freeharness 0.4.1 → 0.4.3

package/canonical/hooks/freeharness-config-guard.mjs

@@ -1,15 +1,40 @@
 // FreeHarness config guard (Claude Code PreToolUse hook, matcher Edit|Write|MultiEdit|Bash).
-// Denies writes to the files that invalidate the prompt cache or change the harness under
-// the session (settings.json, settings.local.json, .mcp.json, CLAUDE.md, hook scripts and
-// the plugin hooks.json) unless an allow marker exists and is fresh:
-//   <project>/.freeharness/allow-config-edit   (or ~/.claude/freeharness/allow-config-edit)
-// The marker is valid for --ttl minutes (30) after its mtime; a numeric (epoch ms) or ISO
-// date body sets an explicit expiry instead. `touch .freeharness/allow-config-edit` in a
-// terminal sets or refreshes it; `freeharness init`/`update` set and remove their own.
-// Bash is denied only when the command writes to such a path (redirect, sed -i, rm, mv, cp,
-// tee, truncate, touch); reads pass. The marker itself is protected from tool writes, so
-// the user, not the model, opens the window. Never throws; exit 0 on every path.
-// Disable: FREEHARNESS_HOOK_CONFIG_GUARD=off.
+// Denies writes to live harness configuration, which runs code or loads instructions in every
+// session, unless a fresh marker exists: <project>/.freeharness/allow-config-edit or
+// ~/.claude/freeharness/allow-config-edit, valid --ttl minutes (240 by default) after its mtime
+// or until an epoch-ms/ISO date in its body. The user opens the window with `touch`;
+// `freeharness init`/`update` set and remove their own. The marker is itself protected, so the
+// model cannot open the window.
+// The live set is a set of locations (liveTarget), judged at the written and the real path: the
+// user config dir's CLAUDE.md, settings, hooks and plugins, ~/.claude.json, any .mcp.json,
+// .claude/settings.json or .claude/settings.local.json, the hooks dir of .claude, .freeharness,
+// ~/.claude/freeharness or freeharness-plugin, a plugin's hooks/hooks.json, the dirs holding
+// them, and the marker. A project CLAUDE.md, a settings.json or hook source elsewhere, or a copy
+// in the temp root outside the home and project passes. Names fold like APFS (NFC, full case)
+// and CLAUDE_CONFIG_DIR gets every ~/.claude rule.
+// The guard is a second layer against the model's accidental writes; Claude Code's permission
+// layer is the perimeter, so on doubt the guard allows. Bash is judged per simple command, and
+// only a literal writer counts: an output redirect target, a tee, sed -i, perl -i, rm or touch
+// operand, a cp or install destination, any mv operand, a protected literal inline python, node, perl or
+// ruby code opens for write or hands to a module write, and the literal string of sh -c, run as
+// a command of its own. Any other command, a word holding an expansion, a heredoc body and code
+// fed on stdin allow. Paths are judged by location from the payload cwd moved by each literal cd,
+// pushd or popd; after a cd the guard cannot follow, a relative path counts by its own segments.
+// A shell function definition splits into commands of its own, so a literal write after it is
+// judged; a line still unsplittable (an open quote, group, case pattern or heredoc, or a `'`
+// inside a double-quoted `${...}`) allows unjudged, as does input past MAX_CHARS or
+// MAX_COMMAND_BYTES. A payload that is no JSON object allows unjudged.
+// Exit 0.
+// The git guard denies history-destroying git commands, and git config that can add an alias or
+// run code, whatever the marker says; the user runs an intended one with the `!` prompt prefix.
+// Same-line values substitute into git slots before the check; interpreter code counts as git
+// only with a spawn call and a git word; it is a second layer against mistakes, so an unknown
+// command word, xargs input (an opaque operand, never pasted producer text) and a git judgment
+// past its depth or size bound allow; a quoted git mention, push --force-with-lease,
+// object-writing plumbing and a forced worktree remove under the temp root pass.
+// A Bash judgment past MAX_JUDGE_MS or nested past MAX_DEPTH allows, as do an unreadable payload
+// and any throw. Reasons escape invisible characters and name at most MAX_NAMED targets.
+// Disable: FREEHARNESS_HOOK_CONFIG_GUARD=off (whole hook), FREEHARNESS_HOOK_GIT_GUARD=off (git).
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -18,61 +43,4079 @@ import { fileURLToPath } from "node:url";
 /** Marker file name (project: .freeharness/, user: ~/.claude/freeharness/). */
 export const MARKER = "allow-config-edit";
 /** Default marker lifetime in minutes. */
-export const DEFAULT_TTL_MIN = 30;
+export const DEFAULT_TTL_MIN = 240;
 
-/** Protected basenames. */
-const NAMES = /^(settings\.json|settings\.local\.json|\.mcp\.json|CLAUDE\.md|hooks\.json)$/i;
-/** Protected directories (hook scripts) and the marker. */
-const DIRS = /\/(\.freeharness\/hooks|\.claude\/freeharness\/hooks|\.claude\/hooks|freeharness-plugin\/hooks)\/[^/]+$|\/\.freeharness\/allow-config-edit$|\/\.claude\/freeharness\/allow-config-edit$/;
-/** Same set as a token pattern for Bash commands (relative spellings included). */
-const TOKEN = /(?:^|[\s"'=:/])((?:[\w.~-]+\/)*(?:settings\.json|settings\.local\.json|\.mcp\.json|CLAUDE\.md|hooks\.json|allow-config-edit|(?:\.freeharness|\.claude\/freeharness|\.claude)\/hooks\/[\w.-]+|freeharness-[\w-]+\.mjs|freeharness-session-start))(?=$|[\s"';|&)])/g;
-/** Write constructs a Bash command may apply to a protected token. */
-const WRITERS = /(^|[\s;|&(])(sed\s+(-[a-zA-Z]*i|--in-place)|rm|mv|cp|tee|truncate|touch|install|ln|dd|shred|python3?\s+-c|perl\s+-[a-z]*i)\b|>{1,2}\s*["']?(?:[\w.~-]+\/)*(?:settings\.json|settings\.local\.json|\.mcp\.json|CLAUDE\.md|hooks\.json|allow-config-edit|freeharness-[\w-]+\.mjs|freeharness-session-start)/;
+/** Realpath calls per judgment, bounding latency; past them Edit/Write denies. */
+const MAX_REALPATHS = 256;
+/** Directories whose `hooks` subdirectory holds hook code wherever it lies. */
+const HOOK_OWNERS = [".claude", ".freeharness", "freeharness-plugin"];
+/** Protected basenames in Bash text; hook scripts and the marker count anywhere. */
+const BASE = /^(?:settings\.json|settings\.local\.json|\.mcp\.json|\.claude\.json|claude\.md|hooks\.json|allow-config-edit|freeharness-[\w-]+\.mjs|freeharness-session-start)$/i;
+/** One sample per BASE alternative, matched against a glob segment. */
+const BASE_SAMPLES = ["settings.json", "settings.local.json", ".mcp.json", ".claude.json", "claude.md", "hooks.json", "allow-config-edit", "freeharness-x.mjs", "freeharness-session-start"];
+/** Hook script names in BASE; repository sources carry them too. */
+const SCRIPT = /^freeharness-(?:[\w-]+\.mjs|session-start)$/i;
+/** HOOK_OWNERS for the name rules, plus a bare `freeharness`: the `.claude` above it may be out of sight. */
+const HOOK_PARENTS = [...HOOK_OWNERS, "freeharness"];
+const NAME_AT = /[A-Za-z_]\w*/y;
+/** An expansion head: zsh `(flags)` and `=`, `~`, `^` prefixes, bash `#`/`!`, then a name. */
+const EXP_FLAGS = /^(?:\([^)]*\))?[=~^#+!]*/;
+const EXP_NAME = /[A-Za-z_]\w*|\d+|[@*#?$!-]/y;
+/** Operator after an expansion head; the text after it can become the value. */
+const EXP_OP = /^(?::?[-=+?]|::=|:|##?|%%?|\/[/#%]?|\^\^?|,,?|@)/;
+/** Bounds on the word lists same-line values fill and on the text one printf body can grow to. */
+const MAX_VARIANTS = 64;
+const MAX_JOINED_CHARS = 1 << 20;
+/** Raw-word separators; `|` and `()` stay inside glob words. */
+const BRACES = /\{[^{}]*(?:,|\.\.)[^{}]*\}/;
+const PURE_WILD = /^(?:[*?]|\[[^\]]*\])+$/;
+/** A lone `*` as the last segment, its directory captured. */
+const STAR = /^(?:(.*?)\/+)?\*\/*$/;
+/** Longer input is not judged, so the judgment stays inside the hook timeout. */
+const MAX_CHARS = 16_384;
+/** Nesting bound for shell strings and substitutions; deeper input is not judged. */
+const MAX_DEPTH = 8;
+const MAX_NAMED = 10;
+
+/** Redirects, zsh clobber forms included: the Bash tool may run zsh. */
+const REDIRECT = /^(?:\d*)(>>!|>>\||>&!|>&\||>>|>\||>!|>&|>|<<<|<<-|<<|<>|<&|<|&>>!|&>>\||&>!|&>\||&>>|&>)$/;
+const OUTPUT_OPS = new Set([">>!", ">>|", ">&!", ">&|", ">>", ">|", ">!", ">&", ">", "<>", "&>>!", "&>>|", "&>!", "&>|", "&>>", "&>"]);
+const OPS = [">>!", ">>|", ">&!", ">&|", ">>", ">|", ">!", ">&", "<<<", "<<-", "<<", "<>", "<&", ">", "<"];
+const AMP_OPS = ["&>>!", "&>>|", "&>!", "&>|", "&>>", "&>"];
+const ASSIGN = /^[A-Za-z_]\w*(?:\[[^\]]*\])?\+?=/;
+const KEYWORDS = new Set(["!", "{", "}", "if", "then", "else", "elif", "fi", "do", "done", "while", "until", "esac", "coproc"]);
+const SYSTEM_BIN = /^\/(?:usr\/(?:local\/)?)?s?bin\/[^/]+$|^\/opt\/homebrew\/bin\/[^/]+$/;
+/** A function definition's name and its `()`. */
+const FUNC_NAME = /^[^\s$`'"=<>|&;(){}[\]*?]+$/;
+const FUNC_PARENS = /^\(\s*\)/;
+/** A line that may turn on dot-name matching for its globs. */
+const DOTGLOB = /dotglob|globdots|glob_dots|GLOBIGNORE/i;
+const SHELLS = /^(?:ba|z|da|k)?sh$/;
+const INTERPRETERS = /^(?:python[\d.]*|node|perl)$/;
+const STDIN_PATH = /^\/dev\/(?:stdin|fd\/\d+)$|^\/proc\/self\/fd\/\d+$/;
+/** Code that can redefine a read call or run text as code. */
+const REBIND = {
+  python: /\b(?:def|class)\s+(?:open|Path|read_text|read_bytes)\b|\bimport\s*\*|\b(?:builtins|__builtins__|__dict__|__class__|__getattribute__|setattr|globals|locals|vars|exec|eval|compile|__import__|importlib|modules)\b/,
+  node: /\bclass\b|\b(?:function|get|set|static|async)\s*\*?\s*(?:readFileSync|readFile|createReadStream|require)\b|[{,]\s*(?:readFileSync|readFile|createReadStream)\s*\(|\b(?:eval|Function|Reflect|Proxy|defineProperty|defineProperties|assign|fromEntries|create|setPrototypeOf|__proto__|prototype|globalThis|global|vm|module|with)\b|\]\s*[:=](?!=)/,
+  perl: /\b(?:sub|use|no|require|do|eval|BEGIN|CORE|local)\b|[*&]|::/,
+};
+/** Commands that change the shell's cwd. */
+const MOVERS = new Set(["cd", "pushd", "popd"]);
+/** Options that run a command, or resolve its paths, from another directory. */
+/** Words opening and closing a compound command. */
+const OPENERS = new Set(["if", "for", "while", "until", "select", "case", "{", "repeat", "foreach"]);
+const CLOSERS = new Set(["fi", "done", "esac", "}", "end"]);
+/** Candidate cwds kept per line; past them the cwd is unresolved. */
+const MAX_CWDS = 8;
+/** Entries one bare `*` lists; past them it counts. */
+const MAX_LISTED = 1024;
+/** Each simple command's place: `isolated` (pipeline, background), `piped` (not the first stage), `joint`/`next` separators, `shells` ids, `late` (in a background list). */
+const PLACES = new WeakMap();
+/** Indices of each simple command's redirect operators: a quoted `>` argument is a plain word. */
+const OP_WORDS = new WeakMap();
+/** Indices of each simple command's quoted heredoc bodies, which never expand. */
+const QUOTED_DOCS = new WeakMap();
+/** Offsets of each simple command's quoted or escaped `$` and backtick text, which never expands. */
+const LITERALS = new WeakMap();
+/** Words of the current judgment holding such text: a `${name}` in them may be literal, so it is never filled with a value. */
+const LITERAL_WORDS = new Set();
+/** Words whose every `$` and backtick is such text, and words with one that expands; a word in both can expand. */
+const LITERAL_ONLY = new Set();
+const EXPANDING = new Set();
+const NAMED_EXP = /\$\{([A-Za-z_]\w*)\}/g;
+
+/** Wrapper commands: [options taking a separate value, options without one]. */
+const WRAPPERS = new Map([
+  ["env", [/^(?:-[uCS]|--unset|--chdir|--split-string)$/, /^(?:-[i0v]+|-|-[uC].+|--(?:ignore-environment|null|debug|list-signal-handling|(?:unset|chdir)=.*|(?:default|ignore|block)-signal(?:=.*)?))$/]],
+  ["command", [null, /^-p$/]],
+  ["builtin", [null, null]],
+  ["exec", [/^-a$/, /^-[cl]+$/]],
+  ["nohup", [null, null]],
+  ["time", [null, /^-p$/]],
+  ["sudo", [/^(?:-[ughpCUrtDRT]|--(?:user|group|host|prompt|close-from|other-user|role|type|chdir|chroot|command-timeout))$/, /^(?:-[AbEHiKknPSsB]+|-[ughpCUrtDRT].+|--(?:[\w-]+=.*|preserve-env|login|shell|non-interactive|stdin|background|askpass|set-home|reset-timestamp|preserve-groups))$/]],
+  ["doas", [/^-[uC]$/, /^-[ns]+$/]],
+  ["nice", [/^(?:-n|--adjustment)$/, /^(?:-n.+|-\d+|--adjustment=.*)$/]],
+  ["timeout", [/^(?:-[sk]|--signal|--kill-after)$/, /^(?:-[sk].+|-v|--(?:signal|kill-after)=.*|--(?:preserve-status|foreground|verbose))$/]],
+  ["stdbuf", [/^(?:-[ioe]|--(?:input|output|error))$/, /^(?:-[ioe].+|--(?:input|output|error)=.*)$/]],
+]);
+/** env's split string, alone or ending a flag cluster (`-iS`); its value is the command. */
+const ENV_SPLIT = /^(?:-[i0v]*S|--split-string=?)/;
+const XARGS_VALUED =/^(?:-[IdEsnLPa]|--(?:max-args|max-procs|max-lines|delimiter|arg-file|max-chars|process-slot-var))$/;
+const XARGS_FLAGS = /^(?:-[0rtpx]+|-[IdEsnLPaiel].*|--[\w-]+=.*|--(?:null|no-run-if-empty|verbose|interactive|exit|open-tty|show-limits|replace|eof))$/;
+/** Readers no option or operand xargs takes from its input can turn into a writer. */
+const XARGS_READERS = new Set(["cat", "head", "tail", "wc", "grep", "egrep", "fgrep", "ls", "stat", "file", "du", "md5", "md5sum", "shasum", "sha1sum", "sha256sum", "echo", "basename", "dirname", "realpath", "readlink"]);
+/** git global options that take a separate value. */
+const GIT_VALUED = /^(?:-C|-c|--git-dir|--work-tree|--namespace|--config-env|--super-prefix|--attr-source)$/;
+/** Code points a deny reason escapes: C0, DEL, C1, zero-width, bidirectional, separators, tags. */
+const INVISIBLE = /[\u{0}-\u{1F}\u{7F}-\u{9F}\u{61C}\u{200B}-\u{200F}\u{2028}-\u{202E}\u{2060}\u{2066}-\u{2069}\u{FEFF}\u{E0000}-\u{E007F}]/u;
+/** git subcommands whose arguments decide the judgment; with appended arguments any of them denies. */
+const GIT_LISTED = new Set(["reset", "push", "branch", "clean", "checkout", "switch", "restore", "stash", "reflog", "filter-branch", "worktree", "config"]);
+/** Config keys a command line may set: none defines an alias or runs code. */
+const GIT_SAFE_KEY = /^(?:(?:user|author|committer)\.(?:name|email)|color\..+|advice\..+|core\.(?:quotepath|autocrlf|safecrlf|abbrev|filemode|ignorecase|precomposeunicode|eol|whitespace)|init\.defaultbranch|(?:commit|tag)\.gpgsign|commit\.(?:verbose|cleanup|status)|log\.(?:date|decorate|follow|abbrevcommit|showroot|mailmap)|diff\.(?:noprefix|mnemonicprefix|renames|renamelimit|algorithm|colormoved|context|relative|indentheuristic|interhunkcontext)|pull\.(?:rebase|ff)|push\.(?:default|autosetupremote|followtags)|fetch\.(?:prune|prunetags|parallel)|merge\.(?:ff|conflictstyle|log|stat|renamelimit)|rebase\.(?:autosquash|autostash|stat)|status\.(?:short|branch|showuntrackedfiles|relativepaths|showstash|renamelimit)|column\.ui|i18n\.\w+|safe\.directory)$/;
+const CONFIG_KEY = /^[a-z\d-]+\.(?:[^\n]*\.)?[a-z][a-z\d-]*$/;
+/** Keys and variables naming a program, safe only with a plain pager or a no-op value. */
+const GIT_PROGRAM_KEY = /^(?:core\.(?:pager|editor)|pager\.[\w-]+|sequence\.editor)$/;
+/** A pager with letter flags only: `less -o` writes a log file, `less +cmd` runs a command. */
+const SAFE_PROGRAM = /^(?:(?:cat|less|more)(?:[ \t]+-(?![^\s]*[ok])[a-z]+)*|true|false|:|yes|no|on|off|0|1)?$/i;
+/** NAME= at a word start for variables that set git config or name a program. */
+const GIT_ENV = /(?:^|[\s;&|(){}`<>'"])(GIT_(?:CONFIG(?:_KEY_\d+|_PARAMETERS|_GLOBAL|_SYSTEM)?|EXTERNAL_DIFF|EXEC_PATH|EDITOR|SEQUENCE_EDITOR|PAGER|SSH|SSH_COMMAND|ASKPASS|PROXY_COMMAND|TEMPLATE_DIR))\+?=((?:'[^']*'|"(?:[^"\\]|\\[\s\S])*"|\\[\s\S]|\S)*)/g;
+/** Per listed subcommand: short and long options that take the next word as their value. */
+const GIT_SUB_VALUED = new Map([
+  ["push", ["o", ["push-option", "repo", "receive-pack", "exec"]]],
+  ["checkout", ["bB", ["orphan", "conflict", "pathspec-from-file"]]],
+  ["switch", ["cC", ["create", "force-create", "orphan", "conflict"]]],
+  ["restore", ["s", ["source", "conflict", "pathspec-from-file"]]],
+  ["stash", ["m", ["message", "pathspec-from-file"]]],
+  ["worktree", ["bB", ["reason"]]],
+  ["clean", ["e", ["exclude"]]],
+  ["reset", ["", ["pathspec-from-file"]]],
+  ["branch", ["u", ["set-upstream-to"]]],
+  ["config", ["f", ["file", "blob", "type", "default", "comment", "value"]]],
+]);
+/** git queries whose output is a ref name or an object id, with the options each may take. */
+const GIT_QUERY = new Map([
+  ["branch", /^--show-current$/],
+  ["symbolic-ref", /^(?:--short|-q|--quiet)$/],
+  ["rev-parse", /^(?:--abbrev-ref(?:=(?:strict|loose))?|--short(?:=\d+)?|--verify|-q|--quiet|--symbolic-full-name)$/],
+  ["merge-base", /^(?:--fork-point|-a|--all|--octopus|--independent)$/],
+  ["for-each-ref", /^(?:--format=%\(refname(?::(?:short|[lr]strip=-?\d+))?\)|--sort=-?[\w:-]+|--count=\d+|--(?:no-)?merged|--contains|--points-at)$/],
+  ["commit-tree", /^(?:-[pmF]|--no-gpg-sign)$/],
+  ["mktree", /^(?:-z|--missing|--batch)$/],
+  ["hash-object", /^(?:-[wt]|--stdin(?:-paths)?|--no-filters|--literally|--path=.*)$/],
+]);
+const GIT_WORD = /(?<![\w.-])git(?![\w-])/;
+const SPAWN = /\b(?:subprocess|child_process|popen\w*|exec(?:Sync|File\w*|[lv]p?e?\s*\()|os\s*\.\s*(?:system|exec\w*))|spawn|create_subprocess_\w+|\bsystem\s*\(/;
+const SPAWN_SCRIPT = new RegExp(String.raw`${SPAWN.source}|\x60|\b(?:qx|system|exec|readpipe|Open3)\b|%x|\bopen\b[^;\n]*?(?:["'][\s-]*\||\|[\s-]*["'])`);
+const PY_ARGV = new Set(["run", "call", "check_call", "check_output", "Popen"]);
+const PY_CONSTS = new Set(["PIPE", "DEVNULL", "STDOUT", "CalledProcessError", "TimeoutExpired", "CompletedProcess", "SubprocessError"]);
+const PY_KW = new Set(["capture_output", "text", "check", "stdout", "stderr", "stdin", "input", "encoding", "errors", "timeout", "universal_newlines", "bufsize", "close_fds"]);
+const JS_ARGV = new Set(["execFileSync", "execFile", "spawn", "spawnSync"]);
+const JS_SHELL = new Set(["execSync", "exec"]);
+const JS_KW = new Set(["encoding", "stdio", "timeout", "maxBuffer", "input", "windowsHide", "killSignal"]);
+/** Names that reach a module, a spawn or code through a value the argv extractor cannot follow. */
+const PY_DYNAMIC = /\b(?:exec|eval|getattr|vars|globals|locals|attrgetter|methodcaller|importlib|builtins|__(?:import|builtins|dict|getattribute|globals|subclasses)__)\b/;
+const JS_DYNAMIC = /\b(?:eval|Function|globalThis|Reflect|import\s*\(|process\s*\.\s*(?:binding|dlopen|mainModule)|module\s*\.\s*(?:constructor|require)|require\s*\(\s*(?!["'][\w:./@-]+["']\s*\)))/;
+const INTERP_GIT_READ = new Set(["status", "diff", "log", "show", "ls-files", "rev-parse", "blame", "grep", "cat-file", "merge-base", "for-each-ref"]);
+const INTERP_GIT_BANNED = /^--(?:exec-path|git-dir|work-tree|config-env|namespace|super-prefix|attr-source)(?:=|$)/;
+const INTERP_GIT_WRITES = /^(?:--output|--open-files-in-pager|--ext-diff|--textconv|-[^-]*O)/;
+/** The git program a spawn may name: a relative or unknown path may be any program called git. */
+const GIT_PROGRAM = /^(?:(?:\/usr(?:\/local)?|\/opt\/homebrew)?\/bin\/)?git$/;
+// A read-only git call changes nothing only under the environment, directory and files it started with.
+const PY_ALTERS = /\b(?:environb?|putenv|unsetenv|f?chdir|posix|nt|breakpoint)\b/;
+const PY_PLAIN_MODULES = new Set(["subprocess", "os", "sys", "re", "json", "shlex", "ast", "tokenize", "keyword","collections", "itertools", "functools", "operator", "math", "textwrap", "difflib", "string", "datetime", "time", "typing", "dataclasses", "pprint", "statistics", "hashlib", "base64", "enum", "fnmatch", "glob", "csv", "unicodedata", "__future__"]);
+const PY_OS_READ = new Set(["path", "getcwd", "getcwdb", "getenv", "listdir", "scandir", "walk", "sep", "linesep", "pathsep", "name", "devnull", "curdir", "pardir", "extsep", "altsep", "cpu_count", "getpid", "getppid", "stat", "lstat", "access", "fspath", "fsencode", "fsdecode", "get_terminal_size", "isatty", "R_OK", "W_OK", "X_OK", "F_OK"]);
+const PY_OPEN_KW = new Set(["mode", "encoding", "errors", "newline", "buffering"]);
+const JS_ALTERS = /\b(?:env|chdir|fs|vm|worker_threads|inspector|repl|wasi|cluster|module|v8|trace_events|net|Worker|global|this|constructor)\b|\bprocess\b(?!\s*\.\s*(?:argv|exit|exitCode|stdout|stderr|platform|version|versions|arch|cwd)\b)|\brequire\b(?!\s*\()/;
+const JS_PLAIN_MODULES = /^(?:node:)?(?:child_process|path|os|util)$/;
+const BRANCH_LIST = /^(?:--list|-[arvi]|-vv|--all|--remotes|--verbose|--ignore-case|--omit-empty|--points-at|--no-abbrev|--(?:no-)?(?:contains|merged|column|color|abbrev)(?:=.*)?|--(?:format|sort)=.*)$/;
+const XARGS_NAME = "xargs_input";
+const XARGS_INPUT = `\${${XARGS_NAME}}`;
+/** Words that can bind a variable or change word splitting in ways the line text does not show. */
+const BINDERS = /(?:^|[^\w.-])(?:eval|source|read|mapfile|readarray|getopts|printf|print|declare|typeset|local|export|readonly|integer|float|let|set|setopt|emulate|vared|zparseopts|sysread|zstat|zformat|strftime|zle|zstyle|zmodload|compgen|coproc|select|foreach|while|until|repeat|trap|shift|alias|function|fc|IFS)(?![\w(-])|\[\[|\(\(|(?:^|[\s;&|(){}])\.(?=[\s;&|(){}]|$)/;
+/** Variables the shell sets itself, so their values are not a user's environment. */
+const SHELL_SET = /^(?:_|REPLY|reply|OPTARG|OPTIND|MATCH|match|MBEGIN|MEND|mbegin|mend|argv|BASH\w*|ZSH\w*|history\w*|HIST\w*|FUNCNAME|funcstack|func\w*trace|COMP\w*|READLINE_\w+|MAPFILE|mapfile|PIPESTATUS|pipestatus|PWD|OLDPWD|commands|aliases|galiases|saliases|functions|options|parameters|builtins|jobtexts|dirstack|widgets|IFS)$/;
+/** Words that cannot be a ref name, so git reads them as a pathspec. */
+const NOT_REF = /^[.:/~]|[*?[\\]|\.\.|\/\/|\/$/;
+/** zsh precommand modifiers. */
+const PRECOMMANDS = new Set(["noglob", "nocorrect", "-"]);
+const AWKS = new Set(["awk", "gawk", "nawk", "mawk"]);
+
+const GIT_READ = new Set(["add", "blame", "cat-file", "check-ignore", "commit", "describe", "diff", "for-each-ref", "grep", "log", "ls-files", "ls-tree", "merge-base", "name-rev", "rev-list", "rev-parse", "shortlog", "show", "show-ref", "status"]);
+const GH_READ = /^(?:(?:api|search|status|browse|label)(?: \S+)?|pr (?:view|list|diff|checks|status|create|comment|edit|review|ready|close|reopen)|issue (?:view|list|status|create|comment|edit|close|reopen)|(?:run|workflow|repo|release) (?:view|list))$/;
+/** Milliseconds one Bash judgment may take, under the host's hook timeout. */
+const MAX_JUDGE_MS = 2_000;
+/** Bytes of a Bash command the guard judges; past them it allows unjudged. */
+const MAX_COMMAND_BYTES = 262_144;
+
+/** `performance.now()` deadline of the running Bash judgment; Infinity outside one. */
+let deadline = Infinity;
+
+/** Thrown past the deadline; respond reads it as an allow, as the host would at its timeout. */
+class Late extends Error {}
+
+/** Throws past the deadline; called in every loop that grows with the input. */
+function tick() {
+  if (performance.now() >= deadline) throw new Late("judgment deadline passed");
+}
+
+/** Whether `arg` is a long option naming one of `names` or an abbreviation of one (getopt). */
+function longOpt(arg, names) {
+  const m = /^--([^=]+)/.exec(arg);
+  return m !== null && names.some((n) => n.startsWith(m[1]));
+}
+
+/** Operands of an argument list: `-`, every word after `--`, and non-options no option consumes. */
+function operands(args, valued) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") return out.concat(args.slice(i + 1));
+    if (a === "-" || !a.startsWith("-")) out.push(a);
+    else if (valued.test(a)) i++;
+  }
+  return out;
+}
+
+/** Whether git's global options and subcommand only read or commit. */
+function gitReadOnly(args) {
+  let j = 0;
+  for (; j < args.length && args[j].startsWith("-"); j++) {
+    if (/^(?:-C|--git-dir|--work-tree|--namespace)$/.test(args[j])) j++;
+    else if (!/^(?:--(?:git-dir|work-tree|namespace)=.*|--no-pager|-P|-p|--paginate|--bare|--no-replace-objects|--literal-pathspecs|--no-optional-locks)$/.test(args[j])) return false;
+  }
+  const writes = (a) => /^(?:--output|-O|--open-files-in-pager|--ext-diff)/.test(a) || longOpt(a, ["output", "open-files-in-pager", "ext-diff"]);
+  const rest = args.slice(j + 1);
+  const remotes = args[j] === "remote" && (rest.every((a) => /^(?:-v|--verbose)$/.test(a)) || /^(?:show|get-url)$/.test(rest.find((a) => !a.startsWith("-")) ?? ""));
+  return (GIT_READ.has(args[j]) || remotes) && !rest.some(writes);
+}
+
+/** Whether sed only prints: no in-place edit, script file, `w`/`W` or `e`, and no brace, command or special-parameter expansion in a script. */
+function sedReadOnly(args) {
+  const scripts = sedScripts(args);
+  return scripts !== null && scripts.every((s) => !/\$[{(\d@*#?$-]|`/.test(s) && sedWrites(s)?.length === 0);
+}
+
+/** sed's scripts: the -e values, else the first operand; null on an in-place edit, a script file, another unknown option or one after an operand. */
+function sedScripts(args) {
+  const given = [];
+  const operands = [];
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--") {
+      operands.push(...args.slice(j + 1));
+      break;
+    }
+    if (a === "-" || !a.startsWith("-")) operands.push(a);
+    else if (operands.length > 0) return null;
+    else if (/^--expression(?:=|$)/.test(a)) given.push(a.includes("=") ? a.slice(a.indexOf("=") + 1) : (args[++j] ?? ""));
+    else if (/^-[nErsuz]*e/.test(a)) given.push(a.indexOf("e") + 1 < a.length ? a.slice(a.indexOf("e") + 1) : (args[++j] ?? ""));
+    else if (!/^-[nErsuz]+$|^--(?:quiet|silent|regexp-extended|posix|debug|null-data|zero-terminated|separate|unbuffered|sandbox)$/.test(a)) return null;
+  }
+  return given.length > 0 ? given : [operands[0] ?? ""];
+}
+
+/** awk's program texts; null past an option that loads code, edits in place or is unknown. */
+function awkPrograms(args) {
+  const programs = [];
+  let j = 0;
+  for (; j < args.length && args[j].startsWith("-") && args[j] !== "-"; j++) {
+    const a = args[j];
+    if (a === "--") {
+      j++;
+      break;
+    }
+    if (/^(?:-[Fv]|--(?:field-separator|assign))$/.test(a)) j++;
+    else if (a === "-e" || a === "--source") programs.push(args[++j] ?? "");
+    else if (a.startsWith("--source=")) programs.push(a.slice(9));
+    else if (!/^-[Fv].|^--(?:field-separator|assign)=|^--(?:posix|traditional|sandbox)$/.test(a)) return null;
+  }
+  return programs.length > 0 ? programs : [args[j] ?? ""];
+}
+
+/** The name a command word runs by lookup, or null for a path outside the system bins. */
+function commandName(word) {
+  return !word.includes("/") || SYSTEM_BIN.test(word) ? path.posix.basename(word) : null;
+}
+
+/**
+ * Where xargs's command starts at or after `from`, with its placeholder and input delimiter (`sep`:
+ * null for lines, the `-0` or `-d` character, false when unreadable); null past an unknown option.
