@vincemakes/kiso-code 0.39.2 → 0.40.0

package/dist/floor.js

@@ -0,0 +1,652 @@
+/**
+ * 0.40.0 — the catastrophe floor (launch-weekend plan §4, minimum shape;
+ * owner, 2026-09-17: "bypass stays bypass: `rm -rf /tmp/probe` runs. The
+ * floor refuses only unrecoverable targets"; the lead's review and rulings
+ * of 2026-09-18).
+ *
+ * A destructive command whose target cannot be recovered is REFUSED, in
+ * every mode, bypass included, as a precondition — a chain member that
+ * denies, and a deny is what nothing outranks. The destructive commands:
+ * `rm`; `git clean -f`, `git reset --hard`, `git checkout -- <paths>` and
+ * the same loss spelled `git checkout .` / `-f`, `git restore` touching
+ * the worktree, `git switch -f` (R5); `find … -delete` with no selecting
+ * primary before it (R6). The unrecoverable targets:
+ *
+ *  - `/`, the home directory, the workspace root or any directory above it;
+ *  - the workspace's `.git` (R7);
+ *  - `~/.ssh`, `~/.config`, `~/.kiso`, `~/.gnupg`, `~/.aws`, or inside one;
+ *  - a system root and what is inside it — except the temp family and the
+ *    software prefixes (/opt/homebrew, /usr/local, linuxbrew), where only
+ *    the root itself is, and /Volumes /Users /home /mnt /media, where the
+ *    root and its direct children are (R8). Inside the workspace or the
+ *    home directory is never a system root's;
+ *  - a wildcard over any of those (`~/*`, `/*`, `*` at the workspace root —
+ *    a component of nothing but globs; `*.log` ranges over SOME entries);
+ *  - a target that is only a variable (`$DIR/`, `"$X"/*`) — empty, it is
+ *    the root of whatever comes after it. `$HOME` and `$PWD` are known.
+ *
+ * This is a reading of the command line, not a guarantee: the sandbox is
+ * the guarantee, and it comes after the launch. So the reading errs toward
+ * seeing a command — it looks inside `$( )`, backticks, `( )`, `sh -c` and
+ * `eval`, through `sudo`/`env`/`timeout`/`command` and shell keywords, and
+ * follows `cd` by its joiner — and a line that knocks the reader out is
+ * denied. Documented, not refused: `xargs rm`, script files and heredocs,
+ * `find -exec rm`, `mv`, `chmod -R`, `rmdir`, `unlink`, `truncate`,
+ * `shred`, `>` truncation, `rsync --delete`, `npx rimraf`, `trash`,
+ * `fish -c`, `ssh`, `docker`, `node -e` / `python -c` / `perl -e`, brace
+ * expansion, `$'…'`, `~+`, popd past one level, nesting past 16.
+ *
+ * The same resolver as the read-only allow decides where a path goes.
+ * Default on; `"floor": "off"` in the USER config turns it off, and a
+ * project config cannot — a repository must not be able to lower it.
