@humwick/runner 0.0.0-stage → 0.130.1

package/plugins/claude/hooks/kill-guard.sh

@@ -0,0 +1,341 @@
+#!/usr/bin/env bash
+# Shared "fleet fratricide" kill-pattern guard (issue #753).
+#
+# Every managed agent's runner runs as
+#   bun run .../agent-relay-runner/src/index.ts <provider> ...  (scoped install: .../@humwick/runner/...)
+# so a broad process kill such as `pkill -f "src/index.ts"` (or `pkill bun`,
+# `killall node`, ...) matches EVERY sibling agent host-wide and silently SIGTERMs
+# the whole fleet. This is the structural guard so that can't happen again.
+#
+# It blocks broad process-kill commands (pkill / killall, and `kill` with a
+# pattern that leaks a fleet token) whose target would match sibling runners,
+# while still allowing the safe shapes: PID-scoped kills (kill 12345,
+# kill "$SERVER_PID") and pkill -f on a token that is unique to the caller's own
+# throwaway server (its exact test port, or "$PWD/public").
+#
+# Layers (#3117): when neither the segment matcher below nor a raw kill-verb +
+# fleet-token check fires, the command passes without starting a process.
+# Otherwise kill-guard.ts parses it and answers block (an executed broad kill, e.g.
+# behind sudo or bash -c), static (no dynamic execution, so a kill word in an
+# argument, heredoc or comment is prose and passes), or sink (text reaches a shell,
+# eval, xargs, ...): then the segment matcher decides, so the guard is never weaker
+# than the segment matcher alone. No parser (no bun, or it fails) → the same.
+#
+# DUAL MODE:
+#   - sourced: defines fratricide_deny_reason() / fratricide_raw_reason() plus the
+#     shell-parsing helpers (trim_shell_text / split_segments / shell_words). The
+#     Claude PreToolUse Bash guard sources this and is wired to it.
+#   - executed: `kill-guard.sh "<command text>"` prints the guidance + exits 0 when
+#     the command is a dangerous broad kill, and exits 1 (silent) when it is safe.
+#     This lets non-bash callers reuse the SAME matcher as a subprocess.
+#
+# TODO(#753 follow-up): wire the Codex runner/exec layer to invoke this guard.
+# Codex managed agents have no Claude PreToolUse hook, so the same broad pkill can
+# still fratricide the fleet from a Codex session until that wiring lands. The
+# matcher is intentionally factored here so the Codex side can call it directly
+# (e.g. `bash kill-guard.sh "$command"`) without duplicating the pattern list.
+
+shopt -s extglob
+
+# Parameter expansion, not dirname: the jq-less hook PATH may hold no coreutils.
+case "${BASH_SOURCE[0]}" in */*) KILL_GUARD_PARSER="${BASH_SOURCE[0]%/*}/kill-guard.ts" ;; *) KILL_GUARD_PARSER=kill-guard.ts ;; esac
+
+# Guidance returned on a block — tells the caller how to clean up safely instead.
+FRATRICIDE_KILL_GUIDANCE='Blocked a broad process-kill (#753 fleet-fratricide guard): this pattern would match sibling agents'\'' runners, because every managed agent runs "bun run .../agent-relay-runner/src/index.ts". Kill only a PID you own — capture it when you spawn the server (SERVER_PID=$!; kill "$SERVER_PID") — or pkill -f a token that is unique to your own process (your exact test port, or "$PWD/public"). Never pkill/killall on bun, node, src/index.ts, agent-relay, humwick, or their runner packages.'
+# The segment matcher reads raw text, so it cannot tell a command from prose.
+FRATRICIDE_PATTERN_GUIDANCE="${FRATRICIDE_KILL_GUIDANCE}"' If this command only MENTIONS a kill in prose (an issue body, a commit message, a heredoc), this guard cannot tell: write the text to a file with the Write tool and pass it by file (gh --body-file, git commit -F), or drop the fleet token from the prose.'
