@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/src/rules/shell/invocation.ts

@@ -0,0 +1,1083 @@
+/**
+ * Classifying a token stream into an `Invocation`.
+ *
+ * Ported from `.agents/hooks/pre-tool-use/src/walk.mjs`. The old tree spread
+ * this classification across `walk.mjs`, three Sets in `constants.mjs`, and a
+ * prose `reason` string in `blocked-reason.mjs` that `deny.mjs` then
+ * regex-reparsed into a message kind. Here `walk` only classifies — it
+ * returns a structured `Invocation`, never a reason — and every rule's own
+ * `match()` (src/rules/impl/*.ts) decides whether that invocation is denied.
+ *
+ * `NON_CANONICAL_TEST_RECIPES` (constants.mjs:45) is deliberately not
+ * ported: the Set was empty, so `walkJustCommand`'s recipe branch
+ * (walk.mjs:144-151) was unreachable dead code exercised by no corpus string.
+ * Its config equivalent is `[rules."tool.noncanonical-test"] enabled = false`
+ * — there is no rule registered under that id at all, since one guarded by
+ * an always-empty Set is not a rule, it is a config toggle with nothing
+ * behind it.
+ */
+
+import { basename, dynamicToken, isTrustedRepoScript, type Token, tokenValue } from './token.ts'
+import { scanGitGlobals, skipPrefixes } from './prefixes.ts'
+import {
+  gitInternalsWriteTargets,
+  unresolvableOperandWriteTargets,
+  unresolvableRedirectionWriteTargets,
+  withoutRedirections,
+} from './git-internals.ts'
+import { protectedCarrierWriteTargets } from './protected-carrier-writes.ts'
+import { type HereDocument, hereDocumentPlaceholder, hereDocumentPlaceholderIndex, nestedSources, scanHereDocuments } from './substitution.ts'
+import { type PieceFeed, splitShell } from './split.ts'
+import { tokenize } from './token.ts'
+import { uncertain, xargsInvocation } from './xargs.ts'
+import { EXPRESSION_RUNNERS, stageFetcher, staticProducerOutput, wordFetcher } from './piped-script.ts'
+
+export type Invocation =
+  | {
+      readonly kind: 'git'
+      readonly subcommand: string
+      readonly globals: readonly Token[]
+      readonly rest: readonly Token[]
+      /**
+       * The raw command word that invoked git — `git`/`git.exe` when run by
+       * bare name (the common case, and the only one `git-worktree`'s
+       * synthetic shortcut below ever produces), or the exact path when run
+       * by one (`/usr/local/bin/git`, `/usr/bin/git`, …). H2
+       * (`adl-git-credential-bypass.ts`) denies an ABSOLUTE path other than
+       * the managed front controller `/usr/local/bin/git` — an agent
+       * invoking git by any other absolute path bypasses `bin/git-ado`
+       * entirely, since that routing lives at exactly that one path. Absent
+       * on the `git-worktree` binary shortcut (no real "binary word" to
+       * report there).
+       */
+      readonly binary?: string
+    }
+  | { readonly kind: 'rm'; readonly args: readonly Token[] }
+  | { readonly kind: 'trash'; readonly args: readonly Token[] }
+  | { readonly kind: 'mv'; readonly args: readonly Token[] }
+  | { readonly kind: 'hook-disarm' }
+  /**
+   * A command that writes into a `.git` directory or gitdir file — delete,
+   * trash, move, copy/link/sync over, truncate, redirect into, tee, in-place
+   * edit, chmod/chown, or find -delete. `targets` are the offending paths.
+   * See git-internals.ts; denied by fs.git-internals.
+   */
+  | { readonly kind: 'git-internals-write'; readonly name: string; readonly targets: readonly string[] }
+  /**
+   * A command that writes into one of the seven tamper-protected carrier
+   * files (`.claude/settings.json`, `.codex/hooks.json`, `adl-config.toml`,
+   * …) via redirection, tee, mv/cp/install/ln, sed -i/perl -pi, truncate,
+   * trash/rm/unlink/shred, or dd. See shell/protected-carrier-writes.ts;
+   * denied by agent.tamper-protection. `git rm`/`checkout --`/`restore --`/
+   * `reset --` on one of these files is a `'git'` Invocation instead — see
+   * that rule's own match().
+   */
+  | { readonly kind: 'protected-carrier-write'; readonly name: string; readonly targets: readonly string[] }
+  | { readonly kind: 'cargo' }
+  /**
+   * `az devops|repos|pipelines|boards|artifacts ...`. `args` is everything
+   * after `az` itself (the subcommand group onward, e.g. `['repos', 'pr',
+   * 'create', '--title', 'x']`) — carried so a rule can tell a mutating
+   * subcommand from a read one (`adl.session-required-for-writes`); denied
+   * outright regardless of that distinction by tool.azure-devops, which
+   * ignores this field. See impl/tool-azure-devops.ts.
+   */
+  | { readonly kind: 'azure-devops'; readonly args: readonly Token[] }
+  | { readonly kind: 'find' }
+  | { readonly kind: 'grep' }
+  | { readonly kind: 'frontend-tool'; readonly tool: string }
+  /**
+   * `bun test` (any arguments, including a file/pattern operand) — the
+   * `test` subcommand specifically, after skipping bun's own `-C <dir>` /
+   * `--cwd <dir>` / `--cwd=<dir>` global. Tarun's decision (2026-09-27,
+   * feature az372): ban `bun test` only — `bun run test`, `bun run
+   * <script>`, `bunx`, `bun install` and every other bun subcommand stay
+   * unclassified here (`null` from `walkToolCommand`) and fall through to
+   * the ordinary `command` kind, which no rule denies. See
+   * impl/tool-bun-test.ts.
+   */
+  | { readonly kind: 'bun-test' }
+  | { readonly kind: 'uncertain'; readonly reason: string }
+  /**
+   * A shell (or `.`/`source`/`eval`/PowerShell `iex`) executing content a
+   * network fetcher produced — piped into its stdin, or read through a
+   * `<(...)`/`$(...)`/backtick. See piped-script.ts; denied by
+   * shell.remote-script-exec.
+   */
+  | { readonly kind: 'remote-script-exec'; readonly fetcher: string }
+  /**
+   * A command the hook never denies, but that advisory.finder wants to see:
+   * `grep`/`egrep`/`fgrep`/`rgrep`/`ack`/`ag` (constants.mjs's
+   * `SUBSTITUTABLE_FINDERS`), plus every other read-only consumer and
+   * introspection command that used to just vanish as `[]`. Every rule but
+   * advisory.finder treats this exactly like an empty invocation list — see
+   * its `match()`, which is the only one that inspects `name`.
+   */
+  | { readonly kind: 'read-only'; readonly name: string }
+  /**
+   * A command whose arguments reach into a tree agents must not touch
+   * (`cfg.deniedTrees`). Emitted for ANY command, ahead of every other
+   * classification, because the alternative does not exist: `cat`/`ls` and the
+   * other read-only consumers return `[]` here and are invisible to rules, and
+   * `read-only` carries only a name. Without this, a path-based deny could see
+   * nothing to deny. See impl/fs-canonical-checkout.ts.
