@sjawhar/pi-legion-envoy 5.17.2 → 5.17.4

package/dist/legion.js

@@ -33473,7 +33473,7 @@ import { logger } from "@oh-my-pi/pi-utils";
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "5.17.2",
+  version: "5.17.4",
   type: "module",
   omp: {
     extensions: [
@@ -34776,6 +34776,8 @@ function createGoLegionTool(deps) {
 import {
   closeSync,
   existsSync,
+  lstatSync,
+  opendirSync,
   openSync,
   readFileSync as readFileSync3,
   readSync,
@@ -41435,9 +41437,15 @@ function isUnset(value) {
 }
 var NO_ELEMENTS = { kind: "literal", text: "", noElements: true };
 function stored(value) {
-  if (!value.some((piece) => piece.noElements === true))
-    return value;
-  return value.map((piece) => piece.noElements === true ? literal2("") : piece);
+  const counted = value.map((piece) => {
+    if (piece.unknownCount !== true)
+      return piece;
+    const { unknownCount: _, ...rest } = piece;
+    return rest;
+  });
+  if (!counted.some((piece) => piece.noElements === true))
+    return counted;
+  return counted.map((piece) => piece.noElements === true ? literal2("") : piece);
 }
 var ANY_NAME = "\x00";
 var IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -41477,7 +41485,7 @@ function wrapRefusal(error48, site, label) {
 }
 var MAX_DEPTH = 8;
 var MAX_WALK_STEPS = 1e5;
-var WALK_LIMIT = `the guard reached its walk limit of ${MAX_WALK_STEPS} nodes; run a smaller script`;
+var WALK_LIMIT = `the guard reached its walk limit of ${MAX_WALK_STEPS} steps (syntax nodes, pattern matching, and the destination entries a copy inspects); run a smaller script, or copy into a smaller destination`;
 var MAX_ALTERNATIVES = 64;
 var MAX_PATTERN_VALUE = 512;
 var PATTERN_WORK_PER_STEP = 1024;
@@ -41500,6 +41508,10 @@ var FILE_COMMANDS = new Set([
   "rm",
   "unlink",
   "mv",
+  "cp",
+  "dd",
+  "install",
+  "ln",
   "shred",
   "truncate",
   "chmod",
@@ -41507,6 +41519,51 @@ var FILE_COMMANDS = new Set([
   "chgrp"
 ]);
 var SIGNAL_COMMANDS = new Set(["kill", "pkill", "killall", "killall5"]);
+var FIND_VALUED_PREDICATES = new Set([
+  "-amin",
+  "-anewer",
+  "-atime",
+  "-cmin",
+  "-cnewer",
+  "-ctime",
+  "-fls",
+  "-fprint",
+  "-fprint0",
+  "-fprintf",
+  "-fstype",
+  "-gid",
+  "-group",
+  "-ilname",
+  "-iname",
+  "-inum",
+  "-ipath",
+  "-iregex",
+  "-iwholename",
+  "-links",
+  "-lname",
+  "-maxdepth",
+  "-mindepth",
+  "-mmin",
+  "-mtime",
+  "-name",
+  "-newer",
+  "-newerat",
+  "-newerct",
+  "-newermt",
+  "-path",
+  "-perm",
+  "-printf",
+  "-regex",
+  "-regextype",
+  "-samefile",
+  "-size",
+  "-type",
+  "-uid",
+  "-used",
+  "-user",
+  "-wholename",
+  "-xtype"
+]);
 var FUNCTION_OUTPUT_SILENT = {
   ":": true,
   break: true,
@@ -41759,8 +41816,10 @@ function resolveArrayIndex(index, st, ctx) {
 }
 function parameter(name, quoted, st, ctx) {
   if (name === "@" || name === "*") {
-    if (st.positional === undefined)
-      return [[unknown2(`\`$${name}\` (the positional parameters)`)]];
+    if (st.positional === undefined) {
+      const piece = unknown2(`\`$${name}\` (the positional parameters)`);
+      return [[name === "*" && quoted ? piece : { ...piece, unknownCount: true }]];
+    }
     return elements(st.positional, name === "*" && quoted);
   }
   if (/^[0-9]+$/.test(name)) {
@@ -41835,11 +41894,14 @@ function parameterExpansion(part, quoted, st, ctx) {
   if (part.index === "@" || part.index === "*") {
     if (array2 !== undefined) {
       const unknownElement = array2.get(UNKNOWN_ARRAY_INDEX);
-      if (unknownElement !== undefined)
-        return [[...unknownElement]];
+      if (unknownElement !== undefined) {
+        if (part.index === "*" && quoted)
+          return [[...unknownElement]];
+        return [unknownElement.map((piece) => ({ ...piece, unknownCount: true }))];
+      }
       return elements([...array2.values()], part.index === "*" && quoted);
     }
-    return parameter(name, quoted, st, ctx);
+    return parameter(name, quoted, st, ctx).map((alt) => !(part.index === "*" && quoted) && alt.some((piece) => piece.kind === "unknown") ? alt.map((piece) => ({ ...piece, unknownCount: true })) : alt);
   }
   if (part.index !== undefined) {
     const index = resolveArrayIndex(part.index, st, ctx);
@@ -42058,10 +42120,18 @@ function braceAlternatives(part) {
     return [[{ kind: "glob", text: part.text }]];
   return inner.split(",").map((alternative) => [literal2(alternative)]);
 }
+function tildeAt(text) {
+  if (text.startsWith("~"))
+    return 0;
+  const equals = text.indexOf("=");
+  if (equals <= 0 || !IDENTIFIER.test(text.slice(0, equals)))
+    return;
+  return text.charAt(equals + 1) === "~" ? equals + 1 : undefined;
+}
 function expandPart(part, first, st, ctx) {
   switch (part.type) {
     case "Literal":
-      return [unquotedLiteral(part.text, first ? 0 : undefined, st, ctx)];
+      return [unquotedLiteral(part.text, first ? tildeAt(part.text) : undefined, st, ctx)];
     case "SingleQuoted":
     case "AnsiCQuoted":
       return [[literal2(part.value)]];
@@ -42117,7 +42187,7 @@ function textLength(pieces) {
 function expandWord(word, st, ctx) {
   let alternatives = [[]];
   if (word.parts === undefined)
-    alternatives = [unquotedLiteral(word.text, 0, st, ctx)];
+    alternatives = [unquotedLiteral(word.text, tildeAt(word.text), st, ctx)];
   else {
     word.parts.forEach((part, index) => {
       alternatives = product(alternatives, expandPart(part, index === 0, st, ctx));
@@ -42143,6 +42213,9 @@ function args(words, st, ctx) {
       if (exp.some((piece) => piece.kind === "glob")) {
         return { text: word.text, exp, fields: "unknown" };
       }
+      if (exp.some((piece) => piece.unknownCount === true)) {
+        return { text: word.text, exp, fields: "unknown" };
+      }
       if (unquoted && exp.some((piece) => piece.kind === "unknown" || /[ \t\n]/.test(piece.text))) {
