omp-conductor 0.18.0 → 0.18.1

package/src/orchestrator.ts

@@ -82,6 +82,12 @@ export interface OrchestratorHandle {
    *  reads alive here — that is the stall watchdog's job, not liveness. */
   alive(): boolean;
   sessionFile(): string | undefined;
+  /**
+   * The omp-conductor version the live orchestrator process loaded (#832):
+   * the session's own attestation at start, exposed to the upgrade's
+   * session-reload verification. `undefined` when the session never attested.
+   */
+  extensionVersion(): string | undefined;
   dispose(): Promise<void>;
 }
 
@@ -290,6 +296,12 @@ export async function startOrchestrator(o: OrchestratorOpts): Promise<Orchestrat
     // The path the harness actually opened, read live: the transcript is how a
     // human audits what the orchestrator decided on their behalf.
     sessionFile: () => session.sessionFile,
+    // The loaded-module attestation (#832): the extension version this
+    // orchestrator PROCESS loaded at session start — the live fact the
+    // upgrade's session-reload verification compares against the target
+    // release. `undefined` when the session never attested (an old build, a
+    // hand-written fake) — absence is "not attested", never "the newest".
+    extensionVersion: () => session.extensionVersion,
     async dispose(): Promise<void> {
       if (disposed) return;
       disposed = true;

package/src/privileged.ts

@@ -25,6 +25,7 @@
  */
 
 import type { WizardUi } from "./wizard-ui.ts";
+import { shellQuote } from "./shell.ts";
 
 export interface PrivilegedStep {
   /** One line naming what this step accomplishes, shown in the plan. */
@@ -113,10 +114,6 @@ export function formatStep(step: PrivilegedStep, asRoot = false): string {
   return [...prefix, ...step.argv].map(shellQuote).join(" ");
 }
 
-function shellQuote(value: string): string {
-  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
-}
-
 /**
  * Refuses to build a step that re-runs conductor itself.
  *

package/src/release-policy.ts

@@ -175,17 +175,17 @@ function commandSegments(command: string): string[] {
 }
 
 /** A leading wrapper command, matched and consumed in a chain (#558). `env`
- *  was already stripped; `timeout`, `nice`, `stdbuf` and a shell `-c` were
- *  not, so a whole-package run became allowed the moment it picked up a
- *  wrapper — the incident ran `timeout 300 bun test` and the guard never
- *  fired. Each alternative owns the arguments that belong to it (the
+ *  has its own dedicated stripper below — its option forms need their own
+ *  handling — while `timeout`, `nice`, `stdbuf` and a shell `-c` were not
+ *  stripped at all, so a whole-package run became allowed the moment it
+ *  picked up a wrapper: the incident ran `timeout 300 bun test` and the guard
+ *  never fired. Each alternative owns the arguments that belong to it (the
  *  duration, the niceness, the option run), so stripping never swallows the
  *  command's own words. Ordered longest-first so `timeout` is consumed
- *  before `time` and `env` before a bare `VAR=…` chain. */
+ *  before `time` and a `VAR=…` chain after `sudo`. */
 const COMMAND_WRAPPER_PREFIX = new RegExp(
   [
     "^sudo(?:\\s+-[a-z][a-z0-9-]*)*\\s+",
-    "^env\\s+",
     "^(?:[A-Za-z_][A-Za-z0-9_]*=\\S+\\s+)+",
     "^timeout(?:\\s+--?[a-z][a-z0-9-]*(?:=\\S+|\\s+\\S+)?)*\\s+(?:inf|infinity|\\d+(?:\\.\\d+)?[smhd]?)\\s+",
     "^nice(?:\\s+-n\\s+-?\\d+|\\s+-\\d+|\\s+--adjustment\\s*=\\s*-?\\d+)?\\s+",
@@ -196,6 +196,478 @@ const COMMAND_WRAPPER_PREFIX = new RegExp(
   ].join("|"),
 );
 
+/**
+ * Consume `env` together with every argument that belongs to it — its
+ * environment assignments and its own option forms — leaving the command the
+ * wrapper would run. The wrapper table's bare `env ` strip read one word and
+ * stopped, so `env -u NAME bun test` survived classification as an
+ * unclassified `-u NAME bun test` while `env FOO=1 bun test` was consumed
+ * through the assignment chain (#789). Every option form below exists to
+ * mutate or choose the *environment*, and that mutation is the wrapper; the
+ * command sits after it, so the whole argument list must go before the
+ * command is classified.
