@guilz-dev/belay 0.3.0 → 0.6.0

package/dist/core/judge-fallback-hints.js

@@ -0,0 +1,108 @@
+const INFRASTRUCTURE_FALLBACK_SUFFIXES = [
+    '_cli_nonzero',
+    '_cli_unavailable',
+    '_cli_parse_error',
+    '_cli_spawn_error',
+];
+const INFRASTRUCTURE_FALLBACK_REASONS = new Set([
+    'eval_timeout',
+    'connect_timeout',
+    'parse_timeout',
+    'session_unavailable',
+    'session_disabled',
+    'provider_not_allowlisted',
+    'guard_reset',
+    'kill_switch',
+    'non_json_response',
+    'parse_error',
+    'cli_error',
+    'timeout',
+    'version_mismatch',
+    'shadow_forced_spawn',
+    'unsafe_option_rejected',
+    'broker_busy_reset',
+]);
+function isInfrastructureFallbackReason(reason) {
+    if (INFRASTRUCTURE_FALLBACK_REASONS.has(reason)) {
+        return true;
+    }
+    return INFRASTRUCTURE_FALLBACK_SUFFIXES.some((suffix) => reason.endsWith(suffix));
+}
+function infrastructureSignal(signal) {
+    return isInfrastructureFallbackReason(signal);
+}
+export function extractJudgeFallbackReason(result) {
+    if (result.axes?.judgeFallbackReason) {
+        return result.axes.judgeFallbackReason;
+    }
+    return result.assessment.signals.find((signal) => isInfrastructureFallbackReason(signal));
+}
+export function isJudgeInfrastructureFailure(result) {
+    if (result.axes?.judgeProvider === 'fallback') {
+        return true;
+    }
+    const fallbackReason = extractJudgeFallbackReason(result);
+    if (fallbackReason && isInfrastructureFallbackReason(fallbackReason)) {
+        return true;
+    }
+    return result.assessment.signals.some(infrastructureSignal);
+}
+export function inferProviderIdFromFallbackReason(fallbackReason, fallbackProviderId = 'cursor') {
+    if (!fallbackReason) {
+        return fallbackProviderId;
+    }
+    const match = fallbackReason.match(/^(cursor|claude|codex)_/);
+    return match?.[1] ?? fallbackProviderId;
+}
+export function formatJudgeRecoveryHint(providerId, fallbackReason) {
+    if (!fallbackReason) {
+        return null;
+    }
+    if (fallbackReason.endsWith('_cli_nonzero') || fallbackReason.endsWith('_cli_unavailable')) {
+        switch (providerId) {
+            case 'cursor':
+                return 'Judge CLI is not authenticated. Run: agent login';
+            case 'claude':
+                return 'Claude CLI failed. Run: claude auth login';
+            case 'codex':
+                return 'Codex CLI failed. Check codex auth';
+            default:
+                return `Judge CLI transport failed (${fallbackReason}). Check ${providerId} CLI auth`;
+        }
+    }
+    if (fallbackReason.endsWith('_cli_parse_error')) {
+        return `Judge CLI returned an invalid response (${fallbackReason}). Retry after updating the ${providerId} CLI`;
+    }
+    if (fallbackReason.endsWith('_cli_spawn_error')) {
+        return `Judge CLI could not be started (${fallbackReason}). Install or repair the ${providerId} CLI`;
+    }
+    switch (fallbackReason) {
+        case 'eval_timeout':
+        case 'connect_timeout':
+        case 'parse_timeout':
+        case 'timeout':
+            return 'Judge timed out. Check network or increase judge.timeoutMs';
+        case 'session_unavailable':
+        case 'session_disabled':
+            return 'Judge session transport is unavailable. Run: belay doctor';
+        case 'kill_switch':
+            return 'Judge session kill switch is active. Run: belay judge status';
+        default:
+            if (isInfrastructureFallbackReason(fallbackReason)) {
+                return `Judge transport failed (${fallbackReason}). Run: belay doctor`;
+            }
+            return null;
+    }
+}
+export function formatJudgeInfrastructureDenyMessage(params) {
+    const fallbackReason = params.fallbackReason ?? 'judge_transport_unavailable';
+    const recoveryHint = formatJudgeRecoveryHint(params.providerId, fallbackReason) ??
+        'Judge transport is unavailable. Run: belay doctor';
+    const commandHint = params.command
+        ? ` For details: belay explain --command "${params.command}"`
+        : ' For details: belay explain';
+    return {
+        user_message: `Belay could not reach the Tier1 judge (${fallbackReason}). ${recoveryHint}. Then retry.${commandHint}`,
+        agent_message: `Belay denied this action because the Tier1 judge transport failed (${fallbackReason}). Repair judge infrastructure, then retry the exact same action.`,
+    };
+}

