@sjawhar/pi-legion-envoy 5.17.3 → 5.17.5

package/dist/legion.js

@@ -33473,7 +33473,7 @@ import { logger } from "@oh-my-pi/pi-utils";
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "5.17.3",
+  version: "5.17.5",
   type: "module",
   omp: {
     extensions: [
@@ -34776,8 +34776,11 @@ function createGoLegionTool(deps) {
 import {
   closeSync,
   existsSync,
+  lstatSync,
+  opendirSync,
   openSync,
   readFileSync as readFileSync3,
+  readlinkSync,
   readSync,
   realpathSync,
   statSync
@@ -41435,9 +41438,15 @@ function isUnset(value) {
 }
 var NO_ELEMENTS = { kind: "literal", text: "", noElements: true };
 function stored(value) {
-  if (!value.some((piece) => piece.noElements === true))
-    return value;
-  return value.map((piece) => piece.noElements === true ? literal2("") : piece);
+  const counted = value.map((piece) => {
+    if (piece.unknownCount !== true)
+      return piece;
+    const { unknownCount: _, ...rest } = piece;
+    return rest;
+  });
+  if (!counted.some((piece) => piece.noElements === true))
+    return counted;
+  return counted.map((piece) => piece.noElements === true ? literal2("") : piece);
 }
 var ANY_NAME = "\x00";
 var IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -41477,7 +41486,7 @@ function wrapRefusal(error48, site, label) {
 }
 var MAX_DEPTH = 8;
 var MAX_WALK_STEPS = 1e5;
-var WALK_LIMIT = `the guard reached its walk limit of ${MAX_WALK_STEPS} nodes; run a smaller script`;
+var WALK_LIMIT = `the guard reached its walk limit of ${MAX_WALK_STEPS} steps (syntax nodes, pattern matching, and the destination entries a copy inspects); run a smaller script, or copy into a smaller destination`;
 var MAX_ALTERNATIVES = 64;
 var MAX_PATTERN_VALUE = 512;
 var PATTERN_WORK_PER_STEP = 1024;
@@ -41500,6 +41509,10 @@ var FILE_COMMANDS = new Set([
   "rm",
   "unlink",
   "mv",
+  "cp",
+  "dd",
+  "install",
+  "ln",
   "shred",
   "truncate",
   "chmod",
@@ -41612,6 +41625,70 @@ function realish(abs, followFinal) {
     return realExisting(resolved);
   return path4.join(realExisting(path4.dirname(resolved)), path4.basename(resolved));
 }
+function readlinkTarget(link) {
+  try {
+    return readlinkSync(link);
+  } catch {
+    return "a target the guard cannot read";
+  }
+}
+function physical(cwd, text, followFinal) {
+  const joined = text.startsWith("/") ? text : `${cwd}/${text}`;
+  const parts = joined.split("/");
+  const last = parts.findLastIndex((part) => part !== "" && part !== ".");
+  const pending = [];
+  let real = "/";
+  for (let i = 0;i < parts.length; i += 1) {
+    const part = parts[i];
+    if (part === "" || part === ".")
+      continue;
+    if (pending.length > 0) {
+      if (part === "..") {
+        return {
+          unknown: `\`${path4.join(real, ...pending)}\`, which does not exist yet, so the guard ` + "cannot know where the `..` after it leads"
+        };
+      }
+      pending.push(part);
+      continue;
+    }
+    if (part === "..") {
+      real = path4.dirname(real);
+      continue;
+    }
+    const candidate = real === "/" ? `/${part}` : `${real}/${part}`;
+    if (!followFinal && i === last) {
+      return { real: candidate };
+    }
+    let link;
+    try {
+      link = lstatSync(candidate).isSymbolicLink();
+    } catch (error48) {
+      if (error48.code !== "ENOENT") {
+        return { unknown: `\`${candidate}\`, which the guard cannot read (${messageFor(error48)})` };
+      }
+      pending.push(part);
+      continue;
+    }
+    if (!link) {
+      real = candidate;
+      continue;
+    }
+    try {
+      real = realpathSync(candidate);
+    } catch (error48) {
+      const code = error48.code;
+      const why = code === "ENOENT" ? `points at \`${readlinkTarget(candidate)}\`, which is not there` : `cannot be followed (${messageFor(error48)})`;
+      return { unknown: `the link \`${candidate}\` ${why}, so the guard cannot resolve this path` };
+    }
+  }
+  return { real: pending.length === 0 ? real : path4.join(real, ...pending) };
+}
+function kernelPath(from, text) {
+  if (from === undefined && !text.startsWith("/"))
+    return;
+  const resolved = physical(from ?? "/", text, true);
+  return "unknown" in resolved ? undefined : resolved.real;
+}
 function isProtectedScratchComponent(component, roots, partial2 = false) {
   return roots.protectedScratch.some((name) => component.startsWith(name) || partial2 && name.startsWith(component)) || roots.protectedDirectories.some((name) => component === name || partial2 && name.startsWith(component));
 }
@@ -41644,12 +41721,16 @@ function judgePath(exp, st, ctx, options) {
         resolution: `relative to a working directory unknown after ${st.cwdWhy}`
       };
     }
-    const abs = path4.resolve(st.cwd ?? "/", text);
-    const real2 = realish(abs, options.follow || text.endsWith("/"));
+    const resolved2 = physical(st.cwd ?? "/", text, options.follow || text.endsWith("/"));
+    if ("unknown" in resolved2) {
+      return { ok: false, resolution: resolved2.unknown, unresolved: true };
+    }
+    const real2 = resolved2.real;
     if (inWorkspace(real2, roots) || inScratch(real2, roots))
       return { ok: true };
     if (options.overwrite && !existsSync(real2))
       return { ok: true };
+    const abs = path4.resolve(st.cwd ?? "/", text);
     return { ok: false, resolution: real2 === abs ? real2 : `${abs}, which resolves to ${real2}` };
   }
   const piece = exp[open];
@@ -41664,11 +41745,13 @@ function judgePath(exp, st, ctx, options) {
     return { ok: false, resolution: `relative to a working directory unknown after ${st.cwdWhy}` };
   }
   const component = prefix.slice(slash + 1);
-  let stem = path4.resolve(st.cwd ?? "/", slash === -1 ? "." : slash === 0 ? "/" : prefix.slice(0, slash));
-  if (piece.kind === "glob" && (component === "" ? piece.text : component).startsWith(".")) {
-    stem = path4.dirname(stem);
+  const stemText = slash === -1 ? "." : slash === 0 ? "/" : prefix.slice(0, slash);
