@blogic-cz/agent-tools 1.11.1 → 1.13.0

package/src/credential-guard/index.ts

@@ -1,25 +1,14 @@
-/**
- * Credential Guard
- *
- * Security patterns and functions for detecting sensitive files and secrets.
- * Used by AI coding agent hooks/plugins.
- *
- * Security layers:
- * 1. Path-based blocking (files that should never be read)
- * 2. Content scanning (detect secrets in write operations)
- * 3. Dangerous bash command detection
- * 4. CLI tool blocking (must use wrapper tools)
- *
- * Note: This is a convenience layer. Real security should be enforced
- * at infrastructure level (K8s RBAC, file permissions, etc.)
- */
-
-import type { CliToolOverride, CredentialGuardConfig } from "#config/types";
+import type { CredentialGuardConfig } from "#config/types";
 import { redactSensitiveText } from "#shared/content-security";
 import { SECRET_PATTERNS } from "#shared/credential-patterns";
 import { posix } from "node:path";
 import { lstatSync, realpathSync } from "node:fs";
-import { passiveJqProgramIndex } from "./passive-jq";
+import { parseBash } from "./bash";
+import { parsePowerShell } from "./powershell";
+import { judge } from "./policy";
+import type { Decision, PolicyContext } from "./policy";
+import { buildRegistry, executableName } from "./registry";
+import { DEFAULT_ALLOWED_PATH_PATTERNS, isSensitivePath, normalizePath } from "./paths";
 
 export { findSecretMatches } from "#shared/credential-patterns";
 export { redactSensitiveText } from "#shared/content-security";
@@ -38,12 +27,6 @@ export type HookOutput = {
   args: Record<string, unknown>;
 };
 
-type BlockedCliTool = {
-  pattern: RegExp;
-  name: string;
-  wrapper: string;
-};
-
 /** Object returned by createCredentialGuard */
 export type CredentialGuard = {
   handleToolExecuteBefore: (input: HookInput, output: HookOutput) => void;
@@ -56,82 +39,6 @@ export type CredentialGuard = {
   detectSleepPolling: (command: string) => string | null;
 };
 
-// ============================================================================
-// DEFAULT PATTERNS
-// ============================================================================
-
-/**
- * Paths that should NEVER be accessed by AI agents.
- * These patterns match files containing credentials, keys, and secrets.
- */
-const DEFAULT_BLOCKED_PATH_PATTERNS: RegExp[] = [
-  /\.env$/,
-  /\.env\.[^.]+$/, // .env.local, .env.production, etc.
-  /\.pem$/,
-  /\.key$/,
-  /\.p12$/,
-  /\.pfx$/,
-  /\/secrets?\//i,
-  /^secrets?\//i,
-  /\/credentials?\//i,
-  /^credentials?\//i,
-  /\.aws\//,
-  /\.ssh\//,
-  /\.kube\//,
-  // Every kubeconfig segment is protected except a final non-prefix Markdown prose basename.
-  /(?:^|\/)(?:kubeconfig[^/]*|(?![^/]+\.md(?![\s\S]))[^/]*kubeconfig[^/]*)(?:\/|$)/i,
-  /\.sentryclirc$/,
-];
-
-/**
- * Exceptions - files that match blocked patterns but are safe to access.
- * Only truly generic defaults (no project-specific paths).
- */
-const DEFAULT_ALLOWED_PATH_PATTERNS: RegExp[] = [
-  /\.env\.example$/,
-  /\.env\.template$/,
-  /\.env\.sample$/,
-];
-
-const PROCESS_ENVIRONMENT_PATH =
-  /^(?:\/|(?:\.\.\/)*)proc\/(?:self|thread-self|[0-9]+|\$\$|\$\{\$\})(?:\/task\/(?:[0-9]+|\$\$|\$\{\$\}))?\/environ$/;
-
-/**
- * CLI tools that must use wrapper tools for security and audit.
- */
-const DEFAULT_BLOCKED_CLI_TOOLS: BlockedCliTool[] = [
-  {
-    pattern: /(?:^|[;&|]\s*)gh\s/,
-    name: "gh",
-    wrapper: "agent-tools-gh",
-  },
-  {
-    pattern: /(?:^|[;&|]\s*)kubectl\s/,
-    name: "kubectl",
-    wrapper: "agent-tools-k8s",
-  },
-  {
-    pattern: /(?:^|[;&|]\s*)psql\s/,
-    name: "psql",
-    wrapper: "agent-tools-db",
-  },
-  {
-    pattern: /(?:^|[;&|]\s*)az\s+(?:devops|pipelines|repos|boards|artifacts)\b/,
-    name: "az (Azure DevOps)",
-    wrapper: "agent-tools-azdo",
-  },
-  {
-    pattern: /(?:^|[;&|]\s*)az\s/,
-    name: "az",
-    wrapper: "agent-tools-az",
-  },
-  {
-    pattern: /(?:^|[;&|]\s*)curl\s.*dev\.azure\.com/,
-    name: "curl (Azure DevOps)",
-    wrapper: "agent-tools-azdo",
-  },
-];
-
 type PollingDetectionRule = {
   pattern: RegExp;
   suggestion: string;
@@ -160,4223 +67,333 @@ const DEFAULT_POLLING_DETECTION_RULES: PollingDetectionRule[] = [
   },
 ];
 
-/**
- * Read-only gh subcommands safe on external repos with -R flag.
- */
-const GH_ALLOWED_READONLY_SUBCOMMANDS = new Set([
-  "issue list",
-  "issue view",
-  "issue search",
-  "pr list",
-  "pr view",
-  "pr diff",
-  "pr checks",
-  "release list",
-  "release view",
-  "repo view",
-  "search issues",
-  "search prs",
-  "search repos",
-]);
-
-function isAllowedGhArgv(argv: string[]): boolean {
-  const subcommand = argv.slice(1, 3).join(" ");
-  return (
-    argv.some((arg, index) => (arg === "-R" || arg === "--repo") && Boolean(argv[index + 1])) &&
-    GH_ALLOWED_READONLY_SUBCOMMANDS.has(subcommand)
-  );
-}
-
-function getLeadingLiteralAssignments(
-  command: string,
-): Map<string, { value: string; end: number }> {
-  const assignments = new Map<string, { value: string; end: number }>();
-  let offset = 0;
-  while (offset === 0 || command[offset - 1] === ";" || command[offset - 1] === "\n") {
-    while (/[ \t\n]/.test(command[offset] ?? "")) offset++;
-    const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./-]+)/.exec(command.slice(offset));
-    if (!assignment) break;
-    const end = offset + assignment[0].length;
-    const next = command.slice(end).match(/^[ \t]*/)?.[0].length ?? 0;
-    const separator = command[end + next];
-    if (separator !== ";" && separator !== "\n") break;
-    assignments.set(assignment[1] ?? "", { value: assignment[2] ?? "", end });
-    offset = end + next + 1;
-  }
-  return assignments;
-}
-
-function isSafeHerdrTabCreate(argv: string[]): boolean {
-  if (argv[0] !== "herdr" || argv[1] !== "tab" || argv[2] !== "create") return false;
-  const seen = new Set<string>();
-  for (let index = 3; index < argv.length; index++) {
-    const arg = argv[index] ?? "";
-    const [option, ...attached] = arg.split("=");
-    if (option === "--focus" || option === "--no-focus") {
-      if (attached.length || seen.has("focus")) return false;
-      seen.add("focus");
-      continue;
-    }
-    if (!["--workspace", "--cwd", "--label"].includes(option ?? "") || seen.has(option ?? ""))
-      return false;
-    const value = attached.length ? attached.join("=") : argv[++index];
-    if (!value || (!attached.length && value.startsWith("--"))) return false;
-    seen.add(option ?? "");
-  }
-  return true;
-}
-
-function hasSafeLocalAssignmentCommands(
-  command: string,
-  assignments: Map<string, { value: string; end: number }>,
-  statusCaptures: Set<string>,
-): boolean {
-  if (!assignments.size) return true;
-  const parsed = parseStaticShellCommands(command);
-  if (!parsed || typeof parsed === "string") return false;
-  return parsed.pipelines.flat().every((words) => {
-    if (words.length === 1 && statusCaptures.has(words[0] ?? "")) return true;
-    const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=([A-Za-z0-9_./-]+)$/.exec(words[0] ?? "");
-    if (assignment) {
-      return (
-        words.length === 1 &&
-        assignment[1] !== "IFS" &&
-        assignments.get(assignment[1] ?? "")?.value === assignment[2]
-      );
-    }
-    return isSafeLocalAssignmentCommand(words);
-  });
-}
-
-function isSafeLocalAssignmentCommand(words: string[]): boolean {
-  const argv = unwrapStaticCommand(words);
-  if (isSafeHerdrTabCreate(argv)) return true;
-  const name = argv[0]?.split("/").at(-1) ?? "";
-  if (name === "wc" && hasExecutionOption(argv.slice(1), ["files0-from"])) return false;
-  if (name === "cd") return isNavigationOperand(argv, "LOCALVALUE");
-  if (name === "git") {
-    let index = 1;
-    while (argv[index] === "-C" && argv[index + 1]) index += 2;
-    return (
-      ["branch", "diff", "log", "rev-parse", "rev-list", "show", "status"].includes(
-        argv[index] ?? "",
-      ) && !hasExecutionOption(argv.slice(index + 1), ["exec", "ext-diff", "textconv"])
-    );
-  }
-  if (name === "find") {
-    return !argv.slice(1).some((arg) => /^-(?:exec|ok|delete|fprint|fprintf)/.test(arg));
-  }
-  if (name === "bun") return argv[1] === "run" && ["db-tool", "gh-tool"].includes(argv[2] ?? "");
-  if (name === "sed") return isReadonlySedPrint(argv);
+/** Extract file path from hook arguments. */
+export function extractFilePath(args: Record<string, unknown>): string {
   return (
-    isPassiveTextCommand(argv) ||
-    ["ls", "cat", "tail", "wc", "uniq", "cut", "mv"].includes(name) ||
-    (name === "sort" &&
-      !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from", "output"], "o"))
+    (args.filePath as string) ||
+    (args.file_path as string) ||
+    (args.notebook_path as string) ||
+    (args.path as string) ||
+    ""
   );
 }
 
-function isChecksumCommand(argv: string[]): boolean {
+/** Extract content from hook arguments. */
+export function extractContent(args: Record<string, unknown>): string {
   return (
-    ["shasum", "sha1sum", "sha256sum", "sha512sum", "md5sum", "cksum"].includes(
-      argv[0]?.split("/").at(-1) ?? "",
-    ) && !hasExecutionOption(argv.slice(1), ["check"], "c")
+    (args.content as string) ||
+    (args.newString as string) ||
+    (args.new_string as string) ||
+    (args.new_source as string) ||
+    ""
   );
 }
 
-function hasSensitivePathRedirect(
-  command: string,
-  isPathBlocked: (path: string) => boolean,
-): boolean {
-  let heredoc = boundedHeredoc(command);
-  while (heredoc) {
-    if (!heredoc.closed) return true;
-    command = [heredoc.header, heredoc.following].join("\n");
-    heredoc = boundedHeredoc(command);
-  }
-  const parsed = parseStaticShellCommands(command, true);
-  if (!parsed || typeof parsed === "string") return false;
-  const assignments = getLeadingLiteralAssignments(command);
-  return parsed.redirects.some(({ target, dynamic }) => {
-    if (!dynamic) return isPathBlocked(target);
-    const materialized = target.replace(
-      /\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g,
-      (match, braced: string, plain: string) => assignments.get(braced ?? plain)?.value ?? match,
-    );
-    return /[$`]/.test(materialized) || isPathBlocked(materialized);
-  });
+/** Extract command from hook arguments. */
+export function extractCommand(args: Record<string, unknown>): string {
+  return (args.command as string) || "";
 }
 
 // ============================================================================
-// HELPERS
+// FACTORY
 // ============================================================================
 
-function escapeRegex(s: string): string {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-/** Static shell words only. Never expand variables or execute a command.
- * literalOperandsOnly retains recognizable paths/commands on unsupported expansions;
- * callers may use it to deny, never to establish a safe exception.
+/**
+ * Create a credential guard with optional extra patterns merged into defaults.
+ *
+ * @param config - Optional overrides. Arrays are concatenated with defaults (not replaced).
+ * @returns Object with all guard functions bound to the merged pattern sets.
  */
-function parseStaticShellCommands(
-  command: string,
-  literalOperandsOnly = false,
-  onUnterminatedQuote?: () => void,
-):
-  | {
-      pipelines: string[][][];
-      redirects: { target: string; dynamic: boolean; pipeline: number }[];
-      pathnameExpansion: boolean;
-    }
-  | "brace-expansion"
-  | undefined {
-  const pipelines: string[][][] = [];
-  const redirects: { target: string; dynamic: boolean; pipeline: number }[] = [];
-  let redirect = false;
-  let dynamic = false;
-  let commands: string[][] = [];
-  let argv: string[] = [];
-  let word = "";
-  let started = false;
-  let quote: "'" | '"' | undefined;
-  let pathnameExpansion = false;
-
-  const finishWord = () => {
-    if (started) {
-      if (redirect) redirects.push({ target: word, dynamic, pipeline: pipelines.length });
-      else argv.push(word);
-      redirect = false;
-    }
-    word = "";
-    started = false;
-    dynamic = false;
-  };
-  const finishCommand = () => {
-    finishWord();
-    if (argv.length) commands.push(argv);
-    argv = [];
-  };
-  const finishPipeline = () => {
-    finishCommand();
-    if (commands.length) pipelines.push(commands);
-    commands = [];
-  };
-
-  for (let i = 0; i < command.length; i++) {
-    const char = command.charAt(i);
-    if (quote === "'") {
-      if (char === quote) quote = undefined;
-      else word += char;
-    } else if (char === "\\") {
-      const next = command[++i];
-      if (next === undefined || next === "\n" || next === "\r") return undefined;
-      if (quote === '"' && !/[\\$`"]/.test(next)) word += "\\";
-      word += next;
-      started = true;
-    } else if (char === "$" || char === "`") {
-      if (!literalOperandsOnly) return undefined;
-      dynamic = true;
-      word += char;
-      started = true;
-    } else if (quote === '"') {
-      if (char === quote) quote = undefined;
-      else word += char;
-    } else if (char === "'" || char === '"') {
-      quote = char;
-      started = true;
-    } else if (
-      !literalOperandsOnly &&
-      char === "{" &&
-      /^\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(command.slice(i))
-    ) {
-      return "brace-expansion";
-    } else if (char === ">" || char === "<") {
-      if (char === "<" && command[i + 1] === "<") {
-        if (literalOperandsOnly) break;
-        return undefined;
-      }
-      if (/^\d+$/.test(word)) {
-        word = "";
-        started = false;
-      } else {
-        finishWord();
-      }
-      if (redirect) return undefined;
-      if (command[i + 1] === char) i++;
-      if (command[i + 1] === "&" && /[0-9-]/.test(command[i + 2] ?? "")) {
-        i += 2;
-        while (/\d/.test(command[i + 1] ?? "")) i++;
-      } else {
-        redirect = true;
-      }
-    } else if (char === "#" && !started) {
-      while (i + 1 < command.length && command[i + 1] !== "\n") i++;
-    } else if (/[()]/.test(char)) {
-      if (!literalOperandsOnly) return undefined;
-      finishWord();
-    } else if (char === "|" && command[i - 1] !== "|" && command[i + 1] !== "|") {
-      finishCommand();
-      if (command[i + 1] === "&") i++;
-    } else if (/[;&|\r\n]/.test(char)) {
-      finishPipeline();
-    } else if (/\s/.test(char)) {
-      finishWord();
-    } else {
-      if (/[*?[\]]/.test(char) || (char === "~" && !started)) pathnameExpansion = true;
-      word += char;
-      started = true;
-    }
-  }
-
-  if (quote && !literalOperandsOnly) {
-    onUnterminatedQuote?.();
-    return undefined;
-  }
-  finishPipeline();
-  if (redirect) return undefined;
-  return { pipelines, redirects, pathnameExpansion };
-}
-
-/** A lexical binding proof, preserving shell quotes and rejecting every other expansion. */
-function literalBindingText(
-  command: string,
-  name: string,
-  value: string,
-  allowBrackets = false,
-): { text: string; syntax: string } | undefined {
-  let text = "";
-  let syntax = "";
-  let quote: "'" | '"' | undefined;
-  for (let i = 0; i < command.length; i++) {
-    const char = command[i] ?? "";
-    if (!quote && /[^\S \t\n]/.test(char)) return undefined;
-    if (char === "\\" && quote !== "'") {
-      const next = command[++i];
-      if (next === undefined || /[\r\n]/.test(next)) return undefined;
-      text += char + next;
-      syntax += "  ";
-    } else if (quote === "'") {
-      text += char;
-      syntax += " ";
-      if (char === quote) quote = undefined;
-    } else if (char === "'" && !quote) {
-      quote = char;
-      text += char;
-      syntax += " ";
-    } else if (char === '"') {
-      quote = quote ? undefined : char;
-      text += char;
-      syntax += " ";
-    } else if (char === "$") {
-      const match = /^\$\{([A-Za-z_]\w*)\}|^\$([A-Za-z_]\w*)/.exec(command.slice(i));
-      if (!match || (match[1] ?? match[2]) !== name) return undefined;
-      text += value;
-      syntax += quote ? " ".repeat(value.length) : value;
-      i += match[0].length - 1;
-    } else {
-      if (
-        char === "`" ||
-        (!quote && (/[(){}*?#]/.test(char) || (!allowBrackets && (char === "[" || char === "]"))))
-      )
-        return undefined;
-      text += char;
-      syntax += quote ? " " : char;
-    }
-  }
-  return quote ? undefined : { text, syntax };
-}
-
-/** These single-letter binders cannot name shell lookup, splitting or generated variables. */
-function isLiteralBinder(name: string): boolean {
-  return /^(?:[a-z]|T)$/.test(name);
-}
-
-function unwrapProofCommand(words: string[], marker: string): string[] | undefined {
-  let index = 0;
-  while (words[index] === "rtk" || words[index] === "command") {
-    if (words[index++] === "rtk") {
-      if (words[index] === "proxy") index++;
-      // RTK forwards this verified external binary without changing its argv roles.
-      else if (words[index] !== "herdr") return undefined;
-    } else if (words[index] === "--") index++;
-  }
-  if (words.slice(0, index + 1).some((word) => word.includes(marker))) return undefined;
-  const argv = words.slice(index);
-  if (!argv.length || /^[A-Za-z_]\w*=/.test(argv[0] ?? "")) return undefined;
-  return argv;
-}
-
-function isLiteralLoopCommand(words: string[], marker: string, value: string): boolean {
-  const marked = unwrapProofCommand(words, marker);
-  if (!marked) return false;
-  const argv = marked.map((word) => word.replaceAll(marker, () => value));
-  const name = argv[0];
-  const uses = marked.flatMap((word, index) => (word.includes(marker) ? [index] : []));
-  const jqProgram = passiveJqProgramIndex(argv);
-  if (jqProgram !== undefined)
-    return uses.every(
-      (index) => index > jqProgram && /^[A-Za-z0-9_./][A-Za-z0-9_./-]*$/.test(argv[index] ?? ""),
-    );
-  if (name === "cat")
-    return (
-      argv.slice(1).every((word) => word === "--" || !word.startsWith("-")) &&
-      uses.every((index) => index > 0 && !argv[index]?.startsWith("-"))
-    );
-  if (name === "echo") return uses.every((index) => index > 0 && !argv[index]?.startsWith("-"));
-  if (name === "printf") {
-    const format = passivePrintfFormatIndex(argv);
-    return format !== undefined && uses.every((index) => index > format);
-  }
-  if (name === "herdr") return isLiteralHerdrRead(argv) && uses.every((index) => index === 3);
-  if (name === "bun") {
-    if (argv.slice(0, 4).join(" ") !== "bun run gh-tool pr") return false;
-    if (!["checks", "checks-failed", "info", "review-triage"].includes(argv[4] ?? "")) return false;
-    let selector = -1;
-    for (let index = 5; index < argv.length; index += 2) {
-      if (argv[index] === "--repo" && /^[A-Za-z0-9_./-]+$/.test(argv[index + 1] ?? "")) continue;
-      if (argv[index] !== "--pr" || selector !== -1 || !/^\d+$/.test(argv[index + 1] ?? ""))
-        return false;
-      selector = index + 1;
-    }
-    return selector !== -1 && uses.every((index) => index === selector && marked[index] === marker);
-  }
-  if (name === "git") {
-    const boundary = argv.indexOf("--", 2);
-    return (
-      argv[1] === "diff" &&
-      (boundary === 2 || boundary === 3) &&
-      argv
-        .slice(2, boundary)
-        .every((revision) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*$/.test(revision)) &&
-      argv.length > boundary + 1 &&
-      argv.slice(boundary + 1).every((file) => /^[A-Za-z0-9_./][A-Za-z0-9_./-]*$/.test(file)) &&
-      uses.every(
-        (index) => index > boundary && /^[A-Za-z0-9_./][A-Za-z0-9_./-]*$/.test(argv[index] ?? ""),
-      )
-    );
-  }
-  return (
-    uses.length === 0 &&
-    ((["grep", "head", "tail"].includes(name ?? "") && isPassiveTextCommand(argv)) ||
-      isLiteralStdinJsonDisplay(argv))
-  );
-}
-
-function isLiteralHerdrRead(argv: string[]): boolean {
-  return (
-    argv[0] === "herdr" &&
-    !argv[3]?.startsWith("-") &&
-    /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "") &&
-    ((argv.length === 4 && argv[1] === "agent" && argv[2] === "get") ||
-      (argv.length === 8 &&
-        ["pane", "agent"].includes(argv[1] ?? "") &&
-        argv[2] === "read" &&
-        argv[4] === "--source" &&
-        argv[5] === "recent-unwrapped" &&
-        argv[6] === "--lines" &&
-        /^[1-9]\d*$/.test(argv[7] ?? "")))
-  );
-}
-
-/** Conventional platform shell names and numeric versions; not arbitrary renamed executables. */
-function isShellWord(word: string): boolean {
-  return /^(?:sh|bash|rbash|zsh|dash|ash|ksh|rksh|csh|tcsh|fish)(?:[.-]?[0-9]+(?:[.][0-9]+)*)?$/.test(
-    word.split("/").at(-1) ?? "",
-  );
-}
-
-/** Shell-named operands are data only under an existing non-executing argument role. */
-function hasProvedShellDataOperands(argv: string[]): boolean {
-  const name = argv[0]?.split("/").at(-1) ?? "";
-  if (isPassiveTextCommand(argv) || isLiteralHerdrRead(argv) || isStaticNavigationCommand(argv))
-    return true;
-  if (["cat", "ls", "uniq", "cut"].includes(name)) return true;
-  if (["find", "wc", "sort"].includes(name)) return isProvedCwdSubprocessRole(argv);
-  return name === "test" && argv.length === 3 && argv[1] === "-e" && !/[$`]/.test(argv[2] ?? "");
-}
 
