one-code-extension 0.4.1 → 0.6.0

package/extensions/permissions/powershell-rules.ts

@@ -12,27 +12,28 @@
  *   case-insensitive. Aliases PowerShell 7 dropped because they collide with
  *   native executables (`sort`, `sc`, `curl`, `wget`) are deliberately absent,
  *   as in CC: mapping `sort` to `Sort-Object` would judge the wrong program.
- * - **Statement split.** A command line is split on `|`, `;`, `&&`, `||` and
- *   unquoted newlines, outside `'…'`, `"…"` and `@'…'@` / `@"…"@` here-strings,
- *   with backtick escapes honoured. For an allow rule every part must match
- *   (CC: "every subcommand must match"); a deny/ask rule fires on any part.
- *   Unbalanced quoting is a parse failure → no allow, the user is asked.
- * - **No AST.** Claude Code parses the command; v1 here is textual and
- *   conservative in the only direction that matters: a wildcard or prefix
- *   allow never covers a line whose meaning is not on its face — `$(…)`
- *   subexpressions, backtick escapes, the `&`/`.` call operators,
- *   `Invoke-Expression`, `-EncodedCommand`, script blocks.
+ * - **Statement split.** A command line is split on `|`, `;`, `&&`, `||`, a
+ *   single (background) `&`, and unquoted line breaks (`\n`, or `\r` on its
+ *   own), outside `'…'`, `"…"` and `@'…'@` / `@"…"@` here-strings (the
+ *   typographic quotes included, as pwsh reads them) and comments, with
+ *   backtick escapes honoured. For an allow rule every part must match (CC:
+ *   "every subcommand must match"); a deny/ask rule fires on any part, and on
+ *   a rough split as well. Unbalanced quoting is a parse failure → no allow,
+ *   the user is asked.
+ * - **Textual rule matching.** Rule matching stays on this split, which
+ *   matches more forms than the tree, never fewer; it is conservative in the
+ *   only direction that matters: a wildcard or prefix allow never covers a
+ *   line whose meaning is not on its face — `$(…)` subexpressions, backtick
+ *   escapes, the `&`/`.` call operators, `Invoke-Expression`,
+ *   `-EncodedCommand`, script blocks.
  *
- * `powershellReadOnly` ports the read-only allowlist Claude Code uses to skip
- * approval — the cmdlet sets from the 2.1.276 binary — and adds path
- * containment by shape: a read of an absolute, `~`, drive-lettered, UNC or
- * `..` path is not auto-cleared (UNC paths always ask in CC). Anything the
- * check cannot vouch for is simply "not read-only", which costs a classifier
- * call or a prompt, never a bypass — docs/decisions/windows.md.
+ * `powershellReadOnly`, the read-only verdict the gate skips approval on, is
+ * judged from PowerShell's own parse instead (`powershell-tree.ts`,
+ * decisions/windows.md "The PowerShell pre-gate reads PowerShell's own parse").
  */
 
-import { isAbsolute } from "node:path";
-import { isWithin, resolveForContainment, toAbsolute } from "../auto-mode/paths.ts";
+import type { PowerShellParse } from "../lib/powershell-parser.ts";
+import { type PowerShellTreeOptions, powershellTreeReadOnly } from "./powershell-tree.ts";
 
 /** Claude Code's `COMMON_ALIASES` (utils/powershell/parser.ts), alias → canonical cmdlet. */
 export const POWERSHELL_ALIASES: Readonly<Record<string, string>> = Object.freeze({
@@ -160,11 +161,12 @@ export function canonicalizeStatement(statement: string): string {
 