+ *
+ * The parsing mirrors how `env` itself stops: `--` ends env's own argument
+ * list and the rest is the command; a token that is neither an assignment
+ * nor an env option is the command, not a wrapper argument. A short cluster
+ * may end in an operand-taking flag (`-u NAME`, `-iu NAME` — the operand is
+ * the next token) or carry the operand mid-token (`-ui` is `-u i`, `-uNAME`
+ * is `-u NAME` — the rest of the token is the operand), exactly as compiled
+ * option parsing does; a lone `-` is env's implied `-i`. A cluster containing
+ * an unrecognised flag is left behind because `env` itself rejects the whole
+ * command on it — there is no command to gate.
+ *
+ * `-S`/`--split-string` is handled, never unwrapped piecemeal. env *re-splits*
+ * the option's operand as its own command line — assignments, options, then
+ * the command — and then keeps the rest of the line as further arguments to
+ * it (verified against coreutils 9.4, where `env -S --unset=FOO cmd` applies
+ * the unset and runs `cmd` via the remaining argv). The operand is decoded
+ * exactly as the shell and env's split-string parser together leave it and is
+ * re-entered into the argument loop below, so the command env would actually
+ * execute meets ordinary classification — a whole-suite `bun test` behind any
+ * `-S` spelling is refused, a focused `bun test src/x.test.ts` still passes.
+ * The only case a static command line cannot resolve is an operand that
+ * expands a runtime variable (`${VAR}`): it is refused via
+ * {@link UNCLASSIFIABLE_ENV_SPLIT} rather than guessed at.
+ *
+ * Long options are the same, and GNU accepts any unambiguous abbreviation of
+ * one (`--u=NAME` is `--unset=NAME`, `--split 'bun test'` is
+ * `--split-string 'bun test'`), so they are resolved against env's option
+ * table by prefix; a token too ambiguous to be one option is what env itself
+ * rejects — nothing runs — and is left behind, exactly like an unrecognised
+ * short flag.
+ *
+ * Adjacent wrappers compose: env's own command may itself be an env
+ * invocation (`env -i env bun test` runs the inner env on the suite), so the
+ * strip reaches a strict shortening fixpoint rather than stopping at the
+ * first `env`.
+ */
+/** The sentinel a strip returns for a segment it must not let through but
+ *  cannot classify: an `env -S` operand that expands a runtime variable
+ *  (`${VAR}`), which env resolves against its live environment and a static
+ *  command line cannot. `releaseCommandMatch` reads it and refuses the whole
+ *  segment as `shared-host-gate` rather than risk a whole-package run
+ *  slipping through, unclassified, as itself. */
+const UNCLASSIFIABLE_ENV_SPLIT = "\u0000env-split-unclassifiable";
+
+/**
+ * Read one shell word at `input`'s head to the first unquoted whitespace (or
+ * end), quoted regions and concatenated fragments included — `'bun test'` and
+ * `'bun'test` are each one word, so the `env -S` operand survives as a unit
+ * while the rest of the segment stays behind. The raw command line still
+ * carries the quotes, because the shell would only remove them as env runs;
+ * they are preserved in `word` for {@link decodeEnvSplitOperand} to resolve
+ * against the split-string parser's own quoting. `undefined` when the head
+ * holds no word at all.
+ */
+function readShellWord(input: string): { word: string; rest: string } | undefined {
+  let end = 0;
+  const n = input.length;
+  while (end < n) {
+    const c = input[end]!;
+    if (c === "\\") {
+      end += end + 1 < n ? 2 : 1;
+      continue;
+    }
+    if (c === "'" || c === '"') {
+      const quote = c;
+      end += 1;
+      while (end < n && input[end] !== quote) {
+        end += input[end] === "\\" && end + 1 < n ? 2 : 1;
+      }
+      if (end < n) end += 1; // the matching close
+      continue;
+    }
+    if (/\s/.test(c)) break;
+    end += 1;
+  }
+  if (end === 0) return undefined;
+  return { word: input.slice(0, end), rest: input.slice(end) };
+}
+
+/**
+ * One backslash escape env's split-string parser accepts, as its character.
