@hasna/hooks 0.11.7 → 0.12.1

package/bin/native-safety-entry.js

@@ -1,1719 +1,16 @@
 // @bun
-// hooks/native-safety-entry.ts
-import { homedir as homedir2 } from "os";
-import { isAbsolute as isAbsolute4 } from "path";
-
-// hooks/hook-trash-guard/src/hook.ts
-import { isAbsolute as isAbsolute2, join as join2, normalize, resolve as resolve2, sep } from "path";
-
-// hooks/hook-trash-guard/src/binary.ts
-import { dirname, isAbsolute, join, resolve } from "path";
-import { accessSync, closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readlinkSync, readSync, realpathSync, statSync } from "fs";
-import { spawnSync } from "child_process";
-var BINARY_FAILURES = {
-  missing: "No verified @hasna/trash guard was found on PATH.",
-  unsafe_executable: "The Trash candidate is not an owned executable file or is writable by group or others.",
-  unsafe_manifest: "The Trash package manifest is not a safe owned regular file.",
-  unsafe_directory: "A Trash PATH or package directory is not owned safely or is writable by group or others.",
-  unsafe_interpreter: "The Trash interpreter is missing, unsupported, or not a safe owned executable on its actual PATH.",
-  unrecognized_package: "The candidate is not the registered @hasna/trash executable.",
-  identity_failed: "The installed Trash identity probe failed or exceeded its deadline.",
-  unsupported_protocol: "The installed Trash version does not expose the required guard protocol."
-};
-function trustedOwner(uid) {
-  return uid === 0 || uid === process.getuid?.();
-}
-function safeExecutableFile(path, systemBinAlias = false) {
-  let current = path;
-  for (let hop = 0;hop < 32; hop++) {
-    if (!isAbsolute(current) || current.length > 4096 || !safeBinaryDirectory("/"))
-      return false;
-    const parts = current.split("/"), name = parts.pop();
-    if (!name || name === "." || name === "..")
-      return false;
-    let parent = "/";
-    for (const part of parts) {
-      if (!part || part === ".")
-        continue;
-      if (part === "..") {
-        parent = dirname(parent);
-        continue;
-      }
-      const next = join(parent, part), info2 = lstatSync(next);
-      if (systemBinAlias && next === "/bin" && info2.isSymbolicLink() && info2.uid === 0) {
-        const target = realpathSync(next);
-        if (!safeBinaryDirectory(target))
-          return false;
-        parent = target;
-        continue;
-      }
-      if (!info2.isDirectory() || !trustedOwner(info2.uid) || info2.mode & 18)
-        return false;
-      parent = next;
-    }
-    const candidate = join(parent, name), info = lstatSync(candidate);
-    if (!trustedOwner(info.uid))
-      return false;
-    if (info.isSymbolicLink()) {
-      const target = readlinkSync(candidate);
-      current = isAbsolute(target) ? target : parent + "/" + target;
-      continue;
-    }
-    return info.isFile() && Boolean(info.mode & 73) && !(info.mode & 18);
-  }
-  return false;
-}
-function safeInterpreterSearchDirectory(path) {
-  if (!isAbsolute(path) || resolve(path) !== (path.replace(/\/+$/, "") || "/"))
-    return false;
-  for (let cursor = resolve(path);; cursor = dirname(cursor)) {
-    try {
-      lstatSync(cursor);
-      return safeBinaryDirectory(cursor);
-    } catch (error) {
-      if (error.code !== "ENOENT")
-        return false;
-    }
-    if (dirname(cursor) === cursor)
-      return false;
-  }
-}
-function safeScriptInterpreter(executable, pathValue) {
-  const fd = openSync(executable, constants.O_RDONLY | constants.O_NONBLOCK | constants.O_NOFOLLOW);
-  let header;
-  try {
-    if (!fstatSync(fd).isFile())
-      return false;
-    const bytes = Buffer.alloc(256), length = readSync(fd, bytes, 0, bytes.length, 0);
-    header = bytes.subarray(0, length).toString("utf8").split(`
-`)[0];
-  } finally {
-    closeSync(fd);
-  }
-  const direct = /^#!(\/[A-Za-z0-9_./-]+)$/.exec(header);
-  if (direct && direct[1] !== "/usr/bin/env")
-    return safeExecutableFile(direct[1], true);
-  if (header !== "#!/usr/bin/env bun" || !safeExecutableFile("/usr/bin/env", true))
-    return false;
-  for (const dir of pathValue.split(":").slice(0, 64)) {
-    if (!safeInterpreterSearchDirectory(dir))
-      return false;
-    const interpreter = resolve(dir, "bun");
-    try {
-      if (!statSync(interpreter).isFile())
-        continue;
-      accessSync(interpreter, constants.X_OK);
-    } catch {
-      continue;
-    }
-    return safeExecutableFile(interpreter, true);
-  }
-  return false;
-}
-function safeBinaryDirectory(path) {
-  let current = path;
-  for (;; ) {
-    const info = lstatSync(current);
-    if (!info.isDirectory() || !trustedOwner(info.uid) || (info.mode & 18) !== 0)
-      return false;
-    const parent = dirname(current);
-    if (parent === current)
-      return true;
-    current = parent;
-  }
-}
-function inspectTrashBinary(env = process.env) {
-  const pathValue = env.PATH ?? "";
-  const deadline = Date.now() + 2000;
-  let failure = "missing";
-  const reject = (code) => {
-    if (failure === "missing" || failure === "unrecognized_package" || code.startsWith("unsafe_"))
-      failure = code;
-  };
-  for (const dir of pathValue.split(":").slice(0, 64)) {
-    if (!isAbsolute(dir) || Date.now() >= deadline)
-      continue;
-    const candidate = resolve(dir, "trash");
-    try {
-      const stat = statSync(candidate);
-      if (!stat.isFile() || !trustedOwner(stat.uid) || (stat.mode & 73) === 0 || (stat.mode & 18) !== 0) {
-        reject("unsafe_executable");
-        continue;
-      }
-      const executable = realpathSync(candidate);
-      if (!safeBinaryDirectory(resolve(dir)) || !safeBinaryDirectory(dirname(executable))) {
-        reject("unsafe_directory");
-        continue;
-      }
-      if (!safeExecutableFile(candidate)) {
-        reject("unsafe_directory");
-        continue;
-      }
-      const packageRoot = resolve(dirname(executable), "../..");
-      const manifestPath = join(packageRoot, "package.json");
-      const manifestStat = statSync(manifestPath);
-      if (!manifestStat.isFile() || !trustedOwner(manifestStat.uid) || manifestStat.size > 16384 || (manifestStat.mode & 18) !== 0 || lstatSync(manifestPath).isSymbolicLink()) {
-        reject("unsafe_manifest");
-        continue;
-      }
-      const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-      if (manifest.name !== "@hasna/trash" || typeof manifest.version !== "string" || typeof manifest.bin?.trash !== "string" || realpathSync(resolve(packageRoot, manifest.bin.trash)) !== executable) {
-        reject("unrecognized_package");
-        continue;
-      }
-      try {
-        if (!safeScriptInterpreter(executable, pathValue)) {
-          reject("unsafe_interpreter");
-          continue;
-        }
-      } catch {
-        reject("unsafe_interpreter");
-        continue;
-      }
-      const remaining = deadline - Date.now();
-      if (remaining <= 0) {
-        reject("identity_failed");
-        break;
-      }
-      const probe = spawnSync(candidate, ["--identity"], {
-        encoding: "utf8",
-        timeout: remaining,
-        maxBuffer: 2048,
-        env: { PATH: pathValue },
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      if (probe.error || probe.status !== 0 || Date.now() >= deadline) {
-        reject("identity_failed");
-        continue;
-      }
-      const identity = JSON.parse(probe.stdout);
-      if (identity.name === "@hasna/trash" && identity.version === manifest.version && identity.guardProtocol === "hasna.trash.guard.v1")
-        return { ok: true, path: candidate, version: manifest.version };
-      reject("unsupported_protocol");
-    } catch {}
-  }
-  return { ok: false, code: failure };
-}
-function findTrashBinary(env = process.env) {
-  const result = inspectTrashBinary(env);
-  return result.ok ? result.path : null;
-}
-// hooks/codewith-native-common.ts
-function getCommand(input) {
-  const command = input.tool_input?.command;
-  return typeof command === "string" ? command : "";
-}
-var segmentCache = new Map;
-var SYSTEM_PROTECTED_ROOTS = [
-  "/",
-  "/bin",
-  "/boot",
-  "/dev",
-  "/etc",
-  "/home",
-  "/lib",
-  "/lib32",
-  "/lib64",
-  "/libx32",
-  "/opt",
-  "/proc",
-  "/root",
-  "/run",
-  "/sbin",
-  "/srv",
-  "/sys",
-  "/usr",
-  "/var",
-  "/Applications",
-  "/Library",
-  "/System",
-  "/Users",
-  "/Volumes",
-  "/private"
-];
-var OPAQUE_BUILTINS = new Set(["eval", "source", ".", "trap", "coproc", "exec"]);
-var COMPOUND_KEYWORDS = new Set(["{", "}", "then", "do", "else", "elif", "fi", "done", "!"]);
-var NAME_BINDING_BUILTINS = new Set(["read", "getopts", "mapfile", "readarray"]);
-var VALUE_BINDING_BUILTINS = new Set(["export", "declare", "typeset", "readonly", "local", "let"]);
-var RSYNC_OPTIONS_WITH_VALUE = new Set([
-  "-e",
-  "--rsh",
-  "--exclude",
-  "--exclude-from",
-  "--include",
-  "--include-from",
-  "--filter",
-  "--files-from",
-  "--rsync-path",
-  "--out-format",
-  "--log-file",
-  "--password-file",
-  "--backup-dir",
-  "--partial-dir",
-  "--compare-dest",
-  "--copy-dest",
-  "--link-dest"
-]);
-var SHELL_INTERPRETERS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "mksh", "busybox"]);
-var USER_SWITCH_COMMANDS = new Set(["su", "runuser"]);
-var SSH_OPTIONS_WITH_VALUE = new Set([
-  "-B",
-  "-b",
-  "-c",
-  "-D",
-  "-E",
-  "-e",
-  "-F",
-  "-I",
-  "-i",
-  "-J",
-  "-L",
-  "-l",
-  "-m",
-  "-O",
-  "-o",
-  "-P",
-  "-p",
-  "-Q",
-  "-R",
-  "-S",
-  "-W",
-  "-w"
-]);
-var SHELL_OPTIONS_WITH_VALUE = new Set(["-o", "+o", "--rcfile", "--init-file"]);
-
-// hooks/hook-trash-guard/src/hook.ts
-var DEFAULT_TIMEOUT_MS = 600000;
-var DEFAULT_DESCRIPTION = "Delete via trash guard (rm intercepted and made recoverable)";
-var HANDOFF_ROOTS = [".hasna/repos/clones", "workspace/repos"];
-var PROTECTED_HOME_TREES = [".hasna", ".ssh", ".aws"];
-var REFUSED_VERBS = {
-  rmdir: "`rmdir` is a delete that trash-guard does not rewrite (it takes rmdir's flags, not rm's). Re-run it as `rm -d -- <path>` for an empty directory, or `rm -r -- <path>` for a non-empty one, and it is redirected into trash.",
-  unlink: "`unlink` is a delete that trash-guard does not rewrite. Re-run it as `rm -- <path>` and it is redirected into trash.",
-  shred: "`shred` destroys content irrecoverably and is never allowed. Re-run it as `rm -- <path>` and it is redirected into trash."
-};
-var OPAQUE_COMMANDS = new Set(["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env"]);
-var WRAPPERS = {
-  sudo: ["-u", "--user", "-g", "--group", "-p", "--prompt", "-C", "--chdir", "-h", "--host", "-r", "--role", "-t", "--type", "-U", "--other-user"],
-  doas: ["-u", "-C"],
-  env: ["-u", "--unset", "-C", "--chdir", "-S", "--split-string"],
-  nice: ["-n", "--adjustment"],
-  ionice: ["-c", "--class", "-n", "--classdata", "-p", "--pid"],
-  stdbuf: ["-i", "-o", "-e", "--input", "--output", "--error"],
-  time: ["-f", "--format", "-o", "--output"],
-  timeout: ["-s", "--signal", "-k", "--kill-after"],
-  nohup: [],
-  setsid: [],
-  command: [],
-  builtin: [],
-  exec: ["-a"]
-};
-var WRAPPER_POSITIONALS = {
-  timeout: 1
-};
-var APPLET_DISPATCHERS = new Set(["busybox", "toybox"]);
-var KEYWORDS = new Set(["!", "{", "}", "then", "do", "else", "elif", "if", "while", "until", "for", "case", "esac", "fi", "done", "select", "function"]);
-var GIT_VALUE_OPTIONS = new Set(["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path", "--config-env"]);
-var DELETE_VERB_WORD_RE = /(^|[^A-Za-z0-9_.-])(rm|rmdir|unlink|shred)(?![A-Za-z0-9_.-])/;
-function mentionsDeleteVerb(text) {
-  return DELETE_VERB_WORD_RE.test(decodeWord(text));
-}
-function envSplitCommandText(words) {
-  return words.map((word) => word.replace(/^-[iv0]*S|^--split-string=/, " ")).join(" ");
-}
-var ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
-function baseVerb(word) {
-  const slash = word.lastIndexOf("/");
-  return slash >= 0 ? word.slice(slash + 1) : word;
-}
-function lexCommand(command) {
-  const segments = [];
-  const substitutions = [];
-  let words = [];
-  let redirects = new Set;
-  let wordStart = -1;
-  let pendingRedirect = false;
-  let trustworthy = true;
-  let i = 0;
-  const n = command.length;
-  const closeWord = (end) => {
-    if (wordStart >= 0) {
-      const index = words.length;
-      words.push({ text: command.slice(wordStart, end), start: wordStart, end });
-      if (pendingRedirect)
-        redirects.add(index);
-      wordStart = -1;
-      pendingRedirect = false;
-    }
-  };
-  const closeSegment = (end) => {
-    closeWord(end);
-    if (words.length > 0)
-      segments.push({ words, redirects });
-    words = [];
-    redirects = new Set;
-    pendingRedirect = false;
-  };
-  const scanSingle = (from) => {
-    const end = command.indexOf("'", from + 1);
-    return end === -1 ? -1 : end + 1;
-  };
-  const scanBacktick = (from) => {
-    let j = from + 1;
-    while (j < n) {
-      if (command[j] === "\\") {
-        j += 2;
-        continue;
-      }
-      if (command[j] === "`")
-        return j + 1;
-      j++;
-    }
-    return -1;
-  };
-  const scanParen = (from) => {
-    let depth = 0;
-    let j = from;
-    while (j < n) {
-      const c = command[j];
-      if (c === "\\") {
-        j += 2;
-        continue;
-      }
-      if (c === "'") {
-        const e = scanSingle(j);
-        if (e < 0)
-          return -1;
-        j = e;
-        continue;
-      }
-      if (c === '"') {
-        const e = scanDouble(j);
-        if (e < 0)
-          return -1;
-        j = e;
-        continue;
-      }
-      if (c === "`") {
-        const e = scanBacktick(j);
-        if (e < 0)
-          return -1;
-        j = e;
-        continue;
-      }
-      if (c === "(")
-        depth++;
-      else if (c === ")") {
-        depth--;
-        if (depth === 0)
-          return j + 1;
-      }
-      j++;
-    }
-    return -1;
-  };
-  function scanDouble(from) {
-    let j = from + 1;
-    while (j < n) {
-      const c = command[j];
-      if (c === "\\") {
-        j += 2;
-        continue;
-      }
-      if (c === '"')
-        return j + 1;
-      if (c === "`") {
-        const e = scanBacktick(j);
-        if (e < 0)
-          return -1;
-        j = e;
-        continue;
-      }
-      if (c === "$" && command[j + 1] === "(") {
-        const e = scanParen(j + 1);
-        if (e < 0)
-          return -1;
-        j = e;
-        continue;
-      }
-      j++;
-    }
-    return -1;
-  }
-  while (i < n) {
-    const ch = command[i];
-    if (ch === " " || ch === "\t" || ch === "\r") {
-      closeWord(i);
-      i++;
-      continue;
-    }
-    if (ch === `
-`) {
-      closeSegment(i);
-      i++;
-      continue;
-    }
-    if (ch === ";") {
-      closeSegment(i);
-      i++;
-      continue;
-    }
-    if (ch === "&") {
-      closeSegment(i);
-      i += command[i + 1] === "&" ? 2 : 1;
-      continue;
-    }
-    if (ch === "|") {
-      closeSegment(i);
-      i += command[i + 1] === "|" ? 2 : 1;
-      continue;
-    }
-    if (ch === "(" || ch === ")") {
-      closeSegment(i);
-      i++;
-      continue;
-    }
-    if (ch === "<" && command[i + 1] === "<" && command[i + 2] !== "<") {
-      const marker = command.slice(i + 2).match(/^-?[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);
-      if (!marker) {
-        trustworthy = false;
-        i = n;
-        continue;
-      }
-      const bodyStart = command.indexOf(`
-`, i + 2 + marker[0].length);
-      if (bodyStart === -1) {
-        trustworthy = false;
-        i = n;
-        continue;
-      }
-      const rest = command.slice(bodyStart + 1);
-      const endIdx = findHeredocEnd(rest, marker[2]);
-      if (endIdx === -1) {
-        trustworthy = false;
-        i = n;
-        continue;
-      }
-      closeWord(i);
-      i = bodyStart + 1 + endIdx + marker[2].length;
-      continue;
-    }
-    if (ch === ">" || ch === "<") {
-      if (wordStart >= 0 && /^\d+$/.test(command.slice(wordStart, i)))
-        wordStart = -1;
-      closeWord(i);
-      pendingRedirect = true;
-      i++;
-      if (command[i] === ch || command[i] === "&" || ch === ">" && command[i] === "|" || ch === "<" && command[i] === ">")
-        i++;
-      continue;
-    }
-    if (ch === "'") {
-      if (wordStart < 0)
-        wordStart = i;
-      const e = scanSingle(i);
-      if (e < 0) {
-        trustworthy = false;
-        i = n;
-      } else
-        i = e;
-      continue;
-    }
-    if (ch === '"') {
-      if (wordStart < 0)
-        wordStart = i;
-      const e = scanDouble(i);
-      if (e < 0) {
-        trustworthy = false;
-        i = n;
-      } else
-        i = e;
-      continue;
-    }
-    if (ch === "`") {
-      if (wordStart < 0)
-        wordStart = i;
-      const e = scanBacktick(i);
-      if (e < 0) {
-        trustworthy = false;
-        i = n;
-      } else {
-        substitutions.push(command.slice(i + 1, e - 1));
-        i = e;
-      }
-      continue;
-    }
-    if (ch === "$" && command[i + 1] === "(") {
-      if (wordStart < 0)
-        wordStart = i;
-      const e = scanParen(i + 1);
-      if (e < 0) {
-        trustworthy = false;
-        i = n;
-      } else {
-        substitutions.push(command.slice(i + 2, e - 1));
-        i = e;
-      }
-      continue;
-    }
-    if (ch === "\\") {
-      if (wordStart < 0)
-        wordStart = i;
-      if (i + 1 >= n) {
-        trustworthy = false;
-        i = n;
-      } else
-        i += 2;
-      continue;
-    }
-    if (wordStart < 0)
-      wordStart = i;
-    i++;
-  }
-  closeSegment(n);
-  return { segments, trustworthy, substitutions };
-}
-function findHeredocEnd(rest, delimiter) {
-  let from = 0;
-  while (from <= rest.length) {
-    const at = rest.indexOf(delimiter, from);
-    if (at === -1)
-      return -1;
-    const lineStart = at === 0 || rest[at - 1] === `
-`;
-    const after = at + delimiter.length;
-    const lineEnd = after === rest.length || rest[after] === `
-` || rest[after] === "\r";
-    if (lineStart && lineEnd)
-      return at;
-    from = at + 1;
-  }
-  return -1;
-}
-function decodeWord(text) {
-  let out = "";
-  let i = 0;
-  while (i < text.length) {
-    const ch = text[i];
-    if (ch === "\\") {
-      if (i + 1 < text.length)
-        out += text[i + 1];
-      i += 2;
-      continue;
-    }
-    if (ch === "'") {
-      const end = text.indexOf("'", i + 1);
-      if (end === -1) {
-        out += text.slice(i + 1);
-        break;
-      }
-      out += text.slice(i + 1, end);
-      i = end + 1;
-      continue;
-    }
-    if (ch === '"') {
-      i++;
-      while (i < text.length && text[i] !== '"') {
-        if (text[i] === "\\" && i + 1 < text.length) {
-          out += text[i + 1];
-          i += 2;
-          continue;
