omakit 0.4.2 → 0.5.0

package/tools/inspect/patterns.mjs

@@ -0,0 +1,355 @@
+// The review patterns of docs/INSPECT.md as data: for each class the
+// marketplace's human review raised in the M11 sample, a precondition over
+// the observed facts, the measurement it cites and the share it prints. A
+// pattern row prints only where the precondition is met, in two lines: the
+// observation with its sites, then "about N of every 100 review findings in
+// the sample (M11)". Never "missing", "should" or "fix": the row names the
+// observation and the frequency and stops. A pattern without a number does
+// not ship; tests/unit/submit.test.mjs holds every entry here to a
+// measurement that names a section of docs/MEASUREMENTS.md and a numeric
+// share, the way it holds every submit check to a why.
+//
+// The shares are the maintainer's review findings by class in a fixed
+// 30-issue sample, one reader's classification, dated 2026-09-12
+// (docs/evidence/inspect/2026-09-12-review-classes.json). They say how
+// often reviewers raised a class, never how likely this plugin is to be
+// blocked, and nothing here turns a share into a verdict.
+//
+// Nothing here restates a marketplace rule (AGENTS.md, rule 2). The
+// `supply-chain` pattern detects nothing itself: it cites the findings the
+// pinned baseline recorded and does not list as selectively blocking, which
+// at the current pin are its three unpinned-remote-source rules, read
+// through verify and the pinned policy rather than named here.
+
+import { basename, blankComments, blocks, lineOf, propertyValue } from "./text.mjs"
+import { toolOf } from "./processes.mjs"
+
+const SAMPLE = "30-issue sample"
+const site = (row) => ({ file: row.file, line: row.line })
+const sites = (rows) => rows.map((row) => `${row.file}:${row.line}`).join(", ")
+const plural = (count, word, words = `${word}s`) => `${count} ${count === 1 ? word : words}`
+
+/** A short flag, alone or inside a cluster: `-q`, `-fsq`; or its long form. */
+function hasFlag(flags, letter, long = null) {
+  return flags.some((flag) => flag === `-${letter}` || (long && (flag === long || flag.startsWith(`${long}=`))) || (/^-[A-Za-z]+$/.test(flag) && flag.includes(letter)))
+}
+
+/** The tool a process resolves through PATH: its first non-wrapper word when that word has no slash. */
+function pathResolved(process) {
+  if (!Array.isArray(process.argv) || !process.argv.length) return null
+  const { tool } = toolOf(process.argv)
+  if (!tool || tool.includes("/")) return null
+  return tool
+}
+
+const SECRET = /authorization|bearer|token=|api[_-]?key|password|secret=/i
+const PRIVILEGED = new Set(["sudo", "pkexec", "doas", "docker"])
+
+/**
+ * `Text` blocks whose `text:` binds to a collector's `.text` and whose
+ * `textFormat` is not `Text.PlainText`, over the QML files.
+ */
+function richTextSinks(files) {
+  const found = []
+  for (const file of files.filter((entry) => entry.kind === "qml")) {
+    const text = blankComments(file.text)
+    const collectors = [...blocks(text, "StdioCollector"), ...blocks(text, "SplitParser")].map((block) => block.id).filter(Boolean)
+    if (!collectors.length) continue
+    for (const block of [...blocks(text, "Text"), ...blocks(text, "Label"), ...blocks(text, "TextEdit")]) {
+      const bound = propertyValue(block.body, "text")
+      if (!bound || !collectors.some((id) => new RegExp(`(?<![\\w.])${id}\\.(?:text|data)\\b`).test(bound.text))) continue
+      const format = propertyValue(block.body, "textFormat")?.text
+      if (format === "Text.PlainText") continue
+      found.push({ file: file.path, line: lineOf(text, block.open + 1 + bound.offset) })
+    }
+  }
+  return found
+}
+
+/** `console.log(...)` and `console.warn(...)` lines whose argument text is secret-shaped, over QML and JavaScript. */
+function secretLogs(files) {
+  const found = []
+  for (const file of files.filter((entry) => entry.kind === "qml" || entry.kind === "js")) {
+    const text = blankComments(file.text)
+    for (const match of text.matchAll(/console\.(?:log|warn|error|info|debug)\s*\(([^\n]*)/g)) {
+      if (SECRET.test(match[1])) found.push({ file: file.path, line: lineOf(text, match.index) })
+    }
+  }
+  return found
+}
+
+/**
+ * The size thresholds: a function is listed as long when it is longer, more
+ * branched or deeper than 90 of 100 functions in the 50 listed trees of
+ * docs/evidence/inspect/2026-09-16-function-lengths.json (M12). The numbers
+ * are that record's p90 quantiles and tests/unit/submit.test.mjs holds them
+ * to it. Length is what the person asked for first, so the default view
+ * lists long functions before the review classes and says that this order
+ * is a preference and not a share.
