@sema-agent/core 7.29.0 → 7.30.1

package/dist/tools/fs/bash-readonly-classifier.js

@@ -1,6 +1,6 @@
 import { isAbsoluteForFamily, isAbsolutePathForm, isBlockedDevicePath, isShellRootedSpellingUnmapped, joinForFamily, nativeUncSpellingOf, normalizeAbsPathLexically, win32NamespaceScreen, pathFamilyOf } from "./safety.js";
-import { lexShellText, literalTildeSpelling, ansiCQuoteClose, dollarOpensQuote, quoteMask, wordsOf, } from "../../shell/lex.js";
-import { COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programPositionRefusalSentence, ASSIGNMENT_PREFIX, readProgramPosition, writtenAssignmentPrefix, } from "./bash-program-position.js";
+import { PARSE_FAILURE_SENTENCE, UNRESOLVED_SENTENCE, argvOf, lexShell, literalTildeSpelling, } from "../../shell/lex.js";
+import { COMMAND_LAUNCHERS, NOT_AUTO_ALLOWED, SHELL_BLOCK_WORDS, argvReentryUnjudged, isBareControlWord, programBasename, programPositionRefusalSentence, readProgramPosition, } from "./bash-program-position.js";
 export const BASH_READONLY_DEFAULT_ALLOW = [
     "ls", "cat", "head", "tail", "wc", "pwd", "echo", "whoami", "uname",
     "grep", "cut", "tr", "basename", "dirname", "stat", "du", "df", "which",
@@ -15,20 +15,33 @@ const SHELL_OPERATORS = /[;&|<>$()`\n\r\\]/;
 function hasBareShellOperator(s, quotedOperatorsAreText) {
     if (!quotedOperatorsAreText)
         return SHELL_OPERATORS.test(s);
-    const mask = quoteMask(s);
-    if (!mask.balanced)
+    const lexed = lexShell(s);
+    if ("parseFailure" in lexed)
         return SHELL_OPERATORS.test(s);
-    for (let i = 0; i < s.length; i++) {
-        const ch = s[i];
-        if (!SHELL_OPERATORS.test(ch))
-            continue;
-        const literal = SHELL_EXPANDS_IN_DOUBLE_QUOTES.test(ch) ? mask.openedBy[i] === "'" : mask.quoted[i];
-        if (!literal)
+    if (lexed.segments.length > 1)
+        return true;
+    for (const t of lexed.segments[0].tokens) {
+        if (t.kind !== "word")
+            return true;
+        if (expandsDollar(t) || t.assignment?.form === "compound")
+            return true;
+        if (t.pieces.some((p) => p.quotedBy === "\\" || (p.quotedBy === undefined && p.literal !== undefined && /[\r\\]/.test(p.literal))))
+            return true;
+    }
+    return false;
+}
+function expandsDollar(w) {
+    if (w.quotedSpans.some((q) => q.by === '$"'))
+        return true;
+    for (const p of w.pieces) {
+        const k = p.expansion?.kind;
+        if (k === "parameter" || k === "command" || k === "process" || k === "arithmetic")
+            return true;
+        if (p.literal !== undefined && (p.quotedBy === undefined || p.quotedBy === '"') && /[$`]/.test(p.literal))
             return true;
     }
     return false;
 }
-const SHELL_EXPANDS_IN_DOUBLE_QUOTES = /[$`]/;
 export function parseLeadingCommandName(command, options) {
     const trimmed = command.trim();
     if (!trimmed)
@@ -38,12 +51,14 @@ export function parseLeadingCommandName(command, options) {
             reject: "shell operators (pipes, redirects, ;, &&, command substitution, subshells, variable expansion) are not allowed — run a single simple command",
         };
     }
-    const first = trimmed.split(/\s+/)[0];
+    const first = trimmed.split(/[ \t]+/)[0];
     if (first.includes("/") && options?.pathPrefixedNameIsText !== true) {
         return { reject: "the command must be a bare name resolved via PATH (no path prefix)" };
     }
     if (first.includes("="))
         return { reject: "leading environment-variable assignments are not allowed" };
+    if (first.startsWith("#"))
+        return { reject: "empty command" };
     if (/["'{}*?[\]~]/.test(first))
         return { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" };
     return { name: first };
@@ -62,96 +77,81 @@ export function carriesShellRedirection(text) {
     return SHELL_REDIRECTION_OPERATORS.test(text);
 }
 const SHELL_REDIRECTION_OPERATORS = /[<>]/;
-const SHELL_CONNECTOR_CHARS = /[|&;]/;
-function redirectionPrecedesConnector(source) {
-    const mask = quoteMask(source);
-    const quoted = (i) => mask.balanced && mask.quoted[i] === true;
-    const isSpace = (c) => c === " " || c === "\t";
-    for (let i = 0; i < source.length; i++) {
-        if (quoted(i) || !SHELL_REDIRECTION_OPERATORS.test(source[i]))
-            continue;
-        let j = i + 1;
-        while (j < source.length && !quoted(j) && (SHELL_REDIRECTION_OPERATORS.test(source[j]) || isSpace(source[j])))
-            j++;
-        if (j < source.length && !quoted(j) && SHELL_CONNECTOR_CHARS.test(source[j]))
-            return true;
-        i = j - 1;
-    }
-    return false;
-}
-function rejectedSansRedirection(source) {
-    if (redirectionPrecedesConnector(source)) {
-        return "a redirection followed by `|`, `&` or `;` is not allowed — the operator's own characters cannot be told apart from a command boundary";
-    }
-    return hardRejectReason(source, true);
+function isDataFreeRedirection(r) {
