@westbayberry/dg 2.3.2 → 2.3.4

package/dist/launcher/agent-check.js

@@ -101,6 +101,14 @@ function splitSegments(line) {
     let buf = "";
     let quote = null;
     let ansiC = false;
+    // Track depth INSIDE substitution groups — `$(…)` command-sub and `<(…)`/`>(…)`
+    // process-sub — whose bodies collectSegments re-extracts and re-screens as a
+    // whole. A separator there (`sh <(true | echo npm i evil)`) must not shear the
+    // group, or the body extractor never sees a balanced span. A BARE `(…)` subshell
+    // is NOT tracked: its `&&`/`;`-joined install (`(cd x && npm i evil)`) has no
+    // separate extractor, so it must still split normally.
+    const parenTracked = [];
+    let substDepth = 0;
     const push = () => {
         const t = buf.trim();
         if (t) {
@@ -160,6 +168,27 @@ function splitSegments(line) {
             buf += ch;
             continue;
         }
+        if (ch === "(") {
+            const tracked = line[i - 1] === "<" || line[i - 1] === ">" || line[i - 1] === "$";
+            parenTracked.push(tracked);
+            if (tracked) {
+                substDepth += 1;
+            }
+            buf += ch;
+            continue;
+        }
+        if (ch === ")") {
+            if (parenTracked.pop() === true && substDepth > 0) {
+                substDepth -= 1;
+            }
+            buf += ch;
+            continue;
+        }
+        if (substDepth > 0) {
+            // Inside a substitution group: keep the body intact for its extractor.
+            buf += ch;
+            continue;
+        }
         if (ch === "#" && (i === 0 || /\s/.test(line[i - 1] ?? ""))) {
             // A bash comment begins at an unquoted `#` on a word boundary and runs to
             // end of line; the shell never executes that text, so splitting it into a
@@ -200,25 +229,149 @@ function splitSegments(line) {
     push();
     return segments;
 }
+// Extract a balanced `(…)` span starting at the index of its opening paren,
+// honoring nested parens and quotes inside (so a `)` inside a quoted string does
+// not close it early — `$(echo "(" ; npm install evil)` yields the whole body,
+// not a truncated one that would drop the install). Returns null if unbalanced.
+function extractParenBody(line, openParen) {
+    let depth = 0;
+    let q = null;
+    for (let j = openParen; j < line.length; j += 1) {
+        const c = line[j] ?? "";
+        if (q === "'") {
+            if (c === "'") {
+                q = null;
+            }
+            continue;
+        }
+        if (q === '"') {
+            if (c === "\\" && j + 1 < line.length) {
+                j += 1;
+                continue;
+            }
+            if (c === '"') {
+                q = null;
+            }
+            continue;
+        }
+        if (c === "\\" && j + 1 < line.length) {
+            j += 1;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            q = c;
+            continue;
+        }
+        if (c === "(") {
+            depth += 1;
+        }
+        else if (c === ")") {
+            depth -= 1;
+            if (depth === 0) {
+                return { text: line.slice(openParen + 1, j).trim(), end: j };
+            }
+        }
+    }
+    return null;
+}
+function extractBacktick(line, openTick) {
+    for (let j = openTick + 1; j < line.length; j += 1) {
+        const c = line[j] ?? "";
+        if (c === "\\" && j + 1 < line.length) {
+            j += 1;
+            continue;
+        }
+        if (c === "`") {
+            return { text: line.slice(openTick + 1, j).trim(), end: j };
+        }
+    }
+    return null;
+}
+// `$(…)`, backtick, and process substitution `<(…)` / `>(…)` run their body as a
+// command, so an install hidden inside one must be re-screened — but only where
+// the shell would actually execute it. A substitution inside SINGLE quotes is
+// literal text the shell never runs (`git commit -m '$(npm install x)'`), so
+// extracting it is a false block. Double-quoted `$(…)`/backtick still execute,
+// so those are kept; `<(…)`/`>(…)` are a word-level construct only when unquoted.
 function substitutionBodies(line) {
     const bodies = [];
-    // `$(…)`, backtick, and process substitution `<(…)` / `>(…)` all run their
-    // body as a command, so an install hidden inside one must be re-screened.
-    const patterns = [/\$\(([^)]*)\)/g, /`([^`]*)`/g, /<\(([^)]*)\)/g, />\(([^)]*)\)/g];
-    for (const pattern of patterns) {
-        let m;
-        while ((m = pattern.exec(line)) !== null) {
-            const body = (m[1] ?? "").trim();
-            if (body) {
-                bodies.push(body);
+    let quote = null;
+    let ansiC = false;
+    const take = (body, i) => {
+        if (body) {
+            if (body.text) {
+                bodies.push(body.text);
+            }
+            return body.end;
+        }
+        return i;
+    };
+    for (let i = 0; i < line.length; i += 1) {
+        const ch = line[i] ?? "";
+        if (ansiC) {
+            if (ch === "\\" && i + 1 < line.length) {
+                i += 1;
+                continue;
+            }
+            if (ch === "'") {
+                ansiC = false;
+            }
+            continue;
+        }
+        if (quote === "'") {
+            if (ch === "'") {
+                quote = null;
+            }
+            continue;
+        }
+        if (quote === '"') {
+            if (ch === "\\" && i + 1 < line.length) {
+                i += 1;
+                continue;
+            }
+            if (ch === '"') {
+                quote = null;
+                continue;
+            }
+            if (ch === "$" && line[i + 1] === "(") {
+                i = take(extractParenBody(line, i + 1), i);
+                continue;
+            }
+            if (ch === "`") {
+                i = take(extractBacktick(line, i), i);
             }
+            continue;
+        }
+        if (ch === "\\" && i + 1 < line.length) {
+            i += 1;
+            continue;
+        }
+        if (ch === "$" && line[i + 1] === "'") {
+            ansiC = true;
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if (ch === "$" && line[i + 1] === "(") {
+            i = take(extractParenBody(line, i + 1), i);
+            continue;
+        }
+        if ((ch === "<" || ch === ">") && line[i + 1] === "(") {
+            i = take(extractParenBody(line, i + 1), i);
+            continue;
+        }
+        if (ch === "`") {
+            i = take(extractBacktick(line, i), i);
         }
     }
     return bodies;
 }
 function collectSegments(line) {
     const texts = [];
-    const pending = [line];
+    const pending = [stripHeredocBodies(line)];
     while (pending.length > 0) {
         const current = pending.pop();
         if (current === undefined || texts.includes(current)) {
@@ -226,6 +379,9 @@ function collectSegments(line) {
         }
         texts.push(current);
         pending.push(...substitutionBodies(current));
+        pending.push(...hereStringBodies(current));
+        pending.push(...pipedLiteralScripts(current));
+        pending.push(...processSubScripts(current));