 /**
  * The separately executing statements of a PowerShell line — what `|`, `;`,
- * `&&`, `||` and unquoted newlines separate — or undefined when quoting is
- * unbalanced. Single quotes, double quotes, here-strings (`@'…'@`, `@"…"@`,
- * whose closer must start a line) and backtick escapes are honoured; a `|`
- * inside `Where-Object { $_ -match 'a|b' }` still splits, conservatively, so
- * an allow rule over a script block has to cover the pieces.
+ * `&&`, `||`, a single `&` and unquoted line breaks separate — or undefined
+ * when quoting is unbalanced. Single quotes, double quotes, here-strings
+ * (`@'…'@`, `@"…"@`, whose closer must start a line), comments and backtick
+ * escapes are honoured (`lexPowerShell`); a `|` inside `Where-Object { $_
+ * -match 'a|b' }` still splits, conservatively, so an allow rule over a
+ * script block has to cover the pieces.
  */
 export function powershellStatements(command: string): string[] | undefined {
 	// One decision parses the same line from several places (read-only check,
@@ -177,103 +179,183 @@ export function powershellStatements(command: string): string[] | undefined {
 }
 let lastSplit: { command: string; statements: string[] | undefined } | undefined;
 
-function splitStatements(command: string): string[] | undefined {
-	const parts: string[] = [];
-	let current = "";
+/**
+ * PowerShell's quote characters. The tokenizer takes the typographic quotes as
+ * quotes too, interchangeably with the ASCII ones: `'x’ ; Remove-Item y ; ‘z'`
+ * is three statements, not one string. Checked against pwsh 7.6's parser.
+ */
+const SINGLE_QUOTES = new Set(["'", "‘", "’", "‚", "‛"]);
+const DOUBLE_QUOTES = new Set(['"', "“", "”", "„"]);
+
+/**
+ * How the lexer sees one character of a line: unquoted code, where separators
+ * and operators mean what they say; a literal (inside a string or
+ * here-string, or escaped by a backtick); or a comment, which never runs.
+ */
+const CODE = 0;
+const LITERAL = 1;
+const COMMENT = 2;
+type Lex = typeof CODE | typeof LITERAL | typeof COMMENT;
+
+/** A line break as PowerShell reads one: `\n`, and a carriage return on its own too. */
+function isLineBreak(ch: string | undefined): boolean {
+	return ch === "\n" || ch === "\r";
+}
+
+/**
+ * Whether position `i` starts a token, where `#` and `<#` open a comment. In
+ * `x#(Set-Content f y)` the `#` is part of the word, and the parenthesis after
+ * it still runs.
+ */
+function atTokenStart(text: string, i: number): boolean {
+	return i === 0 || /[\s;|&(){}]/.test(text[i - 1]);
+}
+
+/**
+ * Classify every character of a PowerShell line, or undefined when a
+ * string, here-string or block comment never closes. The one lexer the
+ * statement split and the grouping check share, so they cannot disagree about
+ * what is quoted. It follows pwsh's tokenizer on the points that decide where
+ * a statement ends: both quote families, doubled quotes, backtick escapes
+ * (outside quotes and inside double quotes), here-strings whose closer starts
+ * a line (after `\n` or a lone `\r`), and line and block comments at a token
+ * start. It does not follow a `$(…)` inside a double-quoted string; every
+ * consumer refuses or rough-splits a line with `$(` anyway.
+ */
+function lexPowerShell(text: string): Lex[] | undefined {
+	const kinds: Lex[] = new Array(text.length);
 	let i = 0;
-	const text = command;
-	type Quote = "'" | '"' | "@'" | '@"' | undefined;
-	let quote: Quote;
-	const push = () => {
-		const trimmed = current.trim();
-		if (trimmed) parts.push(trimmed);
-		current = "";
+	const mark = (from: number, to: number, kind: Lex) => {
+		for (let k = from; k < to; k++) kinds[k] = kind;
 	};
 	while (i < text.length) {
 		const ch = text[i];
 		const next = text[i + 1];
-		if (quote === "@'" || quote === '@"') {
-			// A here-string closes only with its terminator at the start of a line.
-			const closer = quote === "@'" ? "'@" : '"@';
-			if ((i === 0 || text[i - 1] === "\n") && text.startsWith(closer, i)) {
-				current += closer;
-				i += 2;
-				quote = undefined;
-				continue;
-			}
-			current += ch;
-			i++;
+		if (ch === "`" && i + 1 < text.length) {
+			kinds[i] = CODE;
