riskrails 4.0.1 → 4.2.0

package/hooks/guard/paths_human.py

@@ -0,0 +1,105 @@
+"""The human-only gates: the --confirm-delete rule (confirm_delete) and the state.py commands an agent
+may not run (approve, profile set, the --by forms, the dialog recorder), with their patterns
+(dialog_consent).
+
+R16: shell (they read the file system, the clock or a subprocess): dialog_consent; every other name here is core.
+Moved from paths.py in WP5 (small-oop-modules), unchanged.
+"""
+import os
+from guard.common import Deny, b_bytes, exists, herestring_lines
+from guard.paths_base import END, Q, VAR, WHY_CONFIRM_DELETE
+
+
+# The --confirm-delete rule, and --confirm-cleanup (the same human gate; any argparse prefix).
+SEP = "(([^|;&]|[<>]&|&>)*[[:space:]])?" + Q
+CONFIRM_DEL = "d(e(l(e(t(e)?)?)?)?)?"
+CONFIRM_CLEAN = "c(l(e(a(n(u(p)?)?)?)?)?)?"
+CONFIRM = ("--co(n(f(i(r(m(-(" + CONFIRM_DEL + "|" + CONFIRM_CLEAN + ")?)?)?)?)?)?)?"
+           "(=|[[:space:]]|['\"]|$)")
+APPLY = "--ap(p(l(y)?)?)?" + END
+HEAD = "(^|[[:space:]'\"/|;&(`])(update\\.py|-[A-Za-z]*m[[:space:]]*" + Q + "update|" + VAR + ")" + Q + "[[:space:]]"
+CONFIRM_RE = HEAD + SEP + CONFIRM + SEP + APPLY + "|" + HEAD + SEP + APPLY + SEP + CONFIRM
+
+# The gate rules.
+ARGS = "([[:space:]]+--r[a-z]*(=|[[:space:]]+)(\"[^\"]*\"|'[^']*'|[^[:space:]]+))*"
+VERB = "([[:space:]]+--)?[[:space:]]+" + Q + "approve" + END
+BOUND = "(^|[|;&([:space:]`])"
+APPROVE_RE = (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS + VERB + "|"
+              + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + VERB)
+# R36.11: the other human-only state.py commands — `profile set` (dialog on only)
+# and the --by forms of verify, review and reject (dialog on or off) — run from an
+# agent session only as the next live pick, like approve. `start --mode light --by`
+# is denied with the dialog off only: `light` is the one --mode value that can
+# never raise a mode; with the dialog on it reaches state.py, which opens the
+# lowering decision (review H1, T-2026-10-28-010); any other `start --mode X --by`
+# reaches state.py too (T-2026-10-30-0758 Q1, Q2).
+PROFILE_SET_VERB = "([[:space:]]+--)?[[:space:]]+" + Q + "profile" + Q + "[[:space:]]+" + Q + "set" + END
+PROFILE_SET_RE = (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS + PROFILE_SET_VERB
+                  + "|" + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + PROFILE_SET_VERB)
+BY_TOK = Q + "--by?" + Q + "(=|[[:space:]]|$)"
+MODE_LIGHT = Q + "--m(o(d(e)?)?)?" + Q + "(=|[[:space:]]+)" + Q + "light" + END
+SKIP = "([^|;&`]*[[:space:]])?"
+HUMAN_BY_VERB = ("([[:space:]]+--)?[[:space:]]+" + Q + "(verify|review|reject)" + END + SKIP + BY_TOK)
+START_LIGHT_VERB = ("([[:space:]]+--)?[[:space:]]+" + Q + "start" + END + SKIP + "("
+                    + MODE_LIGHT + SKIP + BY_TOK + "|" + BY_TOK + SKIP + MODE_LIGHT + ")")
+
+
+def state_verb_re(verb):
+    """The state.py command whose verb part is `verb`, as an ERE: by path or by a variable."""
