@itc-steve/pi-ask-complete 0.2.0 → 1.0.0

package/src/base-command.ts

@@ -1,287 +0,0 @@
-/**
- * Extract the base command name used for permanent whitelist entries.
- *
- * Examples:
- *   grep -f "Hi"           → grep
- *   /usr/bin/grep foo      → grep
- *   sudo apt install x     → apt
- *   FOO=1 BAR=2 ls -la     → ls
- *   env FOO=1 npm test     → npm
- *   strace -f rm -rf x     → rm
- */
-
-/** True when the command is invoked via sudo/doas (bash should use sudo_run instead). */
-export function isSudoPrefixed(command: string): boolean {
-  const s = command.trim();
-  if (!s) return false;
-  // sudo / doas, optional long flags before the real command
-  return /^(sudo|doas)(\s|$)/i.test(s);
-}
-
-/** Strip a leading sudo/doas (+ common flags) so rules match the real binary. */
-export function stripSudoPrefix(command: string): string {
-  let s = command.trim();
-  // sudo -n -u root pacman … → pacman …
-  s = s.replace(/^(sudo|doas)(\s+(-[A-Za-z]+|--\S+))*(?=\s|$)/i, "").trim();
-  return s;
-}
-
-/**
- * Exec wrappers whose own allow must never stand for the inner binary.
- * Keep in sync with stripWrappers.
- */
-const WRAPPERS = new Set([
-  "command",
-  "builtin",
-  "time",
-  "nohup",
-  "nice",
-  "env",
-  "strace",
-  "ltrace",
-  "timeout",
-  "xargs",
-  "stdbuf",
-  "setsid",
-  "chroot",
-  "unshare",
-]);
-
-/** Long opts that take a separate argument for the wrappers above. */
-const WRAPPER_LONG_VALUE = new Set([
-  "user",
-  "unset",
-  "chdir",
-  "split-string",
-  "arg-file",
-  "delimiter",
-  "replace",
-  "signal",
-  "kill-after",
-  "max-procs",
-  "max-args",
-  "max-chars",
-]);
-
-/** Short opts that take a separate argument (`-u NAME`, `-e EXPR`, …). */
-const WRAPPER_SHORT_VALUE = new Set([
-  "u",
-  "e",
-  "p",
-  "s",
-  "k",
-  "n",
-  "C",
-  "I",
-  "E",
-  "L",
-  "P",
-  "S",
-  "o", // stdbuf -o MODE
-]);
-
-/** Drop leading wrapper flags (`-f`, `-i`, `-u NAME`, `--flag`, timeout duration). */
-function skipWrapperFlags(rest: string): string {
-  for (let n = 0; n < 24 && rest; n++) {
-    if (rest === "--") return "";
-    if (rest.startsWith("-- ")) return rest.slice(3).trim();
-
-    if (rest.startsWith("--")) {
-      const m = rest.match(/^--([^=\s]+)(?:=(\S+))?(?:\s+|$)([\s\S]*)/);
-      if (!m) break;
-      rest = (m[3] ?? "").trim();
-      // --user NAME (value not glued with =)
-      if (m[2] === undefined && WRAPPER_LONG_VALUE.has(m[1]!) && rest && !rest.startsWith("-")) {
-        rest = rest.replace(/^\S+\s*/, "").trim();
-      }
-      continue;
-    }
-
-    if (rest[0] === "-" && rest[1] && rest[1] !== "-") {
-      // -f / -i / -u NAME / -e=expr
-      const m = rest.match(/^-([A-Za-z0-9]+)(?:=(\S+))?(?:\s+|$)([\s\S]*)/);
-      if (!m) break;
-      const flags = m[1]!;
-      rest = (m[3] ?? "").trim();
-      if (m[2] !== undefined) continue; // -e=expr already consumed
-      // single short opt that takes a value: -u NAME
-      if (
-        flags.length === 1 &&
-        WRAPPER_SHORT_VALUE.has(flags) &&
-        rest &&
-        !rest.startsWith("-")
-      ) {
-        rest = rest.replace(/^\S+\s*/, "").trim();
-      }
-      continue;
-    }
-
-    // timeout duration: 5 / 5s / 1m
-    if (/^\d/.test(rest)) {
-      rest = rest.replace(/^\S+\s*/, "").trim();
-      continue;
-    }
-    break;
-  }
-  return rest;
-}
-
-/**
- * True when command starts with a wrapper that has trailing tokens.