+ */
+function xargsChild(args, from) {
+  let mark = null;
+  let sep = null;
+  for (let j = from; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--" || !a.startsWith("-")) return { at: a === "--" ? j + 1 : j, mark, sep };
+    const m = /^(?:-I|-i|--replace=?|--r(?:e(?:p(?:l(?:a(?:ce?)?)?)?)?)?=)(.*)$/.exec(a);
+    if (m) mark = a === "-I" ? (args[j + 1] ?? null) : m[1] || "{}";
+    const d = /^(?:-d|--d(?:e(?:l(?:i(?:m(?:i(?:t(?:er?)?)?)?)?)?)?)?=)([\s\S]*)$/.exec(a);
+    if (d || a === "--delimiter") sep = xargsDelimiter(a === "-d" || a === "--delimiter" ? args[j + 1] : d[1]);
+    if (/^-[rtpx]*0[0rtpx]*$|^--null$/.test(a)) sep = "\0";
+    if (XARGS_VALUED.test(a)) j++;
+    else if (!XARGS_FLAGS.test(a)) return null;
+  }
+  return { at: args.length, mark, sep };
+}
+
+/** The byte GNU xargs reads from a `-d` value; false for an expansion, an invalid value or a non-ASCII byte. */
+function xargsDelimiter(w) {
+  if (w === undefined || !literalWord(w)) return false;
+  if (w.length === 1) return w.charCodeAt(0) < 128 && w;
+  const m = /^\\(?:([abfnrtv\\])|x([0-9a-fA-F]+)$|([0-7]+)$)/.exec(w);
+  const code = m?.[2] !== undefined ? parseInt(m[2], 16) : m?.[3] !== undefined ? parseInt(m[3], 8) : NaN;
+  return m?.[1] !== undefined ? C_ESCAPES[m[1]] : code < 128 && String.fromCharCode(code);
+}
+
+/** Whether a word holds no expansion outside quotes, so its text is what the command sees. */
+function literalWord(w) {
+  return !/[$`]/.test(w) || (LITERAL_ONLY.has(w) && !EXPANDING.has(w));
+}
+
+const C_ESCAPES = { a: "\x07", b: "\b", e: "\x1b", f: "\f", n: "\n", r: "\r", t: "\t", v: "\v", "\\": "\\" };
+
+/** Text with the escapes `echo -e` and `printf` decode. */
+function decodeEscapes(t) {
+  return t.replace(/\\(?:0?([0-7]{1,3})|x([0-9A-Fa-f]{1,2})|([abefnrtv\\]))/g, (m, o, h, c) =>
+    o !== undefined ? String.fromCharCode(parseInt(o, 8)) : h !== undefined ? String.fromCharCode(parseInt(h, 16)) : C_ESCAPES[c],
+  );
+}
+
+/** Bare `cat` and `tee` stages the git guard has judged, each with the simple command piping into it. */
+const PASSED = new WeakMap();
+
+/** Interpreters that may run what they read: any option, module or script can hand stdin to the language or to a shell. */
+const STDIN_CODE = /^(?:python[\d.]*|node|perl|ruby|php|lua[\d.]*|tclsh[\d.]*|wish[\d.]*|expect|Rscript)$/;
+/** Multi-call binaries: the first operand names the applet that runs. */
+const APPLETS = /^(?:busybox|toybox)$/;
+/** The command an applet word runs: their ash and hush shells read code as sh does. */
+const appletName = (word) => path.posix.basename(word).replace(/^(?:a|hu)sh$/, "sh");
+/** Whether the line hands a command stdin of its own: a heredoc, a here-string, an input redirect or a pipe. */
+const fedStdin = (io) => (io.stdin ?? null) !== null || (io.inputs?.length ?? 0) > 0 || Boolean(io.feed);
+/**
+ * Whether interpreter arguments start with stdin as the script (or are none), so fed code is the
+ * program in the language alone; any other first word (an option, a module, inline code or a
+ * script) may hand stdin to other code, a shell included.
+ */
+const plainStdin = (args) => args.length === 0 || args[0] === "-" || STDIN_PATH.test(args[0]);
+const OPAQUE = Object.freeze({ text: "", texts: [] });
+const PRINTF_PART = /\\c|\\(?:0?[0-7]{1,3}|x[0-9A-Fa-f]{1,2}|[\s\S])|%%|%([-+ #0]*)(\d*)(?:\.(\d*))?([a-zA-Z])|[^\\%]+|[\\%]/g;
+
+/**
+ * Code a reader takes from outside its words (stdin, a `<(...)` script, a `-c` or `eval` code
+ * word with expansions), so both guards judge one body: literal as every text the shell can hand
+ * over, else opaque.
+ * @param {string[]} words The command word and its arguments, redirects dropped.
+ * @param {{stdin: string | null, quoted: boolean, herestring?: boolean, inputs: string[], feed?: string[] | null, source?: string[]}} io
+ *   `source` is the split command the words come from, whose quoted spans tell a literal `$` apart.
+ * @returns {{text: string, texts: string[]} | null} Null for no reader, literal code in its
+ *   arguments or a script path.
+ */
+function shellBody(words, io, ctx) {
+  let [name = "", ...args] = words;
+  name = path.posix.basename(name);
+  if (APPLETS.test(name) && args.length > 0) [name, ...args] = [appletName(args[0]), ...args.slice(1)];
+  if (name === "eval") {
+    // eval takes `--` as the end of its options, so it never reaches the code.
+    const code = args[0] === "--" ? args.slice(1) : args;
+    return code.length > 0 ? codeBody(code, io.source, ctx) : null;
+  }
+  const reader = SHELLS.test(name) || STDIN_CODE.test(name) || name === "ssh";
+  // Stdin the line feeds a reader is code whatever its options: a script, module or remote command may run it.
+  // One fed to an enclosing group or loop is stdin the reader's own words do not show.
+  const fed = !reader ? null : fedStdin(io) ? stdinBody(io, ctx) : groupFed(ctx.line ?? "") ? OPAQUE : null;
+  const from = bodySource(name, args);
+  if (from === null) return fed;
+  if (from.code !== undefined) return joinBodies(codeBody([from.code], io.source, ctx), fed);
+  const subs = (from.scripts ?? [from.script]).filter((s) => s?.startsWith("<(") && s.endsWith(")")).map((s) => substitutionBody(s.slice(2, -1), ctx));
+  // ssh's operands name a host and a remote command, never a script.
+  const script = name === "ssh" ? undefined : from.scripts === undefined ? from.script : scriptOperand(name, from.scripts);
+  const files = script === undefined || /^<\(/.test(script) || STDIN_PATH.test(script) ? [] : [writtenBody(script, ctx)];
+  if (from.scripts !== undefined || subs.length > 0) return [...subs, ...files, fed].reduce(joinBodies, null);
+  return from.script === undefined || STDIN_PATH.test(from.script) ? (fed ?? stdinBody(io, ctx)) : joinBodies(files[0] ?? null, fed);
+}
+
+/** The body a script file runs: the guard tracks no writes, so no file has a known body. */
+function writtenBody() {
+  return null;
+}
+
+/** Interpreter options whose operand is the program (no script runs), and options taking a value. */
+const SCRIPT_OPTS = [
+  [/^python/, /^-[bBdEhiIOqsSuvxPR]*[cm]/, /^-[WX]$/],
+  [/^node$/, /^(?:-[pe]{1,2}|--eval|--print)(?:=|$)/, /^(?:-r|--require|--import|--loader|--experimental-loader|-C|--conditions)$/],
+  [/^perl$/, /^-[aclnpsTtuUwWX0-9]*[eE]/, /^-[IMm]$/],
+  [/^ruby$/, /^-[acdlnpsSvwW]*e/, /^-[rIC]$/],
+  [/^php$/, /^-r/, /^-[cdz]$/],
+  [/^lua/, /^-e/, /^-l$/],
+  [/^(?:Rscript|expect)$/, /^-[ec]$/, /(?!)/],
+];
+
+/** Only the script operand runs; any other operand is data. */
+function scriptOperand(name, args) {
+  const [, inline, valued] = SCRIPT_OPTS.find(([n]) => n.test(name)) ?? [null, /(?!)/, /(?!)/];
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--" || (a === "-f" && /^(?:php|expect)$/.test(name))) return args[j + 1];
+    if (a === "-" || inline.test(a)) return undefined;
+    if (!a.startsWith("-")) return a;
+    if (valued.test(a)) j++;
+  }
+  return undefined;
+}
+
+/** An unseen side keeps the other's texts, as they still run. */
+function appendBodies(a, b) {
+  if (a.texts.length === 0 || b.texts.length === 0) return joinBodies(a, b);
+  const texts = [...new Set(a.texts.flatMap((x) => b.texts.map((y) => x + y)))];
+  return texts.length > MAX_VARIANTS ? OPAQUE : { text: texts[0] ?? "", texts };
+}
+
+/** One reading of a stage's redirects, so producers and writers agree on its io; `outs` are [token, operator, target]. */
+function stageIo(stage) {
+  const io = { stdin: null, quoted: false, herestring: false, inputs: [], feed: null, source: stage };
+  const argv = [];
+  const outs = [];
+  for (let i = 0; i < stage.length; i++) {
+    const op = i + 1 < stage.length ? REDIRECT.exec(stage[i]) : null;
+    if (op === null) argv.push(stage[i]);
+    else if (op[1].startsWith("<<")) {
+      io.stdin = stage[++i];
+      io.herestring = op[1] === "<<<";
+      io.quoted = !io.herestring && (QUOTED_DOCS.get(stage)?.has(i) ?? false);
+    } else if (!OUTPUT_OPS.has(op[1])) io.inputs.push(stage[++i]);
+    else outs.push([stage[i], op[1], stage[++i]]);
+  }
+  return { argv, io, outs };
+}
+
+/**
+ * Formatter text with each placeholder dropped; two entries are judged too, as one may end a
+ * command the next completes. -o leaves stdout unseen (format-patch prints file names). Null
+ * without --format, --pretty or an output file.
+ */
+function gitFormat(cmd) {
+  let j = 1;
+  for (; j < cmd.length && cmd[j].startsWith("-"); j++) if (GIT_VALUED.test(cmd[j])) j++;
+  let format;
+  let output;
+  let long = false;
+  for (let i = j + 1; i < cmd.length; i++) {
+    const a = cmd[i];
+    const m = /^--(format|pretty|output)=([\s\S]*)$/.exec(a);
+    if (m?.[1] === "output" || a === "-o" || a === "--output") [output, long] = [m?.[2] ?? cmd[++i], a !== "-o"];
+    else if (m !== null) format = m[1] === "format" ? m[2] : (/^t?format:([\s\S]*)$/.exec(m[2])?.[1] ?? (m[2].includes("%") ? m[2] : null));
+  }
+  if (format === undefined && output === undefined) return null;
+  const text = typeof format !== "string" ? null : format.replace(/%(?:(n)|(%)|x([0-9a-fA-F]{2})|[\s\S]?)/g, (m, n, pct, hex) => (n ? "\n" : pct ? "%" : hex ? String.fromCharCode(parseInt(hex, 16)) : ""));
+  const body = text === null ? OPAQUE : bodyOf([text, `${text}\n${text}`]);
+  return { output, body, stdout: output === undefined ? body : long ? bodyOf([""]) : OPAQUE };
+}
+
+/** Verdicts of groupFed per line text: every reader of a line asks again. */
+const GROUP_FED = new Map();
+
+/**
+ * Whether `text` gives a group, loop or subshell stdin a reader inside may read: an input
+ * redirect on its closer or a pipe into its opener; unsplittable text may.
+ */
+function groupFed(text) {
+  if (GROUP_FED.has(text)) return GROUP_FED.get(text);
+  const input = (c) => c.some((w, i) => i + 1 < c.length && REDIRECT.exec(w)?.[1].startsWith("<") === true);
+  const cmds = splitCommands(text);
+  const fed = cmds === null || cmds.some((c) => (/^(?:\}|done|fi|esac)$/.test(c[0]) || REDIRECT.test(c[0]) ? input(c) : /^(?:\{|while|until|for|if|case|select)$/.test(c[0]) && PLACES.get(c)?.piped === true));
+  if (GROUP_FED.size >= 64) GROUP_FED.clear();
+  GROUP_FED.set(text, fed);
+  return fed;
+}
+
+/** One body of two: literal only when both are, with the texts of both. */
+function joinBodies(a, b) {
+  if (a === null || b === null) return a ?? b;
+  const texts = [...new Set([...a.texts, ...b.texts])];
+  if (texts.length > MAX_VARIANTS) return OPAQUE;
+  return { text: texts[0] ?? "", texts };
+}
+
+/** Where a reader's code comes from besides fed stdin: `{code}` (a -c word), `{script}`, `{scripts}` (every operand), `{}` (stdin), or null for none. */
+function bodySource(name, args) {
+  if (SHELLS.test(name)) {
+    let j = 0;
+    let inline = false;
+    let stdin = false;
+    for (; j < args.length && /^[-+]/.test(args[j]); j++) {
+      const a = args[j];
+      if (a === "--" || a === "-") {
+        stdin ||= a === "-";
+        j++;
+        break;
+      }
+      if (/^[-+][oO]$|^--(?:rcfile|init-file)$/.test(a)) j++;
+      else if (/^-[a-zA-Z]*c/.test(a)) inline = true;
+      else if (/^-[a-zA-Z]*s/.test(a)) stdin = true;
+    }
+    if (inline) return args[j] === undefined ? null : { code: args[j] };
+    return stdin || args[j] === undefined ? {} : { script: args[j] };
+  }
+  if (name === "source" || name === ".") return args[0] === undefined ? null : { script: args[0] };
+  // Any operand of an interpreter or ssh may be a `<(...)` script.
+  return STDIN_CODE.test(name) || name === "ssh" ? { scripts: args } : null;
+}
+
+/** A reader's stdin: its heredoc or here-string, a `<(...)` input, or the literal text piped in; opaque for anything else or past MAX_DEPTH nested inputs. */
+function stdinBody(io, ctx, nest = 0) {
+  const inputs = io.inputs ?? [];
+  if (nest > MAX_DEPTH) return OPAQUE;
+  if (io.stdin !== null && io.stdin !== undefined) return inputs.length > 0 ? OPAQUE : docBody(io.stdin, io, ctx);
+  const last = inputs.at(-1);
+  if (last !== undefined) return last.startsWith("<(") && last.endsWith(")") ? substitutionBody(last.slice(2, -1), ctx, nest + 1) : (writtenBody(last, ctx) ?? OPAQUE);
+  return io.feed ? producerBody(io.feed, ctx, nest + 1) : OPAQUE;
+}
+
+/** A heredoc or here-string body: a quoted heredoc as written, a here-string as its word, an unquoted heredoc after the outer shell expands it. */
+function docBody(text, { quoted, herestring, source }, ctx) {
+  if (quoted) return bodyOf([text]);
+  if (herestring) return codeBody([text], source, ctx) ?? bodyOf([text]);
+  const texts = outerFill(text, ctx);
+  return texts === null ? OPAQUE : bodyOf(texts);
+}
+
+/** An unquoted heredoc as the outer shell expands it; null where a value is unknown. */
+function outerFill(text, ctx) {
+  let out = [""];
+  let pending = "";
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === "\\" && i + 1 < text.length && "$`\\\n".includes(text[i + 1])) {
+      if (text[++i] !== "\n") pending += text[i];
+    } else if (c === "`") return null;
+    else if (c === "$") {
+      const m = /^\$(?:\{([A-Za-z_]\w*)\}|([A-Za-z_]\w*))/.exec(text.slice(i, i + 256));
+      if (m === null) {
+        if (/[({@*#?$!\d-]/.test(text[i + 1] ?? "")) return null;
+        pending += c;
+        continue;
+      }
+      const values = bodyValues(m[1] ?? m[2], ctx);
+      if (values === null) return null;
+      out = out.flatMap((t) => values.map((v) => t + pending + v));
+      if (out.length > MAX_VARIANTS) return null;
+      pending = "";
+      i += m[0].length - 1;
+    } else pending += c;
+  }
+  return out.map((t) => t + pending);
+}
+
+const NAMED_AT = /\$\{([A-Za-z_]\w*)\}/y;
+
+/**
+ * Texts a split word takes: each `${name}` outside its quoted spans filled with the name's literal
+ * same-line values; null when a value or another expansion is unknown, or when `source` spells the
+ * word with two different quotings.
+ */
+function wordValues(w, source, ctx, guess = false) {
+  if (!/[$`]/.test(w)) return [w];
+  const found = new Set((source ?? []).flatMap((x, i) => (x === w ? [JSON.stringify(LITERALS.get(source)?.get(i) ?? [])] : [])));
+  // A word the split never showed is read by the global marks, which only a literal word's text sets.
+  const spans = found.size === 1 ? JSON.parse([...found][0]) : found.size === 0 && !LITERAL_WORDS.has(w) ? [] : null;
+  if (spans === null) return literalWord(w) ? [w] : null;
+  let out = [""];
+  let last = 0;
+  for (let i = 0; i < w.length; i++) {
+    if ((w[i] !== "$" && w[i] !== "`") || spans.some(([a, b]) => i >= a && i < b)) continue;
+    NAMED_AT.lastIndex = i;
+    const m = NAMED_AT.exec(w);
+    // The xargs placeholder stays as written: the items it stands for are judged where they are pasted.
+    const values = m === null ? null : m[1] === XARGS_NAME ? [m[0]] : (bodyValues(m[1], ctx) ?? (guess ? guessedValues(m[1], ctx) : null));
+    if (values === null) return null;
+    const lit = w.slice(last, i);
+    out = out.flatMap((t) => values.map((v) => t + lit + v));
+    if (out.length > MAX_VARIANTS) return null;
+    last = i + m[0].length;
+    i = last - 1;
+  }
+  return out.map((t) => t + w.slice(last));
+}
+
+/**
+ * `-c` or `eval` code words the shell joins and runs: each text their literal same-line values
+ * give, or opaque; null for literal words the caller reads as written. An opaque body still
+ * carries the texts the line's literal assignments would give when some binding is unsure, so
+ * they are still judged.
+ */
+function codeBody(words, source, ctx) {
+  if (words.every(literalWord)) return null;
+  const [word] = words;
+  if (words.length === 1 && word.startsWith("$(") && word[2] !== "(" && substitutionEnd(word, 0, false) === word.length) return substitutionBody(word.slice(2, -1), ctx);
+  for (const guess of [false, true]) {
+    let texts = [];
+    for (const [i, w] of words.entries()) {
+      const values = wordValues(w, source, ctx, guess);
+      texts = values === null ? null : i === 0 ? values : texts.flatMap((t) => values.map((v) => `${t} ${v}`));
+      if (texts === null || texts.length > MAX_VARIANTS) break;
+    }
+    if (texts !== null && texts.length <= MAX_VARIANTS) return guess ? { ...OPAQUE, texts: [...new Set(texts)] } : bodyOf(texts);
+  }
+  return OPAQUE;
+}
+
+/** Literal words assigned to `name` anywhere on the line, whatever else may bind it; null when none. */
+function guessedValues(name, ctx) {
+  const line = ctx.line;
+  const out = [];
+  for (const m of line.matchAll(WORD_NAME)) {
+    if (m[0] !== name || line[m.index + name.length] !== "=") continue;
+    const cmds = splitCommands(rawWords(line, m.index + name.length + 1, true)?.[0] ?? "");
+    const w = cmds?.length === 1 && cmds[0].length === 1 ? cmds[0][0] : null;
+    if (w !== null && literalWord(w)) out.push(w);
+    if (out.length > MAX_VARIANTS) return null;
+  }
+  return out.length > 0 ? out : null;
+}
+
+/** The output of a `<(...)` or `$(...)` body: literal only for one echo, printf or bare cat command. */
+function substitutionBody(body, ctx, nest = 0) {
+  const cmds = splitCommands(body);
+  return cmds?.length === 1 ? producerBody(cmds[0], ctx, nest) : OPAQUE;
+}
+
+/**
+ * Text a producer writes: echo or printf output, or a bare cat or tee passing on its heredoc,
+ * input or the stage piping into it; opaque for any other command.
+ */
+function producerBody(words, ctx, nest = 0) {
+  for (let stage = words, hops = 0; stage && hops <= MAX_DEPTH; hops++) {
+    const { argv, io } = stageIo(stage);
+    const texts = printedTexts(argv, stage, ctx);
+    if (texts !== undefined) return texts === null ? formatterBody(argv, stage, ctx) : bodyOf(texts);
+    const git = path.posix.basename(argv[0] ?? "") === "git" ? gitFormat(argv) : null;
+    if (git !== null) return git.stdout;
+    // cat prints its file operands in turn; one the line wrote shows its body.
+    if (argv[0] === "cat" && argv.length > 1 && argv.slice(1).every((f) => !f.startsWith("-"))) return argv.slice(1).map((f) => writtenBody(f, ctx) ?? OPAQUE).reduce(appendBodies);
+    if (argv.length !== 1 || (argv[0] !== "cat" && argv[0] !== "tee")) return OPAQUE;
+    if (io.stdin !== null || io.inputs.length > 0) return stdinBody(io, ctx, nest + 1);
+    stage = PASSED.get(stage);
+  }
+  return OPAQUE;
+}
+
+/** An echo or printf with a word the line does not show: opaque, still carrying the text its literal words print. */
+function formatterBody(argv, source, ctx) {
+  const shown = argv.map((w, i) => (i > 0 && wordValues(w, source, ctx) === null ? "" : w));
+  return { ...OPAQUE, texts: shown[1] === "" && path.posix.basename(argv[0]) === "printf" ? [] : (printedTexts(shown, source, ctx) ?? []) };
+}
+
+/** Texts an echo or printf command prints, its words' same-line values filled; undefined for another command, null when unreadable. */
+function printedTexts(argv, source, ctx) {
+  const name = path.posix.basename(argv[0] ?? "");
+  if (name !== "echo" && name !== "printf") return undefined;
+  let lists = [[]];
+  for (const w of argv.slice(1)) {
+    const values = wordValues(w, source, ctx);
+    // An unquoted value may split into more words or glob into file names.
+    if (values === null || (!literalWord(w) && values.some(hasGlob))) return null;
+    const forms = values.flatMap((v) => (!literalWord(w) && /\s/.test(v) ? [[v], v.split(/\s+/).filter(Boolean)] : [[v]]));
+    lists = lists.flatMap((l) => forms.map((f) => [...l, ...f]));
+    if (lists.length > MAX_VARIANTS) return null;
+  }
+  const out = [];
+  for (const args of lists) {
+    if (name === "printf") {
+      const text = args[0] === "--" ? printfOutput(args.slice(1)) : printfOutput(args);
+      if (text === null) return null;
+      out.push(text);
+      continue;
+    }
+    let a = args;
+    while (/^-[neE]+$/.test(a[0] ?? "")) a = a.slice(1);
+    const raw = `${a.join(" ")}\n`;
+    // bash's echo prints escapes as written unless -e; zsh's and sh's decode them and stop at `\c`.
+    const stopped = /^(?:[^\\]|\\[^c])*(?=\\c)/.exec(raw)?.[0];
+    out.push(raw, decodeEscapes(raw), ...(stopped === undefined ? [] : [decodeEscapes(stopped)]));
+  }
+  return out;
+}
+
+/** What `printf format args...` prints, the format reused while arguments remain; null for an option or a conversion other than %s, %b, %c, %d and %i. */
+function printfOutput([format, ...args]) {
+  if (format === undefined || (format.startsWith("-") && format !== "-")) return null;
+  let out = "";
+  let k = 0;
+  for (;;) {
+    let used = false;
+    for (const m of format.matchAll(PRINTF_PART)) {
+      const [part, flags, width, precision, conv] = m;
+      let piece = part;
+      if (part === "\\c") return out;
+      if (part.startsWith("\\")) piece = decodeEscapes(part);
+      else if (part === "%%") piece = "%";
+      else if (conv !== undefined) {
+        used = true;
+        const arg = args[k++];
+        if (conv === "s" || conv === "b") {
+          const text = conv === "b" ? decodeEscapes(/^(?:[^\\]|\\[^c])*/.exec(arg ?? "")[0]) : (arg ?? "");
+          piece = precision === undefined ? text : text.slice(0, Number(precision || 0));
+          if (conv === "b" && arg?.includes("\\c")) return out + piece;
+        } else if (conv === "c") piece = (arg ?? "").slice(0, 1);
+        else if (conv === "d" || conv === "i") {
+          if (arg !== undefined && !/^[-+]?\d+$/.test(arg)) return null;
+          piece = String(BigInt((arg ?? "0").replace(/^\+/, "")));
+        } else return null;
+        if (Number(width || 0) > MAX_JOINED_CHARS) return null;
+        piece = flags.includes("-") ? piece.padEnd(Number(width || 0)) : piece.padStart(Number(width || 0), flags.includes("0") && /[di]/.test(conv) ? "0" : " ");
+      }
+      out += piece;
+      if (out.length > MAX_JOINED_CHARS) return null;
+    }
+    if (!used || k >= args.length) return out;
+  }
+}
+
+/** Literal texts `name` holds on the line, each one quoted or plain word with no expansion; null when one is unknown. */
+function bodyValues(name, ctx) {
+  const raw = SHELL_SET.test(name) ? null : lineValues(name, ctx);
+  if (!raw?.length) return null;
+  const out = [];
+  for (const r of raw) {
+    const cmds = splitCommands(r);
+    const w = cmds?.length === 1 && cmds[0].length === 1 ? cmds[0][0] : null;
+    if (w === null || !literalWord(w)) return null;
+    out.push(w);
+  }
+  return out;
+}
+
+/** A literal body of `texts`, opaque past MAX_VARIANTS. */
+function bodyOf(texts) {
+  const all = [...new Set(texts)];
+  return all.length > MAX_VARIANTS ? OPAQUE : { text: all[0] ?? "", texts: all };
+}
+
+/** Whether xargs runs an XARGS_READERS command or none (echo); judgeXargs judges any other child. */
+function xargsReadOnly(args) {
+  const cmd = xargsChild(args, 0);
+  if (cmd === null) return false;
+  const word = args[cmd.at];
+  return word === undefined || (!/[$`]/.test(word) && !hasGlob(word) && XARGS_READERS.has(commandName(word) ?? ""));
+}
+
+/** Read-only commands, each with an optional check of its arguments. */
+const READ_ONLY = new Map([
+  ...["cat", "tac", "nl", "head", "tail", "wc", "grep", "egrep", "fgrep", "jq", "diff", "cmp", "comm", "ls", "stat", "file", "du", "df", "echo", "cut", "tr", "paste", "column", "fold", "fmt", "expand", "rev", "od", "hexdump", "strings", "md5", "md5sum", "shasum", "sha1sum", "sha256sum", "basename", "dirname", "realpath", "readlink", "pwd", "which", "type", "test", "[", "[[", "true", "false", ":", "date", "id", "whoami", "uname", "printenv", "cd", "pushd", "popd", "sleep", "wait", "exit", "return", "break", "continue", "shift", "read", "for", "select", "case"].map((n) => [n, null]),
+  ["printf", (a) => !a.some((x) => x.startsWith("-v"))],
+  ["rg", (a) => !a.some((x) => /^--pre(?:=|$)/.test(x) || longOpt(x, ["pre"]))],
+  ["sort", (a) => !a.some((x) => /^-[a-zA-Z]*o|^--(?:output|compress-program)/.test(x) || longOpt(x, ["output", "compress-program"]))],
+  ["uniq", (a) => operands(a, /^-[fsw]$/).length <= 1],
+  ["git", gitReadOnly],
+  ["find", (a) => !a.some((x) => /^-(?:exec|execdir|ok|okdir|delete|fprint0?|fprintf|fls)$/.test(x))],
+  ["sed", sedReadOnly],
+  ...[...AWKS].map((n) => [n, (a) => awkPrograms(a)?.every(awkPlain) ?? false]),
+  ["xargs", xargsReadOnly],
+  ["gh", (a) => !a.slice(0, 2).some((x) => x.startsWith("-")) && GH_READ.test(a.slice(0, 2).join(" ")) && !a.some((x) => /^(?:-O|--output|-D|--dir|--clobber)/.test(x) || longOpt(x, ["output", "dir", "clobber"]))],
+  ["openspec", (a) => !/^(?:init|update)$/.test(a.find((x) => !x.startsWith("-")) ?? "")],
+]);
+
+/** Parses --ttl (minutes) and --fault after the script path. */
+export function parseOptions(argv) {
+  const opts = { ttlMin: DEFAULT_TTL_MIN };
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--ttl") {
+      const n = Number.parseInt(argv[++i], 10);
+      if (Number.isInteger(n) && n > 0) opts.ttlMin = n;
+    } else if (argv[i] === "--fault") {
+      opts.fault = argv[++i];
+    }
+  }
+  return opts;
+}
+
+/**
+ * Real paths of the temp roots that exist, plus each root as written: a path under an alias
+ * such as /tmp is also judged at its real path, so an alias never hides an escape.
