From 807c6426d23a0e11e32ec85e1f72dd80f4efe9f5 Mon Sep 17 00:00:00 2001
From: Aaron Stannard <aaron@petabridge.com>
Date: Sat, 8 Aug 2026 17:27:47 +0000
Subject: [PATCH] Use ShellSyntaxTree v0.3 for Bash approvals

---
 Directory.Packages.props                      |   5 +-
 .../Tools/ShellApprovalCaseCatalog.cs         |  24 ++-
 ...roval_cases_match_review_table.verified.md |   6 +-
 .../ShellApprovalMatcherMultilineTests.cs     |  11 +
 .../ShellApprovalMatcherTests.cs              |  43 ++++
 .../ShellCommandAnalysisTests.cs              | 198 ++++++++++++++++-
 .../ShellCommandPolicyTests.cs                |   6 +-
 .../ShellSyntaxTreeIntegrationTests.cs        |  22 ++
 src/Netclaw.Security/IToolApprovalMatcher.cs  | 169 +++++++++++----
 .../ShellApprovalSemantics.cs                 |   7 +-
 src/Netclaw.Security/ShellCommandAnalysis.cs  | 199 +++++++++++++-----
 src/Netclaw.Security/ShellCommandPolicy.cs    |   6 +-
 12 files changed, 589 insertions(+), 107 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 80a8dc120..8f3955037 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -75,7 +75,7 @@
     <PackageVersion Include="SlackNet.Extensions.DependencyInjection" Version="$(SlackNetVersion)" />
     <PackageVersion Include="Cronos" Version="0.13.0" />
     <PackageVersion Include="Netclaw.SkillClient" Version="0.4.1" />
-    <PackageVersion Include="ShellSyntaxTree" Version="0.2.0" />
+    <PackageVersion Include="ShellSyntaxTree" Version="0.3.0-alpha" />
     <PackageVersion Include="Termina" Version="0.15.1" />
   </ItemGroup>
   <!-- Serialization -->
@@ -124,7 +124,6 @@
   <ItemGroup>
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="10.0.301" />
   </ItemGroup>
-
   <!-- Transitive audit suppress: Microsoft.Data.Sqlite → SQLitePCLRaw.lib.e_sqlite3 2.1.11
        is flagged by NuGetAudit (GHSA-2m69-gcr7-jv3q, CVE-2025-6965 — SQLite < 3.50.2
        memory corruption in aggregate-term handling). No patched version of
@@ -135,4 +134,4 @@
   <ItemGroup>
     <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
   </ItemGroup>
-</Project>
+</Project>
\ No newline at end of file
diff --git a/src/Netclaw.Actors.Tests/Tools/ShellApprovalCaseCatalog.cs b/src/Netclaw.Actors.Tests/Tools/ShellApprovalCaseCatalog.cs
index 552b11939..7f9f55c78 100644
--- a/src/Netclaw.Actors.Tests/Tools/ShellApprovalCaseCatalog.cs
+++ b/src/Netclaw.Actors.Tests/Tools/ShellApprovalCaseCatalog.cs
@@ -274,10 +274,10 @@ public static class ShellApprovalCases
             Approvals.None,
             ExpectedApproval.Require(["cat"])),
         Case(
-            "safe-verb-namespaced-external-path-prompts",
+            "safe-verb-bash-provider-looking-relative-path-allows",
             Bash("cat filesystem::/etc/netclaw.secret"),
             Approvals.None,
-            ExpectedApproval.Require(["cat"])),
+            ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
         Case(
             "safe-verb-external-redirect-prompts",
             Bash($"git status > {TemporaryFile("netclaw-approval-matrix.txt")}"),
@@ -468,6 +468,11 @@ public static class ShellApprovalCases
             Bash("bash -lc \"netclaw daemon stop\""),
             Approvals.None,
             ExpectedApproval.Deny("hard_deny_self_destructive")),
+        Case(
+            "hard-deny-dash-shell-blocks",
+            Bash("/bin/dash -c \"netclaw daemon stop\""),
+            Approvals.PersistentAnywhere("/bin/dash"),
+            ExpectedApproval.Deny("hard_deny_self_destructive")),
         Case(
             "nested-shell-prompts-for-inner-command",
             Bash("bash -lc \"git push\""),
@@ -533,6 +538,21 @@ public static class ShellApprovalCases
             Bash("git status 2>&1-"),
             Approvals.None,
             ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
+        Case(
+            "combined-output-project-redirect-safe-verb-allows",
+            Bash("git status &> result.log"),
+            Approvals.None,
+            ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
+        Case(
+            "combined-output-append-project-redirect-safe-verb-allows",
+            Bash("git status &>> result.log"),
+            Approvals.None,
+            ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
+        Case(
+            "numeric-source-project-redirect-safe-verb-allows",
+            Bash("git status 3> result.log"),
+            Approvals.None,
+            ExpectedApproval.Allow(ToolAllowReason.SafeVerbInTrustedScope)),
         Case(
             "fd-dup-redirect-mutating-no-grant-prompts-not-messy",
             Bash("git push origin dev 2>&1 | tail -2"),
diff --git a/src/Netclaw.Actors.Tests/Tools/ShellApprovalDispositionMatrixTests.Shell_approval_cases_match_review_table.verified.md b/src/Netclaw.Actors.Tests/Tools/ShellApprovalDispositionMatrixTests.Shell_approval_cases_match_review_table.verified.md
index 67552a9df..0c0033b83 100644
--- a/src/Netclaw.Actors.Tests/Tools/ShellApprovalDispositionMatrixTests.Shell_approval_cases_match_review_table.verified.md
+++ b/src/Netclaw.Actors.Tests/Tools/ShellApprovalDispositionMatrixTests.Shell_approval_cases_match_review_table.verified.md
@@ -20,7 +20,7 @@
 | safe-verb-external-path-prompts | Personal | Project | Interactive | cat /etc/passwd | none | RequiresApproval | approval required | cat | No |
 | safe-verb-quoted-external-path-prompts | Personal | Project | Interactive | cat "/etc/netclaw.secret" | none | RequiresApproval | approval required | cat | No |
 | safe-verb-traversal-external-path-prompts | Personal | Project | Interactive | cat safe/../../../../../../etc/netclaw.secret | none | RequiresApproval | approval required | cat | No |
-| safe-verb-namespaced-external-path-prompts | Personal | Project | Interactive | cat filesystem::/etc/netclaw.secret | none | RequiresApproval | approval required | cat | No |
+| safe-verb-bash-provider-looking-relative-path-allows | Personal | Project | Interactive | cat filesystem::/etc/netclaw.secret | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
 | safe-verb-external-redirect-prompts | Personal | Project | Interactive | git status > {TempPath}netclaw-approval-matrix.txt | none | RequiresApproval | approval required | git status | No |
 | mutating-verb-project-prompts | Personal | Project | Interactive | git push | none | RequiresApproval | approval required | git push | No |
 | all-safe-compound-allows | Personal | Project | Interactive | git status && git log | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
@@ -56,6 +56,7 @@
 | three-step-release-prompts | Personal | Project | Interactive | git add . && git commit -m fix && git push origin dev | none | RequiresApproval | approval required | git add, git commit, git push origin dev | No |
 | hard-deny-pipeline-tail-blocks | Personal | Project | Interactive | echo safe \| netclaw daemon stop | none | Denied | hard_deny_self_destructive | none | Not applicable |
 | hard-deny-nested-shell-blocks | Personal | Project | Interactive | bash -lc "netclaw daemon stop" | none | Denied | hard_deny_self_destructive | none | Not applicable |
+| hard-deny-dash-shell-blocks | Personal | Project | Interactive | /bin/dash -c "netclaw daemon stop" | persistent[anywhere]:/bin/dash | Denied | hard_deny_self_destructive | none | Not applicable |
 | nested-shell-prompts-for-inner-command | Personal | Project | Interactive | bash -lc "git push" | none | RequiresApproval | approval required | git push | No |
 | nested-shell-inner-grant-allows | Personal | Project | Interactive | bash -lc "git push" | persistent[anywhere]:git push | Allowed | StoredApproval | none | Not applicable |
 | nested-shell-wrapper-grant-does-not-cover-inner-command | Personal | Project | Interactive | bash -lc "git push" | persistent[anywhere]:bash | RequiresApproval | approval required | git push | No |
@@ -69,6 +70,9 @@
 | fd-dup-redirect-safe-pipeline-allows | Personal | Project | Interactive | git log --oneline -5 2>&1 \| tail -20 | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
 | fd-close-redirect-safe-verb-allows | Personal | Project | Interactive | git status 2>&- | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
 | fd-move-redirect-safe-verb-allows | Personal | Project | Interactive | git status 2>&1- | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
+| combined-output-project-redirect-safe-verb-allows | Personal | Project | Interactive | git status &> result.log | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
+| combined-output-append-project-redirect-safe-verb-allows | Personal | Project | Interactive | git status &>> result.log | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
+| numeric-source-project-redirect-safe-verb-allows | Personal | Project | Interactive | git status 3> result.log | none | Allowed | SafeVerbInTrustedScope | none | Not applicable |
 | fd-dup-redirect-mutating-no-grant-prompts-not-messy | Personal | Project | Interactive | git push origin dev 2>&1 \| tail -2 | none | RequiresApproval | approval required | git push origin dev, tail | No |
 | dynamic-fd-redirect-fails-closed | Personal | Project | Interactive | git status 2>&$FD | none | RequiresApproval | approval required | none | Yes |
 | background-list-prompts-for-mutating-tail | Personal | Project | Interactive | git status & git push | none | RequiresApproval | approval required | none | Yes |
diff --git a/src/Netclaw.Security.Tests/ShellApprovalMatcherMultilineTests.cs b/src/Netclaw.Security.Tests/ShellApprovalMatcherMultilineTests.cs
index 130e0958f..c16ea3165 100644
--- a/src/Netclaw.Security.Tests/ShellApprovalMatcherMultilineTests.cs
+++ b/src/Netclaw.Security.Tests/ShellApprovalMatcherMultilineTests.cs
@@ -77,4 +77,15 @@ public void ExtractCandidates_multiline_surfaces_each_verb()
         Assert.Contains(candidates, c => c.Verb == "cd" && c.Directory == "/tmp");
         Assert.Contains(candidates, c => c.Verb == "rm" && c.Directory == "/tmp/foo");
     }
+
+    [Fact(SkipUnless = nameof(IsPosix), Skip = "POSIX-only path semantics")]
+    public void ExtractCandidates_uncertain_cwd_without_absolute_scope_fails_closed()
+    {
+        // A newline runs git even if cd fails. Its cwd can therefore be the
+        // original directory or /tmp, and no persistent scope is safe.
+        var arguments = Args("cd /tmp\ngit status");
+
+        Assert.Empty(_matcher.ExtractCandidates(new ToolName("shell_execute"), arguments));
+        Assert.True(_matcher.IsMessy(new ToolName("shell_execute"), arguments));
+    }
 }
diff --git a/src/Netclaw.Security.Tests/ShellApprovalMatcherTests.cs b/src/Netclaw.Security.Tests/ShellApprovalMatcherTests.cs
index 5d672be33..0f0e8df96 100644
--- a/src/Netclaw.Security.Tests/ShellApprovalMatcherTests.cs
+++ b/src/Netclaw.Security.Tests/ShellApprovalMatcherTests.cs
@@ -1142,6 +1142,49 @@ public void ExtractCandidates_recurses_into_bash_dash_c_with_cd_attribution_inta
         Assert.Contains(candidates, c => c.Verb == "git push" && c.Directory == "/repo");
     }
 