+    if (r.op === ">" && r.fd === 2 && r.target !== undefined && r.target.raw === "/dev/null")
+        return true;
+    return r.op === ">&" && r.dup !== undefined && /^[12]$/.test(r.dup) && (r.fd === undefined || r.fd === 1 || r.fd === 2);
 }
-function hardRejectReason(source, tolerateRedirection) {
-    const reason = tolerateRedirection
+const BACKGROUND_REFUSAL = "`&` backgrounding is not allowed — a backgrounded process outlives the command";
+const PIPE_BOTH_REFUSAL = "`|&` pipes standard error as well as standard output — not a connector this face reads";
+export function strictResidualRefusal(lexed, source, opts = {}) {
+    const tolerate = opts.tolerateRedirection === true;
+    const reason = tolerate
         ? "command/variable substitution, subshells, escapes, and line breaks are not allowed"
         : "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed";
-    for (const ch of source) {
-        if (SHELL_SEGMENT_QUOTE_BLIND_REJECT.test(ch) && !(tolerateRedirection && SHELL_REDIRECTION_OPERATORS.test(ch)))
+    const inClass = (text) => {
+        for (const ch of text)
+            if (SHELL_SEGMENT_QUOTE_BLIND_REJECT.test(ch) && !(tolerate && SHELL_REDIRECTION_OPERATORS.test(ch)))
+                return true;
+        return false;
+    };
+    if ("parseFailure" in lexed)
+        return inClass(source) || SHELL_EXPANSION_CHARS.test(source) ? reason : PARSE_FAILURE_SENTENCE[lexed.parseFailure.reason];
+    const words = [];
+    for (const s of lexed.segments) {
+        if (s.connector === "\n")
             return reason;
+        for (const t of s.tokens) {
+            if (t.kind === "word") {
+                if (inClass(t.raw))
+                    return reason;
+                words.push(t);
+                continue;
+            }
+            if (t.kind !== "redirect")
+                return reason;
+            if (opts.dataFreeRedirections === true && isDataFreeRedirection(t))
+                continue;
+            if (!tolerate)
+                return reason;
+            if (t.target !== undefined) {
+                if (inClass(t.target.raw))
+                    return reason;
+                words.push(t.target);
+            }
+        }
     }
-    if (!SHELL_EXPANSION_CHARS.test(source))
-        return undefined;
-    const mask = quoteMask(source);
-    for (let i = 0; i < source.length; i++) {
-        if (!SHELL_EXPANSION_CHARS.test(source[i]))
-            continue;
-        if (mask.balanced && mask.openedBy[i] === "'")
-            continue;
-        return reason;
+    const home = opts.homeDir !== undefined && !homeMayBeRebound(source) ? opts.homeDir : undefined;
+    for (const w of words) {
+        if (expandsDollar(w) && !(home !== undefined && homeSpelledForClassify(w, home) !== undefined))
+            return reason;
     }
+    for (const s of lexed.segments) {
+        if (s.connector === "&")
+            return BACKGROUND_REFUSAL;
+        if (s.pipesStderr)
+            return PIPE_BOTH_REFUSAL;
+    }
+    for (const w of words)
+        if (w.unresolved !== undefined)
+            return UNRESOLVED_SENTENCE[w.unresolved];
     return undefined;
 }
 export function splitShellCompoundSegments(source, options) {
-    if (options?.redirection === "tolerate") {
-        const refused = rejectedSansRedirection(source);
-        if (refused !== undefined)
-            return { reject: refused };
-    }
-    else {
-        const refused = hardRejectReason(source, false);
-        if (refused !== undefined)
-            return { reject: refused };
-    }
     const scanned = options?.trailingTerminator !== "keep" ? source.replace(/;\s*$/, "") : source;
-    const lexed = lexShellText(scanned, { mode: "strict" });
-    if ("reject" in lexed)
-        return lexed;
-    const segments = lexed.segments.map((s) => s.text);
-    const connectors = lexed.segments.map((s) => s.connector);
-    return { segments, pipeFed: connectors.map((k) => k === "|"), connectors };
-}
-const EXEMPT_REDIRECTION = /^(?:2>\/dev\/null|[12]?>&[12])$/;
-function stripExemptRedirections(command) {
-    if (!command.includes(">"))
-        return command;
-    const mask = quoteMask(command);
-    if (!mask.balanced)
-        return command;
-    let out = "";
-    let word = "";
-    let wordQuoted = false;
-    const flush = () => {
-        out += wordQuoted || !EXEMPT_REDIRECTION.test(word) ? word : "";
-        word = "";
-        wordQuoted = false;
-    };
-    for (let i = 0; i < command.length; i++) {
-        const ch = command[i];
-        if (!mask.quoted[i] && (ch === " " || ch === "\t")) {
-            flush();
-            out += ch;
-            continue;
-        }
-        if (mask.quoted[i])
-            wordQuoted = true;
-        word += ch;
-    }
-    flush();
-    return out;
+    if (/[\n\r]/.test(source.slice(scanned.length)))
+        return { reject: options?.redirection === "tolerate" ? "command/variable substitution, subshells, escapes, and line breaks are not allowed" : "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed" };
