@guilz-dev/belay 0.9.1 → 0.9.2

package/dist/adapters/cursor/hooks.d.ts

@@ -1,6 +1,7 @@
 import type { HookEntry, HooksFile } from '../../types.js';
-/** Legacy Belay-managed Shell preToolUse gate duplicated beforeShellExecution. */
-export declare function legacyManagedShellPreToolUseEntry(platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HookEntry;
-export declare function removeLegacyManagedShellPreToolUse(hooks: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HooksFile;
+/** Managed Shell preToolUse gate for Cursor Agent Shell tool invocations. */
+export declare function managedShellPreToolUseEntry(platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HookEntry;
+/** @deprecated Use {@link managedShellPreToolUseEntry}. */
+export declare const legacyManagedShellPreToolUseEntry: typeof managedShellPreToolUseEntry;
 export declare function mergeCursorHooksFile(current: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): HooksFile;
 export declare function hasDuplicateCursorShellGates(hooks: HooksFile, platform: NodeJS.Platform, hooksDir: string, repoRoot: string): boolean;

package/dist/adapters/cursor/hooks.js

@@ -10,37 +10,24 @@ function mergeHookEntry(current, expected, placement) {
     }
     return [...filtered, expected];
 }
-/** Legacy Belay-managed Shell preToolUse gate duplicated beforeShellExecution. */
-export function legacyManagedShellPreToolUseEntry(platform, hooksDir, repoRoot) {
+/** Managed Shell preToolUse gate for Cursor Agent Shell tool invocations. */
+export function managedShellPreToolUseEntry(platform, hooksDir, repoRoot) {
     const managed = getManagedHookEntries(platform, hooksDir, repoRoot);
     const referencePreToolUse = managed.find((entry) => entry.event === 'preToolUse' && entry.definition.matcher === 'Write')?.definition;
     if (!referencePreToolUse) {
-        throw new Error('managed hook definitions missing for legacy Shell migration');
+        throw new Error('managed hook definitions missing for Shell preToolUse gate');
     }
     return {
         command: referencePreToolUse.command,
         matcher: 'Shell',
     };
 }
-export function removeLegacyManagedShellPreToolUse(hooks, platform, hooksDir, repoRoot) {
-    const legacy = legacyManagedShellPreToolUseEntry(platform, hooksDir, repoRoot);
-    const preToolUse = hooks.hooks.preToolUse;
-    if (!Array.isArray(preToolUse)) {
-        return hooks;
-    }
-    return {
-        ...hooks,
-        hooks: {
-            ...hooks.hooks,
-            preToolUse: preToolUse.filter((entry) => !entryMatches(entry, legacy)),
-        },
-    };
-}
+/** @deprecated Use {@link managedShellPreToolUseEntry}. */
+export const legacyManagedShellPreToolUseEntry = managedShellPreToolUseEntry;
 export function mergeCursorHooksFile(current, platform, hooksDir, repoRoot) {
-    const withoutLegacyShell = removeLegacyManagedShellPreToolUse(current, platform, hooksDir, repoRoot);
     const next = {
-        version: withoutLegacyShell.version || 1,
-        hooks: { ...withoutLegacyShell.hooks },
+        version: current.version || 1,
+        hooks: { ...current.hooks },
     };
     const managedEntries = getManagedHookEntries(platform, hooksDir, repoRoot);
     for (const { event, definition } of managedEntries) {
@@ -52,10 +39,11 @@ export function mergeCursorHooksFile(current, platform, hooksDir, repoRoot) {
     return next;
 }
 export function hasDuplicateCursorShellGates(hooks, platform, hooksDir, repoRoot) {
-    const legacy = legacyManagedShellPreToolUseEntry(platform, hooksDir, repoRoot);
+    const shellEntry = managedShellPreToolUseEntry(platform, hooksDir, repoRoot);
     const preToolUse = hooks.hooks.preToolUse;
     if (!Array.isArray(preToolUse)) {
         return false;
     }
-    return preToolUse.some((entry) => entryMatches(entry, legacy));
+    const shellMatches = preToolUse.filter((entry) => entryMatches(entry, shellEntry));
+    return shellMatches.length > 1;
