@juzser/blacksmith 0.3.0 → 0.5.0

package/factory/orchestrator/dist/policy.js

@@ -365,7 +365,14 @@ function gitTokens(segment, word) {
 function isProtectedRef(ref, policy) {
     return policy.protectedBranchNames.some((name) => ref === name || ref.endsWith(`:${name}`) || ref.endsWith(`:refs/heads/${name}`));
 }
-function isProtectedBranchName(branch, policy) {
+/**
+ * Exported so `hookDecision.ts` can tell, on the rule-3 fallback path,
+ * whether a directory the command named is itself protected — the
+ * difference between "the fallback found nowhere safe to land" (old reason
+ * stands) and "the fallback denied cwd, but the named directory would have
+ * been fine" (the reason needs to say so).
+ */
+export function isProtectedBranchName(branch, policy) {
     return policy.protectedBranchNames.includes(branch);
 }
 /**
@@ -662,14 +669,762 @@ function checkPushToProtected(command, branch, policy) {
     }
     return null;
 }
-/** Rule 2: force push (`--force` / `--force-with-lease` / `-f`). Case-sensitive, same as guard.sh (its `grep -Eq` has no `-i`). */
-const FORCE_PUSH_RE = /(--force(-with-lease)?\b|(^|\s)-[a-zA-Z]*f[a-zA-Z]*(\s|$))/;
-function checkForcePush(command, policy) {
-    if (!isGitSubcommand(command, 'push'))
+/**
+ * Rule 2: force push (`--force` / `--force-with-lease` / `-f` / `--mirror`).
+ * Case-sensitive, same as guard.sh (its `grep -Eq` has no `-i`).
+ * `--force-if-includes` is already covered: it contains `--force` as a
+ * prefix, and `\b` stops at the `-` that follows. `--mirror` shares nothing
+ * with `--force`, so it needs its own alternative — a mirror push writes
+ * every ref on the remote to match the local one, which is a force push on
+ * every branch at once.
+ */
+const FORCE_PUSH_RE = /(--force(-with-lease)?\b|--mirror\b|(^|\s)-[a-zA-Z]*f[a-zA-Z]*(\s|$))/;
+const GIT_PUSH_ANYWHERE_RE = new RegExp(`\\bgit\\b[\\s\\S]*${bareWord('push')}`, 'i');
+/**
+ * `$'...'` — bash's ANSI-C quoting — is decoded to real bytes before git (or
+ * anything else) ever sees it: `\x2d` is `-`, `\146` is `f`, `\x70ush` is
+ * `push`. A rule that scans the raw command text for `--force` or `push`
+ * never finds either spelled this way, so every regex rule 2 runs is run
+ * against this decoded reading instead of the raw segment.
+ *
+ * Only the escapes bash's own `$'...'` grammar defines are decoded: `\xHH`
+ * hex, `\NNN` octal (1-3 digits), `\uHHHH` / `\UHHHHHHHH` Unicode, and the
+ * single-letter escapes (`\n`, `\t`, `\\`, `\'`, `\"`, …). Anything else
+ * inside the quotes is copied through unchanged — under-decoding only
+ * leaves an escape sequence looking like itself, never invents a character
+ * that helps an evasion.
+ */
+const ANSI_C_ESCAPE_RE = /\\(x[0-9a-fA-F]{1,2}|u[0-9a-fA-F]{1,4}|U[0-9a-fA-F]{1,8}|[0-7]{1,3}|n|t|r|a|b|f|v|e|E|\\|'|")/g;
+function decodeAnsiCPayload(payload) {
+    return payload.replace(ANSI_C_ESCAPE_RE, (_match, esc) => {
+        switch (esc[0]) {
+            case 'x':
+            case 'u':
+            case 'U':
+                return String.fromCodePoint(Number.parseInt(esc.slice(1), 16));
+            case 'n':
+                return '\n';
+            case 't':
+                return '\t';
+            case 'r':
+                return '\r';
+            case 'a':
+                return '\x07';
+            case 'b':
+                return '\b';
+            case 'f':
+                return '\f';
+            case 'v':
+                return '\v';
+            case 'e':
+            case 'E':
+                return '\x1b';
+            case '\\':
+                return '\\';
+            case "'":
+                return "'";
+            case '"':
+                return '"';
+            default:
+                // Only octal digits reach here (the `[0-7]{1,3}` branch).
+                return String.fromCharCode(Number.parseInt(esc, 8) & 0xff);
+        }
+    });
+}
+/**
+ * Finds the unescaped `'` that closes a `$'` span starting at `start` (the
+ * index right after the opening `$'`). A backslash inside the span escapes
+ * whatever follows it, including a `'`, so `\'` never ends the span early.
+ * Returns -1 when the span runs off the end of the segment unterminated.
+ */
+function findAnsiCQuoteEnd(text, start) {
+    let i = start;
+    while (i < text.length) {
+        if (text[i] === '\\') {
+            i += 2;
+            continue;
+        }
+        if (text[i] === "'")
+            return i;
+        i += 1;
+    }
+    return -1;
+}
+/**
+ * Replaces every `$'...'` span in a segment with its decoded content, so the
+ * rule-2 checks below read what git will actually receive rather than the
+ * quoted spelling. An unterminated span — no closing `'` before the segment
+ * ends — cannot be decoded with confidence; `unterminated` tells the caller
+ * to fail closed rather than silently reading past it.
+ */
+function decodeAnsiCQuoting(segment) {
+    let result = '';
+    let i = 0;
+    while (i < segment.length) {
+        if (segment[i] === '$' && segment[i + 1] === "'") {
+            const end = findAnsiCQuoteEnd(segment, i + 2);
+            if (end === -1)
+                return { text: result + segment.slice(i), unterminated: true };
+            result += decodeAnsiCPayload(segment.slice(i + 2, end));
+            i = end + 1;
+            continue;
+        }
+        result += segment[i];
+        i += 1;
+    }
+    return { text: result, unterminated: false };
+}
+/**
+ * Joins a shell line continuation — a backslash immediately followed by a
+ * newline — the way bash does before word splitting even starts: the pair
+ * is deleted outright, wherever it sits, including mid-word (`gi\`<LF>`t`)
+ * and inside double quotes, which is why `git` spelled with one hidden in
+ * the middle reads as `git` to every scanner below rather than as two
+ * fragments a literal-substring or exact-word match would miss.
+ *
+ * Two spans are left untouched because bash itself treats a backslash there
+ * differently: a single-quoted span is fully literal, so a backslash-newline
+ * pair inside it is data, not a continuation; and a `$'...'` span decodes its
+ * own escapes — `decodeAnsiCPayload` already reads a `\`-newline pair inside
+ * one through unchanged, so joining it here first would be a second, and
+ * conflicting, decode of the same text.
+ */
+function joinLineContinuations(command) {
+    let result = '';
+    let i = 0;
+    while (i < command.length) {
+        const c = command[i];
+        if (c === "'") {
+            const end = command.indexOf("'", i + 1);
+            const spanEnd = end === -1 ? command.length : end + 1;
+            result += command.slice(i, spanEnd);
+            i = spanEnd;
+            continue;
+        }
+        if (c === '$' && command[i + 1] === "'") {
+            const end = findAnsiCQuoteEnd(command, i + 2);
+            const spanEnd = end === -1 ? command.length : end + 1;
+            result += command.slice(i, spanEnd);
+            i = spanEnd;
+            continue;
+        }
+        if (c === '\\' && command[i + 1] === '\n') {
+            i += 2;
+            continue;
+        }
+        result += c;
+        i += 1;
+    }
+    return result;
+}
+/**
+ * Every way this segment could hand git an alias definition inline, without
+ * checking what the alias resolves to:
+ *
+ * - `-c` or `-c<nospace>` naming an `alias.` key, quoted or not
+ *   (`-c alias.p=`, `-calias.p=`, `-c 'alias.p=...'`).
+ * - `--config-env` naming an `alias.` key, whose value is the *name* of an
+ *   environment variable read later — never visible on this line at all.
+ * - `GIT_CONFIG_PARAMETERS`, git's own serialisation of a whole `-c` list,
+ *   assigned or exported.
+ * - A `GIT_CONFIG_KEY_<n>=` pair whose value is an `alias.` key, or is a
+ *   shell variable (`$V`, `${V}`) or command substitution (`` `cmd` ``,
+ *   `$(cmd)`) this scanner cannot resolve — read alongside a
+ *   `GIT_CONFIG_VALUE_<n>` this line may not even set.
