@sema-agent/core 7.17.5 → 7.17.6

package/dist/tools/fs/bash-readonly-classifier.js

@@ -214,6 +214,10 @@ function isPathShapedToken(tok) {
     return tok.includes("/") || tok.startsWith("~") || tok === "." || tok === "..";
 }
 export function resolveOperandLexically(base, operand, homeDir) {
+    return resolveOperandSpellings(base, operand, homeDir)?.folded;
+}
+const PARENT_SEGMENT_RE = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
+export function resolveOperandSpellings(base, operand, homeDir) {
     let raw = operand;
     if (raw === "~" || raw.startsWith("~/")) {
         if (homeDir === undefined || !isAbsolutePathForm(homeDir))
@@ -227,12 +231,16 @@ export function resolveOperandLexically(base, operand, homeDir) {
     if (!win32NamespaceScreen(raw, family).ok)
         return undefined;
     if (isAbsoluteForFamily(family, raw))
-        return normalizeAbsPathLexically(nativeUncSpellingOf(family, raw));
+        return spellingsOf(nativeUncSpellingOf(family, raw));
     if (base === undefined || family === undefined || !isAbsoluteForFamily(family, base))
         return undefined;
     if (isShellRootedSpellingUnmapped(family, raw))
         return undefined;
-    return normalizeAbsPathLexically(joinForFamily(family, base, raw));
+    return spellingsOf(joinForFamily(family, base, raw));
+}
+function spellingsOf(absolute) {
+    const folded = normalizeAbsPathLexically(absolute);
+    return PARENT_SEGMENT_RE.test(absolute) ? { folded, spelled: absolute } : { folded };
 }
 function reheadSegment(toks, head, from = 0) {
     return { folded: [head, ...toks.folded.slice(from + 1)], raw: [head, ...toks.raw.slice(from + 1)] };
@@ -643,10 +651,25 @@ function unwrapLauncher(folded, allow) {
         const head = wordBasename;
         if (SHELL_CONTROL_PREFIXES.has(head) || SHELL_BLOCK_WORDS.has(head))
             return { kind: "refused", reason: `"${folded[0]}" is given shell control syntax ("${head}") where the program it runs would be ${NOT_AUTO_ALLOWED}` };
-        return allow.has(head) || head === "cd" ? { kind: "reader", index: i, head, argvFromStdin } : { kind: "unlisted", head, argvFromStdin };
+        return allow.has(head) || head === "cd" ? { kind: "reader", index: i, head, argvFromStdin } : { kind: "unlisted", head, index: i, argvFromStdin };
     }
     return { kind: "unlisted", argvFromStdin, runsDefaultProgram: lastReentry === folded.length - 1 };
 }
+const LAUNCHER_OPTION_GRAMMAR = new Map([
+    ["time", {
+            plain: new Set(["-p", "-a", "-v", "-q", "--portability", "--append", "--verbose", "--quiet", "--help", "--version"]),
+            valued: new Set(["-f", "-o", "--format", "--output"]),
+        }],
+]);
+function launcherOptionSpan(launcher, folded, i) {
+    const row = launcher === undefined ? undefined : LAUNCHER_OPTION_GRAMMAR.get(launcher);
+    const tok = folded[i];
+    if (row === undefined || tok === undefined)
+        return 0;
+    if (row.plain.has(tok))
+        return 1;
+    return row.valued.has(tok) && folded[i + 1] !== undefined ? 2 : 0;
+}
 const ARGV_REENTRY_DEFAULT_PROGRAM = "echo";
 function argvReentryUnjudged(unwrapped) {
     if (!unwrapped.argvFromStdin)
@@ -846,6 +869,305 @@ const SED_READONLY_FLAGS = new Set([
 ]);
 const SED_READONLY_CLUSTER_LETTERS = new Set(["n", "E", "r", "z"]);
 const SED_READONLY_SCRIPT_PIECE = /^(?:\d+|\d+,\d+)?p$/;
+const SED_FILE_OR_EXEC_COMMANDS = new Set(["r", "R", "w", "W", "e"]);
+const SED_PLAIN_COMMANDS = new Set(["=", "d", "D", "F", "g", "G", "h", "H", "n", "N", "p", "P", "x", "z"]);
+const SED_NUMERIC_COMMANDS = new Set(["q", "Q", "l", "L"]);
+const SED_LABEL_COMMANDS = new Set(["b", "t", "T", ":", "v"]);
+const SED_TEXT_COMMANDS = new Set(["a", "i", "c"]);
+const SED_SUBSTITUTE_FLAGS = /[gpiImM0-9]/;
+const SED_SCRIPT_LINE_LIMIT = 1024;
+function utf8Length(text) {
+    let bytes = 0;
+    for (const ch of text) {
+        const code = ch.codePointAt(0);
+        bytes += code < 0x80 ? 1 : code < 0x800 ? 2 : code < 0x10000 ? 3 : 4;
+    }
+    return bytes;
+}
+function readSedScript(script) {
+    if (script.split("\n").some((line) => utf8Length(line) >= SED_SCRIPT_LINE_LIMIT))
+        return "unseen";
+    let i = 0;
+    let depth = 0;
+    const len = script.length;