+  const resolved = physical(st.cwd ?? "/", stemText, true);
+  if ("unknown" in resolved) {
+    return { ok: false, resolution: resolved.unknown, unresolved: true };
   }
-  const real = realish(stem, true);
+  const dotGlob = piece.kind === "glob" && (component === "" ? piece.text : component).startsWith(".");
+  const real = dotGlob ? path4.dirname(resolved.real) : resolved.real;
   const allowed = inWorkspace(real, roots) || inScratch(real, roots) || real === roots.scratch && component !== "" && !isProtectedScratchComponent(component, roots, true);
   if (allowed)
     return { ok: true };
@@ -41804,8 +41887,10 @@ function resolveArrayIndex(index, st, ctx) {
 }
 function parameter(name, quoted, st, ctx) {
   if (name === "@" || name === "*") {
-    if (st.positional === undefined)
-      return [[unknown2(`\`$${name}\` (the positional parameters)`)]];
+    if (st.positional === undefined) {
+      const piece = unknown2(`\`$${name}\` (the positional parameters)`);
+      return [[name === "*" && quoted ? piece : { ...piece, unknownCount: true }]];
+    }
     return elements(st.positional, name === "*" && quoted);
   }
   if (/^[0-9]+$/.test(name)) {
@@ -41880,11 +41965,14 @@ function parameterExpansion(part, quoted, st, ctx) {
   if (part.index === "@" || part.index === "*") {
     if (array2 !== undefined) {
       const unknownElement = array2.get(UNKNOWN_ARRAY_INDEX);
-      if (unknownElement !== undefined)
-        return [[...unknownElement]];
+      if (unknownElement !== undefined) {
+        if (part.index === "*" && quoted)
+          return [[...unknownElement]];
+        return [unknownElement.map((piece) => ({ ...piece, unknownCount: true }))];
+      }
       return elements([...array2.values()], part.index === "*" && quoted);
     }
-    return parameter(name, quoted, st, ctx);
+    return parameter(name, quoted, st, ctx).map((alt) => !(part.index === "*" && quoted) && alt.some((piece) => piece.kind === "unknown") ? alt.map((piece) => ({ ...piece, unknownCount: true })) : alt);
   }
   if (part.index !== undefined) {
     const index = resolveArrayIndex(part.index, st, ctx);
@@ -41997,12 +42085,13 @@ function patternExpansion(part, quoted, st, ctx) {
   return [unquotedLiteral(result.replaceAll("\\", "\\\\"), undefined, st, ctx)];
 }
 function substitution(script, text, st, ctx) {
-  const pidRead = /^\$\(<(.+)\)$/.exec(text);
-  const variableRead = /^\$\(<"?\$([A-Za-z_][A-Za-z0-9_]*)"?\)$/.exec(text);
+  const pidRead = /^\$\(<\s*(.+?)\s*\)$/.exec(text);
+  const variableRead = /^\$\(<\s*"?\$([A-Za-z_][A-Za-z0-9_]*)"?\s*\)$/.exec(text);
   const directFile = pidRead?.[1]?.includes("$") === true ? undefined : pidRead?.[1];
   const file2 = directFile ?? (variableRead === null ? undefined : literalText(lookup(variableRead[1], st, ctx)));
-  if (file2 !== undefined && st.cwd !== undefined) {
-    const pid = st.pidFiles.get(path4.resolve(st.cwd, file2));
+  const pidFile = file2 === undefined ? undefined : kernelPath(st.cwd, file2);
+  if (pidFile !== undefined) {
+    const pid = st.pidFiles.get(pidFile);
     if (pid !== undefined)
       return [[...pid]];
   }
@@ -42056,22 +42145,70 @@ function substitutionInvocation(node, st, ctx) {
     return;
   return { base: path4.basename(name), command: node, rest: argv.slice(1) };
 }
+function gnuDirname(text) {
+  const trimmed = text.replace(/\/+$/, "");
+  if (trimmed === "")
+    return "/";
+  const cut = trimmed.replace(/\/+[^/]+$/, "");
+  if (cut === trimmed)
+    return ".";
+  return cut === "" ? "/" : cut;
+}
+function gnuBasename(text) {
+  const trimmed = text.replace(/\/+$/, "");
+  if (trimmed === "")
+    return text === "" ? "" : "/";
+  return trimmed.slice(trimmed.lastIndexOf("/") + 1);
+}
 function substitutionPath(base, list, st) {
   if (!["dirname", "basename", "realpath", "readlink"].includes(base))
     return;
-  const target = literalText(operands(list, "").operands.at(-1)?.exp);
-  if (target === undefined || st.cwd === undefined)
+  const found = operands(list, "");
+  if (base === "basename" && found.options.some((option) => option === "--multiple" || option.startsWith("--suffix") || /^-[^-]*[as]/.test(option))) {
+    return;
+  }
+  const suffixed = base === "basename" && found.operands.length === 2;
+  if (found.operands.length !== 1 && !suffixed)
+    return;
+  const target = literalText(found.operands[0]?.exp);
+  const suffix = suffixed ? literalText(found.operands[1]?.exp) : "";
+  if (target === undefined || suffix === undefined || st.cwd === undefined)
     return;
   if (target === "")
     return base === "dirname" ? "." : "";
-  const abs = path4.resolve(st.cwd, target);
   if (base === "dirname")
-    return path4.dirname(abs);
-  if (base === "basename")
-    return path4.basename(abs);
-  if (base === "readlink" && !list.some((arg) => literalText(arg.exp)?.includes("f")))
-    return;
-  return realExisting(abs);
+    return gnuDirname(target);
+  if (base === "basename") {
+    const name = gnuBasename(target);
+    return suffix !== "" && name !== suffix && name.endsWith(suffix) ? name.slice(0, -suffix.length) : name;
+  }
+  if (base === "readlink") {
+    const mode = lastModeFlag(found.options, "fem", {
+      "--canonicalize": "f",
+      "--canonicalize-existing": "e",
+      "--canonicalize-missing": "m"
+    });
+    if (mode !== "f" && mode !== "m")
+      return;
+  }
+  if (base === "realpath") {
+    if (found.options.some((option) => option.startsWith("--relative")))
+      return;
+    const mode = lastModeFlag(found.options, "sLP", {
+      "--strip": "s",
+      "--no-symlinks": "s",
+      "--logical": "L",
+      "--physical": "P"
+    });
+    if (mode === "s" || mode === "L") {
+      const here = kernelPath("/", st.cwd);
+      if (here === undefined)
+        return;
+      const lexical = path4.resolve(here, target);
+      return mode === "s" ? lexical : kernelPath("/", lexical);
+    }
+  }
+  return kernelPath(st.cwd, target);
 }
 function mktempPath(command, st, ctx) {
