session-orchestrator 5.11.0 → 5.13.0

package/scripts/lib/command-blocker.mjs

@@ -373,9 +373,94 @@ function readHeredocBody(command, from, delim, stripTabs) {
  *     with it `rm -rf /tmp/x &> log` staying ALLOWED); the `;`/`|`/`&` branch runs
  *     first and is never shadowed.
  *
+ * ## Subshells and command substitutions (#1667)
+ *
+ * Before #1667 `(`, `$(`, `)` and backticks were word characters, so
+ * `true && (rm -rf X)` resolved the verb `(rm` and every verb- or target-based
+ * check (path-delete denylist, rm allowlist, issue budget, staging fence)
+ * missed X. The ledger guard had fixed this in its own scanner (#1665); the
+ * shared lexer now carries it for every consumer:
+ *   - An unquoted `(` at WORD START opens a subshell: it and its `)` become
+ *     `{ text: ';', operator: 'subshell' }` separators, the body stays in place.
+ *   - `$( … )`, backticks (unquoted AND inside double quotes) and process
+ *     substitution `<( … )` / `>( … )` are WORDS whose body runs as a command:
+ *     the outer word keeps the RAW source text (`$(pwd)/x` stays one operand,
+ *     so no outer word boundary moves) and the body's tokens are HOISTED to the
+ *     end of the stream behind a `{ text: ';', operator: 'substitution' }`.
+ *   - Unchanged on purpose: `$((`/`((` arithmetic, a mid-word `(` (`f()`,
+ *     `arr=(…)`, whose `)` stays word text), an unmatched `)`, the parens of a
+ *     case HEAD (`(a)` patterns), quoted/escaped parens, `{`/`}` (brace groups
+ *     were already split by COMMAND_POSITION_KEYWORDS), here-doc bodies.
+ *   - A case pattern's closing `)` is followed by a `{ text: ';', operator:
+ *     'case-pattern' }` separator, so an arm's first command (`a) rm x;;`)
+ *     heads its own segment; in an arm body `(` opens a subshell again.
+ *   - Fail direction: an unclosed substitution is closed at end of input and
+ *     STILL hoisted (verb visible). Past MAX_TOKENIZER_NESTING an unquoted
+ *     opener degrades to a plain separator (verb visible); a double-quoted one
+ *     stays literal text there.
+ *
  * @param {string} command
  * @returns {Array<{ text: string, quoted: boolean, redirect?: { fd: number|null, mode: string } }>}
  */
+/** Unquoted chain-operator texts — a word after one of them is in command position. */
+const CHAIN_OPERATOR_TEXTS = new Set([';', '&&', '||', '|', '&']);
+
+/**
+ * Reserved words that are followed by a COMMAND (#1671): a word after one of
+ * them — itself in command position — is in command position too. The opener
+ * half of COMMAND_POSITION_KEYWORDS (closers like `fi`/`done` end a command, so
+ * `fi case` is no case) plus `time`, which bash parses as a pipeline prefix.
+ * `(` is absent on purpose: since #1667 the lexer emits it as a separator.
+ */
+const COMMAND_POSITION_OPENERS = new Set([
+  '{', '!', 'if', 'elif', 'then', 'else', 'while', 'until', 'do', 'time', 'coproc',
+]);
+
+/** A function-definition head `name()` — its body is a compound command. */
+const FUNCTION_HEAD_RE = /^[^\s()$`'"]+\(\)$/;
+
+/**
+ * Is the word at index `end` of `sink` (default: the NEXT word pushed) in
+ * command position (#1671)? Walks back over
+ * a run of unquoted opener keywords (`if ! case …`, `then { case …`) to the
+ * statement start: an operator/separator or the start of the sink. An opener
+ * that is itself an argument (`echo then case`) does not count. Also openers:
+ * `coproc`, a function head `name()` / `function name`, and `time -p`.
+ * A case pattern is followed by a `case-pattern` separator token (see
+ * {@link tokenizeCommand}), so the first word of a case ARM is in command
+ * position through the operator branch.
+ *
+ * @param {Array<{ text: string, quoted: boolean, operator?: string }>} sink
+ * @param {number} [end=sink.length]
+ * @returns {boolean}
+ */
+function nextWordInCommandPosition(sink, end = sink.length) {
+  for (let i = end - 1; i >= 0; i--) {
+    const tok = sink[i];
+    if (tok.quoted) return false;
+    if (tok.operator !== undefined || CHAIN_OPERATOR_TEXTS.has(tok.text)) return true;
+    const prev = sink[i - 1];
+    const prevIs = (word) => prev !== undefined && !prev.quoted && prev.text === word;
+    // `time -p cmd`: the POSIX-format flag is part of the `time` prefix.
+    if (tok.text === '-p' && prevIs('time')) continue;
+    // `function name { … }` / `function name() …`: skip the keyword+name pair.
+    if (prevIs('function')) { i--; continue; }
+    if (FUNCTION_HEAD_RE.test(tok.text)) continue;
+    if (!COMMAND_POSITION_OPENERS.has(tok.text)) return false;
+  }
+  return true;
+}
+
+/**
+ * How many `$( … )` / backtick / `( … )` levels {@link tokenizeCommand} tracks
+ * (#1667, mirroring the ledger guard's MAX_SCAN_NESTING). The lexer is a loop
+ * with an explicit frame stack, so this is a work bound, not a stack-safety
+ * bound. Past it an unquoted opener is read as a plain separator: the verb
+ * behind it stays visible (fail-closed for verb checks), only the word-boundary
+ * fidelity of that pathological level is given up.
+ */
+const MAX_TOKENIZER_NESTING = 256;
+
 export function tokenizeCommand(command) {
   const tokens = [];
   if (typeof command !== 'string' || command.length === 0) return tokens;
@@ -384,19 +469,103 @@ export function tokenizeCommand(command) {
   let text = '';
   let started = false;     // a token is in progress
   let sawQuote = false;    // any char of the current token came from inside quotes
+  // Leading UNQUOTED `{` characters of the current token (#1707 point 2). For a
+  // token that is otherwise quoted (`{"unlink"`) the `quoted` flag cannot say
+  // whether its first `{` was bare, so the count rides on the token.
+  let braceLead = 0;
+  // Index of the last BARE `(` appended to a word (`f(`, `arr=(`). An escaped
+  // `\(` or a quoted one never sets it, so `$(echo \()` still closes there.
+  let bareParenAt = -1;
   let state = 'normal';    // 'normal' | 'single' | 'double' | 'ansi'
   let arithDepth = 0;      // open `$((` / `((` levels — inside them `<<` is a shift
+  // One entry per open `case … esac` level, innermost last. Each names what the
+  // NEXT word at that level is: 'subject' (`case WORD`), 'in' (the `in`),
+  // 'pattern' (a clause pattern, or `esac`) or 'body' (commands of an arm).
+  // In the three head states `(`/`)` are pattern syntax; an unquoted `)` in
+  // 'pattern' ENDS the pattern and emits a `case-pattern` separator, so the
+  // arm's first word (`a) rm -f x`, `a)rm -f x`) heads its own segment.
+  let caseStates = [];
+  const caseTop = () => (caseStates.length > 0 ? caseStates[caseStates.length - 1] : null);
+  const setCaseTop = (s) => { caseStates[caseStates.length - 1] = s; };
   const pendingHeredocs = [];
 