+    [Fact(SkipUnless = nameof(IsPosix), Skip = "POSIX-only path semantics")]
+    public void ExtractCandidates_bundled_wrapper_inherits_outer_proven_cwd()
+    {
+        var candidate = Assert.Single(_matcher.ExtractCandidates(
+            new ToolName("shell_execute"),
+            Args(
+                "cd /tmp && bash -lc \"cat relative.txt\"",
+                "/work")),
+            candidate => candidate.Verb == "cat");
+
+        Assert.Equal("/tmp", candidate.Directory);
+    }
+
+    [Fact(SkipUnless = nameof(IsPosix), Skip = "POSIX-only path semantics")]
+    public void Redirect_to_symlink_target_fails_closed()
+    {
+        var root = Path.Combine(Path.GetTempPath(), $"netclaw-redirect-symlink-{Guid.NewGuid():N}");
+        var projectDirectory = Path.Combine(root, "project");
+        var externalDirectory = Path.Combine(root, "external");
+        var externalFile = Path.Combine(externalDirectory, "result.log");
+        var redirectTarget = Path.Combine(projectDirectory, "result.log");
+        Directory.CreateDirectory(projectDirectory);
+        Directory.CreateDirectory(externalDirectory);
+        File.WriteAllText(externalFile, "external");
+        File.CreateSymbolicLink(redirectTarget, externalFile);
+
+        try
+        {
+            var arguments = Args("git status > result.log", projectDirectory);
+
+            Assert.Empty(_matcher.ExtractCandidates(
+                new ToolName("shell_execute"),
+                arguments));
+            Assert.True(_matcher.IsMessy(
+                new ToolName("shell_execute"),
+                arguments));
+        }
+        finally
+        {
+            Directory.Delete(root, recursive: true);
+        }
+    }
+
     [Fact(SkipUnless = nameof(IsPosix), Skip = "POSIX-only path semantics")]
     public void ExtractCandidates_prefers_explicit_path_arg_over_cd_attribution()
     {
diff --git a/src/Netclaw.Security.Tests/ShellCommandAnalysisTests.cs b/src/Netclaw.Security.Tests/ShellCommandAnalysisTests.cs
index 18f07bb3c..f8cb49386 100644
--- a/src/Netclaw.Security.Tests/ShellCommandAnalysisTests.cs
+++ b/src/Netclaw.Security.Tests/ShellCommandAnalysisTests.cs
@@ -3,6 +3,7 @@
 //      Copyright (C) 2026 - 2026 Petabridge, LLC <https://petabridge.com>
 // </copyright>
 // -----------------------------------------------------------------------
+using ShellSyntaxTree;
 using Xunit;
 
