@lannguyensi/harness 0.49.0 → 0.51.0

package/dist/runtime/approval-signing.js

@@ -43,6 +43,29 @@
 //     back the operator's key file), and it makes ANY forgery attempt one
 //     step more expensive and forensically visible (a key read is a
 //     distinguishable event; a bare unsigned-JSON write no longer is).
+//   - SECOND MINTING PATH (agent-tasks/74b4b17d, ADR
+//     docs/decisions/2026-08-27-ug-auto-mode-approval.md): the residual
+//     above was a CONJUNCTION, read the key AND write through an
+//     uncovered primitive. Since the `auto_approve` opt-in of the
+//     `understanding-before-execution` pack, the PreToolUse hook itself
+//     can write a validly signed session marker (`approvedBy:
+//     auto-mode:<harness>:<mode>`) when the payload's `permission_mode`
+//     is allowlisted and a strict-session `pending` report exists. Any
+//     process that can invoke `harness pack hook pre-tool-use` with a
+//     stdin payload and `CLAUDE_CODE_SESSION_ID` of its choosing therefore
+//     obtains a signed marker for that session id WITHOUT reading the
+//     key: the residual is now a DISJUNCTION, read the key, OR make the
+//     hook sign for you. Reach, honestly: pre-approval the oracle is
+//     unreachable (invoking it is a Bash call, and `pack` is not on the
+//     read-only allowlist in `src/runtime/read-only-bash.ts`), so this
+//     is not an escalation over the post-approval write class, which can
+//     already forge by the key-read route; it is a cheaper and less
+//     forensically visible post-approval route (no key read to notice),
+//     and it is why the auto path never creates the key (explicit
+//     key-exists precheck before the shared write path), consumes the
+//     report it used, declines on a forged marker, and applies only
+//     after every existing exemption branch has declined. The pack's
+//     doctor listing of `auto-mode:` markers is the audit surface for it.
 //   - Given the agent and operator share one OS user account on this
 //     machine, this is deliberately pragmatic defense-in-depth, not a hard
 //     authorization boundary. It is documented here in full rather than
@@ -51,7 +74,8 @@
 // KEY STORAGE: `<generatedDir>/.approval-signing.key` — a raw 32-byte
 // secret, mode 0600, generated lazily on first use (by `harness approve
 // understanding` / `harness approve branch-protection`, or by `harness
-// init` — see src/cli/init/index.ts). Colocated with `harness.generated/`
+// init` — see src/cli/init/index.ts; NEVER by the PreToolUse hook's auto
+// path, which prechecks that the key exists and blocks when it does not). Colocated with `harness.generated/`
 // (not a separate home-dir path) so:
 //   - it inherits the SAME test-isolation guarantee every marker/report
 //     path already has (every call site here already threads an explicit,
@@ -176,6 +200,36 @@ export function rotateSigningKey(generatedDir) {
     }
     return { key: fresh, filePath, created: true };
 }
+/**
+ * Non-creating existence probe for the signing key: `true` only when
+ * `<generatedDir>/.approval-signing.key` is a regular file carrying at
+ * least `KEY_BYTES` bytes. Never creates, repairs, or rotates anything.
+ *
+ * Why this exists as a separate export instead of "just call
+ * `getOrCreateSigningKey` and see" (ADR
+ * docs/decisions/2026-08-27-ug-auto-mode-approval.md, threat model (b)
+ * item 5): key CREATION is an operator-side act (`harness init` /
+ * `harness approve`). The PreToolUse hook's auto-approval path
+ * (agent-tasks/74b4b17d) must refuse to mint a marker on a machine that
+ * has no key, but the shared write path it uses (`writeApprovalMarker`
+ * -> `signMarker` -> `getOrCreateSigningKey`) treats a missing key as a
+ * case to REPAIR: it generates one on ENOENT and signs with it. So the
+ * auto path calls this first and blocks when it returns `false`.
+ *
+ * A truncated / short key file counts as absent here for the same
+ * reason: `getOrCreateSigningKey` would overwrite it with a fresh key,
+ * which is the same operator-side act this probe exists to keep the
+ * hook out of.
