@r1z4x/tezgah 1.13.0 → 1.14.0

package/hooks/tezgah_integrity.py

@@ -42,14 +42,65 @@ from tezgah_paths import (SWITCHES, _toplevel, alts, cache_dir, language, latch,
                           off, pack_values, packs, root_for, say, spend_cap)
 import tezgah_store as ts
 
+# The wrappers every shell reader steps over to reach a segment's program, by
+# basename, with the options (short and long) that take the next word as their
+# value; `timeout` also takes its duration and `env -S` splits its string into
+# words (`_past_wrappers`). A wrapper with arguments (`nice -n 5`, `timeout 60`,
+# `sudo --user root`) hid `git commit -n` from the shortcut rule (audit B-001),
+# a write from the control rule and a check from VERIFY (B-121). One table:
+# hooks/tezgah_gate.py imports it with `_past_wrappers`.
+# ponytail: a wrapper outside it (`setsid`, `chrt`, `taskset`, `doas`, `xargs`,
+# `flock`) still hides the program behind it.
+WRAPPER_VALUE_OPTS = {
+    "sudo": ("-u", "--user", "-g", "--group", "-h", "--host", "-p", "--prompt",
+             "-C", "--close-from", "-D", "--chdir", "-r", "--role", "-t", "--type",
+             "-U", "--other-user", "-T", "--command-timeout"),
+    # -S splits its string into words (`_past_wrappers`); -P, -L and -U are
+    # BSD env's (`/usr/bin/env -P /usr/bin git ...` on macOS)
+    "env": ("-u", "--unset", "-C", "--chdir", "-S", "-P", "-L", "-U"),
+    "nice": ("-n", "--adjustment"), "nohup": (), "exec": ("-a",), "command": (),
+    "builtin": (), "time": ("-f", "--format", "-o", "--output"),
+    "timeout": ("-s", "--signal", "-k", "--kill-after"),
+    "stdbuf": ("-i", "--input", "-o", "--output", "-e", "--error"),
+    "ionice": ("-c", "--class", "-n", "--classdata", "-p", "--pid"),
+    "caffeinate": ("-t", "-w")}
+# Words that open a compound command: the command after one is read as if it
+# were not there (`if touch x; then`, `! rm x`, `do touch x`, `{ git commit
+# -n; }`). `[`/`]` are not here: hooks/tezgah_gate.py::_program skips the test
+# command, so the command after it in an `if` line is read.
+SHELL_KEYWORDS = frozenset(("if", "then", "elif", "else", "do", "while",
+                            "until", "!", "{", "time"))
+
+
+def _wrapper_prefix():
+    """VERIFY's prefix: any run of WRAPPER_VALUE_OPTS wrappers, each with its
+    env assignments, options, option values (a short one may close a cluster,
+    `-Hu deploy`) and `timeout`'s duration. No two readings of a word both go
+    on, so a failed match stays linear (review F3): a value never starts with
+    `-` nor looks like an assignment (`-u a=b` reads only as an option and an
+    assignment, which ends the same), and one short alternative per wrapper
+    holds all its value letters, read case sensitively inside VERIFY's `re.I`
+    (`-u`/`-U` as two alternatives under `re.I` gave every `-u a` two readings)."""
+    alts = []
+    value = r"(?!\w+=)[^-\s]\S*\s+"
+    for name, opts in WRAPPER_VALUE_OPTS.items():
+        shorts = "".join(sorted({o[1] for o in opts if len(o) == 2 and o != "-S"}))
+        valued = r"-[A-Za-z]*[%s]\s+%s|" % (re.escape(shorts), value) if shorts else ""
+        valued += "".join(r"%s\s+%s|" % (re.escape(o), value)
+                          for o in opts if o.startswith("--"))
+        alts.append(r"%s\s+(?:\w+=\S+\s+|%s-\S+\s+)*%s" % (
+            re.escape(name), valued, r"(?:\d\S*\s+)?" if name == "timeout" else ""))
+    return r"(?-i:(?:(?:[\w./-]*/)?(?:%s))*)" % "|".join(alts)
+
+
 # A command that actually checks the change, as opposed to one that merely runs.
 # Command position, like UI_CHECK: `echo pytest` and `cat pytest.ini` were
 # recorded as passing checks and let a "done, all tests pass" reply through
-# (audit M-1). The wrapper set keeps `sudo pytest` and `env X=1 pytest` counting;
-# without it they would be refused rather than missed.
+# (audit M-1). The wrapper prefix keeps `sudo pytest`, `env X=1 pytest` and
+# `timeout 60 pytest` counting; without it they would be refused rather than
+# missed, and a neutered or piped one passed the gate (B-121).
 VERIFY = re.compile(
-    r"(?:^|[|;&(])\s*"
-    r"(?:(?:sudo|env|time|nohup|command|exec)\s+(?:\w+=\S+\s+)*(?:-\S+\s+)*)?"
+    r"(?:^|[|;&(])\s*" + _wrapper_prefix() +
     r"(?:"    r"(?:python3?|uv run)\s+(?:(?:--project|--with|--python|--extra|--group|-p|-w)\s+\S+\s+|-\S+\s+)*(?:python3?\s+-m\s+)?(?:pytest|unittest|mypy|ruff|flake8|compileall|"
     r"(?:[\w./-]*/)?tezgah-design\s+(?:check|derive|slop)|"
     r"(?:[\w./-]*/)?tests[/\\]impacted\.py)|"
@@ -66,7 +117,7 @@ VERIFY = re.compile(
     r"go\s+(?:test|vet)|"
     r"cargo\s+(?:test|clippy|check|build)|"
     r"tox|nox|pre-commit|"
-    r"(?:^|\s)(?:make|just)\b|"
+    r"(?:^|\s|(?<=\s))(?:make|just)\b|"
     r"\./\S*(?:test|check|lint)\S*|"