+ * `\_` is a word-separating space exactly like a literal one — `bun\_test`
+ * splits into `bun` and `test` — so it cannot decode to an underscore
+ * (verified against coreutils 9.4). `undefined` for anything else: env
+ * rejects `\a`, `\b`, `\e`, `\0` (no octal), `\x`, `\q`, a backslash before
+ * whitespace and any other undeclared escape with "invalid sequence",
+ * running nothing — the caller fails closed rather than guess.
+ */
+function splitEscapeChar(e: string): string | undefined {
+  switch (e) {
+    case "n": return "\n";
+    case "r": return "\r";
+    case "f": return "\f";
+    case "t": return "\t";
+    case "v": return "\v";
+    case "_": return " ";
+    case "\\": return "\\";
+    case '"': return '"';
+    case "'": return "'";
+    case "$": return "$";
+    case "#": return "#";
+    default: return undefined;
+  }
+}
+
+/**
+ * Decode one `'…'`/`"…"` split-string quoting group. env removes the quotes
+ * and the group stands as a single token, so its content is decoded exactly
+ * like the rest of the string. A `\c` inside a group is rejected by env
+ * ("'\c' must not appear in … -S string") and so is an unterminated group
+ * ("no terminating quote in -S string"): both fail closed.
+ */
+function decodeSplitGroup(
+  text: string,
+  start: number,
+  quote: string,
+): { content: string; end: number } | undefined {
+  let content = "";
+  let i = start;
+  const n = text.length;
+  while (i < n && text[i] !== quote) {
+    const c = text[i]!;
+    if (c === "\\") {
+      i += 1;
+      if (i >= n) return undefined;
+      if (text[i] === "c") return undefined; // env rejects `\c` in a group
+      const decoded = splitEscapeChar(text[i]!);
+      if (decoded === undefined) return undefined;
+      content += decoded;
+      i += 1;
+      continue;
+    }
+    if (c === "$" || c === "`") return undefined;
+    content += c;
+    i += 1;
+  }
+  if (i >= n) return undefined; // no terminating quote
+  return { content, end: i + 1 };
+}
+
+/**
+ * Resolve env's split-string decoding of `text`, so the operand re-enters
+ * classification the way env would execute it (verified against coreutils
+ * 9.4). Escapes become their characters (`\_` a word-separating space),
+ * whitespace runs collapse to single spaces, and a `'…'`/`"…"` quoting group
+ * becomes one token with its quotes removed: `'bun' test` reads `bun test`,
+ * exactly as env runs it. A grouped token whose content carries whitespace
+ * keeps quotes around it in the decoded line — that is what a
+ * `bash -c "bun test"` command string looks like to the downstream shell-`-c`
+ * resolver, and the only shape whose token boundary classification would
+ * otherwise lose. An unquoted, unescaped `#` at the start of an argument — a
+ * `#` coreutils' `ss.sep` flag finds at the string head, after whitespace, or
+ * after an outer `\_` — is a comment that ends the split string: coreutils
+ * `goto eos` drops the `#` and everything after it (`env -S '#' bun test`
+ * executes the untouched `bun test` argv via the remaining command line), so
+ * the decode stops there and the caller re-enters only what preceded it.
+ * Escaped (`\#`) or quoted (`'#'`, `"#"`) hashes are that same literal `#`
+ * argument — `\#` passes as-is, and quotes group — never a comment, and a
+ * mid-argument `#` (`bun#test`, `'a'#b`) is the ordinary character it is to
+ * env. A construct env rejects (a `\c` in a group, an unterminated group, an
+ * undeclared escape, a trailing backslash) or cannot resolve statically (a
+ * `${VAR}`/`$VAR`/backtick expansion) is `undefined`: the caller must refuse
+ * the whole segment rather than guess.
