@opengsd/gsd-path 1.4.0 → 1.6.0

package/scripts/guard_hook.py

@@ -121,6 +121,10 @@ ARCHIVE_REASON = (
     "committed GSD Path archives under .project/archive/ are read-only; "
     "only the bundled pipeline helpers may write there during a ship transaction"
 )
+ARCHIVE_UNPROVEN_READ_REASON = (
+    "commands run in archive context must be provably read-only; only "
+    "recognized read commands and the bundled pipeline helpers may run there"
+)
 DESTRUCTIVE_SHAPE_REASON = (
     "destructive commands must run alone with literal paths; split compound, "
     "substituted, or expanded destructive commands into single commands"
@@ -182,7 +186,7 @@ STATUS_STATE_FIELDS = frozenset(
         "integration_source",
     }
 )
-STATUS_INTEGRATION_MODES = frozenset({"direct", "pull-request"})
+STATUS_INTEGRATION_MODES = frozenset({"direct", "pull-request", "external-landing"})
 STATUS_INTEGRATION_SOURCES = frozenset({"default", "milestone"})
 STATUS_SLUG = re.compile(r"^[a-z0-9][a-z0-9-]*$")
 STATUS_BRANCH = re.compile(r"^gsd-path/M(\d{3,})$")
@@ -206,6 +210,7 @@ ARCHIVE_READ_COMMANDS = frozenset(
         "tail",
         "grep",
         "rg",
+        "sed",
         "ls",
         "stat",
         "wc",
@@ -233,6 +238,147 @@ CLOSED_LISTING_GIT_OPTIONS = {
     "symbolic-ref": frozenset({"-q", "--quiet", "--short"}),
 }
 GIT_READ_WRITE_OPTIONS = frozenset({"--output", "--ext-diff", "--textconv"})
+# Options whose value git writes to or runs as a command: one unknown word is
+# already enough, so a parameter in or after them is never accepted.
+GIT_PARAMETER_DENIED_OPTIONS = GIT_READ_WRITE_OPTIONS | {
+    "--upload-pack", "--receive-pack", "--exec", "-c", "--config-env",
+}
+
+
+# -c/--config keys whose value git executes as a program. A literal value is
+# as dangerous as a parameter here: git -c core.fsmonitor=<path> status runs
+# the configured program while the subcommand stays nominally read-only.
+GIT_EXECUTED_CONFIG_KEYS = frozenset({
+    "core.fsmonitor", "core.editor", "sequence.editor", "core.sshcommand",
+    "core.askpass", "core.pager", "core.gitproxy", "interactive.difffilter",
+})
+GIT_EXECUTED_CONFIG_SECTIONS = {
+    "filter": (".clean", ".smudge", ".process", ".command"),
+    "diff": (".command", ".textconv", ".external"),
+    "merge": (".driver",),
+    "remote": (".uploadpack", ".receivepack"),
+    "gpg": (".program",),
+    "credential": (".helper",),
+    "pager": ("",),
+}
+# Keys whose value is a path or URL git loads code through: an included file
+# can set every key above, and a rewritten URL can retarget the transport.
+# No value of these is a disabling form.
+GIT_LOADED_CONFIG_KEYS = frozenset({"core.hookspath", "include.path"})
+GIT_LOADED_CONFIG_SECTIONS = {
+    "includeif": (".path",),
+    "url": (".insteadof", ".pushinsteadof"),
+}
+GIT_CONFIG_DISABLING_VALUES = frozenset({"", "false"})
+
+
+def config_key_in(key, keys, sections):
+    if key in keys:
+        return True
+    section, _, remainder = key.partition(".")
+    return bool(remainder) and key.endswith(tuple(sections.get(section, ())))
+
+
+def loaded_config_key(key):
+    """Whether a config key's value is a path or URL git loads code through."""
+    return config_key_in(key, GIT_LOADED_CONFIG_KEYS, GIT_LOADED_CONFIG_SECTIONS)
+
+
+def executed_config_key(key):
+    """Whether a config key's value is a program git runs or code it loads."""
+    return loaded_config_key(key) or config_key_in(
+        key, GIT_EXECUTED_CONFIG_KEYS, GIT_EXECUTED_CONFIG_SECTIONS
+    )
+
+
+# Real read-only git options that are a strict prefix of a denied option name.
+GIT_SAFE_PREFIX_OPTIONS = frozenset({"--text"})
+
+
+def git_option_in(token, options):
+    """Whether a token names one of the options, by full name or any long-option prefix.
+
+    git accepts each unique prefix of a long option; matching every prefix is
+    stricter than git and so only fails closed. A prefix that is itself the
+    exact name of a read-only option is that option, not an abbreviation.
+    """
+    name = token.split("=", 1)[0]
+    if name in GIT_SAFE_PREFIX_OPTIONS and name not in options:
+        return False
+    if name.startswith("--") and len(name) > 2:
+        return any(option.startswith(name) for option in options)
+    return name in options
+GIT_CONFIG_READ_MODES = frozenset({
+    "--get", "--get-all", "--get-regexp", "--get-urlmatch", "--get-color",
+    "--get-colorbool", "-l", "--list", "--unset", "--unset-all",
+})
+GIT_CONFIG_READ_SUBCOMMANDS = frozenset({"get", "unset", "list"})
+GIT_CONFIG_DENIED_MODES = frozenset({"--rename-section", "--remove-section", "--edit"})
+GIT_CONFIG_DENIED_SUBCOMMANDS = frozenset({"rename-section", "remove-section", "edit"})
+GIT_CONFIG_VALUE_OPTIONS = frozenset({
+    "--file", "--blob", "--type", "--default", "--comment", "--value", "--url",
+})
+GIT_CONFIG_EDIT_SHORT_OPTION = re.compile(r"-[A-Za-z]*e[A-Za-z]*")
+# An unquoted word the shell can turn into several arguments: a glob, or a
+# brace list or range.
+PLAIN_QUOTED_SEGMENT = re.compile(r"'[^']*'|\"[^\"]*\"")
+ANSI_QUOTE_START = re.compile(r"\$['\"]")
+GIT_CONFIG_EXPANDING_WORD = re.compile(r"[*?\[]|\{.*(?:,|\.\.)")
+
+
+def denied_git_config_argument(arguments):
+    """The git config argument that persists or runs a program git executes.
+
+    A section rename can carry a key into an executed section and --edit runs
+    the editor, so both are denied outright. Otherwise only a set denies: an
+    executed key with a value operand after it and no read or unset mode.
+    Only a trailing redirection is dropped: the operator, its target and a
+    file descriptor digit written against it. A separate digit (5 >file) and a
+    quoted operator are operands.
+    """
+    arguments = list(arguments)
+    while (
+        len(arguments) >= 2
+        and getattr(arguments[-2], "redirection", False)
+        and not arguments[-2].isdigit()
+    ):
+        del arguments[-2:]
+        if (
+            arguments
+            and getattr(arguments[-1], "redirection", False)
+            and arguments[-1].isdigit()
+        ):
+            del arguments[-1]
+    separator = arguments.index("--") if "--" in arguments else len(arguments)
+    options = arguments[:separator]
+    for token in options:
+        if (
+            git_option_in(token, GIT_CONFIG_DENIED_MODES)
+            or GIT_CONFIG_EDIT_SHORT_OPTION.fullmatch(token)
+            or token.casefold() in GIT_CONFIG_DENIED_SUBCOMMANDS
+        ):
+            return token
+    if options[:1] and options[0].casefold() in GIT_CONFIG_READ_SUBCOMMANDS:
+        return None
+    for position, token in enumerate(options):
+        # A mode word that is the value of the option before it is no mode.
+        if token in GIT_CONFIG_READ_MODES and not (
+            position
+            and (
+                options[position - 1] == "-f"
+                or git_option_in(options[position - 1], GIT_CONFIG_VALUE_OPTIONS)
+            )
+        ):
+            return None
+    operands = [
+        token for token in options if not token.startswith("-")
+    ] + arguments[separator + 1:]
+    for token in operands[:-1]:
+        if executed_config_key(token.casefold()):
+            return token
+    return None
+
+
 ARCHIVE_READ_EXECUTION_OPTIONS = {"rg": frozenset({"--pre"})}
 AMBIGUOUS_SHELL_SYNTAX = re.compile(r"[\r\n|;&<>`]|\$\(|@\(")
 SUBSTITUTION_PLACEHOLDER = "COMMAND_SUBSTITUTION_"
@@ -240,10 +386,6 @@ SUBSTITUTION_PLACEHOLDER_SYNTAX = re.compile(
     r"\$\{" + SUBSTITUTION_PLACEHOLDER + r"(\d+)\}"
 )
 LINE_CONTINUATION = re.compile(r"(?<!\\)((?:\\\\)*)\\\r?\n")
-HEREDOC_PATTERN = re.compile(
-    r"<<(?P<dash>-?)\s*(?:'(?P<single>[^']+)'|\"(?P<double>[^\"]+)\""
-    r"|\\?(?P<bare>[A-Za-z_][A-Za-z0-9_]*))"
-)
 SHELL_WRITE_REDIRECTION_CHARS = frozenset("<>&|")
 SHELL_PARAMETER_SYNTAX = re.compile(
     r"\$(?:[A-Za-z_][A-Za-z0-9_]*|[0-9]+|[-*@#?$!]|\{[^}\r\n]+\})"
@@ -251,9 +393,12 @@ SHELL_PARAMETER_SYNTAX = re.compile(
 NAMED_SHELL_PARAMETER_SYNTAX = re.compile(
     r"\$(?:([A-Za-z_][A-Za-z0-9_]*)|\{([A-Za-z_][A-Za-z0-9_]*)\})"
 )
+ZSH_EXPANSION_FLAG_SYNTAX = re.compile(r"\$[=~^+]")
 CMD_PARAMETER_SYNTAX = re.compile(
     r"%([A-Za-z_][A-Za-z0-9_]*)%|!([A-Za-z_][A-Za-z0-9_]*)!"
 )
+# The shell reassigns these on every cd, so a tracked value is stale.
+SHELL_DIRECTORY_VARIABLES = frozenset({"PWD", "OLDPWD"})
 DIRECTORY_CHANGE_COMMANDS = frozenset(
     {"cd", "chdir", "pushd", "set-location", "sl"}
 )
@@ -262,6 +407,18 @@ GIT_REASONS = {
     "clean": "git clean -f deletes untracked evidence and retained task worktrees",
     "push": "force pushes rewrite build-branch history the pipeline resumes from",
     "branch": "git branch -D destroys task branches the recovery protocol inspects",
+    "unresolved-target": (
+        "{action} needs a literal target the guard can resolve; name the branch, "
+        "ref, or registered worktree directly"
+    ),
+    "git-environment": (
+        "env changes Git's repository or alias configuration context; run the Git "
+        "command without resetting or unsetting Git-related environment variables"
+    ),
+    "update-ref-order": (
+        "git update-ref deletion after another Git command can follow a symbolic "
+        "ref that command changed; run it as its own command or add --no-deref"
+    ),
     "branch-move": (
         "git branch -m renames a branch the pipeline resumes by name "
         "(STATE.branch); create a new branch instead"
@@ -306,6 +463,8 @@ MISSING_COMMAND_STRING_REASON = "{executable} {option} lacks a command string"
 UNVALIDATED_EXECUTION_REASONS = {
     ".": SCRIPT_FILE_REASON,
     "source": SCRIPT_FILE_REASON,
+    "readonly": "readonly changes shell assignment behavior the guard cannot validate; "
+    "avoid readonly declarations",
     "start": "start launches a detached process the guard cannot inspect; run the program directly",
     "setenv": ENV_BUILTIN_REASON,
     "unsetenv": ENV_BUILTIN_REASON,
@@ -370,7 +529,64 @@ SHELL_WRITE_COMMANDS = DESTRUCTIVE_SHELL_COMMANDS | frozenset(
     }
 )
 IN_PLACE_EDITORS = frozenset({"perl", "sed"})
+SED_SAFE_OPTIONS = frozenset(
+    {
+        "--debug",
+        "--help",
+        "--null-data",
+        "--posix",
+        "--quiet",
+        "--regexp-extended",
+        "--sandbox",
+        "--separate",
+        "--silent",
+        "--unbuffered",
+        "--version",
+        "-E",
+        "-n",
+        "-r",
+        "-s",
+        "-u",
+    }
+)
 FIND_EXECUTION_ACTIONS = frozenset({"-exec", "-execdir", "-ok", "-okdir"})
+# Programs that run the command in their arguments, with the options of each
+# that take a separate value. The guard checks the command they run.
+EXEC_PREFIX_VALUE_OPTIONS = {
+    "nice": frozenset({"-n", "--adjustment"}),
+    "nohup": frozenset(),
+    "setsid": frozenset(),
+    "stdbuf": frozenset({"-i", "-o", "-e", "--input", "--output", "--error"}),
+    "sudo": frozenset({
+        "-u", "-g", "-h", "-p", "-C", "-T", "-U", "-r", "-t",
+        "--user", "--group", "--host", "--prompt", "--close-from",
+        "--command-timeout", "--other-user", "--role", "--type",
+    }),
+    "time": frozenset({"-f", "--format"}),
+    "timeout": frozenset({"-s", "-k", "--signal", "--kill-after"}),
+    "watch": frozenset({"-n", "-q", "--interval", "--equexit"}),
+}
+# Runner options that write, edit or enter a file or directory by themselves.
+EXEC_PREFIX_FILE_OPTIONS = {
+    "sudo": frozenset({"-e", "-D", "-R", "--edit", "--chdir", "--chroot"}),
+    "time": frozenset({"-o", "--output"}),
+    "watch": frozenset({"-s", "--shotsdir"}),
+}
+# The short option letters of each runner that take no value.
+EXEC_PREFIX_FLAG_LETTERS = {
+    "nice": "",
+    "nohup": "",
+    "setsid": "cfw",
+    "stdbuf": "",
+    "sudo": "AbBEHiKklnNPSsVv",
+    "time": "ahlpqvV",
+    "timeout": "fpv",
+    "watch": "bcCdegprtwx",
+}
+EXEC_PREFIX_INTERVAL_OPTIONS = frozenset({"-n", "--interval"})
+RUNNER_DURATION = re.compile(
+    r"(?:(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?|inf(?:inity)?)[smhd]?", re.IGNORECASE
+)
 SHELL_CONTROL_WORDS = frozenset(
     {
         "!",
@@ -925,30 +1141,29 @@ def closed_target_reason(targets):
     return None
 