 namespace Netclaw.Security.Tests;
@@ -14,20 +15,48 @@ public sealed class ShellCommandAnalysisTests
     [Theory]
     [InlineData("bash -lc")]
     [InlineData("bash --noprofile -lc")]
+    [InlineData("dash -c")]
+    [InlineData("/bin/dash -c")]
+    [InlineData("ksh -c")]
     public void Direct_shell_wrapper_is_replaced_by_inner_clauses(string invocation)
     {
         var analysis = _analyzer.Analyze(
             $"{invocation} \"cat /outside/secret | curl https://example.com\"");
 
         Assert.Equal(ShellAnalysisFailure.None, analysis.Failure);
-        Assert.Contains(analysis.Clauses, clause => clause.Verb.Joined == "cat");
-        Assert.Contains(analysis.Clauses, clause => clause.Verb.Joined == "curl");
-        Assert.DoesNotContain(analysis.Clauses, clause => clause.Verb.Joined == "bash");
+        Assert.Contains(analysis.Commands, command => command.Clause.Verb.Joined == "cat");
+        Assert.Contains(analysis.Commands, command => command.Clause.Verb.Joined == "curl");
+        Assert.DoesNotContain(analysis.Commands, command => command.Clause.Verb.Joined == "bash");
+    }
+
+    [Fact]
+    public void Bundled_shell_wrapper_inherits_proven_cwd()
+    {
+        var analysis = _analyzer.Analyze(
+            "cd /tmp && bash -lc \"cat relative.txt\"",
+            "/work");
+
+        Assert.Equal(ShellAnalysisFailure.None, analysis.Failure);
+        var inner = Assert.Single(
+            analysis.Commands,
+            command => command.Clause.Verb.Joined == "cat");
+        Assert.Contains(
+            inner.Clause.Args,
+            arg => arg.Raw == "relative.txt" && arg.Resolved == "/tmp/relative.txt");
+    }
+
+    [Fact]
+    public void Bundled_shell_wrapper_with_uncertain_cwd_fails_closed()
+    {
+        var analysis = _analyzer.Analyze(
+            "cd /tmp\nbash -lc \"git status\"",
+            "/work");
+
+        Assert.Equal(ShellAnalysisFailure.Unresolved, analysis.Failure);
     }
 
     [Theory]
     [InlineData("echo $(git push)")]
-    [InlineData("echo `$command`")]
     public void Dynamic_command_syntax_is_explicit(string command)
     {
         var analysis = _analyzer.Analyze(command);
@@ -36,17 +65,35 @@ public void Dynamic_command_syntax_is_explicit(string command)
         Assert.True(analysis.HasDynamicSyntax);
     }
 
+    [Fact]
+    public void Unsupported_legacy_backticks_fail_closed()
+    {
+        var analysis = _analyzer.Analyze("echo `$command`");
+
+        Assert.Equal(ShellAnalysisFailure.Unresolved, analysis.Failure);
+        Assert.Empty(analysis.Commands);
+    }
+
     [Theory]
-    [InlineData("git status 2>&1")]
-    [InlineData("git status 2>&123")]
-    [InlineData("git status 2>&1-")]
-    [InlineData("git status 2>&-")]
-    public void Static_file_descriptor_redirect_is_not_dynamic(string command)
+    [InlineData("git status 2>&1", RedirectOperation.DescriptorDuplicate, 1)]
+    [InlineData("git status 2>&123", RedirectOperation.DescriptorDuplicate, 123)]
+    [InlineData("git status 2>&1-", RedirectOperation.DescriptorMove, 1)]
+    [InlineData("git status 2>&-", RedirectOperation.DescriptorClose, null)]
+    public void Static_file_descriptor_redirect_is_not_dynamic(
+        string command,
+        RedirectOperation expectedOperation,
+        int? expectedTargetDescriptor)
     {
         var analysis = _analyzer.Analyze(command);
 
         Assert.Equal(ShellAnalysisFailure.None, analysis.Failure);
         Assert.False(analysis.HasDynamicSyntax);
+        var occurrence = Assert.Single(analysis.Commands);
+        var redirect = Assert.Single(occurrence.Redirects);
+        Assert.Equal(expectedOperation, redirect.Operation);
+        Assert.Equal(expectedTargetDescriptor, redirect.TargetDescriptor);
+        Assert.False(redirect.IsPathRelevant);
+        Assert.True(redirect.IsComplete);
     }
 
     [Theory]
@@ -67,6 +114,137 @@ public void Background_list_fails_closed_when_parser_omits_its_tail()
         var analysis = _analyzer.Analyze("git status & git push");
 