+  // #1667 nesting: `sink` receives the tokens of the CURRENT command context.
+  // A `$( … )` / backtick / process-substitution body gets its own sink and is
+  // HOISTED (appended after the outer stream, behind a separator) on close; a
+  // `( … )` subshell stays in place between two separators. `stack` holds one
+  // frame per open level — see the tokenizeCommand docblock.
+  let sink = tokens;
+  const hoisted = [];
+  const stack = [];
+
   const flush = () => {
     if (started) {
-      tokens.push({ text, quoted: sawQuote });
+      // #1671: BOTH words count only where bash reads them as reserved words.
+      // An argument `esac` (`echo esac`) used to close a case early, and a
+      // `case` behind `then`/`do`/`else`/`{`/`!` was never opened — either way
+      // the next pattern `)` closed the enclosing `$( … )` and moved the rest
+      // of the body (an `rm` operand) into the outer statement.
+      const top = caseTop();
+      if (top === 'subject') setCaseTop('in');
+      else if (top === 'in') { if (!sawQuote && text === 'in') setCaseTop('pattern'); }
+      else if (top === 'pattern') {
+        // `case w in esac` / `;; esac` — `esac` where a pattern may start.
+        if (!sawQuote && text === 'esac') caseStates.pop();
+      } else if (!sawQuote && text === 'case' && nextWordInCommandPosition(sink)) {
+        caseStates.push('subject');
+      } else if (top === 'body' && !sawQuote && text === 'esac' && nextWordInCommandPosition(sink)) {
+        // `a) esac` (last clause without `;;`) is covered too: the pattern's
+        // `case-pattern` separator puts `esac` in command position.
+        caseStates.pop();
+      }
+      const tok = { text, quoted: sawQuote };
+      // Only a QUOTED token carries the count: for an unquoted one every `{` of
+      // its text is bare, so the text already says it (and the token shape of
+      // every unquoted word stays as it was).
+      if (sawQuote && braceLead > 0) tok.braceLead = braceLead;
+      sink.push(tok);
       text = '';
       started = false;
       sawQuote = false;
+      braceLead = 0;
     }
   };
 
+  // Open a substitution level whose BODY is lexed into a fresh sink. The outer
+  // word in progress (`x=` in `x=$(…)`, or the double-quoted run around
+  // `"$(…)"`) is parked in the frame and resumed on close.
+  const openSubstitution = (kind, start) => {
+    stack.push({ kind, start, text, started, sawQuote, braceLead, state, sink, arithDepth, caseStates });
+    text = ''; started = false; sawQuote = false; braceLead = 0; state = 'normal'; arithDepth = 0; caseStates = [];
+    sink = [];
+  };
+
+  // Close the innermost substitution level. `end` is the index just past its
+  // closing character (or the input length when it never closed). The body is
+  // hoisted; the outer word gets the RAW source text of the whole substitution
+  // appended, so the outer token stream is byte-identical to the pre-#1667
+  // lexer's word boundaries (`rm -rf $(pwd)/x` keeps ONE operand).
+  const closeSubstitution = (end) => {
+    if (state !== 'normal') sawQuote = true;
+    flush();
+    const frame = stack.pop();
+    // Loops, never `push(...arr)`: a spread passes every element as a call
+    // argument, and a body of ~125k tokens throws RangeError — which the
+    // destructive guard's top-level catch turns into ALLOW (fail-open).
+    hoisted.push({ text: ';', quoted: false, operator: 'substitution' });
+    for (const t of sink) hoisted.push(t);
+    ({ text, started, sawQuote, braceLead, state, sink, arithDepth, caseStates } = frame);
+    const raw = command.slice(frame.start, end);
+    text += raw; started = true;
+    if (/["']/.test(raw)) sawQuote = true;
+  };
+
+  const topKind = () => (stack.length > 0 ? stack[stack.length - 1].kind : null);
+  const pushSubshellSeparator = () => {
+    flush();
+    sink.push({ text: ';', quoted: false, operator: 'subshell' });
+  };
+
   // A leading all-digit word is the fd of a redirect (`2> log`), not an argument.
   // Returns the digits to prefix onto the operator token; flushes otherwise.
   const takeFdPrefix = () => {
@@ -429,6 +598,20 @@ export function tokenizeCommand(command) {
         text += next; started = true; sawQuote = true; i++;
         continue;
       }
+      // Double quotes do NOT stop command substitution (#1667): `"$(rm x)"` runs
+      // `rm`. The quoted run is parked and the body is lexed as a command.
+      // `$((` stays literal arithmetic text, exactly as before.
+      if (state === 'double' && stack.length < MAX_TOKENIZER_NESTING) {
+        if (ch === '`') {
+          if (topKind() === 'backtick') { closeSubstitution(i + 1); continue; }
+          openSubstitution('backtick', i);
+          continue;
+        }
+        if (ch === '$' && command[i + 1] === '(' && command[i + 2] !== '(') {
+          openSubstitution('subst', i); i++;
+          continue;
+        }
+      }
       text += ch; started = true; sawQuote = true;
       continue;
     }
@@ -460,7 +643,7 @@ export function tokenizeCommand(command) {
         // real newline (#999).
         if (!terminated) { lastTerm = false; pendingHeredocs.length = 0; break; }
         lastTerm = true;
-        if (body.length > 0) tokens.push({ text: body, quoted: true });
+        if (body.length > 0) sink.push({ text: body, quoted: true });
         j = end;
       }
       // `readHeredocBody` returns `end` pointing PAST the newline that closes the
@@ -514,6 +697,86 @@ export function tokenizeCommand(command) {
       continue;
     }
 
