From 0b8b4bd7dac29e1df3b538342d13c9fc14625669 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:31:20 +0000
Subject: [PATCH 01/43] distill: mine "A fails here, B works" repair pitfalls
 from shell runs

---
 docs/features/distill.md |  11 ++
 kypp/distill.py          |  29 ++++-
 kypp/repairs.py          | 232 +++++++++++++++++++++++++++++++++++++++
 tests/test_repairs.py    | 122 ++++++++++++++++++++
 4 files changed, 389 insertions(+), 5 deletions(-)
 create mode 100644 kypp/repairs.py
 create mode 100644 tests/test_repairs.py

diff --git a/docs/features/distill.md b/docs/features/distill.md
index fcd689d..02f4f30 100644
--- a/docs/features/distill.md
+++ b/docs/features/distill.md
@@ -4,6 +4,7 @@ paths:
   - "kypp/distill.py"
   - "kypp/batch_distill.py"
   - "kypp/episodes.py"
+  - "kypp/repairs.py"
   - "scripts/eval_episodes.py"
   - "eval/episodes/*"
   - "docs/episode-extraction-evaluation.md"
@@ -12,6 +13,7 @@ entry:
   - "kypp/batch_distill.py"
 tests:
   - "tests/test_episodes.py"
+  - "tests/test_repairs.py"
 ---
 # Distillation
 
@@ -20,6 +22,15 @@ distiller runs when `KYPP_DISTILL_MODEL` is set (`claude`, `codex` or an ollama
 
 ## Gotchas
 - Without `KYPP_DISTILL_MODEL` you only get heuristic, failure-mined pitfalls.
+- Repair pitfalls (`kypp/repairs.py`) run with or without a model: a shell command that fails
+  with command-not-found, a missing module or a missing env var, followed in the same session by a
+  form that works (`uv run pytest`, `.venv/bin/python`, `V=x cmd`). The subject names only what
+  failed, so a second session's repair lands on the same subject and the K=2 gate accepts it; a
+  one-session quirk stays a candidate. A repair suppresses the generic "`<tool>` repeatedly
+  failed" pitfall for the failures it explains.
+- A repair is skipped when the bare form works later in the session, when the thing was installed
+  in between, or when the working form is a host path. A secret-looking env var's value is never
+  written.
 - If the LLM distiller fails, it falls back to the heuristic distiller rather than raising.
 - With `TYPESAFE_API_KEY` or `KYPP_DECIDER_URL` (a local strands-decider) set, and `kypp[s1]`
   installed, a System One gate drops drafts scoring
diff --git a/kypp/distill.py b/kypp/distill.py
index c058c61..0765110 100644
--- a/kypp/distill.py
+++ b/kypp/distill.py
@@ -27,7 +27,7 @@
 from typing import TYPE_CHECKING, Protocol
 
 from . import episodes as _episodes
-from . import s1
+from . import repairs, s1
 from .vocab import OLLAMA_DEFAULT_HOST, TYPES  # single-sourced vocabulary (turso-free leaf)
 
 if TYPE_CHECKING:
@@ -169,14 +169,32 @@ def distill(self, trace: Trace) -> list[ClaimDraft]:
                 f"in this session's observations", 0.6))
         if trace.run_failed:
             drafts.append(ClaimDraft("pitfall", "run failed", _trunc(trace.run_failed), 0.5))
+        fixes, explained = repairs.mine(trace)
         for name, n in trace.tool_failures.items():
-            if n >= 2:
-                sample = next(a for a in trace.actions if a.failed and a.name == name)
+            unexplained = [a for i, a in enumerate(trace.actions)
+                           if a.failed and a.name == name and i not in explained]
+            # A failure a repair explains is said better by the repair ("A fails, B works").
+            if n >= 2 and unexplained:
+                sample = unexplained[0]
                 drafts.append(ClaimDraft(
                     "pitfall", f"{name} repeatedly failed",
                     _trunc(f"`{name}` errored {n}x this run; e.g. {sample.output}"), 0.4,
                     code_refs=_refs_from(sample.input)))
-        return drafts
+        return drafts + fixes
+
+
+class WithRepairs:
+    """Add the deterministic repair pitfalls to another distiller's drafts. The LLM distiller is told
+    to skip environment artifacts; a repair is one only until a second session hits it, and then
+    the K=2 gate accepts it."""
+
+    def __init__(self, inner: Distiller):
+        self.inner = inner
+
+    def distill(self, trace: Trace) -> list[ClaimDraft]:
+        drafts = self.inner.distill(trace)
+        taken = {d.subject for d in drafts}
+        return drafts + [d for d in repairs.mine(trace)[0] if d.subject not in taken]
 
 
 # LLM_DISTILL_PROMPT + _SCHEMA are what the model is ASKED for (model-agnostic, code-grounded claims).
@@ -404,7 +422,8 @@ def distiller_from_env() -> Distiller:
     A configured System One model (see kypp.s1) adds the write gate on top. The seam-config analog
     of store.store_from_env."""
     model = os.environ.get("KYPP_DISTILL_MODEL")
-    inner = (FallbackDistiller(LLMDistiller(_complete_from_model(model), episodes=_episodes.extractor_from_env()),
+    inner = (FallbackDistiller(WithRepairs(LLMDistiller(_complete_from_model(model),
+                                                        episodes=_episodes.extractor_from_env())),
                                HeuristicDistiller())
              if model else HeuristicDistiller())
     via = s1.client()
diff --git a/kypp/repairs.py b/kypp/repairs.py
new file mode 100644
index 0000000..bd7415a
--- /dev/null
+++ b/kypp/repairs.py
@@ -0,0 +1,232 @@
+"""repairs.py — §0 trace → "A fails here, B works" pitfalls, mined without a model.
+
+An agent often rediscovers the same environment fact by failing at it: `pytest` is not on PATH but
+`uv run pytest` works, `python` can't import the project but `.venv/bin/python` can, a script needs
+`PYTHONPATH=src`. Within one session this mines a failing shell command followed by a later one that
+does the same thing another way and works, and states both forms. The subject names only what failed
+(never the fix), so the same fact from a second session reuses the subject and the arbiter's K=2
+gate accepts it: one session's quirk stays a candidate, a recurring one becomes memory.
+
+Idea borrowed from TokenEconomizer's environment facts (microsoft/TokenEconomizer, Apache-2.0):
+its FormRepair and EnvValue families. Re-implemented here over §0 actions.
+"""
+from __future__ import annotations
+
+import re
+import shlex
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from .distill import Action, ClaimDraft, Trace
+
+# Shell tools as each harness names them (Claude: Bash; Codex: shell / exec_command; pillbox: bash).
+_SHELL_TOOLS = {"bash", "shell", "exec_command", "local_shell", "run_shell_command"}
+
+_SEGMENT_SPLIT = re.compile(r"\s*(?:&&|\|\||;)\s*")  # a pipe stays inside its segment
+_SETUP = {"cd", "source", ".", "export", "set", "pushd", "unset"}
+_ASSIGN = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)=(.*)$", re.S)
+_WORD = re.compile(r"^[A-Za-z0-9._+-]{1,64}$")  # a command or module name we're willing to quote
+# A missing command, as bash, sh, zsh and env each word it.
+_CMD_MISSING = [re.compile(p) for p in (
+    r"(?:^|\s|:)([A-Za-z0-9._+-]+): (?:command )?not found",
+    r"command not found: ([A-Za-z0-9._+-]+)",
+    r"env: '?([A-Za-z0-9._+-]+)'?: No such file or directory",
+)]
+_MOD_MISSING = [re.compile(p) for p in (
+    r"No module named '?([A-Za-z0-9_.]+)'?",
+    r"Cannot find module '([^']+)'",
+)]
+_ENV_MISSING = [re.compile(p) for p in (
+    r"KeyError: '([A-Z][A-Z0-9_]+)'",
+    r"\b([A-Z][A-Z0-9_]{2,})\b (?:environment variable )?(?:is )?(?:not set|unset|required|missing)",
+    r"(?:environment variable|env var)s? '?([A-Z][A-Z0-9_]{2,})'? (?:is )?(?:not set|unset|required|missing)",
+    r"[Mm]issing (?:required )?(?:environment variable|env var) '?([A-Z][A-Z0-9_]{2,})'?",
+)]
+# A later command led by one of these is looking or installing, not running the thing another way.
+_NOT_A_REPAIR = {"which", "type", "command", "whereis", "hash", "echo", "printf", "ls", "cat", "man",
+                 "file", "stat", "find", "fd", "rg", "grep", "sudo", "apt", "apt-get", "brew", "pip",
+                 "pip3", "pipx", "conda", "cargo", "go", "gem", "npm", "pnpm", "yarn"}
+_INSTALL_WORDS = {"install", "add", "i", "sync", "-v", "--version", "--help", "-h"}
+# A value under one of these names may be a credential: name the variable, never repeat its value.
+_SECRET_NAME = re.compile(r"KEY|TOKEN|SECRET|PASS|AUTH|CRED|PRIVATE|COOKIE|SESSION", re.I)
+_EXIT_CODE = re.compile(r"(?:Exit code:?|\"exit_code\":)\s*(-?\d+)")
+_ABS = re.compile(r"(?:^|\s)/(?:var|tmp|private|Users|home|root)/")
+
+
+@dataclass
+class _Run:
+    i: int
+    command: str
+    segments: list[list[str]]  # each shell segment, tokenized, env assignments kept as leading tokens
+    output: str
+    failed: bool
+
+
+def _command_of(a: Action) -> str | None:
+    if (a.name or "").lower() not in _SHELL_TOOLS or not isinstance(a.input, dict):
+        return None
+    c = a.input.get("command", a.input.get("cmd"))
+    if isinstance(c, list):  # codex: ["bash", "-lc", "<script>"] or argv
+        c = c[-1] if len(c) >= 3 and c[1] in ("-c", "-lc") else " ".join(map(str, c))
+    return c.strip() if isinstance(c, str) and c.strip() else None
+
+
+def _segments(command: str) -> list[list[str]]:
+    """Each command in a `&&`/`;` chain, tokenized; only the first stage of a pipeline is kept."""
+    out = []
+    for seg in _SEGMENT_SPLIT.split(command):
+        try:
+            toks = shlex.split(seg)
+        except ValueError:  # unbalanced quotes: a heredoc or a script, not one command
+            continue
+        toks = toks[:toks.index("|")] if "|" in toks else toks
+        if toks:
+            out.append(toks)
+    return out
+
+
+def _failed(a: Action) -> bool:
+    """Claude records an error status; Codex records none, so read the exit code off the output."""
+    if a.status == "error":
+        return True
+    m = _EXIT_CODE.search(a.output or "")
+    return bool(m and m.group(1) != "0")
+
+
+def _runs(trace: Trace) -> list[_Run]:
+    runs = []
+    for i, a in enumerate(trace.actions):
+        cmd = _command_of(a)
+        if cmd and "<<" not in cmd:  # a heredoc body isn't commands
+            runs.append(_Run(i, cmd, _segments(cmd.replace("\n", "; ")), a.output or "", _failed(a)))
+    return runs
+
+
+def _split_env(toks: list[str]) -> tuple[dict[str, str], list[str]]:
+    env, k = {}, 0
+    if toks and toks[0] in ("env", "export"):
+        k = 1
+        while k < len(toks) and toks[k].startswith("-"):  # env -i, env -u NAME
+            k += 2 if toks[k] in ("-u", "--unset", "-C", "--chdir", "-S") else 1
+    while k < len(toks) and (m := _ASSIGN.match(toks[k])):
+        env[m.group(1)] = m.group(2)
+        k += 1
+    return env, toks[k:]
+
+
+def _base(tok: str) -> str:
+    return tok.rsplit("/", 1)[-1]
+
+
+def _first(patterns, text: str) -> str | None:
+    for p in patterns:
+        if m := p.search(text):
+            return m.group(1)
+    return None
+
+
+def _render(toks: list[str], upto: int) -> str:
+    """A form as the fact shows it: its first words, then … for the rest."""
+    return "`" + shlex.join(toks[:upto]) + (" …" if len(toks) > upto else "") + "`"
+
+
+def _working_form(head: str, later: _Run) -> list[str] | None:
+    """The tokens a later, successful command runs `head` with, when it runs it another way: behind a
+    wrapper (`uv run pytest`, `python -m pytest`, `npx tsc`) or by a path (`.venv/bin/pytest`)."""
+    for seg in later.segments:
+        _, toks = _split_env(seg)
+        for j, t in enumerate(toks):
+            if _base(t) != head or (j == 0 and t == head):
+                continue
+            prefix = toks[:j]
+            if prefix and (_base(prefix[0]) in _NOT_A_REPAIR or _INSTALL_WORDS & set(prefix)):
+                break
+            form = toks[:j + 1]
+            return None if _ABS.search(" " + " ".join(form)) else form
+    return None
+
+
+def _installed_between(runs: list[_Run], a: _Run, b: _Run, name: str) -> bool:
+    """An install of `name` between the two runs makes the second work for a reason the fact won't
+    hold in the next session."""
+    for r in runs:
+        if a.i < r.i < b.i and name in r.command and _INSTALL_WORDS & set(r.command.split()):
+            return True
+    return False
+
+
+def _bare_works_later(runs: list[_Run], a: _Run, head: str) -> bool:
+    for r in runs:
+        if r.i > a.i and not r.failed and not _errs(r.output) and any(_split_env(s)[1][:1] == [head] for s in r.segments):
+            return True
+    return False
+
+
+def _errs(output: str) -> bool:
+    return any(_first(ps, output) for ps in (_CMD_MISSING, _MOD_MISSING, _ENV_MISSING))
+
+
+def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | None:
+    """The segment the error is about: the one running the missing command, else the last one that
+    isn't setup (`cd`, `source`, `export`)."""
+    runs = [_split_env(s) for s in seg_toks]
+    if missing_cmd:
+        return next((s for s, (_, t) in zip(seg_toks, runs) if t and _base(t[0]) == missing_cmd), None)
+    return next((s for s, (_, t) in reversed(list(zip(seg_toks, runs))) if t and t[0] not in _SETUP), None)
+
+
+def _env_fix(name: str, head: str, later: _Run) -> str | None:
+    """The later run that sets `name` and runs `head`, as the fact shows it."""
+    for env, toks in map(_split_env, later.segments):
+        if name in env and toks[:1] == [head]:
+            value = env[name]
+            # Never repeat a credential's value, or a host path, into shared memory.
+            if _SECRET_NAME.search(name) or _ABS.search(" " + value) or len(value) > 80:
+                return f"`{name}=… {head} …`"
+            return f"`{shlex.join([f'{name}={value}', head])} …`"
+    return None
+
+
+def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
+    """Repair pitfalls for one trace, and the indexes of the failed actions a repair explains."""
+    from .distill import ClaimDraft  # distill imports this module; import back at call time
+
+    runs = _runs(trace)
+    drafts: dict[str, ClaimDraft] = {}
+    explained: set[int] = set()
+    for a in runs:
+        # A piped run (`… | tail`) exits 0 with the error in its output, so the error text decides.
+        missing_cmd = _first(_CMD_MISSING, a.output)
+        missing_mod = None if missing_cmd else _first(_MOD_MISSING, a.output)
+        missing_env = None if missing_cmd or missing_mod else _first(_ENV_MISSING, a.output)
+        if not (missing_cmd or missing_mod or missing_env):
+            continue
+        seg = _target(a.segments, missing_cmd)
+        env, toks = _split_env(seg or [])
+        if not toks or "/" in toks[0] or not _WORD.match(head := toks[0]):
+            continue
+        if missing_cmd:
+            if _bare_works_later(runs, a, head):
+                continue  # it works bare later in the session: installed or PATH fixed, not a fact
+            subject, why = f"`{head}` is not on PATH", "fails here (command not found)"
+        elif missing_mod and _WORD.match(missing_mod):
+            subject, why = f"`{head}` can't import `{missing_mod}`", f"fails here (no module `{missing_mod}`)"
+        elif missing_env and missing_env not in env:
+            subject, why = f"`{head}` needs `{missing_env}` set", f"fails here asking for `{missing_env}`"
+        else:
+            continue
+        if subject not in drafts:
+            for b in (r for r in runs if r.i > a.i and not r.failed and not _errs(r.output)):
+                if missing_env:
+                    fix = _env_fix(missing_env, head, b)
+                elif (form := _working_form(head, b)) and not _installed_between(runs, a, b, missing_mod or head):
+                    fix = f"`{shlex.join(form)} …`"
+                else:
+                    fix = None
+                if fix:
+                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(toks, 2)} {why}; {fix} works.", 0.6)
+                    break
+        if subject in drafts:
+            explained.add(a.i)
+    return list(drafts.values()), explained
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
new file mode 100644
index 0000000..f310285
--- /dev/null
+++ b/tests/test_repairs.py
@@ -0,0 +1,122 @@
+"""Repair pitfalls: a failing shell form followed by one that works, mined without a model."""
+import unittest
+
+from kypp.distill import ClaimDraft, HeuristicDistiller, WithRepairs, build_trace
+from kypp.repairs import mine
+
+
+def _bash(command, output="", status="completed"):
+    return {"sessionId": "s1", "payload": {"type": "tool_call", "name": "Bash", "status": status,
+                                           "input": {"command": command}, "output": output}}
+
+
+def _codex(command, output):
+    return {"sessionId": "s1", "payload": {"type": "tool_call", "name": "shell", "status": "unspecified",
+                                           "input": {"command": ["bash", "-lc", command]}, "output": output}}
+
+
+def _mine(*events):
+    return mine(build_trace(list(events)))[0]
+
+
+class CommandMissing(unittest.TestCase):
+    def test_wrapper_that_works_becomes_one_pitfall(self):
+        [d] = _mine(_bash("pytest -q tests", "bash: line 1: pytest: command not found", "error"),
+                    _bash("uv run pytest -q tests", "3 passed"))
+        self.assertEqual((d.type, d.subject), ("pitfall", "`pytest` is not on PATH"))
+        self.assertIn("`pytest -q …` fails here (command not found)", d.content)
+        self.assertIn("`uv run pytest …` works", d.content)
+
+    def test_subject_names_only_what_failed_so_sessions_agree(self):
+        a = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("python -m pytest", "ok"))
+        b = _mine(_bash("pytest -x", "pytest: command not found", "error"), _bash(".venv/bin/pytest -x", "ok"))
+        self.assertEqual([d.subject for d in a], [d.subject for d in b])
+        self.assertIn("`.venv/bin/pytest …` works", b[0].content)
+
+    def test_codex_reads_failure_from_the_exit_code(self):
+        [d] = _mine(_codex("cd web && tsc --noEmit", "Exit code: 127\nOutput:\nbash: tsc: command not found"),
+                    _codex("cd web && npx tsc --noEmit", "Exit code: 0\nOutput:\n"))
+        self.assertEqual(d.subject, "`tsc` is not on PATH")
+        self.assertIn("`npx tsc …` works", d.content)
+
+    def test_codex_success_with_a_nonzero_exit_is_not_a_repair(self):
+        self.assertEqual(_mine(_codex("tsc", "Exit code: 127\nbash: tsc: command not found"),
+                               _codex("npx tsc", "Exit code: 2\nerror TS2304")), [])
+
+    def test_no_fact_when_the_bare_form_works_later(self):
+        self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
+                               _bash("uv run pytest", "ok"), _bash("pytest", "ok")), [])
+
+    def test_no_fact_when_it_was_installed_in_between(self):
+        self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
+                               _bash("uv pip install pytest", "ok"), _bash("python -m pytest", "ok")), [])
+
+    def test_probes_and_installs_are_not_repairs(self):
+        for later in ("which pytest", "pip install pytest", "uv add pytest", "pytest --version"):
+            self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
+                             [], later)
+
+    def test_a_host_path_form_is_not_a_fact(self):
+        self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
+                               _bash("/home/u/.venv/bin/pytest", "ok")), [])
+
+
+    def test_a_piped_run_fails_by_its_output(self):
+        [d] = _mine(_bash("pytest -q | tail -3", "bash: pytest: command not found"),
+                    _bash("env -u CI uv run pytest -q | tail -3", "3 passed"))
+        self.assertIn("`uv run pytest …` works", d.content)
+
+    def test_a_multiline_command_is_read_line_by_line(self):
+        [d] = _mine(_bash("cd web\ntsc", "tsc: command not found", "error"), _bash("cd web\nnpx tsc", "ok"))
+        self.assertEqual(d.subject, "`tsc` is not on PATH")
+
+
+class ModuleMissing(unittest.TestCase):
+    def test_interpreter_that_can_import_it(self):
+        [d] = _mine(_bash("python -m kypp.distill", "ModuleNotFoundError: No module named 'turso'", "error"),
+                    _bash("uv run python -m kypp.distill", "OK"))
+        self.assertEqual(d.subject, "`python` can't import `turso`")
+        self.assertIn("(no module `turso`)", d.content)
+        self.assertIn("`uv run python …` works", d.content)
+
+
+class EnvMissing(unittest.TestCase):
+    def test_setting_the_variable_works(self):
+        [d] = _mine(_bash("node build.js", "Error: API_BASE is not set", "error"),
+                    _bash("API_BASE=http://localhost:8787 node build.js", "built"))
+        self.assertEqual(d.subject, "`node` needs `API_BASE` set")
+        self.assertIn("asking for `API_BASE`; `API_BASE=http://localhost:8787 node …` works", d.content)
+
+    def test_a_credential_value_is_never_repeated(self):
+        [d] = _mine(_bash("python run.py", "KeyError: 'OPENAI_API_KEY'", "error"),
+                    _bash("OPENAI_API_KEY=sk-live-123 python run.py", "ok"))
+        self.assertNotIn("sk-live-123", d.content)
+        self.assertIn("`OPENAI_API_KEY=… python …`", d.content)
+
+
+class HeuristicFloor(unittest.TestCase):
+    def test_explained_failures_drop_the_generic_pitfall(self):
+        trace = build_trace([_bash("pytest", "pytest: command not found", "error"),
+                             _bash("pytest -x", "pytest: command not found", "error"),
+                             _bash("uv run pytest -x", "ok")])
+        self.assertEqual([d.subject for d in HeuristicDistiller().distill(trace)], ["`pytest` is not on PATH"])
+
+    def test_unexplained_failures_keep_it(self):
+        trace = build_trace([_bash("cargo build", "error[E0425]", "error"),
+                             _bash("cargo build", "error[E0425]", "error")])
+        self.assertEqual([d.subject for d in HeuristicDistiller().distill(trace)], ["Bash repeatedly failed"])
+
+    def test_llm_path_gets_repairs_without_duplicates(self):
+        class Inner:
+            def distill(self, _t):
+                return [ClaimDraft("pitfall", "`pytest` is not on PATH", "model's wording", 0.7)]
+        trace = build_trace([_bash("pytest", "pytest: command not found", "error"), _bash("uv run pytest", "ok")])
+        self.assertEqual([d.content for d in WithRepairs(Inner()).distill(trace)], ["model's wording"])
+        class Empty:
+            def distill(self, _t):
+                return []
+        self.assertEqual(len(WithRepairs(Empty()).distill(trace)), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