+ */
+export const SIZE = Object.freeze({
+  measurement: "M12",
+  sample: "50 listed trees, 6041 functions",
+  trees: 50,
+  functions: 6041,
+  lines: 22,
+  branches: 6,
+  depth: 2,
+  // The histogram of each measure over the 6041 functions, value to count,
+  // from which a function's percentile rank among listed functions is read;
+  // and each listed tree's heavyShare, the share of its function lines in
+  // functions over the thresholds, in the record's row order, from which
+  // a tree's position among listed trees is read.
+  distribution: Object.freeze({
+    lines: Object.freeze({ 1: 330, 2: 185, 3: 682, 4: 659, 5: 629, 6: 515, 7: 420, 8: 339, 9: 301, 10: 235, 11: 192, 12: 138, 13: 150, 14: 129, 15: 104, 16: 75, 17: 84, 18: 64, 19: 70, 20: 48, 21: 51, 22: 46, 23: 45, 24: 42, 25: 27, 26: 25, 27: 16, 28: 24, 29: 24, 30: 17, 31: 18, 32: 23, 33: 18, 34: 19, 35: 10, 36: 5, 37: 11, 38: 12, 39: 12, 40: 9, 41: 10, 42: 12, 43: 9, 44: 8, 45: 7, 46: 14, 47: 8, 48: 11, 49: 8, 50: 6, 51: 2, 52: 2, 53: 6, 54: 2, 55: 7, 56: 4, 57: 3, 58: 5, 60: 6, 61: 2, 62: 3, 63: 6, 64: 1, 65: 3, 66: 1, 67: 3, 68: 4, 69: 8, 70: 5, 71: 6, 72: 2, 73: 2, 74: 1, 75: 1, 76: 1, 77: 1, 78: 1, 79: 3, 80: 1, 81: 3, 82: 1, 83: 1, 85: 1, 87: 1, 89: 1, 90: 2, 91: 2, 92: 1, 94: 1, 96: 2, 97: 2, 98: 1, 99: 1, 100: 1, 101: 1, 102: 2, 104: 1, 108: 1, 110: 2, 111: 1, 112: 1, 113: 1, 115: 2, 116: 1, 117: 1, 119: 1, 120: 1, 121: 1, 128: 2, 129: 1, 133: 1, 134: 1, 144: 1, 145: 1, 154: 1, 161: 1, 173: 1, 253: 1, 277: 1, 292: 1, 365: 1, 495: 1 }),
+    branches: Object.freeze({ 0: 2336, 1: 1096, 2: 807, 3: 455, 4: 339, 5: 233, 6: 171, 7: 125, 8: 90, 9: 68, 10: 47, 11: 53, 12: 24, 13: 26, 14: 18, 15: 11, 16: 17, 17: 18, 18: 12, 19: 12, 20: 11, 21: 3, 22: 5, 23: 7, 24: 8, 25: 4, 26: 1, 27: 6, 28: 4, 29: 5, 31: 1, 32: 3, 33: 3, 34: 1, 35: 1, 36: 4, 37: 1, 38: 1, 40: 1, 41: 1, 43: 2, 44: 1, 45: 2, 46: 1, 64: 1, 75: 1, 78: 1, 85: 1, 87: 2 }),
+    depth: Object.freeze({ 0: 3794, 1: 1421, 2: 481, 3: 155, 4: 80, 5: 62, 6: 27, 7: 10, 8: 5, 9: 2, 12: 1, 13: 1, 15: 1, 18: 1 }),
+    heavyShare: Object.freeze([0.421, 0.3361, 0.4049, 0, 0.3687, 0.4469, 0.4107, 0.6167, 0.2635, 0.8434, 0, 0, 0.193, 0.7036, 0.4506, 0.4846, 0.5047, 0.5337, 0.3628, 0.682, 0.0554, 0.7775, 0.3548, 0.3552, 0, 0.7172, 0.2542, 0.3747, 0.4275, 0.6607, 0.4322, 0.6941, 0.3247, 0.5225, 0.2545, 0.1462, 0, 0.5817, 0.5891, 0.4353, 0, 0.3479, 0.6109, 0.296, 0.3882, 0.5624, 0.6783, 0.4385, 0.6078, 0.5826]),
+  }),
+})
+
+
+/**
+ * Where a value sits among the sample's: the share of listed functions
+ * with a smaller value, as a percentage, so the smallest listed value ranks
+ * 0 and a value over every listed one ranks 100. A function's rank is the
+ * largest of its three, since one long measure is what a reader sees.
