@gotgenes/pi-permission-system 40.1.0 → 40.1.2

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [40.1.2](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.1...pi-permission-system-v40.1.2) (2026-10-09)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** sudoedit and sudo's clustered or long options no longer earn the pure-reader exemption ([b94d064](https://github.com/gotgenes/pi-packages/commit/b94d064f27e3271a40b157ae311105d14aa83c1b)), closes [#1042](https://github.com/gotgenes/pi-packages/issues/1042)
+* **pi-permission-system:** sudo's shell, login, chdir, and chroot modes keep the indirection floor ([3e36c7b](https://github.com/gotgenes/pi-packages/commit/3e36c7b4090299a147d877d25ea332ad95a8bc0c)), closes [#1042](https://github.com/gotgenes/pi-packages/issues/1042)
+
+### Documentation
+
+* **pi-permission-system:** document the sudo modes that keep the indirection floor ([bd77430](https://github.com/gotgenes/pi-packages/commit/bd774308a50d817b7913713acc963c0f49c635e0))
+
+## [40.1.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.1.0...pi-permission-system-v40.1.1) (2026-10-08)
+
+
+### Bug Fixes
+
+* **pi-permission-system:** commands inside time ( … ) are gated on their own rules ([0b77df6](https://github.com/gotgenes/pi-packages/commit/0b77df61d03c31e394cf68971df0e526b44a1abd)), closes [#1027](https://github.com/gotgenes/pi-packages/issues/1027)
+* **pi-permission-system:** a cd inside time ( … ) resolves the paths after it in that subshell ([6994e15](https://github.com/gotgenes/pi-packages/commit/6994e15042e2ec6cb9e495973e0407d80fa2ff25)), closes [#1027](https://github.com/gotgenes/pi-packages/issues/1027)
+
+### Documentation
+
+* **pi-permission-system:** document the timed-subshell descent and mark #1027 complete ([8337f54](https://github.com/gotgenes/pi-packages/commit/8337f5494ddd7a6c84561e3092700112e1de78a8))
+
 ## [40.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v40.0.2...pi-permission-system-v40.1.0) (2026-10-08)
 
 

package/docs/configuration.md

@@ -1107,7 +1107,8 @@ All four of these must hold, and each keeps the decision about the command that
    The admitted options are `time -p`/`-l`/`-h`/`-f`; `timeout -s`/`-k`/`-f`/`-p`/`-v` and their long forms; `nice -n`/`--adjustment`; and `stdbuf -i`/`-o`/`-e` and their long forms.
 3. The command it runs is not itself a wrapper or an inline shell, so `timeout 5 bash -c '…'` stays floored.
 4. The command it runs is named literally.
-   `time ( … )` and `time { …; }` stay floored: the parser reads the group as `time`'s arguments, so the commands inside are not yet gated on their own rules.
+   `time ( … )` is decided by the commands inside it, each on its own rule, so `time (rm -rf /tmp/x)` reaches an `rm *` deny.
+   `time { …; }` stays floored: the parser reads the group as `time`'s arguments, so the commands inside are not yet gated on their own rules.
 
 So under `bash: {"*": "allow", "git push *": "deny"}`, `time pnpm run lint >/tmp/lint.txt 2>&1` is allowed and `timeout 60 git push --force` is denied, exactly as without the wrapper.
 No redirect refusal applies here: the redirect destination goes through `path` and `external_directory` as it does for the bare command, and a destination the parse cannot resolve (`> $OUT`) is unprojected for both forms alike.
@@ -1137,6 +1138,10 @@ If you run a permissive `bash` policy and want privilege elevation to prompt reg
 
 That rule matches the wrapper's own text, so it is decided before the exemption is ever consulted.
 