     }
     const segments = [];
     for (const segment of texts.flatMap(splitSegments)) {
@@ -338,7 +494,15 @@ function lexSegment(segment) {
                 }
                 if (c === "\\" && i + 1 < n) {
                     const nx = segment[i + 1] ?? "";
-                    if (nx === '"' || nx === "\\" || nx === "`" || nx === "$" || nx === "\n") {
+                    if (nx === "\n") {
+                        i += 2;
+                        continue;
+                    }
+                    if (nx === "\r") {
+                        i += segment[i + 2] === "\n" ? 3 : 2;
+                        continue;
+                    }
+                    if (nx === '"' || nx === "\\" || nx === "`" || nx === "$") {
                         cur += nx;
                         i += 2;
                         continue;
@@ -384,6 +548,15 @@ function lexSegment(segment) {
             continue;
         }
         if (ch === "\\") {
+            const nx = segment[i + 1];
+            if (nx === "\n") {
+                i += 2;
+                continue;
+            }
+            if (nx === "\r") {
+                i += segment[i + 2] === "\n" ? 3 : 2;
+                continue;
+            }
             if (i + 1 < n) {
                 cur += segment[i + 1];
                 started = true;
@@ -431,6 +604,11 @@ function lexSegment(segment) {
     return { tokens, ok: true };
 }
 const ENV_ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*=/;
+const BWRAP_SPEC = {
+    valueFlags: new Set(["--args", "--argv0", "--chdir", "--unsetenv", "--uid", "--gid", "--hostname", "--tmpfs", "--dir", "--proc", "--dev", "--mqueue", "--remount-ro", "--size", "--perms", "--seccomp", "--userns", "--userns2", "--pidns", "--cap-add", "--cap-drop", "--exec-label", "--file-label", "--block-fd", "--userns-block-fd", "--info-fd", "--json-status-fd", "--sync-fd", "--overlay-src", "--tmp-overlay", "--ro-overlay"]),
+    dualValueFlags: new Set(["--bind", "--ro-bind", "--dev-bind", "--bind-try", "--ro-bind-try", "--dev-bind-try", "--bind-fd", "--ro-bind-fd", "--bind-data", "--ro-bind-data", "--file", "--symlink", "--setenv", "--chmod"]),
+    tripleValueFlags: new Set(["--overlay"]),
+};
 const WRAPPERS = new Map([
     ["sudo", { valueFlags: new Set(["-u", "--user", "-g", "--group", "-p", "--prompt", "-C", "-h", "--host", "-R", "--chroot", "-D", "--chdir"]) }],
     ["doas", { valueFlags: new Set(["-u", "-C", "-a"]) }],
@@ -444,31 +622,534 @@ const WRAPPERS = new Map([
     ["ionice", { valueFlags: new Set(["-c", "--class", "-n", "--classdata", "-p", "--pid"]) }],
     ["nohup", { valueFlags: new Set() }],
     ["setsid", { valueFlags: new Set() }],
-    ["chrt", { valueFlags: new Set(["-T", "-P", "-D"]) }],
+    ["chrt", { valueFlags: new Set(["-T", "-P", "-D"]), bareValue: /^\d+$/ }],
     ["time", { valueFlags: new Set(["-o", "--output", "-f", "--format"]) }],
     ["timeout", { valueFlags: new Set(["-s", "--signal", "-k", "--kill-after"]), bareValue: /^\d+(\.\d+)?[smhd]?$/ }],
     ["stdbuf", { valueFlags: new Set(["-i", "--input", "-o", "--output", "-e", "--error"]) }],
+    // macOS keeps-awake prefix (`caffeinate npm i x`) — a built-in on the platform
+    // dg ships to, so a real exec wrapper that otherwise waves the install through.
+    ["caffeinate", { valueFlags: new Set(["-t", "-w"]) }],
+    // macOS architecture launcher (`arch -x86_64 npm i x`, `arch -arch x86_64 …`).
+    ["arch", { valueFlags: new Set(["-arch"]) }],
+    ["eatmydata", { valueFlags: new Set() }],
+    ["proxychains", { valueFlags: new Set(["-f"]) }],
+    ["proxychains4", { valueFlags: new Set(["-f"]) }],
+    ["torsocks", { valueFlags: new Set(["-p", "--port", "-a", "--address", "-c", "--config"]) }],
+    ["numactl", { valueFlags: new Set(["-N", "--cpunodebind", "-m", "--membind", "-C", "--physcpubind", "-i", "--interleave", "-p", "--preferred", "-s", "--shm"]) }],
+    // GNU watch runs its operand through `sh -c`, so `watch npm install x` is a real
+    // install; the remaining tokens ARE that command, so a plain unwrap is correct.
+    ["watch", { valueFlags: new Set(["-n", "--interval"]) }],
+    // taskset/setarch carry one bare operand (a CPU mask / an arch name) before the
+    // command; a package-manager head never matches those shapes, so consuming the
+    // shaped operand cannot swallow the real command head.
+    ["taskset", { valueFlags: new Set(["-c", "--cpu-list", "-p", "--pid"]), bareValue: /^(?:0x[0-9a-fA-F]+|[0-9][0-9,-]*)$/ }],
+    ["setarch", { valueFlags: new Set(), bareValue: /^(?:i[3-6]86|x86_64|ppc(?:64(?:le)?)?|s390x?|sparc(?:64)?|mips(?:64)?|ia64|aarch64|arm(?:v[0-9]+l)?|linux32|linux64|uname-2\.6)$/ }],
+    // `runuser -u user -- npm i x` execs the command after `--` directly (the `--`
+    // token starts with `-`, so the wrapper loop consumes it); the `-c '<script>'`
+    // shell form is caught by the su/runuser/flock branch in commandTokens first.
+    ["runuser", { valueFlags: new Set(["-u", "--user", "-g", "--group", "-G", "--supp-group", "-s", "--shell"]) }],
+    // PolicyKit sibling of sudo/doas; container init/exec wrappers. gosu/su-exec
+    // carry one bare user[:group] operand and are handled in commandTokens below.
+    ["pkexec", { valueFlags: new Set(["--user"]) }],
+    ["tini", { valueFlags: new Set(["-e", "-p"]) }],
+    ["dumb-init", { valueFlags: new Set(["-r", "--rewrite"]) }],
     ["xargs", { valueFlags: new Set(["-a", "--arg-file", "-d", "--delimiter", "-E", "-e", "--eof", "-I", "-i", "--replace", "-L", "-l", "--max-lines", "-n", "--max-args", "-P", "--max-procs", "-s", "--max-chars"]) }],
+    // busybox is a multi-call binary: `busybox sh -c '…'` runs the sh applet. With
+    // no value flags the applet name becomes the next head, so `sh` re-enters the
+    // SHELL_EXEC `-c` extraction below.
+    ["busybox", { valueFlags: new Set() }],
+    ["unshare", { valueFlags: new Set(["-S", "--setuid", "-G", "--setgid", "--map-user", "--map-group", "--setgroups", "-w", "--wd"]) }],
+    ["nsenter", { valueFlags: new Set(["-t", "--target", "-S", "--setuid", "-G", "--setgid", "-w", "--wd"]) }],
+    ["setpriv", { valueFlags: new Set(["--reuid", "--regid", "--groups", "--bounding-set", "--inh-caps", "--ambient-caps", "--securebits", "--pdeathsig", "--selinux-label", "--apparmor-profile"]) }],
+    ["flatpak-spawn", { valueFlags: new Set(["--env", "--directory", "--forward-fd"]) }],
+    // bwrap/bubblewrap is the standard Linux sandbox (Flatpak/CI). Its bind/setenv
+    // family takes TWO operands (SRC DEST / VAR VALUE) and --overlay takes THREE, so
+    // the multi-value sets are load-bearing: a short skip parks on a later operand
+    // and waves the wrapped `npm install` through. Zero-arg flags (--unshare-*,
+    // --die-with-parent, --clearenv, …) are intentionally absent so they are
+    // consumed flag-only. Shared by both spellings so the two can't drift.
+    ["bwrap", BWRAP_SPEC],
+    ["bubblewrap", BWRAP_SPEC],
+]);
+// Shells that run their `-c` operand as a command (so `ksh -c 'npm i x'` must be
+// re-parsed). script(1) runs its `-c`/`--command` value the same way.
