         end
         []
       end
-      private_class_method :shell_scripts
+      private_class_method :shell_script_after
 
       # Where a simple command's shell or interpreter (.runner?) gets its
       # script: nil without one; :inline for its code option's script
@@ -402,7 +510,7 @@ module Samagotchi
       def self.script_source(words, piped: false)
         limit = program_at(words) || (words.size - 1)
         at = (0..limit).find { |i| runner?(words[i]) } or return nil
-        name = File.basename(words[at])
+        name = ShellLex.program_name(words[at])
         return :inline if name == "eval"
         return :stdin if piped
 
@@ -414,7 +522,7 @@ module Samagotchi
         rest.each do |word|
           next skip = false if skip
           return :stdin if ["-", "-s"].include?(word) || (SHELLS.include?(name) && word.match?(/\A-[a-zA-Z]*s[a-zA-Z]*\z/))
-          return :inline if code_flag?(name, word)
+          return :inline if code_flag?(name, word, source: true)
           return :file if word == "-m" || word.match?(/\A-m\w/)
           # a redirection's operator alone: its target is the next word
           next skip = word.sub(ShellPaths::REDIRECT_PREFIX, "").empty? if word.match?(ShellPaths::REDIRECT_PREFIX)
@@ -473,9 +581,20 @@ module Samagotchi
         @refusal = read
       rescue StandardError
         @mise_config = true
+        @net = true
         @refusal = PairBoundary::UNREADABLE
       end
 
+      # Whether the owner approves it for what chi can't read for sure
+      # (PairBoundary::NET): git or chi behind a program no list knows
+      # (#net_hit?), or a $(…) kept in an assigned value that the shell
+      # expands later (#deferred_values), a script it hands on included.
+      # True for one it can't read.
+      def net_ask?
+        refusal
+        @net ||= false
+      end
+
       # Whether it makes a link (ln, link, cp -s/-l, a script's symlink): a
       # path through a link it makes now is judged before the link exists,
       # so the owner approves it (asked about; a link to a folder above a
@@ -517,7 +636,7 @@ module Samagotchi
       def outside_writes?
         return @outside_writes if defined?(@outside_writes)
 
-        @outside_writes = env_command_outside? ||
+        @outside_writes = handed_command_outside? ||
                           !(ReadOnlyShell.read_only?(@text) || writes_inside? || stays_inside?)
       rescue StandardError
         @outside_writes = true
@@ -557,28 +676,36 @@ module Samagotchi
         return PairBoundary::CHI if chi_in_values?(words)
         return PairBoundary::VERB if at && unplain_program?(words[at])
 
-        program = at && File.basename(words[at])
+        program = at && ShellLex.program_name(words[at])
         args = at ? words[(at + 1)..] : []
         return PairBoundary::CHI if program == "chi" && !CHI_ALLOWED.include?(args)
 
         upto = at ? words[0..at] : words
-        return PairBoundary::BACKGROUND if upto.any? { |w| DETACHERS.include?(File.basename(w)) } || detached_session?(program, args)
+        return PairBoundary::BACKGROUND if upto.any? { |w| DETACHERS.include?(ShellLex.program_name(w)) } || detached_session?(program, args)
         return PairBoundary::ENVIRONMENT if env_reader?(program, args) || bare_env?(words)
 
         program, args = PairCommand.git_form(program, args)
         return PairBoundary::GIT_CONFIG if git_config_env?(words) || git_alias?(program, args)
 
-        env_commands(words).each do |script|
-          reason = nested(script).refusal
+        handed_commands(words).each do |script|
+          reason = nested_refusal(script)
           return reason if reason
         end
+        reason = deferred_refusal(words)
+        return reason if reason
 