+    const isBlank = (ch) => ch === " " || ch === "\t" || ch === "\v" || ch === "\f";
+    const skipBlank = () => {
+        while (i < len && isBlank(script[i]))
+            i++;
+    };
+    const digits = () => {
+        while (i < len && script[i] >= "0" && script[i] <= "9")
+            i++;
+    };
+    const consumeDelimited = (delim, regex) => {
+        while (i < len) {
+            const ch = script[i];
+            if (ch === "\\") {
+                const escaped = script[i + 1];
+                if (escaped === undefined || escaped === "\n" || escaped === "\r")
+                    return false;
+                i += 2;
+                continue;
+            }
+            if (ch === "\n" || ch === "\r")
+                return false;
+            if (ch === delim) {
+                i++;
+                return true;
+            }
+            if (regex && ch === "[") {
+                i++;
+                if (script[i] === "^")
+                    i++;
+                if (script[i] === "]")
+                    i++;
+                while (i < len && script[i] !== "]" && script[i] !== "\n" && script[i] !== "\r") {
+                    const next = script[i + 1];
+                    if (script[i] === "[" && (next === ":" || next === "." || next === "=")) {
+                        const at = script.indexOf(`${next}]`, i + 2);
+                        if (at === -1 || script.slice(i, at).includes("\n"))
+                            return false;
+                        i = at + 2;
+                        continue;
+                    }
+                    i++;
+                }
+                if (i >= len || script[i] !== "]")
+                    return false;
+                i++;
+                continue;
+            }
+            i++;
+        }
+        return false;
+    };
+    const readAddress = () => {
+        const ch = script[i];
+        if (ch === undefined)
+            return undefined;
+        if (ch === "$") {
+            i++;
+            return true;
+        }
+        if (ch >= "0" && ch <= "9") {
+            digits();
+            if (script[i] === "~") {
+                i++;
+                digits();
+            }
+            return true;
+        }
+        if (ch === "/" || ch === "\\") {
+            const delim = ch === "/" ? "/" : script[i + 1];
+            i += ch === "/" ? 1 : 2;
+            if (delim === undefined || !consumeDelimited(delim, true))
+                return false;
+            while (i < len && (script[i] === "I" || script[i] === "M"))
+                i++;
+            return true;
+        }
+        return undefined;
+    };
+    while (i < len) {
+        const ch = script[i];
+        if (isBlank(ch) || ch === "\n" || ch === "\r" || ch === ";") {
+            i++;
+            continue;
+        }
+        if (ch === "#") {
+            while (i < len && script[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (ch === "}") {
+            if (depth === 0)
+                return "unparsed";
+            depth--;
+            i++;
+            continue;
+        }
+        const first = readAddress();
+        if (first === false)
+            return "unparsed";
+        if (first === true) {
+            skipBlank();
+            if (script[i] === ",") {
+                i++;
+                skipBlank();
+                if (script[i] === "+" || script[i] === "~") {
+                    i++;
+                    if (!(script[i] >= "0" && script[i] <= "9"))
+                        return "unparsed";
+                    digits();
+                }
+                else if (readAddress() !== true)
+                    return "unparsed";
+            }
+            skipBlank();
+        }
+        while (script[i] === "!") {
+            i++;
+            skipBlank();
+        }
+        const cmd = script[i];
+        if (cmd === undefined)
+            return "unparsed";
+        i++;
+        if (SED_FILE_OR_EXEC_COMMANDS.has(cmd))
+            return "names";
+        if (cmd === "{") {
+            depth++;
+            continue;
+        }
+        if (cmd === "s" || cmd === "y") {
+            const delim = script[i];
+            if (delim === undefined || delim === "\\" || delim === "\n")
+                return "unparsed";
+            i++;
