@getmarrow/mcp 3.9.103 → 3.9.107

package/dist/seatbelt/mapper.js

@@ -46,10 +46,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.evaluateSeatbeltShell = evaluateSeatbeltShell;
 exports.evaluateSeatbelt = evaluateSeatbelt;
 const path = __importStar(require("node:path"));
+const secret_paths_1 = require("../secret-paths");
 const tables_1 = require("./tables");
 const classifier_pin_1 = require("./classifier-pin");
+const env_names_1 = require("./env-names");
 const longopts_1 = require("./longopts");
 const guards_1 = require("./guards");
+const env_dump_1 = require("./env-dump");
 /* eslint-disable @typescript-eslint/no-require-imports */
 const shellParse = require('../../vendor/classifier/shell-parse.js');
 const baseline = require('../../vendor/classifier/policy-baseline.js');
@@ -182,6 +185,11 @@ function evaluateEvent(event, env) {
     if (Array.isArray(rawInput))
         rawInput = { commands: rawInput.filter((v) => typeof v === 'string'), items: rawInput.filter((v) => v && typeof v === 'object') };
     const input = (rawInput && typeof rawInput === 'object' ? rawInput : {});
+    // A Claude Code built-in that runs a fixed local git command (exact label) is read as that command,
+    // as the keyed hook reads it (hook-tool-policy NATIVE_SHELL_EQUIVALENTS).
+    const nativeShell = NATIVE_SHELL_EQUIVALENTS.get(tool);
+    if (nativeShell !== undefined)
+        rawText = rawText === null ? nativeShell : `${rawText}\n${nativeShell}`;
     // One wall-clock ceiling for the whole event, counted from here (audit N6): the input walks below
     // run before any classification and share it.
     const deadline = deadlineFor(env);
@@ -197,9 +205,14 @@ function evaluateEvent(event, env) {
     }
     const evName = mcp ? mcp.name : name;
     const evInput = mcp ? mcp.args : input;
+    // Claude Code's Workflow (exact host label) runs its `script` as JavaScript that only starts
+    // sub-agents, whose own tools reach the hook: that one field is not shell text (as the keyed hook
+    // reads it, hook-tool-policy NON_SHELL_COMMAND_TOOLS). Every other field is read as for any tool.
+    const shellInput = !mcp && tool === 'Workflow' && typeof evInput.script === 'string'
+        ? Object.fromEntries(Object.entries(evInput).filter(([key]) => key !== 'script')) : evInput;
     // A tool that runs a shell command (audit F11): a known shell tool, or any tool whose input names a
     // command, script or argv field, at any depth.
-    const invocation = shellInvocations(evName, evInput, deadline, rawText);
+    const invocation = shellInvocations(evName, shellInput, deadline, rawText);
     if (invocation) {
         const run = newRun(env, invocation.shell.join('\n'), deadline);
         run.shell = true;
@@ -251,6 +264,13 @@ function evaluateEvent(event, env) {
             if (clock(run))
                 break;
             checkSecretOperand(litArg(p), ctx, run, 'tool_grep');
+            // The tool searches every file under a folder: a process folder reaches the `environ` of each.
+            if (namesProcEnviron(absCandidates(p, ctx, run) || [], env_dump_1.PROC_PROCESS_TREE))
+                hit(run, 'S4', 'proc_environ');
+            // Likewise the host-approvals folder, and ~/.marrow that holds it.
+            if (namesApprovalStateFolder(absCandidates(p, ctx, run) || [], run)) {
+                checkSecretOperand(litArg(`${path.posix.join(run.home, '.marrow', 'host-approvals')}/state.json`), ctx, run, 'tool_grep');
+            }
         }
         for (const key of ['glob', 'include', 'file_pattern']) {
             const g = input[key];
@@ -377,6 +397,11 @@ function mcpPathChecks(label, input, ctx, run, allStrings = true) {
             checkProtectedWrite(litArg(p), ctx, run, 'mcp_write', false);
     }
 }
+// Claude Code built-ins that run a fixed local git command (exact host label).
+const NATIVE_SHELL_EQUIVALENTS = new Map([
+    ['EnterWorktree', 'git worktree add'],
+    ['ExitWorktree', 'git worktree remove'],
+]);
 // Tools that never run what their `command`/`script` field says (it names a skill, a slash command,
 // a sub-agent task), plus Marrow's own tools.
 const NON_SHELL_TOOLS = new Set(['slashcommand', 'skill', 'task', 'agent', 'todowrite', 'todoread', 'exitplanmode', 'enterplanmode',
@@ -978,6 +1003,7 @@ function newRun(rawEnv, source, deadline) {
         protectedAnchors: anchors.map((a) => (fold ? a.toLowerCase() : a)),
         operandAnchors: operandAnchors.map((a) => (fold ? a.toLowerCase() : a)),
         secretRegexes: tables_1.SECRET_PATTERNS.map((p) => classifierModule.globToRegex(p, home)),
+        presentSecretRegexes: tables_1.PRESENT_SECRET_PATTERNS.map((p) => classifierModule.globToRegex(p, home)),
         branchRegexes: baseline.BASELINE_POLICY.protected_branches.map((p) => classifierModule.globToRegex(p, '/nonexistent-home')),
         topSource: source,
         work: 0,
@@ -2916,6 +2942,11 @@ function dispatchProgram(prog, args, rest, pathLike, ctx, run, x) {
         run.headMayChange = true;
     // Generic operand checks apply to every program (S4 reads, S0 writes by write-programs).
     genericOperandChecks(prog, args, ctx, run, x.info.subs);
+    // The v1 compose binaries have no handler and are not in KNOWN_COMMANDS (their program label stays as it is): their bind mounts are read here, then their argv is scanned as an unknown program's is.
+    if (prog === 'docker-compose' || prog === 'podman-compose')
+        dockerMountChecks(rest, ctx, run);
+    // Every command that prints the environment (a word-level table shared with the keyed hook).
+    envDumpChecks(prog, rest, ctx, run, x);
     // NEW-2: a protected path as an operand of a program that is not a known reader.
     protectedOperandCheck(prog, rest, ctx, run);
     // Patch round 4: the command zip runs to test its archive (-TT, --unzip-command) is command text.
@@ -3014,6 +3045,10 @@ function dispatchProgram(prog, args, rest, pathLike, ctx, run, x) {
         case 'awk':
         case 'gawk':
         case 'mawk': return awkProgram(rest, ctx, run, x);
+        // nawk was read as an unknown program before: it keeps that argv scan (the break falls through to unknownProgram) besides the awk reading.
+        case 'nawk':
+            awkProgram(rest, ctx, run, x);
+            break;
         case 'sed':
         case 'gsed': return sedProgram(rest, ctx, run);
         case 'ps': return psProgram(rest, run);
@@ -3052,6 +3087,9 @@ function dispatchProgram(prog, args, rest, pathLike, ctx, run, x) {
         }
         default: break;
     }
+    // An awk by a name the table does not have (`original-awk`, `goawk`, `my-awk`): read as awk, and then as the unknown program it also is (as `nawk` is).
+    if (prog !== 'nawk' && /awk/i.test(prog))
+        awkProgram(rest, ctx, run, x);
     if (/^mkfs(?:\.|$)/.test(prog)) {
         hit(run, 'S5', 'mkfs');
         return;
@@ -3292,7 +3330,7 @@ const NESTED_NOT_PROGRAMS = new Set(['set', 'export', 'declare', 'typeset', 'rea
 // Every command hidden in the argv of a program the mapper has no handler for (`strace -f npm
 // publish`, `cross-env NODE_ENV=production vercel --prod`, `tmux new -d 'npm publish'`). Used for
 // unknown programs and for known wrappers with open grammars (docker run IMAGE CMD…).
-function scanArgvForCommands(rest, ctx, run, x, remote = false) {
+function scanArgvForCommands(rest, ctx, run, x, remote = false, execWrapper = false) {
     const fed = withFeed(ctx, x, run).stdinFeed;
     const base = remote ? childCtx(ctx, { cwds: [null], remote: true, vars: new Map(), aliases: new Map(), backstop: true, stdinFeed: fed }) : { ...ctx, backstop: true };
     const env = new Map(x.env);
@@ -3323,7 +3361,7 @@ function scanArgvForCommands(rest, ctx, run, x, remote = false) {
             continue;
         const tail = rest.slice(k);
         const b = progName(w, run);
-        if ((b === 'env' || b === 'printenv') && tail.length === 1)
+        if ((b === 'env' || b === 'printenv') && tail.length === 1 && !execWrapper)
             continue;
         trials += 1;
         if (trials > tables_1.LIMITS.maxTailTrials) {
@@ -3545,7 +3583,7 @@ function unknownProgram(prog, args, ctx, run, x) {
     if (tables_1.INERT_PROGRAMS.has(prog) || ctx.backstop)
         return;
     const rest = args.slice(1);
-    scanArgvForCommands(rest, ctx, run, x);
+    scanArgvForCommands(rest, ctx, run, x, false, env_dump_1.EXEC_WRAPPERS.has(prog));
     // stdin text: `echo 'npm publish' | at now`, `at now <<< 'npm publish'`, `batch <<EOF …`.
     const src = stdinSource(x, ctx, run);
     // Decoded text piped into a program that runs what it reads (at, batch, crontab, a function) or
@@ -3930,7 +3968,11 @@ function interpreterEnvDump(code) {
     if (rest.includes('\u0004SECRETENV\u0004'))
         return true;
     // What is left: any other mention of the environment object is a dump or a computed lookup.
-    return /\bos\.environ\b|\bprocess\.env\b|%ENV\b|\bENV\b(?!\s*(?:=|==)\s*['"])|\bENVIRON\b|\benviron\b\s*(?:[.)\],;:|]|$)|\$_ENV|\$_SERVER|\bSystem\.getenv\s*\(\s*\)|\bgetenv\s*\(\s*\)|\benvironment\.get_environment_variables|\bGet-ChildItem\s+env:/i.test(rest);
+    if (/\bos\.environb?\b|\bprocess\.env\b|%ENV\b|\bENV\b(?!\s*(?:=|==)\s*['"])|\bENVIRON\b|\benvironb?\b\s*(?:[.)\],;:|]|$)|\$_ENV|\$_SERVER|\bSystem\.getenv\s*\(\s*\)|\bSystem\.get_env\s*\(\s*\)|\bgetenv\s*\(\s*(?:null)?\s*\)|\bphpinfo\s*\(|\benvironment\.get_environment_variables|\bGet-ChildItem\s+env:/i.test(rest))
+        return true;
+    // JavaScript reaches the environment object without spelling it out: `const { env } = process`, `process['en' + 'v']`, `with (process) env`, `Reflect.get(process, 'env')`.
+    return (/\bprocess\b/.test(rest) && (/\benv\b/.test(rest) || /\bprocess\s*(?:\?\.)?\s*\[(?!\s*(['"])[A-Za-z_]\w*\1\s*\])/.test(rest)))
+        || /\b(?:globalThis|global)\s*(?:\?\.)?\s*\[(?!\s*(['"])[A-Za-z_]\w*\1\s*\])/.test(rest);
 }
 function scanInterpreterCode(code, run) {
     if ((0, tables_1.interpreterTreeDelete)(code))
@@ -4243,7 +4285,9 @@ function longestRealpath(abs, run) {
     }
     return null;
 }
-function isSecretPath(abs, run) {
+// `mustExist`: a `<name>.env` path (PRESENT_SECRET_PATTERNS) counts only when it is there to read; samples, git
+// pathspecs and git objects (history) leave it false.
+function isSecretPath(abs, run, mustExist = false) {
     const p = run.fold ? abs.toLowerCase() : abs;
     const base = path.posix.basename(p);
     if (/^\.env(?:\.|$)/.test(base) && tables_1.ENV_TEMPLATE_SUFFIX.test(base))
@@ -4254,8 +4298,11 @@ function isSecretPath(abs, run) {
             return true;
     }
     const hits = run.secretRegexes.some((re) => re.test(p) || (run.fold && re.test(abs)));
-    if (!hits)
-        return false;
+    if (!hits) {
+        if (!run.presentSecretRegexes.some((re) => re.test(p) || (run.fold && re.test(abs))))
+            return false;
+        return !mustExist || safeRealpath(run.env, abs) !== null;
+    }
     if (/\/\.ssh\//.test(p) && tables_1.SSH_PUBLIC.test(base))
         return false;
     return true;
@@ -4372,6 +4419,24 @@ function compileGlob(pattern, opts) {
 function patternToRegex(pattern, lookalike) {
     return compileGlob(pattern, { dyn: true, lookalike, ci: true });
 }
+// `..` read lexically (`/tmp/../p*/self/e*` is `/p*/self/e*`): a segment before it, a glob or a dynamic part too, is dropped with it. A dynamic or
+// relative first segment that is dropped leaves the root, so the absolute reading stays.
+function collapseParents(p) {
+    if (!p.includes('..'))
+        return p;
+    const out = [];
+    for (const part of p.split('/')) {
+        if (part !== '..') {
+            out.push(part);
+            continue;
+        }
+        if (out.length > 1)
+            out.pop();
+        else if (out.length === 1 && out[0] !== '')
+            out[0] = out[0].includes(DYN) ? '' : '.';
+    }
+    return out.join('/') || '/';
+}
 function sampleMatch(a, ctx, run, samples) {
     const raw = a.pattern;
     const lookalike = a.nonAscii;
@@ -4383,41 +4448,98 @@ function sampleMatch(a, ctx, run, samples) {
         for (const c of ctx.cwds)
             cands.push(`${(c || '/__unknown_cwd__').replace(/\/$/, '')}/${expanded}`);
     for (const cand of cands) {
-        const re = patternToRegex(cand.replace(/\/\.\//g, '/'), lookalike);
+        const re = patternToRegex(collapseParents(cand.replace(/\/\.\//g, '/')), lookalike);
         if (samples.some((s) => re.test(s) && isSecretPath(s, run)))
             return true;
     }
     return false;
 }
 function cwdsList(ctx) { return ctx.cwds.map((c) => c || '/__unknown_cwd__'); }
+// `${P:-/proc/self/task/1/environ}`, `${P:=…}`, `${P:+…}`: whenever the name is unset (or set, for `+`) the word after the operator is the path, so the
+// word is also read with that default in place of the expansion (any other expansion in it stays dynamic). Null when no part has such a default.
