@gotgenes/pi-permission-system 18.1.1 → 18.2.0

package/test/access-intent/bash/token-classification.test.ts

@@ -1,363 +0,0 @@
-import { describe, expect, test } from "vitest";
-
-import {
-  classifyPromotedRuleCandidate,
-  classifyTokenAsPathCandidate,
-  classifyTokenAsRuleCandidate,
-} from "#src/access-intent/bash/token-classification";
-
-// ── Shared rejection behaviour ─────────────────────────────────────────────
-//
-// Both classifiers delegate to the private `rejectNonPathToken` predicate for
-// the seven shared rejection cases tested below.  Testing via both exports
-// pins that predicate through each caller.
-
-describe("classifyTokenAsPathCandidate", () => {
-  describe("shared rejection: rejectNonPathToken", () => {
-    test("empty string → null", () => {
-      expect(classifyTokenAsPathCandidate("")).toBeNull();
-    });
-
-    test("flag (leading dash) → null", () => {
-      expect(classifyTokenAsPathCandidate("-r")).toBeNull();
-      expect(classifyTokenAsPathCandidate("--recursive")).toBeNull();
-    });
-
-    test("env assignment (= before any /) → null", () => {
-      expect(classifyTokenAsPathCandidate("FOO=/bar")).toBeNull();
-      expect(classifyTokenAsPathCandidate("HOME=/home/user")).toBeNull();
-    });
-
-    test("env-like token where = comes after / is NOT rejected as assignment", () => {
-      // /foo=bar: slashIndex (0) < eqIndex (4) → not an assignment → continues
-      // Starts with /, so path candidate accepts it.
-      expect(classifyTokenAsPathCandidate("/foo=bar")).toBe("/foo=bar");
-    });
-
-    test("URL → null", () => {
-      expect(classifyTokenAsPathCandidate("https://example.com")).toBeNull();
-      expect(classifyTokenAsPathCandidate("http://localhost:3000")).toBeNull();
-      expect(classifyTokenAsPathCandidate("file:///tmp/foo")).toBeNull();
-      expect(
-        classifyTokenAsPathCandidate("git+ssh://github.com/a/b"),
-      ).toBeNull();
-    });
-
-    test("@scope/package → null", () => {
-      expect(classifyTokenAsPathCandidate("@foo/bar")).toBeNull();
-      expect(classifyTokenAsPathCandidate("@scope/pkg")).toBeNull();
-    });
-
-    test("@/ prefix is NOT rejected (it looks like an absolute-rooted scoped path)", () => {
-      // @/ passes the @ guard; then for path candidate it doesn't start with /
-      // or ~/, and doesn't contain .., so it returns null anyway from the
-      // acceptance gate — but the rejection is not due to the @ guard.
-      // This test documents that @/ is not rejected by the shared rejection.
-      // The path classifier then rejects it for not matching any acceptance shape.
-      expect(classifyTokenAsPathCandidate("@/foo/bar")).toBeNull();
-    });
-
-    test("bare-slash token → null", () => {
-      expect(classifyTokenAsPathCandidate("/")).toBeNull();
-      expect(classifyTokenAsPathCandidate("//")).toBeNull();
-      expect(classifyTokenAsPathCandidate("///")).toBeNull();
-    });
-
-    test("regex metacharacters → null", () => {
-      // REGEX_METACHAR_PATTERN: .*, .+, \|, \(, \), [...], ^/
-      expect(classifyTokenAsPathCandidate("foo.*")).toBeNull();
-      expect(classifyTokenAsPathCandidate("bar.+")).toBeNull();
-      expect(classifyTokenAsPathCandidate("a\\|b")).toBeNull();
-      expect(classifyTokenAsPathCandidate("\\(group\\)")).toBeNull();
-      expect(classifyTokenAsPathCandidate("[abc]")).toBeNull();
-      expect(classifyTokenAsPathCandidate("^/start")).toBeNull();
-    });
-  });
-
-  describe("path-candidate acceptance gate", () => {
-    test("absolute path (starts with /) → returned as-is", () => {
-      expect(classifyTokenAsPathCandidate("/etc/hosts")).toBe("/etc/hosts");
-      expect(classifyTokenAsPathCandidate("/tmp")).toBe("/tmp");
-      expect(classifyTokenAsPathCandidate("/home/user/file.txt")).toBe(
-        "/home/user/file.txt",
-      );
-    });
-
-    test("home-relative path (starts with ~/) → returned as-is", () => {
-      expect(classifyTokenAsPathCandidate("~/Documents")).toBe("~/Documents");
-      expect(classifyTokenAsPathCandidate("~/.ssh/config")).toBe(
-        "~/.ssh/config",
-      );
-    });
-
-    test("parent-traversal (contains ..) → returned as-is", () => {
-      expect(classifyTokenAsPathCandidate("../../etc/passwd")).toBe(
-        "../../etc/passwd",
-      );
-      expect(classifyTokenAsPathCandidate("../foo")).toBe("../foo");
-      expect(classifyTokenAsPathCandidate("..")).toBe("..");
-    });
-
-    test("plain word with no path shape → null", () => {
-      expect(classifyTokenAsPathCandidate("hello")).toBeNull();
-      expect(classifyTokenAsPathCandidate("myfile.txt")).toBeNull();
-    });
-
-    test("dot-file (starts with .) → null (strict path gate)", () => {
-      // Path candidate does NOT accept dot-files; rule candidate does.