+    return (BOUND + "(python3?[[:space:]]+)?" + Q + "[^[:space:]'\"]*state\\.py" + Q + ARGS
+            + "(" + verb + ")|" + BOUND + "(python3?[[:space:]]+)?" + Q + VAR + Q + ARGS + "(" + verb + ")")
+
+
+HUMAN_BY_RE = state_verb_re(HUMAN_BY_VERB)
+START_LIGHT_RE = state_verb_re(START_LIGHT_VERB)
+
+# R36.11: running the dialog's recorder by hand would forge the human's answer.
+# dialog-gate.py in command position — the program itself, or the script a
+# python runs — after a separator, a quote, exec/env/command/nohup/time/sudo
+# and their words; naming it as an argument (grep, git diff, chmod) is not running it.
+DIALOG_GATE_RE = ("(^|[|;&(`{'\"]|\\$\\()[[:space:]]*((exec|env|command|nohup|time|sudo)([[:space:]]+[^[:space:]|;&]+)*"
+                  "[[:space:]]+)?(" + Q + "[^[:space:]'\"|;&]*python[0-9.]*" + Q
+                  + "([[:space:]]+-[^[:space:]]+)*[[:space:]]+)?" + Q + "[^[:space:]'\"|;&]*dialog-gate\\.py" + Q
+                  + "([[:space:]|;&)<>]|$)")
+
+
+# -------------------------------------------------------------- the check
+
+def confirm_delete(self, cmd):
+    if "--co" not in cmd:
+        return
+    joined = cmd.replace("\\\n", " ")
+    for line in herestring_lines(joined):
+        if self.loc.length(line) <= 16384:
+            continue
+        if "--ap" not in line:
+            continue
+        if "update" not in line and "$" not in line:
+            continue
+        raise Deny("Refusing a command line over 16384 characters that holds --co, --ap and update or a "
+                   "variable: the --confirm-delete rule does not run its pattern on a line that long."
+                   + WHY_CONFIRM_DELETE)
+    if self.m.ere_match(CONFIRM_RE, joined, need=("--co", "--ap")):
+        raise Deny("Refusing 'update.py --apply --confirm-delete' from an agent session." + WHY_CONFIRM_DELETE)
+
+
+def dialog_consent(self, cmd):
+    """(the dialog is on for this call, the command is the next live pick
+    of this session) — R36.11's pass-through. state.py spends the pick
+    after its own argv check (R36.10); the guard only lets it reach it."""
+    if not self.root or not exists(self.root + "/.ai/policies/dialog.json"):
+        return False, False
+    from datetime import datetime, timezone  # pylint: disable=import-outside-toplevel
+    from guard import dialog            # pylint: disable=import-outside-toplevel
+    root = os.fsdecode(b_bytes(self.root))
+    values = self.p.values
+    raw = values[0] if len(values) == 1 and isinstance(values[0], dict) else None
+    hook_file = os.path.join(os.fsdecode(b_bytes(self.ctx.hook_dir)), "ai-guard.py")
+    try:
+        if raw is None or not dialog.effective_switch(root, dialog.payload_runtime(raw, hook_file), raw):
+            return False, False
+        pick = dialog.next_live_pick(root, raw.get("session_id"), datetime.now(timezone.utc))
+    except Exception:                   # pylint: disable=broad-exception-caught
+        return True, False
+    command = b_bytes(cmd).decode("utf-8", "replace").strip()
+    return True, bool(pick and pick.get("label") == command)

package/hooks/guard/paths_interp.py

@@ -0,0 +1,162 @@
+"""Interpreter one-liners and in-place edits: the patterns that scan the text of python -c, perl -e and
+the like for a secret or a control-file write, the text-tool words that merely name them, and the two
+rules inplace_edit and interpreter_text.
+
+R16: every name here is core (no file, clock or subprocess access).
+Moved from paths.py in WP5 (small-oop-modules), unchanged.
+"""
+import re
+from guard.common import Deny
+from guard.paths_base import WHY_APPROVE, WHY_SENSITIVE
+from guard.paths_shell import shell_segments
+
+
+# An interpreter one-liner is not parsed, its text is scanned: one that names a
+# secret, or one that names a control file and looks like a write, is refused (H3).