-        }
-        out += text[i];
-        i++;
-      }
-      i++;
-      continue;
-    }
-    out += ch;
-    i++;
-  }
-  return out;
-}
-function commandWordIndex(segment) {
-  let index = 0;
-  let guard = 0;
-  while (index < segment.words.length && guard++ < 32) {
-    if (segment.redirects.has(index)) {
-      index++;
-      continue;
-    }
-    const raw = segment.words[index].text;
-    const decoded = decodeWord(raw);
-    if (ASSIGNMENT_RE.test(decoded) && !decoded.startsWith("-")) {
-      index++;
-      continue;
-    }
-    if (KEYWORDS.has(decoded)) {
-      index++;
-      continue;
-    }
-    const wrapper = baseVerb(decoded);
-    if (wrapper === "command") {
-      for (const word of segment.words.filter((_, at) => at > index && !segment.redirects.has(at))) {
-        const option = decodeWord(word.text);
-        if (option === "--" || !option.startsWith("-"))
-          break;
-        if (/^-[pvV]*[vV][pvV]*$/.test(option))
-          return -1;
-      }
-    }
-    const wrapperValues = WRAPPERS[wrapper];
-    if (wrapperValues) {
-      const wrapperIndex = index;
-      index++;
-      while (index < segment.words.length) {
-        if (segment.redirects.has(index)) {
-          index++;
-          continue;
-        }
-        const option = decodeWord(segment.words[index].text);
-        if (!option.startsWith("-") || option === "-")
-          break;
-        if (option === "--") {
-          index++;
-          break;
-        }
-        if (wrapper === "env" && (/^-[iv0]*S/.test(option) || /^--split-string(?:=|$)/.test(option)))
-          return wrapperIndex;
-        index++;
-        if (wrapperValues.includes(option) || wrapper === "exec" && /^-[cl]*a$/.test(option)) {
-          while (segment.redirects.has(index))
-            index++;
-          index++;
-        }
-      }
-      let positionals = WRAPPER_POSITIONALS[wrapper] ?? 0;
-      while (positionals > 0 && index < segment.words.length) {
-        const positional = decodeWord(segment.words[index].text);
-        if (positional.startsWith("-") && positional !== "-")
-          break;
-        index++;
-        positionals--;
-      }
-      continue;
-    }
-    return index;
-  }
-  return -1;
-}
-function rmOperands(segment, verbIndex) {
-  const operands = [];
-  let seenDoubleDash = false;
-  for (let index = verbIndex + 1;index < segment.words.length; index++) {
-    if (segment.redirects.has(index))
-      continue;
-    const decoded = decodeWord(segment.words[index].text);
-    if (!seenDoubleDash) {
-      if (decoded === "--") {
-        seenDoubleDash = true;
-        continue;
-      }
-      if (decoded.startsWith("-") && decoded !== "-")
-        continue;
-    }
-    operands.push(segment.words[index]);
-  }
-  return operands;
-}
-function handoffRoots(home) {
-  return HANDOFF_ROOTS.map((suffix) => join2(home, ...suffix.split("/")));
-}
-function expandHomeSpelling(token, home) {
-  if (token === "~" || token === "$HOME" || token === "${HOME}")
-    return home;
-  if (token.startsWith("~/"))
-    return join2(home, token.slice(2));
-  if (token.startsWith("$HOME/"))
-    return join2(home, token.slice("$HOME/".length));
-  if (token.startsWith("${HOME}/"))
-    return join2(home, token.slice("${HOME}/".length));
-  return token;
-}
-function resolveLiteralTarget(raw, cwd, home) {
-  let decoded = decodeWord(raw);
-  if (!decoded)
-    return null;
-  if (decoded.includes("`"))
-    return null;
-  if (decoded === "$HOME" || decoded === "${HOME}" || decoded === "$HOME/" || decoded === "${HOME}/")
-    return home;
-  const withoutHome = decoded.replace(/\$\{HOME\}/g, "").replace(/\$HOME/g, "");
-  if (withoutHome.includes("$"))
-    return null;
-  if (/[*?[\]]/.test(decoded))
-    return null;
-  if (decoded.startsWith("~")) {
-    const expanded = expandHomeSpelling(decoded, home);
-    if (expanded === decoded)
-      return null;
-    decoded = expanded;
-  }
-  const absolute = isAbsolute2(decoded) ? normalize(decoded) : resolve2(cwd, decoded);
-  const trimmed = absolute.replace(/\/+$/, "");
-  return trimmed === "" ? "/" : trimmed;
-}
-function isUnder(target, root) {
-  return target === root || target.startsWith(`${root}${sep}`);
-}
-function isScratchpadContent(target, home) {
-  const prefix = `${join2(home, ".hasna", "scratchpad", "scratch")}${sep}`;
-  if (!target.startsWith(prefix))
-    return false;
-  const [session, firstChild] = target.slice(prefix.length).split(sep);
-  if (!session || !/^[a-z0-9][a-z0-9._-]{0,63}$/.test(session) || session.endsWith(".") || !firstChild)
-    return false;
-  const control = firstChild.normalize("NFKC").toLowerCase();
-  return control !== "meta.json" && control !== ".lock";
-}
-function protectedTargetReason(target, home) {
-  if (target === home) {
-    return `\`${target}\` is the home directory itself, which is never deleted or trashed. Delete a specific file or directory inside it instead.`;
-  }
-  for (const root of SYSTEM_PROTECTED_ROOTS) {
-    if (target !== root && !isUnder(root, target))
-      continue;
-    return root === "/" ? `\`${target}\` is the filesystem root, which is never deleted.` : `\`${target}\` is the system root \`${root}\` (or an ancestor of it), which is never deleted or trashed.`;
-  }
-  for (const suffix of PROTECTED_HOME_TREES) {
-    const root = join2(home, suffix);
-    if (suffix === ".hasna" && isScratchpadContent(target, home))
-      continue;
-    if (!isUnder(target, root) && !isUnder(root, target))
-      continue;
-    return `\`${target}\` is the protected \`~/${suffix}\` path (or contains it), which is never deleted or trashed. Delete a specific file inside it, and only when you are sure.`;
-  }
-  return null;
-}
-function isHandoff(operands, cwd, home) {
-  const roots = handoffRoots(home);
-  if (roots.some((root) => isUnder(cwd, root)))
-    return true;
-  for (const operand of operands) {
-    const target = resolveLiteralTarget(operand.text, cwd, home);
-    if (target && roots.some((root) => isUnder(target, root)))
-      return true;
-  }
-  return false;
-}
-function scanCommand(command, options) {
-  const ctx = { cwd: options.cwd, home: options.home, depth: options.depth ?? 0 };
-  const result = { rmHits: [], handoffHits: [], refusals: [], protectedHits: [], trustworthy: true };
-  const lexed = lexCommand(command);
-  result.trustworthy = lexed.trustworthy;
-  if (!lexed.trustworthy) {
-    return result;
-  }
-  let cwd = ctx.cwd;
-  for (const segment of lexed.segments) {
-    const index = commandWordIndex(segment);
-    if (index < 0)
-      continue;
-    const verb = baseVerb(decodeWord(segment.words[index].text));
-    if (verb === "cd") {
-      const operand = segment.words[index + 1];
-      if (operand) {
-        const target = resolveLiteralTarget(operand.text, cwd, ctx.home);
-        if (target)
-          cwd = target;
-        else
-          cwd = ctx.cwd;
-      }
-      continue;
-    }
-    const refusal = REFUSED_VERBS[verb];
-    if (refusal) {
-      result.refusals.push({ reason: refusal });
-      continue;
-    }
-    if (verb === "rm") {
-      const operands = rmOperands(segment, index);
-      if (operands.length === 0)
-        continue;
-      const hit = { word: segment.words[index], operands };
-      if (isHandoff(hit.operands, cwd, ctx.home)) {
-        result.handoffHits.push(hit);
-        continue;
-      }
-      result.rmHits.push(hit);
-      for (const operand of hit.operands) {
-        const target = resolveLiteralTarget(operand.text, cwd, ctx.home);
-        if (!target)
-          continue;
-        const reason = protectedTargetReason(target, ctx.home);
-        if (reason) {
-          result.protectedHits.push({ reason });
-          break;
-        }
-      }
-      continue;
-    }
-    if (APPLET_DISPATCHERS.has(verb)) {
-      const appletIndex = segment.words.findIndex((word, at) => at > index && !decodeWord(word.text).startsWith("-"));
-      const applet = appletIndex >= 0 ? baseVerb(decodeWord(segment.words[appletIndex].text)) : "";
-      if (applet === "rm" || applet in REFUSED_VERBS) {
-        result.refusals.push({
-          reason: `\`${verb} ${applet}\` runs the ${verb} applet, whose own \`rm\` is not GNU \`rm\` and cannot be rewritten in place. Run the delete as \`rm -- <path>\`, which is redirected into trash.`
-        });
-      }
-      continue;
-    }
-    if (verb === "git") {
-      const sub = gitSubcommand(segment, index);
-      if (sub === "rm" || sub === "clean") {
-        const dryOrIndexOnly = sub === "rm" ? gitRmIsNonDeleting(segment, index) : gitHasDryRun(segment, index);
-        if (!dryOrIndexOnly) {
-          result.refusals.push({
-            reason: sub === "rm" ? "`git rm` is refused: without `--cached` it deletes the working-tree file, and its semantics are not `rm`'s. Use `rm -- <path>` (intercepted and redirected into trash) to remove the file, or `git rm --cached -- <path>` to unstage it without deleting." : "`git clean` deletes untracked files irrecoverably and is refused. Remove them explicitly with `rm -- <path>` (intercepted and redirected into trash), or preview with `git clean -n`."
-          });
-        }
-      }
-      continue;
-    }
-    if (verb === "find") {
-      const words = segment.words.map((word) => decodeWord(word.text));
-      const deleteIndex = words.indexOf("-delete");
-      if (deleteIndex >= 0) {
-        result.refusals.push({
-          reason: "`find -delete` deletes files irrecoverably and is refused. List the paths first (`find \u2026 -print`), then remove them explicitly with `rm -- <path>` so the delete is redirected into trash."
-        });
-        continue;
-      }
-      const execIndex = words.findIndex((word) => word === "-exec" || word === "-execdir" || word === "-ok");
-      if (execIndex >= 0 && words.slice(execIndex).some((word) => word === "rm" || word === "rmdir" || word === "unlink" || word === "shred")) {
-        result.refusals.push({
-          reason: "`find -exec <delete>` is refused: the delete runs through find, not through `rm`, and cannot be redirected into trash. Remove the paths explicitly with `rm -- <path>`."
-        });
-        continue;
-      }
-      continue;
-    }
-    if (verb === "xargs" && segment.words.some((word) => decodeWord(word.text) === "rm")) {
-      result.refusals.push({
-        reason: "`xargs rm` takes its targets from stdin, so this hook cannot verify what would be deleted. Pipe the paths into an explicit `rm -- <path> \u2026` instead, which is redirected into trash."
-      });
-      continue;
-    }
-    const opaqueText = verb === "env" ? envSplitCommandText(segment.words.map((word) => decodeWord(word.text))) : segmentText(segment);
-    if (OPAQUE_COMMANDS.has(verb) && mentionsDeleteVerb(opaqueText)) {
-      result.refusals.push({
-        reason: `\`${verb}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`
-      });
-      continue;
-    }
-  }
-  if (ctx.depth < 3) {
-    for (const body of lexed.substitutions) {
-      const inner = scanCommand(body, { cwd, home: ctx.home, depth: ctx.depth + 1 });
-      if (inner.rmHits.length > 0 || inner.refusals.length > 0 || inner.handoffHits.length > 0 || inner.protectedHits.length > 0) {
-        result.refusals.push({
-          reason: "This command runs a delete inside a command substitution `$(\u2026)`, which this hook cannot rewrite. Run the delete as a separate `rm -- <path>` command, which is redirected into trash."
-        });
-        break;
-      }
-    }
-  } else if (lexed.substitutions.some((body) => mentionsDeleteVerb(body))) {
-    result.refusals.push({
-      reason: "This command nests a delete inside command substitutions deeper than this hook will follow. Run the delete as a separate `rm -- <path>` command."
-    });
-  }
-  return result;
-}
-function segmentText(segment) {
-  return segment.words.map((word) => word.text).join(" ");
-}
-function gitSubcommand(segment, verbIndex) {
-  let index = verbIndex + 1;
-  while (index < segment.words.length) {
-    const option = decodeWord(segment.words[index].text);
-    if (!option.startsWith("-"))
-      return option;
-    index++;
-    if (GIT_VALUE_OPTIONS.has(option))
-      index++;
-  }
-  return null;
-}
-function gitRmIsNonDeleting(segment, verbIndex) {
-  const options = segment.words.slice(verbIndex + 1).map((word) => decodeWord(word.text));
-  if (options.includes("--cached"))
-    return true;
-  return gitHasDryRun(segment, verbIndex);
-}
-function gitHasDryRun(segment, verbIndex) {
-  const options = segment.words.slice(verbIndex + 1).map((word) => decodeWord(word.text));
-  return options.includes("-n") || options.includes("--dry-run");
-}
-function shellQuoteWord(word) {
-  if (/^[A-Za-z0-9_\-./+=:,@%^]+$/.test(word))
-    return word;
-  return `'${word.replace(/'/g, `'\\''`)}'`;
-}
-function rewriteCommand(command, hits, trashPath, execution) {
-  const replacement = execution ? [
-    "/usr/bin/env",
-    "-i",
-    `HOME=${execution.home}`,
-    `PATH=${execution.path}`,
-    `HASNA_TRASH_AGENT=${execution.agent}`,
-    execution.runtime,
-    "--config=/dev/null",
-    "--no-env-file",
-    "--no-macros",
-    "--no-install",
-    trashPath,
-    "guard"
-  ].map(shellQuoteWord).join(" ") : `${shellQuoteWord(trashPath)} guard`;
-  const ordered = [...hits].sort((a, b) => b.word.start - a.word.start);
-  let out = command;
-  for (const hit of ordered) {
-    out = `${out.slice(0, hit.word.start)}${replacement}${out.slice(hit.word.end)}`;
-  }
-  return out;
-}
-function rewriteIsComplete(original, rewritten, hits, cwd, home) {
-  if (!rewritten || rewritten === original)
-    return false;
-  if (hits.length === 0)
-    return false;
-  const verify = scanCommand(rewritten, { cwd, home });
-  if (!verify.trustworthy)
-    return false;
-  if (verify.rmHits.length > 0 || verify.handoffHits.length > 0)
-    return false;
-  return verify.refusals.length === 0;
-}
-function buildUpdatedInput(toolInput, command) {
-  const out = {};
-  for (const [key, value] of Object.entries(toolInput ?? {}))
-    out[key] = value;
-  out.command = command;
-  if (typeof out.description !== "string" || out.description.trim() === "") {
-    out.description = DEFAULT_DESCRIPTION;
-  }
-  if (typeof out.timeout !== "number" || !Number.isFinite(out.timeout) || out.timeout <= 0) {
-    out.timeout = DEFAULT_TIMEOUT_MS;
-  }
-  if (typeof out.run_in_background !== "boolean") {
-    out.run_in_background = false;
-  }
-  if ("dangerouslyDisableSandbox" in out && typeof out.dangerouslyDisableSandbox !== "boolean") {
-    delete out.dangerouslyDisableSandbox;
-  }
-  return out;
-}
-function updatedInputIsComplete(updated, original, hits, cwd, home) {
-  if (typeof updated.command !== "string" || updated.command.trim() === "")
-    return false;
-  if (typeof updated.description !== "string" || updated.description.trim() === "")
-    return false;
-  if (typeof updated.timeout !== "number" || !Number.isFinite(updated.timeout) || updated.timeout <= 0)
-    return false;
-  if (typeof updated.run_in_background !== "boolean")
-    return false;
-  if ("dangerouslyDisableSandbox" in updated && typeof updated.dangerouslyDisableSandbox !== "boolean")
-    return false;
-  return rewriteIsComplete(original, updated.command, hits, cwd, home);
-}
-function changesExecutionEnvironment(command) {
-  const stateCommands = new Set(["export", "set", "unset", "readonly", "declare", "typeset", "local", "alias", "unalias", "read", "readarray", "mapfile", "getopts", "trap", "enable", "function", "env", "sudo", "doas", "stdbuf"]);
-  const parsed = lexCommand(command);
-  return parsed.segments.some((segment) => {
-    const index = commandWordIndex(segment);
-    const prefix = segment.words.slice(0, index < 0 ? segment.words.length : index);
-    if (prefix.some((word2) => ASSIGNMENT_RE.test(decodeWord(word2.text)) || stateCommands.has(baseVerb(decodeWord(word2.text)))))
-      return true;
-    if (index < 0)
-      return false;
-    const word = segment.words[index];
-    return stateCommands.has(baseVerb(decodeWord(word.text))) || /^\s*\(\s*\)\s*\{/.test(command.slice(word.end));
-  });
-}
-function deny(reason) {
-  return {
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "deny",
-      permissionDecisionReason: reason
-    }
-  };
-}
-function allowRewrite(updatedInput) {
-  return {
-    hookSpecificOutput: {
-      hookEventName: "PreToolUse",
-      permissionDecision: "allow",
-      updatedInput
-    }
-  };
-}
-function resolveTrash(deps) {
-  try {
-    if (deps.inspectTrash) {
-      const inspection = deps.inspectTrash();
-      return inspection.ok ? { path: inspection.path, error: null } : { path: null, error: `${inspection.code}: ${BINARY_FAILURES[inspection.code]}` };
-    }
-    return { path: deps.findTrash(), error: null };
-  } catch (cause) {
-    return { path: null, error: cause instanceof Error ? cause.message : String(cause) };
-  }
-}
-var ABSENT_REASON = "[trash-guard] No verified @hasna/trash guard was found on PATH. This deletion is refused. Install the current @hasna/trash package with Bun and run its setup; the operating-system trash utility is not a compatible guard.";
-function evaluate(input, deps) {
-  if (input.hook_event_name !== "PreToolUse")
-    return { continue: true };
-  if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name ?? "")) {
-    const patch = input.tool_input?.command;
-    if (typeof patch !== "string")
-      return deny("[trash-guard] Unreadable patch input; deletion safety cannot be checked.");
-    if (/^\s*\*\*\* Delete File:/m.test(patch)) {
-      return deny("[trash-guard] Delete File would bypass recoverable deletion. First use `trash put -- <path>` or the trash_put MCP tool, then submit any remaining edits without the deletion block.");
-    }
-    return { continue: true };
-  }
-  if (input.tool_name !== "Bash")
-    return { continue: true };
-  const rawCommand = input.tool_input?.command;
-  if (typeof rawCommand !== "string") {
-    return deny("[trash-guard] The Bash tool call carried no readable `command`, so this hook cannot verify what would run. Refusing a call it cannot verify. Re-run the delete explicitly as `rm -- <path>` so it can be redirected into trash.");
-  }
-  const command = getCommand(input);
-  if (!command.trim())
-    return { continue: true };
-  const scanned = scanCommand(command, { cwd: deps.cwd, home: deps.home });
-  if (scanned.refusals.length > 0) {
-    return deny(`[trash-guard] ${scanned.refusals[0].reason}`);
-  }
-  if (scanned.protectedHits.length > 0) {
-    return deny(`[trash-guard] ${scanned.protectedHits[0].reason}`);
-  }
-  if (!scanned.trustworthy) {