+    // Nesting (#1667) — subshells, command substitutions, backticks and process
+    // substitutions. Arithmetic (`$((`/`((`, taken above) keeps every paren as
+    // text; inside `case … esac` a paren is pattern syntax (`(a)` / `a)`) and
+    // also stays text, the pre-#1667 behaviour.
+    if (arithDepth === 0) {
+      const atCap = stack.length >= MAX_TOKENIZER_NESTING;
+      if (ch === '`') {
+        if (topKind() === 'backtick') { closeSubstitution(i + 1); continue; }
+        if (atCap) { pushSubshellSeparator(); continue; }
+        openSubstitution('backtick', i);
+        continue;
+      }
+      if (ch === '$' && command[i + 1] === '(') {
+        if (atCap) { pushSubshellSeparator(); i++; continue; }
+        openSubstitution('subst', i); i++;
+        continue;
+      }
+      // Inside a case HEAD (`subject`/`in`/`pattern`) a word-start `(` is the
+      // optional leading paren of a pattern (`(a)`); in an arm BODY it is a
+      // subshell like anywhere else (`a) (rm x);;`).
+      const top = caseTop();
+      if (ch === '(' && !started && (top === null || top === 'body')) {
+        if (atCap) { pushSubshellSeparator(); continue; }
+        // `<(cmd)` / `>(cmd)`: a process substitution is a WORD (a filename),
+        // so it is hoisted like `$(…)` and the redirect keeps its operand.
+        const prev = sink[sink.length - 1];
+        if (i > 0 && (command[i - 1] === '<' || command[i - 1] === '>') && prev && prev.redirect) {
+          openSubstitution('subst', i);
+          continue;
+        }
+        // `caseLen`: a subshell opened in an arm body closes only at that
+        // same case level, never through a pattern `)` of a nested case.
+        stack.push({ kind: 'paren', caseLen: caseStates.length });
+        pushSubshellSeparator();
+        continue;
+      }
+      if (ch === ')') {
+        // `esac)` must close its case before the paren is judged.
+        if (started && !sawQuote && text === 'esac') flush();
+        // End of a case PATTERN (`a)`, `(a)`, `"a")`, `a)rm …`): keep the `)`
+        // on the pattern word and start the arm as a new statement, so its
+        // first word is a segment head (#1671 follow-up F1) and a `case`
+        // there opens (F2).
+        if (caseTop() === 'pattern') {
+          text += ch; started = true;
+          flush();
+          sink.push({ text: ';', quoted: false, operator: 'case-pattern' });
+          setCaseTop('body');
+          continue;
+        }
+        // `f()` / `arr=()` — the `)` right after a MID-WORD `(` is that word's
+        // own text, never the close of an enclosing `$( … )` / subshell.
+        // Keyed on WHERE that `(` came from, not on the raw previous char: an
+        // escaped `\(` would otherwise keep a `"$(echo \()"` open and swallow
+        // every following command (refute review of 8f323ad8, HIGH).
+        if (started && bareParenAt === i - 1 && text.endsWith('(')) {
+          text += ch;
+          // #1679: an adjacent compound body must start a fresh token too:
+          // `f(){unlink X;}` / `f()(unlink X)`. Only a bare, unquoted head in
+          // command position qualifies; argument text must stay an argument.
+          const bodyOpener = command[i + 1];
+          if (!sawQuote && FUNCTION_HEAD_RE.test(text) && nextWordInCommandPosition(sink) &&
+              (bodyOpener === '{' || bodyOpener === '(')) {
+            flush();
+            if (bodyOpener === '{') {
+              sink.push({ text: '{', quoted: false });
+              i++;
+            }
+          }
+          continue;
+        }
+        const frame = stack[stack.length - 1];
+        if (topKind() === 'paren' && caseStates.length === frame.caseLen &&
+            (caseTop() === null || caseTop() === 'body')) {
+          stack.pop(); pushSubshellSeparator(); continue;
+        }
+        if (caseStates.length === 0 && topKind() === 'subst') { closeSubstitution(i + 1); continue; }
+      }
+    }
+
     // A REAL (non-continued) newline is a command separator, exactly like `;`
     // in the POSIX grammar (#981). MUST stay below the pending-here-doc branch
     // above: a newline that opens or ends a here-doc body is consumed there and
@@ -528,7 +791,7 @@ export function tokenizeCommand(command) {
     // consumers that care, mirroring how `redirect` marks redirect tokens.
     if (ch === '\n') {
       flush();
-      tokens.push({ text: ';', quoted: false, operator: 'newline' });
+      sink.push({ text: ';', quoted: false, operator: 'newline' });
       continue;
     }
 