   const words = command.suffix;
@@ -42090,7 +42227,7 @@ function mktempPath(command, st, ctx) {
     else if (value.startsWith("-p") && value.length > 2)
       directory = [literal2(value.slice(2))];
     else if (!value.startsWith("-") && value.includes("/")) {
-      directory = [literal2(path4.resolve(st.cwd ?? "/", path4.dirname(value)))];
+      directory = [literal2(path4.dirname(value))];
     }
   }
   const base = directory ?? [literal2(ctx.env.TMPDIR ?? "/tmp")];
@@ -42103,10 +42240,18 @@ function braceAlternatives(part) {
     return [[{ kind: "glob", text: part.text }]];
   return inner.split(",").map((alternative) => [literal2(alternative)]);
 }
+function tildeAt(text) {
+  if (text.startsWith("~"))
+    return 0;
+  const equals = text.indexOf("=");
+  if (equals <= 0 || !IDENTIFIER.test(text.slice(0, equals)))
+    return;
+  return text.charAt(equals + 1) === "~" ? equals + 1 : undefined;
+}
 function expandPart(part, first, st, ctx) {
   switch (part.type) {
     case "Literal":
-      return [unquotedLiteral(part.text, first ? 0 : undefined, st, ctx)];
+      return [unquotedLiteral(part.text, first ? tildeAt(part.text) : undefined, st, ctx)];
     case "SingleQuoted":
     case "AnsiCQuoted":
       return [[literal2(part.value)]];
@@ -42162,7 +42307,7 @@ function textLength(pieces) {
 function expandWord(word, st, ctx) {
   let alternatives = [[]];
   if (word.parts === undefined)
-    alternatives = [unquotedLiteral(word.text, 0, st, ctx)];
+    alternatives = [unquotedLiteral(word.text, tildeAt(word.text), st, ctx)];
   else {
     word.parts.forEach((part, index) => {
       alternatives = product(alternatives, expandPart(part, index === 0, st, ctx));
@@ -42188,6 +42333,9 @@ function args(words, st, ctx) {
       if (exp.some((piece) => piece.kind === "glob")) {
         return { text: word.text, exp, fields: "unknown" };
       }
+      if (exp.some((piece) => piece.unknownCount === true)) {
+        return { text: word.text, exp, fields: "unknown" };
+      }
       if (unquoted && exp.some((piece) => piece.kind === "unknown" || /[ \t\n]/.test(piece.text))) {
         return { text: word.text, exp, fields: "unknown" };
       }
@@ -42227,6 +42375,9 @@ function mayBeOption(arg, matches) {
   const { text, whole } = readableWord(arg);
   if (whole)
     return matches(text);
+  return mayBeSomeOption(text);
+}
+function mayBeSomeOption(text) {
   return text === "" || /^--?[a-zA-Z-]*$/.test(text);
 }
 function valueInWord(arg, count) {
@@ -42522,6 +42673,10 @@ function modelPidFile(st, ctx, file2, pid) {
     model.set(file2, [unknown2("a pid a branch or loop body wrote to this file", true)]);
   }
 }
+function forgetFileModels(st, ctx, why) {
+  st.pidFiles.clear();
+  ctx.unnameableWrite.why ??= why;
+}
 function handlerVars(trap, vars) {
   const { vars: branch, merged } = trap;
   if (branch === undefined || merged === undefined)
@@ -42682,6 +42837,15 @@ function spendPatternWork(work, ctx) {
 function outputChanged(before, after) {
   return before !== undefined && (after === undefined || JSON.stringify(before) !== JSON.stringify(after));
 }
+function loopValue(type, name, words) {
+  const pids = words.every((word) => {
+    const text = literalText(word.exp);
+    return text === "" || word.exp.length > 0 && word.exp.every((piece) => piece.descendantPid);
+  });
+  if (pids)
+    return [unknown2(`\`$${name}\`, a loop variable`, true)];
+  return type === "For" && words.length === 1 && words[0]?.exp[0]?.kind === "literal" && words[0].exp[0].text !== "" && !words[0].exp[0].text.startsWith("-") && words[0]?.exp.some((piece) => piece.kind === "glob") ? words[0].exp : [unknown2(`\`$${name}\`, a loop variable`)];
+}
 function walkNode(node, st, ctx, pipeIn) {
   if (++ctx.steps.count > MAX_WALK_STEPS) {
     const site = siteOf(node, st);
@@ -42805,11 +42969,7 @@ function walkNode(node, st, ctx, pipeIn) {
         }
       } else {
         const body = clone2(st);
-        const signalSafe = words.every((word) => {
-          const text = literalText(word.exp);
-          return text === "" || word.exp.length > 0 && word.exp.every((piece) => piece.descendantPid);
-        });
-        assignScalar(body, name, signalSafe ? [unknown2(`\`$${name}\`, a loop variable`, true)] : [unknown2(`\`$${name}\`, a loop variable`)]);
+        assignScalar(body, name, loopValue(node.type, name, words));
         if (node.type === "Select")
           assignScalar(body, "REPLY", [unknown2("`$REPLY`, read from input")]);
         uncertainly(ctx, () => walkList(node.body.commands, body, ctx));
@@ -42908,13 +43068,15 @@ function checkRedirects(redirects, command, site, st, ctx) {
       if (writes || operator === ">&") {
         const verdict = judgePath(exp, st, ctx, { follow: true, overwrite: true });
         if (!verdict.ok) {
-          throw refusal(site, `the redirection \`${operator}\` would overwrite \`${redirect.target.text}\` (${verdict.resolution})`, ctx);
+          throw refusal(site, `the redirection \`${operator}\` would overwrite \`${redirect.target.text}\` (${verdict.resolution})`, ctx, verdict.unresolved);
         }
       }
       const target = literalText(exp);
-      if (target === undefined || st.cwd === undefined && !target.startsWith("/"))
+      const file2 = target === undefined ? undefined : kernelPath(st.cwd, target);
+      if (file2 === undefined) {
+        forgetFileModels(st, ctx, `the redirection \`${operator} ${redirect.target.text}\``);
         continue;
-      const file2 = path4.resolve(st.cwd ?? "/", target);
+      }
       let content = null;
       if (command?.name === "cat" && command.args.length === 0) {
         if (heredoc !== undefined)
@@ -42948,9 +43110,9 @@ function groupOutputFile(statement, st, ctx) {
   }
   const targets = expandWord(redirect.target, st, ctx);
   const target = targets.length === 1 ? literalText(targets[0]) : undefined;
-  if (target === undefined || st.cwd === undefined && !target.startsWith("/"))
