one-code-extension 0.4.1 → 0.5.0

package/extensions/worktree/guards.ts

@@ -11,24 +11,27 @@
  *    whose repository is decided at runtime (`xargs`/`parallel`/`find -exec`
  *    feeding it arguments, a `-C "$DIR"` computed from a variable, a `cd`
  *    whose destination cannot be resolved), or that points into the shared
- *    checkout or a sibling worktree (`git -C`, `--git-dir`, `--work-tree`, a
- *    preceding `cd`), is refused with the fix named. Git against an unrelated
+ *    checkout or a sibling worktree (`git -C`, `--git-dir`, `--work-tree`,
+ *    `-c core.worktree=`, a `GIT_DIR`/`GIT_WORK_TREE`/`GIT_COMMON_DIR`
+ *    assignment before git or exported earlier in the line, a preceding
+ *    `cd`), is refused with the fix named. Git against an unrelated
  *    repository elsewhere on disk is left alone — the permission gate and
  *    auto-mode still apply to it.
  * 2. The stash stack is shared by the main checkout and every worktree of the
  *    repository, and parallel sessions can interleave on it. Stash forms that
  *    collide with a concurrent session (untagged push, `pop`, `clear`,
- *    ref-less `drop`) are refused with the tag + apply-by-SHA recipe.
+ *    ref-less `drop` and `branch`) are refused with the tag + apply-by-SHA recipe.
  *
- * Steering, not security: only bash is inspected here, and an unparseable
- * command is refused only when it visibly involves git (fail closed on the
- * invariant, fail open on everything else).
+ * Steering, not security: bash (and `monitor`, which runs bash) is inspected
+ * here, PowerShell in powershell-guards.ts, and an unparseable command is
+ * refused only when it visibly involves git (fail closed on the invariant,
+ * fail open on everything else).
  */
 
 import { homedir } from "node:os";
 import { isAbsolute } from "node:path";
-import { isWithin, toAbsoluteBash } from "../auto-mode/paths.ts";
-import { gitSubcommand, leadTokens, parseCommand, resolvePayload, type Token } from "../auto-mode/shell-analysis.ts";
+import { isWithin, resolveForContainment, toAbsoluteBash } from "../auto-mode/paths.ts";
+import { gitSubcommand, INLINE_SCRIPT_SHELLS, isUnknownTilde, leadTokens, LOOPS, movesDirectory, parseCommand, resolvePayload, scopedTracker, type Token } from "../auto-mode/shell-analysis.ts";
 
 export interface WorktreeGuardContext {
 	command: string;
@@ -36,15 +39,59 @@ export interface WorktreeGuardContext {
 	worktreePath: string;
 	/** Root of the shared checkout the worktree belongs to. */
 	sharedRoot: string;
+	/**
+	 * Every worktree of the repository (`git worktree list`). A linked worktree
+	 * can live outside the shared root, and git aimed at it is refused too.
+	 */
+	otherWorktrees?: readonly string[];
 }
 
+/**
+ * Whether a git target lies in a root, judged where both resolve: git lists
+ * worktrees by their real paths (`/private/var/…` on macOS) while the session
+ * and the model may spell a directory through a link (`/var/…`), and a link
+ * inside one worktree may lead anywhere. Lexical only when resolution fails.
+ */
+export const containsPath = (root: string, target: string): boolean => {
+	const resolvedRoot = resolveForContainment(root);
+	const resolvedTarget = resolveForContainment(target);
+	return resolvedRoot !== undefined && resolvedTarget !== undefined ? isWithin(resolvedRoot, resolvedTarget) : isWithin(root, target);
+};
+
+/** The roots a git command must not target: the shared checkout and every other worktree. */
+export const sharedRepositoryRoots = ({ sharedRoot, otherWorktrees }: Pick<WorktreeGuardContext, "sharedRoot" | "otherWorktrees">): string[] => [sharedRoot, ...(otherWorktrees ?? [])];
+
 /** Expansion syntax the guard cannot resolve statically. */
 const hasExpansion = (value: string) => /[$`]/.test(value);
 
-const isolated = (worktreePath: string, problem: string, fix: string): string =>
+export const isolated = (worktreePath: string, problem: string, fix: string): string =>
 	`This session is isolated in the worktree ${worktreePath}, but ${problem}. ` +
 	`Refusing to run it — a worktree-isolated session's git operations must target its own worktree. ${fix}`;
 