@@ -544,10 +807,10 @@ export function tokenizeCommand(command) {
     if (ch === '&' && command[i + 1] === '>') {
       flush();
       if (command[i + 2] === '>') {
-        tokens.push({ text: '&>>', quoted: false, redirect: { fd: null, mode: 'append' } });
+        sink.push({ text: '&>>', quoted: false, redirect: { fd: null, mode: 'append' } });
         i += 2;
       } else {
-        tokens.push({ text: '&>', quoted: false, redirect: { fd: null, mode: 'truncate' } });
+        sink.push({ text: '&>', quoted: false, redirect: { fd: null, mode: 'truncate' } });
         i += 1;
       }
       continue;
@@ -555,7 +818,7 @@ export function tokenizeCommand(command) {
     if (ch === '<') {
       if (command[i + 1] === '<' && command[i + 2] === '<') {
         flush();
-        tokens.push({ text: '<<<', quoted: false, redirect: { fd: null, mode: 'herestring' } });
+        sink.push({ text: '<<<', quoted: false, redirect: { fd: null, mode: 'herestring' } });
         i += 2;
         continue;
       }
@@ -576,7 +839,7 @@ export function tokenizeCommand(command) {
         const fdDigits = takeFdPrefix();
         const fdNum = fdDigits === '' ? null : Number.parseInt(fdDigits, 10);
         const opText = `${fdDigits}<<${stripTabs ? '-' : ''}`;
-        tokens.push({ text: opText, quoted: false, redirect: { fd: fdNum, mode: 'heredoc' } });
+        sink.push({ text: opText, quoted: false, redirect: { fd: fdNum, mode: 'heredoc' } });
         if (value && command[end] !== ')') {
           pendingHeredocs.push({ delim: value, stripTabs });
           i = end - 1;
@@ -587,7 +850,7 @@ export function tokenizeCommand(command) {
       }
       const fdDigits = takeFdPrefix();
       const fdNum = fdDigits === '' ? null : Number.parseInt(fdDigits, 10);
-      tokens.push({ text: `${fdDigits}<`, quoted: false, redirect: { fd: fdNum, mode: 'read' } });
+      sink.push({ text: `${fdDigits}<`, quoted: false, redirect: { fd: fdNum, mode: 'read' } });
       continue;
     }
     if (ch === '>') {
@@ -605,20 +868,20 @@ export function tokenizeCommand(command) {
       }
       const fdText = fd === null ? '' : String(fd);
       if (command[i + 1] === '>') {
-        tokens.push({ text: `${fdText}>>`, quoted: false, redirect: { fd, mode: 'append' } });
+        sink.push({ text: `${fdText}>>`, quoted: false, redirect: { fd, mode: 'append' } });
         i += 1;
       } else if (command[i + 1] === '&' && /[0-9]/.test(command[i + 2] ?? '')) {
         // N>&M / >&M — fd duplication; the target fd is inline, no operand word.
         let j = i + 2;
         let dupTarget = '';
         while (j < command.length && /[0-9]/.test(command[j])) { dupTarget += command[j]; j++; }
-        tokens.push({ text: `${fdText}>&${dupTarget}`, quoted: false, redirect: { fd, mode: 'dup' } });
+        sink.push({ text: `${fdText}>&${dupTarget}`, quoted: false, redirect: { fd, mode: 'dup' } });
         i = j - 1;
       } else if (command[i + 1] === '|') {
-        tokens.push({ text: `${fdText}>|`, quoted: false, redirect: { fd, mode: 'truncate' } });
+        sink.push({ text: `${fdText}>|`, quoted: false, redirect: { fd, mode: 'truncate' } });
         i += 1;
       } else {
-        tokens.push({ text: `${fdText}>`, quoted: false, redirect: { fd, mode: 'truncate' } });
+        sink.push({ text: `${fdText}>`, quoted: false, redirect: { fd, mode: 'truncate' } });
       }
       continue;
     }
@@ -630,12 +893,20 @@ export function tokenizeCommand(command) {
     // #983 redirect token class), so this branch only ever sees a bare chain `&`.
     if (ch === ';' || ch === '|' || ch === '&') {
       flush();
+      // `;;` / `;&` / `;;&` end an arm: the next word at this level is a pattern.
+      if (ch === ';' && (command[i + 1] === ';' || command[i + 1] === '&') && caseTop() === 'body') {
+        setCaseTop('pattern');
+      }
       let op = ch;
       if ((ch === '&' || ch === '|') && command[i + 1] === ch) { op = ch + ch; i++; }
-      tokens.push({ text: op, quoted: false });
+      sink.push({ text: op, quoted: false });
       continue;
     }
 
+    if (ch === '(') bareParenAt = i;
+    // A bare `{` extends the run of leading braces only while nothing else — not
+    // even an empty quote pair (`""{x` is a literal word) — came before it.
+    if (ch === '{' && text.length === braceLead && (braceLead > 0 || !started)) braceLead++;
     text += ch; started = true;
   }
 