+    const lexed = lexShell(scanned);
+    const refused = strictResidualRefusal(lexed, scanned, {
+        tolerateRedirection: options?.redirection === "tolerate",
+        dataFreeRedirections: options?.redirection === "data-free",
+        ...(options?.homeDir !== undefined ? { homeDir: options.homeDir } : {}),
+    });
+    if (refused !== undefined)
+        return { reject: refused };
+    const command = lexed;
+    const connectors = command.segments.map((s) => s.connector);
+    return { segments: command.segments.map((s) => s.text), pipeFed: connectors.map((k) => k === "|"), connectors, lexed: command.segments };
 }
 export function formatOutOfRootReadApprovalOption(directory) {
     const trimmed = directory.replace(/[/\\]+$/, "");
@@ -200,56 +200,36 @@ function reheadSegment(toks, head, from = 0) {
     return { folded: [head, ...toks.folded.slice(from + 1)], raw: [head, ...toks.raw.slice(from + 1)] };
 }
 export const SHELL_REENTRY_PROGRAM_RE = /^(?:(?:ba|z|da|k|fi|a|mk|ya|pdk|c|tc)?sh|eval|source|\.|parallel)$/;
-function tokenizeSegment(segment) {
-    const lexed = lexShellText(segment, { mode: "strict", connectors: "text" });
-    if ("reject" in lexed)
-        return { folded: [], raw: [] };
-    return wordsOf(lexed.segments[0]);
-}
-export function hasUnquotedExpansionMetachar(rawToken) {
-    let open;
-    for (let i = 0; i < rawToken.length; i++) {
-        const ch = rawToken[i];
-        const opener = rawToken[i + 1];
-        if (open === undefined && ch === "$" && dollarOpensQuote(rawToken, i)) {
-            if (opener === '"') {
-                open = opener;
-                i += 1;
-                continue;
-            }
-            const close = ansiCQuoteClose(rawToken, i + 1);
-            if (close === undefined)
-                return true;
-            i = close;
-            continue;
-        }
-        if (open === undefined && (ch === '"' || ch === "'")) {
-            open = ch;
-            continue;
-        }
-        if (open === ch) {
-            open = undefined;
+function segmentSpellings(words, homeDir, homeRebound) {
+    const folded = [];
+    const raw = [];
+    for (const w of words) {
+        const spelled = homeDir !== undefined && !homeRebound ? homeSpelledForClassify(w, homeDir) : undefined;
+        folded.push(spelled ?? w.folded);
+        raw.push(spelled ?? w.raw);
+    }
+    return { folded, raw };
+}
+export function expansionInWord(w) {
+    for (const p of w.pieces) {
+        const k = p.expansion?.kind;
+        if (k === "parameter" || k === "command" || k === "process" || k === "arithmetic" || k === "brace")
+            return true;
+        if (p.literal === undefined)
             continue;
-        }
-        if (open === undefined && (ch === "{" || ch === "}" || ch === "$" || ch === "`"))
+        if (p.quotedBy === undefined && /[{}$`]/.test(p.literal))
             return true;
-        if (open === '"' && (ch === "$" || ch === "`"))
+        if (p.quotedBy === '"' && /[$`]/.test(p.literal))
             return true;
     }
     return false;
 }
-export function hasUnquotedGlobMetachar(rawToken) {
-    let open;
-    for (const ch of rawToken) {
-        if (open === undefined && (ch === '"' || ch === "'")) {
-            open = ch;
-            continue;
-        }
-        if (open === ch) {
-            open = undefined;
-            continue;
-        }
-        if (open === undefined && (ch === "*" || ch === "?" || ch === "["))
+const isGlobPiece = (p) => p.expansion?.kind === "glob";
+export function globInWord(w) {
+    for (const p of w.pieces) {
+        if (isGlobPiece(p))
+            return true;
+        if (p.literal !== undefined && p.quotedBy === undefined && /[*?[]/.test(p.literal))
             return true;
     }
     return false;
@@ -1298,24 +1278,24 @@ function argumentAsProgramRefusal(written, name, args) {
     const clause = inlineProgramClause(interpreter, args);
     return clause === undefined ? undefined : unjudgedProgramTextRefusal(written, clause);
 }
-function guardedVerbFormReason(name, toks, raw) {
+function guardedVerbFormReason(name, toks, args) {
     if (name === "find") {
         for (const t of toks) {
             if (FIND_DANGEROUS_PREDICATES.has(t)) {
                 return `\`find ${t}\` executes a command or writes a file — not a read ${NOT_AUTO_ALLOWED}`;
             }
         }
-        for (const rt of raw.slice(1)) {
-            if (hasUnquotedGlobMetachar(rt) || hasUnquotedExpansionMetachar(rt)) {
-                return `\`find\` is given the unquoted pattern "${rt}", which the shell may expand into other arguments before find runs ${NOT_AUTO_ALLOWED}`;
+        for (const w of args) {
+            if (globInWord(w) || expansionInWord(w)) {
+                return `\`find\` is given the unquoted pattern "${w.raw}", which the shell may expand into other arguments before find runs ${NOT_AUTO_ALLOWED}`;