+`sudo`'s own options are read the way `sudo` reads them, so `sudo -nu cat rm x` runs `rm x`, not a pure reader named `cat`.
+A `sudo` mode in which the command it names is not what runs as named keeps the floor whatever that command is: `-e`/`--edit` (sudoedit edits its operands as files, as root), `-s`/`--shell` and `-i`/`--login` (a shell runs the operand), and `-D`/`--chdir` and `-R`/`--chroot` (relative operands resolve somewhere the path surfaces do not look).
+So does `-h`, whose meaning depends on what follows it, and any option `sudo`'s manual does not list; a mode that keeps the floor is approved at the prompt or under `yoloMode`.
+
 #### Which key to actually write
 
 The useful *grants* are `*_read: allow` and the bare sugar key.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "40.1.0",
+  "version": "40.1.2",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/access-intent/bash/bash-path-resolver.ts

@@ -8,6 +8,7 @@ import { normalizePathPolicyLiteral } from "#src/access-intent/path-normalizatio
 import type { PathNormalizer } from "#src/path/path-normalizer";
 import { isSafeSystemPath } from "#src/path/safe-system-paths";
 import type { ArgumentSpeller } from "./command-enumeration";
+import { timedSubshellOf } from "./nested-execution";
 import {
   ARG_NODE_TYPES,
   SKIP_SUBTREE_TYPES,
@@ -238,6 +239,8 @@ export class BashPathResolver {
    * does not update the running directory; subshell and brace-group interiors
    * inherit the enclosing base without folding their own `cd`s (a conservative
    * first tier).
+   * A subshell timed by `time`, which the grammar reads as the argument of a
+   * command named `time`, is walked as a bare subshell is.
    */
   private collectPathCandidates(
     rootNode: TSNode,
@@ -263,9 +266,14 @@ export class BashPathResolver {
       case "list":
       case "redirected_statement":
         return this.walkCurrentShellSequence(node, base, out);
-      case "command":
+      case "command": {
+        const timed = timedSubshellOf(node);
+        if (timed !== null) {
+          return this.walkTimedSubshell(node, timed, base, out);
+        }
         tagTokens(collectCommandTokens(node, this.words), base, out);
         return this.foldCd(node, base);
+      }
       case "pipeline":
         // tree-sitter-bash mis-groups a redirect-bearing `&&`/`;` list as the
         // first stage of a pipeline (`cd a && pnpm x 2>&1 | tail` parses as
@@ -294,6 +302,30 @@ export class BashPathResolver {
     }
   }
 
+  /**
+   * Walk `time ( … )`, returning the base in force after it, which is `base`.
+   *
+   * The subshell is walked as a subshell, so its `cd`s fold for the commands
+   * after them inside it and reset on exit. Every other named child but the
+   * `time` name, such as a redirect the command hosts (`2>err time ( … )`),
+   * is collected against `base`.
+   */
+  private walkTimedSubshell(
+    command: TSNode,
+    subshell: TSNode,
+    base: EffectiveBase,
+    out: PathCandidate[],
+  ): EffectiveBase {
+    for (let i = 0; i < command.childCount; i++) {
+      const child = command.child(i);
+      if (!child?.isNamed || child.type === "command_name") continue;
+      if (child.startIndex === subshell.startIndex) continue;
+      tagTokens(collectPathCandidateTokens(child, this.words), base, out);
+    }
+    this.walkForCandidates(subshell, base, out);
+    return base;
+  }
+
   /**
    * Fold a current-shell sequence (`program` / `list` / `redirected_statement`):
    * thread the effective base left-to-right through the children so a `cd`

package/src/access-intent/bash/command-enumeration.ts

@@ -1,5 +1,10 @@
 import type { BashCommandContext, FloorExemption } from "#src/types";
-import { EXECUTION_HOST_TYPES, forEachExecutionIn } from "./nested-execution";
+import {
+  commandWordNodes,
+  EXECUTION_HOST_TYPES,
+  forEachExecutionIn,
+  timedSubshellOf,
+} from "./nested-execution";
 import type { WordReader } from "./node-text";
 import { parseUnresolvedWithin } from "./parse-health";
 import type { TSNode } from "./parser";
@@ -269,7 +274,8 @@ const STATEMENT_TYPES = new Set([
  * substitution (`$(…)`, backticks), process substitution (`<(…)`/`>(…)`), and
  * subshells (`( … )`) — emitting each inner command as its own unit *in
  * addition to* the enclosing command, since those inner commands really execute
- * (#306).
+ * (#306). A subshell timed by `time`, which the grammar reads as the argument
+ * of a command named `time`, is descended the same way.
  * A compound statement (control flow, a function definition, a `{ … }` brace
  * group) is emitted whole and then descended for the statements it contains,
  * while its operand words — a loop variable, a word list, a `case` subject, a
@@ -363,6 +369,11 @@ function collectCommandsInto(
   const scope = unresolvedScope(node, inherited);
 
   if (node.type === "command") {
+    const timed = timedSubshellOf(node);
+    if (timed !== null) {
+      collectTimedSubshell(node, timed, scope, out);
+      return;
+    }
     out.push(makeCommandUnit(node, scope));
     // A command's text already contains any substitution; descend its subtree
     // to ALSO emit the inner commands of command/process substitutions.
@@ -422,6 +433,40 @@ function collectCommandsInto(
   collectHostedCommands(node, scope, out);
 }
 