+const SHELL_EXEC = new Set(["sh", "bash", "zsh", "dash", "ash", "ksh", "mksh", "fish", "script"]);
+// Commands that take a package-manager NAME as literal DATA (search/print/inspect),
+// not as a command to run. The unknown-wrapper backstop skips these so a benign
+// `grep npm install …` / `echo npm install` is not deferred.
+const DATA_HEADS = new Set([
+    "echo", "printf", "grep", "egrep", "fgrep", "rg", "ag", "cat", "man", "which", "type",
+    "whereis", "find", "ls", "head", "tail", "sed", "awk", "test", "[", "basename", "dirname",
+    "wc", "sort", "uniq", "tr", "cut", "tee", "less", "more", "cmp", "diff",
 ]);
-const SHELL_EXEC = new Set(["sh", "bash", "zsh", "dash", "ash"]);
-// Control-flow keywords that introduce a command (`if …; then <cmd>`, `for …;
-// do <cmd>`, `! <cmd>`). The segmenter splits on `;`, so the command after one
-// lands at the head of its segment behind the keyword — strip it or a real
-// `do npm install <pkg>` is read as the no-op command `do`.
-const SHELL_KEYWORDS = new Set(["then", "do", "else", "elif", "!"]);
+// Control-flow keywords that introduce a command. The segmenter splits on `;`,
+// so the command after one lands at the head of its segment behind the keyword
+// — strip it or a real install behind it is read as the no-op keyword. This
+// covers both the body introducers (`then`/`do`/`else`/`elif`) and the
+// condition introducers (`if`/`while`/`until`): bash runs the condition pipeline
+// of `if npm install x; then …` and `until npm install x; do …`, so the install
+// there must be classified, not waved through. `!` negates the next command.
+const SHELL_KEYWORDS = new Set(["then", "do", "else", "elif", "!", "if", "while", "until"]);
 // A `case … in <pat>) <cmd> ;;` arm label, e.g. `a)`, `*)`, `*.js)`, `a|b)`.
 const CASE_LABEL = /^[A-Za-z0-9_*?.\][|@!+-]+\)$/;
+// Commands that run their heredoc body as shell input. `.`/`source` read it as a
+// script; `eval` evaluates it; the shells exec it. A heredoc fed to one of these
+// (`sh <<EOF … EOF`, `. /dev/stdin <<EOF`) executes the body, so the body must be
+// screened. A heredoc to a data sink (cat/tee/wc/ssh) is inert text.
+const HEREDOC_EXEC_HEADS = new Set([...SHELL_EXEC, "eval", "source", "."]);
+// Locate heredoc introducers (`<<WORD`, `<<-WORD`, `<<"WORD"`, `<<'WORD'`) on a
+// line, quote-aware so a `<<` inside a string is not one, and excluding the
+// here-string `<<<`.
+function heredocDelimiters(introLine) {
+    const result = [];
+    let quote = null;
+    for (let i = 0; i < introLine.length; i += 1) {
+        const ch = introLine[i] ?? "";
+        if (quote) {
+            if (ch === "\\" && quote === '"' && i + 1 < introLine.length) {
+                i += 1;
+            }
+            else if (ch === quote) {
+                quote = null;
+            }
+            continue;
+        }
+        if (ch === "\\") {
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if (ch === "<" && introLine[i + 1] === "<" && introLine[i + 2] !== "<") {
+            let j = i + 2;
+            let strip = false;
+            if (introLine[j] === "-") {
+                strip = true;
+                j += 1;
+            }
+            while (introLine[j] === " " || introLine[j] === "\t") {
+                j += 1;
+            }
+            let wordQuote = null;
+            if (introLine[j] === '"' || introLine[j] === "'") {
+                wordQuote = introLine[j] ?? null;
+                j += 1;
+            }
+            let delim = "";
+            while (j < introLine.length) {
+                const c = introLine[j] ?? "";
+                if (wordQuote) {
+                    if (c === wordQuote) {
+                        j += 1;
+                        break;
+                    }
+                    delim += c;
+                    j += 1;
+                    continue;
+                }
+                if (/[A-Za-z0-9_]/.test(c)) {
+                    delim += c;
+                    j += 1;
+                    continue;
+                }
+                break;
+            }
+            if (delim) {
+                result.push({ delim, strip });
+                i = j - 1;
+            }
+        }
+    }
+    return result;
+}
+function hasUnquotedPipe(line) {
+    let quote = null;
+    for (let i = 0; i < line.length; i += 1) {
+        const ch = line[i] ?? "";
+        if (quote) {
+            if (ch === "\\" && quote === '"' && i + 1 < line.length) {
+                i += 1;
+            }
+            else if (ch === quote) {
+                quote = null;
+            }
+            continue;
+        }
+        if (ch === "\\") {
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if (ch === "|") {
+            return true;
+        }
+    }
+    return false;
+}
+// Would the shell run the heredoc body attached to this introducer line? A pipe
+// could feed it to a downstream shell (fail closed), and any command whose real
+// head (wrappers unwrapped: `env sh`, `timeout sh`, `xargs sh`) is a shell/eval
+// /source executes it. Otherwise the body is inert data to a sink.
+function introducerExecutesBody(introLine) {
+    if (hasUnquotedPipe(introLine)) {
+        return true;
+    }
+    for (const seg of splitSegments(introLine)) {
+        const head = commandBasename(commandTokens(seg).tokens[0] ?? "");
+        if (HEREDOC_EXEC_HEADS.has(head)) {
+            return true;
+        }
+    }
+    return false;
+}
+// Drop heredoc bodies the shell never executes so their lines are not mis-read as
+// command segments (`cat <<EOF … npm install x … EOF` is data to cat, not an
+// install). Bodies a shell would run are kept for screening; an unterminated
+// heredoc is kept too (fail closed).
+function stripHeredocBodies(line) {
+    if (!line.includes("<<")) {
+        return line;
+    }
+    const physical = line.split("\n");
+    const out = [];
+    let i = 0;
+    while (i < physical.length) {
+        const cur = physical[i] ?? "";
+        out.push(cur);
+        i += 1;
+        const introducers = heredocDelimiters(cur);
+        if (introducers.length === 0) {
+            continue;
+        }
+        const executes = introducerExecutesBody(cur);
+        for (const introducer of introducers) {
+            const body = [];
+            let terminated = false;
+            while (i < physical.length) {
+                const bodyLine = physical[i] ?? "";
+                const probe = introducer.strip ? bodyLine.replace(/^\t+/, "") : bodyLine;
+                i += 1;
+                if (probe === introducer.delim) {
+                    terminated = true;
+                    break;
+                }
+                body.push(bodyLine);
+            }
+            if (executes || !terminated) {
+                out.push(...body);
+            }
+        }
+    }
+    return out.join("\n");
+}
+// Quote/escape-aware index of the first `<<<` here-string operator, or -1.
+function firstHereString(seg) {
+    let quote = null;
+    for (let i = 0; i < seg.length; i += 1) {
+        const ch = seg[i] ?? "";
+        if (quote === "'") {
+            if (ch === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === '"') {
+            if (ch === "\\" && i + 1 < seg.length) {
+                i += 1;
+                continue;
+            }
+            if (ch === '"')
+                quote = null;
+            continue;
+        }
+        if (ch === "\\" && i + 1 < seg.length) {
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if (ch === "<" && seg[i + 1] === "<" && seg[i + 2] === "<")
+            return i;
+    }
+    return -1;
+}
+// `<head> <<< WORD` feeds WORD to head's stdin; a shell/eval/source head runs it
+// as a script. The lexer drops the `<<<` redirection target, and heredoc parsing
+// skips `<<<`, so an install hidden in a here-string is never screened. Recover
+// the (dequoted) word for those heads so it is re-parsed; a here-string to a sink
+// (cat/grep) is inert and ignored.
