@guilz-dev/belay 0.9.3 → 0.9.4

package/dist/bundle/cursor-runtime.mjs

@@ -3580,7 +3580,7 @@ var init_config_io = __esm({
 
 // src/adapters/cursor/runtime-entry.ts
 init_approval();
-import path58 from "node:path";
+import path65 from "node:path";
 import process2 from "node:process";
 
 // src/core/approval-repo-lookup.ts
@@ -3640,7 +3640,7 @@ init_approval_replay();
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { existsSync as existsSync16 } from "node:fs";
 import { mkdir as mkdir14, readFile as readFile16, writeFile as writeFile11 } from "node:fs/promises";
-import path55 from "node:path";
+import path62 from "node:path";
 
 // src/core/approval-service.ts
 init_config_io();
@@ -6647,31 +6647,44 @@ import { randomUUID as randomUUID3 } from "node:crypto";
 import path22 from "node:path";
 
 // src/core/glob.ts
+init_approval();
+function globPatternToRegexSource(pattern) {
+  let result = "";
+  let index = 0;
+  while (index < pattern.length) {
+    const char = pattern[index];
+    if (char === "*" && pattern[index + 1] === "*") {
+      index += 2;
+      if (pattern[index] === "/") {
+        result += "(?:.*/)?";
+        index += 1;
+      } else {
+        result += ".*";
+      }
+      continue;
+    }
+    if (char === "*") {
+      result += "[^/]*";
+      index += 1;
+      continue;
+    }
+    result += escapeRegex(char);
+    index += 1;
+  }
+  return result;
+}
+function globPatternMatches(pattern, normalized, baseName) {
+  const regex = new RegExp(`^${globPatternToRegexSource(pattern)}$`);
+  return regex.test(normalized) || regex.test(baseName);
+}
 function matchesSensitivePath(filePath, patterns) {
   const normalized = filePath.replaceAll("\\", "/");
   const segments = normalized.split("/");
   const baseName = segments.at(-1) ?? normalized;
   for (const pattern of patterns) {
     const normalizedPattern = pattern.replaceAll("\\", "/");
-    if (normalizedPattern.includes("**")) {
-      const parts = normalizedPattern.split("**").map((part) => part.replace(/^\/+|\/+$/g, ""));
-      const prefix = parts[0]?.replace(/\/+$/, "") ?? "";
-      const suffix = parts[1]?.replace(/^\/+/, "") ?? "";
-      if (prefix && !normalized.startsWith(prefix)) {
-        continue;
-      }
-      if (suffix && !normalized.includes(suffix)) {
-        continue;
-      }
-      if (prefix || suffix) {
-        return true;
-      }
-    }
     if (normalizedPattern.includes("*")) {
-      const regex = new RegExp(
-        `^${normalizedPattern.replaceAll(".", "\\.").replaceAll("*", ".*")}$`
-      );
-      if (regex.test(normalized) || regex.test(baseName)) {
+      if (globPatternMatches(normalizedPattern, normalized, baseName)) {
         return true;
       }
       continue;
@@ -11073,6 +11086,16 @@ function subagentFingerprintSource(payload, scrubOptions) {
   }
   return scrubValue(payload, scrubOptions);
 }
+function fingerprintToolInputSource(payload) {
+  const toolInput = payload.tool_input;
+  if (!toolInput || typeof toolInput !== "object") {
+    return {};
+  }
+  return redactToolInvocationId(
+    toolInput,
+    typeof payload.tool_use_id === "string" ? payload.tool_use_id : void 0
+  );
+}
 function fingerprintReplayPayload(kind, payload, scrubOptions) {
   if (!payload) {
     return void 0;
@@ -11182,7 +11205,7 @@ function classifySubagent(payload, repoRoot, options = {}, config) {
 }
 
 // src/core/classify-tool.ts
-import path43 from "node:path";
+import path50 from "node:path";
 init_fingerprint2();
 init_path_utils();
 init_scrub();
@@ -11301,11 +11324,8 @@ function worstEffectDecision(decisions) {
 }
 
 // src/core/effect-ir/shell-lower.ts
-init_git_resource_identity();
-init_path_utils();
 init_shell_tokenizer();
-import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
-import path42 from "node:path";
+import path49 from "node:path";
 
 // src/core/verdict/docker-compose-run.ts
 import path37 from "node:path";
@@ -11645,6 +11665,17 @@ function decodeDockerComposeRun(tokens) {
 
 // src/core/verdict/egress-classify.ts
 import path38 from "node:path";
+var EGRESS_TOOL_HEADS = /* @__PURE__ */ new Set([
+  "aws",
+  "curl",
+  "gh",
+  "gcloud",
+  "heroku",
+  "kubectl",
+  "netlify",
+  "vercel",
+  "wget"
+]);
 var CURL_EFFECT_NEUTRAL_FLAGS = /* @__PURE__ */ new Set([
   "-f",
   "-L",
@@ -11678,6 +11709,9 @@ var GH_READ_COMMANDS = /* @__PURE__ */ new Set([
   "workflow list",
   "workflow view"
 ]);
+function isEgressToolHead(head) {
+  return EGRESS_TOOL_HEADS.has(head);
+}
 function decodeEgressEffects(params) {
   const head = path38.basename(params.tokens[0] ?? "");
   if (head !== "curl" && head !== "wget" && head !== "gh") {
@@ -13940,7 +13974,7 @@ function extractBalancedParenContent(command, start) {
       index += 1;
       continue;
     }
-    if (char === "\\" && (inSingle || inDouble)) {
+    if (char === "\\" && inDouble) {
       escaping = true;
       index += 1;
       continue;
@@ -14018,7 +14052,9 @@ function hasUnclosedQuote(command) {
       continue;
     }
     if (char === "\\") {
-      escaping = true;
+      if (quote !== "'") {
+        escaping = true;
+      }
       continue;
     }
     if (quote) {
@@ -14535,6 +14571,50 @@ function redactCommand(command) {
   return command.replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/sk-[A-Za-z0-9]{8,}/g, "sk-[REDACTED]").trim();
 }
 
+// src/core/effect-ir/argv-delegate.ts
+function innerRecipeFromArgvDelegate(peel) {
+  if (peel.opaque || peel.innerTokens.length === 0) {
+    return null;
+  }
+  return peel.innerTokens.join(" ");
+}
+function peelArgvDelegateArgv(tokens) {
+  const launcher = tokens[0] ?? "";
+  if (!launcher || tokens.length < 2) {
+    return null;
+  }
+  const signals = ["process.argv_delegate"];
+  let index = 1;
+  while (index < tokens.length) {
+    const token = tokens[index] ?? "";
+    if (token === "--") {
+      index += 1;
+      break;
+    }
+    if (token.startsWith("-")) {
+      return {
+        launcher,
+        innerTokens: [],
+        opaque: true,
+        reason: "argv_delegate_wrapper_options",
+        signals: [...signals, "argv_delegate_wrapper_options"]
+      };
+    }
+    break;
+  }
+  const innerTokens = tokens.slice(index);
+  if (innerTokens.length === 0) {
+    return null;
+  }
+  return {
+    launcher,
+    innerTokens,
+    opaque: false,
+    reason: "argv_delegate_peel",
+    signals
+  };
+}
+
 // src/core/effect-ir/shell-build.ts
 function buildShellEffectPlan(params) {
   const nodes = params.segments.map(buildSegmentNode);
@@ -14592,717 +14672,631 @@ function mergeNodes(nodes) {
   return { kind: "merge", children: nodes };
 }
 