@@ -645,6 +916,18 @@ export function tokenizeCommand(command) {
   if (state !== 'normal') sawQuote = true;
   flush();
 
+  // Unclosed nesting levels (#1667): an open `( …` just ends; an open
+  // substitution is closed at end of input, so its body is STILL hoisted — the
+  // conservative direction (the verb inside stays visible) — and the outer word
+  // keeps the raw remainder.
+  while (stack.length > 0) {
+    if (topKind() === 'paren') { stack.pop(); continue; }
+    closeSubstitution(command.length);
+    if (state !== 'normal') sawQuote = true;
+    flush();
+  }
+  for (const t of hoisted) tokens.push(t); // no spread — see closeSubstitution
+
   return tokens;
 }
 
@@ -656,7 +939,10 @@ export function tokenizeCommand(command) {
  *
  * Two classes, both dropped, for the same reason:
  *   - OPENERS (`{`, `(`, `!`, `if`, `elif`, `then`, `else`, `while`, `until`,
- *     `do`) are followed by a COMMAND. Dropping one moves verb resolution
+ *     `do`, `coproc`) are followed by a COMMAND. `coproc` runs it as a
+ *     coprocess in bash and zsh (#1707 point 3). NAMED CEILING (BV-004): bash's
+ *     named form `coproc NAME { …; }` still reads NAME as the verb; revisit if
+ *     that spelling shows up in a transcript census. Dropping one moves verb resolution
  *     towards the real command — the identical safety argument WRAPPER_UNWRAP
  *     makes for a transparent wrapper: a dropped token is a reserved word, never
  *     an interpreter, so this cannot turn a match into a miss.
@@ -672,19 +958,120 @@ export function tokenizeCommand(command) {
  *     one table: a second entry here would fork the wrapper-vs-keyword decision
  *     the way `VERB_PREFIXES` once forked WRAPPER_UNWRAP (#991).
  *
- * NAMED CEILING (BV-004): only a STANDALONE token is dropped. bash requires
- * whitespace around `{` / `}`, so brace groups are always covered; a subshell
- * written WITHOUT the space (`(rm -rf /)`) lexes as the glued word `(rm` and is
- * not reached — the pre-#1145 behaviour, unchanged. Peeling the paren off the
- * token TEXT would mutate a token five consumers read positionally, which is a
- * larger contract change than this defect justifies. Revisit if a glued-paren
- * form shows up in a real overflow triage or guard-bypass measurement.
+ * Only a STANDALONE token is dropped. bash requires whitespace around `{` /
+ * `}`, so brace groups are always covered; a subshell written WITHOUT the space
+ * (`(rm -rf /)`) no longer reaches this table at all — since #1667 the lexer
+ * emits its parens as separators (see {@link tokenizeCommand}).
  */
 const COMMAND_POSITION_KEYWORDS = new Set([
-  '{', '(', '!', 'if', 'elif', 'then', 'else', 'while', 'until', 'do',
+  '{', '(', '!', 'if', 'elif', 'then', 'else', 'while', 'until', 'do', 'coproc',
   '}', ')', 'fi', 'done', 'esac',
 ]);
 