     r"(?:\./)?(?:gradlew|mvn)\s+\S*(?:test|check)|dotnet\s+(?:test|build)|"
     r"swift\s+test|golangci-lint|shellcheck|"
@@ -184,14 +235,25 @@ DESIGN_CHECK = re.compile(
     r"(?:check|slop)\b",
     re.I | re.M)
 # A component, as opposed to the screen it sits on: a file under a
-# component/views/widgets directory, or a name that carries the convention on its
-# own (`Button.tsx`, `users.component.ts`, `user_card.dart`). The two owe
-# different proof - a screen read says what a thing looks like, and the contract
-# is the only thing that says whether it is on the repository's floor - so this
-# is what decides whether the design check is owed at all.
+# component/views/widgets/templates directory, a name that carries the
+# convention on its own (`Button.tsx`, `users.component.ts`, `user_card.dart`),
+# a single-file component (`.vue`, `.svelte`, `.astro` - in those frameworks the
+# file IS the component, whatever its name's case), or the route file the
+# frameworks with no `components/` convention render from (`app/<x>/page.tsx`,
+# `+page.svelte`, `layout.tsx`). The two owe different proof - a screen read says
+# what a thing looks like, and the contract is the only thing that says whether
+# it is on the repository's floor - so this is what decides whether the design
+# check is owed at all; a route file owes both, the screen read first, because
+# nothing else in such a repository ever carries the floor. Its two readers
+# (`_design_evidence`, stopspec's `Dc`) match it against the paths `_ui_writes`
+# accepted - every UI target the row wrote, never the row's command - so a
+# directory named here cannot pull in a file the same shell line merely reads
+# (`cat templates/welcome.txt`).
 DESIGN_COMPONENT = re.compile(
-    r"(?:^|/)(?:components?|views?|widgets?|partials?|screens?)/"
+    r"(?:^|/)(?:components?|views?|widgets?|partials?|screens?|templates?)/"
     r"|(?:^|/)(?-i:[A-Z])[A-Za-z0-9_]*\.(?:tsx|jsx|vue|svelte|swift|kt|dart)$"
+    r"|\.(?:vue|svelte|astro)$"
+    r"|(?:^|/)\+?(?:page|layout|template)\.(?:tsx|jsx)$"
     r"|\.(?:component|view|widget)\.[a-z]+$", re.I)
 # the explicit swallowers that make a failing check exit 0, the classic "I ran it
 # and it was fine": `|| true`, `|| :`, `|| exit 0`, `; true`, `; :` and
@@ -216,8 +278,10 @@ GITISH = re.compile(r"\b(?:git|commit|push|husky|pre-commit|npm|yarn|pnpm)\b", r
 # standalone `git config core.hooksPath .githooks`, a read or `--unset`, and a
 # hook install that merely names `pre-push` pass.
 # ponytail: a hooksPath set in one call and a commit in the next is not seen;
-# that needs the session's earlier calls, not one command line.
-HOOKS_KEY = "core.hookspath"
+# that needs the session's earlier calls, not one command line. An include
+# (`include.path`, `includeIf.<cond>.path`) counts as the key: the file it pulls
+# in can set hooksPath (review 148 r2 #3).
+HOOKS_KEYS = re.compile(r"core\.hookspath|include\.path|includeif\..+\.path")
 GIT_CONFIG_ENV = re.compile(r"GIT_CONFIG_(?:KEY_\d+|PARAMETERS)")
 ENV_WORD = re.compile(r"[A-Za-z_]\w*=")
 # git's global options that take the next word as their value
@@ -239,8 +303,10 @@ REDIRECTION = re.compile(r"^(?=[&<>]*[<>])[&<>]+$")
 # an fd number glued to its redirection (`2>`, `1<&`): bash reads `1<` as fd 1
 # and `1 <` as the program `1`, and shlex cannot tell them apart afterwards
 FD_REDIRECT = re.compile(r"(?<![\w])(\d+)([<>])")
-# what a shell line puts between the start of a command and its program; the
-# same set in the JS mirror, so the two read a line identically
+# the bare wrappers `_bookkeeping_command` steps over (no options: a wrapper
+# with arguments is not a plain read). The shortcut, neuter and control readers
+# use WRAPPER_VALUE_OPTS instead; the opencode mirror's GIT_WRAPPER still reads
+# its shortcut rules with this set until its port, which is plan 149's.
 GIT_WRAPPER = frozenset(("sudo", "env", "nohup", "time", "timeout", "command",
                          "exec"))
 # tests disabled so a failure disappears; checked only when newly introduced
@@ -291,7 +357,9 @@ TESTED_WORD = re.compile(r"test|check|suite", re.I)
 # it now clears only a class whose repair is a check (ADMITTED_CLASSES), and
 # only when a check ran and failed after the turn's newest change
 # (`_failed_since_change`, applied by `_admitted`).
-NEGATED = re.compile(alts("negated"), re.I)
+# A label at a line's start or a sentence about the change, never an
+# incidental "untested" elsewhere in the reply (review 150 R2-1): re.M.
+NEGATED = re.compile(alts("negated"), re.I | re.M)
 ADMITTED_CLASSES = frozenset(("check failed", "partial failure", "stale evidence",
                               "no verify_ok"))
 # What the evidence classes tell the model the admission takes, in one place.
@@ -1237,6 +1305,12 @@ def scratch_target(path, cwd=None):
     return False
 