+ */
+function decodeSplitString(text: string): string | undefined {
+  let out = "";
+  const n = text.length;
+  let i = 0;
+  // Mirror coreutils' `ss.sep`: true while the next character opens a new
+  // argument — the string head, after a whitespace run, or after an outer
+  // `\_` separator. A `#` seen there is the comment that ends the split;
+  // every other position keeps `#` the literal character it is to env.
+  let sep = true;
+  while (i < n) {
+    const c = text[i]!;
+    if (c === "$" || c === "`") return undefined;
+    if (c === "\\") {
+      i += 1;
+      if (i >= n) return undefined; // a trailing backslash: env rejects it
+      const e = text[i]!;
+      if (e === "c") break; // `\c` stops processing the rest of the string
+      const decoded = splitEscapeChar(e);
+      if (decoded === undefined) return undefined;
+      out += decoded;
+      // `\_` is an argument separator outside quotes, exactly like a space;
+      // any other escape is a character inside the current argument.
+      sep = decoded === " " ? true : false;
+      i += 1;
+      continue;
+    }
+    if (c === "#" && sep) break; // comment: an arg-initial `#` ends the split
+    if (c === "'" || c === '"') {
+      const group = decodeSplitGroup(text, i + 1, c);
+      if (group === undefined) return undefined;
+      const content = group.content;
+      if (/\s/.test(content)) {
+        // One token with an interior space; re-quote it so the shell-`-c`
+        // resolver below still sees a quoted command string. Pick the quote
+        // style the content does not already carry; content with both is not
+        // representable and fails closed.
+        if (!content.includes(c)) {
+          out += c + content + c;
+        } else if (c === "'" && !content.includes('"')) {
+          out += `"${content}"`;
+        } else if (c === '"' && !content.includes("'")) {
+          out += `'${content}'`;
+        } else {
+          return undefined;
+        }
+      } else {
+        out += content; // quotes removed: `'bun' test` is `bun test`
+      }
+      // The group opened an argument, so what follows it — a `#` included —
+      // continues that same argument (`'a'#b` is `a#b`).
+      sep = false;
+      i = group.end;
+      continue;
+    }
+    if (/\s/.test(c)) {
+      out += " ";
+      sep = true;
+      while (i < n && /\s/.test(text[i]!)) i += 1;
+      continue;
+    }
+    out += c;
+    sep = false;
+    i += 1;
+  }
+  return out.replace(/\s+/g, " ").trim();
+}
+
+/**
+ * Decode the `env -S` operand word for re-entry, the way the shell and env's
+ * split-string parser between them leave it. The operand's own shell quoting
+ * — the `'…'`/`"…"` wrapping the whole word on the raw command line — is the
+ * printable form of the argument; stripping that one level is what the shell
+ * does before env sees it. The quotes *inside* the content are env's own
+ * grouping and are preserved for {@link decodeSplitString}. `undefined` when
+ * the decoded text carries a runtime expansion.
+ */
+function decodeEnvSplitOperand(word: string): string | undefined {
+  let content = word;
+  if (word.length >= 2) {
+    const first = word[0]!;
+    const last = word[word.length - 1]!;
+    if (first === "'" && last === "'" && !word.slice(1, -1).includes("'")) {
+      content = word.slice(1, -1);
+    } else if (first === '"' && last === '"') {
+      content = word.slice(1, -1);
+    }
+  }
+  return decodeSplitString(content);
+}
+
+/**
+ * Consume a short `-S` option from the current head, returning its operand
+ * word (raw, quotes included) and the rest of the segment. `operand: null`
+ * means the option had no operand at all — env itself rejects that
+ * invocation, so there is no command to gate. The accepted spellings match
+ * compiled option parsing: `-S`, `-iS`, `-0S`, an operand attached to `S` in
+ * the same token (`-Sbun`, `-S'cmd'`), or the next word (`-S bun`). The long
+ * `--split-string` spelling — exact or an unambiguous abbreviation — is
+ * resolved by {@link parseEnvLongOption} instead.