             }
         }
         return undefined;
     }
     if (name === "sed") {
-        for (const rt of raw.slice(1)) {
-            if (hasUnquotedGlobMetachar(rt) || hasUnquotedExpansionMetachar(rt)) {
-                return `\`sed\` is given the unquoted pattern "${rt}", which the shell may expand into other arguments (a file named like a flag becomes a live option) before sed runs ${NOT_AUTO_ALLOWED}`;
+        for (const w of args) {
+            if (globInWord(w) || expansionInWord(w)) {
+                return `\`sed\` is given the unquoted pattern "${w.raw}", which the shell may expand into other arguments (a file named like a flag becomes a live option) before sed runs ${NOT_AUTO_ALLOWED}`;
             }
         }
         const flags = [];
@@ -1361,7 +1341,7 @@ function guardedVerbFormReason(name, toks, raw) {
         return undefined;
     }
     if (name === "sleep") {
-        return pollLoopSleepReason(toks.join(" "));
+        return pollLoopSleepReason(toks);
     }
     if (name === "seq") {
         for (const t of toks.slice(1)) {
@@ -1458,51 +1438,13 @@ function isGrepFileStdinLongOption(tok) {
     return name !== undefined && isLongOptionAbbrevOf(name, "file");
 }
 const CLUSTER_OPTION_CHAR = /[A-Za-z0-9]/;
-function tildeExpandsInValue(rawValue) {
-    if (rawValue === undefined)
-        return false;
-    for (let at = 0; at <= rawValue.length;) {
-        if (rawValue[at] === "~") {
-            let quoted = false;
-            for (let k = at + 1; k < rawValue.length && rawValue[k] !== "/" && rawValue[k] !== ":"; k++) {
-                if (rawValue[k] === "'" || rawValue[k] === '"' || rawValue[k] === "\\") {
-                    quoted = true;
-                    break;
-                }
-            }
-            if (!quoted)
-                return true;
-        }
-        const next = rawValue.indexOf(":", at);
-        if (next < 0)
-            return false;
-        at = next + 1;
-    }
-    return false;
-}
-export function assignmentWordPayload(word, raw = word) {
-    const written = writtenAssignmentPrefix(word);
-    if (written === undefined)
-        return undefined;
-    const eq = written.prefix.length - 1;
-    const spelled = word.slice(eq + 1);
-    const expands = tildeExpandsInValue(raw.startsWith(written.prefix) ? raw.slice(written.prefix.length) : undefined);
-    const value = expands ? spelled : literalTildeSpelling(spelled);
-    if (written.appends) {
-        const reason = `"${word}" appends to a value the text does not contain`;
-        return spelled === "" || expands ? { kind: "unresolved", reason } : { kind: "unresolved", reason, value };
-    }
-    if (expands)
-        return { kind: "unresolved", reason: `"${word}" carries a tilde whose expansion the text does not settle` };
-    return spelled === "" ? undefined : { kind: "value", value };
-}
 export const ASSIGNMENT_VALUE_NOT_PATHS = new Set(["make", "gmake", "bmake", "cmake", "ninja", "meson", "docker", "podman"]);
-export function argvProgramOf(tokens) {
-    const pos = readProgramPosition(tokens);
+export function argvProgramOf(words) {
+    const pos = readProgramPosition(words);
     if (pos.program === undefined)
         return undefined;
     const at = pos.program.index;
-    return ASSIGNMENT_PREFIX.test(tokens.folded[at] ?? "") ? undefined : { program: pos.program.basename, from: at };
+    return words[at]?.assignment !== undefined ? undefined : { program: pos.program.basename, from: at };
 }
 export function attachedOptionPayloads(tok) {
     const literal = literalTildeSpelling;
@@ -1525,83 +1467,243 @@ export function attachedOptionPayloads(tok) {
     }
     return out;
 }
-export function foldHomeVariableSpelling(command, homeDir) {
-    if (homeDir === undefined || !command.includes("$") || /[\\`]/.test(command))
-        return command;
-    const unquotedIsExact = /^[A-Za-z0-9_./+@:%=,-]+$/.test(homeDir);
-    const quotedIsExact = !/["$`\\\n\r]/.test(homeDir);
-    const UNQUOTED_HOME_WORD = /^\$(?:HOME|\{HOME\})(?=[/\s;|&"]|$)/;
-    const DOUBLE_QUOTED_HOME_WORD = /^\$(?:HOME|\{HOME\})(?=[/"]|$)/;
-    let open;
-    let wordStart = true;
-    let quoteHadContent = false;
-    let out = "";
-    for (let i = 0; i < command.length; i++) {
-        const ch = command[i];
-        if (open === undefined && (ch === '"' || ch === "'")) {
-            open = ch;
-            quoteHadContent = false;
-            out += ch;
+const HOME_EXPANDS_TO_ONE_WORD = /^[A-Za-z0-9_./+@:%=,-]+$/;
+export function homeExpansionOf(w, home) {
+    const [head, ...rest] = w.pieces;
+    const e = head?.expansion;
+    if (head === undefined || e === undefined || e.kind !== "parameter" || e.name !== "HOME" || (e.body !== undefined && e.body !== "HOME"))
+        return undefined;
+    if (head.quotedBy !== undefined && head.quotedBy !== '"')
+        return undefined;
+    if (head.quotedBy === undefined && !HOME_EXPANDS_TO_ONE_WORD.test(home))
+        return undefined;