+			kinds[i + 1] = LITERAL;
+			i += 2;
 			continue;
 		}
-		if (quote === "'") {
-			current += ch;
-			i++;
-			if (ch === "'") {
-				if (next === "'") {
-					current += next;
-					i++; // doubled quote is a literal quote
-				} else quote = undefined;
-			}
+		if (ch === "#" && atTokenStart(text, i)) {
+			let end = i;
+			while (end < text.length && !isLineBreak(text[end])) end++;
+			mark(i, end, COMMENT);
+			i = end;
 			continue;
 		}
-		if (quote === '"') {
-			current += ch;
-			i++;
-			if (ch === "`" && i < text.length) {
-				current += text[i];
-				i++;
-				continue;
-			}
-			if (ch === '"') {
-				if (next === '"') {
-					current += next;
-					i++;
-				} else quote = undefined;
-			}
+		if (ch === "<" && next === "#" && atTokenStart(text, i)) {
+			const close = text.indexOf("#>", i + 2);
+			if (close === -1) return undefined;
+			mark(i, close + 2, COMMENT);
+			i = close + 2;
 			continue;
 		}
-		// Unquoted.
-		if (ch === "`" && i + 1 < text.length) {
-			current += ch + text[i + 1];
-			i += 2;
+		if (ch === "@" && next !== undefined && (SINGLE_QUOTES.has(next) || DOUBLE_QUOTES.has(next))) {
+			// A here-string closes only with a quote of its family and `@` at the start of a line.
+			const family = SINGLE_QUOTES.has(next) ? SINGLE_QUOTES : DOUBLE_QUOTES;
+			let end = i + 2;
+			while (end < text.length && !(isLineBreak(text[end - 1]) && family.has(text[end]) && text[end + 1] === "@")) end++;
+			if (end >= text.length) return undefined;
+			mark(i, end + 2, LITERAL);
+			i = end + 2;
 			continue;
 		}
-		if (ch === "#") {
-			// Line comment runs to end of line.
-			const eol = text.indexOf("\n", i);
-			i = eol === -1 ? text.length : eol;
+		if (SINGLE_QUOTES.has(ch)) {
+			let end = i + 1;
+			for (;;) {
+				if (end >= text.length) return undefined;
+				if (SINGLE_QUOTES.has(text[end])) {
+					if (SINGLE_QUOTES.has(text[end + 1] ?? "")) end += 2; // a doubled quote is a literal quote
+					else break;
+				} else end++;
+			}
+			mark(i, end + 1, LITERAL);
+			i = end + 1;
 			continue;
 		}
-		if (ch === "@" && (next === "'" || next === '"')) {
-			quote = next === "'" ? "@'" : '@"';
-			current += ch + next;
-			i += 2;
+		if (DOUBLE_QUOTES.has(ch)) {
+			let end = i + 1;
+			for (;;) {
+				if (end >= text.length) return undefined;
+				if (text[end] === "`") end += 2;
+				else if (DOUBLE_QUOTES.has(text[end])) {
+					if (DOUBLE_QUOTES.has(text[end + 1] ?? "")) end += 2;
+					else break;
+				} else end++;
+			}
+			mark(i, end + 1, LITERAL);
+			i = end + 1;
 			continue;
 		}
-		if (ch === "'" || ch === '"') {
-			quote = ch;
+		kinds[i] = CODE;
+		i++;
+	}
+	return kinds;
+}
+
+/**
+ * Split on the statement separators PowerShell 7 runs: `&&`, `||`, `|`, `;`,
+ * a line break (`\n`, or `\r` on its own), and a single `&`. A single `&`
+ * that starts a statement is the call operator and stays in it; after `>` it
+ * is part of a redirection (`2>&1`); anywhere else it is the background
+ * operator, and the next statement runs at once (`Get-ChildItem & Remove-Item
+ * x` runs both). Comments are dropped.
+ */
+function splitStatements(command: string): string[] | undefined {
+	const kinds = lexPowerShell(command);
+	if (!kinds) return undefined;
+	const parts: string[] = [];
+	let current = "";
+	const push = () => {
+		const trimmed = current.trim();
+		if (trimmed) parts.push(trimmed);
+		current = "";
+	};
+	for (let i = 0; i < command.length; i++) {
+		const ch = command[i];
+		const kind = kinds[i];
+		if (kind === COMMENT) continue;
+		if (kind === LITERAL) {
 			current += ch;
-			i++;
 			continue;
 		}
+		const next = kinds[i + 1] === CODE ? command[i + 1] : undefined;
 		if ((ch === "&" && next === "&") || (ch === "|" && next === "|")) {
 			push();
-			i += 2;
+			i++;
 			continue;
 		}
-		if (ch === "|" || ch === ";" || ch === "\n") {
+		if (ch === "|" || ch === ";" || isLineBreak(ch)) {
+			push();
+			continue;
+		}
+		if (ch === "&" && current.trim() !== "" && command[i - 1] !== ">") {
 			push();
-			i++;
 			continue;
 		}
 		current += ch;
-		i++;
 	}
-	if (quote !== undefined) return undefined;
 	push();
 	return parts;
 }
 