+const PARAM_DEFAULT = /^[A-Za-z_][A-Za-z0-9_]*:?[-=+]([\s\S]*)$/;
+const NESTED_DEFAULT = /^\$\{[A-Za-z_][A-Za-z0-9_]*:?[-=+]([\s\S]*)$/;
+function parameterDefaultReading(a) {
+    if (!a.word || a.word.slots.length === 0)
+        return null;
+    const parts = a.word.text.split('\u0000');
+    let text = parts[0];
+    let any = false;
+    a.word.slots.forEach((slot, k) => {
+        const m = slot.type === 'var' && slot.name ? PARAM_DEFAULT.exec(slot.name) : null;
+        if (m)
+            any = true;
+        // The parser ends an expansion at its first `}`: a default that opens another (`${A:-${B:-/x}/y}`) is read as the innermost default, followed
+        // by the text up to each closing brace it left after the slot.
+        let inner = m ? m[1] : '';
+        let depth = 0;
+        for (let n = NESTED_DEFAULT.exec(inner); n && depth < 16; n = NESTED_DEFAULT.exec(inner)) {
+            inner = n[1];
+            depth += 1;
+        }
+        const word = m ? inner.replace(/^(["'])([\s\S]*)\1$/, '$2').replace(/\$\{[^}]*\}|\$\([^)]*\)|\$[A-Za-z_][A-Za-z0-9_]*|`[^`]*`/g, DYN) : DYN;
+        let rest = parts[k + 1] || '';
+        let tail = '';
+        for (let level = 0; level < depth; level += 1) {
+            const close = rest.indexOf('}');
+            if (close < 0)
+                break;
+            tail += rest.slice(0, close);
+            rest = rest.slice(close + 1);
+        }
+        text += `${word}${tail}${rest}`;
+    });
+    if (!any)
+        return null;
+    // No word: the reading is final (it is not read for defaults again).
+    return text.includes(DYN) ? { text: null, alts: null, pattern: text, glob: a.glob, word: null, nonAscii: a.nonAscii } : { ...litArg(text), glob: a.glob };
+}
 // S4: a secret path as an operand. Returns true on a stop.
-function checkSecretOperand(a, ctx, run, reason) {
+// `history`: git reads the path from its object store (a pathspec after `--`, a `REV:path` object), so it
+// need not exist in the work tree.
+// `pattern`: the pattern of a search (the word in `grep -rn <word> src`), which names no file to read.
+function checkSecretOperand(a, ctx, run, reason, history = false, pattern = false, envOnly = false) {
     if (a.text === null && a.alts && a.alts.length) {
         for (const v of a.alts)
-            if (checkSecretOperand({ ...litArg(v), glob: a.glob, word: a.word }, ctx, run, reason))
+            if (checkSecretOperand({ ...litArg(v), glob: a.glob, word: a.word }, ctx, run, reason, history, pattern, envOnly))
                 return true;
         return false;
     }
     for (const text of operandPaths(a)) {
         if (/^[a-z][a-z0-9+.-]*:\/\//i.test(text))
             continue;
+        // A name under an unknown working folder (the event gave no absolute cwd): a relative operand, `..` included,
+        // or one under /proc/<pid>/cwd. It may be there to read, so a `<name>.env` operand counts as present and a
+        // glob that can expand to a `*.env` name stops (fail closed). The pattern of a search names no file.
+        const underUnknown = !pattern && ctx.cwds.some((c) => c === null) && (() => {
+            const t = expandTilde(text, run);
+            return t !== null && (!path.posix.isAbsolute(t) || /^\/proc\/[^/]+\/cwd(?:\/|$)/.test(t));
+        })();
         // A glob is also listed (through links and names made in this command) and each match judged.
         if (a.text !== null && a.glob && /[*?[]/.test(text) && !a.nonAscii && run.env.fs.readdir) {
             const matches = expandGlob(text, ctx, run);
             if (matches !== null) {
                 for (const mm of matches.slice(0, tables_1.LIMITS.maxGlobMatches))
-                    if (checkSecretOperand({ ...litArg(mm), glob: false }, ctx, run, reason))
+                    if (checkSecretOperand({ ...litArg(mm), glob: false }, ctx, run, reason, history, pattern, envOnly))
                         return true;
                 for (const k of linkNamesMatching(text, ctx, run))
-                    if (checkSecretOperand({ ...litArg(k), glob: false }, ctx, run, reason))
+                    if (checkSecretOperand({ ...litArg(k), glob: false }, ctx, run, reason, history, pattern, envOnly))
                         return true;
             }
         }
         if (a.text === null || a.glob || a.nonAscii) {
             const probe = a.text === null ? a : { ...a, pattern: text };
-            if (/[A-Za-z0-9._~/-]/.test(probe.pattern.replace(new RegExp(DYN, 'g'), '')) && sampleMatch(probe, ctx, run, (0, tables_1.secretSamples)(run.home, cwdsList(ctx)))) {
+            const samples = /[A-Za-z0-9._~/-]/.test(probe.pattern.replace(new RegExp(DYN, 'g'), '')) ? (envOnly ? envSamples(run, ctx) : (0, tables_1.secretSamples)(run.home, cwdsList(ctx))) : [];
+            if (samples.length > 0 && sampleMatch(probe, ctx, run, samples)) {
+                // A glob or dynamic path that can spell a process environment file also carries the env-dump reason (the keyed hook keeps only those).
+                if (sampleMatch(probe, ctx, run, samples.filter((s) => env_dump_1.PROC_ENVIRON.test(s))))
+                    hit(run, 'S4', 'proc_environ');
+                if (sampleMatch(probe, ctx, run, samples.filter((s) => secret_paths_1.APPROVAL_STATE_PATH.test(s))))
+                    hit(run, 'S4', secret_paths_1.APPROVAL_STATE_REASON);
                 return hit(run, 'S4', `${reason}_secret_pattern`);
             }
+            if (underUnknown && a.text !== null && a.glob && /[*?[]/.test(text) && globMayEndWith(text, '.env', run.fold))
+                return hit(run, 'S4', `${reason}_secret_pattern`);
             if (a.text === null)
                 continue;
         }
@@ -4428,13 +4550,143 @@ function checkSecretOperand(a, ctx, run, reason) {
             // A path through a link whose target the mapper cannot follow (audit N3).
             if (run.links.size > 0 && applyLinks(p, run) === '/__unknown_link__')
                 return hit(run, 'S4', `${reason}_unknown_link`);
-            for (const r of realCandidates(p, run, true))
-                if (isSecretPath(r, run))
-                    return hit(run, 'S4', `${reason}_secret_path`);
+            const mustExist = !history && !(underUnknown || (!pattern && p.startsWith('/__unknown_cwd__/')));
+            for (const r of realCandidates(p, run, true)) {
+                if (!isSecretPath(r, run, mustExist) || (envOnly && (0, env_names_1.secretEnvBase)((0, env_names_1.lastSegment)(r)) === null))
+                    continue;
+                if (env_dump_1.PROC_ENVIRON.test(r))
+                    hit(run, 'S4', 'proc_environ');
+                if (secret_paths_1.APPROVAL_STATE_PATH.test(r))
+                    hit(run, 'S4', secret_paths_1.APPROVAL_STATE_REASON);
+                return hit(run, 'S4', `${reason}_secret_path`);
+            }
+        }
+    }
+    // Read last, so a stop the operand already had keeps its reason.
+    const defaulted = a.text === null ? parameterDefaultReading(a) : null;
+    return defaulted !== null && checkSecretOperand(defaulted, ctx, run, reason, history, pattern, envOnly);
+}
+// Whether some name the glob matches (shell rules: `*` and `?` stay inside one path segment) ends with `suffix`:
+// a walk over (glob position, how much of the suffix the name ends with so far), trying the suffix characters
+// and a few others for every wildcard.
+function globMayEndWith(glob, suffix, ci) {
+    const fold = (c) => (ci ? c.toLowerCase() : c);
+    const toks = [];
+    for (let i = 0; i < glob.length; i += 1) {
+        const ch = glob[i];
+        if (ch === '*') {
+            if (toks[toks.length - 1]?.k !== 'star')
+                toks.push({ k: 'star' });
+            continue;
         }
+        if (ch === '?') {
+            toks.push({ k: 'any1' });
+            continue;
+        }
+        if (ch === '[') {
+            const end = glob.indexOf(']', i + 2);
+            if (end > 0) {
+                let body = glob.slice(i + 1, end);
+                const neg = body.startsWith('!') || body.startsWith('^');
+                if (neg)
+                    body = body.slice(1);
+                const tok = { k: 'cls', neg, chars: [], ranges: [] };
+                for (let q = 0; q < body.length; q += 1) {
+                    if (body[q + 1] === '-' && q + 2 < body.length) {
+                        tok.ranges.push([fold(body[q]), fold(body[q + 2])]);
+                        q += 2;
+                    }
+                    else
+                        tok.chars.push(fold(body[q]));
+                }
+                toks.push(tok);
+                i = end;
+                continue;
+            }
+        }
+        toks.push({ k: 'lit', c: fold(ch) });
+    }
+    const want = fold(suffix);
+    const tries = [...new Set([...want, 'x', 'A', '0', '_', '-', ...toks.flatMap((t) => (t.k === 'cls' ? [...t.chars, ...t.ranges.flat()] : []))])].filter((c) => c !== '/');
+    const step = (k, c) => {
+        const s = want.slice(0, k) + c;
+        for (let n = Math.min(s.length, want.length); n > 0; n -= 1)
+            if (s.endsWith(want.slice(0, n)))
+                return n;
+        return 0;
+    };
+    const accepts = (t, c) => {
+        if (t.k === 'lit')
+            return t.c === c;
+        if (t.k === 'any1' || t.k === 'star')
+            return c !== '/';
+        const inSet = t.chars.includes(c) || t.ranges.some(([lo, hi]) => c >= lo && c <= hi);
+        return t.neg ? !inSet && c !== '/' : inSet;
+    };
+    const seen = new Set();
+    const queue = [[0, 0]];
+    while (queue.length) {
+        const [i, k] = queue.pop();
+        const key = `${i}:${k}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (i === toks.length) {
+            if (k === want.length)
+                return true;
+            continue;
+        }
+        const t = toks[i];
+        const chars = t.k === 'lit' ? [t.c] : tries;
+        if (t.k === 'star')
+            queue.push([i + 1, k]);
+        for (const c of chars)
+            if (accepts(t, c))
+                queue.push([t.k === 'star' ? i : i + 1, step(k, c)]);
     }
     return false;
 }
+// The words a search reads as its pattern, not as a file: the value of -e/--regexp (also attached), and the
+// first operand when no -e/-f gave one. A form not listed here is read as a file (the strict reading).
+function searchPatternArgs(rest, end = rest.length) {
+    const out = new Set();
+    let given = false;
+    let first = null;
+    for (let i = 0; i < end; i += 1) {
+        const t = rest[i].text;
+        if (t === null) {
+            if (first === null)
+                first = rest[i];
+            continue;
+        }
+        if (t === '--')
+            break;
+        if (t === '-e' || t === '--regexp') {
+            given = true;
+            if (rest[i + 1])
+                out.add(rest[i + 1]);
+            i += 1;
+            continue;
+        }
+        if (/^(?:--regexp=|-e.)/.test(t)) {
+            given = true;
+            out.add(rest[i]);
+            continue;
+        }
+        if (t === '-f' || t === '--file' || /^(?:--file=|-f.)/.test(t)) {
+            given = true;
+            if (t === '-f' || t === '--file')
+                i += 1;
+            continue;
+        }
+        if (first === null && !t.startsWith('-'))
+            first = rest[i];
+    }
+    if (!given && first !== null)
+        out.add(first);
+    return out;
+}
+const SEARCH_PROGRAMS = new Set(['grep', 'egrep', 'fgrep', 'zgrep', 'rg', 'ag', 'ack']);
 // Path-ish parts of an operand: the value after `--opt=`, after `@` (curl -d @file) and after `:`
 // for git object paths (HEAD:.env).
 function operandPaths(a) {
@@ -4676,7 +4928,11 @@ function isSecretDirOrAncestor(text, ctx, run) {
     if (!abs)
         return false;
     const dirs = SECRET_DIRS.map((d) => path.posix.join(run.home, d));
-    return abs.some((p) => realCandidates(p, run, true).some((r) => dirs.some((d) => isAncestorOrSelf(r, d) || isAncestorOrSelf(d, r))));
+    const secretDir = abs.some((p) => realCandidates(p, run, true).some((r) => dirs.some((d) => isAncestorOrSelf(r, d) || isAncestorOrSelf(d, r))));
+    // Every caller stops (S4) on true. A walk that reaches the host-approvals state file also carries the reason the keyed hook keeps.
+    if (secretDir && reachesApprovalState(text, ctx, run))
+        hit(run, 'S4', secret_paths_1.APPROVAL_STATE_REASON);
+    return secretDir;
 }
 // `cat $(echo ~/.ssh/id_rsa)`, `cat $(ls ~/.ssh/id_*)`, `cat $(find ~/.ssh -name 'id_*')`: the path
 // is produced by a substitution that the reader then opens.
