specpi 0.10.0

package/extensions/command-guard/rules.mjs

@@ -0,0 +1,2557 @@
+import { classifyPath, isAgentPath } from "./paths.mjs";
+import { COMMAND_FLAG, ENCODED_COMMAND_FLAG, HOST_NAMES as POWERSHELL_HOSTS } from "./powershell.mjs";
+
+export const POLICY_VERSION = 2;
+
+// Determinate, noncritical findings are normally filtered out in Guard so routine work stays quiet. These
+// rules are the exception: Guard still asks, because the operation discards or rewrites work — local or
+// remote — that no undo can restore. Critical findings are immutable denials in every mode and do not
+// belong here.
+export const GUARD_APPROVAL_RULES = new Set(["git.destructive", "git.force-push"]);
+
+const DELETE_NAMES = new Set([
+    "rm",
+    "rmdir",
+    "find",
+    "shred",
+    "truncate",
+    "remove-item",
+    "ri",
+    "del",
+    "erase",
+    "rd",
+    "clear-item",
+    "clear-content",
+    "clear-recyclebin",
+]);
+const REGISTRY_PROPERTY_NAMES = new Set([
+    "set-itemproperty",
+    "new-itemproperty",
+    "copy-itemproperty",
+    "move-itemproperty",
+    "rename-itemproperty",
+    "remove-itemproperty",
+    "clear-itemproperty",
+]);
+const POWERSHELL_WRITE_NAMES = new Set([
+    "set-content",
+    "add-content",
+    "out-file",
+    "tee-object",
+    "export-alias",
+    "export-csv",
+    "export-clixml",
+    "export-counter",
+    "export-formatdata",
+    "export-pssession",
+    "new-item",
+    "copy-item",
+    "move-item",
+    "rename-item",
+    "set-item",
+    "compress-archive",
+    "expand-archive",
+    "start-transcript",
+    "add-type",
+    "new-modulemanifest",
+    "save-help",
+    "save-module",
+    "save-package",
+    "save-script",
+]);
+const DISK_NAMES = new Set([
+    "dd",
+    "mkfs",
+    "mkfs.ext4",
+    "wipefs",
+    "fdisk",
+    "parted",
+    "diskpart",
+    "format",
+    "clear-disk",
+    "initialize-disk",
+    "format-volume",
+    "remove-partition",
+    "cipher",
+]);
+const INTERPRETER_NAMES = new Set([
+    "python",
+    "python3",
+    "py",
+    "node",
+    "deno",
+    "bun",
+    "ruby",
+    "perl",
+    "php",
+    "lua",
+    "rscript",
+    "osascript",
+    "tclsh",
+    "expect",
+]);
+// su and runuser are not interpreters, but their -c argument is an unrestricted shell command string.
+const SHELL_NAMES = new Set([
+    "bash",
+    "sh",
+    "zsh",
+    "dash",
+    "ksh",
+    "fish",
+    "powershell",
+    "pwsh",
+    "cmd",
+    "cmd.exe",
+    "eval",
+    "iex",
+    "invoke-expression",
+    "su",
+    "runuser",
+    ...INTERPRETER_NAMES,
+]);
+// awk is deliberately kept out of SHELL_NAMES so ordinary `… | awk '{print $1}'` pipelines stay allowed.
+const AWK_NAMES = new Set(["awk", "gawk", "mawk", "nawk"]);
+const AWK_ESCAPE = /\b(?:system|ENVIRON)\s*[([]|\|\s*&?\s*["']|>>?\s*["']/;
+const AWK_PROGRAM_SOURCE = /^--?(?:f|file|e|source|l|load|include)$/i;
+const ENVIRONMENT_DUMP_NAMES = new Set(["env", "printenv", "set", "export", "declare", "typeset", "compgen"]);
+const SECRET_VARIABLE = /(?:token|secret|password|credential|api[_-]?key|aws_(?:secret|session)|github_token)/i;
+// PowerShell resolves any unambiguous parameter prefix, so -enc and -com run the same code as their full
+// spellings. Matching only the full names lets a shorter one walk past the inline-code gate entirely.
+const INLINE_CODE_FLAG = /^(?:-c|-command|-encodedcommand|\/c|\/k|-e|--eval|-r)$/i;
+function inlineCodeFlag(name, arg) {
+    const value = String(arg);
+    if (INLINE_CODE_FLAG.test(value)) {
+        return true;
+    }
+
+    return POWERSHELL_HOSTS.includes(name) && (COMMAND_FLAG.test(value) || ENCODED_COMMAND_FLAG.test(value));
+}
+
+const DOWNLOAD_NAMES = new Set([
+    "curl",
+    "wget",
+    "invoke-webrequest",
+    "invoke-restmethod",
+    "iwr",
+    "irm",
+    "start-bitstransfer",
+    "bitsadmin",
+    "certutil",
+]);
+// Every one of these turns opaque bytes back into runnable text, so limiting the decode-to-interpreter rule to
+// base64 left base32, hex and uuencode as equivalent uninspected channels into the same shell.
+const DECODER_NAMES = new Set([
+    "base64",
+    "base32",
+    "basenc",
+    "openssl",
+    "certutil",
+    "uudecode",
+    "xxd",
+    "hexdump",
+    "od",
+    "tr",
+    "rev",
+]);
+const NETWORK_NAMES = new Set([
+    ...DOWNLOAD_NAMES,
+    "scp",
+    "rsync",
+    "invoke-command",
+    "ssh",
+    "sftp",
+    "ftp",
+    "start-process",
+]);
+const READ_NAMES = new Set([
+    "cat",
+    "head",
+    "tail",
+    "less",
+    "more",
+    "get-content",
+    "gc",
+    "type",
+    "copy",
+    "cp",
+    "tac",
+    "nl",
+    "od",
+    "xxd",
+    "hexdump",
+    "strings",
+]);
+const SERVICE_NAMES = new Set([
+    "service",
+    "systemctl",
+    "launchctl",
+    "sc",
+    "sc.exe",
+    "stop-service",
+    "restart-service",
+    "new-service",
+    "remove-service",
+]);
+// Endpoint-protection services matched as COMPLETE tokens. Substring matching on words such as "security",
+// "firewall" and "sentinel" turned ordinary units — `redis-sentinel`, `security-scanner.service`, an in-house
+// `firewall-ui` — into critical denials that locked the session, the opposite of a catastrophe backstop.
+const SECURITY_SERVICE_TOKEN =
+    /(?:^|[\s"'=/\\])(?:windefend|windefendsvc|securityhealthservice|sense|mpssvc|auditd|firewalld|ufw|apparmor|selinux|clamav(?:-[a-z]+)?|falcon[-_]?sensor|crowdstrike[a-z-]*|sentinelone|sentinelagent|wazuh[a-z-]*|osqueryd|carbonblack|cbdaemon|defender|windowsdefender)(?:\.(?:service|exe))?(?:$|[\s"'/\\;,])/i;
+const PERMISSION_NAMES = new Set(["chmod", "chown", "chgrp", "setfacl", "icacls", "takeown", "set-acl"]);
+const ACCOUNT_NAMES = new Set([
+    "useradd",
+    "usermod",
+    "userdel",
+    "groupadd",
+    "groupmod",
+    "groupdel",
+    "passwd",
+    "chpasswd",
+    "dscl",
+    "net",
+    "new-localuser",
+    "set-localuser",
+    "remove-localuser",
+    "add-localgroupmember",
+    "remove-localgroupmember",
+]);
+
+const normalized = (value) =>
+    String(value || "")
+        .toLowerCase()
+        .replace(/\.exe$/, "")
+        .split(/[\\/]/)
+        .pop();
+const pathArguments = (args, options) =>
+    args.filter(
+        (arg) =>
+            typeof arg === "string" &&
+            arg !== "--" &&
+            !arg.startsWith("-") &&
+            !(
+                options.platform === "win32" &&
+                /^(?:cmd|cmd\.exe|powershell|pwsh)$/i.test(String(options.shell || "")) &&
+                /^\/[a-z?]+$/i.test(arg)
+            ) &&
+            arg !== "[dynamic]",
+    );
+function match(id, severity, category, reason, leaf, saferAlternative) {
+    return {
+        action: severity === "critical" ? "deny" : "ask",
+        severity,
+        category,
+        ruleIds: [id],
+        leaves: [{ executable: leaf.executable, operation: leaf.operation, redactedTarget: leaf.redactedTarget }],
+        reason,
+        ...(saferAlternative ? { saferAlternative } : {}),
+        lockSession: severity === "critical",
+    };
+}
+
+function targetState(args, options) {
+    const targets = pathArguments(args, options);
+    const classified = targets.map((target) => ({ target, result: classifyPath(target, options) }));
+    const broadProtected = targets.some((target) => {
+        if (!/[?*[{]/.test(target)) {
+            return false;
+        }
+
+        const terminalBase = target.replace(/[\\/](?:\*|\.\*|\{[^}]*\})[\\/]?$/, "");
+        if (terminalBase !== target && classifyPath(terminalBase, options).protected) {
+            return true;
+        }
+
+        const wildcard = target.search(/[?*[{]/);
+        const literalPrefix = target.slice(0, wildcard);
+        const separator = Math.max(literalPrefix.lastIndexOf("/"), literalPrefix.lastIndexOf("\\"));
+        const ancestor = separator >= 0 ? literalPrefix.slice(0, separator + 1) : ".";
+
+        return classifyPath(ancestor, options).protected;
+    });
+
+    return {
+        targets,
+        protectedTarget: classified.some(({ result }) => result.protected),
+        rootTarget:
+            broadProtected ||
+            classified.some(
+                ({ target, result }) =>
+                    result.kind === "device" ||
+                    /^(?:\/|~|\.\.|[a-z]:[\\/]?)$/i.test(result.lexical || "") ||
+                    /^(?:\/(?:\*|\.\*?)?|[a-z]:[\\/](?:\*|\.\*?)?)$/i.test(String(target)),
+            ),
+    };
+}
+
+function optionTargets(args, names) {
+    const targets = [],
+        lowered = names.map((name) => name.toLowerCase());
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = String(args[index]),
+            lower = arg.toLowerCase();
+        const separator = Math.min(
+            ...[lower.indexOf("="), lower.indexOf(":")].filter((value) => value > 0),
+            Number.POSITIVE_INFINITY,
+        );
+        const key = Number.isFinite(separator) ? lower.slice(0, separator) : lower;
+        const exact = lowered.filter((name) => name === key);
+        const candidates = exact.length
+            ? exact
+            : lowered.filter(
+                  (name) =>
+                      (name.startsWith("--") && key.startsWith("--") && key.length >= 3 && name.startsWith(key)) ||
+                      (/^-[a-z]{2,}$/i.test(name) && /^-[a-z]{2,}$/i.test(key) && name.startsWith(key)),
+              );
+        if (new Set(candidates).size === 1) {
+            if (Number.isFinite(separator)) {
+                targets.push(arg.slice(separator + 1));
+            } else if (typeof args[index + 1] === "string") {
+                targets.push(args[index + 1]);
+            }
+
+            continue;
+        }
+
+        for (const name of names) {
+            if (/^-[A-Za-z]$/.test(name) && lower.startsWith(name.toLowerCase()) && arg.length > name.length) {
+                targets.push(arg.slice(name.length));
+            }
+        }
+    }
+
+    return targets.filter(Boolean);
+}
+
+function hasRecursiveFlag(args) {
+    return args.some((arg) => /^(?:--recursive|--force|-{1}[a-z]*r[a-z]*|-recurse|-force|\/s|\/mir)$/i.test(arg));
+}
+
+// find only mutates when it carries an action predicate. A plain search is read-only, so it must not inherit
+// the delete-family rules — and hasRecursiveFlag matches any predicate containing an "r" (-print, -perm,
+// -newer), which would otherwise report `find src -type f -print` as a recursive deletion.