+ */
+export function percentile(measure, value) {
+  const histogram = SIZE.distribution[measure]
+  let below = 0
+  for (const [key, count] of Object.entries(histogram)) if (Number(key) < value) below += count
+  return Math.round((below / SIZE.functions) * 1000) / 10
+}
+
+export function rankOf(entry) {
+  return Math.max(percentile("lines", entry.lines), percentile("branches", entry.branches), percentile("depth", entry.depth))
+}
+
+/**
+ * The share of a tree's function lines that sit in functions over any of
+ * the M12 thresholds: lines inside `overSize` functions over lines inside
+ * every function, 0 with no function. Line-weighted on purpose: splitting
+ * one long function into short ones moves its lines out of the heavy set,
+ * and padding a tree with small functions barely moves the ratio.
+ */
+export function heavyShare(functions) {
+  const total = functions.reduce((sum, entry) => sum + entry.lines, 0)
+  if (!total) return 0
+  const heavy = overSize(functions).reduce((sum, entry) => sum + entry.lines, 0)
+  return heavy / total
+}
+
+/**
+ * The share of listed trees whose heavyShare is strictly smaller than this
+ * one, as a percentage over the trees of the M12 record: 0 for a tree with
+ * no function over the thresholds, 100 for one heavier than every listed
+ * tree.
+ */
+export function treeRank(share) {
+  const below = SIZE.distribution.heavyShare.filter((listed) => listed < share).length
+  return Math.round((below / SIZE.trees) * 1000) / 10
+}
+
+/**
+ * The size score of a tree: 10 minus its rank among the listed trees
+ * divided by 10, on 0 to 10 with two decimals. A tree with no function
+ * over the thresholds scores 10.00, a tree heavier than every listed tree
+ * 0.00. It says where the tree sits among listed plugins by how much of
+ * its function text is in long functions, never whether it is good, and a
+ * tree with no function has no score.
+ */
+export function sizeScore(functions) {
+  if (!functions.length) return null
+  return Math.round((10 - treeRank(heavyShare(functions)) / 10) * 100) / 100
+}
+
+/** The functions over any of the thresholds, longest first, then most branched. */
+export function overSize(functions) {
+  return functions
+    .filter((entry) => entry.lines > SIZE.lines || entry.branches > SIZE.branches || entry.depth > SIZE.depth)
+    .sort((a, b) => b.lines - a.lines || b.branches - a.branches || b.depth - a.depth || a.file.localeCompare(b.file) || a.line - b.line)
+}
+
+export const PATTERNS = Object.freeze([
+  {
+    id: "process-lifecycle",
+    label: "process lifecycle",
+    notObserved: "no process without a deadline",
+    measurement: "M11",
+    share: 0.20,
+    sample: SAMPLE,
+    precondition: ({ processes }) => {
+      const rows = processes.filter((row) => row.declaredIn === "qml" && !row.detached && !row.deadline.observed)
+      return { sites: rows.map(site), observation: `observed ${plural(rows.length, "process", "processes")} with no deadline (${sites(rows)})` }
+    },
+  },
+  {
+    id: "unbounded-buffering",
+    label: "unbounded buffering",
+    notObserved: "no collector without a cap",
+    measurement: "M11",
+    share: 0.19,
+    sample: SAMPLE,
+    precondition: ({ processes }) => {
+      const rows = processes.filter((row) => (row.output.collector === "StdioCollector" || row.output.collector === "SplitParser") && !row.output.capObserved)
+      return { sites: rows.map(site), observation: `observed ${plural(rows.length, "collector")} with no cap (${sites(rows)})` }
+    },
+  },
+  {
+    id: "file-and-state-boundary",
+    label: "file and state boundary",
+    notObserved: "no write outside a controlled directory",
+    measurement: "M11",
+    share: 0.15,
+    sample: SAMPLE,
+    precondition: ({ writes }) => {
+      const outside = writes.filter((row) => row.controlledDirectory === "not-observed" && row.via !== "mktemp")
+      const unmoded = writes.filter((row) => row.via === "mkdir" && row.mode === null)
+      const parts = []
+      if (outside.length) parts.push(`${plural(outside.length, "write")} outside a controlled directory (${sites(outside)})`)
+      if (unmoded.length) parts.push(`${plural(unmoded.length, "mkdir")} with no mode (${sites(unmoded)})`)