+/**
+ * Whether the line has a `(` outside quotes and comments. PowerShell
+ * evaluates a grouping expression in argument position before calling the
+ * command, so `Write-Output (Set-Content f x)` writes `f` behind a read-only
+ * cmdlet (AUTO-MODE-SECURITY-REVIEW-2026-09-24 H2); Claude Code's parser
+ * marks the same node a subexpression. A quoted `(` is a literal (`"Program
+ * Files (x86)"`), and a backtick-escaped one is too. An unbalanced line
+ * counts as having one: nothing can vouch for it.
+ */
+function hasGroupingExpression(command: string): boolean {
+	const kinds = lexPowerShell(command);
+	if (!kinds) return true;
+	for (let i = 0; i < command.length; i++) if (kinds[i] === CODE && command[i] === "(") return true;
+	return false;
+}
+
 /** `& cmd` (call operator) or `. script.ps1` (dot-sourcing) at the head of a statement. */
 function startsWithCallOperator(statement: string): boolean {
 	const trimmed = statement.trim();
@@ -286,15 +368,26 @@ export function statementCommand(statement: string): string {
 	return canonicalCommandName(word).toLowerCase();
 }
 
+/**
+ * A control character the lexer does not model: C0 other than tab, line feed
+ * and carriage return, DEL, C1 (NEL included), and the Unicode line and
+ * paragraph separators. pwsh reads some as whitespace and some as part of a
+ * word; the split here honours neither, so a line with one is never covered
+ * by a wildcard or prefix allow rule.
+ */
+const UNRECOGNISED_CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u2028\u2029]/;
+
 /**
  * Why a wildcard or prefix allow rule must not cover this line: constructs
  * whose effect is not what the words say. Exact rules (the literal string the
  * user approved) are unaffected. Returns undefined when none is present.
  */
 export function powershellInjectionSyntax(command: string): string | undefined {
+	if (UNRECOGNISED_CONTROL.test(command)) return "a control character";
 	if (/\$\(/.test(command)) return "a $(…) subexpression";
 	if (/`/.test(command)) return "a backtick escape";
 	if (/\{/.test(command)) return "a script block";
+	if (hasGroupingExpression(command)) return "a (…) grouping expression";
 	if (/-e(nc|ncoded|ncodedcommand)?\b/i.test(command) && /\b(pwsh|powershell)(\.exe)?\b/i.test(command)) return "an encoded command";
 	const statements = powershellStatements(command);
 	for (const statement of statements ?? []) {
@@ -338,148 +431,28 @@ export function powershellMatchForms(command: string, depth = 0): string[] {
 		const nested = nestedShellScript(statement);
 		if (nested) for (const form of powershellMatchForms(nested, depth + 1)) forms.add(form);
 	}
-	return [...forms];
-}
-
-// ---------------------------------------------------------------------------
-// Read-only allowlist
-
-/**
- * The read-only cmdlet sets in the 2.1.276 binary (findings §22), plus the
- * neutral output pair, plus — One Code's addition (2026-09-19, user decision,
- * docs/decisions/windows.md) — the pure in-process pipeline cmdlets a
- * read-only line is piped through: they shape objects already in memory and
- * touch neither disk nor network. `Where-Object`/`ForEach-Object` are NOT