+ */
+import { existsSync, statSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { HOME_SUBTREES, looseCommands, parseShellLooseChecked, resolveShellPath } from "./shell-words.js";
+/** R8 (the lead's ruling): a system root AND everything inside it. */
+const SYSTEM_ROOTS = [
+    "/bin", "/boot", "/dev", "/etc", "/lib", "/lib64", "/opt", "/proc", "/root", "/run", "/sbin", "/srv", "/sys", "/usr", "/var",
+    "/Applications", "/Library", "/System", "/cores", "/private",
+];
+/** R8: roots whose DIRECT children are mounts or home directories — the
+ *  root and each child are refused, deeper paths run (projects live
+ *  there, WSL's included: /mnt/c/…). */
+const MOUNT_ROOTS = ["/Volumes", "/Users", "/home", "/mnt", "/media"];
+/** R8: the temp family — only the root itself; what is inside runs. */
+const TEMP_ROOTS = ["/tmp", "/private/tmp", "/var/tmp", "/private/var/tmp", "/var/folders", "/private/var/folders"];
+/** R8 (the lead's ruling, second pass): reinstallable software prefixes —
+ *  only the prefix itself; what is inside runs (`brew` put it there and can
+ *  again). */
+const SOFTWARE_PREFIXES = ["/opt/homebrew", "/usr/local", "/home/linuxbrew/.linuxbrew"];
+/** Memoized per (workspace, home): the roots do not move within a session,
+ *  and resolving forty of them cost every shell call ~4 ms. */
+const WHERE = new Map();
+function where(root, home) {
+    const key = `${root}\0${home}`;
+    const hit = WHERE.get(key);
+    if (hit !== undefined)
+        return hit;
+    const real = (p) => resolveShellPath(root, "/", p).canonical;
+    const named = (names) => names.map((name) => ({ name, real: real(name) }));
+    const rootReal = real(root);
+    const w = {
+        root,
+        home,
+        rootReal,
+        homeReal: real(home),
+        gitReal: join(rootReal, ".git"),
+        sys: named(SYSTEM_ROOTS),
+        mounts: named(MOUNT_ROOTS),
+        temps: [...new Set([...TEMP_ROOTS, tmpdir()].map(real))],
+        prefixes: named(SOFTWARE_PREFIXES),
+        subtrees: HOME_SUBTREES.map((name) => ({ name, real: real(join(home, name)) })),
+    };
+    WHERE.set(key, w);
+    return w;
+}
+/** B6: the candidate directories a command may run in are UNIQUE and at
+ *  most this many. `;`-joined cds doubled the set: 30 of them hung the
+ *  event loop, 400 exhausted the heap. Past the bound the set collapses to
+ *  the newest candidate, home and the workspace root — the three a
+ *  catastrophe is judged against. */
+const MAX_CWDS = 8;
+function capCwds(w, list) {
+    const unique = [...new Set(list)];
+    return unique.length <= MAX_CWDS ? unique : [...new Set([unique[0], w.home, w.root])];
+}
+const canon = (w, cwd, p) => resolveShellPath(w.root, cwd, p).canonical;
+const within = (parent, p) => {
+    const rel = relative(parent, p);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+};
+/** Why `p` (canonical) is unrecoverable, or null. `over` is true for a
+ *  wildcard over `p` rather than `p` itself — the same set, since
+ *  emptying a directory is removing everything it held. */
+function unrecoverable(w, p, over) {
+    const what = (s) => (over ? `a wildcard over ${s}` : s);
+    if (p === "/")
+        return what("/");
+    if (p === w.homeReal)
+        return what("the home directory");
+    if (p === w.rootReal)
+        return what("the workspace root");
+    if (within(p, w.rootReal))
+        return what(`a directory above the workspace (${p})`);
+    // R7: the workspace's history — without a remote, gone
+    if (within(w.gitReal, p))
+        return what("the workspace's .git");
+    for (const sub of w.subtrees)
+        if (within(sub.real, p))
+            return what(`~/${sub.name}`);
+    // Inside the workspace or the home directory is the project's and the
+    // person's, never a system root's — or a workspace in /opt, or a root
+    // user's home in /root, would have every rm refused.
