@askexenow/exe-os 0.9.340 → 0.9.342

package/dist/chunk-D74XYSA3.js

@@ -0,0 +1,621 @@
+// src/lib/git-main-guard.ts
+import { execFileSync } from "child_process";
+import path from "path";
+var MAIN_GUARD_OVERRIDE_TOKEN = "EXE_FORCE_ALLOW_MAIN_HISTORY_REWRITE=1";
+var MAIN_GUARD_OVERRIDE_ENV = "EXE_FORCE_ALLOW_MAIN_HISTORY_REWRITE";
+var GIT_TIMEOUT_MS = (() => {
+  const raw = process.env.EXE_GIT_GUARD_TIMEOUT_MS;
+  const n = raw ? Number.parseInt(raw, 10) : Number.NaN;
+  return Number.isFinite(n) && n > 0 ? n : 1e4;
+})();
+function runGit(cwd, args) {
+  try {
+    const out = execFileSync("git", args, {
+      cwd,
+      encoding: "utf8",
+      timeout: GIT_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    return { status: "ok", stdout: out.trim() };
+  } catch (err) {
+    const e = err;
+    return typeof e.status === "number" ? { status: "nonzero" } : { status: "unavailable" };
+  }
+}
+function gitOut(cwd, args) {
+  const r = runGit(cwd, args);
+  return r.status === "ok" ? r.stdout : null;
+}
+function tokenizeShell(command) {
+  const tokens = [];
+  let cur = "";
+  let curStarted = false;
+  let inSingle = false;
+  let inDouble = false;
+  let hasShellControl = false;
+  const push = () => {
+    if (curStarted) tokens.push(cur);
+    cur = "";
+    curStarted = false;
+  };
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    const next = command[i + 1];
+    if (inSingle) {
+      if (ch === "'") inSingle = false;
+      else {
+        cur += ch;
+        curStarted = true;
+      }
+      continue;
+    }
+    if (inDouble) {
+      if (ch === '"') inDouble = false;
+      else {
+        if (ch === "`" || ch === "$" && next === "(") hasShellControl = true;
+        cur += ch;
+        curStarted = true;
+      }
+      continue;
+    }
+    switch (ch) {
+      case "'":
+        inSingle = true;
+        curStarted = true;
+        continue;
+      case '"':
+        inDouble = true;
+        curStarted = true;
+        continue;
+      case " ":
+      case "	":
+        push();
+        continue;
+      case "\n":
+      case "\r":
+        hasShellControl = true;
+        push();
+        continue;
+      case "\\":
+        if (next !== void 0) {
+          cur += next;
+          curStarted = true;
+          i++;
+        }
+        continue;
+      case "&":
+      case "|":
+      case ";":
+      case "<":
+      case ">":
+      case "`":
+        hasShellControl = true;
+        push();
+        continue;
+      case "$":
+        if (next === "(" || next === "{") hasShellControl = true;
+        cur += ch;
+        curStarted = true;
+        continue;
+      case "(":
+      case ")":
+        hasShellControl = true;
+        push();
+        continue;
+      case "#":
+        if (!curStarted) {
+          hasShellControl = true;
+          i = command.length;
+          push();
+          continue;
+        }
+        cur += ch;
+        curStarted = true;
+        continue;
+      default:
+        cur += ch;
+        curStarted = true;
+        continue;
+    }
+  }
+  if (inSingle || inDouble) hasShellControl = true;
+  push();
+  return { tokens, hasShellControl };
+}
+var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
+function basename(tok) {
+  return tok.split("/").pop() ?? tok;
+}
+function isGitProgram(tok) {
+  return tok === "git" || /(?:^|\/)git$/.test(tok);
+}
+function isShellProgram(tok) {
+  return SHELLS.has(basename(tok));
+}
+function isDashC(tok) {
+  return /^-[a-z]*c[a-z]*$/i.test(tok) && tok.includes("c");
+}
+function isLeadingAssignment(tok) {
+  return /^[A-Za-z_][A-Za-z0-9_]*=/.test(tok);
+}
+var FORCE_PUSH_FLAGS = /* @__PURE__ */ new Set(["-f", "--force"]);
+function isForcePushFlag(t) {
+  return FORCE_PUSH_FLAGS.has(t) || /^--force-with-lease(=.*)?$/.test(t) || t === "--force-if-includes";
+}
+function isDeleteFlag(t) {