+
+trim_shell_text() {
+  local value="$1"
+  value="${value##+([[:space:]])}"
+  value="${value%%+([[:space:]])}"
+  printf '%s' "$value"
+}
+
+split_segments() {
+  local text="$1"
+  local current="" i len ch next quote="" escaped=0
+  SEGMENTS=()
+  len=${#text}
+  for ((i = 0; i < len; i++)); do
+    ch="${text:i:1}"
+    if (( escaped )); then
+      current+="$ch"
+      escaped=0
+      continue
+    fi
+    if [ -n "$quote" ]; then
+      current+="$ch"
+      if [ "$quote" = '"' ] && [ "$ch" = "\\" ]; then
+        escaped=1
+        continue
+      fi
+      if [ "$ch" = "$quote" ]; then
+        quote=""
+      fi
+      continue
+    fi
+
+    case "$ch" in
+      "'"|'"')
+        quote="$ch"
+        current+="$ch"
+        ;;
+      "\\")
+        escaped=1
+        current+="$ch"
+        ;;
+      $'\n'|";")
+        SEGMENTS+=("$current")
+        current=""
+        ;;
+      "&")
+        next="${text:i+1:1}"
+        if [ "$next" = "&" ]; then
+          ((i += 1))
+        fi
+        SEGMENTS+=("$current")
+        current=""
+        ;;
+      "|")
+        next="${text:i+1:1}"
+        if [ "$next" = "|" ]; then
+          ((i += 1))
+        fi
+        SEGMENTS+=("$current")
+        current=""
+        ;;
+      *)
+        current+="$ch"
+        ;;
+    esac
+  done
+
+  if [ -n "$quote" ] || (( escaped )); then
+    return 1
+  fi
+  SEGMENTS+=("$current")
+  return 0
+}
+
+shell_words() {
+  local text="$1"
+  local word="" i len ch quote="" escaped=0 in_word=0
+  WORDS=()
+  len=${#text}
+  for ((i = 0; i < len; i++)); do
+    ch="${text:i:1}"
+    if (( escaped )); then
+      word+="$ch"
+      in_word=1
+      escaped=0
+      continue
+    fi
+    if [ -n "$quote" ]; then
+      if [ "$quote" = '"' ] && [ "$ch" = "\\" ]; then
+        escaped=1
+        continue
+      fi
+      if [ "$ch" = "$quote" ]; then
+        quote=""
+      else
+        word+="$ch"
+      fi
+      in_word=1
+      continue
+    fi
+
+    case "$ch" in
+      [[:space:]])
+        if (( in_word )); then
+          WORDS+=("$word")
+          word=""
+          in_word=0
+        fi
+        ;;
+      "'"|'"')
+        quote="$ch"
+        in_word=1
+        ;;
+      "\\")
+        escaped=1
+        in_word=1
+        ;;
+      *)
+        word+="$ch"
+        in_word=1
+        ;;
+    esac
+  done
+
+  if [ -n "$quote" ] || (( escaped )); then
+    return 1
+  fi
+  if (( in_word )); then
+    WORDS+=("$word")
+  fi
+  return 0
+}
+
+# True (0) when text mentions a process-kill verb (pkill / killall / kill).
+_looks_like_kill() {
+  if [[ "${1,,}" =~ (^|[^a-z])(pkill|killall|kill)([^a-z]|$) ]]; then
+    return 0
+  fi
+  return 1
+}
+
+# True (0) when a kill pattern/token would match sibling runners across the fleet.
+# Matches the runner path tokens, and the bare interpreter process names bun/node
+# even when wrapped in pgrep/regex metacharacters such as [b]un, ^node$, bun.* .
