@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/rules/lane-spilled-read.ts

@@ -0,0 +1,90 @@
+import { lane_child_marker } from '#scripts/lane/lane-child-marker'
+import { json_value } from '#scripts/lib/json-value'
+import type { GuardedCall } from '#scripts/time-runtime/time-batch-guard'
+
+// A dispatched lane child's whole `Read` of a spilled Bash result is refused and pointed at a narrowed
+// read (joshuafolkken/kit#5040).
+//
+// **The spill is the largest single result a cut session carries.** A Bash result over the harness cap
+// is saved to `tool-results/<id>.txt` and previewed; reading that file back whole put 10,000–18,000
+// characters into the context in one call, 10–40% of a cut session's tool results. A `grep` or
+// `sed -n` over the same file reads only the lines the run needs.
+//
+// **Lane children only, every occurrence.** The cut that the context growth triggers is a lane
+// child's; a person in an interactive session keeps the whole read. A paginated `Read` (an `offset` or
+// a `limit`) is already narrowed and passes.
+
+const SPILLED_RESULT = /\/tool-results\/[^/]+\.txt$/u
+
+function read_input(call: GuardedCall): Record<string, unknown> | undefined {
+	if (call.name !== 'Read' || !json_value.is_record(call.input)) return undefined
+
+	return call.input
+}
+
+function reads_spilled_result(input: Record<string, unknown>): boolean {
+	const { file_path } = input
+
+	return typeof file_path === 'string' && SPILLED_RESULT.test(file_path)
+}
+
+function is_paginated(input: Record<string, unknown>): boolean {
+	return input['offset'] !== undefined || input['limit'] !== undefined
+}
+
+// The occasion the rule governs: any `Read` of a spilled result, whole or narrowed.
+function reaches_spilled_result(call: GuardedCall): boolean {
+	const input = read_input(call)
+
+	return input !== undefined && reads_spilled_result(input)
+}
+
+// Keeping the rule: the spilled result read with a page, never whole.
+function keeps_narrowed_read(call: GuardedCall): boolean {
+	const input = read_input(call)
+
+	return input !== undefined && reads_spilled_result(input) && is_paginated(input)
+}
+
+function is_whole_spilled_read(
+	call: GuardedCall,
+	is_lane_child: boolean = lane_child_marker.is_child_of(process.cwd()),
+): boolean {
+	if (!reaches_spilled_result(call) || keeps_narrowed_read(call)) return false
+
+	return is_lane_child
+}
+
+const LANE_SPILLED_READ_REASON =
+	'⛔ lane child reading a spilled Bash result whole: `tool-results/<id>.txt` is the output that ' +
+	'overflowed the cap, and reading it back whole fills the context the cut is measured on. Read only ' +
+	'the lines you need: `grep -n <pattern> <path>` or `sed -n <from>,<to>p <path>`. ' +
+	'Refused on every occurrence.'
+
+// The row itself, so `delivered-rules.ts` spreads one entry; the shape is `lane-direct-tool.ts`'s, with
+// the narrowed read as its compliance call.
+const ROW = {
+	id: 'lane-spilled-read',
+	is_trigger: is_whole_spilled_read,
+	reason: LANE_SPILLED_READ_REASON,
+	decide: (): boolean => true,
+	keeps: keeps_narrowed_read,
+	reaches: reaches_spilled_result,
+	about: {
+		title: 'Lane child reading a spilled Bash result whole',
+		topic: '`prompts/collaboration-workflow/output-bounds.md`',
+		fires:
+			"a dispatched lane child's `Read` of a `tool-results/<id>.txt` file with no `offset` or `limit`. Every occurrence",
+		quiet: 'not a lane child, another file, or a paginated `Read`',
+	},
+}
+
+const lane_spilled_read = {
+	LANE_SPILLED_READ_REASON,
+	ROW,
+	is_whole_spilled_read,
+	keeps_narrowed_read,
+	reaches_spilled_result,
+}
+
+export { lane_spilled_read }