+/**
+ * Whether a shell command may run git, so its targets need the repository's
+ * worktree list: any spelling the parse resolves to git (`g"it"`, `\\git`,
+ * `$'\\x67it'`, `env git`), git passed to a runner, git in a script a shell
+ * runs, or a line that does not parse. Over-matching costs one `git worktree list`.
+ */
+export function namesGit(command: string): boolean {
+	if (mentionsGit(command)) return true;
+	const { segments, parseFailed } = parseCommand(command);
+	if (parseFailed) return true;
+	return segments.some((seg) => {
+		const { command: cmd, args } = resolvePayload(leadTokens(seg));
+		return cmd === "git" || args.some((arg) => arg.value === "git" || mentionsGit(arg.value));
+	});
+}
+
+/** The worktree list could not be read, so a git command's target cannot be checked: refuse it. */
+export const unlistedWorktreesReason = (worktreePath: string): string =>
+	isolated(
+		worktreePath,
+		"the repository's worktrees could not be listed, so the repository this git command targets cannot be verified",
+		`Retry; if it keeps failing, run git from ${worktreePath} without -C, --git-dir or --work-tree.`,
+	);
+
 function stashMessage(form: string, hazard: string): string {
 	return (
 		`Blocked: \`${form}\` — the git stash stack is shared between the main checkout and every worktree of this repository, and parallel sessions may push or pop entries concurrently; ${hazard}. ` +
@@ -54,7 +101,7 @@ function stashMessage(form: string, hazard: string): string {
 	);
 }
 
-function stashReason(rest: Token[]): string | undefined {
+export function stashReason(rest: Pick<Token, "value">[]): string | undefined {
 	const words = rest.map((t) => t.value);
 	const sub = words.find((w) => !w.startsWith("-"));
 	// `-m` may ride in a short-flag bundle (`git stash push -um wip`).
@@ -80,19 +127,98 @@ function stashReason(rest: Token[]): string | undefined {
 			return stashMessage("git stash drop", "a ref-less `drop` deletes whatever is currently stash@{0}, which may be another session's entry");
 		}
 	}
+	if (sub === "branch") {
+		// `git stash branch <name> [<stash>]`: without the stash ref it pops stash@{0}.
+		const operands = words.slice(words.indexOf("branch") + 1).filter((w) => !w.startsWith("-"));
+		if (operands.length < 2) {
+			return stashMessage("git stash branch", "without a stash ref, `branch` pops whatever is currently stash@{0}, which may be another session's entry");
+		}
+	}
 	return undefined;
 }
 
