@joshuafolkken/kit 1.3000.0 → 1.3041.0

package/scripts/agent/lane-instructions.ts

@@ -5,6 +5,7 @@ import { document_section } from '#scripts/document/document-section'
 import { distributed_paths } from '#scripts/init/distributed-paths'
 import { find_package_directory } from '#scripts/josh/package-directory'
 import { stamp_file } from '#scripts/josh/stamp-file'
+import { run_park_escalate } from '#scripts/run/park/run-park-escalate'
 
 interface LaneSet {
 	text: string
@@ -28,6 +29,14 @@ const SETTINGS_FLAG = '--settings'
 const PROMPT_FILE_PREFIX = 'josh-lane-instructions-'
 const PROMPT_FILE_SUFFIX = '.md'
 const PACKAGE_DIRECTORY = find_package_directory(path.dirname(fileURLToPath(import.meta.url)))
+// Appended only where `josh.worker.escalate` is true, so a repository without it keeps today's text
+// to the byte (joshuafolkken/kit#7356).
+const ESCALATION_GUIDE = [
+	'',
+	'## Escalation',
+	'',
+	'- This Issue needs a stronger model than the one you run on → `pnpm josh run:park <N> --escalate "<reason>"`, then stop. The reason is required and recorded; the lane resumes one profile up, or goes to a person at the top profile.',
+].join('\n')
 
 // An include that resolves to nothing is `undefined`, never an empty string, so a renamed heading
 // fails the whole composition rather than silently dropping a rule.
@@ -63,7 +72,7 @@ function composed_from(lane_markdown: string, rules_path: string): string | unde
 	return rules === undefined ? undefined : compose(lane_markdown, rules)
 }
 
-function composed_set(cwd: string, package_directory: string): LaneSet | undefined {
+function rules_set(cwd: string, package_directory: string): LaneSet | undefined {
 	const lane_markdown = document_section.read_optional(path.join(package_directory, LANE_DOCUMENT))
 
 	if (lane_markdown === undefined) return undefined
@@ -77,6 +86,19 @@ function composed_set(cwd: string, package_directory: string): LaneSet | undefin
 	return undefined
 }
 
+// Only a worker can declare an escalation: a review session never parks the Issue it reads.
+function composed_set(
+	cwd: string,
+	package_directory: string,
+	is_worker = false,
+): LaneSet | undefined {
+	const set = rules_set(cwd, package_directory)
+
+	if (set === undefined || !is_worker || !run_park_escalate.is_enabled(cwd)) return set
+
+	return { ...set, text: `${set.text}${ESCALATION_GUIDE}` }
+}
+
 function composed_in(
 	cwd: string,
 	package_directory: string = PACKAGE_DIRECTORY,
@@ -108,8 +130,7 @@ function excluded_settings(rules_path: string, cwd: string): string {
 
 // No flags when the set cannot be composed or safely written: the child then loads `CLAUDE.md` as
 // before, which costs tokens but never loses a rule.
-function flags(cwd: string = process.cwd()): ReadonlyArray<string> {
-	const set = composed_set(cwd, PACKAGE_DIRECTORY)
+function flags_of(set: LaneSet | undefined, cwd: string): ReadonlyArray<string> {
 	const prompt_file = set === undefined ? undefined : written(set.text)
 
 	if (set === undefined || prompt_file === undefined) return []
@@ -117,6 +138,11 @@ function flags(cwd: string = process.cwd()): ReadonlyArray<string> {
 	return [PROMPT_FILE_FLAG, prompt_file, SETTINGS_FLAG, excluded_settings(set.rules_path, cwd)]
 }
 