         return { text: word.text, exp, fields: "unknown" };
       }
@@ -42166,6 +42239,46 @@ function literalText(exp) {
     return;
   return exp.map((piece) => piece.text).join("");
 }
+function readableWord(arg) {
+  const whole = literalText(arg.exp);
+  if (whole !== undefined)
+    return { text: whole, whole: true };
+  let text = "";
+  for (const piece of arg.exp) {
+    if (piece.kind !== "literal")
+      break;
+    text += piece.text;
+  }
+  return { text, whole: false };
+}
+function mayBeOption(arg, matches) {
+  const { text, whole } = readableWord(arg);
+  if (whole)
+    return matches(text);
+  return mayBeSomeOption(text);
+}
+function mayBeSomeOption(text) {
+  return text === "" || /^--?[a-zA-Z-]*$/.test(text);
+}
+function valueInWord(arg, count) {
+  const pieces = [];
+  let dropped = 0;
+  for (const piece of arg.exp) {
+    if (dropped >= count) {
+      pieces.push(piece);
+      continue;
+    }
+    if (piece.kind !== "literal")
+      return;
+    if (piece.text.length + dropped <= count) {
+      dropped += piece.text.length;
+      continue;
+    }
+    pieces.push({ ...piece, text: piece.text.slice(count - dropped) });
+    dropped = count;
+  }
+  return dropped < count || pieces.length === 0 ? undefined : pieces;
+}
 function visitParts(parts, st, ctx) {
   for (const part of parts ?? []) {
     switch (part.type) {
@@ -42600,6 +42713,15 @@ function spendPatternWork(work, ctx) {
 function outputChanged(before, after) {
   return before !== undefined && (after === undefined || JSON.stringify(before) !== JSON.stringify(after));
 }
+function loopValue(type, name, words) {
+  const pids = words.every((word) => {
+    const text = literalText(word.exp);
+    return text === "" || word.exp.length > 0 && word.exp.every((piece) => piece.descendantPid);
+  });
+  if (pids)
+    return [unknown2(`\`$${name}\`, a loop variable`, true)];
+  return type === "For" && words.length === 1 && words[0]?.exp[0]?.kind === "literal" && words[0].exp[0].text !== "" && !words[0].exp[0].text.startsWith("-") && words[0]?.exp.some((piece) => piece.kind === "glob") ? words[0].exp : [unknown2(`\`$${name}\`, a loop variable`)];
+}
 function walkNode(node, st, ctx, pipeIn) {
   if (++ctx.steps.count > MAX_WALK_STEPS) {
     const site = siteOf(node, st);
@@ -42723,11 +42845,7 @@ function walkNode(node, st, ctx, pipeIn) {
         }
       } else {
         const body = clone2(st);
-        const signalSafe = words.every((word) => {
-          const text = literalText(word.exp);
-          return text === "" || word.exp.length > 0 && word.exp.every((piece) => piece.descendantPid);
-        });
-        assignScalar(body, name, signalSafe ? [unknown2(`\`$${name}\`, a loop variable`, true)] : [unknown2(`\`$${name}\`, a loop variable`)]);
+        assignScalar(body, name, loopValue(node.type, name, words));
         if (node.type === "Select")
           assignScalar(body, "REPLY", [unknown2("`$REPLY`, read from input")]);
         uncertainly(ctx, () => walkList(node.body.commands, body, ctx));
@@ -43087,6 +43205,7 @@ function operands(list, valued, longValued = []) {
   return { options, operands: found };
 }
 function unwrap2(argv, st, ctx, site) {
+  const alts = [];
   let list = argv;
   let state = st;
   for (let guard = 0;guard < 16; guard += 1) {
@@ -43095,13 +43214,19 @@ function unwrap2(argv, st, ctx, site) {
       break;
     const base = path4.basename(name);
     const rest = list.slice(1);
-    const skip = (valued, longValued = []) => {
+    const skip = (valued, longValued = [], positional = false) => {
       let i = 0;
       for (;i < rest.length; i += 1) {
-        const text = literalText(rest[i]?.exp);
+        const arg = rest[i];
+        const text = literalText(arg.exp);
         if (text === "--")
           return rest.slice(i + 1);
-        if (text === undefined || !text.startsWith("-") || text === "-")
+        if (text === undefined) {
+          if (positional || !mayBeOption(arg, (option) => option.startsWith("-")))
+            break;
+          continue;
+        }
+        if (!text.startsWith("-") || text === "-")
           break;
         if (text.startsWith("--")) {
           if (!text.includes("=") && longValued.includes(text))
@@ -43115,8 +43240,10 @@ function unwrap2(argv, st, ctx, site) {
       }
       return rest.slice(i);
     };
-    if ((base === "busybox" || base === "toybox") && rest[0] !== undefined)
+    if ((base === "busybox" || base === "toybox") && rest[0] !== undefined && literalText(rest[0].exp) !== undefined) {
       list = rest;
+      continue;
+    }
     if (base === "sudo" || base === "doas")
       list = skip("ughpCDrtUT", ["--user", "--group"]);
     else if (base === "nice")
@@ -43128,15 +43255,23 @@ function unwrap2(argv, st, ctx, site) {
     else if (base === "command") {
       const flags = rest.map((arg) => literalText(arg.exp));
       if (flags[0] === "-v" || flags[0] === "-V")
-        return { argv: [], st: state };
+        return { argv: [], st: state, alts };
       list = skip("");
     } else if (base === "stdbuf")
       list = skip("ioe", ["--input", "--output", "--error"]);
     else if (base === "ionice")
       list = skip("cnt", ["--class", "--classdata"]);
     else if (base === "timeout") {
-      const after = skip("sk", ["--signal", "--kill-after"]);
-      list = after.slice(1);
+      const stopped = skip("sk", ["--signal", "--kill-after"], true);
+      list = stopped.slice(1);
+      for (let at = rest.length - stopped.length;at < rest.length; at += 1) {
+        if (literalText(rest[at]?.exp) !== undefined)
+          break;
+        alts.push(rest.slice(at + 1));
+      }
+      const read = skip("sk", ["--signal", "--kill-after"]);
+      if (read.length !== stopped.length)