-// src/core/effect-ir/shell-lower.ts
-var MAX_LOWER_DEPTH = 8;
-var ENV_PREFIX_PATTERN2 = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
-var LOOPBACK_HOSTS2 = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0:0:0:0:0:0:0:1"]);
+// src/core/effect-ir/shell-lower/argv-delegate-gate.ts
+import path42 from "node:path";
+var ARGV_DELEGATE_INNER_BLOCKLIST = /* @__PURE__ */ new Set([
+  "sudo",
+  "env",
+  "command",
+  "builtin",
+  "exec",
+  "time",
+  "nice",
+  "nohup",
+  "stdbuf",
+  "setsid",
+  "("
+]);
+function shouldApplyArgvDelegate(head, innerTokens, depth) {
+  if (depth > 0 || isEgressToolHead(head) || head === "bundle") {
+    return false;
+  }
+  if (ARGV_DELEGATE_INNER_BLOCKLIST.has(head)) {
+    return false;
+  }
+  const innerHead = path42.basename(innerTokens[0] ?? "");
+  if (ARGV_DELEGATE_INNER_BLOCKLIST.has(innerHead)) {
+    return false;
+  }
+  return innerTokens.length >= 2;
+}
+function isGrammarUnknownOnly(requirements, head) {
+  if (requirements.length !== 2) {
+    return false;
+  }
+  const [spawn9, indeterminate] = requirements;
+  return spawn9.action === "process.exec" && spawn9.resource.kind === "executable" && spawn9.resource.command === head && spawn9.resource.operation === "spawn" && indeterminate.action === "indeterminate" && indeterminate.evidence.signals.includes("process.grammar_unknown");
+}
+
+// src/core/effect-ir/shell-lower/augment.ts
+init_shell_tokenizer();
+
+// src/core/effect-ir/shell-lower/requirement.ts
 var SECRET_PATH_PATTERN = /(?:^|[/\\])(?:\.env(?:\..*)?|credentials?|secrets?|id_rsa)(?:$|[/\\])/i;
 var CONTROL_PLANE_PATH_PATTERN = /^(?:\/etc(?:\/|$)|\/var\/run(?:\/|$)|.*(?:^|[/\\])\.(?:git|ssh|cursor|claude)(?:[/\\]|$))/;
-function lowerShellEffectPlan(params) {
-  const context = { ...params, depth: 0 };
-  const segments = lowerTopLevelSegments(params.command, context);
-  return buildShellEffectPlan({
-    inputFingerprint: params.inputFingerprint,
-    segments,
-    signals: pipeToShell(params.command) ? ["pipe_to_shell"] : []
-  });
+function requirement2(tag, action, resource, segment, signals) {
+  return {
+    tag,
+    action,
+    resource,
+    evidence: {
+      level: tag === "indeterminate" ? "indeterminate" : "certain",
+      signals: [...new Set(signals)].sort(),
+      basis: ["shell_semantic_lowering"]
+    },
+    provenance: { segment }
+  };
 }
-function lowerTopLevelSegments(command, context) {
-  const commands = splitStructuralShellSegments(command);
-  if (commands.length === 0 && command.trim()) {
-    commands.push(command.trim());
-  }
-  const pipedToShell = pipeToShell(command);
-  const lowered = [];
-  let cwd = context.cwd;
-  let cwdKnown = true;
-  let inferredEnv = { ...context.env };
-  for (const segment of commands) {
-    let result = lowerSegment(segment, {
-      ...context,
-      cwd,
-      env: inferredEnv,
-      command: segment,
-      depth: context.depth,
-      inputFingerprint: context.inputFingerprint,
-      ...pipedToShell && isShellHead(parseSegment(segment).head) ? { pipeToShellSegment: true } : {}
-    });
-    if (!cwdKnown) {
-      const requiresCwd = result.requirements.some(requiresKnownCwd);
-      const requirements = [...result.requirements];
-      if (requiresCwd) {
-        requirements.push(
-          requirement2(
-            "indeterminate",
-            "indeterminate",
-            { kind: "unknown" },
-            result.commandRedacted,
-            ["shell.cwd_unknown"]
-          )
-        );
-      }
-      result = {
-        ...result,
-        requirements,
-        ...requiresCwd ? {
-          completeness: "partial",
-          opacity: joinEffectOpacity(result.opacity, "opaque")
-        } : {},
-        signals: [.../* @__PURE__ */ new Set([...result.signals, "shell.cwd_unknown"])]
-      };
-    }
-    lowered.push(result);
-    if (!inferredEnv.DATABASE_URL && startsLocalPostgresService(segment)) {
-      inferredEnv = {
-        ...inferredEnv,
-        DATABASE_URL: "postgresql://127.0.0.1:5432/local"
-      };
-    }
-    const nextCwd = resolveCdTransition(segment, cwd);
-    if (nextCwd) {
-      cwd = nextCwd.cwd;
-      cwdKnown = nextCwd.known;
-    }
-  }
-  if (commands.length > 1 && /[\r\n]/.test(command) && lowered.some(
-    (segment) => segment.requirements.some((entry) => entry.action === "network.connect")
-  )) {
-    lowered.push(
-      shellSegment(
-        "[multiline network boundary]",
-        "shell-boundary",
-        [
-          requirement2(
-            "indeterminate",
-            "indeterminate",
-            { kind: "unknown" },
-            "[multiline network boundary]",
-            ["shell.multiline_network_boundary"]
-          )
-        ],
-        "opaque",
-        /* @__PURE__ */ new Set(["shell.multiline_network_boundary"])
+function processRequirement(command, operation, segment, signals) {
+  return requirement2(
+    "process.exec",
+    "process.exec",
+    { kind: "executable", command, operation },
+    segment,
+    signals
+  );
+}
+function unsupportedProcess(command, segment, signal) {
+  return [
+    processRequirement(command, "spawn", segment, [signal]),
+    requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [signal])
+  ];
+}
+function addWriteEffects(requirements, resolved, segment, signals) {
+  requirements.push(
+    requirement2("fs.write", "fs.write", { kind: "path", path: resolved }, segment, signals)
+  );
+  if (CONTROL_PLANE_PATH_PATTERN.test(resolved)) {
+    requirements.push(
+      requirement2(
+        "control_plane.write",
+        "control_plane.write",
+        { kind: "path", path: resolved },
+        segment,
+        [...signals, "protected_path"]
       )
     );
   }
-  return lowered;
-}
-function startsLocalPostgresService(command) {
-  const tokens = tokenizeShell(command);
-  return path42.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
 }
-function resolveCdTransition(command, currentCwd) {
-  const tokens = tokenizeShell(command);
-  if (path42.basename(tokens[0] ?? "") !== "cd") {
-    return null;
-  }
-  const target = tokens[1] ?? "~";
-  if (!target || target === "-" || target.includes("$") || target.includes("`")) {
-    return { cwd: currentCwd, known: false };
+function addSecretRead(requirements, resolved, segment) {
+  if (SECRET_PATH_PATTERN.test(resolved)) {
+    requirements.push(
+      requirement2("secret.read", "secret.read", { kind: "path", path: resolved }, segment, [
+        "secret_path_read"
+      ])
+    );
   }
-  return { cwd: resolvePathOperand(target, currentCwd), known: true };
 }
-function requiresKnownCwd(requirementValue) {
-  if (requirementValue.action === "fs.write" || requirementValue.action === "git.ref.write" || requirementValue.action === "control_plane.write") {
-    return true;
+function ensureRequirement(requirements, candidate) {
+  if (!requirements.some(
+    (entry) => entry.action === candidate.action && JSON.stringify(entry.resource) === JSON.stringify(candidate.resource)
+  )) {
+    requirements.push(candidate);
   }
-  return requirementValue.action === "process.exec" && requirementValue.resource.kind === "executable" && requirementValue.resource.operation === "spawn";
-}
-function joinNestedOpacity(outer, nested) {
-  const nestedOpacity = nested.completeness === "partial" && nested.opacity === "transparent" ? "recursive" : nested.opacity;
-  return joinEffectOpacity(outer, nestedOpacity);
 }
-function lowerSegment(command, context) {
-  const commandRedacted = redactCommand(command);
-  const lexed = lexShell(command);
-  const rawTokens = lexed.tokens.map((token) => token.value);
-  const environment = extractEnvironment(rawTokens, context.env);
-  const env = environment.env;
-  const parsed = parseSegment(command);
-  const parsedTokens = environment.commandTokens ?? parsed.tokens;
-  const tokens = stripRedirects(
-    parsedTokens.length === 0 && rawTokens.length > 0 && rawTokens.every((token) => ENV_PREFIX_PATTERN2.test(token)) ? rawTokens : parsedTokens
-  ).map((token) => expandKnownVariables(token, env));
-  const decoderTokens = alignStructuredTokens(
-    stripStructuredRedirects(lexed.tokens),
-    stripRedirects(parsedTokens)
+function withProvenances(requirementValue, provenance, contributing) {
+  const provenances = [
+    ...requirementValue.provenances ?? [requirementValue.provenance],
+    contributing,
+    provenance
+  ].filter(
+    (candidate, index, all) => all.findIndex((entry) => JSON.stringify(entry) === JSON.stringify(candidate)) === index
   );
-  const head = path42.basename(tokens[0] ?? parsed.head);
-  let opacity = segmentOpacity(command);
-  const signals = /* @__PURE__ */ new Set();
-  const requirements = [];
-  if (!lexed.complete) {
-    requirements.push(
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        "shell.grammar_incomplete"
-      ])
-    );
-    signals.add("shell.grammar_incomplete");
-    opacity = joinEffectOpacity(opacity, "unparseable");
-  }
-  addRedirectEffects(requirements, rawTokens, env, context, commandRedacted);
-  addSubstitutionEffects(requirements, command, context, commandRedacted, signals);
-  if (environment.malformed) {
-    requirements.push(
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        "shell.env_wrapper_incomplete"
-      ])
-    );
-    opacity = joinEffectOpacity(opacity, "opaque");
-  }
-  if (parsed.encounteredXargs) {
-    requirements.push(
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        "shell.xargs_stdin_dynamic"
-      ])
-    );
-    signals.add("shell.xargs_stdin_dynamic");
-    opacity = joinEffectOpacity(opacity, "opaque");
-  }
-  if (context.depth > MAX_LOWER_DEPTH) {
-    requirements.push(
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        "shell.lower_depth_exceeded"
-      ])
-    );
-    return shellSegment(
-      commandRedacted,
-      head,
-      requirements,
-      joinEffectOpacity(opacity, "opaque"),
-      signals
-    );
-  }
-  const packageExec = peelPackageExecArgv(tokens);
-  if (packageExec) {
-    requirements.push(
-      ...decodePackageExec(packageExec, context.cwd, context.repoRoot, commandRedacted)
-    );
-    for (const signal of packageExec.signals) {
-      signals.add(signal);
-    }
-    if (packageExec.opaque) {
-      opacity = joinEffectOpacity(opacity, "opaque");
-    }
-    const innerRecipe = packageExecInnerIsMetadata(packageExec) ? null : innerRecipeFromPeel(packageExec);
-    if (innerRecipe) {
-      const nested = lowerTopLevelSegments(innerRecipe, {
-        ...context,
-        command: innerRecipe,
-        env,
-        depth: context.depth + 1
-      });
-      for (const nestedSegment of nested) {
-        requirements.push(
-          ...nestedSegment.requirements.map(
-            (entry) => withInnerProvenance(entry, innerRecipe, packageExec.launcher, commandRedacted)
-          )
-        );
-        for (const signal of nestedSegment.signals) {
-          signals.add(signal);
+  return { ...requirementValue, provenance, provenances };
+}
+function withInnerProvenance(requirementValue, innerCommand, launcher, outerSegment) {
+  const provenance = {
+    ...requirementValue.provenance,
+    segment: outerSegment,
+    innerCommand: requirementValue.provenance.innerCommand ?? innerCommand,
+    ...launcher === "npm" || launcher === "pnpm" ? { launcher, phase: "delegate" } : {}
+  };
+  const launcherProvenance = {
+    segment: outerSegment,
+    innerCommand,
+    ...launcher === "npm" || launcher === "pnpm" ? { launcher, phase: "delegate" } : {}
+  };
+  return withProvenances(requirementValue, provenance, launcherProvenance);
+}
+
+// src/core/effect-ir/shell-lower/tokens.ts
+init_shell_tokenizer();
+import path43 from "node:path";
+var ENV_PREFIX_PATTERN2 = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/;
+var LOOPBACK_HOSTS2 = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "0:0:0:0:0:0:0:1"]);
+var METADATA_ONLY_FLAGS = /* @__PURE__ */ new Set(["--version", "-v", "-V", "--help", "-h"]);
+function extractEnvironment(tokens, inherited) {
+  const env = { ...inherited };
+  const changedNames = /* @__PURE__ */ new Set();
+  if (tokens[0] === "env") {
+    let index = 1;
+    let malformed = false;
+    while (index < tokens.length) {
+      const option = tokens[index] ?? "";
+      if (option === "-u" || option === "--unset") {
+        const name = tokens[index + 1] ?? "";
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+          malformed = true;
+          index += 1;
+          break;
         }
-        opacity = joinNestedOpacity(opacity, nestedSegment);
+        delete env[name];
+        changedNames.add(name);
+        index += 2;
+        continue;
       }
-    }
-    return shellSegment(commandRedacted, head, requirements, opacity, signals);
-  }
-  const recursive = decodeRecursiveInvocationTokens(decoderTokens);
-  if (recursive.kind === "static" && opacity !== "opaque" && opacity !== "unparseable") {
-    requirements.push(
-      processRequirement(recursive.interpreter, "spawn", commandRedacted, [
-        "shell.recursive_wrapper",
-        "dynamic_shell_evaluation"
-      ])
-    );
-    if (recursive.script !== "") {
-      const nested = lowerTopLevelSegments(recursive.script, {
-        ...context,
-        command: recursive.script,
-        env,
-        depth: context.depth + 1
-      });
-      for (const nestedSegment of nested) {
-        requirements.push(
-          ...nestedSegment.requirements.map(
-            (entry) => withInnerProvenance(entry, recursive.script, head, commandRedacted)
-          )
-        );
-        for (const signal of nestedSegment.signals) signals.add(signal);
+      if (option.startsWith("--unset=")) {
+        const name = option.slice("--unset=".length);
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+          malformed = true;
+          index += 1;
+          break;
+        }
+        delete env[name];
+        changedNames.add(name);
+        index += 1;
+        continue;
       }
-    }
-    signals.add("shell.recursive_wrapper");
-    signals.add("dynamic_shell_evaluation");
-    return shellSegment(commandRedacted, head, requirements, "recursive", signals);
-  }
-  if (recursive.kind === "dynamic" || recursive.kind === "indeterminate") {
-    const recursiveSignals = [
-      recursive.signal,
-      ...recursive.kind === "dynamic" ? ["dynamic_shell_evaluation"] : []
-    ];
-    requirements.push(
-      processRequirement(recursive.interpreter, "spawn", commandRedacted, recursiveSignals),
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        ...recursiveSignals
-      ])
-    );
-    for (const signal of recursiveSignals) signals.add(signal);
-    return shellSegment(
-      commandRedacted,
-      head,
-      requirements,
-      joinEffectOpacity(opacity, "opaque"),
-      signals
-    );
-  }
-  const compose = decodeDockerComposeRun(decoderTokens);
-  if (compose.kind === "recursive" && opacity !== "opaque" && opacity !== "unparseable") {
-    requirements.push(
-      processRequirement(head, "spawn", commandRedacted, ["process.docker_compose_run"])
-    );
-    if (compose.script !== "") {
-      const nested = lowerTopLevelSegments(compose.script, {
-        ...context,
-        command: compose.script,
-        env,
-        depth: context.depth + 1
-      });
-      for (const nestedSegment of nested) {
-        requirements.push(
-          ...nestedSegment.requirements.map(
-            (entry) => withInnerProvenance(entry, compose.script, head, commandRedacted)
-          )
-        );
-        for (const signal of nestedSegment.signals) signals.add(signal);
-        opacity = joinNestedOpacity(opacity, nestedSegment);
+      if (option === "-i" || option === "--ignore-environment") {
+        for (const name of Object.keys(env)) {
+          delete env[name];
+        }
+        changedNames.add("*");
+        index += 1;
+        continue;
       }
+      if (option === "--") {
+        index += 1;
+        break;
+      }
+      if (option.startsWith("-")) {
+        malformed = true;
+        index += 1;
+        break;
+      }
+      break;
     }
-    signals.add("process.docker_compose_run");
-    return shellSegment(commandRedacted, head, requirements, "recursive", signals);
-  }
-  if (compose.kind === "dynamic" || compose.kind === "indeterminate") {
-    requirements.push(
-      processRequirement(head, "spawn", commandRedacted, ["process.docker_compose_run"]),
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        compose.signal
-      ])
-    );
-    signals.add("process.docker_compose_run");
-    signals.add(compose.signal);
-    return shellSegment(
-      commandRedacted,
-      head,
-      requirements,
-      joinEffectOpacity(opacity, "opaque"),
-      signals
-    );
-  }
-  const launcher = resolveLauncherRecipe({
-    tokens,
-    cwd: context.cwd,
-    repoRoot: context.repoRoot,
-    depth: context.depth
-  });
-  if (launcher) {
-    signals.add(`launcher.${launcher.reason}`);
-    requirements.push(
-      requirement2(
-        "process.exec",
-        "process.exec",
-        { kind: "executable", command: head, operation: "spawn" },
-        commandRedacted,
-        ["launcher.invoke"]
-      )
-    );
-    for (const recipe of launcher.recipes) {
-      const nested = lowerTopLevelSegments(recipe, {
-        ...context,
-        command: recipe,
-        env,
-        depth: context.depth + 1
-      });
-      for (const nestedSegment of nested) {
-        requirements.push(
-          ...nestedSegment.requirements.map(
-            (entry) => withInnerProvenance(entry, recipe, head, commandRedacted)
-          )
-        );
-        for (const signal of nestedSegment.signals) {
-          signals.add(signal);
-        }
-        opacity = joinNestedOpacity(opacity, nestedSegment);
+    while (index < tokens.length) {
+      const token = tokens[index] ?? "";
+      const match = ENV_PREFIX_PATTERN2.exec(token);
+      if (!match) {
+        break;
+      }
+      const [, name, value] = match;
+      if (name) {
+        env[name] = expandKnownVariables(value ?? "", env);
+        changedNames.add(name);
       }
+      index += 1;
     }
-    if (launcher.opaque || launcher.recipes.length === 0) {
-      requirements.push(
-        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-          `launcher.${launcher.reason}`
-        ])
-      );
-      opacity = joinEffectOpacity(opacity, "opaque");
-    }
-    return shellSegment(commandRedacted, head, requirements, opacity, signals);
+    const commandTokens = tokens.slice(index);
+    return {
+      env,
+      commandTokens,
+      malformed: malformed || commandTokens.length === 0,
+      changedNames
+    };
   }
-  const egress = decodeEgressEffects({
-    tokens,
-    cwd: context.cwd,
-    segment: commandRedacted
-  });
-  if (egress) {
-    requirements.push(...egress);
-    for (const signal of egress.flatMap((entry) => entry.evidence.signals)) {
-      signals.add(signal);
+  for (const token of tokens) {
+    const match = ENV_PREFIX_PATTERN2.exec(token);
+    if (!match) {
+      break;
     }
-  } else {
-    const git = decodeGitEffects({
-      tokens,
-      cwd: context.cwd,
-      repoRoot: context.repoRoot,
-      segment: commandRedacted
-    });
-    if (git) {
-      requirements.push(...git);
-      for (const signal of git.flatMap((entry) => entry.evidence.signals)) {
-        signals.add(signal);
-      }
-    } else {
-      requirements.push(
-        ...decodeProcessOrFilesystem({
-          tokens,
-          head,
-          env,
-          cwd: context.cwd,
-          repoRoot: context.repoRoot,
-          segment: commandRedacted
-        })
-      );
+    const [, name, value] = match;
+    if (name) {
+      env[name] = expandKnownVariables(value ?? "", env);
+      changedNames.add(name);
     }
   }
-  const environmentSignals = effectChangingEnvironmentSignals(head, env, environment.changedNames);
-  if (environmentSignals.length > 0) {
-    requirements.push(
-      requirement2(
-        "indeterminate",
-        "indeterminate",
-        { kind: "unknown" },
-        commandRedacted,
-        environmentSignals
-      )
-    );
-    opacity = joinEffectOpacity(opacity, "opaque");
-    for (const signal of environmentSignals) {
-      signals.add(signal);
+  return { env, malformed: false, changedNames };
+}
+function expandKnownVariables(token, env) {
+  return token.replace(
+    /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g,
+    (raw, a, b) => {
+      const value = env[a ?? b];
+      return value === void 0 ? raw : value;
     }
+  );
+}
+function stripRedirects(tokens) {
+  const stripped = [];
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index] ?? "";
+    if (isFdDuplication(token)) {
+      continue;
+    }
+    if (!isRedirectOperator(token)) {
+      stripped.push(token);
+      continue;
+    }
+    index += 1;
   }
-  if (context.pipeToShellSegment) {
-    signals.add("pipe_to_shell");
-    ensureRequirement(
-      requirements,
-      requirement2(
-        "process.exec",
-        "process.exec",
-        { kind: "executable", command: head || "sh", operation: "spawn" },
-        commandRedacted,
-        ["pipe_to_shell"]
-      )
-    );
-    ensureRequirement(
-      requirements,
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        "pipe_to_shell"
-      ])
-    );
-    opacity = joinEffectOpacity(opacity, "opaque");
-  }
-  if (opacity === "unparseable" || opacity === "opaque") {
-    ensureRequirement(
-      requirements,
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
-        `shell.${opacity}`
-      ])
-    );
-  }
-  return shellSegment(commandRedacted, head, requirements, opacity, signals);
+  return stripped;
 }
-function decodePackageExec(peel, cwd, repoRoot, segment) {
-  if (peel.opaque) {
-    return [
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-        peel.reason,
-        ...peel.signals
-      ])
-    ];
+function stripStructuredRedirects(tokens) {
+  const stripped = [];
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (!token) continue;
+    if (isFdDuplication(token.value)) {
+      continue;
+    }
+    if (!isRedirectOperator(token.value)) {
+      stripped.push(token);
+      continue;
+    }
+    index += 1;
   }
-  if (peel.reason === "npx_wrapper_readonly") {
-    return [];
+  return stripped;
+}
+function alignStructuredTokens(tokens, values) {
+  if (values.length === 0) return [];
+  for (let start = tokens.length - values.length; start >= 0; start -= 1) {
+    const candidate = tokens.slice(start);
+    if (candidate.length === values.length && candidate.every((token, index) => token.value === values[index])) {
+      return candidate;
+    }
   }
-  const binHead = peel.innerTokens[0] ?? "";
-  const metadataOnly = packageExecInnerIsMetadata(peel);
-  const local = !peel.forceAcquire ? resolveLocalBin(binHead, cwd, repoRoot) : null;
-  if (local) {
-    return metadataOnly ? [
-      requirement2(
-        "process.exec",
-        "process.exec",
-        { kind: "executable", command: local.path, operation: "inspect" },
-        segment,
-        ["package_exec.delegate", "package_exec.local_bin_resolved"]
-      )
-    ] : [];
+  return [];
+}
+function resolvePathOperand(operand, cwd) {
+  if (operand === "~") {
+    return process.env.HOME ?? operand;
   }
-  const networkResources = peel.acquisitionSpecs.map((spec) => classifyPackageAcquisitionSpec(spec)).filter((source) => source.kind !== "local").map(
-    (source) => source.kind === "registry" ? {
-      kind: "network",
-      host: "registry.npmjs.org",
-      protocol: "registry",
-      mode: "read",
-      payload: "none"
-    } : {
-      kind: "network",
-      host: source.host,
-      ...source.port ? { port: source.port } : {},
-      protocol: source.protocol,
-      mode: "read",
-      payload: "none"
-    }
-  );
-  if (networkResources.length === 0) {
-    networkResources.push({
-      kind: "network",
-      host: "registry.npmjs.org",
-      protocol: "registry",
-      mode: "read",
-      payload: "none"
-    });
+  if (operand.startsWith("~/")) {
+    return path43.join(process.env.HOME ?? "~", operand.slice(2));
   }
-  return [
-    ...networkResources.map(
-      (resource) => requirement2("network.acquire", "network.connect", resource, segment, [
-        "package_acquire_possible"
-      ])
-    ),
-    requirement2(
-      "fs.write",
-      "fs.write",
-      { kind: "package-cache", manager: peel.launcher === "pnpm" ? "pnpm" : "npm" },
-      segment,
-      ["package_cache_write"]
-    ),
-    ...metadataOnly ? [
-      requirement2(
-        "process.exec",
-        "process.exec",
-        { kind: "executable", command: binHead || peel.launcher, operation: "inspect" },
-        segment,
-        ["package_exec.delegate"]
-      )
-    ] : []
-  ];
+  return path43.resolve(cwd, operand);
 }
-function packageExecInnerIsMetadata(peel) {
-  const args = peel.innerTokens.slice(1);
-  return args.length > 0 && args.every((arg) => ["--help", "--version", "-V", "-h", "-v"].includes(arg));
+function isOptionToken(value) {
+  return value.startsWith("-") || value.startsWith("+");
 }
-var METADATA_ONLY_FLAGS = /* @__PURE__ */ new Set(["--version", "-v", "-V", "--help", "-h"]);
-function isMetadataOnlyArgv(argv) {
-  return argv.length > 0 && argv.every((token) => METADATA_ONLY_FLAGS.has(token));
+function isShellHead(head) {
+  return head === "bash" || head === "sh" || head === "zsh" || head === "dash" || head === "fish";
+}
+function pipeToShell(command) {
+  return /(?:^|[|;&]\s*)(?:bash|sh|zsh|dash|fish)(?:\s|$)/.test(command) && /\|/.test(command);
 }
 function executableBaseName(head) {
-  return path42.basename(head);
+  return path43.basename(head);
 }
-var RAILS_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set(["routes", "middleware", "stats", "about", "version"]);
-function railsReadOnlySubcommand(args) {
-  const subcommand = args[0];
-  if (!subcommand || subcommand.startsWith("-")) {
-    return false;
-  }
-  return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
+function isMetadataOnlyArgv(argv) {
+  return argv.length > 0 && argv.every((token) => METADATA_ONLY_FLAGS.has(token));
 }
-function isRubyTestScript(scriptPath) {
-  const base = path42.basename(scriptPath);
-  return base.endsWith("_test.rb") || base.endsWith("_spec.rb");
+function databaseEndpoint(raw) {
+  if (!raw || raw.includes("$")) {
+    return null;
+  }
+  try {
+    const url = new URL(raw);
+    if (!url.hostname || !url.protocol) {
+      return null;
+    }
+    return {
+      host: url.hostname.toLowerCase(),
+      protocol: url.protocol.slice(0, -1),
+      ...url.port ? { port: Number(url.port) } : {}
+    };
+  } catch {
+    return null;
+  }
 }
-function parseRubyTestInvocation(args) {
-  const includePaths = [];
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
-    if (arg === "-e" || arg === "-r") {
-      return null;
+
+// src/core/effect-ir/shell-lower/augment.ts
+function addRedirectEffects(requirements, tokens, env, context, segment) {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const operator = tokens[index] ?? "";
+    if (!isRedirectOperator(operator) || isFdDuplication(operator)) {
+      continue;
     }
-    if (arg === "-I") {
-      const includePath = args[index + 1];
-      if (!includePath) {
-        return null;
-      }
-      includePaths.push(includePath);
+    const rawTarget = tokens[index + 1];
+    if (!rawTarget) {
+      requirements.push(
+        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+          "shell.redirect_target_missing"
+        ])
+      );
+      continue;
+    }
+    if (operator.includes("<<")) {
+      requirements.push(
+        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+          "shell.heredoc_opaque"
+        ])
+      );
       index += 1;
       continue;
     }
-    if (arg.startsWith("-I") && arg.length > 2) {
-      includePaths.push(arg.slice(2));
+    const target = expandKnownVariables(rawTarget, env);
+    const resolved = resolvePathOperand(target, context.cwd);
+    if (resolved === "/dev/null") {
+      index += 1;
       continue;
     }
-    if (arg.startsWith("-")) {
-      if (arg === "-n") {
-        if (!args[index + 1]) {
-          return null;
-        }
-        index += 1;
-        continue;
-      }
-      if (arg.startsWith("-n")) {
-        continue;
-      }
-      return null;
+    if (operator.includes("<")) {
+      requirements.push(
+        requirement2("fs.read", "fs.read", { kind: "path", path: resolved }, segment, [
+          "shell.input_redirect"
+        ])
+      );
+      addSecretRead(requirements, resolved, segment);
     }
-    if (isRubyTestScript(arg)) {
-      return { includePaths, scriptPath: arg };
+    if (operator.includes(">")) {
+      addWriteEffects(requirements, resolved, segment, ["shell.output_redirect"]);
     }
-    return null;
+    index += 1;
   }
-  return null;
 }
-function isRubocopMutating(args) {
-  return args.some(
-    (arg) => arg === "-A" || arg === "-a" || arg === "--auto-correct" || arg === "--autocorrect" || arg.startsWith("--auto-correct-all") || arg.startsWith("--autocorrect-all")
-  );
+function effectChangingEnvironmentSignals(head, env, changedNames) {
+  if (head === "curl" && (env.CURL_HOME || changedNames.has("CURL_HOME") || changedNames.has("HOME") || changedNames.has("XDG_CONFIG_HOME"))) {
+    return ["egress.curl.environment_config_override"];
+  }
+  if (head === "wget" && (env.WGETRC || changedNames.has("WGETRC") || changedNames.has("HOME"))) {
+    return ["egress.wget.environment_config_override"];
+  }
+  if (head !== "git") {
+    return [];
+  }
+  const hazardousNames = /* @__PURE__ */ new Set([
+    "GIT_ASKPASS",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_CEILING_DIRECTORIES",
+    "GIT_COMMON_DIR",
+    "GIT_CONFIG",
+    "GIT_CONFIG_GLOBAL",
+    "GIT_CONFIG_SYSTEM",
+    "GIT_DIR",
+    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
+    "GIT_EDITOR",
+    "GIT_EXEC_PATH",
+    "GIT_EXTERNAL_DIFF",
+    "GIT_INDEX_FILE",
+    "GIT_NAMESPACE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_PAGER",
+    "GIT_PROXY_COMMAND",
+    "GIT_QUARANTINE_PATH",
+    "GIT_SEQUENCE_EDITOR",
+    "GIT_SHALLOW_FILE",
+    "GIT_SSH",
+    "GIT_SSH_COMMAND",
+    "GIT_TEMPLATE_DIR",
+    "GIT_WORK_TREE",
+    "SSH_ASKPASS"
+  ]);
+  const overridden = changedNames.has("HOME") || changedNames.has("XDG_CONFIG_HOME") || Object.entries(env).some(([name, value]) => {
+    if (!value) {
+      return false;
+    }
+    if (hazardousNames.has(name) || /^GIT_CONFIG_(?:KEY|VALUE)_\d+$/.test(name) || /^GIT_TRACE/.test(name)) {
+      return true;
+    }
+    return name === "GIT_CONFIG_COUNT" && value !== "0";