-    return mentionsDeleteVerb(command) ? deny("[trash-guard] This command could not be parsed to the end (unterminated quote, substitution or here-document), so a delete inside it cannot be redirected. Re-run the delete as a plain `rm -- <path>` command.") : { continue: true };
-  }
-  if (scanned.rmHits.length === 0) {
-    if (scanned.handoffHits.length > 0) {
-      return { continue: true };
-    }
-    return { continue: true };
-  }
-  if (scanned.handoffHits.length > 0) {
-    return deny("[trash-guard] This command mixes a delete under the protected repo-checkout roots (owned by workspace-repos-guard) with a delete outside them, and a partial rewrite would leave one of them unredirected. Re-run them as separate commands, so each delete is handled by the hook that owns it.");
-  }
-  const trash = resolveTrash(deps);
-  if (trash.error !== null) {
-    return deny(`[trash-guard] The guard could not resolve the \`trash\` binary (${trash.error}), so this \`rm\` cannot be redirected into a recoverable delete \u2014 and an unrecoverable delete is never allowed, so the command is refused rather than run. Fix the environment (PATH, permissions) and re-run the same command.`);
-  }
-  if (trash.path === null) {
-    return deny(ABSENT_REASON);
-  }
-  const trashPath = trash.path;
-  if (deps.execution && changesExecutionEnvironment(command)) {
-    return deny("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");
-  }
-  const rewritten = rewriteCommand(command, scanned.rmHits, trashPath, deps.execution);
-  const updatedInput = buildUpdatedInput(input.tool_input, rewritten);
-  if (deps.execution)
-    updatedInput.hasna_execution = "hasna.hooks.execution.v1";
-  if (!updatedInputIsComplete(updatedInput, command, scanned.rmHits, deps.cwd, deps.home)) {
-    return deny("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");
-  }
-  return allowRewrite(updatedInput);
-}
-if (false) {}
-
-// hooks/hook-workspace-repos-guard/src/hook.ts
-import { closeSync as closeSync2, constants as constants2, fstatSync as fstatSync2, lstatSync as lstatSync2, openSync as openSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
-import { homedir } from "os";
-import { dirname as dirname2, isAbsolute as isAbsolute3, join as join3, normalize as normalize2, relative, resolve as resolve3, sep as sep2 } from "path";
-var FILE_WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
-var PATCH_TOOLS = new Set(["apply_patch", "ApplyPatch", "functions.apply_patch"]);
-var DEFAULT_ORGS = ["hasna", "hasnaxyz", "hasna-products"];
-var RULE = "workspace-repos-guard";
-function reposRoot(home) {
-  return join3(home, ".hasna", "repos", "clones");
-}
-function legacyRoot(home) {
-  return join3(home, "workspace", "repos");
-}
-function protectedRoots(home) {
-  return [reposRoot(home), legacyRoot(home)];
-}
-function allowedOrgsFile(home) {
-  return join3(home, ".hasna", "hooks", "config", "workspace-repos-guard-orgs");
-}
-var ORG_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
-function ownedAndClosed(stat) {
-  const uid = process.getuid?.();
-  return uid !== undefined && (stat.uid === 0 || stat.uid === uid) && (stat.mode & 18) === 0;
-}
-function readAllowedOrgsFile(home) {
-  const file = allowedOrgsFile(home);
-  let text;
-  try {
-    const fd = openSync2(file, constants2.O_RDONLY | constants2.O_NOFOLLOW);
-    try {
-      const stat = fstatSync2(fd);
-      if (!stat.isFile() || !ownedAndClosed(stat) || stat.size > 4096)
-        return null;
-      text = readFileSync2(fd, "utf8");
-    } finally {
-      closeSync2(fd);
-    }
-    const top = normalize2(home);
-    for (let dir = dirname2(file);dir !== top; dir = dirname2(dir)) {
-      const stat = lstatSync2(dir);
-      if (!stat.isDirectory() || !ownedAndClosed(stat) || dir === dirname2(dir))
-        return null;
-    }
-    if (!ownedAndClosed(statSync2(top)))
-      return null;
-  } catch {
-    return null;
-  }
-  const names = text.replace(/#[^\n]*/g, "").split(/[\s,]+/).filter(Boolean);
-  return names.length > 0 && names.every((name) => ORG_NAME.test(name)) ? new Set(names) : null;
-}
-function resolveAllowedOrgs(env = process.env, home = homedir()) {
-  const raw = env.WORKSPACE_REPOS_GUARD_ORGS;
-  if (typeof raw === "string" && raw.trim()) {
-    return new Set(raw.split(",").map((s) => s.trim()).filter(Boolean));
-  }
-  return readAllowedOrgsFile(home) ?? new Set(DEFAULT_ORGS);
-}
-function classifyPath(target, root, orgs, op) {
-  if (op === "read")
-    return { blocked: false };
-  let rel = relative(root, target);
-  if (rel === "") {
-    if (op === "delete")
-      return { blocked: true, reason: `[${RULE}] delete of the protected repo-checkout root is forbidden: ${root}` };
-    return { blocked: true, reason: `[${RULE}] writes directly to the protected repo-checkout root are forbidden: ${root}` };
-  }
-  if (rel.startsWith(`..${sep2}`) || rel === ".." || isAbsolute3(rel)) {
-    return { blocked: false };
-  }
-  const segments = rel.split(sep2).filter(Boolean);
-  if (op === "delete") {
-    return { blocked: true, reason: `[${RULE}] delete under the protected repo-checkout root (${root}) is forbidden at any depth: ${target}` };
-  }
-  if (segments.length <= 1) {
-    return {
-      blocked: true,
-      reason: `[${RULE}] writing would create a top-level entry directly under the protected repo-checkout root (${root}); only GitHub-org folders belong there: ${target}`
-    };
-  }
-  const org = segments[0];
-  if (!orgs.has(org)) {
-    return {
-      blocked: true,
-      reason: `[${RULE}] '${org}' is not an allowed GitHub org under the protected repo-checkout root (${root}); allowed: ${[...orgs].join(", ")}: ${target}`
-    };
-  }
-  return { blocked: false };
-}
-var WRITE_FLAGS = /\b(?:-o|--output|-O|--output-document|-out)\b/;
-var FD_DUPLICATION = /\d*[<>]&\s*(?:\d+|-)(?=$|[\s;&|)])/g;
-var OUTPUT_REDIRECT = /(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;
-function withoutFdDuplication(segment) {
-  return segment.replace(FD_DUPLICATION, " ");
-}
-function pipelineStages(segment) {
-  const stages = [];
-  let quote = null;
-  let parens = 0;
-  let braces = 0;
-  let backtick = false;
-  let start = 0;
-  for (let i = 0;i < segment.length; i++) {
-    const ch = segment[i];
-    if (quote === "'") {
-      if (ch === "'")
-        quote = null;
-      continue;
-    }
-    if (ch === "\\") {
-      i++;
-      continue;
-    }
-    if (ch === "(") {
-      parens++;
-      continue;
-    }
-    if (ch === ")") {
-      if (--parens < 0)
-        return [segment];
-      continue;
-    }
-    if (ch === "$" && segment[i + 1] === "{") {
-      braces++;
-      i++;
-      continue;
-    }
-    if (ch === "}" && braces > 0) {
-      braces--;
-      continue;
-    }
-    if (ch === "`") {
-      backtick = !backtick;
-      continue;
-    }
-    if (quote === '"') {
-      if (ch === '"')
-        quote = null;
-      continue;
-    }
-    if (ch === "'" || ch === '"') {
-      quote = ch;
-      continue;
-    }
-    if (ch !== "|" || parens > 0 || braces > 0 || backtick || segment[i - 1] === ">")
-      continue;
-    stages.push(segment.slice(start, i));
-    if (segment[i + 1] === "&")
-      i++;
-    start = i + 1;
-  }
-  if (quote || parens !== 0 || braces !== 0 || backtick)
-    return [segment];
-  stages.push(segment.slice(start));
-  return stages;
-}
-function shellWords(command) {
-  const words = [];
-  let text = "";
-  let raw = "";
-  let quote = null;
-  let inWord = false;
-  const flush = () => {
-    if (!inWord)
-      return;
-    const body = raw.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/, "");
-    const literalTilde = text.startsWith("~") && !/^~(?:\/|$)/.test(raw);
-    words.push({ text: literalTilde ? `./${text}` : text, opaque: /[$\x60*?[]/.test(body) || /[()]/.test(body) });
-    text = "";
-    raw = "";
-    inWord = false;
-  };
-  for (let i = 0;i < command.length; i++) {
-    const ch = command[i];
-    if (quote === "'") {
-      if (ch === "'")
-        quote = null;
-      else
-        text += ch;
-      raw += ch;
-      continue;
-    }
-    if (ch === "\\" && i + 1 < command.length) {
-      const next = command[i + 1];
-      text += quote === '"' && !/[$\x60"\\\n]/.test(next) ? ch + next : next;
-      raw += ch + next;
-      inWord = true;
-      i++;
-      continue;
-    }
-    if (quote === '"') {
-      if (ch === '"')
-        quote = null;
-      else
-        text += ch;
-      raw += ch;
-      continue;
-    }
-    if (/\s/.test(ch)) {
-      flush();
-      continue;
-    }
-    inWord = true;
-    raw += ch;
-    if (ch === "'" || ch === '"')
-      quote = ch;
-    else
-      text += ch;
-  }
-  if (quote) {
-    raw += "$";
-  }
-  flush();
-  return words;
-}
-function segmentOperation(segment) {
-  const trimmed = segment.trim();
-  if (!trimmed)
-    return "read";
-  const parsed = lexCommand(trimmed);
-  if (!parsed.trustworthy || parsed.substitutions.length || /\$\{[^}]*[|;()]|[<>]\(/.test(trimmed))
-    return opaqueOperation(trimmed);
-  const operations = parsed.segments.map((part) => {
-    const index = commandWordIndex(part);
-    if (index < 0)
-      return "read";
-    const words = part.words.filter((_, at) => at >= index && !part.redirects.has(at)).map((word) => decodeWord(word.text));
-    const tool = words[0].split("/").pop();
-    if (["rm", "rmdir", "unlink", "shred", "rmtree", "del"].includes(tool ?? ""))
-      return "delete";
-    if (tool === "trash") {
-      let at = 1;
-      while (at < words.length && words[at].startsWith("-")) {
-        const flag = words[at++];
-        if (["--help", "-h", "--version", "-V", "--identity"].includes(flag))
-          return "read";
-        if (["--agent", "--spool", "--files", "--info", "--config"].includes(flag))
-          at++;
-        else if (!["--json", "--local"].includes(flag))
-          return "delete";
-      }
-      if (at === words.length || ["status", "doctor", "list", "info", "get", "pending", "station", "setup", "backup", "storage", "retrieval", "backup-storage", "backup-inspect", "backup-refresh", "help"].includes(words[at]))
-        return "read";
-      if (["restore", "restore-capsule"].includes(words[at]))
-        return "write";
-      return "delete";
-    }
-    if (tool === "git") {
-      const sub = gitSubcommand(part, index);
-      if (sub === "clean" || sub === "rm")
-        return "delete";
-      return sub === "clone" || sub === "init" ? "write" : "read";
-    }
-    if (tool === "env" && mentionsDeleteVerb(envSplitCommandText(words)))
-      return "delete";
-    if (["sh", "bash", "zsh", "dash", "ksh", "ash", "eval", "source", ".", "su", "runuser", "env", "xargs", "find", "busybox", "toybox"].includes(tool ?? "")) {
-      return opaqueOperation(words.join(" "));
-    }
-    if (["mkdir", "mkfile", "touch", "mv", "cp", "ln", "tee", "install", "dd", "rsync", "scp", "truncate"].includes(tool ?? ""))
-      return "write";
-    if (tool === "curl" || tool === "wget")
-      return WRITE_FLAGS.test(words.join(" ")) ? "write" : "read";
-    if (tool === "sed" && words.slice(1).some((word) => /^-i|^--in-place(?:=|$)/.test(word)))
-      return "write";
-    if (["python", "python3", "node", "bun"].includes(tool ?? "") && words.some((word) => word === "-c" || word === "-e"))
-      return "write";
-    return "read";
-  });
-  return operations.includes("delete") ? "delete" : operations.includes("write") ? "write" : "read";
-}
-function opaqueOperation(segment) {
-  const trimmed = segment.trim();
-  if (!trimmed)
-    return "read";
-  if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(trimmed))
-    return "delete";
-  if (/\bgit\b/.test(trimmed)) {
-    if (/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(trimmed))
-      return "delete";
-    if (/\bgit\b[^;&|]*\b(?:clone|init)\b/.test(trimmed))
-      return "write";
-    return "read";
-  }
-  if (/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(trimmed))
-    return "write";
-  if (/\b(?:curl|wget)\b/.test(trimmed)) {
-    if (WRITE_FLAGS.test(trimmed))
-      return "write";
-    return "read";
-  }
-  if (/\bsed\b/.test(trimmed)) {
-    if (/(?:^|\s)-i\S*(?:\s|$)|--in-place(?:\s|$)/.test(trimmed))
-      return "write";
-  } else if (/\b(?:rsync|scp|truncate)\b/.test(trimmed)) {
-    return "write";
-  } else if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(trimmed)) {
-    return "write";
-  }
-  if (/(?:^|[;&|])\s*echo\b/.test(trimmed) || />/.test(withoutFdDuplication(trimmed)))
-    return "write";
-  return "read";
-}
-function expandHomeSpelling2(token, home) {
-  let body = token.trim();
-  const quoted = body.match(/^(['"])([\s\S]*)\1$/);
-  if (quoted)
-    body = quoted[2];
-  body = body.replace(/^"*\$HOME"*\//, "$HOME/");
-  body = body.replace(/^"*\$\{HOME\}"*\//, "${HOME}/");
-  if (body === "~")
-    return home;
-  if (body.startsWith("~/"))
-    return join3(home, body.slice(2));
-  if (body === "$HOME" || body === "${HOME}")
-    return home;
-  if (body.startsWith("$HOME/"))
-    return join3(home, body.slice("$HOME/".length));
-  if (body.startsWith("${HOME}/"))
-    return join3(home, body.slice("${HOME}/".length));
-  const homeMatch = body.match(new RegExp(`^"*${regexEscape(home)}"*/`));
-  if (homeMatch)
-    return home + "/" + body.slice(homeMatch[0].length);
-  return token;
-}
-function unwrapSegment(segment) {
-  let s = segment.trim();
-  while (s.startsWith("(") || s.startsWith("{"))
-    s = s.slice(1).trim();
-  while (s.endsWith(")") || s.endsWith("}"))
-    s = s.slice(0, -1).trim();
-  return s;
-}
-function regexEscape(text) {
-  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function cdDestinations(operand, bases, home) {
-  if (operand === undefined)
-    return [home];
-  let word = expandHomeSpelling2(operand, home);
-  const quoted = word.match(/^(['"])(.*)\1$/);
-  if (quoted)
-    word = quoted[2];
-  if (!word || word === "-" || /[$\x60*?[\]{}~\\'"]/.test(word))
-    return null;
-  return [...new Set(bases.map((base) => resolve3(base, word)))];
-}
-var REL_OPERAND = /(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/;
-function bashTargets(command, home, cwd) {
-  if (!command)
-    return [];
-  const roots = protectedRoots(home);
-  const underRoot = (path) => roots.some((root) => path === root || path.startsWith(`${root}${sep2}`));
-  const parts = command.split(/(\s*&&\s*|\s*\|\|\s*|;\s*|\n+)/);
-  const targets = [];
-  let current = [cwd];
-  let reachable = new Set([cwd]);
-  let certain = true;
-  const subshells = [];
-  for (let index = 0;index < parts.length; index += 2) {
-    const separator = index === 0 ? "" : parts[index - 1].trim();
-    if (separator === "||")
-      certain = false;
-    else if (separator !== "&&")
-      certain = true;
-    if (separator !== "&&" || !certain)
-      current = [...reachable];
-    const rawSegment = parts[index];
-    const opens = (rawSegment.match(/^[\s({]*/)?.[0].match(/\(/g) ?? []).length;
-    const closes = (rawSegment.match(/[\s)}]*$/)?.[0].match(/\)/g) ?? []).length;
-    for (let i = 0;i < opens; i++)
-      subshells.push({ current: [...current], reachable: new Set(reachable), certain });
-    const segment = unwrapSegment(rawSegment);
-    const plainCd = segment.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/);
-    const embeddedCd = plainCd ? null : segment.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);
-    if (embeddedCd) {
-      for (const dir of cdDestinations(embeddedCd[1], current, home) ?? [])
-        reachable.add(dir);
-      certain = false;
-      current = [...reachable];
-    }
-    const homeLiteral = regexEscape(home);
-    const suffix = roots.map((root) => regexEscape(root.slice(home.length + 1))).join("|");
-    const prefixRe = new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${homeLiteral}"*)/(?:${suffix})`);
-    const re = new RegExp(`(${prefixRe.source})([^\\s"';&|<>()\`]*|$)`, "g");
-    const explicitTargets = (text) => {
-      const found = [];
-      let m;
-      re.lastIndex = 0;
-      while ((m = re.exec(text)) !== null)
-        found.push(normalize2(expandHomeSpelling2(m[0], home)).replace(/\/+$/, ""));
-      return found;
-    };
-    const stages = pipelineStages(segment).map((stage) => {
-      const operands = [];
-      let opaqueRedirect = false;
-      const commandPart = withoutFdDuplication(stage).replace(OUTPUT_REDIRECT, (_match, operand) => {
-        if (!operand || /[$\x60]/.test(operand))
-          opaqueRedirect = true;
-        if (operand)
-          operands.push(operand);
-        return " ";
-      });
-      const commandOp = segmentOperation(commandPart);
-      return { commandPart, operands, op: opaqueRedirect && commandOp === "read" ? "write" : commandOp };
-    });
-    const pipelineOp = stages.some((stage) => stage.op === "delete") ? "delete" : stages.some((stage) => stage.op === "write") ? "write" : "read";
-    const bases = current.filter(underRoot);
-    for (const stage of stages) {
-      let foundExplicit = false;
-      for (const path of explicitTargets(stage.commandPart)) {
-        foundExplicit = true;
-        targets.push({ path, op: pipelineOp });
-      }
-      for (const operand of stage.operands) {
-        const explicit = explicitTargets(operand);
-        for (const path of explicit)
-          targets.push({ path, op: "write" });
-        if (explicit.length > 0)
-          continue;
-        for (const base of bases) {
-          targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op: "write" });
-        }
-      }
-      if (foundExplicit || stage.op === "read")
-        continue;
-      const words = shellWords(stage.commandPart);
-      let operandStart = 1;
-      const tool = (words[0]?.text ?? "").split("/").pop();
-      if (tool === "trash" && ["put", "rm", "delete", "remove"].includes(words[1]?.text ?? ""))
-        operandStart = 2;
-      if (tool === "git") {
-        const sub = words.findIndex((word, index2) => index2 > 0 && (word.text === "rm" || word.text === "clean"));
-        if (sub > 0)
-          operandStart = sub + 1;
-      }
-      let endOfOptions = false;
-      const nonFlag = words.slice(operandStart).flatMap((word) => {
-        if (!endOfOptions && word.text === "--") {
-          endOfOptions = true;
-          return [];
-        }
-        if (!endOfOptions && word.text.startsWith("-"))
-          return [];
-        endOfOptions = true;
-        return [word.opaque ? "." : word.text];
-      });
-      const everyOperand = stage.op === "delete" || /(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(stage.commandPart) || /(?:^|\s)sed(?:\s|$)/.test(stage.commandPart) && /(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(stage.commandPart);
-      const operandTargets = [];
-      if (everyOperand) {
-        for (const operand of nonFlag.length > 0 ? nonFlag : ["."])