+ */
+function parseEnvSplitOption(rest: string): { operand: string | null; rest: string } | undefined {
+  const short = /^-[i0v]*S/.exec(rest);
+  if (short === null) return undefined;
+  // The operand is attached to S in the same token — `-Sbun`, `-S'cmd'` —
+  // or, after whitespace, the next word: `-S bun`.
+  const after = rest.slice(short[0].length).replace(/^\s+/, "");
+  const word = readShellWord(after);
+  if (word === undefined) return { operand: null, rest: "" };
+  return { operand: word.word, rest: word.rest };
+}
+
+/** env's long options with the operand shape each one declares. */
+const ENV_LONG_OPTIONS: ReadonlyArray<{
+  name: string;
+  /** `required`: an operand via `=` or the next word (empty `=` rejected);
+   *  `eq-only`: an optional operand only via `=` (`--block-signal[=SIG]`);
+   *  `none`: no operand, and a trailing `=` is rejected. */
+  operand: "required" | "eq-only" | "none";
+}> = [
+  { name: "split-string", operand: "required" },
+  { name: "unset", operand: "required" },
+  { name: "chdir", operand: "required" },
+  { name: "block-signal", operand: "eq-only" },
+  { name: "default-signal", operand: "eq-only" },
+  { name: "ignore-signal", operand: "eq-only" },
+  { name: "ignore-environment", operand: "none" },
+  { name: "null", operand: "none" },
+  { name: "list-signal-handling", operand: "none" },
+  { name: "debug", operand: "none" },
+];
+
+/**
+ * Consume a `--…` env long option from the current head, exact or an
+ * unambiguous GNU abbreviation. `/usr/bin/env --u=NAME cmd` applies the unset
+ * and runs `cmd`, and `--split 'bun test'` re-splits — verified against
+ * coreutils 9.4 — so a parser that only knew the full spellings left a
+ * leading `--u=…` behind and a whole-package run bypassed classification.
+ * The resolution mirrors getopt_long: the token is matched against env's own
+ * option table as a prefix; exactly one match is the option, consumed with
+ * the operand shape it declares (split-string's operand is returned for the
+ * caller to decode and re-enter, exactly like `-S`). Zero matches (unknown)
+ * or several (ambiguous) are what env itself rejects — verified:
+ * `--frobnicate …` and `--i=…` both error out and run nothing — so the token
+ * is left behind for the caller to return untouched; there is no command to
+ * gate. `undefined` when the head is not a long option at all.
+ */
+function parseEnvLongOption(
+  rest: string,
+): { next: "leave" } | { next: "continue"; rest: string } | { next: "split"; operand: string | null; rest: string } | undefined {
+  const head = /^--([A-Za-z][A-Za-z0-9-]*)/.exec(rest);
+  if (head === null) return undefined;
+  const token = head[1]!;
+  const matches = ENV_LONG_OPTIONS.filter((option) => option.name.startsWith(token));
+  if (matches.length !== 1) return { next: "leave" };
+  const option = matches[0]!;
+  const after = rest.slice(head[0].length);
+
+  if (option.operand === "none") {
+    if (after.startsWith("=")) return { next: "leave" }; // env rejects `--debug=…`
+    return { next: "continue", rest: after.replace(/^\s+/, "") };
+  }
+
+  if (option.operand === "eq-only") {
+    // `--block-signal[=SIG]`: the signal rides only on the `=` and may be
+    // empty (a no-op); without `=`, the token is consumed bare and the next
+    // word is env's command, matching env's own parsing.
+    if (after.startsWith("=")) {
+      const value = readShellWord(after.slice(1));
+      if (value === undefined) {
+        return { next: "continue", rest: after.slice(1).replace(/^\s+/, "") };
+      }
+      return { next: "continue", rest: value.rest.replace(/^\s+/, "") };
+    }
+    return { next: "continue", rest: after.replace(/^\s+/, "") };
+  }
+
+  if (option.name === "split-string") {
+    // The operand is split and re-entered as a command line by the caller;
+    // an empty `=` value still splits to nothing, after which the rest of
+    // the line is the command.