 
-def enforce_pipeline_reentry(paths, working_directories):
-    reason = closed_target_reason((path, working_directories) for path in paths)
-    if reason:
-        deny(reason)
-    classified = pipeline_target_kinds((path, working_directories) for path in paths)
+def pipeline_product_phase_reason(classified):
+    """Why product writes are denied outside the routed build phase, or None when allowed."""
     if classified is None:
-        return
+        return None
     repo, state, kinds = classified
     for path, kind in kinds:
         if kind == "protected":
-            deny(f"{CONTROL_FILE_REASON} {path}")
-    kinds = [kind for _, kind in kinds]
-    if all(kind == "external" for kind in kinds):
-        return
+            return f"{CONTROL_FILE_REASON} {path}"
+    kind_values = [kind for _, kind in kinds]
+    if all(kind == "external" for kind in kind_values):
+        return None
+    if not any(kind == "product" for kind in kind_values):
+        return None
     try:
         status = project_status(repo)
     except (OSError, ValueError, json.JSONDecodeError):
-        deny(REENTRY_FAILURE_REASON)
+        return REENTRY_FAILURE_REASON
     route = status.get("route")
     state_data = status.get("state") if isinstance(status.get("state"), dict) else {}
     completion = status.get("completion")
     if (state_data.get("phase") == "shipped"
             and isinstance(completion, dict) and completion.get("status") == "verified"):
-        return
+        return None
     routed_build = (
         state_data.get("phase") == "build"
         and isinstance(route, dict)
@@ -956,20 +1171,31 @@ def enforce_pipeline_reentry(paths, working_directories):
         and route.get("phase") == "build"
     )
     if routed_build:
-        return
-    if all(kind in {"external", "artifact"} for kind in kinds):
-        return
+        return None
+    if all(kind in {"external", "artifact"} for kind in kind_values):
+        return None
     phase = state_data.get("phase", "unknown")
     if isinstance(route, dict) and route.get("action") != "run-phase":
         next_step = f"{route.get('action', 'route')}: {route.get('reason', 'no reason')}"
     else:
         next_step = status.get("next_skill") or "gsd-path"
-    deny(
+    return (
         f"GSD Path is {phase}; direct product-file changes require the routed "
         f"build phase. Review {status.get('path', state)}; next: {next_step}"
     )
 
 
+def enforce_pipeline_reentry(paths, working_directories):
+    reason = closed_target_reason((path, working_directories) for path in paths)
+    if reason:
+        deny(reason)
+    reason = pipeline_product_phase_reason(
+        pipeline_target_kinds((path, working_directories) for path in paths)
+    )
+    if reason:
+        deny(reason)
+
+
 def in_archive(path):
     # Casefold: APFS and Windows resolve `.Project/Archive` to the archive.
     normalized = normalize_posix(path).casefold()
@@ -1147,10 +1373,10 @@ def directory_change_target(arguments):
     return operands[-1]
 
 
-def segment_directories(tokens, working_directories):
+def segment_directories(tokens, working_directories, contexts=None):
     """Yield each command segment with the working directories in effect for it."""
     current_directories = list(working_directories)
-    for segment in command_segments(tokens):
+    for position, segment in enumerate(command_segments(tokens)):
         yield segment, current_directories
         invocation = command_invocation(segment)
         if invocation is None:
@@ -1163,16 +1389,36 @@ def segment_directories(tokens, working_directories):
         if command not in DIRECTORY_CHANGE_COMMANDS:
             continue
         target = directory_change_target(arguments)
-        if SHELL_PARAMETER_SYNTAX.search(target):
+        tracked = {}
+        if contexts is not None and position < len(contexts):
+            tracked = {
+                name: value
+                for name, value in contexts[position].items()
+                if name not in SHELL_DIRECTORY_VARIABLES
+            }
+        expanded = expand_environment_parameters(target, tracked, tracked_only=True)
+        # An unquoted empty expansion leaves no word: the shell changes to HOME.
+        if (
+            (target and not expanded)
+            or SHELL_PARAMETER_SYNTAX.search(expanded)
+            or CMD_PARAMETER_SYNTAX.search(expanded)
+        ):
             raise ValueError(
                 f"cd target {target} cannot be resolved by the guard; "
                 "run that command first and cd to the literal result"
             )
-        if is_absolute_path(target):
-            current_directories = [target]
+        if (
+            (SHELL_PARAMETER_SYNTAX.search(target) or CMD_PARAMETER_SYNTAX.search(target))
+            and any(character.isspace() or character in "*?[]" for character in expanded)
+        ):
+            raise ValueError(
+                f"cd target {target} may split or glob; pass a literal path"
+            )
+        if is_absolute_path(expanded):
+            current_directories = [expanded]
         else:
             bases = current_directories or ["."]
-            current_directories = [f"{base}/{target}" for base in bases]
+            current_directories = [f"{base}/{expanded}" for base in bases]
 
 
 def command_can_destroy_files(invocation):
@@ -1188,9 +1434,11 @@ def command_can_destroy_files(invocation):
 def literal_path(operand):
     if len(operand) >= 2 and operand[0] in "\"'" and operand[-1] == operand[0]:
         operand = operand[1:-1]
-    pattern = r"[A-Za-z0-9._/-]+"
+    # A space is safe here: the operand is one shlex unit, so it cannot carry a
+    # second word; injection-relevant characters stay excluded.
+    pattern = r"[A-Za-z0-9._/ -]+"
     if os.name == "nt":
-        pattern = r"(?:[A-Za-z]:(?=[/\\]))?[A-Za-z0-9._/\\-]+"
+        pattern = r"(?:[A-Za-z]:(?=[/\\]))?[A-Za-z0-9._/\\ -]+"
     return operand if re.fullmatch(pattern, operand) is not None else None
 
 
@@ -1203,19 +1451,27 @@ def literal_destructive_operand(operand):
     return literal
 
 
-def command_references_archive(tokens, working_directories):
-    for segment, directories in segment_directories(tokens, working_directories):
-        invocation = command_invocation(segment)
-        ancestors = command_can_destroy_files(invocation)
-        operands = segment
-        if ancestors:
-            operands = [literal_destructive_operand(operand) for operand in invocation[1]]
-        if any(path_in_archive(operand, directories, ancestors) for operand in operands):
-            return True
-        wrapped = wrapped_command_tokens(segment, expand_parameters=False)
-        if wrapped is not None and command_references_archive(wrapped, directories):
-            return True
-    return False
+def segment_references_archive(segment, directories, assignments=None):
+    invocation = command_invocation(segment)
+    ancestors = command_can_destroy_files(invocation)
+    # A here-document body survives tokenization only inside a wrapped payload
+    # (bash -c '...'), where it is data, not commands; keep its text from
+    # flipping the segment into archive context.
+    def searchable(token):
+        return strip_heredoc_bodies(token) if "\n" in token else token
+
+    operands = [
+        expand_environment_parameters(searchable(token), assignments)
+        for token in segment
+    ]
+    if ancestors:
+        resolved = command_invocation(operands)
+        operands = [literal_destructive_operand(operand) for operand in resolved[1]]
+    if any(path_in_archive(operand, directories, ancestors) for operand in operands):
+        return True
+    return unresolved_archive_expansion(
+        " ".join(searchable(token) for token in segment), assignments
+    )
 
 
 def copy_destinations(arguments, directories, assignments=None):
@@ -1286,43 +1542,258 @@ def copy_destinations(arguments, directories, assignments=None):
                         yield str(output / entry.relative_to(source_path))
 
 
+def sed_delimited_end(script, index, delimiter):
+    while index < len(script):
+        if script[index] == "\\":
+            index += 2
+        elif script[index] == delimiter:
+            return index + 1
+        else:
+            index += 1
+    return None
+
+
+def sed_address_end(script, index):
+    if index >= len(script):
+        return index
+    if script[index].isdigit():
+        while index < len(script) and script[index].isdigit():
+            index += 1
+        if index < len(script) and script[index] == "~":
+            index += 1
+            while index < len(script) and script[index].isdigit():
+                index += 1
+    elif script[index] == "$":
+        index += 1
+    elif script[index] == "/":
+        end = sed_delimited_end(script, index + 1, "/")
+        return len(script) if end is None else end
+    elif script[index] == "\\" and index + 1 < len(script):
+        end = sed_delimited_end(script, index + 2, script[index + 1])
+        return len(script) if end is None else end
+    return index
+
+
+def sed_script_is_read_only(script):
+    """Accept only sed scripts whose commands cannot write or execute."""
+    # Sed blocks require recursively validating their nested command grammar;
+    # reject them until that grammar is modeled explicitly.
+    safe_commands = frozenset("aAcCdDgGhHiIlLnNpPqQrstTxv=:")
+    index = 0
+    while index < len(script):
+        while index < len(script) and (script[index].isspace() or script[index] == ";"):
+            index += 1
+        if index >= len(script):
+            break
+        address_start = index
+        index = sed_address_end(script, index)
+        if index < len(script) and script[index] == ",":
+            index = sed_address_end(script, index + 1)
+        if index > address_start and index < len(script) and script[index] == "!":
+            index += 1
+        while index < len(script) and script[index].isspace():
+            index += 1
+        if index >= len(script):
+            break
+        command = script[index]
+        index += 1
+        if command in {"w", "W", "e"}:
+            return False
+        if command == "#":
+            newline = script.find("\n", index)
+            index = len(script) if newline < 0 else newline + 1
+            continue
+        if command == "s":
+            if index >= len(script):
+                return False
+            delimiter = script[index]
+            index = sed_delimited_end(script, index + 1, delimiter)
+            if index is None:
+                return False
+            index = sed_delimited_end(script, index, delimiter)
+            if index is None:
+                return False
+            end = index
+            while end < len(script) and script[end] not in ";\n":
+                end += 1
+            if any(flag in "wWe" for flag in script[index:end]):
+                return False
+            index = end
+            continue
+        if command == "y":
+            if index >= len(script):
+                return False
+            delimiter = script[index]
+            index = sed_delimited_end(script, index + 1, delimiter)
+            if index is None:
+                return False
+            index = sed_delimited_end(script, index, delimiter)
+            if index is None:
+                return False
+            continue
+        if command not in safe_commands:
+            return False
+        while index < len(script) and script[index] not in ";\n":
+            index += 1
+    return True
+
+
+def sed_arguments(arguments):
+    """Return (in_place, input_files, script_is_read_only) for sed arguments."""
+    in_place = False
+    scripts = []
+    inputs = []
+    script_seen = False
+    scripts_are_literal = True
+    index = 0
+    while index < len(arguments):
+        argument = arguments[index]
+        index += 1
+        if argument == "--":
+            positional = arguments[index:]
+            if not script_seen and positional:
+                scripts.append(positional[0])
+                positional = positional[1:]
+                script_seen = True
+            inputs.extend(positional)
+            break
+        if argument in {"-e", "--expression"}:
+            if index >= len(arguments):
+                return in_place, inputs, False
+            scripts.append(arguments[index])
+            script_seen = True
+            index += 1
+            continue
+        if argument == "-f" or argument == "--file":
+            if index >= len(arguments):
+                return in_place, inputs, False
+            script_seen = True
+            scripts_are_literal = False
+            index += 1
+            continue
+        if argument.startswith("--expression="):
+            scripts.append(argument.split("=", 1)[1])
+            script_seen = True
+            continue
+        if argument.startswith("--file="):
+            script_seen = True
+            scripts_are_literal = False
+            continue
+        if argument == "--in-place" or argument.startswith("--in-place="):
+            in_place = True
+            continue
+        if argument.startswith("--"):
+            if argument not in SED_SAFE_OPTIONS:
+                scripts_are_literal = False
+            continue
+        if argument.startswith("-") and argument != "-":
+            options = argument[1:]
+            cursor = 0
+            while cursor < len(options):
+                option = options[cursor]
+                cursor += 1
+                if option == "i":
+                    in_place = True
+                    break
+                if option == "e":
+                    if cursor < len(options):
+                        scripts.append(options[cursor:])
+                        script_seen = True
+                    elif index < len(arguments):
+                        scripts.append(arguments[index])
+                        script_seen = True
+                        index += 1
+                    else:
+                        return in_place, inputs, False
+                    break
+                if option not in "nErsu":
+                    scripts_are_literal = False
+            continue
+        if not script_seen:
+            scripts.append(argument)
+            script_seen = True
+        else:
+            inputs.append(argument)
+    if not scripts or not scripts_are_literal:
+        return in_place, inputs, False
+    return in_place, inputs, all(sed_script_is_read_only(script) for script in scripts)
+
+
 def shell_write_targets(tokens, working_directories, assignments=None):
-    """Yield (target, directories) for every path a shell command may write."""
-    assignments = {**(assignments or {}), **shell_assignment_values(tokens)}
-    for segment, directories in segment_directories(tokens, working_directories):
+    """Yield (target, directories, variables) for every path a shell command may write."""
+    for segment, directories, segment_assignments, _ in shell_segment_contexts(
+        tokens, working_directories, assignments
+    ):
         for index, token in enumerate(segment[:-1]):
             if ">" not in token or not set(token) <= SHELL_WRITE_REDIRECTION_CHARS:
                 continue
             target = segment[index + 1]
             if token.endswith("&") and (target.isdigit() or target == "-"):
                 continue
-            yield target, directories
+            yield target, directories, segment_assignments
         wrapped = wrapped_command_tokens(segment)
         if wrapped is not None:
-            yield from shell_write_targets(wrapped, directories, assignments)
+            yield from shell_write_targets(wrapped, directories, segment_assignments)
             continue
         invocation = command_invocation(segment)
         if invocation is None:
             continue
         command, arguments = invocation
+        command = command.removesuffix(".exe")
+        if command == "sed":
+            in_place, inputs, _ = sed_arguments(arguments)
+            if in_place:
+                for target in inputs:
+                    yield target, directories, segment_assignments
+            continue
         in_place = command in IN_PLACE_EDITORS and (
             has_short_option(arguments, "i")
             or any(argument.startswith("--in-place") for argument in arguments)
         )
-        if command.removesuffix(".exe") == "cp":
-            for destination in copy_destinations(arguments, directories, assignments):
-                yield destination, directories
+        if command == "cp":
+            for destination in copy_destinations(arguments, directories, segment_assignments):
+                yield destination, directories, segment_assignments
             continue
-        if command.removesuffix(".exe") in SHELL_WRITE_COMMANDS or in_place:
+        if command in SHELL_WRITE_COMMANDS or in_place:
             for argument in arguments:
                 if argument and not argument.startswith("-"):
-                    yield argument, directories
+                    yield argument, directories, segment_assignments
+
+
+def shell_write_needs_build_phase_gate(targets):
+    """Phase-gate shell product writes only on bound milestone branches in-tree."""
+    repo = repository_root()
+    branch = subprocess.run(
+        ["git", "-C", str(repo), "branch", "--show-current"],
+        capture_output=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    if branch.returncode or not STATUS_BRANCH.fullmatch(branch.stdout.strip()):
+        return False
+    for path, working_directories in targets:
+        for target in dict.fromkeys(target_paths(path, working_directories, repo)):
+            directory = (
+                target
+                if target.is_dir() and not is_link_like(target)
+                else target.parent
+            )
+            while not directory.exists() and directory != directory.parent:
+                directory = directory.parent
+            root = subprocess.run(
+                ["git", "-C", str(directory), "rev-parse", "--show-toplevel"],
+                capture_output=True,
+                encoding="utf-8",
+                errors="replace",
+            )
+            if root.returncode != 0 or Path(root.stdout.strip()) != repo:
+                return False
+    return True
 
 
 def protected_shell_write_reason(tokens, working_directories):
-    assignments = shell_assignment_values(tokens)
     targets = []
-    for target, directories in shell_write_targets(tokens, working_directories):
+    for target, directories, assignments in shell_write_targets(tokens, working_directories):
         expanded = expand_environment_parameters(target, assignments)
         if SHELL_PARAMETER_SYNTAX.search(expanded) or CMD_PARAMETER_SYNTAX.search(
             expanded
@@ -1342,44 +1813,171 @@ def protected_shell_write_reason(tokens, working_directories):
     for target, kind in classified[2]:
         if kind == "protected":
             return f"{PROTECTED_SHELL_WRITE_REASON} {target}"
+    if shell_write_needs_build_phase_gate(targets):
+        return pipeline_product_phase_reason(classified)
     return None
 