+export const FIND_MUTATION_PREDICATES = Object.freeze([
+    "-delete",
+    "-exec",
+    "-execdir",
+    "-ok",
+    "-okdir",
+    "-fls",
+    "-fprint",
+    "-fprintf",
+]);
+export function findMutates(args) {
+    return (args || []).some((arg) => FIND_MUTATION_PREDICATES.includes(String(arg)));
+}
+
+function deletesFiles(name, args) {
+    return DELETE_NAMES.has(name) && (name !== "find" || findMutates(args));
+}
+
+function bashCmdSyntaxMismatch(name, args, options) {
+    const windows = options.platform === "win32" || options.platform === "windows";
+    const bash = /^(?:bash|sh|zsh|dash|ksh|fish)$/i.test(String(options.shell || ""));
+    const cmdDelete = ["rd", "rmdir", "del", "erase"].includes(name);
+
+    return windows && bash && cmdDelete && args.some((arg) => /^(?:\/s|\/q|\/f|\/a(?::[a-z])?)$/i.test(String(arg)));
+}
+
+// True when the invocation prints or enumerates the whole environment rather than one named variable.
+function dumpsEnvironment(name, args, helpOnly) {
+    // compgen -v lists variables; the shared helpOnly heuristic would misread it as --version.
+    if (name === "compgen") {
+        return (
+            args.some((arg) => /^-[a-z]*[ve][a-z]*$/i.test(String(arg))) ||
+            args.some(
+                (arg, index) =>
+                    String(arg).toLowerCase() === "-a" &&
+                    /^(?:variable|export|exported)$/i.test(String(args[index + 1] || "")),
+            )
+        );
+    }
+
+    if (helpOnly) {
+        return false;
+    }
+
+    if (name === "printenv" || name === "set") {
+        return args.length === 0;
+    }
+
+    if (name === "export" || name === "declare" || name === "typeset") {
+        const named = args.filter((arg) => !String(arg).startsWith("-"));
+        if (named.length > 0 || args.some((arg) => String(arg).includes("="))) {
+            return false;
+        }
+
+        return args.length === 0 || name === "export" || args.some((arg) => /^-[a-z]*[px][a-z]*$/i.test(String(arg)));
+    }
+
+    return false;
+}
+
+function criticalLeaf(leaf, options) {
+    const name = normalized(leaf.executable);
+    const args = leaf.args || [];
+    const joined = args.join(" ").toLowerCase();
+    let targetsCache;
+    const targets = () => (targetsCache ||= targetState(args, options));
+
+    if (bashCmdSyntaxMismatch(name, args, options)) {
+        return {
+            action: "deny",
+            severity: "high",
+            category: "filesystem",
+            ruleIds: ["shell.syntax-mismatch"],
+            leaves: [{ executable: leaf.executable, operation: leaf.operation, redactedTarget: leaf.redactedTarget }],
+            reason: "This is cmd deletion syntax sent to the Bash tool and will not clean the intended Windows path.",
+            saferAlternative: "Use Bash `rm -rf -- <forward-slash-path>` or the PowerShell tool.",
+            lockSession: false,
+        };
+    }
+
+    if (name === "fork-bomb") {
+        return match(
+            "process.fork-bomb",
+            "critical",
+            "process",
+            "Fork-bomb process creation is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        deletesFiles(name, args) &&
+        (hasRecursiveFlag(args) || name === "find") &&
+        (targets().protectedTarget || targets().rootTarget)
+    ) {
+        return match(
+            "fs.root-recursive-delete",
+            "critical",
+            "filesystem",
+            "Recursive deletion can encompass a protected system, profile, or filesystem root.",
+            leaf,
+            "Delete one specific reviewed workspace path instead.",
+        );
+    }
+
+    if (deletesFiles(name, args) && targets().protectedTarget) {
+        return match(
+            "path.protected-mutation",
+            "critical",
+            "protected-path",
+            "The command mutates a protected path.",
+            leaf,
+        );
+    }
+
+    if (["remove-item", "ri", "del", "erase", "rd"].includes(name) && /(?:registry::|cert:\\?)/i.test(joined)) {
+        return match(
+            "windows.provider-critical",
+            "critical",
+            "security",
+            "Removing Windows Registry or certificate-store data is permanently denied.",
+            leaf,
+        );
+    }
+
+    const helpOnly = args.length > 0 && args.every((arg) => /^(?:--?h(?:elp)?|--version|-v|\/\?|help)$/i.test(arg));
+    const ddOutput = args.find((arg) => /^of=/i.test(arg));
+    const ddTarget = ddOutput ? ddOutput.slice(ddOutput.indexOf("=") + 1) : undefined;
+    const destructiveDisk =
+        /\bof=\/dev\/(?:sd|nvme|disk|mapper|md)/i.test(joined) ||
+        (name === "dd" &&
+            ddTarget &&
+            (classifyPath(ddTarget, options).device || /^(?:\\\\[.?]\\|\\\\device\\)/i.test(ddTarget))) ||
+        (/^mkfs(?:\.|$)/i.test(name) && targets().targets.length > 0) ||
+        (name === "wipefs" && /(?:^|\s)(?:-a|--all|-o|--offset)(?:\s|$)/i.test(joined)) ||
+        (name === "fdisk" && !/(?:^|\s)(?:-l|--list)(?:\s|$)/i.test(joined) && targets().targets.length > 0) ||
+        (name === "parted" && /\b(?:mklabel|mkpart|rm|resizepart|set)\b/i.test(joined)) ||
+        (["diskpart", "format", "clear-disk", "initialize-disk", "format-volume", "remove-partition"].includes(name) &&
+            !helpOnly) ||
+        (name === "cipher" && /(?:^|\s)\/w(?::|\s|$)/i.test(` ${joined}`));
+    if (destructiveDisk) {
+        return match(
+            "disk.destructive",
+            "critical",
+            "disk",
+            "Raw disk, data-wipe, formatting, or partition operations are permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        (["shutdown", "reboot", "halt", "poweroff", "stop-computer", "restart-computer"].includes(name) && !helpOnly) ||
+        (name === "bcdedit" && !/^\s*\/enum\b/i.test(joined) && !helpOnly) ||
+        (name === "vssadmin" && /\b(?:delete|resize)\b/i.test(joined))
+    ) {
+        return match(
+            "system.critical",
+            "critical",
+            "system",
+            "This shutdown, boot, or recovery-state operation is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (name === "systemctl" && /\b(?:poweroff|reboot|halt|kexec|emergency|rescue)\b/i.test(joined)) {
+        return match(
+            "system.critical",
+            "critical",
+            "system",
+            "This system-manager operation can stop or destabilize the host.",
+            leaf,
+        );
+    }
+
+    if (
+        ["mdadm", "pvremove", "vgremove", "lvremove", "lvconvert", "zpool", "cryptsetup"].includes(name) &&
+        /\b(?:--zero-superblock|--create|remove|destroy|labelclear|luksformat|erase|reencrypt)\b/i.test(joined)
+    ) {
+        return match(
+            "disk.destructive",
+            "critical",
+            "disk",
+            "Destructive RAID, volume-manager, pool, or encrypted-volume operations are permanently denied.",
+            leaf,
+        );
+    }
+
+    if (["grub-install", "grub-mkconfig", "efibootmgr", "bootcfg"].includes(name) && !helpOnly) {
+        return match(
+            "boot.destructive",
+            "critical",
+            "system",
+            "Boot-loader configuration mutation is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        (name === "auditctl" && /(?:^|\s)-e\s*0(?:\s|$)/i.test(` ${joined}`)) ||
+        (name === "systemctl" && /\b(?:stop|disable|mask)\b/i.test(joined) && SECURITY_SERVICE_TOKEN.test(joined))
+    ) {
+        return match(
+            "security.disable",
+            "critical",
+            "security",
+            "Disabling audit, firewall, or security services is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        ["set-mppreference", "add-mppreference"].includes(name) &&
+        /(?:disable|exclusion|realtime|monitoring|mapsreporting|sampleconsent)/i.test(joined)
+    ) {
+        return match(
+            "security.disable",
+            "critical",
+            "security",
+            "Disabling or weakening host security controls is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        ["disable-netfirewallrule", "set-netfirewallprofile", "netsh", "ufw", "iptables", "nft"].includes(name) &&
+        /(?:disable|enabled\s+false|state\s+off|firewall.*off|\s-f\b|flush)/i.test(` ${joined}`)
+    ) {
+        return match(
+            "security.disable",
+            "critical",
+            "security",
+            "Disabling or flushing host firewall controls is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        ["setenforce", "csrutil", "spctl"].includes(name) &&
+        /(?:^|\s)(?:0|disable|--master-disable)(?:\s|$)/i.test(` ${joined}`)
+    ) {
+        return match(
+            "security.disable",
+            "critical",
+            "security",
+            "Disabling mandatory host security policy is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        [...SERVICE_NAMES, "net"].includes(name) &&
+        /\b(?:stop|disable|delete|remove|unload)\b/i.test(joined) &&
+        SECURITY_SERVICE_TOKEN.test(joined)
+    ) {
+        return match(
+            "security.disable",
+            "critical",
+            "security",
+            "Stopping or removing endpoint, audit, or firewall services is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        (name === "reg" || REGISTRY_PROPERTY_NAMES.has(name)) &&
+        /(?:defender|windows defender|securityhealth)/i.test(joined) &&
+        /(?:disable|exclusion|tamper|realtime)/i.test(joined)
+    ) {
+        return match(
+            "security.disable",
+            "critical",
+            "security",
+            "Weakening endpoint security through registry or policy state is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (name === "set-executionpolicy" && /(?:bypass|unrestricted)/i.test(joined)) {
+        return match(
+            "security.disable",
+            "critical",
+            "security",
+            "Weakening script execution policy is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (
+        ENVIRONMENT_DUMP_NAMES.has(name) &&
+        name !== "env" &&
+        (dumpsEnvironment(name, args, helpOnly) || args.some((arg) => SECRET_VARIABLE.test(String(arg))))
+    ) {
+        return match(
+            "credential.environment-read",
+            "high",
+            "security",
+            "Reading secret-bearing or complete environment state needs approval in Strict mode.",
+            leaf,
+        );
+    }
+
+    if (name === "env" && !leaf.nested && !helpOnly) {
+        return match(
+            "credential.environment-read",
+            "high",
+            "security",
+            "Dumping the complete process environment needs approval in Strict mode.",
+            leaf,
+        );
+    }
+
+    if (["get-childitem", "gci", "dir", "get-item", "gi"].includes(name) && args.some((arg) => /^env:/i.test(arg))) {
+        return match(
+            "credential.environment-read",
+            "high",
+            "security",
+            "Reading the PowerShell environment provider needs approval in Strict mode.",
+            leaf,
+        );
+    }
+
+    if (
+        (name === "security" && /\b(?:find-(?:generic|internet)-password.*\s-w\b|export)\b/i.test(joined)) ||
+        (name === "secret-tool" && /\b(?:lookup|get|show)\b/i.test(joined)) ||
+        name === "get-storedcredential" ||
+        (name === "vaultcmd" && /\/listcreds/i.test(joined))
+    ) {
+        return match(
+            "credential.store-read",
+            "high",
+            "security",
+            "Reading operating-system credential stores needs approval in Strict mode.",
+            leaf,
+        );
+    }
+
+    if (
+        (name === "git" && /^credential\s+(?:fill|get)\b/i.test(joined)) ||
+        (name === "gh" && /^auth\s+token\b/i.test(joined)) ||
+        (name === "aws" && /^configure\s+export-credentials\b/i.test(joined)) ||
+        (name === "az" && /^account\s+get-access-token\b/i.test(joined)) ||
+        (name === "gcloud" &&
+            /^auth\s+(?:print-access-token|application-default\s+print-access-token)\b/i.test(joined)) ||
+        (name === "kubectl" && /^config\s+view\b.*\s--raw\b/i.test(joined))
+    ) {
+        return match(
+            "credential.store-read",
+            "high",
+            "security",
+            "Printing stored access credentials needs approval in Strict mode.",
+            leaf,
+        );
+    }
+
+    if (name === "reg" && /^delete\b/i.test(joined) && /(?:hklm|security|sam|system|bcd|defender)/i.test(joined)) {
+        return match(
+            "registry.system-delete",
+            "critical",
+            "security",
+            "Deleting system or security registry state is permanently denied.",
+            leaf,
+        );
+    }
+
+    const criticalProcess =
+        args.some((arg) => ["0", "1", "*"].includes(String(arg))) ||
+        String(args.at(-1)) === "-1" ||
+        // Killing any of these takes the host down as surely as killing init does.