+  });
+  return overridden ? ["git.environment_execution_or_config_override"] : [];
 }
-function decodeBundleExecInner(innerHead, innerArgs, segment) {
-  const innerBase = executableBaseName(innerHead);
-  if (innerBase === "rubocop") {
-    const mutating = isRubocopMutating(innerArgs);
+
+// src/core/effect-ir/shell-lower/decode-process.ts
+import path47 from "node:path";
+
+// src/core/effect-ir/shell-lower/decoders/belay.ts
+import path44 from "node:path";
+function decodeBelay(args, repoRoot, segment) {
+  const [section, operation, key] = args;
+  const judgeCommand = section === "judge" && operation !== void 0 && ["consent", "list", "status", "test", "use"].includes(operation);
+  const configRead = section === "config" && (operation === void 0 || operation === "list" || operation === "get" && key?.startsWith("judge."));
+  const configJudgeMutation = section === "config" && (["set", "unset"].includes(operation ?? "") && key?.startsWith("judge.") || operation === "credential" && key === "mode");
+  if (judgeCommand || configRead || configJudgeMutation) {
     return [
-      processRequirement(
-        innerHead,
-        mutating ? "spawn" : "inspect",
+      processRequirement("belay", "inspect", segment, [
+        "belay_control_plane_command",
+        configJudgeMutation ? "belay.config_judge_mutation" : "belay.config_read"
+      ])
+    ];
+  }
+  if (section === "config" && ["set", "unset", "credential"].includes(operation ?? "")) {
+    return [
+      requirement2(
+        "control_plane.write",
+        "control_plane.write",
+        { kind: "path", path: path44.join(repoRoot, ".belay-control-plane") },
         segment,
-        mutating ? ["process.linter.mutating"] : ["process.inspect.linter"]
+        ["belay.config_non_judge_mutation"]
       )
     ];
   }
-  if (innerBase === "rspec") {
-    const targetArgs = innerArgs.filter((arg) => !arg.startsWith("-"));
-    if (targetArgs.length === 0) {
-      return null;
+  return [processRequirement("belay", "spawn", segment, ["process.known_local_spawn"])];
+}
+
+// src/core/effect-ir/shell-lower/decoders/builtins.ts
+function decodeSetBuiltin(args) {
+  let index = 0;
+  while (index < args.length) {
+    const arg = args[index] ?? "";
+    if (arg === "--") {
+      index += 1;
+      continue;
     }
-    return [processRequirement(innerHead, "spawn", segment, ["process.test_runner.rspec"])];
+    if (arg === "-o" || arg === "+o") {
+      if (!args[index + 1]) {
+        return false;
+      }
+      index += 2;
+      continue;
+    }
+    if (/^[-+][A-Za-z0-9]+$/.test(arg)) {
+      index += 1;
+      continue;
+    }
+    return false;
   }
-  return null;
+  return true;
 }
-function decodeRuby(args, cwd, repoRoot, segment) {
-  const parsed = parseRubyTestInvocation(args);
-  if (!parsed) {
-    return unsupportedProcess("ruby", segment, "process.ruby_grammar_incomplete");
-  }
-  const scriptPath = resolvePathOperand(parsed.scriptPath, cwd);
-  if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(scriptPath))) {
-    return unsupportedProcess("ruby", segment, "process.ruby_outside_repo");
+function decodeShellControlBuiltin(head, args) {
+  if (head === "set") {
+    return decodeSetBuiltin(args) ? [] : null;
   }
-  for (const includePath of parsed.includePaths) {
-    const resolvedInclude = resolvePathOperand(includePath, cwd);
-    if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(resolvedInclude))) {
-      return unsupportedProcess("ruby", segment, "process.ruby_outside_repo");
+  if (head === "wait") {
+    if (args.length === 0 || args.every((arg) => /^\d+$/.test(arg))) {
+      return [];
     }
+    return null;
   }
-  const lowered = [
-    processRequirement("ruby", "spawn", segment, ["process.test_runner.minitest"]),
-    requirement2("fs.read", "fs.read", { kind: "path", path: scriptPath }, segment, [
-      "ruby.minitest_script_read"
-    ])
-  ];
-  for (const includePath of parsed.includePaths) {
-    lowered.push(
-      requirement2(
-        "fs.read",
-        "fs.read",
-        { kind: "path", path: resolvePathOperand(includePath, cwd) },
-        segment,
-        ["ruby.minitest_load_path_read"]
-      )
-    );
+  if (head === "exit") {
+    if (args.length === 0 || args.length === 1 && /^-?\d+$/.test(args[0] ?? "")) {
+      return [];
+    }
+    return null;
   }
-  return lowered;
+  return null;
 }
-function decodeRuntimeMetadataProcess(head, args, segment) {
-  if (head === "bundle") {
-    if (args.length === 1 && isMetadataOnlyArgv(args)) {
-      return [processRequirement(head, "inspect", segment, ["process.inspect.runtime_metadata"])];
+function validLsof(args) {
+  const flagsWithoutValues = /* @__PURE__ */ new Set(["-a", "-b", "-l", "-n", "-P", "-R", "-t", "-V"]);
+  const flagsWithValues = /* @__PURE__ */ new Set(["-c", "-d", "-F", "-g", "-p", "-T", "-u", "+d", "+D"]);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (flagsWithoutValues.has(arg) || arg === "-i") {
+      continue;
     }
-    if (args[0] === "exec" && args.length >= 2) {
-      const innerHead = args[1] ?? "";
-      const innerArgs = args.slice(2);
-      const innerBase = executableBaseName(innerHead);
-      if ((innerBase === "rails" || innerBase === "rake") && railsReadOnlySubcommand(innerArgs)) {
-        return [
-          processRequirement(innerHead, "inspect", segment, ["process.inspect.rails_read_only"])
-        ];
-      }
-      if (isMetadataOnlyArgv(innerArgs)) {
-        return [
-          processRequirement(innerHead, "inspect", segment, [
-            "process.inspect.bundle_exec_metadata"
-          ])
-        ];
-      }
-      const bundleExecInner = decodeBundleExecInner(innerHead, innerArgs, segment);
-      if (bundleExecInner) {
-        return bundleExecInner;
+    if (flagsWithValues.has(arg)) {
+      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
+        return false;
       }
+      index += 1;
+      continue;
+    }
+    if (/^-[ablnPRtV]+$/.test(arg) && [...arg.slice(1)].every((flag) => "ablnPRtV".includes(flag)) || /^-i(?:TCP|UDP)?(?::\d+(?:-\d+)?)?$/.test(arg) || /^-s(?:TCP|UDP):[A-Za-z]+$/.test(arg) || /^-(?:c|d|F|g|p|T|u).+$/.test(arg) || /^\+(?:d|D).+$/.test(arg)) {
+      continue;
     }
-    return null;
-  }
-  if ((head === "ruby" || head === "yarn") && args.length >= 1 && isMetadataOnlyArgv(args)) {
-    return [processRequirement(head, "inspect", segment, ["process.inspect.runtime_metadata"])];
-  }
-  if (head === "make" && args.includes("-n")) {
-    return [processRequirement(head, "inspect", segment, ["process.inspect.make_dry_run"])];
-  }
-  const base = executableBaseName(head);
-  if ((base === "rails" || base === "rake") && railsReadOnlySubcommand(args)) {
-    return [processRequirement(head, "inspect", segment, ["process.inspect.rails_read_only"])];
+    return false;
   }
-  return null;
+  return true;
 }
-function decodeSetBuiltin(args) {
-  let index = 0;
-  while (index < args.length) {
+function validPs(args) {
+  const bareForms = /* @__PURE__ */ new Set(["aux", "ax", "x", "u"]);
+  const flagsWithoutValues = /* @__PURE__ */ new Set(["-A", "-a", "-d", "-e", "-f", "-j", "-l", "-T", "-x"]);
+  const flagsWithValues = /* @__PURE__ */ new Set([
+    "--format",
+    "--group",
+    "--pid",
+    "--ppid",
+    "--sort",
+    "--tty",
+    "--user"
+  ]);
+  for (let index = 0; index < args.length; index += 1) {
     const arg = args[index] ?? "";
-    if (arg === "--") {
-      index += 1;
+    if (bareForms.has(arg) || flagsWithoutValues.has(arg)) {
       continue;
     }
-    if (arg === "-o" || arg === "+o") {
-      if (!args[index + 1]) {
+    if (flagsWithValues.has(arg)) {
+      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
         return false;
       }
-      index += 2;
+      index += 1;
       continue;
     }
-    if (/^[-+][A-Za-z0-9]+$/.test(arg)) {
-      index += 1;
+    if (/^(?:--format|--group|--pid|--ppid|--sort|--tty|--user)=.+$/.test(arg)) {
       continue;
     }
+    if (/^-[^-]/.test(arg)) {
+      const noValue = /* @__PURE__ */ new Set(["A", "a", "d", "e", "f", "j", "l", "T", "x"]);
+      const withValue = /* @__PURE__ */ new Set(["G", "g", "N", "o", "p", "t", "U", "u"]);
+      const characters = arg.slice(1);
+      let valid = true;
+      for (let optionIndex = 0; optionIndex < characters.length; optionIndex += 1) {
+        const option = characters[optionIndex] ?? "";
+        if (noValue.has(option)) {
+          continue;
+        }
+        if (withValue.has(option)) {
+          if (optionIndex === characters.length - 1) {
+            if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
+              return false;
+            }
+            index += 1;
+          }
+          break;
+        }
+        valid = false;
+        break;
+      }
+      if (valid) {
+        continue;
+      }
+    }
     return false;
   }
   return true;
 }
-function decodeShellControlBuiltin(head, args) {
-  if (head === "set") {
-    return decodeSetBuiltin(args) ? [] : null;
+function validFilesystemTest(head, args) {
+  const operands = head === "[" && args.at(-1) === "]" ? args.slice(0, -1) : args;
+  if (head === "[" && args.at(-1) !== "]") {
+    return false;
   }
-  if (head === "wait") {
-    if (args.length === 0 || args.every((arg) => /^\d+$/.test(arg))) {
-      return [];
+  return operands.length === 2 && (/* @__PURE__ */ new Set(["-b", "-c", "-d", "-e", "-f", "-h", "-L", "-r", "-s", "-w", "-x"])).has(
+    operands[0] ?? ""
+  ) && Boolean(operands[1]);
+}
+function bashSyntaxTarget(args) {
+  let syntaxOnly = false;
+  let script = null;
+  const shortFlags = new Set("abefhkmnptuvxBCEHPT".split(""));
+  const longFlags = /* @__PURE__ */ new Set([
+    "--debugger",
+    "--dump-po-strings",
+    "--dump-strings",
+    "--help",
+    "--login",
+    "--noediting",
+    "--noprofile",
+    "--norc",
+    "--posix",
+    "--restricted",
+    "--verbose",
+    "--version"
+  ]);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (arg === "-c" || arg === "-lc") {
+      return null;
     }
-    return null;
-  }
-  if (head === "exit") {
-    if (args.length === 0 || args.length === 1 && /^-?\d+$/.test(args[0] ?? "")) {
-      return [];
+    if (arg === "-O" || arg === "+O" || arg === "--rcfile" || arg === "--init-file") {
+      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
+        return null;
+      }
+      index += 1;
+      continue;
     }
-    return null;
+    if (arg.startsWith("-O") && arg.length > 2 || arg.startsWith("+O") && arg.length > 2 || arg.startsWith("--rcfile=") && arg.length > "--rcfile=".length || arg.startsWith("--init-file=") && arg.length > "--init-file=".length) {
+      continue;
+    }
+    if (longFlags.has(arg)) {
+      continue;
+    }
+    if (/^[+-][A-Za-z]+$/.test(arg)) {
+      const options = arg.slice(1);
+      if ([...options].some((option) => !shortFlags.has(option))) {
+        return null;
+      }
+      syntaxOnly ||= options.includes("n");
+      continue;
+    }
+    if (arg === "--") {
+      script = args[index + 1] ?? null;
+      break;
+    }
+    if (arg.startsWith("-") || arg.startsWith("+")) {
+      return null;
+    }
+    script = arg;
+    break;
   }
-  return null;
+  return syntaxOnly ? script : null;
 }
+
+// src/core/effect-ir/shell-lower/decoders/docker.ts
 function decodeDockerComposeRun2(head, args, segment) {
   let composeArgs = null;
   let command = head;
@@ -15320,402 +15314,499 @@ function decodeDockerComposeRun2(head, args, segment) {
   }
   return unsupportedProcess(command, segment, "process.docker_compose_grammar_incomplete");
 }
-function decodeProcessOrFilesystem(params) {
-  const { tokens, head, env, cwd, repoRoot, segment } = params;
-  const args = tokens.slice(1);
-  if (tokens.length > 0 && tokens.every((token) => ENV_PREFIX_PATTERN2.test(token))) {
-    return [];
-  }
-  const shellControl = decodeShellControlBuiltin(head, args);
-  if (shellControl) {
-    return shellControl;
-  }
-  if (isCommandInspection(tokens)) {
-    return [processRequirement(head, "inspect", segment, ["process.inspect.command_lookup"])];
-  }
-  if (head === "lsof") {
-    return validLsof(args) ? [processRequirement(head, "inspect", segment, ["process.inspect.lsof"])] : unsupportedProcess(head, segment, "process.lsof_grammar_incomplete");
-  }
-  if (head === "ps") {
-    return validPs(args) ? [processRequirement(head, "inspect", segment, ["process.inspect.ps"])] : unsupportedProcess(head, segment, "process.ps_grammar_incomplete");
-  }
-  if (head === "test" || head === "[") {
-    return validFilesystemTest(head, args) ? [processRequirement(head, "inspect", segment, ["process.inspect.filesystem_test"])] : unsupportedProcess(head, segment, "process.filesystem_test_grammar_incomplete");
-  }
-  if (head === "docker") {
-    if (args[0] === "info") {
-      return validDockerInfo(args.slice(1)) ? [processRequirement(head, "inspect", segment, ["process.inspect.docker_info"])] : unsupportedProcess(head, segment, "process.docker_info_grammar_incomplete");
+function validDockerInfo(args) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (arg === "--help") {
+      continue;
     }
-    if (args[0] === "compose" && ["up", "down", "start", "stop", "restart", "create", "rm"].includes(args[1] ?? "")) {
-      return [processRequirement(head, "spawn", segment, ["service.local_mutation"])];
+    if (arg === "--format" || arg === "-f") {
+      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
+        return false;
+      }
+      index += 1;
+      continue;
     }
-    if (args[0] === "push" || args[0] === "build" && args.includes("--push") || args[0] === "buildx" && args[1] === "build" && (args.includes("--push") || args.some(
-      (arg) => arg.startsWith("--output=type=registry") || arg.startsWith("-o=type=registry")
-    ))) {
-      return [
-        processRequirement(head, "spawn", segment, ["tier0_external", "docker.remote_mutation"]),
-        requirement2(
-          "network.connect",
-          "network.connect",
-          {
-            kind: "network",
-            host: "registry",
-            protocol: "container-registry",
-            mode: "mutate",
-            payload: "present"
-          },
-          segment,
-          ["tier0_external", "docker.remote_mutation"]
-        )
-      ];
+    if (arg.startsWith("--format=")) {
+      if (arg.slice("--format=".length).length === 0) {
+        return false;
+      }
+      continue;
     }
-    if (args[0] === "run" || args[0] === "create" || args[0] === "pull" || args[0] === "build" || args[0] === "buildx" && args[1] === "build") {
-      return [
-        processRequirement(head, "spawn", segment, ["process.docker_spawn"]),
-        requirement2(
-          "network.acquire",
-          "network.connect",
-          {
-            kind: "network",
-            host: "unknown",
-            protocol: "container-registry",
-            mode: "ambiguous",
-            payload: "none"
-          },
-          segment,
-          ["docker.image_acquisition_possible"]
-        )
-      ];
+    return false;
+  }
+  return true;
+}
+
+// src/core/effect-ir/shell-lower/decoders/filesystem.ts
+init_git_resource_identity();
+import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
+import path45 from "node:path";
+function decodeCopyMove(head, args, cwd, segment) {
+  const requirements = [processRequirement(head, "spawn", segment, ["process.filesystem_mutation"])];
+  const operands = [];
+  let targetDirectory = null;
+  let recursive = false;
+  let incomplete = false;
+  let optionsEnded = false;
+  const neutralFlags = /* @__PURE__ */ new Set([
+    "-f",
+    "-i",
+    "-n",
+    "-p",
+    "-v",
+    "--force",
+    "--interactive",
+    "--no-clobber"
+  ]);
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    if (!optionsEnded && arg === "--") {
+      optionsEnded = true;
+      continue;
+    }
+    if (!optionsEnded && (arg === "-r" || arg === "-R" || arg === "--recursive")) {
+      recursive = true;
+      continue;
+    }
+    if (!optionsEnded && (arg === "-t" || arg === "--target-directory")) {
+      const value = args[index + 1];
+      if (!value || value.startsWith("-")) {
+        incomplete = true;
+      } else {
+        targetDirectory = value;
+        index += 1;
+      }
+      continue;
     }
-    return [processRequirement(head, "spawn", segment, ["process.docker_spawn"])];
-  }
-  if (isShellHead(head)) {
-    const syntax = bashSyntaxTarget(args);
-    if (syntax) {
-      return [
-        processRequirement(head, "inspect", segment, ["process.inspect.shell_syntax"]),
-        requirement2(
-          "fs.read",
-          "fs.read",
-          { kind: "path", path: path42.resolve(cwd, syntax) },
-          segment,
-          ["shell.syntax_source_read"]
-        )
-      ];
+    if (!optionsEnded && arg.startsWith("--target-directory=")) {
+      targetDirectory = arg.slice("--target-directory=".length) || null;
+      incomplete ||= !targetDirectory;
+      continue;
     }
-    return unsupportedProcess(head, segment, "process.shell_grammar_incomplete");
-  }
-  if (head === "prisma") {
-    return decodePrisma(args, env, repoRoot, segment);
-  }
-  const runtimeMetadata = decodeRuntimeMetadataProcess(head, args, segment);
-  if (runtimeMetadata) {
-    return runtimeMetadata;
-  }
-  if (head === "ruby") {
-    return decodeRuby(args, cwd, repoRoot, segment);
-  }
-  if (head === "rubocop" || head === "rspec") {
-    const decoded = decodeBundleExecInner(head, args, segment);
-    if (decoded) {
-      return decoded;
+    if (!optionsEnded && arg.startsWith("-")) {
+      if (!neutralFlags.has(arg)) {
+        incomplete = true;
+      }
+      continue;
     }
+    operands.push(arg);
   }
-  const dockerCompose = decodeDockerComposeRun2(head, args, segment);
-  if (dockerCompose) {
-    return dockerCompose;
-  }
-  if ((head === "npm" || head === "pnpm") && args.length === 1 && isMetadataOnlyArgv(args)) {
-    return [processRequirement(head, "inspect", segment, ["process.inspect.package_manager"])];
-  }
-  if (head === "belay") {
-    return decodeBelay(args, repoRoot, segment);
-  }
-  if (head === "tsc") {
-    return decodeTsc(args, cwd, segment);
-  }
-  if (head === "go") {
-    return decodeGo(args, segment);
-  }
-  if (head === "rsync") {
-    return decodeRsync(args, cwd, segment);
-  }
-  if (head === "sed") {
-    return decodeSed(args, cwd, segment);
+  const sources = targetDirectory ? operands : operands.slice(0, -1);
+  const destination = targetDirectory ?? (operands.length >= 2 ? operands.at(-1) ?? null : null);
+  if (sources.length === 0 || !destination) {
+    incomplete = true;
   }
-  if (head === "base64" && args.length === 1 && ["-d", "-D", "--decode"].includes(args[0] ?? "")) {
-    return [processRequirement(head, "inspect", segment, ["process.inspect.base64_stdin"])];
+  for (const source of sources) {
+    const resolved = resolvePathOperand(source, cwd);
+    requirements.push(
+      requirement2("fs.read", "fs.read", { kind: "path", path: resolved }, segment, [
+        `${head}.source_read`
+      ])
+    );
+    addSecretRead(requirements, resolved, segment);
+    if (head === "mv") {
+      addWriteEffects(requirements, resolved, segment, ["mv.source_remove"]);
+    }
   }
-  if (head === "node") {
-    return decodeNode2(args, cwd, segment);
+  if (destination) {
+    addWriteEffects(requirements, resolvePathOperand(destination, cwd), segment, [
+      `${head}.destination_write`
+    ]);
   }
-  if (head === "vite" || head === "vite-node") {
-    return [processRequirement(head, "spawn", segment, ["process.local_dev_spawn"])];
+  if (recursive || incomplete) {
+    requirements.push(
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+        recursive ? `${head}.recursive_source` : `${head}.grammar_incomplete`
+      ])
+    );
   }
-  if ((head === "npm" || head === "pnpm") && args[0] === "publish" || head === "terraform" && args[0] === "apply") {
+  return requirements;
+}
+function decodeRm(args, cwd, repoRoot, segment) {
+  const requirements = [processRequirement("rm", "spawn", segment, ["process.filesystem_mutation"])];
+  const recursive = args.some(
+    (arg) => arg === "-r" || arg === "-R" || arg === "--recursive" || /^-[^-]*[rR]/.test(arg)
+  );
+  const operands = args.filter((arg) => arg && !arg.startsWith("-"));
+  if (operands.length === 0) {
     return [
-      processRequirement(head, "spawn", segment, ["tier0_external"]),
-      requirement2(
-        "network.connect",
-        "network.connect",
-        {
-          kind: "network",
-          host: "control-plane",
-          protocol: head,
-          mode: "mutate",
-          payload: "present"
-        },
-        segment,
-        ["tier0_external"]
-      )
+      ...requirements,
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+        "rm.operand_missing"
+      ])
     ];
   }
-  if (head === "cd") {
-    return [];
-  }
-  if (head === "cp" || head === "mv") {
-    return decodeCopyMove(head, args, cwd, segment);
-  }
-  if (head === "rm") {
-    return decodeRm(args, cwd, repoRoot, segment);
+  const identity = inspectGitResourceIdentity(repoRoot);
+  for (const operand of operands) {
+    const resolved = resolvePathOperand(operand, cwd);
+    addWriteEffects(requirements, resolved, segment, ["filesystem.write", "rm.remove"]);
+    const finalOperandIsSymlink = isSymbolicLink(resolved);
+    const canonicalResolved = canonicalRmOperand(resolved, finalOperandIsSymlink);
+    const targetIdentity = recursive && !finalOperandIsSymlink ? inspectGitResourceIdentity(resolved) : { status: "absent" };
+    const sameIdentityTargetRoot = identity.status === "resolved" && targetIdentity.status === "resolved" && identity.identity.commonDir === targetIdentity.identity.commonDir && pathContains(canonicalResolved, targetIdentity.identity.repositoryRoot);
+    if (recursive && identity.status === "resolved" && (sameIdentityTargetRoot || [
+      repoRoot,
+      identity.identity.repositoryRoot,
+      identity.identity.gitDir,
+      identity.identity.commonDir,
+      identity.identity.gitEntryPath
+    ].some((metadataPath) => pathContains(canonicalResolved, metadataPath)))) {
+      const gitEntryPath = targetIdentity.status === "resolved" ? targetIdentity.identity.gitEntryPath : identity.identity.gitEntryPath;
+      requirements.push(
+        requirement2(
+          "control_plane.write",
+          "control_plane.write",
+          { kind: "path", path: gitEntryPath },
+          segment,
+          ["rm.recursive_git_boundary", "tier1_catastrophic"]
+        )
+      );
+    }
   }
-  if (head === "vitest" || head === "eslint" || head === "biome" || head === "belay") {
-    return [processRequirement(head, "spawn", segment, ["process.known_local_spawn"])];
+  return requirements;
+}
+function canonicalRmOperand(targetPath, finalOperandIsSymlink) {
+  try {
+    if (finalOperandIsSymlink) {
+      return path45.join(realpathSync4.native(path45.dirname(targetPath)), path45.basename(targetPath));
+    }
+    return realpathSync4.native(targetPath);
+  } catch {
+    return path45.resolve(targetPath);
   }
-  if (head === "pwd" || head === "which" || head === "whoami") {
-    return [processRequirement(head, "inspect", segment, ["process.pure_inspection"])];
+}
+function isSymbolicLink(targetPath) {
+  try {
+    return lstatSync2(targetPath).isSymbolicLink();
+  } catch {
+    return false;
   }
-  const readOperands = filesystemReadOperands(head, args);
-  if (readOperands !== null) {
-    const lowered = [processRequirement(head, "inspect", segment, ["process.filesystem_inspect"])];
-    for (const operand of readOperands) {
-      const resolved = resolvePathOperand(operand, cwd);
-      lowered.push(
-        requirement2("fs.read", "fs.read", { kind: "path", path: resolved }, segment, [
-          "filesystem.read"
-        ])
-      );
-      addSecretRead(lowered, resolved, segment);
+}
+function pathContains(ancestor, candidate) {
+  const relative = path45.relative(path45.resolve(ancestor), path45.resolve(candidate));
+  return relative === "" || !relative.startsWith("..") && !path45.isAbsolute(relative);
+}
+function filesystemReadOperands(head, args) {
+  switch (head) {
+    case "ls": {
+      const operands = args.filter((arg) => arg && !arg.startsWith("-"));
+      return operands.length > 0 ? operands : ["."];
     }
-    return lowered;
+    case "find":
+      return findReadOperands(args);
+    case "cat":
+    case "head":
+    case "tail":
+    case "less":
+    case "stat":
+    case "file":
+    case "du":
+    case "wc":
+      return args.filter((arg) => arg && !arg.startsWith("-"));
+    case "grep":
+    case "rg":
+      return args.slice(1).filter((arg) => arg && !arg.startsWith("-"));
+    case "jq":
+      return args.slice(1).filter((arg) => arg && !arg.startsWith("-"));
+    default:
+      return null;
   }
-  const writeOperands = filesystemWriteOperands(head, args);
-  if (writeOperands !== null) {
-    const lowered = [processRequirement(head, "spawn", segment, ["process.filesystem_mutation"])];
-    for (const operand of writeOperands) {
-      addWriteEffects(lowered, resolvePathOperand(operand, cwd), segment, ["filesystem.write"]);
+}
+function findReadOperands(args) {
+  const mutatingPrimaries = /* @__PURE__ */ new Set([
+    "-delete",
+    "-exec",
+    "-execdir",
+    "-fls",
+    "-fprint",
+    "-fprintf",
+    "-ok",
+    "-okdir"
+  ]);
+  if (args.some(
+    (arg) => mutatingPrimaries.has(arg) || [...mutatingPrimaries].some((primary) => arg.startsWith(`${primary}=`))
+  )) {
+    return null;
+  }
+  const paths = [];
+  for (const arg of args) {
+    if (arg.startsWith("-") || arg === "!" || arg === "(") {
+      break;
     }
-    return lowered;
+    paths.push(arg);
   }
-  if (head === "printf" || head === "echo" || head === "true" || head === "false" || head === ":") {
-    return [];
+  return paths.length > 0 ? paths : ["."];
+}
+function filesystemWriteOperands(head, args) {
+  const positional = args.filter((arg) => arg && !arg.startsWith("-"));
+  switch (head) {
+    case "touch":
+    case "mkdir":
+    case "rm":
+    case "truncate":
+    case "chmod":
+      return positional;
+    case "cp":
+    case "mv":
+      return positional.length > 0 ? [positional[positional.length - 1] ?? ""] : [];
+    case "tee":
+      return positional;
+    default:
+      return null;
   }
-  if (!head) {
+}
+
+// src/core/effect-ir/shell-lower/decoders/prisma.ts
+function decodePrisma(args, env, repoRoot, segment) {
+  const processEffect = processRequirement("prisma", "spawn", segment, ["process.prisma"]);
+  if (args[0] === "generate") {
     return [
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-        "shell.segment_empty"
+      processEffect,
+      requirement2("fs.write", "fs.write", { kind: "path", path: repoRoot }, segment, [
+        "prisma.generate.repo_local"
       ])
     ];
   }
-  return unsupportedProcess(head, segment, "process.grammar_unknown");
-}
-function decodeBelay(args, repoRoot, segment) {
-  const [section, operation, key] = args;
-  const judgeCommand = section === "judge" && operation !== void 0 && ["consent", "list", "status", "test", "use"].includes(operation);
-  const configRead = section === "config" && (operation === void 0 || operation === "list" || operation === "get" && key?.startsWith("judge."));
-  const configJudgeMutation = section === "config" && (["set", "unset"].includes(operation ?? "") && key?.startsWith("judge.") || operation === "credential" && key === "mode");
-  if (judgeCommand || configRead || configJudgeMutation) {
+  const databaseMutation = args[0] === "migrate" || args[0] === "db" && args[1] === "seed" || args[0] === "seed";
+  if (!databaseMutation) {
     return [
-      processRequirement("belay", "inspect", segment, [
-        "belay_control_plane_command",
-        configJudgeMutation ? "belay.config_judge_mutation" : "belay.config_read"
+      processEffect,
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+        "prisma.grammar_incomplete"
       ])
     ];
   }
-  if (section === "config" && ["set", "unset", "credential"].includes(operation ?? "")) {
+  const endpoint = databaseEndpoint(env.DATABASE_URL);
+  if (!endpoint) {
     return [
+      processEffect,
       requirement2(
-        "control_plane.write",
-        "control_plane.write",
-        { kind: "path", path: path42.join(repoRoot, ".belay-control-plane") },
+        "network.connect",
+        "network.connect",
+        {
+          kind: "network",
+          host: "unknown",
+          protocol: "database",
+          mode: "ambiguous",
+          payload: "present"
+        },
         segment,
-        ["belay.config_non_judge_mutation"]
-      )
+        ["prisma.database_endpoint_unknown"]
+      ),
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+        "prisma.database_endpoint_unknown"
+      ])
     ];
   }
-  return [processRequirement("belay", "spawn", segment, ["process.known_local_spawn"])];
+  const network = requirement2(
+    "network.connect",
+    "network.connect",
+    {
+      kind: "network",
+      ...endpoint,
+      mode: "mutate",
+      payload: "present"
+    },
+    segment,
+    [LOOPBACK_HOSTS2.has(endpoint.host) ? "prisma.database_local" : "prisma.database_remote"]
+  );
+  if (LOOPBACK_HOSTS2.has(endpoint.host)) {
+    return [processEffect, network];
+  }
+  return [
+    processEffect,
+    network,
+    requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+      "prisma.remote_database_mutation"
+    ])
+  ];
 }
-function decodeTsc(args, cwd, segment) {
-  const metadataOnly = args.length > 0 && args.every((arg) => ["--help", "--version", "-h", "-v"].includes(arg));
-  const requirements = [];
-  let hasOutput = false;
+
+// src/core/effect-ir/shell-lower/decoders/ruby.ts
+init_path_utils();
+import path46 from "node:path";
+var RAILS_READ_ONLY_SUBCOMMANDS = /* @__PURE__ */ new Set(["routes", "middleware", "stats", "about", "version"]);
+function railsReadOnlySubcommand(args) {
+  const subcommand = args[0];
+  if (!subcommand || subcommand.startsWith("-")) {
+    return false;
+  }
+  return RAILS_READ_ONLY_SUBCOMMANDS.has(subcommand);
+}
+function isRubyTestScript(scriptPath) {
+  const base = path46.basename(scriptPath);
+  return base.endsWith("_test.rb") || base.endsWith("_spec.rb");
+}
+function parseRubyTestInvocation(args) {
+  const includePaths = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index] ?? "";
-    const inline = arg.match(/^--(?:outDir|outFile)=(.+)$/)?.[1];
-    const separate = (arg === "--outDir" || arg === "--outFile") && args[index + 1] ? args[index + 1] : null;
-    const output = inline ?? separate;
-    if (!output) {