+_pattern_hits_fleet() {
+  local lower="${1,,}"
+  case "$lower" in
+    *index.ts*|*agent-relay*|*humwick*)
+      return 0
+      ;;
+  esac
+  if [[ "$lower" =~ (^|[^a-z0-9])(bun|node)([^a-z0-9]|$) ]]; then
+    return 0
+  fi
+  local cleaned="$lower" mc
+  for mc in '[' ']' '(' ')' '{' '}' '^' '$' '*' '+' '?' '\' '|'; do
+    cleaned="${cleaned//"$mc"/}"
+  done
+  if [[ "$cleaned" =~ (^|[^a-z0-9])(bun|node)([^a-z0-9]|$) ]]; then
+    return 0
+  fi
+  return 1
+}
+
+# Inspect one shell segment. Prints guidance + returns 0 when it is a dangerous
+# broad kill; returns 1 when the segment is safe or not a kill.
+_fratricide_segment_reason() {
+  local raw="$1" segment base i=0 j arg
+  segment="$(trim_shell_text "$raw")"
+  if [ -z "$segment" ]; then
+    return 1
+  fi
+  if ! shell_words "$segment"; then
+    # Unparseable — only worry if it both looks like a kill and leaks a fleet token.
+    if _looks_like_kill "$segment" && _pattern_hits_fleet "$segment"; then
+      printf '%s' "$FRATRICIDE_PATTERN_GUIDANCE"
+      return 0
+    fi
+    return 1
+  fi
+  if (( ${#WORDS[@]} == 0 )); then
+    return 1
+  fi
+
+  # Skip any leading VAR=value assignments (e.g. SERVER_PID=$!; kill ...).
+  while (( i < ${#WORDS[@]} )) && [[ "${WORDS[i]}" =~ ^[A-Za-z_][A-Za-z0-9_]*= ]]; do
+    ((i += 1))
+  done
+  if (( i >= ${#WORDS[@]} )); then
+    return 1
+  fi
+
+  base="${WORDS[i]##*/}"
+  base="${base,,}"
+  case "$base" in
+    pkill|killall)
+      # Pattern-matching kills: block if ANY non-flag operand hits the fleet.
+      j=$((i + 1))
+      while (( j < ${#WORDS[@]} )); do
+        arg="${WORDS[j]}"
+        if [[ "$arg" == -* ]]; then
+          ((j += 1))
+          continue
+        fi
+        if _pattern_hits_fleet "$arg"; then
+          printf '%s' "$FRATRICIDE_PATTERN_GUIDANCE"
+          return 0
+        fi
+        ((j += 1))
+      done
+      return 1
+      ;;
+    kill)
+      # PID-scoped kills (kill 123, kill "$PID", kill -9 %1) are safe. Block only
+      # when an operand leaks a fleet token — e.g. kill $(pgrep -f src/index.ts).
+      j=$((i + 1))
+      while (( j < ${#WORDS[@]} )); do
+        arg="${WORDS[j]}"
+        if _pattern_hits_fleet "$arg"; then
+          printf '%s' "$FRATRICIDE_PATTERN_GUIDANCE"
+          return 0
+        fi
+        ((j += 1))
+      done
+      return 1
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+# Segment matcher: split a full command into segments and check each one.
+# Prints guidance + returns 0 on the first dangerous broad kill; returns 1 if safe.
+_fratricide_segment_matcher_reason() {
+  local text="$1" segment reason
+  if ! split_segments "$text"; then
+    fratricide_raw_reason "$text"
+    return $?
+  fi
+  local -a segments=("${SEGMENTS[@]}")
+  for segment in "${segments[@]}"; do
+    if reason="$(_fratricide_segment_reason "$segment")"; then
+      printf '%s' "$reason"
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Parser-backed matcher. Prints guidance + returns 0 when the command is a broad
+# fleet kill; returns 1 if safe.