+        /\b(?:system|systemd|init|wininit|csrss|lsass|svchost|services|smss|winlogon|lsm|launchd|kernel_task)(?:\.exe)?\b/i.test(
+            joined,
+        ) ||
+        /(?:^|\s)-(?:u|U|G|P)\s+(?:root|0|1)(?:\s|$)|(?:^|\s)-f\s+[.*+](?:\s|$)/i.test(` ${joined}`) ||
+        (args.includes("--") && args.slice(args.indexOf("--") + 1).includes("-1"));
+    if (["kill", "killall", "pkill", "taskkill", "stop-process"].includes(name) && criticalProcess) {
+        return match(
+            "process.broad-kill",
+            "critical",
+            "process",
+            "Broad or critical host process termination is permanently denied.",
+            leaf,
+        );
+    }
+
+    if (PERMISSION_NAMES.has(name) && targets().protectedTarget && hasRecursiveFlag(args)) {
+        return match(
+            "security.protected-permissions",
+            "critical",
+            "security",
+            "Recursive permission or ownership changes to protected paths are permanently denied.",
+            leaf,
+        );
+    }
+
+    const mutationIntent =
+        deletesFiles(name, args) ||
+        PERMISSION_NAMES.has(name) ||
+        POWERSHELL_WRITE_NAMES.has(name) ||
+        [
+            "<redirect>",
+            "cp",
+            "copy",
+            "copy-item",
+            "mv",
+            "move",
+            "move-item",
+            "rename-item",
+            "set-item",
+            "set-content",
+            "add-content",
+            "out-file",
+            "tee",
+            "touch",
+            "mkdir",
+            "new-item",
+            "sed",
+            "dd",
+            "install",
+            "ln",
+            "rsync",
+            "scp",
+            "tar",
+            "unzip",
+            "7z",
+            "7za",
+            "expand-archive",
+            ...DOWNLOAD_NAMES,
+        ].includes(name) ||
+        (["npm", "pnpm", "yarn"].includes(name) && /\b(?:remove|uninstall|unlink)\b/i.test(joined));
+    const destinationOptions = ["cp", "install", "ln"].includes(name)
+        ? ["-t", "--target-directory"]
+        : name === "copy-item" || name === "move-item"
+          ? ["-destination"]
+          : ["compress-archive", "expand-archive"].includes(name)
+            ? ["-destinationpath"]
+            : name === "tee-object" || name === "out-file"
+              ? ["-filepath"]
+              : name === "export-pssession"
+                ? ["-outputmodule"]
+                : name === "add-type"
+                  ? ["-outputassembly"]
+                  : DOWNLOAD_NAMES.has(name)
+                    ? ["-o", "--output", "--output-document", "-outfile", "--outfile", "-destination"]
+                    : POWERSHELL_WRITE_NAMES.has(name)
+                      ? ["-path", "-literalpath"]
+                      : [];
+    const explicitDestination = optionTargets(args, destinationOptions);
+    const protectedMutationTargets = ["cp", "copy", "copy-item", "install", "ln"].includes(name)
+        ? explicitDestination.length
+            ? explicitDestination
+            : targets().targets.slice(-1)
+        : ["rsync", "scp"].includes(name)
+          ? targets().targets.slice(-1)
+          : ["mv", "move", "move-item", "rename-item"].includes(name)
+            ? [...targets().targets, ...explicitDestination]
+            : POWERSHELL_WRITE_NAMES.has(name)
+              ? explicitDestination.length
+                  ? explicitDestination
+                  : targets().targets
+              : ["set-content", "add-content", "out-file", "tee", "touch", "mkdir", "new-item"].includes(name)
+                ? targets().targets
+                : name === "expand-archive"
+                  ? optionTargets(args, ["-destinationpath", "-destination"])
+                  : DOWNLOAD_NAMES.has(name)
+                    ? explicitDestination.length
+                        ? explicitDestination
+                        : ["start-bitstransfer", "bitsadmin", "certutil"].includes(name)
+                          ? targets().targets.slice(-1)
+                          : []
+                    : name === "tar"
+                      ? optionTargets(args, ["-c", "--directory"])
+                      : name === "unzip"
+                        ? optionTargets(args, ["-d"])
+                        : name === "7z" || name === "7za"
+                          ? optionTargets(args, ["-o"])
+                          : name === "sed" && args.some((arg) => /^-[a-z]*i/i.test(arg))
+                            ? targets().targets
+                            : name === "dd" && ddTarget
+                              ? [ddTarget]
+                              : [];
+    if (mutationIntent && protectedMutationTargets.some((target) => classifyPath(target, options).protected)) {
+        return match(
+            "path.protected-mutation",
+            "critical",
+            "protected-path",
+            "The command writes, moves, or mutates a protected path.",
+            leaf,
+        );
+    }
+
+    // A destructive Git operation rewrites or discards whatever tree it runs in, so when that tree IS protected
+    // host or enforcement state it is the same tampering as deleting the files directly. `git -C <agent-dir>
+    // checkout -- extensions/command-guard/rules.mjs` silently reverted the guard's own sources.
+    const gitDestructive =
+        name === "git" &&
+        /(?:^|\s)(?:reset\s+--hard|clean\s+-[a-z]*f|checkout\s+--|restore\b|stash\s+(?:drop|clear)|filter-(?:branch|repo))/i.test(
+            joined,
+        );
+    if (
+        gitDestructive &&
+        (classifyPath(options.cwd || ".", options).protected ||
+            isAgentPath(options.cwd || ".", options) ||
+            targets().targets.some((target) => isAgentPath(target, options) || classifyPath(target, options).protected))
+    ) {
+        return match(
+            "guard.self-tamper",
+            "critical",
+            "protected-path",
+            "A destructive Git operation targets protected host or SpecPi enforcement state.",
+            leaf,
+        );
+    }
+
+    // Keyed on where the target resolves, not on "specpi" or "command-guard" appearing anywhere in the arguments:
+    // that substring test made `mkdir specpi-experiment` a critical, session-locking denial in any checkout.
+    if (
+        mutationIntent &&
+        [...targets().targets, ...protectedMutationTargets].some((target) => isAgentPath(target, options))
+    ) {
+        return match(
+            "guard.self-tamper",
+            "critical",
+            "protected-path",
+            "The command targets SpecPi guard, configuration, or private state.",
+            leaf,
+        );
+    }
+
+    return undefined;
+}
+
+function ordinaryLeaf(leaf, options) {
+    const name = normalized(leaf.executable);
+    const args = leaf.args || [];
+    const joined = args.join(" ").toLowerCase();
+    // These ordinary findings feed Strict's broader approval layer. Core filters determinate noncritical
+    // findings in Guard after all critical and indeterminate results have been aggregated, except the work-
+    // destroying rules in GUARD_APPROVAL_RULES, which Guard still surfaces.
+    const guard = options.mode === "guard";
+    const classifiedTargets = pathArguments(args, options).map((target) => classifyPath(target, options));
+    const escapesWorkspace = classifiedTargets.some((result) => result.protected || !result.withinWorkspace);
+    const workspaceFileOperation = guard && classifiedTargets.length > 0 && !escapesWorkspace;
+    const workspaceExecution = guard && !escapesWorkspace;
+
+    // Force pushes and the destructive Git family below are the determinate, noncritical operations Guard
+    // still surfaces: they discard or rewrite work no undo can restore. A force push gets its own rule id
+    // because it rewrites remote history collaborators may already hold; --force-with-lease narrows the race
+    // but still overwrites the remote ref, so it asks as well. Ordered ahead of the general git.destructive
+    // rule so a force push reports its own id.