+/**
+ * Enumerate `time ( … )`: the `time` unit whole, then the subshell's commands
+ * as units of their own, exactly as a bare subshell's are.
+ *
+ * The `time` unit is the never-weaker whole emit, and it is exempt from the
+ * wrapper floor: the floor exists because a wrapper hides the command that
+ * should be gated, and every command in this subshell is a unit gated on its
+ * own rules. It resolves by its executed unit, the subshell's text, which is
+ * how the bare subshell's whole unit resolves.
+ *
+ * Substitutions the command hosts outside the subshell (in a redirect) are
+ * still enumerated, and the subshell is left to the descent so a substitution
+ * inside it is emitted once.
+ */
+function collectTimedSubshell(
+  node: TSNode,
+  subshell: TSNode,
+  scope: UnitScope,
+  out: BashCommand[],
+): void {
+  out.push(makeCommandUnit(node, scope, "execution-modifier"));
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (child && child.startIndex !== subshell.startIndex) {
+      collectHostedCommands(child, scope, out);
+    }
+  }
+  descendCommandChildren(
+    subshell,
+    { ...redirectedScope(node, scope), context: "subshell" },
+    out,
+  );
+}
+
 /**
  * The scope `node`'s own subtree establishes, marking it unresolved when
  * tree-sitter could not parse a region within it (#840).
@@ -488,7 +533,11 @@ function makeUnit(
  * before or between the words (`>/tmp/o xargs grep foo`) writes a file as
  * surely as one on the enclosing statement.
  */
-function makeCommandUnit(node: TSNode, scope: UnitScope): BashCommand {
+function makeCommandUnit(
+  node: TSNode,
+  scope: UnitScope,
+  floorExemption?: FloorExemption,
+): BashCommand {
   const { text, words, argumentSpelling } = readCommandUnit(node, scope);
   return makeUnit(text, scope, {
     spellings: distinctSpellings(text, [
@@ -497,7 +546,8 @@ function makeCommandUnit(node: TSNode, scope: UnitScope): BashCommand {
     ]),
     wrapperKind: classifyWrapperWords(words),
     executedUnit: executedUnitOf(text, words) ?? undefined,
-    floorExemption: floorExemptionOf(words, redirectedScope(node, scope)),
+    floorExemption:
+      floorExemption ?? floorExemptionOf(words, redirectedScope(node, scope)),
   });
 }
 
@@ -626,28 +676,6 @@ function gapBetween(
   );
 }
 
-/**
- * The nodes {@link readCommandUnit} reports words for, in the same order: every
- * named child except a prefix assignment and a hosted redirect.
- *
- * Split out so a consumer that needs a *node* rather than a word (the log's
- * command masker, which offsets a re-parse by the payload node's `startIndex`)
- * walks the identical filtered list. Two walks over the same children with the
- * same filter, written twice, is how the two come to disagree about which word
- * is at which index.
- */
-function commandWordNodes(node: TSNode): TSNode[] {
-  const nodes: TSNode[] = [];
-  for (let i = 0; i < node.childCount; i++) {
-    const child = node.child(i);
-    if (!child?.isNamed) continue;
-    if (child.type === "variable_assignment") continue;
-    if (REDIRECT_NODE_TYPES.has(child.type)) continue;
-    nodes.push(child);
-  }
-  return nodes;
-}
-
 /** The redirects a `command` node hosts among its own children. */
 function hostedRedirects(node: TSNode): TSNode[] {
   const redirects: TSNode[] = [];

package/src/access-intent/bash/nested-execution.ts

@@ -1,5 +1,6 @@
 import type { BashCommandContext } from "#src/types";
 import type { TSNode } from "./parser";
+import { REDIRECT_NODE_TYPES } from "./redirect-analysis";
 