+ */
+export function signingKeyExists(generatedDir) {
+    try {
+        const stat = fs.statSync(signingKeyPathFor(generatedDir));
+        return stat.isFile() && stat.size >= KEY_BYTES;
+    }
+    catch {
+        return false;
+    }
+}
 /** sha256 hex digest of a string, used to bind a marker to a persisted report's content. */
 export function sha256Hex(content) {
     return crypto.createHash("sha256").update(content, "utf8").digest("hex");

package/dist/runtime/approval-signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-signing.js","sourceRoot":"","sources":["../../src/runtime/approval-signing.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,mEAAmE;AACnE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,qEAAqE;AACrE,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,iDAAiD;AACjD,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,2EAA2E;AAC3E,wEAAwE;AACxE,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,0EAA0E;AAC1E,qCAAqC;AACrC,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,yDAAyD;AACzD,sEAAsE;AACtE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,2DAA2D;AAC3D,4CAA4C;AAC5C,8DAA8D;AAC9D,0EAA0E;AAC1E,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,wDAAwD;AACxD,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,2DAA2D;AAC3D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,qBAAqB;AAErB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;AACvD,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,6BAA6B;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,oCAAoC;QACpC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,oEAAoE;YACpE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,UAAkB,EAClB,UAAkB,EAClB,iBAAgC;IAEhC,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,6CAA6C;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,YAAoB,EACpB,QAAgB,EAChB,MAAqF;IAErF,MAAM,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;SAC3F,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB;QACjB,GAAG,EAAE,WAAW;QAChB,SAAS;KACV,CAAC;AACJ,CAAC;AAoBD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,iBAAiB,GACrB,OAAO,OAAO,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAC9C,CAAC,CAAE,OAAO,CAAC,mBAAmB,CAAY;QAC1C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;YACvF,IAAI,EAAE,iBAAiB;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;SAC7E,MAAM,EAAE,CAAC;IACZ,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"approval-signing.js","sourceRoot":"","sources":["../../src/runtime/approval-signing.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,oBAAoB;AACpB,EAAE;AACF,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,mEAAmE;AACnE,0EAA0E;AAC1E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,4EAA4E;AAC5E,qEAAqE;AACrE,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,sDAAsD;AACtD,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,wEAAwE;AACxE,iDAAiD;AACjD,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,qDAAqD;AACrD,wEAAwE;AACxE,iEAAiE;AACjE,kEAAkE;AAClE,wEAAwE;AACxE,8DAA8D;AAC9D,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,0EAA0E;AAC1E,qEAAqE;AACrE,2EAA2E;AAC3E,wEAAwE;AACxE,gBAAgB;AAChB,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,8GAA8G;AAC9G,qCAAqC;AACrC,wEAAwE;AACxE,0EAA0E;AAC1E,uEAAuE;AACvE,yDAAyD;AACzD,sEAAsE;AACtE,0EAA0E;AAC1E,sEAAsE;AACtE,yEAAyE;AACzE,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,iEAAiE;AACjE,2DAA2D;AAC3D,4CAA4C;AAC5C,8DAA8D;AAC9D,0EAA0E;AAC1E,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,wDAAwD;AACxD,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,2DAA2D;AAC3D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,qBAAqB;AAErB,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C,yFAAyF;AACzF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;AACvD,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,WAAW,GAAG,IAAI,CAAC;QACnB,IAAI,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACrD,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,kEAAkE;QAClE,qEAAqE;QACrE,6BAA6B;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,WAAW,EAAE,CAAC;QAChB,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,oCAAoC;QACpC,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