 
-def environment_parameter_value(match, assignments):
+def environment_parameter_value(match, assignments, tracked_only=False):
     name = match.group(1) or match.group(2)
     if name.startswith(SUBSTITUTION_PLACEHOLDER):
         return match.group(0)  # command substitution output is never resolved
-    return assignments.get(name, os.environ.get(name, ""))
+    if name in assignments:
+        return assignments[name]
+    if tracked_only:
+        return match.group(0)
+    return os.environ.get(name, match.group(0))
 
 
-def expand_environment_parameters(command, assignments=None):
+def expand_environment_parameters(command, assignments=None, tracked_only=False):
     values = assignments or {}
 
     def substitute(match):
-        return environment_parameter_value(match, values)
+        return environment_parameter_value(match, values, tracked_only)
 
     expanded = NAMED_SHELL_PARAMETER_SYNTAX.sub(substitute, command)
     return CMD_PARAMETER_SYNTAX.sub(substitute, expanded)
 
 
-def shell_assignment_values(tokens):
-    values = {}
-    for segment in command_segments(tokens):
-        variable_command = segment[0].casefold() in VARIABLE_COMMANDS
+def shell_segment_flow(tokens):
+    """Return whether each segment is conditional or runs in a subshell."""
+    flows = []
+    segment = []
+    conditional = False
+    subshell_depth = 0
+    control_depth = 0
+    separators = set("|;&()\n\r")
+    for token in tokens:
+        if token and set(token) <= separators:
+            if segment:
+                flows.append(
+                    (conditional or control_depth > 0, subshell_depth > 0 or token in {"|", "&"})
+                )
+                segment = []
+            if token == "(":
+                subshell_depth += 1
+                conditional = True
+            elif token == ")":
+                subshell_depth = max(0, subshell_depth - 1)
+                conditional = False
+            elif token in {"&&", "||", "|", "&"}:
+                conditional = True
+            else:
+                conditional = False
+            continue
+        word = token.casefold()
+        if not segment and word in SHELL_CONTROL_WORDS:
+            if word in {"if", "while", "until", "for", "select", "case", "coproc"}:
+                control_depth += 1
+            elif word in {"fi", "done", "esac"}:
+                control_depth = max(0, control_depth - 1)
+            if word in {"then", "else", "elif", "do", "in"}:
+                conditional = True
+            continue
+        segment.append(token)
+    if segment:
+        flows.append((conditional or control_depth > 0, subshell_depth > 0))
+    return flows
+
+
+def shell_assignment_changes(segment, values):
+    """Return variables changed by a persistent assignment or variable builtin."""
+    index = 0
+    prefix = []
+    while index < len(segment) and SHELL_ASSIGNMENT_PATTERN.match(segment[index]):
+        prefix.append(segment[index])
+        index += 1
+    executable = segment[index].casefold() if index < len(segment) else None
+    updates = {}
+    removes = set()
+    if executable is None:
+        assignments = prefix
+    elif executable in {"export", "declare", "typeset"}:
+        assignments = [*prefix, *segment[index + 1 :]]
+    else:
+        assignments = []
+    for assignment in assignments:
+        if SHELL_ASSIGNMENT_PATTERN.match(assignment):
+            name, value = assignment.split("=", 1)
+            updates[name] = expand_environment_parameters(value, {**values, **updates})
+    if executable == "unset":
+        removes = {
+            name for name in segment[index + 1 :] if not name.startswith("-")
+        }
+    return updates, removes
+
+
+def shell_assignment_contexts(tokens, initial=None, working_directories=None):
+    """Return the persistent shell variables visible before each segment."""
+    values = dict(initial or {})
+    directories = list(working_directories or [os.getcwd()])
+    if "PWD" not in values:
+        values["PWD"] = (
+            os.path.abspath(native_path_text(directories[0]))
+            if len(directories) == 1 else "$PWD"
+        )
+    contexts = []
+    segments = list(command_segments(tokens))
+    flows = shell_segment_flow(tokens)
+    if len(segments) != len(flows):
+        raise ValueError("shell command segments cannot be aligned")
+    for segment, (conditional, subshell) in zip(segments, flows):
+        contexts.append(dict(values))
+        updates, removes = shell_assignment_changes(segment, values)
+        if subshell:
+            continue
+        for name in removes:
+            if conditional:
+                values[name] = f"${name}"
+            else:
+                # An unset variable expands to empty, never its inherited value.
+                values[name] = ""
+        for name, value in updates.items():
+            values[name] = f"${name}" if conditional else value
+        invocation = command_invocation(segment)
+        if invocation is not None and invocation[0] in DIRECTORY_CHANGE_COMMANDS:
+            # The same tracked expansion as segment_directories.
+            target = expand_environment_parameters(
+                directory_change_target(invocation[1]),
+                {
+                    name: value
+                    for name, value in contexts[-1].items()
+                    if name not in SHELL_DIRECTORY_VARIABLES
+                },
+                tracked_only=True,
+            )
+            directories = (
+                [target] if is_absolute_path(target)
+                else [f"{directory}/{target}" for directory in directories]
+            )
+            values["OLDPWD"] = values.get("PWD", "$PWD")
+            values["PWD"] = (
+                os.path.abspath(native_path_text(directories[0]))
+                if not conditional and len(directories) == 1 else "$PWD"
+            )
+            if conditional:
+                values["OLDPWD"] = "$OLDPWD"
+    return contexts, values
+
+
+def shell_segment_contexts(tokens, working_directories, initial=None):
+    """Yield each segment with its working directory and prior shell variables."""
+    contexts, _ = shell_assignment_contexts(tokens, initial, working_directories)
+    segments = list(segment_directories(tokens, working_directories, contexts))
+    if len(segments) != len(contexts):
+        raise ValueError("shell command segments cannot be aligned")
+    for (segment, directories), assignments in zip(segments, contexts):
+        prefix = {}
         for token in segment:
             if not SHELL_ASSIGNMENT_PATTERN.match(token):
-                if variable_command:
-                    continue
                 break
             name, value = token.split("=", 1)
-            if name in values:
-                raise ValueError(f"shell variable {name} is reassigned; split the commands")
-            values[name] = expand_environment_parameters(value, values)
-    return values
+            prefix[name] = expand_environment_parameters(value, assignments)
+        yield segment, directories, assignments, prefix
 
 
-def unresolved_archive_expansion(command, tokens, working_directories):
-    expanded = expand_environment_parameters(command, shell_assignment_values(tokens))
+def unresolved_archive_expansion(command, assignments=None):
+    expanded = expand_environment_parameters(command, assignments)
     return ARCHIVE_REFERENCE.search(expanded) is not None
 
 
@@ -1408,32 +2006,194 @@ def substitution_end(command, start):
     raise ValueError("command substitution $( is not closed")
 
 
+def heredoc_requests(line):
+    """Find literal here-document delimiters, excluding here-strings and quotes."""
+    requests = []
+    quote = None
+    index = 0
+    while index < len(line):
+        character = line[index]
+        if quote:
+            if character == "\\" and quote == '"':
+                index += 2
+                continue
+            if character == quote:
+                quote = None
+            index += 1
+            continue
+        if character == "\\":
+            index += 2
+            continue
+        if character == "#" and (
+            index == 0
+            or line[index - 1].isspace()
+            or line[index - 1] in ";|&()<>"
+        ):
+            break
+        if character in "'\"":
+            quote = character
+            index += 1
+            continue
+        if line.startswith("$(", index):
+            index = substitution_end(line, index + 2) + 1
+            continue
+        if character == "`":
+            end = index + 1
+            while end < len(line) and line[end] != "`":
+                end += 2 if line[end] == "\\" else 1
+            index = min(end + 1, len(line))
+            continue
+        if line.startswith("<<<", index):
+            index += 3
+            continue
+        if not line.startswith("<<", index):
+            index += 1
+            continue
+        cursor = index + 2
+        strip_tabs = cursor < len(line) and line[cursor] == "-"
+        if strip_tabs:
+            cursor += 1
+        while cursor < len(line) and line[cursor] in " \t":
+            cursor += 1
+        delimiter = []
+        delimiter_quote = None
+        quoted = False
+        while cursor < len(line):
+            value = line[cursor]
+            if delimiter_quote:
+                if value == delimiter_quote:
+                    delimiter_quote = None
+                else:
+                    delimiter.append(value)
+                cursor += 1
+                continue
+            if value in "'\"":
+                delimiter_quote = value
+                quoted = True
+                cursor += 1
+                continue
+            if value == "\\" and cursor + 1 < len(line):
+                quoted = True
+                delimiter.append(line[cursor + 1])
+                cursor += 2
+                continue
+            if value.isspace() or value in ";|&()<>":
+                break
+            delimiter.append(value)
+            cursor += 1
+        if not delimiter:
+            raise ValueError("here-document delimiter cannot be validated")
+        requests.append(("".join(delimiter), strip_tabs, quoted))
+        index = cursor
+    return requests
+
+
+def heredoc_modes(command):
+    """Mark here-document bodies as data or shell-expanded input."""
+    lines = command.splitlines(keepends=True)
+    modes = ["shell"] * len(command)
+    offsets = []
+    offset = 0
+    for line in lines:
+        offsets.append(offset)
+        offset += len(line)
+    line_index = 0
+    while line_index < len(lines):
+        requests = heredoc_requests(lines[line_index].rstrip("\r\n"))
+        line_index += 1
+        for delimiter, strip_tabs, quoted in requests:
+            found = False
+            while line_index < len(lines):
+                line = lines[line_index]
+                content = line.rstrip("\r\n")
+                if strip_tabs:
+                    content = content.lstrip("\t")
+                start = offsets[line_index]
+                stop = start + len(line)
+                mode = "literal" if quoted or content == delimiter else "heredoc"
+                modes[start:stop] = [mode] * (stop - start)
+                line_index += 1
+                if content == delimiter:
+                    found = True
+                    break
+            if not found:
+                raise ValueError(f"here-document {delimiter} is not terminated")
+    return modes
+
+
 def split_command_substitutions(command):
-    """Replace every $(...) and `...` with a placeholder; return (outer, inner)."""
-    if "@(" in command:
-        raise ValueError(
-            "@( expansion cannot be validated; write the list as literal arguments"
-        )
-    if "$(" not in command and "`" not in command:
-        return command, []
-    outer, inner, index = [], [], 0
+    """Replace executable substitutions, leaving quoted text as shell data."""
+    modes = heredoc_modes(command)
+    outer, inner, index, quote = [], [], 0, None
     while index < len(command):
+        mode = modes[index]
+        character = command[index]
+        if mode == "literal":
+            outer.append(character)
+            index += 1
+            continue
+        if mode == "heredoc":
+            if character == "\\" and index + 1 < len(command) and command[index + 1] in "\\$`":
+                outer.append(command[index : index + 2])
+                index += 2
+                continue
+            if command.startswith("$(", index):
+                end = substitution_end(command, index + 2)
+                inner.append(command[index + 2 : end])
+            elif character == "`":
+                end = index + 1
+                while end < len(command) and command[end] != "`":
+                    end += 2 if command[end] == "\\" else 1
+                if end >= len(command):
+                    raise ValueError("backtick command substitution is not closed")
+                inner.append(command[index + 1 : end])
+            elif command.startswith("@(", index):
+                raise ValueError(
+                    "@( expansion cannot be validated; write the list as literal arguments"
+                )
+            else:
+                outer.append(character)
+                index += 1
+                continue
+            outer.append(f"${{{SUBSTITUTION_PLACEHOLDER}{len(inner) - 1}}}")
+            index = end + 1
+            continue
+        if quote == "'":
+            outer.append(character)
+            if character == "'":
+                quote = None
+            index += 1
+            continue
+        if character == "\\":
+            outer.append(command[index : index + 2])
+            index += 2
+            continue
+        if quote is None and character == "'":
+            quote = character
+            outer.append(character)
+            index += 1
+            continue
+        if character == '"':
+            quote = None if quote == '"' else '"'
+            outer.append(character)
+            index += 1
+            continue
         if command.startswith("$(", index):
             end = substitution_end(command, index + 2)
             inner.append(command[index + 2 : end])
-        elif command[index] == "`":
+        elif character == "`":
             end = index + 1
             while end < len(command) and command[end] != "`":
                 end += 2 if command[end] == "\\" else 1
             if end >= len(command):
                 raise ValueError("backtick command substitution is not closed")
             inner.append(command[index + 1 : end])
-        elif command[index] == "\\":
-            outer.append(command[index : index + 2])
-            index += 2
-            continue
+        elif command.startswith("@(", index):
+            raise ValueError(
+                "@( expansion cannot be validated; write the list as literal arguments"
+            )
         else:
-            outer.append(command[index])
+            outer.append(character)
             index += 1
             continue
         outer.append(f"${{{SUBSTITUTION_PLACEHOLDER}{len(inner) - 1}}}")
@@ -1454,11 +2214,8 @@ def strip_heredoc_bodies(command):
         line = lines[index]
         kept.append(line)
         index += 1
-        for match in HEREDOC_PATTERN.finditer(line):
-            delimiter = (
-                match.group("single") or match.group("double") or match.group("bare")
-            )
-            strip = "\t\r" if match.group("dash") else "\r"
+        for delimiter, strip_tabs, _ in heredoc_requests(line):
+            strip = "\t\r" if strip_tabs else "\r"
             while index < len(lines) and lines[index].strip(strip) != delimiter:
                 index += 1
             if index >= len(lines):
@@ -1497,30 +2254,323 @@ def decode_patch_path(raw_path, strip_prefix):
     return path
 
 
-def shell_tokens(command):
-    command = strip_heredoc_bodies(LINE_CONTINUATION.sub(r"\1 ", command))
-    lexer = shlex.shlex(command, posix=True, punctuation_chars="|;&()<>\n\r")
-    lexer.whitespace = " \t"
-    lexer.whitespace_split = True
-    lexer.commenters = ""
-    try:
-        tokens = list(lexer)
-    except ValueError as error:
-        raise ValueError(
-            f"shell command cannot be tokenized ({error}); balance the quotes "
-            "or write the content with an editor tool"
-        ) from None
-    if not tokens:
-        raise ValueError("shell command is empty")
-    return tokens
+PARAMETER_MARKERS = frozenset("$%!")
+SHELL_DESCRIPTOR_WORD = re.compile(r"[0-9]{2,}|\{\w+\}", re.ASCII)
+SHELL_OPERATOR_PARTS = re.compile(
+    r"[<>]\(|&>>?|<<<|<<|>>|>&|<&|<>|>\||[<>]|&&|\|\||\|&|[\s\S]"
+)
 
