@namzu/cli 35.0.0 → 36.1.0

package/dist/chunks/chunk-EIYM6TY7.js

@@ -0,0 +1,1479 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  isBrowserProfileName
+} from "./chunk-WHODOMXA.js";
+import {
+  canonicalBrowserSiteKey,
+  compileBrowserSites
+} from "./chunk-RC6X3ZY6.js";
+import {
+  compilePermissions,
+  isPermissionEffect
+} from "./chunk-Q5YM2GCX.js";
+import {
+  BROWSER_ACT_TOOL_NAME,
+  BROWSER_TOOL_NAME,
+  builtinCommandArguments,
+  commandArgumentOf,
+  lexShellCommandLine,
+  nestedShellCommand,
+  programPositions
+} from "./chunk-EWKJGHRO.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/schedule/policy.ts
+import { homedir } from "node:os";
+
+// src/schedule/floor.ts
+var READ_ONLY_VERBS = ["list", "show", "status", "history", "logs"];
+function floorRefusal(finding) {
+  return `the scheduled-run floor refused this call: ${finding.detail}. It holds for every scheduled run, so rewording the call will not help`;
+}
+__name(floorRefusal, "floorRefusal");
+var DENY_ONLY = /* @__PURE__ */ new WeakSet();
+function isFloorRule(rule) {
+  return DENY_ONLY.has(rule);
+}
+__name(isFloorRule, "isFloorRule");
+function scheduledRunFloorRule(options) {
+  const floor = new Floor(options);
+  const rule = {
+    type: "predicate",
+    description: `the scheduled-run floor: a scheduled run may not stop, disable or remove the scheduler, run a \`namzu schedule\` subcommand other than ${READ_ONLY_VERBS.join(", ")}, or name NAMZU_HOME (${options.namzuHome}) or the Windows browser\u2019s profile folder (%LOCALAPPDATA%\\namzu) in any argument. It holds for every scheduled run, so rewording the call will not help`,
+    decide: /* @__PURE__ */ __name((call) => floor.find(call) === null ? null : "deny", "decide"),
+    // Asked only after `decide` denied, so the reading is done twice for a
+    // refused call and once for every other.
+    describe: /* @__PURE__ */ __name((call) => {
+      const finding = floor.find(call);
+      return finding ? floorRefusal(finding) : null;
+    }, "describe")
+  };
+  DENY_ONLY.add(rule);
+  return rule;
+}
+__name(scheduledRunFloorRule, "scheduledRunFloorRule");
+var SYSTEMCTL_VERBS_WITH_UNIT = /* @__PURE__ */ new Set([
+  "stop",
+  "disable",
+  "mask",
+  "edit",
+  "kill",
+  "revert",
+  "freeze",
+  "set-property",
+  "clean"
+]);
+var SYSTEMCTL_VERBS_ALONE = /* @__PURE__ */ new Set(["isolate", "exit"]);
+var LAUNCHCTL_VERBS = /* @__PURE__ */ new Set(["bootout", "unload", "remove", "disable", "kill", "stop"]);
+var SCHTASKS_SWITCH = /^[/-](?:delete|change|end)$/;
+var DBUS_TOOLS = /* @__PURE__ */ new Set(["busctl", "dbus-send", "gdbus"]);
+var JS_RUNTIMES = /* @__PURE__ */ new Set([
+  "node",
+  "nodejs",
+  "npx",
+  "pnpx",
+  "bunx",
+  "bun",
+  "deno",
+  "tsx",
+  "ts-node",
+  "npm",
+  "pnpm",
+  "yarn"
+]);
+var CLI_ENTRY = /^bin(?:\.[cm]?js)?$/;
+var SHELLS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "dash",
+  "zsh",
+  "ksh",
+  "ash",
+  "mksh",
+  "busybox",
+  "fish",
+  "csh",
+  "tcsh",
+  "pwsh",
+  "powershell",
+  "cmd",
+  "wsl"
+]);
+var INTERPRETERS = /^(?:python[0-9.]*|pypy[0-9.]*|node|nodejs|deno|bun|perl[0-9.]*|ruby|php[0-9.]*|lua[0-9.]*|luajit|osascript|awk|gawk|mawk|nawk|sed|gsed|tclsh|wish|expect|eval|source|xargs|parallel|watch|su|runuser|ssh|script|flock|at|batch|crontab)$/;
+var STRING_OPTIONS = {
+  sudo: /^-(?:[a-z]*[si][a-z]*|-shell|-login)$/,
+  env: /^-(?:[a-z]*s[a-z]*|-split-string(?:=.*)?)$/i
+};
+var POWERSHELL_NAMES = /* @__PURE__ */ new Set(["powershell", "pwsh"]);
+var ENCODED_COMMAND_FLAG = /^-e(?:n(?:c(?:o(?:d(?:e(?:d(?:c(?:o(?:m(?:m(?:a(?:n(?:d)?)?)?)?)?)?)?)?)?)?)?)?)?$/i;
+var NOT_READ_ONLY = `a \`namzu schedule\` subcommand other than ${READ_ONLY_VERBS.join(", ")}`;
+var NAME_CHAR = /[a-z0-9._-]/;
+function lower(text) {
+  return text.toLowerCase();
+}
+__name(lower, "lower");
+function commandName(value) {
+  const cut = Math.max(value.lastIndexOf("/"), value.lastIndexOf("\\"));
+  const base = lower(cut < 0 ? value : value.slice(cut + 1));
+  return base.endsWith(".exe") ? base.slice(0, -4) : base;
+}
+__name(commandName, "commandName");
+function shown(text, max = 80) {
+  const flat = text.replace(/\s*\n\s*/g, " \u23CE ");
+  const cut = [...flat].length > max ? `${[...flat].slice(0, max - 1).join("")}\u2026` : flat;
+  return cut.includes("`") ? `\`\` ${cut} \`\`` : `\`${cut}\``;
+}
+__name(shown, "shown");
+function unlocale(value) {
+  return value.includes('$"') ? value.replace(
+    /\$"((?:[^"\\]|\\.)*)"/g,
+    (_, inner) => inner.replace(/\\([$`"\\\n])/g, "$1")
+  ) : value;
+}
+__name(unlocale, "unlocale");
+function localeOnly(value, catalogue) {
+  return !catalogue && value.includes('$"') && !/[$`*?[{~]/.test(unlocale(value));
+}
+__name(localeOnly, "localeOnly");
+function wordsOf(command, catalogue) {
+  return command.words.map((w) => {
+    const text = w.expands ? unlocale(w.value) : w.value;
+    return { text: lower(text), wild: w.expands && !localeOnly(w.value, catalogue) };
+  });
+}
+__name(wordsOf, "wordsOf");
+function reachesScheduler(command, words, daemonCommandLine, dialect) {
+  const n = words.length;
+  const find = /* @__PURE__ */ __name((from, test) => {
+    for (let i = from; i < n; i++) if (test(words[i], i)) return i;
+    return -1;
+  }, "find");
+  const heads = /* @__PURE__ */ new Set();
+  for (const position of programPositions(command, dialect)) {
+    if (position.word === void 0) continue;
+    const idx = command.words.indexOf(position.word);
+    if (idx >= 0) heads.add(idx);
+  }
+  const named = /* @__PURE__ */ __name((name) => (w, i) => w.wild && heads.has(i) || commandName(w.text) === name, "named");
+  const namesNamzu = /* @__PURE__ */ __name((w) => w.wild || w.text.includes("namzu"), "namesNamzu");
+  const systemctl = find(0, named("systemctl"));
+  if (systemctl >= 0) {
+    if (find(systemctl + 1, (w) => !w.wild && SYSTEMCTL_VERBS_ALONE.has(w.text)) >= 0)
+      return "stops every service, the scheduler with them";
+    const verb = find(systemctl + 1, (w) => w.wild || SYSTEMCTL_VERBS_WITH_UNIT.has(w.text));
+    if (verb >= 0 && find(verb + 1, (u) => namesNamzu(u) || /[*?[]/.test(u.text)) >= 0)
+      return "stops or disables the scheduler\u2019s service";
+  }
+  const launchctl = find(0, named("launchctl"));
+  if (launchctl >= 0) {
+    const verb = find(launchctl + 1, (w) => w.wild || LAUNCHCTL_VERBS.has(w.text));
+    if (verb >= 0 && find(verb + 1, namesNamzu) >= 0) return "removes the scheduler\u2019s launchd agent";
+  }
+  const schtasks = find(0, named("schtasks"));
+  if (schtasks >= 0) {
+    const rest = words.slice(schtasks + 1);
+    if (rest.some((w) => w.wild || SCHTASKS_SWITCH.test(w.text)) && rest.some(namesNamzu))