package/dist/core/path-utils.d.ts

@@ -5,8 +5,20 @@
  * fs-scope allowlist matching).
  */
 export declare function canonicalPath(targetPath: string): string;
+export declare function isPathOutsideRoot(relativePath: string): boolean;
 export declare function pathWithinRoot(root: string, targetPath: string): boolean;
 export declare function relativeWithinRepo(repoRoot: string, targetPath: string): string | null;
+export type WorkspaceRootMatch = {
+    kind: 'repo';
+    root: string;
+    relativePath: string;
+} | {
+    kind: 'trusted';
+    root: string;
+    relativePath: string;
+};
+export declare function resolveWorkspaceRootMatch(repoRoot: string, trustedRoots: string[] | undefined, targetPath: string): WorkspaceRootMatch | null;
 export declare function normalizeToken(token: string, repoRoot: string): string;
 export declare function resolveMutationTarget(token: string, cwd: string): string | null;
 export declare function hasOutsideRepoPath(tokens: string[], cwd: string, repoRoot: string): boolean;
+export declare function containingGitRoot(targetPath: string): string | null;

package/dist/core/path-utils.js

@@ -1,5 +1,6 @@
-import { existsSync, realpathSync } from 'node:fs';
+import { existsSync, realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
+import { isFdDuplication, isRedirectOperator } from './shell-tokenizer.js';
 /**
  * Resolve symlinks for the longest existing prefix of `targetPath`, then append
  * any non-existent suffix without further resolution. Keeps path comparisons
@@ -35,6 +36,9 @@ export function canonicalPath(targetPath) {
     }
     return current;
 }
+export function isPathOutsideRoot(relativePath) {
+    return relativePath === '..' || relativePath.startsWith(`..${path.sep}`);
+}
 export function pathWithinRoot(root, targetPath) {
     const resolvedRoot = canonicalPath(root);
     const resolvedTarget = canonicalPath(targetPath);
@@ -42,20 +46,40 @@ export function pathWithinRoot(root, targetPath) {
     if (relativePath === '') {
         return true;
     }
-    return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
+    return !isPathOutsideRoot(relativePath) && !path.isAbsolute(relativePath);
 }
-export function relativeWithinRepo(repoRoot, targetPath) {
-    const resolvedRoot = canonicalPath(repoRoot);
+function relativeWithinRoot(root, targetPath, options = {}) {
+    const resolvedRoot = options.canonicalizeRoot === false ? path.resolve(root) : canonicalPath(root);
     const resolvedTarget = canonicalPath(targetPath);
     const relativePath = path.relative(resolvedRoot, resolvedTarget);
     if (relativePath === '') {
         return '.';
     }
-    if (relativePath.startsWith('..')) {
+    if (isPathOutsideRoot(relativePath) || path.isAbsolute(relativePath)) {
         return null;
     }
     return relativePath;
 }
+export function relativeWithinRepo(repoRoot, targetPath) {
+    return relativeWithinRoot(repoRoot, targetPath);
+}