 
-def command_segments(tokens):
-    """Yield simple commands with separators and leading control words removed."""
-    segment = []
-    for token in tokens:
-        if token and set(token) <= set("|;&()\n\r"):
-            if segment:
+class ShellToken(str):
+    """A token that keeps, per parameter marker character, whether double quotes enclosed it.
+
+    `redirection` is true for an unquoted redirection operator and for one
+    ASCII file descriptor digit written against one (the 2 of 2>file, not of
+    2 >file). zsh passes a longer or non-ASCII digit word on as an argument.
+    `descriptor` is true for a longer digit word or a {name} word written
+    against a redirection operator: bash reads it as a file descriptor, zsh
+    as an argument.
+    `body` holds the tokens of a process substitution on its operator token,
+    once destructive_git_reason has folded them.
+    `literal` is "bare" for a word written with no quote or escape, "quoted"
+    for a word inside one pair of plain quotes, "mixed" for plain quoted and
+    unquoted parts where no unquoted part can expand, and None when the shell
+    may build the word in another way (escapes, an expanding unquoted part, a
+    line continuation in the word or one that joins it to the next word).
+    """
+
+    double_quoted = ()
+    redirection = False
+    descriptor = False
+    literal = None
+    body = None
+
+
+def double_quoted_markers(command):
+    """Return, per parameter marker in order, whether plain double quotes enclose it.
+
+    None means the command uses quoting outside the plain constructs this scan
+    models (plain single quotes, plain double quotes, unquoted text), so no
+    marker in it can be proven quoted.
+    """
+    flags = []
+    quote = None
+    comment = False
+    braces = 0
+    previous = " "
+    index = 0
+    while index < len(command):
+        character = command[index]
+        following = command[index + 1 : index + 2]
+        if comment:
+            if character in "\r\n":
+                comment = False
+            elif character in "'\"\\`":
+                return None
+        elif quote == "'":
+            if character == "'":
+                quote = None
+        elif character == "\\":
+            if following and following in PARAMETER_MARKERS:
+                # The shell executes the escaped marker as literal text; the
+                # token keeps the bare marker, so the pair is never provable.
+                flags.append(False)
+            previous = character
+            index += 2
+            continue
+        elif character == "`" or (character == "$" and following == "("):
+            return None
+        elif character == "$" and following == "{":
+            braces += 1
+        elif character == "}" and braces:
+            braces -= 1
+        elif character in "'\"" and braces:
+            return None
+        elif character == '"':
+            quote = None if quote else '"'
+        elif quote is None:
+            if character == "'":
+                quote = "'"
+            elif character == "$" and following and following in "'\"":
+                return None
+            elif character == "<" and following == "<":
+                return None
+            elif character == "#" and previous in " \t\r\n;&|()<>":
+                comment = True
+        if character in PARAMETER_MARKERS:
+            flags.append(quote == '"' and not comment)
+        previous = character
+        index += 1
+    return flags if quote is None and not braces else None
+
+
+def zsh_expansion_flag(text):
+    """Whether the text holds an unbraced zsh expansion flag ($=x, $~x, $^x, $+x).
+
+    These match no parameter syntax, so without this check they never enter
+    the parameter proof at all — while zsh word-splits them exactly like the
+    forms the proof denies. Any other unmatched $ is inert literal text.
+    """
+    return ZSH_EXPANSION_FLAG_SYNTAX.search(text)
+
+
+def parameters_double_quoted(token):
+    """Whether every parameter in the token expands inside double quotes to one word.
+
+    Only plain $name and ${name} qualify: flags, operators, subscripts,
+    positional and special parameters can split even inside double quotes.
+    A backslash-escaped marker stays one flag short of proven: the shell
+    executes the literal text while the guard's token still shows the bare
+    marker, so nothing about its expansion is provable.
+    """
+    flags = getattr(token, "double_quoted", ())
+    positions = [
+        index for index, character in enumerate(token) if character in PARAMETER_MARKERS
+    ]
+    if len(flags) != len(positions):
+        return False
+    quoted = dict(zip(positions, flags))
+    plain = {
+        match.start(): match.end() for match in NAMED_SHELL_PARAMETER_SYNTAX.finditer(token)
+    }
+    if any(
+        character == "$" and index not in plain for index, character in enumerate(token)
+    ) or any(token[end : end + 1] == "[" for end in plain.values()):
+        return False
+    return all(
+        quoted[match.start()] and quoted.get(match.end() - 1, True)
+        for syntax in (SHELL_PARAMETER_SYNTAX, CMD_PARAMETER_SYNTAX)
+        for match in syntax.finditer(token)
+    )
+
+
+def shell_tokens(command, direct=True):
+    """Tokenize a command; `direct` is False for a string that a second shell parses.
+
+    Only a directly parsed command keeps quote flags: an outer shell expands
+    parameters before the inner parse, so inner quotes prove nothing.
+    """
+    breaks = set()
+    if LINE_CONTINUATION.search(command):
+        mark = next(
+            character for character in map(chr, range(0xE000, 0xF900))
+            if character not in command
+        )
+        marked = strip_heredoc_bodies(
+            LINE_CONTINUATION.sub(lambda match: match.group(1) + mark, command)
+        )
+        command = strip_heredoc_bodies(LINE_CONTINUATION.sub(r"\1 ", command))
+        breaks = (
+            {index for index, character in enumerate(marked) if character == mark}
+            if marked.replace(mark, " ") == command
+            else None
+        )
+    else:
+        command = strip_heredoc_bodies(command)
+    joins = set()
+    for index in breaks or ():
+        left, right = index - 1, index + 1
+        while left >= 0 and marked[left] == mark:
+            left -= 1
+        while right < len(marked) and marked[right] == mark:
+            right += 1
+        if left >= 0 and marked[left].strip() and marked[right:right + 1].strip():
+            joins.add(index)
+    lexer = shlex.shlex(command, posix=True, punctuation_chars="|;&()<>\n\r")
+    lexer.whitespace = " \t"
+    lexer.whitespace_split = True
+    lexer.commenters = ""
+    tokens = []
+    previous_end = 0
+    try:
+        for token in lexer:
+            end = lexer.instream.tell() - len(lexer._pushback_chars)
+            if command[end - 1:end] in (" ", "\t"):
+                end -= 1
+            word_start = previous_end
+            while word_start < end and command[word_start] in " \t":
+                word_start += 1
+            previous_end = end
+            word = command[word_start:end]
+            literal = None
+            if (
+                breaks is not None
+                and "\\" not in word
+                and not ANSI_QUOTE_START.search(word)
+                and breaks.isdisjoint(range(word_start, end))
+                and end not in joins
+                and word_start - 1 not in joins
+                and PLAIN_QUOTED_SEGMENT.sub(lambda match: match.group(0)[1:-1], word) == token
+            ):
+                unquoted = PLAIN_QUOTED_SEGMENT.sub("", word)
+                if (
+                    "'" not in unquoted
+                    and '"' not in unquoted
+                    and not GIT_CONFIG_EXPANDING_WORD.search(unquoted)
+                ):
+                    literal = "mixed"
+            for quote in ("", "'", '"'):
+                start = end - len(token) - 2 * len(quote)
+                if (
+                    breaks is not None
+                    and start >= 0
+                    and command[start:end] == quote + token + quote
+                    and (start == 0 or command[start - 1] in " \t|;&()<>\n\r")
+                    and breaks.isdisjoint(range(start, end))
+                    and end not in joins
+                    and start - 1 not in joins
+                ):
+                    literal = "quoted" if quote else "bare"
+                    break
+            start = end - len(token)
+            before = command[start - 1:start] if start > 0 else ""
+            escaped = (start - len(command[:start].rstrip("\\"))) % 2 == 1
+            redirection = command[start:end] == token and (
+                (
+                    set(token) <= SHELL_WRITE_REDIRECTION_CHARS
+                    and ("<" in token or ">" in token)
+                    and not escaped
+                )
+                or (
+                    len(token) == 1
+                    and token in "0123456789"
+                    and command[end:end + 1] in ("<", ">")
+                    and (not before or before in " \t|;&()<>\n\r")
+                )
+            )
+            descriptor = (
+                command[start:end] == token
+                and SHELL_DESCRIPTOR_WORD.fullmatch(token) is not None
+                and command[end:end + 1] in ("<", ">")
+                and (not before or before in " \t|;&()<>\n\r")
+            )
+            # The shell reads a control operator and a redirection operator
+            # written against each other as two operators.
+            parts = [token]
+            if (
+                command[start:end] == token
+                and set(token) <= set("|;&()<>\n\r")
+                and ("<" in token or ">" in token)
+                and not escaped
+            ):
+                parts = []
+                for part in SHELL_OPERATOR_PARTS.findall(token):
+                    if "<" in part or ">" in part or not parts or (
+                        "<" in parts[-1] or ">" in parts[-1]
+                    ):
+                        parts.append(part)
+                    else:
+                        parts[-1] += part
+            for part in parts:
+                part = ShellToken(part)
+                part.redirection = redirection if len(parts) == 1 else (
+                    ("<" in part or ">" in part)
+                    and set(part) <= SHELL_WRITE_REDIRECTION_CHARS
+                )
+                part.descriptor = descriptor
+                part.literal = literal
+                tokens.append(part)
+    except ValueError as error:
+        raise ValueError(
+            f"shell command cannot be tokenized ({error}); balance the quotes "
+            "or write the content with an editor tool"
+        ) from None
+    if not tokens:
+        raise ValueError("shell command is empty")
+    flags = double_quoted_markers(command) if direct else None
+    if flags is None or len(flags) != sum(
+        character in PARAMETER_MARKERS for token in tokens for character in token
+    ):
+        return tokens
+    marked = []
+    for token in tokens:
+        count = sum(character in PARAMETER_MARKERS for character in token)
+        redirection, descriptor, literal = (
+            token.redirection, token.descriptor, token.literal
+        )
+        token = ShellToken(token)
+        token.redirection, token.descriptor, token.literal = (
+            redirection, descriptor, literal
+        )
+        token.double_quoted, flags = tuple(flags[:count]), flags[count:]
+        marked.append(token)
+    return marked
+
+
+def shell_parameter_quoting_uncertain(command):
+    """Detect literal parameters whose quoting is lost by shell_tokens."""
+    command = strip_heredoc_bodies(LINE_CONTINUATION.sub(r"\1 ", command))
+    # These forms expand in cmd, but are literal directory text in POSIX shells.
+    if CMD_PARAMETER_SYNTAX.search(command):
+        return True
+    quote = None
+    index = 0
+    while index < len(command):
+        character = command[index]
+        if quote == "'":
+            if NAMED_SHELL_PARAMETER_SYNTAX.match(command, index):
+                return True
+            if character == "'":
+                quote = None
+        elif character == "\\":
+            if NAMED_SHELL_PARAMETER_SYNTAX.match(command, index + 1):
+                return True
+            index += 1
+        elif character in "'\"":
+            if quote is None:
+                quote = character
+            elif character == quote:
+                quote = None
+        index += 1
+    return False
+
+
+def command_segments(tokens):
+    """Yield simple commands with separators and leading control words removed."""
+    segment = []
+    for token in tokens:
+        if token and set(token) <= set("|;&()\n\r"):
+            if segment:
                 yield segment
                 segment = []
         elif segment or token.casefold() not in SHELL_CONTROL_WORDS:
@@ -1572,56 +2622,163 @@ def xargs_command(arguments):
 
 
 def require_read_command(wrapper, wrapped):
-    if wrapped and not archive_command_is_read_only(" ".join(wrapped), wrapped, True):
+    segments = list(command_segments(wrapped))
+    if wrapped and (
+        not segments
+        or not all(
+            archive_command_is_read_only(shlex.join(segment), segment, True)
+            for segment in segments
+        )
+    ):
         raise ValueError(
             f"{wrapper} runs {wrapped[0]} on operands the guard cannot check; "
             f"only read commands may follow {wrapper}, or pass the paths as literals"
         )
 
 
-def command_invocation(segment):
+def runner_value_option(prefix, token):
+    """The option in a runner option word whose value is the next word, if any.
+
+    Raises for an option that writes, edits or enters a file or directory. A
+    long option matches by each prefix, as getopt accepts it. A short word is
+    read as getopt reads it: flag letters, then the first value option letter,
+    whose value is the rest of the word or, with no rest, the next word.
+    """
+    value_options = EXEC_PREFIX_VALUE_OPTIONS[prefix]
+    file_options = EXEC_PREFIX_FILE_OPTIONS.get(prefix, frozenset())
+    denial = ValueError(
+        f"{prefix} {token} writes, edits or enters a file or directory that the "
+        "guard cannot check; run the command without this option and redirect "
+        "its output instead"
+    )
+    if token.startswith("--"):
+        name = token.split("=", 1)[0]
+        if any(option.startswith(name) for option in file_options):
+            raise denial
+        option = next((option for option in value_options if option.startswith(name)), None)
+        return option if "=" not in token else None
+    for position, letter in enumerate(token[1:], start=1):
+        option = f"-{letter}"
+        if option in file_options:
+            raise denial
+        if option in value_options:
+            return option if position == len(token) - 1 else None
+        if letter not in EXEC_PREFIX_FLAG_LETTERS[prefix]:
+            return None
+    return None
+
+
+def nonliteral_runner_option(token):
+    literal = getattr(token, "literal", "bare")
+    return (
+        SHELL_PARAMETER_SYNTAX.search(token)
+        or CMD_PARAMETER_SYNTAX.search(token)
+        or zsh_expansion_flag(token)
+        or literal is None
+        or (literal == "bare" and GIT_CONFIG_EXPANDING_WORD.search(token))
+    )
+
+
+def unresolved_runner_word(token):
+    return (
+        SHELL_PARAMETER_SYNTAX.search(token)
+        or CMD_PARAMETER_SYNTAX.search(token)
+        or zsh_expansion_flag(token)
+    ) and not parameters_double_quoted(token)
+
+
+def command_invocation(segment, unwrap_runners=True):
+    """`unwrap_runners` is False where a command runner itself must be judged."""
     index = 0
-    while index < len(segment) and SHELL_ASSIGNMENT_PATTERN.match(segment[index]):
-        validate_shell_assignment(segment[index])
-        index += 1
-    if index >= len(segment):
-        return None
-    executable = segment[index].replace("\\", "/").rsplit("/", 1)[-1].casefold()
-    if executable == "env":
+    # The shell word `time` is already removed; its only option can remain.
+    while unwrap_runners and index < len(segment) and segment[index] == "-p":
         index += 1
-        while index < len(segment):
-            token = segment[index]
-            if token == "--":
-                index += 1
+    while True:
+        while index < len(segment) and SHELL_ASSIGNMENT_PATTERN.match(segment[index]):
+            validate_shell_assignment(segment[index])
+            index += 1
+        if index >= len(segment):
+            return None
+        executable = segment[index].replace("\\", "/").rsplit("/", 1)[-1].casefold()
+        prefix = executable.removesuffix(".exe")
+        if executable == "env":
+            index += 1
+            while index < len(segment):
+                token = segment[index]
+                if token == "--":
+                    index += 1
+                    break
+                if SHELL_ASSIGNMENT_PATTERN.match(token):
+                    validate_shell_assignment(token)
+                    index += 1
+                    continue
+                option = token.split("=", 1)[0]
+                if option in ENV_OPTIONS_WITHOUT_VALUES:
+                    index += 1
+                    continue
+                if option in ENV_OPTIONS_WITH_VALUES:
+                    if option in {"-C", "--chdir"}:
+                        raise ValueError(
+                            f"env {option} changes the working directory the guard "
+                            "tracks; use cd with a literal path instead"
+                        )
+                    index += 1
+                    if "=" not in token:
+                        if index >= len(segment):
+                            raise ValueError(f"env {option} lacks a value")
+                        index += 1
+                    continue
+                if token.startswith("-"):
+                    raise ValueError(
+                        f"env {token} cannot be validated; use env NAME=VALUE <command>"
+                    )
+                if SHELL_PARAMETER_SYNTAX.search(token) or zsh_expansion_flag(token):
+                    raise ValueError(
+                        f"env word {token} cannot be resolved by the guard; env "
+                        "assignments must be literal NAME=VALUE words and the "
+                        "program a literal name"
+                    )
                 break
-            if SHELL_ASSIGNMENT_PATTERN.match(token):
-                validate_shell_assignment(token)
+        elif unwrap_runners and prefix in EXEC_PREFIX_VALUE_OPTIONS:
+            index += 1
+            while index < len(segment):
+                token = segment[index]
+                if token == "--":
+                    index += 1
+                    break
+                if not token.startswith("-") or token == "-":
+                    break
                 index += 1
-                continue
-            option = token.split("=", 1)[0]
-            if option in ENV_OPTIONS_WITHOUT_VALUES:
+                if nonliteral_runner_option(token):
+                    raise ValueError(
+                        f"{prefix} option {token} cannot be resolved by the guard; "
+                        f"{prefix} options must be literal words"
+                    )
+                option = runner_value_option(prefix, token)
+                if option is None or index >= len(segment):
+                    continue
+                value = segment[index]
                 index += 1
-                continue
-            if option in ENV_OPTIONS_WITH_VALUES:
-                if option in {"-C", "--chdir"}:
+                if prefix == "watch" and option in EXEC_PREFIX_INTERVAL_OPTIONS:
+                    if not RUNNER_DURATION.fullmatch(value):
+                        raise ValueError(
+                            f"watch interval {value} cannot be resolved by the guard; "
+                            "the interval must be a literal number"
+                        )
+                elif unresolved_runner_word(value):
+                    raise ValueError(
+                        f"{prefix} option value {value} cannot be resolved by the "
+                        f"guard; {prefix} option values must be literal words"
+                    )
+            if prefix == "timeout" and index < len(segment):
+                if not RUNNER_DURATION.fullmatch(segment[index]):
                     raise ValueError(
-                        f"env {option} changes the working directory the guard "
-                        "tracks; use cd with a literal path instead"
+                        f"timeout duration {segment[index]} cannot be resolved by the "
+                        "guard; the duration must be a literal number"
                     )
                 index += 1
-                if "=" not in token:
-                    if index >= len(segment):
-                        raise ValueError(f"env {option} lacks a value")
-                    index += 1
-                continue
-            if token.startswith("-"):
-                raise ValueError(
-                    f"env {token} cannot be validated; use env NAME=VALUE <command>"
-                )
+        else:
             break
-    if index >= len(segment):
-        return None
-    executable = segment[index].replace("\\", "/").rsplit("/", 1)[-1].casefold()
     arguments = segment[index + 1 :]
     if SHELL_PARAMETER_SYNTAX.search(executable):
         raise ValueError(
@@ -1645,19 +2802,103 @@ def command_invocation(segment):
     return executable, arguments
 