 
+# How long another session's unanswered `began` row holds its file before its
+# host must have been seen answering that tool (`writers_elsewhere`, plan 171):
+# about a write's own duration, so a refused prompt holds the file a minute.
+FRESH_BEGAN_SECONDS = 60
+
+
 def writers_elsewhere(path, session_id, minutes=10, cwd=None, lineage=False):
     """The other sessions that recorded a write of `path` in the last `minutes`,
     newest first, as ledger ids. With `lineage`, each one is a (ledger id,
@@ -1262,6 +1336,16 @@ def writers_elsewhere(path, session_id, minutes=10, cwd=None, lineage=False):
     parse is skipped. A cross-session rule that cannot see the other ledgers has
     learned nothing, and must stay silent rather than act on a guess.
 
+    A `began` row of `path` that no outcome row of its `id` answered yet is a
+    write in flight and counts as one (audit B-069, owner answer OQ-09): two
+    sessions whose gates both ran before either write landed saw nothing. For
+    its first FRESH_BEGAN_SECONDS it counts outright (owner answer 2026-10-31,
+    plan 171): two sessions on their first write of one file. After that only
+    for a tool that session's host is seen answering inside the window, the way
+    `unanswered` reads it: a host that sends no result for a tool, or a call
+    the user refused at its prompt before any answered one, would otherwise
+    hold the file for the whole window.
+
     ponytail: a shell write counts only through the target its `run` row
     carries (a redirect or `tee`, `tezgah_gate.write_paths`): a sibling that
     wrote the file through a positional target (`sed -i`, `cp`) is invisible
@@ -1270,9 +1354,10 @@ def writers_elsewhere(path, session_id, minutes=10, cwd=None, lineage=False):
     if not want:
         return []
     now = time.time()
-    found = {}
+    found, waiting, delivered = {}, {}, set()
     try:
-        recent = ts.recent_rows(cache_dir(), now - minutes * 60, ("edit", "run"),
+        recent = ts.recent_rows(cache_dir(), now - minutes * 60,
+                                tuple(sorted(OUTCOME_KINDS | {BEGAN_KIND})),
                                 _slug(session_id))
     except ts.ERRORS:
         return []
@@ -1283,8 +1368,26 @@ def writers_elsewhere(path, session_id, minutes=10, cwd=None, lineage=False):
             row = json.loads(text)
         except ValueError:
             continue
-        if isinstance(row, dict) and row.get("target") == want:
+        if not isinstance(row, dict):
+            continue
+        key = (stem, row.get("id"))
+        if row.get("kind") == BEGAN_KIND:
+            if row.get("id"):
+                waiting.setdefault(key, []).append(
+                    (row.get("tool"), row.get("target") == want, stamp))
+            continue
+        if row.get("id") and waiting.get(key):
+            # one outcome answers one `began`, oldest first; a refusal shows
+            # nothing about the host delivering results (`_began_fold`)
+            tool, _mine, _ts = waiting[key].pop(0)
+            if row.get("kind") not in REFUSAL_KINDS:
+                delivered.add((stem, tool))
+        if row.get("kind") in ("edit", "run") and row.get("target") == want:
             found[stem] = max(found.get(stem, stamp), stamp)
+    for (stem, _id), rows in waiting.items():
+        for tool, mine, stamp in rows:
+            if mine and ((stem, tool) in delivered or now - stamp <= FRESH_BEGAN_SECONDS):
+                found[stem] = max(found.get(stem, stamp), stamp)
     stems = sorted(found, key=lambda stem: -found[stem])
     return [(stem,) + _relation(stem, session_id) + (found[stem],)
             for stem in stems] if lineage else stems
@@ -1355,7 +1458,7 @@ def _prompt_key(text):
     return hashlib.sha1(text.encode("utf-8", "replace")).hexdigest()[:12]
 
 
-def note_turn(session_id, prompt, workspace=None):
+def note_turn(session_id, prompt, workspace=None, subagent=False):
     """Write the user-turn marker the loop guard resets on, at most once per
     submission.
 
@@ -1378,7 +1481,8 @@ def note_turn(session_id, prompt, workspace=None):
     unanswered. The `turn` row is still written, since the Stop rule slices
     turns on every one of them, but marked `inflight`, and `_in_flight` reads
     a marked row as no boundary: a first forged run cannot close the window
-    for a second one.
+    for a second one. A subagent's prompt (`subagent`) is its parent's brief,
+    never the user's word, so it authorizes nothing either (B-086).
 
     ponytail: the same prompt re-sent as the very next thing, with no ledger row
     written in between, resets nothing - that direction can only deny too much,
@@ -1391,7 +1495,7 @@ def note_turn(session_id, prompt, workspace=None):
     inflight = _in_flight(session_id)
     named = [n for n in SWITCHES
              if re.search(r"(?<![\w.-])%s(?![\w-])" % re.escape(n), text)]
-    if named and not inflight:
+    if named and not inflight and not subagent:
         note(session_id, "authorized", workspace=workspace, authorized=named)
     note(session_id, "turn", key, workspace=workspace, inflight=1 if inflight else None)
 
@@ -1424,13 +1528,16 @@ def _in_flight(session_id):
 
 
 
-def bind_session(session_id):
+def bind_session(session_id, parent=None):
     """Latch this process's `off()` to `session_id`'s ledger (`tezgah_paths.latch`).
 