+  if (target === undefined)
     return;
-  return path4.resolve(st.cwd ?? "/", target);
+  return kernelPath(st.cwd, target);
 }
 function walkRenderingGroup(group, st, ctx) {
   let content = "";
@@ -43069,8 +43231,10 @@ function printfText(list, limit, script = false) {
   } while (conversions > 0 && index < values.length);
   return out;
 }
-function refusal(site, detail, ctx) {
-  return new Refusal(site.snippet, site.line, `${detail}, outside ${describeRoots(ctx.roots)}. ${HINT}`);
+function refusal(site, detail, ctx, unresolved = false) {
+  const where = unresolved ? `. Every target is resolved as the kernel resolves it, against ${describeRoots(ctx.roots)}` : `, outside ${describeRoots(ctx.roots)}`;
+  const hint = unresolved ? "Make the unresolved path component resolvable in an earlier command \u2014 create it, make " + "it readable, or fix a dangling or looping symlink \u2014 then run this command." : HINT;
+  return new Refusal(site.snippet, site.line, `${detail}${where}. ${hint}`);
 }
 function handleCommand(command, st, ctx, pipeIn) {
   const site = siteOf(command, st);
@@ -43168,6 +43332,16 @@ function operands(list, valued, longValued = []) {
   }
   return { options, operands: found };
 }
+function lastModeFlag(options, letters, long = {}) {
+  return options.flatMap((option) => {
+    const named = long[option];
+    if (named !== undefined)
+      return [named];
+    if (!/^-[a-zA-Z]+$/.test(option))
+      return [];
+    return [...option.slice(1)].filter((letter) => letters.includes(letter));
+  }).at(-1);
+}
 function unwrap2(argv, st, ctx, site) {
   const alts = [];
   let list = argv;
@@ -43251,10 +43425,10 @@ function unwrap2(argv, st, ctx, site) {
           i += 1;
         } else if (text === "-C" || text === "--chdir") {
           const dir = literalText(rest[i + 1]?.exp);
-          cwd = dir === undefined || state.cwd === undefined ? undefined : path4.resolve(state.cwd, dir);
+          cwd = dir === undefined ? undefined : kernelPath(state.cwd, dir);
           i += 1;
         } else if (text?.startsWith("--chdir=")) {
-          cwd = state.cwd === undefined ? undefined : path4.resolve(state.cwd, text.slice(8));
+          cwd = kernelPath(state.cwd, text.slice(8));
         } else if (text === "-S" || text === "--split-string") {
           const split = literalText(rest[i + 1]?.exp);
           const tail = rest.slice(i + 2);
@@ -43421,10 +43595,25 @@ function dispatch(invocation, outer, ctx) {
         outer.output = rest.length === 1 && rest[0] !== undefined ? [...outer.output, rest[0].exp] : undefined;
       }
       return;
-    case "cd":
+    case "cd": {
+      const found = operands(rest, "");
+      if (found.options.some((option) => !/^-[LPe]+$/.test(option))) {
+        outer.cwd = undefined;
+        outer.cwdWhy = "`cd` with an option the guard does not model";
+        return;
+      }
+      changeDirectory(found.operands[0], lastModeFlag(found.options, "LP") === "P", outer, ctx);
+      return;
+    }
     case "pushd": {
-      const target = operands(rest, "").operands[0];
-      changeDirectory(target, outer, ctx);
+      const found = operands(rest, "");
+      const operand = literalText(found.operands[0]?.exp);
+      if (found.options.length > 0 || found.operands[0] === undefined || operand?.startsWith("+") === true) {
+        outer.cwd = undefined;
+        outer.cwdWhy = "`pushd` with a directory stack or option the guard does not model";
+        return;
+      }
+      changeDirectory(found.operands[0], false, outer, ctx);
       return;
     }
     case "popd":
@@ -43624,24 +43813,78 @@ function dispatch(invocation, outer, ctx) {
       return;
     case "rm":
     case "unlink":
-      checkTargets(base, "delete", operands(rest, "").operands, false, st, ctx, site);
+      checkTargets(base, "delete", operands(rest, "").operands, ACTS_ON_LINK, st, ctx, site);
       return;
     case "mv": {
-      const found = operands(rest, "tS", ["--target-directory", "--suffix"]);
-      const targets = [...found.operands];
-      const at = rest.findIndex((arg) => {
-        const text = literalText(arg.exp);
-        return text === "-t" || text === "--target-directory";
-      });
-      if (at !== -1 && rest[at + 1] !== undefined)
-        targets.push(rest[at + 1]);
+      const found = writeArguments(rest, "tS", MV_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const targets = [...found.operands, ...writeDestinations(found, site)];
+      checkTargets("mv", "move", targets, ACTS_ON_LINK, st, ctx, site);
+      return;
+    }
+    case "cp": {
+      const found = writeArguments(rest, "tS", CP_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const unlinks = found.flags.has("b") || found.flags.has("--backup") || found.flags.has("--remove-destination") || found.uncertain;
+      const destinations = writeDestinations(found, site);
+      checkTargets("cp", "overwrite", destinations, unlinks ? WRITES_EITHER : WRITES_THROUGH_LINK, st, ctx, site);
+      checkCopyContents(found, destinations, st, ctx, site);
+      return;
+    }
+    case "install": {
+      const found = writeArguments(rest, "mogtS", INSTALL_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const directories = found.flags.has("d") || found.flags.has("--directory");
+      checkTargets("install", directories ? "create or change the mode of" : "overwrite", directories ? found.operands : writeDestinations(found, site), WRITES_EITHER, st, ctx, site);
+      return;
+    }
+    case "dd": {
+      const targets = [];
       for (const arg of rest) {
-        const text = literalText(arg.exp);
-        if (text?.startsWith("--target-directory=")) {
-          targets.push({ text: arg.text, exp: [literal2(text.slice(19))] });
+        const { text, whole } = readableWord(arg);
+        if (whole && longOption(text, ["--help", "--version"]) !== undefined)
+          return;
+        if (text.startsWith("of=")) {
+          const carried = valueInWord(arg, 3);