package/scripts/rules/lane-split-park.ts

@@ -17,18 +17,19 @@ import { tail_commands } from './tail-commands'
 // carries `epic` as a split (`run-merge.ts`), so the label is never what tells it.
 //
 // **The material is the run's own calls.** The promotion is a `josh epic --promote <N>` this run issued,
-// read off the transcript tail as `filing-cap.ts` reads its filings — a tool call, never prose, so a
+// read off the transcript tail as `turn-filings.ts` reads its filings — a tool call, never prose, so a
 // child that merely read a document quoting the command is not mistaken for one that ran it. Only a
 // promotion of the dispatched issue counts: the epic a mid-run split promotes is the child's own Issue.
 
 // `josh epic`, named canonically — `shell_segments.is_josh_command` expands an alias before the match.
 const EPIC_COMMANDS: ReadonlySet<string> = new Set(['epic'])
 const PROMOTED_ISSUE = /--promote[=\s]+["']?(?<issue>\d+)\b/u
-// The issue a label write targets, in the two spellings `lane_park.records_the_park` accepts: the REST
-// path `…/issues/<N>/labels` and `gh issue edit <N>`.
+// The issue a label write targets, in the spellings `lane_park.records_the_park` accepts: the REST
+// path `…/issues/<N>/labels`, `gh issue edit <N>` and `josh run:park <N>`.
 const LABEL_TARGETS: ReadonlyArray<RegExp> = [
 	/\/issues\/(?<issue>\d+)\/labels\b/u,
 	/\bissue\s+edit\s+["']?(?<issue>\d+)\b/u,
+	/\brun:park\s+["']?(?<issue>\d+)\b/u,
 ]
 // The issue a confirmation notify is about, read off its `--issue-url` the way `stop-rules.ts` spells it.
 const ISSUE_URL = /--issue-url[=\s]+["']?([^\s"']+)/u
@@ -111,6 +112,13 @@ const ROW = {
 	is_trigger: bash_triggers.on_bash_command(is_candidate),
 	reason: LANE_SPLIT_PARK_REASON,
 	decide,
+	about: {
+		title: 'A split is not a park',
+		topic: '`.claude/skills/workflow-commands/backlogrun-park.md` → "Splitting a child mid-run"',
+		fires:
+			'a lane child that promoted its Issue to an epic this run parking it (`needs-decision`, `confirmation` notify). Every occurrence',
+		quiet: 'no promotion this run',
+	},
 }
 
 const lane_split_park = {

package/scripts/rules/lane-switch-main.ts

@@ -19,8 +19,8 @@ import { shell_segments } from './shell-segments'
 //
 // **It refuses rather than rewrites, because a `PreToolUse` guard can only `allow` / `deny` a command,
 // never substitute a different one**. So the refusal hands back the next command: the lane is already on its own issue
-// branch, branched from a fresh default before it opened, and the latest default is brought in during the
-// gate by `pnpm josh main:merge` — so skip the step and keep implementing on the current branch.
+// branch, branched from a fresh default before it opened, and the latest default is brought in before the
+// gate by `josh ship`'s sync — so skip the step and keep implementing on the current branch.
 //
 // **The branch is judged against the lane's own, not the name `main`.** `already used by worktree` is a
 // property of any branch the primary work tree holds, not of the literal `main`, and the default branch
@@ -108,8 +108,8 @@ function is_switch_away_from_lane(
 const LANE_SWITCH_MAIN_REASON =
 	'⛔ lane child on `git switch main`: this session is a dispatched lane child, and switching to the ' +
 	'default branch here always fails (`already used by worktree`: the primary checkout holds it). Skip ' +
-	'this step and keep implementing on the current branch; `pnpm josh main:merge` brings the default ' +
-	'in during the gate. Refused on every occurrence (`backlogrun-lanes.md`, `backlogrun-child.md`).'
+	"this step and keep implementing on the current branch; `pnpm josh ship`'s sync brings the default " +
+	'in before its gate. Refused on every occurrence (`backlogrun-lanes.md`, `backlogrun-child.md`).'
 