@@ -4705,6 +4961,14 @@ function substitutionOperandCheck(prog, rest, ctx, run, subs) {
 }
 // grep -r, rg, ag and ack over a credential directory, or over a directory that holds one, print
 // matches from the credential files inside it.
+// True when `text` names the host-approvals folder, or a folder that holds it (~/.marrow, the home, /): a search walking it reads the state file.
+function reachesApprovalState(text, ctx, run) {
+    const abs = absCandidates(text, ctx, run);
+    if (!abs)
+        return false;
+    const dir = path.posix.join(run.home, '.marrow', 'host-approvals');
+    return abs.some((p) => realCandidates(p, run, true).some((r) => isAncestorOrSelf(run.fold ? r.toLowerCase() : r, run.fold ? dir.toLowerCase() : dir)));
+}
 function recursiveSecretDirRead(prog, rest, ctx, run) {
     const searchers = new Set(['grep', 'egrep', 'fgrep', 'zgrep', 'rg', 'ag', 'ack']);
     if (!searchers.has(prog))
@@ -4732,6 +4996,7 @@ function genericOperandChecks(prog, args, ctx, run, subs = []) {
     recursiveSecretDirRead(prog, rest, ctx, run);
     if (!tables_1.S4_EXEMPT_PROGRAMS.has(prog) && prog !== 'git') {
         let skipNext = false;
+        const patterns = SEARCH_PROGRAMS.has(prog) ? searchPatternArgs(rest) : null;
         for (let i = 0; i < rest.length; i += 1) {
             const a = rest[i];
             if (skipNext) {
@@ -4745,7 +5010,7 @@ function genericOperandChecks(prog, args, ctx, run, subs = []) {
             }
             if (clock(run))
                 return;
-            checkSecretOperand(a, ctx, run, 'operand');
+            checkSecretOperand(a, ctx, run, 'operand', false, patterns !== null && patterns.has(a));
         }
     }
     // Copying or archiving a directory that holds credential files (cp -r ~/.ssh, tar ~) is a read too.
@@ -4757,6 +5022,11 @@ function genericOperandChecks(prog, args, ctx, run, subs = []) {
             const abs = absCandidates(a.text, ctx, run);
             if (!abs)
                 continue;
+            if (reachesApprovalState(a.text, ctx, run)) {
+                hit(run, 'S4', secret_paths_1.APPROVAL_STATE_REASON);
+                hit(run, 'S4', 'copy_secret_directory');
+                break;
+            }
             if (abs.some((p) => realCandidates(p, run, true).some((r) => secretDirs.some((d) => isAncestorOrSelf(r, d))))) {
                 hit(run, 'S4', 'copy_secret_directory');
                 break;
@@ -5916,6 +6186,17 @@ function targetDirFlag(rest) {
 }
 // ---------------------------------------------------------------------------------------------
 // builtins
+// `cd /proc/$$`, `cd /proc/$(pgrep node)/task/*`, `cd $PID` from `/proc`: a target that is a process or thread id (a dynamic part or a glob) under
+// `/proc` is also read as `self`, so a later `cat environ` names the process file. The unknown folder stays possible, as before.
+function procFolderGuesses(target, ctx) {
+    const spelled = target.text !== null ? target.text : target.pattern;
+    if (spelled === '-')
+        return [];
+    const guess = (t) => t.split(DYN).join('self').replace(/\*+/g, 'self').replace(/\?/g, '1').replace(/\[[^\]]*\]/g, '1');
+    if (spelled.startsWith('/'))
+        return /^\/proc(?:\/|$)/.test(spelled) ? [path.posix.normalize(guess(spelled))] : [];
+    return ctx.cwds.filter((c) => c !== null && /^\/proc(?:\/|$)/.test(c)).map((c) => path.posix.resolve(c, guess(spelled)));
+}
 function changeDir(rest, ctx, run, subshell) {
     const ops = nonOptions(rest);
     const target = ops[0];
@@ -5924,7 +6205,7 @@ function changeDir(rest, ctx, run, subshell) {
         return;
     }
     if (target.text === null || target.text === '-' || target.glob) {
-        ctx.cwds = [...new Set([...ctx.cwds, null])];
+        ctx.cwds = [...new Set([...ctx.cwds, ...procFolderGuesses(target, ctx), null])];
         return;
     }
     const next = [];
@@ -6500,8 +6781,16 @@ function simpleWrapper(prog, rest, ctx, run, x) {
         caffeinate: ['-t', '-w'], taskset: [], chrt: [], retry: ['-t', '--times', '-d', '--delay', '--until'], flock: ['-w', '--timeout', '-E', '--conflict-exit-code'],
     };
     const vf = new Set(valueFlags[prog] || []);
-    if (prog === 'command' && rest.some((a) => a.text === '-v' || a.text === '-V'))
-        return;
+    // `command -v NAME` and `-V` only look a name up. They are options of `command`, so they end at the first word that is not one:
+    // `command awk -v c=x '…'` runs awk with its own -v.
+    if (prog === 'command') {
+        for (const a of rest) {
+            if (a.text === null || a.text === '--' || !a.text.startsWith('-'))
+                break;
+            if (a.text === '-v' || a.text === '-V')
+                return;
+        }
+    }
     while (i < rest.length) {
         const t = rest[i].text;
         if (t === null)
@@ -6670,6 +6959,7 @@ function xargsWrapper(prog, rest, ctx, run, x) {
         const sep = inner.findIndex((a) => a.text !== null && /^::::?\+?$/.test(a.text));
         const inputs = sep >= 0 ? inner.slice(sep + 1) : [];
         inner = sep >= 0 ? inner.slice(0, sep) : inner;
+        xargsRunsBareEnv(inner, run);
         if (inner.length === 0) {
             // `parallel ::: 'cmd1' 'cmd2'` and `… | parallel`: every input line is a command line.
             if (sep >= 0) {
@@ -6692,8 +6982,13 @@ function xargsWrapper(prog, rest, ctx, run, x) {
         evalShell(/\{(?:[.\/#%]|\/\.|\d+)?\}/.test(inner.map((a) => a.text || '').join(' ')) ? text : `${text} ${marker}`, childCtx(ctx), run);
         return;
     }
+    xargsRunsBareEnv(inner, run);
     if (inner.length === 0)
         inner = [litArg('echo')];
+    // A command that is not one of the exempt programs reads the names it is given (a dynamic command word too).
+    const innerProg = progName(inner[0], run);
+    if (innerProg === null || !tables_1.S4_EXEMPT_PROGRAMS.has(innerProg))
+        xargsUpstreamEnv(x, ctx, run);
     // Input lines become extra operands: unknown targets (spec A6). The -I replacement string stands
     // for one input line wherever it appears.
     let replaced = false;
@@ -6815,6 +7110,36 @@ function sshRemote(rest, ctx, run, x) {
     else
         dynamicCode({ text: null, alts: null, pattern: remoteCmd.map((a) => (a.text !== null ? a.text : a.pattern)).join(' '), glob: false, word: null, nonAscii: false }, remoteCtx, run, 'dynamic_remote_command');
 }
+// `sh -c '"$@"' _ env`, `bash -c 'exec "$@"' x printenv`: the words after the script text are its positional parameters ($0 first), and a script whose
+// command word is an expansion runs them. `"$@"` / `$*` run the words after $0 as one command line, `$N` runs word N (alone or with the rest after it),
+// and a name (`for c; do "$c"; done`) may hold any of them. The mapper reads each such line; a dynamic word is left to the dynamic-command stop.
+function positionalCommands(code, positional, ctx, run) {
+    if (code.text === null || positional.some((p) => p.text === null))
+        return;
+    const tokens = [...code.text.matchAll(new RegExp(env_dump_1.SHELL_RUNS_EXPANSION.source, 'g'))].map((m) => m[1]);
+    if (tokens.length === 0)
+        return;
+    const words = positional.map((p) => p.text);
+    const quoted = (list) => list.map((w) => `'${w.replace(/'/g, "'\\''")}'`).join(' ');
+    const lines = new Set();
+    for (const t of tokens) {
+        if (t === '@' || t === '*')
+            lines.add(quoted(words.slice(1)));
+        else if (/[0-9]/.test(t)) {
+            const at = Number(t);
+            if (at < words.length) {
+                lines.add(words[at]);
+                lines.add(quoted(words.slice(at)));
+            }
+        }
+        else
+            for (const w of words.slice(1))
+                lines.add(w);
+    }
+    for (const line of lines)
+        if (line.trim() !== '')
+            evalShell(line, childCtx(ctx), run);
+}
 function handleShell(prog, rest, ctx, run, x) {
     // `env BASH_ENV=f bash -c :`: a startup file named by a wrapper's assignment (audit N1).
     for (const name of ['BASH_ENV', 'ENV']) {
@@ -6857,16 +7182,20 @@ function handleShell(prog, rest, ctx, run, x) {
         if (/^[-+][a-zA-Z]+$/.test(t) && /[coO]/.test(t)) {
             let used = 0;
             let codeArg = null;
+            let codeAt = -1;
             for (const ch of t.slice(1)) {
                 if (ch === 'c' && t[0] === '-') {
-                    codeArg = rest[i + 1 + used] || null;
+                    codeAt = i + 1 + used;
+                    codeArg = rest[codeAt] || null;
                     used += 1;
                 }
                 else if (ch === 'o' || ch === 'O')
                     used += 1;
             }
-            if (codeArg)
+            if (codeArg) {
+                positionalCommands(codeArg, rest.slice(codeAt + 1), ctx, run);
                 return shellString(codeArg, withFeed(ctx, x, run), run, x.info.subs);
+            }
             i += used;
             continue;
         }
@@ -6874,6 +7203,7 @@ function handleShell(prog, rest, ctx, run, x) {
             const code = rest[i + 1];
             if (!code)
                 return;
+            positionalCommands(code, rest.slice(i + 2), ctx, run);
             // What this command's stdin carries (here-string, heredoc, pipe, enclosing group) reaches any
             // reader inside the `-c` text.
             return shellString(code, withFeed(ctx, x, run), run, x.info.subs);
@@ -6894,12 +7224,13 @@ function handleShell(prog, rest, ctx, run, x) {
 }
 function handleInterpreter(prog, rest, ctx, run, x) {
     const codeFlags = {
-        node: /^(?:-e|--eval|-p|--print|-pe)$/, nodejs: /^(?:-e|--eval|-p|--print)$/, bun: /^(?:-e|--eval|-p|--print)$/,
+        node: /^(?:-e|--eval|-p|--print|-pe|-ep)$/, 'ts-node': /^(?:-e|--eval|-p|--print)$/, tsx: /^(?:-e|--eval|-p|--print)$/, nodejs: /^(?:-e|--eval|-p|--print)$/, bun: /^(?:-e|--eval|-p|--print)$/,
         deno: /^(?:eval)$/, php: /^-r$/, ruby: /^-[a-zA-Z]*e$/, perl: /^-[a-zA-Z]*[eE]$/, lua: /^-e$/, irb: /^-e$/,
         pwsh: /^-(?:c|command|e|ec|enc|encodedcommand)$/i, powershell: /^-(?:c|command|e|ec|enc|encodedcommand)$/i,
     };
-    const isPython = /^(?:python[23]?(?:\.\d+)?|ipython)$/.test(prog);
-    const codeRe = isPython ? /^-[a-zA-Z]*c$/ : (codeFlags[prog] || /^-e$/);
+    const isPython = /^(?:python[23]?(?:\.\d+)?|ipython|pypy3?(?:\.\d+)?)$/.test(prog);
+    // pypy keeps the `-e` it was read with before it was read as Python (a stop, never a pass), besides Python's `-c`.
+    const codeRe = isPython ? (prog.startsWith('pypy') ? /^(?:-[a-zA-Z]*c|-e)$/ : /^-[a-zA-Z]*c$/) : (codeFlags[prog] || /^-e$/);
     for (let i = 0; i < rest.length; i += 1) {
         const a = rest[i];
         const t = a.text;
@@ -6914,6 +7245,12 @@ function handleInterpreter(prog, rest, ctx, run, x) {
                 hit(run, 'Sx', 'dynamic_interpreter_code');
             return;
         }
+        // The code attached to its flag: `node --eval=CODE`, `perl -e'CODE'`, `ruby -e'CODE'`, `php -r'CODE'`, `python3 -c'CODE'`.
+        const attachedCode = /^(?:node|nodejs|bun)$/.test(prog) ? /^--(?:eval|print)=([\s\S]+)$/.exec(t)
+            : isPython ? /^-[a-zA-Z]*c([\s\S]+)$/.exec(t) : prog === 'perl' ? /^-[a-zA-Z]*[eE]([\s\S]+)$/.exec(t) : prog === 'ruby' ? /^-[a-zA-Z]*e([\s\S]+)$/.exec(t)
+                : prog === 'php' ? /^-r([\s\S]+)$/.exec(t) : null;
+        if (attachedCode)
+            scanInterpreterCode(attachedCode[1], run);
         if (codeRe.test(t) || (prog === 'deno' && t === 'eval')) {
             const code = rest[i + 1];
             if (!code)
@@ -6928,8 +7265,26 @@ function handleInterpreter(prog, rest, ctx, run, x) {
                     return;
                 }
             }
-            const codeText = code.text !== null ? code.text : argText(code);
-            scanInterpreterCode(codeText, run);
+            const firstCode = code.text !== null ? code.text : argText(code);
+            scanInterpreterCode(firstCode, run);
+            // A repeated code flag (`perl -e 'print 1' -e 'system(shift)' env`) runs every piece: each is read like the first, and a dynamic one is code
+            // nobody can read.
