@node9/proxy 2.46.1 → 2.47.0

package/dist/index.js

@@ -667,6 +667,62 @@ function resolveCheckMap(settings) {
   for (const c of CHECKS) out[c.id] = checkValue(settings, c.id);
   return out;
 }
+function isGoNode(v) {
+  return v !== null && typeof v === "object" && typeof v.Pos === "function";
+}
+function toPlainTree(goNode) {
+  const kind = syntax.NodeType(goNode);
+  const out = { kind, pos: goNode.Pos().Offset(), end: goNode.End().Offset() };
+  const spec = KINDS[kind];
+  if (!spec) {
+    unknownKinds.add(kind);
+    return out;
+  }
+  convertFields(goNode, spec, out, kind);
+  return out;
+}
+function convertFields(goNode, spec, out, kind) {
+  for (const f of spec.scalars ?? []) out[f] = goNode[f];
+  for (const f of spec.nodes ?? []) {
+    const v = goNode[f];
+    if (v === void 0 || v === null) {
+      out[f] = null;
+    } else if (Array.isArray(v)) {
+      out[f] = v.map((c) => isGoNode(c) ? toPlainTree(c) : c);
+    } else if (isGoNode(v)) {
+      out[f] = toPlainTree(v);
+    } else if (typeof v === "object" && STRUCTS[`${kind}.${f}`]) {
+      const sub = { struct: `${kind}.${f}` };
+      convertFields(v, STRUCTS[`${kind}.${f}`], sub, `${kind}.${f}`);
+      out[f] = sub;
+    } else {
+      out[f] = v;
+    }
+  }
+}
+function childrenOf(n) {
+  const spec = n.kind ? KINDS[n.kind] : STRUCTS[n.struct];
+  if (!spec?.nodes) return [];
+  const out = [];
+  for (const f of spec.nodes) {
+    if (spec.notWalked?.includes(f)) continue;
+    const v = n[f];
+    if (!v) continue;
+    if (Array.isArray(v)) {
+      for (const c of v) if (c) out.push(c);
+    } else if (v.kind) {
+      out.push(v);
+    } else if (v.struct) {
+      out.push(...childrenOf(v));
+    }
+  }
+  return out;
+}
+function walk(root, fn) {
+  if (!root) return;
+  if (!fn(root)) return;
+  for (const c of childrenOf(root)) walk(c, fn);
+}
 function isInvisibleChar(char) {
   return INVISIBLE_ONE.test(char);
 }
@@ -822,7 +878,7 @@ function judgeInlineCode(language, code, isProtected) {
 }
 function isCatHeredocOrLit(part) {
   if (!part) return false;
-  const t = syntax.NodeType(part);
+  const t = part.kind;
   if (t === "Lit") return true;
   if (t !== "CmdSubst") return false;
   const stmts = part.Stmts || [];
@@ -832,9 +888,9 @@ function isCatHeredocOrLit(part) {
   const hasHeredoc = redirs.some((r) => r && r.Hdoc);
   if (!hasHeredoc) return false;
   const cmd = stmt.Cmd;
-  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return false;
+  if (!cmd || cmd.kind !== "CallExpr") return false;
   const firstArg = cmd.Args?.[0]?.Parts || [];
-  if (firstArg.length !== 1 || syntax.NodeType(firstArg[0]) !== "Lit") return false;
+  if (firstArg.length !== 1 || firstArg[0].kind !== "Lit") return false;
   return (firstArg[0].Value || "").toLowerCase() === "cat";
 }
 function parseShared(command) {
@@ -846,7 +902,7 @@ function parseShared(command) {
   }
   let parsed;
   try {
-    parsed = sharedParser.Parse(command, "cmd");
+    parsed = toPlainTree(sharedParser.Parse(command, "cmd"));
   } catch {
     parsed = PARSE_FAIL;
   }
@@ -907,10 +963,10 @@ function fileAccessViewImpl(command) {
   const at = (byteOffset) => toCharIndex === null ? byteOffset : toCharIndex(byteOffset);
   const edits = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       const words = args.map((a) => resolveWordLiteral(a));
       const head = unwrapCommandHead(words);
@@ -922,8 +978,8 @@ function fileAccessViewImpl(command) {
         if (!PROGRAM_DIR.test(word)) continue;
         const name = word.split(/[\\/]/).pop() ?? "";
         if (!name) continue;
-        const s = at(args[i].Pos().Offset());
-        const e = at(args[i].End().Offset());
+        const s = at(args[i].pos);
+        const e = at(args[i].end);
         if (s < 0 || e < 0) continue;
         edits.push([s, e, name]);
       }
@@ -951,10 +1007,10 @@ function literalPayloadsOf(command, depth) {
   if (f === PARSE_FAIL) return [];
   const out = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || out.length >= MAX_READING_PAYLOADS) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const payload = literalShellPayload(words, baseWord(words[0]));
