@sema-agent/core 7.17.4 → 7.17.6

package/dist/tools/fs/bash-readonly-classifier.js

@@ -109,7 +109,7 @@ export function splitShellCompoundSegments(source, options) {
     }
     const scanned = options?.trailingTerminator !== "keep" ? source.replace(/;\s*$/, "") : source;
     const segments = [];
-    const pipeFed = [false];
+    const connectors = ["start"];
     const mask = quoteMask(scanned);
     const quoted = (i) => mask.balanced && mask.quoted[i] === true;
     let cur = "";
@@ -122,7 +122,7 @@ export function splitShellCompoundSegments(source, options) {
             if (scanned[i + 1] === "&") {
                 segments.push(cur);
                 cur = "";
-                pipeFed.push(false);
+                connectors.push("&&");
                 i++;
             }
             else
@@ -132,25 +132,25 @@ export function splitShellCompoundSegments(source, options) {
             if (scanned[i + 1] === "|") {
                 segments.push(cur);
                 cur = "";
-                pipeFed.push(false);
+                connectors.push("||");
                 i++;
             }
             else {
                 segments.push(cur);
                 cur = "";
-                pipeFed.push(true);
+                connectors.push("|");
             }
         }
         else if (c === ";") {
             segments.push(cur);
             cur = "";
-            pipeFed.push(false);
+            connectors.push(";");
         }
         else
             cur += c;
     }
     segments.push(cur);
-    return { segments, pipeFed };
+    return { segments, pipeFed: connectors.map((k) => k === "|"), connectors };
 }
 const EXEMPT_REDIRECTION = /^(?:2>\/dev\/null|[12]?>&[12])$/;
 function stripExemptRedirections(command) {
@@ -214,6 +214,10 @@ function isPathShapedToken(tok) {
     return tok.includes("/") || tok.startsWith("~") || tok === "." || tok === "..";
 }
 export function resolveOperandLexically(base, operand, homeDir) {
+    return resolveOperandSpellings(base, operand, homeDir)?.folded;
+}
+const PARENT_SEGMENT_RE = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
+export function resolveOperandSpellings(base, operand, homeDir) {
     let raw = operand;
     if (raw === "~" || raw.startsWith("~/")) {
         if (homeDir === undefined || !isAbsolutePathForm(homeDir))
@@ -227,12 +231,16 @@ export function resolveOperandLexically(base, operand, homeDir) {
     if (!win32NamespaceScreen(raw, family).ok)
         return undefined;
     if (isAbsoluteForFamily(family, raw))
-        return normalizeAbsPathLexically(nativeUncSpellingOf(family, raw));
+        return spellingsOf(nativeUncSpellingOf(family, raw));
     if (base === undefined || family === undefined || !isAbsoluteForFamily(family, base))
         return undefined;
     if (isShellRootedSpellingUnmapped(family, raw))
         return undefined;
-    return normalizeAbsPathLexically(joinForFamily(family, base, raw));
+    return spellingsOf(joinForFamily(family, base, raw));
+}
+function spellingsOf(absolute) {
+    const folded = normalizeAbsPathLexically(absolute);
+    return PARENT_SEGMENT_RE.test(absolute) ? { folded, spelled: absolute } : { folded };
 }
 function reheadSegment(toks, head, from = 0) {
     return { folded: [head, ...toks.folded.slice(from + 1)], raw: [head, ...toks.raw.slice(from + 1)] };
@@ -259,7 +267,8 @@ function tokensMoveBase(toks, allow) {
     const unwrapped = unwrapLauncher(toks.folded.slice(from), allow);
     return unwrapped.kind === "refused" || (unwrapped.kind === "reader" && unwrapped.head === "cd");
 }
-const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi)?sh|eval|source|\.)$/;
+const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi)?sh|eval|source|\.|parallel)$/;
+const ARGV_REENTRY_PROGRAM_RE = /^xargs$/;
 export function refusedCommandMayRead(command, allow, boundary) {
     return !refusedCommandExempt(command, allow, boundary, 0);
 }
@@ -579,6 +588,8 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
             const unwrapped = unwrapLauncher(toks.slice(i).map(fold), allow);
             if (unwrapped.kind === "refused")
                 return false;
+            if (argvReentryUnjudged(unwrapped))
+                return false;
             if (unwrapped.kind === "unlisted") {
                 if (!unlistedSegmentJudgedInside(toks, i))
                     return false;
@@ -621,18 +632,50 @@ function refusedCommandExempt(command, allow, boundary, depth, baseMovedOutside
     return true;
 }
 function unwrapLauncher(folded, allow) {
+    let argvFromStdin = ARGV_REENTRY_PROGRAM_RE.test(programBasename(folded[0] ?? ""));
+    let lastReentry = argvFromStdin ? 0 : -1;
     for (let i = 1; i < folded.length; i++) {
         const t = folded[i];
-        if (ASSIGNMENT_WORD.test(t) || /^\d+[smhd]?$/.test(t) || COMMAND_LAUNCHERS.has(t))
+        if (ASSIGNMENT_WORD.test(t) || /^\d+[smhd]?$/.test(t))
+            continue;
+        const wordBasename = programBasename(t);
+        if (ARGV_REENTRY_PROGRAM_RE.test(wordBasename)) {
+            argvFromStdin = true;
+            lastReentry = i;
+            continue;
+        }
+        if (COMMAND_LAUNCHERS.has(wordBasename))
             continue;
         if (t.startsWith("-"))