+    if (after.startsWith("=")) {
+      const value = readShellWord(after.slice(1));
+      if (value === undefined) return { next: "split", operand: "", rest: after.slice(1) };
+      return { next: "split", operand: value.word, rest: value.rest };
+    }
+    const spaced = after.replace(/^\s+/, "");
+    if (spaced.length === 0) {
+      // `--split-string` with no operand: env rejects the invocation.
+      return { next: "split", operand: null, rest: "" };
+    }
+    const word = readShellWord(spaced);
+    if (word === undefined) return { next: "split", operand: null, rest: "" };
+    return { next: "split", operand: word.word, rest: word.rest };
+  }
+
+  // `--unset NAME` / `--chdir DIR` — a required operand via `=` (empty is
+  // rejected by env: "cannot unset ''") or as the next word.
+  if (after.startsWith("=")) {
+    const value = readShellWord(after.slice(1));
+    if (value === undefined || value.word === "") return { next: "leave" };
+    return { next: "continue", rest: value.rest.replace(/^\s+/, "") };
+  }
+  const spaced = after.replace(/^\s+/, "");
+  const word = readShellWord(spaced);
+  if (word === undefined) {
+    // `--unset` with no operand: env rejects the invocation.
+    return { next: "continue", rest: "" };
+  }
+  return { next: "continue", rest: word.rest.replace(/^\s+/, "") };
+}
+
+function stripEnvPrefix(segment: string): string {
+  // env's own command may itself be an env invocation — `env env bun test`
+  // runs the inner env, which runs the whole suite (same for `env -i env …`
+  // and, after a freed wrapper, `sudo env -u NAME env …`) — and the `--`
+  // separator hands env's command to the same strip. So the strip reaches a
+  // strict fixpoint: loop until the remainder no longer opens with `env `.
+  // Each pass consumes at least the `env ` head, so this terminates.
+  let current = segment;
+  while (true) {
+    const head = /^env\s+/.exec(current);
+    if (head === null) return current;
+    let rest = current.slice(head[0].length);
+    const consume = (pattern: RegExp): boolean => {
+      const match = pattern.exec(rest);
+      if (match === null) return false;
+      rest = rest.slice(match[0].length);
+      return true;
+    };
+    while (true) {
+      // `-S`/`--split-string`: env splits its operand as its own command line
+      // and keeps the rest of the segment as further arguments to it — so the
+      // whole line after the option is still one command env makes the
+      // environment for. Decode the operand and let the argument loop below
+      // consume the line, so the command env would actually run meets ordinary
+      // classification. An operand that expands a runtime variable cannot be
+      // classified statically: refuse the whole segment instead of guessing.
+      const split = parseEnvSplitOption(rest);
+      if (split !== undefined) {
+        if (split.operand === null) {
+          // No operand at all: env itself rejects the invocation, so there is
+          // no command to gate — consume the bare option and move on.
+          rest = split.rest;
+          continue;
+        }
+        const decoded = decodeEnvSplitOperand(split.operand);
+        if (decoded === undefined) return UNCLASSIFIABLE_ENV_SPLIT;
+        rest = `${decoded} ${split.rest}`.trimStart();
+        continue;
+      }
+      // `--…` env long options, exact or an unambiguous GNU abbreviation:
+      // consumed with the operand shape the option declares. split-string's
+      // operand is decoded and re-entered here, like `-S`; unknown or ambiguous
+      // long options are what env itself rejects (nothing runs), so they are
+      // left behind and the loop stops — there is no command to classify.
+      const long = parseEnvLongOption(rest);
+      if (long !== undefined) {
+        if (long.next === "leave") return rest;
+        if (long.next === "split") {
+          if (long.operand === null) {
+            // `--split-string` with no operand: env rejects the invocation.
+            rest = "";
+            continue;
+          }
+          const decoded = decodeEnvSplitOperand(long.operand);
+          if (decoded === undefined) return UNCLASSIFIABLE_ENV_SPLIT;
+          rest = `${decoded} ${long.rest}`.trimStart();
+          continue;
+        }
+        rest = long.rest;
+        continue;
+      }
+      // `env -- cmd`: the separator ends env's argument list; the command
+      // follows — command or not, the outer fixpoint loop re-checks it.