 // The row itself, so `delivered-rules.ts` spreads one entry. `is_trigger` reads the input through
 // `on_bash_command` — the `Bash` tool-name gate every command row shares — and `decide` returns true so
@@ -120,6 +120,13 @@ const ROW = {
 	is_trigger: bash_triggers.on_bash_command(is_switch_away_from_lane),
 	reason: LANE_SWITCH_MAIN_REASON,
 	decide: (): boolean => true,
+	about: {
+		title: 'Lane child on `git switch main`',
+		topic: '`.claude/skills/workflow-commands/backlogrun-lanes.md`',
+		fires:
+			'a dispatched lane child switching to the default branch or running `josh main:sync`. Every occurrence',
+		quiet: 'not a lane child — `pnpm josh main:merge` brings the default in at the gate',
+	},
 }
 
 const lane_switch_main = {

package/scripts/rules/last-prompt.ts

@@ -1,32 +1,18 @@
 import { json_value } from '#scripts/lib/json-value'
 import { time_reported_failure } from '#scripts/time-runtime/time-reported-failure'
 import { z } from 'zod'
-import { filing_cap } from './filing-cap'
+import { turn_filings } from './turn-filings'
 
-// The text of the person's last prompt on a transcript tail — what the stop guard's citation row
-// reads to tell a `#N` the person quoted from one the run brought in itself.
+// The person's prompts on a transcript tail — what the stop guard reads to tell a question it answers
+// and the pause a recorded notify belongs to.
 //
-// **A prompt is `filing_cap`'s prompt line, minus what the harness wrote there.** A skill's body is a
+// **A prompt is `turn_filings`' prompt line, minus what the harness wrote there.** A skill's body is a
 // `user` line with no tool result too, but it carries `isMeta`; a background task's completion notice
 // and a subagent's hand-back carry an `origin` whose `kind` is not `human`. Each is the harness
-// speaking, not the person — and a notice can name the very Issue the run filed — so only a line with
-// no `origin` (an SDK prompt) or a `human` one is read.
-//
-// **A workflow invocation quotes nothing.** `fullrun #2819` names this repository's own Issue, so a
-// bare `#2819` in that run's report is a citation slip like any other, and the prompt yields no text —
-// a resumed lane child's prompt included, since it ends on the same invocation.
-
-const WORKFLOW_KEYWORDS: ReadonlySet<string> = new Set([
-	'kickoff',
-	'fullrun',
-	'halfrun',
-	'prrun',
-	'backlogrun',
-])
+// speaking, not the person, so only a line with no `origin` (an SDK prompt) or a `human` one is read.
+
 const NO_PROMPT = ''
 const HUMAN_ORIGIN = 'human'
-// The word before the prompt's last one — where a trailing `fullrun #N` puts its keyword.
-const KEYWORD_BEFORE_ARGUMENT = -2
 
 const PROMPT_LINE_SCHEMA = z.object({
 	isMeta: z.boolean().nullish(),
@@ -61,45 +47,32 @@ function person_text(line: string): string | undefined {
 	return time_reported_failure.result_text(person.message.content)
 }
 