+      return "deletes, changes or ends the scheduler\u2019s task";
+  }
+  const killer = find(0, (w, i) => named("pkill")(w, i) || named("killall")(w, i));
+  if (killer >= 0) {
+    const kills = "has a pattern that could match the scheduler\u2019s process";
+    const full = words.slice(killer + 1).some((w) => /^-[a-z]*f/.test(w.text) || w.text === "--full");
+    for (let i = killer + 1; i < n; i++) {
+      const w = words[i];
+      if (w.wild) return kills;
+      if (w.text.startsWith("-")) continue;
+      if (/[.*+?^$|()[\]{}\\]/.test(w.text)) return kills;
+      if (w.text.includes("namzu") || w.text.includes("schedul")) return kills;
+      if ("node".includes(w.text) || full && daemonCommandLine.includes(w.text)) return kills;
+    }
+  }
+  const dbus = find(0, (w, i) => w.wild && heads.has(i) || DBUS_TOOLS.has(commandName(w.text)));
+  if (dbus >= 0 && find(dbus + 1, namesNamzu) >= 0) return "calls systemd about a namzu unit";
+  const strong = find(0, (w) => commandName(w.text) === "namzu" || w.text.includes("@namzu/cli"));
+  const weak = find(
+    0,
+    (w) => CLI_ENTRY.test(commandName(w.text)) || JS_RUNTIMES.has(commandName(w.text))
+  );
+  if (strong >= 0 && find(strong + 1, (w) => w.wild) >= 0)
+    return "passes the CLI a word that expands at runtime, which could be a `schedule` subcommand";
+  const cli = strong < 0 ? weak : weak < 0 ? strong : Math.min(strong, weak);
+  if (cli >= 0) {
+    for (let i = cli + 1; i < n; i++) {
+      if (words[i].text !== "schedule" || words[i].wild) continue;
+      const verb = words[i + 1];
+      if (verb === void 0) continue;
+      if (verb.wild) return "runs a `schedule` subcommand that expands at runtime";
+      if (!READ_ONLY_VERBS.includes(verb.text))
+        return `runs \`schedule ${verb.text}\`, ${NOT_READ_ONLY}`;
+    }
+  }
+  return null;
+}
+__name(reachesScheduler, "reachesScheduler");
+function runsUnreadText(command) {
+  const words = command.words;
+  const head = command.assignments;
+  const names = words.map((w) => w.expands ? "" : commandName(w.value));
+  const nested = nestedShellCommand(words.slice(head));
+  const readTo = nested !== null && "payload" in nested ? head + (commandName(words[head].value) === "busybox" ? 1 : 0) : -1;
+  for (let i = 0; i < words.length; i++) {
+    const name = names[i];
+    if (name === "") continue;
+    const program = shown(words[i].value);
+    if (INTERPRETERS.test(name)) return `${program} runs text as code`;
+    if (i === head && name === ".") return "`.` runs a file as commands";
+    if (i === head && name === "trap") {
+      const action = words.slice(i + 1).find((w) => w.expands || w.value !== "-l" && w.value !== "-p" && w.value !== "--");
+      if (action !== void 0)
+        return `${program} runs its action as a command when the signal fires`;
+    }
+    if (SHELLS.has(name) && !(i >= head && i <= readTo))
+      return `${program} runs commands the floor does not read`;
+  }
+  for (const [program, option] of Object.entries(STRING_OPTIONS)) {
+    const flag = words.find((w) => !w.expands && option.test(w.value));
+    if (names.includes(program) && flag !== void 0)
+      return `\`${program} ${flag.value}\` runs a string as commands`;
+  }
+  return null;
+}
+__name(runsUnreadText, "runsUnreadText");
+function encodedCommandCall(command) {
+  const words = command.words;
+  for (let i = command.assignments; i < words.length; i++) {
+    const word = words[i];
+    if (word.expands || !POWERSHELL_NAMES.has(commandName(word.value))) continue;
+    const flag = words.slice(i + 1).find((w) => !w.expands && ENCODED_COMMAND_FLAG.test(w.value));
+    if (flag !== void 0) return { program: word, flag };
+  }
+  return null;
+}
+__name(encodedCommandCall, "encodedCommandCall");
+function normalize(text) {
+  const out = [];
+  const parts = text.replace(/\\/g, "/").split("/");
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i];
+    if (part === "" && i > 0) continue;
+    if (part === ".") continue;
+    if (part === "..") {
+      const last = out.at(-1);
+      if (last === "") continue;
+      if (last !== void 0 && last !== "..") {
+        out.pop();
+        continue;
+      }
+    }
+    out.push(part);
+  }
+  if (out.length === 1 && out[0] === "") return "/";
+  return out.join("/");
+}
+__name(normalize, "normalize");
+function isAbsolute(path) {
+  return path.startsWith("/") || path.startsWith("\\") || /^[a-z]:[\\/]/.test(path);
+}
+__name(isAbsolute, "isAbsolute");
+function join(dir, rel) {
+  return normalize(`${dir}/${rel}`);
+}
+__name(join, "join");
+function containsPath(text, home) {
+  let at = text.indexOf(home);
+  while (at >= 0) {
+    const before = at === 0 ? "" : text[at - 1];
+    const after = text[at + home.length] ?? "";
+    if (!NAME_CHAR.test(before) && !NAME_CHAR.test(after)) return true;
+    at = text.indexOf(home, at + 1);
+  }
+  return false;
+}
+__name(containsPath, "containsPath");
+var NOWHERE = { dirs: [], unknown: true };
+var UNKNOWN = { values: [], unknown: true };
+var MAX_ALTERNATIVES = 64;
+var TooMany = class extends Error {
+  static {
+    __name(this, "TooMany");
+  }
+};
+var PROFILE_SEGMENTS = ["appdata", "local", "namzu"];
+var PROFILE_TAIL = PROFILE_SEGMENTS.join("/");
+var LOCAL_APP_DATA = "c:/users/%username%/appdata/local";
+function spellLocalAppData(text) {
+  return text.includes("localappdata") ? text.replace(/%localappdata%|\$\{?(?:env:)?localappdata(?![a-z0-9_])\}?/g, LOCAL_APP_DATA) : text;
+}
+__name(spellLocalAppData, "spellLocalAppData");
+function namesProfile(text) {
+  return containsPath(text, PROFILE_TAIL);
+}
+__name(namesProfile, "namesProfile");
+var WILD = /[*?[$`{]/;
+var WILD_RUN = /\$\{[^}]*\}?|\$[a-z0-9_]*|`[^`]*`?|\[[^\]]*\]?|[*?{}]/;
+function mayBe(segment, name) {
+  if (!WILD.test(segment)) return segment === name;
+  const pieces = segment.split(WILD_RUN);
+  const first = pieces[0];
+  const last = pieces.at(-1);
+  if (!name.startsWith(first) || !name.endsWith(last)) return false;
+  let at = first.length;
+  for (const piece of pieces.slice(1, -1)) {
+    const found = name.indexOf(piece, at);
+    if (found < 0) return false;
+    at = found + piece.length;
+  }
+  return at <= name.length - last.length;
+}
+__name(mayBe, "mayBe");
+function mayNameProfile(text) {
+  const segments = text.split("/");
+  for (let i = 0; i + PROFILE_SEGMENTS.length <= segments.length; i++) {
+    const run = segments.slice(i, i + PROFILE_SEGMENTS.length);
+    if (!run.every((segment, k) => mayBe(segment, PROFILE_SEGMENTS[k]))) continue;
+    if (run.some((segment) => segment.split(WILD_RUN).some((piece) => piece !== ""))) return true;
+  }