         Assert.Equal(ShellAnalysisFailure.Unresolved, analysis.Failure);
-        Assert.Empty(analysis.Clauses);
+        Assert.Empty(analysis.Commands);
+    }
+
+    [Fact]
+    public void Exact_file_redirect_has_bounded_path_target()
+    {
+        var analysis = _analyzer.Analyze("git status > result.log", "/work");
+
+        Assert.Equal(ShellAnalysisFailure.None, analysis.Failure);
+        Assert.False(analysis.HasDynamicSyntax);
+        var redirect = Assert.Single(Assert.Single(analysis.Commands).Redirects);
+        Assert.Equal(RedirectOperation.FileOutput, redirect.Operation);
+        Assert.Equal(ShellValueDomainKind.Exact, redirect.Target.Kind);
+        Assert.Equal("/work/result.log", Assert.Single(redirect.Target.Values));
+        Assert.True(redirect.IsPathRelevant);
     }
+
+    [Fact]
+    public void Heredoc_stays_approval_sensitive()
+    {
+        var analysis = _analyzer.Analyze("cat <<EOF\nbody\nEOF");
+
+        Assert.Equal(ShellAnalysisFailure.None, analysis.Failure);
+        Assert.True(analysis.HasDynamicSyntax);
+        Assert.Single(Assert.Single(analysis.Commands).Redirects);
+    }
+
+    [Theory]
+    [MemberData(nameof(MalformedRedirects))]
+    public void Malformed_or_future_redirect_facts_fail_closed(RedirectAnalysis redirect)
+    {
+        var occurrence = new CommandOccurrence
+        {
+            Clause = new Clause
+            {
+                Verb = new VerbChain { Tokens = ["command"] }
+            },
+            ImmediateRole = CommandOccurrenceRole.Ordinary,
+            Redirects = [redirect],
+            IsComplete = true
+        };
+        var analysis = new ShellCommandAnalysis([occurrence], ShellAnalysisFailure.None);
+
+        Assert.True(analysis.HasDynamicSyntax);
+    }
+
+    [Fact]
+    public void Unknown_ancestry_fails_closed()
+    {
+        var occurrence = new CommandOccurrence
+        {
+            Clause = new Clause
+            {
+                Verb = new VerbChain { Tokens = ["command"] }
+            },
+            ImmediateRole = CommandOccurrenceRole.Ordinary,
+            Ancestry =
+            [
+                new CommandAncestryFrame
+                {
+                    AncestorKind = ShellSyntaxKind.Unknown,
+                    Region = CommandAncestryRegion.Root
+                }
+            ],
+            IsComplete = true
+        };
+        var analysis = new ShellCommandAnalysis([occurrence], ShellAnalysisFailure.None);
+
+        Assert.True(analysis.HasDynamicSyntax);
+    }
+
+    [Theory]
+    [InlineData(ShellValueDomainKind.FiniteSet)]
+    [InlineData(ShellValueDomainKind.Pattern)]
+    [InlineData((ShellValueDomainKind)999)]
+    public void Unsupported_working_directory_domain_fails_closed(
+        ShellValueDomainKind workingDirectoryKind)
+    {
+        var occurrence = new CommandOccurrence
+        {
+            Clause = new Clause
+            {
+                Verb = new VerbChain { Tokens = ["command"] }
+            },
+            ImmediateRole = CommandOccurrenceRole.Ordinary,
+            WorkingDirectory = new ShellValueDomain { Kind = workingDirectoryKind },
+            IsComplete = true
+        };
+        var analysis = new ShellCommandAnalysis([occurrence], ShellAnalysisFailure.None);
+
+        Assert.True(analysis.HasDynamicSyntax);
+    }
+
+    public static TheoryData<RedirectAnalysis> MalformedRedirects => new()
+    {
+        new RedirectAnalysis
+        {
+            Source = new RedirectSource { Kind = RedirectSourceKind.Descriptor },
+            Operation = RedirectOperation.DescriptorDuplicate,
+            TargetDescriptor = 1,
+            IsComplete = true
+        },
+        new RedirectAnalysis
+        {
+            Source = new RedirectSource { Kind = RedirectSourceKind.Default },
+            Operation = RedirectOperation.DescriptorDuplicate,
+            IsComplete = true
+        },
+        new RedirectAnalysis
+        {
+            Source = new RedirectSource { Kind = RedirectSourceKind.Default },
+            Operation = RedirectOperation.DescriptorClose,
+            TargetDescriptor = 1,
+            IsComplete = true
+        },
+        new RedirectAnalysis
+        {
+            Source = new RedirectSource { Kind = RedirectSourceKind.Default },
+            Operation = (RedirectOperation)999,
+            IsComplete = true
+        },
+        new RedirectAnalysis
+        {
+            Source = new RedirectSource { Kind = RedirectSourceKind.Default },
+            Operation = RedirectOperation.FileOutput,
+            Target = new ShellValueDomain
+            {
+                Kind = ShellValueDomainKind.Exact,
+                Values = ["/work/result.log"]
+            },
+            IsComplete = true
+        }
+    };
 }
diff --git a/src/Netclaw.Security.Tests/ShellCommandPolicyTests.cs b/src/Netclaw.Security.Tests/ShellCommandPolicyTests.cs
index 86e4a2710..1998d9042 100644
--- a/src/Netclaw.Security.Tests/ShellCommandPolicyTests.cs
+++ b/src/Netclaw.Security.Tests/ShellCommandPolicyTests.cs
@@ -118,7 +118,11 @@ public void Allows_compound_of_safe_commands()
     [InlineData("timeout 5 bash -lc \"netclaw daemon stop\"")]
     [InlineData("nice -n 5 bash -lc \"netclaw daemon stop\"")]
     [InlineData("bash -c \"echo safe\" && bash -lc \"netclaw daemon stop\"")]
-    public void Denies_bash_wrapping_denied_command(string command)
+    [InlineData("dash -c \"netclaw daemon stop\"")]
+    [InlineData("/bin/dash -c \"netclaw daemon stop\"")]
+    [InlineData("/usr/bin/zsh -c \"netclaw daemon stop\"")]
+    [InlineData("ksh -c \"netclaw daemon stop\"")]
+    public void Denies_bourne_shell_wrapping_denied_command(string command)
     {
         var decision = _policy.EvaluateBash(command);
         Assert.False(decision.Allowed);
diff --git a/src/Netclaw.Security.Tests/ShellSyntaxTreeIntegrationTests.cs b/src/Netclaw.Security.Tests/ShellSyntaxTreeIntegrationTests.cs
index aa50faa77..852300ecb 100644
--- a/src/Netclaw.Security.Tests/ShellSyntaxTreeIntegrationTests.cs
+++ b/src/Netclaw.Security.Tests/ShellSyntaxTreeIntegrationTests.cs
@@ -50,6 +50,11 @@ public void Simple_verb_produces_single_clause()
         Assert.Equal("ls", clause.Verb.Joined);
         Assert.Contains(clause.Args, a => a.Raw == "-la" && a.IsFlag);
         Assert.Contains(clause.Args, a => a.Raw == "/tmp" && a.IsPath);
+
+        var occurrence = Assert.Single(result.Commands);
+        Assert.Same(clause, occurrence.Clause);
+        Assert.Equal(CommandOccurrenceRole.Ordinary, occurrence.ImmediateRole);
+        Assert.True(occurrence.IsComplete);
     }
 
     [Fact]
@@ -281,6 +286,23 @@ public void Heredoc_followed_by_command_parses_as_two_clauses()
         Assert.Equal("echo after", result.Clauses[1].Verb.Joined);
     }
 