             return { kind: "refused", reason: `"${folded[0]}" is given an option before the program it runs — which program runs is not readable without the launcher's option table ${NOT_AUTO_ALLOWED}` };
-        const head = t.includes("/") ? t.slice(t.lastIndexOf("/") + 1) : t;
+        const head = wordBasename;
         if (SHELL_CONTROL_PREFIXES.has(head) || SHELL_BLOCK_WORDS.has(head))
             return { kind: "refused", reason: `"${folded[0]}" is given shell control syntax ("${head}") where the program it runs would be ${NOT_AUTO_ALLOWED}` };
-        return allow.has(head) || head === "cd" ? { kind: "reader", index: i, head } : { kind: "unlisted", head };
+        return allow.has(head) || head === "cd" ? { kind: "reader", index: i, head, argvFromStdin } : { kind: "unlisted", head, index: i, argvFromStdin };
     }
-    return { kind: "unlisted" };
+    return { kind: "unlisted", argvFromStdin, runsDefaultProgram: lastReentry === folded.length - 1 };
+}
+const LAUNCHER_OPTION_GRAMMAR = new Map([
+    ["time", {
+            plain: new Set(["-p", "-a", "-v", "-q", "--portability", "--append", "--verbose", "--quiet", "--help", "--version"]),
+            valued: new Set(["-f", "-o", "--format", "--output"]),
+        }],
+]);
+function launcherOptionSpan(launcher, folded, i) {
+    const row = launcher === undefined ? undefined : LAUNCHER_OPTION_GRAMMAR.get(launcher);
+    const tok = folded[i];
+    if (row === undefined || tok === undefined)
+        return 0;
+    if (row.plain.has(tok))
+        return 1;
+    return row.valued.has(tok) && folded[i + 1] !== undefined ? 2 : 0;
+}
+const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
+function argvReentryUnjudged(unwrapped) {
+    if (!unwrapped.argvFromStdin)
+        return false;
+    const runs = unwrapped.head ?? (unwrapped.runsDefaultProgram === true ? ARGV_REENTRY_DEFAULT_PROGRAM : undefined);
+    return runs === undefined || !NO_PATH_OPERAND_COMMANDS.has(runs);
 }
 function tokenizeSegment(segment) {
     const raw = splitWordsQuoteAware(segment);
@@ -826,6 +869,305 @@ const SED_READONLY_FLAGS = new Set([
 ]);
 const SED_READONLY_CLUSTER_LETTERS = new Set(["n", "E", "r", "z"]);
 const SED_READONLY_SCRIPT_PIECE = /^(?:\d+|\d+,\d+)?p$/;
+const SED_FILE_OR_EXEC_COMMANDS = new Set(["r", "R", "w", "W", "e"]);
+const SED_PLAIN_COMMANDS = new Set(["=", "d", "D", "F", "g", "G", "h", "H", "n", "N", "p", "P", "x", "z"]);
+const SED_NUMERIC_COMMANDS = new Set(["q", "Q", "l", "L"]);
+const SED_LABEL_COMMANDS = new Set(["b", "t", "T", ":", "v"]);
+const SED_TEXT_COMMANDS = new Set(["a", "i", "c"]);
+const SED_SUBSTITUTE_FLAGS = /[gpiImM0-9]/;
+const SED_SCRIPT_LINE_LIMIT = 1024;
+function utf8Length(text) {
+    let bytes = 0;
+    for (const ch of text) {
+        const code = ch.codePointAt(0);
+        bytes += code < 0x80 ? 1 : code < 0x800 ? 2 : code < 0x10000 ? 3 : 4;
+    }
+    return bytes;
+}
+function readSedScript(script) {
+    if (script.split("\n").some((line) => utf8Length(line) >= SED_SCRIPT_LINE_LIMIT))
+        return "unseen";
+    let i = 0;
+    let depth = 0;
+    const len = script.length;
+    const isBlank = (ch) => ch === " " || ch === "\t" || ch === "\v" || ch === "\f";
+    const skipBlank = () => {
+        while (i < len && isBlank(script[i]))
+            i++;
+    };
+    const digits = () => {
+        while (i < len && script[i] >= "0" && script[i] <= "9")
+            i++;
+    };
+    const consumeDelimited = (delim, regex) => {
+        while (i < len) {
+            const ch = script[i];
+            if (ch === "\\") {
+                const escaped = script[i + 1];
+                if (escaped === undefined || escaped === "\n" || escaped === "\r")
+                    return false;
+                i += 2;
+                continue;
+            }
+            if (ch === "\n" || ch === "\r")
+                return false;
+            if (ch === delim) {
+                i++;
+                return true;
+            }
+            if (regex && ch === "[") {
+                i++;
+                if (script[i] === "^")
+                    i++;
+                if (script[i] === "]")
+                    i++;
+                while (i < len && script[i] !== "]" && script[i] !== "\n" && script[i] !== "\r") {
+                    const next = script[i + 1];
+                    if (script[i] === "[" && (next === ":" || next === "." || next === "=")) {
+                        const at = script.indexOf(`${next}]`, i + 2);
+                        if (at === -1 || script.slice(i, at).includes("\n"))
+                            return false;
+                        i = at + 2;
+                        continue;
+                    }
+                    i++;
+                }
+                if (i >= len || script[i] !== "]")
+                    return false;
+                i++;
+                continue;
+            }
+            i++;
+        }
+        return false;
+    };
+    const readAddress = () => {
+        const ch = script[i];
+        if (ch === undefined)
+            return undefined;
+        if (ch === "$") {
+            i++;
+            return true;
+        }
+        if (ch >= "0" && ch <= "9") {
+            digits();
+            if (script[i] === "~") {
+                i++;
+                digits();
+            }
+            return true;