+   */
+  | { readonly kind: 'denied-path'; readonly name: string; readonly path: string }
+  /**
+   * An otherwise-unclassified top-level command. Emitted alongside whatever
+   * `walkNested` finds inside its arguments — every built-in rule but
+   * `tool.lean-ctx-global-state` ignores this kind's extra `prefix` field, so
+   * adding it changes no existing decision; the kind itself exists purely so
+   * `custom.ts`'s declarative `category: "tool"` rules (name-based tool
+   * bans) have something to match. See custom.ts's module doc.
+   */
+  | {
+      readonly kind: 'command'
+      readonly name: string
+      readonly args: readonly Token[]
+      /**
+       * The tokens `shell/prefixes.ts`'s `skipPrefixes` consumed to resolve
+       * `name` — every leading `NAME=value` assignment word, and every
+       * wrapper command's own name/flags (`sudo`/`env`/`timeout`/…), in
+       * their original order. Present so a rule can tell whether THIS
+       * specific invocation carries its own inline assignment (e.g.
+       * `tool.lean-ctx-global-state`'s per-invocation `LEAN_CTX_CONFIG_DIR=`
+       * check) without re-deriving it from the whole raw command text — a
+       * `NAME=value` immediately before the command name, or one consumed as
+       * an `env NAME=value cmd` operand (`skipEnvFlags`'s own
+       * "value-taking flag" branch), both land here. Empty when nothing was
+       * skipped. Optional only so hand-built test fixtures that predate this
+       * field keep compiling.
+       */
+      readonly prefix?: readonly Token[]
+    }
+  /**
+   * A non-shell tool call — Read, Write, Edit, Grep, Glob, an MCP tool, and
+   * so on. The original's `decide-render.mjs:25` gated on `SHELL_TOOLS`, so
+   * these never reached the engine at all. Opening that gate (default OFF;
+   * see engine.ts) lets a `[[rules.custom]]` entry with `category:
+   * "tool-call"` deny a call by its tool name and input shape — e.g. an Edit
+   * whose `file_path` sits inside a protected tree, catching the edit
+   * instead of only the commit.
+   */
+  | { readonly kind: 'tool-call'; readonly tool: string; readonly input: Readonly<Record<string, unknown>> }
+
+/** The name-vocabulary walk() needs to classify a command. Defaults mirror constants.mjs exactly. */
+export interface ClassifyConfig {
+  readonly shellNames: ReadonlySet<string>
+  readonly shellExecutors: ReadonlySet<string>
+  readonly introspectionNames: ReadonlySet<string>
+  readonly subcommandTools: ReadonlySet<string>
+  readonly readOnlyConsumers: ReadonlySet<string>
+  readonly rmNames: ReadonlySet<string>
+  readonly trashNames: ReadonlySet<string>
+  readonly azureDevopsNames: ReadonlySet<string>
+  readonly azureDevopsSubcommands: ReadonlySet<string>
+  readonly cargoNames: ReadonlySet<string>
+  readonly justNames: ReadonlySet<string>
+  readonly frontendToolNames: ReadonlySet<string>
+  readonly bunNames: ReadonlySet<string>
+  readonly trustedScriptPrefixes: readonly string[]
+  /** `SUBSTITUTABLE_FINDERS` (constants.mjs:123) — `find` is deliberately absent; see tool-find.ts. */
+  readonly substitutableFinders: ReadonlySet<string>
+  /**
+   * Absolute trees no command may reference. Empty by default, so classification
+   * is unchanged unless an engine supplies one (engine.ts's classifyConfigFor).
+   */
+  readonly deniedTrees: readonly string[]
+}
+
+export const DEFAULT_CLASSIFY_CONFIG: ClassifyConfig = {
+  deniedTrees: [],
+  shellNames: new Set(['sh', 'bash', 'zsh', 'dash', 'ksh', 'fish']),
+  shellExecutors: new Set(['.', 'eval', 'source']),
+  introspectionNames: new Set(['echo', 'printf', 'which', 'type', 'whereis', 'whatis', 'man', 'apropos', 'info']),
+  subcommandTools: new Set(['docker', 'podman', 'nerdctl', 'kubectl', 'helm', 'buildah', 'crictl']),
+  readOnlyConsumers: new Set([
+    'rg',
+    'rg.exe',
+    'cat',
+    'cat.exe',
+    'sed',
+    'sed.exe',
+    'head',
+    'head.exe',
+    'tail',
+    'tail.exe',
+    'less',
+    'less.exe',
+    'more',
+    'more.exe',
+    'awk',
+    'awk.exe',
+    'grep',
+    'grep.exe',
+  ]),
+  rmNames: new Set(['rm', 'rm.exe', 'unlink', 'unlink.exe']),
+  trashNames: new Set(['trash', 'trash.exe']),
+  azureDevopsNames: new Set(['az', 'az.exe']),
+  azureDevopsSubcommands: new Set(['devops', 'repos', 'pipelines', 'boards', 'artifacts']),
+  cargoNames: new Set(['cargo', 'cargo.exe']),
+  justNames: new Set(['just', 'just.exe']),
+  frontendToolNames: new Set(['npx', 'npx.exe', 'vitest', 'vitest.exe', 'jest', 'jest.exe', 'biome', 'biome.exe', 'tsc', 'tsc.exe']),
+  bunNames: new Set(['bun', 'bun.exe']),
+  trustedScriptPrefixes: ['workflows/scripts/', '.code-quality/', '.agents/hooks/'],
+  substitutableFinders: new Set(['grep', 'grep.exe', 'egrep', 'fgrep', 'rgrep', 'ack', 'ag']),
+}
+
+function isClassifiedCommandName(token: Token, cfg: ClassifyConfig): boolean {
+  const name = basename(token)
+  return (
+    cfg.rmNames.has(name) ||
+    cfg.trashNames.has(name) ||
+    cfg.azureDevopsNames.has(name) ||
+    cfg.cargoNames.has(name) ||
+    cfg.justNames.has(name) ||
+    cfg.frontendToolNames.has(name) ||
+    cfg.bunNames.has(name) ||
+    name === 'git' ||
+    name === 'git.exe' ||
+    name === 'git-worktree' ||
+    name === 'git-worktree.exe' ||
+    name === 'busybox'
+  )
+}
+
+export function rmIsHelpOnly(args: readonly Token[]): boolean {
+  const flags = new Set<string>()
+  for (const token of args) {
+    const arg = tokenValue(token)
+    if (arg === '--') break
+    if (arg === '--help' || arg === '--version') flags.add('help')
+    if (arg === '-h' && args.length === 1) flags.add('help')
+  }
+  return flags.has('help') && args.every((token) => tokenValue(token).startsWith('-') && tokenValue(token) !== '--')
+}
+
+export function isHelpOrVersionOnly(args: readonly Token[]): boolean {
+  let sawHelp = false
+  for (const token of args) {
+    const arg = tokenValue(token)
+    if (arg === '--') return false
+    if (!arg.startsWith('-')) return false
+    if (arg === '--help' || arg === '-h' || arg === '--version' || arg === '-V') {
+      sawHelp = true
+      continue
+    }
+    return false
+  }
+  return sawHelp
+}
+
+function isShellCommandOption(value: string): boolean {
+  return value === '-c' || /^-[^-]*c$/.test(value) || value === '--command' || value.startsWith('--command=')
+}
+
+function isShellNoExecFlag(token: Token): boolean {
+  return /^-[a-zA-Z]*n[a-zA-Z]*$/.test(tokenValue(token))
+}
+
+const LEADING_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/
+
+/**
+ * Whether `tokens` begins (after any leading `NAME=value` assignments) with
+ * an `env`/`env.exe` invocation that carries `-S`/`--split-string` among its
+ * own flags — R3 (STATUS.md 12p). Checked at `walk()`'s
+ * own call site BEFORE `skipPrefixes` (../prefixes.ts's `skipEnvFlags`)
+ * consumes `-S`/`--split-string` and its value as an opaque, value-taking
+ * flag argument; this mirrors that same flag-scanning loop just far enough
+ * to detect the flag's PRESENCE, without trying to parse or classify what
+ * its value names. Narrow by design: only a leading `env`, not `env` nested
+ * behind another wrapper (`sudo env -S …`) — the common, and only currently
+ * observed, shape.