+    if (rest.some((p) => p.expansion !== undefined || p.literal === undefined))
+        return undefined;
+    const next = rest[0];
+    if (next !== undefined) {
+        if (head.quotedBy === undefined && !(next.literal.startsWith("/") || next.quotedBy === '"'))
+            return undefined;
+        if (head.quotedBy === '"' && next.quotedBy === '"' && !next.literal.startsWith("/"))
+            return undefined;
+    }
+    return { spelled: `${home}${rest.map((p) => p.literal).join("")}` };
+}
+const CLASSIFY_HOME_REREADABLE = /["$`\\\n\r]/;
+function homeSpelledForClassify(w, home) {
+    return CLASSIFY_HOME_REREADABLE.test(home) ? undefined : homeExpansionOf(w, home)?.spelled;
+}
+const HOME_PLAIN_READ = /\$HOME(?![A-Za-z0-9_])|\$\{HOME\}/g;
+const HOME_NAME = /HOME(?![A-Za-z0-9_])/;
+export function homeMayBeRebound(text) {
+    const unquoted = text.replace(/\\\r?\n/g, "").replace(HOME_PLAIN_READ, " ").replace(/\$?["']|\\/g, "");
+    if (HOME_NAME.test(unquoted))
+        return true;
+    if (hasUnquotedExtglobOpener(text))
+        return true;
+    if (!unquoted.includes("printf") && !/[*?[{]/.test(unquoted))
+        return false;
+    const lexed = lexShell(text);
+    return !("parseFailure" in lexed) && lexed.segments.some((seg) => {
+        const words = argvOf(seg);
+        return printfNamesComputed(words) || words.some((w) => globMayMatchHome(w) || optionWordCarriesGlob(w) || wordHasBraceList(w));
+    });
+}
+function hasUnquotedExtglobOpener(text) {
+    const lexed = lexShell(text);
+    return "parseFailure" in lexed || extglobOpenerIn(lexed, text);
+}
+export function extglobOpenerIn(lexed, text) {
+    for (const seg of lexed.segments) {
+        for (const [k, tok] of seg.tokens.entries()) {
+            const next = seg.tokens[k + 1];
+            if (tok.kind === "heredoc" && /[?*+@!]$/.test(tok.delimiter) && next?.kind === "group" && next.op === "(")
+                return true;
+            const t = tok.kind === "word" ? tok : tok.kind === "redirect" ? tok.target : undefined;
+            if (t === undefined)
+                continue;
+            const last = t.pieces[t.pieces.length - 1];
+            if (last === undefined || last.quotedBy !== undefined)
+                continue;
+            if (!/[?*+@!]$/.test(text.slice(last.span[0], last.span[1])))
+                continue;
+            let j = last.span[1];
+            while (text[j] === "\\" && (text[j + 1] === "\n" || (text[j + 1] === "\r" && text[j + 2] === "\n")))
+                j += text[j + 1] === "\r" ? 3 : 2;
+            if (text[j] === "(")
+                return true;
+        }
+    }
+    return false;
+}
+function wordHasBraceList(w) {
+    return w.pieces.some((p) => p.expansion?.kind === "brace");
+}
+function optionWordCarriesGlob(w) {
+    if (!w.pieces.some(isGlobPiece))
+        return false;
+    const atoms = patternAtoms(w.pieces);
+    if (atoms === undefined)
+        return UNREADABLE_GLOB_IS_A_REBINDING;
+    try {
+        const reversed = atoms.slice().reverse();
+        return closureReaches(atoms, "-") && (closureReaches(reversed, "EMOH") || closureReaches(reversed, "]"));
+    }
+    catch {
+        return UNREADABLE_GLOB_IS_A_REBINDING;
+    }
+}
+const UNREADABLE_GLOB_IS_A_REBINDING = true;
+function escapeRegExp(s) {
+    return s.replace(/[\\^$.*+?()[\]{}|]/g, "\\$&");
+}
+function globMayMatchHome(w) {
+    if (!w.pieces.some(isGlobPiece))
+        return false;
+    const atoms = patternAtoms(w.pieces);
+    if (atoms === undefined)
+        return UNREADABLE_GLOB_IS_A_REBINDING;
+    try {
+        if (new RegExp(`^${atoms.join("")}$`).test("HOME"))
+            return true;
+        return closureReaches(atoms, "HOME[") && closureReaches(atoms.slice().reverse(), "]");
+    }
+    catch {
+        return UNREADABLE_GLOB_IS_A_REBINDING;
+    }
+}
+function patternAtoms(pieces) {
+    const atoms = [];
+    for (const p of pieces) {
+        if (p.literal !== undefined && p.expansion === undefined) {
+            for (const ch of p.literal)
+                atoms.push(caseFoldedChar(ch));
             continue;
         }
-        if (open !== undefined && open === ch) {
-            open = undefined;
-            wordStart = wordStart && !quoteHadContent;
-            out += ch;
+        if (isGlobPiece(p)) {
+            const body = p.expansion.body;
+            if (body === undefined) {
+                atoms.push(RUN_ATOM);
+                continue;
+            }
+            const cls = translateBracket(body);
+            if (cls === undefined)
+                return undefined;
+            atoms.push(cls);
             continue;
         }
-        if (open !== undefined)
-            quoteHadContent = true;
-        if (open === undefined && /[\s;|&]/.test(ch)) {
-            wordStart = true;
-            out += ch;
+        atoms.push(RUN_ATOM);
+    }
+    return atoms;
+}
+const RUN_ATOM = ".*";
+function caseFoldedChar(ch) {
+    const lower = ch.toLowerCase();