+    if ((w.rootReal !== "/" && within(w.rootReal, p)) || within(w.homeReal, p))
+        return null;
+    for (const t of w.temps) {
+        if (p === t)
+            return what(`a temp root (${t})`);
+        if (within(t, p))
+            return null;
+    }
+    for (const x of w.prefixes) {
+        if (p === x.real)
+            return what(`a software prefix (${x.name})`);
+        if (within(x.real, p))
+            return null;
+    }
+    for (const m of w.mounts) {
+        if (p === m.real)
+            return what(`a system root (${m.name})`);
+        if (dirname(p) === m.real)
+            return what(`a mount or home root (${p})`);
+        // deeper runs — by RESOLVED path: macOS's /home is
+        // /System/Volumes/Data/home, which the /System rule would refuse
+        if (within(m.real, p))
+            return null;
+    }
+    for (const s of w.sys) {
+        if (p === s.real)
+            return what(`a system root (${s.name})`);
+        if (within(s.real, p))
+            return what(`a path inside a system root (${s.name})`);
+    }
+    return null;
+}
+/** Where the first unknown character sits in `text`, and whether it is a
+ *  glob — for a word whose text a known variable was just substituted in. */
+function reUnknown(text, from) {
+    for (let i = from; i < text.length; i += 1) {
+        const c = text[i];
+        if (c === "*" || c === "?" || c === "[")
+            return { at: i, glob: true };
+        if (c === "$" || c === "`")
+            return { at: i, glob: false };
+    }
+    return { at: -1, glob: false };
+}
+/** One target word, from each directory the command might run in. */
+function targetWhy(w, cwds, word) {
+    for (const cwd of cwds) {
+        let text = word.text;
+        let at = word.unknownAt;
+        let glob = word.unknownIsGlob;
+        let variableOnly = word.variableOnly;
+        // B8: $HOME and $PWD are KNOWN — `rm -rf $HOME/.ssh` is ~/.ssh
+        const known = at === 0 ? /^(\$HOME|\$\{HOME\}|\$PWD|\$\{PWD\})(?=\/|$)/.exec(text) : null;
+        if (known !== null) {
+            const value = known[1].includes("HOME") ? w.home : cwd;
+            text = value + text.slice(known[0].length);
+            ({ at, glob } = reUnknown(text, value.length));
+            variableOnly = false;
+        }
+        else if (word.tilde && (text === "~" || text.startsWith("~/"))) {
+            text = w.home + text.slice(1);
+            if (at >= 0)
+                at += w.home.length - 1;
+        }
+        if (variableOnly)
+            return `a target that is only a variable (${word.text})`;
+        if (at < 0) {
+            const why = unrecoverable(w, canon(w, cwd, text), false);
+            if (why !== null)
+                return why;
+            continue;
+        }
+        // A variable FIRST, with something literal after it (`$X/build`),
+        // can be anything at all; only a variable-only target is refused.
+        if (at === 0 && !glob)
+            continue;
+        const prefix = text.slice(0, at);
+        const lastSlash = prefix.lastIndexOf("/");
+        const dir = canon(w, cwd, lastSlash < 0 ? "." : prefix.slice(0, lastSlash + 1) || "/");
+        const head = prefix.slice(lastSlash + 1); // the literal start of the unknown component
+        const nextSlash = text.indexOf("/", at);
+        const component = text.slice(lastSlash + 1, nextSlash < 0 ? text.length : nextSlash);
+        const after = nextSlash < 0 ? "" : text.slice(nextSlash);
+        // B8: a wildcard INSIDE a protected subtree (`~/.ssh/id_*`), or at
+        // home reaching one by its name (`~/.ssh*`, `~/.c*`)
+        for (const sub of w.subtrees) {
+            if (within(sub.real, dir))
+                return `a wildcard inside ~/${sub.name}`;
+            if (glob && dir === w.homeReal && head !== "" && sub.name.toLowerCase().startsWith(head.toLowerCase()))
+                return `a wildcard that reaches ~/${sub.name}`;
+        }
+        // B9: over the directory ONLY when the unknown component is nothing
+        // but glob characters and dots (`*`, `.*`, `**`, `?`), or nothing but
+        // a variable — and what follows is only slashes, dots and globs.
+        // `*.log`, `a*`, `**/node_modules` range over SOME entries and run.
+        const overComponent = glob ? /^[*?.[\]!]+$/.test(component) : head === "" && /^(\$\{?[A-Za-z_][A-Za-z0-9_]*\}?|\$\(.*\)|`.*`)$/.test(component);
+        // ...and that exemption holds only where ranging over SOME entries is
+        // ordinary work: inside the workspace, inside home (the subtrees were
+        // refused above), in the temp family. `/*.log`, `/**/build` are not.