+ *
+ * Issue #258's original fix denied an inline alias only when its value
+ * visibly mentioned `push`. That is not a question this line can always
+ * answer: the value can come from a shell variable, a named environment
+ * variable read later, or a `GIT_CONFIG_VALUE_<n>` set nowhere near the key.
+ * `git -c alias.st=status st` is refused for the same reason as everything
+ * else in this file errs the same direction — a rule that cannot always
+ * tell "harmless alias" from "force-push escape hatch" apart denies both,
+ * because the cost of the false deny is smaller than the cost of the hole.
+ */
+function definesInlineGitAlias(segment) {
+    if (/(^|\s)-c\s*['"]?alias\./i.test(segment))
+        return true;
+    if (/--config-env(=|\s+)['"]?alias\./i.test(segment))
+        return true;
+    if (/\bGIT_CONFIG_PARAMETERS\b/.test(segment))
+        return true;
+    if (/\bGIT_CONFIG_KEY_\d+=(['"]?)(alias\.|\$|`)/i.test(segment))
+        return true;
+    return false;
+}
+/**
+ * Quote removal is the last step of shell word expansion, and it glues
+ * whatever sat on either side of a quote pair into one word: `--for""ce`,
+ * `--for''ce` and `-"-"force` all reach git as `--force`, with no
+ * `--force` substring ever appearing in the raw command text a regex would
+ * scan. Stripping every quote character before the rule-2 checks run reads
+ * the segment the way git will — the same "read it the way the shell will"
+ * move the `$'...'` decode above and the `+refspec` backslash-strip below
+ * already make. Stripping can only pull characters together, never hide
+ * one, so it costs nothing a substring check over the raw text was not
+ * already blind to.
+ */
+function stripSpliceQuotes(text) {
+    return text.replace(/['"]/g, '');
+}
+/**
+ * A character the shell can still act on inside a word: an escape, a
+ * variable or command expansion, a brace list, or a glob. Three rounds of
+ * this rule chased individual tricks spelled with these characters — hex
+ * escapes, quote-splicing, brace expansion — one at a time, and each fix
+ * left the next spelling undetected. This is the fail-closed replacement:
+ * rather than keep enumerating tricks, refuse to read a word built from any
+ * of them at all.
+ */
+const SHELL_ACTIVE_CHAR_RE = /[\\$`{}*?[()<>!\n]/;
+/**
+ * True when `word` is exactly what it looks like to git: either free of
+ * every character the shell could still act on, or a single matching pair
+ * of quotes wrapped around such a word (`"feat"`, `'origin'` — the quotes
+ * themselves removed, nothing shell-active left inside). Anything else — a
+ * bare backslash, a `$`, a backtick, a brace, a glob character, or a quote
+ * that does not open and close the whole word — means this rule cannot read
+ * what git will actually receive, and it refuses rather than guess.
+ */
+function isPlainWord(word) {
+    if (word === '')
+        return true;
+    const quoted = word.length >= 2 &&
+        ((word.startsWith("'") && word.endsWith("'")) || (word.startsWith('"') && word.endsWith('"')));
+    const inner = quoted ? word.slice(1, -1) : word;
+    if (/['"]/.test(inner))
+        return false;
+    return !SHELL_ACTIVE_CHAR_RE.test(inner);
+}
+const PLAIN_WORD_REASON = 'write this git command with plain words — no quotes inside words, escapes, variables, braces or globs — so the guard can read exactly what git will receive';
+/**
+ * True when `word` is unreadable specifically because of an unexpanded
+ * shell expansion — a `$name` parameter, a `${...}` form, a `$(...)`
+ * command substitution, or a backtick span — rather than any other reason
+ * `isPlainWord` refuses a word (a bare glob, a stray `<`/`>`, an embedded
+ * newline). Rule 2 and rule 6 both recognise their command by its literal
+ * word (`git`, `rm`); this is their shared read of "that word's true value
+ * is unknowable here," narrowed to the expansion forms those two rules fail
+ * closed on rather than every non-plain word, so a path argument elsewhere
+ * in the same command — already its own, separately-read concern — is never
+ * what trips this.
+ */
+function isUnexpandedCommandWord(word) {
+    return !isPlainWord(word.raw) && /[$`]/.test(word.raw);
+}
+/** Subcommands the plain-word gate covers unconditionally. */
+const FORCE_GATE_SUBCOMMANDS = ['push', 'rebase', 'reset', 'filter-branch', 'update-ref'];
+const BRANCH_SHORT_FLAG_RE = /^-[a-zA-Z]+$/;
+/**
+ * `git branch` only rewrites or drops a ref when it forces or deletes one:
+ * `-D`, `-f`, `-M` or `--force`, bundled or spelled long. Plain `-d` (delete
+ * a merged branch) and `-m` (rename) are not covered — see the comment on
+ * `checkForcePush` for why a delete without force is let through unread.
+ */
+function isForcingBranchCommand(tokens) {
+    return tokens.some((token) => token === '--force' || (BRANCH_SHORT_FLAG_RE.test(token) && /[DfM]/.test(token)));
+}
+/**
+ * Same read as `gitTokens`, but bridges a real newline in the remainder —
+ * `gitTokens`' `(.*)$` cannot, since `.` does not match `\n` and `$` without
+ * a multiline flag only anchors at the true end of the string. A word split
+ * across a line-continuation backslash-newline (`--for\`<LF>`ce`) still
+ * needs to be read as two whitespace-joined pieces rather than dropped as no
+ * match at all. Local to the gate rather than a change to `gitTokens`
+ * itself, which rules 1 and 3 also read through.
+ */
+function wordsAfterSubcommand(text, subcommand) {
+    const match = new RegExp(`${bareWord(subcommand)}([\\s\\S]*)$`, 'i').exec(text);
+    if (!match)
+        return [];
+    return (match[1] ?? '')
+        .trim()
+        .split(/\s+/)
+        .filter((token) => token !== '');
+}
+/**
+ * `text` with every quoted span blanked to spaces of the same length, so a
+ * quoted phrase cannot be misread as a real subcommand invocation. `--command
+ * 'git push origin main'` and `git commit -m "... push origin main"` both
+ * hold that literal text, but neither one runs it — one is describing a
+ * command, the other is prose in a commit message. Lengths are preserved
+ * only so this stays a drop-in swap for `text` in a regex test; nothing here
+ * reads offsets.
+ */
+function blankQuotedSpans(text) {
+    return text.replace(/'[^']*'|"[^"]*"/g, (span) => ' '.repeat(span.length));
+}
+/**
+ * `text` with the reading the plain-word gate needs: quoted spans blanked
+ * (so a subcommand word only inside quotes is not "really" invoked) and
+ * redirections removed (so `git push origin main > /dev/null` is not read as
+ * having `>` and `/dev/null` for words). Used only to decide *whether* a
+ * segment is covered — word extraction itself still reads real text, quotes
+ * and all, through `isPlainWord`.
+ */
+function forceGateStructuralText(text) {
+    return stripRedirections(blankQuotedSpans(text));
+}
+/** Whether `text` reaches a git subcommand the plain-word gate must cover. */
+function isCoveredForcePushSegment(text) {
+    const structural = forceGateStructuralText(text);
+    if (FORCE_GATE_SUBCOMMANDS.some((subcommand) => isGitSubcommand(structural, subcommand))) {
+        return true;
+    }
+    return (isGitSubcommand(structural, 'branch') &&
+        isForcingBranchCommand(wordsAfterSubcommand(stripRedirections(text), 'branch')));
+}
+/** True when every word after a covered subcommand in `text` is plain. */
+function hasUnsafeWord(text) {
+    const structural = forceGateStructuralText(text);
+    const wordsText = stripRedirections(text);
+    for (const subcommand of FORCE_GATE_SUBCOMMANDS) {
+        if (!isGitSubcommand(structural, subcommand))
+            continue;
+        if (wordsAfterSubcommand(wordsText, subcommand).some((token) => !isPlainWord(token)))
+            return true;
+    }
+    if (isGitSubcommand(structural, 'branch')) {
+        const tokens = wordsAfterSubcommand(wordsText, 'branch');
+        if (isForcingBranchCommand(tokens) && tokens.some((token) => !isPlainWord(token)))
+            return true;
+    }
+    return false;
+}
+const EVAL_RE = /\beval\b/;
+const SHELL_C_WRAPPER_RE = /\b(sh|bash|zsh|env)\b[^;&|]*-c\b/;
+const FORCE_GATE_WORD_RE = /\b(push|rebase|reset|filter-branch|update-ref)\b/i;
+/**
+ * The dequoted payload of a segment wrapped in `eval`, or a `-c` string
+ * handed to `sh`/`bash`/`zsh`/`env` — or `null` when `segment` is not one of
+ * those wrappers at all, so a caller never mistakes "nothing to unwrap" for
+ * an empty payload. Quotes and backslashes are stripped from the *whole*
+ * segment, wrapper prefix included (`bash -c 'git rese""t --hard $(x)'`
+ * names `git` and a spliced `reset` only once they're gone), which is also
+ * why the result still reads correctly as one text to scan rather than an
+ * isolated inner string. Shared so rule 2's and rule 6's own unexpanded-word
+ * checks below read a nested shell's payload the same way
+ * `isShellWrappedForceCandidate` and `checkUnboundedRm`'s wrapped-`rm` pass
+ * already do, instead of a fourth copy of the same two lines.