+function hereStringBodies(line) {
+    const out = [];
+    for (const seg of splitSegments(line)) {
+        const at = firstHereString(seg);
+        if (at < 0) {
+            continue;
+        }
+        const head = commandBasename(commandTokens(seg.slice(0, at)).tokens[0] ?? "");
+        if (!HEREDOC_EXEC_HEADS.has(head)) {
+            continue;
+        }
+        const word = lexSegment(seg.slice(at + 3)).tokens[0];
+        if (word) {
+            out.push(word);
+        }
+    }
+    return out;
+}
+// Split a line into pipeline stages, recording whether each stage feeds the next
+// through a single `|` (not `||`/`;`/`&&`/`&`). Quote/escape/ANSI-C aware so a
+// `|` inside a string is data, not a stage boundary.
+function splitPipeStages(line) {
+    const stages = [];
+    let buf = "";
+    let quote = null;
+    let ansiC = false;
+    const parenTracked = [];
+    let substDepth = 0;
+    const push = (pipedToNext) => {
+        stages.push({ text: buf.trim(), pipedToNext });
+        buf = "";
+    };
+    for (let i = 0; i < line.length; i += 1) {
+        const ch = line[i] ?? "";
+        if (ansiC) {
+            if (ch === "\\" && i + 1 < line.length) {
+                buf += ch + line[i + 1];
+                i += 1;
+                continue;
+            }
+            buf += ch;
+            if (ch === "'")
+                ansiC = false;
+            continue;
+        }
+        if (quote === "'") {
+            buf += ch;
+            if (ch === "'")
+                quote = null;
+            continue;
+        }
+        if (quote === '"') {
+            if (ch === "\\" && i + 1 < line.length) {
+                buf += ch + line[i + 1];
+                i += 1;
+                continue;
+            }
+            buf += ch;
+            if (ch === '"')
+                quote = null;
+            continue;
+        }
+        if (ch === "$" && line[i + 1] === "'") {
+            ansiC = true;
+            buf += "$'";
+            i += 1;
+            continue;
+        }
+        if (ch === "\\" && i + 1 < line.length) {
+            buf += ch + line[i + 1];
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            buf += ch;
+            continue;
+        }
+        if (ch === "(") {
+            const tracked = line[i - 1] === "<" || line[i - 1] === ">" || line[i - 1] === "$";
+            parenTracked.push(tracked);
+            if (tracked)
+                substDepth += 1;
+            buf += ch;
+            continue;
+        }
+        if (ch === ")") {
+            if (parenTracked.pop() === true && substDepth > 0)
+                substDepth -= 1;
+            buf += ch;
+            continue;
+        }
+        if (substDepth > 0) {
+            buf += ch;
+            continue;
+        }
+        if (ch === "|") {
+            if (line[i + 1] === "|") {
+                push(false);
+                i += 1;
+                continue;
+            }
+            push(true);
+            continue;
+        }
+        if (ch === "\n" || ch === "\r" || ch === ";") {
+            push(false);
+            continue;
+        }
+        if (ch === "&") {
+            if (line[i + 1] === "&") {
+                push(false);
+                i += 1;
+                continue;
+            }
+            if (line[i - 1] === ">" || line[i + 1] === ">") {
+                buf += ch;
+                continue;
+            }
+            push(false);
+            continue;
+        }
+        buf += ch;
+    }
+    push(false);
+    return stages;
+}
+// `echo/printf "<script>" | … | sh` (bash/eval/source/.): the printed literal is
+// run by the downstream shell, so the install in it must be screened. Scan the
+// WHOLE pipeline (not just the stage adjacent to the shell) so an interposed
+// passthrough filter (`echo x | cat | sh`) can't hide the producer, and emit
+// several candidate scripts per producer so a printf format string
+// (`printf '%s\n' 'npm install evil'`) can't shield the install. A pipeline into
+// a non-shell (grep/wc) stays inert.
+function pipedLiteralScripts(line) {
+    const out = [];
+    const stages = splitPipeStages(line);
+    let i = 0;
+    while (i < stages.length) {
+        let j = i;
+        while (j < stages.length && stages[j]?.pipedToNext) {
+            j += 1;
+        }
+        const pipeline = stages.slice(i, j + 1);
+        i = j + 1;
+        if (pipeline.length < 2) {
+            continue;
+        }
+        const lastHead = commandBasename(commandTokens(pipeline[pipeline.length - 1]?.text ?? "").tokens[0] ?? "");
+        if (!HEREDOC_EXEC_HEADS.has(lastHead)) {
+            continue;
+        }
+        for (let k = 0; k < pipeline.length - 1; k += 1) {
+            const stageText = pipeline[k]?.text ?? "";
+            const prod = commandTokens(stageText);
+            const phead = commandBasename(prod.tokens[0] ?? "");
+            // A producer that relays a process-sub file's bytes downstream
+            // (`cat <(echo npm i evil) | sh`) feeds the printed text to the shell too;
+            // already scoped to a shell-terminated pipeline by the lastHead guard above.
+            out.push(...procSubLiteralBodies(stageText));
+            if (phead !== "echo" && phead !== "printf") {
+                continue;
+            }
+            const args = prod.tokens.slice(1).filter((t) => !t.startsWith("-"));
+            if (args.length === 0) {
+                continue;
+            }
+            out.push(args.join(" "));
+            if (phead === "printf" && args.length > 1) {
+                // printf's first non-flag arg is the format; the install may live in the
+                // operands it substitutes, so also screen the operands alone.
+                out.push(args.slice(1).join(" "));
+                for (const operand of args.slice(1)) {
+                    out.push(operand);
+                }
+            }
+        }
+    }
+    return out;
+}
+// `<head> <(echo|printf …)` — a shell/eval/source head runs the PRODUCER's output
+// as a script (bash reads the /dev/fd the substitution resolves to). The lexer
+// drops `<(…)` as a redirection, so the install in the producer is otherwise
+// never screened. This is the process-substitution sibling of the `echo … | sh`
+// (pipedLiteralScripts) and `sh <<< …` (hereStringBodies) cases.
+function procSubLiteralBodies(text, depth = 0) {
+    const out = [];
+    if (depth > 8) {
+        return out;
+    }
+    let quote = null;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text[i] ?? "";
+        if (quote) {
+            if (ch === "\\" && quote === '"' && i + 1 < text.length) {
+                i += 1;
+                continue;
+            }
+            if (ch === quote) {
+                quote = null;
+            }
+            continue;
+        }
+        if (ch === "\\" && i + 1 < text.length) {
+            i += 1;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if ((ch === "<" || ch === ">") && text[i + 1] === "(") {
+            const body = extractParenBody(text, i + 1);
+            if (!body) {
+                continue;
+            }
+            // The body is run and its OUTPUT becomes the consumer's script, so harvest
+            // an echo/printf literal from ANY pipe stage of the body (`<(true | echo
+            // npm i evil)`), not just its head. A relay producer wrapping a nested
+            // process-sub (`<(cat <(echo npm i evil))`) is reached by the recursion.