- * Combined with stripWrappers() === "", means the inner binary is unresolvable.
- */
-export function wrapperHasArgs(command: string): boolean {
-  let s = command.trim();
-  s = s.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s+)+/, "").trim();
-  if (!s) return false;
-  const m = s.match(/^(\S+)(?:\s+(\S+))?/);
-  if (!m?.[2]) return false;
-  const tok = m[1]!.replace(/^['"]|['"]$/g, "");
-  const bin = (tok.split(/[/\\]/).pop() ?? tok).toLowerCase();
-  return WRAPPERS.has(bin);
-}
-
-/**
- * Peel leading ENV=value assignments + exec wrappers (env/strace/timeout/…).
- * Returns the inner command, or "" when only a bare wrapper remains.
- * Callers must treat "" + a wrapper prefix as unresolvable (ask, never allow).
- */
-export function stripWrappers(command: string): string {
-  let s = command.trim();
-  if (!s) return "";
-
-  for (let i = 0; i < 8; i++) {
-    // FOO=1 BAR=2 cmd → cmd
-    s = s
-      .replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=(?:"[^"]*"|'[^']*'|\S*)\s+)+/, "")
-      .trim();
-    if (!s) return "";
-
-    const m = s.match(/^(\S+)(?:\s+([\s\S]*))?$/);
-    if (!m) return s;
-    const tok = m[1]!.replace(/^['"]|['"]$/g, "");
-    const bin = (tok.split(/[/\\]/).pop() ?? tok).toLowerCase();
-    if (!WRAPPERS.has(bin)) return s; // real binary — stop
-
-    const rest = skipWrapperFlags((m[2] ?? "").trim());
-    if (!rest) return ""; // bare wrapper / flags only
-    s = rest;
-  }
-  return s.trim();
-}
-
-export function baseCommand(command: string): string {
-  let s = stripSudoPrefix(command.trim());
-  if (!s) return "";
-
-  // Resolve through wrappers so `strace -f rm` → rm (not strace).
-  // Bare `env` peels to "" — fall back so the wrapper name itself is the base.
-  s = stripWrappers(s) || s;
-
-  // If the user wrote a pipeline/list, whitelist against the first segment.
-  const first = s.split(/[|;&\n]/)[0]?.trim() ?? s;
-  const token = first.split(/\s+/)[0] ?? "";
-  if (!token) return "";
-
-  // Drop surrounding quotes and path prefix.
-  const unquoted = token.replace(/^['"]|['"]$/g, "");
-  const base = unquoted.split(/[/\\]/).pop() ?? unquoted;
-  return base;
-}
-
-/** Keywords / non-binaries that must never become permanent allow keys. */
-const BLOCKED_BASH_KEYS = new Set([
-  // shell grammar
-  "if",
-  "then",
-  "else",
-  "elif",
-  "fi",
-  "for",
-  "while",
-  "until",
-  "do",
-  "done",
-  "case",
-  "esac",
-  "function",
-  "select",
-  "coproc",
-  "in",
-  // common leaks from node/python heredoc bodies
-  "const",
-  "let",
-  "var",
-  "return",
-  "class",
-  "import",
-  "from",
-  "def",
-]);
-
-/**
- * True when a bash allow key is safe to write to permission.json.
- * Permanent allow only stores simple binary names (python3, mkfs.ext4) — never
- * prose fragments, JS lines, or shell keywords that leaked from bad splits.
- */
-export function isPersistableBashKey(key: string): boolean {
-  if (!key || key.length > 64) return false;
-  if (BLOCKED_BASH_KEYS.has(key)) return false;
-  // Simple binary: rg, python3, docker-compose
-  if (/^[A-Za-z_][A-Za-z0-9_+-]*$/.test(key)) return true;
-  // Dotted binaries only for known families (mkfs.ext4, python3.12) — not console.log
-  if (/^(mkfs|fsck|python|pip|node)[0-9]*\.[A-Za-z0-9_+-]+$/.test(key)) return true;
-  return false;
-}
-
-/** True when `command` is covered by a whitelist entry (base name or exact). */
-export function commandMatchesWhitelist(
-  command: string,
-  allowed: ReadonlySet<string> | readonly string[],
-): boolean {
-  const set = allowed instanceof Set ? allowed : new Set(allowed);
-  if (set.size === 0) return false;
-  const full = command.trim();
-  if (set.has(full)) return true;
-  const base = baseCommand(command);
-  return base !== "" && set.has(base);
-}
-
-/**
- * Strip noise so rule patterns match the logical command.