- * here: they take script blocks, which the check refuses anyway. Claude Code's
- * captured list has no pipeline cmdlets at all, so `Select-String … |
- * Measure-Object` (the /doctor transcript scan) always went to the classifier.
- */
-export const READ_ONLY_POWERSHELL_COMMANDS = new Set<string>([
-	// search
-	"select-string",
-	"get-childitem",
-	"findstr",
-	"where.exe",
-	// read
-	"get-content",
-	"get-item",
-	"test-path",
-	"resolve-path",
-	"get-process",
-	"get-service",
-	"get-location",
-	"get-filehash",
-	"get-acl",
-	"format-hex",
-	// neutral output
-	"write-output",
-	"write-host",
-	// pure pipeline transforms (One Code's addition)
-	"select-object",
-	"sort-object",
-	"measure-object",
-	"group-object",
-	"convertfrom-json",
-	"out-string",
-	"format-table",
-	"format-list",
-	"format-wide",
-	"format-custom",
-]);
-
-/** Parameters that turn a read-only cmdlet into a write. */
-const WRITING_PARAMETERS = /^-(outfile|filepath|destination)\b/i;
-
-/**
- * Whether a token names a path this check will not vouch for by shape: UNC
- * (`\\server`), home (`~`), a PSDrive outside the filesystem (`HKLM:`,
- * `env:`), or one that climbs (`..`). An absolute or drive-lettered path is
- * judged by `pathOutsideRoots` when roots are known, and refused otherwise.
- */
-function pathUnvouchable(value: string): boolean {
-	if (!value) return false;
-	if (value.startsWith("\\\\") || value.startsWith("//")) return true;
-	if (/^[A-Za-z][A-Za-z0-9]+:/.test(value)) return true; // HKLM:, env:, cert: (a drive is one letter)
-	// Drive-relative (`C:foo.txt`, no separator after the colon) means "foo.txt
-	// relative to PowerShell's current directory ON C:", which need not be the
-	// tool's cwd; `path.isAbsolute` does not call it absolute, so `toAbsolute`
-	// would join it onto the cwd and vouch for the wrong file. Refuse by shape.
-	if (/^[A-Za-z]:(?![\\/])/.test(value)) return true;
-	if (value.startsWith("~")) return true;
-	if (/(^|[\\/])\.\.([\\/]|$)/.test(value)) return true;
-	return false;
-}
-
-/**
- * PowerShell's array syntax splits an argument on commas — outside quotes.
- * `"a,b.txt"` is one path with a comma in its name; `a,"b,c"` is two.
- */
-export function splitPowerShellList(token: string): string[] {
-	const parts: string[] = [];
-	let current = "";
-	let quote: string | undefined;
-	for (const ch of token) {
-		if (quote) {
-			if (ch === quote) quote = undefined;
-			else current += ch;
-		} else if (ch === '"' || ch === "'") {
-			quote = ch;
-		} else if (ch === ",") {
-			parts.push(current);
-			current = "";
-		} else {
-			current += ch;
-		}
+	// A rough split on every separator and grouping character, quotes ignored:
+	// it catches a statement inside `$(…)`, `(…)` or `{…}`, and every
+	// statement of a line the lexer could not read (bash's counterpart adds
+	// the same rough split for an unparseable line).
+	for (const piece of trimmed.split(ROUGH_SEPARATORS)) {
+		const part = piece.trim();
+		if (!part) continue;
+		forms.add(part);
+		forms.add(canonicalizeStatement(part));
 	}
-	parts.push(current);
-	return parts;
+	return [...forms];
 }
 