@@ -974,23 +1030,23 @@ function foldCommandWords(reading) {
   const at = (byteOffset) => toCharIndex === null ? byteOffset : toCharIndex(byteOffset);
   const edits = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       const words = args.map((a) => resolveWordLiteral(a));
       const folded = words.map((w) => w === null ? null : foldHomoglyphs(w));
       const head = unwrapCommandHead(folded);
       for (let i = 0; i <= head && i < args.length; i++) {
         const parts = args[i].Parts || [];
-        if (parts.length !== 1 || syntax.NodeType(parts[0]) !== "Lit") continue;
+        if (parts.length !== 1 || parts[0].kind !== "Lit") continue;
         const value = parts[0].Value ?? "";
         const word = folded[i];
         if (word === null || word === value || !/[^\x00-\x7f]/.test(value)) continue;
         if (!/^[A-Za-z0-9._/-]+$/.test(word)) continue;
-        const s = at(args[i].Pos().Offset());
-        const e = at(args[i].End().Offset());
+        const s = at(args[i].pos);
+        const e = at(args[i].end);
         if (s < 0 || e < 0) continue;
         edits.push([s, e, word]);
       }
@@ -1027,10 +1083,10 @@ function interpreterHeredocSpans(f, at) {
   const stmts = f?.Stmts || [];
   const candidates = [];
   let unsafe = false;
-  syntax.Walk(f, (node) => {
+  walk(f, (node) => {
     if (!node || unsafe) return false;
     const n = node;
-    const t = syntax.NodeType(n);
+    const t = n.kind;
     if (t === "FuncDecl") {
       unsafe = true;
       return false;
@@ -1050,7 +1106,7 @@ function interpreterHeredocSpans(f, at) {
   });
   if (unsafe) return [];
   for (const st of stmts) {
-    if (!st?.Cmd || syntax.NodeType(st.Cmd) !== "CallExpr") continue;
+    if (!st?.Cmd || st.Cmd.kind !== "CallExpr") continue;
     const words = (st.Cmd.Args || []).map((a) => resolveWordLiteral(a));
     const name = (words[0] ?? "").toLowerCase();
     if (!STDIN_CODE_INTERPRETERS.test(name)) continue;
@@ -1065,8 +1121,8 @@ function interpreterHeredocSpans(f, at) {
     if (stdin.length !== 1 || others > 0) continue;
     const r = stdin[0];
     if (heredocText(r.Hdoc) === null) continue;
-    const hs = at(r.Hdoc.Pos().Offset());
-    const he = at(r.Hdoc.End().Offset());
+    const hs = at(r.Hdoc.pos);
+    const he = at(r.Hdoc.end);
     if (hs < 0 || he < 0 || he <= hs) continue;
     spans.push([hs, he]);
   }
@@ -1086,24 +1142,24 @@ function normalizeCommandForPolicyImpl(command, codeBodies) {
       strips.push([hs, he]);
       msgSpans.add(`${hs}:${he}`);
     }
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       for (let i = 0; i < args.length - 1; i++) {
         const argParts = args[i].Parts || [];
-        if (argParts.length !== 1 || syntax.NodeType(argParts[0]) !== "Lit") continue;
+        if (argParts.length !== 1 || argParts[0].kind !== "Lit") continue;
         const flagVal = argParts[0].Value || "";
         if (!MESSAGE_FLAGS.has(flagVal.toLowerCase())) continue;
         const next = args[i + 1];
         const nextParts = next.Parts || [];
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
-        const nt = syntax.NodeType(quotedNode);
+        const nt = quotedNode.kind;
         const markStrip = () => {
-          const s = at(next.Pos().Offset());
-          const e = at(next.End().Offset());
+          const s = at(next.pos);
+          const e = at(next.end);
           if (s < 0 || e < 0) return;
           strips.push([s, e]);
           msgSpans.add(`${s}:${e}`);
@@ -1112,7 +1168,7 @@ function normalizeCommandForPolicyImpl(command, codeBodies) {
           markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
-          const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
+          const allLit = innerParts.length === 0 || innerParts.every((p) => p.kind === "Lit");
           if (allLit) {
             markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
@@ -1121,8 +1177,8 @@ function normalizeCommandForPolicyImpl(command, codeBodies) {