+    [Fact]
+    public void Static_descriptor_redirect_has_explicit_non_path_facts()
+    {
+        var parser = new BashParser();
+
+        var result = parser.Parse("dotnet test 2>&1");
+
+        Assert.False(result.IsUnparseable);
+        var redirect = Assert.Single(Assert.Single(result.Commands).Redirects);
+        Assert.Equal(RedirectSourceKind.Descriptor, redirect.Source.Kind);
+        Assert.Equal(2, redirect.Source.Descriptor);
+        Assert.Equal(RedirectOperation.DescriptorDuplicate, redirect.Operation);
+        Assert.Equal(1, redirect.TargetDescriptor);
+        Assert.False(redirect.IsPathRelevant);
+        Assert.True(redirect.IsComplete);
+    }
+
     [Fact]
     public void Control_flow_keyword_opening_newline_clause_is_unparseable()
     {
diff --git a/src/Netclaw.Security/IToolApprovalMatcher.cs b/src/Netclaw.Security/IToolApprovalMatcher.cs
index e1490adff..f14e3192b 100644
--- a/src/Netclaw.Security/IToolApprovalMatcher.cs
+++ b/src/Netclaw.Security/IToolApprovalMatcher.cs
@@ -201,7 +201,7 @@ public IReadOnlyList<ApprovalCandidate> ExtractCandidates(ToolName toolName, IDi
         string? workingDirectory = null)
     {
         var result = Analyzer.Analyze(command, workingDirectory);
-        return result.Failure == ShellAnalysisFailure.None && result.Clauses.Count > 0
+        return result.Failure == ShellAnalysisFailure.None && result.Commands.Count > 0
             ? result
             : null;
     }
@@ -219,8 +219,9 @@ private static IReadOnlyList<ApprovalCandidate> ExtractCandidatesViaBashAnalysis
         var seen = new HashSet<(string, string?)>();
         var candidates = new List<ApprovalCandidate>();
 
-        foreach (var clause in result.Clauses)
+        foreach (var occurrence in result.Commands)
         {
+            var clause = occurrence.Clause;
             // ShellSyntaxTree's greedy verb walk (SPEC §6.1) folds
             // lowercase-leading value tokens into the verb chain (`git tag
             // v0.4.2`, `git show aa211dcb`, `git checkout feature2`), while
@@ -241,7 +242,10 @@ private static IReadOnlyList<ApprovalCandidate> ExtractCandidatesViaBashAnalysis
                 continue;
 
             var isSideEffectVerb = ShellTokenizer.SingleTokenSideEffectVerbs.Contains(verb);
-            var directories = ResolveClauseDirectories(clause, isSideEffectVerb, workingDirectory);
+            var directories = ResolveCommandDirectories(
+                occurrence,
+                isSideEffectVerb,
+                workingDirectory);
             if (directories is null)
                 return [];
 
@@ -256,15 +260,17 @@ private static IReadOnlyList<ApprovalCandidate> ExtractCandidatesViaBashAnalysis
         return candidates;
     }
 
-    private static IReadOnlyList<string?>? ResolveClauseDirectories(
-        ShellSyntaxTree.Clause clause,
+    private static IReadOnlyList<string?>? ResolveCommandDirectories(
+        ShellSyntaxTree.CommandOccurrence occurrence,
         bool isSideEffectVerb,
         string? workingDirectory)
     {
+        var clause = occurrence.Clause;
         var directories = new List<string?>();
-        var clauseWorkingDirectory = clause.Args
-            .FirstOrDefault(arg => arg.IsCwdAttribution)?.Resolved
-            ?? workingDirectory;
+        var cwdAttribution = clause.Args.FirstOrDefault(static arg => arg.IsCwdAttribution);
+        var clauseWorkingDirectory = ExactValue(occurrence.WorkingDirectory)
+            ?? cwdAttribution?.Resolved
+            ?? (cwdAttribution is null ? workingDirectory : null);
 
         // Each parser path is an authorization scope. A grant must cover all
         // scopes, or a later external path could hide behind an earlier local
@@ -292,20 +298,43 @@ private static IReadOnlyList<ApprovalCandidate> ExtractCandidatesViaBashAnalysis
             directories.Add(ShellTokenizer.ApplyFileParentRule(arg.Resolved));
         }
 
-        foreach (var redirect in clause.Redirects)
+        foreach (var redirect in occurrence.Redirects)
         {
-            var directory = ResolveRedirectDirectory(redirect);
-            if (directory is not null)
-                directories.Add(directory);
+            var redirectDirectories = ResolveRedirectDirectories(redirect);
+            if (redirectDirectories is null)
+                return null;
+
+            directories.AddRange(redirectDirectories);
         }
 
         if (directories.Count == 0)
         {
-            // A side-effect verb ignores cwd. Other verbs inherit a prior cd.
-            var cwdAttribution = isSideEffectVerb
-                ? null
-                : clause.Args.FirstOrDefault(a => a.IsCwdAttribution)?.Resolved;
-            directories.Add(cwdAttribution);
+            // A side-effect verb ignores cwd. Other verbs use the parser's
+            // exact state proof. An unresolved synthetic attribution means a
+            // preceding state change may have failed, so the outer cwd cannot
+            // safely substitute for it.
+            if (isSideEffectVerb)
+            {
+                directories.Add(null);
+            }
+            else if (cwdAttribution is not null)
+            {
+                var attributedDirectory = ExactValue(occurrence.WorkingDirectory)
+                    ?? cwdAttribution.Resolved;
+                if (string.IsNullOrWhiteSpace(attributedDirectory))
+                    return null;
+
+                directories.Add(attributedDirectory);
+            }
+            else if (!string.IsNullOrWhiteSpace(workingDirectory))
+            {
+                directories.Add(
+                    ExactValue(occurrence.WorkingDirectory) ?? workingDirectory);
+            }
+            else
+            {
+                directories.Add(null);
+            }
         }
 
         return directories.Distinct(StringComparer.Ordinal).ToList();
@@ -428,27 +457,67 @@ or NotSupportedException
         }
     }
 
-    private static string? ResolveRedirectDirectory(ShellSyntaxTree.Redirect redirect)
+    private static string? ExactValue(ShellSyntaxTree.ShellValueDomain domain)
+        => domain.Kind == ShellSyntaxTree.ShellValueDomainKind.Exact
+            && domain.Values.Count == 1
+            ? domain.Values[0]
+            : null;
+
+    private static IReadOnlyList<string>? ResolveRedirectDirectories(
+        ShellSyntaxTree.RedirectAnalysis redirect)
     {
-        if (string.IsNullOrWhiteSpace(redirect.Target)
-            || IsHeredocRedirect(redirect)
-            || redirect.Target.StartsWith('&'))
-        {
+        if (!redirect.IsPathRelevant)
+            return [];
+
+        if (!redirect.IsComplete)
             return null;
-        }
 