-          operandTargets.push({ operand, op: stage.op });
-      } else {
-        const relMatch = stage.commandPart.match(REL_OPERAND);
-        const last = words.at(-1);
-        operandTargets.push({ operand: relMatch ? relMatch[1] : !last || last.opaque ? "." : last.text, op: stage.op });
-        if (/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(stage.commandPart)) {
-          words.forEach((word, index2) => {
-            let value;
-            const short = word.text.match(/^-[A-Za-z]*?t(.*)$/);
-            const long = word.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);
-            if (short && !word.text.startsWith("--")) {
-              value = short[1] ? { text: short[1], opaque: word.opaque } : words[index2 + 1];
-            } else if (long && "--target-directory".startsWith(long[1])) {
-              value = long[2] !== undefined ? { text: long[2], opaque: word.opaque } : words[index2 + 1];
-            }
-            if (value)
-              operandTargets.push({ operand: value.opaque || !value.text ? "." : value.text, op: stage.op });
-          });
-        }
-        if (/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(stage.commandPart)) {
-          operandTargets.push({ operand: ".", op: stage.op });
-        }
-      }
-      for (const base of bases) {
-        for (const { operand, op } of operandTargets) {
-          targets.push({ path: normalize2(resolve3(base, expandHomeSpelling2(operand, home))), op });
-        }
-      }
-    }
-    if (plainCd) {
-      const next = cdDestinations(plainCd[1], current, home);
-      if (next) {
-        for (const dir of next)
-          reachable.add(dir);
-        if (certain)
-          current = next;
-      } else {
-        certain = false;
-      }
-    }
-    for (let i = 0;i < closes && subshells.length > 0; i++)
-      ({ current, reachable, certain } = subshells.pop());
-  }
-  return targets;
-}
-var PATCH_FILE_RE = /^\s*\*\*\*\s+(Add File|Update File|Delete File):\s+(\S+)\s*$/gm;
-function patchTargets(patch, cwd) {
-  const targets = [];
-  let m;
-  while ((m = PATCH_FILE_RE.exec(patch)) !== null) {
-    const op = m[1] === "Delete File" ? "delete" : "write";
-    targets.push({ path: normalize2(resolve3(cwd, m[2])), op });
-  }
-  return targets;
-}
-function evaluate2(input, options = {}) {
-  const warnings = [];
-  if (input.hook_event_name !== "PreToolUse")
-    return { output: { continue: true }, warnings };
-  const tool = typeof input.tool_name === "string" ? input.tool_name : "";
-  const home = options.home ?? homedir();
-  const roots = protectedRoots(home);
-  const orgs = resolveAllowedOrgs(process.env, home);
-  if (tool === "Bash") {
-    const command = getCommand(input);
-    if (!command)
-      return { output: { continue: true }, warnings };
-    const cwd2 = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
-    const targets = bashTargets(command, home, cwd2);
-    for (const target2 of targets) {
-      for (const root of roots) {
-        const verdict = classifyPath(target2.path, root, orgs, target2.op);
-        if (verdict.blocked) {
-          return { output: { decision: "block", reason: verdict.reason }, warnings };
-        }
-      }
-    }
-    return { output: { continue: true }, warnings };
-  }
-  const toolInput = input.tool_input ?? {};
-  const cwd = typeof input.cwd === "string" && input.cwd ? input.cwd : process.cwd();
-  if (PATCH_TOOLS.has(tool)) {
-    const patch = typeof toolInput.patch === "string" ? toolInput.patch : "";
-    if (!patch)
-      return { output: { continue: true }, warnings };
-    const targets = patchTargets(patch, cwd);
-    for (const target2 of targets) {
-      for (const root of roots) {
-        const verdict = classifyPath(target2.path, root, orgs, target2.op);
-        if (verdict.blocked) {
-          return { output: { decision: "block", reason: verdict.reason }, warnings };
-        }
-      }
-    }
-    return { output: { continue: true }, warnings };
-  }
-  if (!FILE_WRITE_TOOLS.has(tool))
-    return { output: { continue: true }, warnings };
-  const raw = typeof toolInput.file_path === "string" ? toolInput.file_path : typeof toolInput.path === "string" ? toolInput.path : typeof toolInput.notebook_path === "string" ? toolInput.notebook_path : null;
-  if (!raw)
-    return { output: { continue: true }, warnings };
-  const expanded = expandHomeSpelling2(raw, home);
-  const target = isAbsolute3(expanded) ? normalize2(expanded) : resolve3(cwd, expanded);
-  for (const root of roots) {
-    const verdict = classifyPath(target, root, orgs, "write");
-    if (verdict.blocked) {
-      return { output: { decision: "block", reason: verdict.reason }, warnings };
-    }
-  }
-  return { output: { continue: true }, warnings };
-}
-if (false) {}
-
-// hooks/native-safety-entry.ts
-var name = process.argv[1];
-if (name !== "trash-guard" && name !== "workspace-repos-guard")
-  throw new Error("Invalid safety capability");
-var input = JSON.parse(await Bun.stdin.text());
-if (!input || Array.isArray(input) || input.hook_event_name !== "PreToolUse" || typeof input.tool_name !== "string" || !input.tool_input || typeof input.tool_input !== "object" || Array.isArray(input.tool_input) || typeof input.cwd !== "string" || !isAbsolute4(input.cwd))
-  throw new Error("Invalid safety input");
-if (input.tool_name === "Bash" && typeof input.tool_input.command !== "string")
-  throw new Error("Invalid shell input");
-var requestedExecution = input.hasna_execution;
-if (requestedExecution !== undefined && (!requestedExecution || Object.keys(requestedExecution).sort().join() !== "agent,schema" || requestedExecution.schema !== "hasna.hooks.execution.v1" || typeof requestedExecution.agent !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(requestedExecution.agent)))
-  throw new Error("Invalid execution capability");
-var execution = requestedExecution === undefined ? undefined : {
-  runtime: process.execPath,
-  home: homedir2(),
-  path: process.env.PATH,
-  agent: requestedExecution.agent
-};
-if (execution && (!isAbsolute4(execution.runtime) || !execution.path))
-  throw new Error("Invalid bound execution context");
-if (["apply_patch", "ApplyPatch", "functions.apply_patch"].includes(input.tool_name)) {
-  if (input.tool_input.command !== undefined && input.tool_input.patch !== undefined && input.tool_input.command !== input.tool_input.patch)
-    throw new Error("Conflicting patch aliases");
-  const patch = input.tool_input.command ?? input.tool_input.patch;
-  if (typeof patch !== "string")
-    throw new Error("Invalid patch input");
-  input.tool_input = { ...input.tool_input, command: patch, patch };
-}
-var repos = evaluate2(input).output;
-var handoff = input.tool_name === "Bash" && scanCommand(input.tool_input.command, { home: homedir2(), cwd: input.cwd }).handoffHits.length > 0;
-var verdict = repos.decision === "block" ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: repos.reason } } : handoff ? { hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: "[workspace-repos-guard] Deletion under a protected repository checkout is refused." } } : name === "trash-guard" ? evaluate(input, { home: homedir2(), cwd: input.cwd, findTrash: findTrashBinary, inspectTrash: inspectTrashBinary, execution }) : { continue: true };
-process.stdout.write(JSON.stringify({ verdict: "continue" in verdict ? null : verdict }));
+import{homedir as T0}from"os";import{isAbsolute as B1}from"path";import{isAbsolute as A1,join as ZZ,normalize as L1,resolve as P1,sep as pZ}from"path";import{dirname as t,isAbsolute as PZ,join as lZ,resolve as s}from"path";import{accessSync as M1,closeSync as F1,constants as AZ,fstatSync as N1,lstatSync as HZ,openSync as q1,readFileSync as _1,readlinkSync as j1,readSync as W1,realpathSync as mZ,statSync as cZ}from"fs";import{spawnSync as T1}from"child_process";var A0={missing:"No verified @hasna/trash guard was found on PATH.",unsafe_executable:"The Trash candidate is not an owned executable file or is writable by group or others.",unsafe_manifest:"The Trash package manifest is not a safe owned regular file.",unsafe_directory:"A Trash PATH or package directory is not owned safely or is writable by group or others.",unsafe_interpreter:"The Trash interpreter is missing, unsupported, or not a safe owned executable on its actual PATH.",unrecognized_package:"The candidate is not the registered @hasna/trash executable.",identity_failed:"The installed Trash identity probe failed or exceeded its deadline.",unsupported_protocol:"The installed Trash version does not expose the required guard protocol."};function BZ(Z){return Z===0||Z===process.getuid?.()}function LZ(Z,J=!1){let $=Z;for(let X=0;X<32;X++){if(!PZ($)||$.length>4096||!UZ("/"))return!1;let z=$.split("/"),Q=z.pop();if(!Q||Q==="."||Q==="..")return!1;let K="/";for(let H of z){if(!H||H===".")continue;if(H===".."){K=t(K);continue}let B=lZ(K,H),U=HZ(B);if(J&&B==="/bin"&&U.isSymbolicLink()&&U.uid===0){let V=mZ(B);if(!UZ(V))return!1;K=V;continue}if(!U.isDirectory()||!BZ(U.uid)||U.mode&18)return!1;K=B}let G=lZ(K,Q),Y=HZ(G);if(!BZ(Y.uid))return!1;if(Y.isSymbolicLink()){let H=j1(G);$=PZ(H)?H:K+"/"+H;continue}return Y.isFile()&&Boolean(Y.mode&73)&&!(Y.mode&18)}return!1}function C1(Z){if(!PZ(Z)||s(Z)!==(Z.replace(/\/+$/,"")||"/"))return!1;for(let J=s(Z);;J=t(J)){try{return HZ(J),UZ(J)}catch($){if($.code!=="ENOENT")return!1}if(t(J)===J)return!1}}function I1(Z,J){let $=q1(Z,AZ.O_RDONLY|AZ.O_NONBLOCK|AZ.O_NOFOLLOW),X;try{if(!N1($).isFile())return!1;let Q=Buffer.alloc(256),K=W1($,Q,0,Q.length,0);X=Q.subarray(0,K).toString("utf8").split(`
+`)[0]}finally{F1($)}let z=/^#!(\/[A-Za-z0-9_./-]+)$/.exec(X);if(z&&z[1]!=="/usr/bin/env")return LZ(z[1],!0);if(X!=="#!/usr/bin/env bun"||!LZ("/usr/bin/env",!0))return!1;for(let Q of J.split(":").slice(0,64)){if(!C1(Q))return!1;let K=s(Q,"bun");try{if(!cZ(K).isFile())continue;M1(K,AZ.X_OK)}catch{continue}return LZ(K,!0)}return!1}function UZ(Z){let J=Z;for(;;){let $=HZ(J);if(!$.isDirectory()||!BZ($.uid)||($.mode&18)!==0)return!1;let X=t(J);if(X===J)return!0;J=X}}function VZ(Z=process.env){let J=Z.PATH??"",$=Date.now()+2000,X="missing",z=(Q)=>{if(X==="missing"||X==="unrecognized_package"||Q.startsWith("unsafe_"))X=Q};for(let Q of J.split(":").slice(0,64)){if(!PZ(Q)||Date.now()>=$)continue;let K=s(Q,"trash");try{let G=cZ(K);if(!G.isFile()||!BZ(G.uid)||(G.mode&73)===0||(G.mode&18)!==0){z("unsafe_executable");continue}let Y=mZ(K);if(!UZ(s(Q))||!UZ(t(Y))){z("unsafe_directory");continue}if(!LZ(K)){z("unsafe_directory");continue}let H=s(t(Y),"../.."),B=lZ(H,"package.json"),U=cZ(B);if(!U.isFile()||!BZ(U.uid)||U.size>16384||(U.mode&18)!==0||HZ(B).isSymbolicLink()){z("unsafe_manifest");continue}let V=JSON.parse(_1(B,"utf8"));if(V.name!=="@hasna/trash"||typeof V.version!=="string"||typeof V.bin?.trash!=="string"||mZ(s(H,V.bin.trash))!==Y){z("unrecognized_package");continue}try{if(!I1(Y,J)){z("unsafe_interpreter");continue}}catch{z("unsafe_interpreter");continue}let I=$-Date.now();if(I<=0){z("identity_failed");break}let j=T1(K,["--identity"],{encoding:"utf8",timeout:I,maxBuffer:2048,env:{PATH:J},stdio:["ignore","pipe","pipe"]});if(j.error||j.status!==0||Date.now()>=$){z("identity_failed");continue}let P=JSON.parse(j.stdout);if(P.name==="@hasna/trash"&&P.version===V.version&&P.guardProtocol==="hasna.trash.guard.v1")return{ok:!0,path:K,version:V.version};z("unsupported_protocol")}catch{}}return{ok:!1,code:X}}function OZ(Z=process.env){let J=VZ(Z);return J.ok?J.path:null}function e(Z){let J=Z.tool_input?.command;return typeof J==="string"?J:""}var L0=["/","/bin","/boot","/dev","/etc","/home","/lib","/lib32","/lib64","/libx32","/opt","/proc","/root","/run","/sbin","/srv","/sys","/usr","/var","/Applications","/Library","/System","/Users","/Volumes","/private"];var O1=600000,E1="Delete via trash guard (rm intercepted and made recoverable)",R1=[".hasna/repos/clones","workspace/repos"],y1=[".hasna",".ssh",".aws"],P0={rmdir:"`rmdir` is a delete that trash-guard does not rewrite (it takes rmdir's flags, not rm's). Re-run it as `rm -d -- <path>` for an empty directory, or `rm -r -- <path>` for a non-empty one, and it is redirected into trash.",unlink:"`unlink` is a delete that trash-guard does not rewrite. Re-run it as `rm -- <path>` and it is redirected into trash.",shred:"`shred` destroys content irrecoverably and is never allowed. Re-run it as `rm -- <path>` and it is redirected into trash."},v1=new Set(["sh","bash","zsh","dash","ksh","ash","eval","source",".","su","runuser","env"]),S1={sudo:["-u","--user","-g","--group","-p","--prompt","-C","--chdir","-h","--host","-r","--role","-t","--type","-U","--other-user"],doas:["-u","-C"],env:["-u","--unset","-C","--chdir","-S","--split-string"],nice:["-n","--adjustment"],ionice:["-c","--class","-n","--classdata","-p","--pid"],stdbuf:["-i","-o","-e","--input","--output","--error"],time:["-f","--format","-o","--output"],timeout:["-s","--signal","-k","--kill-after"],nohup:[],setsid:[],command:[],builtin:[],exec:["-a"]},b1={timeout:1},f1=new Set(["busybox","toybox"]),k1=new Set(["!","{","}","then","do","else","elif","if","while","until","for","case","esac","fi","done","select","function"]),w1=new Set(["-C","-c","--git-dir","--work-tree","--namespace","--exec-path","--config-env"]),x1=/(^|[^A-Za-z0-9_.-])(rm|rmdir|unlink|shred)(?![A-Za-z0-9_.-])/;function FZ(Z){return x1.test(A(Z))}function qZ(Z){return Z.map((J)=>J.replace(/^-[iv0]*S|^--split-string=/," ")).join(" ")}var y0=/^[A-Za-z_][A-Za-z0-9_]*=/;function NZ(Z){let J=Z.lastIndexOf("/");return J>=0?Z.slice(J+1):Z}function v0(Z,J){let $=Z.indexOf("'",J+1);return $===-1?-1:$+1}function iZ(Z,J){let $=J+1;while($<Z.length){if(Z[$]==="\\"){$+=2;continue}if(Z[$]==="`")return $+1;$++}return-1}function S0(Z,J){let $=J+1;while($<Z.length){let X=Z[$];if(X==="\\"){$+=2;continue}if(X==='"')return $+1;if(X==="`"){let z=iZ(Z,$);if(z<0)return-1;$=z;continue}if(X==="$"&&Z[$+1]==="("){let z=_Z(Z,$+1);if(z<0)return-1;$=z;continue}$++}return-1}function EZ(Z,J){if(Z[J]!=="<"||Z[J+1]!=="<"||Z[J+2]==="<")return null;let $=J+2,X=Z[$]==="-";if(X)$++;while(Z[$]===" "||Z[$]==="\t")$++;let z="",Q=!1;while($<Z.length&&!/[\s;|&<>()]/.test(Z[$])){let K=Z[$];if(K==="'"||K==='"'){let G=Z.indexOf(K,$+1);if(G<0)return null;z+=Z.slice($+1,G),Q=!0,$=G+1;continue}if(K==="\\"){if($+1>=Z.length)return null;z+=Z[$+1],Q=!0,$+=2;continue}z+=K,$++}return z?{delimiter:z,stripTabs:X,quoted:Q,end:$}:null}function RZ(Z,J,$){let X=J+1;for(let z of $)for(;;){if(X>Z.length)return-1;let Q=Z.indexOf(`
+`,X),K=Q===-1?Z.length:Q,G=Z.slice(X,K);if(G.endsWith("\r"))G=G.slice(0,-1);let Y=z.stripTabs?G.length-G.replace(/^\t+/,"").length:0;if(z.stripTabs)G=G.slice(Y);if(G===z.delimiter){X=K+1;break}if(G.startsWith(z.delimiter)&&/^\s*\)/.test(G.slice(z.delimiter.length))){if(z===$[$.length-1])return X+Y+z.delimiter.length;return-1}if(Q===-1)return-1;X=Q+1}return X-1}function _Z(Z,J){let $=Z.length,X=Z[J+1]==="(",z=0,Q=J,K=[];while(Q<$){let G=Z[Q];if(G==="\\"){Q+=2;continue}if(G==="'"){let Y=v0(Z,Q);if(Y<0)return-1;Q=Y;continue}if(G==='"'){let Y=S0(Z,Q);if(Y<0)return-1;Q=Y;continue}if(G==="`"){let Y=iZ(Z,Q);if(Y<0)return-1;Q=Y;continue}if(!X&&G==="<"&&Z[Q+1]==="<"){if(Z[Q+2]==="<"){Q+=3;continue}let Y=EZ(Z,Q);if(!Y)return-1;K.push(Y),Q=Y.end;continue}if(G===`
+`&&K.length>0){let Y=RZ(Z,Q,K);if(Y<0)return-1;K=[],Q=Y;continue}if(!X&&G==="#"&&/[\s;&|(]/.test(Z[Q-1])){let Y=Z.indexOf(`
+`,Q);if(Y<0)return-1;Q=Y;continue}if(G==="(")z++;else if(G===")"){if(z--,z===0)return K.length>0?-1:Q+1}Q++}return-1}function $Z(Z){let J=[],$=[],X=[],z=new Set,Q=-1,K=!1,G=!0,Y=0,H=Z.length,B=(M)=>{if(Q>=0){let _=X.length;if(X.push({text:Z.slice(Q,M),start:Q,end:M}),K)z.add(_);Q=-1,K=!1}},U=(M)=>{if(B(M),X.length>0)J.push({words:X,redirects:z});X=[],z=new Set,K=!1},V=(M)=>v0(Z,M),I=(M)=>iZ(Z,M),j=(M)=>_Z(Z,M),P=(M)=>S0(Z,M);while(Y<H){let M=Z[Y];if(M===" "||M==="\t"||M==="\r"){B(Y),Y++;continue}if(M===`
+`){U(Y),Y++;continue}if(M===";"){U(Y),Y++;continue}if(M==="&"){U(Y),Y+=Z[Y+1]==="&"?2:1;continue}if(M==="|"){U(Y),Y+=Z[Y+1]==="|"?2:1;continue}if(M==="("||M===")"){U(Y),Y++;continue}if(M==="<"&&Z[Y+1]==="<"&&Z[Y+2]!=="<"){let _=Z.slice(Y+2).match(/^-?[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);if(!_){G=!1,Y=H;continue}let g=Z.indexOf(`