+export function resolveWorkspaceRootMatch(repoRoot, trustedRoots = [], targetPath) {
+    const canonicalRepoRoot = canonicalPath(repoRoot);
+    const repoRelative = relativeWithinRoot(repoRoot, targetPath);
+    if (repoRelative !== null) {
+        return { kind: 'repo', root: canonicalRepoRoot, relativePath: repoRelative };
+    }
+    const normalizedTrustedRoots = [...new Set(trustedRoots.map((root) => path.resolve(root)))]
+        .filter((root) => root !== canonicalRepoRoot)
+        .sort((left, right) => right.length - left.length);
+    for (const root of normalizedTrustedRoots) {
+        const trustedRelative = relativeWithinRoot(root, targetPath, { canonicalizeRoot: false });
+        if (trustedRelative !== null) {
+            return { kind: 'trusted', root, relativePath: trustedRelative };
+        }
+    }
+    return null;
+}
 export function normalizeToken(token, repoRoot) {
     if (!path.isAbsolute(token)) {
         return token;
@@ -67,7 +91,14 @@ export function resolveMutationTarget(token, cwd) {
     if (!token || token === '--' || token.startsWith('-')) {
         return null;
     }
-    if (token === '2>' || token === '1>' || token === '&>' || token === '1>>' || token === '2>>') {
+    if (isRedirectOperator(token) ||
+        isFdDuplication(token) ||
+        token === '&&' ||
+        token === '||' ||
+        token === '|' ||
+        token === '|&' ||
+        token === ';' ||
+        token === '&') {
         return null;
     }
     if (path.isAbsolute(token)) {
@@ -102,6 +133,28 @@ export function hasOutsideRepoPath(tokens, cwd, repoRoot) {
         if (!resolved) {
             return false;
         }
-        return relativeWithinRepo(repoRoot, resolved) === null;
+        return resolveWorkspaceRootMatch(repoRoot, [], resolved) === null;
     });
 }
+export function containingGitRoot(targetPath) {
+    const resolved = canonicalPath(targetPath);
+    let current = resolved;
+    try {
+        if (!statSync(current).isDirectory()) {
+            current = path.dirname(current);
+        }
+    }
+    catch {
+        current = path.dirname(current);
+    }
+    while (true) {
+        if (existsSync(path.join(current, '.git'))) {
+            return current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}

package/dist/core/reclassify.d.ts

@@ -6,6 +6,8 @@ export interface ReclassifyDiff {
     event?: string;
     summary?: string;
     fingerprint?: string;
+    replayCwd?: string;
+    replayKind?: string;
     previousVerdict: string;
     previousReason: string;
     nextVerdict: string;
@@ -13,3 +15,4 @@ export interface ReclassifyDiff {
 }
 export declare function reclassifyAuditRecord(record: AuditRecord, config: BelayConfigV3, repoRoot: string): Promise<ClassifyResult | null>;
 export declare function diffReclassification(record: AuditRecord, config: BelayConfigV3, repoRoot: string): Promise<ReclassifyDiff | null>;
+export declare function countMissingActionSnapshots(records: AuditRecord[]): number;