+ */
+function dequoteShellWrappedSegment(segment) {
+    if (!EVAL_RE.test(segment) && !SHELL_C_WRAPPER_RE.test(segment))
+        return null;
+    // A line continuation is dropped outright, not just its backslash — rule
+    // 6's callers (`hasUnknownRemovalCommandWord`, `shellWrappedRmPayload`)
+    // reach this on a segment `joinLineContinuations` never ran over, so a
+    // bare `.replace(/\\/g, '')` would leave the newline behind and still
+    // split a flag cluster it glues back together (`-r\<LF>f` → `-r`, `<LF>`,
+    // `f` instead of `-rf`).
+    return stripSpliceQuotes(segment).replace(/\\\n/g, '').replace(/\\/g, '');
+}
+/**
+ * `eval`, or a `-c` string handed to `sh`/`bash`/`zsh`/`env`, passes a whole
+ * second command line to another shell to parse — a second chance for any
+ * trick above to hide inside a string this rule would otherwise read as
+ * inert text, without this scanner ever parsing the nested line itself.
+ * Simplest fail-closed read: a segment naming one of those wrappers
+ * alongside `git` and force-push-shaped subcommand text is refused outright,
+ * rather than trusted to be read correctly.
+ */
+function isShellWrappedForceCandidate(segment) {
+    const dequoted = dequoteShellWrappedSegment(segment);
+    if (dequoted === null)
+        return false;
+    return /\bgit\b/i.test(dequoted) && FORCE_GATE_WORD_RE.test(dequoted);
+}
+function splitDequotedWords(segment) {
+    const words = [];
+    let raw = '';
+    let text = '';
+    let inWord = false;
+    const flush = () => {
+        if (inWord)
+            words.push({ raw, text });
+        raw = '';
+        text = '';
+        inWord = false;
+    };
+    let i = 0;
+    while (i < segment.length) {
+        const c = segment.charAt(i);
+        if (c === "'") {
+            inWord = true;
+            raw += c;
+            i += 1;
+            while (i < segment.length && segment.charAt(i) !== "'") {
+                raw += segment.charAt(i);
+                text += segment.charAt(i);
+                i += 1;
+            }
+            if (i < segment.length) {
+                raw += segment.charAt(i);
+                i += 1;
+            }
+            continue;
+        }
+        if (c === '"') {
+            inWord = true;
+            raw += c;
+            i += 1;
+            while (i < segment.length && segment.charAt(i) !== '"') {
+                if (segment.charAt(i) === '\\' && i + 1 < segment.length) {
+                    const escaped = segment.charAt(i + 1);
+                    raw += segment.charAt(i) + escaped;
+                    // A backslash-newline is a line continuation, deleted outright —
+                    // not a character the word's text carries, the same join
+                    // `joinLineContinuations` already does ahead of the callers that
+                    // run it first. This branch also reads segments nothing joins
+                    // first (rule 6's unjoined paths), so it has to hold on its own.
+                    if (escaped !== '\n')
+                        text += escaped;
+                    i += 2;
+                }
+                else {
+                    raw += segment.charAt(i);
+                    text += segment.charAt(i);
+                    i += 1;
+                }
+            }
+            if (i < segment.length) {
+                raw += segment.charAt(i);
+                i += 1;
+            }
+            continue;
+        }
+        if (c === '\\' && i + 1 < segment.length) {
+            const escaped = segment.charAt(i + 1);
+            raw += c + escaped;
+            // A line continuation alone starts nothing: `inWord` stays whatever
+            // it already was, so a bare `\`-newline sitting between two real
+            // words never pushes an empty word between them. Mid-word (`-r\<LF>f`)
+            // `inWord` is already true from the characters before it, so this is
+            // a no-op there — the flag cluster still comes out joined as `-rf`.
+            if (escaped === '\n') {
+                i += 2;
+                continue;
+            }
+            inWord = true;
+            text += escaped;
+            i += 2;
+            continue;
+        }
+        if (/\s/.test(c)) {
+            flush();
+            i += 1;
+            continue;
+        }
+        inWord = true;
+        raw += c;
+        text += c;
+        i += 1;
+    }
+    flush();
+    return words;
+}
+/** `git` global options that spend the *next* word on a value rather than folding it in with `=`, enough to walk past them to the subcommand. */
+const GIT_GLOBAL_VALUE_FLAGS = new Set([
+    '-C',
+    '-c',
+    '--git-dir',
+    '--work-tree',
+    '--namespace',
+    '--exec-path',
+    '--config-env',
+]);
+/** The subcommand word of a `git` invocation found at `words[gitIndex]`, walking past global options the way `git` itself does. */
+function gitSubcommandWord(words, gitIndex) {
+    let i = gitIndex + 1;
+    while (i < words.length) {
+        const word = words[i];
+        if (word === undefined)
+            break;
+        if (word.text.startsWith('-')) {
+            i += GIT_GLOBAL_VALUE_FLAGS.has(word.text) ? 2 : 1;
+            continue;
+        }
+        return i;
+    }
+    return -1;
+}
+const SUBCOMMAND_NOT_PLAIN_REASON = 'the git subcommand is not written as a plain word, so the guard cannot tell what it runs — write it out plainly';
+const UNKNOWN_COMMAND_WORD_REASON = 'the command word here is an unexpanded parameter or substitution, so the guard cannot tell what it runs — write it out plainly';
+/**
+ * Rule 2's gap once some word of the segment is unreadable: neither the
+ * exact `git` match above nor its `hidden` fallback (which still needs the
+ * dequoted text to end in "git") can place a word that only resolves to
+ * `git` once a shell expands `$G`, `$(...)` or a backtick span — this file
+ * never evaluates one of those. So when any word of the segment is
+ * unreadable this way (`isUnexpandedCommandWord`), the rest of it is read
+ * for the shape rule 2 already guards against on a recognised push: a
+ * `push` word together with a force flag (`FORCE_PUSH_RE`, the same test
+ * the raw-text fallback below uses) or a `+refspec` operand
+ * (`pushOperands`, the same read rule 1 uses for a push's destination).
+ * Resolving the expansion itself is out of scope — an open-ended evaluator
+ * is the wrong tool — so this is shape only, same as rule 6's analogue.
+ *
+ * Every word is scanned, not just the one in command position: a wrapper
+ * (`sudo`, `env`, `timeout 5`, `xargs`, a bare `VAR=val` prefix, …), a group
+ * (`( … )`), or a keyword (`{ … }`, `if … then … fi`) can all sit in front
+ * of the unreadable word without moving it out of the segment, and an
+ * open-ended wrapper list would miss whichever one is not on it. No
+ * allowlist narrows this scan the way rule 6's does: a `push` word plus a
+ * force flag or `+refspec` is never the shape of an everyday command, so
+ * there is no ordinary first word to carve an exception for.
+ *
+ * Also checked against the segment's dequoted payload when it is a nested
+ * shell (`sh -c '…'`, `bash -c "…"`, `eval '…'`): `splitDequotedWords` keeps
+ * a quoted span's internal text as one word, which can hide a `-f` token or
+ * even the `push` word itself inside it until the quotes are gone.