+`,Y+2+_[0].length);if(g===-1){G=!1,Y=H;continue}let h=Z.slice(g+1),d=g1(h,_[2]);if(d===-1){G=!1,Y=H;continue}B(Y),Y=g+1+d+_[2].length;continue}if(M===">"||M==="<"){if(Q>=0&&/^\d+$/.test(Z.slice(Q,Y)))Q=-1;if(B(Y),K=!0,Y++,Z[Y]===M||Z[Y]==="&"||M===">"&&Z[Y]==="|"||M==="<"&&Z[Y]===">")Y++;continue}if(M==="'"){if(Q<0)Q=Y;let _=V(Y);if(_<0)G=!1,Y=H;else Y=_;continue}if(M==='"'){if(Q<0)Q=Y;let _=P(Y);if(_<0)G=!1,Y=H;else Y=_;continue}if(M==="`"){if(Q<0)Q=Y;let _=I(Y);if(_<0)G=!1,Y=H;else $.push(Z.slice(Y+1,_-1)),Y=_;continue}if(M==="$"&&Z[Y+1]==="("){if(Q<0)Q=Y;let _=j(Y+1);if(_<0)G=!1,Y=H;else $.push(Z.slice(Y+2,_-1)),Y=_;continue}if(M==="\\"){if(Q<0)Q=Y;if(Y+1>=H)G=!1,Y=H;else Y+=2;continue}if(Q<0)Q=Y;Y++}return U(H),{segments:J,trustworthy:G,substitutions:$}}function g1(Z,J){let $=0;while($<=Z.length){let X=Z.indexOf(J,$);if(X===-1)return-1;let z=X===0||Z[X-1]===`
+`,Q=X+J.length,K=Q===Z.length||Z[Q]===`
+`||Z[Q]==="\r";if(z&&K)return X;$=X+1}return-1}function A(Z){let J="",$=0;while($<Z.length){let X=Z[$];if(X==="\\"){if($+1<Z.length)J+=Z[$+1];$+=2;continue}if(X==="'"){let z=Z.indexOf("'",$+1);if(z===-1){J+=Z.slice($+1);break}J+=Z.slice($+1,z),$=z+1;continue}if(X==='"'){$++;while($<Z.length&&Z[$]!=='"'){if(Z[$]==="\\"&&$+1<Z.length){J+=Z[$+1],$+=2;continue}J+=Z[$],$++}$++;continue}J+=X,$++}return J}function u(Z){let J=0,$=0;while(J<Z.words.length&&$++<32){if(Z.redirects.has(J)){J++;continue}let X=Z.words[J].text,z=A(X);if(y0.test(z)&&!z.startsWith("-")){J++;continue}if(k1.has(z)){J++;continue}let Q=NZ(z);if(Q==="command")for(let G of Z.words.filter((Y,H)=>H>J&&!Z.redirects.has(H))){let Y=A(G.text);if(Y==="--"||!Y.startsWith("-"))break;if(/^-[pvV]*[vV][pvV]*$/.test(Y))return-1}let K=S1[Q];if(K){let G=J;J++;while(J<Z.words.length){if(Z.redirects.has(J)){J++;continue}let H=A(Z.words[J].text);if(!H.startsWith("-")||H==="-")break;if(H==="--"){J++;break}if(Q==="env"&&(/^-[iv0]*S/.test(H)||/^--split-string(?:=|$)/.test(H)))return G;if(J++,K.includes(H)||Q==="exec"&&/^-[cl]*a$/.test(H)){while(Z.redirects.has(J))J++;J++}}let Y=b1[Q]??0;while(Y>0&&J<Z.words.length){let H=A(Z.words[J].text);if(H.startsWith("-")&&H!=="-")break;J++,Y--}continue}return J}return-1}function h1(Z,J){let $=[],X=!1;for(let z=J+1;z<Z.words.length;z++){if(Z.redirects.has(z))continue;let Q=A(Z.words[z].text);if(!X){if(Q==="--"){X=!0;continue}if(Q.startsWith("-")&&Q!=="-")continue}$.push(Z.words[z])}return $}function u1(Z){return R1.map((J)=>ZZ(Z,...J.split("/")))}function l1(Z,J){if(Z==="~"||Z==="$HOME"||Z==="${HOME}")return J;if(Z.startsWith("~/"))return ZZ(J,Z.slice(2));if(Z.startsWith("$HOME/"))return ZZ(J,Z.slice(6));if(Z.startsWith("${HOME}/"))return ZZ(J,Z.slice(8));return Z}function dZ(Z,J,$){let X=A(Z);if(!X)return null;if(X.includes("`"))return null;if(X==="$HOME"||X==="${HOME}"||X==="$HOME/"||X==="${HOME}/")return $;if(X.replace(/\$\{HOME\}/g,"").replace(/\$HOME/g,"").includes("$"))return null;if(/[*?[\]]/.test(X))return null;if(X.startsWith("~")){let G=l1(X,$);if(G===X)return null;X=G}let K=(A1(X)?L1(X):P1(J,X)).replace(/\/+$/,"");return K===""?"/":K}function MZ(Z,J){return Z===J||Z.startsWith(`${J}${pZ}`)}function m1(Z,J){let $=`${ZZ(J,".hasna","scratchpad","scratch")}${pZ}`;if(!Z.startsWith($))return!1;let[X,z]=Z.slice($.length).split(pZ);if(!X||!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(X)||X.endsWith(".")||!z)return!1;let Q=z.normalize("NFKC").toLowerCase();return Q!=="meta.json"&&Q!==".lock"}function c1(Z,J){if(Z===J)return`\`${Z}\` is the home directory itself, which is never deleted or trashed. Delete a specific file or directory inside it instead.`;for(let $ of L0){if(Z!==$&&!MZ($,Z))continue;return $==="/"?`\`${Z}\` is the filesystem root, which is never deleted.`:`\`${Z}\` is the system root \`${$}\` (or an ancestor of it), which is never deleted or trashed.`}for(let $ of y1){let X=ZZ(J,$);if($===".hasna"&&m1(Z,J))continue;if(!MZ(Z,X)&&!MZ(X,Z))continue;return`\`${Z}\` is the protected \`~/${$}\` path (or contains it), which is never deleted or trashed. Delete a specific file inside it, and only when you are sure.`}return null}function p1(Z,J,$){let X=u1($);if(X.some((z)=>MZ(J,z)))return!0;for(let z of Z){let Q=dZ(z.text,J,$);if(Q&&X.some((K)=>MZ(Q,K)))return!0}return!1}function jZ(Z,J){let $={cwd:J.cwd,home:J.home,depth:J.depth??0},X={rmHits:[],handoffHits:[],refusals:[],protectedHits:[],trustworthy:!0},z=$Z(Z);if(X.trustworthy=z.trustworthy,!z.trustworthy)return X;let Q=$.cwd;for(let K of z.segments){let G=u(K);if(G<0)continue;let Y=NZ(A(K.words[G].text));if(Y==="cd"){let U=K.words[G+1];if(U){let V=dZ(U.text,Q,$.home);if(V)Q=V;else Q=$.cwd}continue}let H=P0[Y];if(H){X.refusals.push({reason:H});continue}if(Y==="rm"){let U=h1(K,G);if(U.length===0)continue;let V={word:K.words[G],operands:U};if(p1(V.operands,Q,$.home)){X.handoffHits.push(V);continue}X.rmHits.push(V);for(let I of V.operands){let j=dZ(I.text,Q,$.home);if(!j)continue;let P=c1(j,$.home);if(P){X.protectedHits.push({reason:P});break}}continue}if(f1.has(Y)){let U=K.words.findIndex((I,j)=>j>G&&!A(I.text).startsWith("-")),V=U>=0?NZ(A(K.words[U].text)):"";if(V==="rm"||V in P0)X.refusals.push({reason:`\`${Y} ${V}\` runs the ${Y} applet, whose own \`rm\` is not GNU \`rm\` and cannot be rewritten in place. Run the delete as \`rm -- <path>\`, which is redirected into trash.`});continue}if(Y==="git"){let U=sZ(K,G);if(U==="rm"||U==="clean"){if(!(U==="rm"?i1(K,G):b0(K,G)))X.refusals.push({reason:U==="rm"?"`git rm` is refused: without `--cached` it deletes the working-tree file, and its semantics are not `rm`'s. Use `rm -- <path>` (intercepted and redirected into trash) to remove the file, or `git rm --cached -- <path>` to unstage it without deleting.":"`git clean` deletes untracked files irrecoverably and is refused. Remove them explicitly with `rm -- <path>` (intercepted and redirected into trash), or preview with `git clean -n`."})}continue}if(Y==="find"){let U=K.words.map((j)=>A(j.text));if(U.indexOf("-delete")>=0){X.refusals.push({reason:"`find -delete` deletes files irrecoverably and is refused. List the paths first (`find \u2026 -print`), then remove them explicitly with `rm -- <path>` so the delete is redirected into trash."});continue}let I=U.findIndex((j)=>j==="-exec"||j==="-execdir"||j==="-ok");if(I>=0&&U.slice(I).some((j)=>j==="rm"||j==="rmdir"||j==="unlink"||j==="shred")){X.refusals.push({reason:"`find -exec <delete>` is refused: the delete runs through find, not through `rm`, and cannot be redirected into trash. Remove the paths explicitly with `rm -- <path>`."});continue}continue}if(Y==="xargs"&&K.words.some((U)=>A(U.text)==="rm")){X.refusals.push({reason:"`xargs rm` takes its targets from stdin, so this hook cannot verify what would be deleted. Pipe the paths into an explicit `rm -- <path> \u2026` instead, which is redirected into trash."});continue}let B=Y==="env"?qZ(K.words.map((U)=>A(U.text))):d1(K);if(v1.has(Y)&&FZ(B)){X.refusals.push({reason:`\`${Y}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`});continue}}if($.depth<3)for(let K of z.substitutions){let G=jZ(K,{cwd:Q,home:$.home,depth:$.depth+1});if(G.rmHits.length>0||G.refusals.length>0||G.handoffHits.length>0||G.protectedHits.length>0){X.refusals.push({reason:"This command runs a delete inside a command substitution `$(\u2026)`, which this hook cannot rewrite. Run the delete as a separate `rm -- <path>` command, which is redirected into trash."});break}}else if(z.substitutions.some((K)=>FZ(K)))X.refusals.push({reason:"This command nests a delete inside command substitutions deeper than this hook will follow. Run the delete as a separate `rm -- <path>` command."});return X}function d1(Z){return Z.words.map((J)=>J.text).join(" ")}function sZ(Z,J){let $=J+1;while($<Z.words.length){let X=A(Z.words[$].text);if(!X.startsWith("-"))return X;if($++,w1.has(X))$++}return null}function i1(Z,J){if(Z.words.slice(J+1).map((X)=>A(X.text)).includes("--cached"))return!0;return b0(Z,J)}function b0(Z,J){let $=Z.words.slice(J+1).map((X)=>A(X.text));return $.includes("-n")||$.includes("--dry-run")}function O0(Z){if(/^[A-Za-z0-9_\-./+=:,@%^]+$/.test(Z))return Z;return`'${Z.replace(/'/g,"'\\''")}'`}function s1(Z,J,$,X){let z=X?["/usr/bin/env","-i",`HOME=${X.home}`,`PATH=${X.path}`,`HASNA_TRASH_AGENT=${X.agent}`,X.runtime,"--config=/dev/null","--no-env-file","--no-macros","--no-install",$,"guard"].map(O0).join(" "):`${O0($)} guard`,Q=[...J].sort((G,Y)=>Y.word.start-G.word.start),K=Z;for(let G of Q)K=`${K.slice(0,G.word.start)}${z}${K.slice(G.word.end)}`;return K}function a1(Z,J,$,X,z){if(!J||J===Z)return!1;if($.length===0)return!1;let Q=jZ(J,{cwd:X,home:z});if(!Q.trustworthy)return!1;if(Q.rmHits.length>0||Q.handoffHits.length>0)return!1;return Q.refusals.length===0}function n1(Z,J){let $={};for(let[X,z]of Object.entries(Z??{}))$[X]=z;if($.command=J,typeof $.description!=="string"||$.description.trim()==="")$.description=E1;if(typeof $.timeout!=="number"||!Number.isFinite($.timeout)||$.timeout<=0)$.timeout=O1;if(typeof $.run_in_background!=="boolean")$.run_in_background=!1;if("dangerouslyDisableSandbox"in $&&typeof $.dangerouslyDisableSandbox!=="boolean")delete $.dangerouslyDisableSandbox;return $}function r1(Z,J,$,X,z){if(typeof Z.command!=="string"||Z.command.trim()==="")return!1;if(typeof Z.description!=="string"||Z.description.trim()==="")return!1;if(typeof Z.timeout!=="number"||!Number.isFinite(Z.timeout)||Z.timeout<=0)return!1;if(typeof Z.run_in_background!=="boolean")return!1;if("dangerouslyDisableSandbox"in Z&&typeof Z.dangerouslyDisableSandbox!=="boolean")return!1;return a1(J,Z.command,$,X,z)}function o1(Z){let J=new Set(["export","set","unset","readonly","declare","typeset","local","alias","unalias","read","readarray","mapfile","getopts","trap","enable","function","env","sudo","doas","stdbuf"]);return $Z(Z).segments.some((X)=>{let z=u(X);if(X.words.slice(0,z<0?X.words.length:z).some((G)=>y0.test(A(G.text))||J.has(NZ(A(G.text)))))return!0;if(z<0)return!1;let K=X.words[z];return J.has(NZ(A(K.text)))||/^\s*\(\s*\)\s*\{/.test(Z.slice(K.end))})}function k(Z){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Z}}}function t1(Z){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",updatedInput:Z}}}function e1(Z){try{if(Z.inspectTrash){let J=Z.inspectTrash();return J.ok?{path:J.path,error:null}:{path:null,error:`${J.code}: ${A0[J.code]}`}}return{path:Z.findTrash(),error:null}}catch(J){return{path:null,error:J instanceof Error?J.message:String(J)}}}var Z2="[trash-guard] No verified @hasna/trash guard was found on PATH. This deletion is refused. Install the current @hasna/trash package with Bun and run its setup; the operating-system trash utility is not a compatible guard.";function f0(Z,J){if(Z.hook_event_name!=="PreToolUse")return{continue:!0};if(["apply_patch","ApplyPatch","functions.apply_patch"].includes(Z.tool_name??"")){let H=Z.tool_input?.command;if(typeof H!=="string")return k("[trash-guard] Unreadable patch input; deletion safety cannot be checked.");if(/^\s*\*\*\* Delete File:/m.test(H))return k("[trash-guard] Delete File would bypass recoverable deletion. First use `trash put -- <path>` or the trash_put MCP tool, then submit any remaining edits without the deletion block.");return{continue:!0}}if(Z.tool_name!=="Bash")return{continue:!0};if(typeof Z.tool_input?.command!=="string")return k("[trash-guard] The Bash tool call carried no readable `command`, so this hook cannot verify what would run. Refusing a call it cannot verify. Re-run the delete explicitly as `rm -- <path>` so it can be redirected into trash.");let X=e(Z);if(!X.trim())return{continue:!0};let z=jZ(X,{cwd:J.cwd,home:J.home});if(z.refusals.length>0)return k(`[trash-guard] ${z.refusals[0].reason}`);if(z.protectedHits.length>0)return k(`[trash-guard] ${z.protectedHits[0].reason}`);if(!z.trustworthy)return FZ(X)?k("[trash-guard] This command could not be parsed to the end (unterminated quote, substitution or here-document), so a delete inside it cannot be redirected. Re-run the delete as a plain `rm -- <path>` command."):{continue:!0};if(z.rmHits.length===0){if(z.handoffHits.length>0)return{continue:!0};return{continue:!0}}if(z.handoffHits.length>0)return k("[trash-guard] This command mixes a delete under the protected repo-checkout roots (owned by workspace-repos-guard) with a delete outside them, and a partial rewrite would leave one of them unredirected. Re-run them as separate commands, so each delete is handled by the hook that owns it.");let Q=e1(J);if(Q.error!==null)return k(`[trash-guard] The guard could not resolve the \`trash\` binary (${Q.error}), so this \`rm\` cannot be redirected into a recoverable delete \u2014 and an unrecoverable delete is never allowed, so the command is refused rather than run. Fix the environment (PATH, permissions) and re-run the same command.`);if(Q.path===null)return k(Z2);let K=Q.path;if(J.execution&&o1(X))return k("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");let G=s1(X,z.rmHits,K,J.execution),Y=n1(Z.tool_input,G);if(J.execution)Y.hasna_execution="hasna.hooks.execution.v1";if(!r1(Y,X,z.rmHits,J.cwd,J.home))return k("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");return t1(Y)}import{closeSync as $2,constants as k0,fstatSync as J2,lstatSync as X2,openSync as z2,readFileSync as Y2,statSync as Q2}from"fs";import{homedir as g0}from"os";import{dirname as aZ,isAbsolute as h0,join as JZ,normalize as XZ,relative as K2,resolve as CZ,sep as oZ}from"path";var G2=new Set(["Write","Edit","MultiEdit","NotebookEdit"]),H2=new Set(["apply_patch","ApplyPatch","functions.apply_patch"]),B2=["hasna","hasnaxyz","hasna-products"],WZ="workspace-repos-guard";function U2(Z){return JZ(Z,".hasna","repos","clones")}function V2(Z){return JZ(Z,"workspace","repos")}function u0(Z){return[U2(Z),V2(Z)]}function M2(Z){return JZ(Z,".hasna","hooks","config","workspace-repos-guard-orgs")}var F2=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;function nZ(Z){let J=process.getuid?.();return J!==void 0&&(Z.uid===0||Z.uid===J)&&(Z.mode&18)===0}function N2(Z){let J=M2(Z),$;try{let z=z2(J,k0.O_RDONLY|k0.O_NOFOLLOW);try{let K=J2(z);if(!K.isFile()||!nZ(K)||K.size>4096)return null;$=Y2(z,"utf8")}finally{$2(z)}let Q=XZ(Z);for(let K=aZ(J);K!==Q;K=aZ(K)){let G=X2(K);if(!G.isDirectory()||!nZ(G)||K===aZ(K))return null}if(!nZ(Q2(Q)))return null}catch{return null}let X=$.replace(/#[^\n]*/g,"").split(/[\s,]+/).filter(Boolean);return X.length>0&&X.every((z)=>F2.test(z))?new Set(X):null}function q2(Z=process.env,J=g0()){let $=Z.WORKSPACE_REPOS_GUARD_ORGS;if(typeof $==="string"&&$.trim())return new Set($.split(",").map((X)=>X.trim()).filter(Boolean));return N2(J)??new Set(B2)}function rZ(Z,J,$,X){if(X==="read")return{blocked:!1};let z=K2(J,Z);if(z===""){if(X==="delete")return{blocked:!0,reason:`[${WZ}] delete of the protected repo-checkout root is forbidden: ${J}`};return{blocked:!0,reason:`[${WZ}] writes directly to the protected repo-checkout root are forbidden: ${J}`}}if(z.startsWith(`..${oZ}`)||z===".."||h0(z))return{blocked:!1};let Q=z.split(oZ).filter(Boolean);if(X==="delete")return{blocked:!0,reason:`[${WZ}] delete under the protected repo-checkout root (${J}) is forbidden at any depth: ${Z}`};if(Q.length<=1)return{blocked:!0,reason:`[${WZ}] writing would create a top-level entry directly under the protected repo-checkout root (${J}); only GitHub-org folders belong there: ${Z}`};let K=Q[0];if(!$.has(K))return{blocked:!0,reason:`[${WZ}] '${K}' is not an allowed GitHub org under the protected repo-checkout root (${J}); allowed: ${[...$].join(", ")}: ${Z}`};return{blocked:!1}}var l0=/\b(?:-o|--output|-O|--output-document|-out)\b/,_2=/\d*[<>]&\s*(?:\d+|-)(?=$|[\s;&|)])/g,j2=/(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;function m0(Z){return Z.replace(_2," ")}function W2(Z){let J=[],$=null,X=0,z=0,Q=!1,K=0;for(let G=0;G<Z.length;G++){let Y=Z[G];if($==="'"){if(Y==="'")$=null;continue}if(Y==="\\"){G++;continue}if(Y==="("){X++;continue}if(Y===")"){if(--X<0)return[Z];continue}if(Y==="$"&&Z[G+1]==="{"){z++,G++;continue}if(Y==="}"&&z>0){z--;continue}if(Y==="`"){Q=!Q;continue}if($==='"'){if(Y==='"')$=null;continue}if(Y==="'"||Y==='"'){$=Y;continue}if(Y!=="|"||X>0||z>0||Q||Z[G-1]===">")continue;if(J.push(Z.slice(K,G)),Z[G+1]==="&")G++;K=G+1}if($||X!==0||z!==0||Q)return[Z];return J.push(Z.slice(K)),J}function T2(Z){let J=[],$="",X="",z=null,Q=!1,K=()=>{if(!Q)return;let G=X.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/,""),Y=$.startsWith("~")&&!/^~(?:\/|$)/.test(X);J.push({text:Y?`./${$}`:$,opaque:/[$\x60*?[]/.test(G)||/[()]/.test(G)}),$="",X="",Q=!1};for(let G=0;G<Z.length;G++){let Y=Z[G];if(z==="'"){if(Y==="'")z=null;else $+=Y;X+=Y;continue}if(Y==="\\"&&G+1<Z.length){let H=Z[G+1];$+=z==='"'&&!