,oEAAoE;YACpE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACjD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CACvB,QAAgB,EAChB,UAAkB,EAClB,UAAkB,EAClB,iBAAgC;IAEhC,wEAAwE;IACxE,sEAAsE;IACtE,qEAAqE;IACrE,6CAA6C;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;AACjF,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CACxB,YAAoB,EACpB,QAAgB,EAChB,MAAqF;IAErF,MAAM,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;SAC3F,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iBAAiB;QACjB,GAAG,EAAE,WAAW;QAChB,SAAS;KACV,CAAC;AACJ,CAAC;AAoBD;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAgB,EAChB,OAAgC;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,+DAA+D;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,iBAAiB,GACrB,OAAO,OAAO,CAAC,mBAAmB,CAAC,KAAK,QAAQ;QAC9C,CAAC,CAAE,OAAO,CAAC,mBAAmB,CAAY;QAC1C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,GAAG,EAAE,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;YACvF,IAAI,EAAE,iBAAiB;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM;SACpB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;SAC7E,MAAM,EAAE,CAAC;IACZ,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/runtime/command-normalize.d.ts

@@ -216,6 +216,22 @@ export interface CommandSegment {
      */
     effectiveTarget: string | null;
 }
+/**
+ * The minimal shape `peelWrapperPrefixes` and every individual `peelX`
+ * wrapper-peeler actually need — `.text` only, never `.start`/`.end`
+ * (task d03af8f6, review round 3). Exported so
+ * `src/runtime/deletion-target-resolve.ts` can hand these SAME peelers a
+ * decoded token array of its own (built from ITS quote-aware tokenizer,
+ * not this module's `tokenizeWithOffsets`) without fabricating fake
+ * offsets: `Token` (with real offsets) is structurally assignable to
+ * `WrapperPeelToken[]` already, so `canonicalizeSegment`'s own call sites
+ * below need no change at all — this is a widening of the peelers'
+ * PARAMETER types only, not a behaviour change (none of them ever read
+ * `.start`/`.end`).
+ */
+export interface WrapperPeelToken {
+    text: string;
+}
 /**
  * The `git` token itself, matched by BASENAME so a path-qualified
  * invocation (`/usr/bin/git`, `./git`) is recognised too (F4 fix).
@@ -384,6 +400,29 @@ export declare function normalizeCommand(command: string): NormalizedCommand;
  * of this function at all.
  */
 export declare function segmentViewOf(command: string): CommandSegment[] | null;
+/**
+ * Ampersand-aware sibling of `segmentViewOf` (task d03af8f6, review
+ * round 3): the same per-segment view, but segmented under
+ * `AMP_BOUNDARY_RE` (`BOUNDARY_RE` plus a bare `&`) instead of
+ * `BOUNDARY_RE` — closing the same bare-`&` gap `normalizeCommandAmpAware`
+ * closes for trigger matching (`echo hi & rm -rf /home/x`), but as a
+ * segment VIEW rather than a rejoined string, for
+ * `src/runtime/deletion-target-resolve.ts`'s multi-segment scan. Uses the
+ * SAME shared walk (`segmentAndCanonicalize`, parameterised on
+ * `boundaryRe` since task aabbad63) as every other pass in this module —
+ * no new segmentation logic. `CommandSegment.effectiveTarget`'s own
+ * composition rules are UNCHANGED by which alphabet drove the split; a
+ * caller that only needs `.text` per segment (as the deletion resolver
+ * does) is unaffected by the same directory-extraction reliability
+ * caveat `normalizeCommandAmpAware`'s own comment names for `targetDir`/
+ * `targetBase` — this function returns the FULL `CommandSegment` shape,
+ * `effectiveTarget` included, so a future caller relying on THAT field
+ * under this alphabet should read `normalizeCommandAmpAware`'s comment
+ * first. `null` under the same `MAX_NORMALIZE_LENGTH` condition
+ * `segmentViewOf` uses; `[]` for an empty/non-string command or the
+ * never-throws fallback.
+ */
+export declare function segmentViewOfAmpAware(command: string): CommandSegment[] | null;
 /**
  * Return type of `normalizeCommandAmpAware` — deliberately NOT
  * `NormalizedCommand` (task aabbad63, hard constraint). It carries only
@@ -544,3 +583,76 @@ export interface QuoteAwareNormalizedCommand {
  * "not a formal proof" caveat.