+ */
+function isUnknownForcePushShape(segment) {
+    const words = splitDequotedWords(segment);
+    if (!words.some((word) => isUnexpandedCommandWord(word)))
+        return false;
+    if (!new RegExp(bareWord('push'), 'i').test(segment))
+        return false;
+    if (FORCE_PUSH_RE.test(segment))
+        return true;
+    return pushOperands(segment).some((ref) => ref.replace(/\\/g, '').startsWith('+'));
+}
+function hasUnknownForcePushCommandWord(segment) {
+    if (isUnknownForcePushShape(segment))
+        return true;
+    const wrapped = dequoteShellWrappedSegment(segment);
+    return wrapped !== null && isUnknownForcePushShape(wrapped);
+}
+/**
+ * Round 6's fix for a subcommand word the shell will glue back together
+ * before git ever sees it — quote-splicing (`rese""t`), a stray backslash
+ * (`p\ush`, `\git`) or an expansion (`upd${x}ate-ref`) — none of which
+ * `isCoveredForcePushSegment` can see, since it matches a literal substring
+ * against text that still holds the quotes and backslashes. This reads the
+ * segment as shell words instead: find the actual `git` word (whatever
+ * wrapper precedes it — this needs no wrapper list, since it is looking for
+ * `git` itself, not what comes before it), walk to its subcommand, and
+ * refuse outright if that word cannot be read plainly — not just when it
+ * happens to name a covered subcommand, since a word this unreadable could
+ * be any of them. A subcommand read plainly and found covered still needs
+ * every word after it plain, the same gate `hasUnsafeWord` already applies.
+ *
+ * The scan covers every word of the segment rather than stopping at the
+ * first one that is not a recognised wrapper: a wrapper list is open-ended
+ * (`sudo`, `env`, `time`, `timeout`, `nice`, `nohup`, `xargs`, `stdbuf`,
+ * `ionice`, `command`, `exec`, a bare `VAR=val` prefix, and whatever the
+ * next one is), so stopping early would miss a disguised `git` sitting
+ * right after a wrapper this function does not recognise. `echo g\it` being
+ * refused along with it is accepted — fail-closed over precise.
+ */
+function checkForcePushSubcommandWord(segment, rule) {
+    const words = splitDequotedWords(stripRedirections(segment));
+    const gitIndex = words.findIndex((word) => word.text.toLowerCase() === 'git');
+    if (gitIndex === -1) {
+        // Defence in depth for `joinLineContinuations` missing a spelling of its
+        // own: a word whose dequoted text is not exactly `git` can still resolve
+        // to it once the stray literal newline a shell trick left behind (not a
+        // real word break — bash lets a quoted span carry a raw newline with no
+        // backslash, which `joinLineContinuations` never touches) is stripped
+        // out. Such a word is never plain — `isPlainWord` already refuses a bare
+        // backslash or an embedded newline — so this only fires for a raw form
+        // this rule could not read anyway; refuse it rather than silently pass
+        // through. Only the newline itself is stripped, not every whitespace
+        // character: an ordinary quoted argument can legitimately contain plain
+        // spaces (a PR title, a commit message), and squeezing those out too
+        // reads an innocent word ending in "...ing it" as ending in "git" —
+        // issue #273.
+        const hidden = words.some((word) => word.text.toLowerCase() !== 'git' &&
+            !isPlainWord(word.raw) &&
+            word.text.replace(/\r?\n/g, '').toLowerCase().endsWith('git'));
+        if (hidden)
+            return violation(rule, SUBCOMMAND_NOT_PLAIN_REASON);
+        if (hasUnknownForcePushCommandWord(stripRedirections(segment))) {
+            return violation(rule, UNKNOWN_COMMAND_WORD_REASON);
+        }
         return null;
-    if (!FORCE_PUSH_RE.test(command))
+    }
+    // The `git` word itself, found above by its *dequoted* text, still needs
+    // its raw spelling checked: a backslash inside it (`g\it`, `gi\t`) dequotes
+    // to exactly `git` and so is found here, but it also breaks the literal
+    // `\bgit\b` substring every raw-text check in this file scans for —
+    // `GIT_PUSH_ANYWHERE_RE` chief among them, and, outside this file,
+    // `isGitSubcommand`, which rules 1 (push-to-protected), 3
+    // (merge-into-protected) and 5 (history-rewrite-on-protected) all read a
+    // segment through. None of those ever sees a `git` word written this way,
+    // so this refusal is their only defence against one — a future narrowing
+    // of it must keep covering every subcommand those rules care about, not
+    // just force-flagged pushes.
+    const gitWord = words[gitIndex];
+    if (gitWord !== undefined && !isPlainWord(gitWord.raw)) {
+        return violation(rule, SUBCOMMAND_NOT_PLAIN_REASON);
+    }
+    const subcommandIndex = gitSubcommandWord(words, gitIndex);
+    if (subcommandIndex === -1)
         return null;
-    return violation(requireRule(policy, 'force-push'));
+    const subcommand = words[subcommandIndex];
+    if (subcommand === undefined)
+        return null;
+    if (!isPlainWord(subcommand.raw))
+        return violation(rule, SUBCOMMAND_NOT_PLAIN_REASON);
+    const name = subcommand.text.toLowerCase();
+    const rest = words.slice(subcommandIndex + 1);
+    const covered = FORCE_GATE_SUBCOMMANDS.includes(name) ||
+        (name === 'branch' && isForcingBranchCommand(rest.map((word) => word.text)));
+    if (covered && rest.some((word) => !isPlainWord(word.raw))) {
+        return violation(rule, PLAIN_WORD_REASON);
+    }
+    return null;
+}
+/**
+ * Rule 2's main defence: a plain-word gate, not a growing list of individual
+ * shell tricks. In a segment that reaches `push`, `rebase`, `reset`,
+ * `filter-branch`, `update-ref`, or `branch` when it forces or deletes a
+ * ref, every word after the subcommand must be plain — see `isPlainWord`.
+ * A word this rule cannot read safely is refused rather than guessed at; the
+ * gate decides only readability, not force-ness, which the checks below
+ * still do once the words are known safe to read.
+ */
+function checkForcePush(command, policy) {
+    const rule = requireRule(policy, 'force-push');
+    // Joined first, so every rule-2 layer below — the shell-wrapper check, the
+    // subcommand-word gate, and the plain-word gate over the words after it —
+    // reads the command the way bash will run it, with no continuation left to
+    // hide a subcommand word inside.
+    for (const segment of topLevelCommands(joinLineContinuations(command))) {
+        if (isShellWrappedForceCandidate(segment))
+            return violation(rule);
+        const subcommandWordViolation = checkForcePushSubcommandWord(segment, rule);
+        if (subcommandWordViolation)
+            return subcommandWordViolation;
+        const decoded = decodeAnsiCQuoting(segment);
+        // An unterminated `$'` span cannot be decoded with confidence — fail
+        // closed rather than guess at what it hides, the same direction as
+        // `topLevelCommands`' own fallback for a construct it cannot read.
+        if (decoded.unterminated) {
+            if (/\bgit\b/i.test(segment))
+                return violation(rule);
+            continue;
+        }
+        if (definesInlineGitAlias(decoded.text))
+            return violation(rule);
+        // Subcommand detection reads the decoded text, so a subcommand word
+        // hidden inside a `$'...'` span (`$'\x70ush'`) is still found. But a
+        // `$'...'` span is itself one of the constructs the plain-word gate
+        // exists to refuse — decoding it away first, then checking the decoded
+        // words for plainness, would launder exactly what it is meant to catch.
+        // So once a covered subcommand is found, an undecoded `$'...'` span
+        // anywhere in the segment is already a plain-word failure on its own;
+        // otherwise (no span at all) the raw segment is checked directly.
+        if (isCoveredForcePushSegment(decoded.text)) {
+            if (decoded.text !== segment)
+                return violation(rule, PLAIN_WORD_REASON);
+            if (hasUnsafeWord(segment))
+                return violation(rule, PLAIN_WORD_REASON);
+        }
+        const text = stripSpliceQuotes(decoded.text);
+        const withoutStash = text.replace(/\bstash\s+push\b/gi, 'stash');
+        if (!GIT_PUSH_ANYWHERE_RE.test(withoutStash))
+            continue;
+        if (FORCE_PUSH_RE.test(text))
+            return violation(rule);
+        // A refspec operand starting with `+` forces the update the same way
+        // `--force` does, with no flag on the line at all. Read the same way
+        // rule 1 reads a push's destination: every non-flag operand of the push,
+        // quotes stripped — and backslashes stripped too, since the shell
+        // removes them before git ever sees the argument. `git push origin
+        // \+feat` reaches git as `+feat`; scanning the raw `\+feat` for a
+        // leading `+` misses it, so the operand is read the way git will.