+INTERP_RE = ("(^|[|;&[:space:]])(python3?|perl|ruby|node|php)([[:space:]]+-[^[:space:]]+)*[[:space:]]+-(c|e)([[:space:]]|$)|"
+             "(^|[|;&[:space:]])php([[:space:]]+-[^[:space:]]+)*[[:space:]]+-r([[:space:]]|$)")
+CONTROL_TEXT_RE = "\\.ai/state/|\\.ai/reports/"
+# perl or ruby with -i, behind any blank, separator, ( ` { or quote, so every wrapper and
+# position is caught; Guard.inplace_edit carves out the segments of a text tool (grep, echo,
+# git log ...) that merely name it. An -e/-E/-ne code argument may be one quoted word.
+INPLACE_RE = ("(^|[|;&(`{'\"[:space:]])"
+              "(perl|ruby)([[:space:]]+-([CEIMmr][[:space:]]*[^[:space:]]+|[a-zA-Z]*[eE][[:space:]]+('[^']*'|\"[^\"]*\")|"
+              "[^[:space:]]+))*[[:space:]]+-[acdfghlnpsStTuUvwWXy]*i")
+_TEXT_TOOLS = {"grep", "egrep", "fgrep", "rg", "ag", "ack", "echo", "printf"}
+_GIT_TEXT = {"log", "grep", "commit", "show", "diff", "tag", "notes"}
+_STD_WRITE = re.compile(r"(writeSync|writevSync)\([ \t]*(1|2|process\.std(out|err)\.fd)[ \t]*,|"
+                        r"v?fprintf\([ \t]*STD(OUT|ERR)[ \t]*,")
+
+_SHELL_SINKS = {"sh", "bash", "zsh", "dash", "ksh", "ssh", "source", ".", "eval"}
+_XARGS_ARG = {"-I", "-n", "-P", "-L", "-s", "-E", "-d", "-a"}
+_GIT_RUNS = ("GIT_", "PAGER", "EDITOR", "VISUAL", "SSH_COMMAND")
+_GIT_CFG = re.compile(r"[A-Za-z0-9_.-]+=[A-Za-z0-9_./:-]*$")
+
+
+def _tool_word(w):
+    """The bare word, /bin/<w> or /usr/bin/<w>; any other path is a program of its own."""
+    if w.startswith("/bin/"):
+        return w[5:]
+    if w.startswith("/usr/bin/"):
+        return w[9:]
+    return w
+
+
+def shell_sink(seg):
+    """A segment that runs its input or its arguments as shell text."""
+    words = seg.split()
+    if not words:
+        return False
+    w = _tool_word(words[0])
+    if w in _SHELL_SINKS:
+        return True
+    return w == "xargs" and any(_tool_word(x) in _SHELL_SINKS for x in words[1:])
+
+
+def _plain_text_tool(words, i, git_runs):
+    if i >= len(words):
+        return False
+    w = _tool_word(words[i])
+    if w in _TEXT_TOOLS:
+        return True
+    if w != "git" or git_runs:
+        return False
+    if any(x.startswith(("-O", "--open-files-in-pager", "--config-env")) for x in words[i + 1:]):
+        return False
+    k = i + 1
+    while k < len(words):
+        x = words[k]
+        if x in ("-C", "-c"):
+            if x == "-c" and (k + 1 >= len(words) or not _GIT_CFG.match(words[k + 1])):
+                return False
+            k += 2
+        elif x.startswith("-"):
+            k += 1
+        else:
+            return x in _GIT_TEXT
+    return False
+
+
+def text_tool_segment(seg, git_runs=False):
+    """A segment whose command word is a text tool: a program named in it is an argument.
+    xargs and find -exec are looked through; git_runs is set when the line may hand git a
+    command to run (a stripped GIT_PAGER=... assignment)."""