+// `is_worker` adds the escalation guide where the repository allows one (joshuafolkken/kit#7356).
+function flags(cwd: string = process.cwd(), is_worker = false): ReadonlyArray<string> {
+	return flags_of(composed_set(cwd, PACKAGE_DIRECTORY, is_worker), cwd)
+}
+
 function tokens_of(text: string): string {
 	return cost_tokens.estimate(text).toLocaleString('en-US')
 }

package/scripts/auto-ok/auto-ok-judge-cli.ts

@@ -67,6 +67,9 @@ function parse_request(argv: ReadonlyArray<string>): JudgeRequest | undefined {
 }
 
 async function list(): Promise<number> {
+	console.error(
+		'Judge original user instructions separately from automated plans and prior decisions; kickoff planning alone is not an opt-out. Verify the reference and verbatim prohibition under 自動実行の制約 before treating it as a user constraint (docs/how-to/auto-ok-provenance.md).',
+	)
 	const owed = await auto_ok_judge_read.owed()
 
 	if (owed === undefined) {

package/scripts/auto-ok/auto-ok-judge-write.ts

@@ -89,7 +89,8 @@ async function apply_to(
 	read: IssueRead,
 	answers: RunLabelFlags,
 ): Promise<number> {
-	const exclusion = issue_auto_ok.exclusion_of(read.labels)
+	const exclusion =
+		issue_auto_ok.exclusion_of(read.labels) ?? issue_auto_ok.user_constraint_of(read.body)
 
 	if (exclusion !== undefined) return refused(issue, issue_auto_ok.line_of(exclusion))
 

package/scripts/auto-ok/auto-ok-judge.ts

@@ -26,9 +26,11 @@ interface JudgeIssue {
 	is_trusted: boolean
 }
 
-const MARKER_PREFIX = '<!-- josh:auto-ok-judged body='
+// Legacy records owe one reading under the provenance contract. Current records still use the
+// existing body/person-comment invalidation, rather than re-judging every issue on every offer.
+const MARKER_PREFIX = '<!-- josh:auto-ok-judged v=2 body='
 const MARKER_SUFFIX = ' -->'
-const MARKER_PATTERN = /<!-- josh:auto-ok-judged body=(?<digest>[\da-f]+) -->/u
+const MARKER_PATTERN = /<!-- josh:auto-ok-judged v=2 body=(?<digest>[\da-f]+) -->/u
 const DIGEST_LENGTH = 16
 const CRLF = '\r\n'
 const LF = '\n'