+  return false;
+}
+__name(mayNameProfile, "mayNameProfile");
+function endsShortOfProfile(path) {
+  const segments = path.split("/");
+  const n = segments.length;
+  const last = segments[n - 1];
+  return n >= 3 && segments[n - 3] === "appdata" && segments[n - 2] === "local" && last !== "" && last !== "namzu" && "namzu".startsWith(last);
+}
+__name(endsShortOfProfile, "endsShortOfProfile");
+var SCHEDULE_WORD = /(?:^|[\s,;([{|&=])schedule(?=$|[\s,;)\]}|&])/g;
+var CLI_IN_TEXT = /namzu|bin\.[cm]?js|(?:^|[^a-z0-9_-])(?:node|nodejs|npx|pnpx|bunx|bun|deno|tsx|ts-node|npm|pnpm|yarn)(?![a-z0-9_-])/;
+var EXPANSION_IN_TEXT = /[$`]|%[a-z_][a-z0-9_]*%/;
+var SERVICE_NAME_IN_TEXT = /namzu-scheduler[a-z0-9._-]*|com\.namzu\.[a-z0-9._-]*/;
+var SERVICE_TOOL_IN_TEXT = /(?:^|[^a-z0-9_-])(systemctl|launchctl|schtasks|busctl|dbus-send|gdbus|(?:stop|disable|unregister|set)-scheduledtask|schedule\.service)(?![a-z0-9_-])/;
+var PROCESS_KILLER_IN_TEXT = /(?:^|[^a-z0-9_-])(pkill|killall)(?![a-z0-9_-])/;
+var HOME_VARIABLE_IN_TEXT = /(?:^|[^a-z0-9_])namzu_home(?![a-z0-9_])/;
+var LOCAL_APP_DATA_IN_TEXT = /localappdata|localapplicationdata|(?:^|[^a-z0-9])appdata(?![a-z0-9])/;
+var NAMZU_SEGMENT = /(?:^|[^a-z0-9_.-])namzu(?![a-z0-9_.-])/;
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+__name(escapeRegExp, "escapeRegExp");
+function scheduleSubcommand(text) {
+  for (const match of text.matchAll(SCHEDULE_WORD)) {
+    const after = text.slice((match.index ?? 0) + match[0].length);
+    const verb = /^[\s,]*([a-z0-9][a-z0-9_-]*)/.exec(after)?.[1];
+    if (verb !== void 0 && READ_ONLY_VERBS.includes(verb)) continue;
+    return verb === void 0 ? "schedule" : `schedule ${verb}`;
+  }
+  return null;
+}
+__name(scheduleSubcommand, "scheduleSubcommand");
+var Floor = class {
+  static {
+    __name(this, "Floor");
+  }
+  home;
+  /** NAMZU_HOME as the operator wrote it, for a refusal. */
+  homeShown;
+  homeCore;
+  /** NAMZU_HOME's last segment, and the default's (`.namzu`), as path segments in text. */
+  homeSegments;
+  userHome;
+  folders;
+  daemonCommandLine;
+  builtinCommands;
+  constructor(options) {
+    this.home = normalize(lower(options.namzuHome));
+    this.homeShown = options.namzuHome;
+    this.userHome = normalize(lower(options.userHome));
+    this.folders = (options.folders ?? []).map((f) => normalize(lower(f)));
+    const last = this.home.split("/").at(-1) ?? "";
+    this.homeCore = last.replace(/^\.+/, "");
+    this.homeSegments = [.../* @__PURE__ */ new Set([".namzu", last])].filter((name) => name.replace(/^\.+/, "").length >= 3).map((name) => ({
+      name,
+      pattern: name.startsWith(".") ? new RegExp(`(?:^|[^a-z0-9_.-])${escapeRegExp(name)}(?![a-z0-9_.-])`) : new RegExp(`[/\\\\]${escapeRegExp(name)}(?![a-z0-9_.-])`)
+    }));
+    this.builtinCommands = builtinCommandArguments();
+    this.daemonCommandLine = lower(
+      options.daemonCommandLine ?? `${process.execPath} ${process.argv[1] ?? ""} schedule daemon`
+    );
+  }
+  /** What the floor protects, as a refusal names it. */
+  protectedWords(what) {
+    return what === "NAMZU_HOME" ? `NAMZU_HOME (${this.homeShown})` : "the Windows browser\u2019s profile folder (%LOCALAPPDATA%\\namzu)";
+  }
+  /** Why the floor denies the call and what matched, or null when it does not. */
+  find(call) {
+    const argument = call.toolDef ? commandArgumentOf(call.toolDef) : this.builtinCommands.get(call.toolName);
+    const input = call.toolInput;
+    let line;
+    if (argument !== void 0 && typeof input === "object" && input !== null) {
+      const value = input[argument];
+      if (typeof value === "string") line = value;
+    }
+    try {
+      const named = this.stringsName(input, line);
+      if (named !== null)
+        return {
+          reason: `names ${named.what}`,
+          detail: `${named.where} names ${this.protectedWords(named.what)}`
+        };
+      if (line !== void 0) return this.lineVerdict(line, call.commandDialect);
+      return null;
+    } catch (error) {
+      if (error instanceof TooMany)
+        return {
+          reason: "too many spellings",
+          detail: `a word in the command can be spelled more than ${MAX_ALTERNATIVES} ways once its variables are filled in, and the floor refuses rather than try them all`
+        };
+      throw error;
+    }
+  }
+  // ---- any tool -----------------------------------------------------------
+  /** Every string in the input but the command line, searched as text. */
+  stringsName(input, line) {
+    const stack = [
+      { value: input, at: "" }
+    ];
+    let skipped = false;
+    while (stack.length > 0) {
+      const { value, at, key } = stack.pop();
+      if (typeof value === "string") {
+        if (!skipped && value === line) {
+          skipped = true;
+          continue;
+        }
+        const where = key ? `the argument name ${shown(value)}` : at === "" ? "the input" : `the \`${at}\` argument`;
+        if (this.textNamesHome(value)) return { what: "NAMZU_HOME", where };
+        if (textNamesProfile(value)) return { what: "the browser profiles", where };
+      } else if (Array.isArray(value)) {
+        value.forEach((each, i) => stack.push({ value: each, at: `${at}[${i}]` }));
+      } else if (value !== null && typeof value === "object") {
+        for (const [name, each] of Object.entries(value)) {
+          const path = at === "" ? name : `${at}.${name}`;
+          stack.push({ value: name, at: path, key: true }, { value: each, at: path });
+        }
+      }
+    }
+    return null;
+  }
+  /**
+   * NAMZU_HOME in free text: as a path, through `~`, `$HOME`, `${HOME}` or
+   * `$NAMZU_HOME`, in any letter case; and again with quotes and
+   * backslashes dropped, as a shell would drop them.
+   */
+  textNamesHome(text) {
+    const plain = lower(text);
+    const unquoted = plain.replace(/\\\n/g, "").replace(/\$(?=["'])/g, "").replace(/["'\\]/g, "");
+    for (const variant of [plain, unquoted]) {
+      if (/\$\{?[!#]?namzu_home(?![a-z0-9_])/.test(variant)) return true;
+      const spelled = variant.replace(/\$\{home\}|\$home(?![a-z0-9_])/g, this.userHome).replace(/(^|[\s"'=:(<>|;&,`])~[a-z0-9._-]*(?=[/\\]|$|[\s"'])/g, `$1${this.userHome}`);
+      if (containsPath(normalize(spelled), this.home)) return true;
+    }
+    return false;
+  }
+  // ---- a command line -----------------------------------------------------
+  lineVerdict(line, dialect, depth = 0) {
+    if (dialect === "cmd")
+      return {
+        reason: "unsupported command dialect",
+        detail: "The scheduled-run floor cannot verify native CMD commands. Use an explicitly installed POSIX interpreter; unattended execution is refused."