+ */
+function envUsesSplitString(tokens: readonly Token[]): boolean {
+  let index = 0
+  while (index < tokens.length && LEADING_ASSIGNMENT_RE.test(tokenValue(tokens[index] as Token))) index += 1
+  if (index >= tokens.length) return false
+  const name = basename(tokens[index] as Token)
+  if (name !== 'env' && name !== 'env.exe') return false
+  index += 1
+  while (index < tokens.length) {
+    const value = tokenValue(tokens[index] as Token)
+    if (value === '--') return false
+    if (value === '-S' || value === '--split-string') return true
+    if (value.startsWith('--split-string=')) return true
+    if (value.startsWith('--unset=') || value.startsWith('--chdir=') || value.startsWith('-') || value.includes('=')) {
+      index += ['-u', '--unset', '-C', '--chdir'].includes(value) ? 2 : 1
+      continue
+    }
+    break
+  }
+  return false
+}
+
+function walkShellArgument(
+  args: readonly Token[],
+  look: number,
+  cfg: ClassifyConfig,
+  parseScript: (script: string, feed?: StdinFeed) => readonly Invocation[],
+  feed: StdinFeed | undefined,
+): readonly Invocation[] | null {
+  const arg = args[look] as Token
+  const value = tokenValue(arg)
+  if (value === '--') return null
+  if (value === '-c' || /^-[^-]*c$/.test(value) || value === '--command') {
+    const next = args[look + 1]
+    return next === undefined ? uncertain('dynamic shell script') : parseScript(tokenValue(next), feed)
+  }
+  if (value.startsWith('--command=')) {
+    const script = value.slice('--command='.length)
+    return script ? parseScript(script, feed) : uncertain('dynamic shell script')
+  }
+  if (!value.startsWith('-')) {
+    return isTrustedRepoScript(arg, cfg.trustedScriptPrefixes) ? [] : uncertain('shell script execution')
+  }
+  return null
+}
+
+/** `-n` (read but do not execute) without a `-c` script. */
+const shellRunsNothing = (args: readonly Token[]): boolean =>
+  !args.some((token) => isShellCommandOption(tokenValue(token))) && args.some(isShellNoExecFlag)
+
+/** Shell options that consume the following word. */
+const SHELL_OPTIONS_WITH_VALUE = new Set(['-o', '+o', '-O', '+O', '--rcfile', '--init-file'])
+
+/**
+ * Whether a shell invoked with `args` (redirections removed) reads its script
+ * from stdin: no `-c` script and no script operand, or `-s`/`-` given.
+ */
+function shellScriptFromStdin(args: readonly Token[]): boolean {
+  let fromStdin = false
+  for (let look = 0; look < args.length; look += 1) {
+    const value = tokenValue(args[look] as Token)
+    if (isShellCommandOption(value)) return false
+    if (value === '-') return true
+    if (value === '--') return fromStdin || look + 1 >= args.length
+    if (SHELL_OPTIONS_WITH_VALUE.has(value)) {
+      look += 1
+      continue
+    }
+    if (/^[-+][a-zA-Z]+$/.test(value)) {
+      if (value.startsWith('-') && value.includes('s')) fromStdin = true
+      continue
+    }
+    if (value.startsWith('--')) continue
+    return fromStdin
+  }
+  return true
+}
+
+/**
+ * Whether `xargs ... <shell> ...` builds its shell's SCRIPT from xargs input:
+ * no `-c` (input items become script operands), a `-c` with no script, or a
+ * `-c` script containing the `-I`/`-J`/`--replace` string.
+ */
+function xargsShellReadsInput(args: readonly Token[], cfg: ClassifyConfig): boolean {
+  let replace: string | null = null
+  for (let look = 0; look < args.length; look += 1) {
+    const token = args[look] as Token
+    const value = tokenValue(token)
+    if (cfg.shellNames.has(basename(token))) {
+      const rest = withoutRedirections(args.slice(look + 1))
+      const option = rest.findIndex((word) => isShellCommandOption(tokenValue(word)))
+      if (option < 0) return true
+      const optionValue = tokenValue(rest[option] as Token)
+      const scriptToken = rest[option + 1]
+      const script = optionValue.startsWith('--command=') ? optionValue.slice('--command='.length) : scriptToken && tokenValue(scriptToken)
+      if (script === undefined || script === '') return true
+      return replace !== null && script.includes(replace)
+    }
+    if (value === '-I' || value === '-J') {
+      replace = tokenValue(args[look + 1] ?? token)
+      look += 1
+    } else if (value === '-i' || value === '--replace') replace = '{}'
+    else if (value.startsWith('--replace=')) replace = value.slice('--replace='.length)
+    else if (/^-[IJi]./.test(value)) replace = value.slice(2)
+  }
+  return false
+}
+
+/** A remote fetch executed as code — plus a fail-closed uncertain, so disabling the rule never turns it into an allow. */
+const remoteExec = (fetcher: string): readonly Invocation[] => [
+  { kind: 'remote-script-exec', fetcher },
+  ...uncertain('remote content executed by a shell'),
+]
+
+/** A shell's stdin redirected from a file or descriptor (`bash < script.sh`, `sh <&3`) is a script nobody can see. */
+function readsStdinFromFile(tokens: readonly Token[]): boolean {
+  return tokens.some((token, index) => {
+    const op = token.redirect
+    if (op !== '<' && op !== '<>' && op !== '<&') return false
+    if (!/^0?</.test(tokenValue(token))) return false
+    return !(op === '<&' && tokenValue(tokens[index + 1] ?? token) === '-')
+  })
+}
+
+function walkShell(
+  rawArgs: readonly Token[],
+  cfg: ClassifyConfig,
+  parseScript: (script: string, feed?: StdinFeed) => readonly Invocation[],
+  feed: StdinFeed | undefined,
+): readonly Invocation[] {
+  // Redirections are not script operands; here-document/here-string stdin is walked by `shellStdinInvocations`.