+ */
+export function tmpRoots() {
+  const out = new Set();
+  for (const root of [os.tmpdir(), process.env.TMPDIR, "/tmp", "/private/tmp"]) {
+    if (!root) continue;
+    try {
+      out.add(fs.realpathSync.native(root));
+      out.add(path.resolve(root));
+    } catch {
+      // A missing root holds nothing to exempt.
+    }
+  }
+  return [...out];
+}
+
+/** Real path of `p` in its on-disk form, or `p` made absolute when it cannot be resolved. */
+function realOr(p) {
+  try {
+    return fs.realpathSync.native(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+/**
+ * Where a path is judged from; home, project and configDir are real paths.
+ * @typedef {object} Env
+ * @property {string} home The home directory.
+ * @property {string} project CLAUDE_PROJECT_DIR, else the payload cwd.
+ * @property {string} cwd The directory a relative operand resolves against.
+ * @property {string | null} configDir CLAUDE_CONFIG_DIR when set; every `~/.claude` rule applies to it.
+ * @property {string[]} tmpRoots See tmpRoots().
+ * @property {{ left: number }} realpathBudget Realpath calls left for this judgment.
+ */
+
+/**
+ * Judgment env for a payload, resolved so every comparison is between on-disk forms.
+ * @returns {Env}
+ */
+export function defaultEnv(payload = {}) {
+  const cwd = typeof payload.cwd === "string" && payload.cwd ? payload.cwd : process.cwd();
+  const configDir = process.env.CLAUDE_CONFIG_DIR ? realOr(process.env.CLAUDE_CONFIG_DIR) : null;
+  return { home: realOr(os.homedir()), project: realOr(process.env.CLAUDE_PROJECT_DIR || cwd), cwd, configDir, tmpRoots: tmpRoots(), realpathBudget: { left: MAX_REALPATHS } };
+}
+
+/**
+ * Lexical and real forms of an operand. The real form follows the kernel: symlinks resolve
+ * segment by segment before a `..` applies, the deepest existing ancestor is resolved with the
+ * missing segments rejoined, and a broken link is followed from the real path of its directory.
+ * @param {string} p The operand, absolute or relative to `env.cwd`.
+ * @param {Env} env Each realpath call spends one unit of its budget.
+ * @returns {{ paths: string[], legacy: boolean }} The lexical form first, the real form last when
+ *   distinct; `legacy` when resolution stopped short (budget, loop, unreadable link) and the
+ *   operand must also pass the name rules.
+ */
+export function resolveOperand(p, env) {
+  const written = String(p).replace(/\\/g, "/");
+  const paths = [path.resolve(env.cwd, written)];
+  let legacy = false;
+  const spend = () => {
+    if (env.realpathBudget.left <= 0) {
+      legacy = true;
+      return false;
+    }
+    env.realpathBudget.left--;
+    return true;
+  };
+  // Real path of the deepest existing ancestor of `abs`, which holds no `..`, plus the rest.
+  const climb = (abs) => {
+    const rest = [];
+    for (let dir = abs; ; ) {
+      tick();
+      if (!spend()) return null;
+      try {
+        return path.join(fs.realpathSync.native(dir), rest.join("/"));
+      } catch (e) {
+        if (e?.code !== "ENOENT" && e?.code !== "ENOTDIR") {
+          legacy = true;
+          return null;
+        }
+      }
+      let link = false;
+      try {
+        link = fs.lstatSync(dir).isSymbolicLink();
+      } catch {
+        // Missing: keep climbing.
+      }
+      if (link) followBroken(dir, rest);
+      const parent = path.dirname(dir);
+      if (parent === dir) return null;
+      rest.unshift(path.basename(dir));
+      dir = parent;
+    }
+  };
+  // Segments taken from the real directory `base`; a `..` pops the resolved form. Segments join
+  // as one string: one argument per segment overflows the stack.
+  const walk = (base, segs) => {
+    let cur = base;
+    let pending = [];
+    for (const s of segs) {
+      tick();
+      if (s === "" || s === ".") continue;
+      if (s !== "..") {
+        pending.push(s);
+        continue;
+      }
+      if (pending.length > 0) {
+        cur = climb(path.join(cur, pending.join("/")));
+        if (cur === null) return null;
+        pending = [];
+      }
+      cur = path.dirname(cur);
+    }
+    return pending.length > 0 ? climb(path.join(cur, pending.join("/"))) : cur;
+  };
+  const followBroken = (link, rest) => {
+    if (!spend()) return;
+    let dir;
+    let target;
+    try {
+      dir = fs.realpathSync.native(path.dirname(link));
+      target = fs.readlinkSync(link);
+    } catch {
+      legacy = true;
+      return;
+    }
+    const real = walk(target.startsWith("/") ? "/" : dir, [...target.split("/"), ...rest]);
+    if (real !== null) paths.push(real);
+  };
+  const real = walk("/", (written.startsWith("/") ? written : `${env.cwd}/${written}`).split("/"));
+  if (real !== null) paths.push(real);
+  return { paths: [...new Set(paths)], legacy };
+}
+
+/** Absolute form with `/` separators, folded to NFC and full case as APFS compares names. */
+function norm(p) {
+  return path.posix.resolve("/", String(p).replace(/\\/g, "/")).normalize("NFC").toUpperCase().toLowerCase();
+}
+
+/** Whether `p` is `root` or lies under it (both normalized). */
+function within(p, root) {
+  return p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
+}
+
+/** Whether the directory `up` levels above `file` holds `.claude-plugin/plugin.json`. */
+function pluginRoot(file, up) {
+  let dir = String(file);
+  for (let i = 0; i < up; i++) dir = path.dirname(dir);
+  return fs.existsSync(path.join(dir, ".claude-plugin", "plugin.json"));
+}
+
+/** Whether the normalized path `p` lies in a temp root and outside the home, project and config dirs; with `around`, none of those under `p` either. */
+function tempOnly(p, env, around = false) {
+  const kept = [env.home, env.project, ...(env.configDir ? [env.configDir] : [])].map(norm);
+  return !kept.some((r) => within(p, r) || (around && within(r, p))) && env.tmpRoots.some((t) => within(p, norm(t)));
+}
+
+/** Whether a resolved absolute path is live harness configuration by its location (Claude Code loads it, runs it, or removing its directory takes such a file with it); in a temp root only when it also lies under the home, project or config dir or is named like the marker.
+ * @param {string} absPath The resolved path.
+ * @param {Env} env
+ */
+export function liveTarget(absPath, env) {
+  const p = norm(absPath);
+  const reach = (root, exact) => (exact ? p === root : within(p, root));
+  return liveAt(p.split("/").filter(Boolean), p, env, { m: (seg, name) => seg === name, reach, plugin: (up) => pluginRoot(absPath, up) });
+}
+
+/** The location rules of liveTarget and patternLive over the target's path segments `s`; `at` is the normalized path the temp-root check judges.
+ * @param {(seg: string, name: string) => boolean} o.m Whether segment `seg` matches `name`.
+ * @param {(root: string, exact: boolean) => boolean} o.reach Whether `s` is `root` (`exact`) or lies under it.
+ * @param {(up: number) => boolean} o.plugin Whether the directory `up` levels above the target can be a plugin root.
+ * @param {boolean} [o.around] The temp-root exemption also fails when a home, project or config dir lies under `at`.
+ */
+function liveAt(s, at, env, { m, reach, plugin, around = false }) {
+  const last = s[s.length - 1];
+  const parent = s[s.length - 2];
+  if (m(last, MARKER)) return true;
+  if (tempOnly(at, env, around)) return false;
+  const home = norm(env.home);
+  const configDir = env.configDir ? norm(env.configDir) : null;
+  const userDirs = [...new Set([`${home}/.claude`, ...(configDir ? [configDir] : [])])];
+  const exact = [`${home}/.claude.json`, ...(configDir ? [`${configDir}/.claude.json`] : [])];
+  for (const d of userDirs) exact.push(d, `${d}/claude.md`, `${d}/settings.json`, `${d}/settings.local.json`, `${d}/freeharness`);
+  return (
+    s.some((x, i) => m(x, "hooks") && (HOOK_OWNERS.some((o) => m(s[i - 1], o)) || (m(s[i - 1], "freeharness") && m(s[i - 2], ".claude")))) ||
+    userDirs.some((d) => [`${d}/hooks`, `${d}/freeharness/hooks`, `${d}/plugins`].some((h) => reach(h, false))) ||
+    exact.some((e) => reach(e, true)) ||
+    m(last, ".mcp.json") ||
+    (m(parent, ".claude") && (m(last, "settings.json") || m(last, "settings.local.json"))) ||
+    m(last, ".claude") ||
+    m(last, ".freeharness") ||
+    (m(last, "hooks.json") && m(parent, "hooks") && plugin(2)) ||
+    (m(last, "hooks") && plugin(1))
+  );
+}
+
+/**
+ * Whether an Edit or Write of `file` touches live configuration, judged at its written and real
+ * paths. An operand whose resolution stopped short is also judged by the name rules, except past
+ * the realpath budget: a real path went unseen there, so the write is denied.
+ * @param {string} file The file path, absolute or relative to `env.cwd`.
+ * @param {Env} [env] Defaults to the process's home, cwd and temp roots.
+ */
+export function isProtectedPath(file, env = defaultEnv()) {
+  const { paths, legacy } = resolveOperand(file, env);
+  if (legacy && env.realpathBudget.left <= 0) return true;
+  return paths.some((p) => liveTarget(p, env)) || (legacy && legacyProtected(paths[0], false));
+}
+
+/** `p` with a leading `~` or `~/` made absolute; null for `~user`, `~+` and `~-`. */
+function expandTilde(p, home) {
+  if (!p.startsWith("~")) return p;
+  return p === "~" || p.startsWith("~/") ? home + p.slice(1) : null;
+}
+
+/** Whether `dir` is a directory the shell can enter. */
+function enterable(dir) {
+  try {
+    fs.accessSync(dir, fs.constants.X_OK);
+    return fs.statSync(dir).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Where relative paths resolve at a point of a Bash line: every candidate cwd (a cd that may not
+ * run or may fail keeps the old one), `unresolved` once a cd the guard cannot follow ran, and the
+ * pushd stack. Replaced, never mutated.
+ * @typedef {{ cwds: string[], unresolved: boolean, stack: Dir[] }} Dir
+ */
+
+/** A dir holding both candidates; `lost` also leaves it unresolved. */
+function mergeDirs(a, b, lost) {
+  const cwds = [...new Set([...a.cwds, ...b.cwds])];
+  return { cwds: cwds.slice(0, MAX_CWDS), unresolved: lost || a.unresolved || b.unresolved || cwds.length > MAX_CWDS, stack: a.stack === b.stack ? a.stack : [] };
+}
+
+/** Texts `src` takes with each of its `spans` (read lazily) replaced by every value `valuesOf(name, index)` gives; null once it gives null (the caller's unknown-name policy) or past `max` texts. */
+function expandNames(src, valuesOf, max, spans = namedSpans(src)) {
+  let out = [""];
+  let last = 0;
+  for (const { index, end, name } of spans) {
+    const values = valuesOf(name, index);
+    if (values === null) return null;
+    const lit = src.slice(last, index);
+    out = out.flatMap((w) => values.map((v) => w + lit + v));
+    if (out.length > max) return null;
+    last = end;
+  }
+  return out.map((w) => w + src.slice(last));
+}
+
+/** The `${name}` expansions of `src`. */
+function* namedSpans(src) {
+  for (const m of src.matchAll(NAMED_EXP)) yield { index: m.index, end: m.index + m[0].length, name: m[1] };
+}
+
+/**
+ * Whether a literal path is live: resolved against each candidate cwd and judged by location,
+ * and by name too when resolution stopped short, or when it is relative and the cwd unresolved.
+ */
+function pathLive(p, ctx) {
+  const segs = segments(p);
+  if (p === "" || (segs.length === 1 && segs[0] === "~")) return legacyProtected(p, false);
+  const abs = expandTilde(p, ctx.env.home);
+  if (abs === null) return ownLive(p, false, ctx);
+  const relative = !abs.startsWith("/");
+  if (relative && ctx.dir.unresolved) return ownLive(abs, false, ctx);
+  return (relative ? ctx.dir.cwds : [ctx.env.cwd]).some((cwd) => {
+    const env = { ...ctx.env, cwd };
+    const { paths, legacy } = resolveOperand(abs, env);
+    return paths.some((x) => liveTarget(x, env)) || (legacy && legacyProtected(paths[0], false));
+  });
+}
+
+/**
+ * Whether some expansion of a glob word can be live. Braces expand first; the literal head
+ * (the cwd when there is none) resolves like a path; a tail of bare wildcards is expanded on disk
+ * (wildLive, starLive for a lone `*`), any other is matched against the location rules
+ * (patternLive); a `**` and a `..` after a wildcard keep the name rules.
+ */
+function globLive(p, ctx) {
+  if (BRACES.test(p)) return braceVariants(p).some((v) => operandLive(v, ctx));
+  const star = STAR.exec(p);
+  if (star && !hasGlob(star[1] ?? "")) return starLive(star[1] ?? ".", p, ctx);
+  const bare = segments(p);
+  while (bare.length > 0 && PURE_WILD.test(bare[bare.length - 1])) bare.pop();
+  const abs = expandTilde(p, ctx.env.home);
+  const relative = abs !== null && !abs.startsWith("/");
+  if (abs === null || (relative && ctx.dir.unresolved)) return ownLive(p, true, ctx);
+  if ((bare.length === 0 && !relative) || (bare.length === 1 && bare[0] === "~")) return legacyProtected(p, true);
+  const segs = abs.split("/");
+  const first = segs.findIndex(hasGlob);
+  if (first < 0) return pathLive(p, ctx);
+  const tail = segs.slice(first).filter((s) => s !== "" && s !== ".");
+  if (tail.includes("..") || tail.some((s) => s.includes("**"))) return legacyProtected(p, true);
+  // A tail of bare wildcards is expanded on disk; in another tail, trailing ones stand for the
+  // contents of what the rest matches.
+  const bareTail = tail.every((s) => PURE_WILD.test(s));
+  if (!bareTail) while (PURE_WILD.test(tail[tail.length - 1])) tail.pop();
+  const head = segs.slice(0, first).join("/") || (relative ? "." : "/");
+  const folded = tail.map((s) => s.normalize("NFC").toUpperCase().toLowerCase());
+  const dots = ctx.dots;
+  return (relative ? ctx.dir.cwds : [ctx.env.cwd]).some((cwd) => {
+    const env = { ...ctx.env, cwd };
+    const { paths, legacy } = resolveOperand(head, env);
+    // wildLive lists the disk itself, so past the realpath budget only the head takes the name rules.
+    return (legacy && (bareTail ? legacyProtected(head, false) : legacyProtected(p, true))) || paths.some((x) => (bareTail ? wildLive(x, tail, dots, env) : patternLive(x, folded, env, dots)));
+  });
+}
+
+/**
+ * Whether bare-wildcard segments `tail` expand under the directory `dir` to live configuration,
+ * each level listed as the shell would (a dot name only for a dot pattern or under dotglob) and
+ * each match judged at its written and real path; an unreadable directory or more than
+ * MAX_LISTED entries in all counts.
+ */
+function wildLive(dir, tail, dots, env, listed = { n: 0 }) {
+  if (tail.length === 0) return liveTarget(dir, env) || liveTarget(realOr(dir), env);
+  const [seg, ...rest] = tail;
+  let handle;
+  try {
+    handle = fs.opendirSync(dir);
+  } catch (e) {
+    // A pattern that matches nothing reaches the command as written.
+    return e?.code !== "ENOENT" && e?.code !== "ENOTDIR" ? true : liveTarget(path.join(dir, ...tail), env);
+  }
+  try {
+    for (;;) {
+      tick();
+      const entry = handle.readSync();
+      if (entry === null) return false;
+      if (++listed.n > MAX_LISTED) return true;
+      const name = entry.name;
+      if ((dots || !name.startsWith(".") || /^[.[]/.test(seg)) && globMatch(seg, name) && wildLive(path.join(dir, name), rest, dots, env, listed)) return true;
+    }
+  } finally {
+    handle.closeSync();
+  }
+}
+
+/**
+ * Whether a trailing `*` in `dir` can expand to live configuration: the directory, listed once,
+ * directly holds a live name (a dot name only under a same-line dotglob) or more than
+ * MAX_LISTED entries; an unresolved directory keeps the name rules.
+ */
+function starLive(dir, p, ctx) {
+  const abs = expandTilde(dir, ctx.env.home);
+  if (abs === null) return ownLive(p, true, ctx);
+  const relative = !abs.startsWith("/");
+  if (relative && ctx.dir.unresolved) return ownLive(p, true, ctx);
+  const dots = ctx.dots;
+  return (relative ? ctx.dir.cwds : [ctx.env.cwd]).some((cwd) => {
+    const env = { ...ctx.env, cwd };
+    const { paths, legacy } = resolveOperand(abs, env);
+    return (legacy && legacyProtected(p, true)) || paths.some((x) => holdsLive(x, dots, env));
+  });
+}
+
+/** Whether the directory `dir` directly holds a live entry or more than MAX_LISTED; an unreadable one counts. */
+function holdsLive(dir, dots, env) {
+  let handle;
+  try {
+    handle = fs.opendirSync(dir);
+  } catch (e) {
+    return e?.code !== "ENOENT" && e?.code !== "ENOTDIR";
+  }
+  try {
+    for (let n = 0; ; n++) {
+      const entry = handle.readSync();
+      if (entry === null) return false;
+      if (n >= MAX_LISTED) return true;
+      if ((dots || !entry.name.startsWith(".")) && liveTarget(path.join(dir, entry.name), env)) return true;
+    }
+  } catch {
+    return true;
+  } finally {
+    handle.closeSync();
+  }
+}
+
+/** liveTarget's rules for the resolved head `real` plus folded `tail` segments (one a wildcard), each name matched as a glob, a leading wildcard matching a dot name under `dots`; a temp-root head passes unless a home, project or config dir lies on either side of it or the tail can end in the marker name. */
+function patternLive(real, tail, env, dots) {
+  const headSegs = real.split("/").filter(Boolean);
+  const at = norm(real);
+  const s = [...at.split("/").filter(Boolean), ...tail];
+  const m = (seg, name) => seg !== undefined && (hasGlob(seg) ? globMatch(seg, name) && (dots || !name.startsWith(".") || /^[.[]/.test(seg)) : seg === name);
+  const reach = (root, exact) => {
+    const r = root.split("/").filter(Boolean);
+    return (exact ? s.length === r.length : s.length >= r.length) && r.every((x, i) => m(s[i], x));
+  };
+  // A plugin root inside the literal head is checked on disk; one a wildcard names may hold one.
+  const plugin = (up) => s.length - up > headSegs.length || fs.existsSync(path.join("/", headSegs.slice(0, s.length - up).join("/"), ".claude-plugin", "plugin.json"));
+  return liveAt(s, at, env, { m, reach, plugin, around: true });
+}
+
+/** Whether a word can expand as a glob (brace expansion included). */
+function hasGlob(s) {
+  const open = s.indexOf("[");
+  return /[*?]/.test(s) || (open >= 0 && s.lastIndexOf("]") > open) || BRACES.test(s);
+}
+
+/** Whether a glob segment can match `name`; a class matches any one character. */
+function globMatch(pattern, name) {
+  const tokens = [];
+  const lastClose = pattern.lastIndexOf("]");
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    if (c === "*" || c === "?") tokens.push(c);
+    else if (c === "[" && i + 2 <= lastClose) {
+      tokens.push("?");
+      i = pattern.indexOf("]", i + 2);
+    } else tokens.push(c.toLowerCase());
+  }
+  const n = name.toLowerCase();
+  let row = [true, ...Array(n.length).fill(false)];
+  for (const t of tokens) {
+    const next = [t === "*" && row[0]];
+    for (let j = 1; j <= n.length; j++) next[j] = t === "*" ? next[j - 1] || row[j] : row[j - 1] && (t === "?" || t === n[j - 1]);
+    row = next;
+  }
+  return row[n.length];
+}
+
+/**
+ * Brace expansions of a word; past 64 variants or 4,096 chars the braces become one `*` or `.*`.
+ * With `exact`, only what the shell can produce: a numeric range lists its numbers and a bracket
+ * class its characters; a class it cannot list, or past 64 words, stands for any one character.
+ */
+function braceVariants(p, exact = false) {
+  let out = [p];
+  while (out.some((v) => BRACES.test(v))) {
+    const next = [];
+    for (const v of out) {
+      const m = BRACES.exec(v);
+      const range = exact && /^\{(0|-?[1-9]\d{0,5})\.\.(0|-?[1-9]\d{0,5})\}$/.exec(m?.[0] ?? "");
+      const nums = range && Math.abs(range[2] - range[1]) < 64 ? Array.from({ length: Math.abs(range[2] - range[1]) + 1 }, (_, k) => String(+range[1] + (+range[2] < +range[1] ? -k : k))) : ["*"];
+      if (!m) next.push(v);
+      else for (const alt of m[0].includes(",") ? m[0].slice(1, -1).split(",") : nums) next.push(v.slice(0, m.index) + alt + v.slice(m.index + m[0].length));
+    }
+    if (next.length > 64 || next.length * p.length > 4096) {
+      out = ["*", ".*"].map((w) => `${p.slice(0, p.indexOf("{"))}${w}${p.slice(p.lastIndexOf("}") + 1)}`);
+      break;
+    }
+    out = next;
+  }
+  if (!exact) return out;
+  const posix = { alpha: "a-zA-Z", upper: "A-Z", lower: "a-z", digit: "0-9", alnum: "a-zA-Z0-9", xdigit: "0-9a-fA-F", space: " \t\n\r\v\f", blank: " \t", punct: "!-/:-@[-`{-~" };
+  // A class lists its characters (null past 64 words), else stands for one `?`; an unclosed `[` is literal.
+  const classes = (v) => {
+    const n = v.length;
+    // Every class end comes from one right-to-left pass: a scan per `[` would make a word of openers cubic.
+    const sub = Object.fromEntries([":", ".", "="].map((t) => [t, new Int32Array(n + 2).fill(-1)]));
+    const end = new Int32Array(n + 2).fill(-1);
+    for (let q = n - 1; q >= 0; q--) {
+      for (const t of ":.=") sub[t][q] = v[q] === t && v[q + 1] === "]" ? q : sub[t][q + 1];
+      const close = v[q] === "[" && q + 1 < n && ":.=".includes(v[q + 1]) ? sub[v[q + 1]][q + 2] : -1;
+      end[q] = v[q] === "]" ? q : close >= 0 ? end[close + 2] : end[q + 1];
+    }
+    const parts = [];
+    let lit = "";
+    let wild = "";
+    for (let i = 0; i < n; i++) {
+      let k = i + 1 + (v[i + 1] === "!" || v[i + 1] === "^" ? 1 : 0);
+      if (v[k] === "]") k++;
+      const e = v[i] === "[" && k < n ? end[k] : -1;
+      if (e < 0) {
+        lit += v[i];
+        wild += v[i];
+        continue;
+      }
+      const raw = v.slice(i + 1, e);
+      const body = raw.replace(/\[:(\w+):\]/g, (_, name) => posix[name] ?? "\0");
+      let chars = !/^[!^]|\[[.=]|\0|\\/.test(raw) && !body.includes("\0") ? new Set() : null;
+      for (let j = 0; chars !== null && j < body.length; j++) {
+        const [a, z] = body[j + 1] === "-" && j + 2 < body.length ? [body.charCodeAt(j), body.charCodeAt((j += 2))] : [body.charCodeAt(j), body.charCodeAt(j)];
+        for (let c = a; c <= z && chars.size <= 64; c++) chars.add(String.fromCharCode(c));
+        if (z < a || chars.size > 64) chars = null;
+      }
+      parts.push(lit, chars);
+      lit = "";
+      wild += "?";
+      i = e;
+    }
+    parts.push(lit);
+    let words = parts.includes(null) ? null : [""];
+    for (const part of words === null ? [] : parts) {
+      words = typeof part === "string" ? words.map((s) => s + part) : words.flatMap((s) => [...part].map((c) => s + c));
+      if (words.length > 64) return { words: null, wild };
+    }
+    return { words, wild };
+  };
+  const listed = out.map(classes);
+  return listed.some((l) => l.words === null) || listed.flatMap((l) => l.words).length > 64 ? listed.map((l) => l.wild) : listed.flatMap((l) => l.words);
+}
+
+/** Path segments with empty, `.` and resolvable `..` segments removed. */
+function segments(p) {
+  const out = [];
+  for (const seg of p.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === ".." && out.length > 0 && out[out.length - 1] !== "..") out.pop();
+    else out.push(seg);
+  }
+  return out;
+}
+
+/**
+ * Whether a path names a protected file, a hooks directory or one of their parents, by name
+ * alone: the rule for Bash text and for an operand whose location cannot be resolved.
+ * @param {string} p The path.
+ * @param {boolean} glob Treat wildcards as patterns that can expand to a protected path.
+ * @param {boolean} [scripts] Count a hook script name outside a hooks dir.
+ */
+function legacyProtected(p, glob, scripts = true) {
+  if (glob && BRACES.test(p)) return braceVariants(p).some((v) => legacyProtected(v, true, scripts));
+  const segs = segments(p);
+  if (segs.some((s) => s.toLowerCase() === "node_modules")) return false;
+  const wild = (s) => glob && hasGlob(s);
+  const is = (s, name) => (wild(s) ? globMatch(s, name) : s.toLowerCase() === name);
+  // A bare wildcard stands for its directory's contents: the project root, or a protected dir.
+  let pure = false;
+  while (segs.length > 0 && wild(segs[segs.length - 1]) && PURE_WILD.test(segs[segs.length - 1])) {
+    segs.pop();
+    pure = true;
+  }
+  const n = segs.length;
+  if (n === 0) return pure;
+  const last = segs[n - 1];
+  const hooksAt = (end) => end >= 2 && is(segs[end - 1], "hooks") && HOOK_PARENTS.some((h) => is(segs[end - 2], h));
+  return (
+    (!pure && (wild(last) ? BASE_SAMPLES.some((b) => (scripts || !SCRIPT.test(b)) && globMatch(last, b)) : BASE.test(last) && (scripts || !SCRIPT.test(last)))) ||
+    (!pure && hooksAt(n - 1)) ||
+    hooksAt(n) ||
+    is(last, ".claude") ||
+    is(last, ".freeharness") ||
+    (n >= 2 && is(segs[n - 2], ".claude") && is(last, "freeharness")) ||
+    segs.some((s, k) => k + 1 < n && is(s, ".claude") && is(segs[k + 1], "plugins")) ||
+    (n === 1 && last === "~")
+  );
+}
+
+/** Length of the variable name at `i`, or 0. */
+function nameAt(s, i) {
+  NAME_AT.lastIndex = i;
+  return NAME_AT.exec(s)?.[0].length ?? 0;
+}
+
+/**
+ * The expansion at `i`: `$name`, `${...}`, `$(...)` or a backtick.
+ * @returns {{end: number, words: string[]} | null} The index after it and the words it can
+ *   yield besides its value (an operator's word or replacement); null when none starts here.