+    words = seg.split()
+    if not words:
+        return False
+    w = _tool_word(words[0])
+    if w == "xargs":
+        i = 1
+        while i < len(words) and words[i].startswith("-"):
+            i += 2 if words[i] in _XARGS_ARG else 1
+        return _plain_text_tool(words, i, git_runs)
+    if w == "find":
+        found = False
+        for k, x in enumerate(words):
+            if x in ("-exec", "-execdir", "-ok", "-okdir"):
+                if not _plain_text_tool(words, k + 1, git_runs):
+                    return False
+                found = True
+        return found
+    return _plain_text_tool(words, 0, git_runs)
+
+
+EVAL_WORD_RE = "(^|[|;&[:space:]])eval([[:space:]]|$)"
+SECRET_TEXT_RE = "\\.env|secrets?/|credentials?|id_rsa|\\.pem|\\.aws"
+WRITE_CALL_RE = (
+    "(^|[^A-Za-z0-9_])(write|writelines|write_text|write_bytes|write_file|writeFile|writeFileSync|appendFile|"
+    "appendFileSync|createWriteStream|binwrite|syswrite|fwrite|fputs|fprintf|vfprintf|writeSync|writevSync|file_put_contents|dump|unlink|unlinkSync|"
+    "remove|removedirs|rename|renames|renameSync|rmdir|rmdirSync|rm|rmSync|rmtree|mkdir|mkdirSync|makedirs|"
+    "mkdtemp|truncate|truncateSync|ftruncate|symlink|symlinkSync|symlink_to|hardlink_to|link|linkSync|link_to|"
+    "touch|chmod|chown|utime|utimes|copyFile|copyFileSync|cp|cpSync|move|delete|system|exec|execSync|execFile|"
+    "execFileSync|spawn|spawnSync|popen|passthru|shell_exec|proc_open|fork|eval|copy_into|move_into)"
+    "([[:space:]]*\\(|[[:space:]]+['\"$])|(^|[^A-Za-z0-9_.])copy[[:space:]]*\\(")
+WRITE_WORD_RE = ("subprocess|shutil|child_process|FileUtils|Open3|O_(WRONLY|RDWR|CREAT|APPEND|TRUNC)|os\\.replace|"
+                 "inplace|`|\\$\\(|%x[^A-Za-z0-9_[:space:]]|(^|[^A-Za-z0-9_])qx[^A-Za-z0-9_[:space:]]")
+FIRST_ARG = "([^,()'\"]|'[^']*'|\"[^\"]*\"|\\(([^()]|\\([^()]*\\))*\\))*"
+WRITE_PATHREPL_RE = "\\.replace[[:space:]]*\\(" + FIRST_ARG + "\\)"
+WRITE_PATHCOPY_RE = "\\.copy[[:space:]]*\\([[:space:]]*[^)[:space:]]"
+WRITE_MODE_RE = ("((open[A-Za-z]*|new([[:space:]]+[A-Za-z_][A-Za-z0-9_:]*)?|FileIO)[[:space:]]*(\\(|[[:space:]])"
+                 + FIRST_ARG + ",|mode[[:space:]]*=|open[A-Za-z]*[[:space:]]*\\()[[:space:]]*\\\\?['\"]"
+                 "([rbtU]*[wax+][rbtU+]*\\\\?['\"]|>|\\+|-?\\|[^[:space:]|])")
+WRITE_REDIR_RE = (">[>|]?[[:space:]]*['\"]?[^[:space:]'\"|;&<>]*\\.ai/(state|reports)/|"
+                  "(^|[^A-Za-z0-9_.-])tee[[:space:]][^|;&]*\\.ai/(state|reports)/")
+
+
+def inplace_edit(self, cmd):
+    """perl or ruby -i as a command: INPLACE_RE on the line less the segments of a text tool."""
+    m = self.m
+    if not m.ere_match(INPLACE_RE, cmd):
+        return False
+    if "<<" in cmd:                     # a heredoc body is read by whoever reads it
+        return True
+    segs = shell_segments(cmd).split("\n")
+    if "|" in cmd and any(shell_sink(sg) for sg in segs):
+        return True                     # a text tool's output may run as shell text
+    git_runs = any(t in cmd for t in _GIT_RUNS)
+    if git_runs and any(_tool_word(sg.split(None, 1)[0]) == "git" for sg in segs if sg.strip()):
+        return True                     # the assignment that runs a command is not in the segment
+    keep = [sg for sg in segs if not text_tool_segment(sg, git_runs)]
+    return m.ere_match(INPLACE_RE, "\n".join(keep))
+
+
+def interpreter_text(self, cmd):
+    """The text of an interpreter one-liner or an eval, scanned whole (H3)."""