-      continue;
+    if (arg === "-e" || arg === "-r") {
+      return null;
     }
-    hasOutput = true;
-    addWriteEffects(requirements, resolvePathOperand(output, cwd), segment, ["tsc.output"]);
-    if (separate) {
+    if (arg === "-I") {
+      const includePath = args[index + 1];
+      if (!includePath) {
+        return null;
+      }
+      includePaths.push(includePath);
       index += 1;
+      continue;
+    }
+    if (arg.startsWith("-I") && arg.length > 2) {
+      includePaths.push(arg.slice(2));
+      continue;
+    }
+    if (arg.startsWith("-")) {
+      if (arg === "-n") {
+        if (!args[index + 1]) {
+          return null;
+        }
+        index += 1;
+        continue;
+      }
+      if (arg.startsWith("-n")) {
+        continue;
+      }
+      return null;
+    }
+    if (isRubyTestScript(arg)) {
+      return { includePaths, scriptPath: arg };
     }
+    return null;
   }
-  const typecheckOnly = args.includes("--noEmit") && !hasOutput;
-  const inspect = metadataOnly || typecheckOnly;
-  requirements.unshift(
-    processRequirement("tsc", inspect ? "inspect" : "spawn", segment, [
-      metadataOnly ? "process.inspect.tsc_metadata" : typecheckOnly ? "process.inspect.tsc_typecheck" : "process.known_local_spawn"
-    ])
+  return null;
+}
+function isRubocopMutating(args) {
+  return args.some(
+    (arg) => arg === "-A" || arg === "-a" || arg === "--auto-correct" || arg === "--autocorrect" || arg.startsWith("--auto-correct-all") || arg.startsWith("--autocorrect-all")
   );
-  return requirements;
 }
-function decodeCopyMove(head, args, cwd, segment) {
-  const requirements = [processRequirement(head, "spawn", segment, ["process.filesystem_mutation"])];
-  const operands = [];
-  let targetDirectory = null;
-  let recursive = false;
-  let incomplete = false;
-  let optionsEnded = false;
-  const neutralFlags = /* @__PURE__ */ new Set([
-    "-f",
-    "-i",
-    "-n",
-    "-p",
-    "-v",
-    "--force",
-    "--interactive",
-    "--no-clobber"
-  ]);
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
-    if (!optionsEnded && arg === "--") {
-      optionsEnded = true;
-      continue;
+function decodeBundleExecInner(innerHead, innerArgs, segment) {
+  const innerBase = executableBaseName(innerHead);
+  if (innerBase === "rubocop") {
+    const mutating = isRubocopMutating(innerArgs);
+    return [
+      processRequirement(
+        innerHead,
+        mutating ? "spawn" : "inspect",
+        segment,
+        mutating ? ["process.linter.mutating"] : ["process.inspect.linter"]
+      )
+    ];
+  }
+  if (innerBase === "rspec") {
+    const targetArgs = innerArgs.filter((arg) => !arg.startsWith("-"));
+    if (targetArgs.length === 0) {
+      return null;
     }
-    if (!optionsEnded && (arg === "-r" || arg === "-R" || arg === "--recursive")) {
-      recursive = true;
-      continue;
+    return [processRequirement(innerHead, "spawn", segment, ["process.test_runner.rspec"])];
+  }
+  return null;
+}
+function decodeRuby(args, cwd, repoRoot, segment) {
+  const parsed = parseRubyTestInvocation(args);
+  if (!parsed) {
+    return unsupportedProcess("ruby", segment, "process.ruby_grammar_incomplete");
+  }
+  const scriptPath = resolvePathOperand(parsed.scriptPath, cwd);
+  if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(scriptPath))) {
+    return unsupportedProcess("ruby", segment, "process.ruby_outside_repo");
+  }
+  for (const includePath of parsed.includePaths) {
+    const resolvedInclude = resolvePathOperand(includePath, cwd);
+    if (!pathWithinRoot(canonicalPath(repoRoot), canonicalPath(resolvedInclude))) {
+      return unsupportedProcess("ruby", segment, "process.ruby_outside_repo");
     }
-    if (!optionsEnded && (arg === "-t" || arg === "--target-directory")) {
-      const value = args[index + 1];
-      if (!value || value.startsWith("-")) {
-        incomplete = true;
-      } else {
-        targetDirectory = value;
-        index += 1;
+  }
+  const lowered = [
+    processRequirement("ruby", "spawn", segment, ["process.test_runner.minitest"]),
+    requirement2("fs.read", "fs.read", { kind: "path", path: scriptPath }, segment, [
+      "ruby.minitest_script_read"
+    ])
+  ];
+  for (const includePath of parsed.includePaths) {
+    lowered.push(
+      requirement2(
+        "fs.read",
+        "fs.read",
+        { kind: "path", path: resolvePathOperand(includePath, cwd) },
+        segment,
+        ["ruby.minitest_load_path_read"]
+      )
+    );
+  }
+  return lowered;
+}
+function decodeRuntimeMetadataProcess(head, args, segment) {
+  if (head === "bundle") {
+    if (args.length === 1 && isMetadataOnlyArgv(args)) {
+      return [processRequirement(head, "inspect", segment, ["process.inspect.runtime_metadata"])];
+    }
+    if (args[0] === "exec" && args.length >= 2) {
+      const innerHead = args[1] ?? "";
+      const innerArgs = args.slice(2);
+      const innerBase = executableBaseName(innerHead);
+      if ((innerBase === "rails" || innerBase === "rake") && railsReadOnlySubcommand(innerArgs)) {
+        return [
+          processRequirement(innerHead, "inspect", segment, ["process.inspect.rails_read_only"])
+        ];
+      }
+      if (isMetadataOnlyArgv(innerArgs)) {
+        return [
+          processRequirement(innerHead, "inspect", segment, [
+            "process.inspect.bundle_exec_metadata"
+          ])
+        ];
       }
-      continue;
-    }
-    if (!optionsEnded && arg.startsWith("--target-directory=")) {
-      targetDirectory = arg.slice("--target-directory=".length) || null;
-      incomplete ||= !targetDirectory;
-      continue;
-    }
-    if (!optionsEnded && arg.startsWith("-")) {
-      if (!neutralFlags.has(arg)) {
-        incomplete = true;
+      const bundleExecInner = decodeBundleExecInner(innerHead, innerArgs, segment);
+      if (bundleExecInner) {
+        return bundleExecInner;
       }
-      continue;
     }
-    operands.push(arg);
-  }
-  const sources = targetDirectory ? operands : operands.slice(0, -1);
-  const destination = targetDirectory ?? (operands.length >= 2 ? operands.at(-1) ?? null : null);
-  if (sources.length === 0 || !destination) {
-    incomplete = true;
+    return null;
   }
-  for (const source of sources) {
-    const resolved = resolvePathOperand(source, cwd);
-    requirements.push(
-      requirement2("fs.read", "fs.read", { kind: "path", path: resolved }, segment, [
-        `${head}.source_read`
-      ])
-    );
-    addSecretRead(requirements, resolved, segment);
-    if (head === "mv") {
-      addWriteEffects(requirements, resolved, segment, ["mv.source_remove"]);
-    }
+  if ((head === "ruby" || head === "yarn") && args.length >= 1 && isMetadataOnlyArgv(args)) {
+    return [processRequirement(head, "inspect", segment, ["process.inspect.runtime_metadata"])];
   }
-  if (destination) {
-    addWriteEffects(requirements, resolvePathOperand(destination, cwd), segment, [
-      `${head}.destination_write`
-    ]);
+  if (head === "make" && args.includes("-n")) {
+    return [processRequirement(head, "inspect", segment, ["process.inspect.make_dry_run"])];
   }
-  if (recursive || incomplete) {
-    requirements.push(
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-        recursive ? `${head}.recursive_source` : `${head}.grammar_incomplete`
-      ])
-    );
+  const base = executableBaseName(head);
+  if ((base === "rails" || base === "rake") && railsReadOnlySubcommand(args)) {
+    return [processRequirement(head, "inspect", segment, ["process.inspect.rails_read_only"])];
   }
-  return requirements;
+  return null;
 }
-function decodeRm(args, cwd, repoRoot, segment) {
-  const requirements = [processRequirement("rm", "spawn", segment, ["process.filesystem_mutation"])];
-  const recursive = args.some(
-    (arg) => arg === "-r" || arg === "-R" || arg === "--recursive" || /^-[^-]*[rR]/.test(arg)
-  );
-  const operands = args.filter((arg) => arg && !arg.startsWith("-"));
-  if (operands.length === 0) {
-    return [
-      ...requirements,
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-        "rm.operand_missing"
-      ])
-    ];
-  }
-  const identity = inspectGitResourceIdentity(repoRoot);
-  for (const operand of operands) {
-    const resolved = resolvePathOperand(operand, cwd);
-    addWriteEffects(requirements, resolved, segment, ["filesystem.write", "rm.remove"]);
-    const finalOperandIsSymlink = isSymbolicLink(resolved);
-    const canonicalResolved = canonicalRmOperand(resolved, finalOperandIsSymlink);
-    const targetIdentity = recursive && !finalOperandIsSymlink ? inspectGitResourceIdentity(resolved) : { status: "absent" };
-    const sameIdentityTargetRoot = identity.status === "resolved" && targetIdentity.status === "resolved" && identity.identity.commonDir === targetIdentity.identity.commonDir && pathContains(canonicalResolved, targetIdentity.identity.repositoryRoot);
-    if (recursive && identity.status === "resolved" && (sameIdentityTargetRoot || [
-      repoRoot,
-      identity.identity.repositoryRoot,
-      identity.identity.gitDir,
-      identity.identity.commonDir,
-      identity.identity.gitEntryPath
-    ].some((metadataPath) => pathContains(canonicalResolved, metadataPath)))) {
-      const gitEntryPath = targetIdentity.status === "resolved" ? targetIdentity.identity.gitEntryPath : identity.identity.gitEntryPath;
-      requirements.push(
-        requirement2(
-          "control_plane.write",
-          "control_plane.write",
-          { kind: "path", path: gitEntryPath },
-          segment,
-          ["rm.recursive_git_boundary", "tier1_catastrophic"]
-        )
-      );
+
+// src/core/effect-ir/shell-lower/decoders/toolchain.ts
+function decodeTsc(args, cwd, segment) {
+  const metadataOnly = args.length > 0 && args.every((arg) => ["--help", "--version", "-h", "-v"].includes(arg));
+  const requirements = [];
+  let hasOutput = false;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index] ?? "";
+    const inline = arg.match(/^--(?:outDir|outFile)=(.+)$/)?.[1];
+    const separate = (arg === "--outDir" || arg === "--outFile") && args[index + 1] ? args[index + 1] : null;
+    const output = inline ?? separate;
+    if (!output) {
+      continue;
     }
-  }
-  return requirements;
-}
-function canonicalRmOperand(targetPath, finalOperandIsSymlink) {
-  try {
-    if (finalOperandIsSymlink) {
-      return path42.join(realpathSync4.native(path42.dirname(targetPath)), path42.basename(targetPath));
+    hasOutput = true;
+    addWriteEffects(requirements, resolvePathOperand(output, cwd), segment, ["tsc.output"]);
+    if (separate) {
+      index += 1;
     }
-    return realpathSync4.native(targetPath);
-  } catch {
-    return path42.resolve(targetPath);
-  }
-}
-function isSymbolicLink(targetPath) {
-  try {
-    return lstatSync2(targetPath).isSymbolicLink();
-  } catch {
-    return false;
   }
-}
-function pathContains(ancestor, candidate) {
-  const relative = path42.relative(path42.resolve(ancestor), path42.resolve(candidate));
-  return relative === "" || !relative.startsWith("..") && !path42.isAbsolute(relative);
+  const typecheckOnly = args.includes("--noEmit") && !hasOutput;
+  const inspect = metadataOnly || typecheckOnly;
+  requirements.unshift(
+    processRequirement("tsc", inspect ? "inspect" : "spawn", segment, [
+      metadataOnly ? "process.inspect.tsc_metadata" : typecheckOnly ? "process.inspect.tsc_typecheck" : "process.known_local_spawn"
+    ])
+  );
+  return requirements;
 }
 function decodeGo(args, segment) {
   if (["test", "list", "vet"].includes(args[0] ?? "")) {
@@ -15877,285 +15968,320 @@ function decodeNode2(args, cwd, segment) {
       )
     ];
   }
-  return unsupportedProcess("node", segment, "process.node_grammar_incomplete");
-}
-function decodePrisma(args, env, repoRoot, segment) {
-  const processEffect = processRequirement("prisma", "spawn", segment, ["process.prisma"]);
-  if (args[0] === "generate") {
-    return [
-      processEffect,
-      requirement2("fs.write", "fs.write", { kind: "path", path: repoRoot }, segment, [
-        "prisma.generate.repo_local"
-      ])
-    ];
+  return unsupportedProcess("node", segment, "process.node_grammar_incomplete");
+}
+
+// src/core/effect-ir/shell-lower/decode-process.ts
+function decodeProcessOrFilesystem(params) {
+  const { tokens, head, env, cwd, repoRoot, segment } = params;
+  const args = tokens.slice(1);
+  if (tokens.length > 0 && tokens.every((token) => ENV_PREFIX_PATTERN2.test(token))) {
+    return [];
+  }
+  const shellControl = decodeShellControlBuiltin(head, args);
+  if (shellControl) {
+    return shellControl;
+  }
+  if (isCommandInspection(tokens)) {
+    return [processRequirement(head, "inspect", segment, ["process.inspect.command_lookup"])];
+  }
+  if (head === "lsof") {
+    return validLsof(args) ? [processRequirement(head, "inspect", segment, ["process.inspect.lsof"])] : unsupportedProcess(head, segment, "process.lsof_grammar_incomplete");
+  }
+  if (head === "ps") {
+    return validPs(args) ? [processRequirement(head, "inspect", segment, ["process.inspect.ps"])] : unsupportedProcess(head, segment, "process.ps_grammar_incomplete");
+  }
+  if (head === "test" || head === "[") {
+    return validFilesystemTest(head, args) ? [processRequirement(head, "inspect", segment, ["process.inspect.filesystem_test"])] : unsupportedProcess(head, segment, "process.filesystem_test_grammar_incomplete");
+  }
+  if (head === "docker") {
+    if (args[0] === "info") {
+      return validDockerInfo(args.slice(1)) ? [processRequirement(head, "inspect", segment, ["process.inspect.docker_info"])] : unsupportedProcess(head, segment, "process.docker_info_grammar_incomplete");
+    }
+    if (args[0] === "compose" && ["up", "down", "start", "stop", "restart", "create", "rm"].includes(args[1] ?? "")) {
+      return [processRequirement(head, "spawn", segment, ["service.local_mutation"])];
+    }
+    if (args[0] === "push" || args[0] === "build" && args.includes("--push") || args[0] === "buildx" && args[1] === "build" && (args.includes("--push") || args.some(
+      (arg) => arg.startsWith("--output=type=registry") || arg.startsWith("-o=type=registry")
+    ))) {
+      return [
+        processRequirement(head, "spawn", segment, ["tier0_external", "docker.remote_mutation"]),
+        requirement2(
+          "network.connect",
+          "network.connect",
+          {
+            kind: "network",
+            host: "registry",
+            protocol: "container-registry",
+            mode: "mutate",
+            payload: "present"
+          },
+          segment,
+          ["tier0_external", "docker.remote_mutation"]
+        )
+      ];
+    }
+    if (args[0] === "run" || args[0] === "create" || args[0] === "pull" || args[0] === "build" || args[0] === "buildx" && args[1] === "build") {
+      return [
+        processRequirement(head, "spawn", segment, ["process.docker_spawn"]),
+        requirement2(
+          "network.acquire",
+          "network.connect",
+          {
+            kind: "network",
+            host: "unknown",
+            protocol: "container-registry",
+            mode: "ambiguous",
+            payload: "none"
+          },
+          segment,
+          ["docker.image_acquisition_possible"]
+        )
+      ];
+    }
+    return [processRequirement(head, "spawn", segment, ["process.docker_spawn"])];
+  }
+  if (isShellHead(head)) {
+    const syntax = bashSyntaxTarget(args);
+    if (syntax) {
+      return [
+        processRequirement(head, "inspect", segment, ["process.inspect.shell_syntax"]),
+        requirement2(
+          "fs.read",
+          "fs.read",
+          { kind: "path", path: path47.resolve(cwd, syntax) },
+          segment,
+          ["shell.syntax_source_read"]
+        )
+      ];
+    }
+    return unsupportedProcess(head, segment, "process.shell_grammar_incomplete");
+  }
+  if (head === "prisma") {
+    return decodePrisma(args, env, repoRoot, segment);
+  }
+  const runtimeMetadata = decodeRuntimeMetadataProcess(head, args, segment);
+  if (runtimeMetadata) {
+    return runtimeMetadata;
+  }
+  if (head === "ruby") {
+    return decodeRuby(args, cwd, repoRoot, segment);
+  }
+  if (head === "rubocop" || head === "rspec") {
+    const decoded = decodeBundleExecInner(head, args, segment);
+    if (decoded) {
+      return decoded;
+    }
+  }
+  const dockerCompose = decodeDockerComposeRun2(head, args, segment);
+  if (dockerCompose) {
+    return dockerCompose;
+  }
+  if ((head === "npm" || head === "pnpm") && args.length === 1 && isMetadataOnlyArgv(args)) {
+    return [processRequirement(head, "inspect", segment, ["process.inspect.package_manager"])];
+  }
+  if (head === "belay") {
+    return decodeBelay(args, repoRoot, segment);
+  }
+  if (head === "tsc") {
+    return decodeTsc(args, cwd, segment);
+  }
+  if (head === "go") {
+    return decodeGo(args, segment);
+  }
+  if (head === "rsync") {
+    return decodeRsync(args, cwd, segment);
+  }
+  if (head === "sed") {
+    return decodeSed(args, cwd, segment);
   }
-  const databaseMutation = args[0] === "migrate" || args[0] === "db" && args[1] === "seed" || args[0] === "seed";
-  if (!databaseMutation) {
-    return [
-      processEffect,
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-        "prisma.grammar_incomplete"
-      ])
-    ];
+  if (head === "base64" && args.length === 1 && ["-d", "-D", "--decode"].includes(args[0] ?? "")) {
+    return [processRequirement(head, "inspect", segment, ["process.inspect.base64_stdin"])];
   }
-  const endpoint = databaseEndpoint(env.DATABASE_URL);
-  if (!endpoint) {
+  if (head === "node") {
+    return decodeNode2(args, cwd, segment);
+  }
+  if (head === "vite" || head === "vite-node") {
+    return [processRequirement(head, "spawn", segment, ["process.local_dev_spawn"])];
+  }
+  if ((head === "npm" || head === "pnpm") && args[0] === "publish" || head === "terraform" && args[0] === "apply") {
     return [
-      processEffect,
+      processRequirement(head, "spawn", segment, ["tier0_external"]),
       requirement2(
         "network.connect",
         "network.connect",
         {
           kind: "network",
-          host: "unknown",
-          protocol: "database",
-          mode: "ambiguous",
+          host: "control-plane",
+          protocol: head,
+          mode: "mutate",
           payload: "present"
         },
         segment,
-        ["prisma.database_endpoint_unknown"]
-      ),
-      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-        "prisma.database_endpoint_unknown"
-      ])
+        ["tier0_external"]
+      )
     ];
   }
-  const network = requirement2(
-    "network.connect",
-    "network.connect",
-    {
-      kind: "network",
-      ...endpoint,
-      mode: "mutate",
-      payload: "present"
-    },
-    segment,
-    [LOOPBACK_HOSTS2.has(endpoint.host) ? "prisma.database_local" : "prisma.database_remote"]
-  );
-  if (LOOPBACK_HOSTS2.has(endpoint.host)) {
-    return [processEffect, network];
+  if (head === "cd") {
+    return [];
   }
-  return [
-    processEffect,
-    network,
-    requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-      "prisma.remote_database_mutation"
-    ])
-  ];
-}
-function addRedirectEffects(requirements, tokens, env, context, segment) {
-  for (let index = 0; index < tokens.length; index += 1) {
-    const operator = tokens[index] ?? "";
-    if (!isRedirectOperator(operator) || isFdDuplication(operator)) {
-      continue;
-    }
-    const rawTarget = tokens[index + 1];
-    if (!rawTarget) {
-      requirements.push(
-        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-          "shell.redirect_target_missing"
-        ])
-      );
-      continue;
-    }
-    if (operator.includes("<<")) {
-      requirements.push(
-        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-          "shell.heredoc_opaque"
-        ])
-      );
-      index += 1;
-      continue;
-    }
-    const target = expandKnownVariables(rawTarget, env);
-    const resolved = resolvePathOperand(target, context.cwd);
-    if (resolved === "/dev/null") {
-      index += 1;
-      continue;
-    }
-    if (operator.includes("<")) {
-      requirements.push(
+  if (head === "cp" || head === "mv") {
+    return decodeCopyMove(head, args, cwd, segment);
+  }
+  if (head === "rm") {
+    return decodeRm(args, cwd, repoRoot, segment);
+  }
+  if (head === "vitest" || head === "eslint" || head === "biome" || head === "belay") {
+    return [processRequirement(head, "spawn", segment, ["process.known_local_spawn"])];
+  }
+  if (head === "pwd" || head === "which" || head === "whoami") {
+    return [processRequirement(head, "inspect", segment, ["process.pure_inspection"])];
+  }
+  const readOperands = filesystemReadOperands(head, args);
+  if (readOperands !== null) {
+    const lowered = [processRequirement(head, "inspect", segment, ["process.filesystem_inspect"])];
+    for (const operand of readOperands) {
+      const resolved = resolvePathOperand(operand, cwd);
+      lowered.push(
         requirement2("fs.read", "fs.read", { kind: "path", path: resolved }, segment, [
-          "shell.input_redirect"
+          "filesystem.read"
         ])
       );
-      addSecretRead(requirements, resolved, segment);
-    }
-    if (operator.includes(">")) {
-      addWriteEffects(requirements, resolved, segment, ["shell.output_redirect"]);
+      addSecretRead(lowered, resolved, segment);
     }
-    index += 1;
+    return lowered;
   }
-}
-function addSubstitutionEffects(requirements, command, context, segment, signals) {
-  const inners = structuralSubstitutionInners(command);
-  for (const inner of inners) {
-    signals.add("command_substitution");
-    if (context.depth >= MAX_LOWER_DEPTH) {
-      requirements.push(
-        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
-          "shell.substitution_depth_exceeded"
-        ])
-      );
-      continue;
-    }
-    const nestedSegments = lowerTopLevelSegments(inner, {
-      ...context,
-      command: inner,
-      depth: context.depth + 1
-    });
-    for (const nested of nestedSegments) {
-      requirements.push(
-        ...nested.requirements.map((entry) => {
-          const outerProvenance = {
-            segment,
-            innerCommand: inner
-          };
-          const provenance = {
-            ...entry.provenance,
-            segment,
-            innerCommand: entry.provenance.innerCommand ?? inner
-          };
-          return withProvenances(entry, provenance, outerProvenance);
-        })
-      );
+  const writeOperands = filesystemWriteOperands(head, args);
+  if (writeOperands !== null) {
+    const lowered = [processRequirement(head, "spawn", segment, ["process.filesystem_mutation"])];
+    for (const operand of writeOperands) {
+      addWriteEffects(lowered, resolvePathOperand(operand, cwd), segment, ["filesystem.write"]);
     }
+    return lowered;
   }
-}
-function extractEnvironment(tokens, inherited) {
-  const env = { ...inherited };
-  const changedNames = /* @__PURE__ */ new Set();
-  if (tokens[0] === "env") {
-    let index = 1;
-    let malformed = false;
-    while (index < tokens.length) {
-      const option = tokens[index] ?? "";
-      if (option === "-u" || option === "--unset") {
-        const name = tokens[index + 1] ?? "";
-        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
-          malformed = true;
-          index += 1;
-          break;
-        }
-        delete env[name];
-        changedNames.add(name);
-        index += 2;
-        continue;
-      }
-      if (option.startsWith("--unset=")) {
-        const name = option.slice("--unset=".length);
-        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
-          malformed = true;
-          index += 1;
-          break;
-        }
-        delete env[name];
-        changedNames.add(name);
-        index += 1;
-        continue;
-      }
-      if (option === "-i" || option === "--ignore-environment") {
-        for (const name of Object.keys(env)) {
-          delete env[name];
-        }
-        changedNames.add("*");
-        index += 1;
-        continue;
-      }
-      if (option === "--") {
-        index += 1;
-        break;
-      }
-      if (option.startsWith("-")) {
-        malformed = true;
-        index += 1;
-        break;
-      }
-      break;
-    }
-    while (index < tokens.length) {
-      const token = tokens[index] ?? "";
-      const match = ENV_PREFIX_PATTERN2.exec(token);
-      if (!match) {
-        break;
-      }
-      const [, name, value] = match;
-      if (name) {
-        env[name] = expandKnownVariables(value ?? "", env);
-        changedNames.add(name);
-      }
-      index += 1;
-    }
-    const commandTokens = tokens.slice(index);
-    return {
-      env,
-      commandTokens,
-      malformed: malformed || commandTokens.length === 0,
-      changedNames
-    };
+  if (head === "printf" || head === "echo" || head === "true" || head === "false" || head === ":") {
+    return [];
   }
-  for (const token of tokens) {
-    const match = ENV_PREFIX_PATTERN2.exec(token);
-    if (!match) {
-      break;
-    }
-    const [, name, value] = match;
-    if (name) {
-      env[name] = expandKnownVariables(value ?? "", env);
-      changedNames.add(name);
-    }
+  if (!head) {
+    return [
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+        "shell.segment_empty"
+      ])
+    ];
   }
-  return { env, malformed: false, changedNames };
+  return unsupportedProcess(head, segment, "process.grammar_unknown");
 }
-function expandKnownVariables(token, env) {
-  return token.replace(
-    /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g,
-    (raw, a, b) => {
-      const value = env[a ?? b];
-      return value === void 0 ? raw : value;
+
+// src/core/effect-ir/shell-lower/decoders/decode-package-exec.ts
+function decodePackageExec(peel, cwd, repoRoot, segment) {
+  if (peel.opaque) {
+    return [
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+        peel.reason,
+        ...peel.signals
+      ])
+    ];
+  }
+  if (peel.reason === "npx_wrapper_readonly") {
+    return [];
+  }
+  const binHead = peel.innerTokens[0] ?? "";
+  const metadataOnly = packageExecInnerIsMetadata(peel);
+  const local = !peel.forceAcquire ? resolveLocalBin(binHead, cwd, repoRoot) : null;
+  if (local) {
+    return metadataOnly ? [
+      requirement2(
+        "process.exec",
+        "process.exec",
+        { kind: "executable", command: local.path, operation: "inspect" },
+        segment,
+        ["package_exec.delegate", "package_exec.local_bin_resolved"]
+      )
+    ] : [];
+  }
+  const networkResources = peel.acquisitionSpecs.map((spec) => classifyPackageAcquisitionSpec(spec)).filter((source) => source.kind !== "local").map(
+    (source) => source.kind === "registry" ? {
+      kind: "network",
+      host: "registry.npmjs.org",
+      protocol: "registry",
+      mode: "read",
+      payload: "none"
+    } : {
+      kind: "network",
+      host: source.host,
+      ...source.port ? { port: source.port } : {},
+      protocol: source.protocol,
+      mode: "read",
+      payload: "none"
     }
   );
-}
-function stripRedirects(tokens) {
-  const stripped = [];
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index] ?? "";
-    if (isFdDuplication(token)) {
-      continue;
-    }
-    if (!isRedirectOperator(token)) {
-      stripped.push(token);
-      continue;
-    }
-    index += 1;
+  if (networkResources.length === 0) {
+    networkResources.push({
+      kind: "network",
+      host: "registry.npmjs.org",
+      protocol: "registry",
+      mode: "read",
+      payload: "none"
+    });
   }
-  return stripped;
+  return [
+    ...networkResources.map(
+      (resource) => requirement2("network.acquire", "network.connect", resource, segment, [
+        "package_acquire_possible"
+      ])
+    ),
+    requirement2(
+      "fs.write",
+      "fs.write",
+      { kind: "package-cache", manager: peel.launcher === "pnpm" ? "pnpm" : "npm" },
+      segment,
+      ["package_cache_write"]
+    ),
+    ...metadataOnly ? [
+      requirement2(
+        "process.exec",
+        "process.exec",
+        { kind: "executable", command: binHead || peel.launcher, operation: "inspect" },
+        segment,
+        ["package_exec.delegate"]
+      )
+    ] : []
+  ];
 }
-function stripStructuredRedirects(tokens) {
-  const stripped = [];
-  for (let index = 0; index < tokens.length; index += 1) {
-    const token = tokens[index];
-    if (!token) continue;
-    if (isFdDuplication(token.value)) {
-      continue;
-    }
-    if (!isRedirectOperator(token.value)) {
-      stripped.push(token);
-      continue;
-    }
-    index += 1;
+function packageExecInnerIsMetadata(peel) {
+  const args = peel.innerTokens.slice(1);
+  return args.length > 0 && args.every((arg) => ["--help", "--version", "-V", "-h", "-v"].includes(arg));
+}
+
+// src/core/effect-ir/shell-lower/segment.ts
+init_shell_tokenizer();
+import path48 from "node:path";
+var DYNAMIC_SHELL_VALUE_PATTERN = /(?:\$\(|`|\$(?:\d+|[@*#?$!-]|\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*))/;
+var SHELL_GLOB_PATTERN = /[*?[]/;
+function requiresKnownCwd(requirementValue) {
+  if (requirementValue.action === "fs.write" || requirementValue.action === "git.ref.write" || requirementValue.action === "control_plane.write") {
+    return true;
   }
-  return stripped;
+  return requirementValue.action === "process.exec" && requirementValue.resource.kind === "executable" && requirementValue.resource.operation === "spawn";
 }
-function alignStructuredTokens(tokens, values) {
-  if (values.length === 0) return [];
-  for (let start = tokens.length - values.length; start >= 0; start -= 1) {
-    const candidate = tokens.slice(start);
-    if (candidate.length === values.length && candidate.every((token, index) => token.value === values[index])) {
-      return candidate;
-    }
+function joinNestedOpacity(outer, nested) {
+  const nestedOpacity = nested.completeness === "partial" && nested.opacity === "transparent" ? "recursive" : nested.opacity;
+  return joinEffectOpacity(outer, nestedOpacity);
+}
+function startsLocalPostgresService(command) {
+  const tokens = tokenizeShell(command);
+  return path48.basename(tokens[0] ?? "") === "docker" && tokens[1] === "compose" && ["up", "start", "restart"].includes(tokens[2] ?? "") && tokens.includes("postgres");
+}
+function resolveCdTransition(command, currentCwd) {
+  const tokens = tokenizeShell(command);
+  if (path48.basename(tokens[0] ?? "") !== "cd") {
+    return null;
   }
-  return [];
+  const target = tokens[1] ?? "~";
+  if (!target || target === "-" || target.includes("$") || target.includes("`")) {
+    return { cwd: currentCwd, known: false };