+/**
+ * Is `segment` exactly a function-definition head: `name()`, `function name`
+ * or `function name()`, all unquoted?
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} segment
+ * @returns {boolean}
+ */
+function isFunctionHead(segment) {
+  // Length first: splitSegments asks this per token, so a scan of a long
+  // segment here would make the split quadratic.
+  if (segment.length === 0 || segment.length > 2 || segment.some((t) => t.quoted)) return false;
+  // A lone `function` is zsh's anonymous function (`function { …; }`), which
+  // zsh runs on the spot — measured: zsh 5.9 prints `hi` for
+  // `function { echo hi; }` (#1699 item 13).
+  if (segment.length === 1) return segment[0].text === 'function' || FUNCTION_HEAD_RE.test(segment[0].text);
+  return segment.length === 2 && segment[0].text === 'function';
+}
+
+/**
+ * How many brace-group openers are glued to the front of `tok`'s command word
+ * (`{unlink` → 1, `{{unlink` → 2, `{"unlink"` → 1)? 0 when none.
+ * zsh reads a leading `{` in command position as the reserved word even
+ * without a following blank — measured with zsh 5.9: `{echo hi;}`,
+ * `f() {echo hi;}; f` and `function f() {echo hi;}; f` all print `hi`, and
+ * `{echo,hi}` fails as `command not found: echo,hi` (#1699 item 13). bash
+ * rejects or brace-expands these forms; splitting the `{` off never hides a
+ * verb there either, since the remainder was no verb before. A token that
+ * also ENDS in `}` (`{}`, `{fd}` of a named-fd redirection `{fd}>file`) is
+ * left alone: it closes itself, so no command word sits behind its `{`.
+ *
+ * #1707 point 2: the decision rests on the RAW leading characters, not on the
+ * token's `quoted` flag — zsh runs `{"echo" L;}`, `{'echo' L;}` and
+ * `{{echo L;}}`, where the `{` is bare although the rest of the word is quoted,
+ * or is itself followed by another opener. The lexer records the bare run as
+ * `braceLead` on a quoted token (see {@link tokenizeCommand}); a token that is
+ * quoted from its first character (`"{unlink"`) carries none and stays a word.
+ *
+ * @param {{ text: string, quoted: boolean, braceLead?: number, redirect?: object, operator?: string }} tok
+ * @returns {number}
+ */
+function gluedBraceOpenerCount(tok) {
+  if (tok.redirect || tok.operator !== undefined) return 0;
+  let n = 0;
+  if (tok.quoted) n = tok.braceLead ?? 0;
+  else while (n < tok.text.length && tok.text[n] === '{') n++;
+  if (n === 0 || n >= tok.text.length || tok.text.endsWith('}')) return 0;
+  return n;
+}
+
+/**
+ * The extra reading of a word that ends in a `}` glued to it inside an open
+ * brace group (#1707 point 1): zsh 5.9 prints `-r X` for `{echo -r X}` — the
+ * glued `}` closes the group and is not part of the word — while bash keeps it
+ * as text. An option table cannot enumerate unknown forms, so both readings
+ * are judged and never one picked: the word itself stays, and the word with
+ * ONE trailing `}` stripped is the second reading.
+ *
+ * zsh closes exactly ONE group per glued `}` word, however many braces trail
+ * it (zsh 5.9, measured 2026-10-22): `{echo X}}` prints `X}`, `{{echo X}}` is a
+ * parse error, `{ echo X }}}` prints `X }}`, `{ { echo a}}; echo X}` prints
+ * `a}` then `X` (the outer group stays open until `X}`), and
+ * `{ { { echo a}}}; echo X}; echo Y}` prints `a}}`, `X`, `Y`. Counting several
+ * closes for one word left a later glued `}` with no reading:
+ * `{ { echo a}}; echo x >CLAUDE.md}` truncates `CLAUDE.md` in zsh. One reading
+ * per word also keeps the work linear on a `{`×N `X` `}`×N flood.
+ *
+ * A glued `}` word never lowers `openGroups` (security re-review of f99e1352):
+ * the reader cannot tell a real closer from a word zsh keeps as text —
+ * `${HOME}`, `{a,b}`, `"a}"`, `a\}` — and counting one of those as a close left
+ * the REAL closer behind it with no reading: `{ echo ${HOME}; echo x >CLAUDE.md}`
+ * truncates `CLAUDE.md` in zsh 5.9. Only a `}` keyword in command position
+ * closes a group (see {@link splitSegments}).
+ *
+ * NAMED CEILING (BV-004): this over-counts open groups, deliberately fail-closed
+ * — an extra open group only ADDS a reading, never drops one. What it
+ * over-blocks: once a glued group has really closed, a later `x}` word outside
+ * it still yields `x` too (`{ echo a}; rm x}` is judged as `x}` and `x`).
+ * Revisit if a false DENY on a real transcript command traces to this reading.
+ *
+ * @param {string} text
+ * @param {number} openGroups
+ * @returns {string[]} the one stripped reading, or [] when the word has no
+ *   glued `}`, no group is open, or the word is only `}`.
+ */
+function gluedCloseReadings(text, openGroups) {
+  if (openGroups === 0 || text.length < 2 || !text.endsWith('}')) return [];
+  return [text.slice(0, -1)];
+}
+
+/**
+ * Is `segment` exactly a prefix that puts the next word — a brace group or any
+ * other compound command — in command position? A function head (see
+ * {@link isFunctionHead}) or `time` / `time -p`, which bash and zsh both parse
+ * as a pipeline prefix (#1707 point 3: zsh runs `time {unlink P;}`).
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} segment
+ * @returns {boolean}
+ */
+function isCompoundPrefix(segment) {
+  if (isFunctionHead(segment)) return true;
+  if (segment.length === 0 || segment.length > 2 || segment.some((t) => t.quoted)) return false;
+  return segment[0].text === 'time' && (segment.length === 1 || segment[1].text === '-p');
+}
+
 /**
  * Split a tokenized command into chained segments on shell control operators
  * (`;`, `&&`, `||`, `|`, `&`) and on newline separators (#981). Only UNQUOTED
@@ -699,6 +1086,16 @@ const COMMAND_POSITION_KEYWORDS = new Set([
  * `for t in a b c; do glab issue create …; done` and `{ glab issue create …; }`
  * were allowed with NO accounting at all, while the plain form denied at 1/1.
  *
+ * zsh keyword bodies (#1707 point 3), each judged in command position:
+ * `repeat N cmd` / `repeat N { …; }` (the count word is dropped with the
+ * keyword), `{ …; } always { …; }` (an `always` right after a group's closing
+ * `}` starts a new statement), `time { …; }` (see {@link isCompoundPrefix}) and
+ * zsh's short function body `f() cmd`. Inside an open brace group a word with a
+ * glued `}` carries `closeReadings` (see {@link gluedCloseReadings}) for the
+ * delete and redirect target surfaces. Only a command-position `}` keyword
+ * lowers the open-group count; a glued `}` word never does, so the count may
+ * over-state open groups — a fail-closed ceiling named in gluedCloseReadings.
+ *
  * The newline separator is checked by its `operator` field as well as its text,
  * so the split survives a future change to that token's spelling. Because a
  * separator token is CONSUMED here, it can never reach a per-segment operand
@@ -710,30 +1107,181 @@ const COMMAND_POSITION_KEYWORDS = new Set([
  * parsing (#982/#983). The hook previously kept a drift-prone local mirror
  * of this splitter (regex-based operator set vs. this Set) — W4 B1.
  *
+ * An `always` after a GLUED or one-word close (`x}`, `{true}`) has two readings
+ * and both are judged (review of !233): zsh may read the word as closing the
+ * group, so `always` starts a new statement; bash knows no `always` and passes
+ * it and every word behind it to the command — `bash -c '{ rm -f x} always
+ * CLAUDE.md; }'` deletes CLAUDE.md. The bash reading keeps every statement; from
+ * the first soft cut on, each zsh statement is added unless the bash reading has
+ * the same words, in which case its glued-close readings are merged into that
+ * statement instead — `{true} always {echo a; rm CLAUDE.md}` keeps `CLAUDE.md`
+ * from zsh's open `always` group, and no statement is counted twice (the