 
-def git_command(segment):
+def require_resolved_git_word(word, mixed=True):
+    """Deny a git word the shell can turn into other or several arguments."""
+    literal = getattr(word, "literal", "bare")
+    if (
+        literal is None
+        or (literal == "mixed" and not mixed)
+        or (literal == "bare" and GIT_CONFIG_EXPANDING_WORD.search(word))
+    ):
+        raise ValueError(
+            f"git argument {word} cannot be resolved by the guard; "
+            "pass a literal value"
+        )
+
+
+def git_command(segment, assignments=None):
     invocation = command_invocation(segment)
     if invocation is None:
         return None
     executable, arguments = invocation
     if executable not in {"git", "git.exe"}:
         return None
-    for argument in arguments:
-        if SHELL_PARAMETER_SYNTAX.search(argument):
-            raise ValueError(
-                f"git argument {argument} cannot be resolved by the guard; pass a "
-                "literal value (for commit messages use -F <file>)"
+    resolved_arguments = []
+    parameter_arguments = []
+    unproven_parameters = []
+    argument_index = 0
+    while argument_index < len(arguments):
+        argument = arguments[argument_index]
+        attached_directory = argument.startswith("-C") and len(argument) > 2
+        if argument == "-C" and argument_index + 1 < len(arguments):
+            argument_index += 1
+            directory = arguments[argument_index]
+            require_resolved_git_word(directory)
+            expanded = expand_environment_parameters(directory, assignments)
+            if (
+                SHELL_PARAMETER_SYNTAX.search(expanded)
+                or CMD_PARAMETER_SYNTAX.search(expanded)
+                or zsh_expansion_flag(expanded)
+            ):
+                raise ValueError(
+                    f"git argument {directory} cannot be resolved by the guard; "
+                    "pass a literal path"
+                )
+            if (
+                (SHELL_PARAMETER_SYNTAX.search(directory) or CMD_PARAMETER_SYNTAX.search(directory))
+                and any(character.isspace() or character in "*?[]" for character in expanded)
+            ):
+                raise ValueError(
+                    f"git -C path {directory} may split or glob; pass a literal path"
+                )
+            resolved_arguments.extend((argument, expanded))
+        elif attached_directory:
+            require_resolved_git_word(argument)
+            directory = argument[2:]
+            expanded = expand_environment_parameters(directory, assignments)
+            if (
+                SHELL_PARAMETER_SYNTAX.search(expanded)
+                or CMD_PARAMETER_SYNTAX.search(expanded)
+                or zsh_expansion_flag(expanded)
+            ):
+                raise ValueError(
+                    f"git argument {directory} cannot be resolved by the guard; "
+                    "pass a literal path"
+                )
+            if (
+                (SHELL_PARAMETER_SYNTAX.search(directory) or CMD_PARAMETER_SYNTAX.search(directory))
+                and any(character.isspace() or character in "*?[]" for character in expanded)
+            ):
+                raise ValueError(
+                    f"git -C path {directory} may split or glob; pass a literal path"
+                )
+            resolved_arguments.append(f"-C{expanded}")
+        else:
+            parameter = (
+                SHELL_PARAMETER_SYNTAX.search(argument)
+                or CMD_PARAMETER_SYNTAX.search(argument)
+                or zsh_expansion_flag(argument)
             )
+            if parameter:
+                parameter_arguments.append(argument)
+                literal = re.split(r"[$%!]", argument, maxsplit=1)[0]
+                expanded = expand_environment_parameters(argument, assignments)
+                if (
+                    not literal
+                    or (literal.startswith("-") and "=" not in literal)
+                    or git_option_in(literal, GIT_PARAMETER_DENIED_OPTIONS)
+                    or git_option_in(arguments[argument_index - 1], GIT_PARAMETER_DENIED_OPTIONS)
+                    or (literal.startswith("-c") and literal != "-c")
+                    or "::" in literal
+                    or not parameters_double_quoted(argument)
+                    or SUBSTITUTION_PLACEHOLDER in argument
+                    or SUBSTITUTION_PLACEHOLDER in expanded
+                ):
+                    unproven_parameters.append(argument)
+            expanded = expand_environment_parameters(argument, assignments)
+            resolved_arguments.append(argument if expanded == argument else expanded)
+        argument_index += 1
+    arguments = resolved_arguments
     index = 0
     git_options = []
     while index < len(arguments) and arguments[index].startswith("-"):
@@ -1668,18 +2909,32 @@ def git_command(segment):
             option = token.split("=", 1)[0]
             value = token.split("=", 1)[1] if "=" in token else None
         index += 1
+        if option != "-C":
+            require_resolved_git_word(token)
         if option in GIT_GLOBAL_OPTIONS_WITH_VALUES and value is None:
             if index >= len(arguments):
                 raise ValueError(f"git option {option} lacks a value")
             value = arguments[index]
+            if option != "-C":
+                require_resolved_git_word(value)
             index += 1
         if option in {"-c", "--config-env"}:
-            config_key = str(value).split("=", 1)[0].casefold()
+            config_key, _, config_value = str(value).partition("=")
+            config_key = config_key.casefold()
             if config_key.startswith("alias."):
                 raise ValueError(
                     f"git -c {config_key} defines an alias the guard cannot inspect; "
                     "run the underlying git command directly"
                 )
+            if executed_config_key(config_key) and not (
+                option == "-c"
+                and not loaded_config_key(config_key)
+                and config_value.casefold() in GIT_CONFIG_DISABLING_VALUES
+            ):
+                raise ValueError(
+                    f"git -c {config_key} configures a program git executes; "
+                    "the guard cannot allow it"
+                )
             if config_key == "clean.requireforce":
                 raise ValueError(
                     "git -c clean.requireForce disables the git clean safety check; "
@@ -1688,8 +2943,47 @@ def git_command(segment):
         if option in GIT_GLOBAL_OPTIONS_WITH_VALUES:
             git_options.extend((option, str(value)))
     if index >= len(arguments):
+        if parameter_arguments:
+            raise ValueError(
+                f"git argument {parameter_arguments[0]} cannot be resolved by the guard; "
+                "pass a literal value (for commit messages use -F <file>)"
+            )
         return None
-    return arguments[index].casefold(), arguments[index + 1:], git_options
+    require_resolved_git_word(arguments[index], mixed=False)
+    subcommand = arguments[index].casefold()
+    if subcommand == "config":
+        for argument in arguments[index + 1:]:
+            literal = getattr(argument, "literal", None)
+            if not getattr(argument, "redirection", False) and (
+                literal in (None, "mixed")
+                or (
+                    literal == "bare"
+                    and (argument.startswith("#") or GIT_CONFIG_EXPANDING_WORD.search(argument))
+                )
+            ):
+                raise ValueError(
+                    f"git argument {argument} cannot be resolved by the guard; "
+                    "pass a literal value"
+                )
+        denied = denied_git_config_argument(arguments[index + 1:])
+        if denied is not None:
+            raise ValueError(
+                f"git config {denied} persists a program git executes; "
+                "the guard cannot allow it"
+            )
+    read_only_subcommands = ARCHIVE_READ_GIT_COMMANDS | CLOSED_READ_GIT_COMMANDS
+    if subcommand in read_only_subcommands:
+        # Read-only subcommands still write through --output. A parameter
+        # passes only inside plain double quotes, where its expansion stays
+        # one word; an unquoted one can word-split into an option, and
+        # command substitution output is never known.
+        parameter_arguments = unproven_parameters
+    if parameter_arguments:
+        raise ValueError(
+            f"git argument {parameter_arguments[0]} cannot be resolved by the guard; "
+            "pass a literal value (for commit messages use -F <file>)"
+        )
+    return subcommand, arguments[index + 1:], git_options
 
 
 def wrapped_command_tokens(segment, expand_parameters=True):
@@ -1698,7 +2992,7 @@ def wrapped_command_tokens(segment, expand_parameters=True):
         return None
     executable, arguments = invocation
     if executable == "eval":
-        return shell_tokens(" ".join(arguments)) if arguments else None
+        return shell_tokens(" ".join(arguments), direct=False) if arguments else None
     if executable in COMMAND_WRAPPERS:
         if executable == "command" and arguments[:1] in (["-v"], ["-V"]):
             return None
@@ -1723,7 +3017,7 @@ def wrapped_command_tokens(segment, expand_parameters=True):
                             executable=executable, option=argument
                         )
                     )
-                return shell_tokens(arguments[index + 1])
+                return shell_tokens(arguments[index + 1], direct=False)
         raise ValueError(SHELL_FILE_REASON.format(executable=executable))
     if executable in POWERSHELL_WRAPPERS or executable in {"cmd", "cmd.exe"}:
         switches = {"-c", "-command", "/c", "/k"}
@@ -1742,8 +3036,8 @@ def wrapped_command_tokens(segment, expand_parameters=True):
                         for argument in payload
                     ]
                 if len(payload) == 1:
-                    return shell_tokens(payload[0])
-                return payload
+                    return shell_tokens(payload[0], direct=False)
+                return [str(argument) for argument in payload]
         raise ValueError(SHELL_FILE_REASON.format(executable=executable))
     return None
 
@@ -1757,21 +3051,31 @@ def has_short_option(arguments, option):
     )
 
 
-def git_alias(command, git_options):
-    result = subprocess.run(
-        ["git", *git_options, "config", "--get", f"alias.{command}"],
-        encoding="utf-8", errors="replace",
-        capture_output=True,
-        check=False,
-    )
-    if result.returncode == 1:
-        return None
-    if result.returncode != 0:
-        raise ValueError("git alias configuration cannot be validated")
-    alias = result.stdout.strip()
-    if not alias or alias.startswith("!"):
-        raise ValueError("git alias configuration cannot be validated")
-    return alias
+def git_alias(command, git_options, working_directories=None):
+    aliases = set()
+    for directory in working_directories or [os.getcwd()]:
+        try:
+            result = subprocess.run(
+                ["git", *git_options, "config", "--get", f"alias.{command}"],
+                cwd=directory,
+                encoding="utf-8", errors="replace",
+                capture_output=True,
+                check=False,
+            )
+        except OSError:
+            raise ValueError("git alias configuration cannot be validated") from None
+        if result.returncode == 1:
+            aliases.add(None)
+            continue
+        if result.returncode != 0:
+            raise ValueError("git alias configuration cannot be validated")
+        alias = result.stdout.strip()
+        if not alias or alias.startswith("!"):
+            raise ValueError("git alias configuration cannot be validated")
+        aliases.add(alias)
+    if len(aliases) > 1:
+        raise ValueError("git alias configuration is ambiguous across working directories")
+    return next(iter(aliases), None)
 
 
 def update_ref_deletes(arguments):
@@ -1791,24 +3095,1012 @@ def update_ref_deletes(arguments):
         operands[1] == "" or not operands[1].strip("0")
     )
     return (
-        "-d" in arguments
+        has_short_option(arguments, "d")  # also a cluster such as -dm
         or "--delete" in arguments
-        or any(argument.startswith("--stdin") for argument in arguments)
+        or any(git_option_in(argument, {"--stdin"}) for argument in arguments)
         or zero_value
     )
 