+  const args = withoutRedirections(rawArgs)
+  if (shellRunsNothing(args)) return []
+  for (let look = 0; look < args.length; look += 1) {
+    const result = walkShellArgument(args, look, cfg, parseScript, feed)
+    if (result !== null) return result
+  }
+  return readsStdinFromFile(rawArgs) ? uncertain('shell script execution') : []
+}
+
+function staticEnvironment(tokens: readonly Token[], gitIndex: number): ReadonlyMap<string, string> {
+  const environment = new Map<string, string>()
+  for (const token of tokens.slice(0, gitIndex)) {
+    const assignment = tokenValue(token)
+    const equals = assignment.indexOf('=')
+    if (equals >= 0) environment.set(assignment.slice(0, equals), assignment.slice(equals + 1))
+  }
+  return environment
+}
+
+function environmentGitAlias(environment: ReadonlyMap<string, string>, subcommand: string): string | null {
+  let count: number | null = null
+  const keys = new Map<number, string>()
+  const values = new Map<number, string>()
+  for (const [name, value] of environment) {
+    if (name === 'GIT_CONFIG_COUNT') count = /^\d+$/.test(value) ? Number(value) : null
+    const key = /^GIT_CONFIG_KEY_(\d+)$/.exec(name)
+    if (key) keys.set(Number(key[1]), value)
+    const configured = /^GIT_CONFIG_VALUE_(\d+)$/.exec(name)
+    if (configured) values.set(Number(configured[1]), value)
+  }
+  if (count === null || !Number.isSafeInteger(count)) return null
+  let target: string | null = null
+  for (const index of [...keys.keys()].filter((candidate) => candidate < count).sort((left, right) => left - right)) {
+    if (keys.get(index)?.toLowerCase() === `alias.${subcommand}` && values.has(index)) target = values.get(index) as string
+  }
+  return target
+}
+
+/** Resolve alias definitions statically visible in this command; repository/global configuration is not inspectable here. */
+function configuredGitAlias(tokens: readonly Token[], gitIndex: number, globals: readonly Token[], subcommand: string): string | null {
+  const environment = staticEnvironment(tokens, gitIndex)
+  let target = environmentGitAlias(environment, subcommand)
+  for (let index = 0; index < globals.length; index += 1) {
+    const value = tokenValue(globals[index] as Token)
+    if (value === '--config-env' || value.startsWith('--config-env=')) {
+      const setting = value === '--config-env' ? tokenValue(globals[index += 1] as Token) : value.slice('--config-env='.length)
+      const equals = setting.indexOf('=')
+      if (equals >= 0 && setting.slice(0, equals).toLowerCase() === `alias.${subcommand}`) {
+        target = environment.get(setting.slice(equals + 1)) ?? null
+      }
+      continue
+    }
+    const setting = value === '-c' ? tokenValue(globals[index += 1] as Token) : value.startsWith('-c') ? value.slice(2) : ''
+    const equals = setting.indexOf('=')
+    if (equals < 0 || setting.slice(0, equals).toLowerCase() !== `alias.${subcommand}`) continue
+    target = setting.slice(equals + 1).trim()
+  }
+  return target
+}
+
+function classifyGitArgv(argv: readonly Token[], binary: string): readonly Invocation[] {
+  const scan = scanGitGlobals(argv, 0)
+  if (scan.terminal) return [{ kind: 'read-only', name: 'git' }]
+  const subIndex = scan.index
+  if (subIndex >= argv.length) return uncertain('git command missing subcommand')
+  const subToken = argv[subIndex] as Token
+  if (dynamicToken(subToken)) return uncertain('dynamic git subcommand')
+  return [
+    {
+      kind: 'git',
+      subcommand: tokenValue(subToken).toLowerCase(),
+      globals: argv.slice(0, subIndex),
+      rest: argv.slice(subIndex + 1),
+      binary,
+    },
+  ]
+}
+
+function walkGit(tokens: readonly Token[], index: number, parser: Parser): readonly Invocation[] {
+  const binary = tokenValue(tokens[index] as Token)
+  const argv = tokens.slice(index + 1)
+  const scan = scanGitGlobals(argv, 0)
+  if (scan.terminal) return [{ kind: 'read-only', name: 'git' }]
+  if (scan.index >= argv.length) return uncertain('git command missing subcommand')
+  const subToken = argv[scan.index] as Token
+  if (dynamicToken(subToken)) return uncertain('dynamic git subcommand')
+  const globals = argv.slice(0, scan.index)
+  const alias = configuredGitAlias(tokens, index, globals, tokenValue(subToken).toLowerCase())
+  if (alias === null) return classifyGitArgv(argv, binary)
+  if (alias.startsWith('!')) return parser.parseScript(alias.slice(1))
+  const expanded = tokenize(alias)
+  if (expanded.invalid) return uncertain('unparsed git alias')
+  return classifyGitArgv([...expanded.tokens, ...argv.slice(scan.index + 1)], binary)
+}
+
+function walkShellCommand(name: string, args: readonly Token[], cfg: ClassifyConfig, parser: Parser, feed: StdinFeed | undefined): readonly Invocation[] | null {
+  if (cfg.shellNames.has(name)) return walkShell(args, cfg, parser.parseScript, feed)
+  if (cfg.shellExecutors.has(name)) return uncertain(`dynamic ${name} execution`)
+  if (name === 'busybox') return args.length ? parser.walk(args, feed) : []
+  return null
+}
+
+const LEAN_CTX_COMMAND_NAMES: ReadonlySet<string> = new Set(['lean-ctx', 'lean-ctx.exe'])
+/** `lean-ctx raw`'s documented alias, plus `exec` ("Same as -c" per `lean-ctx help all`). */
+const LEAN_CTX_EXEC_WORDS: ReadonlySet<string> = new Set(['exec', 'raw', 'bypass'])
+/**
+ * lean-ctx's own shell-hook re-exec placeholder (`exec lean-ctx -c
+ * "$BASH_EXECUTION_STRING"`, injected into `~/.bashenv` by `lean-ctx setup`
+ * — see `../impl/tool-lean-ctx-global.ts`'s module doc). Bash substitutes
+ * the REAL command text into this variable inside the interactive shell's
+ * OWN DEBUG-trap machinery — never inside a Bash-tool `command` string an
+ * agent hands this hook. Reaching here unresolved means lean-ctx execs an
+ * EMPTY command (the variable is unset in every context this static
+ * scanner actually observes), not an unknown one, so it is recognized as
+ * this ONE specific, known placeholder and left alone — rather than
+ * failing closed on "any `$...`", which `dynamicToken` would otherwise do
+ * for every other unresolvable value below.
+ */
+const LEAN_CTX_SHELL_HOOK_PLACEHOLDER = '$BASH_EXECUTION_STRING'
+
+/**
+ * lean-ctx's own arbitrary-command-execution surface — independent-review
+ * finding 1 (HIGH, pre-existing, affects every rule): `-c [--raw]`, `-t`,
+ * `exec`, `raw`/`bypass <command>` all hand a shell command to a REAL
+ * shell, exactly like `bash -c`'s own script argument, but nothing walked
+ * that argument before this fix — it was an opaque word inside an
+ * unclassified `{kind:'command', name:'lean-ctx', ...}`.