 /**
  * AST node types whose interior commands really execute when the shell runs the
@@ -47,6 +48,50 @@ export const EXECUTION_HOST_TYPES: ReadonlySet<string> = new Set([
   "heredoc_body",
 ]);
 
+/**
+ * The word nodes of a `command` node, in source order: every named child except
+ * a prefix assignment and a hosted redirect.
+ *
+ * Shared so every consumer that reads a command's words, whether as words (the
+ * command enumerator's unit text) or as nodes (the log's command masker, which
+ * offsets a re-parse by the payload node's `startIndex`), walks the identical
+ * filtered list. Two walks over the same children with the same filter,
+ * written twice, is how the two come to disagree about which word is at which
+ * index.
+ */
+export function commandWordNodes(node: TSNode): TSNode[] {
+  const nodes: TSNode[] = [];
+  for (let i = 0; i < node.childCount; i++) {
+    const child = node.child(i);
+    if (!child?.isNamed) continue;
+    if (child.type === "variable_assignment") continue;
+    if (REDIRECT_NODE_TYPES.has(child.type)) continue;
+    nodes.push(child);
+  }
+  return nodes;
+}
+
+/**
+ * The subshell a `command` node times, or `null` when it is not `time ( … )`.
+ *
+ * `tree-sitter-bash` has no `time` keyword, so `time (rm x)` parses as a
+ * command named `time` whose only argument is a `subshell`. Bash runs that
+ * subshell's commands as surely as a bare `( … )`'s, so both bash surfaces read
+ * the shape through this one recognizer rather than each re-deciding it.
+ *
+ * The words must be exactly a `time` spelled literally (a quoted `"time"` is
+ * not the keyword) and one subshell. Anything between them (`time -p ( … )`,
+ * whose `-p` the grammar cannot place) leaves the shape unrecognized, so it
+ * keeps whatever floor the enumerator gives it.
+ */
+export function timedSubshellOf(command: TSNode): TSNode | null {
+  const words = commandWordNodes(command);
+  if (words.length !== 2) return null;
+  const [name, argument] = words;
+  if (argument.type !== "subshell") return null;
+  return name.type === "command_name" && name.text === "time" ? argument : null;
+}
+
 /**
  * Visit every execution context `node` *is or contains*, in source order.
  *

package/src/access-intent/bash/wrapper-analysis.ts

@@ -223,7 +223,10 @@ export function floorExemptionOf(
  *    past.
  * 4. The inner head is a literal command name. The grammar has no `time`
  *    keyword, so `time { …; }` and `time ( … )` reach here with shell syntax
- *    where the command name should be.
+ *    where the command name should be. A word list cannot tell whether that
+ *    syntax was enumerated, so both keep the floor here; the command
+ *    enumerator, which descends a `time ( … )` subshell, exempts that shape
+ *    itself.
  */
 function onlyModifiesExecution(
   peeled: readonly (readonly CommandWord[])[],
@@ -399,10 +402,10 @@ function unquote(text: string): string {
  * Index of the word beginning the inner command, or `-1` when the wrapper's own
  * options run out first.
  *
- * Skips the wrapper name, environment assignments, options (consuming a
- * following value for the options in {@link VALUE_TAKING_FLAGS}), and a leading
- * operand for the wrappers that take one. An exec-conditional wrapper instead
- * starts immediately after its exec flag.
+ * An exec-conditional wrapper starts immediately after its exec flag. A wrapper
+ * with a {@link GETOPT_GRAMMARS} entry is read as getopt reads it, and answers
+ * `-1` for any option its grammar refuses; every other wrapper is read by the
+ * per-wrapper tables.
  */
 function innerCommandIndex(words: readonly CommandWord[]): number {
   const name = wrapperName(words);
@@ -412,6 +415,101 @@ function innerCommandIndex(words: readonly CommandWord[]): number {
   const execFlag = execFlagIndex(name, argTexts);
   if (execFlag !== -1) return execFlag + 2;
 