+  return t === "--delete" || t === "-d";
+}
+function refShortName(ref) {
+  let r = ref.replace(/^\+/, "");
+  r = r.replace(/^refs\/heads\//, "").replace(/^heads\//, "");
+  return r;
+}
+function isMainName(name) {
+  return name === "main" || name === "master";
+}
+function destHeadShortName(dst) {
+  if (dst.startsWith("refs/remotes/")) return null;
+  if (dst.startsWith("refs/tags/")) return null;
+  if (dst.startsWith("refs/heads/")) return dst.slice("refs/heads/".length);
+  if (dst.startsWith("heads/")) return dst.slice("heads/".length);
+  if (dst.startsWith("refs/")) return null;
+  return dst;
+}
+function headTargetsMainOrGlob(head) {
+  return head.includes("*") || isMainName(head);
+}
+function refspecDestTargetsMainHead(spec) {
+  const bare = spec.replace(/^\+/, "");
+  const colon = bare.indexOf(":");
+  const dst = colon >= 0 ? bare.slice(colon + 1) : bare;
+  const head = destHeadShortName(dst);
+  return head !== null && headTargetsMainOrGlob(head);
+}
+function tokensFromVerb(tokens, verb) {
+  const i = tokens.indexOf(verb);
+  return i === -1 ? [] : tokens.slice(i);
+}
+function hasDestructiveVerbTokens(tokens) {
+  const has = (t) => tokens.includes(t);
+  if (has("reset") && (has("--hard") || has("--mixed"))) return true;
+  if (has("push") && (tokens.some((t) => isForcePushFlag(t) || isDeleteFlag(t)) || has("--mirror") || tokens.some((t) => /^\+/.test(t) || /^:/.test(t)))) return true;
+  if (has("fetch") && tokens.some((t) => t.includes(":"))) return true;
+  for (const verb of ["checkout", "switch"]) {
+    if (has(verb) && tokensFromVerb(tokens, verb).some((t) => /^-[BC]/.test(t) || /^--force-create(=|$)/.test(t))) return true;
+  }
+  if (has("branch") && tokensFromVerb(tokens, "branch").some(
+    (t) => t === "-f" || t === "--force" || t === "-D" || t === "-M" || t === "--move" || t === "--copy" || t === "--delete" || t === "-C" || t === "-m" || t === "-c" || t === "-d"
+  )) return true;
+  if (has("worktree") && has("add") && tokens.some((t) => /^-B/.test(t))) return true;
+  if (has("update-ref")) return true;
+  if (has("rebase")) return true;
+  if (has("filter-branch") || has("filter-repo")) return true;
+  return false;
+}
+function splitShellSegments(command) {
+  const segments = [];
+  let cur = "";
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i];
+    const next = command[i + 1];
+    if (inSingle) {
+      if (ch === "'") inSingle = false;
+      cur += ch;
+      continue;
+    }
+    if (inDouble) {
+      if (ch === '"' && command[i - 1] !== "\\") inDouble = false;
+      cur += ch;
+      continue;
+    }
+    if (ch === "'") {
+      inSingle = true;
+      cur += ch;
+      continue;
+    }
+    if (ch === '"') {
+      inDouble = true;
+      cur += ch;
+      continue;
+    }
+    if (ch === ";" || ch === "\n" || ch === "\r" || ch === "|" || ch === "&") {
+      if ((ch === "|" || ch === "&") && next === ch) i++;
+      segments.push(cur);
+      cur = "";
+      continue;
+    }
+    cur += ch;
+  }
+  segments.push(cur);
+  return segments.filter((s) => s.trim().length > 0);
+}
+function containsDestructiveGitCandidate(command, depth = 0) {
+  if (depth > 3) return true;
+  const { tokens } = tokenizeShell(command);
+  for (let i = 0; i < tokens.length; i++) {
+    if (isShellProgram(tokens[i]) && tokens[i + 1] && isDashC(tokens[i + 1])) {
+      const script = tokens[i + 2];
+      if (script && containsDestructiveGitCandidate(script, depth + 1)) return true;
+    }
+  }
+  if (!tokens.some(isGitProgram)) return false;
+  const segments = splitShellSegments(command);
+  if (segments.length > 1) {
+    for (const seg of segments) {
+      const segTokens = tokenizeShell(seg).tokens;
+      if (!segTokens.some(isGitProgram)) continue;
+      if (segTokens.some((t) => /^alias\./.test(t))) return true;
+      if (hasDestructiveVerbTokens(segTokens)) return true;
+    }
+    return false;