+      };
+    const dialects = dialect === "bash" ? ["bash"] : ["sh", "bash"];
+    const readings = dialects.map((d) => lexShellCommandLine(line, { dialect: d }));
+    const catalogue = /textdomain/i.test(line);
+    const loops = /\b(?:while|until|for|select)\b/.test(line);
+    let unaccounted = null;
+    for (let i = 0; i < readings.length; i += 1) {
+      const reading = readings[i];
+      const finding = this.readingVerdict(reading, catalogue, loops, dialects[i]);
+      if (finding !== null) return finding;
+      if (reading.opaque) {
+        unaccounted ??= {
+          reason: "opaque line mentions a protected name",
+          why: `the floor cannot read the line (${reading.reasons[0] ?? "a construct it does not model"})`
+        };
+        continue;
+      }
+      for (const command of reading.commands) {
+        const unread = unreadCommand(command);
+        if (unread === null) continue;
+        unaccounted ??= { reason: "unread text mentions a protected name", why: unread };
+        break;
+      }
+    }
+    if (unaccounted === null) return null;
+    const trip = this.tripwire(line, readings);
+    if (trip !== null)
+      return {
+        reason: unaccounted.reason,
+        detail: `${unaccounted.why}, and it holds ${shown(trip.token)} (${trip.what})${whereIn(readings, trip.pattern ?? trip.token)}`
+      };
+    if (depth < MAX_TEXT_DEPTH)
+      for (const text of fedTexts(readings)) {
+        const inner = this.lineVerdict(text, "bash", depth + 1);
+        if (inner !== null)
+          return {
+            reason: unaccounted.reason,
+            detail: `${unaccounted.why}, and read as a command line, ${shown(text)}: ${inner.detail}`
+          };
+      }
+    return null;
+  }
+  /**
+   * The tripwire, for a line the lexer could not account for: something in
+   * its text that can reach what the floor protects, or null. Read in the
+   * line as written, with quotes and expansion marks dropped (and once more
+   * with backslashes dropped too), and in every word the lexer decoded:
+   *
+   * - `NAMZU_HOME` by name (`$NAMZU_HOME`, `%NAMZU_HOME%`,
+   *   `os.environ['NAMZU_HOME']`), its last segment as a path segment
+   *   (`.namzu`, always), or a path into it;
+   * - the Windows browser's profile folder, as a path, or `LOCALAPPDATA` (or
+   *   `AppData`) with `namzu` as a segment or a string of its own;
+   * - the scheduler service's name (`namzu-scheduler…`, `com.namzu.…`);
+   * - a service tool (`systemctl`, `launchctl`, `schtasks`, the D-Bus tools,
+   *   PowerShell's `*-ScheduledTask`) with `namzu` or a glob in the text,
+   *   `systemctl isolate` or `exit`; `pkill` or `killall` anywhere, because
+   *   a pattern can match the scheduler's `node` process without naming it;
+   * - `schedule` as a command word followed by anything but a read-only
+   *   verb, when the text also names the CLI (`namzu`, `@namzu/cli`,
+   *   `bin.js`, a JavaScript runtime) or holds an expansion that could.
+   *
+   * Nothing else: the product's name in a string (`MessageBox::Show('Namzu:
+   * scheduled job running')`) reaches none of them.
+   */
+  tripwire(line, readings) {
+    const plain = lower(line).replace(/\\\n/g, "");
+    const unquoted = plain.replace(/["'$`]/g, "");
+    const squashed = unquoted.replace(/\\/g, "");
+    const decoded = readings.flatMap((r) => r.commands.flatMap((c) => c.words.map((w) => lower(w.value)))).join(" ");
+    const texts = [squashed, unquoted, decoded];
+    const first = /* @__PURE__ */ __name((pattern) => {
+      for (const text of texts) {
+        const match = pattern.exec(text);
+        if (match) return match[1] ?? match[0].replace(/^[^a-z0-9%.]+/, "");
+      }
+      return null;
+    }, "first");
+    if (HOME_VARIABLE_IN_TEXT.test(plain) || first(HOME_VARIABLE_IN_TEXT) !== null)
+      return { token: "NAMZU_HOME", what: "the NAMZU_HOME variable" };
+    for (const { name, pattern } of this.homeSegments)
+      if (texts.some((text) => pattern.test(text)))
+        return { token: name, what: "NAMZU_HOME\u2019s folder name", pattern };
+    if (this.textNamesHome(line) || this.textNamesHome(decoded))
+      return { token: this.homeShown, what: "a path into NAMZU_HOME" };
+    if (textNamesProfile(line) || textNamesProfile(decoded))
+      return {
+        token: "%LOCALAPPDATA%\\namzu",
+        what: "a path into the Windows browser\u2019s profile folder"
+      };
+    const appData = first(LOCAL_APP_DATA_IN_TEXT);
+    if (appData !== null && texts.some((text) => NAMZU_SEGMENT.test(text)))
+      return {
+        token: `${appData} \u2026 namzu`,
+        what: "together, the Windows browser\u2019s profile folder"
+      };
+    const service = first(SERVICE_NAME_IN_TEXT);
+    if (service !== null) return { token: service, what: "the scheduler service\u2019s name" };
+    const tool = first(SERVICE_TOOL_IN_TEXT);
+    if (tool !== null) {
+      if (texts.some((text) => text.includes("namzu")))
+        return { token: `${tool} \u2026 namzu`, what: "a service tool with a namzu name" };
+      if (plain.includes("*"))
+        return { token: `${tool} \u2026 *`, what: "a service tool with a pattern that can match it" };
+      if (tool === "systemctl") {
+        const all = first(/(?:^|\s)(isolate|exit)(?![a-z0-9_-])/);
+        if (all !== null) return { token: `systemctl ${all}`, what: "which stops every service" };
+      }
+    }
+    const killer = first(PROCESS_KILLER_IN_TEXT);
+    if (killer !== null)
+      return {
+        token: killer,
+        what: "which kills by pattern, and the scheduler is a node process a pattern can match"
+      };
+    const cli = texts.some((text) => CLI_IN_TEXT.test(text)) || EXPANSION_IN_TEXT.test(plain.replace(/\$(?=['"])/g, ""));
+    if (cli)
+      for (const text of [squashed, decoded]) {
+        const subcommand = scheduleSubcommand(text);
+        if (subcommand !== null) return { token: subcommand, what: NOT_READ_ONLY };
+      }
+    return null;
+  }
+  readingVerdict(reading, catalogue, loops, dialect) {
+    for (const command of reading.commands) {
+      const encoded = encodedCommandCall(command);
+      if (encoded !== null)
+        return {
+          reason: "encoded command cannot be read at all",
+          detail: `${shown(encoded.program.value)} ${shown(encoded.flag.value)} runs a base64-encoded script the floor cannot read at all, so it is refused outright whatever it decodes to; use -Command '<literal text>' instead`
+        };
+    }
+    for (const command of reading.commands) {
+      const does = reachesScheduler(
+        command,
+        wordsOf(command, catalogue),
+        this.daemonCommandLine,
+        dialect
+      );
+      if (does !== null)
+        return {
+          reason: "scheduler command",
+          detail: `${shown(command.words.map((w) => w.text).join(" "))} ${does}`
+        };
+    }
+    const variables = this.assignments(reading);
+    const expanding = /* @__PURE__ */ __name((w) => w.expands && !localeOnly(w.value, catalogue), "expanding");
+    const expands = reading.commands.some((c) => c.words.some(expanding)) || reading.redirections.some((r) => expanding(r.target)) || reading.compoundWords.some(expanding);
+    const exported = reading.commands.some(
+      (c) => c.words.some((w) => !w.expands && EXPORTING.has(commandName(w.value)))
+    );
+    const names = /* @__PURE__ */ __name((what) => `names ${this.protectedWords(what)}`, "names");
+    const cwd = new Directories(this.folders);
+    if (loops)
+      for (const command of reading.commands)
+        cwd.after(command, (target) => this.spell(target, variables, cwd.current()), this.userHome);
+    const seen = /* @__PURE__ */ new Set();
+    const written = /* @__PURE__ */ new Set();
+    for (const command of reading.commands) {
+      const here = cwd.current();
+      const findExec = this.findExecFinding(command, variables, here, dialect);
+      if (findExec !== null) return findExec;
+      const executed = executedPath(command);
+      if (executed !== null && !executed.expands) {
+        for (const base of isAbsolute(executed.value) ? [""] : here.dirs) {