+  }
+  return { cwd: resolvePathOperand(target, currentCwd), known: true };
 }
 function shellSegment(commandRedacted, segmentHead, requirements, opacity, signals) {
   const normalizedRequirements = requirements.flatMap((entry) => {
@@ -16186,430 +16312,520 @@ function shellSegment(commandRedacted, segmentHead, requirements, opacity, signa
     signals: [...signals].sort()
   };
 }
-var DYNAMIC_SHELL_VALUE_PATTERN = /(?:\$\(|`|\$(?:\d+|[@*#?$!-]|\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*))/;
-var SHELL_GLOB_PATTERN = /[*?[]/;
-function effectChangingEnvironmentSignals(head, env, changedNames) {
-  if (head === "curl" && (env.CURL_HOME || changedNames.has("CURL_HOME") || changedNames.has("HOME") || changedNames.has("XDG_CONFIG_HOME"))) {
-    return ["egress.curl.environment_config_override"];
-  }
-  if (head === "wget" && (env.WGETRC || changedNames.has("WGETRC") || changedNames.has("HOME"))) {
-    return ["egress.wget.environment_config_override"];
+function dynamicResourceSignal(resource) {
+  const expanded = (value) => Boolean(value && DYNAMIC_SHELL_VALUE_PATTERN.test(value));
+  const pathLike = (value, allowSemanticWildcard = false) => Boolean(
+    value && (expanded(value) || !allowSemanticWildcard && SHELL_GLOB_PATTERN.test(value))
+  );
+  switch (resource.kind) {
+    case "path":
+      return pathLike(resource.path) ? "shell.path_unresolved" : null;
+    case "network":
+      return expanded(resource.host) || expanded(resource.protocol) ? "shell.network_resource_unresolved" : null;
+    case "git-ref":
+      return pathLike(resource.repoPath) || pathLike(resource.ref, resource.ref.endsWith("/*")) ? "shell.git_resource_unresolved" : null;
+    case "executable":
+      return expanded(resource.command) ? "shell.executable_unresolved" : null;
+    default:
+      return null;
   }
-  if (head !== "git") {
-    return [];
+}
+
+// src/core/effect-ir/shell-lower.ts
+var MAX_LOWER_DEPTH = 8;
+function lowerShellEffectPlan(params) {
+  const context = { ...params, depth: 0 };
+  const segments = lowerTopLevelSegments(params.command, context);
+  return buildShellEffectPlan({
+    inputFingerprint: params.inputFingerprint,
+    segments,
+    signals: pipeToShell(params.command) ? ["pipe_to_shell"] : []
+  });
+}
+function lowerTopLevelSegments(command, context) {
+  const commands = splitStructuralShellSegments(command);
+  if (commands.length === 0 && command.trim()) {
+    commands.push(command.trim());
   }
-  const hazardousNames = /* @__PURE__ */ new Set([
-    "GIT_ASKPASS",
-    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-    "GIT_CEILING_DIRECTORIES",
-    "GIT_COMMON_DIR",
-    "GIT_CONFIG",
-    "GIT_CONFIG_GLOBAL",
-    "GIT_CONFIG_SYSTEM",
-    "GIT_DIR",
-    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
-    "GIT_EDITOR",
-    "GIT_EXEC_PATH",
-    "GIT_EXTERNAL_DIFF",
-    "GIT_INDEX_FILE",
-    "GIT_NAMESPACE",
-    "GIT_OBJECT_DIRECTORY",
-    "GIT_PAGER",
-    "GIT_PROXY_COMMAND",
-    "GIT_QUARANTINE_PATH",
-    "GIT_SEQUENCE_EDITOR",
-    "GIT_SHALLOW_FILE",
-    "GIT_SSH",
-    "GIT_SSH_COMMAND",
-    "GIT_TEMPLATE_DIR",
-    "GIT_WORK_TREE",
-    "SSH_ASKPASS"
-  ]);
-  const overridden = changedNames.has("HOME") || changedNames.has("XDG_CONFIG_HOME") || Object.entries(env).some(([name, value]) => {
-    if (!value) {
-      return false;
+  const pipedToShell = pipeToShell(command);
+  const lowered = [];
+  let cwd = context.cwd;
+  let cwdKnown = true;
+  let inferredEnv = { ...context.env };
+  for (const segment of commands) {
+    let result = lowerSegment(segment, {
+      ...context,
+      cwd,
+      env: inferredEnv,
+      command: segment,
+      depth: context.depth,
+      inputFingerprint: context.inputFingerprint,
+      ...pipedToShell && isShellHead(parseSegment(segment).head) ? { pipeToShellSegment: true } : {}
+    });
+    if (!cwdKnown) {
+      const requiresCwd = result.requirements.some(requiresKnownCwd);
+      const requirements = [...result.requirements];
+      if (requiresCwd) {
+        requirements.push(
+          requirement2(
+            "indeterminate",
+            "indeterminate",
+            { kind: "unknown" },
+            result.commandRedacted,
+            ["shell.cwd_unknown"]
+          )
+        );
+      }
+      result = {
+        ...result,
+        requirements,
+        ...requiresCwd ? {
+          completeness: "partial",
+          opacity: joinEffectOpacity(result.opacity, "opaque")
+        } : {},
+        signals: [.../* @__PURE__ */ new Set([...result.signals, "shell.cwd_unknown"])]
+      };
     }
-    if (hazardousNames.has(name) || /^GIT_CONFIG_(?:KEY|VALUE)_\d+$/.test(name) || /^GIT_TRACE/.test(name)) {
-      return true;
+    lowered.push(result);
+    if (!inferredEnv.DATABASE_URL && startsLocalPostgresService(segment)) {
+      inferredEnv = {
+        ...inferredEnv,
+        DATABASE_URL: "postgresql://127.0.0.1:5432/local"
+      };
+    }
+    const nextCwd = resolveCdTransition(segment, cwd);
+    if (nextCwd) {
+      cwd = nextCwd.cwd;
+      cwdKnown = nextCwd.known;
     }
-    return name === "GIT_CONFIG_COUNT" && value !== "0";
-  });
-  return overridden ? ["git.environment_execution_or_config_override"] : [];
-}
-function dynamicResourceSignal(resource) {
-  const expanded = (value) => Boolean(value && DYNAMIC_SHELL_VALUE_PATTERN.test(value));
-  const pathLike = (value, allowSemanticWildcard = false) => Boolean(
-    value && (expanded(value) || !allowSemanticWildcard && SHELL_GLOB_PATTERN.test(value))
-  );
-  switch (resource.kind) {
-    case "path":
-      return pathLike(resource.path) ? "shell.path_unresolved" : null;
-    case "network":
-      return expanded(resource.host) || expanded(resource.protocol) ? "shell.network_resource_unresolved" : null;
-    case "git-ref":
-      return pathLike(resource.repoPath) || pathLike(resource.ref, resource.ref.endsWith("/*")) ? "shell.git_resource_unresolved" : null;
-    case "executable":
-      return expanded(resource.command) ? "shell.executable_unresolved" : null;
-    default:
-      return null;
   }
-}
-function processRequirement(command, operation, segment, signals) {
-  return requirement2(
-    "process.exec",
-    "process.exec",
-    { kind: "executable", command, operation },
-    segment,
-    signals
-  );
-}
-function unsupportedProcess(command, segment, signal) {
-  return [
-    processRequirement(command, "spawn", segment, [signal]),
-    requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [signal])
-  ];
-}
-function addWriteEffects(requirements, resolved, segment, signals) {
-  requirements.push(
-    requirement2("fs.write", "fs.write", { kind: "path", path: resolved }, segment, signals)
-  );
-  if (CONTROL_PLANE_PATH_PATTERN.test(resolved)) {
-    requirements.push(
-      requirement2(
-        "control_plane.write",
-        "control_plane.write",
-        { kind: "path", path: resolved },
-        segment,
-        [...signals, "protected_path"]
+  if (commands.length > 1 && /[\r\n]/.test(command) && lowered.some(
+    (segment) => segment.requirements.some((entry) => entry.action === "network.connect")
+  )) {
+    lowered.push(
+      shellSegment(
+        "[multiline network boundary]",
+        "shell-boundary",
+        [
+          requirement2(
+            "indeterminate",
+            "indeterminate",
+            { kind: "unknown" },
+            "[multiline network boundary]",
+            ["shell.multiline_network_boundary"]
+          )
+        ],
+        "opaque",
+        /* @__PURE__ */ new Set(["shell.multiline_network_boundary"])
       )
     );
   }
+  return lowered;
 }
-function addSecretRead(requirements, resolved, segment) {
-  if (SECRET_PATH_PATTERN.test(resolved)) {
+function lowerSegment(command, context) {
+  const commandRedacted = redactCommand(command);
+  const lexed = lexShell(command);
+  const rawTokens = lexed.tokens.map((token) => token.value);
+  const environment = extractEnvironment(rawTokens, context.env);
+  const env = environment.env;
+  const parsed = parseSegment(command);
+  const parsedTokens = environment.commandTokens ?? parsed.tokens;
+  const tokens = stripRedirects(
+    parsedTokens.length === 0 && rawTokens.length > 0 && rawTokens.every((token) => ENV_PREFIX_PATTERN2.test(token)) ? rawTokens : parsedTokens
+  ).map((token) => expandKnownVariables(token, env));
+  const decoderTokens = alignStructuredTokens(
+    stripStructuredRedirects(lexed.tokens),
+    stripRedirects(parsedTokens)
+  );
+  const head = path49.basename(tokens[0] ?? parsed.head);
+  let opacity = segmentOpacity(command);
+  const signals = /* @__PURE__ */ new Set();
+  const requirements = [];
+  if (!lexed.complete) {
     requirements.push(
-      requirement2("secret.read", "secret.read", { kind: "path", path: resolved }, segment, [
-        "secret_path_read"
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        "shell.grammar_incomplete"
       ])
     );
+    signals.add("shell.grammar_incomplete");
+    opacity = joinEffectOpacity(opacity, "unparseable");
   }
-}
-function filesystemReadOperands(head, args) {
-  switch (head) {
-    case "ls": {
-      const operands = args.filter((arg) => arg && !arg.startsWith("-"));
-      return operands.length > 0 ? operands : ["."];
-    }
-    case "find":
-      return findReadOperands(args);
-    case "cat":
-    case "head":
-    case "tail":
-    case "less":
-    case "stat":
-    case "file":
-    case "du":
-    case "wc":
-      return args.filter((arg) => arg && !arg.startsWith("-"));
-    case "grep":
-    case "rg":
-      return args.slice(1).filter((arg) => arg && !arg.startsWith("-"));
-    case "jq":
-      return args.slice(1).filter((arg) => arg && !arg.startsWith("-"));
-    default:
-      return null;
-  }
-}
-function findReadOperands(args) {
-  const mutatingPrimaries = /* @__PURE__ */ new Set([
-    "-delete",
-    "-exec",
-    "-execdir",
-    "-fls",
-    "-fprint",
-    "-fprintf",
-    "-ok",
-    "-okdir"
-  ]);
-  if (args.some(
-    (arg) => mutatingPrimaries.has(arg) || [...mutatingPrimaries].some((primary) => arg.startsWith(`${primary}=`))
-  )) {
-    return null;
-  }
-  const paths = [];
-  for (const arg of args) {
-    if (arg.startsWith("-") || arg === "!" || arg === "(") {
-      break;
-    }
-    paths.push(arg);
+  addRedirectEffects(requirements, rawTokens, env, context, commandRedacted);
+  addSubstitutionEffects(requirements, command, context, commandRedacted, signals);
+  if (environment.malformed) {
+    requirements.push(
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        "shell.env_wrapper_incomplete"
+      ])
+    );
+    opacity = joinEffectOpacity(opacity, "opaque");
   }
-  return paths.length > 0 ? paths : ["."];
-}
-function filesystemWriteOperands(head, args) {
-  const positional = args.filter((arg) => arg && !arg.startsWith("-"));
-  switch (head) {
-    case "touch":
-    case "mkdir":
-    case "rm":
-    case "truncate":
-    case "chmod":
-      return positional;
-    case "cp":
-    case "mv":
-      return positional.length > 0 ? [positional[positional.length - 1] ?? ""] : [];
-    case "tee":
-      return positional;
-    default:
-      return null;
+  if (parsed.encounteredXargs) {
+    requirements.push(
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        "shell.xargs_stdin_dynamic"
+      ])
+    );
+    signals.add("shell.xargs_stdin_dynamic");
+    opacity = joinEffectOpacity(opacity, "opaque");
   }
-}
-function validLsof(args) {
-  const flagsWithoutValues = /* @__PURE__ */ new Set(["-a", "-b", "-l", "-n", "-P", "-R", "-t", "-V"]);
-  const flagsWithValues = /* @__PURE__ */ new Set(["-c", "-d", "-F", "-g", "-p", "-T", "-u", "+d", "+D"]);
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
-    if (flagsWithoutValues.has(arg) || arg === "-i") {
-      continue;
-    }
-    if (flagsWithValues.has(arg)) {
-      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
-        return false;
-      }
-      index += 1;
-      continue;
-    }
-    if (/^-[ablnPRtV]+$/.test(arg) && [...arg.slice(1)].every((flag) => "ablnPRtV".includes(flag)) || /^-i(?:TCP|UDP)?(?::\d+(?:-\d+)?)?$/.test(arg) || /^-s(?:TCP|UDP):[A-Za-z]+$/.test(arg) || /^-(?:c|d|F|g|p|T|u).+$/.test(arg) || /^\+(?:d|D).+$/.test(arg)) {
-      continue;
-    }
-    return false;
+  if (context.depth > MAX_LOWER_DEPTH) {
+    requirements.push(
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        "shell.lower_depth_exceeded"
+      ])
+    );
+    return shellSegment(
+      commandRedacted,
+      head,
+      requirements,
+      joinEffectOpacity(opacity, "opaque"),
+      signals
+    );
   }
-  return true;
-}
-function validPs(args) {
-  const bareForms = /* @__PURE__ */ new Set(["aux", "ax", "x", "u"]);
-  const flagsWithoutValues = /* @__PURE__ */ new Set(["-A", "-a", "-d", "-e", "-f", "-j", "-l", "-T", "-x"]);
-  const flagsWithValues = /* @__PURE__ */ new Set([
-    "--format",
-    "--group",
-    "--pid",
-    "--ppid",
-    "--sort",
-    "--tty",
-    "--user"
-  ]);
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
-    if (bareForms.has(arg) || flagsWithoutValues.has(arg)) {
-      continue;
-    }
-    if (flagsWithValues.has(arg)) {
-      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
-        return false;
-      }
-      index += 1;
-      continue;
+  const packageExec = peelPackageExecArgv(tokens);
+  if (packageExec) {
+    requirements.push(
+      ...decodePackageExec(packageExec, context.cwd, context.repoRoot, commandRedacted)
+    );
+    for (const signal of packageExec.signals) {
+      signals.add(signal);
     }
-    if (/^(?:--format|--group|--pid|--ppid|--sort|--tty|--user)=.+$/.test(arg)) {
-      continue;
+    if (packageExec.opaque) {
+      opacity = joinEffectOpacity(opacity, "opaque");
     }
-    if (/^-[^-]/.test(arg)) {
-      const noValue = /* @__PURE__ */ new Set(["A", "a", "d", "e", "f", "j", "l", "T", "x"]);
-      const withValue = /* @__PURE__ */ new Set(["G", "g", "N", "o", "p", "t", "U", "u"]);
-      const characters = arg.slice(1);
-      let valid = true;
-      for (let optionIndex = 0; optionIndex < characters.length; optionIndex += 1) {
-        const option = characters[optionIndex] ?? "";
-        if (noValue.has(option)) {
-          continue;
-        }
-        if (withValue.has(option)) {
-          if (optionIndex === characters.length - 1) {
-            if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
-              return false;
-            }
-            index += 1;
-          }
-          break;
+    const innerRecipe = packageExecInnerIsMetadata(packageExec) ? null : innerRecipeFromPeel(packageExec);
+    if (innerRecipe) {
+      const nested = lowerTopLevelSegments(innerRecipe, {
+        ...context,
+        command: innerRecipe,
+        env,
+        depth: context.depth + 1
+      });
+      for (const nestedSegment of nested) {
+        requirements.push(
+          ...nestedSegment.requirements.map(
+            (entry) => withInnerProvenance(entry, innerRecipe, packageExec.launcher, commandRedacted)
+          )
+        );
+        for (const signal of nestedSegment.signals) {
+          signals.add(signal);
         }
-        valid = false;
-        break;
-      }
-      if (valid) {
-        continue;
+        opacity = joinNestedOpacity(opacity, nestedSegment);
       }
     }
-    return false;
-  }
-  return true;
-}
-function validFilesystemTest(head, args) {
-  const operands = head === "[" && args.at(-1) === "]" ? args.slice(0, -1) : args;
-  if (head === "[" && args.at(-1) !== "]") {
-    return false;
+    return shellSegment(commandRedacted, head, requirements, opacity, signals);
   }
-  return operands.length === 2 && (/* @__PURE__ */ new Set(["-b", "-c", "-d", "-e", "-f", "-h", "-L", "-r", "-s", "-w", "-x"])).has(
-    operands[0] ?? ""
-  ) && Boolean(operands[1]);
-}
-function validDockerInfo(args) {
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
-    if (arg === "--help") {
-      continue;
-    }
-    if (arg === "--format" || arg === "-f") {
-      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
-        return false;
+  const recursive = decodeRecursiveInvocationTokens(decoderTokens);
+  if (recursive.kind === "static" && opacity !== "opaque" && opacity !== "unparseable") {
+    requirements.push(
+      processRequirement(recursive.interpreter, "spawn", commandRedacted, [
+        "shell.recursive_wrapper",
+        "dynamic_shell_evaluation"
+      ])
+    );
+    if (recursive.script !== "") {
+      const nested = lowerTopLevelSegments(recursive.script, {
+        ...context,
+        command: recursive.script,
+        env,
+        depth: context.depth + 1
+      });
+      for (const nestedSegment of nested) {
+        requirements.push(
+          ...nestedSegment.requirements.map(
+            (entry) => withInnerProvenance(entry, recursive.script, head, commandRedacted)
+          )
+        );
+        for (const signal of nestedSegment.signals) signals.add(signal);
       }
-      index += 1;
-      continue;
     }
-    if (arg.startsWith("--format=")) {
-      if (arg.slice("--format=".length).length === 0) {
-        return false;
+    signals.add("shell.recursive_wrapper");
+    signals.add("dynamic_shell_evaluation");
+    return shellSegment(commandRedacted, head, requirements, "recursive", signals);
+  }
+  if (recursive.kind === "dynamic" || recursive.kind === "indeterminate") {
+    const recursiveSignals = [
+      recursive.signal,
+      ...recursive.kind === "dynamic" ? ["dynamic_shell_evaluation"] : []
+    ];
+    requirements.push(
+      processRequirement(recursive.interpreter, "spawn", commandRedacted, recursiveSignals),
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        ...recursiveSignals
+      ])
+    );
+    for (const signal of recursiveSignals) signals.add(signal);
+    return shellSegment(
+      commandRedacted,
+      head,
+      requirements,
+      joinEffectOpacity(opacity, "opaque"),
+      signals
+    );
+  }
+  const compose = decodeDockerComposeRun(decoderTokens);
+  if (compose.kind === "recursive" && opacity !== "opaque" && opacity !== "unparseable") {
+    requirements.push(
+      processRequirement(head, "spawn", commandRedacted, ["process.docker_compose_run"])
+    );
+    if (compose.script !== "") {
+      const nested = lowerTopLevelSegments(compose.script, {
+        ...context,
+        command: compose.script,
+        env,
+        depth: context.depth + 1
+      });
+      for (const nestedSegment of nested) {
+        requirements.push(
+          ...nestedSegment.requirements.map(
+            (entry) => withInnerProvenance(entry, compose.script, head, commandRedacted)
+          )
+        );
+        for (const signal of nestedSegment.signals) signals.add(signal);
+        opacity = joinNestedOpacity(opacity, nestedSegment);
       }
-      continue;
     }
-    return false;
+    signals.add("process.docker_compose_run");
+    return shellSegment(commandRedacted, head, requirements, "recursive", signals);
   }
-  return true;
-}
-function bashSyntaxTarget(args) {
-  let syntaxOnly = false;
-  let script = null;
-  const shortFlags = new Set("abefhkmnptuvxBCEHPT".split(""));
-  const longFlags = /* @__PURE__ */ new Set([
-    "--debugger",
-    "--dump-po-strings",
-    "--dump-strings",
-    "--help",
-    "--login",
-    "--noediting",
-    "--noprofile",
-    "--norc",
-    "--posix",
-    "--restricted",
-    "--verbose",
-    "--version"
-  ]);
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index] ?? "";
-    if (arg === "-c" || arg === "-lc") {
-      return null;
-    }
-    if (arg === "-O" || arg === "+O" || arg === "--rcfile" || arg === "--init-file") {
-      if (!args[index + 1] || isOptionToken(args[index + 1] ?? "")) {
-        return null;
+  if (compose.kind === "dynamic" || compose.kind === "indeterminate") {
+    requirements.push(
+      processRequirement(head, "spawn", commandRedacted, ["process.docker_compose_run"]),
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        compose.signal
+      ])
+    );
+    signals.add("process.docker_compose_run");
+    signals.add(compose.signal);
+    return shellSegment(
+      commandRedacted,
+      head,
+      requirements,
+      joinEffectOpacity(opacity, "opaque"),
+      signals
+    );
+  }
+  const launcher = resolveLauncherRecipe({
+    tokens,
+    cwd: context.cwd,
+    repoRoot: context.repoRoot,
+    depth: context.depth
+  });
+  if (launcher) {
+    signals.add(`launcher.${launcher.reason}`);
+    requirements.push(
+      requirement2(
+        "process.exec",
+        "process.exec",
+        { kind: "executable", command: head, operation: "spawn" },
+        commandRedacted,
+        ["launcher.invoke"]
+      )
+    );
+    for (const recipe of launcher.recipes) {
+      const nested = lowerTopLevelSegments(recipe, {
+        ...context,
+        command: recipe,
+        env,
+        depth: context.depth + 1
+      });
+      for (const nestedSegment of nested) {
+        requirements.push(
+          ...nestedSegment.requirements.map(
+            (entry) => withInnerProvenance(entry, recipe, head, commandRedacted)
+          )
+        );
+        for (const signal of nestedSegment.signals) {
+          signals.add(signal);
+        }
+        opacity = joinNestedOpacity(opacity, nestedSegment);
       }
-      index += 1;
-      continue;
     }
-    if (arg.startsWith("-O") && arg.length > 2 || arg.startsWith("+O") && arg.length > 2 || arg.startsWith("--rcfile=") && arg.length > "--rcfile=".length || arg.startsWith("--init-file=") && arg.length > "--init-file=".length) {
-      continue;
-    }
-    if (longFlags.has(arg)) {
-      continue;
-    }
-    if (/^[+-][A-Za-z]+$/.test(arg)) {
-      const options = arg.slice(1);
-      if ([...options].some((option) => !shortFlags.has(option))) {
-        return null;
-      }
-      syntaxOnly ||= options.includes("n");
-      continue;
+    if (launcher.opaque || launcher.recipes.length === 0) {
+      requirements.push(
+        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+          `launcher.${launcher.reason}`
+        ])
+      );
+      opacity = joinEffectOpacity(opacity, "opaque");
     }
-    if (arg === "--") {
-      script = args[index + 1] ?? null;
-      break;
+    return shellSegment(commandRedacted, head, requirements, opacity, signals);
+  }
+  const egress = decodeEgressEffects({
+    tokens,
+    cwd: context.cwd,
+    segment: commandRedacted
+  });
+  if (egress) {
+    requirements.push(...egress);
+    for (const signal of egress.flatMap((entry) => entry.evidence.signals)) {
+      signals.add(signal);
     }
-    if (arg.startsWith("-") || arg.startsWith("+")) {
-      return null;
+  } else {
+    const git = decodeGitEffects({
+      tokens,
+      cwd: context.cwd,
+      repoRoot: context.repoRoot,
+      segment: commandRedacted
+    });
+    if (git) {
+      requirements.push(...git);
+      for (const signal of git.flatMap((entry) => entry.evidence.signals)) {
+        signals.add(signal);
+      }
+    } else {
+      const processRequirements = decodeProcessOrFilesystem({
+        tokens,
+        head,
+        env,
+        cwd: context.cwd,
+        repoRoot: context.repoRoot,
+        segment: commandRedacted
+      });
+      if (isGrammarUnknownOnly(processRequirements, head)) {
+        const argvDelegate = peelArgvDelegateArgv(tokens);
+        if (argvDelegate && !argvDelegate.opaque && shouldApplyArgvDelegate(head, argvDelegate.innerTokens, context.depth)) {
+          const innerRecipe = innerRecipeFromArgvDelegate(argvDelegate);
+          if (innerRecipe) {
+            requirements.push(
+              processRequirement(head, "inspect", commandRedacted, [
+                "process.argv_delegate",
+                ...argvDelegate.signals
+              ])
+            );
+            for (const signal of argvDelegate.signals) {
+              signals.add(signal);
+            }
+            const nested = lowerTopLevelSegments(innerRecipe, {
+              ...context,
+              command: innerRecipe,
+              env,
+              depth: context.depth + 1
+            });
+            for (const nestedSegment of nested) {
+              requirements.push(
+                ...nestedSegment.requirements.map(
+                  (entry) => withInnerProvenance(entry, innerRecipe, head, commandRedacted)
+                )
+              );
+              for (const signal of nestedSegment.signals) {
+                signals.add(signal);
+              }
+              opacity = joinNestedOpacity(opacity, nestedSegment);
+            }
+            return shellSegment(commandRedacted, head, requirements, opacity, signals);
+          }
+        }
+        if (argvDelegate?.opaque) {
+          requirements.push(
+            processRequirement(head, "spawn", commandRedacted, [
+              "process.argv_delegate",
+              argvDelegate.reason,
+              ...argvDelegate.signals
+            ]),
+            requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+              argvDelegate.reason,
+              "process.argv_delegate_opaque"
+            ])
+          );
+          for (const signal of argvDelegate.signals) {
+            signals.add(signal);
+          }
+          signals.add("process.argv_delegate_opaque");
+          return shellSegment(
+            commandRedacted,
+            head,
+            requirements,
+            joinEffectOpacity(opacity, "opaque"),
+            signals
+          );
+        }
+      }
+      requirements.push(...processRequirements);
     }
-    script = arg;
-    break;
-  }
-  return syntaxOnly ? script : null;
-}
-function isOptionToken(value) {
-  return value.startsWith("-") || value.startsWith("+");
-}
-function databaseEndpoint(raw) {
-  if (!raw || raw.includes("$")) {
-    return null;
   }
-  try {
-    const url = new URL(raw);
-    if (!url.hostname || !url.protocol) {
-      return null;
+  const environmentSignals = effectChangingEnvironmentSignals(head, env, environment.changedNames);
+  if (environmentSignals.length > 0) {
+    requirements.push(
+      requirement2(
+        "indeterminate",
+        "indeterminate",
+        { kind: "unknown" },
+        commandRedacted,
+        environmentSignals
+      )
+    );
+    opacity = joinEffectOpacity(opacity, "opaque");
+    for (const signal of environmentSignals) {
+      signals.add(signal);
     }
-    return {
-      host: url.hostname.toLowerCase(),
-      protocol: url.protocol.slice(0, -1),
-      ...url.port ? { port: Number(url.port) } : {}
-    };
-  } catch {
-    return null;
   }
-}
-function resolvePathOperand(operand, cwd) {
-  if (operand === "~") {
-    return process.env.HOME ?? operand;
+  if (context.pipeToShellSegment) {
+    signals.add("pipe_to_shell");
+    ensureRequirement(
+      requirements,
+      requirement2(
+        "process.exec",
+        "process.exec",
+        { kind: "executable", command: head || "sh", operation: "spawn" },
+        commandRedacted,
+        ["pipe_to_shell"]
+      )
+    );
+    ensureRequirement(
+      requirements,
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        "pipe_to_shell"
+      ])
+    );
+    opacity = joinEffectOpacity(opacity, "opaque");
   }
-  if (operand.startsWith("~/")) {
-    return path42.join(process.env.HOME ?? "~", operand.slice(2));
+  if (opacity === "unparseable" || opacity === "opaque") {
+    ensureRequirement(
+      requirements,
+      requirement2("indeterminate", "indeterminate", { kind: "unknown" }, commandRedacted, [
+        `shell.${opacity}`
+      ])
+    );
   }
-  return path42.resolve(cwd, operand);
-}
-function isShellHead(head) {
-  return head === "bash" || head === "sh" || head === "zsh" || head === "dash" || head === "fish";
-}
-function pipeToShell(command) {
-  return /(?:^|[|;&]\s*)(?:bash|sh|zsh|dash|fish)(?:\s|$)/.test(command) && /\|/.test(command);
-}
-function withInnerProvenance(requirementValue, innerCommand, launcher, outerSegment) {
-  const provenance = {
-    ...requirementValue.provenance,
-    segment: outerSegment,
-    innerCommand: requirementValue.provenance.innerCommand ?? innerCommand,
-    ...launcher === "npm" || launcher === "pnpm" ? { launcher, phase: "delegate" } : {}
-  };
-  const launcherProvenance = {
-    segment: outerSegment,
-    innerCommand,
-    ...launcher === "npm" || launcher === "pnpm" ? { launcher, phase: "delegate" } : {}
-  };
-  return withProvenances(requirementValue, provenance, launcherProvenance);
-}
-function withProvenances(requirementValue, provenance, contributing) {
-  const provenances = [
-    ...requirementValue.provenances ?? [requirementValue.provenance],
-    contributing,
-    provenance
-  ].filter(
-    (candidate, index, all) => all.findIndex((entry) => JSON.stringify(entry) === JSON.stringify(candidate)) === index
-  );
-  return { ...requirementValue, provenance, provenances };
+  return shellSegment(commandRedacted, head, requirements, opacity, signals);
 }
-function ensureRequirement(requirements, candidate) {
-  if (!requirements.some(
-    (entry) => entry.action === candidate.action && JSON.stringify(entry.resource) === JSON.stringify(candidate.resource)
-  )) {
-    requirements.push(candidate);
+function addSubstitutionEffects(requirements, command, context, segment, signals) {
+  const inners = structuralSubstitutionInners(command);
+  for (const inner of inners) {
+    signals.add("command_substitution");
+    if (context.depth >= MAX_LOWER_DEPTH) {
+      requirements.push(
+        requirement2("indeterminate", "indeterminate", { kind: "unknown" }, segment, [
+          "shell.substitution_depth_exceeded"
+        ])
+      );
+      continue;
+    }
+    const nestedSegments = lowerTopLevelSegments(inner, {
+      ...context,
+      command: inner,
+      depth: context.depth + 1
+    });
+    for (const nested of nestedSegments) {
+      requirements.push(
+        ...nested.requirements.map((entry) => {
+          const outerProvenance = {
+            segment,
+            innerCommand: inner
+          };
+          const provenance = {
+            ...entry.provenance,
+            segment,
+            innerCommand: entry.provenance.innerCommand ?? inner
+          };
+          return withProvenances(entry, provenance, outerProvenance);
+        })
+      );
+    }
   }
 }
-function requirement2(tag, action, resource, segment, signals) {
-  return {
-    tag,
-    action,
-    resource,
-    evidence: {
-      level: tag === "indeterminate" ? "indeterminate" : "certain",
-      signals: [...new Set(signals)].sort(),
-      basis: ["shell_semantic_lowering"]
-    },
-    provenance: { segment }
-  };
-}
 