     Every hook entry that knows its session calls it before its first `off()`:
     the gate (`decision`), the prompt path (`context_for`) and the host
-    adapters' Stop paths. No session id leaves the process unbound."""
-    latch(_path(session_id) if session_id else None)
+    adapters' Stop paths. No session id leaves the process unbound. `parent` is
+    the payload's parent session: a subagent latches on the earlier of the two
+    sessions' first rows (B-036)."""
+    latch(_path(session_id) if session_id else None,
+          _path(parent) if session_id and parent and parent != session_id else None)
 
 
 def note_compaction(session_id, summary, trigger=None, found=None, expected=None,
@@ -2119,12 +2226,6 @@ def _check_runs(cmd, cwd=None):
         yield from _repo_check_runs(cmd, prefixes)
 
 
-# The words in front of a program that leave it the program: VERIFY's own
-# wrapper prefix, read on words instead of text.
-CHECK_WRAPPERS = frozenset(("sudo", "env", "time", "nohup", "command", "exec"))
-ASSIGNMENT_WORD = re.compile(r"^[A-Za-z_]\w*=")
-
-
 def repo_checks(cwd):
     """[argv prefix] the repository at `cwd` declares as checks in its manifest
     (`tezgah_extension.repo_checks`), or [] - no cwd, no manifest, a broken one,
@@ -2141,20 +2242,15 @@ def repo_checks(cwd):
 
 def _repo_check_runs(cmd, prefixes):
     """(name, mode) for each simple command of `cmd` that starts with one of
-    `prefixes`, after assignments and VERIFY's wrappers. Read with
+    `prefixes`, after assignments and the wrappers (`_past_wrappers`, the
+    table VERIFY's prefix reads). Read with
     `_shell_commands`, so a prefix inside a quoted argument, a commit message or
     a QUOTED heredoc body (`<<'EOF'`, `<<"EOF"`) is an argument, not a run - the
     masked reading VERIFY keeps. An unquoted heredoc's body (`<<EOF`, `<<-EOF`)
     is read as commands, so `cat > x <<EOF` over a `./bin/run-tool` line counts
-    as a run, as a `pytest` line there does for VERIFY.
-    ponytail: a wrapper's own option (`sudo -u root ./bin/x`) hides the program,
-    a lost credit rather than an invented one."""
+    as a run, as a `pytest` line there does for VERIFY."""
     for words, _sep in _shell_commands(cmd):
-        i = 0
-        while i < len(words) and (words[i] in CHECK_WRAPPERS
-                                  or ASSIGNMENT_WORD.match(words[i])):
-            i += 1
-        run = words[i:]
+        run = _past_wrappers(words)
         if not run:
             continue
         head = [os.path.normpath(run[0])] + run[1:]
@@ -2298,6 +2394,13 @@ def _kept(ch, before, parens):
 
 
 def _heredocs(cmd):
+    """`_heredocs_parse`, as a fresh list: the gate's readers ask for the same
+    command several times in one call (plan 169), so the parse runs once."""
+    return list(_heredocs_parse(cmd))
+
+
+@functools.lru_cache(maxsize=256)
+def _heredocs_parse(cmd):
     """Every heredoc operator in `cmd`, in order, as (operator start, operator
     end, tag, quoted, body start, terminator span or None, safe).
 
@@ -2662,6 +2765,13 @@ def _shell_lines(text):
 
 
 def _shell_commands(cmd):
+    """`_shell_commands_parse`, as fresh lists: one parse per command string per
+    process (plan 169); no caller can change what the next one reads."""
+    return [[list(words), sep] for words, sep in _shell_commands_parse(str(cmd or ""))]
+
+
+@functools.lru_cache(maxsize=256)
+def _shell_commands_parse(cmd):
     """`_shell_segments` with each command's separator kept: [words, sep], where
     `sep` is the `;&|()` runs that ended it (a run after an empty command joins
     the previous one's) plus "\\n" at a line end, "" at the end of the line.
@@ -2765,10 +2875,71 @@ def _shell_segments(cmd):
 