+  }
+  if (tokens.some((t) => /^alias\./.test(t))) return true;
+  return hasDestructiveVerbTokens(tokens);
+}
+var PUSH_VALUE_OPTS = /* @__PURE__ */ new Set(["-o", "--push-option", "--repo", "--receive-pack", "--exec", "--recurse-submodules"]);
+var REBASE_VALUE_OPTS = /* @__PURE__ */ new Set(["--onto", "-s", "--strategy", "-X", "--strategy-option", "--exec", "-x", "--whitespace"]);
+function parseSingleGitCommand(tokens) {
+  if (tokens[0] !== "git") {
+    return { kind: "unparseable", reason: `command does not begin with a bare 'git' (saw "${tokens[0] ?? ""}")` };
+  }
+  let i = 1;
+  let contextDir = null;
+  let cCount = 0;
+  while (i < tokens.length) {
+    const t = tokens[i];
+    if (!t.startsWith("-")) break;
+    if (t === "-C") {
+      const p = tokens[i + 1];
+      if (p === void 0) return { kind: "unparseable", reason: "-C without a path" };
+      contextDir = p;
+      cCount++;
+      i += 2;
+      continue;
+    }
+    if (/^-C./.test(t)) {
+      contextDir = t.slice(2);
+      cCount++;
+      i++;
+      continue;
+    }
+    return { kind: "unparseable", reason: `unsupported git global option "${t}" \u2014 target repo cannot be verified` };
+  }
+  if (cCount > 1) return { kind: "unparseable", reason: "multiple -C options \u2014 composed repo path cannot be verified" };
+  const sub = tokens[i];
+  if (sub === void 0) return { kind: "none", contextDir };
+  const args = tokens.slice(i + 1);
+  switch (sub) {
+    case "reset":
+      return args.includes("--hard") || args.includes("--mixed") ? { kind: "reset-hard", contextDir } : { kind: "none", contextDir };
+    case "checkout":
+    case "switch": {
+      for (let k = 0; k < args.length; k++) {
+        const a = args[k];
+        let target;
+        if (a === "-B" || a === "-C" || a === "--force-create") target = args[k + 1];
+        else if (/^-[BC]./.test(a)) target = a.slice(2);
+        else if (a.startsWith("--force-create=")) target = a.slice("--force-create=".length);
+        if (target !== void 0 && isMainName(refShortName(target))) {
+          return { kind: "move-main", verb: `${sub} ${a} main`, contextDir };
+        }
+      }
+      return { kind: "none", contextDir };
+    }
+    case "branch": {
+      const has = (t) => args.includes(t);
+      const positionals = args.filter((a) => !a.startsWith("-"));
+      const force = has("-f") || has("--force");
+      const forceMove = has("-M") || (has("--move") || has("-m")) && force;
+      const forceCopy = has("-C") || (has("--copy") || has("-c")) && force;
+      const forceDelete = has("-D") || (has("--delete") || has("-d")) && force;
+      if (forceMove || forceCopy) {
+        const dest = positionals[positionals.length - 1];
+        if (dest && isMainName(refShortName(dest))) return { kind: "move-main", verb: "branch move/copy \u2192 main", contextDir };
+      }
+      if (forceDelete) {
+        if (positionals.some((p) => isMainName(refShortName(p)))) return { kind: "move-main", verb: "branch -D main", contextDir };
+      }
+      if (force && !forceMove && !forceCopy && !forceDelete) {
+        const target = positionals[0];
+        if (target && isMainName(refShortName(target))) return { kind: "move-main", verb: "branch -f main", contextDir };
+      }
+      return { kind: "none", contextDir };
+    }
+    case "update-ref": {
+      if (args.includes("--stdin")) {
+        return { kind: "unparseable", reason: "update-ref --stdin \u2014 ref targets are read from stdin and cannot be verified" };
+      }
+      const operands = [];
+      for (let k = 0; k < args.length; k++) {
+        const a = args[k];
+        if (a === "-m") {
+          k++;
+          continue;
+        }
+        if (a.startsWith("-")) continue;
+        operands.push(a);
+      }
+      const target = operands[0];
+      if (target && (target === "refs/heads/main" || target === "refs/heads/master")) {