/[$\x60"\\\n]/.test(H)?Y+H:H,X+=Y+H,Q=!0,G++;continue}if(z==='"'){if(Y==='"')z=null;else $+=Y;X+=Y;continue}if(/\s/.test(Y)){K();continue}if(Q=!0,X+=Y,Y==="'"||Y==='"')z=Y;else $+=Y}if(z)X+="$";return K(),J}function C2(Z){let J=Z.trim();if(!J)return"read";let $=$Z(J);if(!$.trustworthy||$.substitutions.length||/\$\{[^}]*[|;()]|[<>]\(/.test(J))return w0(J);let X=$.segments.map((z)=>{let Q=u(z);if(Q<0)return"read";let K=z.words.filter((Y,H)=>H>=Q&&!z.redirects.has(H)).map((Y)=>A(Y.text)),G=K[0].split("/").pop();if(["rm","rmdir","unlink","shred","rmtree","del"].includes(G??""))return"delete";if(G==="trash"){let Y=1;while(Y<K.length&&K[Y].startsWith("-")){let H=K[Y++];if(["--help","-h","--version","-V","--identity"].includes(H))return"read";if(["--agent","--spool","--files","--info","--config"].includes(H))Y++;else if(!["--json","--local"].includes(H))return"delete"}if(Y===K.length||["status","doctor","list","info","get","pending","station","setup","backup","storage","retrieval","backup-storage","backup-inspect","backup-refresh","help"].includes(K[Y]))return"read";if(["restore","restore-capsule"].includes(K[Y]))return"write";return"delete"}if(G==="git"){let Y=sZ(z,Q);if(Y==="clean"||Y==="rm")return"delete";return Y==="clone"||Y==="init"?"write":"read"}if(G==="env"&&FZ(qZ(K)))return"delete";if(["sh","bash","zsh","dash","ksh","ash","eval","source",".","su","runuser","env","xargs","find","busybox","toybox"].includes(G??""))return w0(K.join(" "));if(["mkdir","mkfile","touch","mv","cp","ln","tee","install","dd","rsync","scp","truncate"].includes(G??""))return"write";if(G==="curl"||G==="wget")return l0.test(K.join(" "))?"write":"read";if(G==="sed"&&K.slice(1).some((Y)=>/^-i|^--in-place(?:=|$)/.test(Y)))return"write";if(["python","python3","node","bun"].includes(G??"")&&K.some((Y)=>Y==="-c"||Y==="-e"))return"write";return"read"});return X.includes("delete")?"delete":X.includes("write")?"write":"read"}function w0(Z){let J=Z.trim();if(!J)return"read";if(/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(J))return"delete";if(/\bgit\b/.test(J)){if(/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(J))return"delete";if(/\bgit\b[^;&|]*\b(?:clone|init)\b/.test(J))return"write";return"read"}if(/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(J))return"write";if(/\b(?:curl|wget)\b/.test(J)){if(l0.test(J))return"write";return"read"}if(/\bsed\b/.test(J)){if(/(?:^|\s)-i\S*(?:\s|$)|--in-place(?:\s|$)/.test(J))return"write"}else if(/\b(?:rsync|scp|truncate)\b/.test(J))return"write";else if(/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(J))return"write";if(/(?:^|[;&|])\s*echo\b/.test(J)||/>/.test(m0(J)))return"write";return"read"}function TZ(Z,J){let $=Z.trim(),X=$.match(/^(['"])([\s\S]*)\1$/);if(X)$=X[2];if($=$.replace(/^"*\$HOME"*\//,"$HOME/"),$=$.replace(/^"*\$\{HOME\}"*\//,"${HOME}/"),$==="~")return J;if($.startsWith("~/"))return JZ(J,$.slice(2));if($==="$HOME"||$==="${HOME}")return J;if($.startsWith("$HOME/"))return JZ(J,$.slice(6));if($.startsWith("${HOME}/"))return JZ(J,$.slice(8));let z=$.match(new RegExp(`^"*${tZ(J)}"*/`));if(z)return J+"/"+$.slice(z[0].length);return Z}function I2(Z){let J=Z.trim();while(J.startsWith("(")||J.startsWith("{"))J=J.slice(1).trim();while(J.endsWith(")")||J.endsWith("}"))J=J.slice(0,-1).trim();return J}function tZ(Z){return Z.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function x0(Z,J,$){if(Z===void 0)return[$];let X=TZ(Z,$),z=X.match(/^(['"])(.*)\1$/);if(z)X=z[2];if(!X||X==="-"||/[$\x60*?[\]{}~\\'"]/.test(X))return null;return[...new Set(J.map((Q)=>CZ(Q,X)))]}var D2=/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/;function A2(Z,J,$){if(!Z)return[];let X=u0(J),z=(U)=>X.some((V)=>U===V||U.startsWith(`${V}${oZ}`)),Q=Z.split(/(\s*&&\s*|\s*\|\|\s*|;\s*|\n+)/),K=[],G=[$],Y=new Set([$]),H=!0,B=[];for(let U=0;U<Q.length;U+=2){let V=U===0?"":Q[U-1].trim();if(V==="||")H=!1;else if(V!=="&&")H=!0;if(V!=="&&"||!H)G=[...Y];let I=Q[U],j=(I.match(/^[\s({]*/)?.[0].match(/\(/g)??[]).length,P=(I.match(/[\s)}]*$/)?.[0].match(/\)/g)??[]).length;for(let q=0;q<j;q++)B.push({current:[...G],reachable:new Set(Y),certain:H});let M=I2(I),_=M.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/),g=_?null:M.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);if(g){for(let q of x0(g[1],G,J)??[])Y.add(q);H=!1,G=[...Y]}let h=tZ(J),d=X.map((q)=>tZ(q.slice(J.length+1))).join("|"),D=new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${h}"*)/(?:${d})`),O=new RegExp(`(${D.source})([^\\s"';&|<>()\`]*|$)`,"g"),v=(q)=>{let w=[],R;O.lastIndex=0;while((R=O.exec(q))!==null)w.push(XZ(TZ(R[0],J)).replace(/\/+$/,""));return w},S=W2(M).map((q)=>{let w=[],R=!1,r=m0(q).replace(j2,(KZ,i)=>{if(!i||/[$\x60]/.test(i))R=!0;if(i)w.push(i);return" "}),QZ=C2(r);return{commandPart:r,operands:w,op:R&&QZ==="read"?"write":QZ}}),U1=S.some((q)=>q.op==="delete")?"delete":S.some((q)=>q.op==="write")?"write":"read",I0=G.filter(z);for(let q of S){let w=!1;for(let L of v(q.commandPart))w=!0,K.push({path:L,op:U1});for(let L of q.operands){let f=v(L);for(let y of f)K.push({path:y,op:"write"});if(f.length>0)continue;for(let y of I0)K.push({path:XZ(CZ(y,TZ(L,J))),op:"write"})}if(w||q.op==="read")continue;let R=T2(q.commandPart),r=1,QZ=(R[0]?.text??"").split("/").pop();if(QZ==="trash"&&["put","rm","delete","remove"].includes(R[1]?.text??""))r=2;if(QZ==="git"){let L=R.findIndex((f,y)=>y>0&&(f.text==="rm"||f.text==="clean"));if(L>0)r=L+1}let KZ=!1,i=R.slice(r).flatMap((L)=>{if(!KZ&&L.text==="--")return KZ=!0,[];if(!KZ&&L.text.startsWith("-"))return[];return KZ=!0,[L.opaque?".":L.text]}),V1=q.op==="delete"||/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(q.commandPart)||/(?:^|\s)sed(?:\s|$)/.test(q.commandPart)&&/(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(q.commandPart),GZ=[];if(V1)for(let L of i.length>0?i:["."])GZ.push({operand:L,op:q.op});else{let L=q.commandPart.match(D2),f=R.at(-1);if(GZ.push({operand:L?L[1]:!f||f.opaque?".":f.text,op:q.op}),/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(q.commandPart))R.forEach((y,D0)=>{let o,uZ=y.text.match(/^-[A-Za-z]*?t(.*)$/),DZ=y.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);if(uZ&&!y.text.startsWith("--"))o=uZ[1]?{text:uZ[1],opaque:y.opaque}:R[D0+1];else if(DZ&&"--target-directory".startsWith(DZ[1]))o=DZ[2]!==void 0?{text:DZ[2],opaque:y.opaque}:R[D0+1];if(o)GZ.push({operand:o.opaque||!o.text?".":o.text,op:q.op})});if(/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(q.commandPart))GZ.push({operand:".",op:q.op})}for(let L of I0)for(let{operand:f,op:y}of GZ)K.push({path:XZ(CZ(L,TZ(f,J))),op:y})}if(_){let q=x0(_[1],G,J);if(q){for(let w of q)Y.add(w);if(H)G=q}else H=!1}for(let q=0;q<P&&B.length>0;q++)({current:G,reachable:Y,certain:H}=B.pop())}return K}var L2=/^\s*\*\*\*\s+(Add File|Update File|Delete File):\s+(\S+)\s*$/gm;function P2(Z,J){let $=[],X;while((X=L2.exec(Z))!==null){let z=X[1]==="Delete File"?"delete":"write";$.push({path:XZ(CZ(J,X[2])),op:z})}return $}function c0(Z,J={}){let $=[];if(Z.hook_event_name!=="PreToolUse")return{output:{continue:!0},warnings:$};let X=typeof Z.tool_name==="string"?Z.tool_name:"",z=J.home??g0(),Q=u0(z),K=q2(process.env,z);if(X==="Bash"){let V=e(Z);if(!V)return{output:{continue:!0},warnings:$};let I=typeof Z.cwd==="string"&&Z.cwd?Z.cwd:process.cwd(),j=A2(V,z,I);for(let P of j)for(let M of Q){let _=rZ(P.path,M,K,P.op);if(_.blocked)return{output:{decision:"block",reason:_.reason},warnings:$}}return{output:{continue:!0},warnings:$}}let G=Z.tool_input??{},Y=typeof Z.cwd==="string"&&Z.cwd?Z.cwd:process.cwd();if(H2.has(X)){let V=typeof G.patch==="string"?G.patch:"";if(!V)return{output:{continue:!0},warnings:$};let I=P2(V,Y);for(let j of I)for(let P of Q){let M=rZ(j.path,P,K,j.op);if(M.blocked)return{output:{decision:"block",reason:M.reason},warnings:$}}return{output:{continue:!0},warnings:$}}if(!G2.has(X))return{output:{continue:!0},warnings:$};let H=typeof G.file_path==="string"?G.file_path:typeof G.path==="string"?G.path:typeof G.notebook_path==="string"?G.notebook_path:null;if(!H)return{output:{continue:!0},warnings:$};let B=TZ(H,z),U=h0(B)?XZ(B):CZ(Y,B);for(let V of Q){let I=rZ(U,V,K,"write");if(I.blocked)return{output:{decision:"block",reason:I.reason},warnings:$}}return{output:{continue:!0},warnings:$}}var O2=new Set(["id","node_id","databaseId","fullDatabaseId","number","state","state_reason","stateReason","status","conclusion","bucket","name","login","sha","oid","abbreviatedOid","ref","headRefName","baseRefName","headRefOid","baseRefOid","head_sha","headSha","head_branch","headBranch","merged","mergeable","mergeable_state","mergeStateStatus","draft","isDraft","locked","isLocked","title","displayTitle","display_title","created_at","updated_at","closed_at","merged_at","started_at","completed_at","submitted_at","pushed_at","published_at","createdAt","updatedAt","closedAt","mergedAt","startedAt","completedAt","submittedAt","pushedAt","publishedAt","tag_name","tagName","total_count","totalCount","count","additions","deletions","changes","changed_files","changedFiles","filename","path","event","workflow","workflowName","workflow_id","workflowDatabaseId","run_id","run_number","run_attempt","attempt","check_suite_id","default_branch","defaultBranch","full_name","fullName","nameWithOwner","private","isPrivate","visibility","archived","isArchived","fork","isFork","isRequired","is_required","required","context","type","__typename","role","permission","size","reviewDecision","author_association","authorAssociation","isCrossRepository","maintainerCanModify","maintainer_can_modify","commentsCount","language","digest","size_in_bytes","run_started_at","date","wait_timer","ahead_by","behind_by","total_commits","expired","current_user_can_approve","environment","html_url"]),E2=new Set(["payload","client_payload","inputs","config","metadata","output","properties","custom_properties","variables"]),s0=new Set(["length","utf8bytelength","not","type","any","all","isempty","empty","test","startswith","endswith","contains","inside","has","in","index","rindex","indices","floor","ceil","round","fabs","sqrt","isinfinite","isnan","isnormal","infinite","nan","true","false","null"]),a0=new Set(["tostring","tojson","ascii_downcase","ascii_upcase","ltrimstr","rtrimstr","trim","ltrim","rtrim","sort","unique","reverse","first","last","min","max","add","flatten","join","split","values","nulls","strings","numbers","booleans","arrays","objects","iterables","scalars","sort_by","group_by","unique_by","min_by","max_by","select","limit","to_entries","from_entries"]),R2=new Set(["test","startswith","endswith","contains","inside","has","in","index","rindex","indices","ltrimstr","rtrimstr","join","split","flatten","limit"]),y2=new Set(["@text","@json","@csv","@tsv","@sh","@base64","@uri","@html"]);class $0 extends Error{}var T=()=>{throw new $0};function eZ(Z,J){let $=[],X="",z=J+1;while(z<Z.length){let Q=Z[z];if(Q==='"'){if(X)$.push(X);return{end:z+1,parts:$}}if(Q==="\\"){let K=Z[z+1];if(K==="("){let G=1,Y=z+2;while(Y<Z.length&&G>0){let H=Z[Y];if(H==='"'){Y=eZ(Z,Y).end;continue}if(H==="(")G++;else if(H===")")G--;Y++}if(G!==0)T();if(X)$.push(X),X="";$.push({src:Z.slice(z+2,Y-1)}),z=Y;continue}if(K===void 0)T();X+=K,z+=2;continue}X+=Q,z++}return T()}function n0(Z){let J=[],$=0,X=["?//","|=","+=","-=","*=","/=","%=","//=","==","!=","<=",">=","//","|",",","+","-","*","/","%","<",">","=","(",")","[","]","{","}",":",";","?"];while($<Z.length){let z=Z[$];if(/\s/.test(z)){$++;continue}if(z==="#")T();if(z==='"'){let Y=eZ(Z,$);J.push({t:"str",parts:Y.parts}),$=Y.end;continue}if(z==="."){if(Z[$+1]===".")T();let Y=/^[A-Za-z_][A-Za-z0-9_]*/.exec(Z.slice($+1));if(Y){J.push({t:"field",name:Y[0]}),$+=1+Y[0].length;continue}if(Z[$+1]==='"'){let H=eZ(Z,$+1);if(H.parts.some((B)=>typeof B!=="string"))T();J.push({t:"field",name:H.parts.join("")}),$=H.end;continue}J.push({t:"dot"}),$++;continue}if(z==="$"||z==="@"){let Y=/^[@$][A-Za-z_][A-Za-z0-9_]*/.exec(Z.slice($));if(!Y||z==="$")T();J.push({t:"fmt",name:Y[0]}),$+=Y[0].length;continue}let Q=/^[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(Z.slice($));if(Q){J.push({t:"num"}),$+=Q[0].length;continue}let K=/^[A-Za-z_][A-Za-z0-9_]*(?:::[A-Za-z_][A-Za-z0-9_]*)*/.exec(Z.slice($));if(K){J.push({t:"ident",name:K[0]}),$+=K[0].length;continue}let G=X.find((Y)=>Z.startsWith(Y,$));if(!G)T();J.push({t:"op",v:G}),$+=G.length}return J}var v2=new Set(["if","then","elif","else","end","as","def","reduce","foreach","try","catch","label","import","include","and","or","__loc__","error","input","inputs","debug","stderr","env","halt","halt_error","input_filename","input_line_number","recurse","paths","leaf_paths","getpath","setpath","delpaths","del","path","splits","sub","gsub","capture","match","scan","keys","keys_unsorted","map_values","with_entries","tostream","fromstream","truncate_stream","walk","tonumber","implode","explode","ascii","fromjson"]);class J0{tokens;at=0;constructor(Z){this.tokens=Z}parse(){if(this.tokens.length===0)T();let Z=this.pipe();if(this.at!==this.tokens.length)T();return Z}peek(){return this.tokens[this.at]}isOp(Z){let J=this.peek();return!!J&&J.t==="op"&&J.v===Z}isIdent(Z){let J=this.peek();return!!J&&J.t==="ident"&&J.name===Z}expectOp(Z){if(!this.isOp(Z))T();this.at++}pipe(){let Z=this.comma();if(this.isIdent("as"))T();if(this.isOp("|"))this.at++,Z={k:"pipe",a:Z,b:this.pipe()};return Z}comma(){let Z=this.alt();while(this.isOp(","))this.at++,Z={k:"comma",a:Z,b:this.alt()};return Z}alt(){let Z=this.or();if(this.isOp("//"))return this.at++,{k:"alt",a:Z,b:this.alt()};return Z}or(){let Z=this.and();while(this.isIdent("or"))this.at++,Z={k:"bool",a:Z,b:this.and()};return Z}and(){let Z=this.cmp();while(this.isIdent("and"))this.at++,Z={k:"bool",a:Z,b:this.cmp()};return Z}cmp(){let Z=this.add();for(let J of["==","!=","<=",">=","<",">"])if(this.isOp(J))return this.at++,{k:"bool",a:Z,b:this.add()};for(let J of["=","|=","+=","-=","*=","/=","%=","//=","?//"])if(this.isOp(J))T();return Z}add(){let Z=this.mul();while(this.isOp("+")||this.isOp("-"))this.at++,Z={k:"arith",a:Z,b:this.mul()};return Z}mul(){let Z=this.unary();while(this.isOp("*")||this.isOp("/")||this.isOp("%"))this.at++,Z={k:"arith",a:Z,b:this.unary()};return Z}unary(){if(this.isOp("-"))return this.at++,{k:"neg",of:this.postfix()};return this.postfix()}objectValue(){let Z=this.unary();if(this.isOp("|"))this.at++,Z={k:"pipe",a:Z,b:this.objectValue()};return Z}postfix(){let Z=this.primary();for(;;){let J=this.peek();if(!J)return Z;if(J.t==="field"){this.at++,Z={k:"field",name:J.name,of:Z};continue}if(J.t==="dot"&&this.tokens[this.at+1]?.t==="op"&&this.tokens[this.at+1].v==="["){this.at++;continue}if(J.t==="op"&&J.v==="?"){this.at++,Z={k:"opt",of:Z};continue}if(J.t==="op"&&J.v==="["){Z=this.bracket(Z);continue}return Z}}bracket(Z){if(this.expectOp("["),this.isOp("]"))return this.at++,{k:"iter",of:Z};if(this.isOp(":")){if(this.at++,!this.isOp("]"))this.pipe();return this.expectOp("]"),{k:"slice",of:Z}}let J=this.pipe();if(this.isOp(":")){if(this.at++,!this.isOp("]"))this.pipe();return this.expectOp("]"),{k:"slice",of:Z}}return this.expectOp("]"),{k:"index",of:Z,key:J}}primary(){let Z=this.peek();if(!Z)return T();switch(this.at++,Z.t){case"dot":return{k:"dot"};case"field":return{k:"field",name:Z.name};case"num":return{k:"lit"};case"str":return this.stringNode(Z.parts);case"fmt":{if(!y2.has(Z.name))T();let J=this.peek();if(J?.t==="str")return this.at++,{k:"fmt",name:Z.name,str:this.stringNode(J.parts)};return{k:"fmt",name:Z.name}}case"ident":{if(v2.has(Z.name))T();if(Z.name==="map"||s0.has(Z.name)||a0.has(Z.name)){let J=[];if(this.isOp("(")){this.at++,J.push(this.pipe());while(this.isOp(";"))this.at++,J.push(this.pipe());this.expectOp(")")}return{k:"call",name:Z.name,args:J}}return T()}case"op":{if(Z.v==="("){let J=this.pipe();return this.expectOp(")"),J}if(Z.v==="["){if(this.isOp("]"))return this.at++,{k:"array"};let J=this.pipe();return this.expectOp("]"),{k:"array",of:J}}if(Z.v==="{")return this.object();return T()}}return T()}stringNode(Z){let J=[];for(let $ of Z){if(typeof $==="string")continue;J.push(new J0(n0($.src)).parse())}return J.length===0?{k:"str",parts:J,text:Z.join("")}:{k:"str",parts:J}}object(){let Z=[];if(this.isOp("}"))return this.at++,{k:"object",entries:Z};for(;;){let J=this.peek();if(!J)T();this.at++;let $;if(J.t==="ident")$=J.name;else if(J.t==="str"){if(J.parts.some((X)=>typeof X!=="string"))T();$=J.parts.join("")}else T();if(this.isOp(":"))this.at++,Z.push({key:"static",value:this.objectValue()});else Z.push({key:"static",value:{k:"field",name:$}});if(this.isOp(",")){this.at++;continue}return this.expectOp("}"),{k:"object",entries:Z}}}}function X0(Z){if(typeof Z==="object"&&"union"in Z)return Z.union.every(X0);return Z==="safe"||typeof Z==="object"&&O2.has(Z.leaf)}var IZ=(...Z)=>Z.every(X0)?"safe":"tainted";function Z0(...Z){let J=[];for(let $ of Z)if(typeof $==="object"&&"union"in $)J.push(...