-      expect(classifyTokenAsPathCandidate(".env")).toBeNull();
-      expect(classifyTokenAsPathCandidate(".gitignore")).toBeNull();
-    });
-
-    test("relative path with / but no leading / or ~/ → null (strict path gate)", () => {
-      // Path candidate does NOT accept bare relative paths; rule candidate does.
-      expect(classifyTokenAsPathCandidate("src/foo.ts")).toBeNull();
-      expect(classifyTokenAsPathCandidate("./build")).toBeNull();
-    });
-  });
-
-  describe("Windows drive-letter acceptance gate", () => {
-    test("forward-slash drive path → returned as-is", () => {
-      expect(classifyTokenAsPathCandidate("C:/Windows/win.ini")).toBe(
-        "C:/Windows/win.ini",
-      );
-      expect(classifyTokenAsPathCandidate("D:/secrets/password.txt")).toBe(
-        "D:/secrets/password.txt",
-      );
-    });
-
-    test("backslash drive path → returned as-is", () => {
-      expect(classifyTokenAsPathCandidate("C:\\Windows\\win.ini")).toBe(
-        "C:\\Windows\\win.ini",
-      );
-      expect(classifyTokenAsPathCandidate("D:\\secrets\\password.txt")).toBe(
-        "D:\\secrets\\password.txt",
-      );
-    });
-
-    test("lowercase drive letter → returned as-is", () => {
-      expect(classifyTokenAsPathCandidate("c:/foo")).toBe("c:/foo");
-    });
-
-    test("single-letter scheme with double-slash (c://x) → null (URL_PATTERN fires first)", () => {
-      // c:// matches URL_PATTERN before the drive-letter check runs.
-      expect(classifyTokenAsPathCandidate("c://x")).toBeNull();
-    });
-
-    test("drive-relative path without separator (C:foo) → null", () => {
-      // No / or \ after the colon — not an absolute drive path per node:path.
-      expect(classifyTokenAsPathCandidate("C:foo")).toBeNull();
-    });
-  });
-});
-
-describe("classifyTokenAsRuleCandidate", () => {
-  describe("shared rejection: rejectNonPathToken", () => {
-    test("empty string → null", () => {
-      expect(classifyTokenAsRuleCandidate("")).toBeNull();
-    });
-
-    test("flag (leading dash) → null", () => {
-      expect(classifyTokenAsRuleCandidate("-r")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("--recursive")).toBeNull();
-    });
-
-    test("env assignment (= before any /) → null", () => {
-      expect(classifyTokenAsRuleCandidate("FOO=/bar")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("HOME=/home/user")).toBeNull();
-    });
-
-    test("env-like token where = comes after / is NOT rejected as assignment", () => {
-      // /foo=bar: slashIndex (0) < eqIndex (4) → not an assignment → continues.
-      // Contains /, so rule candidate accepts it.