 }

package/dist/bundle/claude-runtime.mjs

@@ -11125,6 +11125,7 @@ function worstEffectDecision(decisions) {
 
 // src/core/effect-ir/shell-lower.ts
 init_git_resource_identity();
+init_path_utils();
 init_shell_tokenizer();
 import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
 import path39 from "node:path";
@@ -12855,6 +12856,159 @@ function gitRequirement(tag, action, resource, segment, signals) {
 // src/core/verdict/launcher-resolve.ts
 import { existsSync as existsSync11, readFileSync as readFileSync5 } from "node:fs";
 import path37 from "node:path";
+
+// src/core/verdict/makefile-expand.ts
+var MAX_EXPAND_DEPTH = 16;
+function parseMakefileVariables(content) {
+  const variables = /* @__PURE__ */ new Map();
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+    const match = /^([A-Za-z_][A-Za-z0-9_]*)\s*[:?]?=\s*(.+)$/.exec(trimmed);
+    if (!match) {
+      continue;
+    }
+    variables.set(match[1] ?? "", (match[2] ?? "").trim());
+  }
+  return variables;
+}
+function parsePhonyTargets(content) {
+  const phony = /* @__PURE__ */ new Set();
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    const match = /^\.PHONY:\s*(.+)$/.exec(trimmed);
+    if (!match) {
+      continue;
+    }
+    for (const token of (match[1] ?? "").split(/\s+/)) {
+      if (token) {
+        phony.add(token);
+      }
+    }
+  }
+  return phony;
+}
+function normalizeMakeRecipeLine(line) {
+  let normalized = line.trim();
+  while (normalized.startsWith("@") || normalized.startsWith("-") || normalized.startsWith("+")) {
+    normalized = normalized.slice(1).trimStart();
+  }
+  return normalized;
+}
+function expandMakeExpression(expression, cliVars, makefileVars) {
+  if (/\$\(\s*shell\b/i.test(expression) || expression.includes("$$")) {
+    return null;
+  }
+  try {
+    const expanded = expandMakeValue(expression, cliVars, makefileVars, 0);
+    if (expanded === null || /\$\(/.test(expanded) || /\$\{/.test(expanded)) {
+      return null;
+    }
+    return expanded;
+  } catch {
+    return null;
+  }
+}
+function expandMakeValue(expression, cliVars, makefileVars, depth) {
+  if (depth > MAX_EXPAND_DEPTH) {
+    return null;
+  }
+  let value = expression.trim();
+  let changed = true;
+  let iterations = 0;
+  while (changed && iterations < MAX_EXPAND_DEPTH) {
+    changed = false;
+    iterations += 1;
+    const orMatch = value.match(/\$\(\s*or\s+([^()]*(?:\([^)]*\)[^()]*)*)\)/);
+    if (orMatch) {
+      const [fullMatch, inner] = orMatch;
+      const parts = splitMakeFunctionArgs(inner ?? "");
+      let selected = null;
+      for (const part of parts) {
+        const expanded = expandMakeValue(part.trim(), cliVars, makefileVars, depth + 1);
+        if (expanded !== null && expanded.trim() !== "") {
+          selected = expanded;
+          break;
+        }
+      }
+      if (selected === null) {
+        const fallback = parts.at(-1)?.trim();
+        selected = fallback === void 0 ? "" : expandMakeValue(fallback, cliVars, makefileVars, depth + 1);
+      }
+      if (selected === null) {
+        return null;
+      }
+      value = value.replace(fullMatch, selected);
+      changed = true;
+      continue;
+    }
+    const varMatch = value.match(/\$\(([A-Za-z_][A-Za-z0-9_]*)\)/);
+    if (varMatch) {
+      const [fullMatch, name] = varMatch;
+      const resolved = resolveMakeVariable(name ?? "", cliVars, makefileVars, depth + 1);
+      if (resolved === null) {
+        return null;
+      }
+      value = value.replace(fullMatch, resolved);
+      changed = true;
+      continue;
+    }
+    const bracedMatch = value.match(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/);
+    if (bracedMatch) {
+      const [fullMatch, name] = bracedMatch;
+      const resolved = name === "PWD" ? "." : resolveMakeVariable(name ?? "", cliVars, makefileVars, depth + 1);
+      if (resolved === null) {
+        return null;
+      }