+          const path = base === "" ? normalize(executed.value) : join(base, executed.value);
+          if (written.has(path)) {
+            return {
+              reason: "runs a file the script wrote earlier",
+              detail: `${shown(command.text)} runs ${shown(executed.text)}, which an earlier command in this script wrote; its content cannot be verified, so it is refused rather than run unattended`
+            };
+          }
+        }
+      }
+      for (const target of writeTargets(command)) {
+        if (target.expands) continue;
+        for (const base of isAbsolute(target.value) ? [""] : here.dirs) {
+          written.add(base === "" ? normalize(target.value) : join(base, target.value));
+        }
+      }
+      const check2 = /* @__PURE__ */ __name((word) => this.wordNames(word, variables, here, expands), "check");
+      const standalone = command.words.length === command.assignments && !exported;
+      for (const [i, word] of command.words.entries()) {
+        if (standalone && i < command.assignments) continue;
+        const named = check2(word);
+        if (named !== null)
+          return {
+            reason: `word names ${named}`,
+            detail: `the argument ${shown(word.text)} ${names(named)}`
+          };
+        const assigned = assignedValue(word);
+        const value = assigned ? check2(assigned.word) : null;
+        if (value !== null)
+          return {
+            reason: `assigned value names ${value}`,
+            detail: `the value assigned in ${shown(word.text)} ${names(value)}`
+          };
+      }
+      for (const redirection of command.redirections) {
+        seen.add(redirection);
+        const named = redirectsTo(redirection) ? check2(redirection.target) : null;
+        if (named !== null)
+          return {
+            reason: `redirection names ${named}`,
+            detail: `the redirection ${shown(`${redirection.operator} ${redirection.target.text}`)} ${names(named)}`
+          };
+      }
+      cwd.after(command, (target) => this.spell(target, variables, cwd.current()), this.userHome);
+    }
+    const anywhere = cwd.current();
+    const check = /* @__PURE__ */ __name((word) => this.wordNames(word, variables, anywhere, expands), "check");
+    for (const redirection of reading.redirections) {
+      if (seen.has(redirection) || !redirectsTo(redirection)) continue;
+      const named = check(redirection.target);
+      if (named !== null)
+        return {
+          reason: `redirection names ${named}`,
+          detail: `the redirection ${shown(`${redirection.operator} ${redirection.target.text}`)} ${names(named)}`
+        };
+    }
+    for (const word of reading.compoundWords) {
+      const named = check(word);
+      if (named !== null)
+        return {
+          reason: `loop or case word names ${named}`,
+          detail: `the loop or case word ${shown(word.text)} ${names(named)}`
+        };
+    }
+    return null;
+  }
+  /** Literal values the line assigns to each variable (`X=…`, `export X=…`). */
+  assignments(reading) {
+    const found = /* @__PURE__ */ new Map();
+    const unknown = /* @__PURE__ */ new Set();
+    const record = /* @__PURE__ */ __name((word) => {
+      const value = assignedValue(word);
+      if (value === null) return;
+      const { name, append } = value;
+      const spellings = append ? [] : this.spell(value.word, /* @__PURE__ */ new Map(), NOWHERE);
+      if (spellings.length === 0 || spellings.some((s) => s.stop !== "end")) {
+        unknown.add(name);
+        return;
+      }
+      const values = found.get(name) ?? /* @__PURE__ */ new Set();
+      for (const s of spellings) values.add(s.known);
+      found.set(name, values);
+    }, "record");
+    for (const command of reading.commands) {
+      command.words.slice(0, command.assignments).forEach(record);
+      const head = command.words[command.assignments];
+      if (head && !head.expands && ["export", "declare", "typeset", "local", "readonly"].includes(head.value))
+        command.words.slice(command.assignments + 1).forEach(record);
+    }
+    const out = /* @__PURE__ */ new Map();
+    for (const [name, values] of found) {
+      if (values.size > 8) throw new TooMany();
+      out.set(name, { values: [...values], unknown: true });
+    }
+    for (const name of unknown) if (!out.has(name)) out.set(name, UNKNOWN);
+    return out;
+  }
+  /**
+   * A word's value with `~`, `$HOME`, `${HOME}`, `$NAMZU_HOME`, `$PWD` and
+   * the line's own literal assignments spelled out, one spelling per
+   * combination of the values each may hold.
+   */
+  spell(word, variables, cwd) {
+    if (!word.expands) return [{ known: lower(word.value), stop: "end", rest: "" }];
+    const value = unlocale(word.value.replace(/\\\n/g, ""));
+    const raw = word.text.replace(/\\\n/g, "");
+    const tildeFirst = /^~[A-Za-z0-9._-]*(?:\/|$)/.test(raw);
+    const tildeAssigned = /^[A-Za-z_][A-Za-z0-9_]*\+?=/.test(raw) && /[=:]~[A-Za-z0-9._-]*(?:[/:]|$)/.test(raw);
+    let open = [""];
+    const out = [];
+    const stopAll = /* @__PURE__ */ __name((stop, from) => {
+      const rest = lower(value.slice(from));
+      for (const known of open) out.push({ known: lower(known), stop, rest });
+    }, "stopAll");
+    let i = 0;
+    while (i < value.length && open.length > 0) {
+      const c = value[i];
+      if (c === "~" && (i === 0 && tildeFirst || (value[i - 1] === "=" || value[i - 1] === ":") && tildeAssigned)) {
+        let j = i + 1;
+        while (j < value.length && NAME_CHAR.test(lower(value[j]))) j++;
+        if (j === value.length || value[j] === "/") {
+          open = open.map((known) => known + this.userHome);
+          i = j;
+          continue;
+        }
+      }
+      if (c === "$") {
+        const simple = /^\$(?:([A-Za-z_][A-Za-z0-9_]*)|\{([A-Za-z_][A-Za-z0-9_]*)\})/.exec(
+          value.slice(i, i + 256)
+        );
+        if (simple) {
+          const name = simple[1] ?? simple[2];
+          const alternatives = name === "HOME" ? { values: [this.userHome], unknown: false } : name === "NAMZU_HOME" ? { values: [this.home], unknown: false } : name === "PWD" ? { values: cwd.dirs, unknown: cwd.unknown } : name === "LOCALAPPDATA" ? localAppData(variables.get(name)) : variables.get(name) ?? UNKNOWN;
+          i += simple[0].length;
+          if (alternatives.unknown) stopAll("unknown", i);
+          const next = [];
+          for (const known of open) for (const v of alternatives.values) next.push(known + v);
+          if (next.length + out.length > MAX_ALTERNATIVES) throw new TooMany();
+          open = next;
+          continue;
+        }
+        if (i + 1 < value.length) {
+          stopAll("unknown", i + 1);
+          return out;
+        }
+      }
+      if (c === "`" || c === "{") {
+        stopAll("unknown", i + 1);
+        return out;
+      }
+      if (c === "*" || c === "?" || c === "[") {
+        stopAll("glob", i);
+        return out;
+      }
+      open = open.map((known) => known + c);
+      i++;
+    }
+    stopAll("end", value.length);
+    return out;
+  }
+  inside(path) {
+    return path === this.home || path.startsWith(this.home === "/" ? "/" : `${this.home}/`);
+  }
+  /** The home segment right below `dir`, when `dir` is an ancestor of NAMZU_HOME. */
+  belowAncestor(dir) {
+    const prefix = dir === "/" ? "/" : `${dir}/`;
+    if (!this.home.startsWith(prefix)) return null;
+    return this.home.slice(prefix.length).split("/")[0] ?? "";
+  }
+  /** What a word names that the floor protects, or null. */
+  wordNames(word, variables, cwd, lineExpands) {
+    if (this.wordNamesHome(word, variables, cwd, lineExpands)) return "NAMZU_HOME";
+    if (this.wordNamesProfile(word, variables, cwd, lineExpands)) return "the browser profiles";
+    return null;
+  }
+  /**
+   * The Windows browser's profiles in a word, on the same spellings and
+   * directories as NAMZU_HOME. The root is known only by its last three
+   * segments, so a word with an unknown part is denied when its segments
+   * could still read `appdata/local/namzu` and one of them is spelled out,
+   * or when an unknown expansion is followed by a `namzu` segment.