+ */
+function expansionAt(t, i) {
+  if (t[i] === "`") {
+    const end = quoteEnd(t, i);
+    return end < 0 ? null : { end, words: [] };
+  }
+  if (t[i] !== "$") return null;
+  const open = t[i + 1];
+  if (open === "(" || open === "{") {
+    const end = closeGroup(t, i + 2, open, open === "(" ? ")" : "}");
+    if (end < 0) return null;
+    return { end, words: open === "{" ? expansionWords(t.slice(i + 2, end - 1), true) : [] };
+  }
+  EXP_NAME.lastIndex = i + 1;
+  const m = EXP_NAME.exec(t);
+  return m === null ? null : { end: i + 1 + m[0].length, words: [] };
+}
+
+/** Words a `${...}` body can yield after its head (a nested `${...}` head included); `yielded` drops pattern operands. */
+function expansionWords(body, yielded = false) {
+  let head = EXP_FLAGS.exec(body)[0].length;
+  const open = body[head + 1];
+  if (body[head] === "$" && (open === "{" || open === "(")) head = closeGroup(body, head + 2, open, open === "{" ? "}" : ")");
+  else {
+    EXP_NAME.lastIndex = head;
+    head += EXP_NAME.exec(body)?.[0].length ?? 0;
+  }
+  if (head < 0) return [body];
+  if (body[head] === "[") head = body.indexOf("]", head) + 1 || body.length;
+  const rest = body.slice(head);
+  if (rest === "") return [];
+  const op = EXP_OP.exec(rest)?.[0];
+  if (yielded && (op === undefined || /^(?:##?|%%?|:|\^\^?|,,?|@)$/.test(op))) return [];
+  const after = rest.slice(op?.length ?? 0);
+  if (yielded && op.startsWith("/")) return after.includes("/") ? [after.slice(after.indexOf("/") + 1)] : [];
+  return rest.startsWith("/") && after.includes("/") ? [after, after.slice(after.indexOf("/") + 1)] : [after];
+}
+
+/** Index after the quote closing the one at `i`; -1 if unterminated. */
+function quoteEnd(s, i) {
+  const q = s[i];
+  let j = i + 1;
+  while (j < s.length && s[j] !== q) j += q !== "'" && s[j] === "\\" ? 2 : 1;
+  return j < s.length ? j + 1 : -1;
+}
+
+/** Index after the ANSI-C quote opened at `i` (the `'` after `$`); -1 if unterminated. */
+function ansiEnd(s, i) {
+  let j = i + 1;
+  while (j < s.length && s[j] !== "'") j += s[j] === "\\" ? 2 : 1;
+  return j < s.length ? j + 1 : -1;
+}
+
+const ANSI = { a: "\x07", b: "\b", e: "\x1b", E: "\x1b", f: "\f", n: "\n", r: "\r", t: "\t", v: "\v" };
+
+/** Decodes the body of a `$'...'` word the way Bash does. */
+function decodeAnsi(body) {
+  return body.replace(/\\(?:x([0-9a-fA-F]{1,2})|u([0-9a-fA-F]{1,4})|U([0-9a-fA-F]{1,8})|([0-7]{1,3})|c(.)|(.))/gs, (_, x, u, U, o, c, ch) => {
+    if (x || u || U) return String.fromCodePoint(Math.min(Number.parseInt(x || u || U, 16), 0x10ffff));
+    if (o) return String.fromCharCode(Number.parseInt(o, 8) & 0xff);
+    if (c) return String.fromCharCode(c.charCodeAt(0) & 0x1f);
+    return ANSI[ch] ?? ch;
+  });
+}
+
+/**
+ * Index after the closer of a group opened before `j`, skipping quotes; -1 if unterminated.
+ * With `noSingle` a `'` returns -1: zsh reads it literally inside a double-quoted `${...}`.
+ */
+function closeGroup(s, j, open, close, noSingle = false) {
+  let depth = 1;
+  while (j < s.length) {
+    const c = s[j];
+    if (c === "\\") j += 2;
+    else if (c === "'" && noSingle) return -1;
+    else if (c === "$" && s[j + 1] === "'") {
+      j = ansiEnd(s, j + 1);
+      if (j < 0) return -1;
+    } else if (c === "'" || c === '"' || c === "`") {
+      j = quoteEnd(s, j);
+      if (j < 0) return -1;
+    } else {
+      if (c === open) depth++;
+      else if (c === close && --depth === 0) return j + 1;
+      j++;
+    }
+  }
+  return -1;
+}
+
+/**
+ * End of a substitution at `i` (`$(`, `${`, backtick; `<(`/`>(` outside double quotes).
+ * @returns {number} `i` when none starts here, the index after it, or -1 when unterminated.
+ */
+function substitutionEnd(s, i, inDouble) {
+  const c = s[i];
+  const n = s[i + 1];
+  if (c === "`") return quoteEnd(s, i);
+  if (n === "(" && (c === "$" || (!inDouble && (c === "<" || c === ">")))) return closeGroup(s, i + 2, "(", ")");
+  if (c === "$" && n === "{") return closeGroup(s, i + 2, "{", "}", inDouble);
+  return i;
+}
+
+/**
+ * Splits a Bash command into simple commands of unquoted words. Separators are `;`, `&&`,
+ * `||`, `|`, `&`, newlines and grouping parentheses; redirect operators are words of their
+ * own; substitutions stay verbatim inside their word; a heredoc's operand word is its body;
+ * `$'...'` is decoded and `$"..."` read as a double-quoted string; `$name` becomes `${name}`
+ * (except in a heredoc delimiter), so a quote or escape after a name still ends it. Each
+ * command's place is recorded in PLACES; a `)` inside a `case` never closes a subshell there,
+ * and a case pattern without an expansion is dropped, keeping `case <subject>` as a command.
+ * @param {string} command The command.
+ * @returns {string[][] | null} Simple commands, or null on an unterminated quote, group or case
+ *   pattern, a parenthesis after a word, or a `'` inside a double-quoted `${...}`.
+ */
+export function splitCommands(command) {
+  const s = String(command);
+  const cmds = [];
+  let words = [];
+  let word = "";
+  let inWord = false;
+  let quoted = false;
+  let pendingDoc = null;
+  const docs = [];
+  const shells = [];
+  let opened = 0;
+  let cases = 0;
+  // Index in `words` of an opening `case` word and of a case pattern's first word; -1 for none.
+  let opening = -1;
+  let arm = -1;
+  let piped = false;
+  let joint = "";
+  let groups = 0;
+  let list = 0;
+  let spans = [];
+  // 1 after a `function` keyword, 2 once its name is dropped (an optional `()` may follow).
+  let fn = 0;
+  const literal = (text) => {
+    if (/[$`]/.test(text)) spans.push([word.length, word.length + text.length]);
+    word += text;
+  };
+  const dropWord = () => {
+    word = "";
+    spans = [];
+    inWord = quoted = false;
+  };
+  const endWord = () => {
+    if (!inWord) return;
+    // A definition header is no command: dropping it leaves the body to split like any group.
+    if (fn === 1 && !pendingDoc) {
+      fn = 2;
+      return dropWord();
+    }
+    fn = 0;
+    if (!quoted && !pendingDoc && word === "function" && words.every((w) => KEYWORDS.has(w))) {
+      fn = 1;
+      return dropWord();
+    }
+    if (pendingDoc) docs.push({ ...pendingDoc, delim: word, quoted, words, index: words.length });
+    pendingDoc = null;
+    const lead = !quoted && words.every((w) => KEYWORDS.has(w));
+    if (lead && arm < 0 && word === "case") {
+      cases++;
+      opening = words.length;
+    }
+    if (lead && word === "esac") {
+      cases = Math.max(0, cases - 1);
+      arm = -1;
+    }
+    if (!quoted && word === "in" && opening >= 0 && words.length === opening + 2) arm = words.length + 1;
+    if (!quoted && words.every((w) => KEYWORDS.has(w))) groups = Math.max(0, groups + (OPENERS.has(word) ? 1 : CLOSERS.has(word) ? -1 : 0));
+    const expanding = (word.match(/[$`]/g)?.length ?? 0) - spans.reduce((n, [a, b]) => n + word.slice(a, b).match(/[$`]/g).length, 0);
+    if (expanding > 0) EXPANDING.add(word);
+    if (spans.length > 0) {
+      if (!LITERALS.has(words)) LITERALS.set(words, new Map());
+      LITERALS.get(words).set(words.length, spans);
+      LITERAL_WORDS.add(word);
+      if (expanding === 0) LITERAL_ONLY.add(word);
+    }
+    words.push(word);
+    word = "";
+    spans = [];
+    inWord = quoted = false;
+  };
+  // `ends` is false where a parenthesis, not a separator, ends the command.
+  const endCommand = (sep = ";", ends = true) => {
+    endWord();
+    if (words.length > 0) {
+      cmds.push(words);
+      PLACES.set(words, { isolated: piped || sep === "|" || sep === "&", piped, joint, next: sep, shells: [...shells] });
+      piped = false;
+      joint = "";
+    }
+    if (sep === "&&" || sep === "||") joint = sep;
+    if (sep === "|") piped = true;
+    // `&` sends the whole and-or list to the background, with every group it closes.
+    if (sep === "&") for (const c of cmds.slice(list)) PLACES.get(c).late = true;
+    if (sep === "&" || (ends && sep === ";" && !joint && !piped && shells.length === 0 && groups === 0)) list = cmds.length;
+    words = [];
+    opening = -1;
+    if (arm > 0) arm = 0;
+  };
+  const readDocs = (pos) => {
+    for (const d of docs.splice(0)) {
+      let body = "";
+      while (pos < s.length) {
+        const nl = s.indexOf("\n", pos);
+        const line = s.slice(pos, nl < 0 ? s.length : nl);
+        pos = nl < 0 ? s.length : nl + 1;
+        if ((d.strip ? line.replace(/^\t+/, "") : line) === d.delim) break;
+        body += `${line}\n`;
+      }
+      d.words[d.index] = body;
+      LITERALS.get(d.words)?.delete(d.index);
+      if (d.quoted) QUOTED_DOCS.set(d.words, new Set([...(QUOTED_DOCS.get(d.words) ?? []), d.index]));
+    }
+    return pos;
+  };
+  let parens = null;
+  // Whether a `(` here opens the `()` of a definition: a plain name after keywords only, or a `function` name.
+  const funcHead = (open) => {
+    if (fn === 2) return true;
+    const name = open ? (quoted ? "" : word) : (words.at(-1) ?? "");
+    return FUNC_NAME.test(name) && !KEYWORDS.has(name) && (open ? words : words.slice(0, -1)).every((w) => KEYWORDS.has(w));
+  };
+  let i = 0;
+  while (i < s.length) {
+    tick();
+    const c = s[i];
+    if (c === "\\") {
+      if (s[i + 1] !== "\n" && i + 1 < s.length) {
+        literal(s[i + 1]);
+        inWord = quoted = true;
+      }
+      i += 2;
+    } else if (c === "'") {
+      const end = quoteEnd(s, i);
+      if (end < 0) return null;
+      literal(s.slice(i + 1, end - 1));
+      inWord = quoted = true;
+      i = end;
+    } else if (c === '"') {
+      let j = i + 1;
+      inWord = quoted = true;
+      while (s[j] !== '"') {
+        if (j >= s.length) return null;
+        const sub = substitutionEnd(s, j, true);
+        if (sub < 0) return null;
+        if (sub > j) {
+          word += s.slice(j, sub);
+          j = sub;
+        } else if (s[j] === "\\" && '$`"\\\n'.includes(s[j + 1])) {
+          if (s[j + 1] !== "\n") literal(s[j + 1]);
+          j += 2;
+        } else if (s[j] === "$" && !pendingDoc && nameAt(s, j + 1) > 0) {
+          const end = j + 1 + nameAt(s, j + 1);
+          word += `\${${s.slice(j + 1, end)}}`;
+          j = end;
+        } else word += s[j++];
+      }
+      i = j + 1;
+    } else {
+      const sub = substitutionEnd(s, i, false);
+      if (sub < 0) return null;
+      if (sub > i) {
+        word += s.slice(i, sub);
+        inWord = true;
+        i = sub;
+      } else if (c === "$" && s[i + 1] === "'") {
+        const end = ansiEnd(s, i + 1);
+        if (end < 0) return null;
+        literal(decodeAnsi(s.slice(i + 2, end - 1)));
+        inWord = quoted = true;
+        i = end;
+      } else if (c === "$" && s[i + 1] === '"') {
+        i++;
+      } else if (c === "$" && !pendingDoc && nameAt(s, i + 1) > 0) {
+        const end = i + 1 + nameAt(s, i + 1);
+        word += `\${${s.slice(i + 1, end)}}`;
+        inWord = true;
+        i = end;
+      } else if (c === "#" && !inWord) {
+        while (i < s.length && s[i] !== "\n") i++;
+      } else if (c === " " || c === "\t" || c === "\r") {
+        endWord();
+        i++;
+      } else if (c === "\n") {
+        endCommand();
+        i = readDocs(i + 1);
+      } else if (arm >= 0 && ((c === "(" && !inWord && words.length === arm) || (c === "|" && s[i + 1] !== "|"))) {
+        // A pattern's optional `(` and its `|` alternatives stay inside the pattern.
+        endWord();
+        i++;
+      } else if (c === "(" && funcHead(inWord) && (parens = FUNC_PARENS.exec(s.slice(i, i + 256))) !== null) {
+        if (fn !== 2 && !inWord) words.pop();
+        dropWord();
+        fn = 0;
+        i += parens[0].length;
+      } else if (c === "(" && (inWord || words.some((w) => !KEYWORDS.has(w) && w !== "time"))) {
+        // A zsh glob (`*.(js|ts)`, `rm (a|b)`) or an array value stays inside its word.
+        const end = closeGroup(s, i + 1, "(", ")");
+        if (end < 0) return null;
+        word += s.slice(i, end);
+        inWord = true;
+        i = end;
+      } else if (c === ";" || c === "(" || c === ")") {
+        // A case pattern is no command; one holding an expansion stays, since its substitution runs.
+        if (c === ")" && arm >= 0) {
+          endWord();
+          if (words.slice(arm).every((w) => !/[$`]/.test(w))) words.splice(arm);
+          arm = -1;
+        }
+        endCommand(";", c === ";");
+        if (c === "(") shells.push(++opened);
+        else if (c === ")" && cases === 0) shells.pop();
+        if (c === ";" && s[i + 1] === ";" && cases > 0) arm = 0;
+        i++;
+      } else if (c === "|" || (c === "&" && s[i + 1] !== ">")) {
+        const two = s.slice(i, i + 2);
+        endCommand(two === "&&" || two === "||" ? two : c === "|" ? "|" : "&");
+        i += s[i + 1] === "|" || s[i + 1] === "&" ? 2 : 1;
+      } else if (c === "&" || c === ">" || c === "<") {
+        const op = (c === "&" ? AMP_OPS : OPS).find((o) => s.startsWith(o, i));
+        const fd = inWord && !quoted && /^\d+$/.test(word) && c !== "&" ? word : "";
+        if (fd) inWord = false;
+        else endWord();
+        word = "";
+        spans = [];
+        (OP_WORDS.get(words) ?? OP_WORDS.set(words, new Set()).get(words)).add(words.length);
+        words.push(fd + op);
+        if (op === "<<" || op === "<<-") pendingDoc = { strip: op === "<<-" };
+        i += op.length;
+      } else {
+        word += c;
+        inWord = true;
+        i++;
+      }
+    }
+  }
+  endCommand();
+  if (pendingDoc || arm >= 0) return null;
+  readDocs(s.length);
+  return cmds;
+}
+
+/** Commands nested in a word: `$(...)`, `<(...)`, `>(...)` and backtick bodies; with `arith`, those of a `$((...))` naming no git. */
+function substitutions(word, arith = false) {
+  const found = [];
+  for (let i = 0; i < word.length; i++) {
+    if (word[i] === "$" && word[i + 1] === "{") continue;
+    const end = substitutionEnd(word, i, false);
+    if (end > i) {
+      const body = word.slice(word[i] === "`" ? i + 1 : i + 2, end - 1);
+      const math = arith && word[i] === "$" && /^\([\s\S]*\)$/.test(body) ? body.slice(1, -1) : null;
+      found.push(...(math === null || GIT_WORD.test(math) ? [body] : substitutions(math, true)));
+      i = end - 1;
+    }
+  }
+  return found;
+}
+
+/**
+ * `text`, each of its words that expands there no longer marked literal: the marks are kept per
+ * word text, so a quoted spelling of the same word on the outer line would hide the expansion.
+ */
+function unmark(text) {
+  for (const words of /[$`]/.test(text) ? (splitCommands(text) ?? []) : []) {
+    for (const [i, w] of words.entries()) {
+      if (!/[$`]/.test(w) || LITERALS.get(words)?.has(i)) continue;
+      LITERAL_WORDS.delete(w);
+      LITERAL_ONLY.delete(w);
+    }
+  }
+  return text;
+}
+
+/**
+ * Code with each string and regex literal reduced to a stand-in, the code of every f-string or
+ * template field appended, so a name test sees all code and no literal text.
+ */
+function maskLiterals(code, toks) {
+  let masked = "";
+  let from = 0;
+  const fields = [];
+  for (const x of toks.filter((y) => y.t === "s" || y.t === "r")) {
+    masked += `${code.slice(from, x.s)}${x.t === "s" ? "'x'" : "0"}`;
+    from = x.e;
+    for (const [s, e] of x.fields ?? []) fields.push(code.slice(s, e));
+  }
+  return [masked + code.slice(from), ...fields].join("\n");
+}
+
+const SED_FLAGS = /[gpiImMe0-9]*/y;
+
+/** File names a sed script writes with `w`/`W` or `s///w`; null when it executes or parses unclearly, `files` keeping those before it. */
+function sedWrites(s, files = []) {
+  let i = 0;
+  const eol = () => (s.indexOf("\n", i) < 0 ? s.length : s.indexOf("\n", i));
+  const blank = () => {
+    while (s[i] === " " || s[i] === "\t") i++;
+  };
+  const part = (d, regex) => {
+    const end = regex ? regexEnd(s, i, d) : partEnd(s, i, d, false);
+    i = end;
+    return end >= 0;
+  };
+  const address = () => {
+    if (/\d/.test(s[i] ?? "")) while (/[\d~]/.test(s[i] ?? "")) i++;
+    else if (s[i] === "$") i++;
+    else if (s[i] === "/" || s[i] === "\\") {
+      const d = s[i] === "\\" ? s[++i] : "/";
+      i++;
+      if (!d || d === "\n" || !part(d, true)) return null;
+      while (s[i] === "I" || s[i] === "M") i++;
+    } else return false;
+    return true;
+  };
+  while (i < s.length) {
+    if (/[\s;}]/.test(s[i])) {
+      i++;
+      continue;
+    }
+    if (s[i] === "#") {
+      i = eol();
+      continue;
+    }
+    const first = address();
+    if (first === null) return null;
+    blank();
+    if (first && s[i] === ",") {
+      i++;
+      blank();
+      if (s[i] === "+" || s[i] === "~") for (i++; /\d/.test(s[i] ?? ""); ) i++;
+      else if (address() !== true) return null;
+    }
+    blank();
+    while (s[i] === "!") {
+      i++;
+      blank();
+    }
+    const cmd = s[i++] ?? "";
+    if (cmd === "") return null;
+    if (cmd === "{" || "=dDgGhHnNpPxzF".includes(cmd)) continue;
+    if ("lLqQ".includes(cmd)) {
+      blank();
+      while (/\d/.test(s[i] ?? "")) i++;
+    } else if ("btT:v".includes(cmd)) {
+      blank();
+      while (i < s.length && !/[\s;]/.test(s[i])) i++;
+      blank();
+      if (i < s.length && !/[;\n}#]/.test(s[i])) return null;
+    } else if (cmd === "r" || cmd === "R") i = eol();
+    else if ("aic".includes(cmd)) {
+      for (i = eol(); i < s.length; i = eol()) {
+        let k = i;
+        while (s[k - 1] === "\\") k--;
+        if ((i - k) % 2 === 0) break;
+        i++;
+      }
+    } else if (cmd === "w" || cmd === "W") {
+      files.push(s.slice(i, eol()).trim());
+      i = eol();
+    } else if (cmd === "s" || cmd === "y") {
+      const d = s[i++];
+      if (!d || d === "\n" || d === "\\" || !part(d, cmd === "s") || !part(d, false)) return null;
+      if (cmd === "y") continue;
+      SED_FLAGS.lastIndex = i;
+      const flags = SED_FLAGS.exec(s)?.[0] ?? "";
+      i += flags.length;
+      if (flags.includes("e")) return null;
+      if (s[i] === "w") {
+        files.push(s.slice(i + 1, eol()).trim());
+        i = eol();
+      }
+    } else return null;
+  }
+  return files;
+}
+
+/** Index past the part of `s` from `i` that an unescaped `d` ends on the same line, or -1. */
+function partEnd(s, i, d, brackets) {
+  for (let j = i; j < s.length && s[j] !== "\n"; j++) {
+    if (s[j] === "\\") j++;
+    else if (s[j] === d) return j + 1;
+    else if (brackets && s[j] === "[") {
+      j = bracketEnd(s, j) - 1;
+      if (j < 0) return -1;
+    }
+  }
+  return -1;
+}
+
+/** `partEnd` of a regex, or -1 where a tool that skips bracket expressions would end it elsewhere. */
+function regexEnd(s, i, d) {
+  const end = partEnd(s, i, d, false);
+  return end >= 0 && (d === "[" || end === partEnd(s, i, d, true)) ? end : -1;
+}
+
+/** Index past the bracket expression opening at `j`, or 0 when it does not close on its line. */
+function bracketEnd(s, j) {
+  let k = j + 1;
+  if (s[k] === "^") k++;
+  if (s[k] === "]") k++;
+  for (; k < s.length && s[k] !== "\n"; k++) {
+    if (s[k] === "]") return k + 1;
+    if (s[k] === "[" && ".:=".includes(s[k + 1] || "\n")) {
+      const close = s.indexOf(`${s[k + 1]}]`, k + 2);
+      if (close < 0) return 0;
+      k = close + 1;
+    }
+  }
+  return 0;
+}
+
+/** awk words after which a `/` opens a regex rather than divides. */
+const AWK_STATEMENT = new Set(["print", "printf", "return", "case", "else", "do", "in"]);
+
+/** Whether awk code has no print redirect, pipe, `system`, `@` or shell expansion, all literals closed. */
+function awkPlain(code) {
+  if (/\$[{(@*]|`/.test(code)) return false;
+  const conds = [];
+  const token = /[A-Za-z_]\w*|[\d.]+/y;
+  let depth = 0;
+  let print = -1;
+  let operand = false;
+  let cond = false;
+  for (let i = 0; i < code.length; ) {
+    const c = code[i];
+    token.lastIndex = i;
+    const w = token.exec(code)?.[0];
+    if (w !== undefined) {
+      if (w === "system") return false;
+      if (w === "print" || w === "printf") print = depth;
+      cond = /^(?:if|while|for)$/.test(w);
+      operand = !AWK_STATEMENT.has(w) && !cond;
+      i += w.length;
+      continue;
+    }
+    if (c === '"' || (c === "/" && !operand)) {
+      i = c === '"' ? partEnd(code, i + 1, c, false) : regexEnd(code, i + 1, c);
+      if (i < 0) return false;
+      operand = true;
+      continue;
+    }
+    if (c === "|" && code[i + 1] !== "|") return false;
+    if (c === "@" || (c === ">" && print >= 0 && depth <= print) || (c === "\\" && code[i + 1] !== "\n")) return false;
+    if (c === "#") {
+      while (i < code.length && code[i] !== "\n") i++;
+      continue;
+    }
+    if (c === "(") {
+      if (cond) conds.push(depth);
+      depth++;
+    } else if (c === ")") {
+      if (--depth < 0) return false;
+      operand = conds.at(-1) !== depth;
+      if (!operand) conds.pop();
+    } else if (c === "{" || c === "}" || c === ";") print = -1;
+    if ((c === "+" || c === "-") && code[i + 1] === c) i += 2;
+    else {
+      if (c === "]") operand = true;
+      else if (!/[ \t)\\]/.test(c)) operand = false;
+      cond &&= c === " " || c === "\t";
+      i += c === "|" || c === "\\" ? 2 : 1;
+    }
+  }
+  return true;
+}
+
+/**
+ * Protected paths a Bash command writes through a literal writer, judged per simple command.
+ * Input past MAX_CHARS is not judged: the guard is a second layer, so it allows.
+ * @param {string} command The command.
+ * @param {Env} [env] Defaults to the process's home, cwd and temp roots.
+ * @returns {string[]} Distinct protected targets as written; empty when it only reads or
+ *   mentions them, or is too long to judge.
+ */
+export function judgeBash(command, env = defaultEnv()) {
+  const text = String(command);
+  if (text.length > MAX_CHARS) return [];
+  for (const words of [LITERAL_WORDS, LITERAL_ONLY, EXPANDING]) words.clear();
+  const ctx = { env, dir: { cwds: [env.cwd], unresolved: false, stack: [] }, alt: null, dots: DOTGLOB.test(text), depth: 0 };
+  return [...new Set(judgeLine(text, ctx))];
+}
+
+/**
+ * Protected targets the simple commands of `text` write. A subshell, a pipeline stage and a
+ * substitution run in a child shell, so a `cd` there never moves the cwd of later commands.
+ */
+function judgeLine(text, ctx) {
+  const cmds = ctx.depth <= MAX_DEPTH ? splitCommands(text) : null;
+  const out = [];
+  const saved = [];
+  for (const words of cmds ?? []) {
+    tick();
+    const place = PLACES.get(words);
+    while (saved.length > 0 && !place.shells.includes(saved[saved.length - 1].id)) ctx.dir = saved.pop().dir;
+    // A cd that a failed `&&` chain may have skipped leaves both cwds to the commands after the chain.
+    if (ctx.alt && place.joint !== "&&") [ctx.dir, ctx.alt] = [mergeDirs(ctx.dir, ctx.alt, false), null];
+    for (const id of place.shells) if (!saved.some((s) => s.id === id)) saved.push({ id, dir: ctx.dir });
+    out.push(...judgeWords(words, place, ctx));
+  }
+  return out;
+}
+
+/** Whether a word holds an expansion the guard does not resolve: its value is unknown, so it allows. */
+const unknown = (w) => w === undefined || EXPANDING.has(w);
+
+/** Protected targets one simple command writes through a literal writer (see the header). */
+function judgeWords(words, place, ctx) {
+  const ops = OP_WORDS.get(words) ?? new Set();
+  const out = [];
+  const args = [];
+  const live = (w) => !unknown(w) && operandLive(w, ctx);
+  for (let i = 0; i < words.length; i++) {
+    const w = words[i];
+    if (ops.has(i)) {
+      const op = REDIRECT.exec(w)?.[1];
+      const target = words[++i];
+      // A heredoc body and a here-string are data; `>&2` and `>&-` duplicate or close a descriptor.
+      if (OUTPUT_OPS.has(op) && !(/&/.test(op) && /^(?:\d+|-)$/.test(target ?? "")) && live(target)) out.push(target);
+      continue;
+    }
+    for (const body of substitutions(literalBlanked(words, i))) out.push(...judgeLine(body, { ...ctx, depth: ctx.depth + 1 }));
+    args.push(w);
+  }
+  let k = 0;
+  while (k < args.length && (ASSIGN.test(args[k]) || KEYWORDS.has(args[k]))) k++;
+  if (k >= args.length || unknown(args[k])) return out;
+  const name = path.posix.basename(args[k]);
+  const rest = args.slice(k + 1);
+  if (MOVERS.has(name)) {
+    const maybe = place.joint === "||" || place.next === "||" || args.slice(0, k).some((w) => KEYWORDS.has(w) && w !== "{" && w !== "!");
+    if (!place.isolated) moveCwd(name, rest, place, maybe, ctx);
+    return out;
+  }
+  const writes = (operands) => operands.filter(live);
+  if (name === "tee" || name === "rm" || name === "touch") out.push(...writes(plainOperands(rest, name === "touch" ? /^-[rtd]$/ : null)));
+  else if (name === "sed") out.push(...writes(sedInPlace(rest)));
+  else if (name === "cp" || name === "install" || name === "mv") out.push(...copyTargets(name, rest, live, ctx));
+  else if (SHELLS.test(name)) {
+    const code = inlineCode(rest, /^-[a-zA-Z]*c$/, /^[-+][oO]$|^--(?:rcfile|init-file)$/);
+    if (code !== null && !unknown(code)) out.push(...judgeLine(code, { ...ctx, depth: ctx.depth + 1 }));
+  } else {
+    if (name === "perl") out.push(...writes(perlInPlace(rest)));
+    const lang = /^python[\d.]*$/.test(name) ? "python" : /^(?:node|perl|ruby)$/.test(name) ? name : null;
+    const code = lang === null ? null : interpreterCode(lang, rest);
+    if (code !== null && !unknown(code)) out.push(...codeTargets(code, lang, ctx));
+  }
+  return out;
+}
+
+/** Word `i` of `words` with its quoted `$` and backtick text blanked, so only a substitution that runs is found. */
+function literalBlanked(words, i) {
+  return (LITERALS.get(words)?.get(i) ?? []).reduce((t, [a, b]) => t.slice(0, a) + " ".repeat(b - a) + t.slice(b), words[i]);
+}
+
+/** Operands past the options (`--` ends them); `valued` options take the next word. */
+function plainOperands(args, valued = null) {
+  const out = [];
+  let ended = false;
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (!ended && a === "--") ended = true;
+    else if (!ended && /^-./.test(a)) j += valued?.test(a) ? 1 : 0;
+    else out.push(a);
+  }
+  return out;
+}
+
+/**
+ * The file operands of a `perl -i` (`-pi`, `-i.bak`); none without one. The rest of a bundle after
+ * `i` is the backup suffix; the script is the first operand unless -e or -E gives it.