+    m = self.m
+    is_eval = m.ere_match(EVAL_WORD_RE, cmd)
+    is_interp = m.ere_match(INTERP_RE, cmd)
+    if (is_eval or is_interp) and m.ere_match(SECRET_TEXT_RE, cmd):
+        raise Deny("Refusing an interpreter one-liner that references a sensitive path." + WHY_SENSITIVE)
+    if m.ere_match(CONTROL_TEXT_RE, cmd):
+        if is_eval or self.inplace_edit(cmd):
+            raise Deny("Refusing an interpreter one-liner that writes the task's own control files." + WHY_APPROVE)
+        if is_interp:
+            scan = _STD_WRITE.sub(" ", cmd.replace("stdout.write", " ").replace("stderr.write", " "))
+            pscan = cmd.replace("copy.copy(", " ")
+            if (m.ere_match(WRITE_CALL_RE, scan) or m.ere_match(WRITE_WORD_RE, cmd)
+                    or (m.ere_match("Path", cmd)
+                        and (m.ere_match(WRITE_PATHREPL_RE, cmd) or m.ere_match(WRITE_PATHCOPY_RE, pscan)))
+                    or (m.ere_match("open|new|FileIO", cmd) and m.ere_match(WRITE_MODE_RE, cmd))
+                    or m.ere_match(WRITE_REDIR_RE, cmd)):
+                raise Deny("Refusing an interpreter one-liner that writes the task's own control files."
+                           + WHY_APPROVE)

package/hooks/guard/paths_movers.py

@@ -0,0 +1,393 @@
+"""The movers pass: cp, mv, rm, ln, sed -i, find -delete and their kin, resolved against the covered
+roots, with MoverState, the per-call counters of that pass.
+
+R16: shell (they read the file system, the clock or a subprocess): cover_init, realpath_m_arg, roots_under, covers_work, covers_protected, movers, mover_resolve, mover_check; every other name here is core.
+Moved from paths.py in WP5 (small-oop-modules), unchanged.
+"""
+import re
+from guard.common import (Deny, chomp_all, env_b, exists, herestring_lines, is_dir, read_lines,
+                          real_path, strip1)
+from guard.paths_fs import LoopError, find_print, realpath_m
+from guard.paths_base import SEGMENT, WHY_PROTECTED, WHY_TASK
+
+
+MOVERS = SEGMENT + "(cp|mv|install|rsync|rm|rmdir|unlink)([[:space:]]|$)"
+MOVER_VERBS = ("cp", "mv", "install", "rsync", "rm", "rmdir", "unlink")
+REMOVE_VERBS = ("rm", "rmdir", "unlink")
+MOVER_CHUNK = 32768
+GLOBBY = set("][*?$`{}()\\~@!+")
+
+_SED1 = "[0-9]*[<>]{1,2}&[0-9]+"
+_SED2 = "(&|[0-9]*)[<>]{1,2}[[:space:]]*[^[:space:]|;&<>]*"
+
+_FIND_PRUNE_ROOTS = {".git", "vendor", "node_modules", "projects"}
+_FIND_PRUNE_SCAN = {".git", "vendor", "node_modules", "bower_components", "third_party", "Pods",
+                    "site-packages", ".venv", ".pnpm", ".yarn"}
+
+
+# -------------------------------------------------------------- covers
+
+def cover_init(self):
+    if self.cover_done:
+        return
+    self.cover_done = True
+    parts = []
+    for p in read_lines(self.prot_p + "\n" + self.task_p + "\n"):
+        if not p:
+            continue
+        p = p[5:] if p.startswith("(^|/)") else p
+        p = p[1:] if p.startswith("^") else p
+        parts.append(p + "\n")
+    self.cover_joined = chomp_all("".join(parts)).replace("\n", "|")
+    home = self.home
+    roots = []
+    for r in (self.root + "/.ai", self.root + "/.claude", self.root + "/.codex",
+              env_b("CLAUDE_CONFIG_DIR") or home + "/.claude", env_b("CODEX_HOME") or home + "/.codex"):
+        got = self.realpath_m_arg(r)
+        if got is not None:
+            roots.append(got)
+    self.cover_roots = chomp_all("".join(r + "\n" for r in self.sort_u(roots)))
+
+
+def realpath_m_arg(self, p):
+    """One argument of `realpath -m`, as the line it prints, or None."""