+        return { kind: "move-main", verb: "update-ref refs/heads/main", contextDir };
+      }
+      return { kind: "none", contextDir };
+    }
+    case "worktree": {
+      if (args[0] === "add") {
+        for (let k = 1; k < args.length; k++) {
+          const a = args[k];
+          let target;
+          if (a === "-B") target = args[k + 1];
+          else if (/^-B./.test(a)) target = a.slice(2);
+          if (target !== void 0 && isMainName(refShortName(target))) {
+            return { kind: "move-main", verb: "worktree add -B main", contextDir };
+          }
+        }
+      }
+      return { kind: "none", contextDir };
+    }
+    case "fetch": {
+      const refspecs = args.filter((a) => !a.startsWith("-") && a.includes(":"));
+      if (refspecs.some(refspecDestTargetsMainHead)) return { kind: "move-main", verb: "fetch <src>:<main-or-glob head>", contextDir };
+      return { kind: "none", contextDir };
+    }
+    case "filter-branch":
+    case "filter-repo":
+      return { kind: "move-main", verb: sub, contextDir };
+    case "rebase": {
+      if (args.includes("--abort") || args.includes("--quit")) return { kind: "none", contextDir };
+      const operands = [];
+      for (let k = 0; k < args.length; k++) {
+        const a = args[k];
+        if (a.startsWith("-")) {
+          if (REBASE_VALUE_OPTS.has(a)) k++;
+          continue;
+        }
+        operands.push(a);
+      }
+      if (operands.length >= 2) {
+        const branch = operands[operands.length - 1];
+        return isMainName(refShortName(branch)) ? { kind: "move-main", verb: "rebase \u2026 main", contextDir } : { kind: "none", contextDir };
+      }
+      return { kind: "reset-hard", contextDir };
+    }
+    case "push":
+      return parsePush(args, contextDir);
+    default:
+      return { kind: "none", contextDir };
+  }
+}
+function parsePush(args, contextDir) {
+  let force = false;
+  let del = false;
+  let mirror = false;
+  const positionals = [];
+  for (let k = 0; k < args.length; k++) {
+    const a = args[k];
+    if (a.startsWith("-") && a !== "-") {
+      if (isForcePushFlag(a)) {
+        force = true;
+        continue;
+      }
+      if (isDeleteFlag(a)) {
+        del = true;
+        continue;
+      }
+      if (a === "--mirror") {
+        mirror = true;
+        continue;
+      }
+      if (PUSH_VALUE_OPTS.has(a)) {
+        k++;
+        continue;
+      }
+      if (/^(-o|--push-option|--repo|--receive-pack|--exec|--recurse-submodules)=/.test(a)) continue;
+      continue;
+    }
+    positionals.push(a);
+  }
+  if (mirror) return { kind: "force-remote", verb: "push --mirror", contextDir };
+  const refspecs = positionals.length > 1 ? positionals.slice(1) : [];
+  let targetsMain = false;
+  let needsUpstream = false;
+  for (const spec of refspecs) {
+    if (/^\+/.test(spec)) force = true;
+    if (/^\+?:/.test(spec)) del = true;
+    const bare = spec.replace(/^\+/, "");
+    const colon = bare.indexOf(":");
+    const dst = colon >= 0 ? bare.slice(colon + 1) : bare;
+    if (dst === "HEAD") {
+      needsUpstream = true;
+      continue;
+    }
+    if (refspecDestTargetsMainHead(spec)) targetsMain = true;
+  }
+  if (refspecs.length === 0) needsUpstream = true;
+  const destructive = force || del;
+  return { kind: "push", destructive, targetsMain, needsUpstream, contextDir };
+}
+function resolveRepoStateOnce(cwd) {
+  const root = runGit(cwd, ["rev-parse", "--show-toplevel"]);
+  if (root.status === "unavailable") return { ok: false, reason: "unverifiable" };
+  if (root.status === "nonzero") return { ok: false, reason: "not-a-repo" };
+  const repoRoot = root.stdout;
+  const head = runGit(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  if (head.status === "unavailable") return { ok: false, reason: "unverifiable" };
+  const currentBranch = head.status === "ok" && head.stdout !== "HEAD" ? head.stdout : null;