 
 def _names_hooks_key(setting):
-    """True for `core.hooksPath` or `core.hooksPath=<value>`, any case. A leading
-    `$` is dropped: bash reads `$'core.hooksPath'` and `$"core.hooksPath"` as the
-    plain key, while shlex leaves the `$` on the word."""
-    return setting.lstrip("$").lower().partition("=")[0] == HOOKS_KEY
+    """True for `core.hooksPath`, `include.path` or `includeIf.<cond>.path`
+    (HOOKS_KEYS), bare or with `=<value>`, any case: an include can carry a
+    hooksPath (review 148 r2 #3). A leading `$` is dropped: bash reads
+    `$'core.hooksPath'` and `$"core.hooksPath"` as the plain key, while shlex
+    leaves the `$` on the word."""
+    return bool(HOOKS_KEYS.fullmatch(setting.lstrip("$").lower().partition("=")[0]))
+
+
+def _option_value(word, opts):
+    """How a wrapper's dash word takes its value, the way getopt reads it:
+    (letter, stuck) for a long option in `opts` or the first letter of a short
+    cluster that is one (`-Hu`: `u`), `stuck` the rest of the word after it (""
+    when the value is the next word); None when the word takes no value."""
+    if word in opts:
+        return word, ""
+    if word.startswith("--") or len(word) < 2:
+        return None
+    for k, ch in enumerate(word[1:], 1):
+        if "-" + ch in opts:
+            return ch, word[k + 1:]
+    return None
+
+
+def _past_wrappers(words, assigns=None):
+    """`words` from a segment's program on: past env assignments, compound
+    keywords (SHELL_KEYWORDS) and the wrappers (WRAPPER_VALUE_OPTS, by
+    basename) with their options, their option values - a short option that
+    closes a cluster takes the next word (`sudo -Hu deploy`, `timeout -vk 5`,
+    review F1) - and `timeout`'s duration. `env -S STRING` (alone, in a
+    cluster `-iS`, or `--split-string`) runs STRING split into words, which are
+    read on as the segment's own (review m5). `assigns`, a list when given,
+    collects the env assignments stepped over."""
+    words = list(words)
+    i = 0
+    while i < len(words):
+        word = words[i]
+        wrapper = os.path.basename(word)
+        if ENV_WORD.match(word):
+            if assigns is not None:
+                assigns.append(word)
+            i += 1
+        elif wrapper in WRAPPER_VALUE_OPTS:
+            i += 1
+            opts = WRAPPER_VALUE_OPTS[wrapper]
+            while i < len(words) and words[i].startswith("-"):
+                long_split = wrapper == "env" and re.fullmatch(
+                    r"--split-string(?:=(.*))?", words[i], re.S)
+                hit = _option_value(words[i], opts)
+                if long_split or (wrapper == "env" and hit and hit[0] in ("S", "-S")):
+                    value = long_split.group(1) if long_split else hit[1]
+                    if not value:
+                        value = words.pop(i + 1) if i + 1 < len(words) else ""
+                    try:
+                        words[i:i + 1] = shlex.split(value)
+                    except ValueError:
+                        words[i:i + 1] = value.split()
+                    continue
+                i += 2 if hit and not hit[1] else 1
+            if wrapper == "timeout" and i < len(words):
+                i += 1  # the duration
+        elif word in SHELL_KEYWORDS:
+            i += 1
+        else:
+            break
+    return words[i:]
 
 
 def _hooks_redirect(cmd):
@@ -2781,17 +2952,15 @@ def _hooks_redirect(cmd):
     denied a legitimate line."""
     assigns = writes = False
     for words in _shell_segments(cmd):
-        i = 0
-        while i < len(words) and (ENV_WORD.match(words[i])
-                                  or words[i] in GIT_WRAPPER):
-            if ENV_WORD.match(words[i]):
-                name, _, value = words[i].partition("=")
-                if GIT_CONFIG_ENV.fullmatch(name) and HOOKS_KEY in value.lower():
-                    assigns = True
-            i += 1
-        if i >= len(words) or os.path.basename(words[i]) != "git":
+        seen = []
+        words = _past_wrappers(words, seen)
+        for word in seen:
+            name, _, value = word.partition("=")
+            if GIT_CONFIG_ENV.fullmatch(name) and HOOKS_KEYS.search(value.lower()):
+                assigns = True
+        if not words or os.path.basename(words[0]) != "git":
             continue
-        i += 1
+        i = 1
         sub = None
         while i < len(words):
             word = words[i]
@@ -2823,7 +2992,7 @@ def _hooks_redirect(cmd):
             # option (`core.hooksPath -- --unset` sets the value `--unset`)
             positional = ([a for a in head if not a.startswith("-")]
                           + (args[args.index("--") + 1:] if "--" in args else []))
-            if not reads and len(positional) >= 2 and positional[0] == HOOKS_KEY:
+            if not reads and len(positional) >= 2 and _names_hooks_key(positional[0]):
                 assigns = True
     return assigns and writes
 
@@ -2886,13 +3055,10 @@ def _git_skips_hooks(cmd):
     (`--no-verif`, `--no-ver`). Both passed the gate (audit SEC-03 / L-5).
     `-n` is read for `commit` only: on `push` it is --dry-run."""
     for words in _shell_segments(cmd):
-        i = 0
-        while i < len(words) and (ENV_WORD.match(words[i])
-                                  or words[i] in GIT_WRAPPER):
-            i += 1
-        if i >= len(words) or os.path.basename(words[i]) != "git":
+        words = _past_wrappers(words)
+        if not words or os.path.basename(words[0]) != "git":
             continue
-        i += 1
+        i = 1
         while i < len(words) and words[i].startswith("-"):
             i += 2 if words[i] in GIT_VALUE_OPTS else 1
         if i >= len(words):
@@ -2925,9 +3091,10 @@ def _git_skips_hooks(cmd):
 
 
 def _shell_scripts(cmd):
-    """The script text of every `bash -c '...'` / `sh -c` segment: the masked
-    scan below blanks a quoted script, so a check neutered or a hook skipped
-    inside one passed unseen (audit SEC-03 / L-5).
+    """The script text of every `bash -c '...'` / `sh -c` segment, and of every
+    `eval` (its words joined): the masked scan below blanks a quoted script, so
+    a check neutered or a hook skipped inside one passed unseen (audit SEC-03 /
+    L-5, B-014).
 