+      value = value.replace(fullMatch, resolved);
+      changed = true;
+      continue;
+    }
+    break;
+  }
+  return value;
+}
+function resolveMakeVariable(name, cliVars, makefileVars, depth) {
+  if (Object.hasOwn(cliVars, name)) {
+    return cliVars[name] ?? "";
+  }
+  const definition = makefileVars.get(name);
+  if (definition === void 0) {
+    return null;
+  }
+  return expandMakeValue(definition, cliVars, makefileVars, depth);
+}
+function splitMakeFunctionArgs(input) {
+  const parts = [];
+  let current = "";
+  let depth = 0;
+  for (const char of input) {
+    if (char === "(") {
+      depth += 1;
+      current += char;
+      continue;
+    }
+    if (char === ")") {
+      depth -= 1;
+      current += char;
+      continue;
+    }
+    if (char === "," && depth === 0) {
+      parts.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (current.trim()) {
+    parts.push(current.trim());
+  }
+  return parts;
+}
+
+// src/core/verdict/launcher-resolve.ts
 var MAX_RESOLVE_DEPTH = 8;
 var PNPM_BUILTIN_COMMANDS = /* @__PURE__ */ new Set([
   "add",
@@ -12995,10 +13149,9 @@ function resolveNpmRecipe(cwd, repoRoot, scriptName, extraArgs) {
     reason: "npm_script_resolved"
   };
 }
-function parseMakefileRecipes(makefilePath) {
+function parseMakefileRecipeContent(content) {
   const targets = /* @__PURE__ */ new Map();
   try {
-    const content = readFileSync5(makefilePath, "utf8");
     const lines = content.split("\n");
     let currentTarget = null;
     let recipeLines = [];
@@ -13057,7 +13210,7 @@ function parseMakefileRecipes(makefilePath) {
   }
   return targets;
 }
-function resolveMakeRecipe(cwd, repoRoot, target) {
+function resolveMakeRecipe(cwd, repoRoot, target, cliVars = {}) {
   const candidates = ["Makefile", "makefile", "GNUmakefile"];
   let makefilePath = null;
   let searchDir = path37.resolve(cwd);
@@ -13078,7 +13231,10 @@ function resolveMakeRecipe(cwd, repoRoot, target) {
   if (!makefilePath) {
     return { recipes: [], opaque: true, reason: "unknown_local_effect" };
   }
-  const targets = parseMakefileRecipes(makefilePath);
+  const makefileContent = readFileSync5(makefilePath, "utf8");
+  const makefileVars = parseMakefileVariables(makefileContent);
+  const phonyTargets = parsePhonyTargets(makefileContent);
+  const targets = parseMakefileRecipeContent(makefileContent);
   if (!targets.has(target)) {
     return { recipes: [], opaque: true, reason: "make_target_undefined" };
   }
@@ -13104,7 +13260,10 @@ function resolveMakeRecipe(cwd, repoRoot, target) {
         return false;
       }
     }
-    recipeLines.push(...entry.recipes);
+    const skipPhonyPrerequisiteRecipes = name !== target && (phonyTargets.has(name) || name.startsWith("_")) && (targets.get(target)?.recipes.length ?? 0) > 0;
+    if (!skipPhonyPrerequisiteRecipes) {
+      recipeLines.push(...entry.recipes);
+    }
     visiting.delete(name);
     visited.add(name);
     return true;
@@ -13112,15 +13271,24 @@ function resolveMakeRecipe(cwd, repoRoot, target) {
   if (!collect(target)) {
     return { recipes: recipeLines, opaque: true, reason: "make_dependency_cycle" };
   }
+  const expandedRecipes = [];
   for (const line of recipeLines) {
-    if (/\$\(/.test(line) || /\$\{/.test(line)) {
+    const normalized = normalizeMakeRecipeLine(line);
+    const expanded = expandMakeExpression(normalized, cliVars, makefileVars);
+    if (expanded === null) {
       return { recipes: recipeLines, opaque: true, reason: "make_recipe_dynamic" };
     }
+    expandedRecipes.push(expanded);
+  }
+  for (const line of expandedRecipes) {
+    if (/\$\(/.test(line) || /\$\{/.test(line)) {
+      return { recipes: expandedRecipes, opaque: true, reason: "make_recipe_dynamic" };
+    }
   }
   if (opaquePrerequisites) {
-    return { recipes: recipeLines, opaque: true, reason: "make_prerequisite_dynamic" };
+    return { recipes: expandedRecipes, opaque: true, reason: "make_prerequisite_dynamic" };