+            let codeText = firstCode;
+            for (let j = i + 2; j < rest.length; j += 1) {
+                const flag = rest[j].text;
+                if (flag === null || !codeRe.test(flag) || !rest[j + 1])
+                    continue;
+                const more = rest[j + 1];
+                if (more.text === null && !more.alts) {
+                    worseParse(run, 'dynamic');
+                    tripwire(run.topSource, run);
+                    hit(run, 'Sx', 'dynamic_interpreter_code');
+                    continue;
+                }
+                const moreText = more.text !== null ? more.text : argText(more);
+                scanInterpreterCode(moreText, run);
+                codeText = `${codeText}\n${moreText}`;
+            }
             // Code that reads its own stdin and runs what it reads: the stdin text is a command too.
             // Code that can start a process passes its stdin on to it, whether or not it reads it itself.
             if (tables_1.INTERPRETER_EXEC.test(codeText))
@@ -6943,6 +7298,16 @@ function handleInterpreter(prog, rest, ctx, run, x) {
                     if (extra.text !== null && !extra.text.startsWith('-'))
                         evalShell(extra.text, childCtx(ctx), run);
             }
+            else if (env_dump_1.CODE_STARTS_COMMAND.test(codeText)) {
+                // Code that starts a command and takes its name some other way (`system(shift)`, `os.execvp(sys.argv[1], …)`, `passthru($argv[1])`,
+                // `os.execute(arg[1])`): an environment printer among the arguments is that command.
+                for (const extra of rest.slice(i + 2))
+                    if (extra.text !== null && (0, env_dump_1.mayRunEnvPrinter)(extra.text))
+                        evalShell(extra.text, childCtx(ctx), run);
+            }
+            // …or takes it from its environment: a value set on this command line (`C=env perl -e 'system $ENV{C}'`).
+            if (env_dump_1.CODE_STARTS_COMMAND.test(codeText) && env_dump_1.CODE_READS_ENVIRONMENT.test(codeText))
+                assignedEnvPrinters(x, ctx, run);
             return;
         }
         if ((prog === 'deno' || prog === 'bun') && (t === 'run' || t === 'repl'))
@@ -7027,15 +7392,65 @@ function stdinInterpreter(prog, x, ctx, run) {
 }
 // BSD `ps e`, `ps auxe`, `ps eww` print every process's environment.
 function psProgram(rest, run) {
+    const words = rest.map((a) => a.text);
+    if ((0, env_dump_1.psPrintsEnvironment)(words))
+        hit(run, 'S4', 'ps_environment');
+    // What 3.9.103 stopped and no later version loosens: the keyed hook leaves this reading out.
+    else if ((0, env_dump_1.psLooselyPrintsEnvironment)(words))
+        hit(run, 'S4', 'ps_environment_loose');
+}
+// Commands that print many or all environment variables, found by their words alone (never by file contents):
+// `compgen -e`, `tmux show-environment`, `systemctl show-environment`, `php -i`, a jq filter that reads `env`,
+// `npm run env`, and any program given /proc/<pid>/environ.
+function envDumpChecks(prog, rest, ctx, run, x) {
+    const words = rest.map((a) => a.text);
+    if (prog === 'compgen' && (0, env_dump_1.compgenListsVariables)(words))
+        hit(run, 'S4', 'env_dump_compgen');
+    else if (prog === 'tmux' && ((0, env_dump_1.tmuxShowsEnvironment)(words) || (0, env_dump_1.tmuxRunsEnvironmentPrinter)(words)))
+        hit(run, 'S4', 'env_dump_tmux');
+    else if (prog === 'strace' && (0, env_dump_1.straceShowsEnvironment)(words))
+        hit(run, 'S4', 'env_dump_strace');
+    else if (prog === 'man' && (0, env_dump_1.manPagerPrintsEnvironment)(words))
+        hit(run, 'S4', 'env_dump_env');
+    else if (prog === 'systemctl' && (0, env_dump_1.systemctlShowsEnvironment)(words))
+        hit(run, 'S4', 'env_dump_systemctl');
+    else if (prog === 'php' && words.some((w) => w === '-i' || w === '--info'))
+        hit(run, 'S4', 'env_dump_php_info');
+    else if (prog === 'jq' && ((0, env_dump_1.jqFilters)(words).some(env_dump_1.jqFilterReadsEnvironment) || (x.cmd.heredoc !== null && words.some((w) => w !== null && STDIN_PATHS.has(w)) && (0, env_dump_1.jqFilterReadsEnvironment)(x.cmd.heredoc))))
+        hit(run, 'S4', 'env_dump_jq');
+    else if ((prog === 'npm' || prog === 'pnpm' || prog === 'yarn' || prog === 'bun') && (0, env_dump_1.packageRunsEnvScript)(words))
+        hit(run, 'S4', 'env_dump_npm_run_env');
+    for (const [name, values] of x.env) {
+        if (env_dump_1.HELPER_ENV_VARS.has(name) && values !== null && values.some((v) => env_dump_1.ENV_PRINTER_COMMAND.test(v))) {
+            hit(run, 'S4', 'env_dump_env');
+            break;
+        }
+    }
     for (const a of rest) {
-        if (a.text === null)
+        // A dynamic part of the path (`/proc/$(pgrep node)/environ`) stands for any pid.
+        const text = a.text !== null ? a.text : a.pattern.split(DYN).join('x');
+        if (!text.startsWith('/') && !text.includes('proc'))
             continue;
-        if (/^[a-zA-Z]*e[a-zA-Z]*$/.test(a.text) && !a.text.startsWith('-') && !/^\d+$/.test(a.text)) {
-            hit(run, 'S4', 'ps_environment');
+        if (namesProcEnviron(a.text !== null ? absCandidates(a.text, ctx, run) || [] : [text], env_dump_1.RECURSIVE_READERS.has(prog) ? env_dump_1.PROC_PROCESS_DIRECTORY : null)) {
+            hit(run, 'S4', 'proc_environ');
             return;
         }
     }
 }
+// A path that is, or can spell, a process environment file; for a program that reads every file under a folder, a process folder too.
+function namesProcEnviron(candidates, folder) {
+    return candidates.map((p) => collapseParents(p.length > 1 ? p.replace(/\/+$/, '') : p))
+        .some((p) => env_dump_1.PROC_ENVIRON.test(p) || (0, env_dump_1.procGlobMatchesEnviron)(p) || (folder !== null && folder.test(p)));
+}
+// `xargs env`, `parallel env ::: x`: the command is `env` or `printenv` with only options and assignments, so it prints the environment.
+function xargsRunsBareEnv(words, run) {
+    const b = words[0] && words[0].text !== null ? progName(words[0], run) : null;
+    if (b !== 'env' && b !== 'printenv')
+        return;
+    const bare = words.slice(1).every((a) => a.text !== null && (a.text.startsWith('-') || (b === 'env' && (/^[A-Za-z_]\w*=/.test(a.text) || /^\{[^}]*\}$/.test(a.text)))));
+    if (bare)
+        hit(run, 'S4', b === 'env' ? 'env_dump_env' : 'env_dump_printenv');
+}
 // trap 'cmd' SIGNAL…: the command runs when the signal arrives.
 // util-linux `script [-q] [-c COMMAND] [file]`: COMMAND runs in a pty with this command's stdin.
 function scriptSession(rest, ctx, run, x) {
@@ -7069,54 +7484,798 @@ function trapBuiltin(rest, ctx, run, x) {
 }
 // awk programs run commands through system() and pipes.
 const AWK_EXEC = /\bsystem\s*\(|\|\s*&?\s*["'$a-zA-Z(]|\bgetline\b|\bENVIRON\b|\bPROCINFO\b/;
-function awkProgram(rest, ctx, run, x) {
-    const vf = new Set(['-F', '-v', '-W', '--field-separator', '--assign', '-i', '-l', '--include', '--load']);
-    let program = null;
-    for (let i = 0; i < rest.length; i += 1) {
-        const t = rest[i].text;
-        if (t === '-f' || t === '--file') {
-            const f = rest[i + 1];
-            // `awk -f -`: the program arrives on stdin.
-            if (f && f.text !== null && (f.text === '-' || STDIN_PATHS.has(f.text))) {
-                const src = stdinSource(x, ctx, run);
-                for (const text of src.texts)
-                    if (AWK_EXEC.test(text))
-                        scanInterpreterCode(text, run);
-                if (src.unknown || (src.texts.length === 0 && src.files.length === 0)) {
-                    worseParse(run, 'dynamic');
-                    hit(run, 'Sx', 'dynamic_stdin_code');
-                }
+// A program that can start a command and names its own arguments (`system(ARGV[1])`, `for (i = 1; i < ARGC; i++) s = s ARGV[i]`) may run them: they are command text.
+const AWK_RUNS_ARGV = /\bsystem\s*\(|\|\s*&?\s*["'$a-zA-Z(]|\bgetline\b/;
+function awkArgvCommands(text, rest, ctx, run, x) {
+    if (AWK_RUNS_ARGV.test(text) && /\b(?:ARGV|ARGC)\b/.test(text) && !ctx.backstop)
+        scanArgvForCommands(rest, ctx, run, x);
+    if (env_dump_1.AWK_STARTS_COMMAND.test(text)) {
+        awkEnvPrinterWords(text, rest, ctx, run);
+        if (env_dump_1.CODE_READS_ENVIRONMENT.test(text))
+            assignedEnvPrinters(x, ctx, run);
+    }
+}
+// A value assigned on the command line itself (`X=env awk 'BEGIN{system(ENVIRON["X"])}'`) reaches code that reads its environment: a value that is
+// the environment printer, or a command line that holds it, is a command that code may run.
+function assignedEnvPrinters(x, ctx, run) {
+    for (const values of x.env.values())
+        if (values !== null)
+            for (const v of values)
+                if ((0, env_dump_1.mayRunEnvPrinter)(v))
+                    evalShell(v, childCtx(ctx), run);
+}
+// A program that can start a command may run any word of its command line: an ARGV word, a `-v NAME=VALUE` or `NAME=VALUE` value. A word that
+// is the environment printer (`env`, `printenv`, alone or with options) is that command, even by itself (`awk 'BEGIN{system(ARGV[1])}' env`).
+function awkEnvPrinterWords(program, rest, ctx, run) {
+    for (const a of rest) {
+        // The program text is code (it may say `env` in a string), not a word it runs.
+        if (a.text === null || a.text === program)
+            continue;
+        const m = /^(?:-v|--assign=)?(?:[A-Za-z_][A-Za-z0-9_]*=)?([\s\S]*)$/.exec(a.text);
+        const value = a.text.startsWith('-') && !/^-v[\s\S]|^--assign=/.test(a.text) ? '' : (m ? m[1] : a.text);
+        if ((0, env_dump_1.mayRunEnvPrinter)(value))
+            evalShell(value, childCtx(ctx), run);
+    }
+}
+// awk's own options, in exact spellings only (longopts.ts): gawk 5.2, mawk 1.3.4, BusyBox awk and the one-true-awk. A long option that is
+// shortened, unknown or misspelled is not on the list and stops the run; so does a short letter that is not one of these.
+const AWK_LONG = (0, longopts_1.longList)('file= field-separator= assign= include= load= source= exec= debug[=] dump-variables[=] lint[=] pretty-print[=] profile[=] persist[=] ' +
+    'traditional characters-as-bytes copyright gen-pot help trace bignum use-lc-numeric non-decimal-data optimize no-optimize posix ' +
+    're-interval sandbox lint-old version csv usage');
+const AWK_SHORT_PLAIN = 'bcCghIMnNOPrsStV';
+const AWK_SHORT_OPTIONAL = 'dDLop';
+// `-W NAME` (mawk, and gawk's spelling of its long options): only these are known, the rest (`-W source=…`, `-W exec=…`) are unknown options.
+const AWK_W_KNOWN = /^(?:v(?:ersion)?|u(?:sage)?|h(?:elp)?|d(?:ump)?|i(?:nteractive)?|p(?:osix_space)?|r(?:andom)?=\d+|s(?:printf)?=\d+|posix|traditional|lint|lint-old|copyright|re-interval|non-decimal-data|optimize|no-optimize|sandbox|bignum|characters-as-bytes|use-lc-numeric|gen-pot|csv)$/;
+const AWK_REGEX_AFTER = new Set(['print', 'printf', 'return', 'else', 'do', 'in', 'delete', 'getline', 'case']);
+const AWK_OPS = ['**=', '|&', '&&', '||', '==', '<=', '>=', '!=', '!~', '++', '--', '+=', '-=', '*=', '/=', '%=', '^=', '**', '>>'];
+const AWK_ESCAPES = { n: '\n', t: '\t', r: '\r', a: '\x07', b: '\b', f: '\f', v: '\v', '\\': '\\', '"': '"', '/': '/' };
+// The tokens of an awk program, or null when it cannot be cut into tokens (an unterminated string or regular expression). A `/` starts a regular
+// expression where an operand is expected and divides after one. awks disagree about a `/` inside a bracket expression (`/[/]/`), so the program is
+// cut twice, once either way, and the commands of both cuttings are read.