+      return { sites: [...outside, ...unmoded].map(site), observation: `observed ${parts.join("; ")}` }
+    },
+  },
+  {
+    id: "environment-trust",
+    label: "environment trust",
+    notObserved: "no tool resolved from PATH, no curl without -q",
+    measurement: "M11",
+    share: 0.07,
+    sample: SAMPLE,
+    precondition: ({ processes, hosts }) => {
+      const resolved = processes.map((row) => ({ row, tool: pathResolved(row) })).filter((entry) => entry.tool)
+      const curls = hosts.filter((row) => row.tool === "curl" && !hasFlag(row.flags, "q", "--disable"))
+      const parts = []
+      const names = [...new Set(resolved.map((entry) => entry.tool))]
+      const named = names.length > 6 ? `${names.slice(0, 6).join(", ")} and ${names.length - 6} more` : names.join(", ")
+      if (resolved.length) parts.push(`${plural(resolved.length, "tool")} resolved from PATH (${named}; ${sites(resolved.map((entry) => entry.row))})`)
+      if (curls.length) parts.push(`curl without -q (${sites(curls)})`)
+      return { sites: [...resolved.map((entry) => entry.row), ...curls].map(site), observation: `observed ${parts.join("; ")}` }
+    },
+  },
+  {
+    id: "secrets",
+    label: "secrets",
+    notObserved: "no secret-shaped argv or log line",
+    measurement: "M11",
+    share: 0.07,
+    sample: SAMPLE,
+    precondition: ({ processes, files }) => {
+      const argv = processes.filter((row) => Array.isArray(row.argv) && row.argv.some((word) => SECRET.test(word)))
+      const copies = processes.filter((row) => Array.isArray(row.argv) && basename(toolOf(row.argv).tool || "") === "wl-copy" && row.expressions.length > 0)
+      const logs = secretLogs(files)
+      const parts = []
+      if (argv.length) parts.push(`secret-shaped argv (${sites(argv)})`)
+      if (logs.length) parts.push(`secret-shaped log line (${sites(logs)})`)
+      if (copies.length) parts.push(`wl-copy with a computed value (${sites(copies)})`)
+      return { sites: [...argv, ...logs, ...copies].map(site), observation: `observed ${parts.join("; ")}` }
+    },
+  },
+  {
+    id: "supply-chain",
+    label: "supply chain",
+    notObserved: "no unpinned remote source in the baseline",
+    measurement: "M11",
+    also: ["M4"],
+    share: 0.07,
+    sample: SAMPLE,
+    precondition: ({ baseline, blockingRules }) => {
+      const findings = (baseline?.official?.findings || []).filter((finding) => !blockingRules.includes(finding.ruleId))
+      const evidence = findings.flatMap((finding) => (finding.evidence || []).map((entry) => ({ file: entry.path, line: entry.line })))
+      return {
+        sites: evidence,
+        observation: `observed ${plural(findings.length, "baseline finding")} the pin does not block on (${findings.map((finding) => finding.ruleId).join(", ")}; ${sites(evidence)})`,
+      }
+    },
+  },
+  {
+    id: "network-egress",
+    label: "network egress",
+    notObserved: "no http scheme, no -L without --proto, no private address",
+    measurement: "M11",
+    share: 0.05,
+    sample: SAMPLE,
+    precondition: ({ hosts }) => {
+      const plain = hosts.filter((row) => row.scheme === "http")
+      const redirects = hosts.filter((row) => row.tool === "curl" && hasFlag(row.flags, "L", "--location") && !row.flags.some((flag) => flag.startsWith("--proto")))
+      const local = hosts.filter((row) => row.privateAddress)
+      const parts = []
+      if (plain.length) parts.push(`http scheme (${sites(plain)})`)
+      if (redirects.length) parts.push(`curl -L without --proto (${sites(redirects)})`)
+      if (local.length) parts.push(`private or loopback address (${sites(local)})`)
+      return { sites: [...plain, ...redirects, ...local].map(site), observation: `observed ${parts.join("; ")}` }
+    },
+  },
+  {
+    id: "untrusted-text-to-display",
+    label: "untrusted text to display",
+    notObserved: "no Text bound to output without Text.PlainText",
+    measurement: "M11",
+    share: 0.05,
+    sample: SAMPLE,
+    precondition: ({ files }) => {
+      const found = richTextSinks(files)
+      return { sites: found, observation: `observed ${plural(found.length, "Text")} bound to a collector's output without Text.PlainText (${sites(found)})` }
+    },
+  },
+  {
+    id: "argument-grammar",