+            for (const stage of splitPipeStages(body.text)) {
+                const prod = commandTokens(stage.text);
+                const phead = commandBasename(prod.tokens[0] ?? "");
+                if (phead === "echo" || phead === "printf") {
+                    const args = prod.tokens.slice(1).filter((t) => !t.startsWith("-"));
+                    if (args.length > 0) {
+                        out.push(args.join(" "));
+                        if (phead === "printf" && args.length > 1) {
+                            out.push(args.slice(1).join(" "));
+                            for (const operand of args.slice(1)) {
+                                out.push(operand);
+                            }
+                        }
+                    }
+                }
+            }
+            out.push(...procSubLiteralBodies(body.text, depth + 1));
+            i = body.end;
+        }
+    }
+    return out;
+}
+function processSubScripts(line) {
+    const out = [];
+    for (const seg of splitSegments(line)) {
+        const head = commandBasename(commandTokens(seg).tokens[0] ?? "");
+        if (!HEREDOC_EXEC_HEADS.has(head)) {
+            continue;
+        }
+        out.push(...procSubLiteralBodies(seg));
+    }
+    return out;
+}
 // Package managers dg doesn't statically screen (no shim, no classifier). A
 // recognized install verb for one of these can't be screened by the hook, so it
 // defers to the runtime gate rather than waving it through silently.
 const UNSUPPORTED_INSTALLS = new Map([
-    ["bun", new Set(["add", "install", "i", "x"])],
-    ["deno", new Set(["install", "add"])],
-    ["poetry", new Set(["add", "install"])],
-    ["pdm", new Set(["add", "install"])],
-    ["conda", new Set(["install", "create"])],
-    ["mamba", new Set(["install", "create"])],
-    ["gem", new Set(["install", "i"])],
+    ["bun", new Set(["add", "install", "i", "x", "create"])],
+    ["deno", new Set(["install", "add", "cache"])],
+    ["poetry", new Set(["add", "install", "update"])],
+    ["pdm", new Set(["add", "install", "update"])],
+    ["conda", new Set(["install", "create", "update"])],
+    ["mamba", new Set(["install", "create", "update"])],
+    ["micromamba", new Set(["install", "create", "update"])],
+    ["pipenv", new Set(["install", "update", "sync"])],
+    ["gem", new Set(["install", "i", "fetch"])],
     // `go install`/`go get` fetch and build remote modules; `go build`/`run`/`test`
     // operate on already-resolved local code, so they stay passthrough.
     ["go", new Set(["install", "get"])],
@@ -477,10 +1158,64 @@ const UNSUPPORTED_INSTALLS = new Map([
 // fetched and executed, so a recognized-but-unsupported runner with a target
 // defers to the runtime gate instead of a silent allow (`bunx <pkg>`).
 const UNSUPPORTED_RUNNERS = new Set(["bunx"]);
+// Verb-form fetch-and-run launchers: `npm exec <tool> <tool-args…>`, `pnpm dlx`,
+// `yarn dlx`, `pnpm exec`, `pipx run`. Only the first positional (the fetched
+// tool) is a package; the rest are arguments to that tool, not packages to
+// screen. (The no-verb forms `npx`/`pnpx`/`uvx` already slice to the first.)
+const RUNNER_VERBS = new Set(["exec", "dlx", "run"]);
+// Install/fetch subcommands across the managers. Used only to decide whether a
+// segment whose head is dynamic (`$M install x`, `$(which npm) install x`)
+// looks like an install and must defer rather than wave through.
+const INSTALL_VERBS = new Set([
+    "install", "i", "ci", "add", "get", "download", "wheel", "sync", "upgrade", "dlx", "inject", "create",
+    "exec", "x", "up", "update", "fetch", "dedupe", "tool",
+    "in", "ins", "inst", "insta", "instal", "isnt", "isnta", "isntal", "isntall", "it", "cit", "sit", "ic",
+]);
+// `${IFS}` / `$IFS` expand to whitespace, so an attacker glues a command with
+// them to dodge word-splitting (`npm${IFS}install${IFS}evil`). Default IFS is
+// space/tab/newline; normalize the obfuscation back to a space before lexing.
+// `$IFS` is only the variable when not followed by another word character.
+const IFS_OBFUSCATION = /\$\{IFS\}|\$IFS(?![A-Za-z0-9_])/g;
 function commandBasename(token) {
     const slash = token.lastIndexOf("/");
     return slash === -1 ? token : token.slice(slash + 1);
 }
+// Bash allows whitespace between a function name and its `()` (`f () {…}`,
+// `f ( ) {…}`, `function f () {…}`), which the lexer splits into separate
+// `(`/`)`/`()`/`(){` tokens. Collapse that leading run into the glued `name()`
+// shape so the function-definition strip in commandTokens recognizes it. Only
+// fires when a `{` body follows the parens — a subshell command list `(cmd)`
+// has no name token before the paren, so it is untouched.
+function glueFunctionDefParens(tokens) {
+    const i = tokens[0] === "function" ? 1 : 0;
+    const name = tokens[i] ?? "";
+    if (!/^[A-Za-z_][\w-]*$/.test(name)) {
+        return [...tokens];
+    }
+    let j = i + 1;
+    let sawParen = false;
+    while (j < tokens.length && (tokens[j] === "(" || tokens[j] === ")")) {
+        sawParen = true;
+        j += 1;
+    }
+    let bracePart = "";
+    if (j < tokens.length && (tokens[j] === "()" || tokens[j] === "(){")) {
+        sawParen = true;
+        if (tokens[j] === "(){") {
+            bracePart = "{";
+        }
+        j += 1;
+    }
+    if (!sawParen || j === i + 1) {
+        return [...tokens];
+    }
+    const braceFollows = bracePart === "{" || (j < tokens.length && (tokens[j] === "{" || (tokens[j] ?? "").startsWith("{")));
+    if (!braceFollows) {
+        return [...tokens];
+    }
+    const collapsed = bracePart === "{" ? `${name}(){` : `${name}()`;
+    return [...tokens.slice(0, i), collapsed, ...tokens.slice(j)];
+}
 // Drop shell grouping punctuation: a subshell `(…)`, a brace group `{ …; }`, and
 // stray `;` so the wrapped command underneath is reached.
 function stripGrouping(tokens) {
@@ -492,15 +1227,40 @@ function stripGrouping(tokens) {
     return out.filter((t) => t.length > 0);
 }
 function commandTokens(segment) {
-    const lexed = lexSegment(segment);
-    let tokens = stripGrouping(lexed.tokens);
+    const lexed = lexSegment(segment.replace(IFS_OBFUSCATION, " "));
+    const normalized = glueFunctionDefParens(lexed.tokens);
+    let tokens = stripGrouping(normalized);
     let viaXargs = false;
-    const x = () => (viaXargs ? { viaXargs: true } : {});
+    const inlineEnv = {};
+    const x = () => ({
+        ...(viaXargs ? { viaXargs: true } : {}),
+        ...(Object.keys(inlineEnv).length > 0 ? { inlineEnv } : {}),
+    });
     for (;;) {
         while (tokens.length > 0 && ENV_ASSIGNMENT.test(tokens[0] ?? "")) {
+            // An inline per-command assignment (`NPM_CONFIG_REGISTRY=https://evil npm i x`,
+            // also behind `env VAR=val …`) is applied by the shell to the install, so a
+            // registry/index override here must defer just like the --flag / process-env
+            // forms. Capture it for the alternate-index check rather than dropping it.
+            const assignment = tokens[0] ?? "";
+            const eq = assignment.indexOf("=");
+            inlineEnv[assignment.slice(0, eq)] = assignment.slice(eq + 1);
             tokens = tokens.slice(1);
         }
         const kw = tokens[0] ?? "";
+        if (kw === "coproc") {
+            // `coproc <cmd>`, anonymous `coproc { <cmd>; }`, and named `coproc NAME
+            // { <cmd>; }`. Only the NAMED form has a name token to drop — detect it in
+            // the pre-stripGrouping order (a bare name immediately followed by `{`), so
+            // the anonymous form's command head (`npm`) is never mistaken for the name.