-      expect(classifyTokenAsRuleCandidate("/foo=bar")).toBe("/foo=bar");
-    });
-
-    test("URL → null", () => {
-      expect(classifyTokenAsRuleCandidate("https://example.com")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("http://localhost:3000")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("file:///tmp/foo")).toBeNull();
-    });
-
-    test("@scope/package → null", () => {
-      expect(classifyTokenAsRuleCandidate("@foo/bar")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("@scope/pkg")).toBeNull();
-    });
-
-    test("bare-slash token → null", () => {
-      expect(classifyTokenAsRuleCandidate("/")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("//")).toBeNull();
-    });
-
-    test("regex metacharacters → null", () => {
-      expect(classifyTokenAsRuleCandidate("foo.*")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("bar.+")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("a\\|b")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("[abc]")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("^/start")).toBeNull();
-    });
-  });
-
-  describe("rule-candidate acceptance gate (broader than path)", () => {
-    test("absolute path (starts with /) → returned as-is", () => {
-      expect(classifyTokenAsRuleCandidate("/etc/hosts")).toBe("/etc/hosts");
-    });
-
-    test("home-relative path (starts with ~/) → returned as-is", () => {
-      expect(classifyTokenAsRuleCandidate("~/Documents")).toBe("~/Documents");
-    });
-
-    test("parent-traversal (contains ..) → returned as-is", () => {
-      expect(classifyTokenAsRuleCandidate("../foo")).toBe("../foo");
-      expect(classifyTokenAsRuleCandidate("..")).toBe("..");
-    });
-
-    test("dot-file (starts with .) → returned as-is", () => {
-      // Rule candidate accepts dot-files; path candidate does not.
-      expect(classifyTokenAsRuleCandidate(".env")).toBe(".env");
-      expect(classifyTokenAsRuleCandidate(".gitignore")).toBe(".gitignore");
-    });
-
-    test("current-dir relative (starts with ./) → returned as-is", () => {
-      expect(classifyTokenAsRuleCandidate("./src")).toBe("./src");
-      expect(classifyTokenAsRuleCandidate("./build/output.js")).toBe(
-        "./build/output.js",
-      );
-    });
-
-    test("relative path containing / → returned as-is", () => {
-      // Rule candidate accepts any token with / (not already rejected).
-      expect(classifyTokenAsRuleCandidate("src/foo.ts")).toBe("src/foo.ts");
-      expect(classifyTokenAsRuleCandidate("packages/pi-foo/index.ts")).toBe(
-        "packages/pi-foo/index.ts",
-      );
-    });
-
-    test("plain word with no path shape → null", () => {
-      expect(classifyTokenAsRuleCandidate("hello")).toBeNull();
-      expect(classifyTokenAsRuleCandidate("myfile.txt")).toBeNull();
-    });
-  });
-
-  describe("Windows drive-letter acceptance gate", () => {
-    test("forward-slash drive path → returned as-is", () => {
-      // Forward-slash form was already accepted via token.includes("/").
-      // The explicit branch makes it first-class and order-independent.
-      expect(classifyTokenAsRuleCandidate("C:/Windows/win.ini")).toBe(
-        "C:/Windows/win.ini",
-      );
-    });
-
-    test("backslash drive path → returned as-is (new: no forward slash)", () => {
-      // Previously dropped by both classifiers; the backslash form has no /
-      // so the includes("/") branch could not catch it.
-      expect(classifyTokenAsRuleCandidate("D:\\secrets\\password.txt")).toBe(
-        "D:\\secrets\\password.txt",
-      );
-      expect(classifyTokenAsRuleCandidate("C:\\Windows\\win.ini")).toBe(
-        "C:\\Windows\\win.ini",
-      );
-    });
-
-    test("lowercase drive letter (backslash) → returned as-is", () => {
-      expect(classifyTokenAsRuleCandidate("c:\\foo")).toBe("c:\\foo");
-    });
-
-    test("drive-relative path without separator (C:foo) → null", () => {
-      expect(classifyTokenAsRuleCandidate("C:foo")).toBeNull();
-    });
-  });
-
-  describe("rule-vs-path divergence", () => {
-    const dotFiles = [".env", ".gitignore", ".eslintrc"];
-    const relPaths = ["src/index.ts", "lib/utils.js", "config/settings.json"];
-
-    for (const tok of dotFiles) {
-      test(`dot-file "${tok}": rule accepts, path rejects`, () => {