+    if (name === "git" && /(?:^|\s)push(?:\s|$)/i.test(joined) && /(?:^|\s)(?:--force|-f)\b/i.test(joined)) {
+        return match(
+            "git.force-push",
+            "high",
+            "git",
+            "A force push rewrites remote history and needs approval.",
+            leaf,
+            "Push without force, or confirm the remote ref and use --force-with-lease.",
+        );
+    }
+
+    if (
+        name === "git" &&
+        /(?:reset\s+--hard|clean\s+-[a-z]*f|push\s+.*(?:--force|-f\b|--delete)|branch\s+-[dD]|tag\s+-d|rebase\b|filter-(?:branch|repo)|checkout\s+--\s|restore\s+.*(?:--worktree|--staged|--source)|stash\s+(?:drop|clear)|reflog\s+expire|gc\s+.*--prune)/i.test(
+            joined,
+        )
+    ) {
+        return match(
+            "git.destructive",
+            "high",
+            "git",
+            "This Git operation discards or rewrites working-tree or remote history.",
+            leaf,
+            "Inspect with git status and git diff first.",
+        );
+    }
+
+    if (
+        ["docker", "podman"].includes(name) &&
+        /(?:system\s+prune|(?:rm|rmi|volume\s+rm|network\s+rm)|--volumes|compose\s+down.*(?:-v\b|--volumes))/i.test(
+            joined,
+        )
+    ) {
+        return match(
+            "container.destructive",
+            "high",
+            "container",
+            "This container operation removes images, volumes, networks, or resources.",
+            leaf,
+        );
+    }
+
+    if (name === "kubectl" && /\b(?:delete|drain|cordon|replace|apply|patch|scale)\b/i.test(joined)) {
+        return match(
+            "container.cluster-mutation",
+            "high",
+            "container",
+            "This cluster operation mutates or removes resources.",
+            leaf,
+        );
+    }
+
+    if (["terraform", "tofu", "pulumi"].includes(name) && /\b(?:destroy|apply|state\s+rm|down)\b/i.test(joined)) {
+        return match(
+            "cloud.infrastructure-mutation",
+            "high",
+            "cloud",
+            "This infrastructure operation can replace or destroy remote resources.",
+            leaf,
+        );
+    }
+
+    if (
+        ["aws", "az", "gcloud", "doctl", "heroku", "flyctl"].includes(name) &&
+        /\b(?:delete|destroy|terminate|remove|purge|deprovision)\b/i.test(joined)
+    ) {
+        return match(
+            "cloud.resource-delete",
+            "high",
+            "cloud",
+            "This cloud command deletes or deprovisions remote resources.",
+            leaf,
+        );
+    }
+
+    if (
+        ["npm", "pnpm", "yarn", "twine", "cargo", "dotnet", "gem"].includes(name) &&
+        /\b(?:publish|unpublish|deprecate|upload|nuget\s+push|yank)\b/i.test(joined)
+    ) {
+        return match(
+            "package.registry-mutation",
+            "high",
+            "package",
+            "Package publication or registry mutation needs approval.",
+            leaf,
+        );
+    }
+
+    if (
+        ["npm", "pnpm", "yarn", "pip", "pip3", "apt", "apt-get", "dnf", "yum", "brew", "winget", "choco"].includes(
+            name,
+        ) &&
+        /\b(?:remove|uninstall|update|upgrade|install|add)\b/i.test(joined)
+    ) {
+        return match(
+            "package.mutation",
+            "medium",
+            "package",
+            "Package installation, update, or removal needs approval.",
+            leaf,
+        );
+    }
+
+    const pluginExecution =
+        ["npx", "pre-commit"].includes(name) ||
+        (["npm", "pnpm"].includes(name) && /^(?:run|test|exec|x)\b/i.test(joined.trim())) ||
+        (name === "yarn" && joined.trim().length > 0) ||
+        (["bun", "deno"].includes(name) && /^(?:run|test|task)\b/i.test(joined.trim())) ||
+        (name === "cargo" && /^(?:build|check|test|run)\b/i.test(joined.trim()));
+    if (pluginExecution) {
+        return workspaceExecution
+            ? undefined
+            : match(
+                  "execution.plugins-or-hooks",
+                  "medium",
+                  "dynamic",
+                  "This tool can execute project plugins, hooks, scripts, or configuration and needs approval.",
+                  leaf,
+              );
+    }
+
+    if (["export", "set", "setx"].includes(name) && /(?:^|\s)(?:path|[A-Za-z_][A-Za-z0-9_]*)=/i.test(joined)) {
+        return match("environment.mutation", "medium", "system", "Environment or PATH mutation needs approval.", leaf);
+    }
+
+    if (["set-alias", "new-alias", "import-alias"].includes(name)) {
+        return match(
+            "dynamic.generated-code",
+            "high",
+            "dynamic",
+            "Alias definitions can redirect later command execution and need approval.",
+            leaf,
+        );
+    }
+
+    if (["source", "."].includes(name)) {
+        return match(
+            "dynamic.local-script",
+            "high",
+            "dynamic",
+            "Sourcing an uninspected local script needs approval.",
+            leaf,
+        );
+    }
+
+    if (NETWORK_NAMES.has(name)) {
+        return match(
+            "network.or.remote",
+            "high",
+            "network",
+            "Network transfer, download, upload, or remote execution needs approval.",
+            leaf,
+        );
+    }
+
+    if (["kill", "killall", "pkill", "taskkill", "stop-process"].includes(name)) {
+        return match("process.termination", "medium", "process", "Process termination needs approval.", leaf);
+    }
+
+    // Ordered ahead of the delete family so find keeps its own rule instead of being labelled a recursive delete.
+    if (name === "find" && findMutates(args)) {
+        return match(
+            "filesystem.find-mutation",
+            "high",
+            "filesystem",
+            "Find execution or deletion needs approval.",
+            leaf,
+        );
+    }
+
+    if (deletesFiles(name, args)) {
+        return !hasRecursiveFlag(args) && workspaceFileOperation
+            ? undefined
+            : match(
+                  hasRecursiveFlag(args) ? "filesystem.recursive-delete" : "filesystem.mutation",
+                  "high",
+                  "filesystem",
+                  hasRecursiveFlag(args)
+                      ? "Recursive deletion needs approval."
+                      : "File deletion or truncation needs approval.",
+                  leaf,
+                  "Use a bounded, explicitly reviewed workspace target.",
+              );
+    }
+
+    if (
+        POWERSHELL_WRITE_NAMES.has(name) ||
+        [
+            "cp",
+            "copy",
+            "mv",
+            "move",
+            "tee",
+            "touch",
+            "mkdir",
+            "install",
+            "ln",
+            "rsync",
+            "scp",
+            "tar",
+            "unzip",
+            "7z",
+            "7za",
+        ].includes(name) ||
+        (name === "dd" && !args.every((arg) => /^(?:--?h(?:elp)?|--version|-v)$/i.test(arg))) ||
+        (name === "sed" && args.some((arg) => /^-[a-z]*i/i.test(arg)))
+    ) {
+        return workspaceFileOperation
+            ? undefined
+            : match(
+                  "filesystem.write",
+                  "high",
+                  "filesystem",
+                  "Filesystem creation, overwrite, or movement needs approval.",
+                  leaf,
+              );
+    }
+
+    if (
+        AWK_NAMES.has(name) &&
+        args.some((arg) => AWK_ESCAPE.test(String(arg)) || AWK_PROGRAM_SOURCE.test(String(arg)))
+    ) {
+        return {
+            ...match(
+                "dynamic.inline-code",
+                "high",
+                "dynamic",
+                "An awk program that can spawn shells, read the environment, load modules, or write files needs approval.",
+                leaf,
+            ),
+            indeterminate: true,
+        };
+    }
+
+    if (["xargs", "eval", "invoke-expression", "iex"].includes(name)) {
+        return match(
+            "dynamic.generated-code",
+            "high",
+            "dynamic",
+            "Generated or indirectly invoked code needs approval.",
+            leaf,
+        );
+    }
+
+    if (SERVICE_NAMES.has(name) && /\b(?:stop|restart|disable|delete|remove|create|start)\b/i.test(joined)) {
+        return match("service.mutation", "high", "system", "Service mutation needs approval.", leaf);
+    }
+
+    if (PERMISSION_NAMES.has(name) || ACCOUNT_NAMES.has(name)) {
+        return match(
+            "security.identity-or-permission",
+            "high",
+            "security",
+            "Account, group, ACL, permission, or ownership mutation needs approval.",
+            leaf,
+        );
+    }
+
+    if (name === "reg" && /^delete\b/i.test(joined)) {
+        return match("registry.delete", "high", "security", "Registry deletion needs approval.", leaf);
+    }
+
+    if (name === "reg" && /^(?:add|copy|import|load|unload|restore)\b/i.test(joined)) {
+        return match("registry.mutation", "high", "security", "Registry mutation needs approval.", leaf);
+    }
+
+    if (REGISTRY_PROPERTY_NAMES.has(name)) {
+        return match(
+            "registry.mutation",
+            "high",
+            "security",
+            "Registry property mutation needs approval regardless of provider-drive spelling.",
+            leaf,
+        );
+    }
+
+    if (
+        ["new-psdrive", "remove-psdrive"].includes(name) &&
+        /(?:^|\s)(?:registry|-psprovider\s+registry)\b/i.test(joined)
+    ) {
+        return match("registry.mutation", "high", "security", "Registry provider-drive mutation needs approval.", leaf);
+    }
+
+    if (
+        (name === "schtasks" && /\/delete/i.test(joined)) ||
+        name === "unregister-scheduledtask" ||
+        (name === "crontab" && /(?:^|\s)-r(?:\s|$)/i.test(` ${joined}`)) ||
+        (name === "wsl" && /--unregister/i.test(joined))
+    ) {
+        return match(
+            "system.registration-delete",
+            "high",
+            "system",
+            "Scheduled-task or subsystem deletion needs approval.",
+            leaf,
+        );
+    }
+
+    if (
+        (name === "robocopy" && /\/mir\b/i.test(joined)) ||
+        name === "clear-winevent" ||
+        (name === "wevtutil" && /^cl\b/i.test(joined))
+    ) {
+        return match(
+            "filesystem.broad-mutation",
+            "high",
+            "filesystem",
+            "Mirroring or clearing host data needs approval.",
+            leaf,
+        );
+    }
+
+    if (
+        ["psql", "mysql", "sqlcmd", "sqlite3", "mongosh", "mongo", "redis-cli"].includes(name) &&
+        /\b(?:drop|truncate|delete\s+from|flushall|flushdb)\b/i.test(joined)
+    ) {
+        return match(
+            "database.destructive",
+            "high",
+            "database",
+            "Destructive database statements need approval.",
+            leaf,
+        );
+    }
+
+    if (
+        ["prisma", "knex", "sequelize", "alembic", "rails", "rake", "dotnet"].includes(name) &&
+        /\b(?:migrate\s+reset|migrate:rollback|migrate:undo|downgrade|db:rollback|database\s+drop)\b/i.test(joined)
+    ) {
+        return match(
+            "database.migration-rollback",
+            "high",
+            "database",
+            "Database reset, drop, or migration rollback needs approval.",
+            leaf,
+        );
+    }
+
+    if (SHELL_NAMES.has(name) && args.some((arg) => inlineCodeFlag(name, arg))) {
+        return {
+            ...match(
+                "dynamic.inline-code",
+                "high",
+                "dynamic",
+                "Inline interpreter code that could not be recursively analyzed needs approval.",
+                leaf,
+            ),
+            indeterminate: !leaf.nested,
+        };
+    }
+
+    if (
+        (SHELL_NAMES.has(name) &&
+            args.some((arg) =>
+                /\.(?:sh|bash|zsh|fish|ps1|bat|cmd|js|mjs|cjs|ts|py|rb|pl|php|lua|r|awk|tcl|scpt|applescript)(?:$|[?#])/i.test(
+                    arg,
+                ),
+            )) ||
+        /\.(?:sh|bash|zsh|fish|ps1|bat|cmd|js|mjs|cjs|ts|py|rb|pl|php|lua|r|awk|tcl|scpt|applescript)$/i.test(
+            String(leaf.executable || ""),
+        )
+    ) {
+        return workspaceExecution
+            ? undefined
+            : match(
+                  "dynamic.local-script",
+                  "high",
+                  "dynamic",
+                  "Executing a local script that was not statically inspected needs approval.",
+                  leaf,
+              );
+    }
+
+    return undefined;
+}
+
+function flatten(analysis) {
+    return [
+        ...(analysis.leaves || []),
+        ...(analysis.leaves || []).flatMap((leaf) => (leaf.nested ? flatten(leaf.nested) : [])),
+    ];
+}
+
+function redirectsWithShell(analysis) {
+    return [
+        ...(analysis.redirects || []).map((redirect) => ({ redirect, shell: analysis.shell })),
+        ...(analysis.leaves || []).flatMap((leaf) => (leaf.nested ? redirectsWithShell(leaf.nested) : [])),
+    ];
+}
+
+function leafOptions(leaf, options) {
+    return {
+        ...options,
+        shell: leaf.shell || options.shell,
+        cwd: typeof leaf.cwd === "string" && leaf.cwd ? leaf.cwd : options.cwd,
+    };
+}
+
+const CHDIR_NAMES = new Set(["cd", "chdir", "pushd", "popd", "set-location", "sl", "push-location", "pop-location"]);
+// Wrappers that run their payload from a different directory. `-C` is matched case-sensitively because
+// `git -c key=value` is configuration, not a directory change.