   }
-  return { recipes: recipeLines, opaque: false, reason: "make_recipe_resolved" };
+  return { recipes: expandedRecipes, opaque: false, reason: "make_recipe_resolved" };
 }
 function resolveLauncherRecipe(params) {
   if (params.depth >= MAX_RESOLVE_DEPTH) {
@@ -13144,8 +13312,28 @@ function resolveLauncherRecipe(params) {
     }
     return resolution;
   }
-  if (tokens[0] === "make" && tokens[1] && !tokens[1].startsWith("-")) {
-    return resolveMakeRecipe(params.cwd, params.repoRoot, tokens[1]);
+  if (tokens[0] === "make") {
+    if (tokens.includes("-n") || tokens.includes("--dry-run")) {
+      return null;
+    }
+    let target = null;
+    const cliVars = {};
+    for (const token of tokens.slice(1)) {
+      if (token.startsWith("-")) {
+        continue;
+      }
+      const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(token);
+      if (assignment) {
+        cliVars[assignment[1] ?? ""] = assignment[2] ?? "";
+        continue;
+      }
+      if (!target) {
+        target = token;
+      }
+    }
+    if (target) {
+      return resolveMakeRecipe(params.cwd, params.repoRoot, target, cliVars);
+    }
   }
   if (tokens[0] === "pnpm" && tokens[1] === "exec" && tokens[2]) {
     return {
@@ -13662,7 +13850,6 @@ function extractRecursiveScript(tokens) {
     return null;
   }
   const head = normalizeHead(filtered[0] ?? "");
-  const second = filtered[1] ?? "";
   if (head === "eval") {
     const body = filtered.slice(1).join(" ").trim();
     return body || null;
@@ -13670,12 +13857,33 @@ function extractRecursiveScript(tokens) {
   if (SHELL_INTERPRETERS.has(head) || CODE_INTERPRETERS.has(head)) {
     const flagIndex = filtered.findIndex((token) => SCRIPT_FLAGS.has(token));
     if (flagIndex !== -1) {
-      const body = filtered.slice(flagIndex + 1).join(" ").replace(/^['"]|['"]$/g, "").trim();
+      const body = filtered[flagIndex + 1] ?? "";
       return body || null;
     }
   }
-  if (head === "bash" && (second === "-lc" || second === "-c")) {
-    const body = filtered.slice(2).join(" ").replace(/^['"]|['"]$/g, "").trim();
+  return null;
+}
+function extractDockerComposeRunScript(tokens) {
+  const head = normalizeHead(tokens[0] ?? "");
+  const usesCompose = head === "docker-compose" || head === "docker" && (tokens[1] ?? "") === "compose";
+  if (!usesCompose) {
+    return null;
+  }
+  if (!tokens.includes("run")) {
+    return null;
+  }
+  const runIndex = tokens.indexOf("run");
+  const tail = tokens.slice(runIndex + 1);
+  for (let index = 0; index < tail.length; index += 1) {
+    const shellHead = normalizeHead(tail[index] ?? "");
+    if (!SHELL_INTERPRETERS.has(shellHead)) {
+      continue;
+    }
+    const flag = tail[index + 1] ?? "";
+    if (flag !== "-lc" && flag !== "-c") {
+      continue;
+    }
+    const body = tail[index + 2] ?? "";
     return body || null;
   }
   return null;
@@ -14039,9 +14247,10 @@ function lowerSegment(command, context) {
   const environment = extractEnvironment(rawTokens, context.env);
   const env = environment.env;
   const parsed = parseSegment(command);
-  const tokens = stripRedirects(environment.commandTokens ?? parsed.tokens).map(
-    (token) => expandKnownVariables(token, env)
-  );
+  const parsedTokens = environment.commandTokens ?? parsed.tokens;
+  const tokens = stripRedirects(
+    parsedTokens.length === 0 && rawTokens.length > 0 && rawTokens.every((token) => ENV_PREFIX_PATTERN2.test(token)) ? rawTokens : parsedTokens
+  ).map((token) => expandKnownVariables(token, env));
   const head = path39.basename(tokens[0] ?? parsed.head);
   let opacity = segmentOpacity(command);
   const signals = /* @__PURE__ */ new Set();
@@ -14143,6 +14352,31 @@ function lowerSegment(command, context) {
     }
     return shellSegment(commandRedacted, head, requirements, "recursive", signals);
   }
+  const dockerComposeScript = extractDockerComposeRunScript(tokens);