+            const ci = normalized.indexOf("coproc");
+            const named = ci >= 0 && normalized[ci + 2] === "{" && /^[A-Za-z_]\w*$/.test(normalized[ci + 1] ?? "");
+            tokens = tokens.slice(1);
+            if (named) {
+                tokens = tokens.slice(1);
+            }
+            continue;
+        }
         if (SHELL_KEYWORDS.has(kw)) {
             tokens = tokens.slice(1);
             continue;
@@ -516,13 +1276,52 @@ function commandTokens(segment) {
             tokens = tokens.slice(1);
             continue;
         }
+        // A function DEFINITION whose body holds a real install: `f(){ npm i x; }`,
+        // `f() { … }`, `function f { … }`, `function f() { … }`. The segmenter split
+        // on `;`, so the body lands in this segment behind the def prefix — strip the
+        // prefix (and any glued `{`) so the body command is classified, not the def.
+        if (kw === "function") {
+            tokens = tokens.slice(1);
+            if (/^[A-Za-z_][\w-]*(?:\(\))?\{?$/.test(tokens[0] ?? "")) {
+                tokens = tokens.slice(1);
+            }
+            continue;
+        }
+        if (/^[A-Za-z_][\w-]*\(\)\{?$/.test(kw)) {
+            tokens = tokens.slice(1);
+            continue;
+        }
         const head = commandBasename(tokens[0] ?? "");
         if (head === "eval" && tokens.length > 1) {
             return { tokens, ok: lexed.ok, shellScript: tokens.slice(1).join(" "), ...x() };
         }
+        if (head === "trap") {
+            // `trap 'COMMANDS' SIGSPEC` runs COMMANDS when the trap fires — the same
+            // run-attacker-text-as-script shape as eval/sh -c. Re-parse the action.
+            // Skip the list/print flags (-l/-p) and the `--` separator; the reset form
+            // (`trap - EXIT`) and the bare list forms carry no action to screen.
+            let k = 1;
+            while (k < tokens.length && (tokens[k] ?? "").startsWith("-") && tokens[k] !== "-") {
+                const consumedSeparator = tokens[k] === "--";
+                k += 1;
+                if (consumedSeparator) {
+                    break;
+                }
+            }
+            const action = tokens[k];
+            if (action !== undefined && action !== "-") {
+                return { tokens, ok: lexed.ok, shellScript: action, ...x() };
+            }
+        }
         if (SHELL_EXEC.has(head)) {
             const ci = tokens.indexOf("-c");
-            const script = ci >= 0 ? tokens[ci + 1] : undefined;
+            let script = ci >= 0 ? tokens[ci + 1] : undefined;
+            if (script === undefined && tokens.slice(1).some((t) => /^-[A-Za-z]*c[A-Za-z]*$/.test(t))) {
+                // A combined short-flag cluster carrying -c (`bash -lc`, `sh -cx`,
+                // `bash -ic`): bash reads the command string from the first operand
+                // after the option group, so it is the first non-flag token.
+                script = tokens.slice(1).find((t) => !t.startsWith("-"));
+            }
             if (script !== undefined) {
                 return { tokens, ok: lexed.ok, shellScript: script, ...x() };
             }
@@ -552,6 +1351,67 @@ function commandTokens(segment) {
                 continue;
             }
         }
+        if (head === "env") {
+            // `env -S '<cmd args>'` / `env --split-string=<cmd>` splits the string
+            // into argv and runs it — a real exec path, so re-parse it as a script.
+            for (let k = 1; k < tokens.length; k += 1) {
+                const t = tokens[k] ?? "";
+                const next = tokens[k + 1];
+                if ((t === "-S" || t === "--split-string") && next !== undefined) {
+                    return { tokens, ok: lexed.ok, shellScript: next, ...x() };
+                }
+                const glued = /^(?:-S|--split-string=)(.+)$/.exec(t);
+                if (glued && glued[1]) {
+                    return { tokens, ok: lexed.ok, shellScript: glued[1], ...x() };
+                }
+            }
+        }
+        if (head === "su" || head === "runuser" || head === "flock") {
+            // su/runuser run a `-c '<script>'` (also `--session-command`) value through
+            // a login shell; flock runs its `-c '<command>'` value through $SHELL. Find
+            // that script and re-parse it so a wrapped install can't hide behind the
+            // privilege / lock prefix.
+            for (let k = 1; k < tokens.length; k += 1) {
+                const t = tokens[k] ?? "";
+                const next = tokens[k + 1];
+                if ((t === "-c" || t === "--command" || t === "--session-command") && next !== undefined) {
+                    return { tokens, ok: lexed.ok, shellScript: next, ...x() };
+                }
+                const glued = /^(?:-c|--command=|--session-command=)(.+)$/.exec(t);
+                if (glued && glued[1]) {
+                    return { tokens, ok: lexed.ok, shellScript: glued[1], ...x() };
+                }
+            }
+        }
+        if (head === "flock") {
+            // No `-c` form: `flock [opts] <lockfile|fd> <command...>`. Skip flock's own
+            // options (and the values of -w/-E), drop the one mandatory lock operand,
+            // then re-enter the loop with the wrapped command at the head.
+            const flockValueFlags = new Set(["-w", "--timeout", "-E", "--conflict-exit-code"]);
+            let k = 1;
+            while (k < tokens.length && (tokens[k] ?? "").startsWith("-")) {
+                const t = tokens[k] ?? "";
+                k += 1;
+                if (flockValueFlags.has(t) && k < tokens.length && !(tokens[k] ?? "").startsWith("-")) {
+                    k += 1;
+                }
+            }
+            if (k < tokens.length) {
+                k += 1;
+            }
+            tokens = tokens.slice(k);
+            continue;
+        }
+        if (head === "gosu" || head === "su-exec") {
+            // `gosu user[:group] <command...>` / `su-exec` — drop the head and the one
+            // mandatory user operand, then re-enter the loop with the wrapped command.
+            let k = 1;
+            if (k < tokens.length && !(tokens[k] ?? "").startsWith("-")) {
+                k += 1;
+            }
+            tokens = tokens.slice(k);
+            continue;
+        }
         const spec = WRAPPERS.get(head);
         if (head === "" || spec === undefined) {
             return { tokens, ok: lexed.ok, ...x() };
@@ -560,35 +1420,57 @@ function commandTokens(segment) {
             viaXargs = true;
         }
         tokens = tokens.slice(1);
-        if (spec.bareValue && tokens[0] !== undefined && !tokens[0].startsWith("-") && spec.bareValue.test(tokens[0])) {
-            tokens = tokens.slice(1);
-        }
-        while (tokens.length > 0 && (tokens[0] ?? "").startsWith("-")) {
-            const flag = tokens[0] ?? "";
-            tokens = tokens.slice(1);
-            if (spec.valueFlags.has(flag) && tokens.length > 0 && !(tokens[0] ?? "").startsWith("-")) {
+        // Consume leading wrapper option words and a bare value (timeout's
+        // duration, chrt's priority) in any order, so the real command head is
+        // reached even when the bare value follows the flags (`timeout -s KILL 60
+        // npm i x`).