+function runnerWorkingDirectory(name, args) {
+    const flags = ["git", "tar", "make", "gmake"].includes(name)
+        ? ["-C", "--directory"]
+        : name === "env"
+          ? ["--chdir"]
+          : [];
+    if (!flags.length) {
+        return undefined;
+    }
+
+    const list = (args || []).map((arg) => String(arg));
+    for (let index = 0; index < list.length; index += 1) {
+        const arg = list[index];
+        for (const flag of flags) {
+            if (arg === flag) {
+                return list[index + 1];
+            }
+
+            if (arg.startsWith(`${flag}=`)) {
+                return arg.slice(flag.length + 1);
+            }
+
+            if (/^-[A-Za-z]$/.test(flag) && arg.startsWith(flag) && arg.length > flag.length) {
+                return arg.slice(flag.length);
+            }
+        }
+    }
+
+    return undefined;
+}
+
+// Threads the working directory through a command sequence. Every relative target used to resolve against the
+// SESSION cwd no matter what ran before it, so `cd / && rm -rf usr` was reported as a determinate, clean delete
+// of <session>/usr while it actually removed /usr — and the same held for `Set-Location C:\` and `cd /d C:\`.
+// A directory change the analyzer cannot resolve poisons every later leaf rather than being ignored.
+function applyWorkingDirectories(analysis, options) {
+    let anyUnresolved = false;
+    const resolve = (target, base) => {
+        if (base === undefined) {
+            return undefined;
+        }
+
+        const result = classifyPath(target, { ...options, cwd: base });
+
+        return typeof result.lexical === "string" && result.lexical ? result.lexical : undefined;
+    };
+
+    // Each nested block keeps its own directory state: a `cd` inside `bash -c '…'` or behind an argv-prefix
+    // runner must not leak back out into the enclosing sequence.
+    const walk = (node, inherited, inheritedUnresolved) => {
+        let current = inherited,
+            unresolved = inheritedUnresolved;
+        for (const leaf of node.leaves || []) {
+            const name = normalized(leaf.executable);
+            const runner = runnerWorkingDirectory(name, leaf.args);
+            let leafCwd = unresolved ? undefined : current;
+            let leafUnresolved = unresolved;
+            if (runner !== undefined) {
+                leafCwd = runner === "[dynamic]" ? undefined : resolve(runner, current);
+                leafUnresolved = unresolved || leafCwd === undefined;
+            }
+
+            leaf.cwd = leafCwd;
+            leaf.unresolvedCwd = leafUnresolved;
+            anyUnresolved = anyUnresolved || leafUnresolved;
+            if (leaf.nested) {
+                walk(leaf.nested, leafCwd, leafUnresolved);
+            }
+
+            if (!CHDIR_NAMES.has(name)) {
+                continue;
+            }
+
+            const targets = pathArguments(leaf.args || [], { ...options, shell: leaf.shell || options.shell });
+            if (name === "popd" || targets.length > 1 || (!targets.length && (leaf.args || []).length)) {
+                unresolved = true;
+            } else if (!targets.length) {
+                // A bare `cd` returns to the home directory in every shell that treats it as a directory change.
+                current = /^(?:cmd|cmd\.exe)$/i.test(String(leaf.shell || options.shell || ""))
+                    ? current
+                    : resolve("~", current);
+                unresolved = unresolved || current === undefined;
+            } else {
+                current = resolve(targets[0], current);
+                unresolved = unresolved || current === undefined;
+            }
+
+            anyUnresolved = anyUnresolved || unresolved;
+        }
+    };
+
+    walk(analysis, typeof options.cwd === "string" ? options.cwd : undefined, false);
+
+    return anyUnresolved;
+}
+
+function nestedNames(leaf) {
+    return [
+        normalized(leaf.executable),
+        ...(leaf.nested ? flatten(leaf.nested).map((entry) => normalized(entry.executable)) : []),
+    ];
+}
+
+function pipelineGroups(analysis) {
+    const groups = [],
+        leaves = analysis.leaves || [];
+    const explicit = new Map();
+    for (const leaf of leaves) {
+        if (Number.isInteger(leaf.pipelineGroup)) {
+            explicit.set(leaf.pipelineGroup, [...(explicit.get(leaf.pipelineGroup) || []), leaf]);
+        }
+    }
+
+    for (const group of explicit.values()) {
+        if (group.length > 1) {
+            groups.push(group);
+        }
+    }
+
+    let current = [];
+    for (const leaf of leaves) {
+        if (leaf.executable === "<redirect>") {
+            continue;
+        }
+
+        if (leaf.separatorBefore !== "|" && current.length) {
+            if (current.length > 1) {
+                groups.push(current);
+            }
+
+            current = [];
+        }
+
+        current.push(leaf);
+        if (leaf.nested) {
+            groups.push(...pipelineGroups(leaf.nested));
+        }
+    }
+
+    if (current.length > 1) {
+        groups.push(current);
+    }
+
+    return groups;
+}
+
+// Verbs in COMMAND POSITION — the start of the text or just past a command separator. Accepting them after any
+// whitespace made `echo rd /s /q C:\Windows` a match, and the scan runs on text nobody could parse, so a false
+// critical here is an immutable denial over a command that only printed a string.
+const TEXT_DESTRUCTIVE_VERB =
+    /(?:^|[;&|({\n\r]|&&|\|\|)\s*(?:rm|rmdir|shred|srm|del|erase|rd|remove-item|ri|clear-item|mkfs(?:\.[a-z0-9]+)?|dd|wipefs|diskpart|format|takeown|move-item)(?:[\s;&|)}]|$)/i;
+const TEXT_DIRECTORY_VERB =
+    /(?:^|[;&|({\n\r]|&&|\|\|)\s*(?:cd|chdir|set-location|sl|pushd|push-location)(?:[\s;&|)}]|$)/i;
+const TEXT_STANDALONE_CATASTROPHE =
+    /(?:^|[;&|({\n\r]|&&|\|\|)\s*(?:shutdown|reboot|halt|poweroff|stop-computer|restart-computer)(?:[\s;&|)}]|$)|:\s*\(\s*\)\s*\{[^}]*\|[^}]*&[^}]*\}\s*;\s*:/i;
+const ESCAPED_WHITESPACE = "\u0000";
+
+function substitutionEnd(text, start, shell, delimiter) {
+    const powershell = /^(?:powershell|pwsh)$/.test(shell);
+    const bash = /^(?:bash|sh|zsh|dash|ksh|fish)$/.test(shell);
+    let depth = delimiter === ")" ? 1 : 0;
+    let quote = "";
+    for (let index = start; index < text.length; index += 1) {
+        const character = text[index];
+        const next = text[index + 1];
+        if (quote) {
+            if (powershell && quote === "'" && character === "'" && next === "'") {
+                index += 1;
+                continue;
+            }
+
+            if (powershell && quote === '"' && character === "`" && next !== undefined) {
+                index += 1;
+                continue;
+            }
+
+            if (bash && quote === '"' && character === "\\" && /[$`"\\\n]/.test(next || "")) {
+                index += 1;
+                continue;
+            }
+
+            if (character === quote) {
+                quote = "";
+            }
+
+            continue;
+        }
+
+        if ((powershell && character === "`") || (bash && character === "\\")) {
+            if (next !== undefined) {
+                index += 1;
+            }
+
+            continue;
+        }
+
+        if (character === "'" || character === '"') {
+            quote = character;
+            continue;
+        }
+
+        if (delimiter === "`" && character === "`") {
+            return index;
+        }
+
+        if (delimiter === ")") {
+            if (character === "(") {
+                depth += 1;
+            } else if (character === ")") {
+                depth -= 1;
+                if (depth === 0) {
+                    return index;
+                }
+            }
+        }
+    }
+
+    return text.length - 1;
+}
+
+function executableSubstitutions(text, shell) {
+    const powershell = /^(?:powershell|pwsh)$/.test(shell);
+    const bash = /^(?:bash|sh|zsh|dash|ksh|fish)$/.test(shell);
+    const found = [];
+    let quote = "";
+    for (let index = 0; index < text.length; index += 1) {
+        const character = text[index];
+        const next = text[index + 1];
+        if (quote === "'") {
+            if (powershell && character === "'" && next === "'") {
+                index += 1;
+            } else if (character === "'") {
+                quote = "";
+            }
+
+            continue;
+        }
+
+        if (!quote && powershell && character === "<" && next === "#") {
+            const end = text.indexOf("#>", index + 2);
+            index = end < 0 ? text.length : end + 1;
+            continue;
+        }
+
+        const lineComment =
+            !quote && character === "#" && (powershell || (bash && (index === 0 || /[\s;&|()]/.test(text[index - 1]))));
+        if (lineComment) {
+            const end = text.indexOf("\n", index + 1);
+            index = end < 0 ? text.length : end;
+            continue;
+        }
+
+        if (powershell && character === "`" && next !== undefined) {
+            index += 1;
+            continue;
+        }
+
+        if (bash && character === "\\" && next !== undefined && quote !== "'") {
+            index += 1;
+            continue;
+        }
+
+        if (character === "'") {
+            quote = "'";
+            continue;
+        }
+
+        if (character === '"') {
+            quote = quote === '"' ? "" : '"';
+            continue;
+        }
+
+        if ((powershell || bash) && character === "$" && next === "(") {
+            const end = substitutionEnd(text, index + 2, shell, ")");
+            found.push({ start: index, end, payload: text.slice(index + 2, end) });
+            index = end;
+            continue;
+        }
+
+        if (bash && character === "`") {
+            const end = substitutionEnd(text, index + 1, shell, "`");
+            found.push({ start: index, end, payload: text.slice(index + 1, end) });
+            index = end;
+        }
+    }
+
+    return found;
+}
+
+// Produces cooked statement views without executing or expanding input. `syntax` blanks quoted argument content
+// so inert data cannot invent command-position verbs or separators. `arguments` retains cooked quoted values so
+// a real destructive command still carries paths such as `Remove-Item "C:\Windows"` into target classification.