+fratricide_deny_reason() {
+  local text="$1" verdict segment_reason="" segment_blocks=0
+  if segment_reason="$(_fratricide_segment_matcher_reason "$text")"; then
+    segment_blocks=1
+  fi
+  if (( ! segment_blocks )) && ! { _looks_like_kill "$text" && _pattern_hits_fleet "$text"; }; then
+    return 1
+  fi
+  if command -v bun >/dev/null 2>&1 && verdict="$(printf '%s' "$text" | bun "$KILL_GUARD_PARSER" 2>/dev/null)"; then
+    case "$verdict" in
+      block:*)
+        printf '%s Blocked command: %s' "$FRATRICIDE_KILL_GUIDANCE" "${verdict#block:}"
+        return 0
+        ;;
+      static)
+        return 1
+        ;;
+    esac
+  fi
+  (( segment_blocks )) || return 1
+  printf '%s' "$segment_reason"
+}
+
+# Coarse raw-text fallback for when structured parsing is unavailable (no jq, or
+# unparseable shell). Prints guidance + returns 0 only when the text both looks
+# like a kill and leaks a fleet token.
+fratricide_raw_reason() {
+  local text="$1"
+  if _looks_like_kill "$text" && _pattern_hits_fleet "$text"; then
+    printf '%s' "$FRATRICIDE_PATTERN_GUIDANCE"
+    return 0
+  fi
+  return 1
+}
+
+# Executed directly (not sourced): argv[1] is the command text to inspect.
+if [ "${BASH_SOURCE[0]}" = "${0}" ]; then
+  if reason="$(fratricide_deny_reason "${1:-}")"; then
+    printf '%s\n' "$reason"
+    exit 0
+  fi
+  exit 1
+fi

package/plugins/claude/hooks/kill-guard.ts

@@ -0,0 +1,337 @@
+// Fleet-fratricide parser (#753, #3117). stdin: command text. stdout: `block:<command>` for an executed
+// broad kill, `static` when nothing in the command executes text (so a kill word in an argument, heredoc
+// or comment is prose), or `sink` when text may reach a dynamic executor and kill-guard.sh's segment
+// matcher must decide. A non-zero exit means "parser unavailable". Bundled to kill-guard.provisioned.mjs.
+import { forEachChild, parse, type Command, type Pipeline, type Redirection, type SyntaxNode, type Word } from "unbash";
+
+// Past this depth of `bash -c` / `eval` nesting the parser gives up and reports a sink.
+const MAX_DEPTH = 8;
+const MAX_HIT_CHARS = 200;
+const KILL_VERBS = new Set(["pkill", "killall", "kill"]);
+const SHELLS = new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+// Commands that run text they are given (their own args, a file or stdin) in ways the walker does not follow.
+const DYNAMIC = new Set(["eval", "source", ".", "trap", "python", "python2", "python3", "perl", "ruby", "node", "bun", "deno", "php", "lua", "osascript"]);
+// Readers with no option that executes anything: stdin stays data whatever their arguments.
+const PLAIN_READERS = new Set(["cat", "tee", "head", "tail", "wc", "tr", "cut", "nl", "rev", "tac", "fold", "base64", "od", "md5sum", "sha256sum", "grep", "egrep", "fgrep", "jq", "echo", "printf", "true"]);
+// Tools that take a message body on stdin, only in these exact subcommand forms. Anything else
+// (`git -c alias.x='!sh' x`, a gh alias or extension) may run the text.
+const GIT_BODY_COMMANDS = new Set(["commit", "tag", "notes"]);
+const GH_BODY_COMMANDS = new Set(["issue create", "issue comment", "issue edit", "pr create", "pr comment", "pr edit", "pr review", "release create", "release edit", "gist create"]);
+const RELAY_BODY_COMMANDS = new Set(["message", "/message", "reply", "/reply", "pair", "/pair"]);
+const STDIN_PATHS = new Set(["/dev/stdin", "/dev/fd/0", "/proc/self/fd/0"]);
+// Builtins that change what a later command name runs.