+        }
+        if (ch === "/" || ch === "\\") {
+            const delim = ch === "/" ? "/" : script[i + 1];
+            i += ch === "/" ? 1 : 2;
+            if (delim === undefined || !consumeDelimited(delim, true))
+                return false;
+            while (i < len && (script[i] === "I" || script[i] === "M"))
+                i++;
+            return true;
+        }
+        return undefined;
+    };
+    while (i < len) {
+        const ch = script[i];
+        if (isBlank(ch) || ch === "\n" || ch === "\r" || ch === ";") {
+            i++;
+            continue;
+        }
+        if (ch === "#") {
+            while (i < len && script[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (ch === "}") {
+            if (depth === 0)
+                return "unparsed";
+            depth--;
+            i++;
+            continue;
+        }
+        const first = readAddress();
+        if (first === false)
+            return "unparsed";
+        if (first === true) {
+            skipBlank();
+            if (script[i] === ",") {
+                i++;
+                skipBlank();
+                if (script[i] === "+" || script[i] === "~") {
+                    i++;
+                    if (!(script[i] >= "0" && script[i] <= "9"))
+                        return "unparsed";
+                    digits();
+                }
+                else if (readAddress() !== true)
+                    return "unparsed";
+            }
+            skipBlank();
+        }
+        while (script[i] === "!") {
+            i++;
+            skipBlank();
+        }
+        const cmd = script[i];
+        if (cmd === undefined)
+            return "unparsed";
+        i++;
+        if (SED_FILE_OR_EXEC_COMMANDS.has(cmd))
+            return "names";
+        if (cmd === "{") {
+            depth++;
+            continue;
+        }
+        if (cmd === "s" || cmd === "y") {
+            const delim = script[i];
+            if (delim === undefined || delim === "\\" || delim === "\n")
+                return "unparsed";
+            i++;
+            if (!consumeDelimited(delim, cmd === "s"))
+                return "unparsed";
+            if (!consumeDelimited(delim, false))
+                return "unparsed";
+            if (cmd === "y")
+                continue;
+            while (i < len) {
+                const flag = script[i];
+                if (flag === "w" || flag === "W" || flag === "e")
+                    return "names";
+                if (SED_SUBSTITUTE_FLAGS.test(flag) || isBlank(flag)) {
+                    i++;
+                    continue;
+                }
+                if (flag === ";" || flag === "\n" || flag === "\r" || flag === "}" || flag === "#")
+                    break;
+                return "unparsed";
+            }
+            continue;
+        }
+        if (SED_TEXT_COMMANDS.has(cmd)) {
+            while (i < len && script[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (SED_LABEL_COMMANDS.has(cmd)) {
+            skipBlank();
+            while (i < len && script[i] !== "\n" && script[i] !== ";" && script[i] !== "}" && !isBlank(script[i]))
+                i++;
+            continue;
+        }
+        if (SED_NUMERIC_COMMANDS.has(cmd)) {
+            skipBlank();
+            digits();
+            continue;
+        }
+        if (!SED_PLAIN_COMMANDS.has(cmd))
+            return "unparsed";
+    }
+    return depth === 0 ? "clean" : "unparsed";
+}
+const SED_OPTION_DIALECTS = [
+    { separated: "efl", suffix: "iI", stopsAtFirstOperand: false },
+    { separated: "ef", suffix: "iI", stopsAtFirstOperand: true },
+];
+function sedSeparatedSuffixTaken(tok) {
+    return tok !== undefined && (tok === "" || tok.startsWith("."));
+}
+const SED_LONG_VALUE_OPTIONS = ["expression", "line-length"];
+const SED_LONG_PLAIN_OPTIONS = [
+    "debug", "follow-symlinks", "help", "in-place", "null-data", "posix", "quiet", "regexp-extended",
+    "sandbox", "separate", "silent", "unbuffered", "version", "zero-terminated",
+];
+function readSedInvocation(args, dialect) {
+    const scripts = [];
+    let scriptSupplied = false;
+    let endOfOptions = false;
+    let firstOperand;
+    for (let k = 0; k < args.length; k++) {
+        const tok = args[k];
+        if (!endOfOptions && tok === "--") {
+            endOfOptions = true;
+            continue;
+        }
+        if (endOfOptions || !tok.startsWith("-") || tok === "-") {
+            if (firstOperand === undefined) {
+                firstOperand = tok;
+                if (dialect.stopsAtFirstOperand)
+                    endOfOptions = true;
+            }
+            continue;
+        }
+        if (tok.startsWith("--")) {
+            const long = longOptionNameOf(tok);
+            if (long === undefined)
+                return "unparsed";
+            const eq = tok.indexOf("=");
+            const attached = eq >= 0 ? tok.slice(eq + 1) : undefined;
+            if (isLongOptionAbbrevOf(long, "file"))
+                return "unseen";
+            if (isLongOptionAbbrevOf(long, "expression")) {
+                const value = attached ?? args[++k];
+                if (value === undefined)
+                    return "unparsed";
+                scripts.push(value);
+                scriptSupplied = true;