+        alts.push(read.slice(1));
     } else if (base === "env") {
       let i = 0;
       const overlay = new Map;
@@ -43176,7 +43311,7 @@ function unwrap2(argv, st, ctx, site) {
           overlay.set(arg.exp[0].text.slice(0, arg.exp[0].text.indexOf("=")), [
             unknown2("an `env` assignment")
           ]);
-        } else
+        } else if (text === undefined && mayBeOption(arg, (option) => option.startsWith("-"))) {} else
           break;
       }
       if (i !== -1)
@@ -43193,7 +43328,7 @@ function unwrap2(argv, st, ctx, site) {
     } else
       break;
   }
-  return { argv: list, st: state };
+  return { argv: list, st: state, alts };
 }
 function runFunction(name, definition, args2, outer, ctx) {
   if (outer.runningFunctions.has(name))
@@ -43278,6 +43413,9 @@ function dispatch(invocation, outer, ctx) {
   const unwrapped = unwrap2(invocation.args, outer, ctx, invocation.site);
   const argv = unwrapped.argv;
   const st = unwrapped.st;
+  for (const other of unwrapped.alts) {
+    dispatch({ ...invocation, args: other }, clone2(outer), ctx);
+  }
   const name = literalText(argv[0]?.exp);
   if (name === undefined)
     return;
@@ -43425,15 +43563,21 @@ function dispatch(invocation, outer, ctx) {
       const leading = head[0];
       const spaced = literalText(head) === "-v";
       const joined = !spaced && leading?.kind === "literal" && leading.text.startsWith("-v") && (leading.text.length > 2 || head.length > 1);
-      if (spaced || joined) {
-        const variable = spaced ? literalText(rest[1]?.exp) : literalText([
+      const first = rest[0];
+      const mayBeV = !spaced && !joined && first !== undefined && rest[1] !== undefined && mayBeOption(first, (text) => text.startsWith("-v"));
+      if (spaced || joined || mayBeV) {
+        const variable = spaced || mayBeV ? literalText(rest[1]?.exp) : literalText([
           { ...leading, text: leading?.text.slice(2) ?? "" },
           ...head.slice(1)
         ]);
-        const printed = rest.slice(spaced ? 2 : 1);
+        const printed = rest.slice(spaced || mayBeV ? 2 : 1);
         const [format, value, ...others] = printed;
         let assigned;
-        if (literalText(format?.exp) === "%s" && value !== undefined && others.length === 0) {
+        if (mayBeV) {
+          assigned = [
+            unknown2(`\`$${variable ?? "?"}\` (printf with an option word the guard cannot read, which may be \`-v\`)`)
+          ];
+        } else if (literalText(format?.exp) === "%s" && value !== undefined && others.length === 0) {
           assigned = value.exp;
         } else {
           const text = printfText(printed, MAX_VALUE_LENGTH);
@@ -43516,24 +43660,78 @@ function dispatch(invocation, outer, ctx) {
       return;
     case "rm":
     case "unlink":
-      checkTargets(base, "delete", operands(rest, "").operands, false, st, ctx, site);
+      checkTargets(base, "delete", operands(rest, "").operands, ACTS_ON_LINK, st, ctx, site);
       return;
     case "mv": {
-      const found = operands(rest, "tS", ["--target-directory", "--suffix"]);
-      const targets = [...found.operands];
-      const at = rest.findIndex((arg) => {
-        const text = literalText(arg.exp);
-        return text === "-t" || text === "--target-directory";
-      });
-      if (at !== -1 && rest[at + 1] !== undefined)
-        targets.push(rest[at + 1]);
+      const found = writeArguments(rest, "tS", MV_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const targets = [...found.operands, ...writeDestinations(found, site)];
+      checkTargets("mv", "move", targets, ACTS_ON_LINK, st, ctx, site);
+      return;
+    }
+    case "cp": {
+      const found = writeArguments(rest, "tS", CP_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const unlinks = found.flags.has("b") || found.flags.has("--backup") || found.flags.has("--remove-destination") || found.uncertain;
+      const destinations = writeDestinations(found, site);
+      checkTargets("cp", "overwrite", destinations, unlinks ? WRITES_EITHER : WRITES_THROUGH_LINK, st, ctx, site);
+      checkCopyContents(found, destinations, st, ctx, site);
+      return;
+    }
+    case "install": {
+      const found = writeArguments(rest, "mogtS", INSTALL_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const directories = found.flags.has("d") || found.flags.has("--directory");
+      checkTargets("install", directories ? "create or change the mode of" : "overwrite", directories ? found.operands : writeDestinations(found, site), WRITES_EITHER, st, ctx, site);
+      return;
+    }
+    case "dd": {
+      const targets = [];
       for (const arg of rest) {
-        const text = literalText(arg.exp);
-        if (text?.startsWith("--target-directory=")) {
-          targets.push({ text: arg.text, exp: [literal2(text.slice(19))] });
+        const { text, whole } = readableWord(arg);
+        if (whole && longOption(text, ["--help", "--version"]) !== undefined)
+          return;
+        if (text.startsWith("of=")) {
+          const carried = valueInWord(arg, 3);
+          targets.push({
+            text: arg.text,
+            exp: carried ?? [unknown2("an `of=` operand the guard cannot read")]
+          });
+          continue;
+        }
+        if (!whole && "of=".startsWith(text)) {
+          targets.push({
+            text: arg.text,
+            exp: [unknown2("a `dd` operand the guard cannot read, which may name its `of=` file")]
+          });
         }
       }
-      checkTargets("mv", "move", targets, false, st, ctx, site);
+      checkTargets("dd", "write", targets, WRITES_THROUGH_LINK, st, ctx, site);
+      return;
+    }
+    case "ln": {
+      const found = writeArguments(rest, "St", LN_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const sole = found.operands[0];