+  const mainRef = runGit(repoRoot, ["show-ref", "--verify", "--quiet", "refs/heads/main"]);
+  if (mainRef.status === "unavailable") return { ok: false, reason: "unverifiable" };
+  let mainBranch = mainRef.status === "ok" ? "main" : null;
+  if (!mainBranch) {
+    const masterRef = runGit(repoRoot, ["show-ref", "--verify", "--quiet", "refs/heads/master"]);
+    if (masterRef.status === "unavailable") return { ok: false, reason: "unverifiable" };
+    mainBranch = masterRef.status === "ok" ? "master" : null;
+  }
+  if (!mainBranch) return { ok: true, currentBranch, mainBranch: null, mainAhead: 0, aheadCommits: [] };
+  const originRef = runGit(repoRoot, ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${mainBranch}`]);
+  if (originRef.status === "unavailable") return { ok: false, reason: "unverifiable" };
+  if (originRef.status === "nonzero") return { ok: true, currentBranch, mainBranch, mainAhead: 0, aheadCommits: [] };
+  const aheadRes = runGit(repoRoot, ["rev-list", "--count", `origin/${mainBranch}..${mainBranch}`]);
+  if (aheadRes.status !== "ok") return { ok: false, reason: "unverifiable" };
+  const ahead = Number.parseInt(aheadRes.stdout, 10);
+  if (!Number.isFinite(ahead)) return { ok: false, reason: "unverifiable" };
+  let aheadCommits = [];
+  if (ahead > 0) {
+    const log = runGit(repoRoot, ["log", "--oneline", "--decorate=short", "-5", `origin/${mainBranch}..${mainBranch}`]);
+    aheadCommits = log.status === "ok" ? log.stdout.split("\n").filter(Boolean) : [];
+  }
+  return { ok: true, currentBranch, mainBranch, mainAhead: ahead, aheadCommits };
+}
+function resolveRepoState(cwd) {
+  const first = resolveRepoStateOnce(cwd);
+  if (first.ok || first.reason !== "unverifiable") return first;
+  return resolveRepoStateOnce(cwd);
+}
+function resolvePushTargetOnce(cwd) {
+  for (const rev of ["@{push}", "@{upstream}"]) {
+    const r = runGit(cwd, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", rev]);
+    if (r.status === "unavailable") return { status: "unavailable" };
+    if (r.status === "ok" && r.stdout) {
+      const seg = r.stdout.split("/").pop();
+      if (seg) return { status: "resolved", branch: seg };
+    }
+  }
+  return { status: "none" };
+}
+function resolvePushTargetBranch(cwd) {
+  const first = resolvePushTargetOnce(cwd);
+  if (first.status !== "unavailable") return first;
+  return resolvePushTargetOnce(cwd);
+}
+function getLocalMainAheadInfo(cwd = process.cwd()) {
+  const state = resolveRepoState(cwd);
+  if (!state.ok || !state.mainBranch || state.mainAhead <= 0) return null;
+  const repoRoot = gitOut(cwd, ["rev-parse", "--show-toplevel"]) ?? cwd;
+  return { repoRoot, branch: state.mainBranch, ahead: state.mainAhead, commits: state.aheadCommits };
+}
+function getCurrentBranch(cwd) {
+  const state = resolveRepoState(cwd);
+  return state.ok ? state.currentBranch : null;
+}
+function hasEmergencyOverride(command, env = process.env) {
+  if (env[MAIN_GUARD_OVERRIDE_ENV] === "1") return true;
+  return new RegExp(String.raw`^\s*${MAIN_GUARD_OVERRIDE_ENV}=1\s+git\b`).test(command);
+}
+function normalizeCleanGit(tokens) {
+  const first = tokens[0];
+  if (first === void 0) return { ok: false, reason: "empty command" };
+  if (isLeadingAssignment(first)) return { ok: false, reason: "leading environment assignment before git" };
+  if (isShellProgram(first)) return { ok: false, reason: `command runs a shell ("${first}") whose script cannot be verified` };
+  if (!isGitProgram(first)) return { ok: false, reason: `git is wrapped or embedded (program is "${first}", not a bare 'git')` };
+  return { ok: true, tokens: ["git", ...tokens.slice(1)] };
+}
+function evaluateMainGuard(command, opts = {}) {
+  const env = opts.env ?? process.env;
+  const cwd = opts.cwd ?? process.cwd();
+  if (hasEmergencyOverride(command, env)) return { block: false, overridden: true };