 // src/core/verdict/verdict.ts
 init_path_utils();
@@ -16829,6 +17045,13 @@ function policyAuth(options) {
 function scrubPayload(value, options) {
   return scrubValue(value, options.scrubOptions);
 }
+function fingerprintPayload(payload, options) {
+  const toolInput = fingerprintToolInputSource(payload);
+  if (Object.keys(toolInput).length > 0) {
+    return toolInput;
+  }
+  return scrubPayload(payload.tool_input ?? {}, options);
+}
 function extractFilePath(payload) {
   const toolInput = payload.tool_input;
   if (!toolInput || typeof toolInput !== "object") {
@@ -17003,11 +17226,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
           verdict: "deny_pending_approval",
           reason: "tool_shell_missing_command",
           summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-          fingerprint: toolFingerprint(
-            toolName,
-            scrubPayload(payload.tool_input ?? {}, options),
-            repoRoot
-          ),
+          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
           assessment: {
             reversibility: "irreversible",
             external: false,
@@ -17021,11 +17240,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         verdict: "allow_flagged",
         reason: "tool_shell_missing_command",
         summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(
-          toolName,
-          scrubPayload(payload.tool_input ?? {}, options),
-          repoRoot
-        ),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
         assessment: {
           reversibility: "recoverable_with_cost",
           external: false,
@@ -17049,11 +17264,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
           verdict: "deny_pending_approval",
           reason: "file_mutation_missing_path",
           summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-          fingerprint: toolFingerprint(
-            toolName,
-            scrubPayload(payload.tool_input ?? {}, options),
-            repoRoot
-          ),
+          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
           assessment: {
             reversibility: "irreversible",
             external: false,
@@ -17067,11 +17278,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         verdict: "allow_flagged",
         reason: "file_mutation_missing_path",
         summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(
-          toolName,
-          scrubPayload(payload.tool_input ?? {}, options),
-          repoRoot
-        ),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
         assessment: {
           reversibility: "recoverable_with_cost",
           external: false,
@@ -17082,7 +17289,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       };
     }
     const signals = [];
-    const resolvedPath = path43.isAbsolute(filePath) ? filePath : path43.resolve(cwd, filePath);
+    const resolvedPath = path50.isAbsolute(filePath) ? filePath : path50.resolve(cwd, filePath);
     const hitsProtectedRoot = protectedRoots.some((root) => pathWithinRoot(root, resolvedPath));
     if (hitsProtectedRoot) {
       signals.push("control_plane_path");
@@ -17221,11 +17428,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
           verdict: "deny_pending_approval",
           reason: "apply_patch_missing_path",
           summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-          fingerprint: toolFingerprint(
-            toolName,
-            scrubPayload(payload.tool_input ?? {}, options),
-            repoRoot
-          ),
+          fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
           assessment: {
             reversibility: "irreversible",
             external: false,
@@ -17239,11 +17442,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
         verdict: "allow_flagged",
         reason: "apply_patch_missing_path",
         summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-        fingerprint: toolFingerprint(
-          toolName,
-          scrubPayload(payload.tool_input ?? {}, options),
-          repoRoot
-        ),
+        fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
         assessment: {
           reversibility: "recoverable_with_cost",
           external: false,
@@ -17274,11 +17473,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
       verdict: "allow_flagged",
       reason: sawDelete ? "file_delete" : "file_mutation",
       summary: targets.map((target) => target.path).join(", "),
-      fingerprint: toolFingerprint(
-        toolName,
-        scrubPayload(payload.tool_input ?? {}, options),
-        repoRoot
-      ),
+      fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
       assessment: {
         reversibility: "recoverable_with_cost",
         external: false,
@@ -17292,11 +17487,7 @@ async function classifyToolUse(payload, repoRoot, cwd, config, options = {}) {
     verdict: "allow",
     reason: "unclassified_tool",
     summary: canonicalStringify(scrubPayload(payload.tool_input ?? {}, options)),
-    fingerprint: toolFingerprint(
-      toolName,
-      scrubPayload(payload.tool_input ?? {}, options),
-      repoRoot
-    ),
+    fingerprint: toolFingerprint(toolName, fingerprintPayload(payload, options), repoRoot),
     assessment: {
       reversibility: "reversible",
       external: false,
@@ -17684,7 +17875,7 @@ function hashDecisionConfig(config) {
 init_fingerprint2();
 