-export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: WorktreeGuardContext): string | undefined {
-	const { segments, parseFailed } = parseCommand(command);
-	if (parseFailed || segments.length === 0) {
-		if (!/\bgit\b/.test(command)) return undefined;
-		return isolated(
+/** Environment variables that point git at a repository, like `--git-dir` and `--work-tree`. */
+const GIT_REPOSITORY_ENV = /^(GIT_DIR|GIT_WORK_TREE|GIT_COMMON_DIR)=/;
+
+/** `declare -x` / `typeset -gx`: the builtins that export like `export`. */
+const exportsLikeExport = (cmd: string, args: Token[]) =>
+	cmd === "export" || ((cmd === "declare" || cmd === "typeset") && args.some((arg) => /^-[a-zA-Z]*x/.test(arg.value)));
+
+export function worktreeBashGuardReason(context: WorktreeGuardContext): string | undefined {
+	return guardScript(context.command, context.worktreePath, sharedRepositoryRoots(context), context.worktreePath, 0).reason;
+}
+
+/**
+ * Judge one script that starts in `startDir` (undefined: not statically
+ * known). Returns the refusal, if any, and whether the script can change the
+ * directory of the shell it runs in (what an `eval` of it would do).
+ */
+/** Builtins that run a script in this shell. */
+const SCRIPT_RUNNERS: ReadonlySet<string> = new Set(["eval", "source", "."]);
+
+/** Shell options that take the next word as their value. */
+const SHELL_VALUE_OPTIONS = new Set(["-o", "+o", "-O", "+O", "--rcfile", "--init-file"]);
+
+/**
+ * The command lines a shell invocation runs: with `-c` (alone or in a cluster
+ * such as `-lc`), the first operand; the words after it are `$0`, `$1`, …
+ * (`bash -c 'echo ok' 'git status'` runs no git), unless the script expands
+ * them (`bash -c '"$@"' _ git status`), when they are a command line too.
+ * Without `-c`, every argument, since which one is a script file is not known.
+ */
+function shellScripts(args: Token[]): string[] {
+	let command = false;
+	let i = 0;
+	for (; i < args.length; i++) {
+		const value = args[i].value;
+		if (value === "--" || value === "-") {
+			i++;
+			break;
+		}
+		if (!/^[-+]/.test(value)) break;
+		if (SHELL_VALUE_OPTIONS.has(value)) i++;
+		else if (/^-[A-Za-z]+$/.test(value) && value.includes("c")) command = true;
+	}
+	const values = args.map((arg) => arg.value);
+	if (!command) return values;
+	const [script, ...positional] = values.slice(i);
+	if (script === undefined) return [];
+	// `$0`…`$9`, `$@`, `$*`, `${1}`, `${@}`: read both from `$0` and from `$1`.
+	if (!/\$(?:[0-9@*]|\{[0-9@*])/.test(script) || positional.length === 0) return [script];
+	return [script, positional.join(" "), positional.slice(1).join(" ")];
+}
+
+/** Whether git appears as a word in `text`, read with quotes and backslashes removed (`gi\t`, `g"it"`). */
+const mentionsGit = (text: string): boolean => /\bgit\b/.test(text.replace(/[\\'"]/g, ""));
+
+/**
+ * A script the guard cannot follow (it failed to parse, or is nested too deep):
+ * refused if git appears anywhere in it, and a `cd` in it leaves the directory
+ * unknown.
+ */
+function unverifiedScript(command: string, worktreePath: string, mayMove: boolean): { reason?: string; moves?: boolean } {
+	if (!mentionsGit(command)) return { moves: mayMove && /\b(?:cd|pushd|popd)\b/.test(command) };
+	return {
+		reason: isolated(
 			worktreePath,
 			"this command is too complex to verify that its git operations stay inside the worktree",
 			`Break it into plain, separate git commands with literal paths and run them from ${worktreePath}.`,
-		);
-	}
+		),
+	};
+}
+
+/** How many directories a segment may run in before the guard treats its directory as unknown. */
+const MAX_POSSIBLE_DIRS = 8;
+
+function guardScript(
+	command: string,
+	worktreePath: string,
+	sharedRoots: readonly string[],
+	startDir: string | undefined,
+	depth: number,
+): { reason?: string; moves?: boolean } {
+	const { segments, parseFailed } = parseCommand(command);
+	if (parseFailed || segments.length === 0) return unverifiedScript(command, worktreePath, parseFailed);
 
 	// Claude Code's exact refusal for stdin-fed git (one static string for
 	// both mechanisms) — keep it byte-identical to the capture.
@@ -103,38 +229,141 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 			`Run the equivalent from ${worktreePath} without the redirect.`,
 		);
 