package/scripts/backlog/backlog-drive-escalate.ts

@@ -0,0 +1,115 @@
+import {
+	agent_worker_profile,
+	type WorkerProfile,
+	type WorkerSettings,
+} from '#scripts/agent/agent-worker-profile'
+import { git_gh_issue_write } from '#scripts/gh/git-gh-issue-write'
+import { issue_cite } from '#scripts/issue/issue-cite'
+import { NEEDS_DECISION_LABEL } from '#scripts/issue/issue-labels'
+import { issue_park } from '#scripts/issue/issue-park'
+
+// joshuafolkken/kit#7357: a worker's escalation park (joshuafolkken/kit#7356) resumes the same lane one
+// `josh.worker` profile up. The Issue's `worker:<name>` label moves to the next profile, so the
+// re-dispatch resolves it and records it in the lane's `.env`, and every later resume keeps it. At the
+// top profile the Issue goes to a person. A repository without `josh.worker.escalate` is left as before.
+
+interface EscalatePorts {
+	labels: () => Promise<ReadonlyArray<string> | undefined>
+	retry: (issue: number) => Promise<void>
+}
+
+interface Move {
+	from: WorkerProfile
+	to: WorkerProfile
+}
+
+function label_of(worker: WorkerProfile): string {
+	return `${agent_worker_profile.LABEL_PREFIX}${worker.name}`
+}
+
+function enabled_settings(directory: string): WorkerSettings | undefined {
+	const result = agent_worker_profile.read(directory)
+	if (result.kind !== 'settings') return undefined
+
+	return result.settings.escalate ? result.settings : undefined
+}
+
+async function current_worker(
+	settings: WorkerSettings,
+	read_labels: EscalatePorts['labels'],
+): Promise<WorkerProfile | undefined> {
+	const labels = await read_labels()
+	if (labels === undefined) return undefined
+	const result = agent_worker_profile.for_labels(settings, labels)
+
+	return result.kind === 'worker' ? result.worker : undefined
+}
+
+// The new label goes on before the old one comes off: a failure in between leaves two `worker:` labels,
+// which the dispatch refuses, never a lane resumed on the old profile.
+async function relabel(issue: string, move: Move): Promise<boolean> {
+	if (!(await git_gh_issue_write.issue_add_label(issue, label_of(move.to)))) return false
+
+	return await git_gh_issue_write.issue_clear_label(issue, label_of(move.from))
+}
+
+function agent_of(worker: WorkerProfile): string {
+	return `${worker.agent.model} / ${worker.agent.effort}`
+}
+
+function step_note(move: Move, reason: string): string {
+	return [
+		`Escalated the worker from \`${label_of(move.from)}\` (${agent_of(move.from)}) to \`${label_of(move.to)}\` (${agent_of(move.to)}); the lane resumes in the same worktree.`,
+		`- Reason: ${reason}`,
+	].join('\n')
+}
+
+async function step_up(
+	issue: number,
+	move: Move,
+	reason: string,
+	retry: EscalatePorts['retry'],
+): Promise<void> {
+	if (!(await relabel(String(issue), move))) {
+		console.error(
+			`Could not move ${issue_cite.plain_for('program', issue)} to ${label_of(move.to)}. Left for a person.`,
+		)
+
+		return
+	}
+
+	await git_gh_issue_write.issue_try_comment(String(issue), step_note(move, reason))
+	await retry(issue)
+}
+
+function top_note(top: WorkerProfile, reason: string): string {
+	return [
+		`Parked with \`${NEEDS_DECISION_LABEL}\`: the worker asked for a stronger profile, but \`${label_of(top)}\` is the top of josh.worker.profiles.`,
+		`- Reason: ${reason}`,
+		'- Next: a person decides how to go on.',
+	].join('\n')
+}
+
+async function hand_over(issue: number, top: WorkerProfile, reason: string): Promise<void> {
+	await issue_park.apply(String(issue), NEEDS_DECISION_LABEL, top_note(top, reason))
+}
+
+// The settings are read before the labels, so a repository without escalation costs no GitHub read.
+async function escalate(
+	issue: number,
+	reason: string,
+	ports: EscalatePorts,
+	directory = process.cwd(),
+): Promise<void> {
+	const settings = enabled_settings(directory)
+	if (settings === undefined) return
+	const from = await current_worker(settings, ports.labels)
+	if (from === undefined) return
+	const to = agent_worker_profile.next(settings, from)
+
+	await (to === undefined
+		? hand_over(issue, from, reason)
+		: step_up(issue, { from, to }, reason, ports.retry))
+}
+
+export const backlog_drive_escalate = { escalate }

package/scripts/backlog/backlog-drive-stalled-retry.ts

@@ -19,6 +19,7 @@ import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
 import { run_stalled } from '#scripts/run/park/run-stalled'
 import { run_ship_stage } from '#scripts/run/ship/run-ship-stage'
 import { backlog_budget } from './backlog-budget'
+import { backlog_drive_escalate } from './backlog-drive-escalate'
 import { backlog_drive_retry } from './backlog-drive-retry'
 import { backlog_yield_cap } from './backlog-yield-cap'
 