-        expect(classifyTokenAsRuleCandidate(tok)).toBe(tok);
-        expect(classifyTokenAsPathCandidate(tok)).toBeNull();
-      });
-    }
-
-    for (const tok of relPaths) {
-      test(`relative path "${tok}": rule accepts, path rejects`, () => {
-        expect(classifyTokenAsRuleCandidate(tok)).toBe(tok);
-        expect(classifyTokenAsPathCandidate(tok)).toBeNull();
-      });
-    }
-
-    const sharedAccepted = ["/etc/hosts", "~/docs", "../sibling"];
-    for (const tok of sharedAccepted) {
-      test(`"${tok}": both classifiers accept`, () => {
-        expect(classifyTokenAsRuleCandidate(tok)).toBe(tok);
-        expect(classifyTokenAsPathCandidate(tok)).toBe(tok);
-      });
-    }
-
-    const winDrivePaths = [
-      "C:/Windows/win.ini",
-      "D:\\secrets\\password.txt",
-      "c:/foo",
-    ];
-    for (const tok of winDrivePaths) {
-      test(`Windows drive path "${tok}": both classifiers accept`, () => {
-        expect(classifyTokenAsRuleCandidate(tok)).toBe(tok);
-        expect(classifyTokenAsPathCandidate(tok)).toBe(tok);
-      });
-    }
-
-    const sharedRejected = ["hello", "--flag", "FOO=/bar", "https://x.com"];
-    for (const tok of sharedRejected) {
-      test(`"${tok}": both classifiers reject`, () => {
-        expect(classifyTokenAsRuleCandidate(tok)).toBeNull();
-        expect(classifyTokenAsPathCandidate(tok)).toBeNull();
-      });
-    }
-  });
-});
-
-describe("classifyPromotedRuleCandidate", () => {
-  test("shape-eligible bare token promoted when predicate returns true", () => {
-    expect(classifyPromotedRuleCandidate("id_rsa", () => true)).toBe("id_rsa");
-  });
-
-  test("shape-eligible bare token rejected when predicate returns false", () => {
-    expect(classifyPromotedRuleCandidate("id_rsa", () => false)).toBeNull();
-  });
-
-  test("predicate receives the raw token", () => {
-    const isPromotable = (token: string): boolean => token === "key.pem";
-    expect(classifyPromotedRuleCandidate("key.pem", isPromotable)).toBe(
-      "key.pem",
-    );
-    expect(classifyPromotedRuleCandidate("other.pem", isPromotable)).toBeNull();
-  });
-
-  describe("shared rejection still applies regardless of the predicate", () => {
-    test("flag (leading dash) → null", () => {
-      expect(classifyPromotedRuleCandidate("-r", () => true)).toBeNull();
-    });
-
-    test("env assignment → null", () => {
-      expect(classifyPromotedRuleCandidate("FOO=/bar", () => true)).toBeNull();
-    });
-
-    test("URL → null", () => {
-      expect(
-        classifyPromotedRuleCandidate("https://example.com", () => true),
-      ).toBeNull();
-    });
-
-    test("@scope/package → null", () => {
-      expect(classifyPromotedRuleCandidate("@foo/bar", () => true)).toBeNull();
-    });
-
-    test("regex metacharacters → null", () => {
-      expect(classifyPromotedRuleCandidate("foo.*", () => true)).toBeNull();
-    });
-
-    test("empty string → null", () => {
-      expect(classifyPromotedRuleCandidate("", () => true)).toBeNull();
-    });
-  });
-});

package/test/access-intent/bash/token-collection.test.ts

@@ -1,300 +0,0 @@
-import { describe, expect, it } from "vitest";
-import type { TSNode } from "#src/access-intent/bash/parser";
-import { getParser } from "#src/access-intent/bash/parser";
-import {
-  collectCommandTokens,
-  collectPathCandidateTokens,
-  collectRedirectTokens,
-  extractCommandName,
-} from "#src/access-intent/bash/token-collection";
-
-// ── Helpers ───────────────────────────────────────────────────────────────────
-
-/** Depth-first search for the first node of the given type. */
-function findNode(node: TSNode, type: string): TSNode | null {
-  if (node.type === type) return node;
-  for (let i = 0; i < node.childCount; i++) {
-    const child = node.child(i);
-    if (!child) continue;
-    const found = findNode(child, type);
-    if (found) return found;
-  }
-  return null;
-}
-
-/** Parse a bash snippet and return the first `command` node. */
-async function parseCommandNode(cmd: string): Promise<{
-  node: TSNode;
-  tree: { rootNode: TSNode; delete(): void };
-}> {
-  const parser = await getParser();
-  const tree = parser.parse(cmd);
-  if (!tree) throw new Error("parser.parse returned null");
-  const node = findNode(tree.rootNode, "command");