         }
       }
       for (const arg of args) {
-        const s = at(arg.Pos().Offset());
-        const e = at(arg.End().Offset());
+        const s = at(arg.pos);
+        const e = at(arg.end);
         if (s < 0 || e < 0) continue;
         if (msgSpans.has(`${s}:${e}`)) continue;
         const resolved = resolveWordLiteral(arg);
@@ -1162,10 +1218,10 @@ function scanArgsForDynamicExec(args, startIdx) {
   let hasParamExp = false;
   let hasCurl = false;
   for (let i = startIdx; i < args.length; i++) {
-    syntax.Walk(args[i], (inner) => {
+    walk(args[i], (inner) => {
       if (!inner) return false;
       const inn = inner;
-      const it = syntax.NodeType(inn);
+      const it = inn.kind;
       if (it === "CmdSubst") hasCmdSubst = true;
       if (it === "ParamExp") hasParamExp = true;
       if (it === "Lit" && DOWNLOAD_CMDS.has(inn.Value?.toLowerCase())) hasCurl = true;
@@ -1178,15 +1234,16 @@ function scanArgsForDynamicExec(args, startIdx) {
 }
 function detectDangerousShellExec(command) {
   try {
-    const f = sharedParser.Parse(command, "cmd");
+    const f = parseShared(command);
+    if (f === PARSE_FAIL) return null;
     let result = null;
     const assigned = assignedNames(f);
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || result === "block") return false;
       const n = node;
-      if (syntax.NodeType(n) === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
+      if (n.kind === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
         const call = n.Y.Cmd;
-        if (call && syntax.NodeType(call) === "CallExpr") {
+        if (call && call.kind === "CallExpr") {
           const words = (call.Args || []).map((a) => resolveWordLiteral(a));
           const head2 = unwrapCommandHead(words);
           const name = (words[head2] ?? "").split("/").pop() ?? "";
@@ -1199,7 +1256,7 @@ function detectDangerousShellExec(command) {
             result = "review";
         }
       }
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       if (args.length === 0) return true;
       const headWords = args.map(
@@ -1210,7 +1267,7 @@ function detectDangerousShellExec(command) {
       if (!lookup && (opaqueExecutable(args[0], assigned) || opaqueExecutable(args[head], assigned)))
         result = "review";
       const firstParts = args[0].Parts || [];
-      if (firstParts.length !== 1 || syntax.NodeType(firstParts[0]) !== "Lit") return true;
+      if (firstParts.length !== 1 || firstParts[0].kind !== "Lit") return true;
       const cmdName = firstParts[0].Value?.toLowerCase() ?? "";
       if (cmdName === "eval") {
         const v = scanArgsForDynamicExec(args, 1);
@@ -1218,7 +1275,7 @@ function detectDangerousShellExec(command) {
       } else if (SHELL_INTERPRETERS.has(cmdName)) {
         for (let i = 1; i < args.length - 1; i++) {
           const flagParts = args[i].Parts || [];
-          if (flagParts.length !== 1 || syntax.NodeType(flagParts[0]) !== "Lit" || flagParts[0].Value !== "-c")
+          if (flagParts.length !== 1 || flagParts[0].kind !== "Lit" || flagParts[0].Value !== "-c")
             continue;
           const v = scanArgsForDynamicExec(args, i + 1);
           if (v === "block" || v === "review" && result === null) result = v;
@@ -1242,8 +1299,7 @@ function isDefaultExpansion(part) {
 }
 function lookupSubstitution(part) {
   const stmts = part.Stmts ?? [];
-  if (stmts.length !== 1 || !stmts[0].Cmd || syntax.NodeType(stmts[0].Cmd) !== "CallExpr")
-    return null;
+  if (stmts.length !== 1 || !stmts[0].Cmd || stmts[0].Cmd.kind !== "CallExpr") return null;
   const words = (stmts[0].Cmd.Args ?? []).map((a) => resolveWordLiteral(a));
   if (words.some((w) => w === null)) return null;
   if (words.length === 2 && words[0] === "which") return words[1];
@@ -1253,9 +1309,9 @@ function lookupSubstitution(part) {
 }
 function assignedNames(f) {
   const names = /* @__PURE__ */ new Set();
-  syntax.Walk(f, (node) => {
+  walk(f, (node) => {
     if (!node) return false;
-    const kind = syntax.NodeType(node);
+    const kind = node.kind;