+    label: "argument grammar",
+    notObserved: "no expression inside an argv element",
+    measurement: "M11",
+    share: 0.04,
+    sample: SAMPLE,
+    precondition: ({ processes }) => {
+      const rows = processes.filter((row) => row.expressions.length > 0)
+      return { sites: rows.map(site), observation: `observed ${plural(rows.length, "argv")} with a computed element (${sites(rows)})` }
+    },
+  },
+  {
+    id: "privilege-disclosure",
+    label: "privilege disclosure",
+    notObserved: "no sudo, pkexec, docker or /dev/input in argv",
+    measurement: "M11",
+    also: ["M4"],
+    share: 0.03,
+    sample: SAMPLE,
+    precondition: ({ processes, readme }) => {
+      const found = []
+      for (const row of processes) {
+        if (!Array.isArray(row.argv)) continue
+        const names = [...new Set(row.argv.flatMap((word) => (PRIVILEGED.has(basename(word)) ? [basename(word)] : word.includes("/dev/input") ? ["/dev/input"] : [])))]
+        if (names.length) found.push({ row, names })
+      }
+      const names = [...new Set(found.flatMap((entry) => entry.names))]
+      const named = names.filter((name) => readme && new RegExp(name.replace(/[/]/g, "\\/"), "i").test(readme))
+      const readmeNote = readme === null ? "no README to name it" : named.length === names.length ? "named in the README: observed" : `named in the README: not observed for ${names.filter((name) => !named.includes(name)).join(", ")}`
+      return { sites: found.map((entry) => site(entry.row)), observation: `observed ${names.join(", ")} in argv (${sites(found.map((entry) => entry.row))}); ${readmeNote}` }
+    },
+  },
+])
+
+/** The observation without its site lists and without the leading word, for a row whose sites are marked elsewhere. */
+export function summaryOf(observation) {
+  const SITE = "[\\w./-]+:\\d+"
+  return observation
+    .replace(new RegExp(`;\\s*${SITE}(?:, ${SITE})*(?=\\))`, "g"), "")
+    .replace(new RegExp(`\\s*\\(${SITE}(?:, ${SITE})*\\)`, "g"), "")
+    .replace(/^observed /, "")
+}
+
+/**
+ * @param {{ processes, hosts, writes, timers, files, readme, baseline, blockingRules }} facts the observed facts of one document
+ * @returns {{ patterns: Array, lookedFor: string[] }}
+ */
+export function evaluatePatterns(facts) {
+  const patterns = []
+  const lookedFor = []
+  for (const pattern of PATTERNS) {
+    const found = pattern.precondition(facts)
+    if (found.sites.length) patterns.push({ id: pattern.id, observedCount: found.sites.length, sites: found.sites, observation: found.observation, summary: summaryOf(found.observation), measurement: pattern.measurement, share: pattern.share })
+    else lookedFor.push(pattern.id)
+  }
+  return { patterns, lookedFor }
+}

package/tools/inspect/processes.mjs

@@ -0,0 +1,298 @@
+// Process sites: every `Process {` block in QML (its `command:` inside the
+// block or assigned to its id elsewhere in the file), every
+// `Quickshell.execDetached([...])`, and every command line of a shell
+// script. Each row carries the argv the text shows, whether a deadline is
+// observed for it, what collects its output and whether a producer-side
+// cap is observed in the argv. A command that is not one literal array or
+// string is `argvForm: "computed"` with `argv: null`, never a guess.
+
+import { arrayLiteral, basename, blankComments, blocks, closingBracket, lineOf, propertyValue, blankShellExpressions, shellLogicalLines, shellPieces, shellWords, stringLiteral, withoutRedirections } from "./text.mjs"
+
+/** Shells whose `-c` turns the next element into a script the extraction does not follow. */
+const SHELLS = new Set(["sh", "bash", "zsh", "dash", "fish", "ksh"])
+
+/**
+ * Wrappers that run the word after them: the tool a host or a pattern is
+ * attributed to is the first argv word that is not one of these, with the
+ * wrapper's own options skipped. `timeout` is also the deadline the argv
+ * carries.
+ */
+const WRAPPERS = new Set(["sudo", "doas", "pkexec", "env", "nohup", "nice", "ionice", "command", "exec", "timeout", "stdbuf", "chronic"])
+
+/**
+ * Shell builtins and keywords that start no process. A line whose command
+ * is one of these is not a process site; `eval` is kept because it is the
+ * one builtin that runs computed text.