From 894aef62a9dd001d4e407802b8a4c0791ce3a86d Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:36:52 +0000
Subject: [PATCH 02/43] repairs: confirmed success, same invocation, redact
 values by default, reject probes

---
 docs/features/distill.md |  9 +++--
 kypp/repairs.py          | 81 +++++++++++++++++++++++++++-------------
 tests/test_repairs.py    | 45 +++++++++++++++++++++-
 3 files changed, 105 insertions(+), 30 deletions(-)

diff --git a/docs/features/distill.md b/docs/features/distill.md
index 02f4f30..4dfb7be 100644
--- a/docs/features/distill.md
+++ b/docs/features/distill.md
@@ -28,9 +28,12 @@ distiller runs when `KYPP_DISTILL_MODEL` is set (`claude`, `codex` or an ollama
   failed, so a second session's repair lands on the same subject and the K=2 gate accepts it; a
   one-session quirk stays a candidate. A repair suppresses the generic "`<tool>` repeatedly
   failed" pitfall for the failures it explains.
-- A repair is skipped when the bare form works later in the session, when the thing was installed
-  in between, or when the working form is a host path. A secret-looking env var's value is never
-  written.
+- A repair needs a later run with a confirmed success (Claude's `completed`, Codex's exit 0) that
+  runs the same thing: the same script or `-m module` for a missing module or env var. It is
+  skipped when the original works later without the fix, when the thing was installed in between,
+  when the later run only probes (`--version`, `--help`), or when the working form is a host path.
+- Values are written only for a short allowlist of env vars (`PYTHONPATH`, `NODE_ENV`, ...).
+  Every other `name=value` becomes `name=…`, and a URL's user:password is dropped.
 - If the LLM distiller fails, it falls back to the heuristic distiller rather than raising.
 - With `TYPESAFE_API_KEY` or `KYPP_DECIDER_URL` (a local strands-decider) set, and `kypp[s1]`
   installed, a System One gate drops drafts scoring
diff --git a/kypp/repairs.py b/kypp/repairs.py
index bd7415a..36c0d9a 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -48,8 +48,13 @@
                  "file", "stat", "find", "fd", "rg", "grep", "sudo", "apt", "apt-get", "brew", "pip",
                  "pip3", "pipx", "conda", "cargo", "go", "gem", "npm", "pnpm", "yarn"}
 _INSTALL_WORDS = {"install", "add", "i", "sync", "-v", "--version", "--help", "-h"}
-# A value under one of these names may be a credential: name the variable, never repeat its value.
-_SECRET_NAME = re.compile(r"KEY|TOKEN|SECRET|PASS|AUTH|CRED|PRIVATE|COOKIE|SESSION", re.I)
+# Arguments that only ask the command about itself: running it this way proves nothing works.
+_PROBE_ARGS = {"--version", "-V", "version", "--help", "-h", "help"}
+# Only these variables' values are written; any other value may be a credential (a DATABASE_URL
+# carries a password), so a fact names the variable and never repeats its value.
+_SAFE_ENV = {"PYTHONPATH", "NODE_ENV", "CI", "TZ", "LANG", "LC_ALL", "RUST_BACKTRACE", "RUST_LOG",
+             "DEBUG", "PORT", "HOST", "FORCE_COLOR", "NO_COLOR", "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE"}
+_USERINFO = re.compile(r"://[^/\s]*@")
 _EXIT_CODE = re.compile(r"(?:Exit code:?|\"exit_code\":)\s*(-?\d+)")
 _ABS = re.compile(r"(?:^|\s)/(?:var|tmp|private|Users|home|root)/")
 
@@ -60,7 +65,7 @@ class _Run:
     command: str
     segments: list[list[str]]  # each shell segment, tokenized, env assignments kept as leading tokens
     output: str
-    failed: bool
+    ok: bool  # confirmed to have succeeded; a run with no recorded outcome is neither
 
 
 def _command_of(a: Action) -> str | None:
@@ -86,12 +91,13 @@ def _segments(command: str) -> list[list[str]]:
     return out
 
 
-def _failed(a: Action) -> bool:
-    """Claude records an error status; Codex records none, so read the exit code off the output."""
-    if a.status == "error":
-        return True
+def _succeeded(a: Action) -> bool:
+    """Confirmed success. Claude records a status; Codex records none, so its exit code decides. A
+    run still `running`, or with no status and no exit code, can't prove a repair."""
     m = _EXIT_CODE.search(a.output or "")
-    return bool(m and m.group(1) != "0")
+    code = m.group(1) if m else None
+    failed = a.status == "error" or (code is not None and code != "0")
+    return not failed and (a.status == "completed" or code == "0") and not _errs(a.output or "")
 
 
 def _runs(trace: Trace) -> list[_Run]:
@@ -99,7 +105,7 @@ def _runs(trace: Trace) -> list[_Run]:
     for i, a in enumerate(trace.actions):
         cmd = _command_of(a)
         if cmd and "<<" not in cmd:  # a heredoc body isn't commands
-            runs.append(_Run(i, cmd, _segments(cmd.replace("\n", "; ")), a.output or "", _failed(a)))
+            runs.append(_Run(i, cmd, _segments(cmd.replace("\n", "; ")), a.output or "", _succeeded(a)))
     return runs
 
 
@@ -131,7 +137,25 @@ def _render(toks: list[str], upto: int) -> str:
     return "`" + shlex.join(toks[:upto]) + (" …" if len(toks) > upto else "") + "`"
 
 
-def _working_form(head: str, later: _Run) -> list[str] | None:
+def _invocation(toks: list[str]) -> list[str]:
+    """What a run of `toks[0]` runs: its script or `-m module`. A missing module or env var is about
+    that, so a repair must run the same thing; a missing command is about the command alone."""
+    return toks[1:3] if toks[1:2] == ["-m"] else toks[1:2]
+
+
+def _redact(form: list[str]) -> list[str]:
+    """Never repeat a credential into shared memory: any `name=value` (`K=V`, `-e K=V`, `--token=x`)
+    unless the name is known safe, and a URL's user:password."""
+    out = []
+    for t in form:
+        key, eq, _ = t.partition("=")
+        if eq and key not in _SAFE_ENV:
+            t = f"{key}=…"
+        out.append(_USERINFO.sub("://…@", t))
+    return out
+
+
+def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     """The tokens a later, successful command runs `head` with, when it runs it another way: behind a
     wrapper (`uv run pytest`, `python -m pytest`, `npx tsc`) or by a path (`.venv/bin/pytest`)."""
     for seg in later.segments:
@@ -139,11 +163,13 @@ def _working_form(head: str, later: _Run) -> list[str] | None:
         for j, t in enumerate(toks):
             if _base(t) != head or (j == 0 and t == head):
                 continue
-            prefix = toks[:j]
+            prefix, rest = toks[:j], toks[j + 1:]
             if prefix and (_base(prefix[0]) in _NOT_A_REPAIR or _INSTALL_WORDS & set(prefix)):
                 break
+            if (rest and set(rest) <= _PROBE_ARGS) or rest[:len(args)] != args:
+                break
             form = toks[:j + 1]
-            return None if _ABS.search(" " + " ".join(form)) else form
+            return None if _ABS.search(" " + " ".join(form)) else _redact(form)
     return None
 
 
@@ -156,10 +182,13 @@ def _installed_between(runs: list[_Run], a: _Run, b: _Run, name: str) -> bool:
     return False
 
 
-def _bare_works_later(runs: list[_Run], a: _Run, head: str) -> bool:
+def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], var: str | None) -> bool:
+    """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
-        if r.i > a.i and not r.failed and not _errs(r.output) and any(_split_env(s)[1][:1] == [head] for s in r.segments):
-            return True
+        if r.i > a.i and r.ok:
+            for env, toks in map(_split_env, r.segments):
+                if toks[:1] == [head] and toks[1:1 + len(args)] == args and (var is None or var not in env):
+                    return True
     return False
 
 
@@ -176,13 +205,12 @@ def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | N
     return next((s for s, (_, t) in reversed(list(zip(seg_toks, runs))) if t and t[0] not in _SETUP), None)
 
 
-def _env_fix(name: str, head: str, later: _Run) -> str | None:
-    """The later run that sets `name` and runs `head`, as the fact shows it."""
+def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
+    """The later run that sets `name` and runs the same thing, as the fact shows it."""
     for env, toks in map(_split_env, later.segments):
-        if name in env and toks[:1] == [head]:
+        if name in env and toks[:1] == [head] and toks[1:1 + len(args)] == args:
             value = env[name]
-            # Never repeat a credential's value, or a host path, into shared memory.
-            if _SECRET_NAME.search(name) or _ABS.search(" " + value) or len(value) > 80:
+            if name not in _SAFE_ENV or _ABS.search(" " + value) or len(value) > 80:
                 return f"`{name}=… {head} …`"
             return f"`{shlex.join([f'{name}={value}', head])} …`"
     return None
@@ -206,9 +234,10 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         env, toks = _split_env(seg or [])
         if not toks or "/" in toks[0] or not _WORD.match(head := toks[0]):
             continue
+        args = [] if missing_cmd else _invocation(toks)
+        if _works_unchanged_later(runs, a, head, args, missing_env):
+            continue
         if missing_cmd:
-            if _bare_works_later(runs, a, head):
-                continue  # it works bare later in the session: installed or PATH fixed, not a fact
             subject, why = f"`{head}` is not on PATH", "fails here (command not found)"
         elif missing_mod and _WORD.match(missing_mod):
             subject, why = f"`{head}` can't import `{missing_mod}`", f"fails here (no module `{missing_mod}`)"
@@ -217,15 +246,15 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         else:
             continue
         if subject not in drafts:
-            for b in (r for r in runs if r.i > a.i and not r.failed and not _errs(r.output)):
+            for b in (r for r in runs if r.i > a.i and r.ok):
                 if missing_env:
-                    fix = _env_fix(missing_env, head, b)
-                elif (form := _working_form(head, b)) and not _installed_between(runs, a, b, missing_mod or head):
+                    fix = _env_fix(missing_env, head, args, b)
+                elif (form := _working_form(head, args, b)) and not _installed_between(runs, a, b, missing_mod or head):
                     fix = f"`{shlex.join(form)} …`"
                 else:
                     fix = None
                 if fix:
-                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(toks, 2)} {why}; {fix} works.", 0.6)
+                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(_redact(toks), 2)} {why}; {fix} works.", 0.6)
                     break
         if subject in drafts:
             explained.add(a.i)
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index f310285..395d950 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -71,6 +71,24 @@ def test_a_multiline_command_is_read_line_by_line(self):
         self.assertEqual(d.subject, "`tsc` is not on PATH")
 
 
+    def test_probe_flags_after_the_command_are_not_repairs(self):
+        for later in ("uv run pytest --version", ".venv/bin/pytest --help"):
+            self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
+                             [], later)
+
+    def test_a_run_with_no_recorded_outcome_proves_nothing(self):
+        for status, out in (("running", ""), ("unspecified", ""), ("unspecified", "3 passed")):
+            self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
+                                   _bash("uv run pytest", out, status)), [], status)
+
+    def test_credentials_in_the_working_form_are_redacted(self):
+        [d] = _mine(_bash("pytest", "pytest: command not found", "error"),
+                    _bash("docker run -e OPENAI_API_KEY=sk-live-123 --token=abc img pytest -q", "ok"))
+        self.assertNotIn("sk-live-123", d.content)
+        self.assertNotIn("abc", d.content)
+        self.assertIn("OPENAI_API_KEY=…", d.content)
+
+
 class ModuleMissing(unittest.TestCase):
     def test_interpreter_that_can_import_it(self):
         [d] = _mine(_bash("python -m kypp.distill", "ModuleNotFoundError: No module named 'turso'", "error"),
@@ -80,12 +98,37 @@ def test_interpreter_that_can_import_it(self):
         self.assertIn("`uv run python …` works", d.content)
 
 
+    def test_the_later_run_must_run_the_same_thing(self):
+        for later in ("uv run python -c 'print(1)'", "uv run python unrelated.py", "uv run python -m other"):
+            self.assertEqual(_mine(_bash("python -m kypp.distill", "No module named 'turso'", "error"),
+                                   _bash(later, "ok")), [], later)
+
+    def test_no_fact_when_the_bare_form_works_later(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("uv run python app.py", "ok"), _bash("python app.py", "ok")), [])
+
+
 class EnvMissing(unittest.TestCase):
     def test_setting_the_variable_works(self):
         [d] = _mine(_bash("node build.js", "Error: API_BASE is not set", "error"),
                     _bash("API_BASE=http://localhost:8787 node build.js", "built"))
         self.assertEqual(d.subject, "`node` needs `API_BASE` set")
-        self.assertIn("asking for `API_BASE`; `API_BASE=http://localhost:8787 node …` works", d.content)
+        self.assertIn("asking for `API_BASE`; `API_BASE=… node …` works", d.content)
+
+    def test_only_known_safe_values_are_written(self):
+        [d] = _mine(_bash("python app.py", "DATABASE_URL is required", "error"),
+                    _bash("DATABASE_URL=postgresql://u:pw@h/db python app.py", "ok"))
+        self.assertNotIn("pw", d.content)
+        [d] = _mine(_bash("python -m app", "KeyError: 'PYTHONPATH'", "error"), _bash("PYTHONPATH=src python -m app", "ok"))
+        self.assertIn("`PYTHONPATH=src python …` works", d.content)
+
+    def test_the_later_run_must_run_the_same_script(self):
+        self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
+                               _bash("API_BASE=x node --version", "ok")), [])
+
+    def test_no_fact_when_it_works_later_without_the_variable(self):
+        self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
+                               _bash("API_BASE=x node build.js", "ok"), _bash("node build.js", "ok")), [])
 
     def test_a_credential_value_is_never_repeated(self):
         [d] = _mine(_bash("python run.py", "KeyError: 'OPENAI_API_KEY'", "error"),

From 83cad14c4399b6673df0a43dae7050f45b75f2ae Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:42:15 +0000
Subject: [PATCH 03/43] repairs: prove the fix segment ran, plain wrapper words
 only, skip inline code, no @ in values

---
 docs/features/distill.md |  9 ++++--
 kypp/repairs.py          | 64 ++++++++++++++++++++++++++++++----------
 tests/test_repairs.py    | 32 +++++++++++++++-----
 3 files changed, 78 insertions(+), 27 deletions(-)

diff --git a/docs/features/distill.md b/docs/features/distill.md
index 4dfb7be..eb49fbd 100644
--- a/docs/features/distill.md
+++ b/docs/features/distill.md
@@ -29,11 +29,14 @@ distiller runs when `KYPP_DISTILL_MODEL` is set (`claude`, `codex` or an ollama
   one-session quirk stays a candidate. A repair suppresses the generic "`<tool>` repeatedly
   failed" pitfall for the failures it explains.
 - A repair needs a later run with a confirmed success (Claude's `completed`, Codex's exit 0) that
-  runs the same thing: the same script or `-m module` for a missing module or env var. It is
+  runs the same thing: the same script or `-m module` for a missing module or env var (inline
+  `-c` code never counts). Only a segment followed by nothing but `&&`, outside any `||` or pipe,
+  counts as having succeeded, since a chain exits with its last command. It is
   skipped when the original works later without the fix, when the thing was installed in between,
   when the later run only probes (`--version`, `--help`), or when the working form is a host path.
-- Values are written only for a short allowlist of env vars (`PYTHONPATH`, `NODE_ENV`, ...).
-  Every other `name=value` becomes `name=…`, and a URL's user:password is dropped.
+- Values are written only for a short allowlist of env vars (`PYTHONPATH`, `NODE_ENV`, ...), and
+  never one with `@` in it. A fix's wrapper must be plain words (`uv run`, `python -m`, `npx`), so
+  flags and their values (`--token X`, `-e K=V`) never reach a claim.
 - If the LLM distiller fails, it falls back to the heuristic distiller rather than raising.
 - With `TYPESAFE_API_KEY` or `KYPP_DECIDER_URL` (a local strands-decider) set, and `kypp[s1]`
   installed, a System One gate drops drafts scoring
diff --git a/kypp/repairs.py b/kypp/repairs.py
index 36c0d9a..7123af2 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -44,7 +44,7 @@
     r"[Mm]issing (?:required )?(?:environment variable|env var) '?([A-Z][A-Z0-9_]{2,})'?",
 )]
 # A later command led by one of these is looking or installing, not running the thing another way.
-_NOT_A_REPAIR = {"which", "type", "command", "whereis", "hash", "echo", "printf", "ls", "cat", "man",
+_NOT_A_REPAIR = {"which", "type", "command", "test", "[", "whereis", "hash", "echo", "printf", "ls", "cat", "man",
                  "file", "stat", "find", "fd", "rg", "grep", "sudo", "apt", "apt-get", "brew", "pip",
                  "pip3", "pipx", "conda", "cargo", "go", "gem", "npm", "pnpm", "yarn"}
 _INSTALL_WORDS = {"install", "add", "i", "sync", "-v", "--version", "--help", "-h"}
@@ -55,6 +55,9 @@
 _SAFE_ENV = {"PYTHONPATH", "NODE_ENV", "CI", "TZ", "LANG", "LC_ALL", "RUST_BACKTRACE", "RUST_LOG",
              "DEBUG", "PORT", "HOST", "FORCE_COLOR", "NO_COLOR", "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE"}
 _USERINFO = re.compile(r"://[^/\s]*@")
+# A wrapper word in a recorded fix (`uv run`, `python -m`, `npx`): no flags or values, which could
+# carry a credential (`--token SECRET`, `-e KEY=…`).
+_PLAIN = re.compile(r"^(?:-m|[A-Za-z0-9._+][A-Za-z0-9._+/-]*)$")
 _EXIT_CODE = re.compile(r"(?:Exit code:?|\"exit_code\":)\s*(-?\d+)")
 _ABS = re.compile(r"(?:^|\s)/(?:var|tmp|private|Users|home|root)/")
 
@@ -64,6 +67,7 @@ class _Run:
     i: int
     command: str
     segments: list[list[str]]  # each shell segment, tokenized, env assignments kept as leading tokens
+    proven: list[list[str]]  # the segments the run's success proves ran and succeeded
     output: str
     ok: bool  # confirmed to have succeeded; a run with no recorded outcome is neither
 
@@ -77,20 +81,39 @@ def _command_of(a: Action) -> str | None:
     return c.strip() if isinstance(c, str) and c.strip() else None
 
 
+def _tokens(seg: str) -> list[str] | None:
+    try:
+        return shlex.split(seg)
+    except ValueError:  # unbalanced quotes: a heredoc or a script, not one command
+        return None
+
+
 def _segments(command: str) -> list[list[str]]:
-    """Each command in a `&&`/`;` chain, tokenized; only the first stage of a pipeline is kept."""
+    """Each command in a `&&`/`||`/`;` chain, tokenized; only the first stage of a pipeline is kept."""
     out = []
     for seg in _SEGMENT_SPLIT.split(command):
-        try:
-            toks = shlex.split(seg)
-        except ValueError:  # unbalanced quotes: a heredoc or a script, not one command
-            continue
+        toks = _tokens(seg) or []
         toks = toks[:toks.index("|")] if "|" in toks else toks
         if toks:
             out.append(toks)
     return out
 
 
+def _proven(command: str) -> list[list[str]]:
+    """The segments a successful run proves succeeded. A chain's exit status is its last command's,
+    so only a segment followed by nothing but `&&` counts; `||` may skip a segment, and a pipeline
+    exits with its last stage, so neither proves anything."""
+    if "||" in command:
+        return []
+    parts = re.split(r"\s*(&&|;)\s*", command)
+    out = []
+    for k in range(0, len(parts), 2):
+        toks = _tokens(parts[k])
+        if toks and "|" not in toks and all(sep == "&&" for sep in parts[k + 1::2]):
+            out.append(toks)
+    return out
+
+
 def _succeeded(a: Action) -> bool:
     """Confirmed success. Claude records a status; Codex records none, so its exit code decides. A
     run still `running`, or with no status and no exit code, can't prove a repair."""
@@ -105,7 +128,8 @@ def _runs(trace: Trace) -> list[_Run]:
     for i, a in enumerate(trace.actions):
         cmd = _command_of(a)
         if cmd and "<<" not in cmd:  # a heredoc body isn't commands
-            runs.append(_Run(i, cmd, _segments(cmd.replace("\n", "; ")), a.output or "", _succeeded(a)))
+            flat = cmd.replace("\n", "; ")
+            runs.append(_Run(i, cmd, _segments(flat), _proven(flat), a.output or "", _succeeded(a)))
     return runs
 
 
@@ -137,10 +161,14 @@ def _render(toks: list[str], upto: int) -> str:
     return "`" + shlex.join(toks[:upto]) + (" …" if len(toks) > upto else "") + "`"
 
 
-def _invocation(toks: list[str]) -> list[str]:
+def _invocation(toks: list[str]) -> list[str] | None:
     """What a run of `toks[0]` runs: its script or `-m module`. A missing module or env var is about
-    that, so a repair must run the same thing; a missing command is about the command alone."""
-    return toks[1:3] if toks[1:2] == ["-m"] else toks[1:2]
+    that, so a repair must run the same thing. Inline code (`-c`, `-e`) or flags ahead of the
+    script aren't compared, so those runs yield no repair (None)."""
+    rest = toks[1:]
+    if rest[:1] == ["-m"] and len(rest) >= 2:
+        return rest[:2]
+    return rest[:1] if rest and not rest[0].startswith("-") else None
 
 
 def _redact(form: list[str]) -> list[str]:
@@ -158,7 +186,7 @@ def _redact(form: list[str]) -> list[str]:
 def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     """The tokens a later, successful command runs `head` with, when it runs it another way: behind a
     wrapper (`uv run pytest`, `python -m pytest`, `npx tsc`) or by a path (`.venv/bin/pytest`)."""
-    for seg in later.segments:
+    for seg in later.proven:
         _, toks = _split_env(seg)
         for j, t in enumerate(toks):
             if _base(t) != head or (j == 0 and t == head):
@@ -168,8 +196,10 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
                 break
             if (rest and set(rest) <= _PROBE_ARGS) or rest[:len(args)] != args:
                 break
+            if len(prefix) > 3 or not all(_PLAIN.match(w) for w in prefix):
+                break
             form = toks[:j + 1]
-            return None if _ABS.search(" " + " ".join(form)) else _redact(form)
+            return None if _ABS.search(" " + " ".join(form)) else form
     return None
 