-// A keyword opening the prompt is what a person types; a keyword before its one trailing argument is a
-// lane child's resume prompt, whose preamble ends on `fullrun #N` (`lane-child-invocation.ts`).
-function is_invocation(prompt: string): boolean {
-	const words = prompt.trim().split(/\s+/u)
-
-	return [words.at(0), words.at(KEYWORD_BEFORE_ARGUMENT)].some((word) =>
-		WORKFLOW_KEYWORDS.has(word ?? NO_PROMPT),
-	)
-}
-
-function prompt_line_text(line: string): string | undefined {
-	return filing_cap.is_prompt_line(line) ? person_text(line) : undefined
-}
-
-// The last person prompt on the tail; '' when none is on it or it is an invocation.
-function prompt_text(tail: string): string {
-	const text = tail
-		.split('\n')
-		.map((line) => prompt_line_text(line))
-		.findLast((one) => one !== undefined)
-
-	return text === undefined || is_invocation(text) ? NO_PROMPT : text
-}
-
 // **The prompt that opened this turn, when a person typed it** — '' when the harness opened it (a task
 // notification, a subagent's hand-back), so a question asked turns ago does not answer for a stop the
 // run reached on its own since (`stop-decision.ts` → `is_question`).
 function turn_prompt(tail: string): string {
-	const opener = tail.split('\n').findLast((line) => filing_cap.is_prompt_line(line))
+	const opener = tail.split('\n').findLast((line) => turn_filings.is_prompt_line(line))
 	if (opener === undefined) return NO_PROMPT
 
 	return person_text(opener) ?? NO_PROMPT
 }
 
+// **The person's last prompt on the tail**, past what the harness wrote after it (a skill body, a task
+// notification) — `undefined` when no prompt of theirs is on it, so an unread prompt is told apart
+// from one that asked nothing.
+function person_prompt(tail: string): string | undefined {
+	return tail
+		.split('\n')
+		.filter((line) => turn_filings.is_prompt_line(line))
+		.map((line) => person_text(line))
+		.findLast((text) => text !== undefined)
+}
+
 // When the person last prompted on the tail, or `undefined` when no prompt of theirs is on it.
 function prompt_time(tail: string): string | undefined {
 	return tail
 		.split('\n')
-		.filter((line) => filing_cap.is_prompt_line(line))
+		.filter((line) => turn_filings.is_prompt_line(line))
 		.map((line) => person_line(line)?.timestamp ?? undefined)
 		.findLast((time) => time !== undefined)
 }
@@ -120,6 +93,6 @@ function pause_start(tail: string): string | undefined {
 	return prompt_time(tail) ?? tail_time(tail)
 }
 
-const last_prompt = { pause_start, prompt_text, turn_prompt }
+const last_prompt = { pause_start, person_prompt, turn_prompt }
 
 export { last_prompt }

package/scripts/rules/oracle-consulted.ts

@@ -55,6 +55,15 @@ function reason_for(oracle: Oracle, firing_point: FiringPoint): string {
 	)
 }
 
+// One description for every generated row: the rule is the same act whichever oracle it names.
+const ABOUT: DeliveredRule['about'] = {
+	title: 'An act its oracle was not asked about',
+	topic: '`decision-oracle.ts`',
+	fires:
+		'a `Bash` governed by an oracle that declared a firing point (`pkg:scout` governs `pnpm add`), issued without that `pnpm josh <command>`. Refused until it ran',
+	quiet: 'no governed act, or the oracle already ran',
+}
+
 function row_for(oracle: Oracle, firing_point: FiringPoint): DeliveredRule {
 	const names = command_names(oracle)
 
@@ -65,12 +74,13 @@ function row_for(oracle: Oracle, firing_point: FiringPoint): DeliveredRule {
 		already_satisfied: (tail: string, _call: GuardedCall): boolean =>
 			tail_commands.prior_bash_commands(tail).some((command) => runs_the_oracle(command, names)),
 		keeps: bash_triggers.on_bash_command((command: string) => runs_the_oracle(command, names)),
+		about: ABOUT,
 	}
 }
 