     Read the way bash reads its own options: the script is the first word that
     is not an option, once `-c` has been seen. Long options are skipped (and
@@ -2936,13 +3103,16 @@ def _shell_scripts(cmd):
     `sh -e -c '...'` are unwrapped too (review F10)."""
     out = []
     for words in _shell_segments(cmd):
-        i = 0
-        while i < len(words) and (ENV_WORD.match(words[i])
-                                  or words[i] in GIT_WRAPPER):
-            i += 1
-        if i >= len(words) or os.path.basename(words[i]) not in SHELLS:
+        words = _past_wrappers(words)
+        if words[:1] == ["eval"]:
+            # eval runs its words, joined by spaces, as a script (audit B-014);
+            # a leading `--` only ends its options (review m3)
+            args = words[1:]
+            out.append(" ".join(args[1:] if args[:1] == ["--"] else args))
+            continue
+        if not words or os.path.basename(words[0]) not in SHELLS:
             continue
-        seen, j = False, i + 1
+        seen, j = False, 1
         while j < len(words):
             word = words[j]
             if word in SHELL_VALUE_LONGS:
@@ -2973,8 +3143,9 @@ def _shortcut_command(cmd, depth):
                 "(SKIP=/HUSKY_SKIP_HOOKS/HUSKY=0) turns the checks off. Run them "
                 "instead of disabling them.")
     if _hooks_redirect(cmd):
-        return ("Verification bypass denied: `core.hooksPath` is redirected in "
-                "the same command as a commit/push, so git runs a hooks directory "
+        return ("Verification bypass denied: `core.hooksPath` (or an include that "
+                "can set it) is redirected in the same command as a commit/push, so "
+                "git runs a hooks directory "
                 "that does not hold the checks - the same skip as `--no-verify`. "
                 "Run the checks, fix what they report, and commit without it.")
     if verify_command(c) and NEUTER.search(c):
@@ -2982,6 +3153,11 @@ def _shortcut_command(cmd, depth):
                 "`; true`, so it reports success no matter what it found. Run it "
                 "as the line's last command, with nothing after it but `&&`, and "
                 "read the real exit status before claiming it passed.")
+    if verify_command(c) and exit_trap_swallows(cmd):
+        return ("Verification neutered: a trap that runs `exit 0` ends the "
+                "shell with status 0 whatever this check found. Drop the trap, "
+                "run the check as the line's last command and read its real exit "
+                "status before claiming it passed.")
     if depth < SHELL_DEPTH:
         for script in _shell_scripts(cmd):
             reason = _shortcut_command(script, depth + 1)
@@ -2994,8 +3170,61 @@ def _shortcut_command(cmd, depth):
 # is then its first failing stage's, so a check piped through `tail` keeps its
 # own exit and the host's verdict is the check's.
 PIPEFAIL = re.compile(r"^\s*set\s+(?:-\w+\s+)*-\w*o\s+pipefail\s*(?:;|&&|\n)")
-# the stages that trim or filter what a check printed; `|&` pipes stderr too
-TRIMMER = re.compile(r"^\s*&?\s*(tail|head|e?grep|fgrep|cut|wc|sed\s+-n)\b")
+# the stages that trim or filter what a check printed; `|&` pipes stderr too.
+# A pager, `sort`, `cat` and a `tee` own the line's status just as `tail` does
+# (audit B-070).
+TRIMMER = re.compile(
+    r"^\s*&?\s*(tail|head|e?grep|fgrep|rg|awk|cut|wc|sed|sort|cat|less|more|tee)\b")
+
+
+def exit_trap_swallows(cmd):
+    """True when the line sets a trap that runs `exit 0` (`trap 'exit 0'
+    EXIT`), on any signal: bash then ends with the trap's status, so a failing
+    check exits 0 (audit B-004) - on EXIT after it, on ERR when it fails, on
+    DEBUG before it even runs (review M1). A trap that only cleans up (`trap
+    'rm -f x' EXIT`) keeps the check's status and passes."""
+    for words in _shell_segments(cmd):
+        words = _past_wrappers(words)
+        if words[:1] != ["trap"]:
+            continue
+        args = [w for w in words[1:] if w != "--"]
+        if len(args) >= 2 and re.search(r"(?:^|[\s;&|(])exit\s+0+\b", args[0]):
+            return True
+    return False
+
+
+# What a trap may run and still leave the check's status the line's: an EXIT
+# trap whose every command is plain cleanup. Any other action can end the shell
+# with a status of its own (`exit $((0))`, `exec true`, `ex""it 0`, a function),
+# and an ERR, DEBUG or RETURN trap runs in the middle of the check, so
+# `status_hidden` records such a line as ran, never as passed (review m4, F2).
+# A `trap` word the line's own commands do not set - inside an `eval` or
+# `bash -c` string, a function body, a commit message - counts the same way.
+# The traps are the parsed segments', so a quoted or escaped spelling (`t''rap`,
+# `t\rap`) is one too; a `$'...'` on a trap line counts as an action of its own,
+# since the word reader does not decode its escapes (review 148 r2 #4).
+# ponytail: a trap set by an earlier call is not seen, and a line that only
+# names the word records as ran - a lost credit, never an invented one.
+TRAP_WORD = re.compile(r"(?<![\w.-])trap(?![\w.-])")
+TRAP_CLEANUP = frozenset(("rm", "echo", "printf", ":"))
+
+
+def trap_owns_status(cmd):
+    """True when a trap on this line may own its exit status (TRAP_CLEANUP)."""
+    cmd = str(cmd or "")
+    traps = [w for w in map(_past_wrappers, _shell_segments(cmd)) if w[:1] == ["trap"]]
+    if len(traps) < len(TRAP_WORD.findall(cmd)) or traps and "$'" in cmd:
+        return True
+    for words in traps:
+        args = [w for w in words[1:] if w != "--"]
+        if len(args) < 2 or args[0] == "-":
+            continue  # a listing (`trap -p`) or a reset
+        if any(s.upper().removeprefix("SIG") not in ("EXIT", "0") for s in args[1:]):
+            return True
+        if any(not w or w[0] not in TRAP_CLEANUP
+               for w in _shell_segments(args[0])):
+            return True
+    return False
 