+  if (!containsDestructiveGitCandidate(command)) return { block: false };
+  const { tokens, hasShellControl } = tokenizeShell(command);
+  if (hasShellControl) {
+    return { block: true, message: formatUnverifiableBlockMessage("the command is compound or uses shell control operators (&&, ||, ;, |, newline, backtick, $(), redirection, or a comment)") };
+  }
+  const clean = normalizeCleanGit(tokens);
+  if (!clean.ok) {
+    return { block: true, message: formatUnverifiableBlockMessage(clean.reason) };
+  }
+  const parsed = parseSingleGitCommand(clean.tokens);
+  if (parsed.kind === "unparseable") return { block: true, message: formatUnverifiableBlockMessage(parsed.reason) };
+  if (parsed.kind === "none") return { block: false };
+  const resolveState = opts.stateResolver ?? resolveRepoState;
+  const resolvePush = opts.pushTargetResolver ?? resolvePushTargetBranch;
+  const ctxDir = parsed.contextDir !== null ? path.resolve(cwd, parsed.contextDir) : cwd;
+  if (parsed.kind === "force-remote") {
+    return { block: true, message: formatForcePushBlockMessage(parsed.verb) };
+  }
+  if (parsed.kind === "reset-hard") {
+    const state = resolveState(ctxDir);
+    if (!state.ok) {
+      return state.reason === "not-a-repo" ? { block: false } : { block: true, message: formatStateUnverifiableBlockMessage(ctxDir) };
+    }
+    if (state.currentBranch === null) return { block: false };
+    if (state.currentBranch !== state.mainBranch) return { block: false };
+    if (!state.mainBranch || state.mainAhead <= 0) return { block: false };
+    return { block: true, message: formatMainAheadBlockMessage({ repoRoot: ctxDir, branch: state.mainBranch, ahead: state.mainAhead, commits: state.aheadCommits }, "rewrite of main (reset/rebase)") };
+  }
+  if (parsed.kind === "move-main") {
+    const state = resolveState(ctxDir);
+    if (!state.ok) {
+      return state.reason === "not-a-repo" ? { block: false } : { block: true, message: formatStateUnverifiableBlockMessage(ctxDir) };
+    }
+    if (!state.mainBranch) return { block: false };
+    if (state.mainAhead <= 0) return { block: false };
+    return { block: true, message: formatMainAheadBlockMessage({ repoRoot: ctxDir, branch: state.mainBranch, ahead: state.mainAhead, commits: state.aheadCommits }, parsed.verb) };
+  }
+  if (!parsed.destructive) return { block: false };
+  let targetsMain = parsed.targetsMain;
+  if (!targetsMain && parsed.needsUpstream) {
+    const state = resolveState(ctxDir);
+    if (!state.ok) {
+      return state.reason === "not-a-repo" ? { block: false } : { block: true, message: formatStateUnverifiableBlockMessage(ctxDir) };
+    }
+    const pt = resolvePush(ctxDir);
+    if (pt.status === "unavailable") return { block: true, message: formatStateUnverifiableBlockMessage(ctxDir) };
+    const targetBranch = pt.status === "resolved" ? pt.branch : state.currentBranch;
+    if (targetBranch && isMainName(targetBranch)) targetsMain = true;
+  }
+  if (!targetsMain) return { block: false };
+  return { block: true, message: formatForcePushBlockMessage("force/delete push to main") };
+}
+var OVERRIDE_LINE = `OVERRIDE (genuine emergency, loud + auditable): run it as a SINGLE, non-compound git invocation prefixed with the env assignment ${MAIN_GUARD_OVERRIDE_TOKEN}`;
+function formatMainAheadBlockMessage(info, verb) {
+  const commitList = info.commits.length > 0 ? info.commits.map((c) => `  \u2022 ${c}`).join("\n") : "  \u2022 (commit list unavailable)";
+  return `\u{1F6AB} BLOCKED: ${verb ? `\`${verb}\` ` : "this destructive git operation "}would rewrite local ${info.branch}, but ${info.branch} has ${info.ahead} unpushed commit${info.ahead === 1 ? "" : "s"} ahead of origin/${info.branch} that would be orphaned:
+${commitList}
+WHY: those commits exist only here \u2014 rewriting ${info.branch} discards them (bug 47986655).