+    if p == "":
+        return None
+    full = p if p.startswith("/") else self.ctx.pwd.rstrip("/") + "/" + p
+    try:
+        return realpath_m(full)
+    except LoopError:
+        return None
+
+
+def sort_u(self, items):
+    key = self.loc.sort_key
+    out, seen = [], set()
+    for item in sorted(items, key=key):
+        k = key(item)
+        if k not in seen:
+            seen.add(k)
+            out.append(item)
+    return out
+
+
+def roots_under(self, c):
+    for r in herestring_lines(self.cover_roots):
+        if r and (c == "/" or r == c or r.startswith(c + "/")) and exists(r):
+            yield r
+
+
+def covers_work(self, real, lexical):
+    c = strip1(real, "/") or "/"
+    for _ in self.roots_under(c):
+        self.work_cap("scan")
+        return True
+    if is_dir(c):
+        self.work_cap("scan")
+        return True
+    return bool(lexical)
+
+
+def covers_protected(self, real):
+    c = strip1(real, "/") or "/"
+    for line in (c, c + "/"):
+        if not self.m.ere_match(self.loose_joined, line):
+            continue
+        v = self.classify(line)
+        if v and (v[0] == "protected" or (v[0] == "task" and self.task_in_flight(remember=False))):
+            return strip1(line, "/")
+    roots = list(self.roots_under(c))
+    scan = [c] if is_dir(c) else []
+    if not roots and not scan:
+        return None
+
+    def stream():
+        for r in roots:
+            yield from find_print(r, 3, _FIND_PRUNE_ROOTS)
+        count = 0
+        for s in scan:
+            for path in find_print(s, 6, _FIND_PRUNE_SCAN):
+                if count >= 20000:
+                    return
+                count += 1
+                yield path
+
+    pats = self.cover_joined.split("\n")
+    valid = all(self.m.ere.valid(pt) for pt in pats)
+    picked = 0
+    if not valid:
+        return None
+    for path in stream():
+        for line in (path, path + "/"):
+            if not any(self.m.search_c(pt, line) for pt in pats):
+                continue
+            picked += 1
+            if picked > 50:
+                return None
+            v = self.classify(line)
+            if v and (v[0] == "protected" or (v[0] == "task" and self.task_in_flight(remember=False))):
+                return strip1(line, "/")
+    return None
+
+
+def loose_hits(self, lines):
+    """1-based numbers of the lines that match the loose patterns, bytewise."""
+    pats = self.loose_joined.split("\n")
+    if not all(self.m.ere.valid(pt) for pt in pats):
+        return []
+    return [n for n, line in enumerate(lines, 1) if any(self.m.search_c(pt, line) for pt in pats)]
+
+
+# -------------------------------------------------------------- the movers pass
+
+def movers(self, segs):
+    m = self.m
+    if not (segs and m.ere_match(MOVERS, segs)):
+        return
+    self.cover_init()
+    sed1 = m.ere.compile_ere(self.loc_pat(_SED1), self.loc_mode(), capture=True).rx
+    sed2 = m.ere.compile_ere(self.loc_pat(_SED2), self.loc_mode(), capture=True).rx
+    kept = []
+    for line in segs.split("\n"):
+        t = self.loc_text(line)
+        t = sed1.sub("", t) if sed1 else t
+        t = sed2.sub("", t) if sed2 else t
+        line = self.from_loc(t)
+        if m.search_c(MOVERS, line):
+            kept.append(line)
+    segments = chomp_all("".join(k + "\n" for k in kept))
+    st = MoverState()
+    cwd_slash = strip1(self.cwd, "/") + "/"
+    length = self.loc.length
+    mover_base = max(length(self.cwd), length(self.home)) + 2
+    pending = ""
+    for seg in herestring_lines(segments):
+        self.work_clock()
+        if not st.batch + length(seg) < MOVER_CHUNK:
+            self.mover_check(st)
+        st.batch += length(seg) + 1
+        operands = [w for w in re.split("[ \t]+", seg) if w]
+        if len(operands) <= 1:
+            continue
+        verb = operands[0]
+        if verb not in MOVER_VERBS:
+            continue
+        dest, sources, opts_done, want_dest = "", [], False, False
+        stop = False
+        for w in operands[1:]:
+            self.work_clock()
+            if length(w) > 4096:
+                if any(c in GLOBBY for c in w):
+                    pending = ("Refusing a shell %s with a %d-character operand that holds a glob or "
+                               "expansion character: the guard cannot check what it expands to."