+ * issue-budget guard counts per segment). A command-position `}` is no such
+ * case: `} always` is a bash syntax error, the cut is hard.
+ *
  * @param {Array<{ text: string, quoted: boolean }>} tokens
- * @returns {Array<Array<{ text: string, quoted: boolean }>>}
+ * @returns {Array<Array<{ text: string, quoted: boolean, closeReadings?: string[] }>>}
  */
 function splitSegments(tokens) {
+  const zsh = splitSegmentsReading(tokens, true);
+  if (!zsh.softCut) return zsh.segments;
+  const segments = splitSegmentsReading(tokens, false).segments;
+  const byWords = new Map(segments.map((segment, i) => [segmentKey(segment), i]));
+  for (const segment of zsh.segments) {
+    if (!segment.afterSoftCut) continue;
+    const key = segmentKey(segment);
+    const at = byWords.get(key);
+    if (at === undefined) {
+      byWords.set(key, segments.length);
+      segments.push(segment);
+      continue;
+    }
+    segments[at] = mergeCloseReadings(segments[at], segment);
+  }
+  return segments;
+}
+
+/**
+ * The bash statement with the zsh statement's glued-close readings added per
+ * word (both have the same words). New token objects: the tokens are shared
+ * between the two readings.
+ *
+ * @param {Array<object>} target
+ * @param {Array<object>} source
+ * @returns {Array<object>}
+ */
+function mergeCloseReadings(target, source) {
+  return target.map((tok, i) => {
+    const extra = source[i]?.closeReadings;
+    if (!extra) return tok;
+    const merged = [...new Set([...(tok.closeReadings ?? []), ...extra])];
+    return { ...tok, closeReadings: merged };
+  });
+}
+
+/** @param {Array<{ text: string, quoted: boolean }>} segment */
+function segmentKey(segment) {
+  return JSON.stringify(segment.map((t) => [t.text, t.quoted]));
+}
+
+/**
+ * One reading of {@link splitSegments}. `cutSoftAlways`: whether an `always`
+ * after a glued or one-word close starts a new statement (zsh) or stays a word
+ * (bash). Every statement written after the first such cut is marked
+ * `afterSoftCut`.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} tokens
+ * @param {boolean} cutSoftAlways
+ * @returns {{ segments: Array<Array<object>>, softCut: boolean }}
+ */
+function splitSegmentsReading(tokens, cutSoftAlways) {
+  let softCut = false;
+  // Marked when a statement is WRITTEN, not when `current` starts: keyword
+  // peeling (`always { rm …`) replaces `current` in between.
   const segments = [];
+  const pushSegment = (segment) => {
+    if (segment.length > 0 && softCut) segment.afterSoftCut = true;
+    segments.push(segment);
+  };
   let current = [];
   const operators = new Set([';', '&&', '||', '|', '&']);
-  for (const tok of tokens) {
+  // Open brace groups (#1707 point 1) — only a group opened in command
+  // position counts, so `echo {a,b}` never arms the glued-`}` readings.
+  let openGroups = 0;
+  // The previous token closed a brace group — zsh's `always` may follow it:
+  // 'hard' after a command-position `}`, 'soft' after a glued or one-word close.
+  let closedGroup = null;
+  // The next token is the count word of a command-position `repeat`.
+  let repeatCount = false;
+  for (let i = 0; i < tokens.length; i++) {
+    const tok = tokens[i];
+    const afterClose = closedGroup;
+    closedGroup = null;
     if (!tok.quoted && (tok.operator === 'newline' || operators.has(tok.text))) {
-      segments.push(current);
+      pushSegment(current);
+      current = [];
+      repeatCount = false;
+      continue;
+    }
+    if (repeatCount) { repeatCount = false; continue; }
+    // zsh `repeat N body` (#1707 point 3): the keyword and its count are no
+    // command; the body behind them runs N times. Only a count WORD counts: in
+    // bash `repeat` is an ordinary command name and `repeat >CLAUDE.md`
+    // truncates before the lookup fails, so a redirect or an operator behind it
+    // keeps `repeat` the segment head and the redirect collected. A quoted count
+    // is still one word — zsh 5.9 runs `repeat '2' cmd` and `repeat "$N" cmd`.
+    const count = tokens[i + 1];
+    if (current.length === 0 && !tok.quoted && tok.text === 'repeat' && count !== undefined &&
+        !count.redirect && count.operator === undefined &&
+        !operators.has(count.text)) {
+      repeatCount = true;
+      continue;
+    }
+    // zsh `{ try; } always { finally; }` (#1707 point 3): the `always` body runs
+    // like any group, so `always` ends the statement before it.
+    if (afterClose !== null && !tok.quoted && tok.text === 'always' &&
+        (afterClose === 'hard' || cutSoftAlways)) {
+      if (current.length > 0) pushSegment(current);
       current = [];
+      if (afterClose === 'soft') softCut = true;
       continue;
     }
     // Reserved word in COMMAND POSITION (`current` still empty) → drop it, so
     // the NEXT token becomes the segment head and is itself judged in command
     // position (`do { rm …` peels both). A keyword anywhere else is an ordinary
     // argument and is kept verbatim (#1145).
-    if (current.length === 0 && !tok.quoted && COMMAND_POSITION_KEYWORDS.has(tok.text)) {
+    //
+    // A function head (`f()`, `function f`, `function f()`) before its compound
+    // body (#1679 point 1): the head is no command, and the body runs on every
+    // call, so drop the head and judge the body in command position like a bare
+    // brace group. Before, `f() { unlink <ledger>; }; f` resolved to verb `f()`.
+    // `time` / `time -p` before a compound command is dropped the same way.
+    if (!tok.quoted && COMMAND_POSITION_KEYWORDS.has(tok.text) &&
+        (current.length === 0 || isCompoundPrefix(current))) {
+      current = [];
+      if (tok.text === '{') openGroups++;
+      if (tok.text === '}') { openGroups = Math.max(0, openGroups - 1); closedGroup = 'hard'; }
+      continue;
+    }
+    // A `{` glued to the first word of a brace group (zsh, #1699 item 13 —
+    // repeatedly and on the raw first character since #1707 point 2): drop the
+    // openers, so the word behind them is the segment head.
+    const glued = gluedBraceOpenerCount(tok);
+    if (glued > 0 && (current.length === 0 || isCompoundPrefix(current))) {
+      const { braceLead: _consumed, ...rest } = tok;
+      current = [{ ...rest, text: tok.text.slice(glued) }];
+      openGroups += glued;
+      continue;
+    }
+    // zsh's short function body `f() cmd` (#1707 point 3): zsh 5.9 runs
+    // `f() unlink P; f`, so the head is dropped and `cmd` heads the segment.
+    if (current.length === 1 && !current[0].quoted && FUNCTION_HEAD_RE.test(current[0].text) &&
+        !tok.redirect) {
+      current = [];
+    }
+    // Outside a group `gluedCloseReadings` is []; inside one, a glued `}` word
+    // gets its stripped reading but does NOT lower `openGroups`: `${HOME}`,
+    // `{a,b}`, `"a}"` look the same and close nothing in zsh, so every later
+    // glued `}` keeps its reading (fail-closed, see gluedCloseReadings). It may
+    // still close a group, so an `always` may follow it.
+    const readings = !tok.redirect && tok.operator === undefined
+      ? gluedCloseReadings(tok.text, openGroups)
+      : [];
+    if (readings.length > 0) {
+      closedGroup = 'soft';
+      current.push({ ...tok, closeReadings: readings });
       continue;
     }
+    // A one-word group heading its statement (`{true} always {…}`) closes
+    // itself, so an `always` may follow it as well.
+    if (current.length === 0 && !tok.quoted && tok.text.length > 2 && tok.text[0] === '{' &&
+        tok.text.endsWith('}')) {
+      closedGroup = 'soft';
+    }
     current.push(tok);
   }
-  segments.push(current);
-  return segments.filter((s) => s.length > 0);
+  pushSegment(current);
+  return { segments: segments.filter((s) => s.length > 0), softCut };
 }
 