  */
 export declare function normalizeCommandQuoteAware(command: string): QuoteAwareNormalizedCommand;
+/** Return type of `peelWrapperPrefixes` — see that function's own comment. */
+export interface WrapperPeelResult {
+    /** Index of the first token after every recognised wrapper prefix this
+     *  loop peeled — the wrapped invocation's own head token, or (if
+     *  `tokens.length`) no head token survived at all. */
+    idx: number;
+    /**
+     * The `env -C <dir>` / `--chdir <dir>` target directory, when this
+     * chain peeled an `env` wrapper naming one (excluding a `~`-prefixed
+     * value — F5, treated as if absent). `null` when no `env -C`/`--chdir`
+     * was peeled. Consumed only by `canonicalizeSegment`'s own
+     * `targetDir`/`targetBase` bookkeeping —
+     * `src/runtime/deletion-target-resolve.ts` (the other caller, task
+     * d03af8f6, review round 3) has no analogous need and ignores it.
+     */
+    envTargetDir: string | null;
+}
+/**
+ * Peel a leading wrapper-command chain: `VAR=value` tokens (any number,
+ * in sequence), `env` (+ its own flags/assignments, capturing `-C`/
+ * `--chdir`), `command` (+ its own flags), `nice` (+ its own flags),
+ * `sudo` / `doas` / `time` / `timeout` / `stdbuf` / `setsid` / `exec` /
+ * `nohup` (+ each one's own flags — F4 fix; `exec`/`nohup` added task
+ * d03af8f6, review round 3). Bounded by `tokens.length` so a
+ * pathological input cannot spin. Returns the cursor position of
+ * whatever token (if any) survives the peel — the caller decides what to
+ * do with it; this function never itself inspects the survivor.
+ *
+ * SHARED (task d03af8f6, review round 3) between `canonicalizeSegment`
+ * below — this module's own `git`/`gh`/`npm`/`harness` trigger
+ * recognition — and `src/runtime/deletion-target-resolve.ts`'s deletion-
+ * verb recognition (`rm`/`find`/`git clean`), which used to hand-roll an
+ * independent, narrower copy of this exact peeling vocabulary
+ * (`peelWrapperHeads`, missing `-u`/`-i`/`-C` on `env`, the duration-
+ * consuming shape of `timeout`, `nice`'s glued/`--adjustment=` forms,
+ * and `exec`/`nohup` entirely). Reusing this ONE loop instead of
+ * maintaining two means a future wrapper added here (or a flag fix to an
+ * existing one) benefits both gates automatically, and
+ * `npm run check:duplication`'s clone-count fitness function has one
+ * fewer near-duplicate block to flag. `deletion-target-resolve.ts` hands
+ * this a decoded token array built from ITS OWN quote-aware tokenizer
+ * (`WrapperPeelToken[]`, `.text` only — see that interface's own
+ * comment for why the offset-carrying `Token[]` this module's own
+ * `tokenizeWithOffsets` produces is not required here), then layers its
+ * own `xargs` handling on top (this loop deliberately does NOT recognise
+ * `xargs` — see the module header's NOT-SUPPORTED list for why `xargs`
+ * is architecturally different from every wrapper peeled here: its own
+ * argv is not simply "the command to run").
+ */
+export declare function peelWrapperPrefixes(tokens: readonly WrapperPeelToken[], startIdx?: number): WrapperPeelResult;
+/**
+ * Generic "peel this wrapper's own flags" loop shared by the small,
+ * bounded-vocabulary runners added for F4 (`sudo`, `doas`, `time`,
+ * `stdbuf`, `setsid`, `exec`, `nohup`): consume `--`, any flag in
+ * `valueFlags` (+ its following token), any glued short/long form
+ * matching `gluedRe`, then any OTHER `-`-prefixed token treated as
+ * boolean (mirrors `peelCommand` above — safe because an unrecognised
+ * flag is either genuinely boolean, in which case this is correct, or
+ * value-taking, in which case its VALUE token is left for the next
+ * iteration and — not being `git`, a known wrapper, or another flag —
+ * simply causes a clean, safe bail-out a token late rather than a false
+ * match). Does NOT capture flag VALUES: none of these wrappers have a
+ * "run in a different directory" semantic this module tracks as a
+ * target directory — only `env -C`/`--chdir` does, and that stays
+ * hand-written in `peelEnv`. Exported (task d03af8f6, review round 3) so
+ * `src/runtime/deletion-target-resolve.ts` can reuse this SAME loop for
+ * `xargs`'s own flags (`-0`, `-n1`, ...) instead of a third
+ * independently-drifting copy — that module is the reason this needs no
+ * value-flag vocabulary of its own either: `xargs`'s own value-taking
+ * flags are not modelled there, matching this function's existing
+ * effort level for the boolean-only wrappers above.