+                continue;
+            }
+            if (SED_LONG_VALUE_OPTIONS.some((full) => isLongOptionAbbrevOf(long, full))) {
+                if (attached === undefined)
+                    k++;
+                continue;
+            }
+            if (SED_LONG_PLAIN_OPTIONS.some((full) => isLongOptionAbbrevOf(long, full)))
+                continue;
+            return "unparsed";
+        }
+        for (let c = 1; c < tok.length; c++) {
+            const letter = tok[c];
+            if (dialect.suffix.includes(letter)) {
+                if (c + 1 === tok.length && sedSeparatedSuffixTaken(args[k + 1]))
+                    k++;
+                break;
+            }
+            if (dialect.separated.includes(letter)) {
+                const rest = tok.slice(c + 1);
+                const value = rest !== "" ? rest : args[++k];
+                if (letter === "f")
+                    return "unseen";
+                if (letter === "e") {
+                    if (value === undefined)
+                        return "unparsed";
+                    scripts.push(value);
+                    scriptSupplied = true;
+                }
+                break;
+            }
+            if (!SED_SHORT_PLAIN_LETTERS.includes(letter))
+                return "unparsed";
+        }
+    }
+    const script = scriptSupplied ? scripts.join("\n") : firstOperand;
+    if (script === undefined)
+        return "clean";
+    return readSedScript(script);
+}
+const SED_SHORT_PLAIN_LETTERS = "nsuzEraHl";
+const SCRIPT_SLOT_VERBS = new Map([
+    ["sed", (args) => {
+            const readings = SED_OPTION_DIALECTS.map((dialect) => readSedInvocation(args, dialect));
+            if (readings.includes("names") || readings.includes("unseen"))
+                return true;
+            return readings.every((reading) => reading === "unparsed");
+        }],
+]);
+function unjudgedProgramTextRefusal(written, clause) {
+    return `command "${written}" ${clause}, which this walk does not judge ${NOT_AUTO_ALLOWED}`;
+}
+function scriptSlotRefusal(written, name, args) {
+    const recognizer = SCRIPT_SLOT_VERBS.get(name);
+    if (recognizer === undefined || !recognizer(args))
+        return undefined;
+    return unjudgedProgramTextRefusal(written, "names files or runs commands inside its script text");
+}
 function guardedVerbFormReason(name, toks, raw) {
     if (name === "find") {
         for (const t of toks) {
@@ -1110,12 +1452,12 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
     for (let k = 0; k < args.length; k++) {
         if (!argGlobs(k) || expandingArgs.has(k))
             continue;
-        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], args[k], boundary.homeDir);
-        findings.push({ kind: "undecided", path: resolved ?? args[k] });
+        const r = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], args[k], boundary.homeDir);
+        findings.push({ kind: "undecided", path: r?.folded ?? args[k], ...(r?.spelled !== undefined ? { spelled: r.spelled } : {}) });
     }
     for (const { text: candidate, globbed } of candidates) {
-        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], candidate, boundary.homeDir);
-        if (resolved === undefined) {
+        const spellings = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], candidate, boundary.homeDir);
+        if (spellings === undefined) {
             findings.push({
                 kind: "unresolvable",
                 operand: candidate,
@@ -1123,19 +1465,20 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
             });
             continue;
         }
+        const resolved = spellings.folded;
         if (withinAnyRoot(boundary.roots, resolved)) {
             if (!globbed)
-                findings.push({ kind: "inside", path: resolved });
+                findings.push({ kind: "inside", path: resolved, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
         }
         else
-            findings.push({ kind: "outside", command: name, path: resolved });
+            findings.push({ kind: "outside", command: name, path: resolved, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
     }
     for (const { text: operand, globbed } of bareWordOperands) {
-        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], operand, boundary.homeDir);
-        if (resolved === undefined)
+        const spellings = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], operand, boundary.homeDir);
+        if (spellings === undefined)
             continue;
-        if (!globbed && withinAnyRoot(boundary.roots, resolved))
-            findings.push({ kind: "inside", path: resolved });
+        if (!globbed && withinAnyRoot(boundary.roots, spellings.folded))
+            findings.push({ kind: "inside", path: spellings.folded, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
     }
     if (boundary.denyMatch !== undefined && segmentSelectsRecursiveRead(name, args)) {
         const roots = positionalOperands.length > 0 ? positionalOperands : stdinOperand ? [] : ["."];
@@ -1208,7 +1551,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
     const split = segmentCompoundForReadonly(command, boundary?.homeDir);
     if ("reject" in split)
         return { reason: split.reject, refusedWhole: true };