 
@@ -186,7 +216,7 @@ def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str]
     """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
         if r.i > a.i and r.ok:
-            for env, toks in map(_split_env, r.segments):
+            for env, toks in map(_split_env, r.proven):
                 if toks[:1] == [head] and toks[1:1 + len(args)] == args and (var is None or var not in env):
                     return True
     return False
@@ -207,10 +237,10 @@ def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | N
 
 def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
     """The later run that sets `name` and runs the same thing, as the fact shows it."""
-    for env, toks in map(_split_env, later.segments):
+    for env, toks in map(_split_env, later.proven):
         if name in env and toks[:1] == [head] and toks[1:1 + len(args)] == args:
             value = env[name]
-            if name not in _SAFE_ENV or _ABS.search(" " + value) or len(value) > 80:
+            if name not in _SAFE_ENV or _ABS.search(" " + value) or "@" in value or len(value) > 80:
                 return f"`{name}=… {head} …`"
             return f"`{shlex.join([f'{name}={value}', head])} …`"
     return None
@@ -235,6 +265,8 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         if not toks or "/" in toks[0] or not _WORD.match(head := toks[0]):
             continue
         args = [] if missing_cmd else _invocation(toks)
+        if args is None:
+            continue
         if _works_unchanged_later(runs, a, head, args, missing_env):
             continue
         if missing_cmd:
@@ -254,7 +286,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
                 else:
                     fix = None
                 if fix:
-                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(_redact(toks), 2)} {why}; {fix} works.", 0.6)
+                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(_redact(toks), 1 + len(args))} {why}; {fix} works.", 0.6)
                     break
         if subject in drafts:
             explained.add(a.i)
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 395d950..1a2ec75 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -24,7 +24,7 @@ def test_wrapper_that_works_becomes_one_pitfall(self):
         [d] = _mine(_bash("pytest -q tests", "bash: line 1: pytest: command not found", "error"),
                     _bash("uv run pytest -q tests", "3 passed"))
         self.assertEqual((d.type, d.subject), ("pitfall", "`pytest` is not on PATH"))
-        self.assertIn("`pytest -q …` fails here (command not found)", d.content)
+        self.assertIn("`pytest …` fails here (command not found)", d.content)
         self.assertIn("`uv run pytest …` works", d.content)
 
     def test_subject_names_only_what_failed_so_sessions_agree(self):
@@ -52,7 +52,8 @@ def test_no_fact_when_it_was_installed_in_between(self):
                                _bash("uv pip install pytest", "ok"), _bash("python -m pytest", "ok")), [])
 
     def test_probes_and_installs_are_not_repairs(self):
-        for later in ("which pytest", "pip install pytest", "uv add pytest", "pytest --version"):
+        for later in ("which pytest", "pip install pytest", "uv add pytest", "pytest --version",
+                      "test -x .venv/bin/pytest", "test .venv/bin/pytest", "ls .venv/bin/pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
                              [], later)
 
@@ -63,7 +64,14 @@ def test_a_host_path_form_is_not_a_fact(self):
 
     def test_a_piped_run_fails_by_its_output(self):
         [d] = _mine(_bash("pytest -q | tail -3", "bash: pytest: command not found"),
-                    _bash("env -u CI uv run pytest -q | tail -3", "3 passed"))
+                    _bash("env -u CI uv run pytest -q", "3 passed"))
+        self.assertIn("`uv run pytest …` works", d.content)
+
+    def test_success_proves_only_segments_it_ran(self):
+        for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3"):
+            self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
+                             [], later)
+        [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("cd x; uv run pytest && echo ok", "ok"))
         self.assertIn("`uv run pytest …` works", d.content)
 
     def test_a_multiline_command_is_read_line_by_line(self):
@@ -82,11 +90,12 @@ def test_a_run_with_no_recorded_outcome_proves_nothing(self):
                                    _bash("uv run pytest", out, status)), [], status)
 
     def test_credentials_in_the_working_form_are_redacted(self):
-        [d] = _mine(_bash("pytest", "pytest: command not found", "error"),
-                    _bash("docker run -e OPENAI_API_KEY=sk-live-123 --token=abc img pytest -q", "ok"))
-        self.assertNotIn("sk-live-123", d.content)
-        self.assertNotIn("abc", d.content)
-        self.assertIn("OPENAI_API_KEY=…", d.content)
+        for later in ("docker run -e OPENAI_API_KEY=sk-live-123 img pytest -q",
+                      "docker --config x run --token SECRET image pytest"):
+            self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
+                             [], later)
+        [d] = _mine(_bash("mycli --token=sk-1 sync", "mycli: command not found", "error"), _bash("npx mycli --token=sk-1", "ok"))
+        self.assertNotIn("sk-1", d.content)
 
 
 class ModuleMissing(unittest.TestCase):
@@ -103,6 +112,10 @@ def test_the_later_run_must_run_the_same_thing(self):
             self.assertEqual(_mine(_bash("python -m kypp.distill", "No module named 'turso'", "error"),
                                    _bash(later, "ok")), [], later)
 
+    def test_inline_code_is_not_compared_so_yields_nothing(self):
+        self.assertEqual(_mine(_bash("python -c 'import turso'", "No module named 'turso'", "error"),
+                               _bash("uv run python -c 'print(1)'", "ok")), [])
+
     def test_no_fact_when_the_bare_form_works_later(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv run python app.py", "ok"), _bash("python app.py", "ok")), [])
@@ -121,6 +134,9 @@ def test_only_known_safe_values_are_written(self):
         self.assertNotIn("pw", d.content)
         [d] = _mine(_bash("python -m app", "KeyError: 'PYTHONPATH'", "error"), _bash("PYTHONPATH=src python -m app", "ok"))
         self.assertIn("`PYTHONPATH=src python …` works", d.content)
+        [d] = _mine(_bash("python app.py", "HOST is required", "error"),
+                    _bash("HOST=https://u:pw@example.com python app.py", "ok"))
+        self.assertNotIn("pw", d.content)
 
     def test_the_later_run_must_run_the_same_script(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),

From d184772812be1f9aa0650ce551789e721d160c9a Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:46:16 +0000
Subject: [PATCH 04/43] repairs: attribute module/env errors only in
 single-command runs; skip fixes that set variables

---
 kypp/repairs.py       | 11 +++++++----
 tests/test_repairs.py |  8 ++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 7123af2..085bdf5 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -187,7 +187,9 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     """The tokens a later, successful command runs `head` with, when it runs it another way: behind a
     wrapper (`uv run pytest`, `python -m pytest`, `npx tsc`) or by a path (`.venv/bin/pytest`)."""
     for seg in later.proven:
-        _, toks = _split_env(seg)
+        env, toks = _split_env(seg)
+        if env:
+            continue  # the assignment may be what made it work, and the fix wouldn't say so
         for j, t in enumerate(toks):
             if _base(t) != head or (j == 0 and t == head):
                 continue
@@ -227,12 +229,13 @@ def _errs(output: str) -> bool:
 
 
 def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | None:
-    """The segment the error is about: the one running the missing command, else the last one that
-    isn't setup (`cd`, `source`, `export`)."""
+    """The segment the error is about: the one running the missing command, else the only one that
+    isn't setup (`cd`, `source`, `export`). With two, a module or env error can't be attributed."""
     runs = [_split_env(s) for s in seg_toks]
     if missing_cmd:
         return next((s for s, (_, t) in zip(seg_toks, runs) if t and _base(t[0]) == missing_cmd), None)
-    return next((s for s, (_, t) in reversed(list(zip(seg_toks, runs))) if t and t[0] not in _SETUP), None)
+    work = [s for s, (_, t) in zip(seg_toks, runs) if t and t[0] not in _SETUP]
+    return work[0] if len(work) == 1 else None
 
 
 def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 1a2ec75..ae7727b 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -112,6 +112,14 @@ def test_the_later_run_must_run_the_same_thing(self):
             self.assertEqual(_mine(_bash("python -m kypp.distill", "No module named 'turso'", "error"),
                                    _bash(later, "ok")), [], later)
 
+    def test_an_error_from_a_multi_command_run_is_not_attributed(self):
+        self.assertEqual(_mine(_bash("python app.py; node build.js", "No module named 'turso'", "error"),
+                               _bash("npx node build.js", "ok")), [])
+
+    def test_a_fix_that_also_sets_a_variable_is_not_recorded(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
+                               _bash("PYTHONPATH=src uv run python app.py", "ok")), [])
+
     def test_inline_code_is_not_compared_so_yields_nothing(self):
         self.assertEqual(_mine(_bash("python -c 'import turso'", "No module named 'turso'", "error"),
                                _bash("uv run python -c 'print(1)'", "ok")), [])

From 2ae4fa87e0e6d4edd946540954f211ddfcdf6743 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:48:08 +0000
Subject: [PATCH 05/43] repairs: allowlisted wrappers only, install inside the
 working run, compact pipes

---
 docs/features/distill.md |  5 +++--
 kypp/repairs.py          | 28 ++++++++++++++--------------
 tests/test_repairs.py    | 10 ++++++++--
 3 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/docs/features/distill.md b/docs/features/distill.md
index eb49fbd..f901b10 100644
--- a/docs/features/distill.md
+++ b/docs/features/distill.md
@@ -35,8 +35,9 @@ distiller runs when `KYPP_DISTILL_MODEL` is set (`claude`, `codex` or an ollama
   skipped when the original works later without the fix, when the thing was installed in between,
   when the later run only probes (`--version`, `--help`), or when the working form is a host path.
 - Values are written only for a short allowlist of env vars (`PYTHONPATH`, `NODE_ENV`, ...), and
-  never one with `@` in it. A fix's wrapper must be plain words (`uv run`, `python -m`, `npx`), so
-  flags and their values (`--token X`, `-e K=V`) never reach a claim.
+  never one with `@` in it. A fix runs the command by path or behind a known wrapper (`_WRAPPERS`:
+  `uv run`, `python -m`, `npx`, ...). Nothing else counts, so `touch pytest` isn't a fix, and flags
+  and their values (`--token X`, `-e K=V`) never reach a claim.
 - If the LLM distiller fails, it falls back to the heuristic distiller rather than raising.
 - With `TYPESAFE_API_KEY` or `KYPP_DECIDER_URL` (a local strands-decider) set, and `kypp[s1]`
   installed, a System One gate drops drafts scoring
diff --git a/kypp/repairs.py b/kypp/repairs.py
index 085bdf5..b3abb13 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -43,10 +43,13 @@
     r"(?:environment variable|env var)s? '?([A-Z][A-Z0-9_]{2,})'? (?:is )?(?:not set|unset|required|missing)",
     r"[Mm]issing (?:required )?(?:environment variable|env var) '?([A-Z][A-Z0-9_]{2,})'?",
 )]
-# A later command led by one of these is looking or installing, not running the thing another way.
-_NOT_A_REPAIR = {"which", "type", "command", "test", "[", "whereis", "hash", "echo", "printf", "ls", "cat", "man",
-                 "file", "stat", "find", "fd", "rg", "grep", "sudo", "apt", "apt-get", "brew", "pip",
-                 "pip3", "pipx", "conda", "cargo", "go", "gem", "npm", "pnpm", "yarn"}
+# The wrappers a fix may run the command behind (or none, with the command given by path). Any
+# other prefix (`which`, `touch`, `test -x`, `docker run -e K=V`) doesn't run it, or may carry a
+# credential.
+_WRAPPERS = {("uv", "run"), ("uvx",), ("poetry", "run"), ("pipenv", "run"), ("pdm", "run"),
+             ("hatch", "run"), ("rye", "run"), ("python", "-m"), ("python3", "-m"), ("npx",),
+             ("bunx",), ("bun", "x"), ("bun", "run"), ("pnpm", "exec"), ("pnpm", "dlx"),
+             ("npm", "exec"), ("yarn",), ("yarn", "exec"), ("bundle", "exec")}
 _INSTALL_WORDS = {"install", "add", "i", "sync", "-v", "--version", "--help", "-h"}
 # Arguments that only ask the command about itself: running it this way proves nothing works.
 _PROBE_ARGS = {"--version", "-V", "version", "--help", "-h", "help"}
@@ -55,9 +58,6 @@
 _SAFE_ENV = {"PYTHONPATH", "NODE_ENV", "CI", "TZ", "LANG", "LC_ALL", "RUST_BACKTRACE", "RUST_LOG",
              "DEBUG", "PORT", "HOST", "FORCE_COLOR", "NO_COLOR", "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE"}
 _USERINFO = re.compile(r"://[^/\s]*@")
-# A wrapper word in a recorded fix (`uv run`, `python -m`, `npx`): no flags or values, which could
-# carry a credential (`--token SECRET`, `-e KEY=…`).
-_PLAIN = re.compile(r"^(?:-m|[A-Za-z0-9._+][A-Za-z0-9._+/-]*)$")
 _EXIT_CODE = re.compile(r"(?:Exit code:?|\"exit_code\":)\s*(-?\d+)")
 _ABS = re.compile(r"(?:^|\s)/(?:var|tmp|private|Users|home|root)/")
 
@@ -82,8 +82,10 @@ def _command_of(a: Action) -> str | None:
 
 
 def _tokens(seg: str) -> list[str] | None:
+    lex = shlex.shlex(seg, posix=True, punctuation_chars=True)  # `|tail` is two tokens
+    lex.whitespace_split = True
     try:
-        return shlex.split(seg)
+        return list(lex)
     except ValueError:  # unbalanced quotes: a heredoc or a script, not one command
         return None
 
@@ -194,22 +196,20 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
             if _base(t) != head or (j == 0 and t == head):
                 continue
             prefix, rest = toks[:j], toks[j + 1:]
-            if prefix and (_base(prefix[0]) in _NOT_A_REPAIR or _INSTALL_WORDS & set(prefix)):
+            if prefix and (_base(prefix[0]), *prefix[1:]) not in _WRAPPERS:
                 break
             if (rest and set(rest) <= _PROBE_ARGS) or rest[:len(args)] != args:
                 break
-            if len(prefix) > 3 or not all(_PLAIN.match(w) for w in prefix):
-                break
             form = toks[:j + 1]
             return None if _ABS.search(" " + " ".join(form)) else form
     return None
 
 
 def _installed_between(runs: list[_Run], a: _Run, b: _Run, name: str) -> bool:
-    """An install of `name` between the two runs makes the second work for a reason the fact won't
-    hold in the next session."""
+    """An install of `name` after the failure, up to and including the run that worked, makes it work
+    for a reason the fact won't hold in the next session."""
     for r in runs:
-        if a.i < r.i < b.i and name in r.command and _INSTALL_WORDS & set(r.command.split()):
+        if a.i < r.i <= b.i and name in r.command and _INSTALL_WORDS & set(r.command.split()):
             return True
     return False
 
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index ae7727b..c36eea8 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -51,9 +51,14 @@ def test_no_fact_when_it_was_installed_in_between(self):
         self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
                                _bash("uv pip install pytest", "ok"), _bash("python -m pytest", "ok")), [])
 
+    def test_no_fact_when_the_working_run_installed_it_first(self):
+        self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
+                               _bash("uv pip install pytest && uv run pytest", "ok")), [])
+
     def test_probes_and_installs_are_not_repairs(self):
         for later in ("which pytest", "pip install pytest", "uv add pytest", "pytest --version",
-                      "test -x .venv/bin/pytest", "test .venv/bin/pytest", "ls .venv/bin/pytest"):
+                      "test -x .venv/bin/pytest", "test .venv/bin/pytest", "ls .venv/bin/pytest",
+                      "touch pytest", "true pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
                              [], later)
 
@@ -68,7 +73,8 @@ def test_a_piped_run_fails_by_its_output(self):
         self.assertIn("`uv run pytest …` works", d.content)
 
     def test_success_proves_only_segments_it_ran(self):
-        for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3"):
+        for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
+                      "uv run pytest |tail -3"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
                              [], later)
         [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("cd x; uv run pytest && echo ok", "ok"))

From e658633e546432f29d4db3988f1385791ecf8de3 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:50:20 +0000
Subject: [PATCH 06/43] repairs: background jobs prove nothing; probe flags
 reject with any args

---
 kypp/repairs.py       |  8 +++++---
 tests/test_repairs.py | 13 +++++++++++--
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index b3abb13..a9ef159 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -53,6 +53,7 @@
 _INSTALL_WORDS = {"install", "add", "i", "sync", "-v", "--version", "--help", "-h"}
 # Arguments that only ask the command about itself: running it this way proves nothing works.
 _PROBE_ARGS = {"--version", "-V", "version", "--help", "-h", "help"}
+_PROBE_FLAGS = {"--version", "-V", "--help", "-h"}  # with any other arguments it still only probes
 # Only these variables' values are written; any other value may be a credential (a DATABASE_URL
 # carries a password), so a fact names the variable and never repeats its value.
 _SAFE_ENV = {"PYTHONPATH", "NODE_ENV", "CI", "TZ", "LANG", "LC_ALL", "RUST_BACKTRACE", "RUST_LOG",
@@ -111,7 +112,8 @@ def _proven(command: str) -> list[list[str]]:
     out = []
     for k in range(0, len(parts), 2):
         toks = _tokens(parts[k])
-        if toks and "|" not in toks and all(sep == "&&" for sep in parts[k + 1::2]):
+        # A pipeline exits with its last stage and `&` with the launch, so neither proves the command.
+        if toks and "|" not in toks and "&" not in toks and all(sep == "&&" for sep in parts[k + 1::2]):
             out.append(toks)
     return out
 
@@ -198,7 +200,7 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
             prefix, rest = toks[:j], toks[j + 1:]
             if prefix and (_base(prefix[0]), *prefix[1:]) not in _WRAPPERS:
                 break
-            if (rest and set(rest) <= _PROBE_ARGS) or rest[:len(args)] != args:
+            if (rest and set(rest) <= _PROBE_ARGS) or _PROBE_FLAGS & set(rest) or rest[:len(args)] != args:
                 break
             form = toks[:j + 1]
             return None if _ABS.search(" " + " ".join(form)) else form
@@ -241,7 +243,7 @@ def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | N
 def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
     """The later run that sets `name` and runs the same thing, as the fact shows it."""
     for env, toks in map(_split_env, later.proven):
-        if name in env and toks[:1] == [head] and toks[1:1 + len(args)] == args:
+        if name in env and toks[:1] == [head] and toks[1:1 + len(args)] == args and not _PROBE_FLAGS & set(toks):
             value = env[name]
             if name not in _SAFE_ENV or _ABS.search(" " + value) or "@" in value or len(value) > 80:
                 return f"`{name}=… {head} …`"
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index c36eea8..b34c358 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -74,7 +74,7 @@ def test_a_piped_run_fails_by_its_output(self):
 
     def test_success_proves_only_segments_it_ran(self):
         for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
-                      "uv run pytest |tail -3"):
+                      "uv run pytest |tail -3", "uv run pytest >/tmp/log 2>&1 &"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
                              [], later)
         [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("cd x; uv run pytest && echo ok", "ok"))
@@ -86,7 +86,8 @@ def test_a_multiline_command_is_read_line_by_line(self):
 
 
     def test_probe_flags_after_the_command_are_not_repairs(self):
-        for later in ("uv run pytest --version", ".venv/bin/pytest --help"):
+        for later in ("uv run pytest --version", ".venv/bin/pytest --help", "uv run pytest --help tests",
+                      "python inspect_args.py pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
                              [], later)
 
@@ -126,6 +127,10 @@ def test_a_fix_that_also_sets_a_variable_is_not_recorded(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
                                _bash("PYTHONPATH=src uv run python app.py", "ok")), [])
 
+    def test_no_fact_when_the_working_run_installed_it_first(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("uv pip install turso && uv run python app.py", "ok")), [])
+
     def test_inline_code_is_not_compared_so_yields_nothing(self):
         self.assertEqual(_mine(_bash("python -c 'import turso'", "No module named 'turso'", "error"),
                                _bash("uv run python -c 'print(1)'", "ok")), [])
@@ -156,6 +161,10 @@ def test_the_later_run_must_run_the_same_script(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
                                _bash("API_BASE=x node --version", "ok")), [])
 
+    def test_a_probe_with_the_variable_set_is_not_a_fix(self):
+        self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
+                               _bash("API_BASE=x node build.js --help", "ok")), [])
+
     def test_no_fact_when_it_works_later_without_the_variable(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
                                _bash("API_BASE=x node build.js", "ok"), _bash("node build.js", "ok")), [])

From 0f0ac8c87a977cf6d4e0e762cf3fd8b21dbd0a8a Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:53:03 +0000
Subject: [PATCH 07/43] repairs: read Codex's 'Process exited with code N'

---
 kypp/repairs.py       | 2 +-
 tests/test_repairs.py | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index a9ef159..f0845ad 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -59,7 +59,7 @@
 _SAFE_ENV = {"PYTHONPATH", "NODE_ENV", "CI", "TZ", "LANG", "LC_ALL", "RUST_BACKTRACE", "RUST_LOG",
              "DEBUG", "PORT", "HOST", "FORCE_COLOR", "NO_COLOR", "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE"}
 _USERINFO = re.compile(r"://[^/\s]*@")
-_EXIT_CODE = re.compile(r"(?:Exit code:?|\"exit_code\":)\s*(-?\d+)")
+_EXIT_CODE = re.compile(r"(?:Exit code:?|\"exit_code\":|Process exited with code)\s*(-?\d+)")
 _ABS = re.compile(r"(?:^|\s)/(?:var|tmp|private|Users|home|root)/")
 
 
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index b34c358..8b9b89c 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -39,6 +39,11 @@ def test_codex_reads_failure_from_the_exit_code(self):
         self.assertEqual(d.subject, "`tsc` is not on PATH")
         self.assertIn("`npx tsc …` works", d.content)
 
+    def test_codex_exec_command_exit_format(self):
+        [d] = _mine(_codex("pytest", "Process exited with code 127\nbash: pytest: command not found"),
+                    _codex("uv run pytest", "Process exited with code 0\n3 passed"))
+        self.assertEqual(d.subject, "`pytest` is not on PATH")
+
     def test_codex_success_with_a_nonzero_exit_is_not_a_repair(self):
         self.assertEqual(_mine(_codex("tsc", "Exit code: 127\nbash: tsc: command not found"),
                                _codex("npx tsc", "Exit code: 2\nerror TS2304")), [])
@@ -114,6 +119,10 @@ def test_interpreter_that_can_import_it(self):
         self.assertIn("`uv run python …` works", d.content)
 
 
+    def test_a_script_help_probe_is_not_a_fix(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("uv run python app.py --help", "ok")), [])
+
     def test_the_later_run_must_run_the_same_thing(self):
         for later in ("uv run python -c 'print(1)'", "uv run python unrelated.py", "uv run python -m other"):
             self.assertEqual(_mine(_bash("python -m kypp.distill", "No module named 'turso'", "error"),

From f0a79646fe24be09c4fefa0ef4c82edd44ef2022 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:54:40 +0000
Subject: [PATCH 08/43] repairs: pair a script only with a run from the same
 directory

---
 kypp/repairs.py       | 9 +++++++--
 tests/test_repairs.py | 7 +++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index f0845ad..b73bc71 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -71,6 +71,7 @@ class _Run:
     proven: list[list[str]]  # the segments the run's success proves ran and succeeded
     output: str
     ok: bool  # confirmed to have succeeded; a run with no recorded outcome is neither
+    where: tuple  # the tool's workdir and every `cd` target: a script name means nothing without it
 
 
 def _command_of(a: Action) -> str | None:
@@ -133,7 +134,10 @@ def _runs(trace: Trace) -> list[_Run]:
         cmd = _command_of(a)
         if cmd and "<<" not in cmd:  # a heredoc body isn't commands
             flat = cmd.replace("\n", "; ")
-            runs.append(_Run(i, cmd, _segments(flat), _proven(flat), a.output or "", _succeeded(a)))
+            segs = _segments(flat)
+            where = (str(a.input.get("workdir") or a.input.get("cwd") or ""),
+                     *(" ".join(t[1:]) for t in segs if t[0] in ("cd", "pushd")))
+            runs.append(_Run(i, cmd, segs, _proven(flat), a.output or "", _succeeded(a), where))
     return runs
 