+  const grammar = GETOPT_GRAMMARS.get(name);
+  return grammar === undefined
+    ? tableInnerIndex(words, name)
+    : getoptInnerIndex(words, grammar);
+}
+
+/**
+ * {@link innerCommandIndex} for a wrapper read as getopt_long reads it, with
+ * options permuted no further than the first non-option (sudo's `+` optstring).
+ *
+ * Options come first, then the `NAME=value` assignments the wrapper passes to
+ * the command, then the command. `-1` when an option is refused, unlisted, or
+ * an ambiguous abbreviation, or when the words run out first.
+ */
+function getoptInnerIndex(
+  words: readonly CommandWord[],
+  grammar: GetoptGrammar,
+): number {
+  let index = 1;
+  while (index < words.length) {
+    const word = words[index].text;
+    if (word === "--") {
+      index++;
+      break;
+    }
+    if (!word.startsWith("-") || word === "-") break;
+    const consumed = word.startsWith("--")
+      ? longOptionWords(word.slice(2), grammar.long)
+      : shortClusterWords(word.slice(1), grammar.short);
+    if (consumed === undefined) return -1;
+    index += consumed;
+  }
+  while (index < words.length && isEnvironmentAssignment(words[index].text)) {
+    index++;
+  }
+  return index < words.length ? index : -1;
+}
+
+/**
+ * How many words a short-option cluster spans (`-nu root` is two), or
+ * `undefined` when a letter in it is refused or unlisted.
+ *
+ * A value-taking letter ends the cluster: the rest of the cluster is its value
+ * (`-uedward`), or the following word when nothing is left (`-nu root`).
+ */
+function shortClusterWords(
+  letters: string,
+  table: ReadonlyMap<string, OptionArity>,
+): number | undefined {
+  for (let position = 0; position < letters.length; position++) {
+    const arity = table.get(letters[position]);
+    if (arity === undefined || arity === "refuse") return undefined;
+    if (arity === "value") return position + 1 < letters.length ? 1 : 2;
+  }
+  return 1;
+}
+
+/**
+ * How many words a long option spans (`--user root` is two, `--user=root`
+ * one), or `undefined` when it is refused, unlisted, or ambiguous.
+ */
+function longOptionWords(
+  body: string,
+  table: ReadonlyMap<string, OptionArity>,
+): number | undefined {
+  const equals = body.indexOf("=");
+  const name = equals === -1 ? body : body.slice(0, equals);
+  const arity = resolveLongOption(name, table);
+  if (arity === undefined || arity === "refuse") return undefined;
+  return arity === "value" && equals === -1 ? 2 : 1;
+}
+
+/**
+ * A long option's arity by its exact name, or by the one key it abbreviates.
+ *
+ * Abbreviations resolve against every key, refusing ones included, as
+ * getopt_long does: `--l` is ambiguous between `--list` and `--login`, and
+ * resolving against the admitted keys alone would read it as `--list`.
+ */
+function resolveLongOption(
+  name: string,
+  table: ReadonlyMap<string, OptionArity>,
+): OptionArity | undefined {
+  const exact = table.get(name);
+  if (exact !== undefined) return exact;
+  const matches = [...table.keys()].filter((key) => key.startsWith(name));
+  return matches.length === 1 ? table.get(matches[0]) : undefined;
+}
+
+/**
+ * {@link innerCommandIndex} for a wrapper described by the per-wrapper tables:
+ * its value-taking options ({@link VALUE_TAKING_FLAGS}) and whether it takes a
+ * leading operand ({@link LEADING_OPERAND_WRAPPERS}).
+ */
+function tableInnerIndex(words: readonly CommandWord[], name: string): number {
   const valueTaking = VALUE_TAKING_FLAGS.get(name) ?? EMPTY_FLAGS;
   let operandPending = LEADING_OPERAND_WRAPPERS.has(name);
   let index = 1;
@@ -532,11 +630,15 @@ const EXEC_CONDITIONAL_WRAPPERS = new Map<string, ReadonlySet<string>>([
  * Curated per-wrapper options that consume the following word, so skipping a
  * wrapper's own arguments does not mistake an option's value for the inner
  * command. Attached forms (`-I{}`, `--user=root`) need no entry — they are one
- * word. Only the display-side extraction reads this, and a missing or wrong
- * entry yields `null` (see {@link executedUnitOf}), never a weaker gate.
+ * word.
+ *
+ * This table decides the gate, not only the display: {@link floorExemptionOf}
+ * judges the command it locates, so a missing entry can name a pure reader that
+ * is really an option's value (`xargs -J cat rm x`), and the execution-modifier
+ * clause admits value-taking options from it. A wrapper read by a
+ * {@link GETOPT_GRAMMARS} entry has no row here.
  */
 const VALUE_TAKING_FLAGS = new Map<string, ReadonlySet<string>>([
-  ["sudo", new Set(["-u", "-g", "-p", "-C", "-h", "-U", "-r", "-t"])],
   ["doas", new Set(["-u", "-C"])],
   ["env", new Set(["-u", "-C", "--unset", "--chdir"])],
   [
@@ -553,6 +655,101 @@ const VALUE_TAKING_FLAGS = new Map<string, ReadonlySet<string>>([
 
 const EMPTY_FLAGS: ReadonlySet<string> = new Set<string>();
 