+        const ordinary = within(w.rootReal, dir) || within(w.homeReal, dir) || w.temps.some((t) => within(t, dir));
+        if (ordinary && (!overComponent || !/^[/.*?[\]!]*$/.test(after)))
+            continue;
+        const why = unrecoverable(w, dir, true);
+        if (why !== null)
+            return why;
+    }
+    return null;
+}
+const WRAPPER_ARG = {
+    sudo: ["-u", "-g", "-C", "-D", "-h", "-p", "-r", "-t", "-U"],
+    doas: ["-u", "-C"],
+    nice: ["-n"],
+    exec: ["-a"],
+    env: ["-u", "-C", "-S"],
+    timeout: ["-s", "-k", "--signal", "--kill-after"],
+    command: [],
+    builtin: [],
+    nohup: [],
+    time: [],
+    busybox: [],
+};
+/** B10: shell keywords that come before a command and take nothing */
+const KEYWORD_BEFORE = new Set(["if", "then", "elif", "else", "while", "until", "do", "{", "!"]);
+/** B10: keywords that end a construct — a command on their own */
+const KEYWORD_ALONE = new Set(["fi", "done", "}", "esac", "in"]);
+/** Past keywords, `sudo -u x`, `env A=1`, `timeout 5`, `command`, … to the
+ *  command that runs. Matched by basename: `/usr/bin/env rm` is env. */
+export function unwrap(argv) {
+    let a = argv;
+    for (;;) {
+        // a leading word that is only a variable may be EMPTY (`$SUDO rm …`,
+        // `eval "$X" rm …`): the command may be what follows it
+        while (a.length > 1 && a[0].variableOnly)
+            a = a.slice(1);
+        const name = basename(a[0]?.text ?? "");
+        if (a.length === 0 || KEYWORD_ALONE.has(name))
+            return [];
+        if (KEYWORD_BEFORE.has(name)) {
+            a = a.slice(1);
+            continue;
+        }
+        if (!Object.hasOwn(WRAPPER_ARG, name))
+            return a;
+        let i = 1;
+        while (i < a.length && (a[i].text.startsWith("-") || (name === "env" && a[i].text.includes("=")))) {
+            i += WRAPPER_ARG[name].includes(a[i].text) ? 2 : 1;
+        }
+        if (name === "timeout")
+            i += 1; // the duration
+        a = a.slice(i);
+    }
+}
+const operands = (args) => {
+    const out = [];
+    let rest = false;
+    for (const a of args) {
+        if (!rest && a.text === "--")
+            rest = true;
+        else if (rest || !a.text.startsWith("-"))
+            out.push(a);
+    }
+    return out;
+};
+const literal = (text) => ({ text, unknownAt: -1, unknownIsGlob: false, tilde: false, variableOnly: false });
+/** `sh -c '…'`, `bash -lc '…'`, `eval …`: the command lines inside.