+function awkTokens(src, bracketAware) {
+    const out = [];
+    const n = src.length;
+    let i = 0;
+    while (i < n) {
+        const c = src[i];
+        if (c === ' ' || c === '\t' || c === '\r' || c === '\f' || c === '\v') {
+            i += 1;
+            continue;
+        }
+        if (c === '\\' && (src[i + 1] === '\n' || (src[i + 1] === '\r' && src[i + 2] === '\n'))) {
+            i += src[i + 1] === '\n' ? 2 : 3;
+            continue;
+        }
+        if (c === '\n') {
+            out.push({ k: 'nl', v: c });
+            i += 1;
+            continue;
+        }
+        if (c === '#') {
+            while (i < n && src[i] !== '\n')
                 i += 1;
+            continue;
+        }
+        if (c === '"') {
+            let j = i + 1;
+            let v = '';
+            for (;;) {
+                const ch = src[j];
+                if (ch === undefined || ch === '\n')
+                    return null;
+                if (ch === '"')
+                    break;
+                if (ch !== '\\') {
+                    v += ch;
+                    j += 1;
+                    continue;
+                }
+                const e = src[j + 1];
+                if (e === undefined)
+                    return null;
+                j += 2;
+                if (e === '\n')
+                    continue;
+                if (Object.prototype.hasOwnProperty.call(AWK_ESCAPES, e))
+                    v += AWK_ESCAPES[e];
+                else if (e >= '0' && e <= '7') {
+                    let d = e;
+                    while (d.length < 3 && src[j] !== undefined && src[j] >= '0' && src[j] <= '7') {
+                        d += src[j];
+                        j += 1;
+                    }
+                    v += String.fromCharCode(parseInt(d, 8) & 0xff);
+                }
+                else if (e === 'x' && /^[0-9a-fA-F]/.test(src.slice(j, j + 1))) {
+                    const hex = /^[0-9a-fA-F]{1,2}/.exec(src.slice(j, j + 2));
+                    v += String.fromCharCode(parseInt(hex[0], 16));
+                    j += hex[0].length;
+                }
+                else if (e === 'u' && /^[0-9a-fA-F]/.test(src.slice(j, j + 1))) {
+                    // gawk 5.3 reads `\u` and up to eight hex digits as that code point. A run of up to four is the same under every reading; a longer one is
+                    // read as four or as all of them, so it is a text nobody can read here (a mark no literal reading accepts).
+                    const digits = /^[0-9a-fA-F]{1,8}/.exec(src.slice(j, j + 8))[0];
+                    v += digits.length <= 4 ? String.fromCharCode(parseInt(digits, 16)) : DYN;
+                    j += digits.length;
+                }
+                else
+                    v += `\\${e}`;
+            }
+            out.push({ k: 'str', v });
+            i = j + 1;
+            continue;
+        }
+        const prev = out.length ? out[out.length - 1] : null;
+        const operandBefore = prev !== null && (prev.k === 'str' || prev.k === 'num' || prev.k === 'rx' || (prev.k === 'id' && !AWK_REGEX_AFTER.has(prev.v))
+            || (prev.k === 'op' && (prev.v === ')' || prev.v === ']' || prev.v === '++' || prev.v === '--')));
+        if (c === '/' && !operandBefore) {
+            let j = i + 1;
+            let inBracket = false;
+            for (;;) {
+                const ch = src[j];
+                if (ch === undefined || ch === '\n')
+                    return null;
+                if (ch === '\\') {
+                    j += 2;
+                    continue;
+                }
+                if (bracketAware && !inBracket && ch === '[') {
+                    inBracket = true;
+                    j += 1;
+                    if (src[j] === '^')
+                        j += 1;
+                    if (src[j] === ']')
+                        j += 1;
+                    continue;
+                }
+                if (bracketAware && inBracket && ch === ']') {
+                    inBracket = false;
+                    j += 1;
+                    continue;
+                }
+                if (ch === '/' && !inBracket)
+                    break;
+                j += 1;
+            }
+            out.push({ k: 'rx', v: src.slice(i + 1, j) });
+            i = j + 1;
+            continue;
+        }
+        const num = /^(?:0[xX][0-9a-fA-F]+|(?:\d+\.?\d*|\.\d+)(?:[eE][+-]?\d+)?)/.exec(src.slice(i, i + 64));
+        if (num && (c >= '0' && c <= '9' || (c === '.' && src[i + 1] >= '0' && src[i + 1] <= '9'))) {
+            out.push({ k: 'num', v: num[0] });
+            i += num[0].length;
+            continue;
+        }
+        const id = /^[A-Za-z_][A-Za-z0-9_]*(?:::[A-Za-z_][A-Za-z0-9_]*)?/.exec(src.slice(i, i + 256));
+        if (id) {
+            out.push({ k: 'id', v: id[0] });
+            i += id[0].length;
+            continue;
+        }
+        const op = AWK_OPS.find((o) => src.startsWith(o, i));
+        if (op) {
+            out.push({ k: 'op', v: op });
+            i += op.length;
+            continue;
+        }
+        out.push({ k: 'op', v: c });
+        i += 1;
+    }
+    return out;
+}
+const AWK_SPECIAL_VARS = new Set(['ARGC', 'ARGIND', 'ARGV', 'BINMODE', 'CONVFMT', 'ENVIRON', 'ERRNO', 'FIELDWIDTHS', 'FILENAME', 'FNR', 'FPAT', 'FS', 'FUNCTAB', 'IGNORECASE', 'LINT',
+    'NF', 'NR', 'OFMT', 'OFS', 'ORS', 'PREC', 'PROCINFO', 'RLENGTH', 'ROUNDMODE', 'RS', 'RSTART', 'RT', 'SUBSEP', 'SYMTAB', 'TEXTDOMAIN']);
+// Calls that store into an argument: every name inside them is a variable that may hold anything.
+const AWK_WRITERS = new Set(['split', 'sub', 'gsub', 'patsplit', 'asort', 'asorti', 'match']);
+const AWK_BOUND = 400;
+const AWK_ASSIGN_OP = /^(?:[-+*/%^]|\*\*)?=$/;
+// Where a command is named: the statement or group of tokens that follows `from` (an output pipe's command, a variable's value) or precedes it (the
+// command of `CMD | getline`). A token cap ends a statement that is never closed; it leaves a mark that no literal reading accepts.
+function awkAfter(t, from, comma) {
+    const out = [];
+    let depth = 0;
+    for (let j = from; j < t.length; j += 1) {
+        const k = t[j];
+        if (k.k === 'nl') {
+            if (depth === 0)
+                break;
+            continue;
+        }
+        if (k.k === 'op') {
+            if (k.v === '(')
+                depth += 1;
+            else if (k.v === ')') {
+                if (depth === 0)
+                    break;
+                depth -= 1;
+            }
+            else if (depth === 0 && (k.v === ';' || k.v === '}' || (comma && k.v === ',')))
+                break;
+        }
+        out.push(k);
+        if (out.length >= AWK_BOUND) {
+            out.push({ k: 'op', v: '?' });
+            break;
+        }
+    }
+    return out;
+}
+function awkBefore(t, from, comma) {
+    const out = [];
+    let depth = 0;
+    for (let j = from - 1; j >= 0; j -= 1) {
+        const k = t[j];
+        if (k.k === 'nl') {
+            if (depth === 0)
+                break;
+            continue;
+        }
+        if (k.k === 'op') {
+            if (k.v === ')')
+                depth += 1;
+            else if (k.v === '(') {
+                if (depth === 0)
+                    break;
+                depth -= 1;
+            }
+            else if (depth === 0 && (k.v === ';' || k.v === '{' || k.v === '}' || (comma && k.v === ',') || k.v === '&&' || k.v === '||' || k.v === '?' || k.v === ':' || AWK_ASSIGN_OP.test(k.v)))
+                break;
+        }
+        out.push(k);
+        if (out.length >= AWK_BOUND) {
+            out.push({ k: 'op', v: '?' });
+            break;
+        }
+    }
+    return out.reverse();
+}
+// The tokens between the parenthesis at `open` and its match.
+function awkInside(t, open) {
+    const out = [];
+    let depth = 0;
+    for (let j = open; j < t.length; j += 1) {
+        const k = t[j];
+        if (k.k === 'op' && k.v === '(') {
+            depth += 1;
+            if (depth === 1)
                 continue;
+        }
+        if (k.k === 'op' && k.v === ')') {
+            depth -= 1;
+            if (depth === 0)
+                return out;
+        }
+        if (k.k === 'nl')
+            continue;
+        out.push(k);
+        if (out.length >= AWK_BOUND)
+            break;
+    }
+    out.push({ k: 'op', v: '?' });
+    return out;
+}
+function awkFacts(t, taintedNames, all) {
+    const facts = { sinks: [], assigns: new Map(), tainted: new Set(taintedNames), all, indirect: false };
+    const nextOp = (i, re) => t[i + 1] !== undefined && t[i + 1].k === 'op' && re.test(t[i + 1].v);
+    for (let i = 0; i < t.length; i += 1) {
+        const k = t[i];
+        const nx = t[i + 1];
+        const pv = i > 0 ? t[i - 1] : null;
+        if (k.k === 'op') {
+            if (k.v === '@' && nx && nx.k === 'id' && !/^(?:include|load|namespace)$/.test(nx.v))
+                facts.indirect = true;
+            if (k.v === '|' || k.v === '|&') {
+                if (nx && nx.k === 'id' && nx.v === 'getline')
+                    facts.sinks.push({ command: awkBefore(t, i, true) });
+                else {
+                    // `print LIST | CMD`: LIST is back to the `print` or `printf` of this statement.
+                    const before = awkBefore(t, i, false);
+                    const at = before.findIndex((b) => b.k === 'id' && (b.v === 'print' || b.v === 'printf'));
+                    facts.sinks.push({ command: awkAfter(t, i + 1, false), printed: at === -1 ? null : before.slice(at + 1), printf: at !== -1 && before[at].v === 'printf' });
+                }
             }
-            if (f && f.text !== null) {
-                for (const abs of absCandidates(f.text, ctx, run) || []) {
-                    const content = safeRead(run.env, abs, tables_1.LIMITS.maxScriptBytes);
-                    if (content !== null && AWK_EXEC.test(content))
-                        scanInterpreterCode(content, run);
+            continue;
+        }
+        if (k.k !== 'id')
+            continue;
+        if (k.v === 'system') {
+            facts.sinks.push({ command: nx && nx.k === 'op' && nx.v === '(' ? awkInside(t, i + 1) : [{ k: 'op', v: '?' }] });
+            continue;
+        }
+        if ((k.v === 'function' || k.v === 'func') && t[i + 2] && t[i + 2].k === 'op' && t[i + 2].v === '(') {
+            for (const p of awkInside(t, i + 2))
+                if (p.k === 'id')
+                    facts.tainted.add(p.v);
+            continue;
+        }
+        if (AWK_WRITERS.has(k.v) && nx && nx.k === 'op' && nx.v === '(') {
+            for (const p of awkInside(t, i + 1))
+                if (p.k === 'id')
+                    facts.tainted.add(p.v);
+            continue;
+        }
+        if (k.v === 'getline') {
+            // `getline NAME`, `getline NAME < FILE`, `CMD | getline NAME`: NAME holds what was read.
+            if (nx && nx.k === 'id')
+                facts.tainted.add(nx.v);
+            continue;
+        }
+        if ((pv && pv.k === 'op' && (pv.v === '++' || pv.v === '--')) || nextOp(i, /^(?:[-+*/%^]|\*\*)=$|^\+\+$|^--$|^\[$/) || (nx && nx.k === 'id' && nx.v === 'in')) {
+            facts.tainted.add(k.v);
+            continue;
+        }
+        if (nextOp(i, /^=$/) && !(pv && pv.k === 'op' && pv.v === '$')) {
+            const list = facts.assigns.get(k.v) || [];
+            list.push(awkAfter(t, i + 2, true));
+            facts.assigns.set(k.v, list);
+        }
+    }
+    return facts;
+}
+// The values a run of tokens can have when it holds only string literals, numbers and variables that are set only from such values (a variable may
+// also still be unset): one list of values per word of the run, or null when any part is not a literal. An unset or tainted variable, a field, ARGV,
+// ENVIRON, an array element and the result of any call (sprintf, substr, tolower, a function of the program) are not literals.
+function awkWords(tokens, facts, stack) {
+    const words = [];
+    for (const k of tokens) {
+        if (k.k === 'op' && (k.v === '(' || k.v === ')'))
+            continue;
+        if (k.k === 'str' || k.k === 'num') {
+            words.push([k.v]);
+            continue;
+        }
+        if (k.k !== 'id')
+            return null;
+        const values = awkVariable(k.v, facts, stack);
+        if (values === null)
+            return null;
+        words.push(values);
+    }
+    return words;
+}
+function awkVariable(name, facts, stack) {
+    const written = facts.assigns.get(name);
+    if (facts.all || AWK_SPECIAL_VARS.has(name) || facts.tainted.has(name) || !written || stack.has(name))
+        return null;
+    stack.add(name);
+    const values = new Set(['']);
+    try {
+        for (const value of written) {
+            const words = awkWords(value, facts, stack);
+            const joined = words === null ? null : awkJoin(words, 0, words.length);
+            if (joined === null)
+                return null;
+            for (const v of joined)
+                values.add(v);
+            if (values.size > 32)
+                return null;
+        }
+    }
+    finally {
+        stack.delete(name);
+    }
+    return [...values];
+}
+// Every text that words[from..to) can spell, or null past 64 of them.
+function awkJoin(words, from, to) {
+    let out = [''];
+    for (let i = from; i < to; i += 1) {
+        if (out.length * words[i].length > 64)
+            return null;
+        out = out.flatMap((head) => words[i].map((w) => head + w));
+    }
+    return out;
+}
+// What a program may print into without the words it prints being run: a command that only reads its input and writes it out. A fail-closed list: any other
+// command (a shell by any name or wrapper, an interpreter, `env`, `xargs`, a program nobody knows) may run what it is given, so the words printed into it are
+// judged as the commands they would be. A bare name or one in a system bin folder, plain words and plain redirects only; `sort --compress-program=PROG` and
+// `less +!CMD` run a program of their own.