@@ -26,11 +27,13 @@ import { backlog_yield_cap } from './backlog-yield-cap'
 // park whose check shows its cause gone — through `run:add --retry`, at most `RETRY_CAP` times per
 // issue, counted off the whole stream so a restarted drive counts the retries before it. A recorded
 // ship stop is checked by its stage; a park with no stop by its cause: `run:merge`'s three wait for the
-// next sweep, a yield-cap park for its window. Any other park, or a protected label, stays for a person;
+// next sweep, a yield-cap park for its window. A worker's escalation park is resumed one `josh.worker`
+// profile up (`backlog-drive-escalate.ts`). Any other park, or a protected label, stays for a person;
 // one at the cap is restated once with `CAP_NOTE` and its cause, which its board row shows.
 
 const RETRY_CAP = 2
 const CAP_NOTE = `auto-retry cap ${String(RETRY_CAP)} reached`
+const RESUME_REFUSED = 'escalated one profile up, but run:add refused the resume'
 const { PARK } = run_event_stream.EVENT_KIND
 const last_sweep = { at: -Infinity }
 
@@ -95,19 +98,23 @@ function latest_parks(events: ReadonlyArray<RunEvent>): ReadonlyMap<number, RunE
 	return parks
 }
 
-// Still open, still `run:stalled` and free of a protected label `run:add` would refuse. An issue that
-// cannot be read is not re-offered.
-async function is_still_stalled(issue: number): Promise<boolean> {
+// The labels of an issue still open, still `run:stalled` and free of a protected label `run:add` would
+// refuse, else `undefined`. An issue that cannot be read is not re-offered.
+async function stalled_labels(issue: number): Promise<ReadonlyArray<string> | undefined> {
 	const read = await run_add_issue.read(issue)
 
-	if (read === undefined) return false
+	if (read === undefined) return undefined
 	const labels = epic_issue.label_names(read)
-
-	return (
+	const is_stalled =
 		epic_issue.is_open(read.state) &&
 		has_label_name(labels, RUN_STALLED_LABEL) &&
 		run_add.protected_label(labels) === undefined
-	)
+
+	return is_stalled ? labels : undefined
+}
+
+async function is_still_stalled(issue: number): Promise<boolean> {
+	return (await stalled_labels(issue)) !== undefined
 }
 
 // The check a park's recorded stop has, or with no stop its cause; none for a stage or cause with no
@@ -137,14 +144,18 @@ async function note_cap(issue: number, park: RunEvent): Promise<void> {
 
 // A refused `run:add` (a settled or withdrawn issue, an unreadable lane, a failed label write) leaves the
 // park for a person instead of ending the drive.
-async function retry_cleared(issue: number): Promise<void> {
+async function retry_cleared(issue: number): Promise<boolean> {
 	try {
 		await backlog_drive_retry.add_retry(
 			issue,
 			`${issue_cite.plain_for('program', issue)} automatically`,
 		)
+
+		return true
 	} catch (error) {
 		console.error(`${String(error)} Left for a person.`)
+
+		return false
 	}
 }
 
@@ -170,6 +181,33 @@ async function retry_park(issue: number, park: RunEvent, context: SweepContext):
 	await (is_capped ? note_cap(issue, park) : retry_cleared(issue))
 }
 
+function is_escalation(park: RunEvent): boolean {
+	const cause = run_stalled.cause_in(park.text) ?? ''
+
+	return run_stalled.class_of(cause) === run_stalled.ESCALATION_REQUESTED.short
+}
+
+// A refused resume restates the park with a cause of its own, so the next sweep does not read the
+// escalation again and step the already moved label up a second time.
+async function resume_escalated(issue: number): Promise<void> {
+	if (await retry_cleared(issue)) return
+
+	await run_event_stream_emit.emit(PARK, run_stalled.park_event(issue, RESUME_REFUSED))
+}
+
+// A worker's escalation is not retried on its profile but resumed one up (joshuafolkken/kit#7357);
+// the retry cap does not count it, since the profile order bounds it.
+async function escalate_park(issue: number, park: RunEvent): Promise<void> {
+	await backlog_drive_escalate.escalate(issue, run_stalled.cause_in(park.text) ?? '', {
+		labels: async () => await stalled_labels(issue),
+		retry: resume_escalated,
+	})
+}
+
+async function settle_park(issue: number, park: RunEvent, context: SweepContext): Promise<void> {
+	await (is_escalation(park) ? escalate_park(issue, park) : retry_park(issue, park, context))
+}
+
 async function retry_all(
 	parks: ReadonlyArray<[number, RunEvent]>,
 	context: SweepContext,
@@ -177,7 +215,7 @@ async function retry_all(
 	const [first, ...rest] = parks
 