+ */
+function perlInPlace(args) {
+  let inPlace = false;
+  let script = false;
+  const files = [];
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--") {
+      files.push(...args.slice(j + 1 + (script ? 0 : 1)));
+      break;
+    }
+    if (/^-[^-]/.test(a)) {
+      for (let p = 1; p < a.length; p++) {
+        const c = a[p];
+        if (c === "i") {
+          inPlace = true;
+          break;
+        }
+        if ("eEIMm".includes(c)) {
+          script ||= c === "e" || c === "E";
+          if (p === a.length - 1) j++;
+          break;
+        }
+      }
+    } else if (!script) script = true;
+    else files.push(a);
+  }
+  return inPlace ? files : [];
+}
+
+/** The file operands of a `sed -i` or `sed --in-place`; none without one. The script is the first operand unless -e or -f gives it. */
+function sedInPlace(args) {
+  let inPlace = false;
+  let script = false;
+  const files = [];
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--") {
+      files.push(...args.slice(j + 1 + (script ? 0 : 1)));
+      break;
+    }
+    if (/^--in-place(?:=|$)/.test(a)) inPlace = true;
+    else if (/^--(?:expression|file)=/.test(a)) script = true;
+    else if (/^--(?:expression|file|line-length)$/.test(a)) {
+      script ||= a !== "--line-length";
+      j++;
+    } else if (/^-[^-]/.test(a)) {
+      for (let p = 1; p < a.length; p++) {
+        const c = a[p];
+        if (c === "i") {
+          inPlace = true;
+          // BSD sed takes the backup suffix as the next word: `-i ''`, `-i .bak`.
+          if (a.length === 2 && /^(?:|\.[\w-]+)$/.test(args[j + 1] ?? "x")) j++;
+          break;
+        }
+        if ("efl".includes(c)) {
+          script ||= c !== "l";
+          if (p === a.length - 1) j++;
+          break;
+        }
+      }
+    } else if (!script) script = true;
+    else files.push(a);
+  }
+  return inPlace ? files : [];
+}
+
+/**
+ * The paths a cp, install or mv writes: the destination (`-t` directory or last operand), and for
+ * mv every source too. A destination that is a directory receives each source by its base name;
+ * `install -d` creates every operand.
+ */
+function copyTargets(name, args, live, ctx) {
+  const valued = name === "install" ? /^-[BfghlMmNoSt]$|^--(?:suffix|mode|owner|group|strip-program|target-directory)$/ : /^-[St]$|^--(?:suffix|target-directory)$/;
+  let dir = null;
+  let noDir = false;
+  let dirs = false;
+  const ops = [];
+  let ended = false;
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    if (!ended && a === "--") ended = true;
+    else if (!ended && /^-./.test(a)) {
+      const t = /^--target-directory(?:=(.*))?$/.exec(a) ?? /^-[A-Za-z]*?t(.*)$/.exec(a);
+      if (t) dir = t[1] || (args[++j] ?? null);
+      else if (valued.test(a)) j++;
+      if (/^-[A-Za-z]*T|^--no-target-directory$/.test(a)) noDir = true;
+      if (name === "install" && /^-[A-Za-z]*d|^--directory$/.test(a)) dirs = true;
+    } else ops.push(a);
+  }
+  if (dirs) return ops.filter(live);
+  if (dir === null && ops.length < 2) return name === "mv" ? ops.filter(live) : [];
+  const sources = dir === null ? ops.slice(0, -1) : ops;
+  const dest = dir ?? ops[ops.length - 1];
+  const moved = name === "mv" ? sources.filter(live) : [];
+  if (unknown(dest)) return moved;
+  if (live(dest)) return [...moved, dest];
+  const into = dir !== null || (!noDir && (dest.endsWith("/") || isDir(dest, ctx)));
+  const landed = into ? sources.filter((s) => !unknown(s)).map((s) => `${dest.replace(/\/+$/, "")}/${path.posix.basename(s.replace(/\/+$/, ""))}`) : [];
+  return [...moved, ...landed.filter(live)];
+}
+
+/** Whether a literal path is a directory from some candidate cwd. */
+function isDir(p, ctx) {
+  const abs = expandTilde(p, ctx.env.home);
+  if (abs === null) return false;
+  return (abs.startsWith("/") ? [ctx.env.cwd] : ctx.dir.cwds).some((cwd) => {
+    try {
+      return fs.statSync(path.resolve(cwd, abs)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+
+/** The word after the first option matching `flag` (a cluster ending in it), or null; `valued` options take the next word, an operand ends the scan. */
+function inlineCode(args, flag, valued) {
+  for (let j = 0; j < args.length && /^[-+]/.test(args[j]) && args[j] !== "--"; j++) {
+    if (flag.test(args[j])) return args[j + 1] ?? null;
+    if (valued.test(args[j])) j++;
+  }
+  return null;
+}
+
+/** Inline code of a python `-c`, node `-e`/`-p`/`--eval`/`--print`, or perl and ruby `-e`; null for a script, a module or stdin. */
+function interpreterCode(lang, args) {
+  for (let j = 0; j < args.length; j++) {
+    const a = args[j];
+    let m;
+    if (a === "--" || a === "-" || !a.startsWith("-")) return null;
+    if (lang === "python") {
+      if (/^-[WX]$/.test(a)) j++;
+      else if ((m = /^-[A-Za-z]*?([cm])(.*)$/.exec(a))) return m[1] === "m" ? null : m[2] || (args[j + 1] ?? null);
+    } else if (lang === "node") {
+      if ((m = /^(?:-[pe]{1,2}|--eval|--print)(?:=(.*))?$/.exec(a))) return m[1] ?? args[j + 1] ?? null;
+      if (/^(?:-r|--require|--import|--loader|--experimental-loader|-C|--conditions)$/.test(a)) j++;
+    } else if ((m = /^-[A-Za-z]*?[eE](.*)$/.exec(a))) return m[1] || (args[j + 1] ?? null);
+    else if (/^-[A-Za-z]*[IMmx]$/.test(a)) j++;
+  }
+  return null;
+}
+
+/** Callees that write, move or remove every path argument they get, by method name alone. */
+const CODE_WRITE = /^(?:writeFile|writeFileSync|appendFile|appendFileSync|unlinkSync|rmSync|rmdirSync|renameSync|mkdirSync|truncateSync|chmodSync|createWriteStream|outputFile|outputFileSync|write_text|write_bytes|rmtree|removedirs|makedirs|unlink|copyFileSync|cpSync|symlinkSync|linkSync)$/;
+/** Method names that write only on a file-system module (`os.remove`, not `list.remove`). */
+const MODULE_WRITE = /^(?:remove|rename|replace|rmdir|mkdir|truncate|chmod|chown|utime|move|rm|delete|write|mv|touch|copy|copy2|copyfile|copytree|copyFile|cp|symlink|link|ln|ln_s)$/;
+const FS_MODULE = /^(?:os|shutil|fs|fsp|promises|FileUtils|File|Dir|pathlib)$/;
+/** Copy and link calls write their second argument only: the first is read or pointed at. */
+const CODE_COPY = /^(?:copy|copy2|copyfile|copytree|copyFile|copyFileSync|cp|cpSync|symlink|symlinkSync|link|linkSync|ln|ln_s)$/;
+/** Methods that write the path object they are called on. */
+const RECEIVER_WRITE = /^(?:write_text|write_bytes|unlink|rename|replace|touch|symlink_to|hardlink_to|rmdir|mkdir|chmod)$/;
+const PATH_CALL = /^(?:(?:pathlib\.)?(?:Path|PosixPath|PurePath)|path\.resolve|os\.path\.(?:abspath|expanduser|realpath))$/;
+/** A file-open flag that writes: a literal mode, or os.open flags. */
+const WRITE_MODE = /[wax+]|O_(?:WRONLY|RDWR|CREAT|APPEND|TRUNC)/;
+const PERL_WRITERS = /\b(?:unlink|rename|link|symlink|truncate|chmod|chown|rmdir|mkdir|utime)\b/;
+
+/**
+ * Protected paths inline interpreter code writes: a path literal, directly or through a name the
+ * code binds it to, passed to an open with a write or non-literal mode or to a module write, move,
+ * copy, link or remove call. A read, a mention in data and a path the code takes from argv pass.
+ */
+function codeTargets(code, lang, ctx) {
+  const { strings, calls } = codeShape(code);
+  const out = [];
+  for (const s of strings) {
+    tick();
+    let value = s.value;
+    let perlWrite = false;
+    if (lang === "perl") {
+      const m = /^\s*(\+?>{1,2}|\+<)\s*(.*)$/.exec(value);
+      if (m) [perlWrite, value] = [true, m[2]];
+    }
+    if (!/^[^\s'"`]{1,4096}$/.test(value) || hasGlob(value) || !pathLive(value, ctx)) continue;
+    if (lang === "perl") {
+      const stmt = code.slice(Math.max(code.lastIndexOf(";", s.start), code.lastIndexOf("{", s.start)) + 1, s.start);
+      if (perlWrite || PERL_WRITERS.test(stmt) || /['"]\+?>{1,2}['"]\s*,\s*$/.test(stmt)) out.push(value);
+      continue;
+    }
+    // A call such as Path('x') stands for its path: what receives the call is judged.
+    let span = { start: s.start, end: s.end };
+    const wrap = innermost(calls, span.start);
+    if (wrap && PATH_CALL.test(wrap.callee)) span = { start: wrap.start, end: wrap.close + 1 };
+    const sites = [span];
+    const bound = /(?:^|[^\w$.=!<>])(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*$/.exec(code.slice(Math.max(0, span.start - 128), span.start));
+    if (bound) {
+      for (const m of code.matchAll(new RegExp(String.raw`(?<![\w$.])${bound[1].replace(/\$/g, "\\$")}(?![\w$])(?!\s*=[^=])`, "g"))) sites.push({ start: m.index, end: m.index + m[0].length });
+    }
+    if (sites.some((site) => writtenAt(code, calls, site))) out.push(s.value);
+  }
+  return out;
+}
+
+/** Whether the value at `site` is written: a write-call argument, an open with a write mode, or the receiver of a write method. */
+function writtenAt(code, calls, site) {
+  const method = /^\s*\.\s*([A-Za-z_]\w*)\s*\(/.exec(code.slice(site.end, site.end + 64));
+  if (method && RECEIVER_WRITE.test(method[1])) return true;
+  if (method?.[1] === "open") {
+    const call = calls.find((c) => c.open === site.end + method[0].length - 1);
+    return call !== undefined && writeMode(code, call, 0);
+  }
+  const call = innermost(calls, site.start);
+  if (!call) return false;
+  const arg = call.commas.filter((c) => c < site.start).length;
+  const parts = call.callee.split(".");
+  const last = parts[parts.length - 1];
+  const receiver = parts[parts.length - 2] ?? "";
+  if (/^(?:open|openSync|fopen|sysopen)$/.test(last) && (parts.length === 1 || /^(?:io|codecs|os|fs|File|builtins|promises)$/.test(receiver))) return arg === 0 && writeMode(code, call, 1);
+  // A node read call opens for write under a write flag option.
+  if (/^(?:readFileSync|readFile|createReadStream)$/.test(last)) return arg === 0 && writeMode(code, call, -1);
+  const writer = CODE_WRITE.test(last) || (MODULE_WRITE.test(last) && FS_MODULE.test(receiver));
+  return writer && (!CODE_COPY.test(last) || arg >= 1);
+}
+
+/** Whether an open call's mode (argument `index`, `mode=`, or a `flag:` option) writes; no mode reads, a non-literal one may write. */
+function writeMode(code, call, index) {
+  const ends = [call.open, ...call.commas, call.close];
+  const args = ends.slice(0, -1).map((a, k) => code.slice(a + 1, ends[k + 1]).trim());
+  const named = args.map((a) => /^(?:mode|flags?)\s*[=:]\s*([\s\S]+)$/.exec(a)?.[1]).find((v) => v !== undefined);
+  const option = args.map((a) => /\bflags?\s*:\s*([^,}]+)/.exec(a)?.[1]).find((v) => v !== undefined);
+  const mode = (named ?? (args[index] && !/^\w+\s*=/.test(args[index]) ? args[index] : option))?.trim();
+  if (mode === undefined || mode === "") return false;
+  const lit = /^[rbuf]*(['"])([^'"]*)\1$/.exec(mode);
+  if (lit) return WRITE_MODE.test(lit[2]);
+  if (/^\{/.test(mode)) return option !== undefined && writeModeText(option);
+  return /^\d+$/.test(mode) ? mode !== "0" : !/^(?:os\.)?O_RDONLY$/.test(mode);
+}
+
+/** Whether an option value text names a writing flag. */
+function writeModeText(text) {
+  const lit = /^\s*(['"])([^'"]*)\1\s*$/.exec(text);
+  return lit ? WRITE_MODE.test(lit[2]) : true;
+}
+
+/** The innermost call whose parentheses hold `at`, or null. */
+function innermost(calls, at) {
+  let best = null;
+  for (const c of calls) if (c.open < at && at < c.close && (best === null || c.open > best.open)) best = c;
+  return best;
+}
+
+/**
+ * String literals of interpreter code (start, end and value) and its calls: the callee's dotted
+ * name, where the callee starts, the open and close parentheses and the commas at the call's top
+ * level. An unterminated literal or group ends the scan.
+ */
+function codeShape(code) {
+  const strings = [];
+  const calls = [];
+  const stack = [];
+  for (let i = 0; i < code.length; i++) {
+    const c = code[i];
+    if (c === "'" || c === '"' || c === "`") {
+      const triple = c !== "`" && code.startsWith(c.repeat(3), i);
+      const q = triple ? c.repeat(3) : c;
+      let j = i + q.length;
+      while (j < code.length && !code.startsWith(q, j)) j += code[j] === "\\" ? 2 : 1;
+      if (j >= code.length) break;
+      strings.push({ start: i, end: j + q.length, value: code.slice(i + q.length, j) });
+      i = j + q.length - 1;
+    } else if (c === "(" || c === "[" || c === "{") {
+      const callee = c === "(" ? (/((?:[A-Za-z_$][\w$]*\s*\.\s*)*[A-Za-z_$][\w$]*)\s*$/.exec(code.slice(Math.max(0, i - 128), i)) ?? null) : null;
+      stack.push({ kind: c, open: i, commas: [], callee: callee ? callee[1].replace(/\s+/g, "") : "", start: callee ? i - callee[0].length : i });
+    } else if (c === ")" || c === "]" || c === "}") {
+      const frame = stack.pop();
+      if (frame?.kind === "(") calls.push({ ...frame, close: i });
+    } else if (c === "," && stack.length > 0) stack[stack.length - 1].commas.push(i);
+  }
+  return { strings, calls };
+}
+
+/** Whether a literal Bash operand names live configuration: a glob, brace or bracket word by any expansion it can take. */
+function operandLive(p, ctx) {
+  if (!hasGlob(p)) return pathLive(p, ctx);
+  // Braces and classes expand to the words the shell can produce; a wildcard left is matched on disk.
+  return (/[[{]/.test(p) ? braceVariants(p, true) : [p]).some((w) => (hasGlob(w) ? globLive(w, ctx) : pathLive(w, ctx)));
+}
+
+/**
+ * Applies a `cd`, `pushd` or `popd` to the cwd. A literal target replaces it (both are kept when
+ * the command may not run, or the target may not be a directory); any other target leaves the cwd
+ * unresolved, so later relative operands are judged by their own segments.
+ */
+function moveCwd(name, args, place, maybe, ctx) {
+  const from = ctx.dir;
+  const merge = (a, b) => mergeDirs(a, b, false);
+  let to;
+  if (name === "popd") to = args.length === 0 && from.stack.length > 0 ? from.stack[from.stack.length - 1] : { ...from, unresolved: true };
+  else {
+    const literal = args.length === 1 && !unknown(args[0]) && !/^[-+]/.test(args[0]) && !hasGlob(args[0]);
+    const target = args.length === 0 ? (name === "cd" ? ctx.env.home : null) : literal ? expandTilde(args[0], ctx.env.home) : null;
+    if (target === null) to = { ...from, unresolved: true };
+    else {
+      const abs = target.startsWith("/");
+      let sure = true;
+      const cwds = [];
+      for (const cwd of abs ? [ctx.env.cwd] : from.cwds) {
+        const { paths, legacy } = resolveOperand(target, { ...ctx.env, cwd });
+        if (legacy || !enterable(paths[paths.length - 1])) sure = false;
+        cwds.push(...paths);
+      }
+      to = { cwds: [...new Set(cwds)], unresolved: !abs && from.unresolved, stack: from.stack };
+      if (!sure) to = merge(from, to);
+    }
+    if (name === "pushd") to = { ...to, stack: [...from.stack, from] };
+  }
+  if (place.joint === "&&" && !maybe) ctx.alt = ctx.alt ? merge(ctx.alt, from) : from;
+  ctx.dir = maybe ? merge(from, to) : to;
+}
+
+/** Whether relative `p` is live by its own segments, read from an unresolved cwd. */
+function ownLive(p, glob, ctx) {
+  const s = segments(p).map((x) => x.normalize("NFC").toUpperCase().toLowerCase());
+  if (s.length === 0) return false;
+  const m = (seg, name) => seg !== undefined && (glob && hasGlob(seg) ? globMatch(seg, name) && (ctx.dots || !name.startsWith(".") || /^[.[]/.test(seg)) : seg === name);
+  return liveAt(s, `/${s.join("/")}`, ctx.env, { m, reach: () => false, plugin: () => false });
+}
+
+/** Whether `arg` is `--<name>` or an abbreviation of it at least `min` characters long. */
+function gitLong(arg, name, min = 1) {
+  const m = /^--([^=]+)/.exec(arg);
+  return m !== null && m[1].length >= min && name.startsWith(m[1]);
+}
+
+/** Bundled short flags of `arg`, up to and including the first flag in `valued`. */
+function shortFlags(arg, valued = "") {
+  if (!/^-[^-]/.test(arg)) return "";
+  let out = "";
+  for (const c of arg.slice(1)) {
+    out += c;
+    if (valued.includes(c)) break;
+  }
+  return out;
+}
+
+/** Whether a git subcommand with its arguments destroys commits, refs or uncommitted work; a forced worktree removal is judged from `ctx.loc`. */
+function destructive(sub, args, ctx) {
+  const end = args.indexOf("--");
+  const opts = end < 0 ? args : args.slice(0, end);
+  const flags = (valued) => opts.map((a) => shortFlags(a, valued)).join("");
+  const long = (name, min) => opts.some((a) => gitLong(a, name, min));
+  const op = opts.find((a) => !a.startsWith("-"));
+  switch (sub) {
+    case "reset":
+      return long("hard") || long("keep") || long("merge");
+    case "push":
+      return pushDestroys(opts, args);
+    case "branch":
+      return /[DMCf]/.test(flags("u")) || long("force", 2);
+    case "clean":
+      return flags("e").includes("f") || long("force");
+    case "checkout": {
+      const ops = operands(opts, /^(?:-[bB]|--orphan|--conflict)$/);
+      const paths = ops.length > 1 || ops.some((o) => o !== "-" && NOT_REF.test(o)) || (end >= 0 && end < args.length - 1);
+      return paths || /[fpB]/.test(flags("bB")) || long("force") || long("patch", 2) || long("ours", 2) || long("theirs", 2) || long("pathspec-from-file", 2);
+    }
+    case "switch":
+      return /[fC]/.test(flags("cC")) || long("force") || long("force-create", 7) || long("discard-changes", 2);
+    case "config":
+      return configSets(args);
+    case "restore":
+      // `--s` is ambiguous with `--source`, so it selects no target and the default worktree stays.
+      return !(flags("s").includes("S") || long("staged", 2)) || flags("s").includes("W") || long("worktree");
+    case "stash":
+      return op === "drop" || op === "clear";
+    case "reflog":
+      return op === "expire";
+    case "filter-branch":
+      return true;
+    case "worktree": {
+      // `-B` resets an existing branch and `--force` overrides the checks that keep a branch or path in use.
+      if (op === "add") return /[Bf]/.test(flags("bB")) || long("force");
+      if (op !== "remove" || !(flags().includes("f") || long("force"))) return false;
+      const loc = (ctx.loc ??= defaultEnv());
+      const scratch = (p) => {
+        const r = p.startsWith("/") && !/[$`*?[{\\]/.test(p) ? resolveOperand(p, loc) : { paths: [], legacy: true };
+        return !r.legacy && r.paths.every((q) => tempOnly(norm(q), loc));
+      };
+      return !operands(args, /(?!)/).slice(1).every(scratch);
+    }
+    default:
+      return false;
+  }
+}
+
+const refName = (r) => r.replace(/^refs\/heads\//, "");
+
+/** Whether `git push` mirrors, deletes, or forces a ref no lease covers. */
+function pushDestroys(opts, args) {
+  let force = false;
+  let lease = false;
+  const leased = [];
+  for (const a of opts) {
+    if (gitLong(a, "force-with-lease", 7)) {
+      if (a.includes("=")) leased.push(refName(a.slice(a.indexOf("=") + 1).split(":")[0]));
+      else lease = true;
+    } else if (gitLong(a, "no-force-with-lease", 4)) {
+      lease = false;
+      leased.length = 0;
+    } else if (gitLong(a, "mirror") || gitLong(a, "delete", 2) || gitLong(a, "prune", 3) || shortFlags(a, "o").includes("d")) return true;
+    else if (gitLong(a, "force") || shortFlags(a, "o").includes("f")) force = true;
+  }
+  const refs = operands(args, /^(?:-o|--push-option|--repo|--receive-pack|--exec)$/);
+  if (refs.some((r) => /^\+?:/.test(r)) || (force && !lease)) return true;
+  return !lease && refs.some((r) => r.startsWith("+") && !leased.includes(refName(r.slice(1).split(":").pop())));
+}
+
+/**
+ * Whether a config key (lowercase) with `value` (null when unknown) cannot add an alias or code.
+ * A bare fsmonitor key reads as true, and any value but an explicit false may name a hook program.
+ */
+function safeKey(key, value) {
+  if (/^core\.(?:fsmonitor|untrackedcache)$/.test(key)) return value !== null && /^(?:false|no|off|0)$/i.test(value);
+  if (key.endsWith(".renamelimit") && !(value !== null && /^\d+$/.test(value))) return false;
+  return GIT_SAFE_KEY.test(key) || (GIT_PROGRAM_KEY.test(key) && value !== null && SAFE_PROGRAM.test(value));
+}
+
+/** Whether `git config` arguments edit the file, rename a section, or set an unsafe key. */
+function configSets(args) {
+  const ops = operands(args, /^(?:-f|--file|--blob|--type|--default|--comment|--value)$/);
+  const verb = /^(?:set|get|list|unset|edit|rename-section|remove-section)$/.test(ops[0] ?? "") ? ops.shift() : null;
+  if (verb === "edit" || verb === "rename-section" || args.some((a) => shortFlags(a, "f").includes("e") || gitLong(a, "edit", 2) || gitLong(a, "rename-section", 3))) return true;
+  if ((verb !== null && verb !== "set") || args.some((a) => /^--(?:get|list|unset|remove-section|show-)/.test(a) || shortFlags(a, "f").includes("l"))) return false;
+  return ops.length >= 2 && !safeKey(ops[0].toLowerCase(), ops[1]);
+}
+
+/** Whether a line sets git config or a program git runs through the environment. */
+function gitEnvTainted(text) {
+  for (const [, name, quoted] of String(text).matchAll(GIT_ENV)) {
+    const value = quoted.replace(/['"\\]/g, "");
+    const safe = name.startsWith("GIT_CONFIG_KEY_") ? safeKey(value.toLowerCase(), null) : /EDITOR|PAGER/.test(name) && SAFE_PROGRAM.test(value);
+    if (!safe) return true;
+  }
+  return false;
+}
+
+/** Whether a known text can become an option, a `+`/`:` refspec or a glob; `inside` for a slice, `lead` at a word start. */
+function yieldsText(text, inside, lead = true) {
+  if (/[$`]/.test(text)) return true;
+  const s = text.replace(/['"\\]/g, "");
+  const [first, ...rest] = s.split(/\s+/);
+  return /[*?[]/.test(s) || rest.some((t) => /^[-+:]/.test(t)) || (lead && (inside ? /[-+:]/.test(s) : /^[-+:]/.test(first)));
+}
+
+/** Whether a substitution, bare or double-quoted, runs a GIT_QUERY query whose arguments are literal or such substitutions. */
+function gitQuery(text) {
+  const t = /^"[\s\S]*"$/.test(text) ? text.slice(1, -1) : text;
+  const end = t[0] === "`" ? quoteEnd(t, 0) : t.startsWith("$(") && t[2] !== "(" ? closeGroup(t, 2, "(", ")") : -1;
+  const cmds = end === t.length ? splitCommands(t.slice(t[0] === "`" ? 1 : 2, -1)) : null;
+  if (cmds === null || cmds.length !== 1 || cmds[0][0] !== "git") return false;
+  const args = cmds[0].slice(1);
+  while (/^(?:--no-pager|-P|-C)$/.test(args[0] ?? "")) args.splice(0, args[0] === "-C" ? 2 : 1);
+  const [sub, ...rest] = args;
+  const flags = GIT_QUERY.get(sub);
+  if (flags === undefined || args.some((a) => /[$`]/.test(a) && !gitQuery(a))) return false;
+  return sub === "branch" ? rest.length === 1 && flags.test(rest[0]) : rest.every((a) => (a.startsWith("-") ? flags.test(a) : !/^[+:]/.test(a)));
+}
+
+/** Raw words of `s` from `i` to a separator (only the first with `one`); null on an open quote. */
+function rawWords(s, i, one) {
+  const out = [];
+  let word = "";
+  for (;;) {
+    const c = s[i];
+    if (c === undefined || /[\s;&|()<>]/.test(c)) {
+      if (one) return [word];
+      if (word !== "") out.push(word);
+      if (c === undefined || /[\n;&|()<>]/.test(c)) return out;
+      word = "";
+      i++;
+      continue;
+    }
+    const sub = substitutionEnd(s, i, false);
+    const end = c === "\\" ? i + 2 : c === "'" || c === '"' ? quoteEnd(s, i) : sub === i ? i + 1 : sub;
+    if (end < 0) return null;
+    word += s.slice(i, end);
+    i = end;
+  }
+}
+
+// Names are found with fixed patterns and compared as strings: command text is never compiled.
+const NAME_USE = /\$\{?[#!]?([A-Za-z_]\w*)/g;
+const WORD_NAME = /(?<=^|[\s;&|(){}\x60'"])(?<!\$\{)[A-Za-z_]\w*/g;
+const EXPANSION_BODY = /\$\{([^}]*)/g;
+const ASSIGNED_NAME = /\b([A-Za-z_]\w*)(?:\[[^\]]*\])?:*=/g;
+
+/** Index of the first `$name`, `${name`, `${#name` or `${!name` in `text`; -1 when none. */
+function useIndex(text, name) {
+  for (const m of text.matchAll(NAME_USE)) if (m[1] === name) return m.index;
+  return -1;
+}
+
+/** Whether an expansion in `line` assigns `name` (`${name=v}`, `${x:-${name:=v}}`). */
+function assignsInExpansion(line, name) {
+  for (const body of line.matchAll(EXPANSION_BODY)) for (const m of body[1].matchAll(ASSIGNED_NAME)) if (m[1] === name) return true;
+  return false;
+}
+
+/**
+ * Binding counts per name for standalone assignments and for-in lists that run in the line's own
+ * shell, an assignment unconditionally or only for the uses its `&&` chain gates; `lost` names
+ * are bound anywhere else or by `+=`.
+ */
+function lineScope(line) {
+  const kept = new Map();
+  const lost = new Set();
+  const found = [];
+  const frames = [];
+  const cmds = splitCommands(line) ?? [];
+  const gated = (i, name) => {
+    const end = cmds.findIndex((c, k) => k > i && PLACES.get(c)?.joint !== "&&");
+    return end < 0 || !cmds.slice(end).some((c) => useIndex(c.join(" "), name) >= 0);
+  };
+  for (const [i, words] of cmds.entries()) {
+    const place = PLACES.get(words);
+    const away = place === undefined || place.isolated || place.late === true || place.shells.length > 0;
+    let j = 0;
+    for (; KEYWORDS.has(words[j]); j++) {
+      if (OPENERS.has(words[j])) frames.push({ kind: words[j], away });
+      else if (CLOSERS.has(words[j]) && frames.length > 0) frames.pop().away ||= away;
+    }
+    const rest = words.slice(j);
+    const outer = [...frames];
+    for (const w of rest.filter((x) => ASSIGN.test(x))) {
+      const name = /^\w+/.exec(w)[0];
+      const ok = !away && (!place.joint || (place.joint === "&&" && gated(i, name))) && rest.every((x) => ASSIGN.test(x)) && !/^\w+(?:\[|\+=)/.test(w) && outer.every((f) => f.kind === "{");
+      found.push({ name, ok, outer });
+    }
+    if (OPENERS.has(rest[0])) frames.push({ kind: rest[0], away });
+    if (rest[0] === "for" && rest[2] === "in") found.push({ name: rest[1], ok: !away && frames.every((f) => f.kind === "{" || f.kind === "for"), outer: [...frames] });
+  }
+  for (const { name, ok, outer } of found) {
+    if (ok && !outer.some((f) => f.away)) kept.set(name, (kept.get(name) ?? 0) + 1);
+    else lost.add(name);
+  }
+  return { kept, lost };
+}
+
+/** Values `name` is assigned or for-in listed on the line, or null when something else can bind it or a use comes first. */
+function lineValues(name, ctx) {
+  if (name === XARGS_NAME) return [];
+  if (!ctx.names.has(name)) {
+    const line = ctx.line;
+    // A bare name at a word start not followed by `=` or a for-in list is bound by read, printf -v or a like form.