-    const { segments, pipeFed } = split;
+    const { segments, pipeFed, connectors } = split;
     let nameRefusal;
     const unlistedSegments = new Set();
     const reheaded = new Map();
@@ -1216,11 +1559,17 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         const toks = tokenizeSegment(segments[si]);
         const folded = toks.folded;
         let from = 0;
-        while (from < folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES))
+        while (from < folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES)) {
+            const controlWord = programBasename(folded[from] ?? "");
             from++;
+            for (let span = launcherOptionSpan(controlWord, folded, from); span > 0; span = launcherOptionSpan(controlWord, folded, from))
+                from += span;
+        }
         const written = folded[from];
         if (written === undefined)
             return { reason: "empty command" };
+        if (written === "coproc")
+            return { reason: "`coproc` backgrounds a command — a backgrounded process outlives the command", refusedWhole: true };
         if (isBareControlWord(toks, from, SHELL_BLOCK_WORDS)) {
             unlistedSegments.add(si);
             nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
@@ -1233,6 +1582,18 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         const name = pathPrefixed ? parsed.name.slice(parsed.name.lastIndexOf("/") + 1) : parsed.name;
         if (pathPrefixed)
             nameRefusal ??= "the command must be a bare name resolved via PATH (no path prefix)";
+        if (name.startsWith("-") && name !== "-") {
+            return { reason: `"${folded[0]}" is given an option where the program it runs would be — which program runs is not readable without its option table ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+        }
+        const launcherUnwrap = COMMAND_LAUNCHERS.has(name) ? unwrapLauncher(folded.slice(from), allow) : undefined;
+        if (launcherUnwrap?.kind === "refused")
+            return { reason: launcherUnwrap.reason, refusedWhole: true };
+        const runs = launcherUnwrap === undefined ? { head: name, index: 0 } : { head: launcherUnwrap.head, index: launcherUnwrap.index };
+        if (runs?.head !== undefined && runs.index !== undefined) {
+            const slotRefusal = scriptSlotRefusal(runs.head, runs.head, folded.slice(from + runs.index + 1));
+            if (slotRefusal !== undefined)
+                return { reason: slotRefusal, refusedWhole: true };
+        }
         if (allow.has(name)) {
             if (pathPrefixed || from > 0)
                 reheaded.set(si, { from, head: name });
@@ -1242,14 +1603,17 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         }
         nameRefusal ??= `command "${parsed.name}" is not in the read-only allowlist`;
         if (SHELL_REENTRY_PROGRAM_RE.test(name))
-            return { reason: `command "${parsed.name}" runs its argument as shell text, which this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+            return { reason: unjudgedProgramTextRefusal(parsed.name, "runs its argument as shell text"), refusedWhole: true };
         if (COMMAND_LAUNCHERS.has(name)) {
-            const unwrapped = unwrapLauncher(folded.slice(from), allow);
+            const unwrapped = launcherUnwrap ?? unwrapLauncher(folded.slice(from), allow);
             if (unwrapped.kind === "refused")
                 return { reason: unwrapped.reason, refusedWhole: true };
             if (unwrapped.kind === "unlisted" && unwrapped.head !== undefined && SHELL_REENTRY_PROGRAM_RE.test(unwrapped.head)) {
                 return { reason: `"${written}" runs "${unwrapped.head}", which runs its argument as shell text this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
             }
+            if (argvReentryUnjudged(unwrapped)) {
+                return { reason: `"${written}" takes the operands of the program it runs from its standard input, which this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+            }
             if (unwrapped.kind === "unlisted")
                 unlistedSegments.add(si);
             else
@@ -1288,13 +1652,29 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
     };
     const STDIN_FILE_FLOOR = { cat: 1, grep: 2, head: 1, tail: 1, wc: 1, cut: 1, tr: Infinity, diff: 2, cmp: 2, comm: 2, sed: 2 };
     const foldedSegments = [];
+    const foldedReach = [];
+    let crossedAllAnd = true;
+    let crossedAnyOr = false;
     let shapeRefusal = nameRefusal;
     for (let si = 0; si < segments.length; si++) {
+        if (si > 0) {
+            if (connectors[si] !== "&&")
+                crossedAllAnd = false;
+            if (connectors[si] === "||")
+                crossedAnyOr = true;
+        }
+        const moveProvable = pipeFed[si] !== true && pipeFed[si + 1] !== true && reheaded.get(si) === undefined;
+        const pushReach = () => {
+            foldedReach.push({ andJoined: si > 0 && crossedAllAnd, orBroken: !crossedAllAnd && crossedAnyOr, moveProvable });
+            crossedAllAnd = true;
+            crossedAnyOr = false;
+        };
         if (unlistedSegments.has(si)) {
             const unlisted = tokenizeSegment(segments[si]);
             if (unlisted.folded.length === 0)