+ */
+export declare function peelGenericFlags(tokens: readonly WrapperPeelToken[], startIdx: number, valueFlags: ReadonlySet<string>, gluedRe: RegExp | null): number;

package/dist/runtime/command-normalize.js

@@ -374,16 +374,29 @@
 //   - `$(...)` command substitution is NOT in this list — see the
 //     "accidentally covered" note right below. Do not read its absence
 //     here as "also open"; it genuinely blocks today, pinned by a test.
-//   - Ten more measured-bypass spellings, none of them peeled wrapper
-//     prefixes or a recognised `git` spelling: `exec git status`, `nohup
-//     git status`, `ionice -c3 git status`, `flock /tmp/l git status`,
-//     `script -q /dev/null git status`, `chrt -b 0 git status`, `taskset
-//     -c 0 git status`, `\git status` (the backslash defeats
-//     `GIT_TOKEN_RE`, which requires the bare basename), `"git" status`
-//     (a QUOTED binary name — the mirror image of the quoted-subcommand
-//     gap above), and `env -S "git status"` (the split-string flag hands
-//     the rest of the argv to a fresh, opaque re-parse this module
-//     deliberately does not follow, per `peelEnv`'s own comment).
+//   - CLOSED (task d03af8f6, review round 3): `exec git status` and
+//     `nohup git status` used to sit in this list. Both are now peeled
+//     the same boolean-flag-only way as `setsid` (`peelExec`/`peelNohup`,
+//     part of the shared `peelWrapperPrefixes` loop) — added while
+//     rebuilding `src/runtime/deletion-target-resolve.ts`'s own
+//     recognition on top of this module's peelers so the deletion gate
+//     could see past `exec rm -rf ...` / `nohup rm -rf ... &`, and added
+//     HERE (not only there) so this module's own `git`/`gh`/`npm`/
+//     `harness` trigger recognition benefits too, per the orchestrator
+//     decision for that task. `exec`'s own rare value-taking flag (`-a
+//     name`) is NOT modelled — treated as boolean like every other
+//     unrecognised flag this loop's generic branch consumes, the same
+//     approximation `setsid`'s three flags already use.
+//   - Eight more measured-bypass spellings, none of them peeled wrapper
+//     prefixes or a recognised `git` spelling: `ionice -c3 git status`,
+//     `flock /tmp/l git status`, `script -q /dev/null git status`, `chrt
+//     -b 0 git status`, `taskset -c 0 git status`, `\git status` (the
+//     backslash defeats `GIT_TOKEN_RE`, which requires the bare
+//     basename), `"git" status` (a QUOTED binary name — the mirror image
+//     of the quoted-subcommand gap above), and `env -S "git status"` (the
+//     split-string flag hands the rest of the argv to a fresh, opaque
+//     re-parse this module deliberately does not follow, per `peelEnv`'s
+//     own comment).