+    let values = assignsInExpansion(line, name) ? null : [];
+    let first = line.length;
+    let count = 0;
+    for (const m of values === null ? [] : line.matchAll(WORD_NAME)) {
+      if (m[0] !== name) continue;
+      const at = m.index + name.length;
+      const list = /^[ \t]+in[ \t]/.exec(line.slice(at, at + 8));
+      const forIn = list !== null && /(?:^|[\s;&|(){}])for[ \t]+$/.test(line.slice(Math.max(0, m.index - 64), m.index));
+      const bound = /^\+?=/.test(line.slice(at, at + 2)) ? rawWords(line, line.indexOf("=", at) + 1, true) : forIn ? rawWords(line, at + list[0].length, false) : null;
+      if (bound === null) {
+        values = null;
+        break;
+      }
+      values.push(...bound.flatMap((w) => (forIn && BRACES.test(w) ? braceVariants(w) : [w])));
+      first = Math.min(first, m.index);
+      count++;
+    }
+    ctx.scope ??= lineScope(line);
+    if (values !== null && (ctx.scope.lost.has(name) || (ctx.scope.kept.get(name) ?? 0) !== count)) values = null;
+    const use = useIndex(line, name);
+    if (values?.length && (use < 0 ? first : use) < first) values = null;
+    ctx.names.set(name, values);
+  }
+  return ctx.names.get(name);
+}
+
+/**
+ * What one expansion of a split word can be: "yields" (an option, a `+`/`:` refspec or a glob),
+ * "unknown" (a value from outside the line) or "safe"; `lead` when it starts the word.
+ */
+function expansionKind(text, ctx, lead = true) {
+  if (text[0] === "`" || text[1] === "(") return gitQuery(text) ? "safe" : "yields";
+  const body = text[1] === "{" ? text.slice(2, -1) : text.slice(1);
+  const m = /^([A-Za-z_]\w*)([\s\S]*)$/.exec(body);
+  // Flags, indirection, subscripts, nesting and special parameters count as yielding.
+  if (m === null || SHELL_SET.test(m[1]) || (m[2] !== "" && !EXP_OP.test(m[2]))) return "yields";
+  const slice = m[2] !== "" && !/^:?[-=?+]/.test(m[2]);
+  if (expansionWords(body).some((w) => yieldsText(w, slice, lead))) return "yields";
+  const values = lineValues(m[1], ctx);
+  if (values === null || values.some((v) => !(gitQuery(v) && (!slice || !lead)) && yieldsText(v, slice, lead))) return "yields";
+  return values.length === 0 ? "unknown" : "safe";
+}
+
+/** Whether the git line is short, splits, and binds no name in its unquoted text (see BINDERS). */
+function plainLine(ctx) {
+  ctx.plain ??= ctx.line.length <= MAX_CHARS && splitCommands(ctx.line) !== null && !BINDERS.test(unquotedText(ctx.line));
+  return ctx.plain;
+}
+
+/** A heredoc operator and its delimiter: quoted (groups 2-4) or bare (group 5). */
+const DOC_OP = /<<(-?)[ \t]*(?:(['"])(\w+)\2|\\(\w+)|(\w+))/y;
+
+/**
+ * `line` without single-quoted and ANSI-C text and quoted heredoc bodies; the whole line when a
+ * quote, body or heredoc operator cannot be read, so no unquoted text is ever dropped.
+ */
+function unquotedText(line) {
+  let out = "";
+  const docs = [];
+  let i = 0;
+  while (i < line.length) {
+    tick();
+    const c = line[i];
+    const sub = substitutionEnd(line, i, false);
+    if (sub < 0) return line;
+    let next = i + 1;
+    if (sub > i) next = sub;
+    else if (line.startsWith("<<<", i)) next = i + 3;
+    else if (line.startsWith("<<", i)) {
+      DOC_OP.lastIndex = i;
+      const doc = DOC_OP.exec(line);
+      if (doc === null) return line;
+      docs.push({ strip: doc[1] === "-", delim: doc[3] ?? doc[4] ?? doc[5], quoted: doc[5] === undefined });
+      next = DOC_OP.lastIndex;
+    } else if (c === "\\") next = i + 2;
+    else if (c === "#" && /^$|[\s;&|()<>]/.test(line[i - 1] ?? "")) next = line.includes("\n", i) ? line.indexOf("\n", i) : line.length;
+    else if (c === "'" || (c === "$" && line[i + 1] === "'")) {
+      next = c === "'" ? quoteEnd(line, i) : ansiEnd(line, i + 1);
+      if (next < 0) return line;
+      out += "''";
+      i = next;
+      continue;
+    } else if (c === '"') {
+      let j = i + 1;
+      while (j < line.length && line[j] !== '"') {
+        const inner = substitutionEnd(line, j, true);
+        if (inner < 0) return line;
+        j = inner > j ? inner : line[j] === "\\" ? j + 2 : j + 1;
+      }
+      if (j >= line.length) return line;
+      next = j + 1;
+    } else if (c === "\n" && docs.length > 0) {
+      out += "\n";
+      i++;
+      for (const d of docs.splice(0)) {
+        for (let done = false; !done; ) {
+          if (i >= line.length) return line;
+          const end = line.includes("\n", i) ? line.indexOf("\n", i) : line.length;
+          const text = line.slice(i, end);
+          i = end + 1;
+          done = (d.strip ? text.replace(/^\t+/, "") : text) === d.delim;
+          if (!done && !d.quoted) out += `${text}\n`;
+        }
+      }
+      continue;
+    }
+    out += line.slice(i, next);
+    i = next;
+  }
+  return docs.length > 0 ? line : out;
+}
+
+/** Raw word `text` without the backslash-newlines the shell drops outside single quotes. */
+function joinLines(text) {
+  if (!text.includes("\\\n")) return text;
+  let out = "";
+  let from = 0;
+  let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    const end = c === "'" && !dq ? text.indexOf("'", i + 1) : -1;
+    if (c === "\\" && text[i + 1] === "\n") {
+      out += text.slice(from, i);
+      from = i + 2;
+    } else if (end <= i) dq = c === '"' ? !dq : dq;
+    i = c === "\\" ? i + 1 : Math.max(i, end);
+  }
+  return out + text.slice(from);
+}
+
+/** `text` joined at every backslash-newline, as code parsed again reads it. */
+function joinAll(text) {
+  return text.replaceAll("\\\n", "");
+}
 
 /**
- * Parses --ttl (minutes).
- * @param {string[]} argv Arguments after the script path.
- * @returns {{ttlMin:number}} Options.
+ * Word lists `words` can split into with each `$name` filled by its line values, split and joined
+ * at a backslash-newline (in quotes too under `code`); a word with an unknown value stays as
+ * written, and past MAX_VARIANTS lists the result is null.
  */
-export function parseOptions(argv) {
-  const opts = { ttlMin: DEFAULT_TTL_MIN };
-  for (let i = 0; i < argv.length; i++) {
-    if (argv[i] === "--ttl") {
-      const n = Number.parseInt(argv[++i], 10);
-      if (Number.isInteger(n) && n > 0) opts.ttlMin = n;
+function boundVariants(words, ctx) {
+  const texts = (v) => [...new Set([v, joinLines(v), ctx.code ? joinAll(v) : v])].map((t) => t.replace(/['"\\]/g, ""));
+  const valuesOf = (name) => {
+    const values = name === null || SHELL_SET.test(name) ? null : lineValues(name, ctx);
+    return values?.length && !values.some((v) => /[$`]/.test(v)) ? values.flatMap(texts) : null;
+  };
+  let out = [[]];
+  for (const w of words) {
+    const alts = /[$`]/.test(w) ? expandNames(w, valuesOf, Infinity, shellSpans(w)) : null;
+    const next = alts === null ? [[w]] : alts.map((a) => a.split(/\s+/).filter(Boolean));
+    out = out.flatMap((o) => next.map((n) => [...o, ...n]));
+    if (out.length > MAX_VARIANTS) return null;
+  }
+  return out;
+}
+
+/** Each `$` or backtick expansion of `w` in order; the name is null but for `$name` and `${name}`, and one that does not parse ends the scan. */
+function* shellSpans(w) {
+  for (let i = 0; i < w.length; i++) {
+    if (w[i] !== "$" && w[i] !== "`") continue;
+    const e = expansionAt(w, i);
+    yield { index: i, end: e?.end ?? i, name: e === null ? null : (/^\$\{?([A-Za-z_]\w*)\}?$/.exec(w.slice(i, e.end))?.[1] ?? null) };
+    if (e === null) return;
+    i = e.end - 1;
+  }
+}
+
+/**
+ * Whether an expansion argument of a listed subcommand can complete a listed form: known text
+ * yields an option or a `+`/`:` refspec, or an unknown value stands in a push refspec, a checkout
+ * operand, the stash, reflog or worktree verb, or the start of a worktree add word (it may be `-B`
+ * or `--force`). A line with a binder denies every one, but for the read-only stash and worktree
+ * forms, which move no ref, and a worktree add, read through its same-line literal bindings.
+ */
+function expansionDenies(sub, args, ctx) {
+  if (!args.some((a) => /[$`]/.test(a))) return false;
+  if (sub === "stash" ? /^(?:show|list)$/.test(args[0]) : sub === "worktree" && /^(?:list|prune)$/.test(args[0])) return false;
+  const adds = sub === "worktree" && args[0] === "add";
+  const plain = plainLine(ctx);
+  if (!plain && !adds) return true;
+  const bound = (text, lead) => {
+    const m = /^\$(?:\{([A-Za-z_]\w*)\}|([A-Za-z_]\w*))$/.exec(text);
+    if (m === null) return (text[0] === "`" || text[1] === "(") && gitQuery(text) ? "safe" : "yields";
+    const value = literalBinding(m[1] ?? m[2], ctx);
+    return value === null ? "unknown" : yieldsText(value, false, lead) ? "yields" : "safe";
+  };
+  const [short, long] = GIT_SUB_VALUED.get(sub) ?? ["", []];
+  const kinds = (w) => {
+    const out = [];
+    for (let i = 0; i < w.length; ) {
+      const e = w[i] === "$" || w[i] === "`" ? expansionAt(w, i) : null;
+      if (e === null && (w[i] === "$" || w[i] === "`")) out.push([i, "yields"]);
+      if (e !== null) out.push([i, plain ? expansionKind(w.slice(i, e.end), ctx, i === 0) : bound(w.slice(i, e.end), i === 0)]);
+      i = e === null ? i + 1 : e.end;
+    }
+    return out;
+  };
+  const yields = (w) => w !== undefined && kinds(w).some(([, k]) => k === "yields");
+  let pos = 0;
+  let ended = false;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (!ended && a === "--") ended = true;
+    else if (!ended && /^-[^-]/.test(a)) {
+      let j = 1;
+      while (j < a.length && !short.includes(a[j])) if ("$`".includes(a[j++])) return true;
+      if (j < a.length && yields(j + 1 < a.length ? a.slice(j + 1) : args[++i])) return true;
+    } else if (!ended && a.startsWith("--")) {
+      const eq = a.includes("=") ? a.indexOf("=") : a.length;
+      if (/[$`]/.test(a.slice(0, eq)) || yields(a.slice(eq + 1))) return true;
+      if (eq === a.length && long.some((n) => gitLong(a, n, 3)) && yields(args[++i])) return true;
+    } else {
+      const found = kinds(a);
+      const unknown = found.filter(([, k]) => k === "unknown");
+      if (found.some(([, k]) => k === "yields")) return true;
+      if (((sub === "push" && pos > 0) || (adds && !ended)) && unknown.some(([at]) => at === 0)) return true;
+      if (unknown.length > 0 && (sub === "checkout" || (pos === 0 && /^(?:stash|reflog|worktree)$/.test(sub)))) return true;
+      pos++;
     }
   }
-  return opts;
+  return false;
+}
+
+/**
+ * Whether `argv` (from the `git` word on) destroys work or sets config that can add an alias or
+ * run code; `-c alias.*` is resolved. A listed subcommand denies on `expansionDenies` or a
+ * destructive form of its literal arguments; alias resolution past MAX_DEPTH hops allows.
+ * @param {boolean} [fed] argv carries the input xargs or find hands a literal git child as the
+ *   opaque XARGS_INPUT operand; a subcommand the input spells is unknown and allows.
+ */
+function gitRun(argv, depth, ctx, fed = false) {
+  const aliases = new Map();
+  let words = argv.slice(1);
+  for (let hops = 0; ; hops++) {
+    let j = 0;
+    for (; j < words.length && words[j].startsWith("-"); j++) {
+      const a = words[j];
+      const env = a === "--config-env" || a.startsWith("--config-env=");
+      if (a.startsWith("--exec-path=")) return true;
+      if (a !== "-c" && !env) {
+        if (GIT_VALUED.test(a)) j++;
+        continue;
+      }
+      const entry = env && a.includes("=") ? a.slice(a.indexOf("=") + 1) : (words[++j] ?? "");
+      const eq = entry.indexOf("=");
+      const key = (eq < 0 ? entry : entry.slice(0, eq)).toLowerCase();
+      // --config-env takes the value from a variable, so an alias it defines is unknown.
+      if (key.startsWith("alias.") && !env && eq > 0) aliases.set(key.slice(6), entry.slice(eq + 1));
+      else if ((CONFIG_KEY.test(key) || /[$`]/.test(key)) && !safeKey(key, env ? null : entry.slice(eq + 1 || entry.length))) return true;
+    }
+    const [sub, ...braced] = words.slice(j);
+    if (sub === undefined || (fed && sub.includes(XARGS_INPUT))) return false;
+    if (/[$`]/.test(sub) && !hasGlob(sub) && plainLine(ctx)) {
+      const bound = boundVariants([sub], ctx);
+      if (bound !== null && !bound.some((v) => v[0] === sub)) return bound.some((v) => gitRun([argv[0], ...words.slice(0, j), ...v, ...braced], depth, ctx, fed));
+    }
+    if (/[$`]/.test(sub) || hasGlob(sub)) return true;
+    // Brace expansion turns `{--hard,}` into `--hard`.
+    const rest = braced.flatMap((a) => (BRACES.test(a) && !/[$`]/.test(a) ? braceVariants(a) : [a]));
+    const value = aliases.get(sub.toLowerCase());
+    if (value === undefined) return GIT_LISTED.has(sub) && (expansionDenies(sub, rest, ctx) || (boundVariants(rest, ctx)?.some((v) => destructive(sub, v, ctx)) ?? false));
+    if (hops >= MAX_DEPTH) return false;
+    if (/[$`]/.test(value)) return true;
+    if (value.startsWith("!")) return gitCheck([value.slice(1), ...rest].join(" "), depth + 1, ctx) !== null;
+    words = [...(splitCommands(value)?.[0] ?? value.split(/\s+/)), ...rest];
+  }
+}
+
+/** Deny reason for a git command, echoed through `visible`. */
+function gitReason(words) {
+  return (
+    `FreeHarness git guard: \`${visible(words.join(" "))}\` can destroy commits, refs or uncommitted work. ` +
+    "If it is intended, ask the user to run it with the `!` prompt prefix; no marker opens this guard. " +
+    "Do not route the command through another tool."
+  );
 }
 
 /**
- * Whether an absolute file path is protected.
- * @param {string} file Path (any separator).
- * @returns {boolean} True when protected.
+ * Git guard state of a line: text, aliases, env taint, binder memos (`plain`, `names`, `scope`),
+ * `feed` (the simple command piping into the one judged, for shellBody), `code` (inside code
+ * parsed again) and the judgment env (`loc`).
  */
-export function isProtectedPath(file) {
-  const p = String(file).replace(/\\/g, "/");
-  if (/\/node_modules\//.test(p)) return false;
-  const base = p.split("/").pop() || "";
-  return NAMES.test(base) || DIRS.test(p);
+function gitLine(text, loc = undefined) {
+  return { line: text, aliases: new Map(), env: gitEnvTainted(text), plain: undefined, names: new Map(), scope: undefined, feed: null, code: false, loc };
 }
 
 /**
- * Protected paths a Bash command writes to (empty when it only reads them).
- * @param {string} command The command.
- * @returns {string[]} Matched tokens.
+ * Value of `name` from its one same-line binding, read even on a line with a binder word: a
+ * standalone top-level assignment of literal text, unconditional and ahead of every use, with no
+ * other mention of the name and no command that can bind a name the text does not show (eval,
+ * source, a trap, a nameref, a binder given an expanded name) or remap a command (hash); null
+ * otherwise.
+ */
+function literalBinding(name, ctx) {
+  // Code parsed again runs in another shell, where the line's binding may not hold.
+  if (ctx.code) return null;
+  ctx.literals ??= new Map();
+  if (ctx.literals.has(name)) return ctx.literals.get(name);
+  ctx.literals.set(name, null);
+  const line = ctx.line;
+  const opaque = SHELL_SET.test(name) || line.length > MAX_CHARS || /\bIFS\b|\$\{[(!][^}]*=/.test(line) || assignsInExpansion(line, name);
+  const cmds = opaque ? null : splitCommands(line);
+  if (cmds === null) return null;
+  const opener = /^(?:eval|source|\.|fc|trap|emulate|enable|zmodload|autoload|zparseopts|hash)$/;
+  // Builtins that can assign a name an operand spells, or run one that does.
+  const binder = /^(?:declare|typeset|local|export|readonly|integer|float|let|private|set|read|getln|mapfile|readarray|getopts|vared|sysread|zstat|zformat|strftime|zstyle|zle|zregexparse|pcre_match|zselect|zsocket|ztcp|zpty|zsystem|sysopen|sched|compadd|compgen|zcurses|unset|select|coproc|print|printf|wait|builtin|command|exec|noglob|nocorrect|-|time)$/;
+  const heads = [];
+  let value = null;
+  let at = -1;
+  let frames = 0;
+  for (const [i, c] of cmds.entries()) {
+    const place = PLACES.get(c);
+    let j = 0;
+    for (; KEYWORDS.has(c[j]); j++) frames += OPENERS.has(c[j]) ? 1 : CLOSERS.has(c[j]) ? -1 : 0;
+    let k = j;
+    while (k < c.length && (ASSIGN.test(c[k]) || PRECOMMANDS.has(c[k]) || /^(?:command|builtin|time)$/.test(c[k]))) for (k++; /^-\w*$/.test(c[k] ?? ""); k++);
+    const head = c[k] ?? "";
+    const tail = c.slice(k + 1);
+    const expanded = tail.some((w) => /[$`]/.test(w));
+    if (opener.test(head)) return null;
+    // A declaration builtin takes an operand as one assignment, so only an expanded name can bind another name.
+    const declares = /^(?:declare|typeset|local|export|readonly|integer|float|let|private)$/.test(head);
+    if (declares && tail.some((w) => /^[-+]\w*n/.test(w) || /[$`]/.test(w.split("=")[0]))) return null;
+    const names = /^(?:printf|print)$/.test(head) ? tail.some((w) => /^-\w*v/.test(w)) : head === "wait" ? tail.some((w) => /^-\w*p/.test(w)) : !declares && binder.test(head);
+    if (names && expanded) return null;
+    if (expanded && /[$`]/.test(head)) {
+      // An expanded command word may itself be a binder; it is judged once its own binding is read.
+      const ref = /^("?)\$(?:\{([A-Za-z_]\w*)\}|([A-Za-z_]\w*))([^$`"\\]*)\1$/.exec(head);
+      if (ref === null) return null;
+      heads.push([ref[2] ?? ref[3], ref[4]]);
+    }
+    for (const [p, w] of c.entries()) {
+      if (QUOTED_DOCS.get(c)?.has(p)) continue;
+      if (useIndex(w, name) >= 0 && at < 0) return null;
+      for (const m of w.matchAll(WORD_NAME)) {
+        if (m[0] !== name) continue;
+        const v = w.slice(name.length + 1);
+        const plain = m.index === 0 && w[name.length] === "=" && at < 0 && frames === 0 && j === 0 && c.every((x) => ASSIGN.test(x));
+        const settled = place !== undefined && !place.isolated && !place.late && place.shells.length === 0 && !place.joint;
+        if (!plain || !settled || v === "" || /[\s$`\\*?[]/.test(v)) return null;
+        value = v;
+        at = i;
+      }
+    }
+    if (OPENERS.has(c[j])) frames++;
+  }
+  ctx.literals.set(name, value);
+  for (const [h, suffix] of heads) {
+    const v = h === name ? value : literalBinding(h, ctx);
+    const base = v === null ? "" : path.posix.basename(v + suffix);
+    if (v === null || opener.test(base) || binder.test(base)) {
+      ctx.literals.set(name, null);
+      return null;
+    }
+  }
+  return value;
+}
+
+/**
+ * Git guard reason for one simple command from `splitCommands`, or null; nested code is judged
+ * too, and recursion past MAX_DEPTH allows.
+ * @param {boolean} [appended] xargs, find or parallel adds arguments.
+ * @param {boolean} [unaliased] the command word came from an expansion, which a shell never alias-expands.
+ */
+export function gitDenial(words, depth = 0, ctx = gitLine(words.join(" ")), appended = false, unaliased = false) {
+  if (depth > MAX_DEPTH) return null;
+  if (words.length === 1 && (words[0] === "cat" || words[0] === "tee")) PASSED.set(words, ctx.feed);
+  const argv = [];
+  const from = [];
+  const inputs = [];
+  let stdin = null;
+  let quotedDoc = false;
+  let herestring = false;
+  for (let i = 0; i < words.length; i++) {
+    const op = REDIRECT.exec(words[i]);
+    if (!op || i + 1 >= words.length) {
+      argv.push(words[i]);
+      from.push(i);
+    } else if (op[1].startsWith("<<")) {
+      herestring = op[1] === "<<<";
+      stdin = words[++i];
+      quotedDoc = op[1] !== "<<<" && (QUOTED_DOCS.get(words)?.has(i) ?? false);
+    } else if (!OUTPUT_OPS.has(op[1])) inputs.push(words[++i]);
+    else i++;
+  }
+  const io = { stdin, quoted: quotedDoc, herestring, inputs, feed: ctx.feed, source: words };
+  const code = (text) => codeDenial(text, depth + 1, ctx, appended);
+  let k = 0;
+  let forked = false;
+  let input;
+  let fed = false;
+  while (k < argv.length) {
+    const w = argv[k];
+    const name = path.posix.basename(w);
+    const valued = name === "xargs" ? XARGS_VALUED : WRAPPERS.get(name)?.[0];
+    if (ASSIGN.test(w) || KEYWORDS.has(w) || PRECOMMANDS.has(w)) k++;
+    else if (w === "function" || w === "repeat") k += 2;
+    else if ((w === "for" || w === "select") && argv[k + 2] === "do") k += 3;
+    else if (valued !== undefined) {
+      if (name === "xargs") {
+        const opts = input === undefined && !appended ? xargsChild(argv, k + 1) : false;
+        input = opts === false ? false : opts?.mark;
+      }
+      appended ||= name === "xargs";
+      fed ||= name === "xargs";
+      for (k++; k < argv.length && argv[k].startsWith("-"); k++) {
+        const a = argv[k];
+        if (a === "--") {
+          k++;
+          break;
+        }
+        if (name === "command" && /^-[vV]$/.test(a)) return null;
+        if (name === "env" && ENV_SPLIT.test(a)) {
+          const str = a.replace(ENV_SPLIT, "") || argv[++k];
+          return code([str ?? "", ...argv.slice(k + 1)].join(" "));
+        }
+        if (valued?.test(a)) k++;
+        else if (name !== "xargs" && valuedCluster(name, a)) {
+          // The value word may be read as the command word too; forked once per call.
+          const found = forked ? null : gitDenial([...argv.slice(k + 1), ...(stdin === null ? [] : ["<<<", stdin])], depth + 1, ctx, appended, unaliased);
+          if (found !== null) return found;
+          forked = true;
+          k++;
+        }
+      }
+      if (name === "timeout") k++;
+    } else break;
+  }
+  if (k >= argv.length) return null;
+  const word = argv[k];
+  const name = path.posix.basename(word);
+  const args = argv.slice(k + 1);
+  if (!unaliased && ctx.aliases.has(word)) return code([ctx.aliases.get(word), ...args].join(" "));
+  if (APPLETS.test(name) && args.length > 0) {
+    const applet = words.filter((_, i) => i !== from[k]).map((w, i) => (i === from[k] ? appletName(w) : w));
+    if (QUOTED_DOCS.has(words)) QUOTED_DOCS.set(applet, new Set([...QUOTED_DOCS.get(words)].map((i) => (i > from[k] ? i - 1 : i))));
+    return gitDenial(applet, depth + 1, ctx, appended, unaliased);
+  }
+  // Brace expansion or a glob can turn the command word into git.
+  const [head, ...spread] = hasGlob(word) && !/[$`]/.test(word) ? braceVariants(word) : [word];
+  // An entry that runs code (an alias to a shell command) denies whatever the verb runs.
+  if (globMatch(path.posix.basename(head), "git")) {
+    const given = [...spread, ...args];
+    // The git words of an xargs child are literal and only its operand is input, so the child is judged with that operand opaque.
+    const operand = typeof input === "string" && input !== "" ? given.map((a) => a.replaceAll(input, XARGS_INPUT)) : [...given, XARGS_INPUT];
+    return ctx.env || gitOptions(given).code || gitRun(["git", ...given], depth, ctx) || (fed && gitRun(["git", ...operand], depth, ctx, true)) ? gitReason(words) : null;
+  }
+  // A command word an expansion or a path spells may be a shell: stdin fed to it is code.
+  if (!appended && (/[$`]/.test(word) || (word.includes("/") && !SYSTEM_BIN.test(word))) && fedStdin(io)) {
+    const found = bodyDenial(stdinBody(io, ctx), (t) => codeDenial(t, depth + 1, ctx));
+    if (found !== null) return found;
+  }
+  // An expansion command word may be git, a variable's code or a substitution's output.
+  const bound = /[$`]/.test(word) && plainLine(ctx) ? boundVariants([word], ctx) : null;
+  if (bound !== null && !bound.some((v) => v[0] === word)) {
+    for (const v of bound) {
+      const found = gitDenial([...v, ...args, ...(stdin === null ? [] : ["<<<", stdin])], depth + 1, ctx, appended);
+      if (found !== null) return found;
+    }
+    return null;
+  }
+  const ref = /[$`]/.test(word) && !LITERAL_WORDS.has(word) ? /^\$\{([A-Za-z_]\w*)\}([^$`]*)$/.exec(word) : null;
+  const value = ref === null ? null : literalBinding(ref[1], ctx);
+  if (value !== null) {
+    const swapped = [...words];
+    swapped[from[k]] = value + ref[2];
+    if (QUOTED_DOCS.has(words)) QUOTED_DOCS.set(swapped, QUOTED_DOCS.get(words));
+    return gitDenial(swapped, depth + 1, ctx, appended, true);
+  }
+  // A command word whose value the line does not show is not judged as git.
+  if (/[$`]/.test(word)) return null;
+  if (name === "alias") {
+    for (const a of args.filter((x) => x.indexOf("=") > 0)) ctx.aliases.set(a.slice(0, a.indexOf("=")), a.slice(a.indexOf("=") + 1));
+    return null;
+  }
+  if (name === "eval") {
+    return bodyDenial(shellBody(argv.slice(k), io, ctx), code) ?? code(unmark((args[0] === "--" ? args.slice(1) : args).join(" ")));
+  }
+  if (name === "find") {
+    for (let j = 0; j < args.length; j++) {
+      if (!/^-(?:exec|execdir|ok|okdir)$/.test(args[j])) continue;
+      let end = j + 1;
+      while (end < args.length && args[end] !== ";" && args[end] !== "+") end++;
+      const child = args.slice(j + 1, end);
+      const found = syntaxOnly(child, args) ? null : gitDenial(child, depth + 1, ctx, true);
+      if (found !== null) return found;
+      // find hands a literal git child each path as its `{}` operand, judged opaque.
+      if (path.posix.basename(child[0] ?? "") === "git" && gitRun(["git", ...child.slice(1).map((a) => a.replaceAll("{}", XARGS_INPUT))], depth + 1, ctx, true)) return gitReason(child);
+      j = end;
+    }
+    return null;
+  }
+  if (SHELLS.test(name) || name === "source" || name === ".") return shellDenial(name, args, io, words, depth, ctx, appended, input);
+  if (name === "sed" || AWKS.has(name)) {
+    const scripts = (name === "sed" ? null : awkPrograms(args)) ?? args;
+    return scripts.some((s) => [s, joinAll(s)].some((t) => GIT_WORD.test(t)) && (name === "sed" ? sedWrites(s) === null : !awkPlain(s))) ? gitReason(words) : null;
+  }
+  if (READ_ONLY.has(name)) return null;
+  const interpreted = INTERPRETERS.test(name) || name === "ruby";
+  if (!appended && (name === "ssh" || STDIN_CODE.test(name))) {
+    // Interpreter heredocs keep the spawn rules below; past an option, module or script a body may reach a shell too.
+    const own = (t) => (interpreted && stdin !== null ? null : readerDenial(name, words, t, depth, ctx, appended, unaliased));
+    const shell = name !== "ssh" && !plainStdin(args);
+    const found = bodyDenial(shellBody(argv.slice(k), io, ctx), (t) => own(t) ?? (shell ? codeDenial(t, depth + 1, ctx) : null));
+    if (found !== null) return found;
+  }
+  const text = interpreted ? [...args, stdin ?? ""].join("\n") : "";
+  const spawn = /^(?:perl|ruby)$/.test(name) ? SPAWN_SCRIPT : SPAWN;
+  const py = /^python/.test(name) ? true : name === "node" ? false : null;
+  // A shell expansion can rewrite the code after the guard reads it; a line that expands nothing
+  // outside single quotes hands its `$` and backticks to the code as they are.
+  const expands = ctx.code || /\$[\w{(@*#?$!-]|`/.test(unquotedText(ctx.line));
+  const opaque = expands && (/\$\S|`/.test(args.join("\n")) || (stdin !== null && !quotedDoc && /\$\S|`/.test(stdin)));
+  /**
+   * Whether the code the interpreter reads (a code option's operand, or stdin when no script
+   * operand leads) holds a shell expansion its text does not show. The value may be a git word,
+   * so with a spawn call it denies; outside a plain string literal it may be the spawn call too.