 // One row per oracle that declared a firing point, in registry order. Spread into `DELIVERED_RULES`
 // after the filing rows, so a firing point that overlaps a filing (`issue:lint`) delivers on the
-// reissue rather than ahead of `filing-cap`.
+// reissue rather than ahead of the filing rows.
 const ROWS: ReadonlyArray<DeliveredRule> = oracle_firing
 	.firing_oracles()
 	.map(({ oracle, firing_point }) => row_for(oracle, firing_point))

package/scripts/rules/oracle-firing.ts

@@ -90,6 +90,7 @@ const NOT_NAMED: ReadonlyMap<string, string> = new Map([
 	['run:cut:gate', SELF],
 	['backlog:budget', READ],
 	['run:liveness', READ],
+	['stash:push', SELF],
 	['stash:pop', SELF],
 	['backlog:next', READ],
 	['auto-ok:next', READ],

package/scripts/rules/permission-guards.ts

@@ -1,7 +1,9 @@
 import { destructive_command } from './destructive-command'
 import { direct_pr_create } from './direct-pr-create'
 import { index_guard } from './index-guard'
+import { pr_merge } from './pr-merge'
 import { protected_files } from './protected-files'
+import { repo_admin } from './repo-admin'
 
 // The three rows that close the deny-list bypasses, gathered so
 // `delivered-rules.ts` spreads one entry. Each reads argv or a file path rather than a glob: an index
@@ -10,11 +12,16 @@ import { protected_files } from './protected-files'
 // other row's — `git restore` is split with `worktree-mutation` by `--staged` alone. The fourth row,
 // `direct-pr-create`, closes the same kind of gap for `gh pr create`, which
 // the deny list never listed: it claims `gh pr create` and a `gh api` write to the pulls collection.
+// The fifth, `pr-merge`, claims a merge in every spelling the `gh pr merge*` glob misses. The sixth,
+// `repo-admin`, claims a non-`DELETE` write to the repository's administration, which
+// `destructive-command` leaves open.
 const ROWS = [
 	index_guard.ROW,
 	destructive_command.ROW,
 	protected_files.ROW,
 	direct_pr_create.ROW,
+	pr_merge.ROW,
+	repo_admin.ROW,
 ] as const
 