         if program == "git"
           # xargs adds words of its input: a git config it runs may write
-          xargs = words[0...at].any? { |word| File.basename(word) == "xargs" }
+          xargs = words[0...at].any? { |word| ShellLex.program_name(word) == "xargs" }
           reason = git_refusal(args, appended: xargs) || git_command_refusal(args)
           return reason if reason
         end
+        unless @read_only
+          net = net_hit?(words, at, program == "git")
+          return PairBoundary::UNREADABLE if net == :too_many
+
+          @net ||= net
+        end
         return PairBoundary::GIT_HOOKS if hook_installer?(words)
         return PairBoundary::OPENER if opener?(program, args)
         return PairBoundary::LISTENER if listener?(program, args)
@@ -648,11 +775,10 @@ module Samagotchi
       def scripts_refusal(words)
         limit = program_at(words) || (words.size - 1)
         at = (0..limit).find { |i| runner?(words[i]) } or return nil
-        program = File.basename(words[at])
+        program = ShellLex.program_name(words[at])
         scripts(words, at).each do |script|
           reason = if SHELLS.include?(program) || program == "eval"
-                     inner = nested(script)
-                     inner.refusal.tap { @mise_config = true if inner.mise_config_write? }
+                     nested_refusal(script)
                    elsif PairCommand.interpreter?(program)
                      @mise_config = true if script.match?(MISE_CONFIG_TEXT)
                      script_text_refusal(script)
@@ -665,7 +791,7 @@ module Samagotchi
       def runner?(word) = PairCommand.runner?(word)
 
       def scripts(words, at)
-        name = File.basename(words[at])
+        name = ShellLex.program_name(words[at])
         found = []
         found << words[(at + 1)..].join(" ") if name == "eval"
         words.each_with_index do |word, i|
@@ -723,13 +849,29 @@ module Samagotchi
         end
       end
 
-      # env with no command after it prints the environment.
+      # env with no command after it prints the environment, wherever it
+      # stands among the wrappers (sudo env, mise exec -- env, env -u X);
+      # env -S S runs S (#text_commands), but env followed by options and
+      # assignments only still counts (env -S 'X=1 git log' too).
       def bare_env?(words)
         assignment = ->(word) { word.start_with?("-") || word.match?(/\A[A-Za-z_]\w*=/) }
         at = words.index { |word| !assignment.call(word) }
-        return false unless at && File.basename(words[at]) == "env"
-
-        words[(at + 1)..].all?(&assignment)
+        return true if at && ShellLex.program?(words[at], "env") && words[(at + 1)..].all?(&assignment)
+
+        return false unless program_at(words).nil? && text_commands(words).empty?
+
+        # the last env, followed by its options and assignments only: no program
+        # (a wrapper that is a program of its own counts: env X=1 ruby -e …)
+        at = words.rindex { |word| ShellLex.program?(word, "env") } or return false
+        i = at + 1
+        while i < words.size
+          word = words[i]
+          if word.match?(/\A[A-Za-z_]\w*=/) then i += 1
+          elsif word.start_with?("-") then i += PairCommand.option_width("env", word)
+          else return false
+          end
+        end
+        true
       end
 
       # Why a git command is refused: a config write (anything but a read
@@ -818,7 +960,7 @@ module Samagotchi
       # own command would be.
       def git_command_refusal(args)
         git_commands(args).each do |script|
-          reason = nested(script).refusal
+          reason = nested_refusal(script)
           return reason if reason
         end
         nil
@@ -827,7 +969,7 @@ module Samagotchi
       # alias g=git (or a function's body naming git), then `g config …`:
       # git under another name; an alias naming git is refused.
       def git_alias?(program, args)
-        program == "alias" && args.any? { |arg| arg.match?(%r{=['"]?(?:\S*/)?git(?:\s|['"]?\z)}) }
+        program == "alias" && args.any? { |arg| arg.match?(%r{=['"]?(?:\S*/)?git(?:\s|['"]?\z)}i) }
       end
 
       # An assignment (a prefix, export's, env's) of a variable that hands
@@ -846,11 +988,177 @@ module Samagotchi
         end
       end
 