+   */
+  const codeExpands = () => {
+    // A split word no longer shows its quotes, but a line with no expansion outside single quotes has none to hide.
+    if (!expands) return false;
+    const pieces = [];
+    for (let j = 0; j < args.length; j++) {
+      if (/^--(?:eval|print)=|^-[A-Za-z]*[ceEp]./.test(args[j])) pieces.push([args[j], false]);
+      else if (/^(?:--(?:eval|print)|-[A-Za-z]*[ceEp])$/.test(args[j]) && j + 1 < args.length) pieces.push([args[++j], false]);
+    }
+    if (stdin !== null && !quotedDoc && pieces.length === 0 && (args.length === 0 || args[0].startsWith("-"))) pieces.push([stdin, !herestring]);
+    const mark = "fh_shell_value";
+    const dynamic = [];
+    let unknown = false;
+    for (const [w, doc] of pieces) {
+      let out = "";
+      const marks = [];
+      for (let i = 0; i < w.length; ) {
+        const c = w[i];
+        const e = c === "$" || c === "`" ? expansionAt(w, i) : null;
+        // A split word spells an expanded name `${name}`, so a bare one was quoted; a heredoc body stays raw.
+        if (e === null || (!doc && c === "$" && /[A-Za-z_]/.test(w[i + 1] ?? ""))) {
+          if (c === "`" && e === null) return true;
+          const step = doc && c === "\\" ? 2 : 1;
+          out += w.slice(i, i + step);
+          i += step;
+        } else {
+          const ref = /^\$\{([A-Za-z_]\w*)\}$/.exec(w.slice(i, e.end));
+          unknown ||= !/^[\w./:@%+,=~-]*$/.test((ref === null ? null : literalBinding(ref[1], ctx)) ?? "$");
+          marks.push(out.length);
+          out += mark;
+          i = e.end;
+        }
+      }
+      if (marks.length > 0) dynamic.push({ text: out, marks });
+    }
+    if (dynamic.length === 0) return false;
+    // Behind a bound command word no string literal vouches for a value the line does not show.
+    if ((unaliased && unknown) || [text, joinAll(text)].some((t) => spawn.test(t))) return true;
+    return dynamic.some(({ text: t, marks }) => {
+      const strings = py === null ? null : (codeTokens(t, py)?.code.filter((x) => x.t === "s" && !(py ? /^[rRbBuU]*[fF]/.test(t.slice(x.s)) : t[x.s] === "`")) ?? null);
+      return strings === null || marks.some((m) => !strings.some((x) => x.s < m && m + mark.length < x.e));
+    });
+  };
+  if (interpreted && codeExpands()) return gitReason(words);
+  // A git variable set anywhere on the line reaches every git the code spawns.
+  const gitEnv = ctx.env || /\bGIT_\w+=/.test(ctx.line);
+  const readOnly = (t) => (name === "perl" ? perlInert(perlCode(args, stdin)) : spawnsReadOnly(t, py ?? name, gitEnv));
+  if ([text, joinAll(text)].some((t) => spawn.test(t) && GIT_WORD.test(t) && (opaque || !readOnly(t)))) return gitReason(words);
+  // An unlisted command may run its arguments (caffeinate, xcrun, watch, flock, ssh, parallel).
+  const hit = args.findIndex((a) => ["git", "eval", "xargs"].includes(path.posix.basename(a)) || SHELLS.test(path.posix.basename(a)) || WRAPPERS.has(path.posix.basename(a)));
+  for (const a of (hit < 0 ? args : args.slice(0, hit)).filter((x) => !interpreted && /\s/.test(x))) {
+    const found = code(a);
+    if (found !== null) return found;
+  }
+  return hit >= 0 ? gitDenial(args.slice(hit), depth + 1, ctx, appended) : null;
+}
+
+/**
+ * Whether every call code spawns is a literal read-only git argv: python (`lang` true), node
+ * (false) or perl. Every spawn name must be an import, a constant or a call read literally, and
+ * every git word outside a comment must lie in an accepted argv, so a call the extractor misses
+ * still denies. Code that spawns may not alter the environment, directory or files git reads
+ * either, nor run under a git variable the line sets (`gitEnv`), as git config and variables name
+ * programs git runs. Code with no spawn call at all and no way to run a string spawns no git, so
+ * its git words are data; the code of an f-string or template field is code, never data. Perl is
+ * judged by `perlInert`, ruby never.
+ */
+function spawnsReadOnly(text, lang, gitEnv) {
+  if (typeof lang !== "boolean") return false;
+  const py = lang;
+  // `__import__('subprocess')` is that module; any other `__import__` stays dynamic.
+  const src = py ? text.replace(/__import__\s*\(\s*(['"])(subprocess|os)\1\s*\)/g, (all, q, mod) => mod.padEnd(all.length)) : text;
+  const lexed = codeTokens(src, py);
+  if (lexed === null) return false;
+  const { code, comments } = lexed;
+  // String bodies are data; comments stay, as a lexer slip could hide code in one.
+  const masked = maskLiterals(src, code);
+  if ((py ? PY_DYNAMIC : JS_DYNAMIC).test(masked)) return false;
+  /** Whether `pos` lies in string text outside any replacement field. */
+  const inText = (pos) => {
+    const k = tokenAt(code, pos);
+    return k >= 0 && code[k].t === "s" && !(code[k].fields ?? []).some(([s, e]) => s <= pos && pos < e);
+  };
+  const seen = [];
+  let sites = 0;
+  for (const m of src.matchAll(new RegExp(SPAWN.source, "g"))) {
+    const k = tokenAt(code, m.index);
+    // Prose in a string names no module or attribute a lookup by name could reach.
+    if (inText(m.index) && /\s/.test(src.slice(code[k].s, code[k].e))) continue;
+    sites++;
+    if (k < 0 || !spawnSite(code, k, py, seen)) return false;
+  }
+  if (sites > 0 && (gitEnv || (py ? pyAltersRun(code, masked, src) : jsAltersRun(code, masked)))) return false;
+  const gitWords = [...src.matchAll(new RegExp(GIT_WORD.source, "g"))];
+  if (sites === 0 && !(py ? STRING_RUNNERS.python.test(masked) : STRING_RUNNERS.node.test(src)) && gitWords.every((m) => tokenAt(comments, m.index) >= 0 || inText(m.index))) return true;
+  return gitWords.every((m) => tokenAt(comments, m.index) >= 0 || seen.some(([s, e]) => s <= m.index && m.index < e));
+}
+
+/**
+ * Whether python code may alter what a git call runs under. Only plain modules may load, `os`
+ * under its own name and through read-only members alone, and `open` only with a literal read
+ * mode, as every other module or member may write a file, the environment or the directory.
+ */
+function pyAltersRun(code, masked, src) {
+  if (PY_ALTERS.test(masked) || STRING_RUNNERS.python.test(masked)) return true;
+  if (code.some((t) => (t.fields ?? []).some(([s, e]) => /\b(?:os|open|import)\b/.test(src.slice(s, e))))) return true;
+  const imported = new Set();
+  const dotted = (j) => {
+    if (code[j]?.t !== "w") return null;
+    let name = code[j].v;
+    imported.add(j);
+    for (j++; isP(code[j], ".") && code[j + 1]?.t === "w"; j += 2) name += `.${code[j + 1].v}`;
+    return PY_PLAIN_MODULES.has(name.split(".")[0]) ? { name, end: j } : null;
+  };
+  for (let k = 0; k < code.length; k++) {
+    const t = code[k];
+    if (t.t !== "w") continue;
+    const head = k === 0 || t.nl || isP(code[k - 1], ";") || isP(code[k - 1], ":");
+    if (t.v === "from" && head) {
+      const mod = dotted(k + 1);
+      if (mod === null || mod.name === "os" || code[mod.end]?.v !== "import") return true;
+      k = mod.end;
+    } else if (t.v === "import") {
+      if (!head) return true;
+      for (let j = k + 1; ; ) {
+        const mod = dotted(j);
+        if (mod === null) return true;
+        j = mod.end;
+        if (code[j]?.v === "as") {
+          if (mod.name === "os") return true;
+          j += 2;
+        }
+        if (!isP(code[j], ",")) {
+          k = j - 1;
+          break;
+        }
+        j += isP(code[j + 1], "\\") ? 2 : 1;
+      }
+    } else if (t.v === "os" && !imported.has(k) && !isP(code[k - 1], ".") && !(isP(code[k + 1], ".") && PY_OS_READ.has(code[k + 2]?.v))) return true;
+    else if (t.v === "open" && !pyReadOpen(code, k)) return true;
+  }
+  return false;
+}
+
+/** Whether the `open` at code token `k` is the builtin called with a literal read mode and plain keywords. */
+function pyReadOpen(code, k) {
+  const args = isP(code[k - 1], ".") ? null : spawnArgs(code, k + 1);
+  if (args === null) return false;
+  let pos = 0;
+  return args.every(([s, e]) => {
+    const key = code[s].t === "w" && isP(code[s + 1], "=") && !isP(code[s + 2], "=") ? code[s].v : null;
+    if (isP(code[s], "*") || (key !== null && !PY_OPEN_KW.has(key))) return false;
+    const at = key === null ? pos++ : key === "mode" ? 1 : -1;
+    if (at !== 1) return at < 2;
+    const mode = strAt(code, key === null ? [s, e] : [s + 2, e]);
+    return mode !== null && /^[rbt]+$/.test(mode);
+  });
+}
+
+/**
+ * Whether node code may alter what a git call runs under: an environment, directory, file or
+ * code-loading name (every builtin module is a global under `node -e`), a `process` member
+ * outside the read-only ones, or a module other than the plain ones.
+ */
+function jsAltersRun(code, masked) {
+  if (JS_ALTERS.test(masked)) return true;
+  return code.some((t, k) => t.t === "s" && ((isP(code[k - 1], "(") && code[k - 2]?.v === "require") || (code[k - 1]?.t === "w" && /^(?:from|import)$/.test(code[k - 1].v))) && !JS_PLAIN_MODULES.test(t.v ?? ""));
+}
+
+/**
+ * Modules and names that run a string as code or a process beyond the dynamic forms: python
+ * names (read outside strings), node module names (read inside the literal a `require` takes).
+ */
+const STRING_RUNNERS = {
+  python: /\b(?:modules|pickle|cPickle|marshal|shelve|dill|ctypes|cffi|runpy|code|codeop|pty|timeit|doctest|pdb|bdb|cProfile|profile|trace|compile|setattr)\b/,
+  node: /(?:\brequire\s*\(\s*|\bfrom\s*)["'`](?:node:)?(?:vm|worker_threads|inspector|repl|wasi)["'`]|\bWorker\b/,
+};
+
+/**
+ * The code perl runs from its arguments: the `-e` and `-E` operands joined, or stdin when no
+ * script operand leads. Null for a script file, or for an option that loads or runs other code
+ * or that this reader does not know (`-M`, `-m`, `-I`, `-F`, `-d`, `-x`, `-C`).
+ */
+function perlCode(args, stdin) {
+  const codes = [];
+  let j = 0;
+  for (; j < args.length; j++) {
+    const a = args[j];
+    if (a === "--") {
+      j++;
+      break;
+    }
+    if (a === "-" || !a.startsWith("-")) break;
+    for (let p = 1; p < a.length; p++) {
+      const c = a[p];
+      if (c === "e" || c === "E") {
+        const v = p + 1 < a.length ? a.slice(p + 1) : args[++j];
+        if (v === undefined) return null;
+        codes.push(v);
+        break;
+      }
+      // `-i` takes the rest of its word as a backup suffix; `-0` and `-l` take digits.
+      if (c === "i") break;
+      if (c === "0" || c === "l") p += /^(?:x[\da-fA-F]+|[0-7]*)/.exec(a.slice(p + 1))[0].length;
+      else if (!"naplswWXtTUc".includes(c)) return null;
+    }
+  }
+  if (codes.length > 0) return codes.join("\n");
+  return j < args.length && args[j] !== "-" ? null : stdin;
+}
+
+/** Perl quote-like operators; `qx` runs a command. */
+const PERL_QUOTES = new Set(["q", "qq", "qw", "qx", "m", "qr", "s", "tr", "y"]);
+/** Perl words after which a `/` opens a match and a `<` a readline, not a division or comparison. */
+const PERL_TERM_AFTER = new Set("if unless while until and or not xor return split grep map join push unshift print printf say die warn x lt gt le ge eq ne cmp keys values each delete exists defined scalar ref length lc uc lcfirst ucfirst chomp chop sprintf sort reverse when".split(" "));
+const PERL_NAME = /[A-Za-z_]\w*(?:(?:::|')[A-Za-z_]\w*)*/y;
+const PERL_NUMBER = /0[xXbB][\da-fA-F_]+|\d[\d_]*(?:\.\d[\d_]*)?(?:[eE][+-]?\d+)?/y;
+const PERL_READLINE = /<\$?\w*>/y;
+/** Perl words after which the next word is a declared name. */
+const PERL_DECLARES = new Set(["sub", "package", "use", "no"]);
+/** What follows a `&` or `*` sigil that calls or names code perl reads by name. */
+const PERL_SIGIL_NAME = /^\s*(?:[${':]|(?:q|qq|qw|qx|m|qr|s|tr|y)\b)/;
+
+/** Whether a perl body interpolates code or any variable but a capture group (`$1`). */
+function perlInterpolates(body) {
+  for (let k = 0; k < body.length; k++) {
+    if (body[k] === "\\") k++;
+    else if (body[k] === "@") return true;
+    else if (body[k] === "$") {
+      const d = /^\d+/.exec(body.slice(k + 1));
+      if (d === null || /[[{:'$@-]/.test(body[k + 1 + d[0].length] ?? "")) return true;
+      k += d[0].length;
+    }
+  }
+  return false;
+}
+
+/**
+ * The end of the perl quote-like `op` whose delimiter is at `j`, or null when it can run code:
+ * `qx`, an `s///e`, a regex code block, an interpolating body holding any `$` or `@` but a
+ * capture group, or a second part this reader cannot place.
+ */
+function perlQuote(code, j, op) {
+  const parts = ["s", "tr", "y"].includes(op) ? 2 : 1;
+  const first = code[j];
+  const bodies = [];
+  let open = first;
+  for (let p = 0; p < parts; p++) {
+    const close = { "(": ")", "[": "]", "{": "}", "<": ">" }[open] ?? open;
+    let depth = 0;
+    let k = j + 1;
+    for (; k < code.length; k++) {
+      if (code[k] === "\\") k++;
+      else if (code[k] === open && close !== open) depth++;
+      else if (code[k] === close && depth-- === 0) break;
+    }
+    if (k >= code.length) return null;
+    bodies.push(code.slice(j + 1, k));
+    if (p + 1 < parts && close === open) j = k;
+    else {
+      j = k + 1;
+      if (p + 1 === parts) break;
+      while (/\s/.test(code[j] ?? "")) j++;
+      open = code[j];
+      if (open === undefined || /[\w#)\]}]/.test(open)) return null;
+    }
+  }
+  const flags = ["m", "qr", "s", "tr", "y"].includes(op) ? /^[a-zA-Z]*/.exec(code.slice(j))[0] : "";
+  if (op === "qx" || (op === "s" && flags.includes("e"))) return null;
+  if (["qq", "m", "qr", "s"].includes(op) && first !== "'" && bodies.some(perlInterpolates)) return null;
+  if (["m", "qr", "s"].includes(op) && /\(\?\??\{|\(\*\{/.test(bodies[0])) return null;
+  return j + flags.length;
+}
+
+/**
+ * Whether perl code holds no spawn form once its quoted texts are blanked. A lexer tracks whether
+ * a term or an operator comes next, so a `/`, `<`, `%` or quote is read as perl reads it; any
+ * construct it cannot place (a `=>`, a quote-like word after `-`, before a space or a closing
+ * bracket or where perl reads a name, a `/` after `}` or an unknown word, a string called through
+ * `->(` or `&`, an `__END__` or `__DATA__` that may be a hash key) refuses. Comments
+ * stay; heredocs, POD, backticks, an `open`, a `%SIG` handler and code that loads or evaluates
+ * other code are never inert.
+ */
+function perlInert(code) {
+  if (code == null || /<<\s*[~"'\w]|^=[a-zA-Z]|=>/m.test(code)) return false;
+  let out = "";
+  let state = "term";
+  let word = "";
+  let minus = false;
+  for (let i = 0; i < code.length; ) {
+    tick();
+    const c = code[i];
+    if (/\s/.test(c)) {
+      out += c;
+      i++;
+      continue;
+    }
+    if (c === "#") {
+      const nl = code.indexOf("\n", i);
+      const stop = nl < 0 ? code.length : nl;
+      out += code.slice(i, stop);
+      i = stop;
+      continue;
+    }
+    const term = state === "term" || (state === "word" && PERL_TERM_AFTER.has(word));
+    const afterMinus = minus;
+    minus = false;
+    let end = -1;
+    let next = "operator";
+    if (c === "$" || c === "@" || (c === "%" && term)) {
+      end = i + 1;
+      if (c === "$" && code[end] === "#") end++;
+      if (/[A-Za-z_]/.test(code[end] ?? "")) {
+        PERL_NAME.lastIndex = end;
+        PERL_NAME.test(code);
+        if (code.slice(end, PERL_NAME.lastIndex).includes("'")) return false;
+        end = PERL_NAME.lastIndex;
+      } else if (code[end] === "^") end += 2;
+      else if (/\d/.test(code[end] ?? "")) while (/\d/.test(code[end] ?? "")) end++;
+      else if (code[end] === "$" && /['"]/.test(code[end + 1] ?? "")) return false;
+      // `$'q` and `$::q` name a package variable, so the quote-like word after them is no quote.
+      else if (/^(?:'|::)\w/.test(code.slice(end, end + 3))) return false;
+      else if (code[end] !== "{" && code[end] !== "$" && end < code.length && !/\s/.test(code[end])) end++;
+      out += code.slice(i, end);
+    } else if (/\d/.test(c)) {
+      PERL_NUMBER.lastIndex = i;
+      PERL_NUMBER.test(code);
+      end = PERL_NUMBER.lastIndex;
+      out += code.slice(i, end);
+    } else if (/[A-Za-z_]/.test(c)) {
+      PERL_NAME.lastIndex = i;
+      PERL_NAME.test(code);
+      const w = code.slice(i, PERL_NAME.lastIndex);
+      if (w.includes("'")) return false;
+      // Perl ends the program at such a word only at a statement start; a hash key keeps running.
+      if (w === "__END__" || w === "__DATA__") return false;
+      // A quote-like word perl reads as a name: package-qualified, or after `sub`, `package`, `use`, `no`.
+      if (PERL_QUOTES.has(w.slice(w.lastIndexOf(":") + 1)) && (w.includes("::") || code.slice(i - 2, i) === "::" || (state === "word" && PERL_DECLARES.has(word)))) return false;
+      if (state === "arrow" || !PERL_QUOTES.has(w)) {
+        end = i + w.length;
+        out += w;
+        if (state !== "arrow") [next, word] = ["word", w];
+      } else {
+        const d = code[i + w.length];
+        if (afterMinus || d === undefined || /[\s)\]}]/.test(d)) return false;
+        end = perlQuote(code, i + w.length, w);
+        if (end === null) return false;
+        out += " ".repeat(end - i);
+      }
+    } else if (c === "'" || c === '"' || (c === "/" && state !== "operator")) {
+      if (c === "/" && !term) return false;
+      end = perlQuote(code, i, c === "'" ? "q" : c === '"' ? "qq" : "m");
+      if (end === null) return false;
+      out += " ".repeat(end - i);
+    } else if (c === "<" && state !== "operator") {
+      PERL_READLINE.lastIndex = i;
+      if (!term || !PERL_READLINE.test(code)) return false;
+      end = PERL_READLINE.lastIndex;
+      out += code.slice(i, end);
+    } else if (c === "`") return false;
+    else if (c === "%" && state !== "operator" && /[\w{$]/.test(code[i + 1] ?? "")) return false;
+    else if (c === "-" && code[i + 1] === ">") {
+      end = i + 2;
+      // A method looked up by name or a string called as code.
+      if (/^\s*[($&]/.test(code.slice(end))) return false;
+      out += "->";
+      next = "arrow";
+    } else {
+      // A sub or glob sigil names code by a string, a reference or a word read as a name, never a quote.
+      if ((c === "&" || c === "*") && state !== "operator" && PERL_SIGIL_NAME.test(code.slice(i + 1, i + 64))) return false;
+      end = i + (c === "/" && code[i + 1] === "/" ? 2 : 1);
+      out += code.slice(i, end);
+      next = c === ")" || c === "]" ? "operator" : c === "}" ? "brace" : "term";
+      minus = c === "-";
+    }
+    i = end;
+    state = next;
+  }
+  // `open` and `pipe` take their command inside a string, so no string of such code is data.
+  return !SPAWN_SCRIPT.test(out) && !REBIND.perl.test(out) && !/\b(?:open|sysopen|pipe|syscall|format|SIG)\b/.test(out);
+}
+
+/**
+ * Code and comment tokens; a string's `v` is null when an escape, an interpolation or a shell
+ * expansion makes its value unknown, and `pre` keeps the literal text before any interpolation.
+ * An f-string or template token lists its replacement fields as `fields`, and a node regular
+ * expression literal is an `r` token. Null when a string, field, regular expression or block
+ * comment never ends or cannot be placed: a `/` after `}` or `++`, a hashbang or an HTML-like
+ * comment node honors.
+ */
+function codeTokens(text, py) {
+  const code = [];
+  const comments = [];
+  const word = /[A-Za-z_$][\w$]*|\d[\w.]*/y;
+  const opens = [];
+  if (!py && text.startsWith("#!")) return null;
+  let nl = true;
+  for (let i = 0; i < text.length; ) {
+    tick();
+    const c = text[i];
+    if (/\s/.test(c)) {
+      nl ||= c === "\n";
+      i++;
+      continue;
+    }
+    if (!py && (text.startsWith("<!--", i) || (nl && text.startsWith("-->", i)))) return null;
+    const close = py ? (c === "#" ? "\n" : null) : text.startsWith("//", i) ? "\n" : text.startsWith("/*", i) ? "*/" : null;
+    if (close !== null) {
+      const end = text.indexOf(close, i + 1);
+      if (end < 0 && close === "*/") return null;
+      const e = end < 0 ? text.length : close === "*/" ? end + 2 : end;
+      comments.push({ s: i, e });
+      i = e;
+      continue;
+    }
+    const regex = !py && c === "/" ? regexStarts(code) : false;
+    if (regex === null) return null;
+    if (regex) {
+      const e = jsRegexEnd(text, i);
+      if (e < 0) return null;
+      code.push({ t: "r", s: i, e, v: null, nl });
+      i = e;
+      nl = false;
+      continue;
+    }
+    const str = scanString(text, i, py);
+    if (str === null) return null;
+    if (str !== undefined) {
+      const body = text.slice(str.body[0], str.body[1]);
+      const known = !/[\\$`]/.test(body) && !(str.fmt && /[{}]/.test(body));
+      const cut = str.fmt ? body.search(py ? /\{/ : /\$/) : -1;
+      const head = cut < 0 ? body : body.slice(0, cut);
+      const pre = known ? body : str.fmt && !/[\\$`]/.test(head) ? head : null;
+      code.push({ t: "s", s: i, e: str.end, v: known ? body : null, pre, nl, fields: str.fields });
+      i = str.end;
+    } else {
+      word.lastIndex = i;
+      const w = word.exec(text);
+      const tok = w ? { t: /^\d/.test(w[0]) ? "n" : "w", s: i, e: word.lastIndex, v: w[0], nl } : { t: "p", s: i, e: i + 1, v: c, nl };
+      if (c === "(") opens.push(code.length);
+      else if (c === ")") tok.open = opens.pop();
+      code.push(tok);
+      i = w ? word.lastIndex : i + 1;
+    }
+    nl = false;
+  }
+  return { code, comments };
+}
+
+const PY_PREFIX = /[rRbBuUfF]{1,2}(?=['"])/y;
+/** Node words after which a `/` opens a regular expression rather than dividing. */
+const JS_REGEX_AFTER = new Set("return typeof instanceof in of new delete void throw case do else yield await".split(" "));
+
+/** Whether a node `/` after `code` opens a regular expression; null when only the parse tree could tell. */
+function regexStarts(code) {
+  const prev = code[code.length - 1];
+  if (prev === undefined) return true;
+  if (prev.t !== "p") return prev.t === "w" && JS_REGEX_AFTER.has(prev.v);
+  if (prev.v === "]") return false;
+  if (prev.v === ")") {
+    const kw = code[prev.open - 1];
+    return kw?.t === "w" && ["if", "while", "for", "with"].includes(kw.v);
+  }
+  const before = code[code.length - 2];
+  if (prev.v === "}" || ((prev.v === "+" || prev.v === "-") && before?.t === "p" && before.v === prev.v && before.e === prev.s)) return null;
+  return true;
+}
+
+/** End of the node regular expression literal at `i`, flags included, or -1. */
+function jsRegexEnd(text, i) {
+  let cls = false;
+  for (let j = i + 1; j < text.length; j++) {
+    const c = text[j];
+    if (c === "\\") j++;
+    else if (c === "\n") return -1;
+    else if (c === "[") cls = true;
+    else if (c === "]") cls = false;
+    else if (c === "/" && !cls) {
+      let e = j + 1;
+      while (/[a-z]/i.test(text[e] ?? "")) e++;
+      return e;
+    }
+  }
+  return -1;
+}
+
+/**
+ * The string literal whose prefix or quote is at `i`: its end, body span and the spans of its
+ * replacement fields (python f-string `{...}`, node template `${...}`), each scanned as code so a
+ * nested string never ends the literal early. Undefined when no string starts at `i`; null when
+ * it never ends or a field cannot be read.
  */
-export function bashTargets(command) {
-  const tokens = [...command.matchAll(TOKEN)].map((m) => m[1]).filter((t) => !/\/node_modules\//.test(t));
-  if (tokens.length === 0) return [];
-  return WRITERS.test(command) ? [...new Set(tokens)] : [];
+function scanString(text, i, py) {
+  let p = i;
+  if (py) {
+    PY_PREFIX.lastIndex = i;
+    if (PY_PREFIX.test(text)) p = PY_PREFIX.lastIndex;
+  }
+  const q = text[p];
+  if (!(q === "'" || q === '"' || (!py && q === "`"))) return undefined;
+  const flags = text.slice(i, p);
+  const fmt = py ? /f/i.test(flags) : q === "`";
+  const raw = /r/i.test(flags);
+  const delim = py && text.startsWith(q.repeat(3), p) ? q.repeat(3) : q;
+  const fields = [];
+  for (let j = p + delim.length; j < text.length; j++) {
+    tick();
+    if (text.startsWith(delim, j)) return { end: j + delim.length, body: [p + delim.length, j], fmt, fields };
+    const c = text[j];
+    if (c === "\n" && delim === q && q !== "`") return null;
+    if (c === "\\") {
+      // In an f-string `\{` leaves the brace a field start, and `\N{...}` names a character.
+      if (fmt && py && text[j + 1] === "{") continue;
+      if (fmt && py && !raw && text.startsWith("N{", j + 1)) {
+        j = text.indexOf("}", j);
+        if (j < 0) return null;
+      } else j++;
+      continue;
+    }
+    if (!fmt || !(py ? c === "{" : c === "$" && text[j + 1] === "{")) continue;
+    if (py && text[j + 1] === "{") {
+      j++;
+      continue;
+    }
+    const s = py ? j + 1 : j + 2;
+    const e = fieldEnd(text, s, py);
+    if (e < 0) return null;
+    fields.push([s, e]);
+    j = e;
+  }
+  return null;
+}
+
+/**
+ * The `}` closing the replacement field whose code starts at `s`, past nested strings, brackets
+ * and a python format spec; -1 when the field holds a comment, a node `/` or backslash, or never
+ * closes.
+ */
+function fieldEnd(text, s, py) {
+  let depth = 0;
+  for (let j = s; j < text.length; j++) {
+    tick();
+    const c = text[j];
+    if ((py && c === "#") || (!py && (c === "/" || c === "\\"))) return -1;
+    // A prefix letter inside a longer name opens no string.
+    const str = /[A-Za-z]/.test(c) && /\w/.test(text[j - 1] ?? "") ? undefined : scanString(text, j, py);
+    if (str === null) return -1;
+    if (str !== undefined) {
+      j = str.end - 1;
+      continue;
+    }
+    if (py && depth === 0 && c === ":") {
+      for (let k = j + 1; k < text.length; k++) {
+        if (text[k] === "}") return k;
+        if (text[k] !== "{") continue;
+        k = fieldEnd(text, k + 1, py);
+        if (k < 0) return -1;
+      }
+      return -1;
+    }
+    if ("([{".includes(c)) depth++;
+    else if (c === ")" || c === "]") depth--;
+    else if (c === "}" && depth-- === 0) return j;
+  }
+  return -1;
+}
+
+/** Index of the token covering `pos`, or -1. */
+function tokenAt(toks, pos) {
+  let lo = 0;
+  let hi = toks.length - 1;
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1;
+    if (toks[mid].e <= pos) lo = mid + 1;
+    else if (toks[mid].s > pos) hi = mid - 1;
+    else return mid;
+  }
+  return -1;
+}
+
+function isP(tok, ch) {
+  return tok?.t === "p" && tok.v === ch;
+}
+
+/** Index of the bracket closing the one at `open`, or -1 when brackets mismatch or never close. */
+function closeOf(code, open) {
+  const want = [];
+  for (let k = open; k < code.length; k++) {
+    if (code[k].t !== "p") continue;
+    const i = "([{".indexOf(code[k].v);
+    if (i >= 0) want.push(")]}"[i]);
+    else if (")]}".includes(code[k].v)) {
+      if (want.pop() !== code[k].v) return -1;
+      if (want.length === 0) return k;
+    }
+  }
+  return -1;
+}
+
+/** Token ranges [s, e) between top-level commas of `code[s..e)`. */
+function splitTop(code, s, e) {
+  const out = [];
+  let depth = 0;
+  let from = s;
+  for (let k = s; k < e; k++) {
+    const v = code[k].t === "p" ? code[k].v : "";
+    if (v !== "" && "([{".includes(v)) depth++;
+    else if (v !== "" && ")]}".includes(v)) depth--;
+    else if (v === "," && depth === 0) {
+      if (k > from) out.push([from, k]);
+      from = k + 1;
+    }
+  }
+  if (e > from) out.push([from, e]);
+  return out;
+}
+
+function spawnArgs(code, open) {
+  const close = isP(code[open], "(") ? closeOf(code, open) : -1;
+  return close < 0 ? null : splitTop(code, open + 1, close);
+}
+
+function strAt(code, [s, e]) {
+  return e - s === 1 && code[s].t === "s" ? code[s].v : null;
+}
+
+/**
+ * Elements of a list, tuple or array (a known string, or `{ prefix }` when built at run time) and
+ * the source spans the argv vouches for, so a git word inside a run-time term stays unexplained.