 // src/version.ts
-var PACKAGE_VERSION = "0.9.3";
+var PACKAGE_VERSION = "0.9.4";
 
 // src/runtime-provenance.ts
 function resolveRuntimeArtifactHash(artifactHash) {
@@ -17759,7 +17950,7 @@ init_path_utils();
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { existsSync as existsSync15 } from "node:fs";
 import { mkdir as mkdir11, readdir as readdir3, readFile as readFile13, rename as rename3, rm as rm6 } from "node:fs/promises";
-import path48 from "node:path";
+import path55 from "node:path";
 
 // src/core/recovery/artifact-store.ts
 init_fingerprint2();
@@ -17767,7 +17958,7 @@ init_path_utils();
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { existsSync as existsSync13 } from "node:fs";
 import { lstat as lstat7, mkdir as mkdir10, open as open5, readdir as readdir2, readFile as readFile10, rename as rename2, rm as rm5, writeFile as writeFile7 } from "node:fs/promises";
-import path45 from "node:path";
+import path52 from "node:path";
 
 // src/core/recovery/snapshot-node.ts
 init_fingerprint2();
@@ -17787,25 +17978,25 @@ import {
   symlink as symlink3,
   writeFile as writeFile6
 } from "node:fs/promises";
-import path44 from "node:path";
+import path51 from "node:path";
 var RECOVERY_UNSUPPORTED_FILE_KIND = "recovery_unsupported_file_kind";
 function validRecoveryRelativePath(relativePath) {
-  if (!relativePath || relativePath.includes("\0") || path44.isAbsolute(relativePath)) return false;
-  const normalized = path44.normalize(relativePath);
-  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path44.sep}`);
+  if (!relativePath || relativePath.includes("\0") || path51.isAbsolute(relativePath)) return false;
+  const normalized = path51.normalize(relativePath);
+  return normalized !== "." && normalized !== ".." && !normalized.startsWith(`..${path51.sep}`);
 }
 async function assertRecoverySafeTarget(resourceRoot, relativePath) {
   if (!validRecoveryRelativePath(relativePath)) throw new Error("recovery_path_escape");
   const root = canonicalPath(resourceRoot);
-  const target = path44.resolve(root, relativePath);
-  const relative = path44.relative(root, target);
-  if (relative === ".." || relative.startsWith(`..${path44.sep}`) || path44.isAbsolute(relative)) {
+  const target = path51.resolve(root, relativePath);
+  const relative = path51.relative(root, target);
+  if (relative === ".." || relative.startsWith(`..${path51.sep}`) || path51.isAbsolute(relative)) {
     throw new Error("recovery_path_escape");
   }
   let current = root;
-  const parentParts = path44.relative(root, path44.dirname(target)).split(path44.sep).filter(Boolean);
+  const parentParts = path51.relative(root, path51.dirname(target)).split(path51.sep).filter(Boolean);
   for (const part of parentParts) {
-    current = path44.join(current, part);
+    current = path51.join(current, part);
     if (!existsSync12(current)) break;
     const info = await lstat6(current);
     if (info.isSymbolicLink()) throw new Error("recovery_symlink_escape");
@@ -17861,7 +18052,7 @@ async function captureRecoverySnapshot(filePath, options) {
   let blob;
   if (options?.blobDir) {
     await mkdir9(options.blobDir, { recursive: true, mode: 448 });
-    const blobPath = path44.join(options.blobDir, hash);
+    const blobPath = path51.join(options.blobDir, hash);
     if (!existsSync12(blobPath)) {
       await writeFile6(blobPath, content, { mode: 384 });
       await fsyncPath(blobPath);
@@ -17916,7 +18107,7 @@ async function validateRecoverySnapshot(params) {
   if (record.blob !== `blobs/${record.hash}`) throw new Error(params.corruptReason);
   let content;
   try {
-    content = await readFile9(path44.join(params.artifactDir, record.blob));
+    content = await readFile9(path51.join(params.artifactDir, record.blob));
   } catch {
     throw new Error(params.corruptReason);
   }
@@ -17944,13 +18135,13 @@ var RECOVERY_STATES = /* @__PURE__ */ new Set([
 ]);
 var STAGING_STALE_MS = 5 * 6e4;
 function checkpointsRoot(stateDir) {
-  return path45.join(stateDir, "recovery", "checkpoints");
+  return path52.join(stateDir, "recovery", "checkpoints");
 }
 function checkpointDir(stateDir, checkpointId) {
   if (!/^cp_[a-f0-9]{24}$/.test(checkpointId)) {
     throw new Error("invalid_recovery_checkpoint_id");
   }
-  return path45.join(checkpointsRoot(stateDir), checkpointId);
+  return path52.join(checkpointsRoot(stateDir), checkpointId);
 }
 async function fsyncPath2(filePath) {
   const handle = await open5(filePath, "r");
@@ -17961,13 +18152,13 @@ async function fsyncPath2(filePath) {
   }
 }
 async function atomicWriteJson(filePath, value) {
-  await mkdir10(path45.dirname(filePath), { recursive: true, mode: 448 });
+  await mkdir10(path52.dirname(filePath), { recursive: true, mode: 448 });
   const temporary = `${filePath}.tmp-${randomUUID4()}`;
   await writeFile7(temporary, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   await fsyncPath2(temporary);
   await rename2(temporary, filePath);
-  await fsyncPath2(path45.dirname(filePath));
+  await fsyncPath2(path52.dirname(filePath));
 }
 async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
   const value = {
@@ -17977,13 +18168,13 @@ async function writeRecoveryState(artifactDir, state, manifestHash, detail) {
     manifestHash,
     ...detail ? { detail } : {}
   };
-  await atomicWriteJson(path45.join(artifactDir, "state.json"), value);
+  await atomicWriteJson(path52.join(artifactDir, "state.json"), value);
 }
 async function directorySize(root) {
   if (!existsSync13(root)) return 0;
   let total = 0;
   for (const entry of await readdir2(root, { withFileTypes: true })) {
-    const entryPath = path45.join(root, entry.name);
+    const entryPath = path52.join(root, entry.name);
     if (entry.isDirectory()) total += await directorySize(entryPath);
     else total += (await lstat7(entryPath)).size;
   }
@@ -18028,9 +18219,9 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   let rawManifest;
   let state;
   try {
-    rawManifest = JSON.parse(await readFile10(path45.join(artifactDir, "manifest.json"), "utf8"));
+    rawManifest = JSON.parse(await readFile10(path52.join(artifactDir, "manifest.json"), "utf8"));
     state = JSON.parse(
-      await readFile10(path45.join(artifactDir, "state.json"), "utf8")
+      await readFile10(path52.join(artifactDir, "state.json"), "utf8")
     );
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
@@ -18046,10 +18237,10 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
   }
   const entryPaths = /* @__PURE__ */ new Set();
   for (const entry of manifest.entries) {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path45.normalize(entry.path))) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry) || Object.keys(entry).length !== 3 || !Object.keys(entry).every((key) => ["path", "before", "after"].includes(key)) || typeof entry.path !== "string" || !("before" in entry) || !("after" in entry) || !validRecoveryRelativePath(entry.path) || entryPaths.has(path52.normalize(entry.path))) {
       throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
     }
-    entryPaths.add(path45.normalize(entry.path));
+    entryPaths.add(path52.normalize(entry.path));
     for (const [side, snapshot] of [
       ["before", entry.before],
       ["after", entry.after]
@@ -18063,7 +18254,7 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
       });
     }
   }
-  const receiptPath = path45.join(artifactDir, "receipt.json");
+  const receiptPath = path52.join(artifactDir, "receipt.json");
   let receipt;
   if (["applied", "restoring", "restored", "conflict"].includes(state.state) || existsSync13(receiptPath)) {
     receipt = await readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
@@ -18073,7 +18264,7 @@ async function readRecoveryArtifact(stateDir, checkpointId) {
 async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash) {
   let rawReceipt;
   try {
-    rawReceipt = JSON.parse(await readFile10(path45.join(artifactDir, "receipt.json"), "utf8"));
+    rawReceipt = JSON.parse(await readFile10(path52.join(artifactDir, "receipt.json"), "utf8"));
   } catch {
     throw new Error(RECOVERY_CHECKPOINT_CORRUPT);
   }
@@ -18096,7 +18287,7 @@ async function readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHas
   return receipt;
 }
 async function ensureRecoveryReceipt(artifactDir, manifest, manifestHash) {
-  const receiptPath = path45.join(artifactDir, "receipt.json");
+  const receiptPath = path52.join(artifactDir, "receipt.json");
   if (existsSync13(receiptPath)) {
     return readAndValidateRecoveryReceipt(artifactDir, manifest, manifestHash);
   }
@@ -18121,7 +18312,7 @@ async function artifactRepoRoot(stateDir, checkpointId) {
   const artifactDir = checkpointDir(stateDir, checkpointId);
   try {
     const manifest = JSON.parse(
-      await readFile10(path45.join(artifactDir, "manifest.json"), "utf8")
+      await readFile10(path52.join(artifactDir, "manifest.json"), "utf8")
     );
     if (typeof manifest.repoRoot === "string" && manifest.repoRoot) {
       return canonicalPath(manifest.repoRoot);
@@ -18129,7 +18320,7 @@ async function artifactRepoRoot(stateDir, checkpointId) {
   } catch {
   }
   try {
-    const owner = JSON.parse(await readFile10(path45.join(artifactDir, "owner.json"), "utf8"));
+    const owner = JSON.parse(await readFile10(path52.join(artifactDir, "owner.json"), "utf8"));
     return typeof owner.repoRoot === "string" && owner.repoRoot ? canonicalPath(owner.repoRoot) : null;
   } catch {
     return null;
@@ -18149,10 +18340,10 @@ async function cleanupOrphanedStaging(stateDir) {
   const now = Date.now();
   for (const entry of await readdir2(root, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) continue;
-    const stagingPath = path45.join(root, entry.name);
+    const stagingPath = path52.join(root, entry.name);
     let stale = false;
     try {
-      const owner = JSON.parse(await readFile10(path45.join(stagingPath, "owner.json"), "utf8"));
+      const owner = JSON.parse(await readFile10(path52.join(stagingPath, "owner.json"), "utf8"));
       const pid = typeof owner.pid === "number" ? owner.pid : Number.NaN;
       const createdAt = typeof owner.createdAt === "string" ? Date.parse(owner.createdAt) : NaN;
       let alive = false;
@@ -18194,7 +18385,7 @@ async function markRecoveryCheckpointApplied(stateDir, checkpoint) {
 init_fingerprint2();
 import { existsSync as existsSync14 } from "node:fs";
 import { readFile as readFile11 } from "node:fs/promises";
-import path46 from "node:path";
+import path53 from "node:path";
 async function matchRecoverySide(resourceRoot, entries, side) {
   for (const entry of entries) {
     const target = await assertRecoverySafeTarget(resourceRoot, entry.path);
@@ -18209,7 +18400,7 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
   } catch {
     const artifactDir = checkpointDir(stateDir, checkpointId);
     if (existsSync14(artifactDir)) {
-      const manifestPath = path46.join(artifactDir, "manifest.json");
+      const manifestPath = path53.join(artifactDir, "manifest.json");
       const hash = existsSync14(manifestPath) ? hashValue(await readFile11(manifestPath, "utf8")) : "unavailable";
       await writeRecoveryState(artifactDir, "corrupt", hash, RECOVERY_CHECKPOINT_CORRUPT);
     }
@@ -18246,7 +18437,7 @@ async function reconcileRecoveryCheckpoint(stateDir, checkpointId) {
 // src/core/recovery/resource-identity.ts
 init_fingerprint2();
 import { lstat as lstat8, readFile as readFile12, realpath as realpath3 } from "node:fs/promises";
-import path47 from "node:path";
+import path54 from "node:path";
 async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
   const resolvedRoot = await realpath3(resourceRoot);
   if (resourceKind === "directory") {
@@ -18254,13 +18445,13 @@ async function currentRecoveryResourceIdentity(resourceRoot, resourceKind) {
     if (!rootInfo.isDirectory()) throw new Error("recovery_repo_identity_unavailable");
     return hashValue(`${resolvedRoot}\0${rootInfo.dev}:${rootInfo.ino}:${rootInfo.birthtimeMs}`);
   }
-  const dotGit = path47.join(resolvedRoot, ".git");
+  const dotGit = path54.join(resolvedRoot, ".git");
   const gitInfo = await lstat8(dotGit);
   let gitMetadataPath = dotGit;
   if (gitInfo.isFile()) {
     const marker = (await readFile12(dotGit, "utf8")).trim();
     if (!marker.startsWith("gitdir:")) throw new Error("recovery_repo_identity_unavailable");
-    gitMetadataPath = path47.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
+    gitMetadataPath = path54.resolve(resolvedRoot, marker.slice("gitdir:".length).trim());
   } else if (!gitInfo.isDirectory()) {
     throw new Error("recovery_repo_identity_unavailable");
   }
@@ -18333,16 +18524,16 @@ async function prepareRecoveryCheckpoint(params) {
     throw new Error(RECOVERY_CHECKPOINT_QUOTA);
   }
   const checkpointId = `cp_${randomUUID5().replaceAll("-", "").slice(0, 24)}`;
-  const temporary = path48.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
+  const temporary = path55.join(checkpointsRoot(params.stateDir), `.tmp-${checkpointId}`);
   const finalDir = checkpointDir(params.stateDir, checkpointId);
   await mkdir11(temporary, { recursive: true, mode: 448 });
-  await atomicWriteJson(path48.join(temporary, "owner.json"), {
+  await atomicWriteJson(path55.join(temporary, "owner.json"), {
     version: 1,
     pid: process.pid,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     repoRoot: canonicalPath(params.repoRoot)
   });
-  await mkdir11(path48.join(temporary, "blobs"), { recursive: true, mode: 448 });
+  await mkdir11(path55.join(temporary, "blobs"), { recursive: true, mode: 448 });
   try {
     const entries = [];
     const protectedRoots = (params.protectedRoots ?? []).map(canonicalPath);
@@ -18351,8 +18542,8 @@ async function prepareRecoveryCheckpoint(params) {
     )) {
       const target = await assertRecoverySafeTarget(params.repoRoot, change.relativePath);
       if (protectedRoots.some((root) => {
-        const relative = path48.relative(root, target);
-        return relative === "" || relative !== ".." && !relative.startsWith(`..${path48.sep}`) && !path48.isAbsolute(relative);
+        const relative = path55.relative(root, target);
+        return relative === "" || relative !== ".." && !relative.startsWith(`..${path55.sep}`) && !path55.isAbsolute(relative);
       })) {
         throw new Error("recovery_protected_path");
       }
@@ -18364,7 +18555,7 @@ async function prepareRecoveryCheckpoint(params) {
       entries.push({
         path: change.relativePath,
         before: await captureRecoverySnapshot(baseline, {
-          blobDir: path48.join(temporary, "blobs")
+          blobDir: path55.join(temporary, "blobs")
         }),
         after: withoutRecoveryBlob(await captureRecoverySnapshot(source))
       });
@@ -18401,7 +18592,7 @@ async function prepareRecoveryCheckpoint(params) {
       entries
     };
     const manifestHash = hashValue(canonicalStringify(manifest));
-    await atomicWriteJson(path48.join(temporary, "manifest.json"), manifest);
+    await atomicWriteJson(path55.join(temporary, "manifest.json"), manifest);
     await writeRecoveryState(temporary, "prepared", manifestHash);
     await fsyncPath2(temporary);
     const projectedBytes = await recoveryCheckpointStorageBytes(params.stateDir, params.repoRoot);
@@ -18444,7 +18635,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
       } catch {
         try {
           const raw = JSON.parse(
-            await readFile13(path48.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+            await readFile13(path55.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
           );
           rootFromArtifact = typeof raw.repoRoot === "string" && raw.repoRoot ? raw.repoRoot : void 0;
         } catch {
@@ -18478,7 +18669,7 @@ async function listRecoveryCheckpoints(stateDir, repoRoot) {
     } catch {
       try {
         const manifest = JSON.parse(
-          await readFile13(path48.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
+          await readFile13(path55.join(checkpointDir(stateDir, id), "manifest.json"), "utf8")
         );
         if (manifest.checkpointId !== id || ![1, 2].includes(manifest.version)) continue;
         if (repoRoot && canonicalPath(manifest.repoRoot) !== canonicalPath(repoRoot)) continue;
@@ -18508,7 +18699,7 @@ async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
   let total = 0;
   for (const entry of await readdir3(root, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
-    const entryPath = path48.join(root, entry.name);
+    const entryPath = path55.join(root, entry.name);
     if (/^cp_[a-f0-9]{24}$/.test(entry.name)) {
       if (await artifactRepoRoot(stateDir, entry.name) === expected) {
         total += await directorySize(entryPath);
@@ -18517,7 +18708,7 @@ async function recoveryCheckpointStorageBytes(stateDir, repoRoot) {
     }
     if (/^\.tmp-cp_[a-f0-9]{24}$/.test(entry.name)) {
       try {
-        const owner = JSON.parse(await readFile13(path48.join(entryPath, "owner.json"), "utf8"));
+        const owner = JSON.parse(await readFile13(path55.join(entryPath, "owner.json"), "utf8"));
         if (typeof owner.repoRoot === "string" && canonicalPath(owner.repoRoot) === expected) {
           total += await directorySize(entryPath);
         }
@@ -18561,14 +18752,14 @@ init_scrub();
 // src/core/transactional/file-checkpoint-backend.ts
 import { cp, lstat as lstat11, mkdir as mkdir13, mkdtemp as mkdtemp5, readdir as readdir6, rm as rm9, writeFile as writeFile10 } from "node:fs/promises";
 import os5 from "node:os";
-import path52 from "node:path";
+import path59 from "node:path";
 
 // src/core/transactional/file-checkpoint-git.ts
 init_path_utils();
 import { spawn as spawn8 } from "node:child_process";
 import { createHash as createHash13 } from "node:crypto";
 import { copyFile as copyFile3, lstat as lstat9, readdir as readdir4, readFile as readFile14 } from "node:fs/promises";
-import path49 from "node:path";
+import path56 from "node:path";
 var FILE_CHECKPOINT_GIT_METADATA_CHANGED = "file_checkpoint_git_metadata_changed";
 var FILE_CHECKPOINT_SOURCE_CHANGED = "file_checkpoint_source_changed";
 var FILE_CHECKPOINT_CWD_OUTSIDE_ROOT = "file_checkpoint_cwd_outside_root";
@@ -18602,7 +18793,7 @@ function rethrowStableFileCheckpointError(error) {
 }
 async function rootGitMetadataPresent(repoRoot) {
   try {
-    await lstat9(path49.join(repoRoot, ".git"));
+    await lstat9(path56.join(repoRoot, ".git"));
     return true;
   } catch {
     return false;
@@ -18651,10 +18842,10 @@ function execGit2(repoRoot, args) {
 }
 async function resolveGitPath(repoRoot, gitPath) {
   const trimmed = gitPath.trim();
-  if (path49.isAbsolute(trimmed)) {
+  if (path56.isAbsolute(trimmed)) {
     return trimmed;
   }
-  return path49.join(repoRoot, trimmed);
+  return path56.join(repoRoot, trimmed);
 }
 async function cloneBareWorktreeCopy(sourceRoot, destinationRoot) {
   await execGit2(sourceRoot, [
@@ -18696,7 +18887,7 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
     destinationRoot,
     await execGit2(destinationRoot, ["rev-parse", "--git-dir"])
   );
-  const destinationShared = path49.join(destinationGitDir, path49.basename(sourceShared));
+  const destinationShared = path56.join(destinationGitDir, path56.basename(sourceShared));
   try {
     await copyFile3(sourceShared, destinationShared);
   } catch (error) {
@@ -18705,7 +18896,7 @@ async function copyGitIndexState(sourceRoot, destinationRoot) {
 }
 async function readGitFile(gitDir, relativePath) {
   try {
-    return await readFile14(path49.join(gitDir, relativePath));
+    return await readFile14(path56.join(gitDir, relativePath));
   } catch {
     return null;
   }
@@ -18729,8 +18920,8 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
       repoRoot,
       await execGit2(repoRoot, ["rev-parse", "--git-path", gitPath])
     );
-    const relative = path49.resolve(resolved).startsWith(path49.resolve(gitDir)) ? path49.relative(gitDir, resolved) : resolved;
-    const content = typeof relative === "string" && !relative.startsWith("..") && !path49.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+    const relative = path56.resolve(resolved).startsWith(path56.resolve(gitDir)) ? path56.relative(gitDir, resolved) : resolved;
+    const content = typeof relative === "string" && !relative.startsWith("..") && !path56.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
     if (content !== null) {
       hashGitFileContent(hash, gitPath, content);
     }
@@ -18740,13 +18931,13 @@ async function hashResolvedGitPath(repoRoot, gitDir, gitPath, hash) {
 async function hashGitTree(gitDir, relativeDir, hash) {
   let names;
   try {
-    names = await readdir4(path49.join(gitDir, relativeDir));
+    names = await readdir4(path56.join(gitDir, relativeDir));
   } catch {
     return;
   }
   for (const name of names.sort()) {
-    const relativePath = relativeDir ? path49.join(relativeDir, name) : name;
-    const absolutePath = path49.join(gitDir, relativePath);
+    const relativePath = relativeDir ? path56.join(relativeDir, name) : name;
+    const absolutePath = path56.join(gitDir, relativePath);
     let childNames = null;
     try {
       childNames = await readdir4(absolutePath);
@@ -18768,7 +18959,7 @@ async function hashGitTree(gitDir, relativeDir, hash) {
 }
 async function computeGitMetadataFingerprint(repoRoot) {
   const gitDirRel = (await execGit2(repoRoot, ["rev-parse", "--git-dir"])).trim();
-  const gitDir = path49.isAbsolute(gitDirRel) ? gitDirRel : path49.join(repoRoot, gitDirRel);
+  const gitDir = path56.isAbsolute(gitDirRel) ? gitDirRel : path56.join(repoRoot, gitDirRel);
   const hash = createHash13("sha256");
   for (const file of [
     "HEAD",
@@ -18791,8 +18982,8 @@ async function computeGitMetadataFingerprint(repoRoot) {
     const sharedIndex = (await execGit2(repoRoot, ["rev-parse", "--shared-index-path"])).trim();
     if (sharedIndex) {
       const resolved = await resolveGitPath(repoRoot, sharedIndex);
-      const relative = path49.relative(gitDir, resolved);
-      const content = relative && !relative.startsWith("..") && !path49.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
+      const relative = path56.relative(gitDir, resolved);
+      const content = relative && !relative.startsWith("..") && !path56.isAbsolute(relative) ? await readGitFile(gitDir, relative) : await readAbsoluteGitFile(resolved);
       if (content !== null) {
         hashGitFileContent(hash, "shared-index", content);
       }
@@ -18803,7 +18994,7 @@ async function computeGitMetadataFingerprint(repoRoot) {
     await hashResolvedGitPath(repoRoot, gitDir, gitPath, hash);
   }
   try {
-    const rootGitPath = path49.join(repoRoot, ".git");
+    const rootGitPath = path56.join(repoRoot, ".git");
     const rootGitInfo = await lstat9(rootGitPath);
     if (rootGitInfo.isFile()) {
       const content = await readAbsoluteGitFile(rootGitPath);
@@ -18819,14 +19010,14 @@ async function computeGitMetadataFingerprint(repoRoot) {
 function resolveExecutionCwdRelative(resourceRoot, cwd) {
   const resolvedCwd = canonicalPath(cwd);
   const resourceCanonical = canonicalPath(resourceRoot);
-  const relative = path49.relative(resourceCanonical, resolvedCwd);
+  const relative = path56.relative(resourceCanonical, resolvedCwd);
   if (relative === "" || relative === ".") {
     return "";
   }
-  if (relative.startsWith("..") || path49.isAbsolute(relative)) {
+  if (relative.startsWith("..") || path56.isAbsolute(relative)) {
     throw new Error(FILE_CHECKPOINT_CWD_OUTSIDE_ROOT);
   }
-  return relative.split(path49.sep).join("/");
+  return relative.split(path56.sep).join("/");
 }
 