+            if (!consumeDelimited(delim, cmd === "s"))
+                return "unparsed";
+            if (!consumeDelimited(delim, false))
+                return "unparsed";
+            if (cmd === "y")
+                continue;
+            while (i < len) {
+                const flag = script[i];
+                if (flag === "w" || flag === "W" || flag === "e")
+                    return "names";
+                if (SED_SUBSTITUTE_FLAGS.test(flag) || isBlank(flag)) {
+                    i++;
+                    continue;
+                }
+                if (flag === ";" || flag === "\n" || flag === "\r" || flag === "}" || flag === "#")
+                    break;
+                return "unparsed";
+            }
+            continue;
+        }
+        if (SED_TEXT_COMMANDS.has(cmd)) {
+            while (i < len && script[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (SED_LABEL_COMMANDS.has(cmd)) {
+            skipBlank();
+            while (i < len && script[i] !== "\n" && script[i] !== ";" && script[i] !== "}" && !isBlank(script[i]))
+                i++;
+            continue;
+        }
+        if (SED_NUMERIC_COMMANDS.has(cmd)) {
+            skipBlank();
+            digits();
+            continue;
+        }
+        if (!SED_PLAIN_COMMANDS.has(cmd))
+            return "unparsed";
+    }
+    return depth === 0 ? "clean" : "unparsed";
+}
+const SED_OPTION_DIALECTS = [
+    { separated: "efl", suffix: "iI", stopsAtFirstOperand: false },
+    { separated: "ef", suffix: "iI", stopsAtFirstOperand: true },
+];
+function sedSeparatedSuffixTaken(tok) {
+    return tok !== undefined && (tok === "" || tok.startsWith("."));
+}
+const SED_LONG_VALUE_OPTIONS = ["expression", "line-length"];
+const SED_LONG_PLAIN_OPTIONS = [
+    "debug", "follow-symlinks", "help", "in-place", "null-data", "posix", "quiet", "regexp-extended",
+    "sandbox", "separate", "silent", "unbuffered", "version", "zero-terminated",
+];
+function readSedInvocation(args, dialect) {
+    const scripts = [];
+    let scriptSupplied = false;
+    let endOfOptions = false;
+    let firstOperand;
+    for (let k = 0; k < args.length; k++) {
+        const tok = args[k];
+        if (!endOfOptions && tok === "--") {
+            endOfOptions = true;
+            continue;
+        }
+        if (endOfOptions || !tok.startsWith("-") || tok === "-") {
+            if (firstOperand === undefined) {
+                firstOperand = tok;
+                if (dialect.stopsAtFirstOperand)
+                    endOfOptions = true;
+            }
+            continue;
+        }
+        if (tok.startsWith("--")) {
+            const long = longOptionNameOf(tok);
+            if (long === undefined)
+                return "unparsed";
+            const eq = tok.indexOf("=");
+            const attached = eq >= 0 ? tok.slice(eq + 1) : undefined;
+            if (isLongOptionAbbrevOf(long, "file"))
+                return "unseen";
+            if (isLongOptionAbbrevOf(long, "expression")) {
+                const value = attached ?? args[++k];
+                if (value === undefined)
+                    return "unparsed";
+                scripts.push(value);
+                scriptSupplied = true;
+                continue;
+            }
+            if (SED_LONG_VALUE_OPTIONS.some((full) => isLongOptionAbbrevOf(long, full))) {
+                if (attached === undefined)
+                    k++;
+                continue;
+            }
+            if (SED_LONG_PLAIN_OPTIONS.some((full) => isLongOptionAbbrevOf(long, full)))
+                continue;
+            return "unparsed";
+        }
+        for (let c = 1; c < tok.length; c++) {
+            const letter = tok[c];
+            if (dialect.suffix.includes(letter)) {
+                if (c + 1 === tok.length && sedSeparatedSuffixTaken(args[k + 1]))
+                    k++;
+                break;
+            }
+            if (dialect.separated.includes(letter)) {
+                const rest = tok.slice(c + 1);
+                const value = rest !== "" ? rest : args[++k];
+                if (letter === "f")
+                    return "unseen";
+                if (letter === "e") {
+                    if (value === undefined)
+                        return "unparsed";
