Module plan 

The statement plan: an AST rendered back to shell text, unexpanded.

A plan is parse information. It is built after validation and before execution, so ${HOME} and $(...) appear exactly as written — an embedder judges what was asked, not what it resolved to, and the substitution that would resolve them has not run.

Two products, one AST walk each: render_stmt produces the text, and planned_commands produces one PlannedCommand per command the statement contains — control-structure bodies, if conditions, and command substitutions included, because every one of them is a command this statement would run.

The same walk collects the statement’s variables: the names it reads (free_variables) and the names it writes (bound_variables). A name that is both lands bound, never free.

The collection walk also lifts out any literal --confirm=<key> the statement’s argv carries (StatementPlan::presented_keys) — the same spellings the rendering redacts. One predicate decides all three of lift, redact, and render, so they cannot disagree about what the statement presented.

Redaction is the --confirm=<key> flag spelling and nothing else — that spelling carries a confirmation credential, and a credential must never ride into a stored plan. kaish ships no secret detector — a shell cannot define what a secret is — so an embedder that wants more redacts the plans it holds.

Structs

PlannedStatement

One statement of a planned program: its Plan and where it sits in the parsed source.

StatementPlan

One statement’s plan, plus the redemption credentials its argv presented.

Functions

plan_program

Plan every statement of source without executing anything.

planned_commands

Every command the statement contains, in source order.

redact_keys

Remove every one of keys from captured source text — for an embedder storing source alongside plans, so the stored text never carries a credential. The whole --confirm=<key> token goes, not just its value, so re-running the stored text cannot re-present a spent key.

strip_confirm_tokens

Remove every --confirm= (or confirm=) token from rendered plan text, whatever it carries.