+                               % (verb, length(w)))
+                    stop = True
+                    break
+                if not opts_done and not want_dest:
+                    if w.startswith("--target-directory="):
+                        dest = "LONG-OPERAND"
+                        continue
+                    if w.startswith("-"):
+                        continue
+                w = "LONG-OPERAND"
+            if want_dest:
+                want_dest = False
+                dest = w
+                continue
+            if not opts_done:
+                if w == "--":
+                    opts_done = True
+                    continue
+                if w in ("-t", "--target-directory"):
+                    if verb not in REMOVE_VERBS:
+                        want_dest = True
+                    continue
+                if w.startswith("--target-directory="):
+                    dest = w.split("=", 1)[1]
+                    continue
+                if w.startswith("-"):
+                    continue
+            w = w.lstrip("\"'").rstrip("\"'")
+            if w:
+                sources.append(w)
+        if stop:
+            break
+        dl = 0
+        if verb not in REMOVE_VERBS:
+            dl = length(dest)
+            if not dest and sources:
+                dl = length(sources[-1])
+        if st.seg_first and not (st.batch + (2 * len(sources) + 1) * (mover_base + dl) + 2 * length(seg)
+                                 < MOVER_CHUNK):
+            self.mover_check(st)
+        first = len(st.cands)
+        if verb in REMOVE_VERBS:
+            for src in sources:
+                st.cands.append(src)
+                st.covers.append("yes")
+        else:
+            if not dest:
+                if len(sources) <= 1:
+                    continue
+                dest = sources.pop()
+            dest = dest.lstrip("\"'").rstrip("\"'")
+            if not dest:
+                continue
+            into = ""
+            for src in sources:
+                if verb in ("rsync", "cp") and (src.endswith("/") or src.endswith("/.")):
+                    into = "yes"
+            st.cands.append(dest)
+            st.covers.append(into)
+            for src in sources:
+                src = strip1(strip1(src, "/"), "/.")
+                st.cands.append(strip1(dest, "/") + "/" + src.rsplit("/", 1)[-1])
+                st.covers.append("yes")
+                if verb == "mv":
+                    st.cands.append(src)
+                    st.covers.append("yes")
+        if len(st.cands) <= first:
+            continue
+        for k in range(first, len(st.cands)):
+            self.work_clock()
+            cand = st.cands[k]
+            if cand in ("~", "$HOME", "${HOME}"):
+                cand = self.home
+            elif cand.startswith("~/"):
+                cand = self.home + "/" + cand[2:]
+            elif cand.startswith("$HOME/"):
+                cand = self.home + "/" + cand[6:]
+            elif cand.startswith("${HOME}/"):
+                cand = self.home + "/" + cand[8:]
+            if not cand.startswith("/"):
+                cand = cwd_slash + cand
+            st.abss.append(cand)
+            st.batch += length(cand) + 1
+        st.seg_first.append(first)
+        st.seg_count.append(len(st.cands) - first)
+        st.seg_verb.append(verb)
+    self.mover_check(st)
+    if pending:
+        raise Deny(pending)
+
+
+def loc_mode(self):
+    return "u" if self.loc.utf8 else "b"
+
+
+def loc_pat(self, p):
+    return self.loc.u(p) if self.loc.utf8 else p
+
+
+def loc_text(self, s):
+    return self.loc.u(s) if self.loc.utf8 else s
+
+
+def from_loc(self, t):
+    return t.encode("utf-8", "surrogateescape").decode("latin-1") if self.loc.utf8 else t
+
+
+def mover_resolve(self, st, first, end, one_at_a_time=False):
+    length = self.loc.length
+    size, cuts = 0, []
+    for k in range(first, end):
+        self.work_clock()
+        if not size < MOVER_CHUNK:
+            cuts.append(k)
+            size = 0