 	if (first === undefined) return
-	await retry_park(first[0], first[1], context)
+	await settle_park(first[0], first[1], context)
 	await retry_all(rest, context)
 }
 

package/scripts/document/document-scan.ts

@@ -6,6 +6,13 @@
 // would otherwise read "will" as a command name.
 const COMMAND_PATTERN = /`(?:pnpm )?josh ([a-z][a-z0-9:-]+)/gu
 
+// A flag a command reference passes — `` `pnpm josh ship --detach` `` — read up to the next shell
+// separator, so a flag of a chained command is not read as this command's (#7331).
+const CODE_SPAN_PATTERN = /`([^`\n]+)`/gu
+const COMMAND_SEPARATOR_PATTERN = /&&|\|\||[|;]/u
+const INVOCATION_PATTERN = /\bjosh ([a-z][a-z0-9:-]+)/u
+const FLAG_PATTERN = /(?<![\w-])--[a-z][a-z0-9-]*/gu
+
 // A label the documents operate on — applied (`labels[]=…`), removed (`…/labels/<name>`) or created
 // (`labels -f name=…`). Prose that merely names a label is not scanned; a mistyped name only breaks
 // where a command carries it.
@@ -54,6 +61,26 @@ function command_references(text: string): Array<string> {
 		.filter((name) => !name.endsWith(':'))
 }
 
+// The long flags a text spells, without a `=value`: `--shard=<n>` reads as `--shard`.
+function flag_names(text: string): Array<string> {
+	return text.match(FLAG_PATTERN) ?? []
+}
+
+function invocation_flags(segment: string): Array<FlagReference> {
+	const match = INVOCATION_PATTERN.exec(segment)
+	if (match === null) return []
+	const [invocation, command = ''] = match
+	const rest = segment.slice(match.index + invocation.length)
+
+	return flag_names(rest).map((flag) => ({ command, flag }))
+}
+
+function command_flag_references(text: string): Array<FlagReference> {
+	return matches(text, CODE_SPAN_PATTERN)
+		.flatMap((span) => (span[1] ?? '').split(COMMAND_SEPARATOR_PATTERN))
+		.flatMap((segment) => invocation_flags(segment))
+}
+
 // A `<placeholder>` inside a command, and `label:<n>` after the char class stops at `<`, both leave a
 // token that is not a real label. Real labels never end in a colon and never carry angle brackets.
 function is_real_label(token: string): boolean {
@@ -79,6 +106,11 @@ interface SectionReference {
 	heading: string
 }
 
+interface FlagReference {
+	command: string
+	flag: string
+}
+
 function section_references(text: string): Array<SectionReference> {
 	return matches(text.replaceAll(LINK_TARGET_PATTERN, ''), SECTION_PATTERN)
 		.map(({ groups }) => ({ file: groups?.['file'] ?? '', heading: groups?.['heading'] ?? '' }))
@@ -127,7 +159,9 @@ function reference_forms(title: string): Array<string> {
 const document_scan = {
 	adjacent_references,
 	bare_arrow_references,
+	command_flag_references,
 	command_references,
+	flag_names,
 	label_references,
 	link_targets,
 	normalize_reference,
@@ -135,5 +169,5 @@ const document_scan = {
 	section_references,
 }
 