+ *  eval CONCATENATES its words with spaces and parses the result again —
+ *  that is its meaning, and `eval 'rm -rf ~'` is read that way. It is also
+ *  read once more with each word re-quoted, so `eval sh -c 'rm -rf /'`
+ *  keeps its script whole (B10, the lead's reading): either refusing is a
+ *  refusal. In the re-quoted reading `~` is already expanded and a word
+ *  holding an unknown stays raw — its value is unknown to eval too. */
+export function innerLines(argv, home) {
+    const name = basename(argv[0]?.text ?? "");
+    const quote = (t) => `'${t.replaceAll("'", `'\\''`)}'`;
+    if (name === "eval") {
+        const words = argv.slice(1);
+        const requoted = words.map((a) => (a.tilde && (a.text === "~" || a.text.startsWith("~/")) ? quote(home + a.text.slice(1)) : a.unknownAt >= 0 ? a.text : quote(a.text)));
+        return { lines: [words.map((a) => a.text).join(" "), requoted.join(" ")], subshell: false };
+    }
+    if (!/^(ba|z|da|k)?sh$/.test(name))
+        return null;
+    const at = argv.findIndex((a) => /^-[a-z]*c[a-z]*$/.test(a.text));
+    const line = at < 0 ? undefined : argv[at + 1]?.text;
+    return line === undefined ? null : { lines: [line], subshell: true };
+}
+/** How deep command lines inside command lines are followed — `sh -c`,
+ *  `eval` — and how many are read in all: eval's two readings would
+ *  otherwise double at every level. */
+const MAX_INNER_DEPTH = 16;
+const MAX_INNER_LINES = 256;
+const SELECTING = new Set([
+    "-name", "-iname", "-path", "-ipath", "-wholename", "-iwholename", "-regex", "-iregex", "-newer", "-mtime", "-mmin", "-atime",
+    "-amin", "-ctime", "-cmin", "-size", "-empty", "-user", "-group", "-perm", "-samefile", "-links",
+]);
+/** R5: a checkout/restore operand is a path only when path-shaped — a
+ *  branch name is never refused. */
+const pathShaped = (t) => t === "." || t === "./" || t.startsWith("/") || t.startsWith("~") || t.includes("/") || t.startsWith(":");
+/** B7: pathspec magic from the top of the repository */
+const topMagic = (t) => t.startsWith(":/") || t.startsWith(":(top");
+/** The destructive command's targets, or null when it is not destructive. */
+function destructiveTargets(argv) {
+    const name = basename(argv[0]?.text ?? "");
+    const args = argv.slice(1);
+    if (name === "rm")
+        return { targets: operands(args) };
+    if (name === "find") {
+        if (!args.some((a) => a.text === "-delete"))
+            return null;
+        const paths = [];
+        let i = 0;
+        // B9: find's own options come first — -H -L -P -E -d -s -x -O<n> --,
+        // and -f <path> names a path
+        for (; i < args.length; i += 1) {
+            const t = args[i].text;
+            if (/^-[HLPEdsx]+$/.test(t) || /^-O\d*$/.test(t))
+                continue;
+            if (t === "-f" && i + 1 < args.length) {
+                paths.push(args[i + 1]);
+                i += 1;
+                continue;
+            }
+            if (t === "--")
+                i += 1;
+            break;
+        }
+        for (; i < args.length; i += 1) {
+            const t = args[i].text;
+            if (t.startsWith("-") || t === "!" || t === "(")
+                break;
+            paths.push(args[i]);
+        }
+        // R6 (the lead's ruling): with a selecting primary it ranges over SOME
+        // entries and runs; with none, over everything under its paths
+        // ...and only BEFORE -delete: `find . -delete -name x` deletes all.
+        // The home subtrees come first even so (`find ~/.ssh -name x -delete`)
+        const del = args.findIndex((a) => a.text === "-delete");
+        if (args.slice(i, del).some((a) => SELECTING.has(a.text)))
+            return { targets: paths.length > 0 ? paths : [literal(".")], subtreesOnly: true };
+        return { targets: paths.length > 0 ? paths : [literal(".")], label: "find with no selecting primary" };
+    }
+    if (name !== "git")
+        return null;
+    let i = 0;
+    // B7: several -C compose, each relative to the one before
+    const cds = [];
+    // B7: --work-tree X IS the tree a whole-tree command works on; --git-dir
+    // X is a target in itself (space and = forms both)
+    let workTree;
+    const gitDirs = [];
+    while (i < args.length && args[i].text.startsWith("-")) {
+        const t = args[i].text;
+        const eq = /^--(work-tree|git-dir)=(.*)$/.exec(t);
+        if (eq !== null) {
+            const value = { ...args[i], text: eq[2], unknownAt: -1, tilde: eq[2].startsWith("~") };