-        // A dynamic target must still block an automatic side-effect grant.
-        if (redirect.IsDynamicSkip)
-            return redirect.Target;
+        if (redirect.Target.Kind == ShellSyntaxTree.ShellValueDomainKind.Pattern)
+        {
+            var coveringDirectory = redirect.Target.CoveringDirectory;
+            return string.IsNullOrWhiteSpace(coveringDirectory)
+                || ContainsSymlinkEntry(coveringDirectory)
+                ? null
+                : [coveringDirectory];
+        }
 
-        try
+        if (redirect.Target.Kind is not (
+            ShellSyntaxTree.ShellValueDomainKind.Exact
+            or ShellSyntaxTree.ShellValueDomainKind.FiniteSet))
         {
-            return Path.GetDirectoryName(redirect.Target) ?? redirect.Target;
+            return null;
         }
-        catch (Exception ex) when (ex is ArgumentException or NotSupportedException or PathTooLongException)
+
+        var directories = new List<string>(redirect.Target.Values.Count);
+        foreach (var target in redirect.Target.Values)
         {
-            return redirect.Target;
+            if (string.IsNullOrWhiteSpace(target))
+                return null;
+
+            try
+            {
+                var normalizedTarget = PathUtility.Normalize(target);
+                var pathRoot = Path.GetPathRoot(normalizedTarget);
+                if (string.IsNullOrWhiteSpace(pathRoot)
+                    || PathUtility.ContainsSymlinkSegment(pathRoot, normalizedTarget))
+                {
+                    return null;
+                }
+
+                directories.Add(Path.GetDirectoryName(normalizedTarget) ?? normalizedTarget);
+            }
+            catch (Exception ex) when (ex is ArgumentException
+                                       or IOException
+                                       or NotSupportedException
+                                       or PathTooLongException
+                                       or UnauthorizedAccessException
+                                       or System.Security.SecurityException)
+            {
+                return null;
+            }
         }
+
+        return directories;
     }
 
     /// <summary>
@@ -474,8 +543,9 @@ private static IReadOnlyList<string> ExtractApprovalUnitsViaBashAnalysis(
             var units = new List<string>();
             var current = new StringBuilder();
 
-            foreach (var clause in result.Clauses)
+            foreach (var occurrence in result.Commands)
             {
+                var clause = occurrence.Clause;
                 // AndIf / OrIf / Sequence (and the leading None clause) each
                 // open a fresh approval unit; Pipe clauses fold into the unit
                 // in progress. A bare newline produces Sequence, so multi-line
@@ -700,10 +770,35 @@ public bool IsMessy(ToolName toolName, IDictionary<string, object?>? arguments)
         if (analysis is null || analysis.HasDynamicSyntax)
             return true;
 
-        return analysis.Clauses
-            .SelectMany(static clause => clause.Args)
+        if (analysis.Commands
+            .SelectMany(static command => command.Clause.Args)
             .Where(static arg => arg.IsPath && arg.Kind == ShellSyntaxTree.ArgKind.Glob)
-            .Any(arg => ResolveGlobCoveringDirectory(arg, workingDirectory) is null);
+            .Any(arg => ResolveGlobCoveringDirectory(arg, workingDirectory) is null))
+        {
+            return true;
+        }
+
+        if (analysis.Commands.Any(command =>
+                ResolveCommandDirectories(
+                    command,
+                    IsSideEffectCommand(command),
+                    workingDirectory) is null))
+        {
+            return true;
+        }
+
+        return analysis.Commands
+            .SelectMany(static command => command.Redirects)
+            .Any(static redirect => ResolveRedirectDirectories(redirect) is null);
+    }
+
+    private static bool IsSideEffectCommand(ShellSyntaxTree.CommandOccurrence occurrence)
+    {
+        var clause = occurrence.Clause;
+        var parsedVerb = clause.Verb.CanonicalVerb
+            ?? string.Join(" ", TrimTrailingValueTokens(clause.Verb.Tokens));
+        var verb = ShellTokenizer.ApplyVerbShortCircuit(parsedVerb);
+        return ShellTokenizer.SingleTokenSideEffectVerbs.Contains(verb);
     }
 
     public string FormatForDisplay(ToolName toolName, IDictionary<string, object?>? arguments)
@@ -751,7 +846,8 @@ private static string BuildSanitizedDisplayViaParser(string command)
         if (result is null)
             return command;
 
-        if (result.Clauses.Any(c => c.IsSubshell || c.Redirects.Any(IsHeredocRedirect)))
+        if (result.Commands.Any(c =>
+            c.Clause.IsSubshell || c.Clause.Redirects.Any(IsHeredocRedirect)))
             return command;
 
         try
@@ -759,8 +855,9 @@ private static string BuildSanitizedDisplayViaParser(string command)
             var sb = new StringBuilder();
             var first = true;
 
-            foreach (var clause in result.Clauses)
+            foreach (var occurrence in result.Commands)
             {
+                var clause = occurrence.Clause;
                 if (!first)
                     sb.Append(ClauseOperatorText(clause.Operator));
                 first = false;
diff --git a/src/Netclaw.Security/ShellApprovalSemantics.cs b/src/Netclaw.Security/ShellApprovalSemantics.cs
index f548d348e..49cb1fa43 100644
--- a/src/Netclaw.Security/ShellApprovalSemantics.cs
+++ b/src/Netclaw.Security/ShellApprovalSemantics.cs
@@ -417,8 +417,11 @@ protected override bool IsAnchoredPath(string token)
 
     internal static bool IsPosixShellInvoker(string verb)
     {
-        return verb is "bash" or "sh" or "/bin/bash" or "/bin/sh"
-            or "/usr/bin/bash" or "/usr/bin/sh" or "zsh" or "/bin/zsh";
+        return verb is "bash" or "sh" or "dash" or "ash" or "ksh" or "mksh" or "zsh"
+            or "/bin/bash" or "/bin/sh" or "/bin/dash" or "/bin/ash"
+            or "/bin/ksh" or "/bin/mksh" or "/bin/zsh"
+            or "/usr/bin/bash" or "/usr/bin/sh" or "/usr/bin/dash" or "/usr/bin/ash"
+            or "/usr/bin/ksh" or "/usr/bin/mksh" or "/usr/bin/zsh";
     }
 