+  if (dockerComposeScript && opacity !== "opaque" && opacity !== "unparseable") {
+    requirements.push(
+      processRequirement(head, "spawn", commandRedacted, ["process.docker_compose_run"])
+    );
+    const nested = lowerTopLevelSegments(dockerComposeScript, {
+      ...context,
+      command: dockerComposeScript,
+      env,
+      depth: context.depth + 1
+    });
+    for (const nestedSegment of nested) {
+      requirements.push(
+        ...nestedSegment.requirements.map(
+          (entry) => withInnerProvenance(entry, dockerComposeScript, head, commandRedacted)
+        )
+      );
+      for (const signal of nestedSegment.signals) {
+        signals.add(signal);
+      }
+      opacity = joinNestedOpacity(opacity, nestedSegment);
+    }
+    signals.add("process.docker_compose_run");
+    return shellSegment(commandRedacted, head, requirements, "recursive", signals);
+  }
   const launcher = resolveLauncherRecipe({
     tokens,
     cwd: context.cwd,
@@ -14364,6 +14598,111 @@ function railsReadOnlySubcommand(args) {
   }
   return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
 }
+function isRubyTestScript(scriptPath) {
+  const base = path39.basename(scriptPath);
+  return base.endsWith("_test.rb") || base.endsWith("_spec.rb");
+}
+function parseRubyTestInvocation(args) {
+  const includePaths = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (arg === "-e" || arg === "-r") {
+      return null;
+    }
+    if (arg === "-I") {
+      const includePath = args[index + 1];
+      if (!includePath) {
+        return null;
+      }
+      includePaths.push(includePath);
+      index += 1;
+      continue;
+    }
+    if (arg.startsWith("-I") && arg.length > 2) {
+      includePaths.push(arg.slice(2));
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      if (arg === "-n") {
+        if (!args[index + 1]) {
+          return null;
+        }
+        index += 1;
+        continue;
+      }
+      if (arg.startsWith("-n")) {
+        continue;
+      }
+      return null;
+    }
+    if (isRubyTestScript(arg)) {
+      return { includePaths, scriptPath: arg };
+    }
+    return null;
+  }
+  return null;
+}
+function isRubocopMutating(args) {
+  return args.some(
+    (arg) => arg === "-A" || arg === "-a" || arg === "--auto-correct" || arg === "--autocorrect" || arg.startsWith("--auto-correct-all") || arg.startsWith("--autocorrect-all")
+  );
+}
+function decodeBundleExecInner(innerHead, innerArgs, segment) {
+  const innerBase = executableBaseName(innerHead);
+  if (innerBase === "rubocop") {
+    const mutating = isRubocopMutating(innerArgs);
+    return [
+      processRequirement(
+        innerHead,
+        mutating ? "spawn" : "inspect",
+        segment,
+        mutating ? ["process.linter.mutating"] : ["process.inspect.linter"]
+      )
+    ];
+  }
+  if (innerBase === "rspec") {
+    const targetArgs = innerArgs.filter((arg) => !arg.startsWith("-"));
+    if (targetArgs.length === 0) {
+      return null;
+    }
+    return [processRequirement(innerHead, "spawn", segment, ["process.test_runner.rspec"])];
+  }
+  return null;
+}
+function decodeRuby(args, cwd, repoRoot, segment) {
+  const parsed = parseRubyTestInvocation(args);
+  if (!parsed) {
+    return unsupportedProcess("ruby", segment, "process.ruby_grammar_incomplete");
+  }
+  const scriptPath = resolvePathOperand(parsed.scriptPath, cwd);
+  if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(scriptPath))) {
+    return unsupportedProcess("ruby", segment, "process.ruby_outside_repo");
+  }
+  for (const includePath of parsed.includePaths) {
+    const resolvedInclude = resolvePathOperand(includePath, cwd);
+    if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(resolvedInclude))) {
+      return unsupportedProcess("ruby", segment, "process.ruby_outside_repo");
+    }
+  }
+  const lowered = [
+    processRequirement("ruby", "spawn", segment, ["process.test_runner.minitest"]),