+function fallbackProjection(text, shell) {
+    const shellName = String(shell || "").toLowerCase();
+    const powershell = /^(?:powershell|pwsh)$/.test(shellName);
+    const bash = /^(?:bash|sh|zsh|dash|ksh|fish)$/.test(shellName);
+    const cmd = /^(?:cmd|cmd\.exe)$/.test(shellName);
+    const statements = [];
+    const substitutions = executableSubstitutions(text, shellName);
+    const substitutionAt = new Map(substitutions.map((item) => [item.start, item]));
+    let syntax = "",
+        argumentsText = "",
+        wholeSyntax = "",
+        quote = "";
+    const append = (syntaxText, argumentText = syntaxText) => {
+        syntax += syntaxText;
+        argumentsText += argumentText;
+        wholeSyntax += syntaxText;
+    };
+
+    const flush = () => {
+        if (syntax.trim() || argumentsText.trim()) {
+            statements.push({ syntax, arguments: argumentsText });
+        }
+
+        syntax = "";
+        argumentsText = "";
+    };
+
+    for (let index = 0; index < text.length; index += 1) {
+        const character = text[index];
+        const next = text[index + 1];
+        const substitution = substitutionAt.get(index);
+        if (substitution) {
+            const blanks = " ".repeat(substitution.end - substitution.start + 1);
+            append(blanks, blanks);
+            index = substitution.end;
+            continue;
+        }
+
+        if (quote) {
+            if (powershell && quote === "'" && character === "'" && next === "'") {
+                append("  ", "''");
+                index += 1;
+                continue;
+            }
+
+            if (powershell && quote === '"' && character === "`" && next !== undefined) {
+                append("  ", character + next);
+                index += 1;
+                continue;
+            }
+
+            if (bash && quote === '"' && character === "\\" && /[$`"\\\n]/.test(next || "")) {
+                append("  ", character + next);
+                index += 1;
+                continue;
+            }
+
+            if (character === quote) {
+                quote = "";
+                append(" ", character);
+            } else {
+                append(" ", character);
+            }
+
+            continue;
+        }
+
+        if (powershell && character === "`" && next !== undefined) {
+            if (next === "\n" || (next === "\r" && text[index + 2] === "\n")) {
+                index += next === "\r" ? 2 : 1;
+            } else {
+                append(
+                    /[;&|\s]/.test(next) ? " " : next,
+                    /\s/.test(next) ? ESCAPED_WHITESPACE : /[;&|]/.test(next) ? character + next : next,
+                );
+                index += 1;
+            }
+
+            continue;
+        }
+
+        if (bash && character === "\\" && next !== undefined) {
+            if (next === "\n") {
+                index += 1;
+            } else {
+                append(
+                    /[;&|\s]/.test(next) ? " " : next,
+                    /\s/.test(next) ? ESCAPED_WHITESPACE : /[;&|]/.test(next) ? character + next : next,
+                );
+                index += 1;
+            }
+
+            continue;
+        }
+
+        if (cmd && character === "^" && next !== undefined) {
+            if (next === "\n" || (next === "\r" && text[index + 2] === "\n")) {
+                index += next === "\r" ? 2 : 1;
+            } else {
+                append(/[;&|\s]/.test(next) ? " " : next, /\s/.test(next) ? ESCAPED_WHITESPACE : character + next);
+                index += 1;
+            }
+
+            continue;
+        }
+
+        if (powershell && character === "<" && next === "#") {
+            const end = text.indexOf("#>", index + 2);
+            index = end < 0 ? text.length : end + 1;
+            continue;
+        }
+
+        const lineComment =
+            character === "#" && (powershell || (bash && (index === 0 || /[\s;&|()]/.test(text[index - 1]))));
+        if (lineComment) {
+            const end = text.indexOf("\n", index + 1);
+            flush();
+            wholeSyntax += "\n";
+            index = end < 0 ? text.length : end;
+            continue;
+        }
+
+        if (character === "'" || character === '"') {
+            quote = character;
+            append(" ", character);
+            continue;
+        }
+
+        if ([";", "&", "|", "\n", "\r"].includes(character)) {
+            flush();
+            wholeSyntax += character;
+            if ((character === "&" || character === "|") && next === character) {
+                wholeSyntax += next;
+                index += 1;
+            }
+
+            continue;
+        }
+
+        append(character);
+    }
+
+    flush();
+
+    return {
+        statements,
+        wholeSyntax,
+        embeddedPayloads: substitutions.map((item) => ({ payload: item.payload, shell: shellName })),
+        shell: shellName,
+    };
+}
+
+const POWERSHELL_COMMAND_FLAGS = new Set(["-c", "-co", "-com", "-comm", "-comma", "-comman", "-command"]);
+const POWERSHELL_FILE_FLAGS = new Set(["-f", "-fi", "-fil", "-file"]);
+const POWERSHELL_ENCODED_FLAGS = new Set([
+    "-e",
+    "-en",
+    "-enc",
+    "-enco",
+    "-encod",
+    "-encode",
+    "-encoded",
+    "-encodedc",
+    "-encodedco",
+    "-encodedcom",
+    "-encodedcomm",
+    "-encodedcomma",
+    "-encodedcomman",
+    "-encodedcommand",
+]);
+const INLINE_HOST_NAMES = new Set([
+    "powershell",
+    "pwsh",
+    "cmd",
+    "bash",
+    "sh",
+    "zsh",
+    "dash",
+    "ksh",
+    "fish",
+    "node",
+    "python",
+    "python3",
+    "py",
+    "deno",
+    "bun",
+    "ruby",
+    "perl",
+    "php",
+    "lua",
+    "rscript",
+    "osascript",
+    "tclsh",
+    "expect",
+]);
+
+function fallbackWords(text, shell) {
+    const powershell = /^(?:powershell|pwsh)$/.test(shell);
+    const bash = /^(?:bash|sh|zsh|dash|ksh|fish)$/.test(shell);
+    const words = [];
+    let word = "",
+        quote = "",
+        quoted = false;
+    const flush = () => {
+        if (word || quoted) {
+            words.push({ value: word.replaceAll(ESCAPED_WHITESPACE, " "), quoted });
+            word = "";
+            quoted = false;
+        }
+    };
+
+    for (let index = 0; index < text.length; index += 1) {
+        const character = text[index];
+        const next = text[index + 1];
+        if (quote) {
+            if (powershell && quote === "'" && character === "'" && next === "'") {
+                word += "'";
+                index += 1;
+                continue;
+            }
+
+            if (powershell && quote === '"' && character === "`" && next !== undefined) {
+                if (next === "\n" || (next === "\r" && text[index + 2] === "\n")) {
+                    index += next === "\r" ? 2 : 1;
+                } else {
+                    word += next;
+                    index += 1;
+                }
+
+                continue;
+            }
+
+            if (bash && quote === '"' && character === "\\" && /[$`"\\\n]/.test(next || "")) {
+                if (next !== "\n") {
+                    word += next;
+                }
+
+                index += 1;
+                continue;
+            }
+
+            if (character === quote) {
+                quote = "";
+            } else {
+                word += character;
+            }
+
+            continue;
+        }
+
+        if (character === "'" || character === '"') {
+            quote = character;
+            quoted = true;
+            continue;
+        }
+
+        if (/\s/.test(character)) {
+            flush();
+        } else {
+            word += character;
+        }
+    }
+
+    flush();
+
+    return words;
+}
+
+function executableBase(value) {
+    return value
+        .split(/[\\/]/)
+        .pop()
+        .toLowerCase()
+        .replace(/\.exe$/i, "");
+}
+
+function inlineHost(words) {
+    let index = 0;
+    while (index < words.length) {
+        const wrapper = executableBase(words[index].value);
+        if (!["sudo", "doas", "env", "command", "exec", "nohup"].includes(wrapper)) {
+            break;
+        }
+
+        index += 1;
+        while (index < words.length) {
+            const option = words[index].value;
+            if (option === "--") {
+                index += 1;
+                break;
+            }
+
+            if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(option)) {
+                index += 1;
+                continue;
+            }
+
+            if (!option.startsWith("-")) {
+                break;
+            }
+
+            const separateValue =
+                ((wrapper === "sudo" || wrapper === "doas") &&
+                    [
+                        "-u",
+                        "--user",
+                        "-g",
+                        "--group",
+                        "-h",
+                        "--host",
+                        "-p",
+                        "--prompt",
+                        "-C",
+                        "--close-from",
+                        "-D",
+                        "--chdir",
+                        "-R",
+                        "--chroot",
+                        "-T",
+                        "--command-timeout",
+                    ].includes(option)) ||
+                (wrapper === "env" && ["-u", "--unset", "-C", "--chdir"].includes(option)) ||
+                (wrapper === "exec" && option === "-a");
+            index += separateValue ? 2 : 1;
+        }
+    }
+
+    if (index >= words.length) {
+        return undefined;
+    }
+
+    const host = executableBase(words[index].value);
+
+    return INLINE_HOST_NAMES.has(host) ? { host, index } : undefined;
+}
+
+function inlineHostShell(host) {
+    if (["powershell", "pwsh"].includes(host)) {
+        return "powershell";
+    }
+
+    if (host === "cmd") {
+        return "cmd";
+    }
+
+    if (["bash", "sh", "zsh", "dash", "ksh", "fish"].includes(host)) {
+        return "bash";
+    }
+
+    return host;
+}
+
+function decodeInlinePayload(found, encoded, shell) {
+    try {
+        const decoded = Buffer.from(encoded, "base64");
+        if (decoded.length && decoded.length <= 64 * 1024) {
+            found.push({ payload: decoded.toString("utf16le"), shell }, { payload: decoded.toString("utf8"), shell });
+        }
+    } catch {
+        /* an undecodable argument carries nothing to read */
+    }
+}
+
+// Returns only payloads selected by the invoked host's positional mode flag. This avoids treating quoted script
+// data after `powershell -File` as code and preserves the invoked shell family for recursive fallback scanning.