-	/** Directory later segments run in; undefined = not statically known. */
-	let dir: string | undefined = worktreePath;
-	/** Subshell nesting: a `cd` inside `(...)` must not leak past the `)`. */
-	let depth = 0;
-	let dirBeforeSubshell: { dir: string | undefined } | undefined;
+	/** Directory the current segment runs in; undefined = not statically known. */
+	let dir: string | undefined = startDir;
+	/**
+	 * Repository variables an earlier `export` in this line set, by name:
+	 * the directory they name, or undefined when it is not statically known.
+	 * Later git in the line runs with them. Subshell scopes are ignored, which
+	 * can only refuse more.
+	 */
+	const exportedGitEnv = new Map<string, string | undefined>();
+	const envTarget = (value: string, token: Token | undefined): string | undefined =>
+		!value || hasExpansion(value) || token?.dynamic || token?.glob || dir === undefined ? undefined : toAbsoluteBash(dir, value, homedir());
+	/**
+	 * The directories a segment may run in, per subshell scope
+	 * (`Segment.scopes`): a `cd` inside `( … )`, a substitution or a pipeline
+	 * member does not leak out. A `cd` that may not run (`false && cd x`, an
+	 * `if` branch) leaves both the old and the new directory possible, and every
+	 * git command must be safe in each.
+	 */
+	const scopeDirs = scopedTracker<(string | undefined)[]>([startDir]);
+
+	// A git command as the parse sees it, spelled any way (`gi\t`, `env git`,
+	// `xargs git`, `parallel git`), or anywhere in the script a shell or `eval`
+	// runs (`bash -c '…'`), read as text with quotes and backslashes removed so
+	// a script too complex to parse still counts.
+	const runsGit = (seg: (typeof segments)[number]) => {
+		const { command: cmd, args } = resolvePayload(leadTokens(seg));
+		if (cmd === "git" || (cmd === "parallel" && args.some((arg) => arg.value === "git"))) return true;
+		if (!INLINE_SCRIPT_SHELLS.has(cmd) && !SCRIPT_RUNNERS.has(cmd)) return false;
+		return args.some((arg) => mentionsGit(arg.value));
+	};
+	// A loop body runs more than once, so a `cd` in it moves every git command
+	// in the loop after the first pass; the segments show one pass only.
+	// An `eval` there may `cd` too.
+	const movesOrEvals = (seg: (typeof segments)[number]) => movesDirectory(seg) || resolvePayload(leadTokens(seg)).command === "eval";
+	const movesInLoop = segments.some((seg) => seg.enclosing.some((construct) => LOOPS.has(construct)) && movesOrEvals(seg));
+	if (movesInLoop && segments.some(runsGit)) {
+		return {
+			reason: isolated(
+				worktreePath,
+				"this command changes directory inside a loop, so the repository its git commands target cannot be verified",
+				`Break it into plain, separate git commands with literal paths and run them from ${worktreePath}.`,
+			),
+		};
+	}
+	// The last member of a pipeline runs in the current shell under `shopt -s
+	// lastpipe`, so its `cd` may move every later command.
+	// Only a git command after such a `cd` can be moved by it.
+	// Inside a substitution too (`$(echo | cd /repo; git status)`), but only for
+	// git later in the shell that tail runs in.
+	const inShell = (seg: (typeof segments)[number], shell: number[]) => shell.every((scope, depth) => seg.scopes[depth] === scope);
+	const pipeMoved = segments.some(
+		(cd, index) => cd.pipelineShell && movesDirectory(cd) && segments.slice(index + 1).some((seg) => inShell(seg, cd.pipelineShell!) && runsGit(seg)),
+	);
+	if (pipeMoved) {
+		return {
+			reason: isolated(
+				worktreePath,
+				"this command changes directory in the last command of a pipeline, which can run in the current shell, so the repository its git commands target cannot be verified",
+				`Break it into plain, separate git commands with literal paths and run them from ${worktreePath}.`,
+			),
+		};
+	}
 
 	const checkSegment = (seg: (typeof segments)[number]): string | undefined => {
 		const tokens = leadTokens(seg);
 		const rawLead = tokens[0]?.value;
 		if (!rawLead) return undefined;
+		// The command a wrapper runs (`builtin cd`, `command cd`), not the first word.
+		const { command: lead, args: leadArgs } = resolvePayload(tokens);
 
-		if (rawLead === "cd") {
+		if (lead === "cd") {
 			// Skip cd's own options (-P/-L/-e/-@); `--` ends them; a lone `-`
 			// means the previous directory, which is not statically known.
-			let j = 1;
-			while (j < tokens.length && tokens[j].value.startsWith("-") && !["-", "--"].includes(tokens[j].value)) j++;
-			if (tokens[j]?.value === "--") j++;
-			const target = tokens[j]?.value;
+			let j = 0;
+			while (j < leadArgs.length && leadArgs[j].value.startsWith("-") && !["-", "--"].includes(leadArgs[j].value)) j++;
+			if (leadArgs[j]?.value === "--") j++;
+			const targetToken = leadArgs[j];
+			const target = targetToken?.value;
 			if (!target) dir = homedir();
-			else if (hasExpansion(target) || target === "-") dir = undefined;
+			// A glob (`cd /r*po`), an expansion or `~user` lands wherever bash expands it.
+			else if (hasExpansion(target) || target === "-" || targetToken.glob || targetToken.dynamic || isUnknownTilde(target)) dir = undefined;
 			// An absolute (or ~) destination re-anchors the tracked directory
 			// even when it was unknown — later git commands become checkable again.
 			else if (isAbsolute(target) || target === "~" || target.startsWith("~/")) dir = toAbsoluteBash("/", target, homedir());
 			else if (dir !== undefined) dir = toAbsoluteBash(dir, target, homedir());
 			return undefined;
 		}
-		if (rawLead === "pushd" || rawLead === "popd") {
+		if (lead === "pushd" || lead === "popd") {
 			dir = undefined;
 			return undefined;
 		}
 