-const SHELL_IDENTITIES = new Set([
-  "sh",
-  "bash",
-  "zsh",
-  "/bin/sh",
-  "/usr/bin/sh",
-  "/bin/bash",
-  "/usr/bin/bash",
-  "/bin/zsh",
-  "/usr/bin/zsh",
-]);
-
-/** Literal argv only. Undefined means a shell was found without a complete invocation proof. */
-function literalShellBodies(command: string): string[] | undefined {
-  const parsed = parseStaticShellCommands(command);
-  const operands = parsed ?? parseStaticShellCommands(command, true);
-  if (!operands || typeof operands === "string") return [];
-  const commands = operands.pipelines.flat();
-  if (
-    commands.some((words) =>
-      ["exec", "nohup", "sudo"].includes(unwrapStaticCommand(words)[0]?.split("/").at(-1) ?? ""),
-    )
-  )
-    return undefined;
-  for (const words of commands) {
-    const argv = unwrapStaticCommand(words);
-    if (
-      !isShellWord(argv[0] ?? "") &&
-      argv.some(
-        (word, index) =>
-          index !== inlineProgramIndex(argv) &&
-          (isShellWord(word) ||
-            (/^--?[A-Za-z0-9-]+=/.test(word) && isShellWord(word.slice(word.indexOf("=") + 1)))),
-      ) &&
-      !hasProvedShellDataOperands(argv) &&
-      !(isLiteralHerdrPrompt(argv) && isStaticHerdrPrompt(command))
-    )
-      return undefined;
-  }
-  const shells = commands.filter((words) => isShellWord(unwrapStaticCommand(words)[0] ?? ""));
-  if (!shells.length) return [];
-  if (
-    !parsed ||
-    typeof parsed === "string" ||
-    !literalBindingText(command, "", "") ||
-    new TextEncoder().encode(command).byteLength > 65_536 ||
-    commands.some((words) => unwrapStaticCommand(words)[0]?.split("/").at(-1) === "cd")
-  )
-    return undefined;
-  const bodies: string[] = [];
-  for (const words of shells) {
-    const argv = unwrapProofCommand(words, "\0");
-    if (!argv || !SHELL_IDENTITIES.has(argv[0] ?? "")) return undefined;
-    const name = argv[0]?.split("/").at(-1);
-    if (argv.length === 2 && ["--version", "--help"].includes(argv[1] ?? "")) continue;
-    const index = name === "zsh" && argv[1] === "-f" ? 2 : 1;
-    if ((name === "zsh" && index !== 2) || argv[index] !== "-c" || argv.length !== index + 2)
-      return undefined;
-    bodies.push(argv[index + 1] ?? "");
-  }
-  return bodies;
-}
+const recovery: Readonly<Record<string, string>> = {
+  unparseable: "Use complete literal shell syntax within the supported subset.",
+  "ambient-expansion":
+    "Use a local binding or an exact name in credentialGuard.allowedEnvironmentVariables.",
+  "secret-source":
+    "Use a bounded wrapper operation with filtered output. Do not dump credentials or the environment.",
+  "sensitive-path": "Use a nonsensitive example or template, or a bounded wrapper operation.",
+  "opaque-path": "Use literal nonsensitive file paths.",
+  "opaque-executable": "Use a literal executable name.",
+  "opaque-code": "Use a supported literal shell body or a repository-owned bounded operation.",
+  "opaque-env-name": "Use an exact approved environment variable name.",
+  "no-analyzer":
+    "Use a repository-owned bounded operation. The guard cannot inspect this code form.",
+  "wrapper-required": "Use the configured wrapper. Check its help and the project README.",
+  "configured-pattern": "Use the bounded operation allowed by the project configuration.",
+  "startup-mutation":
+    "Run the operation without changing executable lookup or startup configuration.",
+  "unsupported-option": "Use supported options with complete literal values.",
+  "analysis-limit": "Split the operation into smaller bounded commands.",
+  "copy-destination":
+    "Use a literal destination below a configured chainCopyDestinations directory, without symlinks.",
+};
 
-function isProvedLiteralShellBody(
-  body: string,
-  allowedNames: Set<string>,
-  isPathBlocked: (path: string) => boolean,
-  onProvedPredicate: () => void,
+function proveCopyDestination(
+  target: string,
+  source: string,
+  directories: readonly string[],
 ): boolean {
-  if (!body.trim()) return true;
-  const materialized = materializeLiteralShell(body)?.command ?? body;
-  const parsed = parseStaticShellCommands(materialized);
-  if (!parsed || typeof parsed === "string") {
-    let proved = false;
+  try {
+    const literalPath = (path: string) =>
+      /^(?:\/|[A-Za-z]:\/)[A-Za-z0-9_./ -]+$/.test(path) &&
+      !path.split("/").some((part) => part === "." || part === "..");
     if (
-      hasEnvironmentVariableExpansionRead(body, allowedNames, isPathBlocked, undefined, () => {
-        proved = true;
-      }) ||
-      !proved
+      !literalPath(target) ||
+      !/^(?:~\/)?[A-Za-z0-9_./-]+$/.test(source) ||
+      source.startsWith("-")
     )
       return false;
-    onProvedPredicate();
-    return true;
-  }
-  if (!hasProvedNavigationSequence(materialized)) return false;
-  return parsed.pipelines.flat().every((words) => {
-    const argv = unwrapProofCommand(words, "\0");
-    if (!argv) return false;
-    if (argv[0]?.split("/").at(-1) === "env") return false;
-    const name = unwrapStaticCommand(argv)[0]?.split("/").at(-1) ?? "";
-    if (isShellWord(name)) {
-      const nested = literalShellBodies(
-        words.map((word) => "'" + word.replaceAll("'", "'\"'\"'") + "'").join(" "),
-      );
-      return (
-        nested !== undefined &&
-        nested.every((inner) =>
-          isProvedLiteralShellBody(inner, allowedNames, isPathBlocked, onProvedPredicate),
-        )
-      );
+    const targetPath = target.replace(/\/+$/, "");
+    const targetStat = lstatSync(targetPath, { throwIfNoEntry: false });
+    if (target.endsWith("/") && !targetStat?.isDirectory()) return false;
+    const destination = targetStat?.isDirectory()
+      ? posix.join(targetPath, posix.basename(source))
+      : targetPath;
+    for (const directory of directories) {
+      if (!literalPath(directory)) continue;
+      const root = directory.replace(/\/+$/, "");
+      if (destination !== root && !destination.startsWith(root + "/")) continue;
+      if (!lstatSync(root).isDirectory() || realpathSync(root).replace(/\\/g, "/") !== root)
+        return false;
+      const parts = destination.slice(root.length).split("/").filter(Boolean);
+      let current = root;
+      for (const [index, part] of parts.entries()) {
+        current = posix.join(current, part);
+        const stat = lstatSync(current, { throwIfNoEntry: false });
+        if (!stat) return index === parts.length - 1;
+        if (stat.isSymbolicLink() || (index < parts.length - 1 && !stat.isDirectory()))
+          return false;
+        if (realpathSync(current).replace(/\\/g, "/") !== current) return false;
+      }
+      return true;
     }
-    return (
-      isProvedCwdSubprocessRole(unwrapStaticCommand(argv)) ||
-      (name === "bun" && isSafeLocalAssignmentCommand(argv) && !isUnsupportedInlineRuntime(argv)) ||
-      isStaticNavigationCommand(argv) ||
-      isLiteralHerdrRead(argv) ||
-      (isLiteralHerdrPrompt(argv) && isStaticHerdrPrompt(materialized)) ||
-      (argv.length === 1 && ["true", "false", "pwd"].includes(name))
-    );
-  });
-}
-
-/** A complete stdin-only JSON projection, with no suffix, imports or executable input. */
-function isLiteralStdinJsonDisplay(argv: string[]): boolean {
-  if (argv.length !== 3 || !["python", "python3"].includes(argv[0] ?? "") || argv[1] !== "-c")
+  } catch {
     return false;
-  const program = argv[2] ?? "";
-  if (program.length > 65_536) return false;
-  const parts = programParts(program, true);
-  if (!parts || parts.literals.join("\0") !== "result\0text\0\0result") return false;
-  // ponytail: one JSON projection with a single-letter local; extend only with another complete grammar.
-  const code = parts.code.replace(/[ \t]+/g, " ").trim();
-  return /^import json\s*,\s*sys\s*(?:;|\r?\n)\s*([a-z])\s*=\s*json\s*\.\s*load\s*\(\s*sys\s*\.\s*stdin\s*\)\s*(?:;|\r?\n)\s*print\s*\(\s*\1\s*\[\s*STRING\s*\]\s*\.\s*get\s*\(\s*STRING\s*,\s*STRING\s*\)\s+if isinstance\s*\(\s*\1\s*\.\s*get\s*\(\s*STRING\s*\)\s*,\s*dict\s*\)\s+else \1\s*\)\s*;?$/.test(
-    code,
-  );
+  }
+  return false;
 }
 
-type LiteralShellProof = { command: string; paths: string[] };
-
-/** Bounded observed shell forms only; failure leaves the original command under normal policy. */
-function materializeLiteralShell(command: string): LiteralShellProof | undefined {
-  if (new TextEncoder().encode(command).byteLength > 65_536) return undefined;
-  const marker = "GUARDLITERALBINDING";
-  if (command.includes(marker)) return undefined;
-  let script = command.replace(/^[ \t\n]+|[ \t\n]+$/g, "");
-  // Quote removal is safe only for this literal ASCII path value, never a shell expansion.
-  script = script.replace(
-    /^([A-Za-z])=(["'])([A-Za-z0-9_./][A-Za-z0-9_./-]*)\2(?=[ \t]*(?:;|\n|&&))/,
-    "$1=$3",
-  );
-  const wrapped = parseStaticShellCommands(script);
+export function createCredentialGuard(config?: CredentialGuardConfig): CredentialGuard {
+  const names = config?.allowedEnvironmentVariables;
   if (
-    wrapped &&
-    typeof wrapped !== "string" &&
-    wrapped.pipelines.length === 1 &&
-    wrapped.pipelines[0]?.length === 1 &&
-    wrapped.redirects.length === 0
-  ) {
-    const argv = unwrapProofCommand(wrapped.pipelines[0]?.[0] ?? [], marker);
-    if (argv?.[0] === "sh" && argv[1] === "-c" && argv.length === 3) {
-      if (!literalBindingText(script, "", "")) return undefined;
-      script = argv[2] ?? "";
+    names !== undefined &&
+    (!Array.isArray(names) || names.some((name) => typeof name !== "string"))
+  )
+    throw new Error("allowedEnvironmentVariables must be an array of strings");
+  const approvedNames = new Set(names ?? []);
+  for (const name of approvedNames)
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+      throw new Error(`Invalid allowed environment variable name: ${JSON.stringify(name)}`);
+  const context: PolicyContext = {
+    home: process.env.HOME ?? process.env.USERPROFILE ?? "~",
+    get cwd() {
+      return process.cwd();
+    },
+    approvedNames,
+    registry: buildRegistry(config?.additionalBlockedCliTools),
+    additionalBlockedPaths: config?.additionalBlockedPaths?.map((p) => new RegExp(p)),
+    additionalAllowedPaths: config?.additionalAllowedPaths?.map((p) => new RegExp(p)),
+    dangerousPatterns: config?.additionalDangerousBashPatterns?.map((p) => new RegExp(p)),
+    chainCopyDestinations: config?.chainCopyDestinations,
+    proveCopyDestination: (path, source) =>
+      proveCopyDestination(path, source, config?.chainCopyDestinations ?? []),
+  };
+  const decision = (command: string, powershell = false): Decision =>
+    judge(powershell ? parsePowerShell(command) : parseBash(command), context);
+  const isPathBlocked = (path: string): boolean => isSensitivePath(path, context);
+  const isPathAllowed = (path: string): boolean =>
+    !isPathBlocked(path) &&
+    [...DEFAULT_ALLOWED_PATH_PATTERNS, ...(context.additionalAllowedPaths ?? [])].some((p) =>
+      new RegExp(p.source, p.flags.replace(/[gy]/g, "")).test(
+        normalizePath(path, context.home, context.cwd),
+      ),
+    );
+  function detectSecrets(content: string): { name: string; match: string } | null {
+    for (const { name, pattern } of SECRET_PATTERNS) {
+      const match = content.match(pattern);
+      if (match)
+        return {
+          name,
+          match: match[0].substring(0, 8) + "..." + match[0].substring(match[0].length - 4),
+        };
     }
+    return null;
   }
-  const loop =
-    /^for[ \t]+([A-Za-z_]\w*)[ \t]+in[ \t]+([^;\n]+);[ \t\r\n]*do[ \t\r\n]+([\s\S]*);[ \t\r\n]*done[ \t\r\n]*$/.exec(
-      script,
-    );
-  if (loop) {
-    const name = loop[1] ?? "";
-    if (!isLiteralBinder(name)) return undefined;
-    const items = loop[2] ?? "";
-    const rawValues = items.trim().split(/[ \t]+/);
-    if (
-      rawValues.some(
-        (item) =>
-          !/^(?:[A-Za-z0-9_./:][A-Za-z0-9_./:-]*|'[A-Za-z0-9_./:][A-Za-z0-9_./:-]*'|"[A-Za-z0-9_./:][A-Za-z0-9_./:-]*")$/.test(
-            item,
-          ),
-      )
-    )
-      return undefined;
-    const values = rawValues.map((item) => item.replace(/^['"]|['"]$/g, ""));
-    if (!values.length || values.length > 16) return undefined;
-    const marked = literalBindingText(loop[3] ?? "", name, marker);
-    if (!marked || /&&|\|\||[<>]|&/.test(marked.syntax.replace(/\b2>&1(?=[ \t\n;|]|$)/g, "")))
-      return undefined;
-    const parsed = parseStaticShellCommands(marked.text);
-    if (
-      !parsed ||
-      typeof parsed === "string" ||
-      parsed.redirects.length ||
-      parsed.pipelines.flat().length > 16 ||
-      !parsed.pipelines.flat().length
-    )
-      return undefined;
-    if (
-      !values.every((value) =>
-        parsed.pipelines.flat().every((words) => isLiteralLoopCommand(words, marker, value)),
-      )
-    )
-      return undefined;
-    const size = values.reduce(
-      (total, value) =>
-        total +
-        new TextEncoder().encode(marked.text).byteLength +
-        (marked.text.split(marker).length - 1) * (value.length - marker.length) +
-        2,
-      0,
-    );
-    if (size > 65_536) return undefined;
-    return {
-      command: values.map((value) => marked.text.replaceAll(marker, () => value)).join(";\n"),
-      paths: [],
-    };
+  function getDangerousBashReason(command: string): string | null {
+    const result = decision(command);
+    return result.kind === "pass"
+      ? null
+      : result.findings
+          .slice(0, 8)
+          .map((f) => `${f.rule}: ${f.detail.slice(0, 250)}`)
+          .join("; ");
+  }
+  const isDangerousBashCommand = (command: string): boolean =>
+    getDangerousBashReason(command) !== null;
+  function getBlockedCliTool(command: string): { name: string; wrapper: string } | null {
+    const result = decision(command);
+    if (result.kind === "pass") return null;
+    const finding = result.findings.find((f) => f.rule === "wrapper-required");
+    if (!finding) return null;
+    const split = finding.detail.indexOf(": ");
+    return { name: finding.detail.slice(0, split), wrapper: finding.detail.slice(split + 2) };
   }
-  // Single ASCII-letter names avoid shell startup/special variables such as PATH and IFS.
-  const assignment =
-    /^(?:cd[ \t]+(~?\/?[A-Za-z0-9_./-]+)[ \t]*(;|\n|&&)[ \t]*)?([A-Za-z])=([A-Za-z0-9_./][A-Za-z0-9_./-]*)[ \t]*(;|\n|&&)[ \t]*/.exec(
-      script,
-    );
-  if (assignment) {
-    const rest = literalBindingText(
-      script.slice(assignment[0].length),
-      assignment[3] ?? "",
-      marker,
+  function isGhCommandAllowed(command: string): boolean {
+    let found = false;
+    const result = judge(parseBash(command), {
+      ...context,
+      onInvocation: (name) => {
+        found ||= executableName(name) === "gh";
+      },
+    });
+    return found && result.kind === "pass";
+  }
+  function detectSleepPolling(command: string): string | null {
+    const invocations: string[] = [];
+    let sleep = false;
+    judge(parseBash(command), {
+      ...context,
+      onInvocation: (name, argv) => {
+        const executable = executableName(name);
+        if (executable === "sleep" && /^\d/.test(argv[1] ?? "")) sleep = true;
+        invocations.push([executable, ...argv.slice(1)].join(" "));
+      },
+    });
+    if (!sleep) return null;
+    return (
+      DEFAULT_POLLING_DETECTION_RULES.find(({ pattern }) =>
+        invocations.some((invocation) => pattern.test(invocation)),
+      )?.suggestion ?? null
     );
-    if (!rest || !rest.text.includes(marker)) return undefined;
-    // No branches, background jobs or pipeline-local state. FD duplication stays inert.
-    const syntax = rest.syntax.replace(/[<>]&[0-9-]+/g, "");
-    if (/\|\||(^|[^&])&(?!&)|[^\S \t\n]/.test(syntax)) return undefined;
-    if (assignment[2] === "&&") {
-      if (assignment[5] !== "&&") return undefined;
-      const boundary = rest.syntax.search(/[;\r\n]/);
-      if (boundary >= 0 && rest.text.slice(boundary).includes(marker)) return undefined;
-    }
-    const parsed = parseStaticShellCommands(rest.text);
-    if (
-      !parsed ||
-      typeof parsed === "string" ||
-      parsed.redirects.some(({ target }) => target.includes(marker)) ||
-      !parsed.pipelines.flat().length ||
-      parsed.pipelines.flat().length > 32
-    )
-      return undefined;
-    const value = assignment[4] ?? "";
-    const paths: string[] = [];
-    // One local directory value may occupy only the first gated cd operand.
-    const navigation = parsed.pipelines[0];
-    const navigationArgv = unwrapProofCommand(navigation?.[0] ?? [], marker);
-    const directoryBinding =
-      !assignment[1] &&
-      navigation?.length === 1 &&
-      navigationArgv?.[0] === "cd" &&
-      navigationArgv[navigationArgv[1] === "--" ? 2 : 1] === marker;
-    if (directoryBinding && !hasProvedNavigationSequence(rest.text.replaceAll(marker, () => value)))
-      return undefined;
-    for (const words of parsed.pipelines.flat()) {
-      const marked = unwrapProofCommand(words, marker);
-      if (!marked) return undefined;
-      const argv = marked.map((word) => word.replaceAll(marker, () => value));
-      const name = argv[0]?.split("/").at(-1) ?? "";
-      const uses = marked.flatMap((word, index) => (word.includes(marker) ? [index] : []));
-      const checksum = isChecksumCommand(argv);
-      if (directoryBinding && uses.length && words !== navigation?.[0]) return undefined;
-      if (!uses.length) {
-        if (
-          !isSafeLocalAssignmentCommand(argv) &&
-          inlineProgramIndex(argv) === undefined &&
-          !(argv[0] === "git" && argv[1] === "commit") &&
-          !(
-            directoryBinding &&
-            argv[0] === "git" &&
-            argv[1] === "clone" &&
-            !hasExecutionOption(argv.slice(2), ["config", "upload-pack"], "c")
-          ) &&
-          !checksum
-        )
-          return undefined;
-        continue;
-      }
+  }
+  function handleToolExecuteBefore(input: HookInput, output: HookOutput): void {
+    try {
+      const tool = input.tool.toLowerCase().replace(/^mcp_/, "");
+      const path = extractFilePath(output.args);
       if (
-        uses.some(
-          (index) => index === 0 || !/^[A-Za-z0-9_./][A-Za-z0-9_./-]*$/.test(argv[index] ?? ""),
-        )
+        ["read", "write", "edit", "multiedit", "notebookedit", "grep", "glob"].includes(tool) &&
+        path &&
+        isSensitivePath(path, {
+          ...context,
+          contentRead:
+            tool !== "glob" &&
+            (tool !== "grep" ||
+              (!["files_with_matches", "count"].includes(String(output.args.output_mode)) &&
+                /\.[^/]+$/.test(path))),
+        })
       )
-        return undefined;
-      const gitAdd =
-        argv.slice(0, 3).join(" ") === "git add --" && uses.every((index) => index >= 3);
-      const reader =
-        ["cat", "ls", "head", "tail", "wc", "uniq", "cut", "sort", "grep", "rg"].includes(name) &&
-        isSafeLocalAssignmentCommand(argv);
-      const directory =
-        directoryBinding && words === navigation?.[0] && isStaticNavigationCommand(argv);
-      if (!gitAdd && !reader && !checksum && !directory) return undefined;
-      paths.push(...uses.map((index) => argv[index] ?? ""));
+        throw new Error(`Access blocked: "${path}" is a sensitive file.`);
+      if (tool === "grep") {
+        for (const [field, option] of Object.entries({ glob: "-g", type: "-t" })) {
+          const value = output.args[field];
+          if (value === undefined) continue;
+          if (typeof value !== "string") throw new Error("Invalid Grep filter");
+          const quoted = "'" + value.replaceAll("'", "'\\''") + "'";
+          const checked = decision("rg " + option + " " + quoted + " -- example");
+          if (checked.kind !== "pass")
+            throw new Error("Access blocked: Grep filter can select a sensitive file.");
+        }
+      }
+      if (tool === "multiedit") {
+        if (!Array.isArray(output.args.edits)) throw new Error("Invalid MultiEdit edits");
+        for (const edit of output.args.edits) {
+          if (
+            !edit ||
+            typeof edit !== "object" ||
+            !("new_string" in edit) ||
+            typeof edit.new_string !== "string"
+          )
+            throw new Error("Invalid MultiEdit replacement");
+          handleToolExecuteBefore(
+            { tool: "Edit" },
+            { args: { file_path: path, new_string: edit.new_string } },
+          );
+        }
+      }
+      if (["write", "edit", "notebookedit"].includes(tool) && !isPathAllowed(path)) {
+        const secret = detectSecrets(extractContent(output.args));
+        if (secret)
+          throw new Error(
+            `Secret detected: Potential ${secret.name} found in content. Matched: [REDACTED]. Never commit secrets to code.`,
+          );
+      }
+      if (tool === "bash" || tool === "monitor" || tool === "powershell" || tool === "pwsh") {
+        const command = extractCommand(output.args);
+        const result = decision(command, tool === "powershell" || tool === "pwsh");
+        if (result.kind !== "pass") {
+          const excerpt =
+            command.length > 2000 ? command.slice(0, 2000) + " [command elided]" : command;
+          const families = [...new Set(result.findings.slice(0, 8).map((f) => f.rule))];
+          throw new Error(
+            `Command blocked: ${result.findings
+              .slice(0, 8)
+              .map((f) => `${f.rule}: ${f.detail.slice(0, 250)}`)
+              .join("; ")}.\n\n` +
+              `Command: ${excerpt}\n\n` +
+              families.map((rule) => recovery[rule]).join("\n") +
+              "\nTool inventory and usage: https://github.com/blogic-cz/agent-tools#tools",
+          );
+        }
+        const suggestion = detectSleepPolling(command);
+        if (suggestion) throw new Error(`Sleep-polling detected. Use instead: ${suggestion}`);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const sanitized = redactSensitiveText(message);
+      if (error instanceof Error) {
+        if (sanitized !== message) {
+          error.message = sanitized;
+          if (error.stack) error.stack = error.stack.replace(message, () => sanitized);
+        }
+        throw error;
+      }
+      // eslint-disable-next-line eslint/preserve-caught-error
+      throw new Error(sanitized);
     }
-    const prefix = assignment[1] ? `cd ${assignment[1]}${assignment[2]} ` : "";
-    const size =
-      new TextEncoder().encode(prefix + rest.text).byteLength +
-      (rest.text.split(marker).length - 1) * (value.length - marker.length);
-    if (paths.length > 32 || size > 65_536) return undefined;
-    return { command: prefix + rest.text.replaceAll(marker, () => value), paths };
   }
-  // Expand only complete, unquoted path words. Keep all other source text intact.
-  const paths: string[] = [];
-  let expanded = "";
-  let marked = "";
-  let start = 0;
-  let quote: "'" | '"' | undefined;
-  let braces = false;
-  const finishWord = (end: number): boolean => {
-    const word = command.slice(start, end);
-    if (!braces) {
-      expanded += word;
-      marked += word;
-      return true;
-    }
-    // ponytail: one comma-list per path, no nesting; extend only with a bounded shell parser.
-    const match =
-      /^([A-Za-z0-9_./-]*\/[A-Za-z0-9_./-]*)\{([A-Za-z0-9_./-]+(?:,[A-Za-z0-9_./-]+)+)\}([A-Za-z0-9_./-]*)$/.exec(
-        word,
-      );
-    if (!match) return false;
-    const members = (match[2] ?? "").split(",");
-    if (members.length > 16 || paths.length + members.length > 32) return false;
-    const values = members.map((member) => (match[1] ?? "") + member + (match[3] ?? ""));
-    const text = values.join(" ");
-    if (expanded.length + text.length + command.length - end > 65_536) return false;
-    paths.push(...values);
-    expanded += text;
-    marked += marker;
-    return true;
+  return {
+    handleToolExecuteBefore,
+    detectSecrets,
+    isPathAllowed,
+    isPathBlocked,
+    isDangerousBashCommand,
+    getBlockedCliTool,
+    isGhCommandAllowed,
+    detectSleepPolling,
   };
-  for (let i = 0; i <= command.length; i++) {
-    const char = command[i];
-    if (quote === "'") {
-      if (char === quote) quote = undefined;
-    } else if (char === "\\") {
-      if (command[i + 1] === undefined || /[\r\n]/.test(command[i + 1] ?? "")) return undefined;
-      i++;
-    } else if (quote === '"') {
-      if (char === quote) quote = undefined;
-    } else if (char === "'" || char === '"') {
-      quote = char;
-    } else if (char === "{" || char === "}") {
-      braces = true;
-    } else if (char === undefined || /[ \t\n]/.test(char)) {
-      if (!finishWord(i)) return undefined;
-      expanded += char ?? "";
-      marked += char ?? "";
-      start = i + 1;
-      braces = false;
-    } else if (/[\s;&|<>#]/.test(char)) {
-      // Other JS whitespace is a literal shell word character, not a token boundary.
-      return undefined;
-    }
-  }
-  if (quote || !paths.length || new TextEncoder().encode(expanded).byteLength > 65_536)
-    return undefined;
-  const parsed = parseStaticShellCommands(marked);
-  if (
-    !parsed ||
-    typeof parsed === "string" ||
-    parsed.redirects.length ||
-    parsed.pipelines.length !== 1 ||
-    parsed.pipelines[0]?.length !== 1
-  )
-    return undefined;
-  const argv = unwrapProofCommand(parsed.pipelines[0]?.[0] ?? [], marker);
-  const expandedCommands = parseStaticShellCommands(expanded);
-  const expandedArgv =
-    expandedCommands && typeof expandedCommands !== "string"
-      ? unwrapProofCommand(expandedCommands.pipelines[0]?.[0] ?? [], marker)
-      : undefined;
-  // Classify actual options too: a marked path can hide an executor such as git grep -O/path.
-  if (
-    !argv ||
-    !expandedArgv ||
-    (!isPassiveTextCommand(expandedArgv) && expandedArgv[0]?.split("/").at(-1) !== "cat")
-  )
-    return undefined;
-  return { command: expanded, paths };
-}
-
-/** Complete package metadata loops: no prelude, loader shadowing, mutation or arbitrary suffix. */
-function staticPackageInventory(program: string): string[] | undefined {
-  if (program.length > 65_536) return undefined;
-  const prefix =
-    /^for\s*\(\s*const\s+([a-z])\s+of\s+(\[\s*(?:"[A-Za-z0-9_./@-]+"|'[A-Za-z0-9_./@-]+')(?:\s*,\s*(?:"[A-Za-z0-9_./@-]+"|'[A-Za-z0-9_./@-]+'))*\s*\])\s*\)\s*\{\s*(try\s*\{\s*)?const\s+([a-z])\s*=\s*require\s*\(\s*(["'])\.\/\5\s*\+\s*\1\s*\)\s*;\s*/.exec(
-      program.trim(),
-    );
-  if (!prefix || prefix[1] === prefix[4]) return undefined;
-  const paths = [...(prefix[2] ?? "").matchAll(/["']([^"']+)["']/g)].map(
-    (match) => "./" + (match[1] ?? ""),
-  );
-  if (
-    !paths.length ||
-    paths.length > 16 ||
-    // Four bytes per character bounds encoded text and shell quote escaping before allocation.
-    (program.length + Math.max(...paths.map((path) => path.length)) + 64) * paths.length * 4 >
-      65_536 ||
-    paths.some((path) => !/(?:^|\/)package\.json$/.test(path))
-  )
-    return undefined;
-  const name = prefix[1];
-  const result = prefix[4];
-  const end = prefix[3] ? String.raw`\s*\}\s*catch\s*\{\s*\}\s*\}` : String.raw`\s*\}`;
-  const suffix = program.trim().slice(prefix[0].length);
-  const bin = new RegExp(
-    String.raw`^console\.log\(\s*${name}\s*,\s*${result}\.bin\s*\)\s*;?${end}\s*$`,
-  );
-  const scripts = new RegExp(
-    String.raw`^console\.log\(\s*${name}\s*,\s*Object\.entries\(\s*${result}\.scripts\s*\|\|\s*\{\}\s*\)\.filter\(\(\[n\]\)=>n\.endsWith\("-tool"\)\|\|n\.endsWith\(":cli"\)\|\|n\.endsWith\(":auth"\)\|\|n==="ui:check"\)\s*\)\s*;?${end}\s*$`,
-  );
-  return bin.test(suffix) || scripts.test(suffix) ? paths : undefined;
 }
 