     private static bool LooksLikePosixAbsoluteShellPath(string path)
diff --git a/src/Netclaw.Security/ShellCommandAnalysis.cs b/src/Netclaw.Security/ShellCommandAnalysis.cs
index 7ca2fdd17..add8b8467 100644
--- a/src/Netclaw.Security/ShellCommandAnalysis.cs
+++ b/src/Netclaw.Security/ShellCommandAnalysis.cs
@@ -23,23 +23,22 @@ private ShellCommandAnalyzer()
 
     public ShellCommandAnalysis Analyze(string command, string? workingDirectory = null)
     {
-        var clauses = new List<Clause>();
-        var failure = Analyze(command, workingDirectory, depth: 0, clauses);
-        return new ShellCommandAnalysis(clauses, failure);
+        var commands = new List<CommandOccurrence>();
+        var failure = Analyze(command, workingDirectory, depth: 0, commands);
+        return new ShellCommandAnalysis(commands, failure);
     }
 
     private static ShellAnalysisFailure Analyze(
         string command,
         string? workingDirectory,
         int depth,
-        List<Clause> clauses)
+        List<CommandOccurrence> commands)
     {
         if (depth > MaxWrapperDepth)
             return ShellAnalysisFailure.Unresolved;
 
-        // ShellSyntaxTree 0.2 does not expose a background-list tail.
-        // Treat that parser boundary as unresolved so the tail cannot inherit
-        // the first command's safe-verb or stored-approval result.
+        // Stable v0.3 excludes background lists. Keep this guard until the
+        // parser exposes their concurrency and shell-state boundaries.
         if (ContainsBackgroundListOperator(command))
             return ShellAnalysisFailure.Unresolved;
 
@@ -56,25 +55,43 @@ private static ShellAnalysisFailure Analyze(
             return ShellAnalysisFailure.Unresolved;
         }
 
-        if (parsed.IsUnparseable || parsed.Clauses.Count == 0)
+        if (parsed.IsUnparseable || parsed.Commands.Count == 0)
             return ShellAnalysisFailure.Unresolved;
 
         var innerCommands = PosixShellApprovalSemantics.Instance.ExtractInnerCommands(command);
-        var hasUnexpandedWrapper = parsed.Clauses.Any(IsUnexpandedWrapperClause);
-        if (innerCommands.Count == 0 || !hasUnexpandedWrapper)
+        var unexpandedWrappers = parsed.Commands
+            .Where(static occurrence => IsUnexpandedWrapperClause(occurrence.Clause))
+            .ToList();
+        if (innerCommands.Count == 0 || unexpandedWrappers.Count == 0)
         {
-            clauses.AddRange(parsed.Clauses);
+            commands.AddRange(parsed.Commands);
             return ShellAnalysisFailure.None;
         }
 
-        // A direct shell wrapper adds no independent authority scope.
-        // Prefix wrappers such as env and timeout remain visible.
-        clauses.AddRange(parsed.Clauses.Where(clause =>
-            !IsUnexpandedWrapperClause(clause) || HasShellInvokerInArguments(clause)));
+        // The v0.3 parser owns contracted wrapper forms. This fallback keeps
+        // Netclaw's extra bundled bash -lc form without hiding prefix wrappers.
+        commands.AddRange(parsed.Commands.Where(static occurrence =>
+            !IsUnexpandedWrapperClause(occurrence.Clause)
+            || HasShellInvokerInArguments(occurrence.Clause)));
 
-        foreach (var innerCommand in innerCommands)
+        if (innerCommands.Count != unexpandedWrappers.Count)
+            return ShellAnalysisFailure.Unresolved;
+
+        for (var i = 0; i < innerCommands.Count; i++)
         {
-            var failure = Analyze(innerCommand, workingDirectory, depth + 1, clauses);
+            if (!TryResolveWrapperWorkingDirectory(
+                    unexpandedWrappers[i],
+                    workingDirectory,
+                    out var innerWorkingDirectory))
+            {
+                return ShellAnalysisFailure.Unresolved;
+            }
+
+            var failure = Analyze(
+                innerCommands[i],
+                innerWorkingDirectory,
+                depth + 1,
+                commands);
             if (failure != ShellAnalysisFailure.None)
                 return failure;
         }
@@ -82,13 +99,47 @@ private static ShellAnalysisFailure Analyze(
         return ShellAnalysisFailure.None;
     }
 
+    private static bool TryResolveWrapperWorkingDirectory(
+        CommandOccurrence occurrence,
+        string? inheritedWorkingDirectory,
+        out string? workingDirectory)
+    {
+        var cwdAttribution = occurrence.Clause.Args
+            .FirstOrDefault(static arg => arg.IsCwdAttribution);
+        if (cwdAttribution is null)
+        {
+            workingDirectory = inheritedWorkingDirectory;
+            return true;
+        }
+
+        if (occurrence.WorkingDirectory.Kind == ShellValueDomainKind.Exact
+            && occurrence.WorkingDirectory.Values.Count == 1
+            && !string.IsNullOrWhiteSpace(occurrence.WorkingDirectory.Values[0]))
+        {
+            workingDirectory = occurrence.WorkingDirectory.Values[0];
+            return true;
+        }
+
+        if (!string.IsNullOrWhiteSpace(cwdAttribution.Resolved))
+        {
+            workingDirectory = cwdAttribution.Resolved;
+            return true;
+        }
+
+        workingDirectory = null;
+        return false;
+    }
+
     private static bool IsUnexpandedWrapperClause(Clause clause)
     {
         if (clause.Verb.Tokens.Count == 0 || clause.Args.Count == 0)
             return false;
 
-        if (!clause.Verb.Tokens.Any(IsShellInvokerToken) && !HasShellInvokerInArguments(clause))
+        if (!clause.Verb.Tokens.Any(IsShellInvokerToken)
+            && !HasShellInvokerInArguments(clause))
+        {
             return false;
+        }
 
         return clause.Args.Any(static arg =>
             arg.Raw.Length > 1
@@ -178,49 +229,99 @@ public static bool HasUnresolvedDescendantScope(Arg arg)
 }
 