-  if (!node) throw new Error(`no command node found in: ${cmd}`);
-  return { node, tree };
-}
-
-/** Parse a bash snippet and return the first `file_redirect` node. */
-async function parseRedirectNode(cmd: string): Promise<{
-  node: TSNode;
-  tree: { rootNode: TSNode; delete(): void };
-}> {
-  const parser = await getParser();
-  const tree = parser.parse(cmd);
-  if (!tree) throw new Error("parser.parse returned null");
-  const node = findNode(tree.rootNode, "file_redirect");
-  if (!node) throw new Error(`no file_redirect node found in: ${cmd}`);
-  return { node, tree };
-}
-
-// ── extractCommandName ────────────────────────────────────────────────────────
-
-describe("extractCommandName", () => {
-  it("returns the basename for a bare command", async () => {
-    const { node, tree } = await parseCommandNode("sed 's/x/y/' file.txt");
-    try {
-      expect(extractCommandName(node)).toBe("sed");
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("strips the directory prefix from an absolute command path", async () => {
-    const { node, tree } = await parseCommandNode(
-      "/usr/bin/sed 's/x/y/' file.txt",
-    );
-    try {
-      expect(extractCommandName(node)).toBe("sed");
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("returns the substitution text when the command name is a command substitution", async () => {
-    // $(which sed) parses with a command_name child whose text is "$(which sed)";
-    // resolveNodeText returns that text, so extractCommandName returns its basename.
-    // PATTERN_FIRST_COMMANDS.get("$(which sed)") returns undefined, so
-    // collectCommandTokens falls back to generic collection — correct behaviour.
-    const { node, tree } = await parseCommandNode(
-      "$(which sed) 's/x/y/' file.txt",
-    );
-    try {
-      expect(extractCommandName(node)).toBe("$(which sed)");
-    } finally {
-      tree.delete();
-    }
-  });
-});
-
-// ── collectCommandTokens — pattern-first commands ─────────────────────────────
-
-describe("collectCommandTokens — pattern-first commands", () => {
-  it("sed: skips the first positional (inline pattern) and collects the rest", async () => {
-    const { node, tree } = await parseCommandNode("sed 's/x/y/' a.txt b.txt");
-    try {
-      expect(collectCommandTokens(node)).toEqual(["a.txt", "b.txt"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("sed -e: skips the explicit script arg-consuming flag and collects positionals", async () => {
-    const { node, tree } = await parseCommandNode("sed -e 's/x/y/' file.txt");
-    try {
-      // -e consumes the next argument (the script), so file.txt is the first positional
-      // Since hasExplicitScript is set by -e, the positional is not skipped
-      expect(collectCommandTokens(node)).toEqual(["file.txt"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("sed -f: treats the next argument as a file path (file-consuming flag)", async () => {
-    const { node, tree } = await parseCommandNode(
-      "sed -f /scripts/script.sed file.txt",
-    );
-    try {
-      // -f consumes the next arg as a file path (extracted), and sets hasExplicitScript
-      expect(collectCommandTokens(node)).toEqual([
-        "/scripts/script.sed",
-        "file.txt",
-      ]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("grep: skips the first positional (pattern) and collects file arguments", async () => {
-    const { node, tree } = await parseCommandNode(
-      "grep pattern /etc/hosts /etc/passwd",
-    );
-    try {
-      expect(collectCommandTokens(node)).toEqual(["/etc/hosts", "/etc/passwd"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("grep -e: with explicit -e flag, all positionals are file arguments", async () => {
-    const { node, tree } = await parseCommandNode("grep -e pattern /etc/hosts");
-    try {
-      expect(collectCommandTokens(node)).toEqual(["/etc/hosts"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("grep: end-of-flags (--) causes subsequent args to be treated as positionals", async () => {
-    const { node, tree } = await parseCommandNode("grep -- pattern /etc/hosts");
-    try {
-      // After --, both 'pattern' (first positional) and '/etc/hosts' are positionals.
-      // pattern is the pattern positional and is skipped; /etc/hosts is collected.