-/** Shared identity for refusal paths, including versioned/free-threaded Python and Windows names. */
-function inlineRuntimeKind(executable: string | undefined): "python" | "node" | "bun" | undefined {
-  const name =
-    executable
-      ?.split(/[/\\]/)
-      .at(-1)
-      ?.replace(/\.exe$/i, "") ?? "";
-  if (/^python(?:\d+(?:\.\d+)*)?t?$/i.test(name)) return "python";
-  if (/^node$/i.test(name)) return "node";
-  if (/^bun$/i.test(name)) return "bun";
-  return undefined;
-}
-
-function mentionsInlineRuntime(command: string): boolean {
-  return command.split(/[\s'"`()<>;&|]+/).some((word) => inlineRuntimeKind(word) !== undefined);
-}
-
-/** Locate code only in an actual inline-program operand, after supported runtime flags. */
-function inlineProgramIndex(argv: string[]): number | undefined {
-  const executable = argv[0]?.split("/").at(-1) ?? "";
-  const name = inlineRuntimeKind(argv[0]);
-  // Other recognized runtime spellings retain conservative refusal; this exception is bounded.
-  if (!name || !["python", "python3", "node", "bun"].includes(executable)) return undefined;
-  const python = name === "python";
-  const flags = python ? ["-u", "-B", "-I", "-S"] : name === "bun" ? ["--no-env-file"] : [];
-  let index = 1;
-  while (flags.includes(argv[index] ?? "")) index++;
-  if (
-    !(python ? argv[index] === "-c" : ["-e", "--eval"].includes(argv[index] ?? "")) ||
-    argv[index + 1] === undefined
-  )
-    return undefined;
-  // Python consumes the remaining words as sys.argv. Node can still parse startup options
-  // after eval, until -- or an ordinary positional operand. Bun suffixes require explicit --.
-  const suffix = argv[index + 2];
-  if (name === "bun" && suffix !== undefined && suffix !== "--") return undefined;
-  if (name === "node" && suffix?.startsWith("-") && suffix !== "--") return undefined;
-  return index + 1;
-}
-
-function isUnsupportedInlineRuntime(argv: string[]): boolean {
-  const runtime = inlineRuntimeKind(argv[0]);
-  if (!runtime) return false;
-  if (pythonCompileFiles(argv)) return false;
-  if (inlineProgramIndex(argv) !== undefined) return false;
-  let index = 1;
-  for (; index < argv.length; index++) {
-    const arg = argv[index] ?? "";
-    if (arg === "--" || !arg.startsWith("-")) break;
-    if (
-      /^(?:-[A-Za-z]*[cep]|-[rmp]|--(?:eval|print|require|import|loader|preload|experimental-loader))(?:$|=|[^-])/.test(
-        arg,
-      )
-    )
-      return true;
-    if (
-      (runtime === "python" && arg === "--check-hash-based-pycs") ||
-      (runtime === "node" &&
-        ["--conditions", "-C", "--icu-data-dir", "--dns-result-order"].includes(arg))
-    ) {
-      if (argv[index + 1] === undefined) return true;
-      index++;
-      continue;
-    }
-    // Unknown startup-option arity cannot establish where the script/tool begins.
-    if (
-      !(
-        (runtime === "python" && /^-[uBISsEOqvV]+$/.test(arg)) ||
-        (runtime === "node" &&
-          /^(?:--(?:trace-warnings|no-warnings|version|help)|--(?:conditions|icu-data-dir|dns-result-order)=.+)$/.test(
-            arg,
-          )) ||
-        (runtime === "bun" && ["--no-env-file", "--version", "--help"].includes(arg)) ||
-        ["--version", "--help", "-h"].includes(arg)
-      )
-    )
-      return true;
-  }
-  if (runtime === "bun" && ["exec", "repl"].includes(argv[index] ?? "")) return true;
-  // A separate -- after a literal task/file is an argv boundary, not proof of task contents.
-  let boundary = argv.length;
-  const target = argv[index] === "run" ? index + 1 : index;
-  if (
-    runtime === "bun" &&
-    /^[A-Za-z0-9_./][A-Za-z0-9_./-]*$/.test(argv[target] ?? "") &&
-    ![
-      "exec",
-      "repl",
-      "x",
-      "run",
-      "test",
-      "build",
-      "install",
-      "add",
-      "remove",
-      "update",
-      "pm",
-      "create",
-      "link",
-      "unlink",
-      "init",
-      "upgrade",
-    ].includes(argv[target] ?? "")
-  ) {
-    const separator = argv.indexOf("--", target + 1);
-    if (separator !== -1) boundary = separator;
-  }
-  // Before that boundary, unknown eval/loader controls retain conservative refusal.
-  return (
-    runtime === "bun" &&
-    argv
-      .slice(index, boundary)
-      .some((arg) =>
-        /^(?:-[A-Za-z]*[ep]|-[rmp]|--(?:eval|print|require|import|loader|preload|experimental-loader))(?:$|=|[^-])/.test(
-          arg,
-        ),
-      )
-  );
-}
-
-/** -I excludes cwd/user imports and PYTHON* startup controls; -S disables site hooks. */
-function pythonCompileFiles(argv: string[]): string[] | undefined {
-  if (!["python", "python3"].includes(argv[0]?.split("/").at(-1) ?? "")) return undefined;
-  let index = 1;
-  let isolation = "";
-  while (/^-[ISB]+$/.test(argv[index] ?? "")) isolation += argv[index++]?.slice(1);
-  if (!isolation.includes("I") || !isolation.includes("S")) return undefined;
-  if (argv[index] !== "-m" || argv[index + 1] !== "py_compile") return undefined;
-  const files = argv.slice(index + 2);
-  return files.length > 0 &&
-    files.length <= 32 &&
-    files.every((file) => /^[A-Za-z0-9_./][A-Za-z0-9_./ -]*\.py$/.test(file))
-    ? files
-    : undefined;
-}
-
-function isPythonCompileModule(argv: string[]): boolean {
-  return (
-    inlineRuntimeKind(argv[0]) === "python" &&
-    argv
-      .slice(1)
-      .some(
-        (arg, index) =>
-          (arg === "-m" && argv[index + 2] === "py_compile") || arg === "-mpy_compile",
-      )
-  );
-}
-
-/** Preserve the startup proof through the entire invocation, without inspecting target code. */
-function hasProvedPythonCompileInvocation(command: string): boolean {
-  if (new TextEncoder().encode(command).byteLength > 65_536 || !literalBindingText(command, "", ""))
-    return false;
-  const parsed = parseStaticShellCommands(command);
-  if (
-    !parsed ||
-    typeof parsed === "string" ||
-    parsed.pipelines.flat().length > 32 ||
-    !hasProvedNavigationSequence(command)
-  )
-    return false;
-  return parsed.pipelines.every((pipeline) =>
-    pipeline.every((words, index) => {
-      const argv = unwrapProofCommand(words, "\0");
-      if (!argv) return false;
-      if (pythonCompileFiles(argv)) return index === 0;
-      if (isStaticNavigationCommand(argv)) return index === 0 && pipeline.length === 1;
-      return isReadonlyJqConsumer(argv);
-    }),
-  );
-}
-
-/** Only literal navigation may precede an unqualified writer; shell state can change what runs. */
-function isLiteralWriterHeader(command: string, pipelines: string[][][]): boolean {
-  const commands = pipelines.flat();
-  const writer = commands.at(-1);
-  return (
-    !command.includes("\r") &&
-    pipelines.at(-1)?.length === 1 &&
-    (writer?.[0] === "cat" || writer?.[0] === "tee") &&
-    commands
-      .slice(0, -1)
-      .every(
-        (words) =>
-          (words[0] === "cd" && isStaticNavigationCommand(words)) ||
-          (words.length === 1 && words[0] === "pwd"),
-      )
-  );
-}
-
-/** Move a complete, literal Python stdin program into the existing inline argv boundary. */
-function normalizeProgramHeredocs(command: string, depth = 0): string {
-  if (depth >= 32 || new TextEncoder().encode(command).byteLength > 65_536) return command;
-  const heredoc = boundedHeredoc(command);
-  if (!heredoc || !heredoc.closed || (!heredoc.quoted && /[$`\\]/.test(heredoc.body)))
-    return command;
-  const parsed = parseStaticShellCommands(heredoc.header);
-  if (!parsed || typeof parsed === "string") return command;
-  const last = parsed.pipelines.at(-1)?.at(-1);
-  const argv = last ? unwrapStaticCommand(last) : [];
-  const name = argv[0]?.split("/").at(-1);
-  // A quoted delimiter disables expansion, so a first cat/tee body is data too.
-  if (
-    (depth > 0 || (heredoc.quoted && isLiteralWriterHeader(command, parsed.pipelines))) &&
-    ((name === "cat" && argv.slice(1).every((arg) => arg === "--" || !arg.startsWith("-"))) ||
-      (name === "tee" &&
-        argv
-          .slice(1)
-          .every((arg) => ["-a", "--append", "--"].includes(arg) || !arg.startsWith("-"))))
-  ) {
-    const following = normalizeProgramHeredocs(heredoc.following, depth + 1);
-    const tail = parseStaticShellCommands(following);
-    if (
-      !tail ||
-      typeof tail === "string" ||
-      !tail.pipelines.flat().every((words) => {
-        const next = unwrapProofCommand(words, "\0");
-        return next !== undefined && isReadonlyJqConsumer(next);
-      })
-    )
-      return command;
-    // Literal writer bodies are data. Every header, file operand and following command is retained.
-    return heredoc.header + "\n" + following;
-  }
-  if (
-    inlineRuntimeKind(argv[0]) !== "python" ||
-    inlineProgramIndex([argv[0] ?? "", "-c", ""]) === undefined ||
-    argv.length !== 2 ||
-    argv[1] !== "-"
-  )
-    return command;
-  if (!/-\s*$/.test(heredoc.header)) return command;
-  const quoted = "'" + heredoc.body.replaceAll("'", "'\"'\"'") + "'";
-  return (
-    heredoc.header.replace(/-\s*$/, () => "-c " + quoted) +
-    "\n" +
-    normalizeProgramHeredocs(heredoc.following, depth + 1)
-  );
-}
-
-function hasUnboundedHeredoc(command: string): boolean {
-  if (!boundedHeredoc(command)) return false;
-  if (new TextEncoder().encode(command).byteLength > 65_536) return true;
-  for (let count = 0; count <= 32; count++) {
-    const heredoc = boundedHeredoc(command);
-    if (!heredoc) return false;
-    if (!heredoc.closed || count === 32) return true;
-    command = heredoc.header + "\n" + heredoc.following;
-  }
-  return true;
-}
-
-/** Strings are data in these languages; retain their values separately for path checks. */
-function programParts(
-  program: string,
-  python: boolean,
-):
-  | { code: string; literals: string[]; pathLiterals: string[]; loadedModules: string[] }
-  | undefined {
-  const literals: string[] = [];
-  const pathLiterals: string[] = [];
-  const loadedModules: string[] = [];
-  let code = "";
-  for (let i = 0; i < program.length; i++) {
-    const char = program[i] ?? "";
-    if ((python && char === "#") || (!python && program.startsWith("//", i))) {
-      const terminator = python ? /[\r\n]/ : /[\r\n\u2028\u2029]/;
-      while (i < program.length && !terminator.test(program[i] ?? "")) i++;
-      code += "\n";
-      continue;
-    }
-    if (!python && program.startsWith("/*", i)) {
-      const end = program.indexOf("*/", i + 2);
-      if (end < 0) return undefined;
-      i = end + 1;
-      code += " ";
-      continue;
-    }
-    if (!python && char === "/") {
-      // Recognize regex only at an expression start; ambiguous slash syntax stays closed.
-      if (!/[=(,:!&|?;[{]\s*$/.test(code) && !/\breturn\s+$/.test(code)) return undefined;
-      let inClass = false;
-      let closed = false;
-      for (i++; i < program.length; i++) {
-        const next = program[i];
-        if (next === "\\") {
-          i++;
-          continue;
-        }
-        if (next === "\n") return undefined;
-        if (next === "[") inClass = true;
-        else if (next === "]") inClass = false;
-        else if (next === "/" && !inClass) {
-          closed = true;
-          break;
-        }
-      }
-      if (!closed) return undefined;
-      code += " REGEX ";
-      continue;
-    }
-    if (char !== "'" && char !== '"' && char !== "`") {
-      code += char;
-      continue;
-    }
-    // Bun.write(PATH, TEXT) differs from file-object write(TEXT).
-    const literalTextArgument =
-      (/\.(?:write_text|write)\s*\(\s*$/.test(code) && !/\bBun\s*\.\s*write\s*\(\s*$/.test(code)) ||
-      /\bBun\s*\.\s*write\s*\(\s*STRING\s*,\s*$/.test(code);
-    const interpolated = python && /[fF]/.test(/[rRuUbBfF]+$/.exec(program.slice(0, i))?.[0] ?? "");
-    const delimiter = program.startsWith(char.repeat(3), i) ? char.repeat(3) : char;
-    i += delimiter.length;
-    let value = "";
-    let expressionDepth = 0;
-    while (i < program.length && !program.startsWith(delimiter, i)) {
-      if (program[i] === "\\") {
-        value += program[i] + (program[++i] ?? "");
-        i++;
-      } else {
-        const current = program[i];
-        if (expressionDepth > 0 && (current === "'" || current === '"')) {
-          if (program.startsWith(current.repeat(3), i)) return undefined;
-          let end = i + 1;
-          while (end < program.length && program[end] !== current) {
-            if (program[end] === "\\") end++;
-            end++;
-          }
-          if (end >= program.length) return undefined;
-          value += program.slice(i, end + 1);
-          i = end + 1;
-          continue;
-        }
-        if (
-          interpolated &&
-          expressionDepth === 0 &&
-          (program.startsWith("{{", i) || program.startsWith("}}", i))
-        ) {
-          value += program.slice(i, i + 2);
-          i += 2;
-          continue;
-        }
-        if (
-          (interpolated && current === "{") ||
-          (char === "`" && current === "{" && (expressionDepth > 0 || program[i - 1] === "$"))
-        )
-          expressionDepth++;
-        if ((interpolated || char === "`") && current === "}" && expressionDepth > 0)
-          expressionDepth--;
-        value += program[i++];
-      }
-    }
-    if (i >= program.length || expressionDepth !== 0) return undefined;
-    // Path values need exact decoding. Other escapes (including continuations and
-    // identity escapes) remain unproved; payload strings do not require this proof.
-    if (
-      /\b(?:open|Path|readFile|readFileSync|writeFile|writeFileSync|file|Bun\s*\.\s*write)\s*\(\s*$/.test(
-        code,
-      ) &&
-      value.replace(/\\(?:x[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})/g, "").includes("\\")
-    )
-      return undefined;
-    value = value.replace(
-      /\\(?:x([0-9a-fA-F]{2})|u([0-9a-fA-F]{4})|([0-7]{1,3}))/g,
-      (_match, hex: string | undefined, unicode: string | undefined, octal: string | undefined) =>
-        String.fromCharCode(Number.parseInt(hex ?? unicode ?? octal ?? "0", octal ? 8 : 16)),
-    );
-    if (
-      !python &&
-      /\b(?:require|import)\s*\(\s*$|\bimport\s*$|\b(?:import|export)\s+[^;()\n]*\bfrom\s*$/.test(
-        code,
-      )
-    )
-      loadedModules.push(value);
-    literals.push(value);
-    if (!literalTextArgument) pathLiterals.push(value);
-    // Template expressions remain executable; do not use their quoted boundary as an exemption.
-    if (interpolated || (char === "`" && value.includes("${"))) code += value;
-    code += " STRING ";
-    i += delimiter.length - 1;
-  }
-  return { code, literals, pathLiterals, loadedModules };
-}
-
-/** One immutable literal argv list passed once to subprocess.run, without a shell. */
-function staticSubprocessCommand(program: string): string | undefined {
-  // The binding and use must be adjacent top-level statements at the start of the program.
-  // A literal-looking assignment in a string, branch, or imported scope proves nothing.
-  const prefix =
-    /^import subprocess[ \t]*\r?\n([A-Za-z_]\w*)[ \t]*=[ \t]*(\[\s*(?:"[^"\\]*"|'[^'\\]*')(?:\s*,\s*(?:"[^"\\]*"|'[^'\\]*'))*\s*,?\s*\])[ \t]*\r?\n(?:[A-Za-z_]\w*[ \t]*=[ \t]*)?subprocess\.run\(/.exec(
-      program.trimStart(),
-    );
-  if (!prefix) return undefined;
-  const variable = prefix[1] ?? "";
-  const rest = program.trimStart().slice(prefix[0].length);
-  const call = new RegExp(
-    `^${variable}\\s*(?:,\\s*(?:cwd\\s*=\\s*(?:"[^"\\\\]*"|'[^'\\\\]*')|(?:capture_output|text|check)\\s*=\\s*(?:True|False)|timeout\\s*=\\s*\\d+))*\\s*\\)`,
-  ).exec(rest);
-  if (!call) return undefined;
-  const parts = programParts(program, true);
-  if (
-    !parts ||
-    (parts.code.match(new RegExp(`\\b${variable}\\b`, "g"))?.length ?? 0) !== 2 ||
-    (parts.code.match(/\bsubprocess\b/g)?.length ?? 0) !== 2
-  )
-    return undefined;
-  const values = [...(prefix[2] ?? "").matchAll(/"([^"\\]*)"|'([^'\\]*)'/g)].map(
-    (match) => match[1] ?? match[2] ?? "",
-  );
-  if (!values.length) return undefined;
-  const quote = (value: string) => "'" + value.replaceAll("'", "'\"'\"'") + "'";
-  const command = values.map(quote).join(" ");
-  const directories = [...call[0].matchAll(/\bcwd\s*=\s*(?:"([^"\\]*)"|'([^'\\]*)')/g)];
-  if (!directories.length) return command;
-  const cwd = directories[0]?.[1] ?? directories[0]?.[2] ?? "";
-  // Never replay a cwd-bearing call as if it ran in the original shell directory.
-  if (directories.length !== 1 || !isStaticNavigationCommand(["cd", "--", cwd])) return undefined;
-  const argv = unwrapCwdSubprocessCommand(values);
-  if (!argv || !isProvedCwdSubprocessRole(argv)) return undefined;
-  // Keep wrapper assignments/options in policy replay after proving the nested command role.
-  const replay = `cd -- ${quote(cwd)} && ${command}`;
-  return hasProvedNavigationSequence(replay) ? replay : undefined;
-}
-
-function unwrapCwdSubprocessCommand(words: string[]): string[] | undefined {
-  let argv = words;
-  // Each successful wrapper removes words; the original word count bounds recursion.
-  for (let depth = 0; depth < words.length; depth++) {
-    const unwrapped = unwrapProofCommand(argv, "\0");
-    if (!unwrapped) return undefined;
-    argv = unwrapped;
-    if (argv[0]?.split("/").at(-1) !== "env") return argv;
-    const nested = unwrapEnvironmentCommand(argv);
-    if (!nested) return undefined;
-    // Inspect only env's prefix, not options belonging to its child command.
-    // env directory, split-string and unknown options do not preserve the proved context.
-    if (
-      argv
-        .slice(1, argv.length - nested.length)
-        .some(
-          (arg) =>
-            arg.startsWith("-") && arg !== "--" && arg !== "-i" && arg !== "--ignore-environment",
-        )
-    )
-      return undefined;
-    argv = nested;
-  }
-  return undefined;
-}
-
-function isProvedCwdSubprocessRole(argv: string[]): boolean {
-  const name = argv[0]?.split("/").at(-1) ?? "";
-  if (inlineProgramIndex(argv) !== undefined || isUnsupportedInlineRuntime(argv)) return false;
-  if (isPassiveTextCommand(argv)) return true;
-  if (name === "find") return isSafeLocalAssignmentCommand(argv);
-  if (["ls", "cat", "uniq", "cut"].includes(name)) return true;
-  if (name === "wc") return !hasExecutionOption(argv.slice(1), ["files0-from"]);
-  if (name === "sort")
-    return !hasExecutionOption(argv.slice(1), ["compress-program", "files0-from"]);
-  if (name === "git") {
-    let index = 1;
-    while (argv[index] === "-C" && argv[index + 1]) index += 2;
-    return ["ls-files", "ls-tree", "status", "rev-parse", "rev-list"].includes(argv[index] ?? "");
-  }
-  // A literal Bun script keeps the existing supported test-runner route.
-  if (name === "bun") return /^[A-Za-z0-9_./-]+\.(?:[cm]?[jt]s)$/.test(argv[1] ?? "");
-  // Retain extraction so the nested CLI policy returns its ordinary descriptor.
-  return DEFAULT_BLOCKED_CLI_TOOLS.some((tool) => tool.name === name);
-}
-
-function inlineSubprocessCommands(command: string): string[] {
-  const parsed = parseStaticShellCommands(command);
-  if (!parsed || typeof parsed === "string") return [];
-  return parsed.pipelines.flat().flatMap((words) => {
-    const argv = unwrapStaticCommand(words);
-    const index = inlineProgramIndex(argv);
-    const nested = index === undefined ? undefined : staticSubprocessCommand(argv[index] ?? "");
-    return nested ? [nested] : [];
-  });
-}
-
-/** The complete invocation must preserve the package loader's startup and lookup identity. */
-function hasProvedPackageInventoryInvocation(command: string): boolean {
-  if (hasEnvironmentMutationPrefix(command)) return false;
-  const parsed = parseStaticShellCommands(command);
-  if (!parsed || typeof parsed === "string") return false;
-  return parsed.pipelines.flat().every((words) => {
-    const argv = unwrapStaticCommand(words);
-    if (
-      argv[0]?.split("/").at(-1) === "cat" ||
-      isPassiveTextCommand(argv) ||
-      isLiteralInlineWriter(argv)
-    )
-      return true;
-    const index = inlineProgramIndex(argv);
-    return (
-      inlineRuntimeKind(argv[0]) === "node" &&
-      index !== undefined &&
-      staticPackageInventory(argv[index] ?? "") !== undefined
-    );
-  });
-}
-
-/** Replay each proved JSON loader operand through ordinary command policies as well. */
-function inlinePackageCommands(command: string, allowInventory: boolean): string[] {
-  if (!allowInventory) return [];
-  const parsed = parseStaticShellCommands(command);
-  if (!parsed || typeof parsed === "string") return [];
-  return parsed.pipelines.flat().flatMap((words) => {
-    const argv = unwrapStaticCommand(words);
-    const index = inlineProgramIndex(argv);
-    if (index === undefined || inlineRuntimeKind(argv[0]) !== "node") return [];
-    const program = argv[index] ?? "";
-    const paths = staticPackageInventory(program);
-    return (paths ?? []).map((path) =>
-      ["node", "-e", program]
-        .map((word, position) => {
-          const materialized =
-            position === 2
-              ? program.replace(
-                  /\brequire\s*\(\s*(["'])\.\/\1\s*\+\s*[a-z]\s*\)/,
-                  () => `require(${JSON.stringify(path)})`,
-                )
-              : word;
-          return "'" + materialized.replaceAll("'", "'\"'\"'") + "'";
-        })
-        .join(" "),
-    );
-  });
-}
-
-function hasInlineProgramExecution(
-  program: string,
-  python: boolean,
-  allowInventory = false,
-): boolean {
-  const parts = programParts(program, python);
-  if (!parts) return true;
-  if (parts.loadedModules.some((name) => /^(?:node:)?vm$/.test(name))) return true;
-  // Dynamic loading and reflective access cannot establish a non-executing code operand.
-  if (
-    (/\b(?:require|import)\s*\((?!\s*STRING\s*\))/.test(parts.code) &&
-      (!allowInventory || !staticPackageInventory(program))) ||
-    /\[\s*STRING\s*\+/.test(parts.code) ||
-    /\b(?:process|os)\s*\[/.test(parts.code)
-  )
-    return true;
-  const code = staticSubprocessCommand(program)
-    ? parts.code.replace(/\bsubprocess\b/g, "")
-    : parts.code;
-  return (
-    /\b(?:subprocess|child_process|execSync|execFile|execFileSync|spawn|spawnSync|eval|exec|Function|Reflect|getattr|setattr|globals|locals|vars|compile|__import__)\b|\bos\s*\.\s*(?:system|popen)|\bBun\s*\.\s*(?:spawn|spawnSync)|\bDeno\s*\.\s*Command/.test(
-      code,
-    ) || parts.literals.some((value) => /^(?:node:)?child_process$/.test(value))
-  );
-}
-
-function mentionsEnvironmentRead(text: string): boolean {
-  // `--env dev` is a flag of another command, not the env command.
-  return /(?<![\w.-])printenv\b(?!-)|(?<![\w.-])-\w*Oprintenv\b|(?<![\w.-])\benv\b(?!-)/i.test(
-    text.replace(/['"\\]/g, ""),
-  );
-}
-
-function hasBraceExpansion(text: string): boolean {
-  return /\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(text);
-}
-
-function hasNonExecutingAwkProgram(text: string): boolean {
-  const match = /\bawk\s+(['"])([\s\S]*?)\1/.exec(text);
-  if (!match) return false;
-  const program = match[2] ?? "";
-  return !/\b(?:system|getline)\s*\(|\||\b(?:print|printf)\b[^\n]*>/.test(program);
-}
-
-function hasShellBraceExpansion(text: string): boolean {
-  if (!hasBraceExpansion(text)) return false;
-  if (!hasNonExecutingAwkProgram(text)) return true;
-  return hasBraceExpansion(text.replace(/(\bawk\s+(['"]))[\s\S]*?\2/, "awk "));
-}
-
-/**
- * The command without quoted regex quantifiers such as `{0,80}`. Many commands re-parse quoted
- * text as shell code, so every other quoted brace stays. When both sides are digits, the expansion
- * cannot spell a command name. An empty side is not safe: `e{,}nv` and `e{0,}nv` expand to `env`.
- * An unclosed quote keeps the raw command.
- */
-function withoutQuotedQuantifiers(command: string): string {
-  let text = "";
-  let quote: "'" | '"' | "$'" | undefined;
-  for (let i = 0; i < command.length; i++) {
-    const char = command.charAt(i);
-    const quantifier = quote ? /^\{\d+,\d+\}/.exec(command.slice(i))?.[0] : undefined;
-    if (quantifier) {
-      i += quantifier.length - 1;
-      continue;
-    }
-    text += char;
-    if (quote === "'") {
-      if (char === "'") quote = undefined;
-    } else if (char === "\\") {
-      text += command[++i] ?? "";
-    } else if (quote) {
-      if (char === quote.at(-1)) quote = undefined;
-    } else if (char === "$" && command[i + 1] === "'") {
-      quote = "$'";
-      text += command[++i];
-    } else if (char === "'" || char === '"') {
-      quote = char;
-    }
-  }
-  return quote ? command : text;
-}
-
-/** Braces in static words, except `{m,n}` with digits on both sides (see above). */
-function hasArgumentBraceExpansion(text: string): boolean {
-  return hasShellBraceExpansion(text.replace(/\{\d+,\d+\}/g, ""));
-}
-
-function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
-  const apiData = apiRequestDataIndexes(argv);
-  if (apiData)
-    return argv.some((arg, index) => !apiData.has(index) && hasArgumentBraceExpansion(arg));
-  // LogQL is data for this wrapper; its quoted label selectors are never shell-evaluated.
-  if (
-    argv[0]?.split("/").at(-1) === "bun" &&
-    argv[1] === "run" &&
-    argv[2] === "observability-tool" &&
-    argv[3] === "logs" &&
-    argv[4] === "query"
-  )
-    return false;
-  const sql = literalSqlArgumentIndex(argv);
-  if (sql !== undefined)
-    return argv.some((arg, index) => index !== sql && hasArgumentBraceExpansion(arg));
-  return (argv[0]?.split("/").at(-1) === "awk" && !isAwkExecution(argv)) ||
-    inlineProgramIndex(argv) !== undefined ||
-    isPassiveJqCommand(argv)
-    ? false
-    : hasArgumentBraceExpansion(argv.join(" "));
-}
-
-function apiRequestDataIndexes(argv: string[]): Set<number> | undefined {
-  const start =
-    argv[0] === "bun" && argv[1] === "run" && argv[2] === "api-tool"
-      ? 3
-      : ["api-tool", "agent-tools-api"].includes(argv[0] ?? "")
-        ? 1
-        : -1;
-  if (start < 0 || argv[start] !== "request" || argv.length > 18) return undefined;
-  const data = new Set<number>();
-  const seen = new Set<string>();
-  for (let index = start + 1; index < argv.length; index++) {
-    const [flag = "", ...attached] = (argv[index] ?? "").split("=");
-    if (
-      !["--config", "--profile", "--path", "--method", "--query", "--body"].includes(flag) ||
-      seen.has(flag)
-    )
-      return undefined;
-    seen.add(flag);
-    const value = attached.length ? attached.join("=") : argv[++index];
-    if (!value || value.startsWith("--")) return undefined;
-    if (flag === "--query" || flag === "--body") {
-      try {
-        JSON.parse(value);
-      } catch {
-        return undefined;
-      }
-      data.add(index);
-    } else if (flag === "--method") {
-      if (!["GET", "POST", "PUT", "PATCH", "DELETE"].includes(value)) return undefined;