- * Today: git globals (`-C`, `-c`, `--git-dir`, …) so `git status*` matches
- * `git -C /path status`.
- *
- * ponytail: regex strip of known globals; quoted paths with spaces not handled.
- */
-export function normalizeCommandForMatch(command: string): string {
-  const trimmed = command.trim();
-  if (!trimmed) return trimmed;
-
-  // First token's basename is `git` (covers git, /usr/bin/git, ./git).
-  // Always rewrite to bare `git` so patterns like `git status*` match.
-  const tok = trimmed.match(/^\S+/);
-  if (!tok) return trimmed;
-  const bin = (tok[0]!.split(/[/\\]/).pop() ?? tok[0]!).replace(/^['"]|['"]$/g, "");
-  if (!/^git$/i.test(bin)) return trimmed;
-
-  let rest = trimmed.slice(tok[0]!.length).replace(/^\s+/, "");
-
-  // Repeatedly peel one global option from the front until the subcommand.
-  // Options that take a value: -C path, -c key=val, --git-dir[=]path, …
-  const withVal =
-    /^(?:-C|--git-dir|--work-tree|--namespace|--config-env|--exec-path)(?:=|\s+)\S+\s*/;
-  const shortC = /^-c\s+\S+\s*/;
-  const flagOnly =
-    /^(?:-p|--paginate|-P|--no-pager|--bare|--no-replace-objects|--no-optional-locks|--literal-pathspecs|--glob-pathspecs|--noglob-pathspecs|--icase-pathspecs)\s+/;
-
-  for (let i = 0; i < 16; i++) {
-    let next = rest.replace(withVal, "").replace(shortC, "").replace(flagOnly, "");
-    // --exec-path with no value (prints path; rare in agent cmds)
-    next = next.replace(/^--exec-path\s+/, "");
-    if (next === rest) break;
-    rest = next;
-  }
-
-  return rest ? `git ${rest}`.trim() : "git";
-}

package/src/bash-scan.ts

@@ -1,402 +0,0 @@
-/**
- * Heuristic bash decomposition for the permission gate.
- *
- * Two jobs:
- *  - splitUnits: break a command line into individual command "units" so a rule
- *    lookup can require EVERY unit to be allowed (closes `ls; rm -rf x` bypass).
- *    Units include segments split on ; | && || & \n AND the contents of
- *    command substitution `$(...)` / backticks (closes `echo $(rm x)`).
- *  - pathArgs: pull path-like arguments (incl. redirect targets) out of a
- *    command so they can be checked against path deny rules
- *    (closes `cat .env` / `echo x > .env`).
- *
- * ponytail: regex heuristic, not a real shell parser. Misses full $VAR resolution
- * and nested quote mazes. Unresolved globs/braces/$'' force ask at the store.
- * Upgrade to a shell AST (mvdan-style) only if those vectors matter.
- */
-
-const MAX_DEPTH = 6;
-
-/**
- * Blank out <<EOF … EOF heredoc bodies so their lines are not treated as units
- * (node <<'EOF' / const / for / console.log were landing in permission.json).
- */
-export function stripHeredocs(command: string): string {
-  // <<[-]?  optional quotes  WORD  then body until a line that is exactly WORD
-  return command.replace(
-    /<<(-)?\s*(['"]?)(\w+)\2\r?\n[\s\S]*?\r?\n\3(?=\r?\n|$)/g,
-    " ",
-  );
-}
-
-/**
- * Drop `# …` comments outside quotes so agent annotations don't become units
- * (`# setup; then rm x` → no `#`/`then` bases from prose).
- * ponytail: not a full lexer; # inside $'…' / unclosed quotes is best-effort.
- */
-export function stripComments(command: string): string {
-  let out = "";
-  let quote: "'" | '"' | null = null;
-  for (let i = 0; i < command.length; i++) {
-    const c = command[i]!;
-    if (quote) {
-      out += c;
-      if (c === "\\" && quote === '"' && i + 1 < command.length) {
-        out += command[++i];
-      } else if (c === quote) {
-        quote = null;
-      }
-      continue;
-    }
-    if (c === "'" || c === '"') {
-      quote = c;
-      out += c;
-      continue;
-    }
-    // Bash: # starts a comment only at a word boundary (not $# / ${#x} / foo#bar).
