P1-09: Share Bash parsing preparation and AST traversal

[Dan-StrategicAutomation]

Backlog metadata

• Priority: P1
• Backlog order: P1-09
• Type: Refactor
• Area: Terminal / Bash parsing
• Status: Open
• Depends on: None
• Related work: Related to Make the guard's own command diagnostics reachable from the raw terminal #82

---

Summary

From the 20 September 2026 Violin dev duplication/library review, baseline 5ca0d9d6767b91fe809b2e4996c85ac65ba9e962. Priority: P1. Source locations and measurements describe the review baseline.

Scope

Consolidate heredoc stripping and bashlex traversal used by parse_bash_segments() and extract_all_command_words() into a shared parsed-command representation with segments and words. Keep domain-specific shell authorization and target policy in Violin.

Acceptance criteria

• Retain current parser fallback and fail-closed behavior.
• Run existing shell-policy corpus and cover heredocs, compound commands, quoting, substitutions and parser errors.
• Both consumers derive consistent results without redundant parsing where practical.
• Preserve terminal-policy bypass protections; no new parser dependency.

Dependencies / related work

#82 owns diagnostic exemptions. Closed #1 owns compound-command bypass hardening; preserve it without reopening that feature.

Verification

Working branch: codex/review-bash, based on dev. Future PRs target dev; follow AGENTS.md and preserve fail-closed policy. Rebase dependent branches onto updated dev before implementation.

Implementation must pass uv run pytest, uv run ruff check ., uv run ruff format --check . and uv run python scripts/violin_guard.py check-release, plus the focused checks above. No implementation or test rerun is claimed by this tracking issue.