 
-def destructive_git_reason(tokens, resolved_aliases=frozenset()):
+PATH_OWNED_REF_PREFIXES = (
+    "gsd-path/",
+    "gsd-path-task/",
+    "gsd-path-verify/",
+    "gsd-path-integrate/",
+)
+# Git ignores an alias that has the name of one of its own commands, so these
+# need no alias inspection. Each has been a Git command since Git 2.31, the
+# oldest Git that has the rev-parse --path-format option the pipeline uses.
+# Deprecated commands stay out: newer Git lets an alias replace them
+# (whatchanged, pack-redundant). A name that is absent only fails closed.
+GIT_BUILT_IN_COMMANDS = frozenset({
+    "add", "am", "annotate", "apply", "archive", "bisect", "blame", "branch",
+    "bugreport", "bundle", "cat-file", "check-attr", "check-ignore",
+    "check-mailmap", "check-ref-format", "checkout", "checkout-index", "cherry",
+    "cherry-pick", "clean", "clone", "column", "commit", "commit-graph",
+    "commit-tree", "config", "count-objects", "credential", "credential-store",
+    "describe", "diff", "diff-files", "diff-index", "diff-tree", "difftool",
+    "fast-export", "fast-import", "fetch", "fetch-pack", "fmt-merge-msg",
+    "for-each-ref", "for-each-repo", "format-patch", "fsck", "gc",
+    "get-tar-commit-id", "grep", "hash-object", "help", "index-pack", "init",
+    "interpret-trailers", "log", "ls-files", "ls-remote", "ls-tree", "mailinfo",
+    "mailsplit", "maintenance", "merge", "merge-base", "merge-file",
+    "merge-index", "merge-tree", "mergetool", "mktag", "mktree",
+    "multi-pack-index", "mv", "name-rev", "notes", "pack-objects", "pack-refs",
+    "patch-id", "prune", "prune-packed", "pull", "push", "range-diff",
+    "read-tree", "rebase", "receive-pack", "reflog", "remote", "repack",
+    "replace", "rerere", "reset", "restore", "rev-list", "rev-parse", "revert",
+    "rm", "send-pack", "shortlog", "show", "show-branch", "show-index",
+    "show-ref", "sparse-checkout", "stage", "stash", "status", "stripspace",
+    "submodule", "switch", "symbolic-ref", "tag", "unpack-file",
+    "unpack-objects", "update-index", "update-ref", "update-server-info",
+    "upload-archive", "upload-pack", "var", "verify-commit", "verify-pack",
+    "verify-tag", "version", "worktree", "write-tree",
+})
+
+
+def _ownership_scalar(raw, path, key):
+    value = raw.strip()
+    if not value:
+        return None
+    if value.startswith('"'):
+        quoted = re.match(r'^("(?:\\.|[^"\\])*\")(?:[ \t]+#.*)?$', value)
+        if quoted is None:
+            raise ValueError(f"{path.name} has an unreadable {key} value")
+        try:
+            value = json.loads(quoted.group(1))
+        except json.JSONDecodeError:
+            raise ValueError(f"{path.name} has an unreadable {key} value") from None
+        if not isinstance(value, str):
+            raise ValueError(f"{path.name} has a non-string {key} value")
+        return value or None
+    if value.startswith("'"):
+        quoted = re.fullmatch(r"'((?:[^']|'')*)'(?:[ \t]+#.*)?", value)
+        if quoted is None:
+            raise ValueError(f"{path.name} has an unreadable {key} value")
+        value = quoted.group(1).replace("''", "'")
+        return value or None
+    value = re.sub(r"[ \t]+#.*$", "", value).strip()
+    if not value or value.casefold() in {"null", "~", "none"}:
+        return None
+    if value.casefold() in {"true", "false", "yes", "no", "on", "off"} or re.fullmatch(
+        r"[-+]?(?:[0-9]+(?:\.[0-9]*)?|\.[0-9]+)(?:[eE][-+]?[0-9]+)?", value
+    ):
+        raise ValueError(f"{path.name} has a non-string {key} value")
+    if value[0] in "[{|>&*!" or ": " in value:
+        raise ValueError(f"{path.name} has a non-scalar {key} value")
+    return value
+
+
+def ownership_frontmatter(path, keys, *, missing_ok=False):
+    try:
+        metadata = path.lstat()
+    except FileNotFoundError:
+        if missing_ok and not os.path.lexists(path):
+            return {}
+        raise ValueError(f"{path.name} ownership metadata cannot be read") from None
+    except OSError as error:
+        raise ValueError(f"{path.name} ownership metadata cannot be read: {error}") from None
+    if not stat.S_ISREG(metadata.st_mode):
+        raise ValueError(f"{path.name} ownership metadata is not a regular file")
+    try:
+        lines = path.read_text(encoding="utf-8").splitlines()
+    except (OSError, UnicodeDecodeError) as error:
+        raise ValueError(f"{path.name} ownership metadata cannot be read: {error}") from None
+    if not lines or lines[0] != "---":
+        raise ValueError(f"{path.name} has no readable frontmatter")
+    try:
+        end = lines.index("---", 1)
+    except ValueError:
+        raise ValueError(f"{path.name} frontmatter is not terminated") from None
+
+    values = {}
+    pending_scalar = None
+    for line in lines[1:end]:
+        if not line.strip() or line.lstrip().startswith("#"):
+            continue
+        if line[0].isspace():
+            if pending_scalar is not None:
+                raise ValueError(
+                    f"{path.name} has a non-scalar {pending_scalar} value"
+                )
+            continue
+        pending_scalar = None
+        match = re.fullmatch(r"(?P<key>[A-Za-z_][A-Za-z0-9_-]*):(?P<value>.*)", line)
+        if match is None:
+            raise ValueError(f"{path.name} has unreadable frontmatter")
+        key = match.group("key")
+        if key not in keys:
+            continue
+        if key in values:
+            raise ValueError(f"{path.name} repeats ownership field {key}")
+        value = _ownership_scalar(match.group("value"), path, key)
+        values[key] = value
+        if value is None and not match.group("value").strip():
+            pending_scalar = key
+    return values
+
+
+def git_base_directories(git_options, working_directories):
+    """Resolve target paths from each shell cwd after Git's ordered ``-C`` options."""
+    result = []
+    for directory in working_directories or [os.getcwd()]:
+        current = Path(directory or os.getcwd()).resolve()
+        index = 0
+        while index < len(git_options):
+            option = git_options[index]
+            value = git_options[index + 1]
+            if option == "-C":
+                target = Path(value)
+                current = (target if target.is_absolute() else current / target).resolve()
+            index += 2
+        result.append(current)
+    return result
+
+
+def _git_output(git_options, directory, *arguments):
+    try:
+        result = subprocess.run(
+            ["git", *git_options, *arguments],
+            cwd=directory,
+            capture_output=True,
+            encoding="utf-8",
+            errors="replace",
+            check=False,
+        )
+    except OSError:
+        raise ValueError("git target repository cannot be resolved") from None
+    if result.returncode != 0:
+        raise ValueError("git target repository cannot be resolved")
+    return result.stdout
+
+
+def registered_worktree_records(output, separator="\0"):
+    records = {}
+    for record in output.split(separator * 2):
+        fields = [field for field in record.split(separator) if field]
+        if not fields:
+            continue
+        paths = [field[len("worktree "):] for field in fields if field.startswith("worktree ")]
+        branches = [field[len("branch "):] for field in fields if field.startswith("branch ")]
+        if len(paths) != 1 or len(branches) > 1:
+            raise ValueError("registered worktree metadata cannot be resolved")
+        path = Path(paths[0])
+        if not path.is_absolute():
+            raise ValueError("registered worktree path is not absolute")
+        resolved = path.resolve()
+        if resolved in records:
+            raise ValueError("registered worktree metadata is ambiguous")
+        records[resolved] = branches[0] if branches else None
+    if not records:
+        raise ValueError("registered worktrees cannot be resolved")
+    return records
+
+
+def git_target_contexts(git_options, working_directories):
+    contexts = []
+    for directory, effective_directory in zip(
+        working_directories or [os.getcwd()],
+        git_base_directories(git_options, working_directories),
+    ):
+        root = Path(
+            _git_output(git_options, directory, "rev-parse", "--show-toplevel").strip()
+        ).resolve()
+        listing = ("worktree", "list", "--porcelain")
+        try:
+            output, separator = _git_output(git_options, directory, *listing, "-z"), "\0"
+        except ValueError:
+            # Git before 2.36 has no -z here; pipeline_git.worktree_list_porcelain
+            # retries the same way. A line then ends each field.
+            output, separator = _git_output(git_options, directory, *listing), "\n"
+        records = registered_worktree_records(output, separator)
+        if root not in records:
+            raise ValueError("git target repository worktree cannot be resolved")
+        common = Path(
+            _git_output(git_options, directory, "rev-parse", "--git-common-dir").strip()
+        )
+        if not common.is_absolute():
+            common = effective_directory / common
+        contexts.append(
+            {
+                "root": root,
+                "directory": directory,
+                "effective_directory": effective_directory,
+                "common": common.resolve(),
+                "git_options": list(git_options),
+                "worktrees": records,
+            }
+        )
+    return contexts
+
+
+def path_owned_records(roots):
+    branches, worktrees = set(), set()
+    for root in roots:
+        project = root / ".project"
+        if not os.path.lexists(project):
+            continue
+        if is_link_like(project) or not project.is_dir():
+            raise ValueError(".project ownership metadata cannot be resolved")
+        state = ownership_frontmatter(project / "STATE.md", {"branch"}, missing_ok=True)
+        if state.get("branch"):
+            branches.add(state["branch"])
+        task_files = []
+
+        def raise_walk_error(error):
+            raise error
+
+        try:
+            for directory, child_directories, filenames in os.walk(
+                project, onerror=raise_walk_error, followlinks=False
+            ):
+                if any(is_link_like(Path(directory) / name) for name in child_directories):
+                    raise ValueError("task ownership metadata contains a linked directory")
+                if Path(directory).name == "tasks":
+                    task_files.extend(
+                        Path(directory) / name
+                        for name in filenames
+                        if name.endswith(".md")
+                    )
+        except OSError as error:
+            raise ValueError(f"task ownership metadata cannot be listed: {error}") from None
+        task_files.sort()
+        for task in task_files:
+            fields = ownership_frontmatter(task, {"task_branch", "worktree"})
+            if fields.get("task_branch"):
+                branches.add(fields["task_branch"])
+            recorded = fields.get("worktree")
+            if recorded:
+                path = Path(recorded).expanduser()
+                if not path.is_absolute():
+                    path = root / path
+                try:
+                    worktrees.add(path.resolve())
+                except (OSError, RuntimeError):
+                    raise ValueError("task worktree ownership path cannot be resolved") from None
+    return branches, worktrees
+
+
+def ref_is_path_owned(name, owned_branches):
+    lowered = name.casefold()
+    # git stash drop and clear are denied too; refs/stash holds each stash.
+    if lowered.startswith("refs/gsd-path/") or lowered == "refs/stash":
+        return True
+    if lowered.startswith("refs/remotes/"):
+        # The remote-tracking ref of a Path branch can be the last ref to its
+        # commits. A remote name can contain a slash, so try each split.
+        parts = name.split("/")[2:]
+        return any(
+            ref_is_path_owned("refs/heads/" + "/".join(parts[index:]), owned_branches)
+            for index in range(1, len(parts))
+        )
+    short = name
+    if short.startswith("refs/heads/"):
+        short = short[len("refs/heads/"):]
+    elif short.startswith("heads/"):
+        short = short[len("heads/"):]
+    if short.casefold().startswith(PATH_OWNED_REF_PREFIXES):
+        return True
+
+    def canonical(value):
+        if value.startswith("refs/heads/"):
+            return value[len("refs/heads/"):]
+        if value.startswith("heads/"):
+            return value[len("heads/"):]
+        return value
+
+    # Loose refs that differ only in case are one file on macOS and Windows.
+    return any(
+        canonical(name).casefold() == canonical(branch).casefold()
+        for branch in owned_branches
+    )
+
+
+def _literal_target(value):
+    return bool(value) and not any(character in value for character in "*?[]{}~")
+
+
+def _positional_targets(arguments):
+    targets = []
+    after_separator = False
+    for argument in arguments:
+        if after_separator:
+            targets.append(argument)
+        elif argument == "--":
+            after_separator = True
+        elif not argument.startswith("-"):
+            targets.append(argument)
+    return targets
+
+
+PLAIN_REDIRECTION_OPERATORS = frozenset({">", ">>", "<", ">&", "&>", "&>>"})
+
+
+def _opens_process_substitution(token):
+    return token in ("<(", ">(") and getattr(token, "literal", None) != "quoted"
+
+
+def _fold_process_substitutions(tokens):
+    """The tokens with each process substitution body moved onto its operator."""
+    folded = []
+    body = None
+    depth = 0
+    for token in tokens:
+        opens = _opens_process_substitution(token) and (
+            getattr(token, "body", None) is None
+        )
+        if depth == 0:
+            if opens:
+                depth, body = 1, []
+                operator = ShellToken(token)
+                operator.literal = getattr(token, "literal", None)
+                operator.body = body
+                token = operator
+            folded.append(token)
+            continue
+        if opens:
+            depth += 1
+        elif token and set(token) <= set("|;&()\n\r") and (
+            getattr(token, "literal", None) != "quoted"
+        ):
+            for index, character in enumerate(token):
+                depth += (character == "(") - (character == ")")
+                if depth == 0:
+                    if token[index + 1:]:
+                        folded.append(ShellToken(token[index + 1:]))
+                    if token[:index]:
+                        body.append(token[:index])
+                    break
+            if depth == 0:
+                continue
+        body.append(token)
+    return folded
+
+
+def _runs_git_or_wrapper(segment, assignments):
+    words, _exact = _without_redirections(segment)
+    return (
+        wrapped_command_tokens(words if len(words) > 1 else segment) is not None
+        or git_command(words, assignments) is not None
+    )
+
+
+def _holds_git_command(tokens, assignments):
+    """Whether the tokens run Git or a wrapper, at each process substitution depth."""
     for segment in command_segments(tokens):
-        wrapped = wrapped_command_tokens(segment)
+        words = []
+        for token in [*segment, None]:
+            if token is not None and not _opens_process_substitution(token):
+                if not getattr(token, "descriptor", False):
+                    words.append(token)
+                continue
+            if words and _runs_git_or_wrapper(words, assignments):
+                return True
+            words = []
+            if getattr(token, "body", None) and _holds_git_command(
+                token.body, assignments
+            ):
+                return True
+    return False
+
+
+def _without_descriptor(token):
+    word = ShellToken(token)
+    word.redirection = getattr(token, "redirection", False)
+    word.literal = getattr(token, "literal", None)
+    return word
+
+
+def _without_redirections(words):
+    """The words of a simple command without the redirections the shell parsed.
+
+    Each redirection operator goes with the word after it and one file
+    descriptor digit written against it. The second result is false when one
+    of them is not plain: an operator outside PLAIN_REDIRECTION_OPERATORS or
+    a target that is not one literal word. A process substitution operator is
+    removed too and is never plain.
+    """
+    kept = []
+    exact = True
+    index = 0
+    while index < len(words):
+        word = words[index]
+        if _opens_process_substitution(word):
+            exact = False
+            index += 1
+            continue
+        if not getattr(word, "redirection", False):
+            kept.append(word)
+            index += 1
+            continue
+        if word.isdigit():
+            index += 1
+            word = words[index] if index < len(words) else ""
+        target = words[index + 1] if index + 1 < len(words) else ""
+        exact = exact and not (
+            word not in PLAIN_REDIRECTION_OPERATORS
+            or getattr(target, "redirection", False)
+            or getattr(target, "literal", None) not in ("bare", "quoted")
+            or not _literal_target(target)
+            or any(character in target for character in "$`<>()&|#")
+        )
+        index += 2
+    return kept, exact
+
+
+def _frontmatter_roots(contexts):
+    return {
+        path
+        for context in contexts
+        for path in context["worktrees"]
+    }
+
+
+def _git_refs(context):
+    output = _git_output(
+        context["git_options"],
+        context["directory"],
+        "for-each-ref",
+        "--format=%(refname)",
+    )
+    return {line for line in output.splitlines() if line}
+
+
+def _symbolic_ref_target(context, target):
+    try:
+        result = subprocess.run(
+            ["git", *context["git_options"], "symbolic-ref", "--quiet", target],
+            cwd=context["directory"],
+            capture_output=True,
+            encoding="utf-8",
+            errors="replace",
+            check=False,
+        )
+    except OSError:
+        raise ValueError("git ref target cannot be resolved") from None
+    if result.returncode == 1:
+        return None
+    if result.returncode != 0:
+        raise ValueError("git ref target cannot be resolved")
+    return result.stdout.strip()
+
+
+def _update_ref_names(target, refs, context, no_deref):
+    """The ref names a deletion of this operand touches, or None when unresolved.
+
+    Git reads an update-ref operand as a full name below the git directory,
+    never as a branch short name. It follows each symbolic ref to the ref it
+    deletes; with --no-deref it deletes the named symbolic ref itself. A name
+    outside refs/ (HEAD, a symbolic ref at the top of the git directory) is
+    unresolved: an ordinary command such as git switch changes its target.
+    """
+    if not target.startswith("refs/"):
+        return None
+    names = [target]
+    while True:
+        symbolic = _symbolic_ref_target(context, names[-1])
+        if symbolic is None:
+            return names if names[-1] in refs else None
+        if no_deref:
+            return names
+        if symbolic in names:
+            return None
+        names.append(symbolic)
+
+
+def _workspace_roots(contexts):
+    roots = [(Path.home() / ".gsd-path").resolve()]
+    configured = os.environ.get("GSD_PATH_WORKTREE_ROOT")
+    if configured:
+        configured_root = Path(configured).expanduser()
+        if not configured_root.is_absolute():
+            raise ValueError("GSD_PATH_WORKTREE_ROOT must be absolute")
+        roots.append(configured_root.resolve())
+    for common in {context["common"] for context in contexts}:
+        receipts = common / "gsd-path" / "workspaces"
+        if not os.path.lexists(receipts):
+            continue
+        if is_link_like(receipts) or not receipts.is_dir():
+            raise ValueError("pinned workspace receipts cannot be resolved")
+        try:
+            with os.scandir(receipts) as entries:
+                receipt_files = sorted(
+                    (Path(entry.path) for entry in entries if entry.name.endswith(".json")),
+                    key=lambda path: path.name,
+                )
+        except OSError as error:
+            raise ValueError(f"pinned workspace receipts cannot be listed: {error}") from None
+        for receipt in receipt_files:
+            try:
+                metadata = receipt.lstat()
+                if not stat.S_ISREG(metadata.st_mode):
+                    raise ValueError("receipt is not a regular file")
+                data = json.loads(receipt.read_text(encoding="utf-8"))
+            except (OSError, UnicodeDecodeError, json.JSONDecodeError, ValueError):
+                raise ValueError(
+                    f"pinned workspace receipt cannot be read: {receipt.name}"
+                ) from None
+            if (
+                not isinstance(data, dict)
+                or not isinstance(data.get("primary"), str)
+                or not isinstance(data.get("root"), str)
+                or not Path(data["primary"]).is_absolute()
+                or not Path(data["root"]).is_absolute()
+            ):
+                raise ValueError(
+                    f"pinned workspace receipt is malformed: {receipt.name}"
+                )
+            roots.append(Path(data["root"]).resolve())
+    return roots
+
+
+def owned_target_reason(command, arguments, git_options, working_directories):
+    action = {
+        "branch": "git branch -D",
+        "update-ref": "git update-ref deletion",
+        "worktree": "git worktree remove --force",
+    }[command]
+    unresolved = GIT_REASONS["unresolved-target"].format(action=action)
+    # The shell expands a leading ~ and a glob in an option value such as the
+    # -C directory; the guard has only the literal text.
+    if any(
+        value[:1] == "~" or any(character in value for character in "*?[]{}")
+        for value in git_options[1::2]
+    ):
+        return unresolved
+    contexts = git_target_contexts(git_options, working_directories)
+    branches, task_worktrees = path_owned_records(_frontmatter_roots(contexts))
+
+    if command == "branch":
+        # Each word that is not an option is read as a branch name. Git does
+        # the same after --color; after an option with a separate value
+        # (--sort key) this only adds a name to check.
+        targets = _positional_targets(arguments)
+        if not targets or not all(_literal_target(target) for target in targets):
+            return unresolved
+        remote = has_short_option(arguments, "r") or any(
+            git_option_in(argument, {"--remotes"}) for argument in arguments
+        )
+        for target in targets:
+            # Git reads the name in exactly one namespace, with no other form.
+            ref = f"refs/{'remotes' if remote else 'heads'}/{target}"
+            if ref_is_path_owned(ref, branches) or ref_is_path_owned(
+                f"refs/heads/{target}", branches
+            ):
+                return GIT_REASONS["branch"]
+            if any(ref not in _git_refs(context) for context in contexts):
+                return unresolved
+        return None
+
+    if command == "update-ref":
+        operands, options = [], set()
+        index = 0
+        while index < len(arguments):
+            argument = arguments[index]
+            if argument == "-m":  # its value is not an option, also when it is -d
+                index += 2
+                continue
+            if argument.startswith("-"):
+                options.add(argument)
+                index += 1
+                continue
+            operands.append(argument)
+            index += 1
+        deletion_flag = "-d" in options
+        expected_counts = {1, 2} if deletion_flag else {2, 3}
+        if len(operands) not in expected_counts or not _literal_target(operands[0]):
+            return unresolved
+        if not deletion_flag and not (operands[1] == "" or not operands[1].strip("0")):
+            return unresolved
+        if deletion_flag and len(operands) == 2 and not _literal_target(operands[1]):
+            return unresolved
+        if not deletion_flag and len(operands) == 3 and not _literal_target(operands[2]):
+            return unresolved
+        # Dereferencing a symbolic ref must not erase ownership of its name.
+        if ref_is_path_owned(operands[0], branches):
+            return GIT_REASONS["update-ref"]
+        for context in contexts:
+            names = _update_ref_names(
+                operands[0], _git_refs(context), context, "--no-deref" in options
+            )
+            if names is None:
+                return unresolved
+            if any(ref_is_path_owned(name, branches) for name in names):
+                return GIT_REASONS["update-ref"]
+        return None
+
+    targets = _positional_targets(arguments[1:])
+    if len(targets) != 1 or not _literal_target(targets[0]):
+        return unresolved
+    recorded_paths = set(task_worktrees)
+    managed_roots = _workspace_roots(contexts)
+    for context in contexts:
+        target = Path(targets[0])
+        if not target.is_absolute():
+            target = context["effective_directory"] / target
+        resolved_target = None
+        try:
+            resolved_target = target.resolve(strict=True)
+        except (OSError, RuntimeError):
+            pass
+        registered = context["worktrees"]
+        # Git tries a unique path suffix first, then the path, and compares
+        # without case on macOS and Windows. Both readings must agree.
+        matches = {resolved_target} & set(registered)
+        suffix = tuple(
+            part.casefold() for part in Path(targets[0]).parts if part not in {"", "."}
+        )
+        if suffix and not Path(targets[0]).is_absolute() and ".." not in suffix:
+            by_suffix = [
+                path for path in registered
+                if tuple(part.casefold() for part in path.parts[-len(suffix):]) == suffix
+            ]
+            if len(by_suffix) == 1:
+                matches.add(by_suffix[0])
+        if len(matches) != 1:
+            return unresolved
+        resolved_target = matches.pop()
+        if not resolved_target.is_dir():
+            return unresolved
+        branch = registered[resolved_target]
+        primary = next(iter(registered))
+        if (
+            resolved_target in recorded_paths
+            or (branch is not None and ref_is_path_owned(branch, branches))
+            or any(
+                resolved_target == root or resolved_target.is_relative_to(root)
+                for root in (*managed_roots, primary.parent / f"{primary.name}.gsd-path")
+            )
+            or (
+                resolved_target.parent == primary.parent
+                and resolved_target.name.startswith(f".{primary.name}-gsd-path-integrate-")
+            )
+        ):
+            return GIT_REASONS["worktree"]
+    return None
+
+
+def _path_has_symlink_component(value):
+    path = Path(value)
+    if not path.is_absolute():
+        path = Path.cwd() / path
+    current = Path(path.anchor)
+    for component in path.parts[1:]:
+        if component in {"", "."}:
+            continue
+        if component == "..":
+            current = current.parent
+            continue
+        current = current / component
+        try:
+            if os.path.lexists(current) and is_link_like(current):
+                return True
+        except OSError:
+            return True
+    return False
+
+
+def env_wrapper_changes_git_context(segment):
+    """Whether an env wrapper makes ownership or alias lookup context uncertain."""
+    index = 0
+    while index < len(segment) and SHELL_ASSIGNMENT_PATTERN.match(segment[index]):
+        index += 1
+    if index >= len(segment):
+        return False
+    executable = segment[index].replace("\\", "/").rsplit("/", 1)[-1].casefold()
+    if executable != "env":
+        return False
+
+    def affects_git_context(name):
+        folded = name.upper()
+        return folded.startswith("GIT_") or folded in {"HOME", "XDG_CONFIG_HOME"}
+
+    index += 1
+    while index < len(segment):
+        token = segment[index]
+        if token == "--":
+            return False
+        if token in {"-i", "--ignore-environment"}:
+            return True
+        if token.startswith("--unset="):
+            if affects_git_context(token.split("=", 1)[1]):
+                return True
+            index += 1
+            continue
+        if token in {"-u", "--unset"}:
+            if index + 1 >= len(segment):
+                return False
+            if affects_git_context(segment[index + 1]):
+                return True
+            index += 2
+            continue
+        if SHELL_ASSIGNMENT_PATTERN.match(token):
+            if affects_git_context(token.partition("=")[0]):
+                return True
+            index += 1
+            continue
+        option = token.split("=", 1)[0]
+        if option in ENV_OPTIONS_WITH_VALUES:
+            index += 1 if "=" in token else 2
+            continue
+        if option in ENV_OPTIONS_WITHOUT_VALUES:
+            index += 1
+            continue
+        return False
+    return False
+
+
+def ownership_cwd_is_uncertain(tokens, working_directories=None):
+    """Whether a scoped delete follows a cd whose shell control flow is unclear."""
+    cwd_wrappers = COMMAND_WRAPPERS | {
+        "eval", "source", ".",
+        # These change what a later cd does, or run a cd later.
+        "alias", "trap", "enable", "disable",
+    }
+    segments = []
+    current = []
+    separator = None
+    depth = 0
+    comment = False
+    for token in tokens:
+        # Most shells run nothing from a # word to the end of the line, but
+        # the guard reads that text as commands. A cd there can run or not.
+        if comment and "\n" in token:
+            if not set(token) <= set("|;&()\n\r"):
+                return True
+            comment = False
+        elif comment and token.casefold() in DIRECTORY_CHANGE_COMMANDS:
+            return True
+        if token and set(token) <= set("|;&()\n\r"):
+            if "()" in token:
+                return True  # a function definition: its body runs only on a call
+            if current:
+                segments.append((current, separator, depth))
+                current = []
+            if "(" in token:
+                depth += token.count("(")
+            if ")" in token:
+                depth = max(0, depth - token.count(")"))
+            separator = token.strip()
+        else:
+            comment = comment or (
+                token.startswith("#") and getattr(token, "literal", None) != "quoted"
+            )
+            current.append(token)
+    if current:
+        segments.append((current, separator, depth))
+
+    uncertain = False
+    conditional = False
+    current_directories = list(working_directories or [os.getcwd()])
+    initial_symlink = any(
+        _path_has_symlink_component(directory) for directory in current_directories
+    )
+    for index, (segment, previous_separator, group_depth) in enumerate(segments):
+        plain, _exact = _without_redirections(segment)
+        redirected = len(plain) != len(segment)
+        segment = plain
+        if not segment:
+            continue
+        if env_wrapper_changes_git_context(segment):
+            return True
+        if segment[0] == "function":
+            return True
+        if any(token.casefold() in SHELL_CONTROL_WORDS for token in segment):
+            conditional = True
+        while segment and segment[0].casefold() in SHELL_CONTROL_WORDS:
+            segment = segment[1:]
+        invocation = command_invocation(segment)
+        if invocation is None:
+            continue
+        command, arguments = invocation
+        next_separator = (
+            segments[index + 1][1] if index + 1 < len(segments) else None
+        )
+        if command in DIRECTORY_CHANGE_COMMANDS:
+            target = directory_change_target(arguments)
+            absolute = is_absolute_path(target)
+            dotted = target.replace("\\", "/")
+            next_directories = (
+                [target]
+                if absolute
+                else [f"{directory}/{target}" for directory in current_directories]
+            )
+            if (
+                # Only a plain `cd <directory>` has the same effect in each shell.
+                segment[0] != "cd"
+                or redirected
+                or arguments not in ([target], ["--", target])
+                # A shell with CDPATH looks for a plain relative name in other
+                # directories first; ./name and ../name are not looked up there.
+                or not (
+                    absolute
+                    or dotted in {".", ".."}
+                    or dotted.startswith(("./", "../"))
+                )
+                or any(character in target for character in "*?[]{}$")
+                or group_depth > 0
+                or previous_separator in {"&&", "||", "&"}
+                or next_separator in {"||", "&"}
+                or (previous_separator is not None and "|" in previous_separator)
+                or (next_separator is not None and "|" in next_separator)
+                or conditional
+                or initial_symlink
+                or any(_path_has_symlink_component(path) for path in next_directories)
+            ):
+                uncertain = True
+            current_directories = next_directories
+            initial_symlink = False
+        if command in cwd_wrappers and index + 1 < len(segments):
+            uncertain = True
+        if uncertain and index + 1 < len(segments):
+            return True
+        if any(token.casefold() in {"fi", "done", "esac"} for token in segment):
+            conditional = False
+    return False
+
+
+def assignments_change_git_context(assignments):
+    return any(
+        name.upper().startswith("GIT_")
+        or name.upper() in {"HOME", "XDG_CONFIG_HOME"}
+        for name in assignments
+    )
+
+GIT_CONTEXT_NAME = re.compile(r"GIT_\w+|HOME|XDG_CONFIG_HOME")
+# export, declare, typeset, local, readonly and unset of these names are
+# denied where the guard reads assignments.
+VARIABLE_SETTING_COMMANDS = frozenset(
+    {"read", "getopts", "mapfile", "readarray", "integer", "float", "vared"}
+)
+LOOP_VARIABLE_WORDS = frozenset({"for", "select"})
+
+
+def command_sets_git_context_name(tokens):
+    """Whether a command that the guard does not track sets a Git context variable."""
+    words = []
+    for token in [*tokens, ";"]:
+        if not (token and set(token) <= set("|;&()\n\r")):
+            words.append(token)
+            continue
+        words, _exact = _without_redirections(words)
+        while words and (
+            words[0].casefold() in SHELL_CONTROL_WORDS - LOOP_VARIABLE_WORDS
+            or words[0] in COMMAND_WRAPPERS
+            or SHELL_ASSIGNMENT_PATTERN.match(words[0])
+        ):
+            del words[0]
+        command, operands, words = "".join(words[:1]), words[1:], []
+        if command in LOOP_VARIABLE_WORDS:
+            operands = operands[:1]
+        elif command in {"printf", "print"}:
+            operands = [
+                name for option, name in zip(operands, operands[1:]) if option == "-v"
+            ] + [option[2:] for option in operands if option.startswith("-v")]
+        elif command not in VARIABLE_SETTING_COMMANDS:
+            continue
+        if any(GIT_CONTEXT_NAME.fullmatch(operand) for operand in operands):
+            return True
+    return False
+
+
+def destructive_git_reason(
+    tokens,
+    resolved_aliases=frozenset(),
+    initial_assignments=None,
+    working_directories=None,
+    cwd_reliable=True,
+    git_context_reliable=True,
+    earlier_git=False,
+    fold=True,
+):
+    # A process substitution has two readings: the tokens as they stand, and
+    # the tokens with each substitution body folded onto its operator.
+    folded = _fold_process_substitutions(tokens) if fold else tokens
+    if len(folded) != len(tokens):
+        reason = destructive_git_reason(
+            tokens,
+            resolved_aliases,
+            initial_assignments=initial_assignments,
+            working_directories=working_directories,
+            cwd_reliable=cwd_reliable,
+            git_context_reliable=git_context_reliable,
+            earlier_git=earlier_git,
+            fold=False,
+        )
+        if reason is not None:
+            return reason
+    tokens = folded
+    cwd_reliable = cwd_reliable and not ownership_cwd_is_uncertain(
+        tokens, working_directories
+    )
+    git_context_reliable = (
+        git_context_reliable and not command_sets_git_context_name(tokens)
+    )
+    this_git = False
+    for segment, directories, assignments, _prefix in shell_segment_contexts(
+        tokens, working_directories or [os.getcwd()], initial_assignments
+    ):
+        # Whether a Git command or a wrapped command ran before this segment.
+        earlier_git = earlier_git or this_git
+        # A dollar expansion can introduce literal percent/bang text; the second
+        # expansion pass must not silently reinterpret it as a different path.
+        cwd_reliable = cwd_reliable and not any(
+            CMD_PARAMETER_SYNTAX.search(NAMED_SHELL_PARAMETER_SYNTAX.sub(
+                lambda match: environment_parameter_value(match, assignments), token
+            ))
+            for token in segment
+        )
+        # A descriptor word is a file descriptor in bash and an argument in
+        # zsh; a process substitution runs a second command. Each reading is
+        # checked, and a scoped deletion in one of them is denied.
+        descriptor = any(getattr(token, "descriptor", False) for token in segment)
+        if descriptor:
+            readings = [
+                [token for token in segment if not getattr(token, "descriptor", False)],
+                [
+                    _without_descriptor(token)
+                    if getattr(token, "descriptor", False) else token
+                    for token in segment
+                ],
+            ]
+        else:
+            readings = [token.body for token in segment if getattr(token, "body", None)]
+        for reading in readings:
+            reason = destructive_git_reason(
+                reading,
+                resolved_aliases,
+                initial_assignments=assignments,
+                working_directories=directories,
+                cwd_reliable=False,
+                git_context_reliable=git_context_reliable,
+                earlier_git=earlier_git,
+            )
+            if reason is not None:
+                return reason
+        nested_git = (
+            descriptor or any(_opens_process_substitution(token) for token in segment)
+        ) and _holds_git_command(segment, assignments)
+        if descriptor:
+            this_git = nested_git
+            continue
+        # A redirection can stand at each position of a simple command.
+        words, exact = _without_redirections(segment)
+        segment_git_context_reliable = (
+            git_context_reliable
+            and not env_wrapper_changes_git_context(words)
+            and not assignments_change_git_context(assignments)
+        )
+        wrapped = wrapped_command_tokens(words if len(words) > 1 else segment)
         if wrapped is not None:
-            reason = destructive_git_reason(wrapped, resolved_aliases)
+            reason = destructive_git_reason(
+                wrapped,
+                resolved_aliases,
+                initial_assignments=assignments,
+                working_directories=directories,
+                cwd_reliable=cwd_reliable and exact,
+                git_context_reliable=segment_git_context_reliable,
+                earlier_git=earlier_git,
+            )
             if reason is not None:
                 return reason
-        invocation = git_command(segment)
+        invocation = git_command(words, assignments)
+        this_git = nested_git or wrapped is not None or invocation is not None
         if invocation is None:
             continue
         command, arguments, git_options = invocation
+        # Git matches its own commands by exact case, but alias names in any case.
+        built_in = (
+            command_invocation(words)[1][-len(arguments) - 1] in GIT_BUILT_IN_COMMANDS
+        )
+        if not segment_git_context_reliable and not built_in:
+            return GIT_REASONS["git-environment"]
+        # A scoped deletion needs literal words: the shell can change a variable
+        # in ways the guard does not track (read, +=, for, printf -v).
+        resolvable = cwd_reliable and exact and not any(
+            SHELL_PARAMETER_SYNTAX.search(token) for token in segment
+        )
+        directories = [native_path_text(directory) for directory in directories]
         if command == "config":
             alias_indexes = [
                 index
@@ -1820,16 +4112,32 @@ def destructive_git_reason(tokens, resolved_aliases=frozenset()):
                     "git config alias.* defines an alias the guard cannot inspect; "
                     "run the underlying git command directly"
                 )
-        alias = git_alias(command, git_options)
+        # A directory that an earlier segment creates does not exist yet.
+        alias = None
+        if not built_in or all(os.path.isdir(directory) for directory in directories):
+            alias = git_alias(command, git_options, directories)
         if alias is not None:
             if command in resolved_aliases:
                 raise ValueError(
                     f"git alias {command} refers to itself; run the underlying "
                     "git command directly"
                 )
+            # Git passes each word of an alias on as an argument; it runs no shell.
+            alias_words = shell_tokens(alias, direct=False)
+            for word in alias_words:
+                word.redirection = False
             reason = destructive_git_reason(
-                ["git", *git_options, *shell_tokens(alias), *arguments],
+                ["git", *git_options, *alias_words, *arguments],
                 resolved_aliases | {command},
+                initial_assignments=assignments,
+                working_directories=directories,
+                # Non-shell Git aliases do not expand environment parameters.
+                cwd_reliable=resolvable and not (
+                    NAMED_SHELL_PARAMETER_SYNTAX.search(alias)
+                    or CMD_PARAMETER_SYNTAX.search(alias)
+                ),
+                git_context_reliable=segment_git_context_reliable,
+                earlier_git=earlier_git,
             )
             if reason is not None:
                 return reason
@@ -1857,18 +4165,29 @@ def destructive_git_reason(tokens, resolved_aliases=frozenset()):
             if force_option or force_refspec:
                 return GIT_REASONS[command]
         if command == "branch":
+            # Git accepts each unique prefix of a long option (--del, --forc).
             deletes = (
-                "--delete" in arguments
+                any(git_option_in(argument, {"--delete"}) for argument in arguments)
                 or has_short_option(arguments, "d")
                 or has_short_option(arguments, "D")
             )
             forces = (
-                "--force" in arguments
+                any(git_option_in(argument, {"--force"}) for argument in arguments)
                 or has_short_option(arguments, "f")
                 or has_short_option(arguments, "D")
             )
             if deletes and forces:
-                return GIT_REASONS[command]
+                if not segment_git_context_reliable:
+                    return GIT_REASONS["git-environment"]
+                if not resolvable:
+                    return GIT_REASONS["unresolved-target"].format(
+                        action="git branch -D"
+                    )
+                reason = owned_target_reason(
+                    command, arguments, git_options, directories
+                )
+                if reason is not None:
+                    return reason
             if (
                 "--move" in arguments
                 or has_short_option(arguments, "m")
@@ -1877,10 +4196,39 @@ def destructive_git_reason(tokens, resolved_aliases=frozenset()):
                 return GIT_REASONS["branch-move"]
         if command == "update-ref":
             if update_ref_deletes(arguments):
-                return GIT_REASONS[command]
+                if not segment_git_context_reliable:
+                    return GIT_REASONS["git-environment"]
+                if not resolvable:
+                    return GIT_REASONS["unresolved-target"].format(
+                        action="git update-ref deletion"
+                    )
+                # The guard reads each symbolic ref now; an earlier Git command
+                # of this command line can point it at a Path-owned ref later.
+                # (-m can take the text --no-deref as its value.)
+                if earlier_git and (
+                    "--no-deref" not in arguments or "-m" in arguments
+                ):
+                    return GIT_REASONS["update-ref-order"]
+                reason = owned_target_reason(
+                    command, arguments, git_options, directories
+                )
+                if reason is not None:
+                    return reason
         if command == "worktree" and arguments[:1] == ["remove"]:
-            if "--force" in arguments or has_short_option(arguments[1:], "f"):
-                return GIT_REASONS[command]
+            if any(
+                git_option_in(argument, {"--force"}) for argument in arguments
+            ) or has_short_option(arguments[1:], "f"):
+                if not segment_git_context_reliable:
+                    return GIT_REASONS["git-environment"]
+                if not resolvable:
+                    return GIT_REASONS["unresolved-target"].format(
+                        action="git worktree remove --force"
+                    )
+                reason = owned_target_reason(
+                    "worktree", arguments, git_options, directories
+                )
+                if reason is not None:
+                    return reason
         if command == "stash" and arguments[:1] in (["drop"], ["clear"]):
             return GIT_REASONS[command]
         if command in {"checkout", "restore"} and any(
@@ -1983,28 +4331,76 @@ def bundled_helper_invocation(command, tokens, working_directories, helpers=PIPE
     return False
 