-/** An absolute path by Windows or POSIX spelling: `C:\x`, `C:/x`, `/x`, `\x`. */
-function isAbsoluteSpelling(value: string): boolean {
-	return /^[A-Za-z]:/.test(value) || value.startsWith("/") || value.startsWith("\\");
-}
+/** Everything that can end or open a statement, for the deny/ask rough split. */
+const ROUGH_SEPARATORS = /[;|&\r\n(){}]+/;
 
-export interface PowerShellReadOnlyOptions {
-	/** The working directory the command runs in. */
-	cwd: string;
-	/** The user's home, for `toAbsolute`. */
-	home: string;
-	/**
-	 * REALPATH-resolved directories an absolute path may point into besides the
-	 * working directory: the harness's own session dirs (memory, scratchpad,
-	 * persisted results, this project's transcripts — matcher.ts `DecideInput`),
-	 * resolved once per session by the caller.
-	 */
-	readableRoots?: string[];
-}
+// ---------------------------------------------------------------------------
+// Read-only
 
-/**
- * Whether a path token lies outside every root. Each comma-separated part
- * (PowerShell's array syntax, `-Path a,b`; commas inside quotes are part of
- * the name) is judged on its own: refused by
- * shape when unvouchable; a relative part is inside by construction; an
- * absolute part is resolved through `resolveForContainment` — the nearest
- * existing ancestor's realpath, so a glob leaf (`C:\src\play\*.ts`) is
- * judged by its directory and a symlink planted inside the project that
- * points out of it is outside — and must lie inside a root. With no roots
- * (no options) an absolute part is refused, the pre-2026-09-19 behaviour.
- */
-function pathOutsideRoots(value: string, opts: PowerShellReadOnlyOptions | undefined, roots: string[]): boolean {
-	for (const part of splitPowerShellList(value)) {
-		const trimmed = part.trim();
-		if (!trimmed) continue;
-		if (pathUnvouchable(trimmed)) return true;
-		if (!isAbsoluteSpelling(trimmed)) continue;
-		if (!opts) return true;
-		// Resolve only what THIS platform's path module calls absolute: on a POSIX
-		// host `C:\x` is not, and `toAbsolute` would join it onto the cwd and
-		// vouch for a file the shell would never touch. Refuse it by shape there.
-		if (!isAbsolute(trimmed)) return true;
-		const resolved = resolveForContainment(toAbsolute(opts.cwd, trimmed, opts.home));
-		if (resolved === undefined || !roots.some((root) => isWithin(root, resolved))) return true;
-	}
-	return false;
+export interface PowerShellReadOnlyOptions extends PowerShellTreeOptions {
+	/** PowerShell's own parse of the line (lib/powershell-parser.ts); without one nothing is read-only. */
+	parse?: PowerShellParse;
 }
 
 export interface PowerShellReadOnlyVerdict {
@@ -489,61 +462,15 @@ export interface PowerShellReadOnlyVerdict {
 }
 