-      # Whether a command an assignment hands a program (#env_commands)
-      # may write outside, read as a command of its own.
-      def env_command_outside?
+      # The values a real assignment gives (a prefix, a command of
+      # assignments, ASSIGNERS' words) that keep a $(…), ${ …; } or
+      # backticks as text (DEFERRED_SUBST, $'\x24(…)' too): the shell expands
+      # them later (PS4 under bash -x, PS0/PS1, a prompt).
+      def deferred_values(words)
+        at = program_at(words)
+        assigns = at.nil? || ASSIGNERS.include?(ShellLex.program_name(words[at]))
+        words.each_with_index.filter_map do |word, i|
+          name, value = word.match(/\A([A-Za-z_]\w*)=(.+)\z/m)&.captures
+          value if name && !COMMAND_ENV.include?(name) && value.match?(DEFERRED_SUBST) && (assigns || i < at)
+        end
+      end
+
+      # A deferred value (#deferred_values) read as the commands its $(…)
+      # would run (DEFERRED_PARTS cut into separators): refused for what that
+      # read finds (git config, chi, a secret…), else the owner approves it
+      # (#net_ask?): a value the shell expands later is no command chi can
+      # read for sure.
+      def deferred_refusal(words)
+        deferred_values(words).each do |value|
+          @net = true
+          script = value.sub(/\A\$(?=\\)/, "").gsub(DEFERRED_ESCAPES) { |escape| escape.end_with?("4") ? "$" : "`" }
+          reason = nested_refusal(script.gsub(DEFERRED_PARTS, " ; "))
+          return reason if reason && ![PairBoundary::UNREADABLE, PairBoundary::VERB].include?(reason)
+        end
+        nil
+      end
+
+      # A nested command's refusal (#nested), what it asks (#net_ask?,
+      # #mise_config_write?) carried to this one.
+      def nested_refusal(script)
+        inner = nested(script)
+        inner.refusal.tap do
+          @mise_config = true if inner.mise_config_write?
+          @net = true if inner.net_ask?
+        end
+      end
+
+      # The commands a simple command hands on as text, read as commands of
+      # their own: its assignments' (#env_commands) and the wrappers' and
+      # runners' that take a command line (#text_commands).
+      def handed_commands(words) = env_commands(words) + text_commands(words)
+
+      # The command lines the wrappers and the program take as text: env -S
+      # S, script -c S, ssh's (scp's, sftp's) -o ProxyCommand=S (and
+      # LocalCommand, KnownHostsCommand: run here), and the runners that run
+      # their arguments as command lines (TEXT_RUNNERS: hyperfine, parallel,
+      # watch).
+      def text_commands(words)
+        upto = program_at(words) || (words.size - 1)
+        (0..upto).flat_map do |i|
+          next [] if words[i].include?("\0")
+
+          name = ShellLex.program_name(words[i])
+          next [] unless TEXT_TAKERS.include?(name)
+
+          rest = words[(i + 1)..]
+          case name
+          when "env" then option_values(rest, %w[-S --split-string], cluster: "S")
+          when "script" then option_values(rest, %w[-c --command])
+          when "npx" then option_values(rest, %w[-c --call])
+          when "npm" then %w[exec x].include?(rest.first) ? option_values(rest.drop(1), %w[-c --call]) : []
+          when "rsync" then rsync_commands(rest)
+          when "ssh", "scp", "sftp" then ssh_commands(rest)
+          else text_runner_commands(name, rest)
+          end
+        end
+      end
+
+      # The values of +options+ among the options at +rest+'s start (the next
+      # word, after = for a long one, the rest of a -S… word for +cluster+).
+      def option_values(rest, options, cluster: nil)
+        found = []
+        rest.each_with_index do |word, i|
+          break unless word.start_with?("-")
+
+          option, value = word.split("=", 2)
+          if options.include?(word) then found << rest[i + 1]
+          elsif option.start_with?("--") && options.include?(option) then found << value
+          elsif cluster && !word.start_with?("--") && (at = word.index(cluster, 1))