 const permission_guards = { ROWS }

package/scripts/rules/piped-verification-shapes.ts

@@ -0,0 +1,110 @@
+import { time_shell } from '#scripts/time-runtime/time-shell'
+import { time_transcript_line } from '#scripts/time-runtime/time-transcript-line'
+import { piped_verification } from './piped-verification'
+import { rule_value } from './rule-value'
+import { shell_segments } from './shell-segments'
+
+// The `piped-verification` refusals named by the filter that drew them, for `josh rule:value --fresh`.
+//
+// **Which shape to move from the refusal to the rewrite is read here, not in a transcript by hand.**
+// The refusal text is one fixed reason, so the row's `refused` count says how often and never why; the
+// command that drew it is the call the errored result answers, paired by its `tool_use_id`
+// (joshuafolkken/kit#5266). A shape is named by the first that holds, in the order below: the filters
+// that hide a verdict first, the chain — a line of more than one command, a heredoc's body lines
+// included — only where no filter explains the refusal.
+
+const SHAPE = {
+	head: 'head',
+	grep: 'grep',
+	script: 'awk|sed|tee',
+	chain: 'chain',
+	other: 'other',
+} as const
+
+type RefusalShape = (typeof SHAPE)[keyof typeof SHAPE]
+type ShapeCounts = Map<RefusalShape, number>
+
+const HEAD_FILTER = /^head\b/u
+const SCRIPT_FILTER = /^(?:awk|sed|tee)\b/u
+// The reason's opening, matched as `rule-value.ts` matches a refusal; a text without the cheap mark —
+// the reason's ASCII words, which the rewrite note does not share — is skipped unparsed.
+const SIGNATURE = piped_verification.PIPED_VERIFICATION_REASON.slice(
+	0,
+	rule_value.REASON_SIGNATURE_LENGTH,
+)
+const CHEAP_MARK = 'piped verification: a pipeline exits'
+const HEADING = 'piped-verification refusals by shape:'
+const SHAPE_GAP = ' · '
+
+function filter_shape(filters: ReadonlyArray<string>): RefusalShape | undefined {
+	if (filters.some((piece) => HEAD_FILTER.test(piece))) return SHAPE.head
+	if (filters.some((piece) => piped_verification.EARLY_EXIT_GREP.test(piece))) return SHAPE.grep
+
+	return filters.some((piece) => SCRIPT_FILTER.test(piece)) ? SHAPE.script : undefined
+}
+
+function shape_of(command: string): RefusalShape {
+	const by_filter = filter_shape(piped_verification.check_filters(command))
+
+	if (by_filter !== undefined) return by_filter
+
+	const segments = shell_segments.segments_of(time_shell.unquoted(command))
+
+	return segments.length > 1 ? SHAPE.chain : SHAPE.other
+}
+
+interface Pairing {
+	commands: Map<string, string>
+	refused: Array<string>
+}
+
+type Block = NonNullable<ReturnType<typeof time_transcript_line.parse_line>>['blocks'][number]
+
+function is_refusal(block: Block): boolean {
+	if (block.error_text === '') return false
+
+	return time_transcript_line.refusal_body(block.error_text).startsWith(SIGNATURE)
+}
+
+function pair_block(block: Block, pairing: Pairing): void {
+	if (block.id !== '') pairing.commands.set(block.id, time_shell.bash_command(block.input))
+	if (is_refusal(block)) pairing.refused.push(block.result_id)
+}
+
+function blocks_of(text: string): Array<Block> {
+	return text.split('\n').flatMap((line) => time_transcript_line.parse_line(line)?.blocks ?? [])
+}
+
+// The commands one transcript's `piped-verification` refusals answered.
+function refused_commands(text: string): Array<string> {
+	if (!text.includes(CHEAP_MARK)) return []
+
+	const pairing: Pairing = { commands: new Map(), refused: [] }
+
+	for (const block of blocks_of(text)) pair_block(block, pairing)
+
+	return pairing.refused
+		.map((id) => pairing.commands.get(id) ?? '')
+		.filter((command) => command !== '')
+}
+
+function count(text: string, counts: ShapeCounts): void {
+	for (const command of refused_commands(text)) {
+		const shape = shape_of(command)
+
+		counts.set(shape, (counts.get(shape) ?? 0) + 1)
+	}
+}
+
+function render(counts: ShapeCounts): string {
+	const cells = Object.values(SHAPE).map(
+		(shape) => `${shape} ${(counts.get(shape) ?? 0).toString()}`,
+	)
+
+	return `${HEADING} ${cells.join(SHAPE_GAP)}`
+}
+
+const piped_verification_shapes = { HEADING, SHAPE, count, refused_commands, render, shape_of }
+
+export { piped_verification_shapes }
+export type { RefusalShape, ShapeCounts }

package/scripts/rules/piped-verification.ts

@@ -16,7 +16,7 @@ import { shell_segments } from './shell-segments'
 // document, prompt and skill in this repository found exactly one piped verification example, and it
 // was the repository's own explanation of this bug — so there were no examples to rewrite, and the
 // pipe is invented each time rather than copied. The other candidate, a calling convention, had
-// already been rejected in writing by `scripts/time/time-reported-failure.ts`: a convention is obeyed
+// already been rejected in writing by `tools/time/time-reported-failure.ts`: a convention is obeyed
 // or it is not. `prompts/collaboration-workflow/output-bounds.md` is the single source for the rule.
 //
 // It lives beside the enumeration rather than inside it because `delivered-rules.ts` is the list —
@@ -40,6 +40,7 @@ import { shell_segments } from './shell-segments'
 // change. The Issue that filed this rule names `eval` for that reason.
 const VERIFICATION_COMMANDS: ReadonlySet<string> = new Set([
 	'check',
+	'check:related',
 	'cspell',
 	'cspell:dot',
 	'eval',
@@ -97,6 +98,13 @@ function pipelines_of(command: string): Array<Array<string>> {
 		.map((segment) => segment.split('|').map((piece) => piece.trim()))
 }
 