+        if (pushOperands(text).some((ref) => ref.replace(/\\/g, '').startsWith('+'))) {
+            return violation(rule);
+        }
+    }
+    return null;
+}
+/**
+ * The command's top-level commands, split only where the shell itself ends a
+ * command: `;`, `&&`, `||`, `|` and an unescaped newline, outside quotes,
+ * backticks and `$( )` / `( )`. A redirection (`>`, `2>&1`, `>|`), a lone `&`
+ * and everything nested stay inside the command they belong to.
+ *
+ * Anything it cannot read with confidence returns the whole command as one
+ * segment: an unbalanced quote or paren, or a construct it does not model —
+ * ANSI-C `$'…'` quoting, `${…}` expansion (whose operands may hold `;` or
+ * `&&`), a heredoc (`<<`, whose body is not shell syntax) or any `#` other
+ * than `$#`. A comment's text may hold a lone quote, and a comment starts not
+ * only after a space but right after `;`, `&` or `)` too, so every `#` that
+ * could open one falls back rather than the scan guessing which do. That is
+ * the pre-split reading, so a parse it gets wrong can only over-refuse, never
+ * let a force flag through.
+ */
+function topLevelCommands(command) {
+    if (/\$'|\$\{|<<|(^|[^$])#/.test(command))
+        return [command];
+    const segments = [];
+    const stack = [];
+    let start = 0;
+    let i = 0;
+    const cut = (end, next) => {
+        segments.push(command.slice(start, end));
+        start = next;
+    };
+    while (i < command.length) {
+        const c = command[i];
+        const top = stack[stack.length - 1];
+        if (top === 'sq') {
+            if (c === "'")
+                stack.pop();
+            i += 1;
+            continue;
+        }
+        if (c === '\\') {
+            i += 2;
+            continue;
+        }
+        if (top === 'dq') {
+            if (c === '"')
+                stack.pop();
+            else if (c === '`')
+                stack.push('bt');
+            else if (c === '$' && command[i + 1] === '(') {
+                stack.push('paren');
+                i += 1;
+            }
+            i += 1;
+            continue;
+        }
+        if (top === 'bt' && c === '`') {
+            stack.pop();
+            i += 1;
+            continue;
+        }
+        if (c === "'")
+            stack.push('sq');
+        else if (c === '"')
+            stack.push('dq');
+        else if (c === '`')
+            stack.push('bt');
+        else if (c === '(')
+            stack.push('paren');
+        else if (c === ')') {
+            if (top !== 'paren')
+                return [command];
+            stack.pop();
+        }
+        else if (stack.length === 0) {
+            const pair = command.slice(i, i + 2);
+            if (pair === '&&' || pair === '||') {
+                cut(i, i + 2);
+                i += 2;
+                continue;
+            }
+            if (c === ';' || c === '\n' || (c === '|' && command[i - 1] !== '>'))
+                cut(i, i + 1);
+        }
+        i += 1;
+    }
+    if (stack.length > 0)
+        return [command];
+    segments.push(command.slice(start));
+    return segments;
 }
 /** Rule 3: `git merge` or `git pull` while standing on a protected branch — the only place a merge can land. */
 function checkMergeIntoProtected(command, branch, policy) {
@@ -791,8 +1546,6 @@ function checkHistoryRewriteOnProtected(command, branch, policy) {
     const rule = requireRule(policy, 'history-rewrite-on-protected');
     return violation(rule, renderBranch(rule.reason, branch));
 }
-/** Rule 6 detection, half one: is `rm` invoked as a command in this segment? Looser than "first token", so `sudo rm …` still matches; stricter than a bare substring, so the `rm` inside `charm`/`confirm` is not this rule's business. */
-const RM_INVOKE_RE = /(^|[;&|]|\s)rm\s+/;
 /** A bundled short-flag token (`-rf`, `-Rvf`) as opposed to a long flag (`--force`) or a path. */
 const RM_SHORT_FLAG_RE = /^-[a-zA-Z]+$/;
 /**
@@ -827,6 +1580,60 @@ function hasRecursiveForce(tokens) {
     }
     return recursive && force;
 }
+/**
+ * The same recursive-force cluster `hasRecursiveForce` reads out of a
+ * tokenised word list, asked instead of two independent, linear scans over
+ * raw, unparsed text — one per flag, not one combined pattern — because
+ * there is no word list left to read: the text has not been dequoted or
+ * split, so a cluster split across tokens (`-r -f`, `-r --force`) has to be
+ * found without that split ever happening. This is what a substitution body
+ * falls back to once it cannot be delimited with confidence — an
+ * unterminated quote, an unbalanced paren, or a nesting depth past
+ * `MAX_SUBSTITUTION_DEPTH`.
+ *
+ * Each scan looks for its flag at the start of a token — the start of the
+ * text, or just past whitespace, a quote, `(`, a backtick, `;`, `|` or `&` —
+ * then either the flag's long spelling (`--recursive`, `--force`) or a
+ * single hyphen followed by nothing but letters containing the flag's
+ * letter (`-r`, `-R`, `-rf`, `-Rvf`). The long spelling is checked on its
+ * own branch, gated on a second, literal hyphen, rather than folded into
+ * the bundled-letter scan: `hasRecursiveForce` never reads `--force` as
+ * carrying a recursive flag, because its own bundled-flag test
+ * (`RM_SHORT_FLAG_RE`) is anchored to exactly one leading hyphen and
+ * `--force` has two, so it only ever matches `--force`'s own exact-token
+ * branch. A combined scan that let the recursive pattern walk into a second
+ * hyphen would read `--force`'s own tail letters — `f`, `o`, `r`, `c`, `e` —
+ * and find the `r` in "force", flagging a force-only invocation as
+ * recursive too. Splitting the hyphen count the same way `hasRecursiveForce`
+ * does keeps that false read out. Over-matching in every other direction (a
+ * bundled flag that is not really `rm`'s, a comment mentioning both words)
+ * is the same direction every fail-closed read in this file already takes.
+ */
+const TOKEN_START = String.raw `(?:^|[\s'"(\`;|&])`;
+const RAW_RECURSIVE_FLAG_RE = new RegExp(`${TOKEN_START}-(?:-recursive\\b|[A-Za-z]*[rR][A-Za-z]*)`);
+const RAW_FORCE_FLAG_RE = new RegExp(`${TOKEN_START}-(?:-force\\b|[A-Za-z]*f[A-Za-z]*)`);
+/**
+ * Outside single quotes, the shell turns a backslash followed by any
+ * character into that character, and drops a backslash-newline outright —
+ * its line continuation. `-\r` reads as `-r`, so the two flag regexes above
+ * need to see the escape resolved, not the backslash that is still sitting
+ * in front of the letter. This text is exactly the text whose quoting
+ * could not be resolved with confidence (an unterminated quote, or a
+ * nesting depth this scanner gave up delimiting), so there is no reliable
+ * way to tell whether a given backslash sits inside single quotes, where
+ * the shell would have left it untouched. Reading every backslash as an
+ * escape is the same fail-closed direction the rest of this fallback
+ * already takes: over-denying a backslash that was really inside single
+ * quotes costs nothing here, and under-denying one that was not is the gap
+ * this closes.
+ */
+function unescapeForFlagScan(text) {
+    return text.replace(/\\([\s\S])/g, (_match, ch) => (ch === '\n' ? '' : ch));
+}
+function hasRecursiveForceInText(text) {
+    const unescaped = unescapeForFlagScan(text);
+    return RAW_RECURSIVE_FLAG_RE.test(unescaped) && RAW_FORCE_FLAG_RE.test(unescaped);
+}
 /**
  * The characters that separate one command in a chain from the next. `;&|`
  * are the three guard.sh knew, and for a long time this file knew no others
@@ -867,9 +1674,17 @@ const SEPARATOR_CHARS = `${COMMAND_SEPARATOR_CHARS}${REDIRECTION_CHARS}`;
  * Every separated segment of a command, so a chain can be inspected one
  * invocation at a time — and so a rule reading a segment's operands is looking
  * at that command's operands and nothing else.
+ *
+ * Joins line continuations first. The split below is a naive character class
+ * that includes a bare newline, with no idea a backslash in front of one
+ * means "this is not where the command ends" — left unjoined, `rm -r\<LF>f
+ * /x` would split into `rm -r\` and `f /x` before either reached a word
+ * splitter, and no fix inside one could ever reunite a flag cluster already
+ * cut in half. `joinLineContinuations` is the same join `checkForcePush`
+ * already runs first; every caller here gets it for the same reason.