-      expect(collectCommandTokens(node)).toEqual(["/etc/hosts"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("sd: skips the first two positionals (FIND and REPLACE_WITH) as patterns", async () => {
-    const { node, tree } = await parseCommandNode(
-      "sd find replace file.txt other.txt",
-    );
-    try {
-      expect(collectCommandTokens(node)).toEqual(["file.txt", "other.txt"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("rg: skips the pattern positional and collects file/dir arguments", async () => {
-    const { node, tree } = await parseCommandNode("rg pattern /etc/");
-    try {
-      expect(collectCommandTokens(node)).toEqual(["/etc/"]);
-    } finally {
-      tree.delete();
-    }
-  });
-});
-
-// ── collectCommandTokens — generic commands ───────────────────────────────────
-
-describe("collectCommandTokens — generic commands", () => {
-  it("collects all argument tokens after the command name", async () => {
-    const { node, tree } = await parseCommandNode("cat /etc/hosts /etc/passwd");
-    try {
-      expect(collectCommandTokens(node)).toEqual(["/etc/hosts", "/etc/passwd"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("skips variable assignment prefixes", async () => {
-    const { node, tree } = await parseCommandNode("FOO=/bar cat /etc/hosts");
-    try {
-      expect(collectCommandTokens(node)).toEqual(["/etc/hosts"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("collects no tokens for a bare command with no arguments", async () => {
-    const { node, tree } = await parseCommandNode("ls");
-    try {
-      expect(collectCommandTokens(node)).toEqual([]);
-    } finally {
-      tree.delete();
-    }
-  });
-});
-
-// ── collectRedirectTokens ─────────────────────────────────────────────────────
-
-describe("collectRedirectTokens", () => {
-  it("collects the destination path from a stdout redirect", async () => {
-    const { node, tree } = await parseRedirectNode(
-      "cat /etc/hosts > /tmp/out.txt",
-    );
-    try {
-      expect(collectRedirectTokens(node)).toEqual(["/tmp/out.txt"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("collects the destination path from an append redirect", async () => {
-    const { node, tree } = await parseRedirectNode(
-      "echo hello >> /tmp/log.txt",
-    );
-    try {
-      expect(collectRedirectTokens(node)).toEqual(["/tmp/log.txt"]);
-    } finally {
-      tree.delete();
-    }
-  });
-
-  it("collects the source path from a stdin redirect", async () => {
-    const { node, tree } = await parseRedirectNode("cat < /etc/hosts");
-    try {
-      expect(collectRedirectTokens(node)).toEqual(["/etc/hosts"]);
-    } finally {
-      tree.delete();
-    }
-  });
-});
-
-// ── collectPathCandidateTokens ────────────────────────────────────────────────
-
-describe("collectPathCandidateTokens", () => {
-  it("collects all argument tokens from a simple command via the program root", async () => {
-    const parser = await getParser();
-    const tree = parser.parse("cat /etc/hosts");
-    try {
-      if (!tree) throw new Error("parse returned null");
-      expect(collectPathCandidateTokens(tree.rootNode)).toEqual(["/etc/hosts"]);
-    } finally {
-      tree?.delete();
-    }
-  });
-
-  it("collects redirect destinations as well as command arguments", async () => {
-    const parser = await getParser();
-    const tree = parser.parse("cat /etc/hosts > /tmp/out.txt");
-    try {
-      if (!tree) throw new Error("parse returned null");
-      expect(collectPathCandidateTokens(tree.rootNode)).toEqual([
-        "/etc/hosts",
-        "/tmp/out.txt",
-      ]);
-    } finally {
-      tree?.delete();
-    }
-  });
-
-  it("returns empty array for heredoc-only content (SKIP_SUBTREE_TYPES)", async () => {
-    const parser = await getParser();
-    const tree = parser.parse("cat <<EOF\nhello\nEOF");
-    try {
-      if (!tree) throw new Error("parse returned null");
-      // heredoc_body is in SKIP_SUBTREE_TYPES — its text must not be collected
-      const tokens = collectPathCandidateTokens(tree.rootNode);
-      expect(tokens).not.toContain("hello");
-    } finally {
-      tree?.delete();
-    }
-  });
-
-  it("recurses into command substitution to collect nested tokens", async () => {
-    const parser = await getParser();
-    const tree = parser.parse("cat $(echo /etc/hosts)");
-    try {
-      if (!tree) throw new Error("parse returned null");
-      // The command_substitution is a non-command, non-redirect node — recurse
-      const tokens = collectPathCandidateTokens(tree.rootNode);
-      // /etc/hosts is inside the substitution, collected by recursion
-      expect(tokens).toContain("/etc/hosts");
-    } finally {
-      tree?.delete();
-    }
-  });
-});