package/dist/core/reclassify.js

@@ -1,6 +1,7 @@
 import { getAdapter } from '../adapters/registry.js';
 import { repoShellClassifierOptions } from '../adapters/shared/gate-runtime.js';
 import { detectAdapterName } from '../config-io.js';
+import { hashReplayPayload, parseAuditActionSnapshot, parseAuditReplayContext, } from './audit-replay-context.js';
 import { GATE_EVENTS } from './audit-types.js';
 import { classifyGatedAction, normalizeGatedAction } from './gate-engine.js';
 function shellCommandFromSummary(summary) {
@@ -11,47 +12,68 @@ function classifierOptionsForRepo(config, repoRoot) {
     const adapter = getAdapter(config.adapter ?? detectAdapterName(repoRoot));
     return repoShellClassifierOptions(config, repoRoot, adapter.layout);
 }
+function trustedReplayContext(snapshot, replay) {
+    if (!replay) {
+        return null;
+    }
+    if (snapshot?.payloadHash &&
+        replay.payload &&
+        hashReplayPayload(replay.payload) !== snapshot.payloadHash) {
+        return { ...replay, payload: undefined };
+    }
+    return replay;
+}
 export async function reclassifyAuditRecord(record, config, repoRoot) {
     if (!record.event || !GATE_EVENTS.has(record.event)) {
         return null;
     }
-    const kind = record.kind === 'tool' || record.kind === 'subagent' ? record.kind : 'shell';
+    const snapshot = parseAuditActionSnapshot(record);
+    const replay = trustedReplayContext(snapshot, parseAuditReplayContext(record));
+    const kind = snapshot?.kind ??
+        replay?.kind ??
+        (record.kind === 'tool' || record.kind === 'subagent' ? record.kind : 'shell');
     const summary = record.summary ?? '';
+    const cwd = snapshot?.cwd ?? replay?.cwd ?? repoRoot;
     try {
         if (kind === 'shell') {
-            const command = shellCommandFromSummary(summary);
+            const command = snapshot?.normalizedAction ?? replay?.command ?? shellCommandFromSummary(summary);
             if (!command) {
                 return null;
             }
             const action = normalizeGatedAction({
                 kind: 'shell',
                 repoRoot,
-                cwd: repoRoot,
+                cwd,
                 command,
             });
             return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
         }
         if (kind === 'subagent') {
+            const payload = replay?.payload ??
+                {
+                    tool_name: 'Task',
+                    tool_input: { description: summary },
+                };
             const action = normalizeGatedAction({
                 kind: 'subagent',
                 repoRoot,
-                cwd: repoRoot,
-                payload: {
-                    tool_name: 'Task',
-                    tool_input: { description: summary },
-                },
+                cwd,
+                payload,
             });
             return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
         }
+        const toolName = snapshot?.toolName ?? replay?.toolName ?? 'Shell';
+        const payload = replay?.payload ??
+            {
+                tool_name: toolName,
+                tool_input: { command: snapshot?.normalizedAction ?? replay?.command ?? summary },
+            };
         const action = normalizeGatedAction({
             kind: 'tool',
             repoRoot,
-            cwd: repoRoot,
-            toolName: 'Shell',
-            payload: {
-                tool_name: 'Shell',
-                tool_input: { command: summary },
-            },
+            cwd,
+            toolName,
+            payload,
         });
         return await classifyGatedAction(action, config, classifierOptionsForRepo(config, repoRoot));
     }
@@ -69,14 +91,22 @@ export async function diffReclassification(record, config, repoRoot) {
     if (previousVerdict === next.verdict && previousReason === next.reason) {
         return null;
     }
+    const snapshot = parseAuditActionSnapshot(record);
+    const replay = parseAuditReplayContext(record);
     return {
         timestamp: record.timestamp,
         event: record.event,
         summary: record.summary,
         fingerprint: record.fingerprint,
+        ...(snapshot || replay
+            ? { replayCwd: snapshot?.cwd ?? replay?.cwd, replayKind: snapshot?.kind ?? replay?.kind }
+            : {}),
         previousVerdict,
         previousReason,
         nextVerdict: next.verdict,
         nextReason: next.reason,
     };
 }
+export function countMissingActionSnapshots(records) {
+    return records.filter((record) => record.event && GATE_EVENTS.has(record.event) && !parseAuditActionSnapshot(record)).length;
+}

package/dist/core/recovery/capability.d.ts

@@ -0,0 +1,3 @@
+import type { CapabilityRequestV1 } from '../capability/request.js';
+/** Actions that cannot be closed by local git-worktree / file checkpoint recovery. */
+export declare function capabilityRequestsBlockRecovery(requests: CapabilityRequestV1[] | undefined): boolean;

