The Guard's Run Walk Passes a Separator Fused to a Redirection #2438

Problem

_runs_as_command in host-setup/agent-safety/claude/gh-write-guard.py walks back from a bash -c wrapper or a sleep to the previous separator to find the run's head. The tokenizer fuses a separator and a redirection that touch, as in ;>, into one token, and _is_separator reads that token as a redirection. So the walk passes it and takes the previous command's head. Where that head is in _NAMES_ITS_ARGUMENTS, such as echo, the wrapper or sleep after the ;> reads as an argument, although bash runs it as a new command.

Reproduce (constructed)

Each of these is allowed, and bash runs the loop or the sleep after the ;>:

echo x;>/dev/null bash -c 'until false; do sleep 1; done'
while [ -f x ]; do echo x;>/dev/null sleep 1; done

timeout 5 bash -c 'echo x;>/dev/null bash -c "echo RAN >&2"' prints RAN, which shows the inner shell runs.

Done looks like

The walk in _runs_as_command ends at a token that opens with a separator, alone or fused to a redirection, unless the quote mask marks it quoted. Both commands above are denied, and a self-test row pins each.

The #2080 branch closed this once with a walk break, and decision #2367 reverted that change to keep that branch on eval-only paths, so this is develop's existing behavior rather than a regression. That walk break also stopped at a ) that closes a $(...), which falsely denied echo $(echo)>f bash -c '<loop>', so a fix here keeps ) out of the break.