 /**
- * Whether every statement of the line is a read-only cmdlet (or `where.exe`)
- * with arguments the check can see through: no redirection, no variables or
- * subexpressions, no script blocks, no writing parameters, no path outside
- * the working directory by shape. Positive proof only; anything else is not
- * read-only and takes the ordinary route (classifier in auto mode, a prompt
- * elsewhere).
+ * Whether every statement of the line provably only reads inside the working
+ * directory and the readable roots, judged from PowerShell's own parse
+ * (`powershell-tree.ts`). Positive proof only; without a parse, or with
+ * anything the tree check does not model, the line is not read-only and takes
+ * the ordinary route (the classifier in auto mode, a prompt elsewhere) —
+ * decisions/windows.md "The PowerShell pre-gate reads PowerShell's own parse".
  */
-export function powershellReadOnly(command: string, opts?: PowerShellReadOnlyOptions): PowerShellReadOnlyVerdict {
-	const statements = powershellStatements(command);
-	if (statements === undefined) return { readOnly: false, reason: "unbalanced quoting" };
-	if (statements.length === 0) return { readOnly: false, reason: "empty command" };
-	if (/[<>]/.test(command)) return { readOnly: false, reason: "redirection" };
-	if (/\$/.test(command)) return { readOnly: false, reason: "a variable or subexpression" };
-	if (/[`{}]/.test(command)) return { readOnly: false, reason: "an escape or script block" };
-	// The cwd's realpath once per command (the roots arrive resolved), not once per token.
-	const roots = opts ? [resolveForContainment(opts.cwd) ?? opts.cwd, ...(opts.readableRoots ?? [])] : [];
-	for (const statement of statements) {
-		if (startsWithCallOperator(statement)) return { readOnly: false, reason: "the call operator" };
-		const cmd = statementCommand(statement);
-		if (!READ_ONLY_POWERSHELL_COMMANDS.has(cmd)) return { readOnly: false, reason: `\`${cmd}\` is not a read-only cmdlet` };
-		const tokens = statement.trim().split(/\s+/).slice(1);
-		for (const token of tokens) {
-			if (WRITING_PARAMETERS.test(token)) return { readOnly: false, reason: `${token.split(":")[0]} writes or forwards` };
-			if (token.startsWith("-")) continue;
-			// By shape (UNC, ~, PSDrive, ..) a token is never vouched for. An absolute
-			// path is read-only only when it resolves inside the working directory or
-			// a harness session dir (2026-09-19: /doctor's transcript scan on Windows
-			// spelled `<agentDir>\sessions\…` and was classified —
-			// docs/decisions/auto-mode.md); a comma list is judged part by part.
-			if (pathOutsideRoots(token, opts, roots)) return { readOnly: false, reason: "a path outside the working directory" };
-		}
-	}
-	return { readOnly: true };
-}
-
-/** git global flags that take a value and can precede the subcommand (`git -C x status`). */
-const GIT_GLOBAL_VALUE_FLAGS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
-
-/**
- * Whether the statement is a bare `git status` (global flags before it and
- * plain flags after it allowed, no other statements) — the call after which
- * Claude Code's classifier transcript carries a
- * `{"meta":{"gitStatus":{"clean":…}}}` ground-truth line (findings §22).
- * Works for bash and PowerShell spellings alike. Global value-taking flags
- * (`-C <dir>`, `-c <key=val>`, …) are skipped so `git -C <dir> status` is
- * still recognised instead of mistaking the flag's value for the subcommand.
- */
-export function isGitStatusCommand(command: string): boolean {
-	const statements = powershellStatements(command);
-	if (!statements || statements.length !== 1) return false;
-	if (statementCommand(statements[0]) !== "git") return false;
-	const words = statements[0].trim().split(/\s+/).slice(1);
-	let i = 0;
-	while (i < words.length && words[i].startsWith("-")) {
-		i += GIT_GLOBAL_VALUE_FLAGS.has(words[i]) ? 2 : 1;
-	}
-	return words[i] === "status" && words.slice(i + 1).every((w) => w.startsWith("-"));
+export function powershellReadOnly(opts: PowerShellReadOnlyOptions): PowerShellReadOnlyVerdict {
+	if (!opts.parse) return { readOnly: false, reason: "PowerShell's own parse of the line is not available" };
+	const verdict = powershellTreeReadOnly(opts.parse, opts);
+	return verdict.ok ? { readOnly: true } : { readOnly: false, reason: verdict.reason };
 }