+   */
+  wordNamesProfile(word, variables, cwd, lineExpands) {
+    for (const spelling of this.spell(word, variables, cwd)) {
+      const known = spellLocalAppData(spelling.known);
+      const rest = spellLocalAppData(spelling.rest);
+      const bases = isAbsolute(known) ? [""] : ["", ...cwd.dirs];
+      const inert = !/namzu|local|appdata|\.\.|[*?[$`{]/.test(known + rest);
+      for (const base of bases) {
+        if (inert && base !== "") {
+          if (namesProfile(base)) return true;
+          continue;
+        }
+        const at = /* @__PURE__ */ __name((text) => base === "" ? normalize(text) : join(base, text), "at");
+        if (spelling.stop === "end") {
+          const path = at(known);
+          if (namesProfile(path)) return true;
+          if (lineExpands && endsShortOfProfile(path)) return true;
+          continue;
+        }
+        if (mayNameProfile(at(`${known}*${rest}`))) return true;
+      }
+      if (spelling.stop === "unknown" && /(?:^|\/)namzu(?:\/|$)/.test(normalize(rest))) return true;
+    }
+    return false;
+  }
+  /** Whether text after an unknown expansion holds NAMZU_HOME's last segment as a path segment. */
+  restNamesHome(rest) {
+    let at = rest.indexOf(this.homeCore);
+    while (at >= 0) {
+      const before = at === 0 ? "" : rest[at - 1];
+      const after = rest[at + this.homeCore.length] ?? "";
+      if (/^[./\\]?$/.test(before) && !NAME_CHAR.test(after)) return true;
+      at = rest.indexOf(this.homeCore, at + 1);
+    }
+    return false;
+  }
+  wordNamesHome(word, variables, cwd, lineExpands) {
+    if (word.expands && /\$\{?[!#]?namzu_home(?![a-z0-9_])/i.test(word.value)) return true;
+    for (const spelling of this.spell(word, variables, cwd)) {
+      const { known } = spelling;
+      if (containsPath(normalize(known), this.home)) return true;
+      const bases = isAbsolute(known) ? [""] : cwd.dirs;
+      for (const base of bases) {
+        const path = base === "" ? normalize(known) : join(base, known);
+        if (spelling.stop === "end") {
+          if (this.inside(path)) return true;
+          if (lineExpands && path !== "/" && this.home.startsWith(path) && this.home[path.length] !== "/")
+            return true;
+          continue;
+        }
+        const slash = known.lastIndexOf("/");
+        const partial = known.slice(slash + 1);
+        const dir = slash < 0 ? base === "" ? null : base : base === "" ? normalize(known.slice(0, slash + 1) || "/") : join(base, known.slice(0, slash + 1));
+        if (dir === null) continue;
+        if (this.inside(dir)) return true;
+        const next = this.belowAncestor(dir);
+        if (next === null) continue;
+        if (partial === "") {
+          if (spelling.stop === "glob" && next.startsWith(".")) continue;
+          return true;
+        }
+        if (next.startsWith(partial)) return true;
+      }
+      if (spelling.stop !== "end" && this.homeCore.length >= 3 && this.restNamesHome(spelling.rest))
+        return true;
+    }
+    return false;
+  }
+  /**
+   * `find … -exec|-execdir|-ok|-okdir … ;|+`: the clause runs on every path
+   * `find` matches, substituted for `{}` — a placeholder no static reading
+   * can resolve. Refused when `{}` stands in that clause AND the search
+   * could plausibly reach a protected target: the root is unknown or is
+   * NAMZU_HOME itself or an ancestor of it (so `find` would recurse THROUGH
+   * it), a `-name`/`-iname`/`-path`/`-ipath` pattern could match NAMZU_HOME's
+   * own folder name, or the clause's own program is a tool that can stop or
+   * remove a service (`{}` there could name the scheduler's unit without
+   * ever spelling it in the line the floor can read).
+   */
+  findExecFinding(command, variables, cwd, dialect) {
+    const words = command.words;
+    const findAt = programPositions(command, dialect).map(
+      (position) => position.word && !position.word.expands && commandName(position.word.value) === "find" ? words.indexOf(position.word) : -1
+    ).find((index) => index >= 0);
+    if (findAt === void 0) return null;
+    const head = words[findAt];
+    const rootWords = [];
+    let i = findAt + 1;
+    while (i < words.length) {
+      const w = words[i];
+      if (!w.expands && (w.value.startsWith("-") || w.value === "(" || w.value === "!")) break;
+      rootWords.push(w);
+      i++;
+    }
+    const roots = rootWords.length > 0 ? rootWords : [{ text: ".", value: ".", expands: false, quoted: false, substitutes: false }];
+    const reachesHome = roots.some((root) => {
+      if (root.expands) return true;
+      for (const spelling of this.spell(root, variables, cwd)) {
+        if (spelling.stop !== "end") return true;
+        const bases = isAbsolute(spelling.known) ? [""] : cwd.dirs.length > 0 ? cwd.dirs : [""];
+        for (const base of bases) {
+          const path = base === "" ? normalize(spelling.known) : join(base, spelling.known);
+          if (this.inside(path) || this.belowAncestor(path) !== null) return true;
+        }
+      }
+      return false;
+    });
+    let filterMatchesHome = false;
+    for (let j = findAt; j < words.length; j++) {
+      const flag = words[j];
+      if (flag.expands || !/^-i?(?:name|path)$/.test(flag.value)) continue;
+      const pattern = words[j + 1];
+      if (!pattern || pattern.expands) continue;
+      if (this.homeSegments.some((seg) => mayBe(lower(pattern.value), seg.name))) {
+        filterMatchesHome = true;
+        break;
+      }
+    }
+    for (let j = findAt + 1; j < words.length; j++) {
+      const flag = words[j];
+      if (flag.expands || !/^-(?:exec|execdir|ok|okdir)$/.test(flag.value)) continue;
+      let k = j + 1;
+      let hasPlaceholder = false;
+      const clauseStart = k;
+      while (k < words.length) {
+        const w = words[k];
+        if (!w.expands && (w.value === ";" || w.value === "+")) break;
+        if (!w.expands) {
+          if (w.value.includes("{}")) hasPlaceholder = true;
+        }
+        k++;
+      }
+      const clauseCommand = {
+        ...command,
+        words: [head, flag, ...words.slice(clauseStart, k)],
+        assignments: 0
+      };
+      const toolIsSchedulerTool = programPositions(clauseCommand, dialect).slice(1).some(
+        (position) => position.unknown !== void 0 || position.word !== void 0 && SCHEDULER_EXEC_TOOLS.has(commandName(position.word.value))
+      );
+      if (hasPlaceholder && (reachesHome || filterMatchesHome || toolIsSchedulerTool)) {
+        const clauseText = words.slice(clauseStart, k).map((w) => w.text).join(" ");
+        const why = toolIsSchedulerTool ? "its clause\u2019s own program can stop or remove a service" : filterMatchesHome ? "a -name/-iname/-path/-ipath pattern could match NAMZU_HOME\u2019s own folder name" : "its search root is unknown, is NAMZU_HOME, or is an ancestor of it";
+        return {
+          reason: "find -exec reaches a protected target",
+          detail: `${shown(command.text)} runs \`${flag.value} ${clauseText}\` on whatever it finds, and ${why}; the floor cannot verify what {} will stand for`
+        };
+      }
+      j = k;
+    }
+    return null;
+  }
+};
+var SCHEDULER_EXEC_TOOLS = /* @__PURE__ */ new Set([
+  "systemctl",
+  "launchctl",
+  "schtasks",
+  "pkill",
+  "killall",
+  "busctl",
+  "dbus-send",
+  "gdbus"
+]);
+function writeTargets(command) {
+  const targets = [];
+  for (const r of command.redirections) {
+    if (r.operator === ">" || r.operator === ">>") targets.push(r.target);
+  }
+  const words = command.words;
+  const head = words[command.assignments];
+  if (!head || head.expands) return targets;
+  const name = commandName(head.value);