+      const single = found.operands.length === 1 && found.directory === undefined && !found.uncertain && sole !== undefined && readableWord(sole).whole;
+      const destinations = single ? [{ text: ".", exp: [literal2(".")] }] : writeDestinations(found, site);
+      checkTargets("ln", "overwrite", destinations, WRITES_EITHER, st, ctx, site);
+      const symbolic = found.flags.has("s") || found.flags.has("--symbolic");
+      if (!symbolic) {
+        const sources = found.operands.filter((arg) => !destinations.includes(arg));
+        checkTargets("ln", "hard-link", sources, LINKS_TO, st, ctx, site);
+      }
+      return;
+    }
+    case "sed": {
+      const writes = sedWrites(rest);
+      const program = writes.inferred ? "sed, whose option word the guard cannot read and which may be `-i`," : "sed -i";
+      checkTargets(program, "rewrite in place", writes.replaced, WRITES_LINK, st, ctx, site);
+      checkTargets(program, "rewrite in place", writes.followed, WRITES_EITHER, st, ctx, site);
       return;
     }
     case "rsync": {
@@ -43555,41 +43753,48 @@ function dispatch(invocation, outer, ctx) {
         "--remote-option",
         "--rsync-path",
         "--temp-dir"
-      ]).operands.at(-1);
+      ]).operands.filter(passesAnArgument).at(-1);
       if (destination !== undefined) {
-        checkTargets("rsync", "synchronize and delete into", [destination], true, st, ctx, site);
+        checkTargets("rsync", "synchronize and delete into", [destination], ACTS_THROUGH_LINK, st, ctx, site);
       }
       return;
     }
     case "tar":
     case "unzip": {
       const extracting = base === "unzip" || rest.some((arg, index) => {
-        const text = literalText(arg.exp);
-        return text === "--extract" || text === "--get" || text?.startsWith("-") === true && !text.startsWith("--") && text.includes("x") || index === 0 && /^[A-Za-z]*x[A-Za-z]*$/.test(text ?? "");
+        const { text, whole } = readableWord(arg);
+        if (!whole && index === 0 && /^[A-Za-z]*$/.test(text))
+          return true;
+        return mayBeOption(arg, (mode) => mode === "--extract" || mode === "--get" || mode.startsWith("-") && !mode.startsWith("--") && mode.includes("x") || index === 0 && /^[A-Za-z]*x[A-Za-z]*$/.test(mode));
       });
       if (!extracting)
         return;
       const targetDirectories = [];
       const short = base === "tar" ? "-C" : "-d";
       const long = base === "tar" ? "--directory" : "--destination";
+      const letter = short.slice(1);
       for (const [index, arg] of rest.entries()) {
-        const text = literalText(arg.exp);
-        if (text === short || text === long) {
+        const { text, whole } = readableWord(arg);
+        const clusterAt = text.startsWith("-") && !text.startsWith("--") ? text.indexOf(letter, 1) : -1;
+        const carried = text.startsWith(`${long}=`) ? valueInWord(arg, long.length + 1) : clusterAt !== -1 && (!whole || text.length > clusterAt + 1) ? valueInWord(arg, clusterAt + 1) : undefined;
+        if (carried !== undefined) {
+          targetDirectories.push({ text: arg.text, exp: carried });
+          continue;
+        }
+        if (clusterAt !== -1 || mayBeOption(arg, (option) => option === short || option === long)) {
           const target = rest[index + 1];
           if (target !== undefined)
             targetDirectories.push(target);
-        } else if (text?.startsWith(`${long}=`)) {
-          targetDirectories.push({ text: arg.text, exp: [literal2(text.slice(long.length + 1))] });
         }
       }
-      checkTargets(base, "extract and overwrite in", targetDirectories, true, st, ctx, site);
+      checkTargets(base, "extract and overwrite in", targetDirectories, ACTS_THROUGH_LINK, st, ctx, site);
       return;
     }
     case "shred":
-      checkTargets("shred", "shred", operands(rest, "ns", ["--iterations", "--size", "--random-source"]).operands, false, st, ctx, site);
+      checkTargets("shred", "shred", operands(rest, "ns", ["--iterations", "--size", "--random-source"]).operands, ACTS_ON_BOTH, st, ctx, site);
       return;
     case "truncate":
-      checkTargets("truncate", "truncate", operands(rest, "sr", ["--size", "--reference"]).operands, true, st, ctx, site);
+      checkTargets("truncate", "truncate", operands(rest, "sr", ["--size", "--reference"]).operands, ACTS_THROUGH_LINK, st, ctx, site);
       return;
     case "chmod":
     case "chown":
@@ -43627,41 +43832,73 @@ function dispatch(invocation, outer, ctx) {
     case "killall":
     case "killall5":
       throw new Refusal(site.snippet, site.line, `${base} selects processes by name or pattern, which reaches other agents' processes on a ` + "shared machine; a pane signals only processes it started. Stop a process you started " + 'with the hub tool (`op: "stop"`), or `kill` the pid of a child you started from this pane');
-    case "fuser":
-      if (rest.some((arg) => /^-[a-zA-Z]*k/.test(literalText(arg.exp) ?? ""))) {
+    case "fuser": {
+      const kills = rest.some((arg) => mayBeOption(arg, (text) => /^-[a-zA-Z]*k/.test(text) || text === "--kill"));
+      const readable2 = rest.every((arg) => literalText(arg.exp) !== undefined);
+      const mayBeSeveral = rest.some((arg) => arg.fields === "unknown");
+      if (kills && (readable2 || mayBeSeveral || rest.length > 1)) {
         throw new Refusal(site.snippet, site.line, "`fuser -k` kills every process using a file, other agents' included; a pane signals only " + "processes it started");
       }
       return;
+    }
     case "tmux": {
       let socket;
       let socketIsPath = false;
-      for (let i = 0;i < rest.length; i += 1) {
-        const text = literalText(rest[i]?.exp);
-        if (text === "-L" || text === "-S" || text === "--socket") {
-          socket = rest[i + 1];
-          socketIsPath = text !== "-L";
-          i += 1;