+            tail = word[(at + 1)..]
+            found << (tail.empty? ? rest[i + 1] : tail)
+          end
+        end
+        found.compact
+      end
+
+      # rsync's remote shell (-e S, a cluster ending in it -avze S, --rsh=S):
+      # it runs here.
+      def rsync_commands(rest)
+        rest.each_with_index.filter_map do |word, i|
+          if word.start_with?("--rsh=") then word.delete_prefix("--rsh=")
+          elsif word == "--rsh" then rest[i + 1]
+          elsif (cluster = word[/\A-[A-Za-z]*?e(.*)\z/m, 1]) && !word.start_with?("--")
+            cluster.empty? ? rest[i + 1] : cluster
+          end
+        end
+      end
+
+      # ssh's -o options that run a command on this machine.
+      def ssh_commands(rest)
+        rest.each_with_index.filter_map do |word, i|
+          option = if word == "-o" then rest[i + 1].to_s
+                   elsif word.start_with?("-o") then word[2..]
+                   end
+          option.to_s[SSH_COMMAND_OPTION, 1]
+        end
+      end
+
+      # hyperfine's arguments, each a command line (its options' values
+      # too: harmless as commands); parallel's and watch's words before
+      # parallel's ::: as one command line.
+      def text_runner_commands(name, rest)
+        words = rest.take_while { |word| !word.start_with?(":::") }.reject { |word| word.start_with?("-") }
+        return words if name == "hyperfine"
+
+        words.empty? ? [] : [words.join(" ")]
+      end
+
+      # A fail-closed net for a runner no table knows (a wrapper's option
+      # read wrong, a package runner): any word but the program's (a
+      # wrapper's or an option's value too) that names git is read as git
+      # from there, one naming chi with a chi command after it (CHI_COMMANDS)
+      # counts, and a command line starting with git or chi (the program
+      # word too) is read as a command. A hit asks the owner (#net_ask?),
+      # never refuses: chi can't tell such a word runs. A git command
+      # (+git+) is read as git; only the words before it are netted.
+      # More than NET_GITS such words is :too_many (UNREADABLE): each is
+      # read through the rest of the words.
+      def net_hit?(words, at, git)
+        gits = 0
+        last = git ? at - 1 : words.size - 1
+        (0..last).any? do |i|
+          word = words[i]
+          next false if word.include?("\0")
+
+          if word.match?(/\s/)
+            head = word.strip.split(/\s+/).first.to_s
+            next false unless ShellLex.program?(head, "git") || ShellLex.program?(head, "chi")
+            return :too_many if (gits += 1) > NET_GITS
+
+            next !nested_refusal(word).nil?
+          end
+          next false if i == at
+
+          program, = PairCommand.git_form(ShellLex.program_name(word), [])
+          if program == "git"
+            return :too_many if (gits += 1) > NET_GITS
+
+            _, rest = PairCommand.git_form(ShellLex.program_name(word), words[(i + 1)..])
+            !(git_refusal(rest) || git_command_refusal(rest)).nil?
+          else
+            program == "chi" && chi_call?(words[i + 1])
+          end
+        end
+      end
+
+      # Whether the word after a chi word makes a chi call: a chi command
+      # (CHI_COMMANDS) or an option but --version/--help (chi -p "…").
+      def chi_call?(first)
+        return false if first.nil?
+        return !CHI_ALLOWED.flatten.include?(first) if first.start_with?("-")
+
+        CHI_COMMANDS.include?(first)
+      end
+
+      # Whether a command a simple command hands on (#handed_commands) may
+      # write outside, read as a command of its own.
+      def handed_command_outside?
         ShellLex.simple_commands(ShellLex.lex(@text)).any? do |words|
-          words.is_a?(Array) && env_commands(words).any? { |script| nested(script).outside_writes? }
+          words.is_a?(Array) && handed_commands(words).any? { |script| nested(script).outside_writes? }
         end
       end
 