-export type { SectionReference }
+export type { FlagReference, SectionReference }
 export { document_scan }

package/scripts/gh/git-pr-checks-failed.ts

@@ -0,0 +1,24 @@
+import { FAILURE_REASON_CHECKS } from './git-pr-checks-eval'
+
+// The check names a failed checks wait reported — `git-pr-checks-eval.ts`'s `PR checks failed
+// (failed checks: <a>, <b>; …).` — read back by `josh lane:why` from a ship log and by `josh ship` into
+// a followup `check` stop's record (joshuafolkken/kit#7333). The list ends at the next reason or the
+// closing `).`, so a matrix name such as `Unit Tests (3/6)` stays whole.
+
+const FAILED_CHECKS = new RegExp(
+	String.raw`${FAILURE_REASON_CHECKS}: (?<names>.+?)(?=; |\)\.$)`,
+	'gmu',
+)
+const NAME_SEPARATOR = ', '
+
+// Every check name `text` lists as failed, in order, each list read whole.
+function names_of(text: string): Array<string> {
+	return [...text.matchAll(FAILED_CHECKS)]
+		.flatMap((match) => (match.groups?.['names'] ?? '').split(NAME_SEPARATOR))
+		.map((name) => name.trim())
+		.filter((name) => name !== '')
+}
+
+const git_pr_checks_failed = { names_of }
+
+export { git_pr_checks_failed }

package/scripts/hooks/implementation-shell-deny-expansion.ts

@@ -0,0 +1,20 @@
+// What every consultation-scope refusal group shares (joshuafolkken/kit#6586): the refusal's shape and
+// the word the shell expands before the call, which may spell any write.
+
+type Refusal = string | undefined
+
+// A word the shell expands before the call, so it may spell any subcommand or flag.
+const DYNAMIC = /[$`]/u
+
+function is_dynamic(word: string): boolean {
+	return DYNAMIC.test(word)
+}
+
+function refusal(program: string, word: string): string {
+	return `\`${program} ${word}\`, an expansion that may spell a write`
+}
+
+const implementation_shell_deny_expansion = { is_dynamic, refusal }
+
+export { implementation_shell_deny_expansion }
+export type { Refusal }