 
-def archive_command_is_read_only(command, tokens, archive_context=False, git_commands=ARCHIVE_READ_GIT_COMMANDS):
+def archive_command_is_read_only(
+    command, tokens, archive_context=False, git_commands=ARCHIVE_READ_GIT_COMMANDS,
+    source=None,
+):
+    """`source` is the unexpanded (segment, assignments) whose tokens keep their quote flags."""
     if archive_context and AMBIGUOUS_SHELL_SYNTAX.search(command):
         return False
     if not archive_context:
         return True
-    executable = tokens[0].replace("\\", "/").rsplit("/", 1)[-1].casefold()
+    invocation = command_invocation(tokens, unwrap_runners=False)
+    if invocation is None:
+        return True
+    executable, arguments = invocation
+    executable = executable.removesuffix(".exe")
+    if executable in DIRECTORY_CHANGE_COMMANDS:
+        return True
+    if executable in {"export", "declare", "typeset", "unset"}:
+        return True
     denied_options = ARCHIVE_READ_EXECUTION_OPTIONS.get(executable, ())
     if any(
         token == option or token.startswith(f"{option}=")
-        for token in tokens[1:]
+        for token in arguments
         for option in denied_options
     ):
         return False
+    if executable == "sed":
+        in_place, _inputs, script_is_read_only = sed_arguments(arguments)
+        return not in_place and script_is_read_only
     if executable in ARCHIVE_READ_COMMANDS:
         return True
-    if executable != "git" or len(tokens) < 2:
+    if executable != "git":
+        return False
+    git = git_command(*(source or (tokens,)))
+    if git is None:
         return False
-    if tokens[1].casefold() not in git_commands:
+    subcommand, git_arguments, _options = git
+    if subcommand not in git_commands:
         return False
     return not any(
-        token in GIT_READ_WRITE_OPTIONS or token.startswith("--output=")
-        for token in tokens[2:]
+        git_option_in(token, GIT_READ_WRITE_OPTIONS) for token in git_arguments
+    )
+
+
+def archive_write_attempt(segment, source=None):
+    """Whether a segment denied in archive context attempts a write there."""
+    if any(
+        token
+        and (set(token) <= SHELL_WRITE_REDIRECTION_CHARS
+             or re.fullmatch(r"\d*[<>]+&?", token))
+        for token in segment
+    ):
+        return True
+    invocation = command_invocation(segment)
+    if invocation is None:
+        return False
+    executable, arguments = invocation
+    executable = executable.removesuffix(".exe")
+    if executable in SHELL_WRITE_COMMANDS:
+        return True
+    if executable in IN_PLACE_EDITORS and (
+        has_short_option(arguments, "i")
+        or any(argument.startswith("--in-place") for argument in arguments)
+    ):
+        return True
+    git = git_command(*(source or (segment,)))
+    if git is None:
+        return False
+    subcommand, git_arguments, _options = git
+    return subcommand not in ARCHIVE_READ_GIT_COMMANDS or any(
+        git_option_in(token, GIT_READ_WRITE_OPTIONS) for token in git_arguments
     )
 