 
@@ -283,7 +287,8 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         else:
             continue
         if subject not in drafts:
-            for b in (r for r in runs if r.i > a.i and r.ok):
+            # A script or module is only the same one run from the same place.
+            for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or r.where == a.where)):
                 if missing_env:
                     fix = _env_fix(missing_env, head, args, b)
                 elif (form := _working_form(head, args, b)) and not _installed_between(runs, a, b, missing_mod or head):
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 8b9b89c..dbcf6f4 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -119,6 +119,13 @@ def test_interpreter_that_can_import_it(self):
         self.assertIn("`uv run python …` works", d.content)
 
 
+    def test_the_same_script_name_elsewhere_is_not_the_same_script(self):
+        self.assertEqual(_mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
+                               _bash("cd client && uv run python app.py", "ok")), [])
+        [d] = _mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
+                    _bash("cd server && uv run python app.py", "ok"))
+        self.assertIn("`uv run python …` works", d.content)
+
     def test_a_script_help_probe_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv run python app.py --help", "ok")), [])

From 2f7db34859e5fb9aa54bf7c673853cd1cee54d35 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:56:49 +0000
Subject: [PATCH 09/43] repairs: split shell operators outside quotes; env
 flags count as a change

---
 kypp/repairs.py       | 57 +++++++++++++++++++++++--------------------
 tests/test_repairs.py |  5 ++--
 2 files changed, 33 insertions(+), 29 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index b73bc71..24f8466 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -23,7 +23,7 @@
 # Shell tools as each harness names them (Claude: Bash; Codex: shell / exec_command; pillbox: bash).
 _SHELL_TOOLS = {"bash", "shell", "exec_command", "local_shell", "run_shell_command"}
 
-_SEGMENT_SPLIT = re.compile(r"\s*(?:&&|\|\||;)\s*")  # a pipe stays inside its segment
+_OPS = {";", "&&", "||", "|", "&"}
 _SETUP = {"cd", "source", ".", "export", "set", "pushd", "unset"}
 _ASSIGN = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)=(.*)$", re.S)
 _WORD = re.compile(r"^[A-Za-z0-9._+-]{1,64}$")  # a command or module name we're willing to quote
@@ -83,40 +83,41 @@ def _command_of(a: Action) -> str | None:
     return c.strip() if isinstance(c, str) and c.strip() else None
 
 
-def _tokens(seg: str) -> list[str] | None:
-    lex = shlex.shlex(seg, posix=True, punctuation_chars=True)  # `|tail` is two tokens
+def _chain(command: str) -> list[tuple[list[str], str, str]]:
+    """The command's segments as (tokens, operator before, operator after), split on shell operators
+    outside quotes (`echo 'a; b'` is one segment, `|tail` two tokens). Unbalanced quotes (a heredoc
+    or a script, not one command) yield nothing."""
+    lex = shlex.shlex(command, posix=True, punctuation_chars=True)
     lex.whitespace_split = True
     try:
-        return list(lex)
-    except ValueError:  # unbalanced quotes: a heredoc or a script, not one command
-        return None
+        toks = list(lex)
+    except ValueError:
+        return []
+    out, cur, before = [], [], ""
+    for t in toks + [""]:
+        if t in _OPS or t == "":
+            if cur:
+                out.append((cur, before, t))
+            cur, before = [], t
+        else:
+            cur.append(t)
+    return out
 
 
 def _segments(command: str) -> list[list[str]]:
-    """Each command in a `&&`/`||`/`;` chain, tokenized; only the first stage of a pipeline is kept."""
-    out = []
-    for seg in _SEGMENT_SPLIT.split(command):
-        toks = _tokens(seg) or []
-        toks = toks[:toks.index("|")] if "|" in toks else toks
-        if toks:
-            out.append(toks)
-    return out
+    """Each command in the chain, tokenized; only the first stage of a pipeline is kept."""
+    return [toks for toks, before, _ in _chain(command) if before != "|"]
 
 
 def _proven(command: str) -> list[list[str]]:
     """The segments a successful run proves succeeded. A chain's exit status is its last command's,
-    so only a segment followed by nothing but `&&` counts; `||` may skip a segment, and a pipeline
-    exits with its last stage, so neither proves anything."""
-    if "||" in command:
+    so only a segment followed by nothing but `&&` counts; `||` may skip a segment, a pipeline exits
+    with its last stage, and `&` with the launch, so none of those prove anything."""
+    chain = _chain(command)
+    if any(before == "||" or after == "||" for _, before, after in chain):
         return []
-    parts = re.split(r"\s*(&&|;)\s*", command)
-    out = []
-    for k in range(0, len(parts), 2):
-        toks = _tokens(parts[k])
-        # A pipeline exits with its last stage and `&` with the launch, so neither proves the command.
-        if toks and "|" not in toks and "&" not in toks and all(sep == "&&" for sep in parts[k + 1::2]):
-            out.append(toks)
-    return out
+    return [toks for k, (toks, before, after) in enumerate(chain)
+            if before not in ("|", "&") and all(a in ("&&", "") for _, _, a in chain[k:])]
 
 
 def _succeeded(a: Action) -> bool:
@@ -145,8 +146,10 @@ def _split_env(toks: list[str]) -> tuple[dict[str, str], list[str]]:
     env, k = {}, 0
     if toks and toks[0] in ("env", "export"):
         k = 1
-        while k < len(toks) and toks[k].startswith("-"):  # env -i, env -u NAME
-            k += 2 if toks[k] in ("-u", "--unset", "-C", "--chdir", "-S") else 1
+        while k < len(toks) and toks[k].startswith("-"):  # env -i, env -u NAME: a change, kept as one
+            n = 2 if toks[k] in ("-u", "--unset", "-C", "--chdir", "-S") else 1
+            env[" ".join(toks[k:k + n])] = ""
+            k += n
     while k < len(toks) and (m := _ASSIGN.match(toks[k])):
         env[m.group(1)] = m.group(2)
         k += 1
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index dbcf6f4..50216d3 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -74,12 +74,13 @@ def test_a_host_path_form_is_not_a_fact(self):
 
     def test_a_piped_run_fails_by_its_output(self):
         [d] = _mine(_bash("pytest -q | tail -3", "bash: pytest: command not found"),
-                    _bash("env -u CI uv run pytest -q", "3 passed"))
+                    _bash("uv run pytest -q", "3 passed"))
         self.assertIn("`uv run pytest …` works", d.content)
 
     def test_success_proves_only_segments_it_ran(self):
         for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
-                      "uv run pytest |tail -3", "uv run pytest >/tmp/log 2>&1 &"):
+                      "uv run pytest |tail -3", "uv run pytest >/tmp/log 2>&1 &",
+                      "echo 'example; uv run pytest && end'", "env -u PYTHONPATH uv run pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
                              [], later)
         [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("cd x; uv run pytest && echo ok", "ok"))

From 7c416f9dad5e66ae160ac4b76a780890561abfe9 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 03:59:06 +0000
Subject: [PATCH 10/43] repairs: any setup or install in the working run
 disqualifies it; compare place before suppressing

---
 kypp/repairs.py       | 27 +++++++++++++--------------
 tests/test_repairs.py | 13 ++++++++++---
 2 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 24f8466..720efbd 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -197,10 +197,11 @@ def _redact(form: list[str]) -> list[str]:
 def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     """The tokens a later, successful command runs `head` with, when it runs it another way: behind a
     wrapper (`uv run pytest`, `python -m pytest`, `npx tsc`) or by a path (`.venv/bin/pytest`)."""
+    # An assignment or `export` anywhere in the run may be what made it work, and the fix wouldn't say so.
+    if any(_split_env(seg)[0] or seg[0] in ("export", "set", "source", ".") for seg in later.segments):
+        return None
     for seg in later.proven:
-        env, toks = _split_env(seg)
-        if env:
-            continue  # the assignment may be what made it work, and the fix wouldn't say so
+        _, toks = _split_env(seg)
         for j, t in enumerate(toks):
             if _base(t) != head or (j == 0 and t == head):
                 continue
@@ -214,19 +215,17 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     return None
 
 
-def _installed_between(runs: list[_Run], a: _Run, b: _Run, name: str) -> bool:
-    """An install of `name` after the failure, up to and including the run that worked, makes it work
-    for a reason the fact won't hold in the next session."""
-    for r in runs:
-        if a.i < r.i <= b.i and name in r.command and _INSTALL_WORDS & set(r.command.split()):
-            return True
-    return False
+def _installed_between(runs: list[_Run], a: _Run, b: _Run) -> bool:
+    """Any install or sync after the failure, up to and including the run that worked (`uv sync` and
+    `pip install -r` don't name what they install), may be why it worked: the fact won't hold."""
+    return any(a.i < r.i <= b.i and _INSTALL_WORDS & set(r.command.split()) for r in runs)
 
 
-def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], var: str | None) -> bool:
+def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], var: str | None,
+                           same_place: bool) -> bool:
     """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
-        if r.i > a.i and r.ok:
+        if r.i > a.i and r.ok and (not same_place or r.where == a.where):
             for env, toks in map(_split_env, r.proven):
                 if toks[:1] == [head] and toks[1:1 + len(args)] == args and (var is None or var not in env):
                     return True
@@ -279,7 +278,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         args = [] if missing_cmd else _invocation(toks)
         if args is None:
             continue
-        if _works_unchanged_later(runs, a, head, args, missing_env):
+        if _works_unchanged_later(runs, a, head, args, missing_env, same_place=not missing_cmd):
             continue
         if missing_cmd:
             subject, why = f"`{head}` is not on PATH", "fails here (command not found)"
@@ -294,7 +293,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
             for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or r.where == a.where)):
                 if missing_env:
                     fix = _env_fix(missing_env, head, args, b)
-                elif (form := _working_form(head, args, b)) and not _installed_between(runs, a, b, missing_mod or head):
+                elif (form := _working_form(head, args, b)) and not _installed_between(runs, a, b):
                     fix = f"`{shlex.join(form)} …`"
                 else:
                     fix = None
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 50216d3..5245760 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -124,7 +124,7 @@ def test_the_same_script_name_elsewhere_is_not_the_same_script(self):
         self.assertEqual(_mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
                                _bash("cd client && uv run python app.py", "ok")), [])
         [d] = _mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
-                    _bash("cd server && uv run python app.py", "ok"))
+                    _bash("cd server && uv run python app.py", "ok"), _bash("cd client && python app.py", "ok"))
         self.assertIn("`uv run python …` works", d.content)
 
     def test_a_script_help_probe_is_not_a_fix(self):
@@ -141,8 +141,15 @@ def test_an_error_from_a_multi_command_run_is_not_attributed(self):
                                _bash("npx node build.js", "ok")), [])
 
     def test_a_fix_that_also_sets_a_variable_is_not_recorded(self):
-        self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
-                               _bash("PYTHONPATH=src uv run python app.py", "ok")), [])
+        for later in ("PYTHONPATH=src uv run python app.py", "export PYTHONPATH=src && uv run python app.py",
+                      "env -C other uv run python app.py"):
+            self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
+                                   _bash(later, "ok")), [], later)
+
+    def test_a_sync_or_bulk_install_in_between_explains_it(self):
+        for between in ("uv sync", "pip install -r requirements.txt"):
+            self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), _bash(between, "ok"),
+                                   _bash("uv run python app.py", "ok")), [], between)
 
     def test_no_fact_when_the_working_run_installed_it_first(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),

From 8e01e90c00ee4321f0d2d7a92418cffda5504ff8 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:00:16 +0000
Subject: [PATCH 11/43] repairs: only install/add/sync count as installs, not
 -v

---
 kypp/repairs.py       | 4 ++--
 tests/test_repairs.py | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 720efbd..df163fb 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -50,7 +50,7 @@
              ("hatch", "run"), ("rye", "run"), ("python", "-m"), ("python3", "-m"), ("npx",),
              ("bunx",), ("bun", "x"), ("bun", "run"), ("pnpm", "exec"), ("pnpm", "dlx"),
              ("npm", "exec"), ("yarn",), ("yarn", "exec"), ("bundle", "exec")}
-_INSTALL_WORDS = {"install", "add", "i", "sync", "-v", "--version", "--help", "-h"}
+_INSTALLS = {"install", "add", "i", "sync"}  # a run with one of these may have installed anything
 # Arguments that only ask the command about itself: running it this way proves nothing works.
 _PROBE_ARGS = {"--version", "-V", "version", "--help", "-h", "help"}
 _PROBE_FLAGS = {"--version", "-V", "--help", "-h"}  # with any other arguments it still only probes
@@ -218,7 +218,7 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
 def _installed_between(runs: list[_Run], a: _Run, b: _Run) -> bool:
     """Any install or sync after the failure, up to and including the run that worked (`uv sync` and
     `pip install -r` don't name what they install), may be why it worked: the fact won't hold."""
-    return any(a.i < r.i <= b.i and _INSTALL_WORDS & set(r.command.split()) for r in runs)
+    return any(a.i < r.i <= b.i and _INSTALLS & set(r.command.split()) for r in runs)
 
 
 def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], var: str | None,
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 5245760..b915dda 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -77,6 +77,10 @@ def test_a_piped_run_fails_by_its_output(self):
                     _bash("uv run pytest -q", "3 passed"))
         self.assertIn("`uv run pytest …` works", d.content)
 
+    def test_flags_on_the_working_run_are_not_installs(self):
+        [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("uv run pytest -v", "ok"))
+        self.assertIn("`uv run pytest …` works", d.content)
+
     def test_success_proves_only_segments_it_ran(self):
         for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
                       "uv run pytest |tail -3", "uv run pytest >/tmp/log 2>&1 &",

From 86c3a5cffb8703ab8ed81cb34cd686b5ba6b0800 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:01:47 +0000
Subject: [PATCH 12/43] repairs: unchanged means no env change; an env fix sets
 only the missing variable

---
 kypp/repairs.py       | 9 ++++-----
 tests/test_repairs.py | 9 +++++++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index df163fb..d85106e 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -221,13 +221,12 @@ def _installed_between(runs: list[_Run], a: _Run, b: _Run) -> bool:
     return any(a.i < r.i <= b.i and _INSTALLS & set(r.command.split()) for r in runs)
 
 
-def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], var: str | None,
-                           same_place: bool) -> bool:
+def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], same_place: bool) -> bool:
     """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
         if r.i > a.i and r.ok and (not same_place or r.where == a.where):
             for env, toks in map(_split_env, r.proven):
-                if toks[:1] == [head] and toks[1:1 + len(args)] == args and (var is None or var not in env):
+                if toks[:1] == [head] and toks[1:1 + len(args)] == args and not env:  # unchanged: no env either
                     return True
     return False
 
@@ -249,7 +248,7 @@ def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | N
 def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
     """The later run that sets `name` and runs the same thing, as the fact shows it."""
     for env, toks in map(_split_env, later.proven):
-        if name in env and toks[:1] == [head] and toks[1:1 + len(args)] == args and not _PROBE_FLAGS & set(toks):
+        if set(env) == {name} and toks[:1] == [head] and toks[1:1 + len(args)] == args and not _PROBE_FLAGS & set(toks):
             value = env[name]
             if name not in _SAFE_ENV or _ABS.search(" " + value) or "@" in value or len(value) > 80:
                 return f"`{name}=… {head} …`"
@@ -278,7 +277,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         args = [] if missing_cmd else _invocation(toks)
         if args is None:
             continue
-        if _works_unchanged_later(runs, a, head, args, missing_env, same_place=not missing_cmd):
+        if _works_unchanged_later(runs, a, head, args, same_place=not missing_cmd):
             continue
         if missing_cmd:
             subject, why = f"`{head}` is not on PATH", "fails here (command not found)"
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index b915dda..3a1fd88 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -193,6 +193,15 @@ def test_a_probe_with_the_variable_set_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
                                _bash("API_BASE=x node build.js --help", "ok")), [])
 
+    def test_a_fix_with_other_variables_too_is_not_recorded(self):
+        self.assertEqual(_mine(_bash("python app.py", "API_BASE is not set", "error"),
+                               _bash("API_BASE=x PYTHONPATH=src python app.py", "ok")), [])
+
+    def test_a_later_run_with_its_own_env_change_is_not_unchanged(self):
+        [d] = _mine(_bash("python app.py", "No module named 'project'", "error"),
+                    _bash("uv run python app.py", "ok"), _bash("PYTHONPATH=src python app.py", "ok"))
+        self.assertIn("`uv run python …` works", d.content)
+
     def test_no_fact_when_it_works_later_without_the_variable(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
                                _bash("API_BASE=x node build.js", "ok"), _bash("node build.js", "ok")), [])

From 084ba9e489b28bd935a80bb9f9a71c905a51e0ee Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:06:37 +0000
Subject: [PATCH 13/43] repairs: quoted or escaped operators are arguments;
 probes don't prove an unchanged run works

---
 kypp/repairs.py       | 39 ++++++++++++++++++++++++++++++++++-----
 tests/test_repairs.py | 13 ++++++++++++-
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index d85106e..47314a8 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -83,11 +83,34 @@ def _command_of(a: Action) -> str | None:
     return c.strip() if isinstance(c, str) and c.strip() else None
 
 
+_MASK = {c: chr(0xE000 + i) for i, c in enumerate(";&|")}
+_UNMASK = str.maketrans({v: k for k, v in _MASK.items()})
+
+
+def _mask(command: str) -> str:
+    """The command with quoted or escaped `;`, `&` and `|` swapped for placeholders, so the lexer,
+    which drops quotes before it splits, never reads a printed `';'` as an operator."""
+    out, quote, esc = [], "", False
+    for c in command:
+        if esc:
+            out.append(_MASK.get(c, c))
+            esc = False
+            continue
+        if c == "\\" and quote != "'":
+            esc = True
+        elif c in "'\"" and quote in ("", c):
+            quote = "" if quote else c
+        elif quote and c in _MASK:
+            c = _MASK[c]
+        out.append(c)
+    return "".join(out)
+
+
 def _chain(command: str) -> list[tuple[list[str], str, str]]:
     """The command's segments as (tokens, operator before, operator after), split on shell operators
     outside quotes (`echo 'a; b'` is one segment, `|tail` two tokens). Unbalanced quotes (a heredoc
     or a script, not one command) yield nothing."""
-    lex = shlex.shlex(command, posix=True, punctuation_chars=True)
+    lex = shlex.shlex(_mask(command), posix=True, punctuation_chars=True)
     lex.whitespace_split = True
     try:
         toks = list(lex)
@@ -100,7 +123,7 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
                 out.append((cur, before, t))
             cur, before = [], t
         else:
-            cur.append(t)
+            cur.append(t.translate(_UNMASK))
     return out
 
 
@@ -208,7 +231,7 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
             prefix, rest = toks[:j], toks[j + 1:]
             if prefix and (_base(prefix[0]), *prefix[1:]) not in _WRAPPERS:
                 break
-            if (rest and set(rest) <= _PROBE_ARGS) or _PROBE_FLAGS & set(rest) or rest[:len(args)] != args:
+            if _probes(rest) or rest[:len(args)] != args:
                 break
             form = toks[:j + 1]
             return None if _ABS.search(" " + " ".join(form)) else form
@@ -221,12 +244,18 @@ def _installed_between(runs: list[_Run], a: _Run, b: _Run) -> bool:
     return any(a.i < r.i <= b.i and _INSTALLS & set(r.command.split()) for r in runs)
 
 
+def _probes(args: list[str]) -> bool:
+    """The arguments only ask for a version or help, which can work while the real run can't."""
+    return bool(args) and set(args) <= _PROBE_ARGS or bool(_PROBE_FLAGS & set(args))
+
+
 def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], same_place: bool) -> bool:
     """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
         if r.i > a.i and r.ok and (not same_place or r.where == a.where):
             for env, toks in map(_split_env, r.proven):
-                if toks[:1] == [head] and toks[1:1 + len(args)] == args and not env:  # unchanged: no env either
+                # unchanged: no env either, and a probe (`--help`) doesn't prove the real run works
+                if toks[:1] == [head] and toks[1:1 + len(args)] == args and not env and not _probes(toks[1:]):
                     return True
     return False
 
@@ -248,7 +277,7 @@ def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | N
 def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
     """The later run that sets `name` and runs the same thing, as the fact shows it."""
     for env, toks in map(_split_env, later.proven):
-        if set(env) == {name} and toks[:1] == [head] and toks[1:1 + len(args)] == args and not _PROBE_FLAGS & set(toks):
+        if set(env) == {name} and toks[:1] == [head] and toks[1:1 + len(args)] == args and not _probes(toks[1:]):
             value = env[name]
             if name not in _SAFE_ENV or _ABS.search(" " + value) or "@" in value or len(value) > 80:
                 return f"`{name}=… {head} …`"
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 3a1fd88..596d9bb 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -84,7 +84,8 @@ def test_flags_on_the_working_run_are_not_installs(self):
     def test_success_proves_only_segments_it_ran(self):
         for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
                       "uv run pytest |tail -3", "uv run pytest >/tmp/log 2>&1 &",
-                      "echo 'example; uv run pytest && end'", "env -u PYTHONPATH uv run pytest"):
+                      "echo 'example; uv run pytest && end'", "env -u PYTHONPATH uv run pytest",
+                      "echo ';' uv run pytest", 'echo "a|b" uv run pytest', "echo \\; uv run pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
                              [], later)
         [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("cd x; uv run pytest && echo ok", "ok"))
@@ -167,8 +168,18 @@ def test_no_fact_when_the_bare_form_works_later(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv run python app.py", "ok"), _bash("python app.py", "ok")), [])
 
+    def test_a_later_help_probe_does_not_count_as_working_bare(self):
+        [d] = _mine(_bash("python app.py", "No module named 'turso'", "error"),
+                    _bash("uv run python app.py", "ok"), _bash("python app.py --help", "usage: app"))
+        self.assertIn("`uv run python …` works", d.content)
+
 
 class EnvMissing(unittest.TestCase):
+    def test_a_later_help_probe_does_not_count_as_working_without_it(self):
+        [d] = _mine(_bash("node build.js", "Error: API_BASE is not set", "error"),
+                    _bash("API_BASE=http://localhost:8787 node build.js", "built"), _bash("node build.js -h", "usage"))
+        self.assertEqual(d.subject, "`node` needs `API_BASE` set")
+
     def test_setting_the_variable_works(self):
         [d] = _mine(_bash("node build.js", "Error: API_BASE is not set", "error"),
                     _bash("API_BASE=http://localhost:8787 node build.js", "built"))

From 6c0b90ec1e37abc3846d1743c13326e595b57bab Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:09:04 +0000
Subject: [PATCH 14/43] repairs: read comments and newlines as the shell does;
 an env change on either run disqualifies it