-    } else if (flag === "--profile") {
-      if (!/^[A-Za-z0-9_-]{1,128}$/.test(value)) return undefined;
-    } else if (flag === "--config") {
-      if (!/^(?:\.?\.?\/)?[A-Za-z0-9_./-]+$/.test(value)) return undefined;
-    } else if (flag === "--path") {
-      if (
-        value.length > 16384 ||
-        !/^\/[A-Za-z0-9_~!$&'()+,=:@./-]*$/.test(value) ||
-        value.includes("//") ||
-        value.split("/").some((part) => part.endsWith("."))
-      )
-        return undefined;
-    }
-  }
-  return data;
-}
-
-function literalSqlArgumentIndex(argv: string[]): number | undefined {
-  if (
-    argv[0]?.split("/").at(-1) !== "bun" ||
-    argv[1] !== "run" ||
-    argv[2] !== "db-tool" ||
-    !["sql", "query"].includes(argv[3] ?? "")
-  )
-    return undefined;
-  let sql: number | undefined;
-  const seen = new Set<string>();
-  for (let index = 4; index < argv.length; index++) {
-    const [option = "", ...attached] = (argv[index] ?? "").split("=");
-    if (
-      !["--sql", "--env", "--profile", "--limit", "--format"].includes(option) ||
-      seen.has(option)
-    )
-      return undefined;
-    seen.add(option);
-    const value = attached.length ? attached.join("=") : argv[++index];
-    if (!value || value.startsWith("--")) return undefined;
-    if (option === "--sql") sql = index;
-    else if (!/^[A-Za-z0-9_./-]+$/.test(value)) return undefined;
-  }
-  return sql;
-}
-
-function isLiteralTextProducer(argv: string[]): boolean {
-  return (
-    (argv[0]?.split("/").at(-1) === "git" && argv[1] === "commit") ||
-    (isPassiveTextCommand(argv) && argv[0]?.split("/").at(-1) !== "head")
-  );
-}
-
-function awkProgramIndex(argv: string[]): number | undefined {
-  if (argv[0]?.split("/").at(-1) !== "awk") return undefined;
-  let index = 1;
-  while (index < argv.length) {
-    const arg = argv[index] ?? "";
-    if (arg === "--") return index + 1 < argv.length ? index + 1 : undefined;
-    if (arg === "-F") {
-      if (argv[index + 1] === undefined) return undefined;
-      index += 2;
-      continue;
-    }
-    if (arg.startsWith("-F") && arg.length > 2) {
-      index++;
-      continue;
-    }
-    if (arg.startsWith("-")) return undefined;
-    return index;
-  }
-  return undefined;
-}
-
-function isAwkExecution(argv: string[]): boolean {
-  if (argv[0]?.split("/").at(-1) !== "awk") return false;
-  // Only a literal inline program with known-safe options establishes passive behavior.
-  const index = awkProgramIndex(argv);
-  const program = index === undefined ? undefined : argv[index];
-  return (
-    !program ||
-    /\b(?:system|getline|ENVIRON)\b|\||\b(?:print|printf)\b[^\n]*>|@(?:include|load)/.test(
-      program,
-    ) ||
-    argv.slice((index ?? -1) + 1).some((arg) => arg.startsWith("-"))
-  );
-}
-
-function isPassiveJqCommand(argv: string[]): boolean {
-  return passiveJqProgramIndex(argv) !== undefined;
-}
-
-/** Preserve explicit startup and cwd context across every command in a jq compound. */
-function hasProvedJqContext(words: string[]): boolean {
-  let index = 0;
-  while (["rtk", "command"].includes(words[index]?.split("/").at(-1) ?? "")) {
-    const wrapper = words[index++]?.split("/").at(-1);
-    if (
-      (wrapper === "rtk" && words[index] === "proxy") ||
-      (wrapper === "command" && words[index] === "--")
-    )
-      index++;
-  }
-  let argv = words.slice(index);
-  if (argv[0]?.split("/").at(-1) === "env") {
-    if (argv[1] !== "HOME=/dev/null") return false;
-    argv = argv.slice(2);
-    return isPassiveJqCommand(argv);
-  }
-  const name = argv[0]?.split("/").at(-1) ?? "";
-  if (/^[A-Za-z_]\w*=/.test(argv[0] ?? "")) return false;
-  return (
-    isReadonlyJqConsumer(argv) ||
-    isProvedCwdSubprocessRole(argv) ||
-    isStaticNavigationCommand(argv) ||
-    isSafeLocalAssignmentCommand(argv) ||
-    isLiteralHerdrRead(argv) ||
-    isLiteralHerdrPrompt(argv) ||
-    isLiteralInlineWriter(argv) ||
-    isChecksumCommand(argv) ||
-    pythonCompileFiles(argv) !== undefined ||
-    DEFAULT_BLOCKED_CLI_TOOLS.some((tool) => tool.wrapper === name) ||
-    (argv.length === 1 && ["true", "false", "pwd"].includes(name))
-  );
-}
-
-function jqFileArguments(argv: string[]): string[] {
-  const program = passiveJqProgramIndex(argv);
-  if (program !== undefined) return argv.slice(program + 1);
-  // Unsupported forms retain conservative path evidence, including loader operands.
-  const files: string[] = [];
-  let index = 1;
-  for (; index < argv.length; index++) {
-    const arg = argv[index] ?? "";
-    if (arg === "--") {
-      index++;
-      break;
-    }
-    if (/^-[rRcMsScn]+$/.test(arg)) continue;
-    if (arg === "--arg" || arg === "--argjson") {
-      index += 2;
-      continue;
-    }
-    if (arg === "--rawfile" || arg === "--slurpfile") {
-      files.push(argv[index + 2] ?? "");
-      index += 2;
-      continue;
-    }
-    if (arg.startsWith("-")) return argv.slice(1);
-    break;
-  }
-  return [...files, ...argv.slice(index + 1)];
-}
-
-/** File roles only, never evaluation or repository/cwd attestation. Unknown syntax fails closed. */
-function gitDiffFileArguments(args: string[]): string[] | undefined {
-  const flags = [
-    "patch",
-    "no-patch",
-    "raw",
-    "patch-with-raw",
-    "patch-with-stat",
-    "numstat",
-    "shortstat",
-    "summary",
-    "name-only",
-    "name-status",
-    "cached",
-    "staged",
-    "merge-base",
-    "check",
-    "full-index",
-    "binary",
-    "no-abbrev",
-    "no-renames",
-    "find-copies-harder",
-    "text",
-    "reverse",
-    "exit-code",
-    "quiet",
-    "no-ext-diff",
-    "no-textconv",
-    "no-index",
-    "no-color",
-    "no-relative",
-    "no-prefix",
-    "default-prefix",
-    "ignore-all-space",
-    "ignore-space-change",
-    "ignore-space-at-eol",
-    "ignore-cr-at-eol",
-    "ignore-blank-lines",
-    "minimal",
-    "patience",
-    "histogram",
-    "indent-heuristic",
-    "no-indent-heuristic",
-    "cc",
-    "function-context",
-    "pickaxe-all",
-    "pickaxe-regex",
-  ];
-  const data = [
-    "src-prefix",
-    "dst-prefix",
-    "line-prefix",
-    "word-diff-regex",
-    "anchored",
-    "diff-algorithm",
-    "inter-hunk-context",
-    "find-object",
-    "skip-to",
-    "rotate-to",
-    "ignore-matching-lines",
-    "stat-width",
-    "stat-name-width",
-    "stat-graph-width",
-    "stat-count",
-    "diff-filter",
-    "output-indicator-new",
-    "output-indicator-old",
-    "output-indicator-context",
-    "ws-error-highlight",
-    "color-moved-ws",
-  ];
-  const optional = [
-    "stat",
-    "unified",
-    "color",
-    "color-moved",
-    "relative",
-    "abbrev",
-    "word-diff",
-    "submodule",
-    "dirstat",
-    "dirstat-by-file",
-    "find-renames",
-    "find-copies",
-    "break-rewrites",
-    "ignore-submodules",
-  ];
-  const names = [...flags, ...data, ...optional, "output"];
-  const files: string[] = [];
-  for (let index = 0; index < args.length; index++) {
-    const arg = args[index] ?? "";
-    if (arg === "--") return [...files, ...args.slice(index + 1)];
-    if (!arg.startsWith("-") || arg === "-") {
-      files.push(arg);
-      continue;
-    }
-    if (arg.startsWith("--")) {
-      const equals = arg.indexOf("=");
-      const spelling = arg.slice(2, equals === -1 ? undefined : equals);
-      const candidates = names.includes(spelling)
-        ? [spelling]
-        : names.filter((name) => name.startsWith(spelling));
-      if (!spelling || candidates.length !== 1) return undefined;
-      const name = candidates[0] ?? "";
-      if (flags.includes(name)) {
-        if (equals !== -1) return undefined;
-        continue;
-      }
-      if (optional.includes(name)) continue; // Optional values attach with =, never consume the next path.
-      const value = equals === -1 ? args[++index] : arg.slice(equals + 1);
-      if (value === undefined || (equals === -1 && value === "--")) return undefined;
-      if (name === "output") {
-        if (!value) return undefined;
-        files.push(value);
-      }
-      continue;
-    }
-    for (let cursor = 1; cursor < arg.length; cursor++) {
-      const option = arg[cursor] ?? "";
-      if ("puszawbcRDW".includes(option)) continue;
-      if ("UMCB".includes(option)) break; // Optional attached data occupies the rest of this word.
-      if (!"OSGIl".includes(option)) return undefined;
-      const attached = arg.slice(cursor + 1);
-      const value = attached || args[++index];
-      if (value === undefined || (!attached && value === "--")) return undefined;
-      if (option === "O") {
-        if (!value) return undefined;
-        files.push(value);
-      }
-      break; // Required data consumes its attached/separate value, including option-looking patterns.
-    }
-  }
-  return files;
-}
-
-function hasUnsupportedGitDiffArguments(command: string): boolean {
-  const parsed = parseStaticShellCommands(command);
-  if (!parsed || typeof parsed === "string") return false;
-  return parsed.pipelines.flat().some((words) => {
-    const argv = unwrapStaticCommand(words);
-    if (argv[0]?.split("/").at(-1) !== "git") return false;
-    let index = 1;
-    while (argv[index] === "-C" && argv[index + 1]) index += 2;
-    return argv[index] === "diff" && gitDiffFileArguments(argv.slice(index + 1)) === undefined;
-  });
-}
-
-/** Index in `args` where the command wrapped by `env` starts, or null when `env` only lists. */
-function environmentCommandStart(args: string[]): number | null {
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i] ?? "";
-    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(arg)) continue;
-    if (arg === "--") return i + 1 === args.length ? null : i + 1;
-    if (arg === "-u" || arg === "--unset" || arg === "-C" || arg === "--chdir") {
-      i++;
-      continue;
-    }
-    if (arg === "-i" || arg === "--ignore-environment" || arg.startsWith("--chdir=")) continue;
-    if (arg.startsWith("--unset=")) continue;
-    if (arg.startsWith("-")) return null;
-    return i;
-  }
-  return null;
-}
-
-function isEnvironmentListing(argv: string[]): boolean {
-  return environmentCommandStart(argv.slice(1)) === null;
-}
-
-function unwrapEnvironmentCommand(argv: string[]): string[] | null {
-  if (argv[0]?.split("/").at(-1) !== "env") return null;
-  const args = argv.slice(1);
-  const start = environmentCommandStart(args);
-  return start === null ? null : args.slice(start);
-}
-
-function isSafeLiteralInspection(argv: string[]): boolean {
-  const name = argv[0]?.split("/").at(-1) ?? "";
-  return (
-    ["head", "tail"].includes(name) &&
-    !argv.slice(1).some((arg) => /\.env(?:\.|$)|\.(?:pem|key)\b|secret|credential/i.test(arg))
-  );
-}
-
-function isSafeLiteralConsumer(argv: string[]): boolean {
-  return (
-    isSafeLiteralInspection(argv) ||
-    (argv[0]?.split("/").at(-1) === "bun" &&
-      argv[1] === "run" &&
-      argv[2] === "gh-tool" &&
-      argv.includes("--body-file"))
-  );
-}
-
-function unwrapStaticCommand(words: string[]): string[] {
-  let argv = [...words];
-  while (argv.length) {
-    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[0] ?? "")) {
-      argv.shift();
-      continue;
-    }
-    const executable = argv[0]?.split("/").at(-1);
-    if (executable === "env") {
-      const wrapped = unwrapEnvironmentCommand(argv);
-      if (!wrapped) break;
-      argv = wrapped;
-    } else if (executable === "rtk" || executable === "command") {
-      argv.shift();
-      if (executable === "rtk") {
-        if (argv[0] === "proxy") argv.shift();
-        else if (argv[0] === "read") argv[0] = "cat";
-      }
-      if (executable === "command" && argv[0] === "--") argv.shift();
-    } else break;
-  }
-  return argv;
-}
-
-function isAllowedEnvironmentRead(argv: string[], allowedNames: Set<string>): boolean {
-  if (isAllowedPythonEnvironmentRead(argv, allowedNames)) return true;
-  if (argv[0]?.split("/").at(-1) !== "printenv") return false;
-  const args = argv.slice(1);
-  if (args[0] === "--") args.shift();
-  return args.length > 0 && args.every((name) => allowedNames.has(name));
-}
-
-/** Prove the complete, print-only Python program before treating its reads as approved. */
-function isAllowedPythonEnvironmentRead(argv: string[], allowedNames: Set<string>): boolean {
-  const index = inlineProgramIndex(argv);
-  if (inlineRuntimeKind(argv[0]) !== "python" || index === undefined || argv.length !== index + 1)
-    return false;
-
-  const program = argv[index] ?? "";
-  if (program.length > 65_536) return false;
-  let position = 0;
-  let foundRead = false;
-  let importedJson = false;
-  const skipInlineWhitespace = () => {
-    while (/[\t ]/.test(program[position] ?? "")) position++;
-  };
-  const take = (value: string): boolean => {
-    if (!program.startsWith(value, position)) return false;
-    position += value.length;
-    return true;
-  };
-  const takeIdentifier = (value: string): boolean => {
-    if (
-      !program.startsWith(value, position) ||
-      /[A-Za-z0-9_]/.test(program[position + value.length] ?? "")
-    )
-      return false;
-    position += value.length;
-    return true;
-  };
-  const takeString = (): string | undefined => {
-    skipInlineWhitespace();
-    const quote = program[position];
-    if ((quote !== "'" && quote !== '"') || program.startsWith(quote.repeat(3), position))
-      return undefined;
-    position++;
-    const start = position;
-    while (position < program.length && program[position] !== quote) {
-      if (/[\\\r\n]/.test(program[position] ?? "")) return undefined;
-      position++;
-    }
-    if (program[position] !== quote) return undefined;
-    const value = program.slice(start, position);
-    position++;
-    return value;
-  };
-  const takeEnvironmentRead = (variable?: string): boolean => {
-    skipInlineWhitespace();
-    const takeName = (): boolean => {
-      skipInlineWhitespace();
-      if (variable !== undefined) return takeIdentifier(variable);
-      const name = takeString();
-      return name !== undefined && allowedNames.has(name);
-    };
-    const start = position;
-    if (!takeIdentifier("os")) return false;
-    if (!take(".")) {
-      position = start;
-      return false;
-    }
-    if (takeIdentifier("getenv")) {
-      if (!take("(")) return false;
-      if (!takeName()) return false;
-      skipInlineWhitespace();
-      if (take(",")) {
-        if (takeString() === undefined) return false;
-        skipInlineWhitespace();
-      }
-      if (!take(")")) return false;
-      foundRead = true;
-      return true;
-    }
-    if (!takeIdentifier("environ")) return false;
-    if (take(".")) {
-      if (!takeIdentifier("get") || !take("(")) return false;
-      if (!takeName()) return false;
-      skipInlineWhitespace();
-      if (take(",")) {
-        if (takeString() === undefined) return false;
-        skipInlineWhitespace();
-      }
-      if (!take(")")) return false;
-      foundRead = true;
-      return true;
-    }
-    if (!take("[")) return false;
-    if (!takeName()) return false;
-    skipInlineWhitespace();
-    if (!take("]")) return false;
-    foundRead = true;
-    return true;
-  };
-  const takeApprovedNames = (): boolean => {
-    if (!take("[")) return false;
-    for (let count = 0; count < 16; count++) {
-      const name = takeString();
-      if (name === undefined || !allowedNames.has(name)) return false;
-      skipInlineWhitespace();
-      if (take("]")) return true;
-      if (!take(",")) return false;
-      skipInlineWhitespace();
-      if (take("]")) return true;
-    }
-    return false;
-  };
-  const takeComprehension = (): boolean => {
-    const dictionary = take("{");
-    if (!dictionary && !take("[")) return false;
-    skipInlineWhitespace();
-    const variable = dictionary
-      ? /^[A-Za-z_][A-Za-z0-9_]*/.exec(program.slice(position))?.[0]
-      : /^os\.(?:getenv\(|environ(?:\.get\(|\[))[\t ]*([A-Za-z_][A-Za-z0-9_]*)/.exec(
-          program.slice(position),
-        )?.[1];
-    if (!variable || ["os", "json", "print"].includes(variable)) return false;
-    if (dictionary) {
-      if (!takeIdentifier(variable)) return false;
-      skipInlineWhitespace();
-      if (!take(":")) return false;
-    }
-    if (!takeEnvironmentRead(variable)) return false;
-    const loop = new RegExp(`[\\t ]+for[\\t ]+${variable}[\\t ]+in[\\t ]+`, "y");
-    loop.lastIndex = position;
-    const match = loop.exec(program);
-    if (!match) return false;
-    position = loop.lastIndex;
-    if (!takeApprovedNames()) return false;
-    skipInlineWhitespace();
-    return take(dictionary ? "}" : "]");
-  };
-  const takeProjection = (): boolean => {
-    const start = position;
-    const previousRead = foundRead;
-    if (takeComprehension()) return true;
-    position = start;
-    foundRead = previousRead;
-    const dictionary = take("{");
-    if (!dictionary && !take("[")) return false;
-    const close = dictionary ? "}" : "]";
-    for (let count = 0; count < 16; count++) {
-      if (dictionary) {
-        const key = takeString();
-        if (key === undefined || !allowedNames.has(key)) return false;
-        skipInlineWhitespace();
-        if (!take(":")) return false;
-      }
-      if (!takeEnvironmentRead()) return false;
-      skipInlineWhitespace();
-      if (take(close)) return true;
-      if (!take(",")) return false;
-      skipInlineWhitespace();
-      if (take(close)) return true;
-    }
-    return false;
-  };
-  const takeJsonDisplay = (): boolean => {
-    if (!importedJson || !takeIdentifier("json") || !take(".dumps")) return false;
-    skipInlineWhitespace();
-    if (!take("(")) return false;
-    skipInlineWhitespace();
-    if (!takeProjection()) return false;
-    skipInlineWhitespace();
-    return take(")");
-  };
-  const takeExpression = (): boolean => {
-    const takeTerm = (): boolean => {
-      skipInlineWhitespace();
-      return program.startsWith("json", position)
-        ? takeJsonDisplay()
-        : takeString() !== undefined || takeEnvironmentRead();
-    };
-    if (!takeTerm()) return false;
-    skipInlineWhitespace();
-    while (take("+")) {
-      if (!takeTerm()) return false;
-      skipInlineWhitespace();
-    }
-    return true;
-  };
-  const takePrint = (): boolean => {
-    skipInlineWhitespace();
-    if (!takeIdentifier("print")) return false;
-    skipInlineWhitespace();
-    if (!take("(")) return false;
-    skipInlineWhitespace();
-    if (take(")")) return true;
-    while (true) {
-      if (!takeExpression()) return false;
-      skipInlineWhitespace();
-      if (take(")")) return true;
-      if (!take(",")) return false;
-      skipInlineWhitespace();
-      if (take(")")) return true;
-    }
-  };
-  const skipSeparators = (): void => {
-    while (true) {
-      skipInlineWhitespace();
-      if (take(";") || take("\n") || take("\r\n")) continue;
-      break;
-    }
-  };
-
-  skipInlineWhitespace();
-  if (!takeIdentifier("import")) return false;
-  skipInlineWhitespace();
-  const jsonFirst = takeIdentifier("json");
-  if (!jsonFirst && !takeIdentifier("os")) return false;
-  importedJson = jsonFirst;
-  skipInlineWhitespace();
-  if (take(",")) {
-    skipInlineWhitespace();
-    if (!takeIdentifier(jsonFirst ? "os" : "json")) return false;
-    importedJson = true;
-  } else if (jsonFirst) return false;
-  skipInlineWhitespace();
-  if (!(take(";") || take("\n") || take("\r\n"))) return false;
-  skipSeparators();
-  if (!importedJson && takeIdentifier("import")) {
-    skipInlineWhitespace();
-    if (!takeIdentifier("json")) return false;
-    importedJson = true;
-    skipInlineWhitespace();
-    if (!(take(";") || take("\n") || take("\r\n"))) return false;
-    skipSeparators();
-  }
-  while (position < program.length) {
-    if (!takePrint()) return false;
-    skipInlineWhitespace();
-    if (position === program.length) break;
-    if (!(take(";") || take("\n") || take("\r\n"))) return false;
-    skipSeparators();
-  }
-  return foundRead;
-}
-
-function hasExecutionOption(args: string[], longOptions: string[], shortOption?: string): boolean {
-  return args.some((arg) => {
-    const flag = arg.split("=", 1)[0] ?? "";
-    if (flag.startsWith("--") && flag.length > 2) {
-      // Git supports long-option abbreviations. Refuse ambiguous prefixes too.
-      return longOptions.some((option) => option.startsWith(flag.slice(2)));
-    }
-    return shortOption !== undefined && /^-[^-]/.test(flag) && flag.includes(shortOption);
-  });
-}
-
-function passivePrintfFormatIndex(argv: string[]): number | undefined {
-  const index = argv[1] === "--" ? 2 : 1;
-  const format = argv[index];
-  if (format === undefined || (index === 1 && format.startsWith("-"))) return undefined;
-  // Ignore escaped percent signs; %n writes a shell variable named by a data argument.
-  return /%[-+ #0]*(?:\d+|\*)?(?:\.(?:\d+|\*))?[hljztL]*n/.test(format.replaceAll("%%", ""))
-    ? undefined
-    : index;
-}
-
-/** Unknown values are permitted only in operands that navigate without displaying the value. */
-function isNavigationOperand(argv: string[], marker: string): boolean {
-  const name = argv[0]?.split("/").at(-1);
-  if (name === "cd") {
-    const index = argv[1] === "--" ? 2 : 1;
-    return argv.length === index + 1 && !argv[0]?.includes(marker);
-  }
-  if (name !== "git") return false;
-  let index = 1;
-  while (argv[index] === "-C" && argv[index + 1]) index += 2;
-  return (
-    ["status", "rev-parse", "rev-list"].includes(argv[index] ?? "") &&
-    !argv.slice(index).some((arg) => arg.includes(marker)) &&
-    !argv[0]?.includes(marker)
-  );
-}
-
-/** Literal directory operands only; navigation is never a pipeline consumer. */
-function isStaticNavigationCommand(argv: string[]): boolean {
-  const path = (value: string | undefined) => /^[A-Za-z0-9_./][A-Za-z0-9_./ -]*$/.test(value ?? "");
-  if (argv[0] === "cd")
-    return isNavigationOperand(argv, "\0") && path(argv[argv[1] === "--" ? 2 : 1]);
-  if (argv[0] !== "git") return false;
-  let index = 1;
-  while (argv[index] === "-C") {
-    if (!path(argv[index + 1])) return false;
-    index += 2;
-  }
-  return (
-    isNavigationOperand(argv, "\0") ||
-    (index > 1 && isPassiveTextCommand(["git", ...argv.slice(index)]))
-  );
-}
-
-/** Literal wrappers and exact directory-operation roles; unknown consumers keep refusal. */
-function isProvedDirectoryCommand(words: string[]): boolean {
-  const argv = unwrapStaticCommand(words);
-  if (
-    !words
-      .slice(0, words.length - argv.length)
-      .every((word) => ["rtk", "proxy", "command", "--"].includes(word))
-  )
-    return false;
-  if (argv[0] === "cd") return isStaticNavigationCommand(argv);
-  if (argv[0] !== "git") return false;
-  let index = 1;
-  while (argv[index] === "-C") {
-    if (!isStaticNavigationCommand(["cd", argv[index + 1] ?? ""])) return false;
-    index += 2;
-  }
-  const args = argv.slice(index);
-  if (args[0] === "status")
-    return args.length === 1 || (args.length === 2 && args[1] === "--short");
-  if (args[0] === "fetch")
-    return (
-      args.length >= 2 &&
-      args.length <= 3 &&
-      args.slice(1).every((arg) => /^[A-Za-z0-9_][A-Za-z0-9_./-]*$/.test(arg))
-    );
-  return (
-    (args.length === 2 && args[0] === "rev-parse" && args[1] === "HEAD") ||
-    (args.length === 3 && args[0] === "rev-list" && args[1] === "--count" && args[2] === "HEAD")
-  );
-}
-
-/** Prove a single cd whose uses are gated on success, without simulating shell state. */
-function hasProvedNavigationSequence(command: string): boolean {
-  const literal = literalBindingText(command, "", "");
-  const parsed = parseStaticShellCommands(command);
-  if (!literal || !parsed || typeof parsed === "string") return false;
-  const commands = parsed.pipelines.flat().map((words) => unwrapProofCommand(words, "\0"));
-  const changesDirectory = commands.filter((argv) => argv?.[0] === "cd");
-  if (
-    !commands.some((argv) => argv && (argv[0] === "cd" || (argv[0] === "git" && argv[1] === "-C")))
-  )
-    return true;
-  if (
-    /\|\||(^|[^&])&(?!&)/.test(literal.syntax.replace(/[<>]&[0-9-]+/g, "")) ||
-    parsed.redirects.some(({ target }) => !target.startsWith("/")) ||
-    changesDirectory.length > 1
-  )
-    return false;
-  if (!changesDirectory.length) return true;
-  // Only the final AND list can use this directory. A failing cd never reaches its readers.
-  // Trim real trailing whitespace, not the spaces masking final quoted argv words.
-  const syntax = literal.syntax.slice(0, command.replace(/[ \t\n]+$/g, "").length);
-  const boundary = Math.max(syntax.lastIndexOf(";"), syntax.lastIndexOf("\n"));
-  const tail = parseStaticShellCommands(command.slice(boundary + 1, syntax.length));
-  if (!tail || typeof tail === "string" || tail.pipelines.length < 2) return false;
-  const first = tail.pipelines[0];
-  const argv = unwrapProofCommand(first?.[0] ?? [], "\0");
-  return (
-    first?.length === 1 &&
-    argv?.[0] === "cd" &&
-    isStaticNavigationCommand(argv) &&
-    syntax.slice(boundary + 1).match(/&&|[;&|\n]/)?.[0] === "&&"
-  );
-}
-
-function isPassiveTextCommand(argv: string[]): boolean {
-  const name = argv[0]?.split("/").at(-1) ?? "";
-  const args = argv.slice(1);
-  // These commands consume literal text. Execution options are not exceptions.
-  if (name === "printf") return passivePrintfFormatIndex(argv) !== undefined;
-  // Native cut only selects input data; its file operands still receive shared path checks.
-  if (["echo", "grep", "head", "tail", "cut"].includes(name)) {
-    return true;
-  }
-  if (name === "rg") return !hasExecutionOption(args, ["pre", "hostname-bin"]);
-  if (name === "awk") return !isAwkExecution(argv);
-  if (name === "sed") return isReadonlySedPrint(argv);
-  if (name === "jq") return isPassiveJqCommand(argv);
-  return (
-    (name === "git" && args[0] === "status") ||
-    (name === "git" &&
-      args[0] === "grep" &&
-      !hasExecutionOption(args, ["open-files-in-pager", "textconv"], "O"))
-  );
-}
-
-/** Native data consumers only; ordinary path, expansion and redirect checks still apply. */
-function isReadonlyJqConsumer(argv: string[]): boolean {
-  if (isPassiveTextCommand(argv)) return true;
-  const name = argv[0]?.split("/").at(-1) ?? "";
-  if (name === "sort")
-    return argv
-      .slice(1)
-      .every(
-        (arg) =>
-          !arg.startsWith("-") || arg === "-" || arg === "--" || /^-[bdfgMhnRruVszcC]+$/.test(arg),
-      );
-  if (name === "uniq") return isReadonlyUniqConsumer(argv);
-  if (["cat", "wc"].includes(name)) return isProvedCwdSubprocessRole(argv);
-  return name === "tr";
-}
-
-/** uniq INPUT is a read; uniq INPUT OUTPUT is a write and cannot acquire this proof. */
-function isReadonlyUniqConsumer(argv: string[]): boolean {
-  let operands = 0;
-  let options = true;
-  for (let index = 1; index < argv.length; index++) {