+          targets.push({
+            text: arg.text,
+            exp: carried ?? [unknown2("an `of=` operand the guard cannot read")]
+          });
+          continue;
         }
+        if (!whole && "of=".startsWith(text)) {
+          targets.push({
+            text: arg.text,
+            exp: [unknown2("a `dd` operand the guard cannot read, which may name its `of=` file")]
+          });
+        }
+      }
+      checkTargets("dd", "write", targets, WRITES_THROUGH_LINK, st, ctx, site);
+      return;
+    }
+    case "ln": {
+      const found = writeArguments(rest, "St", LN_OPTIONS);
+      if (found.flags.has("--help") || found.flags.has("--version"))
+        return;
+      const sole = found.operands[0];
+      const single = found.operands.length === 1 && found.directory === undefined && !found.uncertain && sole !== undefined && readableWord(sole).whole;
+      const destinations = single ? [{ text: ".", exp: [literal2(".")] }] : writeDestinations(found, site);
+      checkTargets("ln", "overwrite", destinations, WRITES_EITHER, st, ctx, site);
+      const symbolic = found.flags.has("s") || found.flags.has("--symbolic");
+      if (!symbolic) {
+        const sources = found.operands.filter((arg) => !destinations.includes(arg));
+        checkTargets("ln", "hard-link", sources, LINKS_TO, st, ctx, site);
       }
-      checkTargets("mv", "move", targets, false, st, ctx, site);
+      return;
+    }
+    case "sed": {
+      const writes = sedWrites(rest);
+      const program = writes.inferred ? "sed, whose option word the guard cannot read and which may be `-i`," : "sed -i";
+      checkTargets(program, "rewrite in place", writes.replaced, WRITES_LINK, st, ctx, site);
+      checkTargets(program, "rewrite in place", writes.followed, WRITES_EITHER, st, ctx, site);
       return;
     }
     case "rsync": {
@@ -43663,9 +43906,9 @@ function dispatch(invocation, outer, ctx) {
         "--remote-option",
         "--rsync-path",
         "--temp-dir"
-      ]).operands.at(-1);
+      ]).operands.filter(passesAnArgument).at(-1);
       if (destination !== undefined) {
-        checkTargets("rsync", "synchronize and delete into", [destination], true, st, ctx, site);
+        checkTargets("rsync", "synchronize and delete into", [destination], ACTS_THROUGH_LINK, st, ctx, site);
       }
       return;
     }
@@ -43697,14 +43940,14 @@ function dispatch(invocation, outer, ctx) {
             targetDirectories.push(target);
         }
       }
-      checkTargets(base, "extract and overwrite in", targetDirectories, true, st, ctx, site);
+      checkTargets(base, "extract and overwrite in", targetDirectories, ACTS_THROUGH_LINK, st, ctx, site);
       return;
     }
     case "shred":
-      checkTargets("shred", "shred", operands(rest, "ns", ["--iterations", "--size", "--random-source"]).operands, false, st, ctx, site);
+      checkTargets("shred", "shred", operands(rest, "ns", ["--iterations", "--size", "--random-source"]).operands, ACTS_ON_BOTH, st, ctx, site);
       return;
     case "truncate":
-      checkTargets("truncate", "truncate", operands(rest, "sr", ["--size", "--reference"]).operands, true, st, ctx, site);
+      checkTargets("truncate", "truncate", operands(rest, "sr", ["--size", "--reference"]).operands, ACTS_THROUGH_LINK, st, ctx, site);
       return;
     case "chmod":
     case "chown":
@@ -43722,16 +43965,18 @@ function dispatch(invocation, outer, ctx) {
         if (!append) {
           const verdict = judgePath(arg.exp, st, ctx, { follow: true, overwrite: true });
           if (!verdict.ok) {
-            throw refusal(site, `tee would overwrite \`${arg.text}\` (${verdict.resolution})`, ctx);
+            throw refusal(site, `tee would overwrite \`${arg.text}\` (${verdict.resolution})`, ctx, verdict.unresolved);
           }
         }
         const target = literalText(arg.exp);
-        if (target !== undefined && st.cwd !== undefined) {
-          const file2 = path4.resolve(st.cwd, target);
-          st.pidFiles.delete(file2);
-          const text = heredoc === undefined ? null : heredocText(heredoc);
-          modelWrite(st, ctx, file2, append ? UNREAD_FILE : text === null ? UNRENDERED_WRITE : readable(text) ?? OVERLONG_WRITE);
+        const file2 = target === undefined ? undefined : kernelPath(st.cwd, target);
+        if (file2 === undefined) {
+          forgetFileModels(st, ctx, `\`tee ${arg.text}\``);
+          continue;
         }
+        st.pidFiles.delete(file2);
+        const text = heredoc === undefined ? null : heredocText(heredoc);
+        modelWrite(st, ctx, file2, append ? UNREAD_FILE : text === null ? UNRENDERED_WRITE : readable(text) ?? OVERLONG_WRITE);
       }
       return;
     }
@@ -43778,8 +44023,8 @@ function dispatch(invocation, outer, ctx) {
           return false;
         const { text, whole } = readableWord(word);
         const compact = text.replace("-", "");
-        const reachable = commands.filter((command) => command.replace("-", "").startsWith(compact));
-        return whole ? reachable.length === 1 : reachable.length > 0;
+        const normalized = commands.map((command) => command.replace("-", ""));
+        return whole ? completeName(compact, normalized) !== undefined : normalized.some((command) => command.startsWith(compact));
       };
       let killing;
       for (const segment of segments) {
@@ -43856,7 +44101,7 @@ function dispatch(invocation, outer, ctx) {
     runFile(argv[0], rest, childState(st, invocation.overlay), ctx, site, "auto");
   }
 }
-function changeDirectory(target, st, ctx) {
+function changeDirectory(target, physicalMode, st, ctx) {
   if (target === undefined) {
     const home = literalText(lookup("HOME", st, ctx));
     st.cwd = home;
@@ -43869,7 +44114,13 @@ function changeDirectory(target, st, ctx) {
     st.cwdWhy = `\`cd ${target.text}\``;
     return;
   }
-  st.cwd = path4.resolve(st.cwd, text);
+  if (!physicalMode) {
+    st.cwd = path4.resolve(st.cwd, text);