---
 kypp/repairs.py       | 46 ++++++++++++++++++++++++++++++++-----------
 tests/test_repairs.py | 14 +++++++++++++
 2 files changed, 49 insertions(+), 11 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 47314a8..6477be7 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -89,11 +89,19 @@ def _command_of(a: Action) -> str | None:
 
 def _mask(command: str) -> str:
     """The command with quoted or escaped `;`, `&` and `|` swapped for placeholders, so the lexer,
-    which drops quotes before it splits, never reads a printed `';'` as an operator."""
-    out, quote, esc = [], "", False
+    which drops quotes before it splits, never reads a printed `';'` as an operator. Comments are
+    dropped and an unquoted newline separates commands, as the shell reads them."""
+    out, quote, esc, comment = [], "", False, False
     for c in command:
+        if comment:
+            if c != "\n":
+                continue
+            comment = False
         if esc:
-            out.append(_MASK.get(c, c))
+            if c == "\n":  # a line continuation joins the lines
+                out.pop()
+            else:
+                out.append(_MASK.get(c, c))
             esc = False
             continue
         if c == "\\" and quote != "'":
@@ -102,6 +110,11 @@ def _mask(command: str) -> str:
             quote = "" if quote else c
         elif quote and c in _MASK:
             c = _MASK[c]
+        elif not quote and c == "#" and (not out or out[-1] in " \t\n;&|()"):
+            comment = True
+            continue
+        elif not quote and c == "\n":  # ends a command, unless the line ended on an operator
+            c = " " if "".join(out).rstrip()[-1:] in ("", ";", "&", "|", "(") else ";"
         out.append(c)
     return "".join(out)
 
@@ -111,7 +124,7 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
     outside quotes (`echo 'a; b'` is one segment, `|tail` two tokens). Unbalanced quotes (a heredoc
     or a script, not one command) yield nothing."""
     lex = shlex.shlex(_mask(command), posix=True, punctuation_chars=True)
-    lex.whitespace_split = True
+    lex.whitespace_split, lex.commenters = True, ""  # _mask already dropped comments
     try:
         toks = list(lex)
     except ValueError:
@@ -157,11 +170,10 @@ def _runs(trace: Trace) -> list[_Run]:
     for i, a in enumerate(trace.actions):
         cmd = _command_of(a)
         if cmd and "<<" not in cmd:  # a heredoc body isn't commands
-            flat = cmd.replace("\n", "; ")
-            segs = _segments(flat)
+            segs = _segments(cmd)
             where = (str(a.input.get("workdir") or a.input.get("cwd") or ""),
                      *(" ".join(t[1:]) for t in segs if t[0] in ("cd", "pushd")))
-            runs.append(_Run(i, cmd, segs, _proven(flat), a.output or "", _succeeded(a), where))
+            runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), where))
     return runs
 
 
@@ -217,11 +229,15 @@ def _redact(form: list[str]) -> list[str]:
     return out
 
 
+def _changes_env(segments: list[list[str]]) -> bool:
+    return any(_split_env(seg)[0] or seg[0] in ("export", "set", "source", ".") for seg in segments)
+
+
 def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     """The tokens a later, successful command runs `head` with, when it runs it another way: behind a
     wrapper (`uv run pytest`, `python -m pytest`, `npx tsc`) or by a path (`.venv/bin/pytest`)."""
     # An assignment or `export` anywhere in the run may be what made it work, and the fix wouldn't say so.
-    if any(_split_env(seg)[0] or seg[0] in ("export", "set", "source", ".") for seg in later.segments):
+    if _changes_env(later.segments):
         return None
     for seg in later.proven:
         _, toks = _split_env(seg)
@@ -276,7 +292,13 @@ def _target(seg_toks: list[list[str]], missing_cmd: str | None) -> list[str] | N
 
 def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
     """The later run that sets `name` and runs the same thing, as the fact shows it."""
-    for env, toks in map(_split_env, later.proven):
+    for seg in later.proven:
+        env, toks = _split_env(seg)
+        others = list(later.segments)
+        if seg in others:
+            others.remove(seg)
+        if _changes_env(others):  # other setup in the run may be part of the fix
+            continue
         if set(env) == {name} and toks[:1] == [head] and toks[1:1 + len(args)] == args and not _probes(toks[1:]):
             value = env[name]
             if name not in _SAFE_ENV or _ABS.search(" " + value) or "@" in value or len(value) > 80:
@@ -300,7 +322,9 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         if not (missing_cmd or missing_mod or missing_env):
             continue
         seg = _target(a.segments, missing_cmd)
-        env, toks = _split_env(seg or [])
+        _, toks = _split_env(seg or [])
+        if _changes_env(a.segments):  # `PATH=/x pytest` failing says nothing about this environment
+            continue
         if not toks or "/" in toks[0] or not _WORD.match(head := toks[0]):
             continue
         args = [] if missing_cmd else _invocation(toks)
@@ -312,7 +336,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
             subject, why = f"`{head}` is not on PATH", "fails here (command not found)"
         elif missing_mod and _WORD.match(missing_mod):
             subject, why = f"`{head}` can't import `{missing_mod}`", f"fails here (no module `{missing_mod}`)"
-        elif missing_env and missing_env not in env:
+        elif missing_env:
             subject, why = f"`{head}` needs `{missing_env}` set", f"fails here asking for `{missing_env}`"
         else:
             continue
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 596d9bb..14f0b8d 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -91,6 +91,16 @@ def test_success_proves_only_segments_it_ran(self):
         [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("cd x; uv run pytest && echo ok", "ok"))
         self.assertIn("`uv run pytest …` works", d.content)
 
+    def test_comments_and_continuations_read_as_the_shell_does(self):
+        for later in ("# run tests\nuv run pytest", "cd x  # into the repo\nuv run pytest", "uv run \\\n  pytest"):
+            [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok"))
+            self.assertIn("`uv run pytest …` works", d.content, later)
+
+    def test_a_failure_under_its_own_env_change_says_nothing(self):
+        for failed in ("PATH=/nonexistent pytest", "export PATH=/x; pytest"):
+            self.assertEqual(_mine(_bash(failed, "pytest: command not found", "error"),
+                                   _bash("uv run pytest", "ok")), [], failed)
+
     def test_a_multiline_command_is_read_line_by_line(self):
         [d] = _mine(_bash("cd web\ntsc", "tsc: command not found", "error"), _bash("cd web\nnpx tsc", "ok"))
         self.assertEqual(d.subject, "`tsc` is not on PATH")
@@ -204,6 +214,10 @@ def test_a_probe_with_the_variable_set_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
                                _bash("API_BASE=x node build.js --help", "ok")), [])
 
+    def test_a_fix_with_other_setup_in_the_run_is_not_recorded(self):
+        self.assertEqual(_mine(_bash("python app.py", "Error: API_BASE is not set", "error"),
+                               _bash("export PYTHONPATH=src && API_BASE=x python app.py", "ok")), [])
+
     def test_a_fix_with_other_variables_too_is_not_recorded(self):
         self.assertEqual(_mine(_bash("python app.py", "API_BASE is not set", "error"),
                                _bash("API_BASE=x PYTHONPATH=src python app.py", "ok")), [])

From 19c672df4188739936fa9b9ee3ab433ffecc04b2 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:09:37 +0000
Subject: [PATCH 15/43] repairs: a later bare run after export or source isn't
 unchanged

---
 kypp/repairs.py       |  4 ++--
 tests/test_repairs.py | 11 +++++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 6477be7..b29a4d1 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -268,9 +268,9 @@ def _probes(args: list[str]) -> bool:
 def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], same_place: bool) -> bool:
     """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
-        if r.i > a.i and r.ok and (not same_place or r.where == a.where):
+        if r.i > a.i and r.ok and (not same_place or r.where == a.where) and not _changes_env(r.segments):
             for env, toks in map(_split_env, r.proven):
-                # unchanged: no env either, and a probe (`--help`) doesn't prove the real run works
+                # unchanged: no env anywhere in the run, and a probe (`--help`) doesn't prove the real run works
                 if toks[:1] == [head] and toks[1:1 + len(args)] == args and not env and not _probes(toks[1:]):
                     return True
     return False
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 14f0b8d..9a541c1 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -215,8 +215,15 @@ def test_a_probe_with_the_variable_set_is_not_a_fix(self):
                                _bash("API_BASE=x node build.js --help", "ok")), [])
 
     def test_a_fix_with_other_setup_in_the_run_is_not_recorded(self):
-        self.assertEqual(_mine(_bash("python app.py", "Error: API_BASE is not set", "error"),
-                               _bash("export PYTHONPATH=src && API_BASE=x python app.py", "ok")), [])
+        for later in ("export PYTHONPATH=src && API_BASE=x python app.py", "source .env && API_BASE=x python app.py"):
+            self.assertEqual(_mine(_bash("python app.py", "Error: API_BASE is not set", "error"),
+                                   _bash(later, "ok")), [], later)
+
+    def test_a_later_bare_run_after_an_export_is_not_unchanged(self):
+        [d] = _mine(_bash("node build.js", "Error: API_BASE is not set", "error"),
+                    _bash("API_BASE=http://localhost:8787 node build.js", "built"),
+                    _bash("export API_BASE=x && node build.js", "built"))
+        self.assertEqual(d.subject, "`node` needs `API_BASE` set")
 
     def test_a_fix_with_other_variables_too_is_not_recorded(self):
         self.assertEqual(_mine(_bash("python app.py", "API_BASE is not set", "error"),

From f9f1f57772b68746d165ea6fafd42223793ea7ad Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:13:16 +0000
Subject: [PATCH 16/43] repairs: compare a script's arguments too; an install
 in between rules out env repairs

---
 kypp/repairs.py       | 19 ++++++++++---------
 tests/test_repairs.py | 10 ++++++++++
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index b29a4d1..d932364 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -208,13 +208,14 @@ def _render(toks: list[str], upto: int) -> str:
 
 
 def _invocation(toks: list[str]) -> list[str] | None:
-    """What a run of `toks[0]` runs: its script or `-m module`. A missing module or env var is about
-    that, so a repair must run the same thing. Inline code (`-c`, `-e`) or flags ahead of the
-    script aren't compared, so those runs yield no repair (None)."""
+    """What a run of `toks[0]` runs: its script or `-m module` and their arguments, since a
+    subcommand (`manage.py migrate` vs `check`) may import or read what another doesn't. A repair
+    must run the same thing. Inline code (`-c`, `-e`) or flags ahead of the script aren't compared,
+    so those runs yield no repair (None)."""
     rest = toks[1:]
     if rest[:1] == ["-m"] and len(rest) >= 2:
-        return rest[:2]
-    return rest[:1] if rest and not rest[0].startswith("-") else None
+        return rest
+    return rest if rest and not rest[0].startswith("-") else None
 
 
 def _redact(form: list[str]) -> list[str]:
@@ -343,12 +344,12 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         if subject not in drafts:
             # A script or module is only the same one run from the same place.
             for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or r.where == a.where)):
-                if missing_env:
+                if _installed_between(runs, a, b):
+                    fix = None
+                elif missing_env:
                     fix = _env_fix(missing_env, head, args, b)
-                elif (form := _working_form(head, args, b)) and not _installed_between(runs, a, b):
-                    fix = f"`{shlex.join(form)} …`"
                 else:
-                    fix = None
+                    fix = (form := _working_form(head, args, b)) and f"`{shlex.join(form)} …`"
                 if fix:
                     drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(_redact(toks), 1 + len(args))} {why}; {fix} works.", 0.6)
                     break
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 9a541c1..f619bb8 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -146,6 +146,12 @@ def test_a_script_help_probe_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv run python app.py --help", "ok")), [])
 
+    def test_a_different_subcommand_is_not_the_same_run(self):
+        fail = _bash("python manage.py migrate", "No module named 'psycopg'", "error")
+        self.assertEqual(_mine(fail, _bash("uv run python manage.py check", "ok")), [])
+        [d] = _mine(fail, _bash("uv run python manage.py migrate", "ok"), _bash("python manage.py check", "ok"))
+        self.assertIn("`uv run python …` works", d.content)
+
     def test_the_later_run_must_run_the_same_thing(self):
         for later in ("uv run python -c 'print(1)'", "uv run python unrelated.py", "uv run python -m other"):
             self.assertEqual(_mine(_bash("python -m kypp.distill", "No module named 'turso'", "error"),
@@ -214,6 +220,10 @@ def test_a_probe_with_the_variable_set_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),
                                _bash("API_BASE=x node build.js --help", "ok")), [])
 
+    def test_no_fact_when_something_was_installed_in_between(self):
+        self.assertEqual(_mine(_bash("node build.js", "Error: API_BASE is not set", "error"), _bash("npm install", "ok"),
+                               _bash("API_BASE=http://localhost:8787 node build.js", "built")), [])
+
     def test_a_fix_with_other_setup_in_the_run_is_not_recorded(self):
         for later in ("export PYTHONPATH=src && API_BASE=x python app.py", "source .env && API_BASE=x python app.py"):
             self.assertEqual(_mine(_bash("python app.py", "Error: API_BASE is not set", "error"),

From d5b2f0ad21f31f9096a9eab424871476cee0dee0 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:16:45 +0000
Subject: [PATCH 17/43] repairs: same invocation means the same arguments; the
 claim shows only the command and script

---
 kypp/repairs.py       | 15 +++++++++++----
 tests/test_repairs.py | 12 ++++++++++++
 2 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index d932364..7447b3c 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -218,6 +218,12 @@ def _invocation(toks: list[str]) -> list[str] | None:
     return rest if rest and not rest[0].startswith("-") else None
 
 
+def _same(rest: list[str], args: list[str]) -> bool:
+    """A run is the same invocation only with exactly its arguments: an added `--skip-db` may skip
+    the failing import. A missing command has none to match, so any arguments do."""
+    return rest == args if args else True
+
+
 def _redact(form: list[str]) -> list[str]:
     """Never repeat a credential into shared memory: any `name=value` (`K=V`, `-e K=V`, `--token=x`)
     unless the name is known safe, and a URL's user:password."""
@@ -248,7 +254,7 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
             prefix, rest = toks[:j], toks[j + 1:]
             if prefix and (_base(prefix[0]), *prefix[1:]) not in _WRAPPERS:
                 break
-            if _probes(rest) or rest[:len(args)] != args:
+            if _probes(rest) or not _same(rest, args):
                 break
             form = toks[:j + 1]
             return None if _ABS.search(" " + " ".join(form)) else form
@@ -272,7 +278,7 @@ def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str]
         if r.i > a.i and r.ok and (not same_place or r.where == a.where) and not _changes_env(r.segments):
             for env, toks in map(_split_env, r.proven):
                 # unchanged: no env anywhere in the run, and a probe (`--help`) doesn't prove the real run works
-                if toks[:1] == [head] and toks[1:1 + len(args)] == args and not env and not _probes(toks[1:]):
+                if toks[:1] == [head] and _same(toks[1:], args) and not env and not _probes(toks[1:]):
                     return True
     return False
 
@@ -300,7 +306,7 @@ def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
             others.remove(seg)
         if _changes_env(others):  # other setup in the run may be part of the fix
             continue
-        if set(env) == {name} and toks[:1] == [head] and toks[1:1 + len(args)] == args and not _probes(toks[1:]):
+        if set(env) == {name} and toks[:1] == [head] and _same(toks[1:], args) and not _probes(toks[1:]):
             value = env[name]
             if name not in _SAFE_ENV or _ABS.search(" " + value) or "@" in value or len(value) > 80:
                 return f"`{name}=… {head} …`"
@@ -351,7 +357,8 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
                 else:
                     fix = (form := _working_form(head, args, b)) and f"`{shlex.join(form)} …`"
                 if fix:
-                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(_redact(toks), 1 + len(args))} {why}; {fix} works.", 0.6)
+                    shown = 1 + (2 if args[:1] == ["-m"] else len(args[:1]))  # the command and script, never its arguments
+                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(_redact(toks), shown)} {why}; {fix} works.", 0.6)
                     break
         if subject in drafts:
             explained.add(a.i)
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index f619bb8..17483a6 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -146,6 +146,18 @@ def test_a_script_help_probe_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv run python app.py --help", "ok")), [])
 
+    def test_extra_arguments_are_not_the_same_run(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'psycopg'", "error"),
+                               _bash("uv run python app.py --skip-database", "ok")), [])
+        self.assertEqual(_mine(_bash("node build.js", "Error: API_BASE is not set", "error"),
+                               _bash("API_BASE=x node build.js --dry-run", "ok")), [])
+
+    def test_the_failing_form_shows_only_the_script(self):
+        [d] = _mine(_bash("python app.py --token SECRET", "No module named 'turso'", "error"),
+                    _bash("uv run python app.py --token SECRET", "ok"))
+        self.assertNotIn("SECRET", d.content)
+        self.assertIn("`python app.py …` fails here", d.content)
+
     def test_a_different_subcommand_is_not_the_same_run(self):
         fail = _bash("python manage.py migrate", "No module named 'psycopg'", "error")
         self.assertEqual(_mine(fail, _bash("uv run python manage.py check", "ok")), [])

From f04928b26131dc20df0654808db2f54d8f2e69dc Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:21:27 +0000
Subject: [PATCH 18/43] repairs: a cd after the command leaves the place
 unknown; installs are read from parsed segments

---
 kypp/repairs.py       | 20 ++++++++++++++------
 tests/test_repairs.py |  8 ++++++++
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 7447b3c..b6d21ec 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -71,7 +71,7 @@ class _Run:
     proven: list[list[str]]  # the segments the run's success proves ran and succeeded
     output: str
     ok: bool  # confirmed to have succeeded; a run with no recorded outcome is neither
-    where: tuple  # the tool's workdir and every `cd` target: a script name means nothing without it
+    where: tuple | None  # workdir and `cd` targets; None when a `cd` follows a command, so the place is unclear
 
 
 def _command_of(a: Action) -> str | None:
@@ -171,8 +171,11 @@ def _runs(trace: Trace) -> list[_Run]:
         cmd = _command_of(a)
         if cmd and "<<" not in cmd:  # a heredoc body isn't commands
             segs = _segments(cmd)
-            where = (str(a.input.get("workdir") or a.input.get("cwd") or ""),
-                     *(" ".join(t[1:]) for t in segs if t[0] in ("cd", "pushd")))
+            moves = [t[0] in ("cd", "pushd") for t in segs]
+            first_cmd = moves.index(False) if False in moves else len(moves)
+            where = None if any(moves[first_cmd:]) else (
+                str(a.input.get("workdir") or a.input.get("cwd") or ""),
+                *(" ".join(t[1:]) for t in segs[:first_cmd]))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), where))
     return runs
 
@@ -261,10 +264,15 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     return None
 
 
+def _same_place(a: _Run, b: _Run) -> bool:
+    """A script name means the same script only from the same, known directory."""
+    return a.where is not None and a.where == b.where
+
+
 def _installed_between(runs: list[_Run], a: _Run, b: _Run) -> bool:
     """Any install or sync after the failure, up to and including the run that worked (`uv sync` and
     `pip install -r` don't name what they install), may be why it worked: the fact won't hold."""
-    return any(a.i < r.i <= b.i and _INSTALLS & set(r.command.split()) for r in runs)
+    return any(a.i < r.i <= b.i and any(_INSTALLS & set(t) for t, _, _ in _chain(r.command)) for r in runs)
 
 
 def _probes(args: list[str]) -> bool:
@@ -275,7 +283,7 @@ def _probes(args: list[str]) -> bool:
 def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], same_place: bool) -> bool:
     """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
-        if r.i > a.i and r.ok and (not same_place or r.where == a.where) and not _changes_env(r.segments):
+        if r.i > a.i and r.ok and (not same_place or _same_place(a, r)) and not _changes_env(r.segments):
             for env, toks in map(_split_env, r.proven):
                 # unchanged: no env anywhere in the run, and a probe (`--help`) doesn't prove the real run works
                 if toks[:1] == [head] and _same(toks[1:], args) and not env and not _probes(toks[1:]):
@@ -349,7 +357,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
             continue
         if subject not in drafts:
             # A script or module is only the same one run from the same place.
-            for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or r.where == a.where)):
+            for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or _same_place(a, r))):
                 if _installed_between(runs, a, b):
                     fix = None
                 elif missing_env:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 17483a6..74d2c7e 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -158,6 +158,14 @@ def test_the_failing_form_shows_only_the_script(self):
         self.assertNotIn("SECRET", d.content)
         self.assertIn("`python app.py …` fails here", d.content)
 
+    def test_a_cd_after_the_command_leaves_the_place_unclear(self):
+        self.assertEqual(_mine(_bash("python app.py; cd server", "No module named 'turso'", "error"),
+                               _bash("cd server; uv run python app.py", "ok")), [])
+
+    def test_an_install_joined_by_a_separator_still_counts(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("uv sync; uv run python app.py", "ok")), [])
+
     def test_a_different_subcommand_is_not_the_same_run(self):
         fail = _bash("python manage.py migrate", "No module named 'psycopg'", "error")
         self.assertEqual(_mine(fail, _bash("uv run python manage.py check", "ok")), [])

From ebc95ed6342c4ba432f9573676aa4ebc65099a94 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:23:54 +0000
Subject: [PATCH 19/43] repairs: a failure is explained only by its own repair

---
 kypp/repairs.py       | 29 ++++++++++++++---------------
 tests/test_repairs.py |  6 ++++++
 2 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index b6d21ec..afe76a4 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -355,19 +355,18 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
             subject, why = f"`{head}` needs `{missing_env}` set", f"fails here asking for `{missing_env}`"
         else:
             continue
-        if subject not in drafts:
-            # A script or module is only the same one run from the same place.
-            for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or _same_place(a, r))):
-                if _installed_between(runs, a, b):
-                    fix = None
-                elif missing_env:
-                    fix = _env_fix(missing_env, head, args, b)
-                else:
-                    fix = (form := _working_form(head, args, b)) and f"`{shlex.join(form)} …`"
-                if fix:
-                    shown = 1 + (2 if args[:1] == ["-m"] else len(args[:1]))  # the command and script, never its arguments
-                    drafts[subject] = ClaimDraft("pitfall", subject, f"{_render(_redact(toks), shown)} {why}; {fix} works.", 0.6)
-                    break
-        if subject in drafts:
-            explained.add(a.i)
+        # Each failure needs its own repair to count as explained; the first one found writes the claim.
+        # A script or module is only the same one run from the same place.
+        for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or _same_place(a, r))):
+            if _installed_between(runs, a, b):
+                fix = None
+            elif missing_env:
+                fix = _env_fix(missing_env, head, args, b)
+            else:
+                fix = (form := _working_form(head, args, b)) and f"`{shlex.join(form)} …`"
+            if fix:
+                shown = 1 + (2 if args[:1] == ["-m"] else len(args[:1]))  # the command and script, never its arguments
+                drafts.setdefault(subject, ClaimDraft("pitfall", subject, f"{_render(_redact(toks), shown)} {why}; {fix} works.", 0.6))
+                explained.add(a.i)
+                break
     return list(drafts.values()), explained
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 74d2c7e..3b2dee0 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -166,6 +166,12 @@ def test_an_install_joined_by_a_separator_still_counts(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv sync; uv run python app.py", "ok")), [])
 