+  const rest = words.slice(command.assignments + 1).filter((w) => w.expands || !w.value.startsWith("-"));
+  if (name === "tee") targets.push(...rest);
+  else if (name === "cp" || name === "mv") {
+    const last = rest.at(-1);
+    if (last) targets.push(last);
+  }
+  return targets;
+}
+__name(writeTargets, "writeTargets");
+function executedPath(command) {
+  const words = command.words;
+  const head = words[command.assignments];
+  if (!head || head.expands) return null;
+  const name = commandName(head.value);
+  if (name === "sh" || name === "bash" || name === "." || name === "source") {
+    const rest = words.slice(command.assignments + 1).filter((w) => w.expands || !w.value.startsWith("-"));
+    return rest[0] ?? null;
+  }
+  if (!head.expands && head.value.includes("/")) return head;
+  return null;
+}
+__name(executedPath, "executedPath");
+function assignedValue(word) {
+  const text = word.text.replace(/\\\n/g, "");
+  const match = /^([A-Za-z_][A-Za-z0-9_]*)(\+?)=/.exec(text);
+  if (!match || !word.value.startsWith(match[0])) return null;
+  return {
+    name: match[1],
+    append: match[2] === "+",
+    word: {
+      text: text.slice(match[0].length),
+      value: word.value.slice(match[0].length),
+      expands: word.expands,
+      quoted: word.quoted,
+      substitutes: word.substitutes
+    }
+  };
+}
+__name(assignedValue, "assignedValue");
+function localAppData(assigned) {
+  return {
+    values: [LOCAL_APP_DATA, ...assigned?.values ?? []],
+    unknown: assigned?.unknown ?? false
+  };
+}
+__name(localAppData, "localAppData");
+function textNamesProfile(text) {
+  const plain = lower(text);
+  const unquoted = plain.replace(/\\\n/g, "").replace(/\$(?=["'])/g, "").replace(/["']/g, "");
+  for (const variant of [plain, unquoted])
+    if (namesProfile(normalize(spellLocalAppData(variant)))) return true;
+  return false;
+}
+__name(textNamesProfile, "textNamesProfile");
+var EXPORTING = /* @__PURE__ */ new Set([
+  "export",
+  "declare",
+  "typeset",
+  "local",
+  "readonly",
+  "set",
+  "env",
+  "printenv"
+]);
+function redirectsTo(redirection) {
+  return redirection.operator !== "<<" && redirection.operator !== "<<-";
+}
+__name(redirectsTo, "redirectsTo");
+var Directories = class {
+  static {
+    __name(this, "Directories");
+  }
+  dirs;
+  unknown = false;
+  constructor(folders) {
+    this.dirs = new Set(folders);
+  }
+  /** Every directory known to be possible, and whether others are. */
+  current() {
+    return { dirs: [...this.dirs], unknown: this.unknown };
+  }
+  after(command, spell, userHome) {
+    const words = command.words.slice(command.assignments);
+    let at = 0;
+    while (at < words.length && !words[at]?.expands && ["builtin", "command"].includes(words[at]?.value ?? ""))
+      at++;
+    const head = words[at];
+    if (!head || head.expands) return;
+    if (head.value === "popd") {
+      this.unknown = true;
+      return;
+    }
+    if (head.value !== "cd" && head.value !== "pushd") return;
+    let target = words.slice(at + 1).find((w) => w.expands || !/^-[LPe@]+$/.test(w.value));
+    if (target && !target.expands && target.value === "--")
+      target = words[words.indexOf(target) + 1];
+    if (!target) {
+      this.dirs.add(userHome);
+      return;
+    }
+    if (!target.expands && (target.value === "-" || /^[+-]\d+$/.test(target.value))) {
+      this.unknown = true;
+      return;
+    }
+    const from = [...this.dirs];
+    for (const spelling of spell(target)) {
+      if (spelling.stop !== "end") {
+        this.unknown = true;
+        continue;
+      }
+      for (const dir of isAbsolute(spelling.known) ? ["/"] : from) {
+        if (this.dirs.size >= 16) {
+          this.unknown = true;
+          return;
+        }
+        this.dirs.add(join(dir, spelling.known));
+      }
+    }
+  }
+};
+var MAX_TEXT_DEPTH = 3;
+function fedTexts(readings) {
+  const out = /* @__PURE__ */ new Set();
+  for (const reading of readings) {
+    for (const command of reading.commands)
+      for (const word of command.words) {
+        const text = word.expands ? unlocale(word.value) : word.value;
+        if (/\s|;|&|\|/.test(text)) out.add(text);
+      }
+    for (const redirection of reading.redirections) {
+      if (redirection.body !== void 0) out.add(redirection.body);
+      if (redirection.operator === "<<<") out.add(redirection.target.value);
+    }
+  }
+  return [...out];
+}
+__name(fedTexts, "fedTexts");
+function unreadCommand(command) {
+  const head = command.words[command.assignments];
+  if (head?.expands) return `the command\u2019s name ${shown(head.text)} expands at runtime`;
+  return runsUnreadText(command);
+}
+__name(unreadCommand, "unreadCommand");
+function whereIn(readings, token) {
+  const holds = typeof token === "string" ? (text) => text.includes(lower(token)) : (text) => token.test(text);
+  for (const reading of readings)
+    for (const command of reading.commands)
+      for (const word of command.words)
+        if (holds(lower(word.value))) return `, in the argument ${shown(word.value)}`;
+  return "";
+}
+__name(whereIn, "whereIn");
+
+// src/schedule/policy.ts
+var NETWORK_TOOLS = ["web_fetch", "web_search"];
+var BROWSER_TOOLS = [BROWSER_TOOL_NAME, BROWSER_ACT_TOOL_NAME];
+var GRANT_LEVELS = ["read", "ask", "act"];
+var WRITE_TOOLS = ["write", "edit", "bash"];
+var READ_ONLY = {
+  read: "allow",
+  glob: "allow",
+  grep: "allow",
+  ls: "allow",
+  write: "deny",
+  edit: "deny",
+  bash: "deny",
+  web_fetch: "deny",
+  web_search: "deny"
+};
+var PRESETS = {
+  "read-only": { rules: READ_ONLY, unmatched: "deny" },
+  "edit-in-folder": {
+    rules: { ...READ_ONLY, write: "allow", edit: "allow", bash: "ask" },
+    unmatched: "park"
+  }
+};
+function isPresetName(value) {
+  return value === "read-only" || value === "edit-in-folder";
+}
+__name(isPresetName, "isPresetName");
+function checkBrowserGrant(input, unmatched) {
+  if (!isBrowserProfileName(input.profile)) {
+    throw new Error(
+      `"${input.profile}" is not a browser profile name: lowercase letters, digits and single hyphens.`
+    );
+  }
+  const entries = Object.entries(input.sites);
+  if (entries.length === 0) {
+    throw new Error(
+      "A browser grant needs at least one site, e.g. --browser-site https://github.com=read."
+    );
+  }
+  const sites = {};
+  for (const [raw, level] of entries) {
+    if (raw.trim() === "*") {
+      throw new Error(
+        'A scheduled job cannot grant every site ("*"); every site it does not list is denied. List each site.'
+      );
+    }
+    if (!GRANT_LEVELS.includes(level)) {
+      throw new Error(`browser site ${raw}: "${level}" is not read, ask or act.`);
+    }
+    const key = canonicalBrowserSiteKey(raw);
+    if (!key.ok) throw new Error(`browser site ${raw}: ${key.reason}`);
+    const existing = sites[key.key];
+    if (existing !== void 0 && existing !== level) {
+      throw new Error(`browser site ${key.key} is listed twice, as ${existing} and ${level}.`);
+    }
+    sites[key.key] = level;
+  }
+  if (unmatched !== "park" && Object.values(sites).includes("ask")) {
+    throw new Error(
+      `A browser site at "ask" waits for you, which needs unmatched: park; with ${unmatched} it would be ${unmatched === "deny" ? "refused every time" : "approved without asking"}. Use read or act, or --unmatched park.`
+    );
+  }
+  return {
+    profile: input.profile,
+    sites,
+    ...input.headed ? { headed: true } : {}
+  };
+}
+__name(checkBrowserGrant, "checkBrowserGrant");
+function expandPermissions(input) {
+  if (!input.preset && !input.rules && !input.browser) {
+    throw new Error(
+      "A permission set needs a preset (read-only, edit-in-folder), rules or a browser grant; there is no default."