-        } else if (text?.startsWith("--socket=")) {
-          socket = { text, exp: [literal2(text.slice(9))] };
-          socketIsPath = true;
+      let current = { words: [], speculative: false };
+      const segments = [current];
+      for (const arg of rest) {
+        const word = literalText(arg.exp);
+        const trailing = word !== ";" && word !== undefined && word.endsWith(";");
+        if (trailing)
+          current.words.push({ text: arg.text, exp: [literal2(word.slice(0, -1))] });
+        else if (word !== ";")
+          current.words.push(arg);
+        if (word === ";" || trailing) {
+          current = { words: [], speculative: false };
+          segments.push(current);
+        } else if (word === undefined || arg.fields === "unknown") {
+          current = { words: [], speculative: true };
+          segments.push(current);
         }
       }
       const killCommands = ["kill-server", "kill-session", "kill-window", "kill-pane"];
       const respawnCommands = ["respawn-pane", "respawn-window"];
-      const respawning = rest.some((arg) => {
-        const text = literalText(arg.exp);
-        if (text === undefined)
-          return false;
-        const compact = text.replace("-", "");
-        return respawnCommands.filter((command) => command.replace("-", "").startsWith(compact)).length === 1;
-      }) && rest.some((arg) => literalText(arg.exp) === "-k");
-      const killing = rest.find((arg) => {
-        const text = literalText(arg.exp);
-        if (text === undefined)
+      const names = (word, commands) => {
+        if (word === undefined)
           return false;
+        const { text, whole } = readableWord(word);
         const compact = text.replace("-", "");
-        return killCommands.filter((command) => command.replace("-", "").startsWith(compact)).length === 1 || respawning;
-      });
+        const normalized = commands.map((command) => command.replace("-", ""));
+        return whole ? completeName(compact, normalized) !== undefined : normalized.some((command) => command.startsWith(compact));
+      };
+      let killing;
+      for (const segment of segments) {
+        const words = segment.words;
+        let subcommand;
+        for (let i = 0;i < words.length; i += 1) {
+          const arg = words[i];
+          const { text, whole } = readableWord(arg);
+          const attached = (option) => text.startsWith(option) && (!whole || text.length > option.length) ? valueInWord(arg, option.length) : undefined;
+          const carried = attached("-L") ?? attached("-S") ?? attached("--socket=");
+          if (carried !== undefined) {
+            socket = { text: arg.text, exp: carried };
+            socketIsPath = !text.startsWith("-L");
+          } else if (text === "-L" || text === "-S" || text === "--socket") {
+            socket = words[i + 1];
+            socketIsPath = text !== "-L";
+            i += 1;
+          } else if (text === "-f" || text === "-T") {
+            i += 1;
+          } else if (subcommand === undefined && !text.startsWith("-")) {
+            subcommand = arg;
+          }
+        }
+        if (segment.speculative && (subcommand === undefined || readableWord(subcommand).text === ""))
+          continue;
+        const respawning = names(subcommand, respawnCommands) && words.some((arg) => mayBeOption(arg, (text) => text === "-k"));
+        if (names(subcommand, killCommands) || respawning)
+          killing ??= subcommand;
+      }
       if (killing === undefined)
         return;
       let resolvedSocket;
@@ -43685,13 +43922,19 @@ function dispatch(invocation, outer, ctx) {
       if (resolvedSocket !== undefined && judgePath(resolvedSocket, st, ctx, { follow: true, overwrite: false }).ok) {
         return;
       }
-      throw new Refusal(site.snippet, site.line, `\`tmux ${literalText(killing.exp)}\` needs a socket path inside this pane's roots; the ` + "resolved socket can end panes and processes this pane did not start");
+      throw new Refusal(site.snippet, site.line, `\`tmux ${killing.text}\` needs a socket path inside this pane's roots; the ` + "resolved socket can end panes and processes this pane did not start");
+    }
+    case "busybox":
+    case "toybox": {
+      if (rest.length === 0)
+        return;
+      throw new Refusal(site.snippet, site.line, `the guard cannot read the applet \`${rest[0].text}\` ${base} would run, and the ` + "applets it carries include `rm`, `sh` and `killall`, which reach paths and processes " + `this pane did not start; name the applet (\`${base} rm \u2026\`) so it can be checked`);
     }
     default:
       break;
   }
-  if (SHELLS.has(base) || base === "busybox" && SHELLS.has(literalText(rest[0]?.exp) ?? "")) {
-    runShell(base === "busybox" ? rest.slice(1) : rest, invocation, st, ctx);
+  if (SHELLS.has(base)) {
+    runShell(rest, invocation, st, ctx);
     return;
   }
   const interpreter = interpreterLanguage(base);
@@ -43721,8 +43964,9 @@ function changeDirectory(target, st, ctx) {
 function declaration(builtin, list, st, ctx, site) {
   const options = list.map((arg) => literalText(arg.exp) ?? "").filter((text) => /^[-+][a-zA-Z]+$/.test(text));
   const option = (letter) => options.some((text) => text.startsWith("-") && text.includes(letter));
-  if (builtin !== "export" && option("n")) {
-    throw new Refusal(site.snippet, site.line, "the guard does not follow a nameref (`declare -n`), whose writes land in the variable it names");
+  const mayBeNameref = list.some((arg) => mayBeOption(arg, (text) => /^-[a-zA-Z]*n/.test(text)));
+  if (builtin !== "export" && mayBeNameref) {
+    throw new Refusal(site.snippet, site.line, option("n") ? "the guard does not follow a nameref (`declare -n`), whose writes land in the variable it names" : `an option word \`${builtin}\` carries that the guard cannot read may be \`-n\`, a nameref ` + "whose writes land in the variable it names and which the guard does not follow; write " + "the option as a literal");