+    def test_a_failure_without_its_own_repair_is_not_explained(self):
+        drafts, explained = mine(build_trace([_bash("python app.py", "No module named 'project'", "error"),
+                                              _bash("uv run python app.py", "ok"),
+                                              _bash("python other.py", "No module named 'project'", "error")]))
+        self.assertEqual((len(drafts), explained), (1, {0}))
+
     def test_a_different_subcommand_is_not_the_same_run(self):
         fail = _bash("python manage.py migrate", "No module named 'psycopg'", "error")
         self.assertEqual(_mine(fail, _bash("uv run python manage.py check", "ok")), [])

From 2ae9e6c80e0b3b0692fcd88a9470b67e0bc44d9f Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:26:07 +0000
Subject: [PATCH 20/43] repairs: a trailing separator ends the command

---
 kypp/repairs.py       | 2 ++
 tests/test_repairs.py | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index afe76a4..53e7d26 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -137,6 +137,8 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
             cur, before = [], t
         else:
             cur.append(t.translate(_UNMASK))
+    if out and out[-1][2] == ";":  # a trailing `;` ends the command; its status is still the last one's
+        out[-1] = (out[-1][0], out[-1][1], "")
     return out
 
 
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 3b2dee0..79c8027 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -92,7 +92,7 @@ def test_success_proves_only_segments_it_ran(self):
         self.assertIn("`uv run pytest …` works", d.content)
 
     def test_comments_and_continuations_read_as_the_shell_does(self):
-        for later in ("# run tests\nuv run pytest", "cd x  # into the repo\nuv run pytest", "uv run \\\n  pytest"):
+        for later in ("# run tests\nuv run pytest", "uv run pytest;", "uv run pytest\n# done", "cd x  # into the repo\nuv run pytest", "uv run \\\n  pytest"):
             [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok"))
             self.assertIn("`uv run pytest …` works", d.content, later)
 

From 86eb10e0af0cc1692cd73a876b679cb6b7d75027 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:29:19 +0000
Subject: [PATCH 21/43] repairs: |& is a pipe; a file edit in between rules out
 a script repair

---
 kypp/repairs.py       | 12 +++++++++++-
 tests/test_repairs.py |  8 +++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 53e7d26..1b7bcf1 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -131,6 +131,7 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
         return []
     out, cur, before = [], [], ""
     for t in toks + [""]:
+        t = "|" if t == "|&" else t  # bash's `|&` is a pipe that also carries stderr
         if t in _OPS or t == "":
             if cur:
                 out.append((cur, before, t))
@@ -266,6 +267,15 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     return None
 
 
+_EDIT_TOOL = re.compile(r"edit|write|patch|replace", re.I)
+
+
+def _edited_between(trace: Trace, a: _Run, b: _Run) -> bool:
+    """A file edit between the runs may have changed the script itself (dropped the import), so the
+    later run no longer tests what failed."""
+    return any(_EDIT_TOOL.search(x.name or "") for x in trace.actions[a.i + 1:b.i])
+
+
 def _same_place(a: _Run, b: _Run) -> bool:
     """A script name means the same script only from the same, known directory."""
     return a.where is not None and a.where == b.where
@@ -360,7 +370,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         # Each failure needs its own repair to count as explained; the first one found writes the claim.
         # A script or module is only the same one run from the same place.
         for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or _same_place(a, r))):
-            if _installed_between(runs, a, b):
+            if _installed_between(runs, a, b) or (not missing_cmd and _edited_between(trace, a, b)):
                 fix = None
             elif missing_env:
                 fix = _env_fix(missing_env, head, args, b)
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 79c8027..10aa4ee 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -83,7 +83,7 @@ def test_flags_on_the_working_run_are_not_installs(self):
 
     def test_success_proves_only_segments_it_ran(self):
         for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
-                      "uv run pytest |tail -3", "uv run pytest >/tmp/log 2>&1 &",
+                      "uv run pytest |tail -3", "uv run pytest |& tail -3", "uv run pytest >/tmp/log 2>&1 &",
                       "echo 'example; uv run pytest && end'", "env -u PYTHONPATH uv run pytest",
                       "echo ';' uv run pytest", 'echo "a|b" uv run pytest', "echo \\; uv run pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),
@@ -172,6 +172,12 @@ def test_a_failure_without_its_own_repair_is_not_explained(self):
                                               _bash("python other.py", "No module named 'project'", "error")]))
         self.assertEqual((len(drafts), explained), (1, {0}))
 
+    def test_an_edit_in_between_may_have_changed_the_script(self):
+        edit = {"sessionId": "s1", "payload": {"type": "tool_call", "name": "Edit", "status": "completed",
+                                               "input": {"file_path": "app.py"}, "output": "ok"}}
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), edit,
+                               _bash("uv run python app.py", "ok")), [])
+
     def test_a_different_subcommand_is_not_the_same_run(self):
         fail = _bash("python manage.py migrate", "No module named 'psycopg'", "error")
         self.assertEqual(_mine(fail, _bash("uv run python manage.py check", "ok")), [])

From 070f89eeefb1380917cac8033842c0f3035d86ba Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:32:14 +0000
Subject: [PATCH 22/43] repairs: an empty argument isn't the end of the
 command; substitutions prove nothing

---
 kypp/repairs.py       | 8 +++++---
 tests/test_repairs.py | 3 ++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 1b7bcf1..4793f6d 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -130,11 +130,11 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
     except ValueError:
         return []
     out, cur, before = [], [], ""
-    for t in toks + [""]:
+    for t in toks + [None]:  # None ends it: `''` lexes to an empty token
         t = "|" if t == "|&" else t  # bash's `|&` is a pipe that also carries stderr
-        if t in _OPS or t == "":
+        if t in _OPS or t is None:
             if cur:
-                out.append((cur, before, t))
+                out.append((cur, before, t or ""))
             cur, before = [], t
         else:
             cur.append(t.translate(_UNMASK))
@@ -152,6 +152,8 @@ def _proven(command: str) -> list[list[str]]:
     """The segments a successful run proves succeeded. A chain's exit status is its last command's,
     so only a segment followed by nothing but `&&` counts; `||` may skip a segment, a pipeline exits
     with its last stage, and `&` with the launch, so none of those prove anything."""
+    if re.search(r"\$\(|`|[<>]\(", command):  # a substitution's status is hidden by the command around it
+        return []
     chain = _chain(command)
     if any(before == "||" or after == "||" for _, before, after in chain):
         return []
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 10aa4ee..4858a81 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -83,7 +83,8 @@ def test_flags_on_the_working_run_are_not_installs(self):
 
     def test_success_proves_only_segments_it_ran(self):
         for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
-                      "uv run pytest |tail -3", "uv run pytest |& tail -3", "uv run pytest >/tmp/log 2>&1 &",
+                      "uv run pytest |tail -3", "uv run pytest |& tail -3", "printf '' uv run pytest",
+                      "echo $(true; uv run pytest 2>/dev/null)", "echo `uv run pytest`", "uv run pytest >/tmp/log 2>&1 &",
                       "echo 'example; uv run pytest && end'", "env -u PYTHONPATH uv run pytest",
                       "echo ';' uv run pytest", 'echo "a|b" uv run pytest', "echo \\; uv run pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),

From 093e16a63bede95aada8aee90b85b1109b9515bc Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:35:38 +0000
Subject: [PATCH 23/43] repairs: error text counts only from a failed or
 status-masked run; redirections aren't arguments

---
 kypp/repairs.py       | 40 +++++++++++++++++++++++++++++++++-------
 tests/test_repairs.py |  9 +++++++++
 2 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 4793f6d..a03e100 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -71,6 +71,7 @@ class _Run:
     proven: list[list[str]]  # the segments the run's success proves ran and succeeded
     output: str
     ok: bool  # confirmed to have succeeded; a run with no recorded outcome is neither
+    may_fail: bool  # failed, or its exit status could hide a failure (`pytest | tail`, `pytest; echo`)
     where: tuple | None  # workdir and `cd` targets; None when a `cd` follows a command, so the place is unclear
 
 
@@ -119,6 +120,21 @@ def _mask(command: str) -> str:
     return "".join(out)
 
 
+def _strip_redirects(toks: list[str]) -> list[str]:
+    """The command's words without its redirections (`>out`, `2>&1`, `<in`), which aren't arguments."""
+    out, skip = [], False
+    for t in toks:
+        if skip:
+            skip = False
+        elif t and set(t) <= set("<>&") and set(t) & set("<>"):
+            if out and out[-1].isdigit():  # the `2` of `2>`
+                out.pop()
+            skip = True
+        else:
+            out.append(t)
+    return out
+
+
 def _chain(command: str) -> list[tuple[list[str], str, str]]:
     """The command's segments as (tokens, operator before, operator after), split on shell operators
     outside quotes (`echo 'a; b'` is one segment, `|tail` two tokens). Unbalanced quotes (a heredoc
@@ -134,7 +150,7 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
         t = "|" if t == "|&" else t  # bash's `|&` is a pipe that also carries stderr
         if t in _OPS or t is None:
             if cur:
-                out.append((cur, before, t or ""))
+                out.append((_strip_redirects(cur), before, t or ""))
             cur, before = [], t
         else:
             cur.append(t.translate(_UNMASK))
@@ -161,13 +177,19 @@ def _proven(command: str) -> list[list[str]]:
             if before not in ("|", "&") and all(a in ("&&", "") for _, _, a in chain[k:])]
 
 
+def _exit(a: Action) -> str | None:
+    m = _EXIT_CODE.search(a.output or "")
+    return m.group(1) if m else None
+
+
+def _failed(a: Action) -> bool:
+    return a.status == "error" or (_exit(a) or "0") != "0"
+
+
 def _succeeded(a: Action) -> bool:
     """Confirmed success. Claude records a status; Codex records none, so its exit code decides. A
     run still `running`, or with no status and no exit code, can't prove a repair."""
-    m = _EXIT_CODE.search(a.output or "")
-    code = m.group(1) if m else None
-    failed = a.status == "error" or (code is not None and code != "0")
-    return not failed and (a.status == "completed" or code == "0") and not _errs(a.output or "")
+    return not _failed(a) and (a.status == "completed" or _exit(a) == "0") and not _errs(a.output or "")
 
 
 def _runs(trace: Trace) -> list[_Run]:
@@ -181,7 +203,8 @@ def _runs(trace: Trace) -> list[_Run]:
             where = None if any(moves[first_cmd:]) else (
                 str(a.input.get("workdir") or a.input.get("cwd") or ""),
                 *(" ".join(t[1:]) for t in segs[:first_cmd]))
-            runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), where))
+            masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
+            runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where))
     return runs
 
 
@@ -344,7 +367,10 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
     drafts: dict[str, ClaimDraft] = {}
     explained: set[int] = set()
     for a in runs:
-        # A piped run (`… | tail`) exits 0 with the error in its output, so the error text decides.
+        # Error text counts only from a run that failed, or one whose status could hide it (`… | tail`):
+        # a successful `rg "No module named"` just printed it.
+        if not a.may_fail:
+            continue
         missing_cmd = _first(_CMD_MISSING, a.output)
         missing_mod = None if missing_cmd else _first(_MOD_MISSING, a.output)
         missing_env = None if missing_cmd or missing_mod else _first(_ENV_MISSING, a.output)
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 4858a81..45df053 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -77,6 +77,15 @@ def test_a_piped_run_fails_by_its_output(self):
                     _bash("uv run pytest -q", "3 passed"))
         self.assertIn("`uv run pytest …` works", d.content)
 
+    def test_a_successful_run_that_prints_error_text_is_not_a_failure(self):
+        self.assertEqual(_mine(_bash("rg \"No module named 'turso'\" errors.log", "No module named 'turso'"),
+                               _bash("uv run rg \"No module named 'turso'\" errors.log", "No module named 'turso'")), [])
+
+    def test_redirections_are_not_arguments(self):
+        [d] = _mine(_bash("python app.py", "No module named 'turso'", "error"),
+                    _bash("uv run python app.py >out 2>&1", "ok"))
+        self.assertIn("`uv run python …` works", d.content)
+
     def test_flags_on_the_working_run_are_not_installs(self):
         [d] = _mine(_bash("pytest", "pytest: command not found", "error"), _bash("uv run pytest -v", "ok"))
         self.assertIn("`uv run pytest …` works", d.content)

From abf61b755197dfefb94320a88e50e263ab4e1139 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:38:15 +0000
Subject: [PATCH 24/43] repairs: shell edits in between count as edits; a URL
 or user@ in the working form is never written

---
 kypp/repairs.py       |  8 ++++++--
 tests/test_repairs.py | 10 ++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index a03e100..458d19f 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -288,17 +288,21 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
             if _probes(rest) or not _same(rest, args):
                 break
             form = toks[:j + 1]
-            return None if _ABS.search(" " + " ".join(form)) else form
+            # a host path, URL or `user@` may carry a home dir or a token; none belongs in shared memory
+            return None if _ABS.search(" " + " ".join(form)) or any("://" in t or "@" in t for t in form) else form
     return None
 
 
 _EDIT_TOOL = re.compile(r"edit|write|patch|replace", re.I)
+# A shell command that writes files: sed/perl -i, tee, a `>` into a file, apply_patch, write_text.
+_SHELL_EDIT = re.compile(r"\b(?:sed|perl)\s+-i|\btee\b|apply_patch|write_text|(?<![0-9&])>>?\s*(?!/dev/null|&)[\w./]")
 
 
 def _edited_between(trace: Trace, a: _Run, b: _Run) -> bool:
     """A file edit between the runs may have changed the script itself (dropped the import), so the
     later run no longer tests what failed."""
-    return any(_EDIT_TOOL.search(x.name or "") for x in trace.actions[a.i + 1:b.i])
+    return any(_EDIT_TOOL.search(x.name or "") or _SHELL_EDIT.search(_command_of(x) or "")
+               for x in trace.actions[a.i + 1:b.i])
 
 
 def _same_place(a: _Run, b: _Run) -> bool:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 45df053..fe346e1 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -188,6 +188,16 @@ def test_an_edit_in_between_may_have_changed_the_script(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), edit,
                                _bash("uv run python app.py", "ok")), [])
 
+    def test_a_shell_edit_in_between_may_have_changed_the_script(self):
+        for edit in ("sed -i '/turso/d' app.py", "python - <<'EOF'\nPath('app.py').write_text('')\nEOF",
+                     "echo 'print(1)' > app.py"):
+            self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), _bash(edit, ""),
+                                   _bash("uv run python app.py", "ok")), [], edit)
+
+    def test_a_url_or_user_in_the_working_form_is_never_written(self):
+        self.assertEqual(_mine(_bash("mycli", "mycli: command not found", "error"),
+                               _bash("npx https://user:TOKEN@packages.example/mycli", "ok")), [])
+
     def test_a_different_subcommand_is_not_the_same_run(self):
         fail = _bash("python manage.py migrate", "No module named 'psycopg'", "error")
         self.assertEqual(_mine(fail, _bash("uv run python manage.py check", "ok")), [])

From 480ada75d63fb53e90aee819f975236c2885d2ea Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:40:42 +0000
Subject: [PATCH 25/43] repairs: skip redirection-only segments; unset is an
 env change; only plain env values are written

---
 kypp/repairs.py       |  9 +++++----
 tests/test_repairs.py | 12 ++++++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 458d19f..0e19240 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -149,8 +149,8 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
     for t in toks + [None]:  # None ends it: `''` lexes to an empty token
         t = "|" if t == "|&" else t  # bash's `|&` is a pipe that also carries stderr
         if t in _OPS or t is None:
-            if cur:
-                out.append((_strip_redirects(cur), before, t or ""))
+            if cur and (words := _strip_redirects(cur)):  # `> out.log` alone has no command
+                out.append((words, before, t or ""))
             cur, before = [], t
         else:
             cur.append(t.translate(_UNMASK))
@@ -268,7 +268,7 @@ def _redact(form: list[str]) -> list[str]:
 
 
 def _changes_env(segments: list[list[str]]) -> bool:
-    return any(_split_env(seg)[0] or seg[0] in ("export", "set", "source", ".") for seg in segments)
+    return any(_split_env(seg)[0] or seg[0] in ("export", "set", "unset", "source", ".") for seg in segments)
 
 
 def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
@@ -357,7 +357,8 @@ def _env_fix(name: str, head: str, args: list[str], later: _Run) -> str | None:
             continue
         if set(env) == {name} and toks[:1] == [head] and _same(toks[1:], args) and not _probes(toks[1:]):
             value = env[name]
-            if name not in _SAFE_ENV or _ABS.search(" " + value) or "@" in value or len(value) > 80:
+            # Only a plain value is written: a URL, `?token=`, `@` or host path may carry a secret.
+            if name not in _SAFE_ENV or _ABS.search(" " + value) or "://" in value or not re.fullmatch(r"[\w.,:/+-]{0,80}", value):
                 return f"`{name}=… {head} …`"
             return f"`{shlex.join([f'{name}={value}', head])} …`"
     return None
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index fe346e1..c319258 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -198,6 +198,15 @@ def test_a_url_or_user_in_the_working_form_is_never_written(self):
         self.assertEqual(_mine(_bash("mycli", "mycli: command not found", "error"),
                                _bash("npx https://user:TOKEN@packages.example/mycli", "ok")), [])
 
+    def test_a_redirection_only_command_is_skipped(self):
+        [d] = _mine(_bash("> out.log", ""), _bash("python app.py", "No module named 'turso'", "error"),
+                    _bash("uv run python app.py 2>/dev/null", "ok"))
+        self.assertIn("`uv run python …` works", d.content)
+
+    def test_unset_is_an_env_change(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("unset PYTHONHOME; uv run python app.py", "ok")), [])
+
     def test_a_different_subcommand_is_not_the_same_run(self):
         fail = _bash("python manage.py migrate", "No module named 'psycopg'", "error")
         self.assertEqual(_mine(fail, _bash("uv run python manage.py check", "ok")), [])
@@ -263,6 +272,9 @@ def test_only_known_safe_values_are_written(self):
         [d] = _mine(_bash("python app.py", "HOST is required", "error"),
                     _bash("HOST=https://u:pw@example.com python app.py", "ok"))
         self.assertNotIn("pw", d.content)
+        [d] = _mine(_bash("python app.py", "HOST is required", "error"),
+                    _bash("HOST='https://api.example/?token=SECRET' python app.py", "ok"))
+        self.assertNotIn("SECRET", d.content)
 
     def test_the_later_run_must_run_the_same_script(self):
         self.assertEqual(_mine(_bash("node build.js", "API_BASE is not set", "error"),

From 76a32c0a4ec8294f339c09b15ed4b0802ceaa16d Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:43:09 +0000
Subject: [PATCH 26/43] repairs: an in-place edit in the working run counts;
 quoted < and > are arguments

---
 kypp/repairs.py       | 14 ++++++++------
 tests/test_repairs.py |  8 ++++++++
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 0e19240..adfb430 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -84,12 +84,12 @@ def _command_of(a: Action) -> str | None:
     return c.strip() if isinstance(c, str) and c.strip() else None
 
 
-_MASK = {c: chr(0xE000 + i) for i, c in enumerate(";&|")}
+_MASK = {c: chr(0xE000 + i) for i, c in enumerate(";&|<>")}
 _UNMASK = str.maketrans({v: k for k, v in _MASK.items()})
 
 
 def _mask(command: str) -> str:
-    """The command with quoted or escaped `;`, `&` and `|` swapped for placeholders, so the lexer,
+    """The command with quoted or escaped `;`, `&`, `|`, `<` and `>` swapped for placeholders, so the lexer,
     which drops quotes before it splits, never reads a printed `';'` as an operator. Comments are
     dropped and an unquoted newline separates commands, as the shell reads them."""
     out, quote, esc, comment = [], "", False, False
@@ -150,10 +150,10 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
         t = "|" if t == "|&" else t  # bash's `|&` is a pipe that also carries stderr
         if t in _OPS or t is None:
             if cur and (words := _strip_redirects(cur)):  # `> out.log` alone has no command
-                out.append((words, before, t or ""))
+                out.append(([w.translate(_UNMASK) for w in words], before, t or ""))
             cur, before = [], t
         else:
-            cur.append(t.translate(_UNMASK))
+            cur.append(t)
     if out and out[-1][2] == ";":  # a trailing `;` ends the command; its status is still the last one's
         out[-1] = (out[-1][0], out[-1][1], "")
     return out
@@ -295,14 +295,16 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
 
 _EDIT_TOOL = re.compile(r"edit|write|patch|replace", re.I)
 # A shell command that writes files: sed/perl -i, tee, a `>` into a file, apply_patch, write_text.
+_IN_PLACE = re.compile(r"\b(?:sed|perl)\s+-i|apply_patch|write_text")
 _SHELL_EDIT = re.compile(r"\b(?:sed|perl)\s+-i|\btee\b|apply_patch|write_text|(?<![0-9&])>>?\s*(?!/dev/null|&)[\w./]")
 
 
 def _edited_between(trace: Trace, a: _Run, b: _Run) -> bool:
     """A file edit between the runs may have changed the script itself (dropped the import), so the
     later run no longer tests what failed."""
-    return any(_EDIT_TOOL.search(x.name or "") or _SHELL_EDIT.search(_command_of(x) or "")
-               for x in trace.actions[a.i + 1:b.i])
+    between = any(_EDIT_TOOL.search(x.name or "") or _SHELL_EDIT.search(_command_of(x) or "")
+                  for x in trace.actions[a.i + 1:b.i])
+    return between or bool(_IN_PLACE.search(b.command))  # `sed -i … && uv run …`; its `> log` is no edit
 
 
 def _same_place(a: _Run, b: _Run) -> bool:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index c319258..16cbadb 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -194,6 +194,14 @@ def test_a_shell_edit_in_between_may_have_changed_the_script(self):
             self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), _bash(edit, ""),
                                    _bash("uv run python app.py", "ok")), [], edit)
 
+    def test_an_edit_in_the_working_run_itself_counts(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("sed -i '/import turso/d' app.py && uv run python app.py", "ok")), [])
+
+    def test_a_quoted_angle_bracket_is_an_argument(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("uv run python app.py '>' --help", "usage")), [])
+
     def test_a_url_or_user_in_the_working_form_is_never_written(self):
         self.assertEqual(_mine(_bash("mycli", "mycli: command not found", "error"),
                                _bash("npx https://user:TOKEN@packages.example/mycli", "ok")), [])

From 66d5ca75f4555fc9a43f193047c65f5fad8a5cb7 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:45:26 +0000
Subject: [PATCH 27/43] repairs: attribute an error across every pipeline stage