+                    scripts.push(value);
+                    scriptSupplied = true;
+                }
+                break;
+            }
+            if (!SED_SHORT_PLAIN_LETTERS.includes(letter))
+                return "unparsed";
+        }
+    }
+    const script = scriptSupplied ? scripts.join("\n") : firstOperand;
+    if (script === undefined)
+        return "clean";
+    return readSedScript(script);
+}
+const SED_SHORT_PLAIN_LETTERS = "nsuzEraHl";
+const SCRIPT_SLOT_VERBS = new Map([
+    ["sed", (args) => {
+            const readings = SED_OPTION_DIALECTS.map((dialect) => readSedInvocation(args, dialect));
+            if (readings.includes("names") || readings.includes("unseen"))
+                return true;
+            return readings.every((reading) => reading === "unparsed");
+        }],
+]);
+function unjudgedProgramTextRefusal(written, clause) {
+    return `command "${written}" ${clause}, which this walk does not judge ${NOT_AUTO_ALLOWED}`;
+}
+function scriptSlotRefusal(written, name, args) {
+    const recognizer = SCRIPT_SLOT_VERBS.get(name);
+    if (recognizer === undefined || !recognizer(args))
+        return undefined;
+    return unjudgedProgramTextRefusal(written, "names files or runs commands inside its script text");
+}
 function guardedVerbFormReason(name, toks, raw) {
     if (name === "find") {
         for (const t of toks) {
@@ -1130,12 +1452,12 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
     for (let k = 0; k < args.length; k++) {
         if (!argGlobs(k) || expandingArgs.has(k))
             continue;
-        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], args[k], boundary.homeDir);
-        findings.push({ kind: "undecided", path: resolved ?? args[k] });
+        const r = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], args[k], boundary.homeDir);
+        findings.push({ kind: "undecided", path: r?.folded ?? args[k], ...(r?.spelled !== undefined ? { spelled: r.spelled } : {}) });
     }
     for (const { text: candidate, globbed } of candidates) {
-        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], candidate, boundary.homeDir);
-        if (resolved === undefined) {
+        const spellings = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], candidate, boundary.homeDir);
+        if (spellings === undefined) {
             findings.push({
                 kind: "unresolvable",
                 operand: candidate,
@@ -1143,19 +1465,20 @@ function collectSegmentBoundaryFindings(tokens, boundary) {
             });
             continue;
         }
+        const resolved = spellings.folded;
         if (withinAnyRoot(boundary.roots, resolved)) {
             if (!globbed)
-                findings.push({ kind: "inside", path: resolved });
+                findings.push({ kind: "inside", path: resolved, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
         }
         else
-            findings.push({ kind: "outside", command: name, path: resolved });
+            findings.push({ kind: "outside", command: name, path: resolved, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
     }
     for (const { text: operand, globbed } of bareWordOperands) {
-        const resolved = resolveOperandLexically(boundary.cwd ?? boundary.roots[0], operand, boundary.homeDir);
-        if (resolved === undefined)
+        const spellings = resolveOperandSpellings(boundary.cwd ?? boundary.roots[0], operand, boundary.homeDir);
+        if (spellings === undefined)
             continue;
-        if (!globbed && withinAnyRoot(boundary.roots, resolved))
-            findings.push({ kind: "inside", path: resolved });
+        if (!globbed && withinAnyRoot(boundary.roots, spellings.folded))
+            findings.push({ kind: "inside", path: spellings.folded, ...(spellings.spelled !== undefined ? { spelled: spellings.spelled } : {}) });
     }
     if (boundary.denyMatch !== undefined && segmentSelectsRecursiveRead(name, args)) {
         const roots = positionalOperands.length > 0 ? positionalOperands : stdinOperand ? [] : ["."];
@@ -1236,11 +1559,17 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         const toks = tokenizeSegment(segments[si]);
         const folded = toks.folded;
         let from = 0;
-        while (from < folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES))