  */
 function splitChainSegments(command) {
-    return command.split(new RegExp(`[${SEPARATOR_CHARS}]`));
+    return joinLineContinuations(command).split(new RegExp(`[${SEPARATOR_CHARS}]`));
 }
 /**
  * A redirection, with its target: an optional file descriptor or `&`, one of
@@ -913,8 +1728,56 @@ function catchUpSegments(command) {
         .split(new RegExp(`[${COMMAND_SEPARATOR_CHARS}]`))
         .filter((s) => re.test(s));
 }
+/** Rule 6 detection, half one: is `rm` invoked as a command in this segment? Looser than "first token", so `sudo rm …` still matches; stricter than a bare substring, so the `rm` inside `charm`/`confirm` is not this rule's business. Used as a fallback alongside the whole-segment word scan below — see `checkUnboundedRm`. */
+const RM_INVOKE_RE = /(^|[;&|]|\s)rm\s+/;
 /** The `rm <args>` run up to the next separator, ported from guard.sh's `grep -Eo 'rm[[:space:]]+[^;&|]*'` and widened with it. Applied per chain segment (see `checkUnboundedRm`), so "up to the next separator" and "to the end of the string" mean the same thing by the time this runs — the negated class is belt and braces, kept in step with the split so the two can never disagree about where a command ends. */
 const RM_ARGS_RE = new RegExp(`rm\\s+([^${SEPARATOR_CHARS}]*)`);
+/**
+ * True when any word of `segment` has basename `rm` and resolves to it only
+ * once a backslash is undone (`r\m`, `/bin/r\m`, `./r\m`) — fails closed,
+ * refused outright wherever it sits rather than parsed for its flags and
+ * paths, since neither can be trusted from a word that was never written
+ * plainly. Every word of the segment is scanned, not just the one in command
+ * position: an open-ended list of wrappers (`sudo`, `env`, `time`, `xargs`,
+ * `nohup`, `stdbuf`, `ionice`, `command`, `exec`, a bare `VAR=val` prefix…)
+ * can sit in front of `rm`, so narrowing the scan to command position would
+ * miss a disguised `rm` behind any wrapper not on that list. `echo r\m`
+ * being refused along with it is accepted.
+ */
+function hasDisguisedRmWord(words) {
+    return words.some((word) => {
+        const basename = word.text.split(/[\\/]/).pop() ?? word.text;
+        return basename === 'rm' && !isPlainWord(word.raw);
+    });
+}
+/**
+ * The index of the first plain (non-disguised) word in `words` whose
+ * basename is `rm` — `rm`, `/bin/rm`, `./rm` — or `-1` if there is none.
+ * Reading this word's position, rather than just whether one exists, is
+ * what lets `extractRmArgsFromWords` take the words that follow it instead
+ * of re-deriving them from raw text.
+ */
+function plainRmWordIndex(words) {
+    return words.findIndex((word) => {
+        if (!isPlainWord(word.raw))
+            return false;
+        const basename = word.text.split(/[\\/]/).pop() ?? word.text;
+        return basename === 'rm';
+    });
+}
+/**
+ * `rm`'s arguments, already dequoted, straight from the same word split that
+ * found it. `RM_ARGS_RE` reads flags from the *raw* text
+ * after a literal `rm `, so a quoted invocation like `"rm" -rf /x` was never
+ * matched: the closing quote sits where the regex wants whitespace, the
+ * match fails, and `-rf /x` is never seen at all. The word list has already
+ * dequoted `"rm"` down to the plain word `rm` and split `-rf`/`/x` out as
+ * their own words regardless of how `rm` itself was spelled, so slicing from
+ * the word after it is both simpler and correct where the regex was not.
+ */
+function extractRmArgsFromWords(words, rmIndex) {
+    return words.slice(rmIndex + 1).map((word) => word.text);
+}
 function extractRmArgs(segment) {
     const match = RM_ARGS_RE.exec(segment);
     if (!match)
@@ -924,6 +1787,15 @@ function extractRmArgs(segment) {
         .split(/\s+/)
         .filter((t) => t !== '');
 }
+function isOutOfBoundsRemoval(args, repoRoot, policy) {
+    if (!hasRecursiveForce(args))
+        return false;
+    return args.some((tok) => {
+        if (tok.startsWith('-'))
+            return false;
+        return !isAllowedRemovalPath(normalizeRemovalPath(tok, repoRoot), policy);
+    });
+}
 /**
  * Normalize an `rm` argument to a repo-root-relative path — the portable
  * replacement for guard.sh's `normalize_path`, which shelled out to
@@ -961,32 +1833,404 @@ function isAllowedRemovalPath(normalizedPath, policy) {
         policy.allowedRemovalRoots.includes(first));
 }
 /**
- * Rule 6: a recursive-force `rm` outside `allowed_roots`, however the two
- * flags are spelled (see `hasRecursiveForce`).
+ * Whether `text` names `rm` outside `allowed_roots`, by itself — no chain
+ * splitting, no wrapper unwrapping, just the three reads of one piece of
+ * text: a disguised `rm` word anywhere is refused outright; a plain `rm`
+ * word's flags come from the same word split that found it
+ * (`extractRmArgsFromWords`), trusted directly; and the raw `RM_INVOKE_RE`
+ * fallback — belt and braces for a spelling the word-level read might miss —
+ * is read with less trust, since it is text `plainRmWordIndex` could not
+ * place a word at. `RM_ARGS_RE` wants whitespace right after a literal `rm`,
+ * so a quoted invocation like `"rm" -rf /x` leaves it with no match and
+ * nothing to say was forced — handled for the plain-word case by reading
+ * args from the words themselves, and for the raw-fallback case by failing
+ * closed when it can find `rm` but not its flags, rather than reading
+ * "found nothing" as "not forced".
+ */
+function rmOutOfBoundsInText(text, repoRoot, policy) {
+    const words = splitDequotedWords(text);
+    if (hasDisguisedRmWord(words))
+        return true;
+    const rmIndex = plainRmWordIndex(words);
+    if (rmIndex !== -1) {
+        return isOutOfBoundsRemoval(extractRmArgsFromWords(words, rmIndex), repoRoot, policy);
+    }
+    if (!RM_INVOKE_RE.test(text))
+        return false;
+    const args = extractRmArgs(text);
+    if (args.length === 0)
+        return true;
+    return isOutOfBoundsRemoval(args, repoRoot, policy);
+}
+/**
+ * Rule 6's analogue of `checkForcePush`'s `isShellWrappedForceCandidate`: a
+ * `-c` string handed to `sh`/`bash`/`zsh`/`env`, or `eval`, hides its payload
+ * from a word-level read the same way it hides a force-push from rule 2 — a
+ * pre-existing gap (`sh -c "rm -rf /x"` was allowed on every prior version).
+ * Rather than parse the wrapped command a second time, hand the same
+ * dequoted text back through `rmOutOfBoundsInText`: stripping every quote
+ * character turns `sh -c "rm -rf /x"` into `sh -c rm -rf /x`, where `rm`
+ * reads as an ordinary word like any other. A thin alias over
+ * `dequoteShellWrappedSegment`, kept under this name since
+ * `checkUnboundedRm`'s wrapped-`rm` pass below already reads by it.
+ */
+function shellWrappedRmPayload(segment) {
+    return dequoteShellWrappedSegment(segment);
+}
+/**
+ * The index just past the quote that closes the one starting at `start`
+ * (`text[start]` is `'` or `"`) — or `null` when the text ends first. Shared
+ * by `findBalancedParenClose` and `findBacktickClose` so the two
+ * substitution-delimiter scanners below read a quoted span inside a body the
+ * same way, rather than a second copy of the same loop apiece.
+ */
+function skipQuotedSpan(text, start) {
+    if (text[start] === "'") {
+        const end = text.indexOf("'", start + 1);
+        return end === -1 ? null : end + 1;
+    }
+    let i = start + 1;
+    while (i < text.length && text[i] !== '"') {
+        i += text[i] === '\\' && i + 1 < text.length ? 2 : 1;
+    }
+    return i < text.length ? i + 1 : null;
+}
+/**
+ * The index of the `)` that balances the `(` just before `start` — or `null`
+ * when the text ends first, the same "cannot delimit this with confidence"
+ * signal `topLevelCommands` falls back on for an unbalanced paren. A quoted
+ * span inside the body is skipped whole (`skipQuotedSpan`), so a literal
+ * `)` inside an argument, like the one in `$(echo ")")`, is never mistaken
+ * for the substitution's own close.