---
 kypp/repairs.py       | 2 +-
 tests/test_repairs.py | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index adfb430..1f15160 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -383,7 +383,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         missing_env = None if missing_cmd or missing_mod else _first(_ENV_MISSING, a.output)
         if not (missing_cmd or missing_mod or missing_env):
             continue
-        seg = _target(a.segments, missing_cmd)
+        seg = _target([t for t, _, _ in _chain(a.command)], missing_cmd)  # every stage: `a | b` may fail in b
         _, toks = _split_env(seg or [])
         if _changes_env(a.segments):  # `PATH=/x pytest` failing says nothing about this environment
             continue
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 16cbadb..69c008f 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -194,6 +194,10 @@ def test_a_shell_edit_in_between_may_have_changed_the_script(self):
             self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), _bash(edit, ""),
                                    _bash("uv run python app.py", "ok")), [], edit)
 
+    def test_an_error_from_a_pipeline_is_not_attributed(self):
+        self.assertEqual(_mine(_bash("python producer.py | python consumer.py", "No module named 'turso'"),
+                               _bash("uv run python producer.py", "ok")), [])
+
     def test_an_edit_in_the_working_run_itself_counts(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("sed -i '/import turso/d' app.py && uv run python app.py", "ok")), [])

From f6fe03ad80404c719672fa5af3017119cc7030b5 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:48:39 +0000
Subject: [PATCH 28/43] repairs: a redirection-only command still sets the
 chain's status

---
 kypp/repairs.py       | 5 +++--
 tests/test_repairs.py | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 1f15160..2b3e49d 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -24,7 +24,7 @@
 _SHELL_TOOLS = {"bash", "shell", "exec_command", "local_shell", "run_shell_command"}
 
 _OPS = {";", "&&", "||", "|", "&"}
-_SETUP = {"cd", "source", ".", "export", "set", "pushd", "unset"}
+_SETUP = {"cd", "source", ".", "export", "set", "pushd", "unset", ":"}
 _ASSIGN = re.compile(r"^([A-Za-z_][A-Za-z0-9_]*)=(.*)$", re.S)
 _WORD = re.compile(r"^[A-Za-z0-9._+-]{1,64}$")  # a command or module name we're willing to quote
 # A missing command, as bash, sh, zsh and env each word it.
@@ -149,7 +149,8 @@ def _chain(command: str) -> list[tuple[list[str], str, str]]:
     for t in toks + [None]:  # None ends it: `''` lexes to an empty token
         t = "|" if t == "|&" else t  # bash's `|&` is a pipe that also carries stderr
         if t in _OPS or t is None:
-            if cur and (words := _strip_redirects(cur)):  # `> out.log` alone has no command
+            if cur:  # `> out.log` alone runs nothing but still sets the status: keep it as `:`
+                words = _strip_redirects(cur) or [":"]
                 out.append(([w.translate(_UNMASK) for w in words], before, t or ""))
             cur, before = [], t
         else:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 69c008f..2bda357 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -93,7 +93,7 @@ def test_flags_on_the_working_run_are_not_installs(self):
     def test_success_proves_only_segments_it_ran(self):
         for later in ("true || uv run pytest", "uv run pytest; true", "uv run pytest | tail -3",
                       "uv run pytest |tail -3", "uv run pytest |& tail -3", "printf '' uv run pytest",
-                      "echo $(true; uv run pytest 2>/dev/null)", "echo `uv run pytest`", "uv run pytest >/tmp/log 2>&1 &",
+                      "echo $(true; uv run pytest 2>/dev/null)", "uv run pytest 2>/dev/null; > out.log", "echo `uv run pytest`", "uv run pytest >/tmp/log 2>&1 &",
                       "echo 'example; uv run pytest && end'", "env -u PYTHONPATH uv run pytest",
                       "echo ';' uv run pytest", 'echo "a|b" uv run pytest', "echo \\; uv run pytest"):
             self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(later, "ok")),

From ce35b8e338f315593be68b3896d727f02d04f2ea Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:51:12 +0000
Subject: [PATCH 29/43] repairs: writes before the invocation in the working
 run count; only an adjacent number is a descriptor

---
 kypp/repairs.py       | 26 +++++++++++++++++---------
 tests/test_repairs.py | 11 +++++++++--
 2 files changed, 26 insertions(+), 11 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 2b3e49d..60f67be 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -114,6 +114,12 @@ def _mask(command: str) -> str:
         elif not quote and c == "#" and (not out or out[-1] in " \t\n;&|()"):
             comment = True
             continue
+        elif not quote and c in "<>" and out and out[-1].isdigit():
+            fd = len(out)
+            while fd and out[fd - 1].isdigit():
+                fd -= 1
+            if fd == 0 or out[fd - 1] in " \t;&|":  # `2>` names a descriptor; `2 >` keeps 2 as an argument
+                del out[fd:]
         elif not quote and c == "\n":  # ends a command, unless the line ended on an operator
             c = " " if "".join(out).rstrip()[-1:] in ("", ";", "&", "|", "(") else ";"
         out.append(c)
@@ -127,8 +133,6 @@ def _strip_redirects(toks: list[str]) -> list[str]:
         if skip:
             skip = False
         elif t and set(t) <= set("<>&") and set(t) & set("<>"):
-            if out and out[-1].isdigit():  # the `2` of `2>`
-                out.pop()
             skip = True
         else:
             out.append(t)
@@ -300,12 +304,16 @@ def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
 _SHELL_EDIT = re.compile(r"\b(?:sed|perl)\s+-i|\btee\b|apply_patch|write_text|(?<![0-9&])>>?\s*(?!/dev/null|&)[\w./]")
 
 
-def _edited_between(trace: Trace, a: _Run, b: _Run) -> bool:
-    """A file edit between the runs may have changed the script itself (dropped the import), so the
-    later run no longer tests what failed."""
-    between = any(_EDIT_TOOL.search(x.name or "") or _SHELL_EDIT.search(_command_of(x) or "")
-                  for x in trace.actions[a.i + 1:b.i])
-    return between or bool(_IN_PLACE.search(b.command))  # `sed -i … && uv run …`; its `> log` is no edit
+def _edited_between(trace: Trace, a: _Run, b: _Run, head: str) -> bool:
+    """A file edit between the runs, or before the invocation in the working run, may have changed
+    the script itself (dropped the import), so the later run no longer tests what failed."""
+    if any(_EDIT_TOOL.search(x.name or "") or _SHELL_EDIT.search(_command_of(x) or "")
+           for x in trace.actions[a.i + 1:b.i]):
+        return True
+    runs_head = re.compile(rf"(?<![\w./-]){re.escape(head)}\b")
+    # The invocation's own `> log` is output, not an edit; any other segment's write may be one.
+    return any(_IN_PLACE.search(seg) if runs_head.search(seg) else _SHELL_EDIT.search(seg)
+               for seg in re.split(r"[;&|]", _mask(b.command)))
 
 
 def _same_place(a: _Run, b: _Run) -> bool:
@@ -406,7 +414,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
         # Each failure needs its own repair to count as explained; the first one found writes the claim.
         # A script or module is only the same one run from the same place.
         for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or _same_place(a, r))):
-            if _installed_between(runs, a, b) or (not missing_cmd and _edited_between(trace, a, b)):
+            if _installed_between(runs, a, b) or (not missing_cmd and _edited_between(trace, a, b, head)):
                 fix = None
             elif missing_env:
                 fix = _env_fix(missing_env, head, args, b)
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 2bda357..86e68b6 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -81,6 +81,12 @@ def test_a_successful_run_that_prints_error_text_is_not_a_failure(self):
         self.assertEqual(_mine(_bash("rg \"No module named 'turso'\" errors.log", "No module named 'turso'"),
                                _bash("uv run rg \"No module named 'turso'\" errors.log", "No module named 'turso'")), [])
 
+    def test_a_number_before_a_spaced_redirection_is_an_argument(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
+                               _bash("uv run python app.py 2 >out", "ok")), [])
+        self.assertEqual(_mine(_bash("python app.py 2 > /dev/null", "No module named 'turso'", "error"),
+                               _bash("uv run python app.py", "ok")), [])
+
     def test_redirections_are_not_arguments(self):
         [d] = _mine(_bash("python app.py", "No module named 'turso'", "error"),
                     _bash("uv run python app.py >out 2>&1", "ok"))
@@ -199,8 +205,9 @@ def test_an_error_from_a_pipeline_is_not_attributed(self):
                                _bash("uv run python producer.py", "ok")), [])
 
     def test_an_edit_in_the_working_run_itself_counts(self):
-        self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
-                               _bash("sed -i '/import turso/d' app.py && uv run python app.py", "ok")), [])
+        for later in ("sed -i '/import turso/d' app.py && uv run python app.py",
+                      "echo 'print(1)' > app.py && uv run python app.py", "echo x | tee app.py; uv run python app.py"):
+            self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), _bash(later, "ok")), [], later)
 
     def test_a_quoted_angle_bracket_is_an_argument(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),

From 65ab06a1833db5ad70d3dca6df1b7047c023a863 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:56:06 +0000
Subject: [PATCH 30/43] repairs: a relative-path fix must run from the same
 place

---
 kypp/repairs.py       | 6 +++++-
 tests/test_repairs.py | 4 ++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 60f67be..fb60934 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -419,7 +419,11 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
             elif missing_env:
                 fix = _env_fix(missing_env, head, args, b)
             else:
-                fix = (form := _working_form(head, args, b)) and f"`{shlex.join(form)} …`"
+                form = _working_form(head, args, b)
+                # a relative path (`.venv/bin/pytest`) only works from where it ran
+                if form and "/" in form[0] and not _same_place(a, b):
+                    form = None
+                fix = form and f"`{shlex.join(form)} …`"
             if fix:
                 shown = 1 + (2 if args[:1] == ["-m"] else len(args[:1]))  # the command and script, never its arguments
                 drafts.setdefault(subject, ClaimDraft("pitfall", subject, f"{_render(_redact(toks), shown)} {why}; {fix} works.", 0.6))
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 86e68b6..b630acb 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -213,6 +213,10 @@ def test_a_quoted_angle_bracket_is_an_argument(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv run python app.py '>' --help", "usage")), [])
 
+    def test_a_path_form_from_another_directory_is_not_a_fix(self):
+        self.assertEqual(_mine(_bash("pytest -q", "pytest: command not found", "error"),
+                               _bash("cd backend && .venv/bin/pytest -q", "ok")), [])
+
     def test_a_url_or_user_in_the_working_form_is_never_written(self):
         self.assertEqual(_mine(_bash("mycli", "mycli: command not found", "error"),
                                _bash("npx https://user:TOKEN@packages.example/mycli", "ok")), [])

From b5adba227bc00e929958f02943cc23ac3b20e8aa Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:58:24 +0000
Subject: [PATCH 31/43] repairs: keep argv boundaries when joining a command
 list

---
 kypp/repairs.py       | 2 +-
 tests/test_repairs.py | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index fb60934..1dd0c5f 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -80,7 +80,7 @@ def _command_of(a: Action) -> str | None:
         return None
     c = a.input.get("command", a.input.get("cmd"))
     if isinstance(c, list):  # codex: ["bash", "-lc", "<script>"] or argv
-        c = c[-1] if len(c) >= 3 and c[1] in ("-c", "-lc") else " ".join(map(str, c))
+        c = c[-1] if len(c) >= 3 and c[1] in ("-c", "-lc") else shlex.join(map(str, c))
     return c.strip() if isinstance(c, str) and c.strip() else None
 
 
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index b630acb..6e2445b 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -213,6 +213,12 @@ def test_a_quoted_angle_bracket_is_an_argument(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),
                                _bash("uv run python app.py '>' --help", "usage")), [])
 
+    def test_an_argv_command_keeps_its_argument_boundaries(self):
+        argv = lambda c, out, st: {"sessionId": "s1", "payload": {"type": "tool_call", "name": "shell", "status": st,
+                                                                  "input": {"command": c}, "output": out}}
+        self.assertEqual(_mine(argv(["python", "app.py", "hello world"], "No module named 'turso'", "error"),
+                               argv(["uv", "run", "python", "app.py", "hello", "world"], "ok", "completed")), [])
+
     def test_a_path_form_from_another_directory_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("pytest -q", "pytest: command not found", "error"),
                                _bash("cd backend && .venv/bin/pytest -q", "ok")), [])

From 62a3d66135613119fdb2ef65baca841663b77983 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:05:39 +0000
Subject: [PATCH 32/43] repairs: exempt only the segment that runs the command
 from the write check

---
 kypp/repairs.py       | 10 ++++++++--
 tests/test_repairs.py |  4 +++-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 1dd0c5f..270a00f 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -310,9 +310,15 @@ def _edited_between(trace: Trace, a: _Run, b: _Run, head: str) -> bool:
     if any(_EDIT_TOOL.search(x.name or "") or _SHELL_EDIT.search(_command_of(x) or "")
            for x in trace.actions[a.i + 1:b.i]):
         return True
-    runs_head = re.compile(rf"(?<![\w./-]){re.escape(head)}\b")
+    def runs_head(seg: str) -> bool:  # as the command or behind a wrapper: `echo python > app.py` doesn't
+        for toks, _, _ in _chain(seg.translate(_UNMASK)):
+            w = _split_env(toks)[1]
+            j = next((k for k, t in enumerate(w) if _base(t) == head), None)
+            if j == 0 or (j and (_base(w[0]), *w[1:j]) in _WRAPPERS):
+                return True
+        return False
     # The invocation's own `> log` is output, not an edit; any other segment's write may be one.
-    return any(_IN_PLACE.search(seg) if runs_head.search(seg) else _SHELL_EDIT.search(seg)
+    return any(_IN_PLACE.search(seg) if runs_head(seg) else _SHELL_EDIT.search(seg)
                for seg in re.split(r"[;&|]", _mask(b.command)))
 
 
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 6e2445b..4fc1f24 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -206,7 +206,9 @@ def test_an_error_from_a_pipeline_is_not_attributed(self):
 
     def test_an_edit_in_the_working_run_itself_counts(self):
         for later in ("sed -i '/import turso/d' app.py && uv run python app.py",
-                      "echo 'print(1)' > app.py && uv run python app.py", "echo x | tee app.py; uv run python app.py"):
+                      "echo 'print(1)' > app.py && uv run python app.py",
+                      "echo 'print(\"python\")' > app.py && uv run python app.py",
+                      "echo python > app.py && uv run python app.py", "echo x | tee app.py; uv run python app.py"):
             self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"), _bash(later, "ok")), [], later)
 
     def test_a_quoted_angle_bracket_is_an_argument(self):

From 0ad24a89003c0a8f55659ef5d0edc133c97c7292 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:11:30 +0000
Subject: [PATCH 33/43] repairs: a cd made on its own between runs changes the
 place

---
 kypp/repairs.py       | 9 ++++++---
 tests/test_repairs.py | 4 ++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 270a00f..eb91b39 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -198,16 +198,19 @@ def _succeeded(a: Action) -> bool:
 
 
 def _runs(trace: Trace) -> list[_Run]:
-    runs = []
+    runs, moved = [], 0
     for i, a in enumerate(trace.actions):
         cmd = _command_of(a)
         if cmd and "<<" not in cmd:  # a heredoc body isn't commands
             segs = _segments(cmd)
-            moves = [t[0] in ("cd", "pushd") for t in segs]
+            moves = [t[0] in ("cd", "pushd", "popd") for t in segs]
             first_cmd = moves.index(False) if False in moves else len(moves)
+            # A shell that persists (Claude's Bash) keeps a `cd` made on its own, so count those before this run;
+            # `cd x && cmd` is read as self-contained, since its place is already in `where`.
             where = None if any(moves[first_cmd:]) else (
-                str(a.input.get("workdir") or a.input.get("cwd") or ""),
+                moved, str(a.input.get("workdir") or a.input.get("cwd") or ""),
                 *(" ".join(t[1:]) for t in segs[:first_cmd]))
+            moved += all(moves)
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where))
     return runs
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 4fc1f24..10319cc 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -174,6 +174,10 @@ def test_the_failing_form_shows_only_the_script(self):
         self.assertNotIn("SECRET", d.content)
         self.assertIn("`python app.py …` fails here", d.content)
 
+    def test_a_cd_in_between_changes_the_place(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"), _bash("cd other", ""),
+                               _bash("uv run python app.py", "ok")), [])
+
     def test_a_cd_after_the_command_leaves_the_place_unclear(self):
         self.assertEqual(_mine(_bash("python app.py; cd server", "No module named 'turso'", "error"),
                                _bash("cd server; uv run python app.py", "ok")), [])

From 106f9292e0306ad5d394a8ee564cc2ab55c824c4 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:13:00 +0000
Subject: [PATCH 34/43] repairs: check the wrapped executable's path, not the
 wrapper's

---
 kypp/repairs.py       | 4 ++--
 tests/test_repairs.py | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index eb91b39..a81e30f 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -429,8 +429,8 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
                 fix = _env_fix(missing_env, head, args, b)
             else:
                 form = _working_form(head, args, b)
-                # a relative path (`.venv/bin/pytest`) only works from where it ran
-                if form and "/" in form[0] and not _same_place(a, b):
+                # a relative path (`.venv/bin/pytest`, `uv run .venv/bin/pytest`) only works from where it ran
+                if form and "/" in form[-1] and not _same_place(a, b):
                     form = None
                 fix = form and f"`{shlex.join(form)} …`"
             if fix:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 10319cc..9fe0d1a 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -228,6 +228,8 @@ def test_an_argv_command_keeps_its_argument_boundaries(self):
     def test_a_path_form_from_another_directory_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("pytest -q", "pytest: command not found", "error"),
                                _bash("cd backend && .venv/bin/pytest -q", "ok")), [])
+        self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
+                               _bash("cd backend && uv run .venv/bin/pytest", "ok")), [])
 
     def test_a_url_or_user_in_the_working_form_is_never_written(self):
         self.assertEqual(_mine(_bash("mycli", "mycli: command not found", "error"),

From 2d94ec7fb6986b247faa83c69294f75bba6f37a5 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:15:43 +0000
Subject: [PATCH 35/43] repairs: reject any absolute path and env changes
 between the runs

---
 kypp/repairs.py       | 9 ++++++---
 tests/test_repairs.py | 8 ++++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index a81e30f..7a82ecb 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -60,7 +60,8 @@
              "DEBUG", "PORT", "HOST", "FORCE_COLOR", "NO_COLOR", "PYTHONUNBUFFERED", "PYTHONDONTWRITEBYTECODE"}
 _USERINFO = re.compile(r"://[^/\s]*@")
 _EXIT_CODE = re.compile(r"(?:Exit code:?|\"exit_code\":|Process exited with code)\s*(-?\d+)")
-_ABS = re.compile(r"(?:^|\s)/(?:var|tmp|private|Users|home|root)/")
+# Any absolute or home-relative path is this host's, wherever it is rooted.
+_ABS = re.compile(r"(?:^|[\s:=])[/~]")
 
 
 @dataclass
@@ -332,8 +333,10 @@ def _same_place(a: _Run, b: _Run) -> bool:
 
 def _installed_between(runs: list[_Run], a: _Run, b: _Run) -> bool:
     """Any install or sync after the failure, up to and including the run that worked (`uv sync` and
-    `pip install -r` don't name what they install), may be why it worked: the fact won't hold."""
-    return any(a.i < r.i <= b.i and any(_INSTALLS & set(t) for t, _, _ in _chain(r.command)) for r in runs)
+    `pip install -r` don't name what they install), may be why it worked: the fact won't hold. So may
+    an `export` or `source` between them, which persists in the shell."""
+    return any(a.i < r.i <= b.i and any(_INSTALLS & set(t) for t, _, _ in _chain(r.command)) or a.i < r.i < b.i
+               and _changes_env(r.segments) for r in runs)
 
 
 def _probes(args: list[str]) -> bool:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 9fe0d1a..c7331e8 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -70,6 +70,14 @@ def test_probes_and_installs_are_not_repairs(self):
     def test_a_host_path_form_is_not_a_fact(self):
         self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"),
                                _bash("/home/u/.venv/bin/pytest", "ok")), [])
+        for path in ("/opt/company/venv/bin/pytest", "/workspace/.venv/bin/pytest", "/mnt/x/pytest",
+                     "~/.local/bin/pytest", "/opt/uv run pytest"):
+            self.assertEqual(_mine(_bash("pytest", "pytest: command not found", "error"), _bash(path, "ok")), [], path)
+
+    def test_an_export_between_the_runs_may_be_the_fix(self):
+        for setup in ("export PYTHONPATH=src", "source .venv/bin/activate", "PYTHONPATH=src; true"):
+            self.assertEqual(_mine(_bash("python app.py", "ModuleNotFoundError: No module named 'project'", "error"),
+                                   _bash(setup, "ok"), _bash("uv run python app.py", "ok")), [], setup)
 
 
     def test_a_piped_run_fails_by_its_output(self):

From 1e32b1221fc98e0fe668c2dc9befb33f799f449f Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:19:03 +0000
Subject: [PATCH 36/43] repairs: every relative cd moves the persistent shell

---
 kypp/repairs.py       |  6 +++---
 tests/test_repairs.py | 11 +++++++++--
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 7a82ecb..d603404 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -206,12 +206,12 @@ def _runs(trace: Trace) -> list[_Run]:
             segs = _segments(cmd)
             moves = [t[0] in ("cd", "pushd", "popd") for t in segs]
             first_cmd = moves.index(False) if False in moves else len(moves)
-            # A shell that persists (Claude's Bash) keeps a `cd` made on its own, so count those before this run;
-            # `cd x && cmd` is read as self-contained, since its place is already in `where`.
+            # A shell that persists (Claude's Bash) keeps every `cd`, so count those before this run; only a
+            # `cd /abs` lands in the same place again, wherever the shell was.
             where = None if any(moves[first_cmd:]) else (
                 moved, str(a.input.get("workdir") or a.input.get("cwd") or ""),
                 *(" ".join(t[1:]) for t in segs[:first_cmd]))
-            moved += all(moves)
+            moved += any(t[0] != "cd" or not t[1:] or not all(x.startswith("/") for x in t[1:]) for t in segs if t[0] in ("cd", "pushd", "popd"))
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where))
     return runs
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index c7331e8..01958b4 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -162,9 +162,16 @@ def test_interpreter_that_can_import_it(self):
     def test_the_same_script_name_elsewhere_is_not_the_same_script(self):
         self.assertEqual(_mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
                                _bash("cd client && uv run python app.py", "ok")), [])
-        [d] = _mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
-                    _bash("cd server && uv run python app.py", "ok"), _bash("cd client && python app.py", "ok"))
+        [d] = _mine(_bash("cd /r/server && python app.py", "No module named 'project'", "error"),
+                    _bash("cd /r/server && uv run python app.py", "ok"), _bash("cd /r/client && python app.py", "ok"))
         self.assertIn("`uv run python …` works", d.content)
+        # the shell keeps a relative `cd`, so the second one lands somewhere else
+        self.assertEqual(_mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
+                               _bash("cd server && uv run python app.py", "ok")), [])
+
+    def test_a_cd_inside_a_compound_command_moves_the_shell(self):
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
+                               _bash("cd other && ls", "ok"), _bash("uv run python app.py", "ok")), [])
 
     def test_a_script_help_probe_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),

