[hakula139]

Summary

Shell permission analysis combined syntax walking, nested invocation, wrappers, word expansion, pattern parsing, and reader operands in one module. Each concern now has a private child module while command and permission interfaces remain at the parent boundary.

• Responsibilities: walk, invocation, wrapper, word, pattern, and reader own their production logic and tests. Shell startup and inherited environment handling stay together in invocation.
• Contracts: visibility reaches only sibling and parent consumers. Command targets and pattern-word contracts remain at the parent boundary.
• Documentation: the permission design Sources inventory names the children. The top-level architecture boundary is unchanged.

Test plan

• cargo fmt --check, cargo build, both Clippy runs, cargo doc --no-deps, cargo llvm-cov --show-missing-lines, pnpm format, pnpm lint, and pnpm spellcheck pass on 651e8eb95. All applicable commit and push hooks pass. The macOS run has 3,496 passing tests and five existing ignored paid live tests, with 99.24% line coverage.
• All 82 shell test functions are retained: 81 pass locally and one is Linux-only. Five real-input table cases cover bare redirects, here-strings, assignments before heredoc-carried commands, globbed tilde reader paths, and missing-token diagnostics. Each targeted mutation failed at runtime and was restored.
• Production function bodies were mechanically compared with the extraction source, excluding imports, visibility, and comments. The final derive-order correction changes no behavior.
• Uncovered startup and option constructors run during const evaluation. Runtime tests exercise the resulting tables. Other parser guards enforce bundled-grammar requirements: command names have literal children, compound statements have children, and file redirects have operators and destinations. first_error runs only after has_error, excluding its search-exhaustion return.
• Dependencies are unchanged, so cargo deny check was not rerun. Current cross-platform CI is reported in the PR checks.

[codecov]

Codecov Report

❌ Patch coverage is 97.84590% with 78 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
crates/ox-core/src/permission/shell/reader.rs	97.09%	37 Missing ⚠️
crates/ox-core/src/permission/shell/wrapper.rs	91.60%	22 Missing ⚠️
crates/ox-core/src/permission/shell/invocation.rs	94.17%	12 Missing ⚠️
crates/ox-core/src/permission/shell/walk.rs	99.59%	6 Missing ⚠️
crates/ox-core/src/permission/shell/pattern.rs	98.71%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!