+    return;
+  }
+  st.cwd = kernelPath(st.cwd, text);
+  if (st.cwd === undefined)
+    st.cwdWhy = `\`cd -P ${target.text}\``;
 }
 function declaration(builtin, list, st, ctx, site) {
   const options = list.map((arg) => literalText(arg.exp) ?? "").filter((text) => /^[-+][a-zA-Z]+$/.test(text));
@@ -44023,17 +44274,389 @@ function nameAndValue(arg) {
   }
   return { name, value: undefined };
 }
-function checkTargets(program, verb, targets, follow, st, ctx, site) {
+var ACTS_ON_LINK = {
+  followed: false,
+  unfollowed: true,
+  overwrite: false
+};
+var ACTS_THROUGH_LINK = {
+  followed: true,
+  unfollowed: false,
+  overwrite: false
+};
+var ACTS_ON_BOTH = {
+  followed: true,
+  unfollowed: true,
+  overwrite: false
+};
+var WRITES_THROUGH_LINK = {
+  followed: true,
+  unfollowed: false,
+  overwrite: true
+};
+var WRITES_LINK = {
+  followed: false,
+  unfollowed: true,
+  overwrite: true
+};
+var WRITES_EITHER = {
+  followed: true,
+  unfollowed: true,
+  overwrite: true
+};
+var LINKS_TO = {
+  followed: true,
+  unfollowed: false,
+  overwrite: true
+};
+function checkTargets(program, verb, targets, reach, st, ctx, site) {
   for (const target of targets) {
-    const verdict = judgePath(target.exp, st, ctx, { follow, overwrite: false });
-    if (!verdict.ok) {
-      throw refusal(site, `${program} would ${verb} \`${target.text}\` (${verdict.resolution})`, ctx);
+    for (const follow of [true, false]) {
+      if (!(follow ? reach.followed : reach.unfollowed))
+        continue;
+      const verdict = judgePath(target.exp, st, ctx, { follow, overwrite: reach.overwrite });
+      if (!verdict.ok) {
+        throw refusal(site, `${program} would ${verb} \`${target.text}\` (${verdict.resolution})`, ctx, verdict.unresolved);
+      }
     }
     const text = literalText(target.exp);
-    if (text !== undefined && (text.startsWith("/") || st.cwd !== undefined)) {
-      st.pidFiles.delete(path4.resolve(st.cwd ?? "/", text));
+    const file2 = text === undefined ? undefined : kernelPath(st.cwd, text);
+    if (file2 !== undefined)
+      st.pidFiles.delete(file2);
+  }
+}
+function completeName(prefix, names) {
+  if (names.includes(prefix))
+    return prefix;
+  const reachable = names.filter((name) => name.startsWith(prefix));
+  return reachable.length === 1 ? reachable[0] : undefined;
+}
+function longOption(text, names) {
+  return completeName(text.split("=", 1)[0], names);
+}
+var GNU_INFORMATION = { "--help": false, "--version": false };
+var MV_OPTIONS = {
+  "--backup": false,
+  "--context": false,
+  "--debug": false,
+  "--force": false,
+  "--interactive": false,
+  "--no-clobber": false,
+  "--no-copy": false,
+  "--no-target-directory": false,
+  "--strip-trailing-slashes": false,
+  "--suffix": true,
+  "--target-directory": true,
+  "--update": false,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+var CP_OPTIONS = {
+  "--archive": false,
+  "--attributes-only": false,
+  "--backup": false,
+  "--context": false,
+  "--copy-contents": false,
+  "--debug": false,
+  "--dereference": false,
+  "--force": false,
+  "--interactive": false,
+  "--link": false,
+  "--no-clobber": false,
+  "--no-dereference": false,
+  "--no-preserve": true,
+  "--no-target-directory": false,
+  "--one-file-system": false,
+  "--parents": false,
+  "--preserve": false,
+  "--recursive": false,
+  "--reflink": false,
+  "--remove-destination": false,
+  "--sparse": true,
+  "--strip-trailing-slashes": false,
+  "--suffix": true,
+  "--symbolic-link": false,
+  "--target-directory": true,
+  "--update": false,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+var INSTALL_OPTIONS = {
+  "--backup": false,
+  "--compare": false,
+  "--context": false,
+  "--debug": false,
+  "--directory": false,
+  "--group": true,
+  "--mode": true,
+  "--no-target-directory": false,
+  "--owner": true,
+  "--preserve-context": false,
+  "--preserve-timestamps": false,
+  "--strip": false,
+  "--strip-program": true,
+  "--suffix": true,
+  "--target-directory": true,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+var LN_OPTIONS = {
+  "--backup": false,
+  "--directory": false,
+  "--force": false,
+  "--interactive": false,
+  "--logical": false,
+  "--no-dereference": false,
+  "--no-target-directory": false,
+  "--physical": false,
+  "--relative": false,
+  "--suffix": true,
+  "--symbolic": false,
+  "--target-directory": true,
+  "--verbose": false,
+  ...GNU_INFORMATION
+};
+function passesAnArgument(arg) {
+  return arg.fields !== "none";
+}
+function writeArguments(rest, valued, long) {
+  const names = Object.keys(long);
+  const operands2 = [];
+  const flags = new Set;
+  let directory;
+  let uncertain;
+  for (let i = 0;i < rest.length; i += 1) {
+    const arg = rest[i];
+    const { text, whole } = readableWord(arg);
+    if (whole && text === "--") {
+      operands2.push(...rest.slice(i + 1).filter(passesAnArgument));
+      break;
+    }
+    if (!whole || !text.startsWith("-") || text === "-") {
+      if (!whole && mayBeSomeOption(text))
+        uncertain = arg;
+      if (passesAnArgument(arg))
+        operands2.push(arg);
+      continue;
     }
+    let takesValue = false;
+    let offset;
+    if (text.startsWith("--")) {
+      const option = longOption(text, names);
+      if (option === undefined)
+        continue;
+      flags.add(option);
+      takesValue = long[option] === true && !text.includes("=");
+      if (option === "--target-directory")
+        offset = text.indexOf("=") + 1 || text.length;
+    } else {
+      for (let index = 1;index < text.length; index += 1) {
+        const letter = text.charAt(index);
+        flags.add(letter);
+        if (!valued.includes(letter))
+          continue;
+        takesValue = index === text.length - 1;
+        if (letter === "t")
+          offset = index + 1;
+        break;
+      }
+    }
+    const next = takesValue ? rest[i + 1] : undefined;
+    if (takesValue)