-    const arg = argv[index] ?? "";
-    if (options && arg === "--") {
-      options = false;
-      continue;
-    }
-    if (options) {
-      if (/^-[cduiz]+$|^--(?:count|repeated|unique|ignore-case|zero-terminated)$/.test(arg))
-        continue;
-      const short = /^-[fsw]([0-9]*)$/.exec(arg);
-      const long = /^--(?:skip-fields|skip-chars|check-chars)(?:=(.*))?$/.exec(arg);
-      if (short || long) {
-        const attached = short ? short[1] || undefined : long?.[1];
-        const value = attached === undefined ? argv[++index] : attached;
-        if (!/^[0-9]+$/.test(value ?? "")) return false;
-        continue;
-      }
-      if (arg.startsWith("-") && arg !== "-") return false;
-    }
-    options = false;
-    if (++operands > 1) return false;
-  }
-  return true;
-}
-
-/** One print program with optional numeric or escaped-regex addresses; no callbacks. */
-function isReadonlySedPrint(argv: string[]): boolean {
-  if (argv[0]?.split("/").at(-1) !== "sed") return false;
-  let index = 1;
-  while (/^-[nE]+$/.test(argv[index] ?? "")) index++;
-  if (argv[index] === "--") index++;
-  const address = String.raw`(?:[0-9]+|\$|/(?:\\[^\r\n]|[^/\\\r\n])*/)`;
-  return (
-    new RegExp(`^(?:${address}(?:,${address})?)?p$`).test(argv[index] ?? "") &&
-    argv.slice(index + 1).every((arg) => !arg.startsWith("-"))
-  );
-}
-
-function gitCommitExecutionArguments(argv: string[]): string[] {
-  if (argv[0]?.split("/").at(-1) !== "git" || argv[1] !== "commit") return argv;
-  const executionArguments = [...argv];
-  for (let index = 2; index < argv.length && argv[index] !== "--"; index++) {
-    const argument = argv[index] ?? "";
-    if (argument === "-m" || argument === "--message") {
-      if (index + 1 < argv.length) executionArguments[++index] = "";
-    } else if (argument.startsWith("--message=")) {
-      executionArguments[index] = "--message=";
-    } else if (argument.startsWith("-m") && argument.length > 2) {
-      executionArguments[index] = "-m";
-    }
-  }
-  return executionArguments;
-}
-
-function hasStaticEnvironmentRead(
-  argv: string[],
-  allowedNames: Set<string>,
-  allowInventory = false,
-): boolean {
-  const name = argv[0]?.split("/").at(-1);
-  if (isLiteralHerdrPrompt(argv)) return false;
-  if (
-    ["sh", "bash", "zsh"].includes(name ?? "") &&
-    hasExecutionOption(argv.slice(1), ["command"], "c") &&
-    argv.slice(1).some((arg) => /\$\{?[A-Za-z_]/.test(arg))
-  ) {
-    return true;
-  }
-  if (
-    name === "docker" &&
-    argv.some((arg) => ["sh", "bash", "zsh"].includes(arg)) &&
-    argv.some((arg) => /[$`]/.test(arg))
-  )
-    return true;
-  if (name === "awk" && argv.slice(1).some((arg) => /\bENVIRON\b/.test(arg))) return true;
-  if (name === "printenv") return !isAllowedEnvironmentRead(argv, allowedNames);
-  if (name === "env") {
-    const wrapped = unwrapEnvironmentCommand(argv);
-    return wrapped === null
-      ? isEnvironmentListing(argv)
-      : hasStaticEnvironmentRead(unwrapStaticCommand(wrapped), allowedNames, allowInventory);
-  }
-  if (name === "jq") return !isPassiveJqCommand(argv);
-  if (isUnsupportedInlineRuntime(argv)) return true;
-  const programIndex = inlineProgramIndex(argv);
-  if (programIndex !== undefined)
-    return hasInlineProgramExecution(
-      argv[programIndex] ?? "",
-      inlineRuntimeKind(argv[0]) === "python",
-      allowInventory && inlineRuntimeKind(argv[0]) === "node",
-    );
-  if (isPassiveTextCommand(argv)) return false;
-  // Any command may re-parse an argument as shell code (trap, find -exec, awk system()).
-  return (
-    hasCommandArgumentBraceExpansion(argv) ||
-    ([
-      "sh",
-      "bash",
-      "zsh",
-      "eval",
-      "source",
-      "find",
-      "xargs",
-      "trap",
-      "awk",
-      "git",
-      "sort",
-      "jq",
-      "docker",
-    ].includes(name ?? "") &&
-      mentionsEnvironmentRead(gitCommitExecutionArguments(argv).join(" ")))
-  );
-}
-
-function commandChainSources(command: string): string[] | undefined {
-  const parts: string[] = [];
-  let start = 0;
-  let quote: "'" | '"' | "`" | undefined;
-  let depth = 0;
-  for (let index = 0; index < command.length; index++) {
-    const char = command[index];
-    if (char === "\\" && quote !== "'") {
-      index++;
-    } else if (quote) {
-      if (char === quote) quote = undefined;
-    } else if (char === "'" || char === '"' || char === "`") {
-      quote = char;
-    } else if (char === "#") {
-      return undefined;
-    } else if (char === "(") {
-      depth++;
-    } else if (char === ")") {
-      if (--depth < 0) return undefined;
-    } else if (!depth && (char === ";" || command.startsWith("&&", index))) {
-      const part = command.slice(start, index).trim();
-      if (!part || parts.length >= 31) return undefined;
-      parts.push(part);
-      if (char === "&") index++;
-      start = index + 1;
-    }
-  }
-  const last = command.slice(start).trim();
-  return !quote && !depth && last && parts.length ? [...parts, last] : undefined;
-}
-
-type LiteralChainPart = { source: string; argv: string[]; redirects: boolean };
-
-function literalCommandChain(command: string): LiteralChainPart[] | undefined {
-  const literal = literalBindingText(command, "", "");
-  if (!literal || /[|&\r\n]/.test(literal.syntax.replaceAll("&&", ""))) return undefined;
-  const boundaries = [...literal.syntax.matchAll(/&&|;/g)];
-  if (!boundaries.length || boundaries.length > 31) return undefined;
-  const parts: LiteralChainPart[] = [];
-  let start = 0;
-  for (const end of [...boundaries.map((match) => match.index), command.length]) {
-    const source = command.slice(start, end).trim();
-    const parsed = parseStaticShellCommands(source);
-    if (
-      !parsed ||
-      typeof parsed === "string" ||
-      parsed.pipelines.length !== 1 ||
-      parsed.pipelines[0]?.length !== 1
-    )
-      return undefined;
-    const argv = unwrapProofCommand(parsed.pipelines[0][0] ?? [], "\0");
-    if (!argv) return undefined;
-    parts.push({ source, argv, redirects: parsed.redirects.length > 0 });
-    start = end + (literal.syntax.startsWith("&&", end) ? 2 : 1);
-  }
-  return parts;
-}
-
-function isIndependentHerdrOperation(argv: string[]): boolean {
-  if (isLiteralHerdrPrompt(argv)) return argv.length === 5;
-  if (argv[0] !== "herdr") return false;
-  if (argv[1] === "agent" && argv[2] === "start") {
-    const separator = argv.indexOf("--", 3);
-    const options = argv.slice(3, separator < 0 ? undefined : separator);
-    const kinds = options.filter((arg) => arg === "--kind" || arg.startsWith("--kind="));
-    return (
-      kinds.length === 1 &&
-      kinds[0] === "--kind" &&
-      options[options.indexOf("--kind") + 1] === "codex"
-    );
-  }
-  if (argv[1] !== "pane") return false;
-  if (argv[2] === "run")
-    return argv.length === 5 && argv[4] === "exec bash ~/.codex/codex-clean.sh bash --norc -i";
-  if (argv[2] !== "wait-output" || argv.length < 6) return false;
-  const seen = new Set<string>();
-  for (let index = 4; index < argv.length; index += 2) {
-    const option = argv[index] ?? "";
-    if (seen.has(option)) return false;
-    seen.add(option);
-    if (!["--match", "--regex", "--timeout"].includes(option) || !argv[index + 1]) return false;
-    if (argv[index] === "--timeout" && !/^\d+$/.test(argv[index + 1] ?? "")) return false;
-  }
-  return true;
-}
-
-function isIndependentDataCopy(argv: string[], destinations: string[]): boolean {
-  if (!destinations.length || argv[0] !== "cp" || argv.length !== 3) return false;
-  const source = argv[1] ?? "";
-  const target = argv[2] ?? "";
-  const literalPath = (path: string) =>
-    /^\/[A-Za-z0-9_./ -]+$/.test(path) &&
-    !path.split("/").some((part) => part === "." || part === "..");
-  if (!/^(?:~\/)?[A-Za-z0-9_./-]+$/.test(source) || source.startsWith("-") || !literalPath(target))
-    return false;
-  try {
-    const targetPath = target.replace(/\/+$/, "");
-    const targetStat = lstatSync(targetPath, { throwIfNoEntry: false });
-    if (target.endsWith("/") && !targetStat?.isDirectory()) return false;
-    const destination = targetStat?.isDirectory()
-      ? posix.join(targetPath, posix.basename(source))
-      : targetPath;
-    for (const directory of destinations) {
-      if (!literalPath(directory)) continue;
-      const root = directory.replace(/\/+$/, "");
-      if (!destination.startsWith(root + "/")) continue;
-      if (!lstatSync(root).isDirectory() || realpathSync(root) !== root) return false;
-      const parts = destination.slice(root.length + 1).split("/");
-      let current = root;
-      for (const [index, part] of parts.entries()) {
-        current += "/" + part;
-        const stat = lstatSync(current, { throwIfNoEntry: false });
-        const last = index === parts.length - 1;
-        if (!stat) return last;
-        if (stat.isSymbolicLink() || (!last && !stat.isDirectory())) return false;
-        if (realpathSync(current) !== current) return false;
-      }
-      return true;
-    }
-  } catch {
-    return false;
-  }
-  return false;
-}
-
-function isLiteralHerdrPrompt(argv: string[]): boolean {
-  return argv[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt" && argv.length >= 5;
-}
-
-function isStaticHerdrPrompt(command: string): boolean {
-  // Preserve shell word boundaries and executable identity before proving composition.
-  const literal = literalBindingText(command, "", "");
-  if (!literal) return false;
-  const parsed = parseStaticShellCommands(command);
-  if (!parsed || typeof parsed === "string") return false;
-  const commands = parsed.pipelines.flat().map((words) => unwrapProofCommand(words, "\0"));
-  const prompts = commands.filter((argv) => argv && isLiteralHerdrPrompt(argv));
-  if (!hasProvedNavigationSequence(command) || hasEnvironmentMutationPrefix(command)) return false;
-  return (
-    prompts.length > 0 &&
-    parsed.pipelines.every((pipeline) => {
-      return pipeline.every((words, index) => {
-        const argv = unwrapProofCommand(words, "\0");
-        if (!argv) return false;
-        if (isLiteralHerdrPrompt(argv)) return index === 0;
-        if (argv[0] === "herdr" && argv[1] === "pane" && argv[2] === "close")
-          return (
-            index === 0 &&
-            pipeline.length === 1 &&
-            argv.length === 4 &&
-            /^[A-Za-z0-9_.:-]+$/.test(argv[3] ?? "")
-          );
-        // cat is a reader at the start of an independent pipeline, never a consumer.
-        if (argv[0] === "cat")
-          return (
-            index === 0 &&
-            argv.length > 1 &&
-            argv.slice(1).every((arg) => arg === "--" || !arg.startsWith("-"))
-          );
-        if (isPassiveTextCommand(argv)) return true;
-        if (isLiteralHerdrRead(argv)) return index === 0;
-        if (argv[0] === "sleep")
-          return (
-            index === 0 &&
-            pipeline.length === 1 &&
-            argv.length === 2 &&
-            /^\d+(?:\.\d+)?$/.test(argv[1] ?? "")
-          );
-        if (isStaticNavigationCommand(argv))
-          return index === 0 && (argv[0] !== "cd" || pipeline.length === 1);
-        // Literal child scripts keep the existing execution boundary; their source is not attested.
-        if (
-          argv[0] === "bun" &&
-          inlineProgramIndex(argv) === undefined &&
-          !isUnsupportedInlineRuntime(argv)
-        )
-          return index === 0 && /^(?:~\/)?[A-Za-z0-9_./-]+\.(?:[cm]?[jt]s)$/.test(argv[1] ?? "");
-        return false;
-      });
-    })
-  );
-}
-
-function isHerdrPrompt(command: string): boolean {
-  if (/^herdr\s+agent\s+prompt\b/.test(command.trim())) return true;
-  const parsed = parseStaticShellCommands(command, true);
-  if (!parsed || typeof parsed === "string") return false;
-  return parsed.pipelines.flat().some((words) => {
-    const argv = unwrapStaticCommand(words);
-    return argv[0] === "herdr" && argv[1] === "agent" && argv[2] === "prompt";
-  });
-}
-
-function hasEnvironmentRead(
-  command: string,
-  allowedNames: Set<string>,
-  allowInventory = hasProvedPackageInventoryInvocation(command),
-  replayedShellBodies: string[] = [],
-): boolean {
-  if (isHerdrPrompt(command) && !isStaticHerdrPrompt(command)) return true;
-  if (isLiteralTextWrite(command)) return false;
-  // ponytail: complex shell syntax stays conservative; use a shell AST if more exceptions are needed.
-  const parsed = parseStaticShellCommands(command);
-  if (parsed === "brace-expansion") return true;
-  if (
-    parsed &&
-    typeof parsed !== "string" &&
-    hasEnvironmentMutationPrefix(command) &&
-    parsed.pipelines
-      .flat()
-      .some((words) => apiRequestDataIndexes(unwrapStaticCommand(words)) !== undefined)
-  )
-    return true;
-  if (!parsed) {
-    const operands = parseStaticShellCommands(command, true);
-    if (
-      operands &&
-      typeof operands !== "string" &&
-      operands.pipelines.flat().some((words) => {
-        const argv = unwrapStaticCommand(words);
-        return (
-          argv[0]?.split("/").at(-1) === "bun" &&
-          argv[1] === "run" &&
-          argv[2] === "db-tool" &&
-          ["sql", "query"].includes(argv[3] ?? "") &&
-          argv.some(
-            (arg, index) =>
-              (arg === "--sql" && /\$\(|`/.test(argv[index + 1] ?? "")) ||
-              (arg.startsWith("--sql=") && /\$\(|`/.test(arg)),
-          )
-        );
-      })
-    )
-      return true;
-    const unquoted = command.replace(/'(?:\\.|[^'])*'/g, " ").replace(/"(?:\\.|[^"$`])*"/g, " ");
-    const hasExecutor =
-      /\|\s*(?:sh|bash|zsh|xargs)|\b(?:sh|bash|zsh)\b|\$\(|`|\b(?:eval|source)\b|\bfind\b.*\b-exec\b/i.test(
-        command,
-      );
-    return (
-      mentionsEnvironmentRead(unquoted) ||
-      (mentionsEnvironmentRead(command) && hasExecutor) ||
-      hasShellBraceExpansion(withoutQuotedQuantifiers(command))
-    );
-  }
-  const pipelines = parsed.pipelines.map((commands) => commands.map(unwrapStaticCommand));
-  const unwrapped = pipelines.flat();
-  if (
-    pipelines.some((pipeline) =>
-      pipeline.some(
-        (argv, index) =>
-          (literalSqlArgumentIndex(argv) !== undefined &&
-            pipeline.slice(index + 1).some((consumer) => !isPassiveTextCommand(consumer))) ||
-          (isPassiveJqCommand(argv) &&
-            pipeline.slice(index + 1).some((consumer) => !isReadonlyJqConsumer(consumer))),
-      ),
-    )
-  )
-    return true;
-  if (
-    parsed.redirects.length > 0 &&
-    unwrapped.some((argv) => isAllowedEnvironmentRead(argv, allowedNames))
-  ) {
-    return true;
-  }
-  if (
-    parsed.redirects.length > 0 &&
-    unwrapped.some(
-      (producer, index) =>
-        producer[0]?.split("/").at(-1) === "git" &&
-        producer[1] === "commit" &&
-        mentionsEnvironmentRead(producer.join(" ")) &&
-        unwrapped.slice(index + 1).some((consumer) => !isPassiveTextCommand(consumer)),
-    )
-  ) {
-    return true;
-  }
-  if (
-    parsed.redirects.length > 0 &&
-    pipelines.some((pipeline) =>
-      pipeline.some(
-        (argv) => isLiteralTextProducer(argv) && mentionsEnvironmentRead(argv.join(" ")),
-      ),
-    ) &&
-    unwrapped.some((argv) => ["sh", "bash", "zsh", "xargs", "eval"].includes(argv[0] ?? ""))
-  ) {
-    return true;
-  }
-  if (
-    unwrapped.some(
-      (argv) =>
-        !(SHELL_IDENTITIES.has(argv[0] ?? "") && replayedShellBodies.includes(argv.at(-1) ?? "")) &&
-        hasStaticEnvironmentRead(argv, allowedNames, allowInventory),
-    )
-  ) {
-    return true;
-  }
-
-  // A literal producer can feed executable text to a shell, xargs, or an unknown consumer.
-  const result = pipelines.some((pipeline) =>
-    pipeline.some(
-      (argv, index) =>
-        (isAllowedEnvironmentRead(argv, allowedNames) ||
-          (isLiteralTextProducer(argv) &&
-            (mentionsEnvironmentRead(argv.join(" ")) || hasCommandArgumentBraceExpansion(argv)))) &&
-        pipeline
-          .slice(index + 1)
-          .some(
-            (consumer) =>
-              !isPassiveTextCommand(consumer) && !isAllowedEnvironmentRead(consumer, allowedNames),
-          ),
-    ),
-  );
-  return result;
-}
-
-/** Find an actual heredoc operator outside shell quotes/comments, then parse one bounded body. */
-function boundedHeredoc(command: string) {
-  let quote: "'" | '"' | undefined;
-  let wordStarted = false;
-  for (let i = 0; i < command.length; i++) {
-    const char = command[i];
-    if (quote === "'") {
-      if (char === quote) quote = undefined;
-    } else if (char === "\\") {
-      i++;
-      wordStarted = true;
-    } else if (quote === '"') {
-      if (char === quote) quote = undefined;
-    } else if (char === "'" || char === '"') {
-      quote = char;
-      wordStarted = true;
-    } else if (char === "#" && !wordStarted) {
-      while (i + 1 < command.length && command[i + 1] !== "\n") i++;
-    } else if (command.startsWith("<<", i)) {
-      const match =
-        /^<<(-?)[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\2[ \t]*(?:#[^\r\n]*)?(?:\r?\n|$)/.exec(
-          command.slice(i),
-        );
-      const lines = match
-        ? command
-            .slice(i + match[0].length)
-            .trimEnd()
-            .split(/\r?\n/)
-        : [];
-      const end = lines.findIndex(
-        (line) => (match?.[1] ? line.replace(/^\t+/, "") : line) === match?.[3],
-      );
-      return {
-        header: command.slice(0, i),
-        quoted: Boolean(match?.[2]),
-        closed: Boolean(match) && end >= 0,
-        body: lines.slice(0, end >= 0 ? end : undefined).join("\n"),
-        following: end >= 0 ? lines.slice(end + 1).join("\n") : "",
-      };
-    } else {
-      wordStarted = !/[\s;&|()<>]/.test(char ?? "");
-    }
-  }
-  return undefined;
-}
-
-/** A single literal writer cannot execute its body or feed another command. */
-function isLiteralTextWrite(command: string): boolean {
-  const heredoc = boundedHeredoc(command);
-  let header = command;
-  let writers = ["echo", "printf"];
-  if (heredoc) {
-    // Only a complete body with no following commands is a literal-write exception.
-    if (!heredoc.closed || heredoc.following) return false;
-    if (!heredoc.quoted && /[$`\\]/.test(heredoc.body)) return false;
-    header = heredoc.header;
-    writers = ["cat", "tee"];
-  } else if (!command.includes(">")) {
-    return false;
-  }
-
-  // Output redirection does not execute text. Other unsupported syntax still fails parsing.
-  const parsed = parseStaticShellCommands(header.replace(/2>&1/g, " ").replace(/>>?/g, " "));
-  if (!parsed || parsed === "brace-expansion") return false;
-  const commands = parsed.pipelines.flat().map(unwrapStaticCommand);
-  const writerIndexes = commands
-    .map((argv, index) => (writers.includes(argv[0]?.split("/").at(-1) ?? "") ? index : -1))
-    .filter((index) => index >= 0);
-  return (
-    writerIndexes.length === 1 &&
-    commands.every((argv, index) => {
-      if (index === writerIndexes[0]) return true;
-      const name = argv[0]?.split("/").at(-1) ?? "";
-      return name === "cd" || (name === "pwd" && argv.length === 1) || isSafeLiteralConsumer(argv);
-    })
-  );
-}
-
-function hasSensitiveFileRead(command: string, isPathBlocked: (path: string) => boolean): boolean {
-  const sensitivePath =
-    /(?:^|[/\s'"])(?:[.]env(?![.](?:example|template|sample)\b)|\S*[.](?:pem|key)\b|\S*[.](?:ssh|aws)[/]|(?:\S*secret(?:-|[/\s.]|$))|(?:(?:secrets?|credentials?)(?:[/\s.]|$)|[A-Za-z0-9_.-]*(?:secrets?|credentials?)(?:[/\s.]|$)|[A-Za-z0-9_.-]*-(?:secrets?|credentials?)(?:[/\s.-]|$)))/i;
-  const sensitiveCamelCase =
-    /(?:^|[/\s'"])[A-Za-z0-9_.-]*(?:(?:secret|credential)[A-Z]|(?:Secret|Credential)[A-Z])[^/\s'"]*/;
-  const sensitiveName = /secret|credential/i;
-  const isSensitivePath = (text: string) =>
-    sensitivePath.test(text) ||
-    sensitiveCamelCase.test(text) ||
-    (sensitiveName.test(text) &&
-      !/(?:^|\/)credential-guard(?:(?:-[^/]+)?\.(?:ts|md|js)|\*|\/(?:index\.(?:ts|js)))?$/.test(
-        text,
-      ));
-  const heredoc = boundedHeredoc(command);
-  if (
-    heredoc &&
-    (isLiteralTextWrite(command) ||
-      (isLiteralTextWrite(command.slice(0, command.length - heredoc.following.length).trimEnd()) &&
-        !mentionsInlineRuntime(heredoc.following) &&
-        !/\b(?:sh|bash|zsh|eval|source|xargs)\b/.test(heredoc.following)))
-  ) {
-    return hasSensitiveFileRead(heredoc.header + "\n" + heredoc.following, isPathBlocked);
-  }
-  if (/\bcat\b[^;&|]*<<-?\s*\S+[\s\S]*\b(?:secret|credential)\b/i.test(command)) return true;
-  const parsed = parseStaticShellCommands(command);
-  const readers =
-    /\b(?:cat|tee|cp|grep|rg|sed|awk|jq|head|tail|less|more|source|ls|sort|uniq|cut|wc|mv|find|shasum|sha1sum|sha256sum|sha512sum|md5sum|cksum)\b/i;
-  if (parsed && parsed !== "brace-expansion") {
-    let directory = "";
-    const trackDirectory = hasProvedNavigationSequence(command);
-    const safeDirectorySequence = parsed.pipelines.flat().every(isProvedDirectoryCommand);
-    return parsed.pipelines.flat().some((words) => {
-      const argv = unwrapStaticCommand(words);
-      const inspectedArgv =
-        argv[0]?.split("/").at(-1) === "env" ? unwrapEnvironmentCommand(argv) : argv;
-      if (inspectedArgv === null) return false;
-      let inspected = unwrapStaticCommand(inspectedArgv);
-      let name = inspected[0]?.split("/").at(-1) ?? "";
-      let commandDirectory = directory;
-      const inDirectory = (path: string) =>
-        path.startsWith("/") ? posix.normalize(path) : posix.join(commandDirectory, path);
-      const blockedOperand = (path: string) =>
-        [path, inDirectory(path)].some((value) => isPathBlocked(value) || isSensitivePath(value));
-      // Directory slots use path policies, not the broad credential-file name heuristic.
-      const blockedDirectory = (path: string) =>
-        [path, inDirectory(path)].some(
-          (value) => isPathBlocked(value) || isPathBlocked(value + "/"),
-        );
-      const program = inlineProgramIndex(inspected);
-      // Runtime file options are operands; known text/prompt/program data is not an option.
-      if (
-        !isPassiveTextCommand(inspected) &&
-        !(name === "herdr" && inspected[1] === "agent" && inspected[2] === "prompt") &&
-        inspected.some(
-          (arg, index) =>
-            index !== program &&
-            ((arg === "--env-file" && blockedOperand(inspected[index + 1] ?? "")) ||
-              (arg.startsWith("--env-file=") && blockedOperand(arg.slice("--env-file=".length)))),
-        )
-      )
-        return true;
-      if (name === "cd") {
-        const path = inspected[inspected[1] === "--" ? 2 : 1];
-        if (path === undefined) return false;
-        if (blockedDirectory(path)) return true;
-        // A successful cd alone proves neither its later readers nor pipeline consumers safe.
-        if (
-          (!trackDirectory || !safeDirectorySequence) &&
-          (blockedOperand(path) || blockedOperand(path + "/"))
-        )
-          return true;
-        if (trackDirectory && isStaticNavigationCommand(inspected)) directory = inDirectory(path);
-        return false;
-      }
-      if (name === "git") {
-        let index = 1;
-        while (inspected[index] === "-C" && inspected[index + 1]) {
-          const path = inspected[index + 1] ?? "";
-          if (blockedDirectory(path)) return true;
-          // Git -C affects this command only; following consumers keep the shell directory.
-          if (
-            !isProvedDirectoryCommand(words) &&
-            (blockedOperand(path) || blockedOperand(path + "/"))
-          )
-            return true;
-          commandDirectory = inDirectory(path);
-          index += 2;
-        }
-        // Git grep has the same pattern-versus-file roles as grep below.
-        if (inspected[index] === "grep") {
-          inspected = ["grep", ...inspected.slice(index + 1)];
-          name = "grep";
-        } else if (inspected[index] === "diff") {
-          const files = gitDiffFileArguments(inspected.slice(index + 1));
-          return files === undefined || files.some(blockedOperand);
-        }
-      }
-      if (name === "bun" && inspected[1] === "run" && inspected[2] === "gh-tool") {
-        return inspected.some((arg, index) => {
-          const path =
-            arg === "--body-file"
-              ? inspected[index + 1]
-              : arg.startsWith("--body-file=")
-                ? arg.slice("--body-file=".length)
-                : undefined;
-          return path !== undefined && (isPathBlocked(path) || isSensitivePath(path));
-        });
-      }
-      const programIndex = inlineProgramIndex(inspected);
-      const compileFiles = pythonCompileFiles(inspected);
-      if (isPythonCompileModule(inspected)) {
-        return (compileFiles ?? inspected.slice(1)).some(
-          (file) =>
-            blockedOperand(file) ||
-            blockedDirectory(posix.join(posix.dirname(file), "__pycache__")),
-        );
-      }
-      if (programIndex !== undefined) {
-        const parts = programParts(
-          inspected[programIndex] ?? "",
-          inlineRuntimeKind(inspected[0]) === "python",
-        );
-        if (!parts) return true;
-        const inventory = staticPackageInventory(inspected[programIndex] ?? "");
-        if (inventory?.some((path) => isPathBlocked(path) || isSensitivePath(path))) return true;
-        if (parts.code.split(/[\s'"`()<>;&|]+/).some(isPathBlocked)) return true;
-        const accessesFiles =
-          /\b(?:open|Path|read_text|read_bytes|readFile|readFileSync|file|write_text|writeFile|writeFileSync)\b/.test(
-            parts.code,
-          ) || /\bBun\s*\.\s*write\s*\(/.test(parts.code);
-        if (
-          accessesFiles &&
-          /\b(?:sys|process)\s*\.\s*argv\b/.test(parts.code) &&
-          inspected
-            .slice(programIndex + 1)
-            .some((arg) => isPathBlocked(arg) || isSensitivePath(arg))
-        )
-          return true;
-        // Interpolation expressions remain in code; inspect their nested literal operands too.
-        const expressionParts = /['"]/.test(parts.code)
-          ? programParts(parts.code, inlineRuntimeKind(inspected[0]) === "python")
-          : { pathLiterals: [] };
-        if (!expressionParts) return true;
-        return [...parts.pathLiterals, ...expressionParts.pathLiterals].some(
-          (value) =>
-            (accessesFiles && isPathBlocked(value)) ||
-            (!/\s/.test(value) && /[/.]/.test(value) && isSensitivePath(value)),
-        );
-      }
-      if (!readers.test(name)) return false;
-      if (name === "rg" || name === "grep") {
-        const args = inspected.slice(1);
-        const paths: string[] = [];
-        let hasPattern = false;
-        let options = true;