+ */
+const BUILTINS = new Set([
+  "cd", "set", "export", "local", "declare", "readonly", "typeset", "unset", "shift", "return", "exit", "break", "continue",
+  "echo", "printf", "read", "source", ".", "trap", "true", "false", ":", "test", "[", "[[", "wait", "umask", "alias", "unalias",
+  "pushd", "popd", "let", "type", "hash", "builtin", "getopts", "ulimit", "times", "jobs", "fg", "bg", "kill", "help", "exec",
+])
+const KEYWORDS = new Set(["if", "then", "else", "elif", "fi", "do", "done", "while", "until", "for", "in", "case", "esac", "select", "function", "time", "!", "{", "}", "(", ")", "coproc"])
+
+/** The first argv word that is a tool, wrappers and their options skipped, with its index. */
+export function toolOf(argv) {
+  let index = 0
+  while (index < argv.length) {
+    const word = basename(argv[index])
+    if (!WRAPPERS.has(word)) break
+    index += 1
+    if (word === "env") while (index < argv.length && (/^[A-Za-z_]\w*=/.test(argv[index]) || argv[index].startsWith("-"))) index += 1
+    else if (word === "timeout") {
+      while (index < argv.length && argv[index].startsWith("-")) index += /^(?:-s|-k|--signal|--kill-after)$/.test(argv[index]) ? 2 : 1
+      if (index < argv.length && /^\d/.test(argv[index])) index += 1
+    } else while (index < argv.length && argv[index].startsWith("-")) index += 1
+  }
+  return index < argv.length ? { tool: argv[index], index } : { tool: null, index: -1 }
+}
+
+/** The `timeout` duration in an argv, in milliseconds, or null: `timeout 5`, `timeout 2m`, `timeout -k 1 5s`. */
+export function timeoutMs(argv) {
+  const at = argv.findIndex((word) => basename(word) === "timeout")
+  if (at < 0) return null
+  let index = at + 1
+  while (index < argv.length && argv[index].startsWith("-")) index += /^(?:-s|-k|--signal|--kill-after)$/.test(argv[index]) ? 2 : 1
+  const match = String(argv[index] || "").match(/^(\d+(?:\.\d+)?)([smhd]?)$/)
+  if (!match) return null
+  const unit = { "": 1000, s: 1000, m: 60000, h: 3600000, d: 86400000 }[match[2]]
+  return Math.round(Number(match[1]) * unit)
+}
+
+/** Whether a joined argv shows a producer-side cap, and which. */
+function capIn(argv) {
+  if (!argv) return { observed: false, via: null }
+  const joined = argv.join(" ")
+  if (argv.some((word) => word.startsWith("--max-filesize"))) return { observed: true, via: "--max-filesize" }
+  if (/(?:^|[\s|/])head\s+(?:-\S+\s+)*-c\b/.test(joined) || argv.some((word, index) => basename(word) === "head" && argv[index + 1] === "-c")) return { observed: true, via: "head -c" }
+  if (argv.some((word) => basename(word) === "timeout")) return { observed: true, via: "timeout" }
+  return { observed: false, via: null }
+}
+
+function isShellWrapper(argv) {
+  if (!argv || argv.length < 2) return false
+  const { tool, index } = toolOf(argv)
+  if (!tool) return false
+  if (basename(tool) === "eval") return true
+  // `-c` alone or inside a cluster: `sh -lc`, `bash -ec`.