 
 def pipe_hides_status(cmd):
@@ -3025,11 +3254,15 @@ def status_hidden(cmd, cwd=None):
     status. Read with `_shell_commands`, each command re-quoted for
     `verify_command`; `cwd` reads the repository's declared checks
     (`repo_checks`) as checks too, so `./bin/run-tool x; echo done` is hidden
-    the way `pytest; echo done` is. ponytail: `set -e` is not read, so `set -e;
-    pytest; echo done` records as ran - a lost credit, never an invented one."""
-    if pipe_hides_status(cmd):
-        return True
+    the way `pytest; echo done` is. A trap that may end the shell on its own
+    (`trap_owns_status`) owns the status too, and so does an `exit` or a
+    command-running `exec` before the check (`exit 0; pytest` never runs it;
+    a bare `exec >log` only redirects). ponytail: `set -e` is not read, so
+    `set -e; pytest; echo done` records as ran - a lost credit, never an
+    invented one; `builtin exit` and `command exec` are not read."""
     cmd = str(cmd or "")
+    if pipe_hides_status(cmd) or trap_owns_status(cmd):
+        return True
     body = _heredoc_bytes(cmd)
     cmds = _shell_commands("".join(" " if b and ch != "\n" else ch
                                    for ch, b in zip(cmd, body)))
@@ -3039,6 +3272,9 @@ def status_hidden(cmd, cwd=None):
         if not (verify_command(line) or any(
                 mode == "check" for _n, mode in _repo_check_runs(line, prefixes))):
             continue
+        if any(w[:1] == ["exit"] or w[:1] == ["exec"] and len(w) > 1
+               for w, _s in cmds[:i]):
+            return True
         for k in range(i, len(cmds) - 1):
             if OWNING_SEP.match(cmds[k][1]):
                 continue
@@ -4042,7 +4278,9 @@ def ran_nothing(result):
 # pre-existing or environmental still reads as a claim: it names no conflict.
 # `claims` is the false-done reader the benchmarks count with; the Stop verdict
 # and its claim row read the vocabulary (`asserted_claims`), where an admitted
-# claim is a claim NEGATED lets through.
+# claim is a claim NEGATED lets through. Both read a claim word through the
+# same question/negation window (`_asserted`): "I have not fixed it yet" is no
+# completion, like its twin "henüz düzeltmedim" (B-052).
 ADMITTED = re.compile(alts("admitted"), re.I)
 
 
@@ -4051,7 +4289,7 @@ def claims(text):
     t = str(text or "")
     if NEGATED.search(t) or ADMITTED.search(t):
         return (False, False)
-    return (bool(DONE.search(t)), bool(VERIFIED.search(t)))
+    return asserted_claims(t)
 
 
 # The question/negation window around a claim word (R04 i, evidence-10): "is
@@ -4064,8 +4302,14 @@ def claims(text):
 # all still assert.
 NEGATION_BEFORE = re.compile(r"(?:%s)(?:\s+\S+){0,2}\s+\Z" % alts("negation_before"),
                              re.I)
+# "if/when the tests pass" makes a completion conditional, but "when I ran the
+# tests" still reports the run: the condition window is read for DONE only
+# (review 150 R2-2).
+CONDITION_BEFORE = re.compile(r"(?:%s)(?:\s+\S+){0,2}\s+\Z" % alts("condition_before"),
+                              re.I)
 QUESTION_PARTICLE = re.compile(r"\s*(?:%s)\b" % alts("question_particle"), re.I)
-CLAUSE_END = re.compile(r"[.!?\n,;:\u2014\u2013()]|\b(?:%s)\b" % alts("clause_join"),
+# a `.` inside a number ("Python 3.12") ends no clause (review 150 F3)
+CLAUSE_END = re.compile(r"\.(?!\d)|[!?\n,;:\u2014\u2013()]|\b(?:%s)\b" % alts("clause_join"),
                         re.I)
 # The first-person claim that a command or a check was run ("test ettim", "i
 # ran the suite"): the one claim a read-only turn cannot have earned, read by
@@ -4074,17 +4318,21 @@ CLAUSE_END = re.compile(r"[.!?\n,;:\u2014\u2013()]|\b(?:%s)\b" % alts("clause_jo
 RAN_IT = re.compile(alts("ask", "ran_it"), re.I)
 