-    const prev = i === 0 ? "" : command[i - 1]!;
-    if (c === "#" && (i === 0 || /[\s;|&()]/.test(prev))) {
-      while (i + 1 < command.length && command[i + 1] !== "\n") i++;
-      continue;
-    }
-    out += c;
-  }
-  return out;
-}
-
-/**
- * Split on shell control operators, but NOT inside quotes.
- * Fixes `python3 -c "…\n…"` being shredded into fake units (and crashing the
- * permission panel with a 20-base label).
- */
-function splitSegments(command: string): string[] {
-  const parts: string[] = [];
-  let cur = "";
-  let quote: "'" | '"' | null = null;
-  for (let i = 0; i < command.length; i++) {
-    const c = command[i]!;
-    if (quote) {
-      cur += c;
-      if (c === "\\" && quote === '"' && i + 1 < command.length) {
-        cur += command[++i];
-      } else if (c === quote) {
-        quote = null;
-      }
-      continue;
-    }
-    if (c === "'" || c === '"') {
-      quote = c;
-      cur += c;
-      continue;
-    }
-    // && or ||
-    if ((c === "&" || c === "|") && command[i + 1] === c) {
-      if (cur.trim()) parts.push(cur.trim());
-      cur = "";
-      i++;
-      continue;
-    }
-    // Redirects that contain & must not become split points:
-    //   2>&1  >&2  &>file  &>>file
-    // (bare `cmd &` / `cmd1 & cmd2` still split — that's intentional).
-    if (c === "&") {
-      const prev = cur.length ? cur[cur.length - 1]! : "";
-      const next = command[i + 1] ?? "";
-      if (prev === ">" || next === ">") {
-        cur += c;
-        continue;
-      }
-    }
-    if (c === ";" || c === "|" || c === "&" || c === "\n") {
-      if (cur.trim()) parts.push(cur.trim());
-      cur = "";
-      continue;
-    }
-    cur += c;
-  }
-  if (cur.trim()) parts.push(cur.trim());
-  return parts;
-}
-
-/** Extract `$(...)`, backtick, and process substitution <(...)/>(...) bodies.
- * (one level; recursion + segment split handles nesting). */
-function extractSubstitutions(command: string): string[] {
-  const out: string[] = [];
-  // $( ... )
-  const dollar = /\$\(([^()]*(?:\([^()]*\)[^()]*)*)\)/g;
-  let m: RegExpExecArray | null;
-  while ((m = dollar.exec(command))) {
-    if (m[1]?.trim()) out.push(m[1].trim());
-  }
-  // backticks
-  const back = /`([^`]*)`/g;
-  while ((m = back.exec(command))) {
-    if (m[1]?.trim()) out.push(m[1].trim());
-  }
-  // process substitution <(cmd) and >(cmd) — C1 fix
-  const proc = /[<>]\(\s*([^()]*?(?:\([^()]*\)[^()]*?)*)\s*\)/g;
-  while ((m = proc.exec(command))) {
-    if (m[1]?.trim()) out.push(m[1].trim());
-  }
-  return out;
-}
-
-/**
- * All command units in a line: each segment, plus every substitution body
- * (recursively), each itself segment-split.
- */
-export function splitUnits(command: string, depth = 0): string[] {
-  // Top-level only: drop comments + heredoc bodies before segmenting.
-  const cleaned =
-    depth === 0 ? stripComments(stripHeredocs(command)) : command;
-  const trimmed = cleaned.trim();
-  if (!trimmed || depth > MAX_DEPTH) return trimmed ? [trimmed] : [];
-
-  const units: string[] = [];
-  for (const seg of splitSegments(trimmed)) {
-    const subs = extractSubstitutions(seg);
-    // The segment with substitutions blanked out is still a real command to check.
-    const bare = seg
-      .replace(/\$\([^)]*\)/g, " ")
-      .replace(/`[^`]*`/g, " ")
-      .replace(/[<>]\([^)]*\)/g, " ")
-      .trim();
-    if (bare) units.push(bare);
-    for (const sub of subs) units.push(...splitUnits(sub, depth + 1));
-  }
-  return units.length ? units : [];
-}
-
-/**
- * Collapse shell quoting/escapes to the path value the shell would open.