+const REDEFINERS = new Set(["alias", "shopt", "enable", "hash"]);
+const ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+
+/** How a wrapper's own options look: `valued` options take the next word unless attached
+ *  (`-uroot`, `--user=root`); `nonExec` options mean the wrapped command never runs. */
+interface WrapperSpec {
+  valued?: string[];
+  /** Options whose value is itself a command line (`env -S 'cmd'`, `su -c 'cmd'`). */
+  script?: string[];
+  nonExec?: string[];
+  assignments?: boolean;
+  positionals?: number;
+  /** The wrapped words are joined and run by a shell (`ssh host cmd`, `watch cmd`). */
+  joinsRest?: boolean;
+  /** Options may follow operands (`su root -c cmd`). */
+  permute?: boolean;
+  /** Any use is a dynamic-execution sink, even when the walker also follows the command. */
+  sink?: boolean;
+}
+
+const WRAPPERS: Record<string, WrapperSpec> = {
+  sudo: {
+    valued: ["u", "g", "h", "p", "C", "D", "r", "t", "T", "U", "--user", "--group", "--host", "--prompt", "--close-from", "--chdir", "--role", "--type", "--command-timeout", "--other-user"],
+    assignments: true,
+  },
+  doas: { valued: ["u", "C"] },
+  su: { script: ["c", "--command"], valued: ["s", "g", "G", "w", "--shell", "--group", "--supp-group", "--whitelist-environment"], permute: true, sink: true },
+  env: { script: ["S", "--split-string"], valued: ["u", "C", "--unset", "--chdir"], assignments: true },
+  xargs: { valued: ["a", "d", "E", "I", "L", "n", "P", "s", "--arg-file", "--delimiter", "--max-args", "--max-procs", "--max-chars", "--process-slot-var"], sink: true },
+  timeout: { valued: ["s", "k", "--signal", "--kill-after"], positionals: 1 },
+  nice: { valued: ["n", "--adjustment"] },
+  ionice: { valued: ["c", "n", "--class", "--classdata"] },
+  stdbuf: { valued: ["i", "o", "e", "--input", "--output", "--error"] },
+  time: { valued: ["f", "o", "--format", "--output"] },
+  exec: { valued: ["a"], sink: true },
+  command: { nonExec: ["v", "V"] },
+  nohup: {},
+  setsid: {},
+  builtin: {},
+  watch: { valued: ["n", "--interval"], joinsRest: true, sink: true },
+  ssh: { valued: [..."BbcDEeFIiJLlmOoPpQRSWw"], positionals: 1, joinsRest: true, sink: true },
+};
+
+/** Per-call walk state: the whole command, and whether any sink was seen. */
+interface Walk {
+  source: string;
+  sink: boolean;
+}
+
+interface Context {
+  depth: number;
+  /** stdin carries data from a heredoc, here-string or an earlier pipeline stage. */
+  stdinData?: boolean;
+  /** That data when it is literal (a heredoc, here-string, or `echo`/`cat <<EOF` piped in). */
+  stdinText?: string;
+  /** Arguments are read from stdin (`xargs kill`), so the kill targets are not in its words. */
+  xargsInput?: boolean;
+}
+
+const baseName = (word: string): string => word.slice(word.lastIndexOf("/") + 1);
+
+/** True when `words` provably reads stdin as data: a known command in a known form, no other path. */
+function readsAsData(words: string[]): boolean {
+  const command = words[0]!;
+  if (command.includes("/") && !/^\/(usr\/)?bin\/[^/]+$/.test(command)) return false;
+  const name = baseName(command);
+  if (PLAIN_READERS.has(name)) return true;
+  if (name === "git") return GIT_BODY_COMMANDS.has(words[1] ?? "");
+  if (name === "gh") return GH_BODY_COMMANDS.has(`${words[1]} ${words[2]}`);
+  return (name === "agent-relay" || name === "humwick") && RELAY_BODY_COMMANDS.has(words[1] ?? "");
+}
+// Values keep expansions verbatim (`$X`, `$(cmd)`), so a `$` or backtick means the word is not static.
+const isDynamicWord = (value: string): boolean => /[$`]/.test(value);
+
+// Keep in sync with _pattern_hits_fleet in kill-guard.sh. True when a kill pattern would match
+// sibling runners: the runner path tokens, or bare bun/node even inside regex metacharacters.