 //   - `gh`'s / `npm`'s own tool-specific flags inserted BETWEEN the head
 //     token and its subcommand: `gh -R owner/repo pr merge`, `gh --repo
 //     owner/repo pr create`, `npm --loglevel=silent publish`, `npm
@@ -913,6 +926,40 @@ export function segmentViewOf(command) {
         return [];
     }
 }
+/**
+ * Ampersand-aware sibling of `segmentViewOf` (task d03af8f6, review
+ * round 3): the same per-segment view, but segmented under
+ * `AMP_BOUNDARY_RE` (`BOUNDARY_RE` plus a bare `&`) instead of
+ * `BOUNDARY_RE` — closing the same bare-`&` gap `normalizeCommandAmpAware`
+ * closes for trigger matching (`echo hi & rm -rf /home/x`), but as a
+ * segment VIEW rather than a rejoined string, for
+ * `src/runtime/deletion-target-resolve.ts`'s multi-segment scan. Uses the
+ * SAME shared walk (`segmentAndCanonicalize`, parameterised on
+ * `boundaryRe` since task aabbad63) as every other pass in this module —
+ * no new segmentation logic. `CommandSegment.effectiveTarget`'s own
+ * composition rules are UNCHANGED by which alphabet drove the split; a
+ * caller that only needs `.text` per segment (as the deletion resolver
+ * does) is unaffected by the same directory-extraction reliability
+ * caveat `normalizeCommandAmpAware`'s own comment names for `targetDir`/
+ * `targetBase` — this function returns the FULL `CommandSegment` shape,
+ * `effectiveTarget` included, so a future caller relying on THAT field
+ * under this alphabet should read `normalizeCommandAmpAware`'s comment
+ * first. `null` under the same `MAX_NORMALIZE_LENGTH` condition
+ * `segmentViewOf` uses; `[]` for an empty/non-string command or the
+ * never-throws fallback.
+ */
+export function segmentViewOfAmpAware(command) {
+    if (typeof command !== "string" || command.length === 0)
+        return [];
+    if (command.length > MAX_NORMALIZE_LENGTH)
+        return null;
+    try {
+        return segmentAndCanonicalize(command, AMP_BOUNDARY_RE, true).segments ?? [];
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Ampersand-aware SECOND normalisation pass (task aabbad63). Segments the
  * command under `AMP_BOUNDARY_RE` (`BOUNDARY_RE` plus a bare `&`) instead
@@ -1644,41 +1691,40 @@ function tokenizeWithOffsets(s) {
     return out;
 }
 /**
- * Rewrite one boundary-delimited segment: peel wrapper prefixes to look
- * for an invocation of one of the closed head-token set's four members
- * (`git`, `gh`, `npm`, `harness` — D-001, run
- * 2026-07-28-nongit-trigger-wrappers), and — ONLY if one is found —
- * canonicalise it. `git` is canonicalised to `git <subcommand>` with its
- * OWN global options dropped, same as before this run. The other three
- * are canonicalised by wrapper peeling plus whitespace collapsing across
- * the REST OF THE SEGMENT (fix round 2, finding F2 — rejoining every
- * token from the head onward with a single space, not just the head-to-
- * next-token gap), no option-dropping (see the module header). When no
- * recognised head token is found (wrong binary, ran out of tokens, or a
- * malformed git global option), the segment is returned COMPLETELY
- * UNCHANGED: peeling is tentative, and nothing is stripped from a
- * segment that turns out not to be a recognised call (so `digit=1 foo`,
- * `env -C X ls`, `ghx pr merge`, etc. are never touched).
+ * Peel a leading wrapper-command chain: `VAR=value` tokens (any number,
+ * in sequence), `env` (+ its own flags/assignments, capturing `-C`/
+ * `--chdir`), `command` (+ its own flags), `nice` (+ its own flags),
+ * `sudo` / `doas` / `time` / `timeout` / `stdbuf` / `setsid` / `exec` /
+ * `nohup` (+ each one's own flags — F4 fix; `exec`/`nohup` added task
+ * d03af8f6, review round 3). Bounded by `tokens.length` so a
+ * pathological input cannot spin. Returns the cursor position of
+ * whatever token (if any) survives the peel — the caller decides what to
+ * do with it; this function never itself inspects the survivor.