+    const upper = ch.toUpperCase();
+    return lower !== upper ? `[${escapeRegExp(lower)}${escapeRegExp(upper)}]` : escapeRegExp(ch);
+}
+function closureReaches(atoms, target) {
+    let re = "";
+    for (let i = atoms.length - 1; i >= 0; i--)
+        re = `(?:${atoms[i]}${re})?`;
+    return new RegExp(`^${re}$`).test(target);
+}
+function scanBracketBody(body) {
+    const members = [];
+    let computed = false;
+    for (let i = 0; i < body.length; i++) {
+        const c = body[i];
+        if (c === "\\") {
+            if (i + 1 < body.length)
+                members.push({ ch: body[++i], unquoted: false });
             continue;
         }
-        if (ch === "$" && wordStart && ((open === '"' && quotedIsExact) || (open === undefined && unquotedIsExact))) {
-            const m = (open === '"' ? DOUBLE_QUOTED_HOME_WORD : UNQUOTED_HOME_WORD).exec(command.slice(i));
-            if (m !== null) {
-                wordStart = false;
-                if (open === '"')
-                    quoteHadContent = true;
-                out += homeDir;
-                i += m[0].length - 1;
-                continue;
-            }
+        if (c === "$" || c === "`" || c === "{")
+            computed = true;
+        members.push({ ch: c, unquoted: true });
+    }
+    return { members, computed };
+}
+function membersOpenClassExpression(members) {
+    return members.some((m, i) => m.unquoted && m.ch === "[" && members[i + 1]?.unquoted === true && (members[i + 1].ch === ":" || members[i + 1].ch === "=" || members[i + 1].ch === "."));
+}
+function translateBracket(body) {
+    if (body.includes('"') || body.includes("'"))
+        return undefined;
+    const { members, computed } = scanBracketBody(body);
+    if (computed || membersOpenClassExpression(members))
+        return undefined;
+    let i = 0;
+    let negated = false;
+    if (members[0]?.unquoted === true && (members[0].ch === "!" || members[0].ch === "^")) {
+        negated = true;
+        i = 1;
+    }
+    const first = i;
+    let cls = "";
+    for (; i < members.length; i++) {
+        const { ch, unquoted } = members[i];
+        if (ch === "-" && unquoted && i > first && i < members.length - 1) {
+            if (!negated)
+                return undefined;
+            cls += "-";
+            continue;
         }
-        wordStart = false;
-        out += ch;
+        const escaped = ch.replace(/[\\\]\[^-]/g, "\\$&");
+        cls += !negated && ch.toLowerCase() !== ch.toUpperCase() ? `${escapeRegExp(ch.toLowerCase())}${escapeRegExp(ch.toUpperCase())}` : escaped;
     }
-    return open === undefined ? out : command;
+    return `[${negated ? "^" : ""}${cls || "\\]"}]`;
+}
+const literalWord = (w) => (w !== undefined && w.pieces.every((p) => p.literal !== undefined && p.expansion === undefined) ? w.pieces.map((p) => p.literal).join("") : undefined);
+const IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function printfNamesComputed(words) {
+    for (let i = 0; i < words.length; i++) {
+        const head = literalWord(words[i]);
+        if (head === undefined || programBasename(head) !== "printf")
+            continue;
+        for (let j = i + 1; j < words.length; j++) {
+            const lit = literalWord(words[j]);
+            const opt = lit ?? words[j].pieces[0]?.literal ?? "";
+            if (lit === "--" || !opt.startsWith("-v"))
+                break;
+            if (lit === undefined)
+                return true;
+            const name = lit === "-v" ? words[++j] : undefined;
+            if (lit === "-v" && name === undefined)
+                break;
+            if (!IDENTIFIER.test(lit === "-v" ? (literalWord(name) ?? "") : lit.slice(2)))
+                return true;
+        }
+    }
+    return false;
 }
 function segmentCompoundForReadonly(command, homeDir) {
-    const trimmed = foldHomeVariableSpelling(command, homeDir).trim();
+    const trimmed = command.trim();
     if (!trimmed)
         return { reject: "empty command" };
-    const redirectionStripped = stripExemptRedirections(trimmed);
-    const terminatorStripped = redirectionStripped.endsWith(";")
-        ? redirectionStripped.slice(0, -1)
-        : redirectionStripped;
-    return splitShellCompoundSegments(terminatorStripped, { trailingTerminator: "keep" });
+    const terminatorStripped = trimmed.endsWith(";") ? trimmed.slice(0, -1) : trimmed;
+    return splitShellCompoundSegments(terminatorStripped, { trailingTerminator: "keep", redirection: "data-free", ...(homeDir !== undefined ? { homeDir } : {}) });
 }
 export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
     const split = segmentCompoundForReadonly(command, boundary?.homeDir);
     if ("reject" in split)
         return { reason: split.reject };
     const { segments, pipeFed } = split;
+    const homeRebound = boundary?.homeDir !== undefined && homeMayBeRebound(command);
     let nameRefusal;
     const unlistedSegments = new Set();
     const reheaded = new Map();