 		const { command: cmd, args, peeled } = resolvePayload(tokens);
+		// Git behind a wrapper the strict reading does not peel (`sudo`, `exec`,
+		// `env -C /repo`): the wrapper may have moved it, so its target cannot be
+		// read off the command.
+		// A shell, `eval` or `source` in command position is judged below instead.
+		if (cmd !== "git" && !SCRIPT_RUNNERS.has(cmd) && !INLINE_SCRIPT_SHELLS.has(cmd)) {
+			const wide = resolvePayload(tokens, "wide");
+			const runsScript = INLINE_SCRIPT_SHELLS.has(wide.command) || SCRIPT_RUNNERS.has(wide.command);
+			const shellScript = runsScript && wide.args.some((arg) => mentionsGit(arg.value));
+			if (wide.command === "git" || shellScript || wide.scripts.some(mentionsGit)) {
+				return isolated(
+					worktreePath,
+					`this command runs git through ${rawLead}, which can change the repository it targets`,
+					`Run git directly, with literal paths inside ${worktreePath}.`,
+				);
+			}
+		}
+
+		// A script a shell or `eval` runs is judged as commands of its own,
+		// starting where this command runs: `bash -c 'cd /repo && git status'`
+		// runs git in /repo. A shell's script runs in a child, but `eval` runs
+		// in this shell, so a `cd` in it moves the commands after it.
+		// Past three levels a script is judged as one the guard cannot follow.
+		if (INLINE_SCRIPT_SHELLS.has(cmd) || cmd === "eval") {
+			const scripts = cmd === "eval" ? [args.map((arg) => arg.value).join(" ")] : shellScripts(args);
+			for (const script of scripts) {
+				const nested = depth < 3 ? guardScript(script, worktreePath, sharedRoots, dir, depth + 1) : unverifiedScript(script, worktreePath, true);
+				if (nested.reason) return nested.reason;
+				if (cmd === "eval" && nested.moves) dir = undefined;
+			}
+			return undefined;
+		}
+
+		// `source <(…)`, `. "$f"`: the script is only known at runtime, so git in
+		// its source text cannot be checked.
+		// It runs in this shell, so a `cd` in it would move later git: the
+		// directory is unknown after it. A literal file (`source .venv/bin/activate`)
+		// keeps it: its text is not the guard's to read.
+		if ((cmd === "source" || cmd === ".") && args.some((arg) => arg.dynamic)) {
+			const unverified = unverifiedScript(seg.raw, worktreePath, false);
+			if (unverified.reason) return unverified.reason;
+			dir = undefined;
+		}
 
 		// Git whose arguments are assembled at runtime — the repository it will
 		// target cannot be read off the command.
@@ -152,6 +381,16 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 			);
 		}
 
+		if (exportsLikeExport(cmd, args)) {
+			for (const arg of args) {
+				const name = /^(GIT_DIR|GIT_WORK_TREE|GIT_COMMON_DIR)(=|$)/.exec(arg.value);
+				if (!name) continue;
+				// `export GIT_DIR` (no value) exports whatever it was set to earlier.
+				exportedGitEnv.set(name[1], name[2] ? envTarget(arg.value.slice(name[0].length), arg) : undefined);
+			}
+			return undefined;
+		}
+
 		if (cmd !== "git") return undefined;
 