+// The filters behind each check on the line — what a refusal is named by (`piped-verification-shapes.ts`).
+function check_filters(command: string): Array<string> {
+	return pipelines_of(command).flatMap(([head = '', ...filters]) =>
+		is_verification_command(head) ? filters : [],
+	)
+}
+
 function command_pieces(command: string): Array<string> {
 	return pipelines_of(command).flat()
 }
@@ -125,7 +133,12 @@ function keeps_verdict_intact(command: string): boolean {
 // `grep` stopping at its first match — closes the pipe on a check still writing, and under `pipefail` the
 // check's SIGPIPE turns a passing run into exit 141; `head` also cuts the verdict line josh prints last.
 // `cut`, `sort`, `uniq` and `wc` read to the end as well, and a `grep … | cut -c1-250` narrowing was the
-// commonest masking still refused after #3875 (joshuafolkken/kit#3920).
+// commonest masking still refused after #3875 (joshuafolkken/kit#3920). `tee` passes every line on, and an
+// `awk` or `sed` script reads to the end where it can neither exit nor reach past the pipe — read on the
+// typed piece, since the script is quoted: an `awk` program with no `exit`, `nextfile`, `system`, `getline` or `|`,
+// and a `sed` script of `p`, `d` and `s///` alone (joshuafolkken/kit#5266). A quoted `<`, `>` or `&`
+// still refuses below: inside `awk` a `>` may be `print > "f"`, which no reading here tells from a
+// comparison.
 //
 // **Each masked check is wrapped on its own, and the rest of the line runs as typed.** Most of the
 // refusals left after #3570 were a check chained beside other work — `vitest …; pnpm josh lint:related
@@ -143,9 +156,18 @@ function keeps_verdict_intact(command: string): boolean {
 const PIPEFAIL_OPEN = '(set -o pipefail; '
 const PIPEFAIL_CLOSE = ')'
 const COMMENT_START = /(?:^|\s)#/u
-const FULL_READING_FILTER = /^(?:tail|grep|cut|sort|uniq|wc)\b/u
+const FULL_READING_FILTER = /^(?:tail|grep|cut|sort|uniq|wc|tee)(?=\s|$)/u
 const EARLY_EXIT_GREP =
 	/^grep\b.*\s(?:-[a-zA-Z]*[lLmq]|--(?:quiet|silent|max-count|files-with(?:out)?-match))/u
+const AWK_PROGRAM = /^awk\s+(?:-F\s*\S+\s+)?'[^']*'$/u
+const AWK_EARLY_EXIT = /\b(?:exit|nextfile|system|getline)\b|\|/u
+const SED_TEXT = String.raw`(?:[^/\\']|\\.)*`
+const SED_ADDRESS = String.raw`(?:\d+|\$|/${SED_TEXT}/)`
+const SED_COMMAND = String.raw`(?:${SED_ADDRESS}(?:,${SED_ADDRESS})?)?!?(?:p|d|s/${SED_TEXT}/${SED_TEXT}/[gip\d]*)`
+const SED_PROGRAM = new RegExp(
+	String.raw`^sed\s+(?:-[nEr]+\s+)*'${SED_COMMAND}(?:;\s*${SED_COMMAND})*'$`,
+	'u',
+)
 
 const ALLOWED_OPERATORS = /2>&1|&&/gu
 const SIDE_EFFECT_SYNTAX = /[&<>`]|\$\(/u
@@ -156,14 +178,40 @@ const PIPEFAIL_NOTE =
 	"`(set -o pipefail; …)` to carry the check's status, and the rest of the line ran as typed. Read " +
 	'the printed verdict, never the exit code alone — `prompts/collaboration-workflow/output-bounds.md`.'
 