+ */
+function listAt(code, [s, e]) {
+  if (!(isP(code[s], "[") || isP(code[s], "(")) || closeOf(code, s) !== e - 1) return null;
+  const argv = [];
+  const spans = [];
+  let at = s + 1;
+  for (const r of splitTop(code, s + 1, e - 1)) {
+    const item = r[0] === at ? elemAt(code, r) : null;
+    if (item === null) return null;
+    argv.push(item);
+    spans.push([code[r[0]].s, code[typeof item === "string" ? r[1] - 1 : r[0]].e]);
+    at = r[1] + 1;
+  }
+  return { argv, spans };
+}
+
+/** A known string, or `{ prefix }` for a literal joined by `+` to primaries (never `?:`, `or`, `if`) or interpolated. */
+function elemAt(code, [s, e]) {
+  const t = code[s];
+  if (t.t !== "s") return null;
+  if (e - s === 1 && t.v !== null) return t.v;
+  return t.pre && (e - s === 1 || (isP(code[s + 1], "+") && termsAt(code, s + 2, e))) ? { prefix: t.pre } : null;
+}
+
+/** Whether `code[k..e)` is primaries (a name, string, number or group with member, call or index suffixes) joined by `+`. */
+function termsAt(code, k, e) {
+  const group = (j) => (isP(code[j], "(") || isP(code[j], "[") ? closeOf(code, j) : -1);
+  for (;;) {
+    if (k >= e) return false;
+    if (["w", "s", "n"].includes(code[k].t)) k++;
+    else if (group(k) > k && group(k) < e) k = group(k) + 1;
+    else return false;
+    for (;;) {
+      if (k + 1 < e && isP(code[k], ".") && code[k + 1].t === "w") k += 2;
+      else if (group(k) > k && group(k) < e) k = group(k) + 1;
+      else break;
+    }
+    if (k === e) return true;
+    if (!isP(code[k], "+")) return false;
+    k++;
+  }
+}
+
+/**
+ * Whether the spawn name at code token `k` is an import or a constant, or opens a read-only git
+ * spawn call; a shell string is never one, as a shell may run more than its text shows.
+ */
+function spawnSite(code, k, py, seen) {
+  const tok = code[k];
+  const v = tok.t === "w" ? tok.v : null;
+  const member = (j) => (isP(code[j + 1], ".") && code[j + 2]?.t === "w" ? code[j + 2].v : null);
+  if (py) {
+    if (v !== "subprocess") return false;
+    const name = member(k);
+    if (name === null) return pyImport(code, k);
+    return PY_CONSTS.has(name) || (PY_ARGV.has(name) && pyCall(code, k + 3, seen));
+  }
+  if (tok.t === "s") return /^(?:node:)?child_process$/.test(tok.v ?? "") && jsModule(code, k, seen);
+  const recv = v === "child_process";
+  const name = recv ? member(k) : v;
+  if (recv && name === null) return /^(?:const|let|var)$/.test(code[k - 1]?.v ?? "") && isP(code[k + 1], "=");
+  if (!JS_ARGV.has(name) && !JS_SHELL.has(name)) return false;
+  const at = recv ? k + 2 : k;
+  return isP(code[at + 1], "(") ? jsCall(code, at + 1, name, seen) : !recv && jsDestructured(code, k);
+}
+
+/** Whether `subprocess` at `k` is a plain import, or `from subprocess import` of constants only. */
+function pyImport(code, k) {
+  if (code[k - 1]?.v === "from" && code[k + 1]?.v === "import") {
+    for (let j = isP(code[k + 2], "(") ? k + 3 : k + 2; ; j += 2) {
+      if (code[j]?.t !== "w" || !PY_CONSTS.has(code[j].v)) return false;
+      if (!isP(code[j + 1], ",")) return true;
+    }
+  }
+  let j = k;
+  while (isP(code[j - 1], ",") && code[j - 2]?.t === "w") j -= 2;
+  return code[j - 1]?.v === "import" && (code[j - 1].nl || isP(code[j - 2], ";")) && code[k + 1]?.v !== "as";
+}
+
+/** Whether the module string at `k` is bound only to spawn names, or to an alias whose every use is a judged spawn call. */
+function jsModule(code, k, seen) {
+  const required = isP(code[k - 1], "(") && code[k - 2]?.v === "require" && isP(code[k + 1], ")");
+  if (!required && !(code[k - 1]?.t === "w" && code[k - 1].v === "from")) return false;
+  const spawnAt = (j) => (JS_ARGV.has(code[j + 1]?.v) || JS_SHELL.has(code[j + 1]?.v)) && isP(code[j], ".") && isP(code[j + 2], "(") && jsCall(code, j + 2, code[j + 1].v, seen);
+  if (required && isP(code[k + 2], ".")) return spawnAt(k + 2);
+  if (required && !isP(code[k - 3], "=")) return false;
+  const target = required ? k - 4 : k - 2;
+  if (isP(code[target], "}")) {
+    let j = target - 1;
+    for (; code[j]?.t === "w" || isP(code[j], ","); j--) if (code[j].t === "w" && !JS_ARGV.has(code[j].v) && !JS_SHELL.has(code[j].v)) return false;
+    return isP(code[j], "{");
+  }
+  const alias = code[target]?.t === "w" ? code[target].v : null;
+  return alias !== null && code.every((t, j) => j === target || t.t !== "w" || t.v !== alias || isP(code[j - 1], ".") || spawnAt(j + 1));
+}
+
+/** Whether a destructuring of a spawn name from `require(...)` or an `import {...} from` holds `k`. */
+function jsDestructured(code, k) {
+  let a = k;
+  let b = k;
+  while (isP(code[a - 1], ",") && code[a - 2]?.t === "w") a -= 2;
+  while (isP(code[b + 1], ",") && code[b + 2]?.t === "w") b += 2;
+  if (isP(code[b + 1], ",")) b++;
+  if (!isP(code[a - 1], "{") || !isP(code[b + 1], "}")) return false;
+  const next = code[b + 2];
+  return (isP(next, "=") && code[b + 3]?.v === "require") || (next?.t === "w" && next.v === "from");
+}
+
+/** Python spawn call: one argv list, and only keywords that pick neither the program, a shell, the environment nor the directory. */
+function pyCall(code, open, seen) {
+  const args = spawnArgs(code, open);
+  if (args === null) return false;
+  const pos = [];
+  for (const r of args) {
+    const [s, e] = r;
+    const key = code[s].t === "w" && isP(code[s + 1], "=") && !isP(code[s + 2], "=") ? code[s].v : null;
+    if (key === null || key === "args") pos.push(key === null ? r : [s + 2, e]);
+    else if (key === "shell" ? !(e - s === 3 && code[s + 2].v === "False") : !PY_KW.has(key)) return false;
+  }
+  return pos.length === 1 && argvRead(code, pos[0], seen);
+}
+
+/** Node spawn call: program, argv array and an options object with no env, shell or cwd; a callback last. */
+function jsCall(code, open, name, seen) {
+  const args = JS_SHELL.has(name) ? null : spawnArgs(code, open);
+  if (args === null || args.length === 0) return false;
+  const list = args[1] !== undefined ? listAt(code, args[1]) : null;
+  let opts = args.slice(list ? 2 : 1);
+  // A callback's own spawns and git words are judged where they stand.
+  if (name === "execFile" && opts.length > 0 && !isP(code[opts.at(-1)[0]], "{")) opts = opts.slice(0, -1);
+  if (opts.length > 1 || (opts.length === 1 && !jsOptions(code, opts[0]))) return false;
+  const program = strAt(code, args[0]);
+  if (program === null || !gitArgvReadOnly([program, ...(list?.argv ?? [])])) return false;
+  seen.push([code[args[0][0]].s, code[args[0][1] - 1].e], ...(list?.spans ?? []));
+  return true;
+}
+
+function jsOptions(code, [s, e]) {
+  if (!isP(code[s], "{") || !isP(code[e - 1], "}")) return false;
+  return splitTop(code, s + 1, e - 1).every(([a, b]) => {
+    const key = code[a].t === "w" || code[a].t === "s" ? code[a].v : null;
+    if (key === null || !isP(code[a + 1], ":")) return false;
+    if (key === "shell") return b - a === 3 && code[a + 2].v === "false";
+    return JS_KW.has(key);
+  });
+}
+
+/** Whether the argv list at range `r` is a read-only git call. */
+function argvRead(code, r, seen) {
+  const list = listAt(code, r);
+  if (list === null || !gitArgvReadOnly(list.argv)) return false;
+  seen.push(...list.spans);
+  return true;
+}
+
+/**
+ * Whether an argv is git with only safe `-c` globals and a read-only subcommand. A run-time
+ * operand after the subcommand passes on a non-empty prefix without a leading `-`, as every
+ * option that writes a file or runs a program starts with one.
+ */
+function gitArgvReadOnly(argv) {
+  const lit = (a) => typeof a === "string";
+  if (argv.length === 0 || !lit(argv[0]) || !GIT_PROGRAM.test(argv[0])) return false;
+  if (argv.some((a) => lit(a) && INTERP_GIT_BANNED.test(a))) return false;
+  let j = 1;
+  for (; lit(argv[j]) && argv[j].startsWith("-"); j += 2) {
+    const value = argv[j + 1];
+    const eq = lit(value) ? value.indexOf("=") : -1;
+    if (argv[j] !== "-c" || eq <= 0 || !safeKey(value.slice(0, eq).toLowerCase(), value.slice(eq + 1))) return false;
+  }
+  const [sub, ...rest] = argv.slice(j);
+  if (!lit(sub)) return false;
+  // `--text` is its own option, not an abbreviation of `--textconv`; `--filters` runs configured filters.
+  const writes = (a) => INTERP_GIT_WRITES.test(a) || longOpt(a, ["output", "open-files-in-pager", "ext-diff", "filters", "no-index"]) || (a !== "--text" && longOpt(a, ["textconv"]));
+  if (rest.some((a) => (lit(a) ? writes(a) : a.prefix === "" || a.prefix.startsWith("-")))) return false;
+  return sub === "branch" ? rest.includes("--list") && rest.every((a) => !lit(a) || !a.startsWith("-") || BRANCH_LIST.test(a)) : INTERP_GIT_READ.has(sub);
+}
+
+/** Whether find runs a shell that only parses: `-n` set last, no `-i`/`-o`, no `+` start path. */
+function syntaxOnly(cmd, findArgs) {
+  if (!SHELLS.test(cmd[0] ?? "")) return false;
+  for (const a of findArgs) {
+    if (/^[-(!]/.test(a)) break;
+    if (a.startsWith("+")) return false;
+  }
+  let n = false;
+  for (let j = 1; j < cmd.length && /^[-+]./.test(cmd[j]) && cmd[j] !== "--"; j++) {
+    const a = cmd[j];
+    if (/^--(?:rcfile|init-file)$/.test(a)) j++;
+    else if (!a.startsWith("--")) {
+      if (/[ioO]/.test(a)) return false;
+      if (a.includes("n")) n = a[0] === "-";
+    }
+  }
+  return n;
+}
+
+/**
+ * Git guard reason for a shell or `source`: inline code, a heredoc or a pipe. Inline code xargs or
+ * find runs is judged with the `input` placeholder as an opaque non-git operand; producer text is
+ * never pasted into it, and code the input itself supplies is not judged.
+ * @param {string | null | false | undefined} [input] The xargs placeholder string, or none.
+ */
+function shellDenial(name, args, io, words, depth, ctx, appended, input = undefined) {
+  let j = 0;
+  let inline = false;
+  let fromStdin = false;
+  for (; SHELLS.test(name) && j < args.length && /^[-+]/.test(args[j]); j++) {
+    const a = args[j];
+    if (a === "--" || a === "-") {
+      fromStdin ||= a === "-";
+      j++;
+      break;
+    }
+    if (/^[-+][oO]$|^--(?:rcfile|init-file)$/.test(a)) j++;
+    else if (/^-[a-zA-Z]*c/.test(a)) inline = true;
+    else if (/^-[a-zA-Z]*s/.test(a)) fromStdin = true;
+  }
+  if (appended) {
+    // A placeholder inside the options would make the input part of the shell's own arguments.
+    if (!inline || args[j] === undefined || (input && args.slice(0, j).some((a) => a.includes(input)))) return null;
+    return codeDenial(input ? args[j].replaceAll(input, XARGS_INPUT) : args[j], depth + 1, ctx);
+  }
+  const run = (t) => codeDenial(t, depth + 1, ctx);
+  const fed = bodyDenial(shellBody([name, ...args], io, ctx), run);
+  if (fed !== null) return fed;
+  if (inline) return args[j] === undefined ? null : run(args[j]);
+  const script = fromStdin ? undefined : args[j];
+  const piped = script === undefined || script === "-" || STDIN_PATH.test(script);
+  return piped && io.stdin !== null ? codeDenial(io.stdin, depth + 1, ctx) : null;
+}
+
+/** Git guard reason for each text of a reader's body the line shows. */
+function bodyDenial(body, judge) {
+  if (body === null) return null;
+  for (const t of body.texts) {
+    const found = judge(unmark(t));
+    if (found !== null) return found;
+  }
+  return null;
+}
+
+/** Config keys that run a program or load config besides GIT_PROGRAM_KEY (lowercase). */
+const CODE_KEY = /^(?:core\.(?:hookspath|fsmonitor|sshcommand)|include(?:if)?\..+)$/;
+
+/** Whether config `key` (lowercase) set to `value` (null when unknown) runs code whatever verb follows: an alias to a shell command, a program, a hook path or an include. */
+function runsCode(key, value) {
+  if (key.startsWith("alias.")) return value === null || /[$`]/.test(value) || value.trimStart().startsWith("!");
+  return (GIT_PROGRAM_KEY.test(key) || CODE_KEY.test(key)) && !safeKey(key, value);
+}
+
+/**
+ * Whether a `-c` or `--config-env` entry runs code whatever verb follows. A valued entry gets the
+ * key rules direct git applies; a value-less one sets its key to true, which names no program, so
+ * only an alias or a key read as a hook or path counts. A key an expansion builds takes its line
+ * values and default operand; one the line does not fill may be any key when a value is set, while
+ * a lone unknown word (`-c $CFG`, as other tools take it) names no key at all.
+ */
+function entryCode(entry, env, ctx) {
+  const eq = entry.indexOf("=");
+  const value = env ? null : eq < 0 ? "" : entry.slice(eq + 1);
+  const keys = keyFill(eq < 0 ? entry : entry.slice(0, eq), ctx);
+  if (keys === null) return env || eq >= 0;
+  return keys.some((k) => {
+    const key = k.toLowerCase();
+    if (key.startsWith("alias.") || (eq < 0 && !env)) return runsCode(key, value);
+    return CONFIG_KEY.test(key) && !safeKey(key, value);
+  });
+}
+
+/** Keys a config key word spells with each `$name`, `${name}` or `${name:-default}` filled by its literal line values; null when a part stays unknown. */
+function keyFill(key, ctx) {
+  if (!/[$`]/.test(key)) return [key];
+  if (ctx === undefined) return null;
+  let out = [""];
+  let last = 0;
+  for (const m of key.matchAll(/\$\{([A-Za-z_]\w*)(?::?[-=]([^$`{}]*))?\}|\$([A-Za-z_]\w*)/g)) {
+    const name = m[1] ?? m[3];
+    const values = SHELL_SET.test(name) ? null : lineValues(name, ctx);
+    if (!values?.length || values.some((v) => /[$`]/.test(v))) return null;
+    const alts = [...values.map((v) => v.replace(/['"\\]/g, "")), ...(m[2] === undefined ? [] : [m[2]])];
+    out = out.flatMap((o) => alts.map((v) => o + key.slice(last, m.index) + v));
+    last = m.index + m[0].length;
+    if (out.length > MAX_VARIANTS) return null;
+  }
+  out = out.map((o) => o + key.slice(last));
+  return out.some((o) => /[$`]/.test(o)) ? null : out;
+}
+
+/** Leading git options of `args`: the argv git reads them as, aliases their entries define, the index past them and whether an entry runs code. */
+function gitOptions(args, ctx = undefined) {
+  const kept = [];
+  const aliases = new Set();
+  let code = false;
+  let j = 0;
+  for (; j < args.length && args[j].startsWith("-"); j++) {
+    const a = args[j];
+    const env = a === "--config-env" || a.startsWith("--config-env=");
+    code ||= a.startsWith("--exec-path=");
+    // A glued entry is read as git reads it.
+    const entry = /^-c./.test(a) ? a.slice(2) : a === "-c" || a === "--config-env" ? (args[++j] ?? "") : env ? a.slice(a.indexOf("=") + 1) : null;
+    if (entry === null) {
+      kept.push(a);
+      if (GIT_VALUED.test(a)) kept.push(args[++j] ?? "");
+      continue;
+    }
+    kept.push(...(env ? ["--config-env", entry] : ["-c", entry]));
+    const eq = entry.indexOf("=");
+    const key = (eq < 0 ? entry : entry.slice(0, eq)).toLowerCase();
+    code ||= entryCode(entry, env, ctx);
+    if (key.startsWith("alias.")) aliases.add(key.slice(6));
+  }
+  return { kept, aliases, at: j, code };
+}
+
+/** Git guard reason for stdin code: a quoted heredoc to a modelled interpreter keeps its spawn rules; ssh runs it as shell code, and another language's code is not judged. */
+function readerDenial(name, words, text, depth, ctx, appended, unaliased) {
+  if (name === "ssh") return codeDenial(text, depth + 1, ctx);
+  if (!INTERPRETERS.test(name) && name !== "ruby") return null;
+  const doc = [...words, "<<", text];
+  QUOTED_DOCS.set(doc, new Set([...(QUOTED_DOCS.get(words) ?? []), doc.length - 1]));
+  return gitDenial(doc, depth + 1, ctx, appended, unaliased);
+}
+
+/** Git guard reason for code parsed again. */
+function codeDenial(text, depth, ctx, appended = false) {
+  const outer = ctx.code;
+  ctx.code = true;
+  try {
+    return gitCheck(text, depth, ctx, appended);
+  } finally {
+    ctx.code = outer;
+  }
+}
+
+/** Git guard reason for a command line, or null; a line it cannot split, a longer one or one nested past MAX_DEPTH allows. */
+function gitCheck(text, depth, ctx, appended = false) {
+  if (depth > MAX_DEPTH) return null;
+  const cmds = text.length <= MAX_CHARS ? splitCommands(text) : null;
+  if (cmds === null) return null;
+  for (const [i, words] of cmds.entries()) {
+    // Quoted text of interpreter code is code, judged by the interpreter rule, not a substitution.
+    const head = words.findIndex((w) => !ASSIGN.test(w));
+    const code = head >= 0 && (INTERPRETERS.test(path.posix.basename(words[head])) || path.posix.basename(words[head]) === "ruby") ? LITERALS.get(words) : undefined;
+    const plain = (w, k) => (k > head ? (code?.get(k) ?? []) : []).reduce((s, [a, b]) => s.slice(0, a) + " ".repeat(b - a) + s.slice(b), w);
+    for (const inner of words.flatMap((w, k) => (QUOTED_DOCS.get(words)?.has(k) ? [] : substitutions(plain(w, k), true)))) {
+      const found = gitCheck(inner, depth + 1, ctx);
+      if (found !== null) return found;
+    }
+    const outer = ctx.feed;
+    ctx.feed = pipedFrom(cmds, i);
+    try {
+      const found = gitDenial(words, depth, ctx, appended);
+      if (found !== null) return found;
+    } finally {
+      ctx.feed = outer;
+    }
+  }
+  return null;
+}
+
+/** The simple command whose output `cmds[i]` reads through a pipe, or null. */
+function pipedFrom(cmds, i) {
+  return i > 0 && PLACES.get(cmds[i])?.piped && PLACES.get(cmds[i - 1])?.next === "|" ? cmds[i - 1] : null;
+}
+
+/** Whether `a` is flags ending in a valued letter (`sudo -nu x`, `env -i0u X`); only env has a digit flag, and its `-S` stays a split string. */
+function valuedCluster(name, a) {
+  const [valued, flags] = WRAPPERS.get(name) ?? [];
+  if (!valued || !flags || !(name === "env" ? /^-[A-Za-z\d]{2,}$/ : /^-[A-Za-z]{2,}$/).test(a) || (name === "env" && a.endsWith("S"))) return false;
+  return valued.test(`-${a.at(-1)}`) && [...a.slice(1, -1)].every((f) => flags.test(`-${f}`) && !valued.test(`-${f}`));
+}
+
+/** `text` with INVISIBLE code points as `\u{XXXX}` (diagnosable, unlike stripping), capped at `max`. */
+export function visible(text, max = 200) {
+  const parts = Array.from(String(text), (c) => (INVISIBLE.test(c) ? `\\u{${c.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")}}` : c));
+  const whole = parts.join("");
+  if (whole.length <= max) return whole;
+  let out = "";
+  for (const p of parts) {
+    if (out.length + p.length > max - 1) break;
+    out += p;
+  }
+  return `${out}\u2026`;
 }
 
 /**
- * Whether a marker file is present and unexpired.
- * @param {string} file Marker path.
- * @param {number} ttlMin Default lifetime from mtime, in minutes.
- * @param {number} now Reference time (ms).
+ * Marker state; `ttlMin` is the lifetime from mtime unless the body sets an expiry.
  * @returns {"valid" | "expired" | "absent"} State.
  */
 export function markerState(file, ttlMin, now = Date.now()) {
@@ -82,6 +4125,8 @@ export function markerState(file, ttlMin, now = Date.now()) {
   } catch {
     return "absent";
   }
+  // `mkdir` can create the marker path; only a regular file counts.
+  if (!stat.isFile()) return "absent";
   let expires = stat.mtimeMs + ttlMin * 60_000;
   try {
     const body = fs.readFileSync(file, "utf8").trim();
@@ -93,70 +4138,87 @@ export function markerState(file, ttlMin, now = Date.now()) {
   return now < expires ? "valid" : "expired";
 }
 
-/**
- * Candidate marker paths for a payload: project first, then user.
- * @param {Record<string, any>} payload Hook payload.
- * @returns {string[]} Absolute paths.
- */
+/** Candidate absolute marker paths for a hook payload: project first, then user. */
 export function markerPaths(payload) {
   const project = process.env.CLAUDE_PROJECT_DIR || (typeof payload.cwd === "string" && payload.cwd ? payload.cwd : process.cwd());
   return [path.join(project, ".freeharness", MARKER), path.join(os.homedir(), ".claude", "freeharness", MARKER)];
 }
 
+/** PreToolUse deny response carrying `reason`. */
+function deny(reason) {
+  return { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: reason } };
+}
+
+/** Git guard reason for a Bash command, or null. */
+function gitGuard(command, loc) {
+  if ((process.env.FREEHARNESS_HOOK_GIT_GUARD || "").toLowerCase() === "off") return null;
+  return gitCheck(command, 0, gitLine(command, loc));
+}
+
 /**
- * Builds the deny response for a PreToolUse payload, or null to allow.
- * @param {Record<string, any>} payload Parsed hook payload.
- * @param {{ttlMin:number}} opts Options.
- * @returns {Record<string, unknown> | null} JSON to print, or null.
+ * Deny response for a parsed PreToolUse payload, or null to allow. The git guard runs first:
+ * no marker opens it, so its reason is the one the user can act on. The guard is a second layer
+ * under the host's permission layer, so a passed deadline, any throw while judging or reading
+ * markers, and a non-string command allow. A command past MAX_COMMAND_BYTES allows before any
+ * pattern runs: no judgment of it fits the hook timeout. --fault respond, argv no session sets,
+ * throws inside the judgment so a test proves the throw allows.
+ * @param {object} payload
+ * @param {{ ttlMin: number, judgeMs?: number, fault?: string }} opts judgeMs defaults to MAX_JUDGE_MS.
  */
 export function respond(payload, opts) {
-  const tool = String(payload.tool_name || "");
-  const input = payload.tool_input && typeof payload.tool_input === "object" ? payload.tool_input : {};
-  let targets = [];
-  if (/^(Edit|Write|MultiEdit|NotebookEdit)$/.test(tool)) {
-    const file = input.file_path || input.notebook_path || input.path || "";
-    if (file && isProtectedPath(String(file))) targets = [String(file)];
-  } else if (tool === "Bash") {
-    targets = bashTargets(typeof input.command === "string" ? input.command : "");
-  }
-  if (targets.length === 0) return null;
-  const markers = markerPaths(payload);
-  const states = markers.map((m) => markerState(m, opts.ttlMin));
-  if (states.includes("valid")) return null;
-  const expired = states.findIndex((s) => s === "expired");
-  const why = expired >= 0 ? `marker expired: ${markers[expired]}` : `no marker at ${markers[0]}`;
-  return {
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "deny",
-      permissionDecisionReason:
-        `FreeHarness config guard: ${targets.join(", ")} is harness configuration (cache invalidator: settings, MCP, hooks, CLAUDE.md); ${why}. ` +
+  try {
+    if (opts.fault === "respond") throw new Error("forced fault");
+    const tool = String(payload.tool_name || "");
+    const input = payload.tool_input && typeof payload.tool_input === "object" ? payload.tool_input : {};
+    let targets = [];
+    if (/^(Edit|Write|MultiEdit|NotebookEdit)$/.test(tool)) {
+      const file = input.file_path || input.notebook_path || input.path || "";
+      if (file && isProtectedPath(String(file), defaultEnv(payload))) targets = [String(file)];
+    } else if (tool === "Bash") {
+      if (input.command != null && typeof input.command !== "string") return null;
+      const command = input.command ?? "";
+      if (Buffer.byteLength(command, "utf8") > MAX_COMMAND_BYTES) return null;
+      deadline = performance.now() + (opts.judgeMs ?? MAX_JUDGE_MS);
+      const git = gitGuard(command, defaultEnv(payload));
+      if (git !== null) return deny(git);
+      targets = judgeBash(command, defaultEnv(payload));
+      deadline = Infinity;
+    }
+    if (targets.length === 0) return null;
+    const markers = markerPaths(payload);
+    const states = markers.map((m) => markerState(m, opts.ttlMin));
+    if (states.includes("valid")) return null;
+    const expired = states.findIndex((s) => s === "expired");
+    const why = expired >= 0 ? `marker expired: ${visible(markers[expired])}` : `no marker at ${visible(markers[0])}`;
+    const more = targets.length > MAX_NAMED ? ` and ${targets.length - MAX_NAMED} more` : "";
+    return deny(
+      `FreeHarness config guard: ${targets.slice(0, MAX_NAMED).map((t) => visible(t)).join(", ")}${more} is live harness configuration (it runs code or loads instructions in every session); ${why}. ` +
         `Ask the user to open a ${opts.ttlMin}-minute window from a terminal: \`mkdir -p .freeharness && touch .freeharness/${MARKER}\` (project) or \`touch ~/.claude/freeharness/${MARKER}\` (user), then retry. ` +
         "Do not create the marker yourself, and do not route the edit through another tool.",
-    },
-  };
+    );
+  } catch {
+    return null;
+  } finally {
+    deadline = Infinity;
+  }
 }
 
-/** Entry point: read stdin, deny or stay silent, exit 0. */
+/** Silence is an allow: input that cannot be read, parsed or judged writes no decision. */
 function main() {
   if ((process.env.FREEHARNESS_HOOK_CONFIG_GUARD || "").toLowerCase() === "off") return;
-  let payload = {};
-  try {
-    const raw = fs.readFileSync(0, "utf8");
-    if (raw.trim()) payload = JSON.parse(raw);
-  } catch {
-    return;
-  }
-  if (!payload || typeof payload !== "object") return;
+  let out = null;
   try {
-    const out = respond(payload, parseOptions(process.argv.slice(2)));
-    if (out) process.stdout.write(JSON.stringify(out));
+    const payload = JSON.parse(fs.readFileSync(0, "utf8"));
+    if (payload !== null && typeof payload === "object" && !Array.isArray(payload)) out = respond(payload, parseOptions(process.argv.slice(2)));
   } catch (e) {
     process.stderr.write(`freeharness-config-guard: ${e instanceof Error ? e.message : String(e)}\n`);
   }
+  if (out) process.stdout.write(JSON.stringify(out));
 }
 
 if (process.argv[1] && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url))) {
+  // exit() would cut a pending pipe write short; EPIPE is ignored.
+  process.stdout.on("error", () => {});
+  process.stderr.on("error", () => {});
   main();
-  process.exit(0);
 }