+      i += 1;
+    if (offset === undefined)
+      continue;
+    const value = valueInWord(arg, offset);
+    directory = value === undefined ? next : { text: arg.text, exp: value };
+  }
+  return { operands: operands2, flags, directory, uncertain };
+}
+function writeDestinations(found, site) {
+  if (found.operands.length > 1 && (found.flags.has("T") || found.flags.has("--no-target-directory"))) {
+    return [found.operands.at(-1)];
   }
+  if (found.directory !== undefined && !found.uncertain)
+    return [found.directory];
+  if (found.operands.length < 2 || found.uncertain) {
+    const word = found.uncertain?.text ?? found.operands.at(-1)?.text ?? "missing destination";
+    throw new Refusal(site.snippet, site.line, `the guard cannot read a write destination from \`${word}\`; put \`--\` before operands, or use \`-T\` to name the last operand as the destination`);
+  }
+  return [found.operands.at(-1)];
+}
+function checkCopyContents(found, destinations, st, ctx, site) {
+  const recursive = found.uncertain || ["r", "R", "a", "--recursive", "--archive"].some((flag) => found.flags.has(flag));
+  const direct = found.flags.has("T") || found.flags.has("--no-target-directory");
+  for (const destination of destinations) {
+    const text = literalText(destination.exp);
+    if (text === undefined || !path4.isAbsolute(text) && st.cwd === undefined)
+      continue;
+    const dir = realExisting(path4.resolve(st.cwd ?? "/", text));
+    if (!statSync(dir, { throwIfNoEntry: false })?.isDirectory())
+      continue;
+    for (const source of found.operands) {
+      if (destinations.includes(source))
+        continue;
+      const name = literalText(source.exp);
+      const from = name === undefined ? undefined : path4.resolve(st.cwd ?? "/", name);
+      const knownTree = from !== undefined && statSync(from, { throwIfNoEntry: false })?.isDirectory();
+      const root = direct || name === undefined ? dir : path4.join(dir, found.flags.has("--parents") ? name : path4.basename(name));
+      const pending = [root];
+      while (pending.length > 0) {
+        const target = pending.pop();
+        checkTargets("cp", "overwrite", [{ text: name === undefined ? source.text : target, exp: [literal2(target)] }], WRITES_THROUGH_LINK, st, ctx, site);
+        if (!recursive && !(name === undefined && target === root))
+          continue;
+        if (!lstatSync(target, { throwIfNoEntry: false })?.isDirectory())
+          continue;
+        const entries = opendirSync(target);
+        try {
+          for (let entry = entries.readSync();entry !== null; entry = entries.readSync()) {
+            if (++ctx.steps.count > MAX_WALK_STEPS) {
+              throw new Refusal(site.snippet, site.line, WALK_LIMIT);
+            }
+            const child = path4.join(target, entry.name);
+            if (knownTree && !existsSync(path4.join(from, path4.relative(root, child))))
+              continue;
+            pending.push(child);
+          }
+        } finally {
+          entries.closeSync();
+        }
+      }
+    }
+  }
+}
+var SED_OPTIONS = {
+  "--debug": false,
+  "--expression": true,
+  "--file": true,
+  "--follow-symlinks": false,
+  "--in-place": false,
+  "--line-length": true,
+  "--null-data": false,
+  "--posix": false,
+  "--quiet": false,
+  "--regexp-extended": false,
+  "--sandbox": false,
+  "--separate": false,
+  "--silent": false,
+  "--unbuffered": false,
+  ...GNU_INFORMATION
+};
+function sedWrites(list) {
+  const names = Object.keys(SED_OPTIONS);
+  let inPlace = false;
+  let follow = false;
+  let expression = false;
+  let splitOption = false;
+  let ended = false;
+  let reopened = false;
+  let takesNext = false;
+  const unread = [];
+  const operands2 = [];
+  for (let i = 0;i < list.length; i += 1) {
+    const arg = list[i];
+    const { text, whole } = readableWord(arg);
+    const afterUnread = takesNext;
+    takesNext = false;
+    const several = arg.fields === "unknown";
+    if (ended) {
+      operands2.push({ arg, option: false, several });
+      continue;
+    }
+    if (whole && text === "--") {
+      if (reopened)
+        operands2.push({ arg, option: false, several: false });
+      if (afterUnread)
+        reopened = true;
+      else
+        ended = true;
+      continue;
+    }
+    if (several) {
+      splitOption = true;
+      takesNext = true;
+      operands2.push({ arg, option: true, several });
+      continue;
+    }
+    if (!text.startsWith("-") || whole && text === "-") {
+      const option = !whole && text === "";
+      if (option) {
+        unread.push(arg);
+        takesNext = true;
+      }
+      operands2.push({ arg, option, several });
+      continue;
+    }
+    if (reopened)
+      operands2.push({ arg, option: false, several });
+    if (text.startsWith("--")) {
+      const option = longOption(text, names);
+      if (whole && !reopened && (option === "--help" || option === "--version")) {
+        return { replaced: [], followed: [], inPlace: false, inferred: false };
+      }
+      if (option === "--in-place")
+        inPlace = true;
+      if (option === "--follow-symlinks")
+        follow = true;
+      if (option === "--expression" || option === "--file")
+        expression = true;
+      if (option === undefined && !whole)
+        unread.push(arg);
+      if ((option === undefined ? !whole : SED_OPTIONS[option]) && !text.includes("=")) {
+        if (whole && !reopened)
+          i += 1;
+        else
+          takesNext = true;
+      }
+      continue;
+    }
+    let settled = false;
+    for (const [offset, letter] of [...text.slice(1)].entries()) {
+      if (letter === "i") {
+        inPlace = true;
+        settled = true;
+        break;
+      }
+      if ("efl".includes(letter)) {
+        if (letter !== "l")
+          expression = true;
+        if (offset === text.length - 2) {
+          if (whole && !reopened)
+            i += 1;
+          else
+            takesNext = true;