   }
   if (option("f") || option("F"))
     return;
@@ -43869,11 +44113,50 @@ function nameAndValue(arg) {
   }
   return { name, value: undefined };
 }
-function checkTargets(program, verb, targets, follow, st, ctx, site) {
+var ACTS_ON_LINK = {
+  followed: false,
+  unfollowed: true,
+  overwrite: false
+};
+var ACTS_THROUGH_LINK = {
+  followed: true,
+  unfollowed: false,
+  overwrite: false
+};
+var ACTS_ON_BOTH = {
+  followed: true,
+  unfollowed: true,
+  overwrite: false
+};
+var WRITES_THROUGH_LINK = {
+  followed: true,
+  unfollowed: false,
+  overwrite: true
+};
+var WRITES_LINK = {
+  followed: false,
+  unfollowed: true,
+  overwrite: true
+};
+var WRITES_EITHER = {
+  followed: true,
+  unfollowed: true,
+  overwrite: true
+};
+var LINKS_TO = {
+  followed: true,
+  unfollowed: false,
+  overwrite: true
+};
+function checkTargets(program, verb, targets, reach, st, ctx, site) {
   for (const target of targets) {
-    const verdict = judgePath(target.exp, st, ctx, { follow, overwrite: false });
-    if (!verdict.ok) {
-      throw refusal(site, `${program} would ${verb} \`${target.text}\` (${verdict.resolution})`, ctx);
+    for (const follow of [true, false]) {
+      if (!(follow ? reach.followed : reach.unfollowed))
+        continue;
+      const verdict = judgePath(target.exp, st, ctx, { follow, overwrite: reach.overwrite });
+      if (!verdict.ok) {
+        throw refusal(site, `${program} would ${verb} \`${target.text}\` (${verdict.resolution})`, ctx);
+      }
     }
     const text = literalText(target.exp);
     if (text !== undefined && (text.startsWith("/") || st.cwd !== undefined)) {
@@ -43881,6 +44164,339 @@ function checkTargets(program, verb, targets, follow, st, ctx, site) {
     }
   }
 }
+function completeName(prefix, names) {
+  if (names.includes(prefix))
+    return prefix;
+  const reachable = names.filter((name) => name.startsWith(prefix));
+  return reachable.length === 1 ? reachable[0] : undefined;
+}
+function longOption(text, names) {
+  return completeName(text.split("=", 1)[0], names);
+}
+var GNU_INFORMATION = { "--help": false, "--version": false };
+var MV_OPTIONS = {
+  "--backup": false,
+  "--context": false,
+  "--debug": false,
+  "--force": false,
+  "--interactive": false,
+  "--no-clobber": false,
+  "--no-copy": false,
+  "--no-target-directory": false,
+  "--strip-trailing-slashes": false,
+  "--suffix": true,
+  "--target-directory": true,
+  "--update": false,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+var CP_OPTIONS = {
+  "--archive": false,
+  "--attributes-only": false,
+  "--backup": false,
+  "--context": false,
+  "--copy-contents": false,
+  "--debug": false,
+  "--dereference": false,
+  "--force": false,
+  "--interactive": false,
+  "--link": false,
+  "--no-clobber": false,
+  "--no-dereference": false,
+  "--no-preserve": true,
+  "--no-target-directory": false,
+  "--one-file-system": false,
+  "--parents": false,
+  "--preserve": false,
+  "--recursive": false,
+  "--reflink": false,
+  "--remove-destination": false,
+  "--sparse": true,
+  "--strip-trailing-slashes": false,
+  "--suffix": true,
+  "--symbolic-link": false,
+  "--target-directory": true,
+  "--update": false,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+var INSTALL_OPTIONS = {
+  "--backup": false,
+  "--compare": false,
+  "--context": false,
+  "--debug": false,
+  "--directory": false,
+  "--group": true,
+  "--mode": true,
+  "--no-target-directory": false,
+  "--owner": true,
+  "--preserve-context": false,
+  "--preserve-timestamps": false,
+  "--strip": false,
+  "--strip-program": true,
+  "--suffix": true,
+  "--target-directory": true,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+var LN_OPTIONS = {
+  "--backup": false,
+  "--directory": false,
+  "--force": false,
+  "--interactive": false,
+  "--logical": false,
+  "--no-dereference": false,
+  "--no-target-directory": false,
+  "--physical": false,
+  "--relative": false,
+  "--suffix": true,
+  "--symbolic": false,
+  "--target-directory": true,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+function passesAnArgument(arg) {
+  return arg.fields !== "none";
+}
+function writeArguments(rest, valued, long) {
+  const names = Object.keys(long);
+  const operands2 = [];
+  const flags = new Set;
+  let directory;
+  let uncertain;
+  for (let i = 0;i < rest.length; i += 1) {
+    const arg = rest[i];
+    const { text, whole } = readableWord(arg);
+    if (whole && text === "--") {
+      operands2.push(...rest.slice(i + 1).filter(passesAnArgument));
+      break;
+    }
+    if (!whole || !text.startsWith("-") || text === "-") {
+      if (!whole && mayBeSomeOption(text))
+        uncertain = arg;
+      if (passesAnArgument(arg))
+        operands2.push(arg);
+      continue;
+    }
+    let takesValue = false;
+    let offset;
+    if (text.startsWith("--")) {
+      const option = longOption(text, names);
+      if (option === undefined)
+        continue;
+      flags.add(option);
+      takesValue = long[option] === true && !text.includes("=");
+      if (option === "--target-directory")
+        offset = text.indexOf("=") + 1 || text.length;
+    } else {
+      for (let index = 1;index < text.length; index += 1) {
+        const letter = text.charAt(index);
+        flags.add(letter);
+        if (!valued.includes(letter))
+          continue;
+        takesValue = index === text.length - 1;
+        if (letter === "t")
+          offset = index + 1;
+        break;
+      }
+    }
+    const next = takesValue ? rest[i + 1] : undefined;
+    if (takesValue)
+      i += 1;
+    if (offset === undefined)
+      continue;