-function reads_to_the_end(piece: string): boolean {
-	return FULL_READING_FILTER.test(piece) && !EARLY_EXIT_GREP.test(piece)
+function is_full_reading_script(typed: string): boolean {
+	if (AWK_PROGRAM.test(typed)) return !AWK_EARLY_EXIT.test(typed)
+
+	return SED_PROGRAM.test(typed)
 }
 
-function is_filtered_check(pipeline: Array<string>): boolean {
-	const [head = '', ...filters] = pipeline
+// A filter's name and flags are read on the blanked piece, its quoted script on the typed one.
+function reads_to_the_end(piece: string, typed: string): boolean {
+	if (FULL_READING_FILTER.test(piece)) return !EARLY_EXIT_GREP.test(piece)
 
-	return is_verification_command(head) && filters.every((piece) => reads_to_the_end(piece))
+	return is_full_reading_script(typed)
+}
+
+// The typed text at the offsets of the blanked pieces, each `gap` characters apart — the blanked line
+// keeps every offset, so a cut found there is the same cut in the typed one.
+function typed_slices(raw: string, pieces: ReadonlyArray<string>, gap: number): Array<string> {
+	const offset = { at: 0 }
+
+	return pieces.map((piece) => {
+		const typed = raw.slice(offset.at, offset.at + piece.length)
+
+		offset.at += piece.length + gap
+
+		return typed
+	})
+}
+
+function is_filtered_check(pieces: ReadonlyArray<string>, typed: ReadonlyArray<string>): boolean {
+	const [head = '', ...filters] = pieces.map((piece) => piece.trim())
+
+	return (
+		is_verification_command(head) &&
+		filters.every((piece, index) => reads_to_the_end(piece, typed[index + 1]?.trim() ?? ''))
+	)
 }
 
 function has_side_effect_syntax(command: string): boolean {
@@ -173,9 +221,13 @@ function has_side_effect_syntax(command: string): boolean {
 // The side-effect syntax is read on the typed part, since a double-quoted `$(cmd)` still runs; the pipe
 // cut and the grouping are read on the blanked one, since a quoted `|` or `(` is text.
 function is_rewritable_part(raw: string, judged: string): boolean {
-	const pipeline = judged.split('|').map((piece) => piece.trim())
+	const pieces = judged.split('|')
 
-	return !has_side_effect_syntax(raw) && !GROUP_SYNTAX.test(judged) && is_filtered_check(pipeline)
+	return (
+		!has_side_effect_syntax(raw) &&
+		!GROUP_SYNTAX.test(judged) &&
+		is_filtered_check(pieces, typed_slices(raw, pieces, 1))
+	)
 }
 
 // Where the part's code ends: an unquoted `#` opens a comment, which would swallow the closing `)`.
@@ -210,14 +262,10 @@ function pipefail_command(command: string): string | undefined {
 
 	if (judged === undefined || !is_masked_verification(command)) return undefined
 
-	const offset = { at: 0 }
-	const parts = shell_segments.parts_of(judged).map((part) => {
-		const raw = command.slice(offset.at, offset.at + part.length)
-
-		offset.at += part.length
-
-		return rewritten_part(raw, part)
-	})
+	const pieces = shell_segments.parts_of(judged)
+	const parts = typed_slices(command, pieces, 0).map((raw, index) =>
+		rewritten_part(raw, pieces[index] ?? ''),
+	)
 
 	const rewritten = parts.includes(undefined) ? undefined : parts.join('')
 
@@ -236,9 +284,11 @@ function pipefail_input(call: GuardedCall): Record<string, unknown> | undefined
 }
 
 const piped_verification = {
+	EARLY_EXIT_GREP,
 	PIPED_VERIFICATION_REASON,
 	PIPEFAIL_NOTE,
 	VERIFICATION_COMMANDS,
+	check_filters,
 	is_masked_verification,
 	keeps_verdict_intact,
 	pipefail_input,