+ */
+function findBalancedParenClose(text, start) {
+    let depth = 1;
+    let i = start;
+    while (i < text.length) {
+        const c = text[i];
+        if (c === '\\' && i + 1 < text.length) {
+            i += 2;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            const next = skipQuotedSpan(text, i);
+            if (next === null)
+                return null;
+            i = next;
+            continue;
+        }
+        if (c === '(') {
+            depth += 1;
+            i += 1;
+            continue;
+        }
+        if (c === ')') {
+            depth -= 1;
+            if (depth === 0)
+                return i;
+            i += 1;
+            continue;
+        }
+        i += 1;
+    }
+    return null;
+}
+/**
+ * The index of the unescaped backtick that closes a backtick substitution
+ * starting at `start` — reading through a quoted span the same way
+ * `findBalancedParenClose` does, so a backtick inside a quoted argument
+ * never ends the span early. `null` when no close is found before the text
+ * ends.
+ */
+function findBacktickClose(text, start) {
+    let i = start;
+    while (i < text.length) {
+        const c = text[i];
+        if (c === '\\' && i + 1 < text.length) {
+            i += 2;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            const next = skipQuotedSpan(text, i);
+            if (next === null)
+                return null;
+            i = next;
+            continue;
+        }
+        if (c === '`')
+            return i;
+        i += 1;
+    }
+    return null;
+}
+/**
+ * Every command substitution (`$(...)`), backtick substitution, and process
+ * substitution (`<(...)`/`>(...)`) body in `segment` — the shell still runs
+ * each of these while it builds an allowlisted command's argv, which
+ * `isUnknownRemovalSegment`'s first-word allowlist does not account for on
+ * its own: `cp` cannot run a second program from one of its own
+ * *arguments*, but `echo $(X=rm; $X -rf /x)` never puts anything dangerous
+ * in an argument — the shell runs `$X -rf /x` as a command in its own right
+ * to decide what `echo` should print. A body inside single quotes is not a
+ * substitution at all, since single quotes suppress every expansion, so
+ * that span is skipped rather than read; one inside double quotes still
+ * runs and is read the same as an unquoted one.
+ *
+ * Reads as a small quote-state machine — unquoted, single-quoted or
+ * double-quoted — rather than `skipQuotedSpan`'s "skip the whole span" read
+ * the two delimiter finders above use: a single-quoted span truly has
+ * nothing left to find inside it, but a double-quoted one still runs a
+ * `$(...)` or backtick substitution this scan must keep recognising, so it
+ * cannot be skipped whole. The one thing double quotes change inside their
+ * own span is that `'` is just a character, not a span of its own — an
+ * apostrophe in `"it's $(...)"` used to be read as opening a fresh
+ * single-quoted span, which this text never closes, so the whole scan gave
+ * up and returned `null` for a segment that was perfectly readable. Process
+ * substitution (`<(`/`>(`) is the other thing double quotes change: they
+ * suppress it, so it is only recognised unquoted, matching
+ * `shellExpandsPayload`'s read of the same two forms for rule 4's message
+ * payload. A backslash escapes the next character in either the unquoted or
+ * the double-quoted state, the same as a real shell. `$((` arithmetic is
+ * left exactly as it reads today: this scan does not special-case it, so it
+ * is still found as a `$(` whose body happens to start with its own `(`.
+ *
+ * `null` means some substitution in `segment` could not be delimited with
+ * confidence — an unterminated quote or an unbalanced paren — so the caller
+ * reads that as "cannot prove this is safe", not "found nothing".
+ */
+function extractSubstitutionBodies(segment) {
+    const bodies = [];
+    let i = 0;
+    let inDouble = false;
+    while (i < segment.length) {
+        const c = segment[i];
+        if (c === '\\' && i + 1 < segment.length) {
+            i += 2;
+            continue;
+        }
+        if (!inDouble && c === "'") {
+            const next = skipQuotedSpan(segment, i);
+            if (next === null)
+                return null;
+            i = next;
+            continue;
+        }
+        if (c === '"') {
+            inDouble = !inDouble;
+            i += 1;
+            continue;
+        }
+        if (c === '$' && segment[i + 1] === '(') {
+            const close = findBalancedParenClose(segment, i + 2);
+            if (close === null)
+                return null;
+            bodies.push(segment.slice(i + 2, close));
+            i = close + 1;
+            continue;
+        }
+        if (c === '`') {
+            const close = findBacktickClose(segment, i + 1);
+            if (close === null)
+                return null;
+            bodies.push(segment.slice(i + 1, close));
+            i = close + 1;
+            continue;
+        }
+        if (!inDouble && (c === '<' || c === '>') && segment[i + 1] === '(') {
+            const close = findBalancedParenClose(segment, i + 2);
+            if (close === null)
+                return null;
+            bodies.push(segment.slice(i + 2, close));
+            i = close + 1;
+            continue;
+        }
+        i += 1;
+    }
+    return bodies;
+}
+/**
+ * Whether `segment` carries a removal the shell would run while building
+ * another command's argv, even one behind a plain, allowlisted first word —
+ * the gap a re-review found in `isUnknownRemovalSegment`'s allowlist: `echo`
+ * cannot run a second program from an *argument*, but
+ * `echo $(X=rm; $X -rf /x)` has the shell run `$X -rf /x` as a command in
+ * its own right before `echo` ever sees a value to print. Each substitution
+ * body found by `extractSubstitutionBodies` is checked as a full command
+ * line of its own, by recursing into `isUnboundedRemovalCommand` — the same
+ * literal-`rm`, unknown-word and nested-shell reads it runs on the outer
+ * command — so a substitution nested inside a body is caught by that same
+ * recursive call rather than a second extraction pass here.
+ *
+ * A body this scanner cannot delimit with confidence (an unbalanced paren, a
+ * quote that never closes) is not read as "found nothing": the segment is
+ * refused outright when it carries a recursive-force flag cluster anywhere
+ * in its raw text, the same shape `isUnknownRemovalSegment` already refuses
+ * an unreadable word for — read as a substring of the untouched text
+ * (`hasRecursiveForceInText`), not a dequoted word list, because the same
+ * quoting that defeated delimiting also defeats a clean word split: an
+ * apostrophe stranded inside an unresolved double-quoted span is exactly
+ * what left this body undelimitable in the first place, so the one word
+ * list `splitDequotedWords` would produce here cannot be trusted either.
+ *
+ * `depth` counts how many substitution bodies deep this call already is —
+ * zero at the outermost command, one past the first `$(...)`/backtick/
+ * process substitution, and so on as each body recurses into
+ * `isUnboundedRemovalCommand` below. Nesting is attacker-controlled and
+ * unbounded (`$($($(...)))`), and following it one JS stack frame per level
+ * throws past a few hundred levels — so once `depth` reaches
+ * `MAX_SUBSTITUTION_DEPTH`, extraction stops outright rather than reading
+ * whatever raw text is left: nesting sixteen levels deep is never a
+ * legitimate agent command, and a check this far past the point it can
+ * actually read the body has nothing to vouch for it with. Refusing here
+ * does not depend on `hasRecursiveForceInText` finding anything — it denies
+ * on depth alone, the same way an undelimitable body used to read as "found
+ * nothing" if it happened to carry no flags. That keeps both the call stack
+ * and the work done bounded, however deep the nesting actually goes.
+ */
+const MAX_SUBSTITUTION_DEPTH = 16;
+function hasUnsafeSubstitution(segment, repoRoot, policy, depth = 0) {
+    if (depth >= MAX_SUBSTITUTION_DEPTH)
+        return true;
+    const bodies = extractSubstitutionBodies(segment);
+    if (bodies === null)
+        return hasRecursiveForceInText(segment);
+    return bodies.some((body) => isUnboundedRemovalCommand(body, repoRoot, policy, depth + 1));
+}
+/**
+ * Plain first words that cannot hand their later arguments to another
+ * program — the allowlist that keeps the every-word scan below from
+ * refusing ordinary commands whose own flags happen to spell `-rf`/`-Rf`:
+ * `cp -rf "$SRC" dst`, `ls -rf $DIR`, `chmod -Rf 755 $DIR`. None of these
+ * runs a second program from an argument the way a wrapper (`sudo`, `env`,
+ * `xargs`, `timeout 5`, a bare `VAR=val` prefix, …) or a nested shell can, so
+ * an unreadable word later in the same line carries no risk here. `rm`
+ * itself is deliberately left out of this set: a plain `rm` or `/bin/rm`
+ * first word is exempted the same way, but keeps the allowed-roots analysis
+ * above instead of skipping straight to "allowed" — see
+ * `isUnknownRemovalSegment`.