+export function hitsFleet(text: string): boolean {
+  const lower = text.toLowerCase();
+  if (lower.includes("index.ts") || lower.includes("agent-relay") || lower.includes("humwick")) return true;
+  const fleetToken = /(^|[^a-z0-9])(bun|node)([^a-z0-9]|$)/;
+  return fleetToken.test(lower) || fleetToken.test(lower.replace(/[[\](){}^$*+?\\|]/g, ""));
+}
+
+type Option = { kind: "skip"; next: number } | { kind: "script"; value: string; next: number } | { kind: "nonExec" };
+
+/** Reads the wrapper option at `words[i]`, or returns undefined when it is not an option. */
+function readOption(words: string[], i: number, spec: WrapperSpec): Option | undefined {
+  const word = words[i]!;
+  const valueOf = (name: string, attached: string | undefined): Option => {
+    if (spec.nonExec?.includes(name)) return { kind: "nonExec" };
+    const takesValue = spec.script?.includes(name) || spec.valued?.includes(name);
+    if (!takesValue) return { kind: "skip", next: i + 1 };
+    const next = attached === undefined ? i + 2 : i + 1;
+    const value = attached ?? words[i + 1];
+    return spec.script?.includes(name) && value !== undefined ? { kind: "script", value, next } : { kind: "skip", next };
+  };
+  if (word.startsWith("--") && word.length > 2) {
+    const eq = word.indexOf("=");
+    return eq < 0 ? valueOf(word, undefined) : valueOf(word.slice(0, eq), word.slice(eq + 1));
+  }
+  if (word.length < 2 || !word.startsWith("-")) return undefined;
+  // A cluster (`-iS'cmd'`, `-uroot`): the first option taking a value takes the rest of the word.
+  for (let k = 1; k < word.length; k += 1) {
+    const letter = word[k]!;
+    if (spec.nonExec?.includes(letter)) return { kind: "nonExec" };
+    if (spec.script?.includes(letter) || spec.valued?.includes(letter)) return valueOf(letter, k + 1 < word.length ? word.slice(k + 1) : undefined);
+  }
+  return { kind: "skip", next: i + 1 };
+}
+
+type Handoff = { next: number } | { script: string } | { none: "nonExec" | "stdin" };
+
+/** Where a wrapper hands off: the wrapped command word, a command line it runs through a shell,
+ *  or nothing (a lookup like `command -v`, or an interactive shell reading stdin). */
+function scanWrapper(words: string[], start: number, spec: WrapperSpec): Handoff {
+  let i = start + 1;
+  while (i < words.length) {
+    const word = words[i]!;
+    if (word === "--") {
+      i += 1;
+      break;
+    }
+    const option = readOption(words, i, spec);
+    if (option?.kind === "nonExec") return { none: "nonExec" };
+    if (option?.kind === "script") return { script: [option.value, ...words.slice(option.next)].join(" ") };
+    if (option) {
+      i = option.next;
+      continue;
+    }
+    if (!(spec.permute || (spec.assignments && ASSIGNMENT.test(word)))) break;
+    i += 1;
+  }
+  if (spec.permute) return { none: "stdin" };
+  const next = i + (spec.positionals ?? 0);
+  if (!spec.joinsRest) return { next };
+  return next < words.length ? { script: words.slice(next).join(" ") } : { none: "stdin" };
+}
+
+/** A shell's `-c` command line, or undefined when it reads a script from stdin (`-s`) or a file. */
+function shellCommand(words: string[]): string | undefined {
+  let i = 1;
+  let command = false;
+  for (; i < words.length; i += 1) {
+    const word = words[i]!;
+    if (word === "--" || word === "-") {
+      i += 1;
+      break;
+    }
+    if (word.startsWith("--")) {
+      if (word === "--rcfile" || word === "--init-file") i += 1;
+      continue;
+    }
+    if (word.length > 1 && (word.startsWith("-") || word.startsWith("+"))) {
+      const letters = word.slice(1);
+      if (letters.includes("c")) command = true;
+      if (/[oO]/.test(letters)) i += 1;
+      continue;
+    }
+    break;
+  }
+  return command ? (words[i] ?? "") : undefined;
+}
+
+function checkKill(verb: string, words: string[], ctx: Context, walk: Walk): boolean {
+  const operands = verb === "kill" ? words.slice(1) : words.slice(1).filter((word) => !word.startsWith("-"));
+  // `xargs kill` takes its targets from stdin, which the walker does not trace: any fleet token decides.
