# Fix 2a: a variable assigned a STATIC LITERAL path in the same command resolves to
# its concrete path and runs the normal scope check. EXPECTED = desired verdict.
# --- static literal temp path -> now silent (the reported false positive) ---
SILENT ::: - ::: ROOT=/tmp/feat009-edge; rm -rf "$ROOT"
SILENT ::: - ::: ROOT=/tmp/x; mkdir -p "$ROOT/src"; rm -rf "$ROOT"
SILENT ::: - ::: D=/tmp/x; rm -rf "$D/sub"
SILENT ::: - ::: D=/tmp/x; rm -rf "${D}"
SILENT ::: - ::: D="/tmp/x"; rm -rf "$D"
# --- static literal under project root / EXTRA root -> silent ---
SILENT ::: - ::: D=nodes; rm -rf "$D"
SILENT ::: /mnt/scratch ::: S=/mnt/scratch/x; rm -rf "$S"
# --- static literal OUTSIDE the workspace -> must still prompt ---
ASK ::: - ::: ROOT=/etc; rm -rf "$ROOT"
ASK ::: - ::: D=/var/www; rm -rf "$D/html"
# --- RHS not a pure literal (var / subst) -> unchanged, still prompts ---
ASK ::: - ::: D=$TMPDIR/x; rm -rf "$D"
ASK ::: - ::: D=$HOME; rm -rf "$D"
# --- reassigned / loop- or read-rebound / traversal -> must NOT be trusted ---
ASK ::: - ::: D=/tmp/x; D=/etc; rm -rf "$D"
ASK ::: - ::: D=/tmp/x; for D in /etc; do rm -rf "$D"; done
ASK ::: - ::: D=/tmp/x; read D < /etc/passwd; rm -rf "$D"
ASK ::: - ::: D=/tmp/x; rm -rf "$D/../../etc"
# --- catastrophic still hard-blocks even with a static temp var present ---
BLOCK ::: - ::: D=/tmp/x; rm -rf /
# --- variable NAME with metacharacters is not a resolvable ref -> must prompt ---
# ($A.B is $A + ".B"; the name must not be fed to the matchers as a regex/glob)
ASK ::: - ::: AXB=/tmp/x; rm -rf "$A.B"
ASK ::: - ::: Afoo_xB=/tmp/x; rm -rf "$A.*B"
ASK ::: - ::: D=/tmp/x; rm -rf "$D*"
ASK ::: - ::: D=$(mktemp -d); rm -rf "$D*"