+    const value = valueInWord(arg, offset);
+    directory = value === undefined ? next : { text: arg.text, exp: value };
+  }
+  return { operands: operands2, flags, directory, uncertain };
+}
+function writeDestinations(found, site) {
+  if (found.operands.length > 1 && (found.flags.has("T") || found.flags.has("--no-target-directory"))) {
+    return [found.operands.at(-1)];
+  }
+  if (found.directory !== undefined && !found.uncertain)
+    return [found.directory];
+  if (found.operands.length < 2 || found.uncertain) {
+    const word = found.uncertain?.text ?? found.operands.at(-1)?.text ?? "missing destination";
+    throw new Refusal(site.snippet, site.line, `the guard cannot read a write destination from \`${word}\`; put \`--\` before operands, or use \`-T\` to name the last operand as the destination`);
+  }
+  return [found.operands.at(-1)];
+}
+function checkCopyContents(found, destinations, st, ctx, site) {
+  const recursive = found.uncertain || ["r", "R", "a", "--recursive", "--archive"].some((flag) => found.flags.has(flag));
+  const direct = found.flags.has("T") || found.flags.has("--no-target-directory");
+  for (const destination of destinations) {
+    const text = literalText(destination.exp);
+    if (text === undefined || !path4.isAbsolute(text) && st.cwd === undefined)
+      continue;
+    const dir = realExisting(path4.resolve(st.cwd ?? "/", text));
+    if (!statSync(dir, { throwIfNoEntry: false })?.isDirectory())
+      continue;
+    for (const source of found.operands) {
+      if (destinations.includes(source))
+        continue;
+      const name = literalText(source.exp);
+      const from = name === undefined ? undefined : path4.resolve(st.cwd ?? "/", name);
+      const knownTree = from !== undefined && statSync(from, { throwIfNoEntry: false })?.isDirectory();
+      const root = direct || name === undefined ? dir : path4.join(dir, found.flags.has("--parents") ? name : path4.basename(name));
+      const pending = [root];
+      while (pending.length > 0) {
+        const target = pending.pop();
+        checkTargets("cp", "overwrite", [{ text: name === undefined ? source.text : target, exp: [literal2(target)] }], WRITES_THROUGH_LINK, st, ctx, site);
+        if (!recursive && !(name === undefined && target === root))
+          continue;
+        if (!lstatSync(target, { throwIfNoEntry: false })?.isDirectory())
+          continue;
+        const entries = opendirSync(target);
+        try {
+          for (let entry = entries.readSync();entry !== null; entry = entries.readSync()) {
+            if (++ctx.steps.count > MAX_WALK_STEPS) {
+              throw new Refusal(site.snippet, site.line, WALK_LIMIT);
+            }
+            const child = path4.join(target, entry.name);
+            if (knownTree && !existsSync(path4.join(from, path4.relative(root, child))))
+              continue;
+            pending.push(child);
+          }
+        } finally {
+          entries.closeSync();
+        }
+      }
+    }
+  }
+}
+var SED_OPTIONS = {
+  "--debug": false,
+  "--expression": true,
+  "--file": true,
+  "--follow-symlinks": false,
+  "--in-place": false,
+  "--line-length": true,
+  "--null-data": false,
+  "--posix": false,
+  "--quiet": false,
+  "--regexp-extended": false,
+  "--sandbox": false,
+  "--separate": false,
+  "--silent": false,
+  "--unbuffered": false,
+  ...GNU_INFORMATION
+};
+function sedWrites(list) {
+  const names = Object.keys(SED_OPTIONS);
+  let inPlace = false;
+  let follow = false;
+  let expression = false;
+  let splitOption = false;
+  let ended = false;
+  let reopened = false;
+  let takesNext = false;
+  const unread = [];
+  const operands2 = [];
+  for (let i = 0;i < list.length; i += 1) {
+    const arg = list[i];
+    const { text, whole } = readableWord(arg);
+    const afterUnread = takesNext;
+    takesNext = false;
+    const several = arg.fields === "unknown";
+    if (ended) {
+      operands2.push({ arg, option: false, several });
+      continue;
+    }
+    if (whole && text === "--") {
+      if (reopened)
+        operands2.push({ arg, option: false, several: false });
+      if (afterUnread)
+        reopened = true;
+      else
+        ended = true;
+      continue;
+    }
+    if (several) {
+      splitOption = true;
+      takesNext = true;
+      operands2.push({ arg, option: true, several });
+      continue;
+    }
+    if (!text.startsWith("-") || whole && text === "-") {
+      const option = !whole && text === "";
+      if (option) {
+        unread.push(arg);
+        takesNext = true;
+      }
+      operands2.push({ arg, option, several });
+      continue;
+    }
+    if (reopened)
+      operands2.push({ arg, option: false, several });
+    if (text.startsWith("--")) {
+      const option = longOption(text, names);
+      if (whole && !reopened && (option === "--help" || option === "--version")) {
+        return { replaced: [], followed: [], inPlace: false, inferred: false };
+      }
+      if (option === "--in-place")
+        inPlace = true;
+      if (option === "--follow-symlinks")
+        follow = true;
+      if (option === "--expression" || option === "--file")
+        expression = true;
+      if (option === undefined && !whole)
+        unread.push(arg);
+      if ((option === undefined ? !whole : SED_OPTIONS[option]) && !text.includes("=")) {
+        if (whole && !reopened)
+          i += 1;
+        else
+          takesNext = true;
+      }
+      continue;
+    }
+    let settled = false;
+    for (const [offset, letter] of [...text.slice(1)].entries()) {
+      if (letter === "i") {
+        inPlace = true;
+        settled = true;
+        break;
+      }
+      if ("efl".includes(letter)) {
+        if (letter !== "l")
+          expression = true;
+        if (offset === text.length - 2) {
+          if (whole && !reopened)