+  return SHELLS.has(basename(tool)) && /^-[a-z]*c[a-z]*$/.test(argv[index + 1] || "")
+}
+
+/** The argv an expression resolves to, or the computed form. */
+function resolveCommand(valueText) {
+  const elements = arrayLiteral(valueText)
+  if (elements) {
+    const expressions = elements.map((element, index) => (element.literal === null ? { index, text: element.text } : null)).filter(Boolean)
+    return { argv: elements.map((element) => element.literal ?? element.text), argvForm: "array", expressions }
+  }
+  const literal = stringLiteral(valueText)
+  if (literal !== null) {
+    const words = shellWords(literal)
+    return { argv: words, argvForm: "string", expressions: [] }
+  }
+  return { argv: null, argvForm: "computed", expressions: [], text: valueText.trim() }
+}
+
+/** The value assigned to `<id>.command =` somewhere in the text, with its offset. */
+function assignedCommand(text, id) {
+  if (!id) return null
+  const pattern = new RegExp(`(?<![\\w.])${id}\\.command\\s*=(?!=)\\s*`, "g")
+  const match = pattern.exec(text)
+  if (!match) return null
+  const start = match.index + match[0].length
+  if (text[start] === "[") {
+    const end = closingBracket(text, start)
+    if (end > 0) return { text: text.slice(start, end + 1), offset: match.index }
+  }
+  let end = text.indexOf("\n", start)
+  if (end < 0) end = text.length
+  return { text: text.slice(start, end).replace(/;\s*$/, ""), offset: match.index }
+}
+
+/** Whether a handler body stops the process with the given id. */
+function stops(body, id) {
+  if (!id) return false
+  return new RegExp(`(?<![\\w.])${id}\\.(?:kill\\s*\\(|signal\\s*\\(|running\\s*=\\s*false)`).test(body)
+}
+
+function numeric(valueText) {
+  return valueText !== undefined && valueText !== null && /^\d+$/.test(String(valueText).trim()) ? Number(valueText) : null
+}
+
+/** The deadline the file shows for a process: a killing Timer, `timeout` in argv, or a destruction handler. */
+function deadlineFor(text, id, argv) {
+  for (const timer of blocks(text, "Timer")) {
+    const handler = propertyValue(timer.body, "onTriggered")
+    if (handler && stops(handler.text, id)) {
+      return { observed: true, via: "timer-kill", ms: numeric(propertyValue(timer.body, "interval")?.text) }
+    }
+  }
+  const ms = argv ? timeoutMs(argv) : null
+  if (argv && argv.some((word) => basename(word) === "timeout")) return { observed: true, via: "timeout-argv", ms }
+  const destruction = text.match(/Component\.onDestruction\s*:/)
+  if (destruction) {
+    const start = destruction.index + destruction[0].length
+    const trimmed = text.slice(start).replace(/^\s+/, "")
+    const at = start + (text.slice(start).length - trimmed.length)
+    const end = text[at] === "{" ? closingBracket(text, at) : text.indexOf("\n", at)
+    if (end > 0 && stops(text.slice(at, end + 1), id)) return { observed: true, via: "destruction", ms: null }
+  }
+  return { observed: false, via: null, ms: null }
+}
+
+function outputOf(body, argv) {
+  const collector = /(?<![\w.])StdioCollector\s*\{/.test(body) ? "StdioCollector"
+    : /(?<![\w.])SplitParser\s*\{/.test(body) ? "SplitParser"
+      : propertyValue(body, "stdout") ? "unknown" : "none"
+  const cap = capIn(argv)
+  return { collector, capObserved: cap.observed, via: cap.via }
+}
+
+function qmlRow(file, text, block, command, commandOffset) {
+  const resolved = command ? resolveCommand(command.text) : { argv: null, argvForm: "computed", expressions: [], text: null }
+  const id = block.id
+  const running = Boolean(propertyValue(block.body, "running")?.text === "true"
+    || (id && new RegExp(`(?<![\\w.])${id}\\.(?:running\\s*=\\s*true|start\\s*\\(|startDetached\\s*\\()`).test(text)))
+  return {
+    file: file.path,
+    line: lineOf(text, commandOffset ?? block.start),
+    declaredIn: "qml",
+    id,
+    argv: resolved.argv,
+    argvForm: resolved.argvForm,
+    expressions: resolved.expressions,
+    commandText: resolved.argvForm === "computed" ? (resolved.text || "command not declared in the block") : null,
+    running,
+    detached: false,
+    deadline: deadlineFor(text, id, resolved.argv),
+    output: outputOf(block.body, resolved.argv),
+    shellWrapper: isShellWrapper(resolved.argv),
+    pipedFrom: null,
+  }
+}
+
+function detachedRows(file, text) {
+  const rows = []
+  for (const match of text.matchAll(/(?<![\w.])(?:Quickshell\.execDetached|Process\.exec)\s*\(/g)) {
+    const open = match.index + match[0].length - 1
+    const end = closingBracket(text, open)
+    if (end < 0) continue
+    const inner = text.slice(open + 1, end).trim()
+    // execDetached takes an argv array, or an object whose `command` is one.