- *  - unquoted \x → x; drop unescaped ' and " anywhere (not just edges)
- *  - single-quoted text is literal (including $ and \) — closes C3 while
- *    keeping `'$HOME'/.env` as the literal path $HOME/.env
- *  - double-quoted: \ only escapes $ ` " \ newline; $ residue stays so
- *    isUnresolvedPath still fires for "$HOME"/.env
- * Unclosed quote → return s unchanged (fail closed: ambiguous).
- */
-function collapseShellToken(s: string): string {
-  let out = "";
-  let i = 0;
-  while (i < s.length) {
-    const c = s[i]!;
-    if (c === "'") {
-      i++;
-      let closed = false;
-      while (i < s.length) {
-        if (s[i] === "'") {
-          closed = true;
-          i++;
-          break;
-        }
-        out += s[i++];
-      }
-      if (!closed) return s;
-      continue;
-    }
-    if (c === '"') {
-      i++;
-      let closed = false;
-      while (i < s.length) {
-        if (s[i] === '"') {
-          closed = true;
-          i++;
-          break;
-        }
-        if (s[i] === "\\" && i + 1 < s.length) {
-          const n = s[i + 1]!;
-          // bash: inside double quotes only $ ` " \ and newline are special
-          if (n === "$" || n === "`" || n === '"' || n === "\\" || n === "\n") {
-            out += n;
-            i += 2;
-          } else {
-            out += s[i++]; // keep the backslash
-          }
-        } else {
-          out += s[i++];
-        }
-      }
-      if (!closed) return s;
-      continue;
-    }
-    if (c === "\\" && i + 1 < s.length) {
-      out += s[i + 1];
-      i += 2;
-      continue;
-    }
-    out += c;
-    i++;
-  }
-  return out;
-}
-
-function unquote(s: string): string {
-  return collapseShellToken(s).trim();
-}
-
-/**
- * Normalize a raw argv token into a path candidate:
- *  - strip @file upload prefix, trailing ) from subs
- *  - strip trailing shell operators glued on (`cat .env;true` → `.env`)
- *  - peel git pathspecs (`HEAD:.env` → `.env`)
- *  - peel dd-style if=/of= assignments
- *  - collapse intra-word quotes/escapes (`.en''v` → `.env`) so path globs match
- */
-export function cleanPathToken(token: string): string {
-  let t = token.trim();
-  if (!t) return "";
-  t = t.replace(/^@/, "");
-  // Operators glued to the path without whitespace (bypass vector).
-  t = t.replace(/[;|&`].*$/, "");
-  t = t.replace(/\)+$/, "").trim();
-  if (!t) return "";
-
-  // dd/install style: if=.env of=/tmp/x
-  const assign = t.match(
-    /^(?:if|of|in|out|file|path|filename|dest|source)=(.+)$/i,
-  );
-  if (assign?.[1]) t = assign[1];
-
-  // git pathspec rev:path / :path — not Windows drive (C:\… / C:/…)
-  if (
-    t.includes(":") &&
-    !/^[A-Za-z]:[\\/]/.test(t) &&
-    !/^[A-Za-z]:$/.test(t)
-  ) {
-    const pathPart = t.slice(t.lastIndexOf(":") + 1);
-    if (pathPart) t = pathPart;
-  }
-
-  // After operator/assign/pathspec peel: collapse quotes so **/.env matches.
-  return collapseShellToken(t).trim();
-}
-
-/**
- * True when the token still needs shell expansion before path policy can allow.
- * Quote-aware: single-quoted text is literal (`'$HOME'` is not an expansion);
- * `$VAR` / `${…}` / `$(…)` / `$ '…'` / globs / braces outside single quotes
- * (and `$` inside double quotes) still force unresolved.
- */
-export function isUnresolvedPath(token: string): boolean {
-  if (!token) return false;
-  // Bash expands ~user, but this gate only resolves the current user's ~/.