+function inlineCodePayloads(projection) {
+    const found = [...projection.embeddedPayloads];
+    for (const statement of projection.statements) {
+        const words = fallbackWords(statement.arguments, projection.shell);
+        const invocation = inlineHost(words);
+        if (!invocation) {
+            continue;
+        }
+
+        const { host } = invocation;
+        const payloadShell = inlineHostShell(host);
+        const args = words.slice(invocation.index + 1);
+        if (["powershell", "pwsh"].includes(host)) {
+            for (let index = 0; index < args.length; index += 1) {
+                const flag = args[index].value.toLowerCase();
+                if (POWERSHELL_FILE_FLAGS.has(flag)) {
+                    break;
+                }
+
+                if (POWERSHELL_COMMAND_FLAGS.has(flag)) {
+                    if (args[index + 1]) {
+                        found.push({
+                            payload: args
+                                .slice(index + 1)
+                                .map((word) => word.value)
+                                .join(" "),
+                            shell: payloadShell,
+                        });
+                    }
+
+                    break;
+                }
+
+                if (POWERSHELL_ENCODED_FLAGS.has(flag)) {
+                    if (args[index + 1]) {
+                        decodeInlinePayload(found, args[index + 1].value, payloadShell);
+                    }
+
+                    break;
+                }
+            }
+        } else {
+            const shellHost = ["bash", "sh", "zsh", "dash", "ksh", "fish"].includes(host);
+            const codeFlag = (value) => {
+                const flag = value.toLowerCase();
+                if (host === "cmd") {
+                    return flag === "/c" || flag === "/k";
+                }
+
+                if (shellHost) {
+                    return flag === "--command" || /^-[a-z]*c[a-z]*$/i.test(flag);
+                }
+
+                return flag === "-e" || flag === "--eval" || flag === "-c" || flag === "--command";
+            };
+
+            let flagIndex = -1;
+            if (shellHost || host === "cmd") {
+                for (let index = 0; index < args.length; index += 1) {
+                    const value = args[index].value;
+                    if (value === "--") {
+                        break;
+                    }
+
+                    if (codeFlag(value)) {
+                        flagIndex = index;
+                        break;
+                    }
+
+                    const option = shellHost ? value.startsWith("-") : value.startsWith("/");
+                    if (!option) {
+                        break;
+                    }
+                }
+            } else {
+                flagIndex = args.findIndex((arg) => codeFlag(arg.value));
+            }
+
+            if (flagIndex >= 0 && args[flagIndex + 1]) {
+                const codeWords = args.slice(flagIndex + 1);
+                let payload = codeWords[0].value;
+                if (host === "cmd" && codeWords.length > 1) {
+                    payload = codeWords
+                        .map((word) => (word.quoted ? `"${word.value.replaceAll('"', '\\"')}"` : word.value))
+                        .join(" ");
+                }
+
+                found.push({ payload, shell: payloadShell });
+            }
+        }
+    }
+
+    let size = 0;
+
+    return found.filter((item) => {
+        size += Buffer.byteLength(item.payload, "utf8");
+
+        return size <= 64 * 1024;
+    });
+}
+
+// Pulls the path-shaped tokens out of one cooked fallback statement without needing a successful parse.
+function textPathTokens(text) {
+    return text
+        .split(/[\s;&|<>(){}`]+/)
+        .map((token) => {
+            const unquoted = token
+                .replaceAll(ESCAPED_WHITESPACE, " ")
+                .replace(/^["']+/, "")
+                .replace(/["']+$/, "");
+            const assigned = unquoted.includes("=") ? unquoted.slice(unquoted.lastIndexOf("=") + 1) : unquoted;
+
+            return assigned.replace(/[,]+$/, "");
+        })
+        .filter((token) => token && (/[\\/]/.test(token) || token === "~" || /^[a-z]:$/i.test(token)));
+}
+
+function fallbackDirectoryTarget(statement, shell) {
+    if (!TEXT_DIRECTORY_VERB.test(statement.syntax)) {
+        return undefined;
+    }
+
+    const words = fallbackWords(statement.arguments, shell);
+    const commandIndex = words.findIndex((word) =>
+        ["cd", "chdir", "set-location", "sl", "pushd", "push-location"].includes(executableBase(word.value)),
+    );
+    if (commandIndex < 0) {
+        return undefined;
+    }
+
+    const args = words.slice(commandIndex + 1).map((word) => word.value);
+    const candidates = args.filter((arg) => {
+        if (arg === "--" || /^\/d$/i.test(arg)) {
+            return false;
+        }
+
+        return !arg.startsWith("-");
+    });
+    const target = candidates.at(-1);
+    if (!target || /[$%*?]/.test(target)) {
+        return undefined;
+    }
+
+    return target;
+}
+
+function fallbackDestructiveTargets(statement, shell) {
+    const words = fallbackWords(statement.arguments, shell);
+    const commandIndex = words.findIndex((word) => {
+        const name = executableBase(word.value);
+
+        return DELETE_NAMES.has(name) || /^(?:mkfs(?:\.[a-z0-9]+)?|srm|wipefs|diskpart|format|takeown)$/.test(name);
+    });
+    if (commandIndex < 0) {
+        return [];
+    }
+
+    return words
+        .slice(commandIndex + 1)
+        .map((word) => word.value)
+        .filter((arg) => {
+            if (!arg || arg === "--" || arg.startsWith("-") || /^[A-Za-z_][A-Za-z0-9_]*=/.test(arg)) {
+                return false;
+            }
+
+            return !/^\/[a-z]+$/i.test(arg);
+        });
+}
+
+// A last-resort scan of the RAW command text, used only when the structural parser could not produce a usable
+// analysis. Without it an infrastructure failure — a helper timeout, a missing interpreter, a blown limit —
+// silently converts an immutable catastrophic denial into a prompt a person can approve, which is precisely the
+// case where the guard has the least information and should yield the least ground.
+export function catastrophicTextScan(command, options = {}) {
+    const raw = String(command || "");
+    if (!raw || Buffer.byteLength(raw, "utf8") > 128 * 1024) {
+        return undefined;
+    }
+
+    // Quoted values are inert for command-position detection but remain arguments of a real destructive command.
+    // Inline-code payloads are scanned separately only when their flag belongs to a host invocation.
+    const projections = [];
+    const queue = [{ payload: raw, shell: options.shell, depth: 0 }];
+    const seen = new Set();
+    let scannedBytes = 0;
+    let truncated = false;
+    while (queue.length && projections.length < 64) {
+        const item = queue.shift();
+        const key = `${item.shell}\u0000${item.payload}`;
+        if (seen.has(key)) {
+            continue;
+        }
+
+        seen.add(key);
+        scannedBytes += Buffer.byteLength(item.payload, "utf8");
+        if (scannedBytes > 128 * 1024) {
+            truncated = true;
+            break;
+        }
+
+        const projection = fallbackProjection(item.payload, item.shell);
+        projections.push(projection);
+        const payloads = inlineCodePayloads(projection);
+        if (item.depth < 8) {
+            queue.push(...payloads.map((payload) => ({ ...payload, depth: item.depth + 1 })));
+        } else if (payloads.some((payload) => !seen.has(`${payload.shell}\u0000${payload.payload}`))) {
+            truncated = true;
+        }
+    }
+
+    truncated ||= queue.length > 0;
+    if (truncated) {
+        return {
+            action: "deny",
+            severity: "critical",
+            category: "dynamic",
+            ruleIds: ["parser.unanalyzed-catastrophe"],
+            leaves: [],
+            reason: "The unparsed command contains executable payload nesting beyond the fallback safety limit.",
+            indeterminate: true,
+            lockSession: false,
+        };
+    }
+
+    if (
+        projections.some(
+            (projection) =>
+                TEXT_STANDALONE_CATASTROPHE.test(projection.wholeSyntax) ||
+                projection.statements.some((statement) => TEXT_STANDALONE_CATASTROPHE.test(statement.syntax)),
+        )
+    ) {
+        return {
+            action: "deny",
+            severity: "critical",
+            category: "system",
+            ruleIds: ["parser.unanalyzed-catastrophe"],
+            leaves: [],
+            reason: "The command could not be parsed and its text carries a host-destroying operation.",
+            indeterminate: true,
+            lockSession: false,
+        };
+    }
+
+    const scanOptions = { ...options, mode: "guard", read: false };
+    let reaches = false;
+    for (const projection of projections) {
+        let projectedCwd = scanOptions.cwd;
+        let changedDirectory = false;
+        for (const statement of projection.statements) {
+            const directoryTarget = fallbackDirectoryTarget(statement, projection.shell);
+            if (directoryTarget) {
+                try {
+                    projectedCwd = classifyPath(directoryTarget, { ...scanOptions, cwd: projectedCwd }).lexical;
+                    changedDirectory = true;
+                } catch {
+                    changedDirectory = false;
+                }
+            }
+
+            if (!TEXT_DESTRUCTIVE_VERB.test(statement.syntax)) {
+                continue;
+            }
+
+            const targets = textPathTokens(statement.arguments);
+            if (changedDirectory) {
+                targets.push(...fallbackDestructiveTargets(statement, projection.shell));
+            }
+
+            reaches = targets.some((token) => {
+                const scoped = { ...scanOptions, cwd: projectedCwd };
+                try {
+                    return classifyPath(token, scoped).protected || isAgentPath(token, scoped);
+                } catch {
+                    return false;
+                }
+            });
+            if (reaches) {
+                break;
+            }
+        }
+
+        if (reaches) {
+            break;
+        }
+    }
+
+    return reaches
+        ? {
+              action: "deny",
+              severity: "critical",
+              category: "filesystem",
+              ruleIds: ["parser.unanalyzed-catastrophe"],
+              leaves: [],
+              reason: "The command could not be parsed and its text targets a protected host or enforcement path.",
+              indeterminate: true,
+              lockSession: false,
+          }
+        : undefined;
+}
+
+export function evaluateRules(analysis, options = {}) {
+    const findings = [];
+    const unresolvedWorkingDirectory = applyWorkingDirectories(analysis, options);
+    const allLeaves = flatten(analysis);
+    const criticalOnly = options.criticalOnly === true;
+    if (unresolvedWorkingDirectory) {
+        findings.push({
+            action: "ask",
+            severity: "high",
+            category: "dynamic",
+            ruleIds: ["parser.indeterminate"],
+            leaves: [],
+            reason: "A directory change could not be resolved, so later targets are ambiguous; approval is required.",
+            indeterminate: true,
+        });
+    }
+
+    if (!criticalOnly) {
+        const readsProtectedInput = allLeaves.some(