+      if (consume(/^--\s+/)) {
+        current = rest;
+        break;
+      }
+      // An assignment: `env FOO=1 cmd` (`FOO= cmd` — the empty value env also
+      // honours — is an assignment too, because the `=` makes it one).
+      if (consume(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S*)\s+/)) continue;
+      // Short-option cluster: operand-taking flag terminal in the token (the
+      // operand is the next token), operand-taking flag mid-token (the rest of
+      // the token is its operand), a bare cluster of no-operand flags, or the
+      // lone `-` that means `-i` (the cluster is then empty).
+      if (
+        consume(
+          /^-(?:[i0v]*[uC]\s+\S+|[i0v]*[uC]\S+|[i0v]+)?\s+/,
+        )
+      ) {
+        continue;
+      }
+      current = rest;
+      break;
+    }
+  }
+}
+
 /** `bash -c`, `sh -c`, `zsh -c` with optional preceding flags — `-lc` and
  *  friends parse as combined short options, so the `c` may ride in the same
  *  token as the flags before it. A `bash -n` parse check is deliberately not
@@ -224,14 +696,18 @@ function shellCommandInner(segment: string): string | undefined {
  *  command (#558). The old stripper recognised `env` and `sudo` and nothing
  *  else, so a whole-package `bun test` became allowed the moment a worker
  *  wrapped it in `timeout`/`nice`/`bash -c`. Chains matter — `timeout 300
- *  nice bun test` is one command with two wrappers — so the table is matched
- *  repeatedly until the leading word belongs to the command itself.
+ *  nice bun test` is one command with two wrappers, and an `env` with its own
+ *  options may sit anywhere in the chain (`sudo env -u NAME timeout 300 bun
+ *  test`) — so env is stripped before the table and again after each match,
+ *  and the table is matched repeatedly until the leading word belongs to the
+ *  command itself.
  */
 function stripCommandPrefix(segment: string): string {
-  let stripped = segment;
+  let stripped = stripEnvPrefix(segment);
   let match: RegExpExecArray | null;
   while ((match = COMMAND_WRAPPER_PREFIX.exec(stripped)) !== null) {
     stripped = stripped.slice(match[0].length);
+    stripped = stripEnvPrefix(stripped);
   }
   return stripped;
 }
@@ -448,6 +924,12 @@ function gitTagIsWrite(segment: string): boolean {
 function releaseCommandMatch(command: string): { shape: GateShape; matched: string } | undefined {
   for (const raw of commandSegments(command)) {
     const segment = stripCommandPrefix(raw);
+    // A segment whose `env -S` operand expands a runtime variable cannot be
+    // classified from a static command line; refuse the whole command rather
+    // than let an unclassified whole-package run past.
+    if (segment === UNCLASSIFIABLE_ENV_SPLIT) {
+      return { shape: SHARED_HOST_SHAPE, matched: raw.trim() };
+    }
     // A `bash -c '<cmd>'` / `sh -c "<cmd>"` wrapper executes the quoted
     // string, so classify that string as a command of its own: a whole
     // package inside the quotes is refused (#558), a focused run inside
@@ -667,6 +1149,18 @@ function sharedHostRefusalReason(matched: string | undefined): string {
       "Run a focused `bun test <file>.test.ts` instead."
     );
   }
+  // The only shared-host matches that still open with `env` are the -S
+  // operands this policy refuses rather than classify (a runtime `${…}`
+  // expansion, or an escape env's split-string parser rejects). Name that,
+  // not the generic suite wording, so a refused command reads like what it is.
+  if (matched !== undefined && /^env\s+/.test(matched)) {
+    return (
+      "Blocked by sharedHostPolicy: an `env -S`/`--split-string` operand cannot be classified from a static " +
+      "command line — it carries a `${…}`/`$` runtime expansion or an escape env's split-string parser does " +
+      "not accept. Refusing rather than guessing whether it runs a whole-package `bun test`; spell the " +
+      "command literally instead."
+    );
+  }
   if (matched !== undefined) {
     return (
       `Blocked by sharedHostPolicy: \`${matched}\` is a shared-host shell suite and not a worker's proof ` +