package/dist/core/recovery/capability.js

@@ -0,0 +1,22 @@
+const NON_RECOVERABLE_ACTIONS = new Set([
+    'network.connect',
+    'git.ref.write',
+    'control_plane.write',
+    'secret.read',
+    'indeterminate',
+]);
+/** Actions that cannot be closed by local git-worktree / file checkpoint recovery. */
+export function capabilityRequestsBlockRecovery(requests) {
+    if (!requests?.length) {
+        return false;
+    }
+    for (const request of requests) {
+        if (NON_RECOVERABLE_ACTIONS.has(request.action)) {
+            return true;
+        }
+        if (request.evidence.level === 'indeterminate') {
+            return true;
+        }
+    }
+    return false;
+}

package/dist/core/recovery/fail-closed.d.ts

@@ -0,0 +1,6 @@
+import type { ClassifyResult } from '../types.js';
+export declare const RECOVERY_SUBSTRATE_UNAVAILABLE = "recovery_substrate_unavailable";
+export declare const RECOVERY_EXECUTION_FAILED = "recovery_execution_failed";
+export declare const RECOVERY_DIRTY_WORKTREE = "recovery_dirty_worktree";
+export declare function recoveryFailReasonFromSkip(skipReason: string): string;
+export declare function recoveryFailClosedResult(predicted: ClassifyResult, reason: string, signals?: string[]): ClassifyResult;

package/dist/core/recovery/fail-closed.js

@@ -0,0 +1,25 @@
+export const RECOVERY_SUBSTRATE_UNAVAILABLE = 'recovery_substrate_unavailable';
+export const RECOVERY_EXECUTION_FAILED = 'recovery_execution_failed';
+export const RECOVERY_DIRTY_WORKTREE = 'recovery_dirty_worktree';
+export function recoveryFailReasonFromSkip(skipReason) {
+    if (skipReason === 'transactional_command_failed' || skipReason === 'transactional_timed_out') {
+        return RECOVERY_EXECUTION_FAILED;
+    }
+    if (skipReason === 'dirty_worktree') {
+        return RECOVERY_DIRTY_WORKTREE;
+    }
+    return RECOVERY_SUBSTRATE_UNAVAILABLE;
+}
+export function recoveryFailClosedResult(predicted, reason, signals = []) {
+    return {
+        ...predicted,
+        verdict: 'deny_pending_approval',
+        reason,
+        assessment: {
+            ...predicted.assessment,
+            reversibility: 'irreversible',
+            confidence: 1,
+            signals: [...predicted.assessment.signals, 'recovery_fail_closed', ...signals],
+        },
+    };
+}

package/dist/core/recovery/index.d.ts

@@ -0,0 +1,3 @@
+export { capabilityRequestsBlockRecovery } from './capability.js';
+export { RECOVERY_DIRTY_WORKTREE, RECOVERY_EXECUTION_FAILED, RECOVERY_SUBSTRATE_UNAVAILABLE, recoveryFailClosedResult, recoveryFailReasonFromSkip, } from './fail-closed.js';
+export type { RecoveryBackend, RecoveryProofContext, RecoveryProofV1 } from './types.js';

package/dist/core/recovery/index.js

@@ -0,0 +1,2 @@
+export { capabilityRequestsBlockRecovery } from './capability.js';
+export { RECOVERY_DIRTY_WORKTREE, RECOVERY_EXECUTION_FAILED, RECOVERY_SUBSTRATE_UNAVAILABLE, recoveryFailClosedResult, recoveryFailReasonFromSkip, } from './fail-closed.js';

package/dist/core/recovery/types.d.ts

@@ -0,0 +1,20 @@
+import type { CapabilityRequestV1 } from '../capability/request.js';
+/** Backends that can mint a verifiable RecoveryProof (ADR: proof-only execution). */
+export type RecoveryBackend = 'git_worktree' | 'file_checkpoint';
+export interface RecoveryProofV1 {
+    version: 1;
+    backend: RecoveryBackend;
+    inputFingerprint: string;
+    resourceScope: string;
+    baseStateHash: string;
+    effectClosure: 'repo_local_fs';
+    issuedAt: string;
+    expiresAt: string;
+    probeSignals: string[];
+}
+export interface RecoveryProofContext {
+    repoRoot: string;
+    cwd: string;
+    command: string;
+    requests: CapabilityRequestV1[];
+}

package/dist/core/recovery/types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/replay-scrub.d.ts