 // src/core/transactional/file-checkpoint-isolation.ts
@@ -18848,7 +19039,7 @@ function fileCheckpointIsolationReason(context) {
 
 // src/core/transactional/file-checkpoint-staging.ts
 import { readdir as readdir5, readFile as readFile15, rm as rm7, writeFile as writeFile8 } from "node:fs/promises";
-import path50 from "node:path";
+import path57 from "node:path";
 function isOwnerProcessAlive(pid) {
   try {
     process.kill(pid, 0);
@@ -18858,12 +19049,12 @@ function isOwnerProcessAlive(pid) {
   }
 }
 async function writeOwnerMarker(stagingRoot, marker) {
-  await writeFile8(path50.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
+  await writeFile8(path57.join(stagingRoot, "owner.json"), `${JSON.stringify(marker)}
 `, "utf8");
 }
 async function readOwnerMarker(stagingRoot) {
   try {
-    const raw = await readFile15(path50.join(stagingRoot, "owner.json"), "utf8");
+    const raw = await readFile15(path57.join(stagingRoot, "owner.json"), "utf8");
     return JSON.parse(raw.trim());
   } catch {
     return null;
@@ -18881,7 +19072,7 @@ async function collectDeadOwnerStaging(parentDir) {
     if (!name.startsWith("belay-file-checkpoint-")) {
       continue;
     }
-    const stagingRoot = path50.join(parentDir, name);
+    const stagingRoot = path57.join(parentDir, name);
     const marker = await readOwnerMarker(stagingRoot);
     if (!marker) {
       dead.push(stagingRoot);
@@ -18913,7 +19104,7 @@ import {
   writeFile as writeFile9
 } from "node:fs/promises";
 import os4 from "node:os";
-import path51 from "node:path";
+import path58 from "node:path";
 var FILE_CHECKPOINT_COPY_FAILED = "file_checkpoint_copy_failed";
 async function chmodSafe2(target, mode) {
   try {
@@ -18923,7 +19114,7 @@ async function chmodSafe2(target, mode) {
   }
 }
 async function copyRegularFile(sourcePath, destinationPath, mode, strategy) {
-  await mkdir12(path51.dirname(destinationPath), { recursive: true });
+  await mkdir12(path58.dirname(destinationPath), { recursive: true });
   if (strategy === "clonefile" && fsConstants2.COPYFILE_FICLONE !== void 0) {
     try {
       await copyFile4(sourcePath, destinationPath, fsConstants2.COPYFILE_FICLONE);
@@ -18949,7 +19140,7 @@ async function copyNode(sourceRoot, destinationRoot, relativePath, strategy) {
     return strategy;
   }
   if (info.isSymbolicLink()) {
-    await mkdir12(path51.dirname(destinationPath), { recursive: true });
+    await mkdir12(path58.dirname(destinationPath), { recursive: true });
     await symlink4(await readlink5(sourcePath), destinationPath);
     return strategy;
   }
@@ -19005,9 +19196,9 @@ async function mapWithConcurrency(items, concurrency, worker) {
 async function probeFileCloneStrategy() {
   let tempDir = null;
   try {
-    tempDir = await mkdtemp4(path51.join(os4.tmpdir(), "belay-clone-probe-"));
-    const source = path51.join(tempDir, "source.txt");
-    const destination = path51.join(tempDir, "dest.txt");
+    tempDir = await mkdtemp4(path58.join(os4.tmpdir(), "belay-clone-probe-"));
+    const source = path58.join(tempDir, "source.txt");
+    const destination = path58.join(tempDir, "dest.txt");
     await writeFile9(source, "probe\n");
     if (fsConstants2.COPYFILE_FICLONE_FORCE !== void 0) {
       try {
@@ -19160,11 +19351,11 @@ async function protectedRootState(root) {
   return `directory:${node.hash}:${index.treeHash}`;
 }
 function executionProtectedRoot(resourceRoot, executionRoot, protectedRoot) {
-  const relative = path52.relative(path52.resolve(resourceRoot), path52.resolve(protectedRoot));
-  if (relative === "" || relative.startsWith("..") || path52.isAbsolute(relative)) {
+  const relative = path59.relative(path59.resolve(resourceRoot), path59.resolve(protectedRoot));
+  if (relative === "" || relative.startsWith("..") || path59.isAbsolute(relative)) {
     return null;
   }
-  return path52.join(executionRoot, relative);
+  return path59.join(executionRoot, relative);
 }
 async function captureProtectedRootStates(resourceRoot, executionRoot, protectedRoots) {
   const states = /* @__PURE__ */ new Map();
@@ -19189,15 +19380,15 @@ async function directoryByteSize(root, deadlineMs) {
   }
   let total = 0;
   for (const name of await readdir6(root)) {
-    total += await directoryByteSize(path52.join(root, name), deadlineMs);
+    total += await directoryByteSize(path59.join(root, name), deadlineMs);
   }
   return total;
 }
 async function copyGitMetadataDirectory(sourceRoot, destinationRoot) {
   const gitDirRel = (await execGit2(sourceRoot, ["rev-parse", "--git-dir"])).trim();
-  const sourceGitDir = path52.isAbsolute(gitDirRel) ? gitDirRel : path52.join(sourceRoot, gitDirRel);
-  const relativeGitDir = path52.relative(path52.resolve(sourceRoot), path52.resolve(sourceGitDir));
-  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path52.join(destinationRoot, relativeGitDir) : path52.join(destinationRoot, ".git");
+  const sourceGitDir = path59.isAbsolute(gitDirRel) ? gitDirRel : path59.join(sourceRoot, gitDirRel);
+  const relativeGitDir = path59.relative(path59.resolve(sourceRoot), path59.resolve(sourceGitDir));
+  const destinationGitDir = relativeGitDir && !relativeGitDir.startsWith("..") ? path59.join(destinationRoot, relativeGitDir) : path59.join(destinationRoot, ".git");
   await cp(sourceGitDir, destinationGitDir, { recursive: true, force: true });
 }
 async function prepareDirtyGitSnapshot(context) {
@@ -19206,7 +19397,7 @@ async function prepareDirtyGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path52.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path59.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -19214,8 +19405,8 @@ async function prepareDirtyGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path52.join(stagingRoot, "baseline");
-  const executionRoot = path52.join(stagingRoot, "execution");
+  const baselineRoot = path59.join(stagingRoot, "baseline");
+  const executionRoot = path59.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const sourceGitMetadataFingerprint = await computeGitMetadataFingerprint(context.repoRoot);
@@ -19249,7 +19440,7 @@ async function prepareDirtyGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path52.join(stagingRoot, "baseline-index.json"),
+      path59.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -19299,7 +19490,7 @@ async function prepareNonGitSnapshot(context) {
   const quotas = context.fileCheckpoint;
   const deadlineMs = Date.now() + quotas.prepareTimeoutMs;
   await removeDeadOwnerStaging(os5.tmpdir());
-  const stagingRoot = await mkdtemp5(path52.join(os5.tmpdir(), "belay-file-checkpoint-"));
+  const stagingRoot = await mkdtemp5(path59.join(os5.tmpdir(), "belay-file-checkpoint-"));
   await writeOwnerMarker(stagingRoot, {
     version: 1,
     pid: process.pid,
@@ -19307,8 +19498,8 @@ async function prepareNonGitSnapshot(context) {
     resourceRoot: context.repoRoot,
     backend: "file_checkpoint"
   });
-  const baselineRoot = path52.join(stagingRoot, "baseline");
-  const executionRoot = path52.join(stagingRoot, "execution");
+  const baselineRoot = path59.join(stagingRoot, "baseline");
+  const executionRoot = path59.join(stagingRoot, "execution");
   try {
     resolveExecutionCwdRelative(context.repoRoot, context.cwd);
     const resourceIdentity = await currentRecoveryResourceIdentity(context.repoRoot, "directory");
@@ -19337,7 +19528,7 @@ async function prepareNonGitSnapshot(context) {
       throw new Error(FILE_CHECKPOINT_SOURCE_CHANGED);
     }
     await writeFile10(
-      path52.join(stagingRoot, "baseline-index.json"),
+      path59.join(stagingRoot, "baseline-index.json"),
       `${JSON.stringify(baselineIndex)}
 `,
       "utf8"
@@ -19690,10 +19881,10 @@ async function selectTransactionalBackend(context) {
 }
 
 // src/core/transactional/diff-evaluator.ts
-import path53 from "node:path";
+import path60 from "node:path";
 init_path_utils();
 function categorizeChange(change, ctx) {
-  const absolutePath = canonicalPath(path53.join(ctx.repoRoot, change.relativePath));
+  const absolutePath = canonicalPath(path60.join(ctx.repoRoot, change.relativePath));
   if (!pathWithinRoot(ctx.repoRoot, absolutePath)) {
     return "repo_outside";
   }
@@ -20287,7 +20478,7 @@ async function notifyDeny(config, event) {
 init_path_utils();
 
 // src/adapters/layouts/protected-paths.ts
-import path54 from "node:path";
+import path61 from "node:path";
 function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   const roots = [
     layout.configPath(repoRoot),
@@ -20299,7 +20490,7 @@ function protectedArtifactRoots(layout, repoRoot, controlPlaneDir) {
   if (controlPlaneDir) {
     roots.push(controlPlaneDir);
   }
-  return roots.map((entry) => path54.resolve(entry));
+  return roots.map((entry) => path61.resolve(entry));
 }
 
 // src/adapters/shared/gate-runtime.ts
@@ -20352,8 +20543,8 @@ function createDefaultGateRuntimeDeps() {
       return loadJsonFile(configPath, {});
     },
     async appendAudit(ctx, event) {
-      const auditPath = path55.join(ctx.repoRoot, ctx.config.audit.logPath);
-      await mkdir14(path55.dirname(auditPath), { recursive: true });
+      const auditPath = path62.join(ctx.repoRoot, ctx.config.audit.logPath);
+      await mkdir14(path62.dirname(auditPath), { recursive: true });
       const provenance = auditProvenance(ctx.config);
       const record = {
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -20386,7 +20577,7 @@ function createDefaultGateRuntimeDeps() {
       };
     },
     async writeApprovals(filePath, state) {
-      await mkdir14(path55.dirname(filePath), { recursive: true });
+      await mkdir14(path62.dirname(filePath), { recursive: true });
       await writeFile11(filePath, `${JSON.stringify(compactApprovals(state), null, 2)}
 `, "utf8");
     },
@@ -20548,7 +20739,7 @@ function deriveWorkspaceRootScopeHint(params) {
   if (!targetPath) {
     return void 0;
   }
-  const candidateRoot = canonicalPath(path55.dirname(targetPath));
+  const candidateRoot = canonicalPath(path62.dirname(targetPath));
   const validation = validateTrustedWorkspaceRootCandidate({
     candidatePath: candidateRoot,
     repoRoot: action.repoRoot,
@@ -21124,6 +21315,7 @@ async function gateDecisionToVerdict(ctx, deps, kind, result, auditExtras = {})
     event: auditEvent,
     sourceEvent,
     kind,
+    repoLabel: path62.basename(ctx.repoRoot),
     ...auditExtras.toolInvocationCorrelationId ? { toolInvocationCorrelationId: auditExtras.toolInvocationCorrelationId } : {},
     fingerprint: result.fingerprint,
     summary: result.normalizedCommand ?? result.summary ?? "",
@@ -21571,18 +21763,18 @@ async function appendObservedAudit(ctx, deps, eventName, payload) {
 
 // src/adapters/shared/repo-root.ts
 import { existsSync as existsSync17 } from "node:fs";
-import path56 from "node:path";
+import path63 from "node:path";
 function belayConfigPath(current, adapterName) {
   if (adapterName === "cursor") {
-    return path56.join(current, ".cursor", "belay.config.json");
+    return path63.join(current, ".cursor", "belay.config.json");
   }
   if (adapterName === "claude") {
-    return path56.join(current, ".claude", "belay.config.json");
+    return path63.join(current, ".claude", "belay.config.json");
   }
-  return path56.join(current, ".codex", "belay.config.json");
+  return path63.join(current, ".codex", "belay.config.json");
 }
 function markerMatches(current, marker, layout) {
-  const markerPath = path56.join(current, marker);
+  const markerPath = path63.join(current, marker);
   if (!existsSync17(markerPath)) {
     return false;
   }
@@ -21592,16 +21784,16 @@ function markerMatches(current, marker, layout) {
   return true;
 }
 function findRepoRoot(startPath, layout) {
-  let current = path56.resolve(startPath);
+  let current = path63.resolve(startPath);
   while (true) {
     for (const marker of layout.repoRootMarkers) {
       if (markerMatches(current, marker, layout)) {
         return current;
       }
     }
-    const parent = path56.dirname(current);
+    const parent = path63.dirname(current);
     if (parent === current) {
-      return path56.resolve(startPath);
+      return path63.resolve(startPath);
     }
     current = parent;
   }
@@ -21609,7 +21801,7 @@ function findRepoRoot(startPath, layout) {
 
 // src/adapters/cursor/cwd-resolution.ts
 import os6 from "node:os";
-import path57 from "node:path";
+import path64 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function nonEmptyPathString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
@@ -21621,36 +21813,36 @@ function resolveCursorActionCwdDetails(payload, fallback = process.cwd()) {
   const workspaceRoot = Array.isArray(payload.workspace_roots) ? payload.workspace_roots.map(nonEmptyPathString).find(Boolean) : void 0;
   if (toolInputWorkingDirectory) {
     return {
-      cwd: path57.resolve(toolInputWorkingDirectory),
+      cwd: path64.resolve(toolInputWorkingDirectory),
       source: "tool_input.working_directory",
       fromPayload: true
     };
   }
   if (topLevelCwd) {
     return {
-      cwd: path57.resolve(topLevelCwd),
+      cwd: path64.resolve(topLevelCwd),
       source: "cwd",
       fromPayload: true
     };
   }
   if (workspaceRoot) {
     return {
-      cwd: path57.resolve(workspaceRoot),
+      cwd: path64.resolve(workspaceRoot),
       source: "workspace_roots",
       fromPayload: true
     };
   }
   return {
-    cwd: path57.resolve(fallback),
+    cwd: path64.resolve(fallback),
     source: "fallback",
     fromPayload: false
   };
 }
 function isGlobalCursorHookRuntime() {
   try {
-    const runtimePath = path57.resolve(fileURLToPath2(import.meta.url));
-    const globalRuntimeDir = path57.resolve(path57.join(os6.homedir(), ".cursor", "belay", "runtime"));
-    return runtimePath === globalRuntimeDir || runtimePath.startsWith(`${globalRuntimeDir}${path57.sep}`);
+    const runtimePath = path64.resolve(fileURLToPath2(import.meta.url));
+    const globalRuntimeDir = path64.resolve(path64.join(os6.homedir(), ".cursor", "belay", "runtime"));
+    return runtimePath === globalRuntimeDir || runtimePath.startsWith(`${globalRuntimeDir}${path64.sep}`);
   } catch {
     return false;
   }
@@ -21700,7 +21892,7 @@ function resolveCursorToolActionCwdDetails(payload, fallback, eventName, toolNam
 function collectCandidateRepoRoots(payload, resolution) {
   const roots = [];
   const add = (value) => {
-    const resolved = path58.resolve(value);
+    const resolved = path65.resolve(value);
     if (!roots.includes(resolved)) {
       roots.push(resolved);
     }
@@ -21762,17 +21954,15 @@ function isSubagentEvent(payload, eventName) {
 function isFileMutationTool(toolName) {
   return toolName === "Write" || toolName === "StrReplace" || toolName === "Delete";
 }
-async function runBeforeSubmitPromptHook() {
+async function handleBeforeSubmitPromptHook(payload) {
   try {
-    const payload = await readStdinJson();
     const prompt = String(payload.prompt ?? "");
     const resolution = resolveCursorActionCwdDetails(payload);
     if (isUnsafeGlobalHookFallback(resolution)) {
-      jsonResponse({
+      return {
         continue: false,
         user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE
-      });
-      return;
+      };
     }
     const ctx = await loadRuntimeContext(resolution.cwd);
     const deps = createDefaultGateRuntimeDeps();
@@ -21783,29 +21973,30 @@ async function runBeforeSubmitPromptHook() {
       payload,
       resolution
     );
-    jsonResponse({
+    return {
       continue: result.continue,
       ...result.user_message ? { user_message: result.user_message } : {},
       ...result.replay ? { replay: result.replay } : {}
-    });
+    };
   } catch {
-    jsonResponse({
+    return {
       continue: false,
       user_message: "belay failed while processing approval state. Run belay doctor, then retry."
-    });
+    };
   }
 }
-async function runShellGateHook() {
+async function runBeforeSubmitPromptHook() {
+  jsonResponse(await handleBeforeSubmitPromptHook(await readStdinJson()));
+}
+async function handleShellGateHook(payload) {
   try {
-    const payload = await readStdinJson();
     const command = String(payload.command ?? "").trim();
     const resolution = resolveCursorActionCwdDetails(payload);
     if (isUnsafeGlobalHookFallback(resolution)) {
-      jsonResponse({
+      return {
         permission: "deny",
         user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE
-      });
-      return;
+      };
     }
     const cwd = resolution.cwd;
     const ctx = await loadRuntimeContext(cwd);
@@ -21817,17 +22008,19 @@ async function runShellGateHook() {
       payload,
       sourceEvent: "beforeShellExecution"
     });
-    jsonResponse(gateVerdictToCursorResponse(verdict2));
+    return gateVerdictToCursorResponse(verdict2);
   } catch {
-    jsonResponse({
+    return {
       permission: "deny",
       user_message: "belay failed while classifying this shell command. Run belay doctor, then retry."
-    });
+    };
   }
 }
-async function runToolGateHook(eventName) {
+async function runShellGateHook() {
+  jsonResponse(await handleShellGateHook(await readStdinJson()));
+}
+async function handleToolGateHook(eventName, payload) {
   try {
-    const payload = await readStdinJson();
     const toolName = String(payload.tool_name ?? "");
     const resolution = resolveCursorToolActionCwdDetails(
       payload,
@@ -21836,11 +22029,10 @@ async function runToolGateHook(eventName) {
       toolName
     );
     if (isUnsafeGlobalHookFallback(resolution)) {
-      jsonResponse({
+      return {
         permission: "deny",
         user_message: GLOBAL_HOOK_WORKSPACE_MISSING_MESSAGE
-      });
-      return;
+      };
     }
     const cwd = resolution.cwd;
     const ctx = await loadRuntimeContext(cwd);
@@ -21852,8 +22044,7 @@ async function runToolGateHook(eventName) {
         payload,
         sourceEvent: eventName
       });
-      jsonResponse(gateVerdictToCursorResponse(verdict2));
-      return;
+      return gateVerdictToCursorResponse(verdict2);
     }
     if (toolName === "Shell") {
       const verdict2 = await evaluateGatedAction(ctx, deps, {
@@ -21863,8 +22054,7 @@ async function runToolGateHook(eventName) {
         toolName,
         sourceEvent: eventName
       });
-      jsonResponse(gateVerdictToCursorResponse(verdict2));
-      return;
+      return gateVerdictToCursorResponse(verdict2);
     }
     if (isFileMutationTool(toolName)) {
       const verdict2 = await evaluateGatedAction(ctx, deps, {
@@ -21874,8 +22064,7 @@ async function runToolGateHook(eventName) {
         toolName,
         sourceEvent: eventName
       });
-      jsonResponse(gateVerdictToCursorResponse(verdict2));
-      return;
+      return gateVerdictToCursorResponse(verdict2);
     }
     if (payload.tool_name === "Task") {
       const verdict2 = await evaluateGatedAction(ctx, deps, {
@@ -21884,20 +22073,21 @@ async function runToolGateHook(eventName) {
         payload,
         sourceEvent: eventName
       });
-      jsonResponse(gateVerdictToCursorResponse(verdict2));
-      return;
+      return gateVerdictToCursorResponse(verdict2);
     }
-    jsonResponse({ permission: "allow" });
+    return { permission: "allow" };
   } catch {
-    jsonResponse({
+    return {
       permission: "deny",
       user_message: "belay failed while classifying this tool action. Run belay doctor, then retry."
-    });
+    };
   }
 }
-async function runAuditHook(eventName) {
+async function runToolGateHook(eventName) {
+  jsonResponse(await handleToolGateHook(eventName, await readStdinJson()));
+}
+async function handleAuditHook(eventName, payload) {
   try {
-    const payload = await readStdinJson();
     const toolName = String(payload.tool_name ?? "");
     const resolution = resolveCursorToolActionCwdDetails(
       payload,
@@ -21906,22 +22096,28 @@ async function runAuditHook(eventName) {
       toolName
     );
     if (isUnsafeGlobalHookFallback(resolution)) {
-      jsonResponse({});
-      return;
+      return {};
     }
     const ctx = await loadRuntimeContext(resolution.cwd);
     const deps = createDefaultGateRuntimeDeps();
     await appendObservedAudit(ctx, deps, eventName, payload);
-    jsonResponse({});
+    return {};
   } catch (error) {
     console.error(
       "belay audit hook failed:",
       error instanceof Error ? error.message : String(error)
     );
-    jsonResponse({});
+    return {};
   }
 }
+async function runAuditHook(eventName) {
+  jsonResponse(await handleAuditHook(eventName, await readStdinJson()));
+}
 export {
+  handleAuditHook,
+  handleBeforeSubmitPromptHook,
+  handleShellGateHook,
+  handleToolGateHook,
   resolveCursorActionCwd,
   runAuditHook,
   runBeforeSubmitPromptHook,