+const AWK_READERS = new Set(['cat', 'tee', 'sort', 'uniq', 'wc', 'grep', 'egrep', 'fgrep', 'head', 'tail', 'less', 'more', 'cut', 'tr', 'column', 'nl', 'rev', 'fold', 'paste', 'tac']);
+function awkReaderSink(text) {
+    if (text.trim() === '')
+        return true;
+    const parsed = safeParse(text, { depth: 1 });
+    if (!parsed.ok || parsed.dynamic || parsed.reasons.length > 0 || parsed.substitutions.length > 0 || parsed.commands.length === 0 || parsed.commands.length > 8)
+        return false;
+    const plain = (w) => !w.dynamic && !w.substitution && !w.glob;
+    return parsed.commands.every((c) => {
+        if (c.words.length === 0 || c.assignments.length > 0 || c.heredoc !== null || c.forLoop !== undefined || !c.words.every(plain))
+            return false;
+        // A command word that starts with `-` names no program (a command variable that may still be unset reads ` -u`).
+        if (c.words[0].text.startsWith('-'))
+            return true;
+        const m = /^(?:\/usr\/bin\/|\/bin\/)?([a-z]+)$/.exec(c.words[0].text);
+        if (!m || !AWK_READERS.has(m[1]))
+            return false;
+        // getopt takes any prefix of a long option that only one option starts with: `sort --compr=PROG` and `sort --co PROG` are `--compress-program`.
+        if (c.words.slice(1).some((w) => /compress-program/.test(w.text) || (m[1] === 'sort' && w.text.startsWith('--co')) || ((m[1] === 'less' || m[1] === 'more') && w.text.startsWith('+'))))
+            return false;
+        return c.redirects.every((r) => /^(?:>|>>|<|>&)$/.test(r.op) && r.target !== null && plain(r.target));
+    });
+}
+// The items of a print list (the tokens between its commas), each as the words it can be, or null when any item is not made of literals.
+function awkItems(printed, facts) {
+    const items = [[]];
+    for (const t of printed) {
+        if (t.k === 'op' && t.v === ',')
+            items.push([]);
+        else
+            items[items.length - 1].push(t);
+    }
+    const out = [];
+    for (const item of items) {
+        const words = awkWords(item, facts, new Set());
+        if (words === null)
+            return null;
+        out.push(words);
+    }
+    return out;
+}
+// Every place a program starts a command is `system(CMD)`, `print … | CMD`, `printf … | CMD` or `CMD | getline` (and gawk's `|&`). A CMD made only of
+// literals is a command line, judged like a nested shell string: the same stop the direct command gets (every part of a concatenation is judged
+// too, since awks differ on what `"a" "b" | getline` runs). Any other CMD is a command nobody can read here (ARGV, ENVIRON, a -v or NAME=VALUE
+// variable, a field, a value read by getline, a call such as sprintf): a stop. Words printed into a shell are the commands it runs: they must be
+// literals too.
+function awkCommandSinks(program, words, taintedNames, taintAll, ctx, run, x) {
+    if (!/\||\bsystem\b|@/.test(program))
+        return;
+    let dynamic = false;
+    const judged = new Set();
+    const judge = (texts) => {
+        if (texts === null) {
+            dynamic = true;
+            return;
+        }
+        for (const text of texts) {
+            if (text.includes(DYN)) {
+                dynamic = true;
+                continue;
+            }
+            if (text.trim() === '' || judged.has(text))
+                continue;
+            judged.add(text);
+            if (judged.size > 96) {
+                dynamic = true;
+                return;
+            }
+            evalShell(text, childCtx(ctx), run);
+        }
+    };
+    const judgeWords = (w, slices) => {
+        judge(awkJoin(w, 0, w.length));
+        if (!slices || w.length < 2 || w.length > 6)
+            return;
+        for (let a = 0; a < w.length; a += 1)
+            for (let b = a + 1; b <= w.length; b += 1)
+                if (b - a < w.length)
+                    judge(awkJoin(w, a, b));
+    };
+    // The line a `print` or `printf` writes into a command that is not a known reader: the command may run it, so it must be made of literals and is judged as
+    // the shell string it is. A print list is written with OFS (a space) between its words, and is also read with nothing between them. A `%` in a printf format
+    // is a conversion that puts something else in the line (`%c`, `%s`): a stop. OFS set by the program or the command line is not a space nobody can rely on: a stop.
+    const judgePrinted = (sink, facts) => {
+        const lists = sink.printed ? awkItems(sink.printed, facts) : null;
+        // A bare `print` prints the input line: not a literal.
+        if (lists === null || lists.every((l) => l.length === 0)) {
+            dynamic = true;
+            return;
+        }
+        if (sink.printf) {
+            const format = awkJoin(lists[0], 0, lists[0].length);
+            if (format === null || format.some((f) => f.includes('%'))) {
+                dynamic = true;
+                return;
+            }
+        }
+        judgeWords(lists.flat(), true);
+        if (lists.length < 2)
+            return;
+        if (facts.all || facts.tainted.has('OFS') || facts.assigns.has('OFS')) {
+            dynamic = true;
+            return;
+        }
+        const spaced = [];
+        lists.forEach((l, k) => { if (k > 0)
+            spaced.push([' ']); spaced.push(...l); });
+        judge(awkJoin(spaced, 0, spaced.length));
+        for (const l of lists)
+            judge(awkJoin(l, 0, l.length));
+    };
+    if (program.length > 65536)
+        dynamic = true;
+    else {
+        for (const bracketAware of [true, false]) {
+            const tokens = awkTokens(program, bracketAware);
+            if (tokens === null) {
+                dynamic = true;
+                continue;
+            }
+            const facts = awkFacts(tokens, taintedNames, taintAll);
+            if (facts.indirect)
+                dynamic = true;
+            for (const sink of facts.sinks) {
+                const w = awkWords(sink.command, facts, new Set());
+                if (w === null || w.length === 0) {
+                    dynamic = true;
+                    continue;
+                }
+                judgeWords(w, true);
+                if (sink.printed !== undefined) {
+                    const command = awkJoin(w, 0, w.length);
+                    if (command === null || !command.every(awkReaderSink))
+                        judgePrinted(sink, facts);
                 }
             }
+        }
+    }
+    if (!dynamic)
+        return;
+    // The reason first: a command-line word, a -v or NAME=VALUE value, or an environment value that is itself a stopped command.
+    if (!ctx.backstop)
+        scanArgvForCommands(words, ctx, run, x);
+    for (const values of x.env.values())
+        if (values !== null)
+            for (const v of values)
+                if (/\S/.test(v))
+                    evalShell(v, childCtx(ctx), run);
+    worseParse(run, 'dynamic');
+    hit(run, 'Sx', 'dynamic_awk_command');
+}
+// A word with no readable text: it is wholly a variable, a substitution or a parameter default. The word parser ends `${P:-BEGIN{…}}` at its first `}`, which
+// leaves a closing brace that nothing opened; no awk program text has that, so such a word is read as unreadable too.
+function awkUnreadable(a) {
+    if (a.text !== null)
+        return false;
+    const literal = a.pattern.split(DYN).join('');
+    if (literal.trim() === '')
+        return true;
+    let depth = 0;
+    for (const ch of literal) {
+        if (ch === '{')
+            depth += 1;
+        else if (ch === '}') {
+            if (depth === 0)
+                return true;
+            depth -= 1;
+        }
+    }
+    return false;
+}
+// The word that awk programs were read from before the options were parsed: the first word that is not an option or the value of one.
+function awkOlderProgram(rest) {
+    const valued = new Set(['-F', '-v', '-W', '--field-separator', '--assign', '-i', '-l', '--include', '--load']);
+    for (let i = 0; i < rest.length; i += 1) {
+        const t = rest[i].text;
+        if (t === '-f' || t === '--file' || (t !== null && valued.has(t))) {
             i += 1;
             continue;
         }
-        if (t !== null && vf.has(t)) {
+        if (t !== null && t.startsWith('-') && t.length > 1)
+            continue;
+        return rest[i];
+    }
+    return null;
+}
+function awkProgram(rest, ctx, run, x) {
+    const texts = [];
+    const assigned = [];
+    let anyAssign = false;
+    let unread = false;
+    // A word that may be the program itself and cannot be read (`awk "${P:-…}"`): judged like the code of `python3 -c "$P"`, by the whole command text.
+    let unreadCode = false;
+    // ... and when it is code for certain (`-e "$P"`, the word after `--`) or one word that is not a list of options (a quoted `"$P"`), as that code is a stop.
+    // An unquoted `$OPTS` before a program may be options, which word splitting turns into several words: it is judged by name only.
+    let unreadHit = false;
+    let programFile = false;
+    // The text of a program word: its literal text, or its pattern (an unreadable part is DYN, never nothing). Never its `alts`: the word
+    // parser brace-expands a quoted `{a,b}`, so a program with a comma inside braces has no single text but its pattern is the program.
+    const programTexts = (a) => [a.text !== null ? a.text : a.pattern];
+    // A program or program file that is a substitution (`awk -f <(…)`, `awk "$(…)"`) is read like one given to an interpreter.
+    const substituted = (a) => { if (a.word && a.word.substitution)
+        checkSubstitutionExec(x.info.subs, ctx, run, true); };
+    const source = (a) => {
+        if (!a)
+            return;
+        substituted(a);
+        programFile = true;
+        // `awk -e "$P"`: a program that is wholly a variable or a substitution is code nobody can read.
+        if (awkUnreadable(a)) {
+            unread = true;
+            unreadCode = true;
+            unreadHit = true;
+        }
+        for (const text of programTexts(a))
+            texts.push([text, true]);
+    };
+    const file = (a) => {
+        programFile = true;
+        if (!a)
+            return;
+        substituted(a);
+        // `awk -f -`: the program arrives on stdin.
+        if (a.text !== null && (a.text === '-' || STDIN_PATHS.has(a.text))) {
+            const src = stdinSource(x, ctx, run);
+            for (const text of src.texts)
+                texts.push([text, false]);
+            if (src.unknown || (src.texts.length === 0 && src.files.length === 0)) {
+                worseParse(run, 'dynamic');
+                hit(run, 'Sx', 'dynamic_stdin_code');
+            }
+            return;
+        }
+        // A program file is read like any script: one that cannot be read is an unread script, as for `python3 prog.py`. A path that is not literal is
+        // `python3 "$S"`: the words of the command line are all that can be judged.
+        if (a.text === null) {
+            unread = true;
+            return;
+        }
+        for (const abs of absCandidates(a.text, ctx, run) || []) {
+            const content = safeRead(run.env, abs, tables_1.LIMITS.maxScriptBytes);
+            if (content !== null)
+                texts.push([content, false]);
+        }
+    };
+    const assign = (a) => {
+        if (!a || a.text === null) {
+            anyAssign = true;
+            return;
+        }
+        const m = /^([A-Za-z_][A-Za-z0-9_]*)=/.exec(a.text);
+        if (m)
+            assigned.push(m[1]);
+    };
+    const wordList = [];
+    const unknown = () => { hit(run, 'Sx', 'awk_unknown_option'); };
+    let i = 0;
+    for (; i < rest.length; i += 1) {
+        const a = rest[i];
+        let t = a.text;
+        if (t === null) {
+            // A word nobody can read may be an option, its value or the program: it is judged by name (unread), and the options go on after it.
+            if (awkUnreadable(a)) {
+                unread = true;
+                unreadCode = true;
+                if (a.word && a.word.quoted)
+                    unreadHit = true;
+                substituted(a);
+                continue;
+            }
+            // A program with a dynamic part (`awk "NR==$N"`) ends the options; an option with one (`-F$SEP`) is read from its pattern.
+            if (!a.pattern.startsWith('-'))
+                break;
+            t = a.pattern;
+        }
+        if (t === '--') {
             i += 1;
+            break;
+        }
+        if (t === '-' || !t.startsWith('-'))
+            break;
+        if (t.startsWith('--')) {
+            const eq = t.indexOf('=');
+            const name = eq === -1 ? t.slice(2) : t.slice(2, eq);
+            const mode = AWK_LONG.get(name);
+            if (mode === undefined || (eq !== -1 && mode === 'n')) {
+                unknown();
+                continue;
+            }
+            let value;
+            if (mode === 'v') {
+                if (eq === -1) {
+                    value = rest[i + 1];
+                    i += 1;
+                }
+                else
+                    value = litArg(t.slice(eq + 1));
+            }
+            else if (eq !== -1)
+                value = litArg(t.slice(eq + 1));
+            if (name === 'file' || name === 'exec')
+                file(value);
+            else if (name === 'source')
+                source(value);
+            else if (name === 'assign') {
+                assign(value);
+                if (value)
+                    wordList.push(value);
+            }
             continue;
         }
-        if (t !== null && t.startsWith('-') && t.length > 1)
+        // `-version` and `-safe` are the one-true-awk's single-dash long options.