+  return operands.some(hitsFleet) || (ctx.xargsInput === true && hitsFleet(walk.source));
+}
+
+/** A shell reading its script from stdin: a sink, and when the script is literal, parsed too. */
+function checkStdinShell(ctx: Context, walk: Walk): boolean {
+  walk.sink = true;
+  return ctx.stdinText !== undefined && checkScript(ctx.stdinText, { depth: ctx.depth }, walk);
+}
+
+function checkArgv(words: string[], ctx: Context, walk: Walk): boolean {
+  let i = 0;
+  let xargsInput = ctx.xargsInput;
+  while (i < words.length) {
+    const base = baseName(words[i]!);
+    const spec = WRAPPERS[base];
+    if (!spec) break;
+    if (spec.sink) walk.sink = true;
+    if (base === "xargs") xargsInput = true;
+    const handoff = scanWrapper(words, i, spec);
+    if ("none" in handoff) return handoff.none === "stdin" && checkStdinShell(ctx, walk);
+    if ("script" in handoff) {
+      walk.sink = true;
+      return checkScript(handoff.script, { ...ctx, xargsInput }, walk);
+    }
+    i = handoff.next;
+  }
+  if (i >= words.length) {
+    // `echo cmd | sudo -s`: a wrapper with no command starts a shell reading stdin.
+    return ctx.stdinData === true && i > 0 && checkStdinShell(ctx, walk);
+  }
+  const rest = words.slice(i);
+  const verb = baseName(rest[0]!);
+  if (isDynamicWord(rest[0]!) || DYNAMIC.has(verb) || REDEFINERS.has(verb)) walk.sink = true;
+  // `env PATH=/tmp/x cat`: a changed PATH means a known name may run something else.
+  if (words.slice(0, i).some((word) => word.startsWith("PATH="))) walk.sink = true;
+  if (KILL_VERBS.has(verb)) return checkKill(verb, rest, { ...ctx, xargsInput }, walk);
+  if (verb === "eval") return checkScript(rest.slice(1).join(" "), { ...ctx, xargsInput }, walk);
+  // `trap 'cmd' EXIT` runs its first operand as a command line.
+  if (verb === "trap") return rest.length > 2 && !rest[1]!.startsWith("-") && checkScript(rest[1]!, ctx, walk);
+  if ((verb === "source" || verb === ".") && STDIN_PATHS.has(rest[1] ?? "")) return checkStdinShell(ctx, walk);
+  if (SHELLS.has(verb)) {
+    const command = shellCommand(rest);
+    return command === undefined ? checkStdinShell(ctx, walk) : checkScript(command, { ...ctx, xargsInput }, walk);
+  }
+  if (ctx.stdinData && !readsAsData(rest)) walk.sink = true;
+  return false;
+}
+
+function checkCommand(command: Command, ctx: Context, walk: Walk): boolean {
+  const words = [command.name, ...command.args]
+    .filter((arg): arg is Word => arg?.type === "Word")
+    .map((word) => word.value);
+  const hereText = hereTextOf(command.redirects);
+  const stdin = hereText === undefined ? {} : { stdinData: true, stdinText: hereText };
+  return checkArgv(words, { ...ctx, ...stdin }, walk);
+}
+
+/** The literal text a heredoc or here-string among `redirects` feeds to stdin, if any. */
+function hereTextOf(redirects: readonly Redirection[]): string | undefined {
+  let text: string | undefined;
+  for (const redirect of redirects) {
+    if (redirect.type === "HereString") text = redirect.target?.value;
+    else if (redirect.type === "HereDoc") text = redirect.body.text;
+  }
+  return text;
+}
+
+/** What a pipeline stage writes when that is literal: `echo words`, `printf` lines or `cat <<EOF`. */
+function literalOutput(stage: SyntaxNode): string | undefined {
+  if (stage.type !== "Command") return undefined;
+  const words = stage.args.filter((arg): arg is Word => arg.type === "Word").map((word) => word.value);
+  const name = stage.name?.value;
+  if (name === "echo") return words.filter((word) => !/^-[neE]+$/.test(word)).join(" ");
+  // Each printf argument as its own line approximates `printf '%s\n' a b`; a lone format is printed.