+            i += 1;
+          else
+            takesNext = true;
+        }
+        settled = true;
+        break;
+      }
+    }
+    if (!settled && !whole) {
+      unread.push(arg);
+      takesNext = true;
+    }
+  }
+  const unsettled = (settled) => settled ? 0 : 1;
+  const replaced = [];
+  const followed = [];
+  let before = false;
+  for (const operand of operands2) {
+    const maybe = operand.option && !operand.several;
+    const others = unread.length - (maybe ? 1 : 0);
+    const needed = unsettled(inPlace || splitOption) + unsettled(expression || splitOption || operand.several || before);
+    if (others >= needed + unsettled(follow || splitOption))
+      followed.push(operand.arg);
+    else if (others >= needed)
+      replaced.push(operand.arg);
+    if (!maybe)
+      before = true;
+  }
+  return {
+    replaced,
+    followed,
+    inPlace: inPlace || splitOption || unread.length > 0,
+    inferred: !inPlace
+  };
+}
 function checkRecursiveMode(program, list, st, ctx, site) {
   const flags = program === "chmod" ? "cfvR" : "cfvRhHLP";
   const found = [];
@@ -43907,11 +44523,20 @@ function checkRecursiveMode(program, list, st, ctx, site) {
     }
     found.push(arg);
   }
-  if (!recursive)
-    return;
-  const targets = reference ? found : found.slice(1);
   const verb = program === "chmod" ? "recursively change the mode of" : "recursively change the owner of";
-  checkTargets(`${program} -R`, verb, targets, true, st, ctx, site);
+  if (recursive) {
+    checkTargets(`${program} -R`, verb, reference ? found : found.slice(1), ACTS_THROUGH_LINK, st, ctx, site);
+    return;
+  }
+  for (const [index, arg] of found.entries()) {
+    if (!mayBeOption(arg, (text) => /^-[A-Za-z]*R/.test(text)))
+      continue;
+    const others = arg.fields === "unknown" ? found : found.filter((_, at) => at !== index);
+    const targets = reference || arg.fields === "unknown" ? others : others.slice(1);
+    if (targets.length === 0)
+      continue;
+    checkTargets(`${program} -R`, verb, targets, ACTS_THROUGH_LINK, st, ctx, site);
+  }
 }
 function checkFind(list, st, ctx, site) {
   let i = 0;
@@ -43926,17 +44551,27 @@ function checkFind(list, st, ctx, site) {
     break;
   }
   const starts = [];
+  let rootsBeforePredicate;
   for (;i < list.length; i += 1) {
-    const text = literalText(list[i]?.exp);
+    const arg = list[i];
+    const text = literalText(arg.exp);
     if (text !== undefined && (text.startsWith("-") || text === "(" || text === "!" || text === ")"))
       break;
-    starts.push(list[i]);
+    if (rootsBeforePredicate === undefined && mayBeOption(arg, (option) => option.startsWith("-"))) {
+      rootsBeforePredicate = [...starts];
+    }
+    starts.push(arg);
   }
   const targets = starts.length > 0 ? starts : [{ text: ".", exp: [literal2(".")] }];
   const expression = list.slice(i).map((arg) => literalText(arg.exp));
   let action;
   let shell;
+  let consumedByPredicate = false;
   for (const [index, word] of expression.entries()) {
+    const isValue = consumedByPredicate;
+    consumedByPredicate = word !== undefined && FIND_VALUED_PREDICATES.has(word);
+    if (word === undefined && !isValue)
+      action ??= "find with a predicate the guard cannot read";
     if (word === "-delete")
       action = "find -delete";
     if (word !== "-exec" && word !== "-execdir" && word !== "-ok" && word !== "-okdir")
@@ -43946,16 +44581,22 @@ function checkFind(list, st, ctx, site) {
       continue;
     const inner = unwrap2(list.slice(i + index + 1, i + end), st, ctx, site);
     const program = path4.basename(literalText(inner.argv[0]?.exp) ?? "");
-    if (FILE_COMMANDS.has(program) || program === "xargs")
+    if (FILE_COMMANDS.has(program) || program === "xargs" || program === "sed" && sedWrites(inner.argv.slice(1)).inPlace) {
       action = `find ${word} ${program}`;
+    }
     if (SHELLS.has(program)) {
       action = `find ${word} ${program}`;
       shell = inner.argv;
     }
   }
-  if (action === undefined)
+  if (action === undefined) {
+    if (rootsBeforePredicate === undefined)
+      return;
+    const under = rootsBeforePredicate.length > 0 ? rootsBeforePredicate : [{ text: ".", exp: [literal2(".")] }];
+    checkTargets("find with a root the guard cannot read, which may be a predicate", "delete or change what it finds under", under, ACTS_ON_LINK, st, ctx, site);
     return;
-  checkTargets(action, "delete or change what it finds under", targets, false, st, ctx, site);
+  }
+  checkTargets(action, "delete or change what it finds under", targets, ACTS_ON_LINK, st, ctx, site);
   if (shell === undefined)
     return;
   const found = targets.length === 1 ? targets[0]?.exp ?? [] : [unknown2("a path `find` found")];
@@ -43993,7 +44634,7 @@ function checkXargs(list, st, ctx, site) {
     };
   });
   const program = path4.basename(literalText(argv[0]?.exp) ?? "");
-  if (FILE_COMMANDS.has(program) || SIGNAL_COMMANDS.has(program)) {
+  if (FILE_COMMANDS.has(program) || SIGNAL_COMMANDS.has(program) || program === "sed" && sedWrites(argv.slice(1)).inPlace) {
     throw new Refusal(site.snippet, site.line, `\`xargs ${program}\` takes its targets from standard input, which the guard cannot see; name ` + `the paths or pids on the command line (or use \`find <dir> -delete\`) so it can check them`);
   }
   const overlay = new Map;
@@ -44231,7 +44872,7 @@ function runInterpreter(base, language, list, invocation, st, ctx) {
   for (;i < words.length; i += 1) {
     const word = words[i];
     if (word === undefined)
-      return;
+      continue;
     if (codeFlags.includes(word)) {
       runCode(language, list[i + 1], invocation, st, ctx, site);
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "5.17.2",
+  "version": "5.17.4",
   "type": "module",
   "omp": {
     "extensions": [