+SAFE ALTERNATIVES:
+  \u2022 Preserve first:  git branch backup-${info.branch} ${info.branch}
+  \u2022 Or push them:    git push origin ${info.branch}
+  \u2022 Resetting a NON-${info.branch} branch onto its own ancestor is allowed \u2014 check that branch out first (git checkout -B <branch> <sha>); this guard only fires when ${info.branch} itself moves.
+${OVERRIDE_LINE}`;
+}
+function formatForcePushBlockMessage(verb = "force/delete push to main") {
+  return `\u{1F6AB} BLOCKED: ${verb} would overwrite SHARED history on origin \u2014 it can silently discard commits other people (and other agents) pushed.
+WHY: --force / --force-with-lease / --mirror / +refspec / --delete rewrites the remote branch everyone builds on (bug 6aaea78f).
+SAFE ALTERNATIVES:
+  \u2022 Push your work on a feature branch and open a PR instead of force-pushing main.
+  \u2022 If you must correct main, do it with a forward commit (git revert), not a force-push.
+  \u2022 Force-pushing a FEATURE branch is allowed; only main/master is guarded.
+${OVERRIDE_LINE}`;
+}
+function formatUnverifiableBlockMessage(reason) {
+  return `\u{1F6AB} BLOCKED: this git command could rewrite main/master and the guard CANNOT verify its target \u2014 ${reason}.
+WHY: exe-os fails CLOSED here \u2014 a compound/wrapped command can move HEAD before a check runs, so an unverifiable destructive-git command is denied rather than parsed permissively (bug 6aaea78f).
+SAFE ALTERNATIVE: run the git command as a SINGLE, non-compound invocation with a bare 'git' program (no sh -c, no wrapper, no path), no shell operators, no comment, at most one -C, and no --git-dir/--work-tree. Then the guard can verify whether it touches main and allow it if it does not.
+${OVERRIDE_LINE}`;
+}
+function formatStateUnverifiableBlockMessage(dir) {
+  return `\u23F3 BLOCKED (could not verify): the guard could not read the repo state in "${dir}" within ${GIT_TIMEOUT_MS}ms \u2014 most likely git was slow to spawn under machine load. This does NOT mean the command is dangerous; the guard just could not confirm it is safe.
+WHAT TO DO: simply RE-RUN the command (the guard already retried once internally) \u2014 this usually clears immediately. If it persists, the repo may be in an unusual state or on a stalled filesystem.
+${OVERRIDE_LINE}`;
+}
+
+export {
+  MAIN_GUARD_OVERRIDE_TOKEN,
+  MAIN_GUARD_OVERRIDE_ENV,
+  tokenizeShell,
+  isGitProgram,
+  splitShellSegments,
+  containsDestructiveGitCandidate,
+  parseSingleGitCommand,
+  resolveRepoState,
+  resolvePushTargetBranch,
+  getLocalMainAheadInfo,
+  getCurrentBranch,
+  hasEmergencyOverride,
+  evaluateMainGuard,
+  formatMainAheadBlockMessage,
+  formatForcePushBlockMessage,
+  formatUnverifiableBlockMessage,
+  formatStateUnverifiableBlockMessage
+};