+    requirement2("fs.read", "fs.read", { kind: "path", path: scriptPath }, segment, [
+      "ruby.minitest_script_read"
+    ])
+  ];
+  for (const includePath of parsed.includePaths) {
+    lowered.push(
+      requirement2(
+        "fs.read",
+        "fs.read",
+        { kind: "path", path: resolvePathOperand(includePath, cwd) },
+        segment,
+        ["ruby.minitest_load_path_read"]
+      )
+    );
+  }
+  return lowered;
+}
 function decodeRuntimeMetadataProcess(head, args, segment) {
   if (head === "bundle") {
     if (args.length === 1 && isMetadataOnlyArgv(args)) {
@@ -14385,6 +14724,10 @@ function decodeRuntimeMetadataProcess(head, args, segment) {
           ])
         ];
       }
+      const bundleExecInner = decodeBundleExecInner(innerHead, innerArgs, segment);
+      if (bundleExecInner) {
+        return bundleExecInner;
+      }
     }
     return null;
   }
@@ -14400,9 +14743,74 @@ function decodeRuntimeMetadataProcess(head, args, segment) {
   }
   return null;
 }
+function decodeSetBuiltin(args) {
+  let index = 0;
+  while (index < args.length) {
+    const arg = args[index] ?? "";
+    if (arg === "--") {
+      index += 1;
+      continue;
+    }
+    if (arg === "-o" || arg === "+o") {
+      if (!args[index + 1]) {
+        return false;
+      }
+      index += 2;
+      continue;
+    }
+    if (/^[-+][A-Za-z0-9]+$/.test(arg)) {
+      index += 1;
+      continue;
+    }
+    return false;
+  }
+  return true;
+}
+function decodeShellControlBuiltin(head, args) {
+  if (head === "set") {
+    return decodeSetBuiltin(args) ? [] : null;
+  }
+  if (head === "wait") {
+    if (args.length === 0 || args.every((arg) => /^\d+$/.test(arg))) {
+      return [];
+    }
+    return null;
+  }
+  if (head === "exit") {
+    if (args.length === 0 || args.length === 1 && /^-?\d+$/.test(args[0] ?? "")) {
+      return [];
+    }
+    return null;
+  }
+  return null;
+}
+function decodeDockerComposeRun(head, args, segment) {
+  let composeArgs = null;
+  let command = head;
+  if (head === "docker-compose") {
+    composeArgs = args;
+  } else if (head === "docker" && args[0] === "compose") {
+    composeArgs = args.slice(1);
+    command = "docker";
+  }
+  if (!composeArgs) {
+    return null;
+  }
+  if (composeArgs.includes("run")) {
+    return [processRequirement(command, "spawn", segment, ["process.docker_compose_run"])];
+  }
+  return unsupportedProcess(command, segment, "process.docker_compose_grammar_incomplete");
+}
 function decodeProcessOrFilesystem(params) {
   const { tokens, head, env, cwd, repoRoot, segment } = params;
   const args = tokens.slice(1);
+  if (tokens.length > 0 && tokens.every((token) => ENV_PREFIX_PATTERN2.test(token))) {
+    return [];
+  }
+  const shellControl = decodeShellControlBuiltin(head, args);
+  if (shellControl) {
+    return shellControl;
+  }
   if (isCommandInspection(tokens)) {
     return [processRequirement(head, "inspect", segment, ["process.inspect.command_lookup"])];
   }
@@ -14485,6 +14893,19 @@ function decodeProcessOrFilesystem(params) {
   if (runtimeMetadata) {
     return runtimeMetadata;
   }
+  if (head === "ruby") {
+    return decodeRuby(args, cwd, repoRoot, segment);
+  }
+  if (head === "rubocop" || head === "rspec") {
+    const decoded = decodeBundleExecInner(head, args, segment);
+    if (decoded) {
+      return decoded;
+    }
+  }
+  const dockerCompose = decodeDockerComposeRun(head, args, segment);
+  if (dockerCompose) {
+    return dockerCompose;
+  }
   if ((head === "npm" || head === "pnpm") && args.length === 1 && isMetadataOnlyArgv(args)) {
     return [processRequirement(head, "inspect", segment, ["process.inspect.package_manager"])];
   }
@@ -16723,7 +17144,7 @@ function hashDecisionConfig(config) {
 init_fingerprint2();
 
 // src/version.ts
-var PACKAGE_VERSION = "0.9.1";
+var PACKAGE_VERSION = "0.9.2";
 
 // src/runtime-provenance.ts
 function resolveRuntimeArtifactHash(artifactHash) {