$.union);else J.push($);return J.length===1?J[0]:{union:J}}function yZ(Z,J){return typeof Z==="object"&&"union"in Z?Z0(...Z.union.map(J)):J(Z)}var vZ=(Z)=>typeof Z==="object"&&("leaf"in Z)&&E2.has(Z.leaf),l=(Z)=>yZ(Z,(J)=>J==="safe"?"safe":J==="tainted"||vZ(J)?"tainted":"unknown");function p0(Z){return Z.k==="lit"||Z.k==="str"&&Z.parts.length===0||Z.k==="call"&&["true","false","null"].includes(Z.name)&&Z.args.length===0}function d0(Z,J,$){return yZ(Z,(X)=>{if(X==="safe"||X==="tainted")return X;if(vZ(X))return"tainted";if(X==="root"&&$.rootScalars.has(J))return"safe";return{leaf:J}})}function C(Z,J,$){switch(Z.k){case"dot":return J;case"field":return d0(Z.of?C(Z.of,J,$):J,Z.name,$);case"iter":return l(C(Z.of,J,$));case"index":{let X=C(Z.of,J,$);if(Z.key.k==="str"&&Z.key.text!==void 0)return d0(X,Z.key.text,$);if(Z.key.k==="lit")return l(X);return C(Z.key,J,$),"tainted"}case"slice":return yZ(C(Z.of,J,$),(X)=>X==="root"?"unknown":vZ(X)?"tainted":X);case"opt":return C(Z.of,J,$);case"lit":return"safe";case"str":return IZ(...Z.parts.map((X)=>C(X,J,$)));case"fmt":return Z.str?C(Z.str,J,$):J;case"array":return Z.of?IZ(C(Z.of,J,$)):"safe";case"object":return IZ(...Z.entries.map((X)=>C(X.value,J,$)));case"pipe":return C(Z.b,C(Z.a,J,$),$);case"comma":return Z0(C(Z.a,J,$),C(Z.b,J,$));case"alt":return Z0(C(Z.a,J,$),C(Z.b,J,$));case"bool":return C(Z.a,J,$),C(Z.b,J,$),"safe";case"arith":return IZ(C(Z.a,J,$),C(Z.b,J,$));case"neg":return C(Z.of,J,$);case"call":return S2(Z,J,$)}}var i0=(Z)=>yZ(Z,(J)=>J==="root"?"unknown":vZ(J)?"tainted":J);function S2(Z,J,$){let{name:X,args:z}=Z;if(R2.has(X)&&X!=="limit"&&!z.every(p0))T();switch(X){case"map":if(z.length!==1)T();return IZ(C(z[0],l(J),$));case"select":if(z.length!==1)T();return C(z[0],J,$),J;case"limit":if(z.length!==2||!p0(z[0]))T();return C(z[1],J,$);case"first":case"last":if(z.length>1)T();return z.length===1?C(z[0],J,$):l(J);case"min":case"max":return l(J);case"sort_by":case"group_by":case"unique_by":if(z.length!==1)T();return C(z[0],l(J),$),i0(J);case"min_by":case"max_by":if(z.length!==1)T();return C(z[0],l(J),$),l(J);case"any":case"all":case"isempty":for(let Q of z)C(Q,"unknown",$);return"safe"}if(s0.has(X))return"safe";if(a0.has(X))return i0(J);return T()}function r0(Z,J={}){if(typeof Z!=="string"||!Z.trim()||Z.length>4096)return!1;try{let $=new J0(n0(Z)).parse();return X0(C($,"root",{rootScalars:J.rootScalars??new Set}))}catch($){if($ instanceof $0)return!1;return!1}}var V0="composite output withheld: signed-link shape; use bounded scalar projections per class disposition 799310",N={refused:!1},F=(Z)=>({refused:!0,rule:Z}),z0=new Set(["additions","assignees","author","baseRefName","baseRefOid","changedFiles","closed","closedAt","createdAt","deletions","files","fullDatabaseId","headRefName","headRefOid","headRepository","headRepositoryOwner","id","isCrossRepository","isDraft","labels","maintainerCanModify","mergeCommit","mergeStateStatus","mergeable","mergedAt","mergedBy","number","potentialMergeCommit","reactionGroups","reviewDecision","reviewRequests","state","title","updatedAt","url"]),Y0=new Set(["assignees","author","closed","closedAt","createdAt","id","isPinned","labels","number","reactionGroups","state","stateReason","subIssuesSummary","title","updatedAt","url"]),o0=new Set(["apiUrl","author","createdAt","databaseId","id","isDraft","isImmutable","isLatest","isPrerelease","name","publishedAt","tagName","tarballUrl","targetCommitish","uploadUrl","url","zipballUrl"]),t0=new Set(["answerChosenAt","answerChosenBy","answered","author","closed","closedAt","createdAt","id","labels","locked","number","reactionGroups","state","stateReason","title","updatedAt","url"]),b2=new Set(["assignees","author","authorAssociation","closedAt","commentsCount","createdAt","id","isDraft","isLocked","isPullRequest","labels","number","repository","state","title","updatedAt","url"]),f2=new Set(["author","committer","id","parents","repository","sha","url"]),k2=new Set(["bucket","completedAt","event","name","startedAt","state","workflow"]);function $1(Z){let J=[];for(let $=0;$<Z.length;$++){let X=Z[$];if(X==="\\"){$++;continue}if(X==="'"){let z=Z.indexOf("'",$+1);if(z<0)return!1;$=z;continue}if(X==='"'){$++;while($<Z.length&&Z[$]!=='"')$+=Z[$]==="\\"?2:1;continue}if(X==="{"){J.push({list:!1});continue}if(J.length===0)continue;if(X===","||X==="."&&Z[$+1]===".")J[J.length-1].list=!0;else if(X==="}"&&J.pop().list)return!0}return!1}function zZ(Z){let J="",$=!1,X=0,z=(Q)=>Z[Q]==="`"||Z[Q]==="$"&&/[A-Za-z_{(@*#?$!0-9-]/.test(Z[Q+1]??"");while(X<Z.length){let Q=Z[X];if(Q==="\\"){J+=Z[X+1]??"",X+=2;continue}if(Q==="$"&&Z[X+1]==="'"){$=!0,J+=Q,X++;continue}if(Q==="'"){let K=Z.indexOf("'",X+1);if(K<0){$=!0,J+=Z.slice(X+1);break}J+=Z.slice(X+1,K),X=K+1;continue}if(Q==='"'){X++;while(X<Z.length&&Z[X]!=='"'){if(Z[X]==="\\"&&/[$`"\\\n]/.test(Z[X+1]??"")){J+=Z[X+1],X+=2;continue}if(z(X))$=!0;J+=Z[X],X++}if(X>=Z.length)$=!0;X++;continue}if(z(X)||Q==="*"||Q==="?"||Q==="[")$=!0;J+=Q,X++}if(!$&&Z.includes("{")&&$1(Z))$=!0;return{value:J,opaque:$,raw:Z}}var a=(Z)=>Z.slice(Z.lastIndexOf("/")+1);function G0(Z,J="word"){let $=[],X=!1;for(let z=0;z<Z.length;z++){let Q=Z[z];if(Q==="\\"){z++;continue}if(J==="word"&&Q==="'"&&!X){let K=Z.indexOf("'",z+1);if(K<0)return{bodies:$,complete:!1};z=K;continue}if(J==="word"&&Q==='"'){X=!X;continue}if(Q==="`"){let K=z+1;while(K<Z.length&&Z[K]!=="`")K+=Z[K]==="\\"?2:1;if(K>=Z.length)return{bodies:$,complete:!1};$.push(Z.slice(z+1,K)),z=K;continue}if(Q==="$"&&Z[z+1]==="("){let K=_Z(Z,z+1);if(K<0)return{bodies:$,complete:!1};$.push(Z.slice(z+2,K-1)),z=K-1}}return{bodies:$,complete:!0}}function YZ(Z,J){let $=new Set(J.values),X={flags:[],positionals:[]},z=(Q,K)=>({value:Q,opaque:K.opaque,raw:K.raw});for(let Q=0;Q<Z.length;Q++){let K=Z[Q],G=K.value;if(G==="--"){X.positionals.push(...Z.slice(Q+1));break}if(G.startsWith("--")&&G.length>2){let Y=G.indexOf("="),H=Y>=0?G.slice(0,Y):G;if(Y>=0)X.flags.push({name:H,value:z(G.slice(Y+1),K),inline:!0});else if($.has(H)){let B=Z[Q+1];X.flags.push(B?{name:H,value:B}:{name:H,missing:!0}),Q++}else X.flags.push({name:H});continue}if(G.startsWith("-")&&G.length>1){for(let Y=1;Y<G.length;Y++){let H="-"+G[Y],B=G.slice(Y+1);if(B.startsWith("=")){X.flags.push({name:H,value:z(B.slice(1),K),inline:!0});break}if(!$.has(H)){X.flags.push({name:H});continue}if(B)X.flags.push({name:H,value:z(B,K),inline:!0});else{let U=Z[Q+1];X.flags.push(U?{name:H,value:U}:{name:H,missing:!0}),Q++}break}continue}X.positionals.push(K)}return X}function E(Z,...J){let $=!1;for(let X of Z.flags){if(!J.includes(X.name))continue;if(!X.inline){$=!0;continue}let z=X.value;$=!z.opaque&&["1","t","T","TRUE","true","True"].includes(z.value)}return $}var c=(Z,...J)=>Z.flags.filter(($)=>J.includes($.name)),b=["-R","--repo","-q","--jq","-t","--template","--json"],n={"pr view":{values:b},"issue view":{values:b},"release view":{values:b},"discussion view":{values:[...b,"--after","-L","--limit","--order"]},"pr list":{values:[...b,"--app","-a","--assignee","-A","--author","-B","--base","-H","--head","-l","--label","-L","--limit","-S","--search","-s","--state"]},"issue list":{values:[...b,"--app","-a","--assignee","-A","--author","-l","--label","-L","--limit","--mention","-m","--milestone","-S","--search","-s","--state"]},"discussion list":{values:[...b,"--after","-A","--author","-c","--category","-l","--label","-L","--limit","--order","-S","--search","--sort","-s","--state"]},"release list":{values:[...b,"-L","--limit","-O","--order"]},"pr status":{values:b},"issue status":{values:b},"pr checks":{values:[...b,"-i","--interval"]},"pr diff":{values:["-R","--repo"]},search:{values:[...b,"--app","--assignee","--author","--author-date","--author-email","--author-name","--base","--checks","--closed","--commenter","--committer","--committer-date","--committer-email","--committer-name","--created","--hash","--head","--interactions","--involves","--label","--language","--limit","-L","--match","--mentions","--merged-at","--milestone","--no-assignee","--no-label","--no-milestone","--no-project","--order","--owner","--parent","--project","--reactions","--review","--review-requested","--reviewed-by","--sort","--state","--team-mentions","--tree","--updated","--visibility","--extension","--filename","--size","--forks","--good-first-issue","--help-wanted-issues","--number-topics","--stars","--topic","--followers","--include-forks","--license"]},"project item-list":{values:["--format","-L","--limit","--owner","-q","--jq","-t","--template","--query","--field","--field-id"]},api:{values:["-X","--method","-H","--header","-f","--raw-field","-F","--field","-q","--jq","-t","--template","-p","--preview","--input","--hostname","--cache"]},group:{values:["-R","--repo"]}},w2=new Set(["auth","browse","codespace","cs","gist","org","repo","skill","cache","run","workflow","co","agent-task","alias","attestation","completion","config","copilot","extension","ext","extensions","gpg-key","label","licenses","preview","ruleset","secret","ssh-key","variable","help","version","accessibility","actions","environment","exit-codes","formatting","mintty","reference","telemetry"]),x2=new Set(["pr","issue","release","discussion","search","project","api","status"]),g2=new Set(["create","new","checkout","co","close","comment","edit","lock","merge","ready","reopen","revert","review","unlock","update-branch"]),h2=new Set(["create","new","close","comment","delete","develop","edit","lock","pin","reopen","transfer","unlock","unpin"]),u2=new Set(["create","new","delete","delete-asset","download","edit","upload","verify","verify-asset"]),l2=new Set(["create","new","close","comment","delete","edit","lock","reopen","unlock","answer","unanswer"]);function kZ(Z,J){let $=c(Z,"--json"),X=[],z=!1;for(let Q of $){if(Q.missing){if(J.appendsArgs)z=!0;continue}if(!Q.value)continue;if(Q.value.opaque)z=!0;X.push(...Q.value.value.split(",").map((K)=>K.trim()).filter(Boolean))}return{present:$.length>0,opaque:z,fields:X}}function M0(Z,J){if(E(Z,"--verbose")||c(Z,"-t","--template").length>0)return!1;let $=c(Z,"-q","--jq");return $.length>0&&$.every((X)=>X.value!==void 0&&!X.value.opaque&&r0(X.value.value,{rootScalars:J}))}function F0(Z,J,$,X){let z=kZ(Z,$);if(z.opaque)return F("unclassifiable");if(z.fields.every((Q)=>J.has(Q)))return N;if($.debug)return F("debug-traffic");return M0(Z)?N:F(X)}function SZ(Z,J,$,X,z){let Q=YZ(Z,n[J]);if(E(Q,"-h","--help"))return N;if(E(Q,"-w","--web"))return X.debug?F("debug-traffic"):N;if(z&&E(Q,"-c","--comments"))return F("view-comments");if(!kZ(Q,X).present)return F(X.debug?"debug-traffic":"view-human");return F0(Q,$,X,"json-composite")}function m(Z,J,$,X){let z=YZ(Z,n[J]);if(E(z,"-h","--help"))return N;if(X.debug&&(E(z,"-w","--web")||!kZ(z,X).present))return F("debug-traffic");if(E(z,"-w","--web"))return N;return F0(z,$,X,"json-composite")}function m2(Z,J){let $=YZ(Z,n["pr checks"]);if(E($,"-h","--help"))return N;if(J.debug)return F("debug-traffic");if(E($,"-w","--web"))return N;if(!kZ($,J).present)return F("checks-human");return F0($,k2,J,"checks-json")}function c2(Z){let J=new Set(n.group.values);for(let $=0;$<Z.length;$++){let X=Z[$].value;if(X==="--")return{sub:Z[$+1],rest:Z.slice($+2)};if(!X.startsWith("-")||X==="-")return{sub:Z[$],rest:[...Z.slice(0,$),...Z.slice($+1)]};if(J.has(X))$++}return{rest:Z}}function p2(Z,J,$){let{sub:X,rest:z}=c2(J);if(!X)return $.appendsArgs?F("unclassifiable"):N;if(X.opaque)return F("unclassifiable");let Q=X.value;if((Z==="pr"?g2:Z==="issue"?h2:Z==="release"?u2:Z==="discussion"?l2:new Set).has(Q))return $.debug?F("debug-traffic"):N;if($.appendsArgs&&!(Z==="project"&&Q!=="item-list"))return F("unclassifiable");switch(Z){case"pr":if(Q==="view")return SZ(z,"pr view",z0,$,!0);if(Q==="list"||Q==="ls")return m(z,"pr list",z0,$);if(Q==="status")return m(z,"pr status",z0,$);if(Q==="checks")return m2(z,$);if(Q==="diff"){let G=YZ(z,n["pr diff"]);if(E(G,"-h","--help"))return N;if($.debug)return F("debug-traffic");return E(G,"--patch")?F("composite-other"):N}return F("unclassifiable");case"issue":if(Q==="view")return SZ(z,"issue view",Y0,$,!0);if(Q==="list"||Q==="ls")return m(z,"issue list",Y0,$);if(Q==="status")return m(z,"issue status",Y0,$);return F("unclassifiable");case"release":if(Q==="view")return SZ(z,"release view",o0,$,!1);if(Q==="list"||Q==="ls")return m(z,"release list",o0,$);return F("unclassifiable");case"discussion":if(Q==="view")return SZ(z,"discussion view",t0,$,!0);if(Q==="list"||Q==="ls")return m(z,"discussion list",t0,$);return F("unclassifiable");case"search":if(Q==="prs"||Q==="issues")return m(z,"search",b2,$);if(Q==="commits")return m(z,"search",f2,$);if(Q==="code"||Q==="repos")return $.debug?F("debug-traffic"):N;return F("unclassifiable");case"project":{if($.debug)return F("debug-traffic");if(Q!=="item-list")return N;let G=YZ(z,n["project item-list"]);if(E(G,"-h","--help"))return N;let Y=c(G,"--format");if(Y.some((H)=>!H.value||H.value.opaque))return F("unclassifiable");if(Y.every((H)=>H.value.value!=="json"))return N;return M0(G)?N:F("composite-other")}}return F("unclassifiable")}var J1=new Set(["pulls","issues","commits","check-runs","check-suites","statuses","comments","releases","compare","events","discussions","deployments","milestones"]);function d2(Z){let J=Z.value.trim(),$=/^https?:\/\/([^/]+)(\/.*)?$/i.exec(J);if($){let Q=$[1].toLowerCase(),K=$[2]??"/";if(Q==="api.github.com"||/^api\./.test(Q))J=K;else if(/^\/api\/v3(?:\/|$)/i.test(K))J=K.replace(/^\/api\/v3/i,"");else if(/^\/api\/graphql(?:[/?#]|$)/i.test(K))J="graphql";else return null}J=J.replace(/[?#].*$/,"");let X=[],z=[];for(let Q of J.split("/")){let K;try{K=decodeURIComponent(Q)}catch{return null}for(let G of K.split("/")){if(G===""||G===".")continue;if(G===".."){X.pop(),z.pop();continue}X.push(G.toLowerCase()),z.push(Z.opaque&&/[$`]/.test(G)||/[*?[]/.test(G)||$1(G))}}return{segments:X,opaque:z}}function i2(Z){let J=d2(Z);if(!J)return{kind:"unclassifiable",segments:[]};let{segments:$,opaque:X}=J,z=(Y)=>({kind:Y,segments:$});if($.length===1&&$[0]==="graphql")return z("graphql");if($.length===0)return z(Z.opaque?"unclassifiable":"other");if(X[0])return z("unclassifiable");let Q,K=[];if($[0]==="repos")Q=$.slice(3),K=X.slice(3);else if($[0]==="repositories")Q=$.slice(2),K=X.slice(2);if(Q){if(($[0]==="repos"?X.slice(1,3):X.slice(1,2)).some(Boolean)){let H=X.findIndex(Boolean),B=$.findIndex((U,V)=>V>H&&!X[V]&&s2.has(U));return z(B<0?"unclassifiable":e0($.slice(B),X.slice(B)))}return z(e0(Q,K))}let G=$[0];if(G==="issues")return z("sensitive");if(G==="user"&&$[1]==="issues")return z("sensitive");if(G==="orgs"&&$[2]==="issues")return z("sensitive");if(G==="search")return z($[1]==="issues"||$[1]==="commits"?"sensitive":$[1]!==void 0&&X[1]?"unclassifiable":"other");if(G==="events"||G==="networks")return z("sensitive");if((G==="users"||G==="orgs")&&$.slice(2).some((Y)=>Y==="events"||Y==="received_events"||Y==="discussions"))return z("sensitive");if((G==="users"||G==="orgs")&&$[2]==="projectsv2"&&$[4]==="items")return z("sensitive");if(G==="orgs"&&$[2]==="hooks"&&$[4]==="deliveries"&&$[5]!==void 0||G==="app"&&$[1]==="hook"&&$[2]==="deliveries"&&$[3]!==void 0)return z("sensitive");if(G==="teams"&&$.includes("discussions"))return z("sensitive");if(G==="projects"&&$.includes("cards"))return z("sensitive");if(X.some(Boolean))return z($.some((Y)=>Y==="events"||Y==="discussions"||Y==="issues")?"sensitive":"unclassifiable");return z("other")}var s2=new Set([...J1,"branches","git","actions","hooks","zipball","tarball"]);function e0(Z,J){let[$,X]=Z;if($===void 0)return"other";if(J[0])return"unclassifiable";if($==="issues"&&/^\d+$/.test(X??"")&&Z[2]==="labels")return"other";if(J1.has($))return"sensitive";if($==="branches"){if(Z.length===1||Z.slice(1).some((z)=>z==="protection")||Z[Z.length-1]==="rename")return"other";return J.slice(1).some(Boolean)?"unclassifiable":"sensitive"}if($==="git")return X===void 0||X==="commits"||X==="tags"?"sensitive":J[1]?"unclassifiable":"other";if($==="actions"){if(X===void 0)return"sensitive";if(J[1])return"unclassifiable";if(X==="runs"||X==="jobs"){if(Z[Z.length-1]==="logs"&&Z.length>=4&&!J.some(Boolean))return"download";return"sensitive"}if(X==="workflows"&&Z[3]==="runs")return"sensitive";if(X==="artifacts"&&Z.length===4)return"download";return"other"}if($==="hooks"&&Z[2]==="deliveries"&&Z[3]!==void 0)return"sensitive";if($==="zipball"||$==="tarball")return"download";return"other"}function a2(Z,J){if(J[0]!=="repos"||J.length<5)return!1;let $=J.slice(3),X=(Q)=>/^\d+$/.test($[Q]??""),z=(...Q)=>$.length===Q.length&&Q.every((K,G)=>typeof K==="number"?X(G):$[G]===K);if(Z==="DELETE")return z("issues","comments",0)||z("pulls","comments",0)||z("comments",0)||z("issues","comments",0,"reactions",0)||z("pulls","comments",0,"reactions",0)||z("issues",0,"reactions",0)||z("issues",0,"labels")||$.length===4&&$[0]==="issues"&&X(1)&&$[2]==="labels"||z("releases",0)||z("releases","assets",0)||z("actions","runs",0)||z("actions","runs",0,"logs")||z("deployments",0)||z("milestones",0)||z("issues",0,"lock");if(Z==="POST")return $.length===4&&$[0]==="actions"&&$[1]==="runs"&&X(2)&&["rerun","rerun-failed-jobs","cancel","force-cancel","approve"].includes($[3])||z("actions","jobs",0,"rerun")||z("issues",0,"labels");if(Z==="PUT")return z("pulls",0,"merge")||z("pulls",0,"update-branch")||z("issues",0,"labels")||z("issues",0,"lock");if(Z==="GET")return z("pulls",0,"merge");return!1}function n2(Z){if(Z[0]!=="repos"||Z.length!==5||!/^\d+$/.test(Z[4]))return;if(Z[3]==="pulls")return new Set(["commits","comments","review_comments"]);if(Z[3]==="issues")return new Set(["comments"]);return}var r2=new Set(["body","bodyText","bodyHTML","bodyUrl","bodyResourcePath","comments","reviews","latestReviews","latestOpinionatedReviews","reviewThreads","url","permalink","summary","text","description","message","messageBody","messageHeadline","commitBody","commitHeadline","annotations","rawDetails","note","diff","readme","payload"]),o2=new Set(["checkRuns","checkRun","checkSuites","checkSuite","contexts","statusCheckRollup","annotations","CheckRun","CheckSuite","StatusContext","CheckAnnotation","latestStatus","status","statuses"]);function t2(Z){let J=[],$=0;while($<Z.length){let X=Z[$];if(/[\s,\uFEFF]/.test(X)){$++;continue}if(X==="#"){let K=Z.indexOf(`