 // Public alias — the single source of truth for chain-segment splitting shared
@@ -1394,8 +1942,12 @@ function collectRedirectTargets(segments, out, depth, budget) {
         // Variable indirection (`> "$X"`), command substitution (`> $(cmd)` /
         // backticks), or a missing operand: fail-visible, never guess (#983).
         out.push({ target: null, mode, fd, unresolved: true });
-      } else {
-        out.push({ target: operand.text, mode, fd });
+        continue;
+      }
+      // A glued group-closing `}` (`{echo x >CLAUDE.md}`) — both readings are
+      // judged (#1707 point 1, see gluedCloseReadings).
+      for (const text of [operand.text, ...(operand.closeReadings ?? [])]) {
+        out.push({ target: text, mode, fd });
       }
     }
 
@@ -1975,7 +2527,11 @@ function collectDeleteTargets(segments, out, depth, budget) {
       // this segment — same rule commandHasRecursiveForceRm applies. An
       // interpreter's quoted payload is reached through the recursion below
       // instead, where it is re-tokenized as the command it really is.
-      if (segment[reading.index].quoted) continue;
+      // A quoted SINGLE word is no such literal (#1707 point 2): `"unlink" P`
+      // and `{"unlink" P;}` run unlink, the quotes only vanish. Only a quoted
+      // token with whitespace in it — a payload, never one argv word that
+      // could still resolve to the verb — stays inert.
+      if (segment[reading.index].quoted && /\s/.test(segment[reading.index].text)) continue;
 
       let seenDashDash = false;
       for (let i = reading.index + 1; i < segment.length; i++) {
@@ -1998,19 +2554,23 @@ function collectDeleteTargets(segments, out, depth, budget) {
         // where a value-taking reading would have swallowed it silently.
         if (!seenDashDash && !tok.quoted && tok.text.startsWith('-') && tok.text !== '-') continue;
 
-        const key = `${reading.verb}\u0000${tok.text}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-
-        if (/[$`]/.test(tok.text)) {
-          // Variable indirection (`rm -f "$LEDGER"`) or command substitution:
-          // fail-visible, never guess (#983 rule, same direction).
-          out.push({
-            target: null, verb: reading.verb, unresolved: true, reason: 'variable/substitution',
-          });
-          continue;
+        // A word with a glued group-closing `}` is judged in BOTH readings
+        // (#1707 point 1, see gluedCloseReadings): `{rm -r .orchestrator}`.
+        for (const text of tok.closeReadings ? [tok.text, ...tok.closeReadings] : [tok.text]) {
+          const key = `${reading.verb}\u0000${text}`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+
+          if (/[$`]/.test(text)) {
+            // Variable indirection (`rm -f "$LEDGER"`) or command substitution:
+            // fail-visible, never guess (#983 rule, same direction).
+            out.push({
+              target: null, verb: reading.verb, unresolved: true, reason: 'variable/substitution',
+            });
+            continue;
+          }
+          out.push({ target: text, verb: reading.verb });
         }
-        out.push({ target: tok.text, verb: reading.verb });
       }
     }