+ *
+ * Verified against the real `lean-ctx 3.10.5` binary: `lean-ctx -c echo a
+ * b` prints `a b` — every remaining word is joined with a single space
+ * into ONE command string (not only the first), so `rest.map(tokenValue).
+ * join(' ')` mirrors that exactly; a single already-quoted argument
+ * (`-c "npm install"`) round-trips unchanged through the same join.
+ *
+ * `lean-ctx shell` (an interactive compressed shell) is the READ side of
+ * the same risk when its stdin is fed by a pipe or a file redirection —
+ * the commands it will run are whatever that feed contains, invisible to
+ * this static scanner, so it fails closed as `uncertain` (matching how
+ * every other unreadable script source in this file is handled) rather
+ * than silently falling through to an unclassified allow. A bare `lean-ctx
+ * shell` with no stdin feed is left unclassified (out of scope for this
+ * finding — no probe or finding names that shape, and an interactive
+ * session an agent cannot feed input into is not the arbitrary-command
+ * risk this fix closes).
+ *
+ * Redirections between `lean-ctx` and its first argument (`lean-ctx
+ * >/dev/null -c "cmd"`) are stripped here the same way `walkShell` strips
+ * them for a real shell's own `-c` — `rawArgs` (`args` in `classify()`)
+ * still carries them; the generic `{kind:'command', ...}` fallback and
+ * `tool.lean-ctx-global-state`'s own `firstPositional` scan handle THAT
+ * redirection-before-subcommand case for the subcommand forms this
+ * function does not otherwise touch.
+ */
+function walkLeanCtxExec(
+  name: string,
+  rawArgs: readonly Token[],
+  rawTokens: readonly Token[],
+  parser: Parser,
+  feed: StdinFeed | undefined,
+): readonly Invocation[] | null {
+  if (!LEAN_CTX_COMMAND_NAMES.has(name)) return null
+  const args = withoutRedirections(rawArgs)
+  if (args.length === 0) return null
+  const first = tokenValue(args[0] as Token)
+  const firstLower = first.toLowerCase()
+
+  if (firstLower === 'shell') {
+    return feed !== undefined || readsStdinFromFile(rawTokens) ? uncertain('lean-ctx shell fed from stdin') : null
+  }
+
+  let rest: readonly Token[] | null = null
+  if (first === '-c') {
+    const second = args[1]
+    rest = second !== undefined && tokenValue(second) === '--raw' ? args.slice(2) : args.slice(1)
+  } else if (first === '-t') {
+    rest = args.slice(1)
+  } else if (LEAN_CTX_EXEC_WORDS.has(firstLower)) {
+    rest = args.slice(1)
+  }
+  if (rest === null) return null
+  if (rest.length === 0) return uncertain('dynamic lean-ctx script')
+  if (rest.length === 1 && tokenValue(rest[0] as Token) === LEAN_CTX_SHELL_HOOK_PLACEHOLDER) return []
+  const joined = rest.map(tokenValue).join(' ')
+  return parser.parseScript(joined, feed)
+}
+
+const isTrashDestination = (token: Token): boolean => {
+  const value = tokenValue(token).replace(/\/+$/, '')
+  return value.endsWith('/.Trash') || value === '~/.Trash' || value.endsWith('/Trash')
+}
+const movesIntoTrash = (args: readonly Token[]): boolean => args.some((token) => isTrashDestination(token))
+
+function walkFileCommand(name: string, args: readonly Token[], cfg: ClassifyConfig): readonly Invocation[] | null {
+  if (cfg.rmNames.has(name)) return [{ kind: 'rm', args }]
+  if (cfg.trashNames.has(name)) return [{ kind: 'trash', args }]
+  if (name === 'mv' && movesIntoTrash(args)) {
+    return [{ kind: 'trash', args: args.filter((token) => !isTrashDestination(token)) }]
+  }
+  if (name === 'mv') return [{ kind: 'mv', args }]
+  if (name !== 'chmod' && name !== 'chmod.exe') return null
+  const disarms = args.some((token) => {
+    const value = tokenValue(token)
+    return /(^|\/)workflows\/hooks(\/|$)/.test(value) || /(^|\/)\.git\/hooks(\/|$)/.test(value)
+  })
+  return disarms ? [{ kind: 'hook-disarm' }] : null
+}
+
+function walkJustCommand(args: readonly Token[]): readonly Invocation[] | null {
+  // `just _cargo ...` shells out straight to cargo (walk.mjs:145) and is kept.
+  // The recipe-name branch that followed it (walk.mjs:146-150) is not ported
+  // — see the module comment for why.
+  if (args.some((token) => tokenValue(token) === '_cargo')) return [{ kind: 'cargo' }]
+  return null
+}
+
+/** bun's own global flags that take a directory value ahead of the subcommand — `bun -C <dir> test`, `bun --cwd <dir> test`. */
+const BUN_CWD_FLAGS = new Set(['-C', '--cwd'])
+
+/**
+ * Whether `bun <args>` invokes the `test` subcommand, after skipping bun's
+ * own `-C <dir>` / `--cwd <dir>` / `--cwd=<dir>` global (bun accepts that
+ * ahead of the subcommand to run in a different directory). Any operand
+ * after `test` — a file, a pattern, `--coverage`, `--help` — leaves this
+ * true: per Tarun's decision (2026-09-27, feature az372) `bun test` is
+ * denied with ANY arguments, unlike cargo/frontend-tool which carve out
+ * `--help`/`--version`.
+ */
+function isBunTestSubcommand(args: readonly Token[]): boolean {
+  let index = 0
+  while (index < args.length) {
+    const value = tokenValue(args[index] as Token)
+    if (BUN_CWD_FLAGS.has(value)) {
+      index += 2
+      continue
+    }
+    if (value.startsWith('--cwd=')) {
+      index += 1
+      continue
+    }
+    break
+  }
+  const subcommand = args[index]
+  return subcommand !== undefined && tokenValue(subcommand) === 'test'
+}
+
+/**
+ * The real Azure CLI global parameters that can appear before ANY
+ * subcommand group — https://learn.microsoft.com/cli/azure/reference-index
+ * (checked 2026-09-28) — M6 (STATUS.md 12p):
+ * without skipping these, `az --output json devops project list` read
+ * `args[0]` as `--output`, not `devops`, never matched
+ * `azureDevopsSubcommands`, and fell through to the generic `'command'` kind
+ * — invisible to `tool.azure-devops`'s outright deny. `--help`/`-h`/
+ * `--version`/`-v` are deliberately NOT skipped here: `isHelpOrVersionOnly`
+ * already gates a purely-help invocation before this runs, and one
+ * appearing BEFORE the subcommand group is real az's own "show generic
+ * help, run nothing" shape — not worth threading through this scan too.
+ */
+const AZ_GLOBAL_VALUE_FLAGS: ReadonlySet<string> = new Set(['--output', '-o', '--query', '--subscription'])
+const AZ_GLOBAL_BOOLEAN_FLAGS: ReadonlySet<string> = new Set(['--debug', '--only-show-errors', '--verbose'])
+
+/**
+ * Index of the first word in `args` that is not a recognized `az` global
+ * flag (or its value) — see `AZ_GLOBAL_VALUE_FLAGS`/`AZ_GLOBAL_BOOLEAN_FLAGS`.
