Module resolver 

Bash command parsing and affected-path scope resolution.

Parsing uses brush-parser (pure Rust). The original tree-sitter-bash backend was removed after fuzzing found glibc-only segfaults in its C error recovery (heap-layout-dependent; 7-byte minimized repro) — a safety tool whose input is adversarial by definition cannot keep a memory-unsafe parser in the trust path. With pure Rust, worst-case failures are panics, which the thread wrapper in resolve converts into a conservative Unknown resolution.

Quote-context correctness: every word is carried as segments with an expandability mask (unquoted vs quoted/escaped), because bash only brace-expands, globs, and tilde-expands unquoted spans. '{a,b}'{c,d} expands only the second group; '*'x never globs; '~/x' is a literal. The bash differential oracle (tests/resolver_oracle.rs) enforces this against real bash.

Design invariants (property-tested):

• never panics or crashes the caller on any input;
• anything the resolver cannot fully account for — opaque constructs (eval, $( ), sh -c, xargs, wrappers like sudo), unresolvable variables, parse errors, control-flow compounds, or a destructive rule that yielded zero concrete paths — sets has_unknown, which routes the action through the engine’s unknown policy instead of silently under-protecting;
• resolution is deterministic and purely lexical except for glob expansion and git-repo-root discovery, which read (never write) the filesystem.

Structs

Ctx

Resolution

Enums

Severity

Classification severity. Extends registry Effect with Unknown, ordered so that a destructive-with-known-scope part still dominates an unknown part in reporting (the has_unknown flag carries the safety obligation separately).

Functions

find_repo_root

Nearest enclosing git repository (walks up looking for .git).

normalize_lexical

Lexical normalization: resolves . and .. without touching the filesystem (no symlink resolution — the snapshot engine handles links).

resolve