+ */
+const REMOVAL_SAFE_FIRST_WORDS = new Set([
+    'cp',
+    'mv',
+    'ls',
+    'chmod',
+    'chown',
+    'chgrp',
+    'ln',
+    'mkdir',
+    'touch',
+    'cat',
+    'echo',
+    'printf',
+    'grep',
+]);
+/**
+ * Rule 6's gap once some word of the segment is unreadable: neither
+ * `hasDisguisedRmWord` (which still needs a word's basename to resolve to
+ * the literal `rm`) nor the rest of `rmOutOfBoundsInText` (which needs to
+ * find an `rm` word at all) can place a word that only resolves to `rm` once
+ * a shell expands `$X`, `$(...)` or a backtick span — this file never
+ * evaluates one of those. So when any word of the segment is unreadable this
+ * way (`isUnexpandedCommandWord`), the rest of it is read for the one shape
+ * this rule already guards against: a recursive-force flag cluster
+ * (`hasRecursiveForce`, the same flag parsing the plain-`rm` path above
+ * uses). Resolving the expansion itself is out of scope — an open-ended
+ * evaluator is the wrong tool — so this is shape only.
+ *
+ * Every word is scanned, not just the one in command position: a wrapper, a
+ * group (`( … )`), or a keyword (`{ … }`, `if … then … fi`) can all sit in
+ * front of the unreadable word without moving it out of the segment. That
+ * widens what trips the check, so a first word that is plain and cannot run
+ * another program (`REMOVAL_SAFE_FIRST_WORDS`), or dequotes to the literal
+ * `rm`/`/bin/rm`, is exempted — anything else in first position, including
+ * an unrecognised command, falls through to the refusal. Fail-closed over
+ * precise, same direction as every other read in this file.
+ *
+ * Checked before any of that: `hasUnsafeSubstitution`. The allowlist above
+ * only says a plain first word cannot run another program from its own
+ * *arguments* — it says nothing about a command or process substitution
+ * sitting in one of those arguments, which the shell still runs as a
+ * command in its own right while it builds the argv. `echo $(X=rm; $X -rf
+ * /x)` is exactly `echo`'s shape and nothing else, so the allowlist alone
+ * would wave it through; the substitution check below is what actually
+ * reads what the shell runs before `echo` sees a value to print.
+ */
+function isUnknownRemovalSegment(segment, repoRoot, policy, depth = 0) {
+    if (hasUnsafeSubstitution(segment, repoRoot, policy, depth))
+        return true;
+    const words = splitDequotedWords(segment);
+    const first = words[0];
+    if (first !== undefined && isPlainWord(first.raw)) {
+        const basename = first.text.split(/[\\/]/).pop() ?? first.text;
+        if (basename === 'rm' || REMOVAL_SAFE_FIRST_WORDS.has(basename))
+            return false;
+    }
+    if (!words.some((word) => isUnexpandedCommandWord(word)))
+        return false;
+    return hasRecursiveForce(words.map((word) => word.text));
+}
+/**
+ * Reads `topLevelCommands`, not `splitChainSegments`: the naive
+ * single-character split above cuts `$(echo rm) -rf /x` apart at the very
+ * `(`/`)`/backtick that make the word unreadable, landing the flag cluster
+ * in a different "segment" than the word it belongs to and missing the
+ * combination entirely.
+ *
+ * Each top-level segment is also checked as a nested shell's dequoted
+ * payload (`sh -c '…'`, `bash -c "…"`, `eval '…'`): `splitDequotedWords`
+ * keeps a quoted span's internal text as one word, which hides a `-rf`
+ * token as a standalone token until the quotes are gone — see
+ * `dequoteShellWrappedSegment`.
+ */
+function hasUnknownRemovalCommandWord(command, repoRoot, policy, depth = 0) {
+    return topLevelCommands(command).some((segment) => {
+        if (isUnknownRemovalSegment(segment, repoRoot, policy, depth))
+            return true;
+        const wrapped = dequoteShellWrappedSegment(segment);
+        return wrapped !== null && isUnknownRemovalSegment(wrapped, repoRoot, policy, depth);
+    });
+}
+/**
+ * Rule 6's boolean core, pulled out of `checkUnboundedRm` so
+ * `hasUnsafeSubstitution` can run the exact same check on a substitution
+ * body: the literal-`rm` path (every chain segment read for a disguised or
+ * plain `rm` outside `allowed_roots`) plus the unknown-word path
+ * (`hasUnknownRemovalCommandWord`, which already folds in the nested-shell
+ * path). `command` here is "a command line of its own" in the brief's
+ * words — it may be the whole tool call, or it may be the text found inside
+ * someone else's `$(...)`.
  *
  * Checks every chain segment independently, not just the first `rm` in the
  * whole command. guard.sh's own `grep -Eo 'rm[[:space:]]+[^;&|]*'` — and this
- * function, until this fix — stopped at the first match in the *whole*
+ * function, until an earlier fix — stopped at the first match in the *whole*
  * command string, so `rm -rf workspaces/a; rm -rf src/important` read
  * `workspaces/a` (allowed), decided the command was fine, and never looked
  * at `src/important` at all. That is a deliberate behaviour change from a
  * straight port: closing a chained-command bypass that guard.sh always had,
  * not carrying it forward with new spelling.
  */
-function checkUnboundedRm(command, repoRoot, policy) {
+function isUnboundedRemovalCommand(command, repoRoot, policy, depth = 0) {
     const outOfBounds = splitChainSegments(command).some((segment) => {
-        if (!RM_INVOKE_RE.test(segment))
-            return false;
-        const args = extractRmArgs(segment);
-        if (!hasRecursiveForce(args))
-            return false;
-        return args.some((tok) => {
-            if (tok.startsWith('-'))
-                return false;
-            return !isAllowedRemovalPath(normalizeRemovalPath(tok, repoRoot), policy);
-        });
+        const decoded = decodeAnsiCQuoting(segment);
+        // An unterminated `$'` span cannot be decoded with confidence — fail
+        // closed rather than guess at what it hides, the same direction
+        // `checkForcePush` takes for the same construct.
+        if (decoded.unterminated)
+            return /\brm\b/i.test(segment);
+        if (rmOutOfBoundsInText(decoded.text, repoRoot, policy))
+            return true;
+        const wrapped = shellWrappedRmPayload(decoded.text);
+        return wrapped !== null && rmOutOfBoundsInText(wrapped, repoRoot, policy);
     });
-    if (!outOfBounds)
+    return outOfBounds || hasUnknownRemovalCommandWord(command, repoRoot, policy, depth);
+}
+/**
+ * Rule 6: a recursive-force `rm` outside `allowed_roots`, however the two
+ * flags are spelled (see `hasRecursiveForce`) — see
+ * `isUnboundedRemovalCommand` for the check itself.
+ */
+function checkUnboundedRm(command, repoRoot, policy) {
+    if (!isUnboundedRemovalCommand(command, repoRoot, policy))
         return null;
     return violation(requireRule(policy, 'unbounded-rm'));
 }
@@ -1245,10 +2489,10 @@ function checkRoleWriteScope(command, filePath, lease, repoRoot, policy, scope)
 /**
  * Judge rule 3: a judge does not touch its own lease.
  *
- * Without this the sandbox would be one `smith sandbox close` away from
- * being off, and `rm state/sandboxes/<hash>.json` is a removal under
- * `state/`, which the `unbounded-rm` rule above explicitly permits. The
- * refusal is unconditional on the lease directory rather than scoped to
+ * Without this the sandbox would be one `bs sandbox close` (or its
+ * deprecated `smith` alias) away from being off, and
+ * `rm state/sandboxes/<hash>.json` is a removal under `state/`, which the
+ * `unbounded-rm` rule above explicitly permits. The refusal is unconditional on the lease directory rather than scoped to
  * *this* lease: reading another judge's lease is no more a judge's business
  * than deleting its own.
  */
@@ -1258,7 +2502,8 @@ function checkJudgeSandboxEscape(command, lease, policy) {
             return true;
         if (!/\bsandbox\b/i.test(segment))
             return false;
-        return (hasCommandWord(segment, 'smith') ||
+        return (hasCommandWord(segment, 'bs') ||
+            hasCommandWord(segment, 'smith') ||
             hasCommandWord(segment, 'node') ||
             /\bcli\.js\b/i.test(segment));
     });