 
@@ -2126,22 +4522,28 @@ def closed_git_listing(tokens):
     return not positionals
 
 
-def closed_shell_execution_reason(command, tokens, working_directories):
+def closed_shell_execution_reason(
+    command, tokens, working_directories, initial_assignments=None
+):
     helpers = PIPELINE_HELPERS | {"pipeline_git.py", "status_runtime.py", "promote_lookahead.py", "pipeline_diagnose.py"}
     rest = tokens[3:] if tokens[1:2] == ["-B"] else tokens[2:]
     if rest[:1] == ["pending"]:
         helpers = helpers | {"discussion_records.py"}
     if bundled_helper_invocation(command, tokens, working_directories, helpers):
         return None
-    for segment, directories in segment_directories(tokens, working_directories):
+    for segment, directories, assignments, _prefix in shell_segment_contexts(
+        tokens, working_directories, initial_assignments
+    ):
         wrapped = wrapped_command_tokens(segment)
         if wrapped is not None:
-            reason = closed_shell_execution_reason(shlex.join(wrapped), wrapped, directories)
+            reason = closed_shell_execution_reason(
+                shlex.join(wrapped), wrapped, directories, assignments
+            )
             if reason:
                 return reason
             continue
         metadata_closed = None
-        git = git_command(segment)
+        git = git_command(segment, assignments)
         checked_segment = segment
         if git is not None:
             subcommand, arguments, options = git
@@ -2180,6 +4582,7 @@ def closed_shell_execution_reason(command, tokens, working_directories):
 def command_denial(command, working_directories, allow_destructive=True):
     """Return why a shell command is denied, or None when it may run."""
     working_directories = working_directories or [os.getcwd()]
+    command = re.sub(r"(?i:(\.project)\\(archive))", r"\1/\2", command)
     outer, substitutions = split_command_substitutions(command)
     try:
         tokens = shell_tokens(outer)
@@ -2188,6 +4591,7 @@ def command_denial(command, working_directories, allow_destructive=True):
             for interpreter in ("python3", "python", "py -3")
         ):
             return None
+        bundled_helper = bundled_helper_invocation(command, tokens, working_directories)
         destructive = list(destructive_shell_invocations(tokens))
         if destructive and (
             not allow_destructive
@@ -2208,19 +4612,35 @@ def command_denial(command, working_directories, allow_destructive=True):
             reason = command_denial(inner, working_directories, allow_destructive=False)
             if reason is not None:
                 return reason
-        archive_context = (
-            any(working_directory_in_archive(path) for path in working_directories)
-            or bool(ARCHIVE_REFERENCE.search(outer))
-            or command_references_archive(tokens, working_directories)
-            or unresolved_archive_expansion(outer, tokens, working_directories)
-        )
-        if not archive_command_is_read_only(command, tokens, archive_context) and not (
-            archive_context and bundled_helper_invocation(command, tokens, working_directories)
-        ):
-            return ARCHIVE_REASON
-        reason = destructive_git_reason(tokens) or protected_shell_write_reason(
+        for segment, directories, assignments, prefix in shell_segment_contexts(
             tokens, working_directories
-        )
+        ):
+            resolved_segment = [
+                expand_environment_parameters(token, assignments) for token in segment
+            ]
+            archive_context = (
+                any(working_directory_in_archive(path) for path in directories)
+                or segment_references_archive(segment, directories, assignments)
+                or any(
+                    ARCHIVE_REFERENCE.search(value)
+                    or path_in_archive(value, directories, ancestors=False)
+                    for value in prefix.values()
+                )
+            )
+            if not archive_command_is_read_only(
+                shlex.join(resolved_segment), resolved_segment, archive_context,
+                source=(segment, assignments),
+            ) and not (
+                archive_context
+                and bundled_helper
+            ):
+                if archive_write_attempt(resolved_segment, (segment, assignments)):
+                    return ARCHIVE_REASON
+                return ARCHIVE_UNPROVEN_READ_REASON
+        reason = destructive_git_reason(
+            tokens, working_directories=working_directories,
+            cwd_reliable=not shell_parameter_quoting_uncertain(outer),
+        ) or protected_shell_write_reason(tokens, working_directories)
     except ValueError as error:
         raise ValueError(describe_substitutions(str(error), substitutions)) from None
     return reason and describe_substitutions(reason, substitutions)