+ * `--flag=value` is a single word and is skipped as one. Exported (not just
+ * used internally here) so `impl/tool-azure-devops.ts`'s own separate
+ * `account get-access-token`/`rest` positional checks (M6) use the SAME
+ * skip, rather than a second copy that could drift from this one.
+ */
+export function skipAzGlobalFlags(args: readonly Token[]): number {
+  let index = 0
+  while (index < args.length) {
+    const value = tokenValue(args[index] as Token)
+    if (AZ_GLOBAL_VALUE_FLAGS.has(value)) {
+      index += 2
+      continue
+    }
+    const equals = value.indexOf('=')
+    if (equals > 0 && AZ_GLOBAL_VALUE_FLAGS.has(value.slice(0, equals))) {
+      index += 1
+      continue
+    }
+    if (AZ_GLOBAL_BOOLEAN_FLAGS.has(value)) {
+      index += 1
+      continue
+    }
+    break
+  }
+  return index
+}
+
+function walkToolCommand(name: string, args: readonly Token[], cfg: ClassifyConfig, walk: (tokens: readonly Token[]) => readonly Invocation[]): readonly Invocation[] | null {
+  if (cfg.azureDevopsNames.has(name)) {
+    if (isHelpOrVersionOnly(args)) return []
+    const subIndex = skipAzGlobalFlags(args)
+    const subcommand = subIndex < args.length ? tokenValue(args[subIndex] as Token) : ''
+    if (!cfg.azureDevopsSubcommands.has(subcommand)) return null
+    if (isHelpOrVersionOnly(args.slice(subIndex + 1))) return []
+    return [{ kind: 'azure-devops', args }]
+  }
+  if (cfg.cargoNames.has(name)) return isHelpOrVersionOnly(args) ? [] : [{ kind: 'cargo' }]
+  if (cfg.frontendToolNames.has(name)) return isHelpOrVersionOnly(args) ? [] : [{ kind: 'frontend-tool', tool: name }]
+  if (cfg.bunNames.has(name)) return isBunTestSubcommand(args) ? [{ kind: 'bun-test' }] : null
+  if (cfg.justNames.has(name)) return walkJustCommand(args)
+  if (name === 'xargs' || name === 'xargs.exe') return xargsInvocation(args, walk)
+  // `find` is denied outright, not merely inspected for -exec/-delete
+  // payloads: it emits PATHS, so piping it to grep/rg/awk/etc. filters
+  // FILENAMES, never file contents (see impl/tool-find.ts for the message).
+  if (name === 'find' || name === 'find.exe') return [{ kind: 'find' }]
+  // `grep` is denied outright, in every shape including a pure stdin filter:
+  // `rg` does that job too, and faster, so there is no capability to carve out
+  // (see impl/tool-grep.ts for the message and the replacement set).
+  if (GREP_NAMES.has(name)) return [{ kind: 'grep' }]
+  return null
+}
+
+/** The grep family, plus the Windows spellings the other tool checks accept. */
+const GREP_NAMES: ReadonlySet<string> = new Set([
+  'grep', 'egrep', 'fgrep', 'rgrep',
+  'grep.exe', 'egrep.exe', 'fgrep.exe', 'rgrep.exe',
+])
+
+function walkNested(tokens: readonly Token[], index: number, args: readonly Token[], cfg: ClassifyConfig, walk: (tokens: readonly Token[]) => readonly Invocation[]): readonly Invocation[] {
+  const nested: Invocation[] = []
+  for (let look = 0; look < args.length; look += 1) {
+    const arg = args[look] as Token
+    if (dynamicToken(arg) || !isClassifiedCommandName(arg, cfg)) continue
+    for (const invocation of walk(tokens.slice(index + 1 + look))) {
+      if (invocation.kind === 'uncertain' && invocation.reason === 'git command missing subcommand') continue
+      nested.push(invocation)
+    }
+  }
+  return nested
+}
+
+/** Nested shell scripts (`-c` arguments, here-document and here-string bodies fed to a shell) are walked at most this deep. */
+export const MAX_SHELL_SCRIPT_DEPTH = 16
+
+/**
+ * A piece's stdin when a pipe feeds it: every earlier stage of its pipeline
+ * (nearest last), and whether the pipeline starts at a group/subshell
+ * (`{ ...; } | b`) preceded by a here-document — that group's output is unknown.
+ */
+interface StdinFeed {
+  readonly upstream: readonly (readonly Token[])[]
+  /** Raw source text of each `upstream` stage (parallel to it), for static echo/printf reconstruction. */
+  readonly upstreamText: readonly string[]
+  readonly groupAfterHereText: boolean
+  /** Every piece before a group/subshell that pipes into this one (`(curl x) | bash`); empty otherwise. */
+  readonly groupUpstream: readonly (readonly Token[])[]
+}
+
+interface Parser {
+  readonly walk: (tokens: readonly Token[], feed?: StdinFeed) => readonly Invocation[]
+  /**
+   * Parse a shell script that a shell will run, one nesting level deeper.
+   * `feed` is the outer pipe's stdin, passed through only to the script's
+   * own first top-level piece — a `-c` script inherits the invoking
+   * process's stdin, so `bash -c 'bash'` fed by a pipe reads that pipe's
+   * content as ITS script, exactly like a bare piped `bash` would.
+   */
+  readonly parseScript: (script: string, feed?: StdinFeed) => readonly Invocation[]
+}
+
+/** A command's tokens with its here-document placeholders detached, plus the text it reads from here-documents/strings. */
+interface ShellInput {
+  readonly tokens: readonly Token[]
+  readonly documents: readonly HereDocument[]
+  readonly hereStrings: readonly Token[]
+}
+
+/**
+ * Remove each `<<`/`<<-` + placeholder pair (so every rule sees exactly the
+ * tokens it saw when bodies were simply stripped) and collect the bodies and
+ * `<<<` words the command reads.
+ */
+function detachShellInput(tokens: readonly Token[], documents: readonly HereDocument[]): ShellInput {
+  const kept: Token[] = []
+  const attached: HereDocument[] = []
+  const hereStrings: Token[] = []
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index] as Token
+    const word = tokens[index + 1]
+    if ((token.redirect === '<<' || token.redirect === '<<-') && word !== undefined) {
+      const placeholder = hereDocumentPlaceholderIndex(tokenValue(word))
+      const document = placeholder === null ? undefined : documents[placeholder]
+      if (document !== undefined) {
+        attached.push(document)
+        index += 1
+        continue
+      }
+    }
+    if (token.redirect === '<<<' && word !== undefined) hereStrings.push(word)
+    kept.push(token)
+  }
+  return { tokens: kept, documents: attached, hereStrings }
+}
+
+const readsHereText = (input: ShellInput): boolean => input.documents.length > 0 || input.hereStrings.length > 0
+const hasUnquotedDocument = (input: ShellInput): boolean => input.documents.some((document) => !document.quoted)
+
+/**
+ * Walk here-document bodies and here-string words as the script a shell reads
+ * from them. The literal text is walked FIRST, so a recognisable command
+ * reports under its own rule; an unquoted body or an expanding here-string is
+ * then still uninspectable (the outer shell expands it before the inner one
+ * parses it) and fails closed as before.
