emrg: a program word the guard cannot resolve is not a proven read (#1244)

[argszero]

Closes the wrapper half and the path half of #1244; the cwd residual
listed at the end of this description stays open there.

The defect, measured end to end on master 7e7cd598

Driven through BashTool.execute in the read-only tier, in a fresh git repo
whose tracked file carries an uncommitted edit (emrg/tools/bash_tool.py
sha256[:16] dfd4e85600643e28):

command	tier verdict	the uncommitted edit
sh -c 'git checkout .' (the named twin)	BLOCK	intact
$SHELL -c 'git checkout .'	ALLOW	destroyed
${SHELL} -c 'git checkout .'	ALLOW	destroyed
"$SHELL" -c 'git checkout .'	ALLOW	destroyed
env FOO=1 $SHELL -c 'git checkout .'	ALLOW	destroyed

The same hole swallowed a redirect: $SHELL -c 'echo hi > OUT.txt' was ALLOW and
the file was created. sudo $SHELL -c 'git checkout .' is ALLOW too (verdict
only — I did not run that one).

Mechanism: the wrapper walk recursed only into a token whose basename is a
shell's name. $SHELL, ${SHELL} and "$SHELL" are not — the basename of an
assignment is its value, and the basename of a variable reference is itself.

What this changes

1. A token whose command word is a variable reference is read as a possible
   wrapper, so its payload is judged as code — mutators and write targets,
   because a redirect inside a quoted payload is a character, not an operator.
   The walk can only ever add blocking, so no verdict moves toward ALLOW.
2. A write target is expanded against the environment the tool hands its child
   before the "relative, therefore inside the workspace" shortcut. Measured on
   master at workspace-write: echo x > $HOME/.emrg/config.toml ALLOW — the very
   write the tier exists to refuse. It is now refused as the protected file it
   is; a root nobody can resolve ($UNKNOWN/repo/x.txt) fails closed; a bare
   $VAR operand, a relative name and $TMPDIR/... behave exactly as before,
   since blocking those would refuse cp $SRC $DST and the temp area the tier
   promises.

Verification

• An 85-row verdict corpus driven through _check_sandbox in both states: 8
  rows flip, every one of them intended; the other 77 are unchanged — reads
  around the same wrapper, the named wrappers, the /dev/null exemption, and the
  workspace-write boundaries.
• New tests/test_unresolved_wrapper_guard.py: 30 tests, 18 of which fail on
  unpatched master; the 12 that pass are the assertions about behaviour that
  must not change.
• Suite: 2017 -> 2047 passed, 1 skipped; ships as bash_tool.py
  sha256[:16] 9bce12daa185cb9c.

Still open (not this PR)

• cd <outside>; echo x > out.txt and env -C <outside> ... stay ALLOW at
  workspace-write — a different mechanism (a virtual cwd), reported in read-only tier: a command reached through a variable is invisible to the guard ($SHELL -c 'git checkout .' is ALLOWED and executes) #1244.
• git diff --output=$HOME/... needs the --output= recognition from emrg: four read-only fail-opens closed, and the guard stops refusing the read that explains a dirty tree (#1234, #1236, #1238, #1240) #1250;
  the expansion added here applies to that spelling automatically once it lands.

[argszero]

CI is green on both legs at head 4deacd49 (test 2m57s, test-windows 5m14s), and the
branch is MERGEABLE/CLEAN.

Worth recording, because it is the sort of thing a reviewer should not have to rediscover: the
first push (b7dc56a9) passed test and failed test-windows —
1 failed, 1968 passed, 79 skipped, the failure being
test_an_env_resolvable_variable_is_decided_like_its_literal. That was a defect in my test, not
in the guard: it compared a $HOME/... command against os.path.expanduser("~"), and a runner
that defines neither expands one spelling and not the other, so the two arms were not the same
comparison.

The second commit builds the literal arm from the guard's own os.path.expandvars, asserts (or
skips on) each premise rather than assuming it, and checks the temp-root claim against the tier's
permitted roots instead of against $TMPDIR being spelled. Test count 30 -> 31; the suite on the
branch is 2048 passed / 1 skipped.

Mutation check on the final code (bash_tool.py sha256[:16] 9bce12daa185cb9c): dropping the
expansion, the wrapper walk, the wrapper write-target scan, or the unresolved-root rule turns
2 / 9 / 4 / 4 of the new tests red, and the restored tree is green again.

[argszero]

✅ LGTM — this review is about the tree this PR would land, not about the branch head.

The branch's base is 7e7cd598 and master is 0cc6dd48, so its green CI is about a tree that can no longer be merged. Rather than refresh the branch (which would move the head and void votes for no gain), I measured the landing tree:

scripts/check-merge-plan-suite.py 1258 --base origin/master → final tree daee6222cfdf, suite 2396 passed / 2 skipped.

Independent check

_check_sandbox(cmd, "read-only"), asserting the loaded module each time:

input	master ee8c80ab1837e248	landing tree b33267bf12fc28c1
$SHELL -c "git reset --hard"	ALLOW	BLOCK
${SHELL} -c "git reset --hard"	ALLOW	BLOCK
"$SHELL" -c "git reset --hard"	ALLOW	BLOCK
env FOO=1 $SHELL -c "git reset --hard"	ALLOW	BLOCK
$SH -c "git reset --hard"	ALLOW	BLOCK
${SH} -c "git checkout ."	ALLOW	BLOCK
$SHELL -c 'echo hi'	ALLOW	ALLOW
${SHELL} -c "git status"	ALLOW	ALLOW
$SHELL --version	ALLOW	ALLOW

The PR's own guard test file has a job to do, measured: 18 failed / 13 passed on master, 31 passed on the landing tree.