                 continue;
             foldedSegments.push({ folded: [LAUNCHER_SCAN_HEAD, ...unlisted.folded], raw: [LAUNCHER_SCAN_HEAD, ...unlisted.raw] });
+            pushReach();
             continue;
         }
         const rehead = reheaded.get(si);
@@ -1303,6 +1683,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         if (toks.length === 0)
             continue;
         foldedSegments.push(segmentTokens);
+        pushReach();
         const name = toks[0];
         const guardReason = guardedVerbFormReason(name, toks, segmentTokens.raw);
         if (guardReason !== undefined) {
@@ -1383,7 +1764,7 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
             shapeRefusal ??= `multiple directory changes in one command require approval for clarity ${NOT_AUTO_ALLOWED}`;
     }
     if (boundary !== undefined) {
-        const walk = evaluateReadBoundary(foldedSegments, boundary);
+        const walk = evaluateReadBoundary(foldedSegments, boundary, foldedReach);
         if (shapeRefusal === undefined)
             return walk;
         const { reason: _walkSentence, ...structure } = walk;
@@ -1396,90 +1777,171 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
     }
     return {};
 }
-function evaluateReadBoundary(foldedSegments, boundary) {
+const BASE_CANDIDATE_MAX = 256;
+function evaluateReadBoundary(foldedSegments, boundary, reach) {
+    const seen = { outside: new Set(), inside: new Set(), undecided: new Set(), recursive: new Set(), unresolved: new Set(), checkedSpelled: new Set(), undecidedSpelled: new Set(), outsideSpelled: new Set() };
     const outside = [];
     const inside = [];
     let unresolvable;
     const unresolved = [];
     let baseLost = false;
     const undecided = [];
+    const checkedSpellings = [];
+    const undecidedSpellings = [];
+    const outOfRootSpellings = [];
+    const recordSpelling = (into, seenHere, finding) => {
+        if (finding.spelled === undefined || seenHere.has(finding.spelled))
+            return;
+        seenHere.add(finding.spelled);
+        into.push(finding.spelled);
+    };
     const recursive = [];
-    let currentBase = boundary.cwd ?? boundary.roots[0];
-    for (const toks of foldedSegments) {
+    let candidates = [{ base: boundary.cwd ?? boundary.roots[0], skippedCd: -1 }];
+    let andRunStart = 0;
+    const findingsByWords = new Map();
+    const findingsRowFor = (wordsKey) => {
+        const row = findingsByWords.get(wordsKey);
+        if (row !== undefined)
+            return row;
+        const fresh = new Map();
+        findingsByWords.set(wordsKey, fresh);
+        return fresh;
+    };
+    const findingsFor = (row, toks, base) => {
+        const hit = row.get(base);
+        if (hit !== undefined)
+            return hit;
+        const segBoundary = base === (boundary.cwd ?? boundary.roots[0]) ? boundary : { ...boundary, cwd: base };
+        const computed = collectSegmentBoundaryFindings(toks, segBoundary);
+        row.set(base, computed);
+        return computed;
+    };
+    for (let si = 0; si < foldedSegments.length; si++) {
+        const toks = foldedSegments[si];
         if (baseLost)
             break;
-        const segBoundary = currentBase === (boundary.cwd ?? boundary.roots[0]) ? boundary : { ...boundary, cwd: currentBase };
-        for (const finding of collectSegmentBoundaryFindings(toks, segBoundary)) {
-            if (finding.kind === "unresolvable") {
-                unresolvable ??= finding.reason;
-                if (!unresolved.includes(finding.operand))
-                    unresolved.push(finding.operand);
-                if (toks.folded[0] === "cd")
-                    baseLost = true;
-                continue;
-            }
-            const denied = boundary.denyMatch?.(finding.path);
-            if (denied != null) {
-                return {
-                    reason: `a command operand resolves to "${finding.path}", which matches the sensitive-path read deny list (pattern "${denied}") ${NOT_AUTO_ALLOWED}`,
-                    readDenied: true,
-                };
-            }
-            if (finding.kind === "inside") {
-                if (!inside.includes(finding.path))
-                    inside.push(finding.path);
-                continue;
-            }
-            if (finding.kind === "undecided") {
-                if (!undecided.includes(finding.path))
-                    undecided.push(finding.path);
-                continue;
-            }
-            if (finding.kind === "recursive") {
-                if (!recursive.includes(finding.path))
-                    recursive.push(finding.path);
-                continue;
-            }
-            if (boundary.face === "open") {
-                if (!inside.includes(finding.path))
-                    inside.push(finding.path);
-                continue;
+        if (si > 0 && reach?.[si]?.andJoined !== true)
+            andRunStart = reach?.[si]?.orBroken === true ? si + 1 : si;
+        const reachable = candidates.filter((c) => c.skippedCd < andRunStart);
+        const row = findingsRowFor(JSON.stringify([toks.folded, toks.raw]));
+        for (const { base: currentBase } of reachable) {
+            for (const finding of findingsFor(row, toks, currentBase)) {
+                if (finding.kind === "unresolvable") {