+ *
+ * SHARED (task d03af8f6, review round 3) between `canonicalizeSegment`
+ * below — this module's own `git`/`gh`/`npm`/`harness` trigger
+ * recognition — and `src/runtime/deletion-target-resolve.ts`'s deletion-
+ * verb recognition (`rm`/`find`/`git clean`), which used to hand-roll an
+ * independent, narrower copy of this exact peeling vocabulary
+ * (`peelWrapperHeads`, missing `-u`/`-i`/`-C` on `env`, the duration-
+ * consuming shape of `timeout`, `nice`'s glued/`--adjustment=` forms,
+ * and `exec`/`nohup` entirely). Reusing this ONE loop instead of
+ * maintaining two means a future wrapper added here (or a flag fix to an
+ * existing one) benefits both gates automatically, and
+ * `npm run check:duplication`'s clone-count fitness function has one
+ * fewer near-duplicate block to flag. `deletion-target-resolve.ts` hands
+ * this a decoded token array built from ITS OWN quote-aware tokenizer
+ * (`WrapperPeelToken[]`, `.text` only — see that interface's own
+ * comment for why the offset-carrying `Token[]` this module's own
+ * `tokenizeWithOffsets` produces is not required here), then layers its
+ * own `xargs` handling on top (this loop deliberately does NOT recognise
+ * `xargs` — see the module header's NOT-SUPPORTED list for why `xargs`
+ * is architecturally different from every wrapper peeled here: its own
+ * argv is not simply "the command to run").
  */
-function canonicalizeSegment(segmentText) {
-    const tokens = tokenizeWithOffsets(segmentText);
-    if (tokens.length === 0) {
-        return {
-            text: segmentText,
-            targetDir: null,
-            targetBase: null,
-            identityTargetDir: null,
-            identityTargetBase: null,
-            isGit: false,
-        };
-    }
-    let idx = 0;
+export function peelWrapperPrefixes(tokens, startIdx = 0) {
+    let idx = startIdx;
     let envTargetDir = null;
-    // Peel wrapper prefixes: VAR=value tokens, `env` (+ its own flags/
-    // assignments), `command` (+ its own flags), `nice` (+ its own
-    // flags), `sudo` / `doas` / `time` / `timeout` / `stdbuf` / `setsid`
-    // (+ each one's own flags — F4 fix). Bounded by tokens.length so a
-    // pathological input cannot spin.
     for (let guard = 0; guard < tokens.length; guard++) {
         const head = tokens[idx]?.text;
         if (head === undefined)
@@ -1726,8 +1772,50 @@ function canonicalizeSegment(segmentText) {
             idx = peelSetsid(tokens, idx + 1);
             continue;
         }
+        if (head === "exec") {
+            idx = peelExec(tokens, idx + 1);
+            continue;
+        }
+        if (head === "nohup") {
+            idx = peelNohup(tokens, idx + 1);
+            continue;
+        }
         break;
     }
+    return { idx, envTargetDir };
+}
+/**
+ * Rewrite one boundary-delimited segment: peel wrapper prefixes to look
+ * for an invocation of one of the closed head-token set's four members
+ * (`git`, `gh`, `npm`, `harness` — D-001, run
+ * 2026-07-28-nongit-trigger-wrappers), and — ONLY if one is found —
+ * canonicalise it. `git` is canonicalised to `git <subcommand>` with its
+ * OWN global options dropped, same as before this run. The other three
+ * are canonicalised by wrapper peeling plus whitespace collapsing across
+ * the REST OF THE SEGMENT (fix round 2, finding F2 — rejoining every
+ * token from the head onward with a single space, not just the head-to-
+ * next-token gap), no option-dropping (see the module header). When no
+ * recognised head token is found (wrong binary, ran out of tokens, or a
+ * malformed git global option), the segment is returned COMPLETELY
+ * UNCHANGED: peeling is tentative, and nothing is stripped from a
+ * segment that turns out not to be a recognised call (so `digit=1 foo`,
+ * `env -C X ls`, `ghx pr merge`, etc. are never touched).