+        while (from < folded.length && isBareControlWord(toks, from, SHELL_CONTROL_PREFIXES)) {
+            const controlWord = programBasename(folded[from] ?? "");
             from++;
+            for (let span = launcherOptionSpan(controlWord, folded, from); span > 0; span = launcherOptionSpan(controlWord, folded, from))
+                from += span;
+        }
         const written = folded[from];
         if (written === undefined)
             return { reason: "empty command" };
+        if (written === "coproc")
+            return { reason: "`coproc` backgrounds a command — a backgrounded process outlives the command", refusedWhole: true };
         if (isBareControlWord(toks, from, SHELL_BLOCK_WORDS)) {
             unlistedSegments.add(si);
             nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
@@ -1253,6 +1582,18 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         const name = pathPrefixed ? parsed.name.slice(parsed.name.lastIndexOf("/") + 1) : parsed.name;
         if (pathPrefixed)
             nameRefusal ??= "the command must be a bare name resolved via PATH (no path prefix)";
+        if (name.startsWith("-") && name !== "-") {
+            return { reason: `"${folded[0]}" is given an option where the program it runs would be — which program runs is not readable without its option table ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+        }
+        const launcherUnwrap = COMMAND_LAUNCHERS.has(name) ? unwrapLauncher(folded.slice(from), allow) : undefined;
+        if (launcherUnwrap?.kind === "refused")
+            return { reason: launcherUnwrap.reason, refusedWhole: true };
+        const runs = launcherUnwrap === undefined ? { head: name, index: 0 } : { head: launcherUnwrap.head, index: launcherUnwrap.index };
+        if (runs?.head !== undefined && runs.index !== undefined) {
+            const slotRefusal = scriptSlotRefusal(runs.head, runs.head, folded.slice(from + runs.index + 1));
+            if (slotRefusal !== undefined)
+                return { reason: slotRefusal, refusedWhole: true };
+        }
         if (allow.has(name)) {
             if (pathPrefixed || from > 0)
                 reheaded.set(si, { from, head: name });
@@ -1262,9 +1603,9 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
         }
         nameRefusal ??= `command "${parsed.name}" is not in the read-only allowlist`;
         if (SHELL_REENTRY_PROGRAM_RE.test(name))
-            return { reason: `command "${parsed.name}" runs its argument as shell text, which this walk does not judge ${NOT_AUTO_ALLOWED}`, refusedWhole: true };
+            return { reason: unjudgedProgramTextRefusal(parsed.name, "runs its argument as shell text"), refusedWhole: true };
         if (COMMAND_LAUNCHERS.has(name)) {
-            const unwrapped = unwrapLauncher(folded.slice(from), allow);
+            const unwrapped = launcherUnwrap ?? unwrapLauncher(folded.slice(from), allow);
             if (unwrapped.kind === "refused")
                 return { reason: unwrapped.reason, refusedWhole: true };
             if (unwrapped.kind === "unlisted" && unwrapped.head !== undefined && SHELL_REENTRY_PROGRAM_RE.test(unwrapped.head)) {
@@ -1438,13 +1779,22 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary, opts)
 }
 const BASE_CANDIDATE_MAX = 256;
 function evaluateReadBoundary(foldedSegments, boundary, reach) {
-    const seen = { outside: new Set(), inside: new Set(), undecided: new Set(), recursive: new Set(), unresolved: new Set() };
+    const seen = { outside: new Set(), inside: new Set(), undecided: new Set(), recursive: new Set(), unresolved: new Set(), checkedSpelled: new Set(), undecidedSpelled: new Set(), outsideSpelled: new Set() };
     const outside = [];
     const inside = [];
     let unresolvable;
     const unresolved = [];
     let baseLost = false;
     const undecided = [];
+    const checkedSpellings = [];
+    const undecidedSpellings = [];
+    const outOfRootSpellings = [];
+    const recordSpelling = (into, seenHere, finding) => {
+        if (finding.spelled === undefined || seenHere.has(finding.spelled))
+            return;
+        seenHere.add(finding.spelled);
+        into.push(finding.spelled);
+    };
     const recursive = [];