+        for (;;) {
+            const t0 = tokens[0];
+            if (t0 !== undefined && spec.bareValue && !t0.startsWith("-") && spec.bareValue.test(t0)) {
                 tokens = tokens.slice(1);
+                continue;
             }
+            if (t0 !== undefined && t0.startsWith("-")) {
+                tokens = tokens.slice(1);
+                const consume = spec.tripleValueFlags?.has(t0) ? 3 : spec.dualValueFlags?.has(t0) ? 2 : spec.valueFlags.has(t0) ? 1 : 0;
+                for (let c = 0; c < consume && tokens.length > 0 && !(tokens[0] ?? "").startsWith("-"); c += 1) {
+                    tokens = tokens.slice(1);
+                }
+                continue;
+            }
+            break;
         }
     }
 }
 function parseSpecToken(eco, token) {
     if (eco === "npm") {
+        // `alias@npm:real-pkg[@version]` installs real-pkg under a local alias, so
+        // the package that actually lands is the alias target — screen THAT, not the
+        // alias name.
+        const alias = token.indexOf("@npm:");
+        if (alias > 0) {
+            return parseSpecToken("npm", token.slice(alias + "@npm:".length));
+        }
         const at = token.lastIndexOf("@");
         if (at > 0) {
             return { name: token.slice(0, at), version: token.slice(at + 1) || null };
         }
         return { name: token, version: null };
     }
-    // pypi: only an exact `name==version` is a pinned version; ranges are unpinned.
-    const exact = /^([A-Za-z0-9._-]+)==([^,;\s]+)$/.exec(token);
+    // pypi: only an exact `name[extras]==version` is a pinned version; ranges are
+    // unpinned. The optional `[extras]` is dropped from the screened name.
+    const exact = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?==([^,;\s]+)$/.exec(token);
     if (exact && exact[1] && exact[2]) {
         return { name: exact[1], version: exact[2] };
     }
-    const ranged = /^([A-Za-z0-9._-]+)\s*(?:===|>=|<=|~=|!=|<|>)/.exec(token);
+    const ranged = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?\s*(?:===|>=|<=|~=|!=|<|>)/.exec(token);
     if (ranged && ranged[1]) {
         return { name: ranged[1], version: null };
     }
+    const bare = /^([A-Za-z0-9._-]+)(?:\[[^\]]*\])?$/.exec(token);
+    if (bare && bare[1]) {
+        return { name: bare[1], version: null };
+    }
     return { name: token, version: null };
 }
 // A token built from a shell variable or substitution — its real value is only
@@ -656,6 +1538,83 @@ function extractUvRunWithSpecs(rawArgs) {
     }
     return { specs, remoteUnverifiable, dynamic };
 }
+// A single brace list `pre{a,b,c}post` expands to `prea bpost cpost` in bash, so
+// `npm install {evil,lodash}` really installs both — expand it or the literal
+// `{evil,lodash}` is screened as one bogus name and the real packages are
+// missed. Sequence braces (`{1..5}`) and nesting are left intact (no comma).
+// A leftover comma-brace after expandBraces means the expansion was incomplete
+// (hit the cap, or malformed) — the caller defers rather than trusting the verb.
+const UNEXPANDED_BRACE = /\{[^{}]*,[^{}]*\}/;
+const BRACE_EXPANSION_CAP = 1024;
+// Full bash-style brace expansion: a word is the cartesian product over EVERY
+// brace group in it (recursively), e.g. `{i,ci}{,x}` -> i ix ci cix. The old
+// single-group form let an adjacent-group verb (`npm {i,ci}{,x} evil`) slip past
+// classification. Sequence braces (`{1..5}`, no top-level comma) and malformed/
+// comma-less groups stay literal. Over the cap we return the token literal; the
+// caller treats a surviving comma-brace as undecidable (fail closed).
+function expandBraces(token) {
+    const out = expandBracesInto(token, []);
+    return out.length > 0 && out.length <= BRACE_EXPANSION_CAP ? out : [token];
+}
+function expandBracesInto(token, acc) {
+    if (acc.length > BRACE_EXPANSION_CAP) {
+        return acc;
+    }
+    let depth = 0;
+    let open = -1;
+    for (let i = 0; i < token.length; i += 1) {
+        const c = token[i];
+        if (c === "{") {
+            if (depth === 0) {
+                open = i;
+            }
+            depth += 1;
+        }
+        else if (c === "}") {
+            depth -= 1;
+            if (depth === 0 && open >= 0) {
+                const inner = token.slice(open + 1, i);
+                const parts = splitTopLevelCommas(inner);
+                if (parts.length > 1) {
+                    const prefix = token.slice(0, open);
+                    const suffix = token.slice(i + 1);
+                    for (const part of parts) {
+                        expandBracesInto(`${prefix}${part}${suffix}`, acc);
+                        if (acc.length > BRACE_EXPANSION_CAP) {
+                            return acc;
+                        }
+                    }
+                    return acc;
+                }
+                open = -1;
+            }
+        }
+    }
+    acc.push(token);
+    return acc;
+}
+// Split on commas that are NOT inside a nested {...}; returns one element when
+// there is no top-level comma (so `{1..5}` / `{a}` stay a single literal group).
+function splitTopLevelCommas(inner) {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    for (let i = 0; i < inner.length; i += 1) {
+        const c = inner[i];
+        if (c === "{") {
+            depth += 1;
+        }
+        else if (c === "}") {
+            depth -= 1;
+        }
+        else if (c === "," && depth === 0) {
+            parts.push(inner.slice(start, i));
+            start = i + 1;
+        }
+    }
+    parts.push(inner.slice(start));
+    return parts.length > 1 ? parts : [];
+}
 function extractSpecs(manager, eco, rawArgs) {
     if (manager === "uv" && rawArgs.find((a) => !a.startsWith("-")) === "run") {
         return extractUvRunWithSpecs(rawArgs);
@@ -663,6 +1622,11 @@ function extractSpecs(manager, eco, rawArgs) {
     const valueFlags = eco === "pypi" ? PIP_VALUE_FLAGS : NPM_VALUE_FLAGS;
     const noVerb = manager === "npx" || manager === "pnpx" || manager === "uvx";
     const positionals = [];
+    // `npx/npm exec/pnpm dlx --package=<pkg>` and `pipx run --spec=<pkg>` fetch the
+    // flag's value, not the trailing bin — screen those too or `--package=evil`
+    // rides through while only the benign bin name is checked (FW-15).
+    const packageFlagLong = eco === "pypi" ? "--spec" : "--package";
+    const packageFlagTokens = [];
     // Most managers have a one-word verb (`pip install <pkg>`). `uv pip install`,
     // `uv tool install`, and `pipx inject <venv> <pkg>` are two leading tokens
     // before the package, so consume the extra leading positional or the scan
@@ -670,12 +1634,28 @@ function extractSpecs(manager, eco, rawArgs) {
     let verbWords = noVerb ? 0 : 1;
     let consumed = 0;
     let firstSeen = false;
+    let verb = "";
     for (let i = 0; i < rawArgs.length; i += 1) {
         const a = rawArgs[i];
         if (a === undefined) {
             continue;
         }
         if (a.startsWith("-")) {
+            const eq = a.indexOf("=");
+            const flagName = eq >= 0 ? a.slice(0, eq) : a;
+            if (flagName === packageFlagLong || (noVerb && eco !== "pypi" && flagName === "-p")) {
+                if (eq >= 0) {
+                    packageFlagTokens.push(a.slice(eq + 1));
+                }
+                else {
+                    const next = rawArgs[i + 1];
+                    if (next !== undefined && !next.startsWith("-")) {
+                        packageFlagTokens.push(next);
+                        i += 1;
+                    }
+                }
+                continue;
+            }
             if (valueFlags.has(a)) {
                 i += 1;
             }
@@ -683,6 +1663,7 @@ function extractSpecs(manager, eco, rawArgs) {
         }
         if (!firstSeen) {
             firstSeen = true;
+            verb = a;
             if (manager === "uv" && (a === "pip" || a === "tool")) {
                 verbWords = 2;
             }
@@ -696,7 +1677,11 @@ function extractSpecs(manager, eco, rawArgs) {
         }
         positionals.push(a);
     }
-    const tokens = noVerb ? positionals.slice(0, 1) : positionals;
+    const onlyFirstPositional = noVerb || RUNNER_VERBS.has(verb);
+    const tokens = [
+        ...(onlyFirstPositional ? positionals.slice(0, 1) : positionals),
+        ...packageFlagTokens,
+    ].flatMap(expandBraces);
     const specs = [];
     const remoteUnverifiable = [];
     const dynamic = [];
@@ -768,6 +1753,11 @@ function extractAlternateIndexes(eco, rawArgs, env) {
                     value = a.slice(f.length + 1);
                     break;
                 }
+                // Glued short form: -ihttps://… / -fhttps://… (pip accepts no separator).