+/**
+ * How a getopt-parsed wrapper treats one of its options: a flag, an option
+ * taking a value, or a mode in which the command the peel would name is not
+ * the one that runs, which refuses the peel.
+ */
+type OptionArity = "flag" | "value" | "refuse";
+
+/**
+ * A wrapper's options as getopt_long reads them, keyed by short letter and by
+ * full long name. Anything absent refuses, so a missing row costs a prompt and
+ * never misplaces the inner command.
+ */
+interface GetoptGrammar {
+  readonly short: ReadonlyMap<string, OptionArity>;
+  readonly long: ReadonlyMap<string, OptionArity>;
+}
+
+/**
+ * `sudo`'s options, verified against `man sudo` (1.9.17p2). The SELinux
+ * `-r`/`-t` (`--role`/`--type`) are absent from that page, so they are left
+ * unlisted and refuse.
+ *
+ * Each refusing mode is one where the command the peel would name is not what
+ * runs as named: `-e` (sudoedit) opens each operand in an editor and writes it
+ * back as root; `-s` and `-i` hand the operand to a shell, which still expands
+ * `$`; `-i`, `-D`, and `-R` move where its relative operands resolve, so the
+ * path surfaces would judge the wrong file; and `-h` is help alone but a remote
+ * host with a value, an arity the page does not settle.
+ */
+const SUDO_GRAMMAR: GetoptGrammar = {
+  short: new Map<string, OptionArity>([
+    ["A", "flag"],
+    ["B", "flag"],
+    ["b", "flag"],
+    ["E", "flag"],
+    ["H", "flag"],
+    ["K", "flag"],
+    ["k", "flag"],
+    ["l", "flag"],
+    ["N", "flag"],
+    ["n", "flag"],
+    ["P", "flag"],
+    ["S", "flag"],
+    ["V", "flag"],
+    ["v", "flag"],
+    ["C", "value"],
+    ["g", "value"],
+    ["p", "value"],
+    ["T", "value"],
+    ["U", "value"],
+    ["u", "value"],
+    ["D", "refuse"],
+    ["e", "refuse"],
+    ["h", "refuse"],
+    ["i", "refuse"],
+    ["R", "refuse"],
+    ["s", "refuse"],
+  ]),
+  long: new Map<string, OptionArity>([
+    ["askpass", "flag"],
+    ["background", "flag"],
+    ["bell", "flag"],
+    ["help", "flag"],
+    ["list", "flag"],
+    ["no-update", "flag"],
+    ["non-interactive", "flag"],
+    // Its value is attached only (`--preserve-env=list`), which a flag accepts.
+    ["preserve-env", "flag"],
+    ["preserve-groups", "flag"],
+    ["remove-timestamp", "flag"],
+    ["reset-timestamp", "flag"],
+    ["set-home", "flag"],
+    ["stdin", "flag"],
+    ["validate", "flag"],
+    ["version", "flag"],
+    ["close-from", "value"],
+    ["command-timeout", "value"],
+    ["group", "value"],
+    ["other-user", "value"],
+    ["prompt", "value"],
+    ["user", "value"],
+    ["chdir", "refuse"],
+    ["chroot", "refuse"],
+    ["edit", "refuse"],
+    ["host", "refuse"],
+    ["login", "refuse"],
+    ["shell", "refuse"],
+  ]),
+};
+
+/** Wrappers whose inner command is located by a getopt grammar. */
+const GETOPT_GRAMMARS = new Map<string, GetoptGrammar>([
+  ["sudo", SUDO_GRAMMAR],
+]);
+
 /**
  * Wrappers that change only *how* the same visible command runs — timing, kill
  * deadline, scheduling, buffering, session — each with the flags (options