+                    unresolvable ??= finding.reason;
+                    if (!seen.unresolved.has(finding.operand)) {
+                        seen.unresolved.add(finding.operand);
+                        unresolved.push(finding.operand);
+                    }
+                    if (toks.folded[0] === "cd")
+                        baseLost = true;
+                    continue;
+                }
+                const denied = boundary.denyMatch?.(finding.path);
+                if (denied != null) {
+                    return {
+                        reason: `a command operand resolves to "${finding.path}", which matches the sensitive-path read deny list (pattern "${denied}") ${NOT_AUTO_ALLOWED}`,
+                        readDenied: true,
+                    };
+                }
+                if (finding.kind === "inside") {
+                    if (!seen.inside.has(finding.path)) {
+                        seen.inside.add(finding.path);
+                        inside.push(finding.path);
+                    }
+                    recordSpelling(checkedSpellings, seen.checkedSpelled, finding);
+                    continue;
+                }
+                if (finding.kind === "undecided") {
+                    if (!seen.undecided.has(finding.path)) {
+                        seen.undecided.add(finding.path);
+                        undecided.push(finding.path);
+                    }
+                    recordSpelling(undecidedSpellings, seen.undecidedSpelled, finding);
+                    continue;
+                }
+                if (finding.kind === "recursive") {
+                    if (!seen.recursive.has(finding.path)) {
+                        seen.recursive.add(finding.path);
+                        recursive.push(finding.path);
+                    }
+                    continue;
+                }
+                if (boundary.face === "open") {
+                    if (!seen.inside.has(finding.path)) {
+                        seen.inside.add(finding.path);
+                        inside.push(finding.path);
+                    }
+                    continue;
+                }
+                if (!seen.outside.has(finding.path)) {
+                    seen.outside.add(finding.path);
+                    outside.push(finding);
+                }
+                recordSpelling(outOfRootSpellings, seen.outsideSpelled, finding);
             }
-            if (!outside.some((o) => o.path === finding.path))
-                outside.push(finding);
         }
         if (!baseLost && toks.folded[0] === "cd") {
             const cdArgs = toks.folded.slice(1);
             const cdTargetIdx = cdArgs.findIndex((t) => !t.startsWith("-") || t === "-");
             const cdTarget = cdTargetIdx === -1 ? undefined : cdArgs[cdTargetIdx];
             if (cdTarget !== undefined && cdTarget !== "-") {
-                currentBase = resolveOperandLexically(currentBase, cdTarget, boundary.homeDir) ?? currentBase;
+                const provable = reach?.[si]?.moveProvable === true;
+                const branched = [];
+                for (const c of candidates) {
+                    if (c.skippedCd < andRunStart)
+                        branched.push({ base: resolveOperandLexically(c.base, cdTarget, boundary.homeDir) ?? c.base, skippedCd: c.skippedCd });
+                    branched.push({ base: c.base, skippedCd: provable ? si : c.skippedCd });
+                }
+                const byBase = new Map();
+                for (const c of branched) {
+                    const prior = byBase.get(c.base);
+                    if (prior === undefined || c.skippedCd < prior.skippedCd)
+                        byBase.set(c.base, c);
+                }
+                const next = [...byBase.values()];
+                if (next.length > BASE_CANDIDATE_MAX) {
+                    unresolvable ??= `too many directory changes to track where "${cdTarget}" leaves the working directory ${NOT_AUTO_ALLOWED}`;
+                    if (!seen.unresolved.has(cdTarget)) {
+                        seen.unresolved.add(cdTarget);
+                        unresolved.push(cdTarget);
+                    }
+                    baseLost = true;
+                }
+                else
+                    candidates = next;
             }
         }
     }
-    const undecidedAll = [...undecided, ...recursive.filter((p) => !undecided.includes(p))];
+    const undecidedAll = [...undecided, ...recursive.filter((p) => !seen.undecided.has(p))];
     const undecidedField = {
         ...(undecidedAll.length > 0 ? { undecidedPaths: undecidedAll } : {}),
         ...(recursive.length > 0 ? { recursiveReadPaths: recursive } : {}),
+        ...(undecidedSpellings.length > 0 ? { undecidedSpellings } : {}),
     };
+    const checkedField = {
+        ...(inside.length > 0 ? { checkedPaths: inside } : {}),
+        ...(checkedSpellings.length > 0 ? { checkedSpellings } : {}),
+    };
+    const outsideField = outOfRootSpellings.length > 0 ? { outOfRootSpellings } : {};
     if (unresolvable !== undefined) {
         return {
             reason: unresolvable,
             unresolvedOperands: unresolved,
-            ...(outside.length > 0 ? { outOfRootRead: true, outOfRootPaths: outside.map((o) => o.path) } : {}),