     let candidates = [{ base: boundary.cwd ?? boundary.roots[0], skippedCd: -1 }];
     let andRunStart = 0;
@@ -1498,6 +1848,7 @@ function evaluateReadBoundary(foldedSegments, boundary, reach) {
                         seen.inside.add(finding.path);
                         inside.push(finding.path);
                     }
+                    recordSpelling(checkedSpellings, seen.checkedSpelled, finding);
                     continue;
                 }
                 if (finding.kind === "undecided") {
@@ -1505,6 +1856,7 @@ function evaluateReadBoundary(foldedSegments, boundary, reach) {
                         seen.undecided.add(finding.path);
                         undecided.push(finding.path);
                     }
+                    recordSpelling(undecidedSpellings, seen.undecidedSpelled, finding);
                     continue;
                 }
                 if (finding.kind === "recursive") {
@@ -1525,6 +1877,7 @@ function evaluateReadBoundary(foldedSegments, boundary, reach) {
                     seen.outside.add(finding.path);
                     outside.push(finding);
                 }
+                recordSpelling(outOfRootSpellings, seen.outsideSpelled, finding);
             }
         }
         if (!baseLost && toks.folded[0] === "cd") {
@@ -1563,25 +1916,32 @@ function evaluateReadBoundary(foldedSegments, boundary, reach) {
     const undecidedField = {
         ...(undecidedAll.length > 0 ? { undecidedPaths: undecidedAll } : {}),
         ...(recursive.length > 0 ? { recursiveReadPaths: recursive } : {}),
+        ...(undecidedSpellings.length > 0 ? { undecidedSpellings } : {}),
     };
+    const checkedField = {
+        ...(inside.length > 0 ? { checkedPaths: inside } : {}),
+        ...(checkedSpellings.length > 0 ? { checkedSpellings } : {}),
+    };
+    const outsideField = outOfRootSpellings.length > 0 ? { outOfRootSpellings } : {};
     if (unresolvable !== undefined) {
         return {
             reason: unresolvable,
             unresolvedOperands: unresolved,
-            ...(outside.length > 0 ? { outOfRootRead: true, outOfRootPaths: outside.map((o) => o.path) } : {}),
-            ...(inside.length > 0 ? { checkedPaths: inside } : {}),
+            ...(outside.length > 0 ? { outOfRootRead: true, outOfRootPaths: outside.map((o) => o.path), ...outsideField } : {}),
+            ...checkedField,
             ...undecidedField,
         };
     }
     if (outside.length === 0)
-        return inside.length > 0 ? { checkedPaths: inside, ...undecidedField } : { ...undecidedField };
+        return { ...checkedField, ...undecidedField };
     const paths = outside.map((o) => `"${o.path}"`).join(", ");
     const allowed = boundary.roots.length > 0 ? boundary.roots.join(", ") : "(none)";
     return {
         reason: `"${outside[0].command}" reads ${paths}, outside the allowed directories for this session: ${allowed} ${NOT_AUTO_ALLOWED}`,
         outOfRootRead: true,
         outOfRootPaths: outside.map((o) => o.path),
-        ...(inside.length > 0 ? { checkedPaths: inside } : {}),
+        ...outsideField,
+        ...checkedField,
         ...undecidedField,
     };
 }
@@ -1589,6 +1949,19 @@ export function classifySimpleCommandReadBoundary(command, boundary) {
     const toks = tokenizeSegment(command);
     if (toks.folded.length === 0)
         return {};
+    const head = programBasename(toks.folded[0]);
+    let past = 0;
+    for (let span = launcherOptionSpan(head, toks.folded, past + 1); span > 0; span = launcherOptionSpan(head, toks.folded, past + 1))
+        past += span;
+    const chain = past === 0 ? toks.folded : [toks.folded[0], ...toks.folded.slice(past + 1)];
+    const runs = COMMAND_LAUNCHERS.has(head) ? unwrapLauncher(chain, new Set()) : { kind: "reader", head, index: 0 };
+    if (runs.kind === "refused")
+        return { reason: runs.reason, refusedWhole: true };
+    if (runs.head !== undefined && runs.index !== undefined) {
+        const slotRefusal = scriptSlotRefusal(runs.head, runs.head, toks.folded.slice(runs.index + past + 1));
+        if (slotRefusal !== undefined)
+            return { reason: slotRefusal, refusedWhole: true };
+    }
     return evaluateReadBoundary([toks], boundary);
 }
 const NOT_GATED = { gated: false, paths: [] };