 internal sealed record ShellCommandAnalysis(
-    IReadOnlyList<Clause> Clauses,
+    IReadOnlyList<CommandOccurrence> Commands,
     ShellAnalysisFailure Failure)
 {
-    public bool HasDynamicSyntax => Clauses.Any(static clause =>
-        clause.Verb.IsDynamic
-        || clause.Args.Any(static arg => arg.Kind == ArgKind.DynamicSkip)
-        || clause.Args.Any(static arg =>
+    public bool HasDynamicSyntax => Commands.Any(static command =>
+        !command.IsComplete
+        || !Enum.IsDefined(command.ImmediateRole)
+        || command.ImmediateRole == CommandOccurrenceRole.Unknown
+        || command.Ancestry.Any(static frame =>
+            !Enum.IsDefined(frame.AncestorKind)
+            || frame.AncestorKind == ShellSyntaxKind.Unknown
+            || !Enum.IsDefined(frame.Region)
+            || frame.Region == CommandAncestryRegion.Unknown)
+        || HasUnsupportedWorkingDirectory(command.WorkingDirectory)
+        || command.Clause.Verb.IsDynamic
+        || command.Clause.Args.Any(static arg =>
+            arg.Kind == ArgKind.DynamicSkip && !arg.IsCwdAttribution)
+        || command.Clause.Args.Any(static arg =>
             arg.IsPath
             && arg.Kind != ArgKind.Glob
             && string.IsNullOrWhiteSpace(arg.Resolved))
         // A glob in a directory segment can hide traversal or a symlink.
         // Only a leaf glob has a fixed directory scope.
-        || clause.Args.Any(ShellGlobPath.HasUnresolvedDescendantScope)
-        // An fd-dup target (&1, &2, &-) is a static file-descriptor number,
-        // not a dynamic token: ShellSyntaxTree marks it IsDynamicSkip to mean
-        // "do not path-resolve", but it carries no unresolved syntax and no
-        // filesystem scope (ResolveRedirectDirectory skips &-prefixed targets).
-        // Treating it as dynamic fails the whole command closed to an approval
-        // prompt for every `2>&1`-shaped command, even fully safe ones.
-        || clause.Redirects.Any(static redirect =>
-            redirect.IsDynamicSkip
-            && !IsStaticFileDescriptor(redirect.Target)));
-
-    /// <summary>
-    /// Returns true only for the static file-descriptor targets that
-    /// ShellSyntaxTree 0.2 recognizes: &amp;N, &amp;N-, and &amp;-.
-    /// </summary>
-    private static bool IsStaticFileDescriptor(string target)
+        || command.Clause.Args.Any(ShellGlobPath.HasUnresolvedDescendantScope)
+        || command.Redirects.Any(HasUnresolvedRedirect));
+
+    private static bool HasUnsupportedWorkingDirectory(ShellValueDomain workingDirectory)
     {
-        if (target == "&-")
+        if (!Enum.IsDefined(workingDirectory.Kind))
             return true;
 
-        if (target.Length < 2 || target[0] != '&')
-            return false;
+        return workingDirectory.Kind switch
+        {
+            ShellValueDomainKind.Unknown => workingDirectory.Values.Count != 0
+                || workingDirectory.Pattern is not null
+                || workingDirectory.CoveringDirectory is not null,
+            ShellValueDomainKind.Exact => workingDirectory.Values.Count != 1
+                || string.IsNullOrWhiteSpace(workingDirectory.Values[0])
+                || workingDirectory.Pattern is not null
+                || workingDirectory.CoveringDirectory is not null,
+            _ => true
+        };
+    }
 
-        var index = 1;
-        while (index < target.Length && char.IsAsciiDigit(target[index]))
-            index++;
+    private static bool HasUnresolvedRedirect(RedirectAnalysis redirect)
+    {
+        if (!redirect.IsComplete
+            || !Enum.IsDefined(redirect.Source.Kind)
+            || redirect.Source.Kind == RedirectSourceKind.Unknown
+            || !Enum.IsDefined(redirect.Operation)
+            || redirect.Operation == RedirectOperation.Unknown)
+        {
+            return true;
+        }
 
-        if (index == 1)
-            return false;
+        var hasValidSource = redirect.Source.Kind switch
+        {
+            RedirectSourceKind.Default => redirect.Source.Descriptor is null,
+            RedirectSourceKind.Descriptor => redirect.Source.Descriptor is >= 0,
+            _ => false
+        };
+        if (!hasValidSource)
+        {
+            return true;
+        }
 
-        return index == target.Length
-               || index == target.Length - 1 && target[index] == '-';
+        return redirect.Operation switch
+        {
+            // Netclaw keeps shell-fed stdin approval-sensitive. The parser can
+            // prove its syntax without proving executable-specific data use.
+            RedirectOperation.HereDocument or RedirectOperation.HereString => true,
+            RedirectOperation.DescriptorDuplicate or RedirectOperation.DescriptorMove =>
+                redirect.IsPathRelevant || redirect.TargetDescriptor is < 0 or null,
+            RedirectOperation.DescriptorClose =>
+                redirect.IsPathRelevant || redirect.TargetDescriptor is not null,
+            RedirectOperation.FileInput
+                or RedirectOperation.FileOutput
+                or RedirectOperation.FileAppend
+                or RedirectOperation.CombinedOutput
+                or RedirectOperation.CombinedOutputAppend =>
+                !redirect.IsPathRelevant || !HasBoundedPathTarget(redirect.Target),
+            _ => true
+        };
     }
+
+    private static bool HasBoundedPathTarget(ShellValueDomain target)
+        => target.Kind switch
+        {
+            ShellValueDomainKind.Exact => target.Values.Count == 1
+                && !string.IsNullOrWhiteSpace(target.Values[0]),
+            ShellValueDomainKind.FiniteSet => target.Values.Count is >= 2 and <= 32
+                && target.Values.All(static value => !string.IsNullOrWhiteSpace(value)),
+            ShellValueDomainKind.Pattern => !string.IsNullOrWhiteSpace(target.Pattern)
+                && !string.IsNullOrWhiteSpace(target.CoveringDirectory),
+            _ => false
+        };
 }
diff --git a/src/Netclaw.Security/ShellCommandPolicy.cs b/src/Netclaw.Security/ShellCommandPolicy.cs
index 0d3809e81..cd5cd34fe 100644
--- a/src/Netclaw.Security/ShellCommandPolicy.cs
+++ b/src/Netclaw.Security/ShellCommandPolicy.cs
@@ -145,12 +145,12 @@ internal ShellCommandDecision EvaluateBash(string command)
     private ShellCommandDecision EvaluateBashAnalysis(string command)
     {
         var analysis = Analyzer.Analyze(command);
-        if (analysis.Failure == ShellAnalysisFailure.Unresolved || analysis.Clauses.Count == 0)
+        if (analysis.Failure == ShellAnalysisFailure.Unresolved || analysis.Commands.Count == 0)
             return EvaluateLegacySegments(command);
 
-        foreach (var clause in analysis.Clauses)
+        foreach (var occurrence in analysis.Commands)
         {
-            var decision = EvaluateClause(clause);
+            var decision = EvaluateClause(occurrence.Clause);
             if (!decision.Allowed)
                 return decision;
         }