 		if (dir === undefined) {
@@ -165,15 +404,47 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 		// Effective repository target: the tracked cwd, adjusted by global flags.
 		let effective = dir;
 		const extraTargets: string[] = [];
+		// `GIT_DIR=… git`, `env GIT_WORK_TREE=… git`, and an earlier `export`:
+		// the environment spelling of `--git-dir` / `--work-tree`.
+		const envRefusal = (name: string) =>
+			isolated(
+				worktreePath,
+				`\`${name}\` points git at a repository that is decided at runtime, so it cannot be verified`,
+				`Drop the ${name} setting and run git from ${worktreePath}.`,
+			);
+		const prefix = tokens.slice(0, tokens.length - args.length - 1);
+		const assigned = new Map(exportedGitEnv);
+		for (const token of prefix) {
+			if (!GIT_REPOSITORY_ENV.test(token.value)) continue;
+			const eq = token.value.indexOf("=");
+			assigned.set(token.value.slice(0, eq), envTarget(token.value.slice(eq + 1), token));
+		}
+		for (const [name, target] of assigned) {
+			if (target === undefined) return envRefusal(name);
+			extraTargets.push(target);
+		}
 		let i = 0;
 		while (i < args.length) {
 			const value = args[i].value;
 			if (!value.startsWith("-")) break;
+			// `-c core.worktree=<dir>` is `--work-tree` spelled as config;
+			// `--config-env` takes the value from a variable at runtime.
+			if (value === "-c" && /^core\.worktree=/i.test(args[i + 1]?.value ?? "")) {
+				const raw = args[i + 1].value.slice(args[i + 1].value.indexOf("=") + 1);
+				if (!raw || hasExpansion(raw)) return envRefusal("core.worktree");
+				extraTargets.push(toAbsoluteBash(effective, raw, homedir()));
+				i += 2;
+				continue;
+			}
+			if ((value === "--config-env" && /^core\.worktree=/i.test(args[i + 1]?.value ?? "")) || /^--config-env=core\.worktree=/i.test(value)) {
+				return envRefusal("core.worktree");
+			}
 			const pathFlag = value === "-C" || value === "--git-dir" || value === "--work-tree";
 			const inlined = value.startsWith("--git-dir=") || value.startsWith("--work-tree=");
 			if (pathFlag || inlined) {
-				const raw = inlined ? value.slice(value.indexOf("=") + 1) : args[i + 1]?.value;
-				if (!raw || hasExpansion(raw)) {
+				const pathToken = inlined ? args[i] : args[i + 1];
+				const raw = inlined ? value.slice(value.indexOf("=") + 1) : pathToken?.value;
+				if (!raw || hasExpansion(raw) || pathToken?.dynamic || pathToken?.glob || isUnknownTilde(raw)) {
 					return isolated(
 						worktreePath,
 						`\`git ${value}\` computes its repository target at runtime, so it cannot be verified`,
@@ -191,8 +462,8 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 
 		const targets = [effective, ...extraTargets];
 		for (const target of targets) {
-			if (isWithin(worktreePath, target)) continue;
-			if (isWithin(sharedRoot, target)) {
+			if (containsPath(worktreePath, target)) continue;
+			if (sharedRoots.some((root) => containsPath(root, target))) {
 				return isolated(
 					worktreePath,
 					`this git command targets ${target}, which is the shared checkout or another worktree of the same repository`,
@@ -205,7 +476,7 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 		// The stash stack is per-repository and shared across its worktrees. Any
 		// shared-root target that is NOT inside the worktree already returned
 		// above, so only worktree-contained targets can reach this check.
-		if (targets.some((t) => isWithin(worktreePath, t))) {
+		if (targets.some((t) => containsPath(worktreePath, t))) {
 			const { sub, rest } = gitSubcommand(args);
 			if (sub === "stash") {
 				const reason = stashReason(rest);
@@ -216,26 +487,17 @@ export function worktreeBashGuardReason({ command, worktreePath, sharedRoot }: W
 	};
 
 	for (const seg of segments) {
-		// Subshell bookkeeping reads the RAW tokens — leadTokens strips the very
-		// parens being counted. A `cd` between `(` and `)` is scoped: the tracked
-		// directory is restored when the subshell closes.
-		const first = seg.tokens[0]?.value ?? "";
-		const opens = (/^\(+/.exec(first)?.[0] ?? "").length;
-		if (opens > 0 && depth === 0) dirBeforeSubshell = { dir };
-		depth += opens;
-
-		const reason = checkSegment(seg);
-		if (reason) return reason;
-
-		const last = seg.tokens[seg.tokens.length - 1]?.value ?? "";
-		const closes = (/\)+$/.exec(last)?.[0] ?? "").length;
-		if (closes > 0 && depth > 0) {
-			depth = Math.max(0, depth - closes);
-			if (depth === 0 && dirBeforeSubshell) {
-				dir = dirBeforeSubshell.dir;
-				dirBeforeSubshell = undefined;
-			}
+		const before = scopeDirs.get(seg);
+		const after: (string | undefined)[] = [];
+		for (const start of before) {
+			dir = start;
+			const reason = checkSegment(seg);
+			if (reason) return { reason };
+			after.push(dir);
 		}
+		const possible = [...new Set(seg.conditional ? [...before, ...after] : after)];
+		// Past a handful of possibilities the directory is as good as unknown.
+		scopeDirs.set(seg, possible.length > MAX_POSSIBLE_DIRS ? [undefined] : possible);
 	}
-	return undefined;
+	return { moves: segments.some(movesDirectory) || segments.some((seg) => resolvePayload(leadTokens(seg)).command === "eval") };
 }