@@ -0,0 +1,9 @@
+import type { GatedActionKind } from './gate-contract.js';
+import type { ScrubOptions } from './types.js';
+/** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
+export declare function subagentFingerprintSource(payload: Record<string, unknown>, scrubOptions: ScrubOptions): unknown;
+/**
+ * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
+ * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.
+ */
+export declare function fingerprintReplayPayload(kind: GatedActionKind, payload: Record<string, unknown> | undefined, scrubOptions: ScrubOptions): Record<string, unknown> | undefined;

package/dist/core/replay-scrub.js

@@ -0,0 +1,43 @@
+import { scrubValue } from './scrub.js';
+/** Subagent fingerprint input — must match classify-subagent `fingerprintSource`. */
+export function subagentFingerprintSource(payload, scrubOptions) {
+    const toolInput = payload.tool_input;
+    if (toolInput && typeof toolInput === 'object') {
+        const input = toolInput;
+        return scrubValue({
+            description: input.description ?? '',
+            prompt: input.prompt ?? '',
+        }, scrubOptions);
+    }
+    const task = payload.task;
+    if (typeof task === 'string') {
+        return scrubValue({ task }, scrubOptions);
+    }
+    if (task && typeof task === 'object') {
+        const taskObj = task;
+        return scrubValue({
+            description: taskObj.description ?? '',
+            prompt: taskObj.prompt ?? '',
+        }, scrubOptions);
+    }
+    return scrubValue(payload, scrubOptions);
+}
+/**
+ * Scrubbed payload used for replay envelope hashing — aligned with classifier fingerprints.
+ * Tool: scrubbed `tool_input`. Subagent: description/prompt subset. Other: full payload.
+ */
+export function fingerprintReplayPayload(kind, payload, scrubOptions) {
+    if (!payload) {
+        return undefined;
+    }
+    if (kind === 'tool') {
+        const toolInput = payload.tool_input;
+        if (toolInput && typeof toolInput === 'object') {
+            return scrubValue(toolInput, scrubOptions);
+        }
+    }
+    if (kind === 'subagent') {
+        return subagentFingerprintSource(payload, scrubOptions);
+    }
+    return scrubValue(payload, scrubOptions);
+}

package/dist/core/shell-tokenizer.d.ts

@@ -1,3 +1,5 @@
+export declare function isRedirectOperator(token: string): boolean;
+export declare function isFdDuplication(token: string): boolean;
 export declare function tokenizeShell(input: string): string[];
 export declare function normalizeShellCommand(command: string, repoRoot: string, normalizeToken: (t: string, r: string) => string): string;
 export declare function splitTopLevelSegments(tokens: string[]): string[][];