+`,$);$=K<0?Z.length:K+1;continue}if(Z.startsWith('"""',$)){let K=$+3;for(;;){let G=Z.indexOf('"""',K);if(G<0)return null;if(Z[G-1]==="\\"){K=G+3;continue}$=G+3;break}continue}if(X==='"'){let K=$+1;while(K<Z.length&&Z[K]!=='"'&&Z[K]!==`
+`)K+=Z[K]==="\\"?2:1;if(Z[K]!=='"')return null;$=K+1;continue}let z=/^[_A-Za-z][_0-9A-Za-z]*/.exec(Z.slice($,$+256));if(z){J.push({kind:"name",text:z[0]}),$+=z[0].length;continue}let Q=/^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(Z.slice($,$+64));if(Q){$+=Q[0].length;continue}if(Z.startsWith("...",$)){J.push({kind:"punct",text:"..."}),$+=3;continue}if("{}()[]:!$@=|&".includes(X)){J.push({kind:"punct",text:X}),$++;continue}return null}return J}function e2(Z){let J=t2(Z);if(!J)return!0;let $=[],X="",z=0;for(let Q=0;Q<J.length;Q++){let K=J[Q];if(K.kind==="punct"){if(K.text==="(")z++;else if(K.text===")"){if(z--,z<0)return!0}else if(z===0&&K.text==="{")$.push(X),X="";else if(z===0&&K.text==="}"){if($.pop()===void 0)return!0;X=""}continue}if(z>0)continue;let G=J[Q-1];if(G?.kind==="punct"&&(G.text==="@"||G.text==="$"))continue;if(J[Q+1]?.kind==="punct"&&J[Q+1].text===":")continue;if(K.text==="on"&&G?.kind==="punct"&&G.text==="...")continue;if(G?.kind==="name"&&G.text==="on"){X=K.text;continue}if($.length===0){X=K.text;continue}if(r2.has(K.text)||/(?:Url|URL|HTML|Html)$/.test(K.text))return!0;if(K.text==="title"&&$.some((Y)=>o2.has(Y)))return!0;X=K.text}return z!==0||$.length!==0}function Z3(Z,J){let $=YZ(Z,n.api);if(E($,"-h","--help"))return N;let X=$.positionals[0];if(!X)return J.appendsArgs?F("unclassifiable"):N;let z=i2(X),Q=c($,"-X","--method"),K=Q[Q.length-1],G=c($,"-f","--raw-field","-F","--field","--input"),Y=K?K.value&&!K.value.opaque?K.value.value.toUpperCase():"?":G.length>0?"POST":"GET",H=a2(Y,z.segments),B=N;if(z.kind==="unclassifiable")B=F("unclassifiable");else if(z.kind==="sensitive"&&!H)B=F("api-rest");else if(z.kind==="graphql")B=$3($);if(J.debug||E($,"--verbose")){if(z.kind==="download"&&!B.refused)B=F("api-rest");if(B.refused)return J.debug?F("debug-traffic"):B;return N}if(J.appendsArgs&&z.kind!=="other"&&z.kind!=="download")return F("unclassifiable");if(!B.refused||E($,"--silent"))return N;if(M0($,n2(z.segments)))return N;return B}function $3(Z){if(c(Z,"--input").length>0)return F("unclassifiable");let J=c(Z,"-f","--raw-field","-F","--field"),$=J.filter((X)=>X.value&&/^query=/.test(X.value.value));if($.length===0||J.some((X)=>!X.value))return F("unclassifiable");for(let X of $){let z=X.value.value.slice(6);if((X.name==="-F"||X.name==="--field")&&z.startsWith("@")||X.value.opaque)return F("unclassifiable");if(e2(z))return F("api-graphql")}return N}function fZ(Z,J){let $=0;while($<Z.length&&Z[$].value.startsWith("-")&&!Z[$].opaque){if(["--help","-h","--version"].includes(Z[$].value))return N;$++}if($>=Z.length)return J.appendsArgs?F("unclassifiable"):N;let X=Z[$],z=Z.slice($+1);if(X.opaque)return F("unclassifiable");switch(X.value){case"pr":case"issue":case"release":case"discussion":case"search":case"project":return p2(X.value,z,J);case"api":return Z3(z,J);case"status":return z.length>0&&z.every((Q)=>Q.value==="-h"||Q.value==="--help")?N:F("composite-other");case"help":case"version":return N;case"cs":case"codespace":{let Q=z.findIndex((K)=>K.value==="--");if(z.some((K)=>K.value==="ssh")&&Q>=0&&Q+1<z.length){let K=x(z.slice(Q+1).map((G)=>G.value).join(" "),J.depth+1,J.debug);if(K.refused)return K}break}}if(!w2.has(X.value))return F("unclassifiable");if(J.debug)return F("debug-traffic");return N}var wZ=new Set(["sh","bash","zsh","dash","ksh","ash","mksh","fish"]),J3=new Set(["su","runuser","script","flock"]),X3=new Set(["secrets","op","unbuffer","caffeinate","chronic","strace","ltrace","firejail","bwrap","nsenter","unshare","chroot","sg","retry","parallel","doppler","aws-vault","dotenv","direnv","faketime","taskset","numactl","cgexec","systemd-run","docker","podman","kubectl","mise","asdf","rtx","devbox","gosu","su-exec","setpriv","pkexec","with-contenv","uv","poetry","pipenv","npx","bunx","pnpm","yarn","nix","nix-shell","infisical","chamber","envchain","dotenvx","teller","vault","chrt","coproc","prlimit","ionice","cpulimit","trickle","proxychains","proxychains4","torsocks","tsocks","catchsegv","valgrind"]),z3=new Map([["bun",["x","exec"]],["npm",["exec","x"]],["deno",["run"]]]),Y3=new Set(["-I","-L","-l","-n","-P","-s","-d","-E","-e","-a","--arg-file","--delimiter","--max-args","--max-lines","--max-procs","--max-chars","--replace","--eof","--process-slot-var"]),Q3=new Set(["-b","-c","-D","-E","-e","-F","-I","-i","-J","-L","-l","-m","-O","-o","-p","-Q","-R","-S","-W","-w"]),bZ=/(?:^|[^A-Za-z0-9_.-])gh(?:$|[^A-Za-z0-9_.-])/,K3=/^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]*)$/,G3=6;function Z1(Z,J){let $,X;for(let z of Z){let Q=K3.exec(z.value);if(!Q)continue;let K={...z,value:Q[2]};if(Q[1]==="GH_DEBUG")$=K;else if(Q[1]==="DEBUG")X=K}if($)return $.opaque||!["","0","false","no"].includes($.value);if(X&&(X.opaque||["1","true","yes","api"].includes(X.value)))return!0;return J}function N0(Z){let J=$Z(Z),$=0;return{segments:J.segments.map((z)=>{let Q=z.words[0],K=Z.slice($,Q.start);return $=z.words[z.words.length-1].end,{words:z.words,redirects:z.redirects,sepBefore:K}}),trustworthy:J.trustworthy}}var X1=(Z)=>/(?:^|[^|])\|&?$/.test(Z.trim());function H0(Z,J){if(!wZ.has(Z))return!1;if(q0(J))return!1;for(let $=0;$<J.length;$++){let X=J[$].value;if(X==="--")return $+1>=J.length;if(X==="-"||X==="-s")return!0;if(/^[-+][A-Za-z]*[oO]$/.test(X)){$++;continue}if(!X.startsWith("-")&&!X.startsWith("+"))return!1}return!0}function B0(Z){let{segments:J}=N0(Z.trim());if(J.length!==1)return null;let $=J[0],X=u($);if(X<0)return null;let z=a(zZ($.words[X].text).value),Q=$.words.slice(X+1).filter((K,G)=>!$.redirects.has(G+X+1)).map((K)=>zZ(K.text));if(z==="echo")return Q.filter((K,G)=>!(G===0&&/^-[neE]+$/.test(K.value))).map((K)=>K.value).join(" ");if(z==="printf"){let[K,...G]=Q.filter((H)=>H.value!=="--");if(!K)return null;let Y=0;return K.value.replace(/\\n/g,`
+`).replace(/%s/g,()=>G[Y++]?.value??"")+(Y<G.length?" "+G.slice(Y).map((H)=>H.value).join(" "):"")}if(z==="cat"){let K=Z.indexOf("<<");if(K<0)return null;let G=EZ(Z,K),Y=Z.indexOf(`
+`,K);if(!G||Y<0)return null;let H=RZ(Z,Y,[G]);if(H<0)return null;let B=Z.slice(Y+1,H);return B.slice(0,B.lastIndexOf(G.delimiter)).replace(/\n$/,"")}return null}function Q0(Z,J,$){for(let X of G0(Z).bodies){let z=B0(X);if(z===null)continue;let Q=x(z,J+1,$.debug);if(Q.refused)return Q}return N}function x(Z,J=0,$=!1){if(typeof Z!=="string"||!Z.trim())return N;if(J>G3)return bZ.test(Z)?F("unclassifiable"):N;let{segments:X,trustworthy:z}=N0(Z);if(!z)return bZ.test(Z)?F("unclassifiable"):N;let Q=$,K=(G)=>x(G,J+1,Q);for(let G of U3(Z)){if(G.runsBody){let Y=K(G.body);if(Y.refused)return Y}if(!G.quoted){let Y=G0(G.body,"heredoc");if(!Y.complete&&bZ.test(G.body))return F("unclassifiable");for(let H of Y.bodies){let B=K(H);if(B.refused)return B}}}for(let G=0;G<X.length;G++){let Y=X[G];for(let D of Y.words){let O=G0(D.text);if(!O.complete&&bZ.test(D.text))return F("unclassifiable");for(let v of O.bodies){let S=K(v);if(S.refused)return S}}let H=u(Y),B=Y.words.map((D,O)=>({word:zZ(D.text),redirect:Y.redirects.has(O)})),U=B.slice(0,H<0?B.length:H).map((D)=>D.word),V=H>=0?a(B[H].word.value):"";if(H<0||["export","declare","typeset","readonly","local"].includes(V)){if(Q=Z1([...U,...B.slice(H+1).map((D)=>D.word)],Q),H<0)continue}let I=Z1(U,Q),j=B.slice(H+1).filter((D)=>!D.redirect).map((D)=>D.word),P=B.slice(H+1).filter((D)=>D.redirect).map((D)=>D.word),M=B[H].word,_=a(M.value),g={depth:J,appendsArgs:!1,debug:I};if(H>0&&B[H-1].word.value==="function"){let D=j.filter((v)=>!["{","()","(",")"].includes(v.value)),O=U0(D,g);if(O.refused)return O;continue}if(G>0&&X1(Y.sepBefore)&&H0(_,j)){let D=X[G-1],O=H3(Z,D),v=O===null?null:B0(O);if(v!==null){let S=x(v,J+1,I);if(S.refused)return S}}let h=X[G+1];if(h&&/<\(\s*$/.test(h.sepBefore)&&(wZ.has(_)||_==="source"||_===".")){let D=h.words[0].start-h.sepBefore.length+h.sepBefore.lastIndexOf("("),O=_Z(Z,D),v=O<0?null:B0(Z.slice(D+1,O-1));if(v!==null){let S=x(v,J+1,I);if(S.refused)return S}}let d=z1(_,M,j,P,Y.words.slice(0,H+1),g);if(d.refused)return d}return N}function H3(Z,J){let $=J.words[0],X=J.words[J.words.length-1];return $&&X?Z.slice($.start,X.end):null}function B3(Z){let J=a(Z.value);return/[$`]/.test(J)||J===""?void 0:J}function z1(Z,J,$,X,z,Q){let K=Q.depth,G=(Y)=>x(Y,K+1,Q.debug);if(J.opaque){let Y=B3(J);if(Y===void 0){let H=$.find((U)=>!U.value.startsWith("-")),B=fZ($,Q);if(!B.refused)return N;return B.rule!=="unclassifiable"||H!==void 0&&!H.opaque&&x2.has(H.value)?B:N}Z=Y}if(Z==="gh")return fZ($,Q);if(wZ.has(Z)){let Y=q0($);if(Y){let H=G(Y.value);if(H.refused||!Y.opaque)return H;return Q0(Y.raw,K,Q)}for(let H of X){let B=G(H.value);if(B.refused)return B;if(H.opaque){let U=Q0(H.raw,K,Q);if(U.refused)return U}}return N}if(J3.has(Z)){let Y=$.findIndex((B)=>B.value==="-c"||B.value==="--command"||/^-[A-Za-z]*c$/.test(B.value)),H=Y>=0?$[Y+1]:void 0;return H?G(H.value):K0($,Q)}if(Z==="eval"||Z==="watch"){let Y=$;if(Z==="watch"){let B=0;while(B<$.length&&$[B].value.startsWith("-")){if($[B].value==="--"){B++;break}if(["-n","--interval","-q","--equexit"].includes($[B].value))B++;B++}Y=$.slice(B)}let H=G(Y.map((B)=>B.value).join(" "));if(H.refused)return H;for(let B of Y){let U=Q0(B.raw,K,Q);if(U.refused)return U}return N}if(Z==="env")return G(qZ([...z.map((Y)=>zZ(Y.text).value),...$.map((Y)=>Y.value)]));if(Z==="ssh"){let Y=0;for(;Y<$.length;Y++){let U=$[Y].value;if(!U.startsWith("-"))break;if(Q3.has(U))Y++}let H=$.slice(Y+1);if(H[0]?.value==="--")H.shift();let B=H.map((U)=>U.value).join(" ");return B?G(B):N}if(Z==="xargs"){let Y=0,H=!1;for(;Y<$.length;Y++){let B=$[Y].value;if(B==="--"){Y++;break}if(!B.startsWith("-"))break;if(/^-I|^-i|^--replace/.test(B))H=!0;if(Y3.has(B))Y++}return U0($.slice(Y),{depth:K,appendsArgs:!H,debug:Q.debug})}if(Z==="find"){for(let Y=0;Y<$.length;Y++){if(!["-exec","-execdir","-ok","-okdir"].includes($[Y].value))continue;let H=Y+1;while(H<$.length&&$[H].value!==";"&&$[H].value!=="+")H++;let B=U0($.slice(Y+1,H),Q);if(B.refused)return B;Y=H}return N}if(X3.has(Z))return K0($,Q);if(z3.get(Z)?.includes($[0]?.value??""))return K0($.slice(1),Q);return N}function U0(Z,J){if(Z.length===0)return N;let $=a(Z[0].value);if($==="gh")return fZ(Z.slice(1),J);if(wZ.has($)){let X=q0(Z.slice(1));return X?x(X.value,J.depth+1,J.debug):N}return z1($,Z[0],Z.slice(1),[],[],J)}function K0(Z,J){let $=Z.findIndex((X)=>!X.opaque&&a(X.value)==="gh"&&(X.value==="gh"||X.value.includes("/")));return $>=0?fZ(Z.slice($+1),J):N}function q0(Z){for(let J=0;J<Z.length;J++){let $=Z[J].value;if($==="--")return;if(!$.startsWith("-")&&!$.startsWith("+"))return;if($==="-c"||/^-[A-Za-z]+$/.test($)&&$.includes("c"))return Z.slice(J+1).find((X)=>!X.value.startsWith("-")||X.value==="-");if(/^[-+][A-Za-z]*[oO]$/.test($))J++}return}function U3(Z){let J=[],$=0;for(;;){let X=Z.indexOf("<<",$);if(X<0)break;if($=X+2,Z[X+2]==="<"||X>0&&Z[X-1]==="<"){$=X+3;continue}let z=EZ(Z,X);if(!z)continue;let Q=Z.lastIndexOf(`
+`,X)+1,K=Z.indexOf(`
+`,X);if(K<0)continue;let G=RZ(Z,K,[z]),Y=G<0?Z.slice(K+1):Z.slice(K+1,G),H=G<0?Y:Y.slice(0,Math.max(0,Y.lastIndexOf(z.delimiter))).replace(/\n$/,""),B=Z.slice(Q,X)+" HEREDOC_OPERATOR "+Z.slice(z.end,K);J.push({body:H,runsBody:V3(B),quoted:z.quoted})}return J}function V3(Z){let{segments:J}=N0(Z),$=J.findIndex((G)=>G.words.some((Y)=>Y.text==="HEREDOC_OPERATOR"));if($<0)return!1;let X=(G)=>{let Y=u(G);if(Y<0)return{verb:"",args:[]};let H=G.words.slice(Y+1).filter((B)=>B.text!=="HEREDOC_OPERATOR").map((B)=>zZ(B.text));return{verb:a(zZ(G.words[Y].text).value),args:H}},{verb:z,args:Q}=X(J[$]);if(z==="ssh"||H0(z,Q))return!0;if((z==="source"||z===".")&&["/dev/stdin","/dev/fd/0","/proc/self/fd/0"].includes(Q[0]?.value??""))return!0;let K=J[$+1];if(z==="cat"&&K&&X1(K.sepBefore)){let G=X(K);return G.verb==="ssh"||H0(G.verb,G.args)}return!1}var M3=/(?:^|[^A-Za-z0-9_.-])gh(?:$|[^A-Za-z0-9_.-])/;function Y1(){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:V0}}}var F3=new Set(["Bash","Monitor"]);function Q1(Z){if(Z?.hook_event_name!=="PreToolUse"||!F3.has(Z.tool_name??""))return{continue:!0};let J=e(Z);if(!J.trim())return{continue:!0};try{return x(J).refused?Y1():{continue:!0}}catch{return M3.test(J)?Y1():{continue:!0}}}var _0=process.argv[1];if(_0!=="trash-guard"&&_0!=="workspace-repos-guard")throw Error("Invalid safety capability");var W=JSON.parse(await Bun.stdin.text());if(!W||Array.isArray(W)||W.hook_event_name!=="PreToolUse"||typeof W.tool_name!=="string"||!W.tool_input||typeof W.tool_input!=="object"||Array.isArray(W.tool_input)||typeof W.cwd!=="string"||!B1(W.cwd))throw Error("Invalid safety input");if(W.tool_name==="Bash"&&typeof W.tool_input.command!=="string")throw Error("Invalid shell input");if(W.tool_name==="Monitor"&&W.tool_input.command!==void 0&&typeof W.tool_input.command!=="string")throw Error("Invalid monitor input");var p=W.hasna_execution;if(p!==void 0&&(!p||Object.keys(p).sort().join()!=="agent,schema"||p.schema!=="hasna.hooks.execution.v1"||typeof p.agent!=="string"||!/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(p.agent)))throw Error("Invalid execution capability");var xZ=p===void 0?void 0:{runtime:process.execPath,home:T0(),path:process.env.PATH,agent:p.agent};if(xZ&&(!B1(xZ.runtime)||!xZ.path))throw Error("Invalid bound execution context");if(["apply_patch","ApplyPatch","functions.apply_patch"].includes(W.tool_name)){if(W.tool_input.command!==void 0&&W.tool_input.patch!==void 0&&W.tool_input.command!==W.tool_input.patch)throw Error("Conflicting patch aliases");let Z=W.tool_input.command??W.tool_input.patch;if(typeof Z!=="string")throw Error("Invalid patch input");W.tool_input={...W.tool_input,command:Z,patch:Z}}var gZ=W.tool_name==="Monitor",C0=W.tool_name==="Bash"||gZ&&typeof W.tool_input.command==="string",hZ=gZ&&C0?{...W,tool_name:"Bash"}:W,j0=(Z)=>({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Z}}),K1=c0(hZ).output,G1=Q1(hZ),N3=C0&&jZ(hZ.tool_input.command,{home:T0(),cwd:W.cwd}).handoffHits.length>0,W0=_0==="trash-guard"&&(!gZ||C0)?f0(hZ,{home:T0(),cwd:W.cwd,findTrash:OZ,inspectTrash:VZ,execution:xZ}):{continue:!0};if(gZ&&W0.hookSpecificOutput?.permissionDecision==="allow")W0=j0("[trash-guard] A deletion inside a Monitor command is refused; run it with the Bash tool, where it is redirected into trash.");var H1=K1.decision==="block"?j0(K1.reason):G1.hookSpecificOutput?G1:N3?j0("[workspace-repos-guard] Deletion under a protected repository checkout is refused."):W0;process.stdout.write(JSON.stringify({verdict:"continue"in H1?null:H1}));