-        const enumeratesFiles = name === "rg" && args.includes("--files");
-        let filesOnly = enumeratesFiles;
-        for (let i = 0; i < args.length; i++) {
-          const arg = args[i] ?? "";
-          if (options && arg === "--") {
-            options = false;
-            continue;
-          }
-          if (
-            options &&
-            (arg === "--pre" ||
-              arg.startsWith("--pre=") ||
-              arg === "--hostname-bin" ||
-              arg.startsWith("--hostname-bin="))
-          )
-            return true;
-          if (options && (arg.startsWith("--file=") || /^-f.+/.test(arg))) {
-            paths.push(arg.startsWith("--file=") ? arg.slice(7) : arg.slice(2));
-            hasPattern = true;
-            continue;
-          }
-          if (options && (arg.startsWith("--regexp=") || /^-e.+/.test(arg))) {
-            hasPattern = true;
-            continue;
-          }
-          if (
-            options &&
-            (arg.startsWith("--glob=") ||
-              arg.startsWith("--iglob=") ||
-              arg.startsWith("--include=") ||
-              /^-g.+/.test(arg))
-          ) {
-            const glob = arg.startsWith("--iglob=")
-              ? arg.slice(8)
-              : arg.startsWith("--include=")
-                ? arg.slice(10)
-                : arg.startsWith("--glob=")
-                  ? arg.slice(7)
-                  : arg.slice(2);
-            if (
-              !enumeratesFiles &&
-              (isSensitivePath(glob) || isPathBlocked(glob.replaceAll("*", "")))
-            )
-              paths.push(glob);
-            continue;
-          }
-          if (
-            options &&
-            ["-e", "--regexp", "-f", "--file", "-g", "--glob", "--iglob", "--include"].includes(arg)
-          ) {
-            const value = args[++i];
-            if (arg === "-f" || arg === "--file") paths.push(value ?? "");
-            if (
-              (arg === "-g" || arg === "--glob" || arg === "--iglob" || arg === "--include") &&
-              !enumeratesFiles &&
-              value &&
-              (isSensitivePath(value) || isPathBlocked(value.replaceAll("*", "")))
-            )
-              paths.push(value);
-            if (arg === "-e" || arg === "--regexp" || arg === "-f" || arg === "--file")
-              hasPattern = true;
-            continue;
-          }
-          if (options && (arg === "--files" || (arg === "-l" && name === "grep"))) {
-            filesOnly = arg === "--files";
-            if (filesOnly) continue;
-          }
-          if (options && arg.startsWith("-")) {
-            if (/^-[A-Za-z]+[fg]$/.test(arg)) {
-              const value = args[++i];
-              if (value && isSensitivePath(value)) paths.push(value);
-              if (arg.endsWith("f")) hasPattern = true;
-              continue;
-            }
-            const combinedPatternFile = arg.match(/^-[A-Za-z]*f(.+)$/)?.[1];
-            if (combinedPatternFile) {
-              if (isSensitivePath(combinedPatternFile)) paths.push(combinedPatternFile);
-              hasPattern = true;
-            }
-            const optionValue = arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : null;
-            if (optionValue && isSensitivePath(optionValue)) paths.push(optionValue);
-            continue;
-          }
-          if (!hasPattern && !filesOnly) {
-            hasPattern = true;
-            continue;
-          }
-          paths.push(arg);
-        }
-        return paths.some(blockedOperand);
-      }
-      const paths = name === "jq" ? jqFileArguments(inspected) : inspected.slice(1);
-      return paths.some(blockedOperand);
-    });
-  }
-  // Unsupported shell syntax retains conservative option evidence.
-  if (/(?:^|[\s;&|])--env-file(?:=|\s)[^;&|]*\.env\b/i.test(command)) return true;
-  const operands = parseStaticShellCommands(command, true);
-  if (
-    operands &&
-    typeof operands !== "string" &&
-    operands.pipelines.flat().some((words) => {
-      const argv = unwrapStaticCommand(words);
-      return readers.test(argv[0] ?? "") && argv.slice(1).some(isPathBlocked);
-    })
-  )
-    return true;
-  if (readers.test(command) && command.split(/[\s'"`()<>;&|]+/).some(isPathBlocked)) return true;
-  const unquoted = command.replace(/'(?:\\.|[^'])*'/g, " ").replace(/"(?:\\.|[^"$`])*"/g, " ");
-  if ((mentionsInlineRuntime(command) || /\bruby\b/i.test(command)) && isSensitivePath(command)) {
-    return true;
-  }
-  return (
-    new RegExp(readers.source + "[^;&|]*" + sensitivePath.source, "i").test(unquoted) ||
-    new RegExp(readers.source + "[^;&|]*" + sensitiveCamelCase.source).test(unquoted) ||
-    new RegExp(readers.source + "[^;&|]*" + sensitiveName.source, "i").test(unquoted)
-  );
-}
-
-function hasEnvironmentVariableExpansionRead(
-  command: string,
-  allowedNames: Set<string>,
-  isPathBlocked: (path: string) => boolean,
-  onProvedStatus?: (command: string) => void,
-  onProvedPredicate?: () => void,
-): boolean {
-  const originalCommand = command;
-  let heredoc = boundedHeredoc(command);
-  while (heredoc) {
-    // In an unquoted heredoc, # and quote characters are data, not shell syntax.
-    if (!heredoc.closed || (!heredoc.quoted && /[$`\\]/.test(heredoc.body))) return true;
-    command = [heredoc.header, heredoc.following].join("\n");
-    heredoc = boundedHeredoc(command);
-  }
-  if (!command.includes("$") && !command.includes("`")) return false;
-  let predicateSyntaxIntact = command === originalCommand;
-  let invalidExpansion = false;
-  const assignments = getLeadingLiteralAssignments(command);
-  let localIndex = 0;
-  const directCaptures = new Map<string, string>();
-  const statusReferences = new Map<string, { name: string; fallback: string }>();
-  const marker = (prefix: string): string => {
-    let value: string;
-    do value = `${prefix}${localIndex++}END`;
-    while (command.includes(value));
-    return value;
-  };
-  let expansions = 0;
-  let normalized = "";
-  let quote: "'" | '"' | undefined;
-  let wordStarted = false;
-  for (let i = 0; i < command.length; i++) {
-    const char = command[i] ?? "";
-    if (!quote && char === "#" && !wordStarted) {
-      predicateSyntaxIntact = false;
-      while (i + 1 < command.length && command[i + 1] !== "\n") i++;
-      continue;
-    }
-    if (!quote && /[\s;&|()<>]/.test(char)) wordStarted = false;
-    else wordStarted = true;
-    if (char === "\\" && quote !== "'") {
-      normalized += char + (command[++i] ?? "");
-      continue;
-    }
-    if (quote === "'") {
-      normalized += char;
-      if (char === "'") quote = undefined;
-      continue;
-    }
-    if (char === "'" && quote !== '"') {
-      normalized += char;
-      quote = "'";
-      continue;
-    }
-    if (char === '"') {
-      normalized += char;
-      quote = quote === '"' ? undefined : '"';
-      continue;
-    }
-    if (char === "`") return true;
-    if (char !== "$") {
-      normalized += char;
-      continue;
-    }
-    if (command[i + 1] === "?") {
-      expansions++;
-      const value = marker("NUMERICSTATUSVALUE");
-      // Only an exact standalone assignment token captures in the parent shell.
-      // Quoting/escaping the name can instead produce an executable command word.
-      const capture = /(?:^|[;\n])[ \t]*([A-Za-z_][A-Za-z0-9_]*)=("?)$/.exec(command.slice(0, i));
-      const ending = capture?.[2] === '"' ? '"' : "";
-      if (
-        capture &&
-        command.slice(i + 2).startsWith(ending) &&
-        /^[ \t]*(?:[;\n]|$)/.test(command.slice(i + 2 + ending.length))
-      )
-        directCaptures.set(value, capture[1] ?? "");
-      normalized += value;
-      i++;
-      continue;
-    }
-    const variable = /^\$\{([A-Za-z_][A-Za-z0-9_]*)(:-)?\}|^\$([A-Za-z_][A-Za-z0-9_]*)/.exec(
-      command.slice(i),
-    );
-    if (!variable) {
-      if (command[i + 1] === "{" || /[$][0-9@*#?!]/.test(command.slice(i, i + 2))) {
-        invalidExpansion = true;
-      }
-      normalized += char;
-      continue;
-    }
-    expansions++;
-    const name = variable[1] ?? variable[3] ?? "";
-    if (variable[2]) {
-      if (quote !== '"' || !allowedNames.has(name)) invalidExpansion = true;
-      normalized += "ENVVALUE";
-      i += variable[0].length - 1;
-      continue;
-    }
-    const assignment = assignments.get(name);
-    if (assignment && assignment.end >= i) invalidExpansion = true;
-    const reference = marker("STATUSREFERENCE");
-    const fallback =
-      assignment && assignment.end < i
-        ? assignment.value
-        : allowedNames.has(name)
-          ? quote
-            ? "ENVVALUE"
-            : "ENVVALUEUNQUOTED"
-          : quote
-            ? "UNKNOWNVALUE"
-            : "UNKNOWNVALUEUNQUOTED";
-    statusReferences.set(reference, { name, fallback });
-    normalized += reference;
-    i += variable[0].length - 1;
-  }
-  if (!expansions) return invalidExpansion;
-  if (invalidExpansion) return true;
-
-  // Resolve every reference at its command position; a later capture cannot prove
-  // an earlier read, and only proved passive intermediates preserve the binding.
-  const initial = parseStaticShellCommands(normalized);
-  if (!initial || typeof initial === "string") return true;
-  const captures = new Map<string, string>();
-  for (const words of initial.pipelines.flat()) {
-    const capture = /^([A-Za-z_][A-Za-z0-9_]*)=(.+)$/.exec(words[0] ?? "");
-    if (capture && directCaptures.get(capture[2] ?? "") === capture[1])
-      captures.set(words[0] ?? "", capture[1] ?? "");
-  }
-  const statusCaptures = new Set<string>();
-  const localStatuses = new Set<string>();
-  const resolutions = new Map<string, string>();
-  const capturedNames = new Set(captures.values());
-  const bound = new Set<string>();
-  if (captures.size) {
-    const syntax = literalBindingText(normalized, "", "")?.syntax;
-    if (syntax === undefined || /&&|\|\||&/.test(syntax.replace(/[<>]&[0-9-]+/g, ""))) return true;
-  }
-  for (const [index, pipeline] of initial.pipelines.entries()) {
-    for (const words of pipeline) {
-      for (const arg of words) {
-        for (const [reference, { name, fallback }] of statusReferences) {
-          if (!arg.includes(reference)) continue;
-          if (bound.has(name)) {
-            const value = marker("NUMERICSTATUSVALUE");
-            localStatuses.add(value);
-            resolutions.set(reference, value);
-          } else {
-            if (capturedNames.has(name)) return true;
-            resolutions.set(reference, fallback);
-          }
-        }
-      }
-      const capture = captures.get(words[0] ?? "");
-      if (capture) {
-        if (
-          pipeline.length !== 1 ||
-          words.length !== 1 ||
-          initial.redirects.some((redirect) => redirect.pipeline === index) ||
-          // Inherited export attributes can make a numeric value select code or paths.
-          /^(?:LD_|DYLD_|_RLD_|LDR_|GIT_CONFIG_(?:KEY|VALUE)_)/.test(capture) ||
-          /^(?:PATH|IFS|CDPATH|BASH_ENV|ENV|FPATH|ZDOTDIR|SHELLOPTS|BASHOPTS|PROMPT_COMMAND|PS[0-4]|GLOBIGNORE|RANDOM|SECONDS|PIPESTATUS|UID|EUID|BASH_XTRACEFD|HOME|XDG_CONFIG_HOME|LIBPATH|SHLIB_PATH|NODE_OPTIONS|NODE_PATH|BUN_OPTIONS|BUN_PRELOAD|PYTHONPATH|PYTHONSTARTUP|PYTHONHOME|RUBYOPT|RUBYLIB|GEM_HOME|GEM_PATH|PERL5OPT|PERL5LIB|PERLLIB|JAVA_TOOL_OPTIONS|JDK_JAVA_OPTIONS|CLASSPATH|_JAVA_OPTIONS|JAVA_HOME|GIT_SSH_COMMAND|GIT_SSH|GIT_PROXY_COMMAND|GIT_EXEC_PATH|GIT_CONFIG|GIT_CONFIG_GLOBAL|GIT_CONFIG_SYSTEM|GIT_CONFIG_PARAMETERS|GIT_CONFIG_COUNT|GIT_ASKPASS|SSH_ASKPASS|GIT_EDITOR|GIT_SEQUENCE_EDITOR|GIT_PAGER|PAGER|EDITOR|VISUAL)$/.test(
-            capture,
-          )
-        )
-          return true;
-        bound.add(capture);
-        statusCaptures.add(words[0] ?? "");
-        continue;
-      }
-      const argv = unwrapStaticCommand(words);
-      const name = argv[0]?.split("/").at(-1) ?? "";
-      if (
-        captures.size &&
-        /^(?:alias|unalias|readonly|declare|typeset|local|export|eval|source|\.|trap|set|read|unset|let)$/.test(
-          name,
-        )
-      )
-        return true;
-      if (!isPassiveTextCommand(argv) && name !== "cat") bound.clear();
-    }
-    for (const redirect of initial.redirects.filter((value) => value.pipeline === index)) {
-      if (
-        [...statusReferences].some(
-          ([reference, { name }]) => capturedNames.has(name) && redirect.target.includes(reference),
-        )
-      )
-        return true;
-    }
-  }
-  for (const [reference, { fallback }] of statusReferences) {
-    normalized = normalized.replaceAll(reference, () => resolutions.get(reference) ?? fallback);
-  }
-  const localMaterialized = normalized;
-  // Options must be checked after local literals become actual argv, never as placeholders.
-  if (!hasSafeLocalAssignmentCommands(localMaterialized, assignments, statusCaptures)) return true;
-  const parsed = parseStaticShellCommands(localMaterialized);
-  if (!parsed || typeof parsed === "string") return true;
-  for (const [index, pipeline] of parsed.pipelines.entries()) {
-    if (!pipeline.some((words) => words.some((arg) => arg.includes("NUMERICSTATUSVALUE"))))
-      continue;
-    if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
-    if (
-      pipeline.some((words) => {
-        if (words.length === 1 && statusCaptures.has(words[0] ?? "")) return false;
-        const argv = unwrapStaticCommand(words);
-        if (!words.some((arg) => arg.includes("NUMERICSTATUSVALUE")))
-          return !isPassiveTextCommand(argv);
-        const name = argv[0]?.split("/").at(-1);
-        const format = name === "printf" ? passivePrintfFormatIndex(argv) : undefined;
-        return (
-          !["echo", "printf"].includes(name ?? "") ||
-          !isPassiveTextCommand(argv) ||
-          argv.some(
-            (arg) => arg.startsWith("-") && [...localStatuses].some((value) => arg.includes(value)),
-          ) ||
-          words
-            .slice(0, words.length - argv.length)
-            .some((arg) => arg.includes("NUMERICSTATUSVALUE")) ||
-          argv[0]?.includes("NUMERICSTATUSVALUE") === true ||
-          (name === "printf" &&
-            (format === undefined ||
-              argv.slice(0, format + 1).some((arg) => arg.includes("NUMERICSTATUSVALUE"))))
-        );
-      })
-    )
-      return true;
-  }
-  for (const words of parsed.pipelines.flat()) {
-    if (!words.some((arg) => arg.includes("UNKNOWNVALUE"))) continue;
-    if (words.some((arg) => arg.includes("UNKNOWNVALUEUNQUOTED"))) return true;
-    const argv = unwrapStaticCommand(words);
-    if (
-      words.slice(0, words.length - argv.length).some((arg) => arg.includes("UNKNOWNVALUE")) ||
-      !isNavigationOperand(argv, "UNKNOWNVALUE")
-    )
-      return true;
-  }
-  if (!localMaterialized.includes("ENVVALUE")) {
-    const blocked =
-      hasSensitiveFileRead(localMaterialized, isPathBlocked) ||
-      hasSensitivePathRedirect(localMaterialized, isPathBlocked) ||
-      hasEnvironmentRead(localMaterialized, allowedNames);
-    if (!blocked && statusCaptures.size) onProvedStatus?.(localMaterialized);
-    return blocked;
-  }
-
-  for (const [index, pipeline] of parsed.pipelines.entries()) {
-    const hasEnvironmentValue = pipeline.some((argv) =>
-      argv.some((arg) => arg.includes("ENVVALUE")),
-    );
-    if (!hasEnvironmentValue) continue;
-    if (parsed.redirects.some((redirect) => redirect.pipeline === index)) return true;
-    if (
-      pipeline.some((argv) => {
-        const unwrapped = unwrapStaticCommand(argv);
-        const name = unwrapped[0]?.split("/").at(-1) ?? "";
-        if (argv.some((arg) => arg.includes("ENVVALUE"))) {
-          if (argv.slice(0, argv.length - unwrapped.length).some((arg) => arg.includes("ENVVALUE")))
-            return true;
-          if (isApprovedEnvironmentPredicate(unwrapped)) return false;
-          if (isNavigationOperand(unwrapped, "ENVVALUE")) {
-            return unwrapped.some((arg) => arg.includes("ENVVALUEUNQUOTED"));
-          }
-          const formatIndex = name === "printf" ? passivePrintfFormatIndex(unwrapped) : undefined;
-          return (
-            !["echo", "printf"].includes(name) ||
-            !isPassiveTextCommand(unwrapped) ||
-            unwrapped[0]?.includes("ENVVALUE") === true ||
-            (name === "printf" &&
-              (formatIndex === undefined ||
-                unwrapped.slice(0, formatIndex + 1).some((arg) => arg.includes("ENVVALUE"))))
-          );
-        }
-        return !isPassiveTextCommand(unwrapped);
-      })
-    ) {
-      return true;
-    }
-  }
-  const materialized = normalized.replaceAll("ENVVALUE", "SAFEENVVALUE");
-  const blocked = hasSensitiveFileRead(materialized, isPathBlocked);
-  if (!blocked && statusCaptures.size) onProvedStatus?.(materialized);
-  // This is a complete command proof, not merely a recursively safe shell body.
-  if (
-    !blocked &&
-    parsed.pipelines.length === 1 &&
-    parsed.pipelines[0]?.length === 1 &&
-    !parsed.redirects.length
-  ) {
-    const argv = unwrapProofCommand(parsed.pipelines[0]?.[0] ?? [], "ENVVALUE");
-    if (argv && isApprovedEnvironmentPredicate(argv) && predicateSyntaxIntact) {
-      // Roles alone cannot prove original shell boundaries or discarded controls.
-      // Brackets are enabled only for the completely proved bracket builtin.
-      const binding = literalBindingText(normalized, "", "", argv[0] === "[");
-      if (binding && !/[;&|<>\r\n]/.test(binding.syntax.trim())) onProvedPredicate?.();
-    }
-  }
-  return blocked;
-}
-
-/** Quoted approved metadata can be compared or checked for blankness, never evaluated. */
-function isApprovedEnvironmentPredicate(argv: string[]): boolean {
-  let args = argv.slice(1);
-  if (argv[0] === "[") {
-    if (args.at(-1) !== "]") return false;
-    args = args.slice(0, -1);
-  } else if (argv[0] !== "test") return false;
-  const value = (arg: string | undefined) => arg === "ENVVALUE";
-  const literal = (arg: string | undefined) =>
-    /^[A-Za-z0-9_.:-]*$/.test(arg ?? "") && arg !== undefined;
-  return (
-    (args.length === 2 && ["-n", "-z"].includes(args[0] ?? "") && value(args[1])) ||
-    (args.length === 3 &&
-      args[1] === "=" &&
-      ((value(args[0]) && literal(args[2])) || (literal(args[0]) && value(args[2]))))
-  );
-}
-
-function mentionsEnvironmentSource(command: string): boolean {
-  return /\b(?:os\s*\.\s*(?:environ|getenv)|process\s*\.\s*env|Environment\s*\.\s*GetEnvironmentVariable)\b/.test(
-    command,
-  );
-}
-
-/** Closed raw-source grammar: literal display/write only, without projection or evaluation. */
-function isLiteralInlineWriter(argv: string[]): boolean {
-  const index = inlineProgramIndex(argv);
-  if (index === undefined || argv.length !== index + 1) return false;
-  const kind = inlineRuntimeKind(argv[0]);
-  const python = kind === "python";
-  const program = (argv[index] ?? "").trim();
-  let position = 0;
-  const take = (pattern: RegExp): boolean => {
-    const match = pattern.exec(program.slice(position));
-    if (!match) return false;
-    position += match[0].length;
-    return true;
-  };
-  const literal = (): string | undefined => {
-    take(/^\s*/);
-    const start = position;
-    const quote = program[position];
-    if (quote !== "'" && quote !== '"') return undefined;
-    const delimiter =
-      python && program.startsWith(quote.repeat(3), position) ? quote.repeat(3) : quote;
-    position += delimiter.length;
-    while (position < program.length) {
-      if (program.startsWith(delimiter, position)) {
-        position += delimiter.length;
-        return program.slice(start, position);
-      }
-      if (program[position] === "\\") position += 2;
-      else if (delimiter.length === 1 && /[\r\n\u2028\u2029]/.test(program[position] ?? ""))
-        return undefined;
-      else position++;
-    }
-    return undefined;
-  };
-  let prefix: RegExp;
-  let middle: RegExp | undefined;
-  let mode = false;
-  if (python && /^print\s*\(/.test(program)) prefix = /^print\s*\(\s*/;
-  else if (!python && /^console\s*\.\s*log\s*\(/.test(program))
-    prefix = /^console\s*\.\s*log\s*\(\s*/;
-  else if (python && /^open\s*\(/.test(program)) {
-    prefix = /^open\s*\(\s*/;
-    mode = true;
-    middle = /^\s*\)\s*\.\s*write\s*\(\s*/;
-  } else if (kind === "bun" && /^Bun\s*\.\s*write\s*\(/.test(program)) {
-    prefix = /^Bun\s*\.\s*write\s*\(\s*/;
-    middle = /^\s*,\s*/;
-  } else if (python) {
-    prefix = /^from[ \t]+pathlib[ \t]+import[ \t]+Path[ \t]*(?:;|\r?\n)\s*Path\s*\(\s*/;
-    middle = /^\s*\)\s*\.\s*write_text\s*\(\s*/;
-  } else return false;
-  if (!take(prefix) || literal() === undefined) return false;
-  if (mode) {
-    if (!take(/^\s*,\s*/)) return false;
-    const value = literal();
-    if (value !== "'w'" && value !== '"w"') return false;
-  }
-  if (middle && (!take(middle) || literal() === undefined)) return false;
-  return take(/^\s*\)\s*;?\s*$/) && position === program.length;
-}
-
-/** Literal inline output can accompany a proved environment display; file writers cannot. */
-function isLiteralInlineDisplay(argv: string[]): boolean {
-  const index = inlineProgramIndex(argv);
-  if (index === undefined || !isLiteralInlineWriter(argv)) return false;
-  const kind = inlineRuntimeKind(argv[0]);
-  const program = argv[index] ?? "";
-  return (
-    (kind === "python" && /^\s*print\s*\(/.test(program)) ||
-    (kind === "node" && /^\s*console\s*\.\s*log\s*\(/.test(program))
-  );
-}
-
-/** Parse approved Python readers from the original shell shape, including quoted stdin heredocs. */
-function hasApprovedPythonEnvironmentRead(command: string, allowedNames: Set<string>): boolean {
-  const normalized = normalizeProgramHeredocs(command);
-  const parsed = parseStaticShellCommands(normalized);
-  if (!parsed || typeof parsed === "string") return false;
-  return parsed.pipelines
-    .flat()
-    .some((words) => isAllowedPythonEnvironmentRead(unwrapStaticCommand(words), allowedNames));
-}
-
-/** Inert command identity is unproved after an explicit environment mutation. */
-function hasEnvironmentMutationPrefix(command: string): boolean {
-  const heredoc = boundedHeredoc(command);
-  if (heredoc) {
-    if (!heredoc.closed) return true;
-    return hasEnvironmentMutationPrefix(heredoc.header + "\n" + heredoc.following);
-  }
-  const parsed = parseStaticShellCommands(command);
-  if (!parsed || typeof parsed === "string") return true;
-  return parsed.pipelines.flat().some((words) => {
-    let index = 0;
-    while (index < words.length) {
-      const word = words[index] ?? "";
-      if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(word)) return true;
-      const name = word.split("/").at(-1);
-      if (name === "env") {
-        index++;
-        if (words[index] === "--") index++;
-        if (words[index]?.startsWith("-")) return true;
-      } else if (name === "rtk" || name === "command") {
-        index++;
-        if ((name === "rtk" && words[index] === "proxy") || words[index] === "--") index++;
-      } else return false;
-    }
-    return false;
-  });
-}
-
-function hasEnvironmentSourceAccess(
-  command: string,
-  rawTrigger: boolean,
-  allowedNames: Set<string>,
-): boolean {
-  if (rawTrigger && hasEnvironmentMutationPrefix(command)) return true;
-  const parsed = parseStaticShellCommands(command);
-  if (parsed && typeof parsed !== "string") {
-    const commands = parsed.pipelines.flat().map(unwrapStaticCommand);
-    if (commands.some((argv) => isAllowedPythonEnvironmentRead(argv, allowedNames))) {
-      if (hasEnvironmentMutationPrefix(command)) return true;
-      return !commands.every(
-        (argv) =>
-          argv[0]?.split("/").at(-1) === "cat" ||
-          isPassiveTextCommand(argv) ||
-          isAllowedPythonEnvironmentRead(argv, allowedNames) ||
-          isLiteralInlineDisplay(argv),
-      );
-    }
-  }
-  if (isLiteralTextWrite(command)) return false;
-  if (!parsed || typeof parsed === "string") return rawTrigger;
-  const commands = parsed.pipelines.flat().map(unwrapStaticCommand);
-  const promptContext = isStaticHerdrPrompt(command);
-  if (rawTrigger) {
-    // Original invocation-wide evidence survives split writers and inline quote projection.
-    return !commands.every(
-      (argv) =>
-        argv[0]?.split("/").at(-1) === "cat" ||
-        isPassiveTextCommand(argv) ||
-        isLiteralInlineWriter(argv) ||
-        (promptContext && isLiteralHerdrPrompt(argv)),
-    );
-  }
-  return commands.some((argv) => {
-    if (isAllowedPythonEnvironmentRead(argv, allowedNames)) return false;
-    const index = inlineProgramIndex(argv);
-    if (index === undefined) return false;
-    const python = inlineRuntimeKind(argv[0]) === "python";
-    const parts = programParts(argv[index] ?? "", python);
-    if (!parts) return true;
-    return (
-      mentionsEnvironmentSource(parts.code) ||
-      (python && /\b(?:environ|getenv)\b/.test(parts.code)) ||
-      (/\b(?:os|process)\s*\[/.test(parts.code) &&
-        parts.literals.some((value) => /^(?:env|environ|getenv)$/.test(value)))
-    );
-  });
-}
-
-/** Explicit lookup/loader names cannot establish interpreter startup context. Literal text is data. */
-function hasInterpreterStartupMutation(command: string): boolean {
-  const parsed = parseStaticShellCommands(command) ?? parseStaticShellCommands(command, true);
-  if (!parsed || typeof parsed === "string") return false;
-  const commands = parsed.pipelines.flat();
-  if (
-    !commands.some((words) => {
-      const name = unwrapStaticCommand(words)[0];
-      return inlineRuntimeKind(name) !== undefined || isShellWord(name ?? "");
-    })
-  )
-    return false;
-  const startupName =
-    /^(?:PATH|HOME|XDG_CONFIG_HOME|BUN_OPTIONS|BUN_PRELOAD|NODE_OPTIONS|NODE_PATH|PYTHON[A-Z_]*|BASH_ENV|ENV|ZDOTDIR|FPATH|SHELLOPTS|BASHOPTS|LD_[A-Z_]+|DYLD_[A-Z_]+)$/;
-  return commands.some((words) => {
-    const argv = unwrapStaticCommand(words);
-    const prefix = words.slice(0, words.length - argv.length);
-    if (prefix.some((word) => startupName.test(word.split("=", 1)[0] ?? ""))) return true;
-    const mutator = argv[0] === "builtin" ? argv.slice(1) : argv;
-    return (
-      ["export", "declare", "typeset", "local", "readonly"].includes(mutator[0] ?? "") &&
-      mutator.slice(1).some((word) => startupName.test(word.split("=", 1)[0] ?? ""))
-    );
-  });
-}
-
-/** Extract file path from hook arguments. */
-export function extractFilePath(args: Record<string, unknown>): string {
-  return (args.filePath as string) || (args.file_path as string) || (args.path as string) || "";
-}
-
-/** Extract content from hook arguments. */
-export function extractContent(args: Record<string, unknown>): string {
-  return (args.content as string) || (args.newString as string) || "";
-}
-