+            (leaf) =>
+                READ_NAMES.has(normalized(leaf.executable)) &&
+                (leaf.args || []).some(
+                    (arg) => classifyPath(arg, { ...leafOptions(leaf, options), read: true }).protected,
+                ),
+        );
+        if (readsProtectedInput) {
+            findings.push({
+                action: "ask",
+                severity: "high",
+                category: "security",
+                ruleIds: ["credential.protected-read"],
+                leaves: [],
+                reason: "Reading credential or Pi private-state paths needs approval in Strict mode.",
+            });
+        }
+
+        if (
+            allLeaves.some((leaf) => {
+                const name = normalized(leaf.executable);
+                if (!SHELL_NAMES.has(name)) {
+                    return false;
+                }
+
+                const semanticShell = ["cmd", "cmd.exe"].includes(name)
+                    ? "cmd"
+                    : ["powershell", "pwsh"].includes(name)
+                      ? "powershell"
+                      : leaf.shell;
+                const scoped = { ...leafOptions(leaf, options), shell: semanticShell, read: true };
+                const args = leaf.args || [];
+                const inline = args.findIndex((arg) => inlineCodeFlag(name, arg));
+                const candidateArgs = inline >= 0 ? args.slice(0, inline) : args;
+
+                return pathArguments(candidateArgs, scoped).some((arg) => classifyPath(arg, scoped).protected);
+            })
+        ) {
+            findings.push({
+                action: "ask",
+                severity: "high",
+                category: "security",
+                ruleIds: ["credential.execution"],
+                leaves: [],
+                reason: "Credential or private-state content connected to an interpreter needs approval in Strict mode.",
+            });
+        }
+
+        for (const group of pipelineGroups(analysis)) {
+            const names = group.map((leaf) => nestedNames(leaf)).flat();
+            const protectedStage = group.some(
+                (leaf) =>
+                    READ_NAMES.has(normalized(leaf.executable)) &&
+                    (leaf.args || []).some(
+                        (arg) => classifyPath(arg, { ...leafOptions(leaf, options), read: true }).protected,
+                    ),
+            );
+            if (names.some((name) => DOWNLOAD_NAMES.has(name)) && names.some((name) => SHELL_NAMES.has(name))) {
+                findings.push({
+                    action: "ask",
+                    severity: "high",
+                    category: "dynamic",
+                    ruleIds: ["exec.download-pipe"],
+                    leaves: [],
+                    reason: "Downloaded content connected to an interpreter could not be inspected.",
+                    indeterminate: true,
+                });
+            }
+
+            if (
+                names.some((name) => DECODER_NAMES.has(name)) &&
+                names.some((name) => SHELL_NAMES.has(name)) &&
+                !group.some((leaf) => leaf.decodedInput)
+            ) {
+                findings.push({
+                    action: "ask",
+                    severity: "high",
+                    category: "dynamic",
+                    ruleIds: ["exec.generated-pipe"],
+                    leaves: [],
+                    reason: "Decoded or generated content connected to an interpreter could not be inspected.",
+                    indeterminate: true,
+                });
+            }
+
+            if (protectedStage && names.some((name) => NETWORK_NAMES.has(name))) {
+                findings.push({
+                    action: "ask",
+                    severity: "high",
+                    category: "security",
+                    ruleIds: ["credential.exfiltration"],
+                    leaves: [],
+                    reason: "Credential or private-key data connected to network transfer needs approval in Strict mode.",
+                });
+            }
+        }
+
+        if (
+            allLeaves.some(
+                (leaf) =>
+                    NETWORK_NAMES.has(normalized(leaf.executable)) &&
+                    (leaf.args || []).some(
+                        (arg) =>
+                            classifyPath(String(arg).replace(/^@/, ""), { ...leafOptions(leaf, options), read: true })
+                                .protected,
+                    ),
+            )
+        ) {
+            findings.push({
+                action: "ask",
+                severity: "high",
+                category: "security",
+                ruleIds: ["credential.exfiltration"],
+                leaves: [],
+                reason: "A network command targeting credential or private-key data needs approval in Strict mode.",
+            });
+        }
+    }
+
+    for (const leaf of allLeaves) {
+        const optionsForLeaf = leafOptions(leaf, options);
+        const criticalFinding = criticalLeaf(leaf, optionsForLeaf);
+        if (criticalFinding) {
+            findings.push(criticalFinding);
+        } else if (!criticalOnly) {
+            const finding = ordinaryLeaf(leaf, optionsForLeaf);
+            if (finding) {
+                findings.push(finding);
+            }
+        }
+    }
+
+    for (const entry of redirectsWithShell(analysis)) {
+        const redirect = entry.redirect;
+        const redirectOptions = { ...options, shell: entry.shell || options.shell };
+        const target = typeof redirect === "string" ? undefined : redirect.target || redirect.targetLiteral;
+        const output =
+            typeof redirect === "string"
+                ? redirect.includes(">")
+                : redirect.operator
+                  ? String(redirect.operator).includes(">")
+                  : true;
+        if (criticalOnly && !output) {
+            continue;
+        }
+
+        if (target && classifyPath(target, { ...redirectOptions, read: !output }).protected) {
+            findings.push(
+                output
+                    ? {
+                          action: "deny",
+                          severity: "critical",
+                          category: "protected-path",
+                          ruleIds: ["guard.redirect-tamper"],
+                          leaves: [],
+                          reason: "A shell redirect targets a protected path.",
+                          lockSession: true,
+                      }
+                    : {
+                          action: "ask",
+                          severity: "high",
+                          category: "security",
+                          ruleIds: ["credential.protected-read"],
+                          leaves: [],
+                          reason: "A shell redirect reads credential or private-state data and needs approval in Strict mode.",
+                      },
+            );
+        } else if (output && !criticalOnly) {
+            // A redirect into the workspace is ordinary file writing; one that escapes it, or whose target could not
+            // be resolved, still needs approval.
+            const resolved = target ? classifyPath(target, redirectOptions) : undefined;
+            const inWorkspace = options.mode === "guard" && resolved && !resolved.protected && resolved.withinWorkspace;
+            if (!inWorkspace) {
+                findings.push({
+                    action: "ask",
+                    severity: "high",
+                    category: "filesystem",
+                    ruleIds: ["filesystem.redirect"],
+                    leaves: [],
+                    reason: "A shell redirect may mutate a file and needs approval.",
+                });
+            }
+        }
+    }
+
+    if (
+        !criticalOnly &&
+        (analysis.dynamicConstructs || []).some((entry) => entry.kind === "resolved-command-execution")
+    ) {
+        findings.push({
+            action: "ask",
+            severity: "medium",
+            category: "dynamic",
+            ruleIds: ["dynamic.generated-code"],
+            leaves: [],
+            reason: "Strict mode requires approval for nested command execution.",
+            indeterminate: false,
+        });
+    }
+
+    if (
+        !criticalOnly &&
+        (analysis.indeterminate ||
+            (analysis.dynamicConstructs || []).some((entry) =>
+                /substitution|environment-expansion|dynamic|depth|limit|batch|heredoc|stopparsing/i.test(entry.kind),
+            ))
+    ) {
+        findings.push({
+            action: "ask",
+            severity: "high",
+            category: "dynamic",
+            ruleIds: ["parser.indeterminate"],
+            leaves: [],
+            reason: "The command could not be completely analyzed; approval is required.",
+            indeterminate: true,
+        });
+    }
+
+    return findings;
+}
+
+export const matchRules = evaluateRules;
+export const ruleCatalog = Object.freeze({
+    version: POLICY_VERSION,
+    ruleIds: Object.freeze([
+        "boot.destructive",
+        "cloud.infrastructure-mutation",
+        "cloud.resource-delete",
+        "container.cluster-mutation",
+        "container.destructive",
+        "credential.environment-read",
+        "credential.execution",
+        "credential.exfiltration",
+        "credential.protected-read",
+        "credential.store-read",
+        "database.destructive",
+        "database.migration-rollback",
+        "disk.destructive",
+        "filesystem.outside-workspace",
+        "dynamic.generated-code",
+        "dynamic.inline-code",
+        "dynamic.local-script",
+        "environment.mutation",
+        "exec.download-pipe",
+        "exec.generated-pipe",
+        "execution.plugins-or-hooks",
+        "filesystem.broad-mutation",
+        "filesystem.find-mutation",
+        "filesystem.mutation",
+        "filesystem.recursive-delete",
+        "filesystem.redirect",
+        "filesystem.write",
+        "fs.root-recursive-delete",
+        "git.destructive",
+        "git.force-push",
+        "guard.redirect-tamper",
+        "guard.self-tamper",
+        "network.or.remote",
+        "package.mutation",
+        "package.registry-mutation",
+        "parser.indeterminate",
+        "parser.unanalyzed-catastrophe",
+        "path.protected-mutation",
+        "parser.integrity",
+        "parser.syntax",
+        "path.canonicalization",
+        "path.protected",
+        "policy.integrity",
+        "process.broad-kill",
+        "process.fork-bomb",
+        "process.termination",
+        "registry.delete",
+        "registry.mutation",
+        "registry.system-delete",
+        "security.disable",
+        "security.identity-or-permission",
+        "security.protected-permissions",
+        "service.mutation",
+        "system.critical",
+        "system.registration-delete",
+        "session.locked",
+        "shell.syntax-mismatch",
+        "strict.execution",
+        "strict.mutation",
+        "tool.unknown-capability",
+        "windows.provider-critical",
+    ]),
+    critical: ["filesystem-root", "disk", "boot", "host-security", "broad-process", "guard-tamper", "download-execute"],
+    high: [
+        "filesystem",
+        "git",
+        "database",
+        "container",
+        "cloud",
+        "package-publish",
+        "service",
+        "registry",
+        "identity",
+        "network",
+    ],
+    medium: ["package-install", "process-termination"],
+});