+        size += length(st.abss[k]) + 1
+    cuts.append(end)
+    at, got = first, []
+    for k in cuts:
+        self.work_clock()
+        args = st.abss[at:k]
+        had = len(got)
+        for a in args:
+            r = self.realpath_m_arg(a)
+            if r is not None:
+                got.append(r)
+        if len(got) - had != len(args):
+            if not one_at_a_time:
+                return False
+            got = []
+            for n in range(first, end):
+                self.work_cap("classify")
+                r = self.realpath_m_arg(st.abss[n])
+                got.append(r if r else st.abss[n])
+            break
+        at = k
+    for n in range(first, end):
+        st.reals[n] = got[n - first]
+    at = first
+    for k in cuts:
+        self.work_clock()
+        lines = []
+        for n in range(at, k):
+            norm = strip1(st.reals[n], "/") or "/"
+            lines += [st.abss[n] + " " + st.reals[n], norm, norm + "/"]
+        for r in self.loose_hits(lines):
+            st.hits.add(3 * at + r)
+        at = k
+    return True
+
+
+def mover_check(self, st):
+    per_seg = False
+    st.reals, st.hits = {}, set()
+    if st.abss and not self.mover_resolve(st, 0, len(st.abss)):
+        per_seg = True
+    for s, first in enumerate(st.seg_first):
+        last = first + st.seg_count[s]
+        verb = st.seg_verb[s]
+        if per_seg:
+            self.mover_resolve(st, first, last, one_at_a_time=True)
+        self.work_clock()
+        for i in range(first, last):
+            self.work_clock()
+            a, real, cand = st.abss[i], st.reals[i], st.cands[i]
+            how = "copy or move into"
+            if verb in REMOVE_VERBS:
+                how = "removal of"
+            elif verb == "mv" and i > first and a != strip1(st.abss[first], "/") + "/" + a.rsplit("/", 1)[-1]:
+                how = "move of"
+            verdict = None
+            lexical = (3 * i + 2) in st.hits or (3 * i + 3) in st.hits
+            if (3 * i + 1) in st.hits or (st.covers[i] == "yes" and lexical):
+                self.work_cap("classify")
+            if (3 * i + 1) in st.hits:
+                verdict = (self.classify(a) or self.classify(real)
+                           or self.classify(real_path(a, self.cwd)))
+            kind = verdict[0] if verdict else ""
+            if kind == "protected":
+                raise Deny("Refusing a shell %s a RiskRails control file: %s%s" % (how, cand, WHY_PROTECTED))
+            if kind == "task" and self.task_in_flight():
+                raise Deny("Refusing a shell %s runtime configuration while task %s is in flight: %s%s"
+                           % (how, self.task_id, cand, WHY_TASK))
+            if st.covers[i] != "yes":
+                continue
+            if not self.covers_work(real, lexical):
+                continue
+            found = self.covers_protected(real)
+            if found is None:
+                continue
+            verdict = self.classify(found) or self.classify(found + "/")
+            held = "" if found == strip1(real, "/") else " (holds %s)" % found
+            if verdict and verdict[0] == "protected":
+                raise Deny("Refusing a shell %s a directory that holds a RiskRails control file: %s%s%s"
+                           % (how, cand, held, WHY_PROTECTED))
+            raise Deny("Refusing a shell %s a directory that holds runtime configuration while task %s is "
+                       "in flight: %s%s%s" % (how, self.task_id, cand, held, WHY_TASK))
+    st.reset()
+
+
+class MoverState:                           # pylint: disable=too-many-instance-attributes,too-few-public-methods
+    """One batch of the movers pass: candidates and the segments that own them."""
+
+    def __init__(self):
+        self.reset()
+
+    def reset(self):
+        self.cands, self.covers, self.abss = [], [], []
+        self.seg_first, self.seg_count, self.seg_verb = [], [], []
+        self.reals, self.hits = {}, set()
+        self.batch = 0