+ */
+function hereTextScript(input: ShellInput, parser: Parser): readonly Invocation[] {
+  const found: Invocation[] = []
+  for (const document of input.documents) found.push(...parser.parseScript(document.body))
+  for (const word of input.hereStrings) found.push(...parser.parseScript(tokenValue(word)))
+  if (hasUnquotedDocument(input)) found.push(...uncertain('unparsed unquoted here-document'))
+  if (input.hereStrings.some((word) => /[$`]/.test(tokenValue(word)))) found.push(...uncertain('dynamic here-string'))
+  return found
+}
+
+function commandOf(input: ShellInput): { readonly name: string; readonly args: readonly Token[] } {
+  const index = skipPrefixes(input.tokens)
+  const name = index < input.tokens.length ? basename(input.tokens[index] as Token) : ''
+  return { name, args: withoutRedirections(input.tokens.slice(index + 1)) }
+}
+
+const pipelineReadsHereText = (feed: StdinFeed, documents: readonly HereDocument[]): boolean =>
+  feed.groupAfterHereText || feed.upstream.some((tokens) => readsHereText(detachShellInput(tokens, documents)))
+
+/**
+ * `cat <<'EOF' | bash`: a single bare `cat` stage passes its here-text through
+ * unchanged, so it is walked as the script; any other stage (or more than one)
+ * may transform it unseen, so it fails closed.
+ */
+function pipedHereTextScript(feed: StdinFeed, documents: readonly HereDocument[], parser: Parser): readonly Invocation[] {
+  if (!pipelineReadsHereText(feed, documents)) return []
+  const only = feed.upstream.length === 1 && !feed.groupAfterHereText ? detachShellInput(feed.upstream[0] as readonly Token[], documents) : null
+  if (only === null) return uncertain('here-document piped to shell')
+  const { name, args } = commandOf(only)
+  const plainCat = (name === 'cat' || name === 'cat.exe') && args.every((token) => tokenValue(token) === '-')
+  return plainCat ? hereTextScript(only, parser) : uncertain('here-document piped to shell')
+}
+
+const pipedFetcher = (feed: StdinFeed): string | null => {
+  for (const stage of [...feed.groupUpstream, ...feed.upstream]) {
+    const fetcher = stageFetcher(stage)
+    if (fetcher !== null) return fetcher
+  }
+  return null
+}
+
+/** The first fetcher run inside a substitution among a code runner's words (`bash <(curl x)`, `eval "$(curl x)"`). */
+const substitutedFetcher = (tokens: readonly Token[]): string | null => {
+  for (const token of tokens) {
+    const fetcher = wordFetcher(tokenValue(token))
+    if (fetcher !== null) return fetcher
+  }
+  return null
+}
+
+function makeParser(cfg: ClassifyConfig): Parser & { readonly parse: (command: string) => readonly Invocation[] } {
+  const documents: HereDocument[] = []
+  let depth = 0
+
+  /**
+   * A shell fed by a pipe (no here-text anywhere in the pipeline): remote
+   * content is denied outright; otherwise, when the shell reads its script
+   * from stdin, a lone static echo/printf is reconstructed and walked and any
+   * other producer fails closed.
+   */
+  const pipedShellScript = (args: readonly Token[], input: ShellInput, feed: StdinFeed): readonly Invocation[] => {
+    if (pipelineReadsHereText(feed, documents)) return pipedHereTextScript(feed, documents, parser)
+    const fetcher = pipedFetcher(feed)
+    if (fetcher !== null) return remoteExec(fetcher)
+    if (readsHereText(input) || readsStdinFromFile(args) || !shellScriptFromStdin(withoutRedirections(args))) return []
+    const only = feed.upstream.length === 1 && feed.groupUpstream.length === 0 ? feed.upstreamText[0] : undefined
+    const script = only === undefined ? null : staticProducerOutput(only)
+    return script === null ? uncertain('script piped to shell') : parser.parseScript(script)
+  }
+
+  const stdinInvocations = (name: string, args: readonly Token[], input: ShellInput, feed: StdinFeed | undefined): readonly Invocation[] => {
+    const found: Invocation[] = []
+    const runsCode = cfg.shellNames.has(name) || cfg.shellExecutors.has(name) || EXPRESSION_RUNNERS.has(name)
+    const substituted = runsCode ? substitutedFetcher(args) : null
+    if (substituted !== null) found.push(...remoteExec(substituted))
+    if (EXPRESSION_RUNNERS.has(name) && feed !== undefined) {
+      const fetcher = pipedFetcher(feed)
+      found.push(...(fetcher === null ? uncertain('script piped to expression runner') : remoteExec(fetcher)))
+      return found
+    }
+    if (cfg.shellNames.has(name) && !shellRunsNothing(withoutRedirections(args))) {
+      found.push(...hereTextScript(input, parser))
+      if (feed !== undefined) found.push(...pipedShellScript(args, input, feed))
+      return found
+    }
+    const pipedHereText = feed !== undefined && pipelineReadsHereText(feed, documents)
+    const fedHereText = readsHereText(input) || pipedHereText
+    const xargsShell = (name === 'xargs' || name === 'xargs.exe') && args.some((token) => cfg.shellNames.has(basename(token)))
+    if (xargsShell && feed !== undefined && !pipedHereText) {
+      const fetcher = pipedFetcher(feed)
+      if (fetcher !== null) return [...found, ...remoteExec(fetcher)]
+      if (xargsShellReadsInput(args, cfg)) return [...found, ...uncertain('dynamic xargs execution')]
+    }
+    if (fedHereText && xargsShell) return [...found, ...uncertain('dynamic xargs execution')]
+    return hasUnquotedDocument(input) ? [...found, ...uncertain('unparsed unquoted here-document')] : found
+  }
+
+  const walk = (rawTokens: readonly Token[], feed?: StdinFeed): readonly Invocation[] => {
+    const input = detachShellInput(rawTokens, documents)
+    const tokens = input.tokens
+    // R3 (STATUS.md 12p): `env -S`/`--split-string` splits its
+    // value into argv and execs it — but `skipPrefixes`'s own `skipEnvFlags`
+    // (../prefixes.ts) treats that value as an opaque, value-taking flag
+    // argument and skips straight past it, so whatever it actually names was
+    // previously invisible to every rule (a bare `env -S '<value>'` made
+    // `invocations()` return `[]` — no Invocation, so no rule's match() ever
+    // ran). Checked BEFORE `skipPrefixes` runs, so this fires instead of
+    // silently vanishing; see `envUsesSplitString`'s own doc.
+    if (envUsesSplitString(tokens)) return [...uncertain('env -S/--split-string execution')]
+    const index = skipPrefixes(tokens)
+    const name = index < tokens.length ? basename(tokens[index] as Token) : ''
+    const args = tokens.slice(index + 1)
+    // Emitted FIRST, so a `.git` write reports as fs.git-internals rather than
+    // as the generic rm/trash/find denial the same command also trips.