package/dist/core/shell-tokenizer.js

@@ -1,4 +1,72 @@
 const ENV_PREFIX_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*=(?:'[^']*'|"[^"]*"|\S+)$/;
+const FD_DUPLICATION_PATTERN = /^\d+[<>]&(?:\d+|-)$/;
+const FD_REDIRECT_PATTERN = /^\d+(?:>>?|<)$/;
+function readDigits(input, index) {
+    let end = index;
+    while (end < input.length && /[0-9]/.test(input[end] ?? '')) {
+        end += 1;
+    }
+    return input.slice(index, end);
+}
+// This tokenizer only recognizes FD redirects when the digit run is immediately
+// followed by `>` or `<` (for example `2>&1`, `3>file`, `12>>log`, `3<file`,
+// `3<&1`). It does not try to recover bash's full word-boundary rules for cases
+// like `foo12>>bar` or `foo12<bar`.
+function readShellOperator(input, index) {
+    const char = input[index];
+    const next = input[index + 1] ?? '';
+    const digits = /[0-9]/.test(char) ? readDigits(input, index) : '';
+    const digitsLength = digits.length;
+    const afterDigits = digitsLength > 0 ? (input[index + digitsLength] ?? '') : '';
+    const afterDigitsNext = digitsLength > 0 ? (input[index + digitsLength + 1] ?? '') : '';
+    if (char === '&' && next === '&') {
+        return { token: '&&', length: 2 };
+    }
+    if (char === '|' && next === '|') {
+        return { token: '||', length: 2 };
+    }
+    if (char === '|' && next === '&') {
+        return { token: '|&', length: 2 };
+    }
+    if (char === '&' && next === '>') {
+        return { token: '&>', length: 2 };
+    }
+    if (digitsLength > 0 && (afterDigits === '>' || afterDigits === '<')) {
+        if (afterDigitsNext === '&') {
+            let end = index + digitsLength + 2;
+            while (end < input.length && /[0-9-]/.test(input[end] ?? '')) {
+                end += 1;
+            }
+            if (end > index + digitsLength + 2) {
+                return { token: input.slice(index, end), length: end - index };
+            }
+        }
+        if (afterDigits === '>' && afterDigitsNext === '>') {
+            return { token: `${digits}>>`, length: digitsLength + 2 };
+        }
+        return { token: `${digits}${afterDigits}`, length: digitsLength + 1 };
+    }
+    if (char === '>' && next === '>') {
+        return { token: '>>', length: 2 };
+    }
+    if (char === '&') {
+        return { token: '&', length: 1 };
+    }
+    if (char === '|' || char === ';' || char === '>' || char === '<') {
+        return { token: char, length: 1 };
+    }
+    return null;
+}
+export function isRedirectOperator(token) {
+    return (token === '>' ||
+        token === '>>' ||
+        token === '<' ||
+        token === '&>' ||
+        FD_REDIRECT_PATTERN.test(token));
+}
+export function isFdDuplication(token) {
+    return FD_DUPLICATION_PATTERN.test(token);
+}
 export function tokenizeShell(input) {
     const tokens = [];
     let buffer = '';
@@ -12,7 +80,6 @@ export function tokenizeShell(input) {
     };
     for (let index = 0; index < input.length; index += 1) {
         const char = input[index];
-        const next = input[index + 1] ?? '';
         if (escaping) {
             buffer += char;
             escaping = false;
@@ -35,27 +102,11 @@ export function tokenizeShell(input) {
             quote = char;
             continue;
         }
-        if (char === '&' && next === '&') {
-            flush();
-            tokens.push('&&');
-            index += 1;
-            continue;
-        }
-        if (char === '|' && next === '|') {
-            flush();
-            tokens.push('||');
-            index += 1;
-            continue;
-        }
-        if (char === '>' && next === '>') {
+        const operator = readShellOperator(input, index);
+        if (operator) {
             flush();
-            tokens.push('>>');
-            index += 1;
-            continue;
-        }
-        if (char === '|' || char === ';' || char === '>' || char === '<') {
-            flush();
-            tokens.push(char);
+            tokens.push(operator.token);
+            index += operator.length - 1;
             continue;
         }
         if (char === '\n' || char === '\r') {
@@ -84,7 +135,12 @@ export function splitTopLevelSegments(tokens) {
     const segments = [];
     let current = [];
     for (const token of tokens) {
-        if (token === '&&' || token === '||' || token === ';' || token === '|') {
+        if (token === '&&' ||
+            token === '||' ||
+            token === ';' ||
+            token === '|' ||
+            token === '&' ||
+            token === '|&') {
             if (current.length > 0) {
                 segments.push(current);
             }
@@ -118,7 +174,10 @@ export function extractRedirectTargets(tokens) {
     const targets = [];
     for (let index = 0; index < tokens.length; index += 1) {
         const token = tokens[index];
-        if (token === '>' || token === '>>' || token === '<') {
+        if (isFdDuplication(token)) {
+            continue;
+        }
+        if (isRedirectOperator(token)) {
             const next = tokens[index + 1];
             if (next) {
                 targets.push(next);