     for (let si = 0; si < segments.length; si++) {
-        const toks = tokenizeSegment(segments[si]);
+        const words = argvOf(split.lexed[si]);
+        const toks = segmentSpellings(words, boundary?.homeDir, homeRebound);
         const folded = toks.folded;
-        const pos = readProgramPosition(toks);
+        const pos = readProgramPosition(words);
         const from = pos.written ?? folded.length;
         const written = folded[from];
         if (written === undefined)
             return { reason: "empty command" };
         if (written === "coproc")
             return { reason: "`coproc` backgrounds a command — a backgrounded process outlives the command" };
-        if (isBareControlWord(toks, from, SHELL_BLOCK_WORDS)) {
+        if (isBareControlWord(words, from, SHELL_BLOCK_WORDS)) {
             unlistedSegments.add(si);
             nameRefusal ??= `command "${written}" is not in the read-only allowlist`;
             continue;
@@ -1682,13 +1784,16 @@ export function classifyCompoundReadonlyDetailed(command, allow, boundary) {
         if (unlistedSegments.has(si))
             continue;
         const rehead = reheaded.get(si);
-        const segmentTokens = rehead === undefined ? tokenizeSegment(segments[si]) : reheadSegment(tokenizeSegment(segments[si]), rehead.head, rehead.from);
+        const words = argvOf(split.lexed[si]);
+        const spelled = segmentSpellings(words, boundary?.homeDir, homeRebound);
+        const segmentTokens = rehead === undefined ? spelled : reheadSegment(spelled, rehead.head, rehead.from);
+        const argWords = words.slice((rehead?.from ?? 0) + 1);
         const toks = segmentTokens.folded;
         if (toks.length === 0)
             continue;
         foldedSegments.push(segmentTokens);
         const name = toks[0];
-        const guardReason = guardedVerbFormReason(name, toks, segmentTokens.raw);
+        const guardReason = guardedVerbFormReason(name, toks, argWords);
         if (guardReason !== undefined) {
             shapeRefusal ??= guardReason;
             continue;
@@ -1776,31 +1881,53 @@ export const POLL_LOOP_MAX_BEATS = 120;
 export const POLL_LOOP_MAX_SLEEP_SECONDS = 600;
 const POLL_BODY_HARD_REJECT = /[<>$()`|&{}\n\r\\]/;
 const NON_ASCII_WHITESPACE = /[^\S \t]/;
-const POLL_LOOP_SHAPE = /^for[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+in[ \t]+(.+?)[ \t]*;[ \t]*do[ \t]+(.+?)[ \t]*;[ \t]*done[ \t]*;?$/;
-function pollLoopQuotesBalanced(s) {
-    let open;
-    for (const ch of s) {
-        if (open === undefined && (ch === '"' || ch === "'"))
-            open = ch;
-        else if (open === ch)
-            open = undefined;
-    }
-    return open === undefined;
+const NOT_A_POLL_LOOP = "not a bounded read-only poll loop (`for <v> in <literal bound>; do <read commands>; done` is the only accepted control structure)";
+function pollLoopShapeOf(lexed) {
+    const segments = [...lexed.segments];
+    const last = segments[segments.length - 1];
+    if (last !== undefined && last.tokens.length === 0 && last.connector === ";" && segments.length > 1)
+        segments.pop();
+    if (segments.length < 3)
+        return undefined;
+    const bare = (w, text) => w !== undefined && w.raw === w.folded && w.folded === text;
+    const onlyWords = (s) => s.tokens.every((t) => t.kind === "word");
+    const head = segments[0];
+    if (!onlyWords(head))
+        return undefined;
+    const hw = argvOf(head);
+    if (!bare(hw[0], "for") || !bare(hw[2], "in") || hw.length < 4)
+        return undefined;
+    const name = hw[1];
+    if (name.raw !== name.folded || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name.folded))
+        return undefined;
+    const done = segments[segments.length - 1];
+    const dw = argvOf(done);
+    if (done.connector !== ";" || !onlyWords(done) || dw.length !== 1 || !bare(dw[0], "done"))
+        return undefined;
+    const first = segments[1];
+    if (first.connector !== ";")
+        return undefined;
+    const fw = argvOf(first);
+    if (!bare(fw[0], "do") || fw.length < 2)
+        return undefined;
+    const body = [{ words: fw.slice(1), segment: first }];
+    for (const s of segments.slice(2, -1))
+        body.push({ words: argvOf(s), segment: s });
+    return { varName: name.folded, iterable: hw.slice(3), body };
 }
 function pollLoopBeatsOf(iterable) {
-    const seq = /^\$\(seq[ \t]+(\d{1,7})[ \t]+(\d{1,7})\)$/.exec(iterable);
-    const brace = seq === null ? /^\{(\d{1,7})\.\.(\d{1,7})\}$/.exec(iterable) : null;
+    const one = iterable.length === 1 && iterable[0].pieces.length === 1 ? iterable[0].pieces[0].expansion : undefined;
+    const seq = one?.kind === "command" ? /^seq[ \t]+(\d{1,7})[ \t]+(\d{1,7})$/.exec(one.body ?? "") : null;
+    const brace = seq === null && one?.kind === "brace" ? /^(\d{1,7})\.\.(\d{1,7})$/.exec(one.body ?? "") : null;
     const range = seq ?? brace;
     if (range !== null) {
         const lo = Number(range[1]);
         const hi = Number(range[2]);