 
-def _asserted(pattern, text):
+def _asserted(pattern, text, within=None):
     """The first match of `pattern` in `text` that is neither inside a question
-    nor under a negation of its own clause, else None. ponytail: a window of
-    words, not a parser."""
+    nor under a negation of its own clause, else None; with `within`, only a
+    match whose own text holds it counts. ponytail: a window of words, not a
+    parser."""
     t = str(text or "")
     for m in pattern.finditer(t):
+        if within and not within.search(m.group(0)):
+            continue
         before = CLAUSE_END.split(t[max(0, m.start() - 80):m.start()])[-1]
         end = CLAUSE_END.search(t, m.end())
         asked = (QUESTION_PARTICLE.match(t, m.end())
                  or (end and end.group(0) == "?"))
-        if not (NEGATION_BEFORE.search(before) or asked):
+        if not (NEGATION_BEFORE.search(before) or asked
+                or (pattern is DONE and CONDITION_BEFORE.search(before))):
             return m
     return None
 
@@ -4328,16 +4576,33 @@ def _ui_write(row):
     counts the row as a change. The kind test above is what the two agree on; the
     target of a command longer than the cut is this reader's to lose, and
     recovering it would mean walking the snapshot rows by call id for a path the
-    command already carried."""
+    command already carried.
+
+    The first UI target is the answer; `_ui_writes` has the rest."""
+    found = _ui_writes(row)
+    return found[0] if found else None
+
+
+def _ui_writes(row):
+    """Every UI source this row wrote, first one first: a shell line can redirect
+    into several files (`echo a > app.css; echo b > components/Button.tsx`), and
+    the gate's `write_paths` names the first target only. The rest come from
+    `tezgah_gate.shell_targets`, the gate's own per-target reader, so this is
+    still not a second shell parser. Before plan 144's review only the first
+    target was read: a UI source written after a non-UI one owed no proof at
+    all, and a component written after a screen owed no design check."""
     if not _change_row(row):
-        return None
+        return []
     detail = str(row.get("detail") or "")
     if row.get("kind") != "run":
-        return detail if UI_PATH.search(detail) else None
-    for target in _written_paths({"command": detail}):
-        if UI_PATH.search(str(target)):
-            return str(target)
-    return None
+        return [detail] if UI_PATH.search(detail) else []
+    targets = [str(t) for t in _written_paths({"command": detail})]
+    try:
+        from tezgah_gate import shell_targets
+        targets += [str(t) for t in shell_targets(detail)]
+    except ImportError:
+        pass
+    return [t for t in dict.fromkeys(targets) if UI_PATH.search(t)]
 
 
 def _screen_read(row):
@@ -4442,7 +4707,7 @@ def _design_evidence(rows, cwd=None):
     component, check = -1, -1
     for i, row in enumerate(rows):
         detail = mask(str(row.get("detail") or ""))
-        if _ui_write(row) and DESIGN_COMPONENT.search(detail):
+        if any(DESIGN_COMPONENT.search(p) for p in _ui_writes(row)):
             component = i
         if passing_check(row) and DESIGN_CHECK.search(detail):
             if DESIGN_SLOP.search(detail) and not _slop_row_holds(row, cwd):
@@ -4979,9 +5244,12 @@ def stop_reason(text, session_id, cwd=None, after_block=0,
         kind, reason = "subagent_end" if subagent else "after_block", None
     elif reason:
         # an external-state claim is a claim when it is refused: the class it
-        # owes (`no external read`) is about the claim, not the turn's work
+        # owes (`no external read`) is about the claim, not the turn's work;
+        # so is a plan claim, whose trigger is the run claim (RAN_IT), not
+        # DONE/VERIFIED - "çalıştırdım" is in neither (B-073)
         detail = "blocked: %s" % cls
-        kind = ("claim" if claimed or _external_claim(str(text or ""))
+        kind = ("claim" if claimed or cls == "plan claim"
+                or _external_claim(str(text or ""))
                 else "refusal")
     elif claimed:
         detail, kind = "ok", "claim"
@@ -5530,9 +5798,11 @@ def _stop_block(text, session_id, rows=None, cwd=None, shape=True, fold=None,
     # failure at all (the row carries no `exit`).
     # A prose edit (`_prose_edit`) is no step a check is owed for - unless the
     # reply says something was tested or checked, a claim that rests on a pass.
+    # The claim is read through the question/negation window, as in a turn
+    # with no step: "Testler geçti mi?" names a pass without claiming it (B-032).
     worked = {str(r.get("kind")) for r in rows if _work_row(r)}
     if not worked and any(_prose_edit(r) for r in rows) and (
-            verified or any(TESTED_WORD.search(m.group(0)) for m in DONE.finditer(t))):
+            _asserted(VERIFIED, t) or _asserted(DONE, t, TESTED_WORD)):
         worked = {"edit"}
     # A turn whose steps are only reads - every simple command a known reader
     # or a git read (`_bookkeeping_turn` with GIT_READS), no change row - is
@@ -5664,7 +5934,7 @@ def _evidence_text(cls, rows, external, where="this turn"):
     `where` names the span the rows cover."""
     if cls == "check failed":
         return ("check failed",
-                "A check failed in %s and the reply claims success. "
+                "A check failed in %s and no check ran after it. "
                 "Report the failure with its exact error line, or fix it and "
                 "re-run; do not describe a failed check as passing. %s."
                 % (where, ADMISSION))