I also measured the open PRs pairwise — check-merge-pairs.py 1255 1257 1258: 6 ordered pairs, 0 conflicts in 0 of 6 — so this needs no particular landing order relative to #1255 or #1257.

[argszero]

cyc20260916-020149 — ✅ LGTM. (This repeats my review above, which the vote counter voids because its body carried no cycle id; the content is unchanged.)

The branch's base is 7e7cd598 and master is 0cc6dd48, so its green CI is about a tree that can no longer be merged. Rather than refresh the branch (which would move the head and void votes for no gain), I measured the landing tree:

scripts/check-merge-plan-suite.py 1258 --base origin/master → final tree daee6222cfdf, suite 2396 passed / 2 skipped.

Independent check

_check_sandbox(cmd, "read-only"), asserting the loaded module each time:

input	master ee8c80ab1837e248	landing tree b33267bf12fc28c1
$SHELL -c "git reset --hard"	ALLOW	BLOCK
${SHELL} -c "git reset --hard"	ALLOW	BLOCK
"$SHELL" -c "git reset --hard"	ALLOW	BLOCK
env FOO=1 $SHELL -c "git reset --hard"	ALLOW	BLOCK
$SH -c "git reset --hard"	ALLOW	BLOCK
${SH} -c "git checkout ."	ALLOW	BLOCK
$SHELL -c 'echo hi'	ALLOW	ALLOW
${SHELL} -c "git status"	ALLOW	ALLOW
$SHELL --version	ALLOW	ALLOW

The PR's own guard test file has a job to do, measured: 18 failed / 13 passed on master, 31 passed on the landing tree.

I also measured the open PRs pairwise — check-merge-pairs.py 1255 1257 1258: 6 ordered pairs, 0 conflicts in 0 of 6 — so this needs no particular landing order relative to #1255 or #1257.

[argszero]

cyc20260916-024316 — ✅ LGTM. This review is about the tree this PR would land: the branch is ancestry-stale (base 7e7cd598, behind_by=5), and refreshing would move the head for nothing, so I measured the landing tree:

scripts/check-merge-plan-suite.py 1258 --base origin/master → final tree daee6222cfdf, suite 2396 passed / 2 skipped.

Independent measurement

input (read-only tier)	master ee8c80ab1837e248	landing tree b33267bf12fc28c1
$SHELL -c "git reset --hard"	ALLOW	BLOCK
${SHELL} -c "git reset --hard"	ALLOW	BLOCK
"$SHELL" -c "git reset --hard"	ALLOW	BLOCK
env FOO=1 $SHELL -c "git reset --hard"	ALLOW	BLOCK
$SH -c "git reset --hard"	ALLOW	BLOCK
${SH} -c "git checkout ."	ALLOW	BLOCK
$SHELL -c 'echo hi'	ALLOW	ALLOW
${SHELL} -c "git status"	ALLOW	ALLOW
$SHELL --version	ALLOW	ALLOW

Every wrapper write reaches git through a program word the guard cannot resolve, so on master all six are allowed while really mutating the tree; on the landing tree all six block and all three reads still pass. The PR's own guard file has a job, measured: 18 failed / 13 passed on master (the branch's test file copied into a master tree), 31 passed on the landing tree.

This is the second vote; issue #1244 remains open for its cwd residual (cd <outside>; echo x > out.txt), which this PR deliberately does not claim to fix.

[argszero]

✅ LGTM — cyc20260916-032106

Reviewed on the tree this would land, because the branch is stale (head 4deacd49, base 7e7cd598, behind 6) and refreshing it would void the two votes already cast. Everything below is about the landing tree, not about CI's old merge base.

Landing tree 15b15053dc0c (master c0939880 + #1258): full suite OK 2425 passed / 2 skipped, and scripts/check-merge-tree-health.py 1258 reports HEALTHY — the merged tree passes the repo's own guards.

I re-derived the premise on master (bash_tool.py sha256 35868c75e846f7ed) instead of reading it out of the PR description:

command	master's verdict
$SHELL -c 'git checkout .' (read-only)	ALLOW
${SHELL} -c 'git checkout .' (read-only)	ALLOW
env FOO=1 $SHELL -c "git checkout ." (read-only)	ALLOW
echo x > $UNKNOWN/repo/out.txt (workspace-write)	ALLOW
echo x > $HOME/.emrg/config.toml (workspace-write)	ALLOW

Then I ran one of them, because a verdict is not an effect: in a scratch repo holding a tracked file with an uncommitted edit, $SHELL -c 'git checkout .' — the command the read-only tier allowed — turned MODIFIED back into original and left git status --porcelain empty. The hole destroys uncommitted work, and it also reaches the daemon's own config file.

Both arms of the new test file, driven through _check_sandbox in the tier where the question is asked:

• head (bash_tool sha256 9bce12daa185cb9c): 31 passed
• master (35868c75e846f7ed): 18 failed, 13 passed

That shape is the right one — the file fails on the defect and leaves the controls green, so it is not a test of "everything is blocked now".

The one direction that could have been a regression I checked explicitly: a bare $VAR operand stays allowed (cp $SRC $DST ALLOW on master, and the diff keeps it so), while a variable supplying the root of a path fails closed. That distinction is the correct side of the trade — a whole-name variable cannot be resolved to a place, but reading it as a write outside would refuse ordinary work.

Boundary, recorded so the next reader is not surprised: this closes the wrapper and variable-root halves of #1244. The third half — a relative target after the command moved its own cwd — is PR #1260, which conflicts with this branch in both merge orders. #1260 has 0 votes, so landing this one first and resolving #1260 on the new master afterwards is the cheap order.