         return hi >= lo ? hi - lo + 1 : undefined;
     }
-    const items = iterable.split(/[ \t]+/);
-    return items.every((t) => /^[A-Za-z0-9_.-]{1,64}$/.test(t)) ? items.length : undefined;
+    return iterable.every((w) => w.raw === w.folded && w.expansions.length === 0 && /^[A-Za-z0-9_.-]{1,64}$/.test(w.raw)) ? iterable.length : undefined;
 }
-function pollLoopSleepReason(segment) {
-    const toks = segment.split(/[ \t]+/);
+function pollLoopSleepReason(toks) {
     if (toks.length !== 2)
         return "`sleep` in a poll loop must take exactly one literal numeric argument";
     const v = toks[1];
@@ -1816,42 +1943,47 @@ export function classifyBoundedReadonlyPollLoopDetailed(command, allow, boundary
     if (NON_ASCII_WHITESPACE.test(command)) {
         return { reason: "the command contains a non-ASCII or control whitespace character (only space and tab are allowed) — its word boundaries cannot be read the way bash would split them, so it is not auto-allowed" };
     }
-    const trimmed = foldHomeVariableSpelling(command, boundary?.homeDir).trim();
+    const trimmed = command.trim();
     if (!trimmed)
         return { reason: "empty command" };
-    if (!pollLoopQuotesBalanced(trimmed)) {
-        return { reason: "unbalanced quote — the command's structure cannot be read reliably, so it is not auto-allowed" };
-    }
-    const m = POLL_LOOP_SHAPE.exec(trimmed);
-    if (m === null) {
-        return { reason: "not a bounded read-only poll loop (`for <v> in <literal bound>; do <read commands>; done` is the only accepted control structure)" };
+    const lexed = lexShell(trimmed);
+    if ("parseFailure" in lexed) {
+        const r = lexed.parseFailure.reason;
+        if (r === "unterminated_single_quote" || r === "unterminated_double_quote" || r === "unterminated_ansi_c") {
+            return { reason: "unbalanced quote — the command's structure cannot be read reliably, so it is not auto-allowed" };
+        }
+        return { reason: NOT_A_POLL_LOOP };
     }
-    const varName = m[1];
-    const iterable = m[2];
-    const body = m[3];
-    if (!/^[a-z]$/.test(varName)) {
-        return { reason: `the loop variable "${varName}" must be a single lowercase letter — a name like PATH/IFS/LD_PRELOAD would change how the body's commands resolve` };
+    const shape = pollLoopShapeOf(lexed);
+    if (shape === undefined)
+        return { reason: NOT_A_POLL_LOOP };
+    if (!/^[a-z]$/.test(shape.varName)) {
+        return { reason: `the loop variable "${shape.varName}" must be a single lowercase letter — a name like PATH/IFS/LD_PRELOAD would change how the body's commands resolve` };
     }
-    const beats = pollLoopBeatsOf(iterable);
+    const beats = pollLoopBeatsOf(shape.iterable);
     if (beats === undefined) {
-        return { reason: `the loop bound "${iterable}" is not a recognized literal — only \`$(seq <int> <int>)\`, \`{<int>..<int>}\` (ascending) or a literal word list is accepted` };
+        return { reason: `the loop bound "${shape.iterable.map((w) => w.raw).join(" ")}" is not a recognized literal — only \`$(seq <int> <int>)\`, \`{<int>..<int>}\` (ascending) or a literal word list is accepted` };
     }
     if (beats > POLL_LOOP_MAX_BEATS) {
         return { reason: `the loop runs ${beats} iterations, above the ${POLL_LOOP_MAX_BEATS}-iteration cap for auto-allow` };
     }
-    if (POLL_BODY_HARD_REJECT.test(body)) {
-        return { reason: "the loop body may not contain redirection, pipes, backgrounding, substitution, subshells, braces, escapes, or line breaks" };
+    const homeRebound = boundary?.homeDir !== undefined && homeMayBeRebound(command);
+    const bodies = shape.body.map((b) => ({ ...b, spelled: segmentSpellings(b.words, boundary?.homeDir, homeRebound).raw }));
+    for (const b of bodies) {
+        if (b.segment.connector !== ";" || b.segment.tokens.some((t) => t.kind !== "word") || b.spelled.some((raw) => POLL_BODY_HARD_REJECT.test(raw))) {
+            return { reason: "the loop body may not contain redirection, pipes, backgrounding, substitution, subshells, braces, escapes, or line breaks" };
+        }
     }
     const readSegments = [];
-    for (const rawSegment of body.split(";")) {
-        const segment = rawSegment.trim();
-        if (segment.length === 0)
+    for (const b of bodies) {
+        if (b.words.length === 0)
             return { reason: "empty command in the loop body" };
-        const parsed = parseLeadingCommandName(segment);
+        const segment = b.spelled.join(" ");
+        const parsed = parseLeadingCommandName(segment, { quotedOperatorsAreText: true });
         if ("reject" in parsed)
             return { reason: parsed.reject };
         if (parsed.name === "sleep") {
-            const sleepReason = pollLoopSleepReason(segment);
+            const sleepReason = pollLoopSleepReason(b.spelled);
             if (sleepReason !== undefined)
                 return { reason: sleepReason };
             continue;