+            if (eq[1] === "work-tree")
+                workTree = value;
+            else
+                gitDirs.push(value);
+        }
+        if ((t === "-C" || t === "--work-tree" || t === "--git-dir") && i + 1 < args.length) {
+            if (t === "-C")
+                cds.push(args[i + 1]);
+            else if (t === "--work-tree")
+                workTree = args[i + 1];
+            else
+                gitDirs.push(args[i + 1]);
+            i += 2;
+        }
+        else if (t === "-c" || t === "--namespace" || t === "--exec-path")
+            i += 2;
+        else
+            i += 1;
+    }
+    const sub = args[i]?.text;
+    const rest = args.slice(i + 1);
+    const flags = new Set(rest.filter((a) => a.text.startsWith("-")).map((a) => a.text));
+    const as = (targets) => ({
+        targets: [...targets.map((t) => (t === "repo" && workTree !== undefined ? workTree : t)), ...gitDirs],
+        ...(cds.length > 0 ? { cds } : {}),
+    });
+    // a pathspec's glob is GIT's to expand, quoted from the shell or not:
+    // `git checkout -- '*'` is every file under the directory
+    const asGlob = (wd) => {
+        const g = wd.text.search(/[*?[]/);
+        return wd.unknownAt < 0 && g >= 0 ? { ...wd, unknownAt: g, unknownIsGlob: true } : wd;
+    };
+    const asPaths = (words) => words.map((wd) => (topMagic(wd.text) ? "repo" : asGlob(wd)));
+    if (sub === "reset")
+        return flags.has("--hard") ? as(["repo"]) : null;
+    if (sub === "clean") {
+        if (!rest.some((a) => a.text === "--force" || /^-[a-zA-Z]*f[a-zA-Z]*$/.test(a.text)))
+            return null;
+        // a dry run deletes nothing, wherever its -n sits
+        if (rest.some((a) => a.text === "--dry-run" || /^-[a-zA-Z]*n[a-zA-Z]*$/.test(a.text)))
+            return null;
+        const paths = operands(rest.filter((_, k) => !(k > 0 && (rest[k - 1].text === "-e" || rest[k - 1].text === "--exclude"))));
+        return as(paths.length > 0 ? asPaths(paths) : [literal(".")]);
+    }
+    if (sub === "checkout") {
+        // R5: `checkout -- <paths>`, a path-shaped operand, or -f with none
+        const dd = rest.findIndex((a) => a.text === "--");
+        const paths = dd >= 0 ? rest.slice(dd + 1) : operands(rest).filter((a) => pathShaped(a.text));
+        if (paths.length > 0)
+            return as(asPaths(paths));
+        return flags.has("-f") || flags.has("--force") ? as(["repo"]) : null;
+    }
+    if (sub === "restore") {
+        // R5: touching the worktree — no --staged, or -W / --worktree
+        const staged = [...flags].some((f) => f === "--staged" || /^-[a-zA-Z]*S[a-zA-Z]*$/.test(f));
+        const worktree = [...flags].some((f) => f === "--worktree" || /^-[a-zA-Z]*W[a-zA-Z]*$/.test(f));
+        if (staged && !worktree)
+            return null;
+        const paths = operands(rest.filter((_, k) => !(k > 0 && (rest[k - 1].text === "-s" || rest[k - 1].text === "--source"))));
+        return as(asPaths(paths));
+    }
+    if (sub === "switch")
+        return flags.has("-f") || flags.has("--force") || flags.has("--discard-changes") ? as(["repo"]) : null;
+    return null;
+}
+/** As git's own discovery judges it: a `.git` FILE (a worktree's link),
+ *  or a `.git` directory with a HEAD. An empty `.git` is not a repository,
+ *  and git walks on past it — so does the floor. */
+function isGitDir(p) {
+    try {
+        const st = statSync(p);
+        return st.isFile() || (st.isDirectory() && existsSync(join(p, "HEAD")));
+    }
+    catch {
+        return false;
+    }
+}
+/** B7: the root of the repository a command in `cwd` works on — up to the
+ *  nearest `.git` (a directory, or a worktree's file). With none found:
+ *  inside the workspace, the workspace root; outside it, the directory
+ *  itself — git would refuse to run there, and the floor does not bet on it. */
+function repoRoot(w, cwd) {
+    const start = canon(w, cwd, ".");
+    for (let d = start;; d = dirname(d)) {
+        if (isGitDir(join(d, ".git")))
+            return d;
+        if (dirname(d) === d)
+            break;
+    }
+    return within(w.rootReal, start) ? w.rootReal : start;
+}
+/** A child shell starts where this node runs — the node's joiner has
+ *  already been applied — and nothing it does comes back. */
+const child = (s) => ({ cwds: [...s.cwds], lastCd: null, prev: s.prev });
+/**
+ * Would the floor refuse this command line? `workspaceRoot` is where the
+ * shell runs it.