-/** Extract command from hook arguments. */
-export function extractCommand(args: Record<string, unknown>): string {
-  return (args.command as string) || "";
-}
-
-// ============================================================================
-// FACTORY
-// ============================================================================
-
-/**
- * Create a credential guard with optional extra patterns merged into defaults.
- *
- * @param config - Optional overrides. Arrays are concatenated with defaults (not replaced).
- * @returns Object with all guard functions bound to the merged pattern sets.
- */
-export function createCredentialGuard(config?: CredentialGuardConfig): CredentialGuard {
-  const names = config?.allowedEnvironmentVariables;
-  if (
-    names !== undefined &&
-    (!Array.isArray(names) || names.some((name) => typeof name !== "string"))
-  ) {
-    throw new Error("allowedEnvironmentVariables must be an array of strings");
-  }
-  const allowedEnvironmentVariables = new Set(names ?? []);
-  for (const name of allowedEnvironmentVariables) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
-      throw new Error(`Invalid allowed environment variable name: ${JSON.stringify(name)}`);
-    }
-  }
-  const blockedPathPatterns = [
-    ...DEFAULT_BLOCKED_PATH_PATTERNS,
-    ...(config?.additionalBlockedPaths ?? []).map((p) => new RegExp(p)),
-  ];
-
-  const allowedPathPatterns = [
-    ...DEFAULT_ALLOWED_PATH_PATTERNS,
-    ...(config?.additionalAllowedPaths ?? []).map((p) => new RegExp(p)),
-  ];
-
-  const dangerousBashPatterns = [
-    ...(config?.additionalDangerousBashPatterns?.map((p) => new RegExp(p)) ?? []),
-  ];
-
-  const blockedCliTools: BlockedCliTool[] = [
-    ...DEFAULT_BLOCKED_CLI_TOOLS,
-    ...(config?.additionalBlockedCliTools ?? []).map(
-      (override: CliToolOverride): BlockedCliTool => ({
-        pattern: new RegExp(`(?:^|[;&|]\\s*)${escapeRegex(override.tool)}\\s`),
-        name: override.tool,
-        wrapper: override.suggestion,
-      }),
-    ),
-  ];
-
-  function isPathAllowed(filePath: string): boolean {
-    const normalizedPath = filePath.replace(/\\/g, "/");
-    return (
-      !PROCESS_ENVIRONMENT_PATH.test(posix.normalize(normalizedPath)) &&
-      allowedPathPatterns.some((pattern) => pattern.test(normalizedPath))
-    );
-  }
-
-  function isPathBlocked(filePath: string): boolean {
-    const normalizedPath = filePath.replace(/\\/g, "/");
-
-    if (PROCESS_ENVIRONMENT_PATH.test(posix.normalize(normalizedPath))) return true;
-
-    for (const pattern of allowedPathPatterns) {
-      if (pattern.test(normalizedPath)) {
-        return false;
-      }
-    }
-
-    for (const pattern of blockedPathPatterns) {
-      if (pattern.test(normalizedPath)) {
-        return true;
-      }
-    }
-
-    return false;
-  }
-
-  function detectSecrets(content: string): { name: string; match: string } | null {
-    for (const { name, pattern } of SECRET_PATTERNS) {
-      const match = content.match(pattern);
-      if (match) {
-        const redacted = match[0].substring(0, 8) + "..." + match[0].substring(match[0].length - 4);
-        return { name, match: redacted };
-      }
-    }
-    return null;
-  }
-
-  function isDangerousBashCommand(command: string): boolean {
-    return getDangerousBashReason(command) !== null;
-  }
-
-  function getDangerousBashReason(command: string, shellDepth = 0): string | null {
-    const originalCommand = command;
-    if (hasUnboundedHeredoc(command)) return "cannot prove a bounded complete heredoc invocation";
-    let unterminatedQuote = false;
-    parseStaticShellCommands(command, false, () => {
-      unterminatedQuote = true;
-    });
-    if (unterminatedQuote)
-      return "cannot prove shell syntax: an unterminated quoted argument was found";
-    const chain = literalCommandChain(command);
-    if (chain?.some(({ argv }) => isLiteralHerdrPrompt(argv)) && !isStaticHerdrPrompt(command)) {
-      let copied = false;
-      for (const [index, part] of chain.entries()) {
-        const reason = getDangerousBashReason(part.source, shellDepth);
-        if (reason) return `cannot prove chain part ${index + 1} (${part.source}): ${reason}`;
-        if (
-          !part.redirects &&
-          isIndependentDataCopy(part.argv, config?.chainCopyDestinations ?? []) &&
-          !copied
-        ) {
-          copied = true;
-          continue;
-        }
-        if (
-          part.redirects ||
-          !isIndependentHerdrOperation(part.argv) ||
-          (copied && !(isLiteralHerdrPrompt(part.argv) && part.argv.length === 5))
-        )
-          return `cannot prove independent chain part ${index + 1} (${part.source}) under the environment/execution policy`;
-      }
-      if (dangerousBashPatterns.some((pattern) => pattern.test(originalCommand)))
-        return "matches a configured dangerous-command pattern";
-      return null;
-    }
-    const allowPackageInventory = hasProvedPackageInventoryInvocation(originalCommand);
-    const promptWords = isStaticHerdrPrompt(command)
-      ? parseStaticShellCommands(command)
-      : undefined;
-    const sourceText =
-      promptWords && typeof promptWords !== "string"
-        ? promptWords.pipelines
-            .flat()
-            .map((words) => {
-              const argv = unwrapStaticCommand(words);
-              return (isLiteralHerdrPrompt(argv) ? argv.slice(0, 4) : words).join(" ");
-            })
-            .join("; ")
-        : command;
-    const rawEnvironmentSource =
-      mentionsEnvironmentSource(sourceText) && mentionsInlineRuntime(sourceText);
-    if (
-      hasApprovedPythonEnvironmentRead(originalCommand, allowedEnvironmentVariables) &&
-      hasEnvironmentMutationPrefix(normalizeProgramHeredocs(originalCommand))
-    ) {
-      return "blocked by the environment/execution policy after an unproved environment mutation";
-    }
-    if (rawEnvironmentSource && hasEnvironmentMutationPrefix(originalCommand))
-      return "blocked by the environment/execution policy after an unproved environment mutation";
-    command = normalizeProgramHeredocs(command);
-    const shellBodies = literalShellBodies(command);
-    if (!shellBodies || (shellBodies.length && shellDepth >= 8))
-      return "cannot prove a bounded literal shell invocation";
-    const provedPredicateShellBodies: string[] = [];
-    for (const body of shellBodies) {
-      const reason = getDangerousBashReason(body, shellDepth + 1);
-      if (reason || getBlockedCliTool(body, true, shellDepth + 1))
-        return reason ?? "invokes a blocked CLI from a shell body";
-      if (
-        !isProvedLiteralShellBody(body, allowedEnvironmentVariables, isPathBlocked, () => {
-          provedPredicateShellBodies.push(body);
-        })
-      )
-        return "cannot prove a closed literal shell body";
-    }
-    if (provedPredicateShellBodies.length) {
-      const context = parseStaticShellCommands(command);
-      const binding = literalBindingText(command, "", "");
-      const argv =
-        context && typeof context !== "string"
-          ? unwrapProofCommand(context.pipelines[0]?.[0] ?? [], "\0")
-          : undefined;
-      if (
-        !context ||
-        typeof context === "string" ||
-        context.pipelines.length !== 1 ||
-        context.pipelines[0]?.length !== 1 ||
-        context.redirects.length !== 0 ||
-        !binding ||
-        /[;&|<>\r\n]/.test(binding.syntax.trim()) ||
-        !argv ||
-        !SHELL_IDENTITIES.has(argv[0] ?? "")
-      )
-        return "cannot prove a single literal shell predicate invocation";
-    }
-    const proof = materializeLiteralShell(command);
-    if (!proof && /^\s*for\b/.test(command)) return "cannot prove a bounded literal shell loop";
-    if (proof) {
-      if (proof.paths.some((path) => hasSensitiveFileRead("cat " + path, isPathBlocked)))
-        return "accesses a sensitive file path";
-      command = proof.command;
-      if (getBlockedCliTool(command, true, shellDepth))
-        return "invokes a blocked CLI from a literal expansion";
-    }
-    for (const nested of [
-      ...inlineSubprocessCommands(command),
-      ...inlinePackageCommands(command, allowPackageInventory),
-    ]) {
-      const reason = getDangerousBashReason(nested, shellDepth);
-      if (reason || getBlockedCliTool(nested, true, shellDepth))
-        return reason ?? "invokes a blocked CLI from a script";
-    }
-    if (hasUnsupportedGitDiffArguments(command))
-      return "cannot prove supported Git diff option and file argument roles";
-    if (
-      hasSensitiveFileRead(command, isPathBlocked) ||
-      hasSensitivePathRedirect(command, isPathBlocked)
-    )
-      return "blocked by the file-access policy; a sensitive path matched or this command form could not be verified";
-    if (hasInterpreterStartupMutation(command))
-      return "cannot prove interpreter startup after an explicit lookup or loader mutation";
-    const staticCommands = parseStaticShellCommands(command);
-    const diagnosticCommands = staticCommands ?? parseStaticShellCommands(command, true);
-    const staticArgv =
-      diagnosticCommands && typeof diagnosticCommands !== "string"
-        ? diagnosticCommands.pipelines.flat().map(unwrapStaticCommand)
-        : [];
-    const hasJqInvocation = staticArgv.some(
-      (argv) =>
-        unwrapStaticCommand(argv[0] === "builtin" ? argv.slice(1) : argv)[0]
-          ?.split("/")
-          .at(-1) === "jq",
-    );
-    if (staticArgv.some(isPythonCompileModule) && !hasProvedPythonCompileInvocation(command))
-      return "cannot prove isolated Python py_compile startup and literal source/cache paths";
-    if (staticArgv.some(isPythonCompileModule) && config?.additionalBlockedPaths?.length)
-      return "cannot prove implicit py_compile cache writes against configured path rules";
-    if (
-      staticArgv.some(
-        (argv) =>
-          argv[0]?.split("/").at(-1) === "jq" &&
-          (!staticCommands ||
-            staticCommands === "brace-expansion" ||
-            staticCommands.pathnameExpansion ||
-            !isPassiveJqCommand(argv)),
-      )
-    )
-      return "cannot prove a supported passive jq filter and literal options";
-    if (
-      staticCommands &&
-      typeof staticCommands !== "string" &&
-      hasJqInvocation &&
-      (!hasProvedNavigationSequence(command) ||
-        staticCommands.pipelines.flat().some((words) => !hasProvedJqContext(words)))
-    )
-      return "cannot prove a supported passive jq startup prefix";
-    let environmentCommand = command;
-    if (
-      !isLiteralTextWrite(command) &&
-      hasEnvironmentVariableExpansionRead(
-        command,
-        allowedEnvironmentVariables,
-        isPathBlocked,
-        (proved) => {
-          environmentCommand = proved;
-        },
-      )
-    ) {
-      if (getLeadingLiteralAssignments(command).size || /\b[A-Za-z_]\w*=(?:\$\(|~)/.test(command))
-        return "cannot prove a local binding expansion in a supported data operand";
-      return "expands an unapproved or executable environment variable value";
-    }
-    if (
-      hasEnvironmentSourceAccess(command, rawEnvironmentSource, allowedEnvironmentVariables) ||
-      hasEnvironmentRead(
-        environmentCommand,
-        allowedEnvironmentVariables,
-        allowPackageInventory,
-        shellBodies.filter((body) => {
-          if (provedPredicateShellBodies.includes(body)) return true;
-          const parsed = parseStaticShellCommands(body);
-          return (
-            parsed &&
-            typeof parsed !== "string" &&
-            parsed.pipelines
-              .flat()
-              .every((words) => isPassiveTextCommand(unwrapStaticCommand(words)))
-          );
-        }),
-      )
-    ) {
-      if (staticArgv.some(isUnsupportedInlineRuntime))
-        return "cannot prove supported inline runtime or module startup; external script contents were not inspected";
-      return "blocked by the environment/execution policy; permitted access or non-execution could not be established for this command form";
-    }
-    if (
-      dangerousBashPatterns.some(
-        (pattern) => pattern.test(originalCommand) || pattern.test(command),
-      )
-    ) {
-      return "matches a configured dangerous-command pattern";
-    }
-    return null;
-  }
-
-  function isGhCommandAllowed(command: string): boolean {
-    const parsed = parseStaticShellCommands(command);
-    if (!parsed || typeof parsed === "string") return false;
-    const ghCommands = parsed.pipelines
-      .flat()
-      .map(unwrapStaticCommand)
-      .filter((argv) => argv[0]?.split("/").at(-1) === "gh");
-    return ghCommands.length > 0 && ghCommands.every(isAllowedGhArgv);
-  }
-
-  function allGhCommandsAllowed(command: string): boolean {
-    return isGhCommandAllowed(command);
-  }
-
-  function detectSleepPolling(command: string): string | null {
-    command = normalizeProgramHeredocs(command);
-    if (!/\bsleep\s+\d+/.test(command)) return null;
-
-    for (const { pattern, suggestion } of DEFAULT_POLLING_DETECTION_RULES) {
-      if (pattern.test(command)) {
-        return suggestion;
-      }
-    }
-    return null;
-  }
-
-  function getBlockedCliTool(
-    command: string,
-    expand = true,
-    shellDepth = 0,
-  ): { name: string; wrapper: string } | null {
-    command = normalizeProgramHeredocs(command);
-    const shellBodies = literalShellBodies(command);
-    if (shellBodies && shellDepth < 8) {
-      for (const body of shellBodies) {
-        const blocked = getBlockedCliTool(body, true, shellDepth + 1);
-        if (blocked) return blocked;
-      }
-    }
-    const proof = expand ? materializeLiteralShell(command) : undefined;
-    if (proof) {
-      const originalBlocked = getBlockedCliTool(command, false, shellDepth);
-      if (originalBlocked) return originalBlocked;
-      command = proof.command;
-    }
-    for (const nested of inlineSubprocessCommands(command)) {
-      const blocked = getBlockedCliTool(nested, true, shellDepth);
-      if (blocked) return blocked;
-    }
-    const staticCommands = parseStaticShellCommands(command);
-    const parsed = staticCommands ?? parseStaticShellCommands(command, true);
-    if (parsed && typeof parsed !== "string") {
-      const commands = parsed.pipelines.flat().map(unwrapStaticCommand);
-      for (const argv of commands) {
-        const executable = argv[0]?.split("/").at(-1) ?? "";
-        const match = blockedCliTools.find(({ name }) =>
-          name === "curl (Azure DevOps)"
-            ? executable === "curl" && argv.slice(1).join(" ").includes("dev.azure.com")
-            : name === "az" || name === "az (Azure DevOps)"
-              ? executable === "az" &&
-                (name !== "az (Azure DevOps)" ||
-                  /^(?:devops|pipelines|repos|boards|artifacts)$/.test(argv[1] ?? ""))
-              : executable === name,
-        );
-        if (!match) continue;
-        if (match.name === "gh" && allGhCommandsAllowed(command)) continue;
-        return { name: match.name, wrapper: match.wrapper };
-      }
-      if (staticCommands) return null;
-    }
-    for (const { pattern, name, wrapper } of blockedCliTools) {
-      if (pattern.test(command)) {
-        if (name === "gh" && allGhCommandsAllowed(command)) {
-          return null;
-        }
-        return { name, wrapper };
-      }
-    }
-    return null;
-  }
-
-  function handleToolExecuteBefore(input: HookInput, output: HookOutput): void {
-    try {
-      enforceToolExecuteBefore(input, output);
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      const sanitized = redactSensitiveText(message);
-      if (error instanceof Error) {
-        if (sanitized !== message) {
-          error.message = sanitized;
-          if (error.stack) error.stack = error.stack.replace(message, () => sanitized);
-        }
-        throw error;
-      }
-      // Do not preserve an unsanitized non-Error value as the new error's cause.
-      // eslint-disable-next-line eslint/preserve-caught-error
-      throw new Error(sanitized);
-    }
-  }
-
-  function blockedCliRecovery(blockedTool: { name: string; wrapper: string }): string {
-    // Custom suggestions can be prose or commands. Preserve them without inventing a binary.
-    const hasKnownHelp = DEFAULT_BLOCKED_CLI_TOOLS.some(
-      ({ wrapper }) => wrapper === blockedTool.wrapper,
-    );
-    return (
-      `Configured recovery: ${blockedTool.wrapper}\n` +
-      (hasKnownHelp ? `Discover supported operations: ${blockedTool.wrapper} --help\n` : "") +
-      `Check the project README and the tool's documented help for the bounded operation.`
-    );
-  }
-
-  function dangerousCommandRecovery(command: string, reason: string): string {
-    if (reason.includes("Git diff"))
-      return (
-        `Use supported literal Git diff options with complete argument values and nonsensitive file operands. ` +
-        `Output/order-file arguments and revision-shaped positional operands receive file policy too. ` +
-        `Unknown, ambiguous, missing or executable option roles remain unproved; use a simple git diff HEAD -- path/to/source form. ` +
-        `The guard does not inspect repository state, native configuration or source contents.`
-      );
-    if (reason.includes("shell syntax"))
-      return (
-        `Check shell quote balance and encode the complete literal argument safely. ` +
-        `An apostrophe inside single quotes needs shell encoding such as 'don'"'"'t'. ` +
-        `Use a documented file-input option only if that command supports one; no such option is inferred here. ` +
-        `Path, environment and execution policies still apply to the corrected command.`
-      );
-    if (reason.startsWith("invokes a blocked CLI")) {
-      const blockedTool = getBlockedCliTool(command);
-      if (blockedTool) return blockedCliRecovery(blockedTool);
-    }
-    const externalExecutionRecovery =
-      `The guard sees the command, not external script contents. Removing shell flags does not certify a script. ` +
-      `No generic approved external-script executor is provided by this guard. Review or implement a repository-owned bounded operation ` +
-      `with secret injection and filtered output; discover existing operations in the project README and tool help.`;
-    if (reason.includes("py_compile") && config?.additionalBlockedPaths?.length)
-      return (
-        `Configured path rules cannot be proved for py_compile's runtime-specific cache and temporary filenames. ` +
-        `Use a cache-free syntax parse with literal nonsensitive paths: ` +
-        `python3 -I -S -B -c 'import ast; ast.parse(open("path/to/source.py", "rb").read(), filename="path/to/source.py")'. ` +
-        `Source paths and all other command policies still apply; target source is parsed without execution. ` +
-        `The guard has not inspected source contents or resolved symlinks.`
-      );
-    if (reason.includes("py_compile"))
-      return (
-        `Use python3 -I -S -m py_compile path/to/source.py with literal nonsensitive .py paths and passive consumers. ` +
-        `Both -I and -S must precede -m; unknown flags, other modules and stdin file lists are unsupported. ` +
-        `This compiles syntax without executing target source, but writes __pycache__ even with -B and may quote source in errors. ` +
-        `The guard has not inspected source contents or resolved symlinks.`
-      );
-    if (reason.includes("jq"))
-      return (
-        `Use a literal inline jq filter within the supported passive grammar and known formatting/input flags. ` +
-        `Field traversal, // fallback, nested objects/arrays, map/select and length are supported. ` +
-        `Environment reads, imports, program files, unknown calls and incomplete syntax cannot establish this proof. ` +
-        `Use literal nonsensitive input paths and passive output consumers; field omission does not certify input contents. ` +
-        `Native jq normally loads a home .jq file; trusted host configuration is assumed, not inspected. ` +
-        `The exact child-process prefix env HOME=/dev/null jq avoids that user startup lookup; -L does not.`
-      );
-    if (reason.includes("local binding"))
-      return (
-        `Use separate commands with literal nonsensitive file paths, or a supported bounded literal file binding/loop. ` +
-        `Command substitution and a binding used as an executable or script operand cannot establish this proof. ` +
-        `The guard has not inspected external script contents; this refusal does not establish ambient environment access.`
-      );
-    if (reason.includes("runtime or module"))
-      return (
-        `Use a supported literal inline program with known runtime flags, or a repository-owned bounded operation. ` +
-        `Unknown startup options and executable module forms remain unsupported. ` +
-        `The guard has not inspected external script contents.`
-      );
-    if (reason.startsWith("cannot prove") && reason.includes("shell")) {
-      return (
-        `Interactive and login shells load startup files, which can execute code or load credentials. ` +
-        `Only supported noninteractive literal forms, such as sh -c or zsh -f -c, with a completely proved closed body can pass. ` +
-        externalExecutionRecovery
-      );
-    }
-    if (reason.includes("file")) {
-      return (
-        `Use a nonsensitive example/template or a bounded wrapper operation that returns only the needed fields. ` +
-        `A matched sensitive path or an unverifiable file-access form remains blocked; do not copy or dump credential files.`
-      );
-    }
-    if (reason.includes("environment")) {
-      return (
-        `Do not dump or forward the environment. For a known nonsensitive value, use an exact approved name ` +
-        `with printenv NAME; approval is configured in credentialGuard.allowedEnvironmentVariables. ` +
-        `This does not approve execution or secret values. ` +
-        externalExecutionRecovery
-      );
-    }
-    return (
-      `The guard cannot verify this command form as permitted. Check the project README and tool help ` +
-      `for an existing bounded operation, or review the guard proof and add a regression test before changing policy. ` +
-      externalExecutionRecovery
-    );
-  }
-
-  function enforceToolExecuteBefore(input: HookInput, output: HookOutput): void {
-    // Normalize tool name across platforms:
-    // - AI coding agents pass capitalized: "Bash", "Read", "Write", "Edit"
-    // - OpenCode MCP tools pass prefixed: "mcp_bash", "mcp_read", "mcp_write", "mcp_edit"
-    const tool = input.tool.toLowerCase().replace(/^mcp_/, "");
-    const args = output.args;
-
-    const filePath = extractFilePath(args);
-
-    if ((tool === "read" || tool === "write" || tool === "edit") && filePath) {
-      if (isPathBlocked(filePath)) {
-        throw new Error(
-          `\u{1F6AB} Access blocked: "${filePath}" is a sensitive file.\n\n` +
-            `This file may contain credentials or secrets.\n` +
-            `If you need this file's content, ask the user to provide relevant parts.\n\n` +
-            `Think this should be allowed? Review the project repository, extend the guard, and submit a PR.`,
-        );
-      }
-    }
-
-    if (tool === "write" || tool === "edit") {
-      if (!isPathAllowed(filePath)) {
-        const content = extractContent(args);
-
-        if (content) {
-          const detected = detectSecrets(content);
-          if (detected) {
-            throw new Error(
-              `\u{1F6AB} Secret detected: Potential ${detected.name} found in content.\n\n` +
-                `Matched: [REDACTED]\n\n` +
-                `Never commit secrets to code. Use environment variables or secret managers.\n\n` +
-                `Think this is a false positive? Review the project repository, fix the pattern, and submit a PR.`,
-            );
-          }
-        }
-      }
-    }
-
-    if (tool === "bash") {
-      const command = extractCommand(args);
-
-      let dangerousReason = getDangerousBashReason(command);
-      if (dangerousReason && !dangerousReason.includes("chain part")) {
-        let unproved: string | undefined;
-        for (const [index, source] of (commandChainSources(command) ?? []).entries()) {
-          const reason = getDangerousBashReason(source);
-          const parsed = parseStaticShellCommands(source);
-          const literal = literalBindingText(source, "", "");
-          const words = parsed && typeof parsed !== "string" ? parsed.pipelines[0]?.[0] : undefined;
-          const argv = words ? unwrapProofCommand(words, "\0") : undefined;
-          if (reason) {
-            dangerousReason += `; cannot prove chain part ${index + 1} (${source}): ${reason}`;
-            break;
-          }
-          if (!unproved && (!literal || /[<>]/.test(literal.syntax) || !argv))
-            unproved = `cannot prove chain part ${index + 1} (${source}): independent composition is unproved`;
-        }
-        if (!dangerousReason.includes("chain part") && unproved) dangerousReason += `; ${unproved}`;
-      }
-      if (dangerousReason) {
-        throw new Error(
-          `\u{1F6AB} Command blocked: ${dangerousReason}.\n\n` +
-            `Command: ${command}\n\n` +
-            `${dangerousCommandRecovery(command, dangerousReason)}\n\n` +
-            `Tool inventory and usage: https://github.com/blogic-cz/agent-tools#tools`,
-        );
-      }
-
-      const sleepSuggestion = detectSleepPolling(command);
-      if (sleepSuggestion) {
-        throw new Error(
-          `\u{26A0}\u{FE0F} Sleep-polling detected.\n\n` +
-            `Instead of polling with sleep, use the built-in watch command:\n\n` +
-            `Use instead: ${sleepSuggestion}\n\n` +
-            `Watch commands block until completion — no polling needed.`,
-        );
-      }
-
-      const blockedTool = getBlockedCliTool(command);
-      if (blockedTool) {
-        throw new Error(
-          `\u{1F6AB} Direct ${blockedTool.name} usage blocked.\n\n` +
-            `AI agents must use wrapper tools for security and audit.\n\n` +
-            blockedCliRecovery(blockedTool),
-        );
-      }
-    }
-  }
-
-  return {
-    handleToolExecuteBefore,
-    detectSecrets,
-    isPathAllowed,
-    isPathBlocked,
-    isDangerousBashCommand,
-    getBlockedCliTool,
-    isGhCommandAllowed,
-    detectSleepPolling,
-  };
-}
-
-// ============================================================================
-// TOP-LEVEL EXPORTS (default guard, no config)
-// ============================================================================
-
-const defaultGuard = createCredentialGuard();
+let defaultGuard: CredentialGuard | undefined;
+const getDefaultGuard = (): CredentialGuard => (defaultGuard ??= createCredentialGuard());
 