package/scripts/hooks/implementation-shell-deny-git.ts

@@ -0,0 +1,128 @@
+import { git_argv } from '#scripts/rules/git-argv'
+import {
+	implementation_shell_deny_expansion as expansion,
+	type Refusal,
+} from './implementation-shell-deny-expansion'
+
+// The git calls a consultation scope refuses before execution (joshuafolkken/kit#6586).
+
+// Subcommands that move a ref, the index, the worktree or the shared stash in every spelling.
+const GIT_WRITES: ReadonlySet<string> = new Set([
+	'add',
+	'am',
+	'apply',
+	'bisect',
+	'checkout',
+	'checkout-index',
+	'cherry-pick',
+	'clean',
+	'commit',
+	'credential',
+	'fetch',
+	'filter-branch',
+	'gc',
+	'init',
+	'maintenance',
+	'merge',
+	'mv',
+	'pack-refs',
+	'prune',
+	'prune-packed',
+	'pull',
+	'push',
+	'read-tree',
+	'rebase',
+	'repack',
+	'replace',
+	'reset',
+	'restore',
+	'revert',
+	'rm',
+	'send-email',
+	'sparse-checkout',
+	'stage',
+	'submodule',
+	'switch',
+	'symbolic-ref',
+	'update-index',
+	'update-ref',
+])
+const BRANCH_CHANGE =
+	/^--(?:delete|move|copy|force|set-upstream-to|unset-upstream|edit-description)/u
+const BRANCH_CHANGE_LETTERS = 'dDmMcCfu'
+const CONFIG_READ = /^(?:--get|--list$|-l$)/u
+// The flags that put `git branch` / `git tag` in list mode, where a name is a pattern, not a new ref.
+const LIST_MODE =
+	/^(?:-l$|--list$|-n\d*$|--contains|--no-contains|--points-at|--merged|--no-merged)/u
+// List flags whose value is the next word, so the value is not read as a new ref's name.
+const LIST_VALUE_FLAGS: ReadonlySet<string> = new Set(['--sort', '--format'])
+const REFLOG_WRITES: ReadonlySet<string> = new Set(['expire', 'delete'])
+// A global that rewrites git's configuration or launcher, or an option that writes a file or runs one.
+const GIT_WRITE_FLAGS = /^-c$|^--(?:config-env|exec-path|output|ext-diff|textconv)/u
+const QUOTES = /['"\\]/gu
+
+function is_branch_change(argument: string): boolean {
+	return BRANCH_CHANGE.test(argument) || git_argv.short_cluster_has(argument, BRANCH_CHANGE_LETTERS)
+}
+
+function names_a_reference(args: ReadonlyArray<string>): boolean {
+	return args.some(
+		(argument, index) => !argument.startsWith('-') && !LIST_VALUE_FLAGS.has(args[index - 1] ?? ''),
+	)
+}
+
+// `git branch` / `git tag` only list when no word names a new ref, or a flag puts them in list mode.
+function is_listing(args: ReadonlyArray<string>): boolean {
+	return !names_a_reference(args) || args.some((argument) => LIST_MODE.test(argument))
+}
+
+// Subcommands with a read spelling: the predicate says whether the arguments only read.
+const GIT_READ_FORMS: ReadonlyMap<string, (args: ReadonlyArray<string>) => boolean> = new Map([
+	['branch', (args) => is_listing(args) && args.every((argument) => !is_branch_change(argument))],
+	['stash', (args) => ['list', 'show'].includes(args[0] ?? '')],
+	['worktree', (args) => args[0] === 'list'],
+	['notes', (args) => ['list', 'show'].includes(args[0] ?? '')],
+	['remote', (args) => ['', '-v', 'show', 'get-url'].includes(args[0] ?? '')],
+	['config', (args) => args.some((argument) => CONFIG_READ.test(argument))],
+	['tag', is_listing],
+	['reflog', (args) => !REFLOG_WRITES.has(args[0] ?? '')],
+])
+
+// A read spelling holds only when every argument is literal: an expanded one may be `-D` or `expire`.
+function is_git_write(subcommand: string, args: ReadonlyArray<string>): boolean {
+	if (GIT_WRITES.has(subcommand)) return true
+
+	const read_form = GIT_READ_FORMS.get(subcommand)
+	if (read_form === undefined) return false
+
+	return args.some((argument) => expansion.is_dynamic(argument)) || !read_form(args)
+}
+
+// A quoted program runs as the bare one: `"git" push` is `git push`.
+function parsed_git(segment: string): ReturnType<typeof git_argv.parse> {
+	return git_argv.parse(segment) ?? git_argv.parse(segment.replaceAll(QUOTES, ''))
+}
+
+// A quoted subcommand runs as the bare one too: `git 'push'` is `git push`.
+function subcommand_refusal(segment: string): Refusal {
+	const call = parsed_git(segment)
+	if (call?.subcommand === undefined) return undefined
+	if (expansion.is_dynamic(call.subcommand)) return expansion.refusal('git', call.subcommand)
+
+	const subcommand = call.subcommand.replaceAll(QUOTES, '')
+	const args = call.args.map((argument) => argument.replaceAll(QUOTES, ''))
+
+	return is_git_write(subcommand, args) ? `\`git ${subcommand}\`, a git write` : undefined
+}
+
+function refusal(segment: string, args: ReadonlyArray<string>): Refusal {
+	if (args.some((argument) => GIT_WRITE_FLAGS.test(argument))) {
+		return 'a git option that rewrites its configuration, runs a program or writes a file'
+	}
+
+	return subcommand_refusal(segment)
+}
+
+const implementation_shell_deny_git = { refusal }
+
+export { implementation_shell_deny_git }