+ */
+export function floorCheck(commandLine, workspaceRoot, home = homedir()) {
+    const w = where(workspaceRoot, home);
+    const seen = new Set();
+    const tilde = (word) => (word.tilde && (word.text === "~" || word.text.startsWith("~/")) ? home + word.text.slice(1) : word.text);
+    const walk = (nodes, state, depth) => {
+        for (const node of nodes) {
+            // Where this node runs: after `cd x`, `&&` means only if the cd
+            // worked (x), `||` only if it failed (where it was), else either.
+            if (state.lastCd !== null) {
+                const { to, from } = state.lastCd;
+                state.cwds = capCwds(w, node.joinedBy === "&&" ? to : node.joinedBy === "||" ? from : [...to, ...from]);
+                if (node.joinedBy !== "&&")
+                    state.lastCd = null;
+            }
+            if (node.kind === "group") {
+                // B10: a subshell — `( … )`, `$( … )`, backticks — its cd does
+                // not move the shell around it
+                const v = walk(node.items, child(state), depth);
+                if (v.refused)
+                    return v;
+                continue;
+            }
+            const argv = unwrap(node.argv);
+            if (argv.length === 0)
+                continue;
+            const name = basename(argv[0].text);
+            const inner = innerLines(argv, home);
+            if (inner !== null) {
+                if (depth < MAX_INNER_DEPTH) {
+                    for (const line of inner.lines) {
+                        if (seen.has(line) || seen.size >= MAX_INNER_LINES)
+                            continue;
+                        seen.add(line);
+                        // `sh -c` is a child shell: its cd does not move this one.
+                        // eval runs HERE, and its cd does — from this node's
+                        // directory, with the outer chain's pending cd kept if the
+                        // line itself does not cd
+                        const read = parseShellLooseChecked(line);
+                        if (read.truncated)
+                            return { refused: true, why: NESTED_TOO_DEEP };
+                        if (inner.subshell) {
+                            const v = walk(read.nodes, child(state), depth + 1);
+                            if (v.refused)
+                                return v;
+                        }
+                        else {
+                            const pending = state.lastCd;
+                            state.lastCd = null;
+                            const v = walk(read.nodes, state, depth + 1);
+                            if (v.refused)
+                                return v;
+                            if (state.lastCd === null)
+                                state.lastCd = pending;
+                        }
+                    }
+                }
+                continue;
+            }
+            if (name === "cd" || name === "pushd" || name === "popd") {
+                // B10: skip cd's own options; `cd -` and popd go back one
+                const args = argv.slice(1).filter((a) => !["--", "-P", "-L", "-e", "-@"].includes(a.text));
+                const to = args[0];
+                const from = state.lastCd?.from ?? state.cwds;
+                let dest;
+                if (name === "popd" || to?.text === "-")
+                    dest = state.prev ?? state.cwds;
+                // `cd` with nothing, or with anything unknown, may land at home
+                else if (to === undefined || to.unknownAt >= 0 || to.variableOnly)
+                    dest = capCwds(w, [w.home, ...state.cwds]);
+                else
+                    dest = capCwds(w, state.cwds.map((c) => resolve(c, tilde(to))));
+                state.prev = state.cwds;
+                state.lastCd = { to: dest, from };
+                continue;
+            }
+            const d = destructiveTargets(argv);
+            if (d === null)
+                continue;
+            let here = state.cwds;
+            for (const cd of d.cds ?? [])
+                here = cd.unknownAt >= 0 ? capCwds(w, [...here, w.home]) : here.map((c) => resolve(c, tilde(cd)));
+            for (const t of d.targets) {
+                let why = null;
+                if (t === "repo") {
+                    for (const c of here)
+                        if ((why = unrecoverable(w, repoRoot(w, c), false)) !== null)
+                            break;
+                }
+                else
+                    why = targetWhy(w, here, t);
+                if (why !== null && d.subtreesOnly === true && !why.includes("~/."))