 /** Handle tool execution with default guard (no extra config). */
-export const handleToolExecuteBefore = defaultGuard.handleToolExecuteBefore;
+export const handleToolExecuteBefore: CredentialGuard["handleToolExecuteBefore"] = (...args) =>
+  getDefaultGuard().handleToolExecuteBefore(...args);
 
 /** Detect secrets in content with default guard. */
-export const detectSecrets = defaultGuard.detectSecrets;
+export const detectSecrets: CredentialGuard["detectSecrets"] = (...args) =>
+  getDefaultGuard().detectSecrets(...args);
 
 /** Check if a path is in the allowed exceptions list (default guard). */
-export const isPathAllowed = defaultGuard.isPathAllowed;
+export const isPathAllowed: CredentialGuard["isPathAllowed"] = (...args) =>
+  getDefaultGuard().isPathAllowed(...args);
 
 /** Check if a path should be blocked (default guard). */
-export const isPathBlocked = defaultGuard.isPathBlocked;
+export const isPathBlocked: CredentialGuard["isPathBlocked"] = (...args) =>
+  getDefaultGuard().isPathBlocked(...args);
 
 /** Check if a bash command might expose secrets (default guard). */
-export const isDangerousBashCommand = defaultGuard.isDangerousBashCommand;
+export const isDangerousBashCommand: CredentialGuard["isDangerousBashCommand"] = (...args) =>
+  getDefaultGuard().isDangerousBashCommand(...args);
 
 /** Get blocked CLI tool info (default guard). */
-export const getBlockedCliTool = defaultGuard.getBlockedCliTool;
+export const getBlockedCliTool: CredentialGuard["getBlockedCliTool"] = (...args) =>
+  getDefaultGuard().getBlockedCliTool(...args);
 
 /** Check if a gh command is allowed (default guard). */
-export const isGhCommandAllowed = defaultGuard.isGhCommandAllowed;
+export const isGhCommandAllowed: CredentialGuard["isGhCommandAllowed"] = (...args) =>
+  getDefaultGuard().isGhCommandAllowed(...args);
 
 /** Detect sleep-polling with agent-tools wrapper commands (default guard). */
-export const detectSleepPolling = defaultGuard.detectSleepPolling;
+export const detectSleepPolling: CredentialGuard["detectSleepPolling"] = (...args) =>
+  getDefaultGuard().detectSleepPolling(...args);