+  if (name === "printf") return words.length > 1 ? words.slice(1).join("\n") : words[0]?.replace(/\\n/g, "\n");
+  return name === "cat" && words.length === 0 ? hereTextOf(stage.redirects) : undefined;
+}
+
+function pipelineHit(pipeline: Pipeline, ctx: Context, walk: Walk): boolean {
+  return pipeline.commands.some((stage, index) => {
+    if (index === 0) return nodeHit(stage, ctx, walk);
+    // Only a simple command can be a proven data reader; a grouped stage is a sink.
+    if (stage.type !== "Command") walk.sink = true;
+    return nodeHit(stage, { ...ctx, stdinData: true, stdinText: literalOutput(pipeline.commands[index - 1]!) }, walk);
+  });
+}
+
+function childHit(node: SyntaxNode, ctx: Context, walk: Walk): boolean {
+  let hit = false;
+  forEachChild(node, (child) => {
+    if (!hit) hit = nodeHit(child, ctx, walk);
+  });
+  return hit;
+}
+
+function nodeHit(node: SyntaxNode, ctx: Context, walk: Walk): boolean {
+  switch (node.type) {
+    case "Script":
+      if ("errors" in node && (node as { errors?: unknown[] }).errors?.length) walk.sink = true;
+      break;
+    case "Pipeline":
+      return pipelineHit(node, ctx, walk);
+    case "Command":
+      if (checkCommand(node, ctx, walk)) return true;
+      return childHit(node, { depth: ctx.depth }, walk);
+    case "Function":
+      // A function can shadow any command name, including a data reader.
+      walk.sink = true;
+      break;
+    case "Assignment":
+      if (node.name === "PATH") walk.sink = true;
+      break;
+    case "Redirected": {
+      // Every command in `{ sh; } <<< text` shares that stdin.
+      const hereText = hereTextOf(node.redirects);
+      if (hereText === undefined) break;
+      walk.sink = true;
+      return childHit(node, { ...ctx, stdinData: true, stdinText: hereText }, walk);
+    }
+    case "ProcessSubstitution":
+      walk.sink = true;
+      break;
+  }
+  return childHit(node, ctx, walk);
+}
+
+function checkScript(source: string, ctx: Context, walk: Walk): boolean {
+  if (ctx.depth >= MAX_DEPTH) {
+    walk.sink = true;
+    return false;
+  }
+  return nodeHit(parse(source), { ...ctx, depth: ctx.depth + 1 }, walk);
+}
+
+export type KillGuardVerdict = { kind: "block"; command: string } | { kind: "static" } | { kind: "sink" };
+
+export function fleetKillVerdict(command: string): KillGuardVerdict {
+  const walk: Walk = { source: command, sink: false };
+  const script = parse(command);
+  if (script.errors?.length) walk.sink = true;
+  const statement = script.commands.find((candidate) => nodeHit(candidate, { depth: 0 }, walk));
+  if (statement) return { kind: "block", command: command.slice(statement.pos, statement.end).slice(0, MAX_HIT_CHARS) };
+  return walk.sink ? { kind: "sink" } : { kind: "static" };
+}
+
+if (import.meta.main) {
+  const verdict = fleetKillVerdict(await Bun.stdin.text());
+  process.stdout.write(verdict.kind === "block" ? `block:${verdict.command}` : verdict.kind);
+}