+                    why = null;
+                if (why !== null) {
+                    const command = argv.map((a) => a.text).join(" ");
+                    return { refused: true, why: d.label !== undefined ? `${command} — ${d.label} over ${why}` : `${command} — its target is ${why}` };
+                }
+            }
+        }
+        return { refused: false };
+    };
+    const top = parseShellLooseChecked(commandLine);
+    if (top.truncated)
+        return { refused: true, why: NESTED_TOO_DEEP };
+    return walk(top.nodes, { cwds: [workspaceRoot], lastCd: null, prev: null }, 0);
+}
+/** B6, second pass: a line the reader stopped short on is a line it could
+ *  not read — past the nesting it follows, bash still runs every level. */
+const NESTED_TOO_DEEP = "the line is nested deeper than the floor reads";
+/** Is there a destructive command anywhere in the line, whatever its
+ *  target? A saved allow is never inherited by one (plan §4). */
+export function isDestructive(commandLine) {
+    const seen = new Set();
+    const visit = (line, depth) => {
+        const read = parseShellLooseChecked(line);
+        return read.truncated || looseCommands(read.nodes).some(({ argv: raw }) => {
+            const argv = unwrap(raw);
+            const inner = innerLines(argv, homedir());
+            if (inner !== null) {
+                return (depth < MAX_INNER_DEPTH &&
+                    inner.lines.some((l) => {
+                        if (seen.has(l) || seen.size >= MAX_INNER_LINES)
+                            return false;
+                        seen.add(l);
+                        return visit(l, depth + 1);
+                    }));
+            }
+            return destructiveTargets(argv) !== null;
+        });
+    };
+    return visit(commandLine, 0);
+}
+const ABSTAIN = { action: "abstain" };
+/** The chain member, at the chain's head: DENY or ABSTAIN. */
+export function floorExtension(on, workspaceRoot, check = floorCheck) {
+    return {
+        name: "floor",
+        approvals: [
+            {
+                decide: (call) => {
+                    if (call.name !== "shell" || !on())
+                        return ABSTAIN;
+                    const command = call.input.command;
+                    if (typeof command !== "string")
+                        return ABSTAIN;
+                    // B6: a read that THROWS is not "a line it cannot follow" — it
+                    // is a line that knocked the reader out, and letting the
+                    // runtime degrade the throw to an ask handed it to bypass's
+                    // allow. The floor denies what it could not read.
+                    let v;
+                    try {
+                        v = check(command, workspaceRoot());
+                    }
+                    catch (err) {
+                        return { action: "deny", reason: `the floor could not read this line (${err instanceof Error ? err.name : "error"}) — kiso does not run it.` };
+                    }
+                    return v.refused ? { action: "deny", reason: `the floor refused this: ${v.why}. kiso never runs it, in any mode.` } : ABSTAIN;
+                },
+            },
+        ],
+    };
+}
+/** Plan §4: "destructive commands never inherit a saved allow in the
+ *  asking modes" — the predicate the saved-allow wrap
+ *  (protected-writes.ts) is given, keyed on destructiveness, not on the
+ *  target: a saved allow never runs even `rm -rf build` unasked. */
+export function isDestructiveCall(call) {
+    if (call.name !== "shell" || typeof call.input.command !== "string")
+        return false;
+    // B6: unreadable is treated as destructive — the saved allow abstains
+    try {
+        return isDestructive(call.input.command);
+    }
+    catch {
+        return true;
+    }
+}