+        if (t === '-version' || t === '-safe')
             continue;
-        program = rest[i];
-        break;
+        for (let c = 1; c < t.length; c += 1) {
+            const ch = t[c];
+            if (AWK_SHORT_PLAIN.includes(ch))
+                continue;
+            if (AWK_SHORT_OPTIONAL.includes(ch))
+                break;
+            if (!'fFeEvilW'.includes(ch)) {
+                unknown();
+                break;
+            }
+            const attached = t.slice(c + 1);
+            const value = attached !== '' ? litArg(attached) : rest[i + 1];
+            if (attached === '')
+                i += 1;
+            if (ch === 'f' || ch === 'E')
+                file(value);
+            else if (ch === 'e')
+                source(value);
+            else if (ch === 'v') {
+                assign(value);
+                if (value)
+                    wordList.push(value);
+            }
+            else if (ch === 'W') {
+                const w = value && value.text !== null ? value.text : null;
+                if (w !== null && /^e(?:xec)?$/.test(w)) {
+                    file(rest[i + 1]);
+                    i += 1;
+                }
+                else if (w === null || !AWK_W_KNOWN.test(w))
+                    unknown();
+            }
+            break;
+        }
     }
-    if (!program)
-        return;
-    const code = program.text !== null ? program.text : argText(program);
-    if (AWK_EXEC.test(code)) {
-        scanInterpreterCode(code, run);
+    // The program is the first operand unless -f or -e gave it; the others are files and NAME=VALUE assignments.
+    let operands = rest.slice(i);
+    if (!programFile && operands.length > 0) {
+        const program = operands[0];
+        operands = operands.slice(1);
+        substituted(program);
+        if (awkUnreadable(program)) {
+            unread = true;
+            unreadCode = true;
+            unreadHit = true;
+        }
+        for (const text of programTexts(program))
+            texts.push([text, true]);
+    }
+    // The word the older reading took as the program stays one more program text, so a command line the two read differently (`awk -- -e 'PROGRAM'`,
+    // `awk -f prog.awk 'PROGRAM'`: awk reads those words as file names) is never judged less than it was.
+    const older = awkOlderProgram(rest);
+    if (older)
+        for (const text of programTexts(older))
+            if (!texts.some(([t]) => t === text))
+                texts.push([text, true]);
+    for (const o of operands) {
+        if (o.text === null) {
+            anyAssign = true;
+            wordList.push(o);
+            continue;
+        }
+        if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(o.text)) {
+            assign(o);
+            wordList.push(o);
+        }
+        else
+            wordList.push(o);
+    }
+    // A program that cannot be read: the words of its command line are judged by name, as for an interpreter given a script it cannot read.
+    if (unread) {
+        worseParse(run, 'dynamic');
+        tripwire(rest.map(argText).join(' '), run);
+    }
+    if (unreadCode) {
+        tripwire(run.topSource.slice(0, tables_1.LIMITS.maxCommandBytes), run);
+        if (unreadHit)
+            hit(run, 'Sx', 'dynamic_interpreter_code');
+    }
+    // What base read of each program text it was given stays as it was; the commands it names are then read from all of them as one program.
+    for (const [raw, inline] of texts) {
+        const text = raw.split(DYN).join('');
+        if (!AWK_EXEC.test(text))
+            continue;
+        scanInterpreterCode(text, run);
+        awkArgvCommands(text, rest, ctx, run, x);
         // `awk '{system($0)}'` runs the lines it reads: the input is a command text (audit N1).
-        if (/\bsystem\s*\(|\|\s*&?\s*["'$a-zA-Z(]|\bgetline\b/.test(code))
+        if (inline && /\bsystem\s*\(|\|\s*&?\s*["'$a-zA-Z(]|\bgetline\b/.test(text))
             stdinExec('sh', [], x, ctx, run);
     }
+    awkCommandSinks(texts.map(([text]) => text).join('\n'), wordList, assigned, anyAssign, ctx, run, x);
 }
 // GNU sed runs a command with the `e` command and the `s///e` flag.
 function sedProgram(rest, ctx, run) {
@@ -8290,19 +9449,119 @@ function handleGit(rest, ctx, run, x, cOverrides, aliasDepth) {
         hit(run, 'S4', 'git_credential_get');
         return;
     }
-    if (!tables_1.GIT_S4_EXEMPT_SUBS.has(sub)) {
-        // Commit messages are prose, never paths.
+    // `git log` prints names and messages, but with patch output it prints the content of the files it
+    // names, as `git show` does: then its operands are read like those of `git show`.
+    if (!tables_1.GIT_S4_EXEMPT_SUBS.has(sub) || (sub === 'log' && gitLogPrintsPatch(args))) {
+        // Commit messages are prose, never paths. A pathspec after `--` or a `REV:path` object is read from history.
+        // log, whatchanged and format-patch take no message: their -m and -F are flags, and the next word is read.
+        const prose = !GIT_PATCH_LOG_SUBS.has(sub);
+        const dashDash = args.findIndex((a) => a.text === '--');
+        const patterns = sub === 'grep' ? searchPatternArgs(args, dashDash >= 0 ? dashDash : args.length) : null;
         for (let k = 0; k < args.length; k += 1) {
             const t = args[k].text;
-            if (t === '-m' || t === '--message' || t === '-F' || t === '--file' || (t !== null && /^-[a-zA-Z]*m$/.test(t))) {
+            if (prose && (t === '-m' || t === '--message' || t === '-F' || t === '--file' || (t !== null && /^-[a-zA-Z]*m$/.test(t)))) {
                 k += 1;
                 continue;
             }
-            if (t !== null && /^(?:--message=|-m.)/.test(t))
+            if (prose && t !== null && /^(?:--message=|-m.)/.test(t))
                 continue;
-            checkSecretOperand(args[k], gctx, run, 'git_operand');
+            const history = (dashDash >= 0 && k > dashDash) || t === null || /^[^/:]+:/.test(t);
+            checkSecretOperand(args[k], gctx, run, 'git_operand', history, patterns !== null && patterns.has(args[k]));
+            // `-L<range>:<file>` (or `-L <range>:<file>`) prints the history of <file>: every part after a colon is read.
+            if (!prose && t !== null && /^-L/.test(t) && (dashDash < 0 || k < dashDash)) {
+                const value = t === '-L' ? (args[k + 1] ? args[k + 1].text : null) : t.slice(2);
+                if (value !== null) {
+                    for (let c = value.indexOf(':'); c >= 0; c = value.indexOf(':', c + 1)) {
+                        if (c + 1 < value.length)
+                            checkSecretOperand(litArg(value.slice(c + 1)), gctx, run, 'git_operand', true);
+                    }
+                }
+            }
+        }
+    }
+}
+// Subcommands whose output can be the patches of the files they name; none takes a commit message.
+const GIT_PATCH_LOG_SUBS = new Set(['log', 'whatchanged', 'format-patch']);
+// Long options of `git log` that print patches (each implies --patch, or prints changed lines: --check).
+const GIT_LOG_PATCH_LONG = new Set(['--patch', '--patch-with-stat', '--patch-with-raw', '--unified', '--binary', '--check', '--cc', '--dd',
+    '--remerge-diff', '--combined']);
+// Words that never take the next word as their value (so a `-s` after one of them is an option).
+const GIT_LOG_FLAG_WORDS = new Set([...GIT_LOG_PATCH_LONG, '-p', '-u', '-s', '-c', '-m', '--no-patch', '--oneline', '--stat', '--all', '--follow',
+    '--graph', '--reverse', '--first-parent', '--no-merges', '--merges', '--name-only', '--name-status', '--raw', '--numstat', '--shortstat',
+    '--summary', '--decorate', '--full-diff', '--color', '--no-color', '--abbrev-commit', '--no-abbrev-commit', '--topo-order', '--date-order',
+    '--no-renames', '--no-ext-diff', '--no-textconv', '--no-diff-merges']);
+// Whether `git log <args>` prints patches. On: -p, -u, --patch, -U<n>, --unified, -L, --binary, --check, -c,
+// --cc, --dd, --remerge-diff, --diff-merges=<format> other than off/none, --patch-with-stat/raw, a short cluster
+// with p, u, U or L (`-sp`), a word the mapper cannot read, and any long option not on the read list (git takes
+// no abbreviation here, so it cannot be a known one). Off: -s or --no-patch after the last of them, only where the
+// word cannot be the value of the word before it (`--author -s`) and only before --end-of-options. A word after
+// `--` is a pathspec (`git log -- -p`).
+function gitLogPrintsPatch(args) {
+    let on = false;
+    let offs = true;
+    // A word that is not an option itself or holds its value (`--author=x`, `-n5`, `-Sx`) takes no next word.
+    const mayTakeNext = (k) => {
+        if (k < 0)
+            return false;
+        const p = args[k].text;
+        if (p === null)
+            return true;
+        if (!p.startsWith('-') || p === '-' || p.includes('=') || GIT_LOG_FLAG_WORDS.has(p))
+            return false;
+        if (p.startsWith('--'))
+            return true;
+        const m = p.slice(1).match(/[SGOIlLnU]/);
+        return m !== null && m.index === p.length - 2;
+    };
+    for (let k = 0; k < args.length; k += 1) {
+        const t = args[k].text;
+        if (t === '--')
+            break;
+        if (t === null) {
+            on = true;
+            continue;
+        }
+        if (t === '--end-of-options') {
+            offs = false;
+            continue;
+        }
+        const off = offs && !mayTakeNext(k - 1);
+        if (t === '-c' || t === '--no-patch') {
+            if (t === '-c')
+                on = true;
+            else if (off)
+                on = false;
+            continue;
+        }
+        if (t.startsWith('--')) {
+            const eq = t.indexOf('=');
+            const name = eq === -1 ? t : t.slice(0, eq);
+            if (GIT_LOG_PATCH_LONG.has(name))
+                on = true;
+            else if (name === '--diff-merges') {
+                if (!/^--diff-merges=(?:off|none)$/.test(t))
+                    on = true;
+            }
+            else if (t.length > 2 && (0, longopts_1.unknownLong)([args[k]], longopts_1.GIT_READ_LONG, 2, false) !== -1)
+                on = true;
+            continue;
+        }
+        // A short word or cluster, left to right: p, u, U<n> and L<range> print patches, s stops them; a letter
+        // that takes a value ends the word (`-Sfoo`, `-n5`).
+        if (/^-[A-Za-z]/.test(t)) {
+            for (const ch of t.slice(1)) {
+                if (ch === 'p' || ch === 'u' || ch === 'U' || ch === 'L')
+                    on = true;
+                else if (ch === 's') {
+                    if (off)
+                        on = false;
+                }
+                if (/[^A-Za-z]|[SGOIlLnUMCBX]/.test(ch))
+                    break;
+            }
         }
     }
+    return on;
 }
 // Options that hand git a command to run: rebase --exec, filter-branch filters, bisect run, submodule
 // foreach, and the pack programs of fetch and push.
@@ -9871,7 +11130,249 @@ function handleHelm(rest, ctx, run) {
 function emptyExec() {
     return { cmd: { words: [], assignments: [], redirects: [], heredoc: null, heredocDynamic: false, pipedInput: false, pipesOutput: false, background: false, subshell: false }, info: { upstream: [], ansiC: false, subs: [] }, env: new Map() };
 }
+// ---------------------------------------------------------------------------------------------
+// S4: a secret env file named in a container bind mount, a find primary or the stage that feeds xargs (the stop a plain `cat .env.local` already has).
+// Only an env file counts here (envOnly): `.env`, `.env.<word>` (never a template), `.dev.vars`, and `<name>.env` where it is there. A mount or a listing
+// of a FOLDER that holds one is not a stop (a folder mount such as `-v $PWD:/app` is common), and no program is added to the readers: the command that gets
+// the name is a reader when it is not one of S4_EXEMPT_PROGRAMS, as for `find -exec`.
+/** The samples a glob or a partly dynamic path is judged against when only env files count: the env-family samples and the common names, per working folder. */
+function envSamples(run, ctx) {
+    const out = (0, tables_1.secretSamples)(run.home, cwdsList(ctx)).filter((s) => (0, env_names_1.secretEnvBase)((0, env_names_1.lastSegment)(s)) !== null);
+    for (const c of cwdsList(ctx))
+        for (const n of env_names_1.ENV_NAME_CORPUS)
+            out.push(`${c.replace(/\/$/, '')}/${n}`);
+    return out;
+}
+/** The readings of an argument: its known values (a loop variable, a brace list) and its dynamic form. */
+function argVariants(a) {
+    if (a.text !== null)
+        return [a];
+    const out = a.alts ? a.alts.map((v) => ({ ...litArg(v), glob: a.glob, word: a.word })) : [];
+    out.push(a);
+    return out;
+}
+/** The part of an argument from `from` to `to`: a literal stays a literal, a dynamic word keeps its dynamic slots. */
+function subArg(a, from, to) {
+    if (a.text !== null)
+        return { ...litArg(a.text.slice(from, to)), glob: a.glob, word: a.word };
+    const pattern = a.pattern.slice(from, to);
+    return pattern.includes(DYN) ? { text: null, alts: null, pattern, glob: a.glob, word: null, nonAscii: a.nonAscii } : { ...litArg(pattern), glob: a.glob };
+}
+/** Whether a word names a secret env file anywhere in it: a piece between separators is one by name (a dynamic slot ends the piece, so `.env.$X` is). */
+function namesSecretEnv(text) {
+    return text.split(/[\s,:=/;|&()<>"'`]+/).some((piece) => piece !== '' && (0, env_names_1.secretEnvBase)(piece) === 'secret');
+}
+/** A path (the host side of a mount, a find start, a word a stage lists) that is a secret env file, a glob that can name one, or a dynamic path that ends in one. */
+function checkEnvHost(h, ctx, run, reason) {
+    for (const v of argVariants(h)) {
+        if (checkSecretOperand(v, ctx, run, reason, false, false, true))
+            return true;
+        const seg = (0, env_names_1.lastSegment)(v.text !== null ? v.text : v.pattern);
+        if (seg === '')
+            continue;
+        const hasDyn = seg.includes(DYN);
+        const hasGlob = v.glob && /[*?[]/.test(seg);
+        if (!hasDyn && !hasGlob) {
+            // A literal name, whatever the case and whatever is in front of it; `<name>.env` is judged by the file being there unless the folder is not known.