+ */
+function canonicalizeSegment(segmentText) {
+    const tokens = tokenizeWithOffsets(segmentText);
+    if (tokens.length === 0) {
+        return {
+            text: segmentText,
+            targetDir: null,
+            targetBase: null,
+            identityTargetDir: null,
+            identityTargetBase: null,
+            isGit: false,
+        };
+    }
+    const peeled = peelWrapperPrefixes(tokens);
+    let idx = peeled.idx;
+    const envTargetDir = peeled.envTargetDir;
     const headTok = tokens[idx]?.text;
     if (headTok === undefined) {
         return {
@@ -2006,19 +2094,26 @@ function peelNice(tokens, startIdx) {
 /**
  * Generic "peel this wrapper's own flags" loop shared by the small,
  * bounded-vocabulary runners added for F4 (`sudo`, `doas`, `time`,
- * `stdbuf`, `setsid`): consume `--`, any flag in `valueFlags` (+ its
- * following token), any glued short/long form matching `gluedRe`, then
- * any OTHER `-`-prefixed token treated as boolean (mirrors `peelCommand`
- * above — safe because an unrecognised flag is either genuinely boolean,
- * in which case this is correct, or value-taking, in which case its
- * VALUE token is left for the next iteration and — not being `git`, a
- * known wrapper, or another flag — simply causes a clean, safe bail-out
- * a token late rather than a false match). Does NOT capture flag
- * VALUES: none of these five wrappers have a "run in a different
- * directory" semantic this module tracks as a target directory — only
- * `env -C`/`--chdir` does, and that stays hand-written in `peelEnv`.
+ * `stdbuf`, `setsid`, `exec`, `nohup`): consume `--`, any flag in
+ * `valueFlags` (+ its following token), any glued short/long form
+ * matching `gluedRe`, then any OTHER `-`-prefixed token treated as
+ * boolean (mirrors `peelCommand` above — safe because an unrecognised
+ * flag is either genuinely boolean, in which case this is correct, or
+ * value-taking, in which case its VALUE token is left for the next
+ * iteration and — not being `git`, a known wrapper, or another flag —
+ * simply causes a clean, safe bail-out a token late rather than a false
+ * match). Does NOT capture flag VALUES: none of these wrappers have a
+ * "run in a different directory" semantic this module tracks as a
+ * target directory — only `env -C`/`--chdir` does, and that stays
+ * hand-written in `peelEnv`. Exported (task d03af8f6, review round 3) so
+ * `src/runtime/deletion-target-resolve.ts` can reuse this SAME loop for
+ * `xargs`'s own flags (`-0`, `-n1`, ...) instead of a third
+ * independently-drifting copy — that module is the reason this needs no
+ * value-flag vocabulary of its own either: `xargs`'s own value-taking
+ * flags are not modelled there, matching this function's existing
+ * effort level for the boolean-only wrappers above.
  */
-function peelGenericFlags(tokens, startIdx, valueFlags, gluedRe) {
+export function peelGenericFlags(tokens, startIdx, valueFlags, gluedRe) {
     let idx = startIdx;
     while (idx < tokens.length) {
         const t = tokens[idx].text;
@@ -2108,6 +2203,25 @@ function peelStdbuf(tokens, startIdx) {
 function peelSetsid(tokens, startIdx) {
     return peelGenericFlags(tokens, startIdx, new Set(), null);
 }
+/**
+ * `exec`'s own flags (bash builtin: `-a name`, `-c`, `-l`) are rare
+ * enough that this module treats it as a boolean-only wrapper like
+ * `setsid` above — an unrecognised flag (including `-a`, whose VALUE
+ * this does not capture) simply consumes one token via
+ * `peelGenericFlags`'s generic `-flag` branch (task d03af8f6, review
+ * round 3 — closes the `exec git status` / `exec rm -rf ...` bypass
+ * named in the module header's NOT-SUPPORTED list).
+ */
+function peelExec(tokens, startIdx) {
+    return peelGenericFlags(tokens, startIdx, new Set(), null);
+}
+/** `nohup` takes no flags of its own (GNU coreutils: only `--help`/`--version`,
+ *  neither of which precedes a real wrapped command). Boolean-only, same
+ *  shape as `peelSetsid`/`peelExec` (task d03af8f6, review round 3 — closes
+ *  the `nohup git status` / `nohup rm -rf ... &` bypass). */
+function peelNohup(tokens, startIdx) {
+    return peelGenericFlags(tokens, startIdx, new Set(), null);
+}
 /** Strip a path that ends in a `.git` directory down to its parent. */
 function parentIfDotGit(dir) {
     const trimmed = dir.replace(/\/+$/, "");