-  if (/^~[^/\s]+(?:\/|$)/.test(token)) return true;
-  let i = 0;
-  while (i < token.length) {
-    const c = token[i]!;
-    if (c === "'") {
-      const end = token.indexOf("'", i + 1);
-      if (end < 0) return true; // unclosed — fail closed
-      i = end + 1;
-      continue;
-    }
-    if (c === '"') {
-      i++;
-      while (i < token.length && token[i] !== '"') {
-        if (token[i] === "\\" && i + 1 < token.length) {
-          i += 2;
-          continue;
-        }
-        // $ expands inside double quotes; globs do not
-        if (token[i] === "$" && i + 1 < token.length) {
-          const n = token[i + 1]!;
-          if (n === "'" || n === "{" || n === "(" || /[A-Za-z_]/.test(n)) return true;
-        }
-        i++;
-      }
-      if (i >= token.length) return true; // unclosed
-      i++;
-      continue;
-    }
-    if (c === "\\" && i + 1 < token.length) {
-      i += 2;
-      continue;
-    }
-    // unquoted glob / brace / $
-    if (c === "*" || c === "?" || c === "[" || c === "{") return true;
-    if (c === "$" && i + 1 < token.length) {
-      const n = token[i + 1]!;
-      if (n === "'" || n === "{" || n === "(" || /[A-Za-z_]/.test(n)) return true;
-    }
-    i++;
-  }
-  return false;
-}
-
-// Looks like a path argument (has a slash or a dotfile/ext), not a flag.
-function looksLikePath(token: string): boolean {
-  if (!token || token.startsWith("-")) return false;
-  if (token.includes("=")) return false; // env assignment / --opt=val left after clean
-  return (
-    token.includes("/") ||
-    /^\.?[\w.-]+\.\w+$/.test(token) ||
-    token.startsWith(".") ||
-    // git pathspec residue or plain secret basenames without a dot (id_rsa)
-    /^(id_rsa|id_ed25519|id_ecdsa|id_dsa|shadow|gshadow|sudoers|kubeconfig)$/i.test(
-      token,
-    )
-  );
-}
-
-/**
- * Path-like arguments across the whole command line, including redirect targets
- * (`> file`, `>> file`, `2> file`). Quotes stripped; returned cleaned.
- */
-export function pathArgs(command: string): string[] {
-  const src = stripComments(stripHeredocs(command));
-  const out: string[] = [];
-
-  const push = (raw: string) => {
-    const t = cleanPathToken(raw);
-    if (t && (looksLikePath(t) || isUnresolvedPath(t))) out.push(t);
-  };
-
-  // redirect targets: >, >>, <, 2>, &> followed by a filename (but NOT <( > ( process subs)
-  const redir = /(?:\d*&?>{1,2}|<)\s*("[^"]+"|'[^']+'|(?!\()\S+)/g;
-  let m: RegExpExecArray | null;
-  while ((m = redir.exec(src))) {
-    const t = unquote(m[1]!);
-    if (t && !t.startsWith("&")) push(t);
-  }
-
-  // bare tokens (and if=/.git pathspec forms via cleanPathToken)
-  for (const rawTok of src.split(/\s+/)) {
-    if (!rawTok) continue;
-    // Attached option values commonly carry paths (`--file=.env`, `--chdir=/tmp`).
-    const optionValue = rawTok.match(/^--?[A-Za-z][A-Za-z0-9-]*=(.+)$/)?.[1];
-    if (optionValue) {
-      push(optionValue);
-      continue;
-    }
-    // Keep if=.env visible to cleanPathToken (looksLikePath alone would skip `=`).
-    if (/^(?:if|of|in|out|file|path|filename|dest|source)=/i.test(rawTok)) {
-      push(rawTok);
-      continue;
-    }
-    push(rawTok.replace(/^[<>]+\(?/, ""));
-  }
-
-  return [...new Set(out)];
-}
-
-/**
- * True when the line has unquoted glob/brace/ANSI-C tokens so path policy
- * cannot prove the real path — caller should force ask (never silent allow).
- */
-export function hasUnresolvedExpansion(command: string): boolean {
-  const src = stripComments(stripHeredocs(command));
-  for (const rawTok of src.split(/\s+/)) {
-    if (!rawTok || rawTok.startsWith("-")) continue;
-    // Quote-aware on the raw token first: '$HOME' is literal, "$HOME" is not.
-    // Do not re-scan the collapsed form for $ — that would turn single-quoted
-    // literal $ into a false expansion after cleanPathToken strips the quotes.
-    if (isUnresolvedPath(rawTok)) return true;
-    const t = cleanPathToken(rawTok);
-    // Globs/braces that survive collapse (unquoted) still force ask.
-    if (t && /[*?[{]/.test(t)) return true;
-  }
-  // Whole-line $'…' even when glued
-  if (/\$'[^']*'/.test(src)) return true;
-  return false;
-}