+            const kind = (0, env_names_1.secretEnvBase)(seg);
+            if (kind === 'secret' || (kind === 'present' && v.text === null))
+                return hit(run, 'S4', `${reason}_secret_name`);
+            continue;
+        }
+        if (!/[^*?[\]\u0001]/.test(seg))
+            continue;
+        const re = patternToRegex(seg, false);
+        if (env_names_1.ENV_NAME_CORPUS.some((n) => re.test(n)))
+            return hit(run, 'S4', `${reason}_secret_pattern`);
+    }
+    return false;
+}
+/**
+ * The bind-mount flags of a docker or podman command line, wherever they stand (an unknown flag or a word it takes never hides one; a flag that is part of the
+ * container's own command line can only add a stop): `-v`, `--volume` and `--mount` in every spelling (`-vX`, `-v=X`, `--volume=X`, `-itv X`), every repeat.
+ * The host side of each is the path the container reads. A value that cannot be read (a dynamic word with no colon, no `source=`) on a line that names a secret
+ * env file anywhere is a stop.
+ */
+function dockerMountChecks(rest, ctx, run) {
+    let unresolved = false;
+    const sourceArg = (v, text) => (text.includes(DYN) ? { text: null, alts: null, pattern: text, glob: v.glob, word: null, nonAscii: v.nonAscii } : { ...litArg(text), glob: v.glob });
+    const hostsOf = (kind, value) => {
+        const hosts = [];
+        for (const v of argVariants(value)) {
+            const raw = v.text !== null ? v.text : v.pattern;
+            if (kind === 'volume') {
+                const host = (0, env_names_1.volumeHost)(raw);
+                if (host !== null)
+                    hosts.push(subArg(v, 0, host.length));
+                else if (v.text === null) {
+                    hosts.push(v);
+                    unresolved = true;
+                }
+            }
+            else {
+                const sources = (0, env_names_1.mountSources)(raw);
+                for (const s of sources)
+                    hosts.push(sourceArg(v, s));
+                if (sources.length === 0 && v.text === null)
+                    unresolved = true;
+            }
+        }
+        return hosts;
+    };
+    for (let k = 0; k < rest.length; k += 1) {
+        if (clock(run))
+            return;
+        const a = rest[k];
+        const t = a.text !== null ? a.text : a.pattern;
+        let kind = null;
+        let value = null;
+        if (t === '-v' || t === '--volume') {
+            kind = 'volume';
+            value = rest[k + 1] || null;
+        }
+        else if (t === '--mount') {
+            kind = 'mount';
+            value = rest[k + 1] || null;
+        }
+        else if (t.startsWith('--volume=') || t.startsWith('--mount=')) {
+            kind = t.startsWith('--mount') ? 'mount' : 'volume';
+            value = subArg(a, t.indexOf('=') + 1);
+        }
+        else if (!t.startsWith('--') && /^-[A-Za-z]*v/.test(t)) {
+            const at = t.indexOf('v');
+            kind = 'volume';
+            value = at + 1 >= t.length ? rest[k + 1] || null : subArg(a, at + 1 + (t[at + 1] === '=' ? 1 : 0));
+        }
+        if (kind === null || value === null)
+            continue;
+        for (const h of hostsOf(kind, value))
+            if (checkEnvHost(h, ctx, run, 'docker_mount'))
+                return;
+    }
+    if (unresolved && rest.some((a) => namesSecretEnv(argText(a))))
+        hit(run, 'S4', 'docker_mount_unresolved_secret_name');
+}
+// `find` options that take a pattern for the name of a file, and the names a -regex pattern is tried against (the common secret env names).
+const FIND_NAME_PRIMARIES = new Set(['-name', '-iname', '-path', '-ipath', '-wholename', '-iwholename']);
+const ENV_REGEX_NAMES = [...new Set([...env_names_1.ENV_NAME_CORPUS, '.env', '.env.local', '.env.production', '.dev.vars', 'app.env'])];
+/** The start points and the expression of a find command line. */
+function splitFind(rest) {
+    const starts = [];
+    let i = 0;
+    while (i < rest.length && rest[i].text !== null && /^-[HLP]$|^-O\d$|^-D$/.test(rest[i].text))
+        i += rest[i].text === '-D' ? 2 : 1;
+    while (i < rest.length) {
+        const t = rest[i].text;
+        if (t !== null && (t.startsWith('-') || t === '(' || t === '!' || t === ')'))
+            break;
+        starts.push(rest[i]);
+        i += 1;
+    }
+    if (starts.length === 0)
+        starts.push(litArg('.'));
+    return { starts, expr: rest.slice(i) };
+}
+// Whether a regex pattern's own text mentions env (a backslash, bracket or group mark inside the word does not hide it).
+const regexMentionsEnv = (text) => /env/i.test(text.replace(/[\\[\]()|?\u0001]/g, ''));
+/** A `-regex` pattern that matches the path of a secret env file under a start point (read as emacs and as extended syntax by a bounded matcher). */
+function findRegexNamesEnv(pat, starts, run) {
+    for (const v of argVariants(pat)) {
+        if (v.text === null) {
+            if (regexMentionsEnv(v.pattern))
+                return true;
+            continue;
+        }
+        const bases = new Set();
+        for (const st of starts)
+            if (st.text !== null) {
+                bases.add(st.text.replace(/\/+$/, '') || '/');
+                const e = expandTilde(st.text, run);
+                if (e !== null)
+                    bases.add(e.replace(/\/+$/, '') || '/');
+            }
+        const candidates = [];
+        for (const b of bases)
+            for (const n of ENV_REGEX_NAMES)
+                candidates.push(`${b}/${n}`, `${b}/d/${n}`, `${b}/d/e/${n}`);
+        const answer = (0, env_names_1.regexMatchesAny)(v.text, candidates);
+        if (answer === 'yes' || (answer === 'unsure' && regexMentionsEnv(v.text)))
+            return true;
+    }
+    return false;
+}
+/**
+ * A find expression that selects a secret env file: a start point that is one, a name, path or regex primary that matches one. The caller says whether what
+ * find hands the files to reads them (`-exec`, or a command after `xargs`).
+ */
+function findEnvNames(starts, expr, ctx, run) {
+    for (const st of starts)
+        if (checkEnvHost(st, ctx, run, 'find_start'))
+            return true;
+    for (let k = 0; k + 1 < expr.length; k += 1) {
+        const t = expr[k].text;
+        if (t === null)
+            continue;
+        if (t === '-regex' || t === '-iregex') {
+            if (findRegexNamesEnv(expr[k + 1], starts, run))
+                return hit(run, 'S4', 'find_exec_secret_name');
+            continue;
+        }
+        // `-samefile <file>` selects the file that is named (and every link to it): the name is judged as a start point is.
+        if (t === '-samefile') {
+            if (checkEnvHost(expr[k + 1], ctx, run, 'find_start'))
+                return true;
+            continue;
+        }
+        if (!FIND_NAME_PRIMARIES.has(t))
+            continue;
+        const pathLike = t.includes('path') || t.includes('wholename');
+        for (const v of argVariants(expr[k + 1])) {
+            const seg = pathLike ? (0, env_names_1.lastSegment)(v.text !== null ? v.text : v.pattern) : (v.text !== null ? v.text : v.pattern);
+            if (seg === '')
+                continue;
+            if (!seg.includes(DYN) && !/[*?[]/.test(seg)) {
+                if ((0, env_names_1.secretEnvBase)(seg) !== null)
+                    return hit(run, 'S4', 'find_exec_secret_name');
+                continue;
+            }
+            // Only wildcards (`*`) are judged by the samples the find rule already has.
+            if (!/[^*?[\]\u0001]/.test(seg))
+                continue;
+            const re = patternToRegex(seg, false);
+            if (env_names_1.ENV_NAME_CORPUS.some((n) => re.test(n)))
+                return hit(run, 'S4', 'find_exec_secret_name');
+        }
+    }
+    return false;
+}
+/**
+ * `ls .env* | xargs cat`, `printf '%s\n' .env.local | xargs head`, `find . -name .env.staging | xargs cat`: a stage in front of xargs that lists a secret
+ * env file (by name or by a glob that matches one), whatever the stages between, feeds a command that reads what it is given. Called only for such a command.
+ */
+function xargsUpstreamEnv(x, ctx, run) {
+    for (const stage of x.info.upstream) {
+        if (clock(run))
+            return;
+        const words = stage.words.map((w) => resolveWord(w, ctx, run));
+        const prog = words[0] ? progName(words[0], run) : null;
+        if (prog === 'find') {
+            const { starts, expr } = splitFind(words.slice(1));
+            if (findEnvNames(starts, expr, ctx, run))
+                return;
+            continue;
+        }
+        if (prog !== 'ls' && prog !== 'printf' && prog !== 'echo')
+            continue;
+        for (const a of words.slice(1)) {
+            if (a.text !== null && a.text.length > 1 && a.text.startsWith('-'))
+                continue;
+            if (checkEnvHost(a, ctx, run, 'xargs_input'))
+                return;
+        }
+    }
+}
 function handleDocker(rest, ctx, run, x) {
+    dockerMountChecks(rest, ctx, run);
     // The command inside the container reads this command's stdin (`… | docker exec -i c sh`).
     const inner = () => emptyExec();
     ctx = withFeed(ctx, x, run);
@@ -10001,20 +11502,7 @@ function handleRmdir(rest, ctx, run) {
     }
 }
 function handleFind(rest, ctx, run, x) {
-    const starts = [];
-    let i = 0;
-    while (i < rest.length && rest[i].text !== null && /^-[HLP]$|^-O\d$|^-D$/.test(rest[i].text))
-        i += rest[i].text === '-D' ? 2 : 1;
-    while (i < rest.length) {
-        const t = rest[i].text;
-        if (t !== null && (t.startsWith('-') || t === '(' || t === '!' || t === ')'))
-            break;
-        starts.push(rest[i]);
-        i += 1;
-    }
-    if (starts.length === 0)
-        starts.push(litArg('.'));
-    const expr = rest.slice(i);
+    const { starts, expr } = splitFind(rest);
     let deletes = false;
     for (let k = 0; k < expr.length; k += 1) {
         const t = expr[k].text;
@@ -10060,12 +11548,19 @@ function handleFind(rest, ctx, run, x) {
         const samples = (0, tables_1.secretSamples)(run.home, cwdsList(ctx));
         for (const n of names) {
             const re = patternToRegex(n.replace(/^\*\*\//, ''), false);
-            if (samples.some((smp) => (re.test(path.posix.basename(smp)) || re.test(smp)) && isSecretPath(smp, run))) {
+            const named = samples.filter((smp) => (re.test(path.posix.basename(smp)) || re.test(smp)) && isSecretPath(smp, run));
+            if (named.length > 0) {
+                // `find /proc/self/task -name environ -exec cat {} +`: the process files are what the name reaches (the keyed hook keeps this reason).
+                if (named.some((smp) => env_dump_1.PROC_ENVIRON.test(smp)) && starts.some((st) => st.text === null || /^\/proc(?:\/|$)/.test(collapseParents(st.text))))
+                    hit(run, 'S4', 'proc_environ');
                 hit(run, 'S4', 'find_exec_secret_name');
                 break;
             }
         }
     }
+    // A secret env file named as a start point, by name, path or regex, whatever the name is (the samples above only know a few): the same reader rule.
+    if (readerExec)
+        findEnvNames(starts, expr, ctx, run);
     if (deletes)
         for (const s of starts) {
             checkProtectedWrite(s, ctx, run, 'find_delete', false);
@@ -10112,12 +11607,24 @@ function handleDd(rest, run) {
 }
 // ---------------------------------------------------------------------------------------------
 // Grep tool glob, Edit/Write tool on protected files
+function namesApprovalStateFolder(abs, run) {
+    const folder = path.posix.join(run.home, '.marrow', 'host-approvals');
+    const same = (a, b) => (run.fold ? a.toLowerCase() === b.toLowerCase() : a === b);
+    return abs.some((p) => { const q = path.posix.normalize(p).replace(/\/+$/, ''); return same(q, folder) || same(q, path.posix.dirname(folder)); });
+}
 function checkGrepGlob(glob, ctx, run) {
     const g = glob.replace(/^\*\*\//, '');
     const re = patternToRegex(g, false);
     const samples = (0, tables_1.secretSamples)(run.home, cwdsList(ctx));
-    if (samples.some((s) => re.test(path.posix.basename(s)) && isSecretPath(s, run)))
+    // The state file's name is generic (`state.json`): a glob on the name alone is not read as that file (the folder rule and the suffix rule below are).
+    if (samples.some((s) => !secret_paths_1.APPROVAL_STATE_PATH.test(s) && re.test(path.posix.basename(s)) && isSecretPath(s, run)))
+        hit(run, 'S4', 'tool_grep_glob_secret');
+    // A glob with folders (`.marrow/host-approvals/state.json`, an absolute one) is read against the same number of trailing names of the state file samples.
+    const depth = g.split('/').filter(Boolean).length;
+    if (depth > 1 && samples.some((s) => secret_paths_1.APPROVAL_STATE_PATH.test(s) && patternToRegex(g.replace(/^\/+/, ''), false).test(s.split('/').slice(-depth).join('/')))) {
         hit(run, 'S4', 'tool_grep_glob_secret');
+        hit(run, 'S4', secret_paths_1.APPROVAL_STATE_REASON);
+    }
 }
 // Patch round 3 (delta audit F-CODEX): `.codex/hooks.json` is not compared like the others: any write under .codex stops (S0)
 // on every host, including a gemini write_file that leaves the Marrow part as it was.