+                if (f.length === 2 && a.startsWith(f) && a.length > 2 && a[2] !== "=") {
+                    value = a.slice(2);
+                    break;
+                }
             }
         }
         if (value !== undefined && isAlternateIndexValue(value)) {
@@ -856,6 +1846,52 @@ async function checkSegment(segment, env, cwd, fetchImpl, depth = 0) {
         if (UNSUPPORTED_RUNNERS.has(manager) && verb0 && !isDynamicToken(verb0)) {
             return undecidableVerdict(env, `dg cannot statically screen a ${manager} fetch-and-run; it is covered only when the network gate is on`);
         }
+        const head0 = tokens[0] ?? "";
+        // A command name built from a substitution (`$(echo npm) install x`,
+        // `` `which npm` install x ``, `sh -c "$(…)"`) runs whatever it outputs —
+        // statically undecidable, so always defer. A bare `$VAR` head only defers
+        // when an install verb follows, so a benign `$EDITOR file` is not nagged.
+        if (head0.startsWith("$(") || head0.includes("`") || (isDynamicToken(head0) && tokens.slice(1).some((t) => INSTALL_VERBS.has(t)))) {
+            return undecidableVerdict(env, `dg cannot statically resolve a dynamically-built command (${head0}) that may install packages`);
+        }
+        // Backstop for an UNKNOWN exec-prefix wrapper (a privilege/sandbox/init tool
+        // not in WRAPPERS): if its operand is itself a package-manager install
+        // (`<wrapper> [flags] <pm> <install-verb> …`), defer rather than wave it
+        // through, so a wrapper the allowlist hasn't enumerated can't silently re-open
+        // the firewall. The `<wrapper> <pm> <verb>` shape skips tools with a
+        // subcommand/target before the manager (docker run …, ssh host …); DATA_HEADS
+        // skips commands that take a manager NAME as literal data (grep/echo/…).
+        if (manager && !DATA_HEADS.has(manager) && !isDynamicToken(head0)) {
+            const rest = tokens.slice(1);
+            let i = 0;
+            while (i < rest.length && (rest[i] ?? "").startsWith("-")) {
+                const flag = rest[i] ?? "";
+                i += 1;
+                // A bare (non `=`) leading flag of an unknown wrapper may take a separate
+                // value (`systemd-run -p MemoryMax=1G …`, `proot -b /tmp …`); consume it
+                // so the scan reaches the real wrapped head — but never swallow another
+                // flag or a package-manager token, so `ssh -p 22 host …` still stops at
+                // the host and `wrapper --foo npm …` still stops at npm.
+                if (!flag.includes("=")) {
+                    const value = rest[i];
+                    if (value !== undefined &&
+                        !value.startsWith("-") &&
+                        !isSupportedPackageManager(normalizeManagerName(commandBasename(value)))) {
+                        i += 1;
+                    }
+                }
+            }
+            const operandManager = normalizeManagerName(commandBasename(rest[i] ?? ""));
+            // Reuse the classifier (the single source of truth) rather than re-deriving
+            // install-ness from a verb table — that catches bare `yarn` (no verb, but an
+            // install of every lockfile dep), npx/pnpx/uvx, and any future protected
+            // shape, with no drift. A non-protected operand (yarn --version, a non-pm
+            // subcommand like `docker run`) stays allow.
+            if (isSupportedPackageManager(operandManager) &&
+                classifyPackageManagerInvocation(operandManager, rest.slice(i + 1)).kind === "protected") {
+                return undecidableVerdict(env, `dg cannot statically screen an install behind an unrecognized wrapper (${manager}); it is covered only when the network gate is on`);
+            }
+        }
         return ALLOW;
     }
     if (!ok) {
@@ -863,7 +1899,16 @@ async function checkSegment(segment, env, cwd, fetchImpl, depth = 0) {
         // (unbalanced quote / trailing escape). Never wave it through.
         return { decision: "ask", reason: `dg could not safely parse this ${manager} command, so it cannot be verified` };
     }
-    const args = tokens.slice(1);
+    // Brace-expand the args the shell would (`npm {install,ci} evil` -> install +
+    // ci) BEFORE classification: the lexer keeps a comma-brace as one literal
+    // token, so a braced verb (`{install,ci}`) otherwise matches no install verb
+    // and waves the install through. extractSpecs re-expands the specs idempotently.
+    const args = tokens.slice(1).flatMap(expandBraces);
+    if (args.some((a) => UNEXPANDED_BRACE.test(a))) {
+        // A comma-brace survived expansion (over the cap, or malformed) — we can't
+        // know which install the shell would run, so defer rather than wave it through.
+        return undecidableVerdict(env, "dg cannot statically expand a brace-heavy command that may install packages");
+    }
     const verb = args.find((a) => !a.startsWith("-")) ?? "";
     if (isDynamicToken(verb)) {
         // A dynamically-built subcommand (`npm $i pkg`) can't be classified — defer,
@@ -893,17 +1938,24 @@ async function checkSegment(segment, env, cwd, fetchImpl, depth = 0) {
     // hostile repo can't slip a malicious direct package past the static hook;
     // the transitive tree stays the runtime network gate's job.
     let manifestTruncated = false;
+    let manifestAlternateIndexes = [];
     if (specs.length === 0 && remoteUnverifiable.length === 0) {
         const manifest = eco === "npm" ? readNpmManifestSpecs(cwd) : readPipRequirementSpecs(args, cwd);
         if (manifest) {
             specs = manifest.specs;
             manifestTruncated = manifest.truncated;
+            manifestAlternateIndexes = manifest.alternateIndexes ?? [];
         }
     }
     if (specs.some((s) => CONTROL_CHARS.test(s.name) || (s.version !== null && CONTROL_CHARS.test(s.version)))) {
         return { decision: "deny", reason: `dg refused a ${manager} install with a malformed package spec` };
     }
-    const alternateIndexes = extractAlternateIndexes(eco, args, env);
+    const alternateIndexes = extractAlternateIndexes(eco, args, { ...env, ...(parsed.inlineEnv ?? {}) });
+    for (const idx of manifestAlternateIndexes) {
+        if (isAlternateIndexValue(idx)) {
+            alternateIndexes.push(idx);
+        }
+    }
     const unverifiableReasons = [];
     if (remoteUnverifiable.length > 0) {
         unverifiableReasons.push(`non-registry source${remoteUnverifiable.length > 1 ? "s" : ""}: ${remoteUnverifiable.join(", ")}`);
@@ -948,6 +2000,8 @@ async function checkSegment(segment, env, cwd, fetchImpl, depth = 0) {
             ecosystem: eco,
             env,
             fetchImpl,
+            publicFallback: true,
+            bill: false,
             ...(cooldown ? { cooldown: cooldown.param } : {}),
         });
     }