+    const value = inner.startsWith("{") ? propertyValue(inner.slice(1, -1), "command")?.text || inner : inner
+    const resolved = resolveCommand(value)
+    rows.push({
+      file: file.path,
+      line: lineOf(text, match.index),
+      declaredIn: "qml",
+      id: null,
+      argv: resolved.argv,
+      argvForm: resolved.argvForm,
+      expressions: resolved.expressions,
+      commandText: resolved.argvForm === "computed" ? resolved.text : null,
+      running: true,
+      detached: true,
+      deadline: { observed: false, via: null, ms: null },
+      output: { collector: "none", capObserved: false, via: null },
+      shellWrapper: isShellWrapper(resolved.argv),
+      pipedFrom: null,
+    })
+  }
+  return rows
+}
+
+/** Every `Process {` block and detached exec in a QML file. */
+export function qmlProcesses(file) {
+  const text = blankComments(file.text)
+  const rows = []
+  for (const block of blocks(text, "Process")) {
+    const inside = propertyValue(block.body, "command")
+    // `command: []` is a placeholder for a value set later: the assignment to
+    // the block's id is the command, and without one the command is computed.
+    if (inside && !/^\[\s*\]$/.test(inside.text)) {
+      rows.push(qmlRow(file, text, block, inside, block.open + 1 + inside.offset))
+      continue
+    }
+    const assigned = assignedCommand(text, block.id)
+    if (!assigned && inside) {
+      rows.push({ ...qmlRow(file, text, block, null, block.open + 1 + inside.offset), commandText: "[] (set at run time, no assignment to the id observed)" })
+      continue
+    }
+    rows.push(qmlRow(file, text, block, assigned, assigned ? assigned.offset : null))
+  }
+  rows.push(...detachedRows(file, text))
+  return rows.sort((a, b) => a.line - b.line)
+}
+
+/** The command words of a shell segment, leading assignments and keywords dropped; null when nothing runs. */
+function commandWords(segment) {
+  let words = shellWords(segment)
+  // A case pattern (`*)`, `[0-9]*)`) and the blanked shells of `(( ))` and
+  // `[[ ]]` run nothing; what follows a pattern on the same line does.
+  if (words.length && /\)$/.test(words[0]) && !/^\$?\(/.test(words[0])) words = words.slice(1)
+  words = words.filter((word) => !/^(?:\(\(\s*\)\)|\(\(|\)\)|\[\[|\]\])$/.test(word))
+  while (words.length && (KEYWORDS.has(words[0]) || /^[A-Za-z_]\w*\+?=/.test(words[0]))) {
+    if (words[0] === "for" || words[0] === "case" || words[0] === "select" || words[0] === "function") return null
+    words = words.slice(1)
+  }
+  if (!words.length) return null
+  if (/^[A-Za-z_]\w*\(\)$/.test(words[0])) return null
+  if (BUILTINS.has(basename(words[0])) && basename(words[0]) !== "eval") return null
+  return words
+}
+
+/** Every command site of a shell script, per line, pipes as separate sites. */
+export function shellProcesses(file) {
+  const rows = []
+  for (const { line, text } of shellLogicalLines(file.text)) {
+    const trimmed = blankShellExpressions(text).trim()
+    if (!trimmed || trimmed.startsWith("#")) continue
+    // A command substitution runs too: `t=$(mktemp)` is a `mktemp` site.
+    const segments = shellPieces(trimmed)
+    const lineCap = capIn(shellWords(trimmed))
+    let previous = null
+    for (const segment of segments) {
+      const argv = commandWords(segment.text)
+      if (!argv) {
+        previous = null
+        continue
+      }
+      const stripped = withoutRedirections(argv)
+      // A line that is only a redirection (`exec > log`, `> file`) runs nothing.
+      if (!stripped.length) {
+        previous = null
+        continue
+      }
+      const deadlineMs = timeoutMs(stripped)
+      const row = {
+        file: file.path,
+        line,
+        declaredIn: "shell",
+        id: null,
+        argv: stripped,
+        argvForm: "string",
+        expressions: [],
+        commandText: null,
+        running: true,
+        detached: false,
+        deadline: stripped.some((word) => basename(word) === "timeout") ? { observed: true, via: "timeout-argv", ms: deadlineMs } : { observed: false, via: null, ms: null },
+        output: { collector: "none", capObserved: lineCap.observed, via: lineCap.via },
+        shellWrapper: isShellWrapper(stripped),
+        pipedFrom: segment.operator === "|" || segment.operator === "|&" ? previous : null,
+      }
+      rows.push(row)
+      previous = { line, argv0: stripped[0] }
+    }
+  }
+  return rows
+}
+
+/**
+ * @param {{ path: string, kind: string, text: string }} file
+ * @returns {Array} process rows, in file order
+ */
+export function extractProcesses(file) {
+  if (file.kind === "qml") return qmlProcesses(file)
+  if (file.kind === "shell") return shellProcesses(file)
+  return []
+}