From 01146e661911541a57eccf94aa955cf9e268daf5 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:21:00 +0000
Subject: [PATCH 37/43] repairs: skip runs fed stdin; scan between runs only
 for a candidate fix

---
 kypp/repairs.py       | 20 ++++++++++++--------
 tests/test_repairs.py | 12 ++++++++++++
 2 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index d603404..65d2e54 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -74,6 +74,9 @@ class _Run:
     ok: bool  # confirmed to have succeeded; a run with no recorded outcome is neither
     may_fail: bool  # failed, or its exit status could hide a failure (`pytest | tail`, `pytest; echo`)
     where: tuple | None  # workdir and `cd` targets; None when a `cd` follows a command, so the place is unclear
+    installs: bool  # runs an install or sync
+    sets_env: bool  # sets, exports, unsets or sources something, which a persistent shell keeps
+    reads_input: bool  # a `<` input may choose what the script does, so two runs of it can differ
 
 
 def _command_of(a: Action) -> str | None:
@@ -213,7 +216,8 @@ def _runs(trace: Trace) -> list[_Run]:
                 *(" ".join(t[1:]) for t in segs[:first_cmd]))
             moved += any(t[0] != "cd" or not t[1:] or not all(x.startswith("/") for x in t[1:]) for t in segs if t[0] in ("cd", "pushd", "popd"))
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
-            runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where))
+            runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where,
+                             any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), _changes_env(segs), "<" in _mask(cmd)))
     return runs
 
 
@@ -335,8 +339,7 @@ def _installed_between(runs: list[_Run], a: _Run, b: _Run) -> bool:
     """Any install or sync after the failure, up to and including the run that worked (`uv sync` and
     `pip install -r` don't name what they install), may be why it worked: the fact won't hold. So may
     an `export` or `source` between them, which persists in the shell."""
-    return any(a.i < r.i <= b.i and any(_INSTALLS & set(t) for t, _, _ in _chain(r.command)) or a.i < r.i < b.i
-               and _changes_env(r.segments) for r in runs)
+    return any(a.i < r.i <= b.i and r.installs or a.i < r.i < b.i and r.sets_env for r in runs)
 
 
 def _probes(args: list[str]) -> bool:
@@ -397,7 +400,7 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
     for a in runs:
         # Error text counts only from a run that failed, or one whose status could hide it (`… | tail`):
         # a successful `rg "No module named"` just printed it.
-        if not a.may_fail:
+        if not a.may_fail or a.reads_input:
             continue
         missing_cmd = _first(_CMD_MISSING, a.output)
         missing_mod = None if missing_cmd else _first(_MOD_MISSING, a.output)
@@ -425,10 +428,8 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
             continue
         # Each failure needs its own repair to count as explained; the first one found writes the claim.
         # A script or module is only the same one run from the same place.
-        for b in (r for r in runs if r.i > a.i and r.ok and (missing_cmd or _same_place(a, r))):
-            if _installed_between(runs, a, b) or (not missing_cmd and _edited_between(trace, a, b, head)):
-                fix = None
-            elif missing_env:
+        for b in (r for r in runs if r.i > a.i and r.ok and not r.reads_input and (missing_cmd or _same_place(a, r))):
+            if missing_env:
                 fix = _env_fix(missing_env, head, args, b)
             else:
                 form = _working_form(head, args, b)
@@ -436,6 +437,9 @@ def mine(trace: Trace) -> tuple[list[ClaimDraft], set[int]]:
                 if form and "/" in form[-1] and not _same_place(a, b):
                     form = None
                 fix = form and f"`{shlex.join(form)} …`"
+            # checked only for a candidate fix: each scans every run in between
+            if fix and (_installed_between(runs, a, b) or (not missing_cmd and _edited_between(trace, a, b, head))):
+                fix = None
             if fix:
                 shown = 1 + (2 if args[:1] == ["-m"] else len(args[:1]))  # the command and script, never its arguments
                 drafts.setdefault(subject, ClaimDraft("pitfall", subject, f"{_render(_redact(toks), shown)} {why}; {fix} works.", 0.6))
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 01958b4..5aa4c08 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -169,6 +169,18 @@ def test_the_same_script_name_elsewhere_is_not_the_same_script(self):
         self.assertEqual(_mine(_bash("cd server && python app.py", "No module named 'project'", "error"),
                                _bash("cd server && uv run python app.py", "ok")), [])
 
+    def test_a_run_reading_stdin_may_take_another_path(self):
+        self.assertEqual(_mine(_bash("python app.py < deploy.txt", "No module named 'boto3'", "error"),
+                               _bash("uv run python app.py < status.txt", "ok")), [])
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'boto3'", "error"),
+                               _bash("uv run python app.py < status.txt", "ok")), [])
+
+    def test_unrelated_successes_stay_cheap(self):
+        import time
+        t = time.monotonic()
+        _mine(_bash("pytest", "pytest: command not found", "error"), *[_bash(f"ls d{i} && pip install x{i}", "ok") for i in range(400)])
+        self.assertLess(time.monotonic() - t, 1.0)
+
     def test_a_cd_inside_a_compound_command_moves_the_shell(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
                                _bash("cd other && ls", "ok"), _bash("uv run python app.py", "ok")), [])

From 883c3b4069b84856d6a3f6c9939479798e4a6823 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:23:38 +0000
Subject: [PATCH 38/43] repairs: follow the persistent shell's directory
 through every cd

---
 kypp/repairs.py       | 29 +++++++++++++++++++++--------
 tests/test_repairs.py |  5 +++++
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 65d2e54..053fbf8 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -73,7 +73,7 @@ class _Run:
     output: str
     ok: bool  # confirmed to have succeeded; a run with no recorded outcome is neither
     may_fail: bool  # failed, or its exit status could hide a failure (`pytest | tail`, `pytest; echo`)
-    where: tuple | None  # workdir and `cd` targets; None when a `cd` follows a command, so the place is unclear
+    where: tuple | None  # where the shell was when it ran; None when a `cd` follows a command, so the place is unclear
     installs: bool  # runs an install or sync
     sets_env: bool  # sets, exports, unsets or sources something, which a persistent shell keeps
     reads_input: bool  # a `<` input may choose what the script does, so two runs of it can differ
@@ -201,20 +201,33 @@ def _succeeded(a: Action) -> bool:
     return not _failed(a) and (a.status == "completed" or _exit(a) == "0") and not _errs(a.output or "")
 
 
+def _walk(place: tuple, cds: list[list[str]], unknown: list[int]) -> tuple:
+    """Where these `cd`s land from `place`: a `cd /abs` lands in the same place from anywhere; one we
+    can't follow (`cd -`, `pushd`, `popd`) lands somewhere no other run can match."""
+    for t in cds:
+        if t[0] == "cd" and len(t) == 2 and t[1] not in ("-", "~") and not t[1].startswith("~"):
+            place = (t[1],) if t[1].startswith("/") else (*place, t[1])
+        else:
+            unknown[0] += 1
+            place = ("?", unknown[0])
+    return place
+
+
 def _runs(trace: Trace) -> list[_Run]:
-    runs, moved = [], 0
+    runs, shell, unknown = [], None, [0]
     for i, a in enumerate(trace.actions):
         cmd = _command_of(a)
         if cmd and "<<" not in cmd:  # a heredoc body isn't commands
             segs = _segments(cmd)
             moves = [t[0] in ("cd", "pushd", "popd") for t in segs]
             first_cmd = moves.index(False) if False in moves else len(moves)
-            # A shell that persists (Claude's Bash) keeps every `cd`, so count those before this run; only a
-            # `cd /abs` lands in the same place again, wherever the shell was.
-            where = None if any(moves[first_cmd:]) else (
-                moved, str(a.input.get("workdir") or a.input.get("cwd") or ""),
-                *(" ".join(t[1:]) for t in segs[:first_cmd]))
-            moved += any(t[0] != "cd" or not t[1:] or not all(x.startswith("/") for x in t[1:]) for t in segs if t[0] in ("cd", "pushd", "popd"))
+            # A call that names its directory starts there; otherwise the shell persists (Claude's Bash)
+            # and keeps every `cd`, so the run starts where the last one left it.
+            wd = str(a.input.get("workdir") or a.input.get("cwd") or "")
+            base = ("", wd) if wd else shell or ("", "")
+            where = None if any(moves[first_cmd:]) else _walk(base, segs[:first_cmd], unknown)
+            if any(moves) and not wd:
+                shell = _walk(base, [t for t, m in zip(segs, moves) if m], unknown)
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where,
                              any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), _changes_env(segs), "<" in _mask(cmd)))
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 5aa4c08..5af2ebe 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -184,6 +184,11 @@ def test_unrelated_successes_stay_cheap(self):
     def test_a_cd_inside_a_compound_command_moves_the_shell(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
                                _bash("cd other && ls", "ok"), _bash("uv run python app.py", "ok")), [])
+        self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
+                               _bash("cd /other", "ok"), _bash("uv run python app.py", "ok")), [])
+        [d] = _mine(_bash("cd /r && python app.py", "No module named 'project'", "error"),
+                    _bash("cd /elsewhere && ls", "ok"), _bash("cd /r && uv run python app.py", "ok"))
+        self.assertIn("`uv run python …` works", d.content)
 
     def test_a_script_help_probe_is_not_a_fix(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'turso'", "error"),

From c298b45d359461ed05a3fdd1fe75227f29ba6e63 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:26:08 +0000
Subject: [PATCH 39/43] repairs: only Claude's Bash keeps its directory across
 calls

---
 kypp/repairs.py       | 9 +++++----
 tests/test_repairs.py | 5 +++++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 053fbf8..7600088 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -221,12 +221,13 @@ def _runs(trace: Trace) -> list[_Run]:
             segs = _segments(cmd)
             moves = [t[0] in ("cd", "pushd", "popd") for t in segs]
             first_cmd = moves.index(False) if False in moves else len(moves)
-            # A call that names its directory starts there; otherwise the shell persists (Claude's Bash)
-            # and keeps every `cd`, so the run starts where the last one left it.
+            # Only Claude's Bash keeps one shell, and every `cd`, across calls, so its run starts where the
+            # last one left it; any other call starts fresh, in its named directory.
             wd = str(a.input.get("workdir") or a.input.get("cwd") or "")
-            base = ("", wd) if wd else shell or ("", "")
+            persists = (a.name or "").lower() == "bash" and not wd
+            base = shell or ("", "") if persists else ("", wd)
             where = None if any(moves[first_cmd:]) else _walk(base, segs[:first_cmd], unknown)
-            if any(moves) and not wd:
+            if any(moves) and persists:
                 shell = _walk(base, [t for t, m in zip(segs, moves) if m], unknown)
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where,
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 5af2ebe..83ab746 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -181,6 +181,11 @@ def test_unrelated_successes_stay_cheap(self):
         _mine(_bash("pytest", "pytest: command not found", "error"), *[_bash(f"ls d{i} && pip install x{i}", "ok") for i in range(400)])
         self.assertLess(time.monotonic() - t, 1.0)
 
+    def test_each_codex_call_starts_a_fresh_shell(self):
+        [d] = _mine(_codex("cd backend && python app.py", "Exit code: 1\nNo module named 'project'"),
+                    _codex("cd backend && uv run python app.py", "Exit code: 0\nok"))
+        self.assertIn("`uv run python …` works", d.content)
+
     def test_a_cd_inside_a_compound_command_moves_the_shell(self):
         self.assertEqual(_mine(_bash("python app.py", "No module named 'project'", "error"),
                                _bash("cd other && ls", "ok"), _bash("uv run python app.py", "ok")), [])

From 6ca0629b7dadd59d8f1543b24a1bbd7291fa958f Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:31:29 +0000
Subject: [PATCH 40/43] repairs: a piped or backgrounded cd leaves the shell's
 place unknown

---
 kypp/repairs.py       | 2 ++
 tests/test_repairs.py | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 7600088..27512b4 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -229,6 +229,8 @@ def _runs(trace: Trace) -> list[_Run]:
             where = None if any(moves[first_cmd:]) else _walk(base, segs[:first_cmd], unknown)
             if any(moves) and persists:
                 shell = _walk(base, [t for t, m in zip(segs, moves) if m], unknown)
+                if any(o in ("|", "&") for _, before, after in _chain(cmd) for o in (before, after)):
+                    shell = _walk(base, [["popd"]], unknown)  # a piped or backgrounded `cd` may run in a subshell
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where,
                              any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), _changes_env(segs), "<" in _mask(cmd)))
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 83ab746..2d8713b 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -181,6 +181,10 @@ def test_unrelated_successes_stay_cheap(self):
         _mine(_bash("pytest", "pytest: command not found", "error"), *[_bash(f"ls d{i} && pip install x{i}", "ok") for i in range(400)])
         self.assertLess(time.monotonic() - t, 1.0)
 
+    def test_a_piped_cd_leaves_the_place_unknown(self):
+        self.assertEqual(_mine(_bash("cd /other | cat", "ok"), _bash("python app.py", "No module named 'project'", "error"),
+                               _bash("cd /other && uv run python app.py", "ok")), [])
+
     def test_each_codex_call_starts_a_fresh_shell(self):
         [d] = _mine(_codex("cd backend && python app.py", "Exit code: 1\nNo module named 'project'"),
                     _codex("cd backend && uv run python app.py", "Exit code: 0\nok"))

From 080c429e24d806605b1c937bf30d51f9008a32f0 Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:35:40 +0000
Subject: [PATCH 41/43] repairs: a bare run after an export doesn't prove the
 variable unneeded

---
 kypp/repairs.py       | 14 +++++++++++---
 tests/test_repairs.py |  5 +++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index 27512b4..ff87ab1 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -75,7 +75,7 @@ class _Run:
     may_fail: bool  # failed, or its exit status could hide a failure (`pytest | tail`, `pytest; echo`)
     where: tuple | None  # where the shell was when it ran; None when a `cd` follows a command, so the place is unclear
     installs: bool  # runs an install or sync
-    sets_env: bool  # sets, exports, unsets or sources something, which a persistent shell keeps
+    sets_env: bool  # exports, unsets or sources something, or assigns on its own, which the shell keeps
     reads_input: bool  # a `<` input may choose what the script does, so two runs of it can differ
 
 
@@ -233,7 +233,7 @@ def _runs(trace: Trace) -> list[_Run]:
                     shell = _walk(base, [["popd"]], unknown)  # a piped or backgrounded `cd` may run in a subshell
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where,
-                             any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), _changes_env(segs), "<" in _mask(cmd)))
+                             any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), _persists_env(segs), "<" in _mask(cmd)))
     return runs
 
 
@@ -300,6 +300,13 @@ def _changes_env(segments: list[list[str]]) -> bool:
     return any(_split_env(seg)[0] or seg[0] in ("export", "set", "unset", "source", ".") for seg in segments)
 
 
+def _persists_env(segments: list[list[str]]) -> bool:
+    """An env change the shell keeps for later calls: `export`, `source`, or an assignment on its own;
+    `X=1 cmd` sets it for that command only."""
+    return any(seg[0] in ("export", "set", "unset", "source", ".") or (_split_env(seg)[0] and not _split_env(seg)[1])
+               for seg in segments)
+
+
 def _working_form(head: str, args: list[str], later: _Run) -> list[str] | None:
     """The tokens a later, successful command runs `head` with, when it runs it another way: behind a
     wrapper (`uv run pytest`, `python -m pytest`, `npx tsc`) or by a path (`.venv/bin/pytest`)."""
@@ -366,7 +373,8 @@ def _probes(args: list[str]) -> bool:
 def _works_unchanged_later(runs: list[_Run], a: _Run, head: str, args: list[str], same_place: bool) -> bool:
     """The same thing ran bare later, without the fix, and worked: installed or fixed mid-session."""
     for r in runs:
-        if r.i > a.i and r.ok and (not same_place or _same_place(a, r)) and not _changes_env(r.segments):
+        # a run after an `export` may only work because it inherited the fix
+        if r.i > a.i and r.ok and (not same_place or _same_place(a, r)) and not any(x.sets_env for x in runs if a.i < x.i <= r.i):
             for env, toks in map(_split_env, r.proven):
                 # unchanged: no env anywhere in the run, and a probe (`--help`) doesn't prove the real run works
                 if toks[:1] == [head] and _same(toks[1:], args) and not env and not _probes(toks[1:]):
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 2d8713b..b8659f7 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -181,6 +181,11 @@ def test_unrelated_successes_stay_cheap(self):
         _mine(_bash("pytest", "pytest: command not found", "error"), *[_bash(f"ls d{i} && pip install x{i}", "ok") for i in range(400)])
         self.assertLess(time.monotonic() - t, 1.0)
 
+    def test_a_bare_run_after_an_export_inherits_the_fix(self):
+        [d] = _mine(_bash("node build.js", "Error: API_BASE is not set", "error"), _bash("API_BASE=x node build.js", "ok"),
+                    _bash("export API_BASE=x", "ok"), _bash("node build.js", "ok"))
+        self.assertIn("`API_BASE", d.content)
+
     def test_a_piped_cd_leaves_the_place_unknown(self):
         self.assertEqual(_mine(_bash("cd /other | cat", "ok"), _bash("python app.py", "No module named 'project'", "error"),
                                _bash("cd /other && uv run python app.py", "ok")), [])

From 2f03dd56938d53fb96a38a8b8694376a700b0e7f Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:39:46 +0000
Subject: [PATCH 42/43] repairs: follow a cd only when the run proves it ran;
 export runs nothing

---
 kypp/repairs.py       | 10 ++++++----
 tests/test_repairs.py |  9 +++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index ff87ab1..e0970bc 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -228,9 +228,10 @@ def _runs(trace: Trace) -> list[_Run]:
             base = shell or ("", "") if persists else ("", wd)
             where = None if any(moves[first_cmd:]) else _walk(base, segs[:first_cmd], unknown)
             if any(moves) and persists:
-                shell = _walk(base, [t for t, m in zip(segs, moves) if m], unknown)
-                if any(o in ("|", "&") for _, before, after in _chain(cmd) for o in (before, after)):
-                    shell = _walk(base, [["popd"]], unknown)  # a piped or backgrounded `cd` may run in a subshell
+                # Follow the `cd`s only when the run proves they all ran: it succeeded, chained only by `&&`.
+                # Otherwise one may have been skipped, failed, or run in a subshell (`| cat`, `&`).
+                sure = _succeeded(a) and all(op in ("", "&&") for _, _, op in _chain(cmd))
+                shell = _walk(base, [t for t, m in zip(segs, moves) if m] if sure else [["popd"]], unknown)
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where,
                              any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), _persists_env(segs), "<" in _mask(cmd)))
@@ -248,7 +249,8 @@ def _split_env(toks: list[str]) -> tuple[dict[str, str], list[str]]:
     while k < len(toks) and (m := _ASSIGN.match(toks[k])):
         env[m.group(1)] = m.group(2)
         k += 1
-    return env, toks[k:]
+    # `export A=1 python app` only exports names; it runs nothing
+    return env, [] if toks[:1] == ["export"] else toks[k:]
 
 
 def _base(tok: str) -> str:
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index b8659f7..5bb76a2 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -186,6 +186,15 @@ def test_a_bare_run_after_an_export_inherits_the_fix(self):
                     _bash("export API_BASE=x", "ok"), _bash("node build.js", "ok"))
         self.assertIn("`API_BASE", d.content)
 
+    def test_a_cd_that_may_not_have_run_leaves_the_place_unknown(self):
+        for cd, status in (("false && cd /other", "error"), ("cd /other || true", "completed"), ("cd /other; ls", "completed")):
+            self.assertEqual(_mine(_bash(cd, "", status), _bash("python app.py", "No module named 'project'", "error"),
+                                   _bash("cd /other && uv run python app.py", "ok")), [], cd)
+
+    def test_an_export_runs_nothing(self):
+        self.assertEqual(_mine(_bash("python app", "API_BASE is not set", "error"),
+                               _bash("export API_BASE=x python app", "ok")), [])
+
     def test_a_piped_cd_leaves_the_place_unknown(self):
         self.assertEqual(_mine(_bash("cd /other | cat", "ok"), _bash("python app.py", "No module named 'project'", "error"),
                                _bash("cd /other && uv run python app.py", "ok")), [])

From 9bd3a068b53baff746e6a4cd35da4f427e58d40e Mon Sep 17 00:00:00 2001
From: vu1n <2105991+vu1n@users.noreply.github.com>
Date: Tue, 27 Oct 2026 05:44:05 +0000
Subject: [PATCH 43/43] repairs: only a persistent shell carries an export to
 the next call

---
 kypp/repairs.py       | 4 ++--
 tests/test_repairs.py | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/kypp/repairs.py b/kypp/repairs.py
index e0970bc..2c87f0d 100644
--- a/kypp/repairs.py
+++ b/kypp/repairs.py
@@ -75,7 +75,7 @@ class _Run:
     may_fail: bool  # failed, or its exit status could hide a failure (`pytest | tail`, `pytest; echo`)
     where: tuple | None  # where the shell was when it ran; None when a `cd` follows a command, so the place is unclear
     installs: bool  # runs an install or sync
-    sets_env: bool  # exports, unsets or sources something, or assigns on its own, which the shell keeps
+    sets_env: bool  # in a persistent shell, exports, unsets or sources something, or assigns on its own
     reads_input: bool  # a `<` input may choose what the script does, so two runs of it can differ
 
 
@@ -234,7 +234,7 @@ def _runs(trace: Trace) -> list[_Run]:
                 shell = _walk(base, [t for t, m in zip(segs, moves) if m] if sure else [["popd"]], unknown)
             masked = any(op in ("|", ";", "||", "&") for _, _, op in _chain(cmd))
             runs.append(_Run(i, cmd, segs, _proven(cmd), a.output or "", _succeeded(a), _failed(a) or masked, where,
-                             any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), _persists_env(segs), "<" in _mask(cmd)))
+                             any(_INSTALLS & set(t) for t, _, _ in _chain(cmd)), persists and _persists_env(segs), "<" in _mask(cmd)))
     return runs
 
 
diff --git a/tests/test_repairs.py b/tests/test_repairs.py
index 5bb76a2..4cd360f 100644
--- a/tests/test_repairs.py
+++ b/tests/test_repairs.py
@@ -199,6 +199,11 @@ def test_a_piped_cd_leaves_the_place_unknown(self):
         self.assertEqual(_mine(_bash("cd /other | cat", "ok"), _bash("python app.py", "No module named 'project'", "error"),
                                _bash("cd /other && uv run python app.py", "ok")), [])
 
+    def test_a_codex_export_does_not_reach_the_next_call(self):
+        self.assertEqual(_mine(_codex("pytest", "Exit code: 127\nbash: pytest: command not found"),
+                               _codex("uv run pytest", "Exit code: 0\nok"), _codex("export FOO=bar", "Exit code: 0\n"),
+                               _codex("pytest", "Exit code: 0\nok")), [])
+
     def test_each_codex_call_starts_a_fresh_shell(self):
         [d] = _mine(_codex("cd backend && python app.py", "Exit code: 1\nNo module named 'project'"),
                     _codex("cd backend && uv run python app.py", "Exit code: 0\nok"))