+    const targets = gitInternalsWriteTargets(name, args, tokens)
+    const found: Invocation[] = targets.length > 0 ? [{ kind: 'git-internals-write', name, targets }] : []
+    const carrierTargets = protectedCarrierWriteTargets(name, args, tokens)
+    if (carrierTargets.length > 0) found.push({ kind: 'protected-carrier-write', name, targets: carrierTargets })
+    // A write whose target is an unresolvable command substitution fails closed, like any other dynamic construct.
+    if (unresolvableRedirectionWriteTargets(tokens).length > 0) found.push(...uncertain('dynamic redirection target'))
+    if (unresolvableOperandWriteTargets(name, args).length > 0) found.push(...uncertain('dynamic write target'))
+    found.push(...stdinInvocations(name, args, input, feed))
+    found.push(...classify(tokens, index, name, args, feed))
+    return found
+  }
+  const classify = (tokens: readonly Token[], index: number, name: string, args: readonly Token[], feed: StdinFeed | undefined): readonly Invocation[] => {
+    if (index >= tokens.length) return []
+    const first = tokens[index] as Token
+    if (name === 'git-worktree' || name === 'git-worktree.exe') return [{ kind: 'git', subcommand: 'worktree', globals: [], rest: args }]
+    if (dynamicToken(first)) return uncertain('dynamic shell command')
+
+    // Independent-review finding 1 (HIGH, pre-existing, affects every rule):
+    // lean-ctx's own -c/-t/exec/raw(/bypass) run an ARBITRARY shell command
+    // that nothing below this point ever inspected — see walkLeanCtxExec's
+    // own doc for the fix and the verified-against-the-real-binary behavior
+    // it relies on. Checked before walkShellCommand/walkToolCommand/the
+    // generic fallback, same priority as a real shell's own -c.
+    const leanCtxExec = walkLeanCtxExec(name, args, tokens, parser, feed)
+    if (leanCtxExec !== null) return leanCtxExec
+
+    const shellCommand = walkShellCommand(name, args, cfg, parser, feed)
+    const denied = deniedPathInvocation(name, args, cfg)
+    if (denied !== null) return [denied]
+    if (shellCommand !== null) return shellCommand
+    if (name === 'git' || name === 'git.exe') return walkGit(tokens, index, parser)
+    const fileCommand = walkFileCommand(name, args, cfg)
+    if (fileCommand !== null) return fileCommand
+    const toolCommand = walkToolCommand(name, args, cfg, walk)
+    if (toolCommand !== null) return toolCommand
+    if (cfg.substitutableFinders.has(name)) return [{ kind: 'read-only', name }]
+    if (cfg.introspectionNames.has(name) || cfg.subcommandTools.has(name) || cfg.readOnlyConsumers.has(name)) return []
+    // `prefix` is omitted entirely (rather than set to `[]`) when nothing was
+    // skipped, so every existing `toEqual({kind:'command', name, args})`
+    // fixture — none of which name a wrapper or leading assignment — keeps
+    // matching exactly; only an invocation that actually had one gains the
+    // extra field.
+    const prefix = tokens.slice(0, index)
+    const command: Invocation = prefix.length > 0 ? { kind: 'command', name, args, prefix } : { kind: 'command', name, args }
+    return [command, ...walkNested(tokens, index, args, cfg, walk)]
+  }
+
+  const feedFor = (
+    feeds: readonly PieceFeed[],
+    pieces: readonly (readonly Token[])[],
+    texts: readonly string[],
+    index: number,
+  ): StdinFeed | undefined => {
+    if (feeds[index] !== 'piece' && feeds[index] !== 'group') return undefined
+    let start = index
+    while (start > 0 && feeds[start] === 'piece') start -= 1
+    const upstream = pieces.slice(start, index)
+    const groupUpstream = feeds[start] === 'group' ? pieces.slice(0, start) : []
+    const groupAfterHereText = groupUpstream.some((tokens) => readsHereText(detachShellInput(tokens, documents)))
+    return { upstream, upstreamText: texts.slice(start, index), groupAfterHereText, groupUpstream }
+  }
+
+  /**
+   * `outerFeed` is a `-c` script's inherited stdin (the outer pipe): it
+   * applies only to the script's own first top-level piece, when that piece
+   * isn't already fed by a pipe/group inside the script itself — a `-c`
+   * script's first stage reads the invoking process's stdin exactly like a
+   * bare piped shell would (`producer | outer -c 'bash'` reads `producer`'s
+   * output as the SCRIPT `bash` then reads, same as `producer | bash`).
+   * Nested `$(...)`/backtick sources never inherit it.
+   */
+  const parse = (command: string, outerFeed?: StdinFeed): readonly Invocation[] => {
+    const offset = documents.length
+    const scan = scanHereDocuments(command, (n) => `<<${hereDocumentPlaceholder(offset + n)} `)
+    if (scan.invalid) return uncertain(scan.reason ?? 'unparsed here-document')
+    documents.push(...scan.documents)
+
+    const nested = nestedSources(scan.text)
+    if (nested.invalid) return uncertain(nested.reason ?? 'unclosed shell construct')
+    const found: Invocation[] = []
+    for (const source of nested.sources) found.push(...parse(source))
+
+    const split = splitShell(scan.text)
+    if (split.invalid) return uncertain(split.reason ?? 'unparsed shell input')
+    const pieces: (readonly Token[])[] = []
+    for (const piece of split.pieces) {
+      const tokenized = tokenize(piece)
+      if (tokenized.invalid) return uncertain('unparsed shell token')
+      pieces.push(tokenized.tokens)
+    }
+    pieces.forEach((tokens, index) => {
+      const localFeed = feedFor(split.feeds, pieces, split.pieces, index)
+      found.push(...walk(tokens, localFeed ?? (index === 0 ? outerFeed : undefined)))
+    })
+    return found
+  }
+
+  const parseScript = (script: string, feed?: StdinFeed): readonly Invocation[] => {
+    if (depth >= MAX_SHELL_SCRIPT_DEPTH) return uncertain('shell input nested too deeply')
+    depth += 1
+    try {
+      return parse(script, feed)
+    } finally {
+      depth -= 1
+    }
+  }
+
+  const parser = { walk, parseScript, parse }
+  return parser
+}
+
+/** Parse and classify a raw shell command line into zero or more Invocations. */
+export function invocations(command: string, cfg: ClassifyConfig = DEFAULT_CLASSIFY_CONFIG): readonly Invocation[] {
+  return makeParser(cfg).parse(command)
+}
+
+/**
+ * The first argument that reaches into one of `cfg.deniedTrees`, or null.
+ *
+ * Matches a tree EXACTLY or as a parent directory — `<tree>` and `<tree>/...`,
+ * never `<tree>-m5`. A clone whose name merely starts with the denied one is a
+ * different repository and stays usable; that boundary is the whole point.
+ */
+function deniedPathInvocation(
+  name: string,
+  args: readonly Token[],
+  cfg: ClassifyConfig,
+): Invocation | null {
+  if (cfg.deniedTrees.length === 0) return null
+  for (const token of args) {
+    const raw = tokenValue(token)
+    if (raw.startsWith('-')) continue
+    const path = raw.replace(/\/+$/, '')
+    for (const tree of cfg.deniedTrees) {
+      if (path === tree || path.startsWith(`${tree}/`)) return { kind: 'denied-path', name, path: raw }
+    }
+  }
+  return null
+}