@@ -859,7 +1167,7 @@ module Samagotchi
       def hook_installer?(words)
         at = program_at(words) or return false
         (0..at).any? do |i|
-          name = File.basename(words[i])
+          name = ShellLex.program_name(words[i])
           next false unless HOOK_INSTALLERS.key?(name)
 
           verbs = HOOK_INSTALLERS[name]
@@ -872,7 +1180,7 @@ module Samagotchi
       # denied dir; a $var word whose fixed part does; a sweeper given a
       # folder above a denied one; SECRET_TEXT for a word it can't read.
       def paths_refusal(words, resolved)
-        program_word = (at = program_at(words)) && File.basename(words[at])
+        program_word = (at = program_at(words)) && ShellLex.program_name(words[at])
         resolved.each do |word, path|
           return PairBoundary::GIT_HOOKS if !@read_only && PairCommand.git_hook?(path || word)
 
@@ -930,13 +1238,13 @@ module Samagotchi
 
       def link_command?(words)
         at = program_at(words)
-        program = at && File.basename(words[at])
+        program = at && ShellLex.program_name(words[at])
         return true if LINKERS.include?(program)
         return true if program == "cp" && words[(at + 1)..].any? { |arg| arg.match?(CP_LINK_OPTION) }
-        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && LINKERS.include?(File.basename(word)) }
+        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && LINKERS.include?(ShellLex.program_name(word)) }
 
         runner = (0..(at || (words.size - 1))).find { |i| runner?(words[i]) } or return false
-        name = File.basename(words[runner])
+        name = ShellLex.program_name(words[runner])
         scripts(words, runner).any? do |script|
           SHELLS.include?(name) || name == "eval" ? nested(script).links? : script.match?(SCRIPT_LINK_TEXT)
         end
@@ -944,11 +1252,12 @@ module Samagotchi
 
       def env_loader_command?(words)
         at = program_at(words)
-        return true if at && ENV_LOADERS.include?(File.basename(words[at]))
-        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && ENV_LOADERS.include?(File.basename(word)) }
+        # wherever it stands among the wrappers too (mise exec -- env)
+        return true if words[0..at].any? { |word| ENV_LOADERS.any? { |name| ShellLex.program?(word, name) } }
+        return true if words.each_cons(2).any? { |option, word| CODE_OPTIONS.include?(option) && ENV_LOADERS.include?(ShellLex.program_name(word)) }
 
         runner = (0..(at || (words.size - 1))).find { |i| runner?(words[i]) } or return false
-        name = File.basename(words[runner])
+        name = ShellLex.program_name(words[runner])
         scripts(words, runner).any? do |script|
           SHELLS.include?(name) || name == "eval" ? nested(script).loads_env? : script.match?(ENV_LOADER_TEXT)
         end
@@ -999,7 +1308,7 @@ module Samagotchi
           program = words[i]
           args = words[(i + 1)..]
           local = project_program?(walk, program)
-          if PairCommand.interpreter?(File.basename(program)) && (module_args = module_run(args))
+          if PairCommand.interpreter?(ShellLex.program_name(program)) && (module_args = module_run(args))
             program, args = module_args
           end
           ImplicitWriters.outside?(program, args, local: local, assigned: assigned)
@@ -1020,7 +1329,7 @@ module Samagotchi
       # (.git_commands): where it writes isn't placed, so it asks.
       def git_hands_command?(words)
         at = program_at(words) or return false
-        program, args = PairCommand.git_form(File.basename(words[at]), words[(at + 1)..])
+        program, args = PairCommand.git_form(ShellLex.program_name(words[at]), words[(at + 1)..])
         program == "git" && !git_commands(args).empty?
       end
 
@@ -1043,10 +1352,10 @@ module Samagotchi
       def words_inside?(words, walk)
         at = program_at(words)
         # xargs runs its program on paths it reads from its input
-        return false if at && words[0...at].any? { |word| File.basename(word) == "xargs" }
+        return false if at && words[0...at].any? { |word| ShellLex.program_name(word) == "xargs" }
 
         words.each_with_index.all? do |word, i|
-          next true if at && (i == at || (i < at && WRAPPERS.include?(File.basename(word))))
+          next true if at && (i == at || (i < at && WRAPPERS.include?(ShellLex.program_name(word))))
           next true if LIST_VARIABLES.any? { |name| word.start_with?("#{name}=") }
 
           word_inside?(walk, word)
@@ -1090,7 +1399,7 @@ module Samagotchi
       def scripts_inside?(words)
         limit = program_at(words) || (words.size - 1)
         at = (0..limit).find { |i| runner?(words[i]) } or return true
-        program = File.basename(words[at])
+        program = ShellLex.program_name(words[at])
         scripts(words, at).all? do |script|
           if SHELLS.include?(program) || program == "eval"
             !nested(script).outside_writes?