+        }
+        settled = true;
+        break;
+      }
+    }
+    if (!settled && !whole) {
+      unread.push(arg);
+      takesNext = true;
+    }
+  }
+  const unsettled = (settled) => settled ? 0 : 1;
+  const replaced = [];
+  const followed = [];
+  let before = false;
+  for (const operand of operands2) {
+    const maybe = operand.option && !operand.several;
+    const others = unread.length - (maybe ? 1 : 0);
+    const needed = unsettled(inPlace || splitOption) + unsettled(expression || splitOption || operand.several || before);
+    if (others >= needed + unsettled(follow || splitOption))
+      followed.push(operand.arg);
+    else if (others >= needed)
+      replaced.push(operand.arg);
+    if (!maybe)
+      before = true;
+  }
+  return {
+    replaced,
+    followed,
+    inPlace: inPlace || splitOption || unread.length > 0,
+    inferred: !inPlace
+  };
 }
 function checkRecursiveMode(program, list, st, ctx, site) {
   const flags = program === "chmod" ? "cfvR" : "cfvRhHLP";
@@ -44063,7 +44686,7 @@ function checkRecursiveMode(program, list, st, ctx, site) {
   }
   const verb = program === "chmod" ? "recursively change the mode of" : "recursively change the owner of";
   if (recursive) {
-    checkTargets(`${program} -R`, verb, reference ? found : found.slice(1), true, st, ctx, site);
+    checkTargets(`${program} -R`, verb, reference ? found : found.slice(1), ACTS_THROUGH_LINK, st, ctx, site);
     return;
   }
   for (const [index, arg] of found.entries()) {
@@ -44073,7 +44696,7 @@ function checkRecursiveMode(program, list, st, ctx, site) {
     const targets = reference || arg.fields === "unknown" ? others : others.slice(1);
     if (targets.length === 0)
       continue;
-    checkTargets(`${program} -R`, verb, targets, true, st, ctx, site);
+    checkTargets(`${program} -R`, verb, targets, ACTS_THROUGH_LINK, st, ctx, site);
   }
 }
 function checkFind(list, st, ctx, site) {
@@ -44119,8 +44742,9 @@ function checkFind(list, st, ctx, site) {
       continue;
     const inner = unwrap2(list.slice(i + index + 1, i + end), st, ctx, site);
     const program = path4.basename(literalText(inner.argv[0]?.exp) ?? "");
-    if (FILE_COMMANDS.has(program) || program === "xargs")
+    if (FILE_COMMANDS.has(program) || program === "xargs" || program === "sed" && sedWrites(inner.argv.slice(1)).inPlace) {
       action = `find ${word} ${program}`;
+    }
     if (SHELLS.has(program)) {
       action = `find ${word} ${program}`;
       shell = inner.argv;
@@ -44130,10 +44754,10 @@ function checkFind(list, st, ctx, site) {
     if (rootsBeforePredicate === undefined)
       return;
     const under = rootsBeforePredicate.length > 0 ? rootsBeforePredicate : [{ text: ".", exp: [literal2(".")] }];
-    checkTargets("find with a root the guard cannot read, which may be a predicate", "delete or change what it finds under", under, false, st, ctx, site);
+    checkTargets("find with a root the guard cannot read, which may be a predicate", "delete or change what it finds under", under, ACTS_ON_LINK, st, ctx, site);
     return;
   }
-  checkTargets(action, "delete or change what it finds under", targets, false, st, ctx, site);
+  checkTargets(action, "delete or change what it finds under", targets, ACTS_ON_LINK, st, ctx, site);
   if (shell === undefined)
     return;
   const found = targets.length === 1 ? targets[0]?.exp ?? [] : [unknown2("a path `find` found")];
@@ -44171,7 +44795,7 @@ function checkXargs(list, st, ctx, site) {
     };
   });
   const program = path4.basename(literalText(argv[0]?.exp) ?? "");
-  if (FILE_COMMANDS.has(program) || SIGNAL_COMMANDS.has(program)) {
+  if (FILE_COMMANDS.has(program) || SIGNAL_COMMANDS.has(program) || program === "sed" && sedWrites(argv.slice(1)).inPlace) {
     throw new Refusal(site.snippet, site.line, `\`xargs ${program}\` takes its targets from standard input, which the guard cannot see; name ` + `the paths or pids on the command line (or use \`find <dir> -delete\`) so it can check them`);
   }
   const overlay = new Map;
@@ -44454,7 +45078,14 @@ function runFile(file2, positional, st, ctx, site, kind, source = false) {
   if (text === undefined || !text.startsWith("/") && st.cwd === undefined) {
     throw new Refusal(site.snippet, site.line, `the guard cannot resolve the script \`${file2.text}\` (${file2.exp.find((p) => p.kind !== "literal")?.why ?? `a working directory unknown after ${st.cwdWhy}`}), so it cannot read what it runs`);
   }
-  const abs = path4.resolve(st.cwd ?? "/", text);
+  if (ctx.unnameableWrite.why !== undefined) {
+    throw new Refusal(site.snippet, site.line, `${ctx.unnameableWrite.why} writes a file the guard cannot name, so it cannot tell whether \`${file2.text}\` is the file that was written`);
+  }
+  const resolved = physical(st.cwd ?? "/", text, true);
+  if ("unknown" in resolved) {
+    throw new Refusal(site.snippet, site.line, `the guard cannot resolve the script \`${file2.text}\` (${resolved.unknown}), so it cannot read what it runs`);
+  }
+  const abs = resolved.real;
   let content;
   if (st.files.has(abs)) {
     const written = st.files.get(abs);
@@ -44582,7 +45213,7 @@ function checkCode(language, code, st, ctx, ipython = false) {
         overwrite: verb === "overwrite"
       });
       if (!verdict.ok) {
-        throw refusal({ snippet: call, line: 1 }, `${call} would ${verb} ${verdict.resolution}`, ctx);
+        throw refusal({ snippet: call, line: 1 }, `${call} would ${verb} ${verdict.resolution}`, ctx, verdict.unresolved);
       }
     },
     signal: (call, pid, group) => {
@@ -44653,6 +45284,7 @@ function createPaneGuard(options) {
     ompPid: options.ompPid,
     parentOf: options.parentOf ?? procParent,
     steps: { count: 0 },
+    unnameableWrite: { why: undefined },
     uncertain: { depth: 0 }
   });
   const initial = (cwd, source) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "5.17.3",
+  "version": "5.17.5",
   "type": "module",
   "omp": {
     "extensions": [