+    );
+  }
+  const named = BROWSER_TOOLS.filter((tool) => input.rules?.[tool] !== void 0);
+  if (named.length > 0) {
+    throw new Error(
+      `The rules name ${named.join(" and ")}; a scheduled job reaches the browser only through a browser grant (--browser <profile> --browser-site <site>=read|ask|act).`
+    );
+  }
+  const preset = input.preset ? PRESETS[input.preset] : void 0;
+  const unmatched = input.unmatched ?? preset?.unmatched;
+  if (!unmatched) {
+    throw new Error("unmatched is required: park (wait for the operator), deny, or allow.");
+  }
+  const rules = { ...preset?.rules ?? {}, ...input.rules ?? {} };
+  const compiled = compilePermissions(rules);
+  if (compiled.diagnostics.length > 0) {
+    throw new Error(
+      `The permission rules do not compile: ${compiled.diagnostics.map(describeDiagnostic).join("; ")}`
+    );
+  }
+  const browser = input.browser ? checkBrowserGrant(input.browser, unmatched) : void 0;
+  return {
+    unmatched,
+    execution: input.execution ?? "host",
+    rules,
+    ...input.additionalDirectories && input.additionalDirectories.length > 0 ? { additionalDirectories: [...input.additionalDirectories] } : {},
+    preset: input.preset && !input.rules ? input.preset : "custom",
+    ...browser ? { browser } : {}
+  };
+}
+__name(expandPermissions, "expandPermissions");
+function describeDiagnostic(d) {
+  return `${d.pattern ? `${d.tool}."${d.pattern}"` : d.tool}: ${d.message}`;
+}
+__name(describeDiagnostic, "describeDiagnostic");
+function effectsOf(permission) {
+  if (permission === void 0) return [];
+  if (isPermissionEffect(permission)) return [permission];
+  return Object.values(permission).filter(isPermissionEffect);
+}
+__name(effectsOf, "effectsOf");
+function allowsNetwork(set) {
+  return set.browser !== void 0 || NETWORK_TOOLS.some((t) => effectsOf(set.rules[t]).some((e) => e !== "deny"));
+}
+__name(allowsNetwork, "allowsNetwork");
+function allowsCommands(set) {
+  const effects = effectsOf(set.rules.bash);
+  return effects.length > 0 ? effects.some((e) => e !== "deny") : set.unmatched !== "deny";
+}
+__name(allowsCommands, "allowsCommands");
+function allowsWrites(set) {
+  if (set.unmatched !== "deny") return true;
+  return WRITE_TOOLS.some((t) => effectsOf(set.rules[t]).some((e) => e !== "deny"));
+}
+__name(allowsWrites, "allowsWrites");
+function denialsOf(table) {
+  const out = {};
+  for (const [tool, permission] of Object.entries(table)) {
+    if (permission === "deny") out[tool] = "deny";
+    else if (permission && typeof permission === "object") {
+      const denied = Object.fromEntries(
+        Object.entries(permission).filter(([, effect]) => effect === "deny")
+      );
+      if (Object.keys(denied).length > 0) out[tool] = denied;
+    }
+  }
+  return out;
+}
+__name(denialsOf, "denialsOf");
+function scheduledRunFloor(namzuHome, userHome = homedir(), folders = []) {
+  return [scheduledRunFloorRule({ namzuHome, userHome, folders })];
+}
+__name(scheduledRunFloor, "scheduledRunFloor");
+function modeFor(unmatched) {
+  return unmatched === "park" ? "prompt" : unmatched === "deny" ? "strict" : "auto";
+}
+__name(modeFor, "modeFor");
+function lineFor(tool, permission) {
+  if (isPermissionEffect(permission)) return [`${tool}: ${permission}`];
+  return Object.entries(permission).map(([pattern, effect]) => `${tool} "${pattern}": ${effect}`);
+}
+__name(lineFor, "lineFor");
+function compileJobPolicy(set, options) {
+  const diagnostics = [];
+  const configDenies = [];
+  const denyLines = [];
+  for (const layer of options.layers) {
+    const denied = denialsOf(layer.permissions);
+    const compiled = compilePermissions(denied);
+    configDenies.push(...compiled.rules);
+    for (const d of compiled.diagnostics)
+      diagnostics.push(`${layer.path}: ${describeDiagnostic(d)}`);
+    for (const [tool, permission] of Object.entries(denied))
+      for (const line of lineFor(tool, permission)) denyLines.push(`${line} (from ${layer.path})`);
+  }
+  const own = compilePermissions(set.rules);
+  for (const d of own.diagnostics) diagnostics.push(`job: ${describeDiagnostic(d)}`);
+  const siteDenies = options.layers.flatMap(
+    (layer) => (layer.browserDenies ?? []).map((site) => ({ site, path: layer.path }))
+  );
+  const browser = set.browser ? compileBrowserGrant(set.browser, siteDenies) : void 0;
+  if (browser) diagnostics.push(...browser.diagnostics.map((d) => `job: ${d}`));
+  const networkDenied = [
+    ...NETWORK_TOOLS.filter((t) => set.rules[t] === void 0),
+    ...BROWSER_TOOLS
+  ];
+  const rules = [
+    ...scheduledRunFloor(
+      options.namzuHome,
+      homedir(),
+      options.folder ? [options.folder.path, options.folder.canonical] : []
+    ),
+    ...configDenies,
+    ...own.rules,
+    ...browser?.rules ?? [],
+    { type: "deny_by_name", toolNames: [...networkDenied] }
+  ];
+  const lines = [
+    "dangerous commands (rm -rf /, mkfs, curl | sh, sudo \u2026): deny, always",
+    `the scheduler\u2019s commands (but ${READ_ONLY_VERBS.join(", ")}), and anything naming NAMZU_HOME or the browser\u2019s profiles: deny`,
+    ...denyLines,
+    ...Object.entries(set.rules).flatMap(([tool, permission]) => lineFor(tool, permission)),
+    ...set.browser ? browserGrantLines(set.browser, siteDenies) : [],
+    `anything else: ${set.unmatched === "park" ? "wait for the operator" : set.unmatched === "deny" ? "deny" : "run without asking"}`
+  ];
+  return {
+    rules,
+    diagnostics,
+    mode: modeFor(set.unmatched),
+    network: allowsNetwork(set),
+    writes: allowsWrites(set),
+    lines
+  };
+}
+__name(compileJobPolicy, "compileJobPolicy");
+function compileScriptCheckPolicy(set, options) {
+  const diagnostics = [];
+  const configDenies = [];
+  for (const layer of options.layers) {
+    const compiled = compilePermissions(denialsOf(layer.permissions));
+    configDenies.push(...compiled.rules);
+    for (const d of compiled.diagnostics)
+      diagnostics.push(`${layer.path}: ${describeDiagnostic(d)}`);
+  }
+  const ownDenies = compilePermissions(denialsOf(set.rules));
+  for (const d of ownDenies.diagnostics) diagnostics.push(`job: ${describeDiagnostic(d)}`);
+  return {
+    floorRules: scheduledRunFloor(
+      options.namzuHome,
+      homedir(),
+      options.folder ? [options.folder.path, options.folder.canonical] : []
+    ),
+    denyRules: [...configDenies, ...ownDenies.rules],
+    diagnostics
+  };
+}
+__name(compileScriptCheckPolicy, "compileScriptCheckPolicy");
+var GRANT_WORDS = {
+  read: "open and read, never change",
+  ask: "open and read; each change waits for you",
+  act: "open, read and change without asking"
+};
+function compileBrowserGrant(grant, denies = []) {
+  const sites = {
+    ...grant.sites,
+    "*": "deny"
+  };
+  for (const { site } of denies) sites[site] = "deny";
+  const compiled = compileBrowserSites(sites);
+  return {
+    rules: [
+      ...compiled.rules,
+      {
+        type: "argument_pattern",
+        toolNames: [BROWSER_TOOL_NAME],
+        argument: "action",
+        pattern: "^(?:back|forward|reload)$",
+        decision: "allow"
+      }
+    ],
+    diagnostics: compiled.diagnostics
+  };
+}
+__name(compileBrowserGrant, "compileBrowserGrant");
+function browserGrantLines(grant, denies = []) {
+  const denied = new Map(denies.map((d) => [d.site, d.path]));
+  return [
+    `browser: profile ${grant.profile}, ${grant.headed ? "in a visible window" : "no window"}`,
+    ...Object.entries(grant.sites).map(
+      ([site, level]) => denied.has(site) ? `browser ${site}: deny (from ${denied.get(site)})` : `browser ${site}: ${GRANT_WORDS[level]}`
+    ),
+    "browser any other site: deny",
+    "browser sign-in, CAPTCHA or a code: the run stops and tells you"
+  ];
+}
+__name(browserGrantLines, "browserGrantLines");
+var STRICT_UNREACHABLE = [
+  "Agent",
+  "send_message",
+  "cancel_agent",
+  "wait_for_task",
+  "agent_task_list",
+  "agent_models",
+  "save_memory",
+  "update_memory",
+  "delete_memory"
+];
+var JOB_TOOLS = ["job", "wait_for_job"];
+function mayReach(rule, tool) {
+  switch (rule.type) {
+    case "deny_by_name":
+    case "deny_dangerous_patterns":
+      return false;
+    case "allow_by_name":
+      return rule.toolNames.includes(tool);
+    case "argument_pattern":
+      return rule.decision !== "deny" && rule.toolNames.includes(tool);
+    case "custom_pattern": {
+      if (rule.decision === "deny") return false;
+      const named = /^\^([A-Za-z0-9_-]+)(?![A-Za-z0-9_-])/.exec(rule.pattern);
+      return named ? named[1] === tool : true;
+    }
+    case "predicate":
+      return !isFloorRule(rule);
+    default:
+      return true;
+  }
+}
+__name(mayReach, "mayReach");
+function withheldTools(set, policy) {
+  const out = /* @__PURE__ */ new Set();
+  policy.rules.forEach((rule, index) => {
+    if (rule.type !== "deny_by_name") return;
+    const earlier = policy.rules.slice(0, index);
+    for (const tool of rule.toolNames) if (!earlier.some((r) => mayReach(r, tool))) out.add(tool);
+  });
+  if (set.unmatched === "deny") {
+    for (const tool of STRICT_UNREACHABLE)
+      if (!policy.rules.some((r) => mayReach(r, tool))) out.add(tool);
+  }
+  if (out.has("bash")) for (const tool of JOB_TOOLS) out.add(tool);
+  return [...out].sort();
+}
+__name(withheldTools, "withheldTools");
+
+export {
+  isPresetName,
+  expandPermissions,
+  allowsCommands,
+  allowsWrites,
+  compileJobPolicy,
+  compileScriptCheckPolicy,
+  withheldTools
+};
+//# sourceMappingURL=chunk-EIYM6TY7.js.map