-            ...(inside.length > 0 ? { checkedPaths: inside } : {}),
+            ...(outside.length > 0 ? { outOfRootRead: true, outOfRootPaths: outside.map((o) => o.path), ...outsideField } : {}),
+            ...checkedField,
             ...undecidedField,
         };
     }
     if (outside.length === 0)
-        return inside.length > 0 ? { checkedPaths: inside, ...undecidedField } : { ...undecidedField };
+        return { ...checkedField, ...undecidedField };
     const paths = outside.map((o) => `"${o.path}"`).join(", ");
     const allowed = boundary.roots.length > 0 ? boundary.roots.join(", ") : "(none)";
     return {
         reason: `"${outside[0].command}" reads ${paths}, outside the allowed directories for this session: ${allowed} ${NOT_AUTO_ALLOWED}`,
         outOfRootRead: true,
         outOfRootPaths: outside.map((o) => o.path),
-        ...(inside.length > 0 ? { checkedPaths: inside } : {}),
+        ...outsideField,
+        ...checkedField,
         ...undecidedField,
     };
 }
@@ -1487,6 +1949,19 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
     const toks = tokenizeSegment(command);
     if (toks.folded.length === 0)
         return {};
+    const head = programBasename(toks.folded[0]);
+    let past = 0;
+    for (let span = launcherOptionSpan(head, toks.folded, past + 1); span > 0; span = launcherOptionSpan(head, toks.folded, past + 1))
+        past += span;
+    const chain = past === 0 ? toks.folded : [toks.folded[0], ...toks.folded.slice(past + 1)];
+    const runs = COMMAND_LAUNCHERS.has(head) ? unwrapLauncher(chain, new Set()) : { kind: "reader", head, index: 0 };
+    if (runs.kind === "refused")
+        return { reason: runs.reason, refusedWhole: true };
+    if (runs.head !== undefined && runs.index !== undefined) {
+        const slotRefusal = scriptSlotRefusal(runs.head, runs.head, toks.folded.slice(runs.index + past + 1));
+        if (slotRefusal !== undefined)
+            return { reason: slotRefusal, refusedWhole: true };
+    }
     return evaluateReadBoundary([toks], boundary);
 }
 const NOT_GATED = { gated: false, paths: [] };
@@ -1504,7 +1979,7 @@ const COMMAND_LAUNCHERS = new Set([
     "env", "command", "builtin", "exec", "noglob", "xargs",
     "sudo", "doas", "pkexec", "su", "runuser", "chroot", "setpriv",
     "nohup", "nice", "ionice", "chrt", "taskset", "stdbuf", "timeout", "time", "watch",
-    "setsid", "flock", "unshare", "nsenter", "script", "numactl", "prlimit", "systemd-run", "parallel",
+    "setsid", "flock", "unshare", "nsenter", "script", "numactl", "prlimit", "systemd-run",
     "strace", "ltrace", "valgrind", "firejail", "bwrap",
 ]);
 export const COMMAND_LAUNCHERS_FOR_TEST = COMMAND_LAUNCHERS;
@@ -1524,8 +1999,25 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
         if ("reject" in split)
             return NOT_GATED;
         const readers = [];
+        const readerReach = [];
+        let crossedAllAnd = true;
+        let crossedAnyOr = false;
         let baseMoved = false;
-        for (const segment of split.segments) {
+        for (let si = 0; si < split.segments.length; si++) {
+            const segment = split.segments[si];
+            if (si > 0) {
+                if (split.connectors[si] !== "&&")
+                    crossedAllAnd = false;
+                if (split.connectors[si] === "||")
+                    crossedAnyOr = true;
+            }
+            const moveProvable = split.pipeFed[si] !== true && split.pipeFed[si + 1] !== true;
+            const pushReader = (st) => {
+                readers.push(st);
+                readerReach.push({ andJoined: si > 0 && crossedAllAnd, orBroken: !crossedAllAnd && crossedAnyOr, moveProvable });
+                crossedAllAnd = true;
+                crossedAnyOr = false;
+            };
             const toks = tokenizeSegment(segment);
             if (toks.folded.length === 0)
                 continue;
@@ -1539,16 +2031,16 @@ export function classifyOutOfRootReadGate(command, allow, boundary) {
             if (UNMODELLED_BASE_MOVERS.has(name))
                 baseMoved = true;
             if (!allow.has(name) && name !== "cd") {
-                readers.push({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded.slice(i)], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw.slice(i)] });
+                pushReader({ folded: [LAUNCHER_SCAN_HEAD, ...toks.folded.slice(i)], raw: [LAUNCHER_SCAN_HEAD, ...toks.raw.slice(i)] });
                 continue;
             }
-            readers.push(i === 0 && name === written ? toks : { folded: [name, ...toks.folded.slice(i + 1)], raw: [toks.raw[i] ?? name, ...toks.raw.slice(i + 1)] });
+            pushReader(i === 0 && name === written ? toks : { folded: [name, ...toks.folded.slice(i + 1)], raw: [toks.raw[i] ?? name, ...toks.raw.slice(i + 1)] });
         }
         if (readers.length === 0)
             return NOT_GATED;
         if (baseMoved)
             return { gated: true, paths: [] };
-        const verdict = evaluateReadBoundary(readers, containmentOnly);
+        const verdict = evaluateReadBoundary(readers, containmentOnly, readerReach);
         return verdict.outOfRootRead === true ? { gated: true, paths: verdict.outOfRootPaths ?? [] } : NOT_GATED;
     };
     const direct = judge(command);