     if (kind === "Assign" && node.Name?.Value) names.add(node.Name.Value);
     if (kind === "ForClause" && node.Loop?.Name?.Value) names.add(node.Loop.Name.Value);
     if (kind === "CallExpr") {
@@ -1270,7 +1326,7 @@ function assignedNames(f) {
 }
 function executableParts(word, assigned, quoted = false) {
   return (word?.Parts ?? []).flatMap((part) => {
-    const kind = syntax.NodeType(part);
+    const kind = part.kind;
     if (kind === "DblQuoted") return executableParts(part, assigned, true);
     if (kind === "Lit") return [{ kind: "Lit", value: part.Value ?? "", quoted }];
     if (kind === "SglQuoted")
@@ -1338,10 +1394,10 @@ function chmodHasOpenPermMode(command) {
   if (f === PARSE_FAIL) return false;
   let found = false;
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || found) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const name = (words[0] ?? "").toLowerCase();
@@ -1394,11 +1450,11 @@ function redirStdinOps() {
 }
 function deriveBinaryOp(sample) {
   try {
-    const f = sharedParser.Parse(sample, "cmd");
+    const f = toPlainTree(sharedParser.Parse(sample, "cmd"));
     let op = -1;
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       const n = node;
-      if (n && syntax.NodeType(n) === "BinaryCmd" && op < 0) op = n.Op;
+      if (n && n.kind === "BinaryCmd" && op < 0) op = n.Op;
       return true;
     });
     return op;
@@ -1472,7 +1528,7 @@ function heredocText(word) {
   const parts = word?.Parts ?? [];
   let out = "";
   for (const p of parts) {
-    if (syntax.NodeType(p) !== "Lit") return null;
+    if (p.kind !== "Lit") return null;
     out += p.Value ?? "";
   }
   return out;
@@ -1508,7 +1564,7 @@ function attachedCode(interp, flag) {
 }
 function inlineExecCall(stmt, pipeFed) {
   const cmd = stmt?.Cmd;
-  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return null;
+  if (!cmd || cmd.kind !== "CallExpr") return null;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
   if (words.length === 0) return null;
   const headIdx = unwrapCommandHead(words);
@@ -1589,10 +1645,10 @@ function shellPayloadNeedsReview(payload) {
   let review = false;
   payloadNesting++;
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || review) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const h = unwrapCommandHead(words);
@@ -1626,10 +1682,10 @@ function inlineExecCalls(command) {
   if (f === PARSE_FAIL) return PARSE_FAIL;
   const calls = [];
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || calls.length >= MAX_INLINE_CALLS) return false;
       const n = node;
-      const t = syntax.NodeType(n);
+      const t = n.kind;
       if (t === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
         const call = inlineExecCall(n.Y, true);
         if (call) calls.push(call);
@@ -1764,7 +1820,7 @@ function shellScriptOperands(command) {
     walkWithCalls(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const callArgs = n.Args || [];
       if (callArgs.length === 0) return true;
       const words = callArgs.map((a) => resolveWordLiteral(a));
@@ -1800,7 +1856,7 @@ function shellScriptOperands(command) {
 }
 function windowsDrivePathSpelling(word) {
   const parts = word?.Parts || [];
-  if (parts.length === 0 || !parts.every((p) => syntax.NodeType(p) === "Lit")) return null;
+  if (parts.length === 0 || !parts.every((p) => p.kind === "Lit")) return null;
   const raw = parts.map((p) => p.Value ?? "").join("");
   return /^[A-Za-z]:\\[^\s'"$`]*$/.test(raw) ? raw : null;
 }
@@ -1838,15 +1894,15 @@ function recordTopLevelAssignments(f) {
 }
 function probeBinOp(src) {
   try {
-    const cmd = syntax.NewParser().Parse(src, "probe")?.Stmts?.[0]?.Cmd;
-    if (cmd && syntax.NodeType(cmd) === "BinaryCmd") return cmd.Op;
+    const cmd = toPlainTree(syntax2.NewParser().Parse(src, "probe"))?.Stmts?.[0]?.Cmd;
+    if (cmd && cmd.kind === "BinaryCmd") return cmd.Op;
   } catch {
   }
   return null;
 }
 function recordTopLevelStmt(stmt) {
   if (!stmt || !stmt.Cmd) return false;
-  const t = syntax.NodeType(stmt.Cmd);
+  const t = stmt.Cmd.kind;
   if (t === "BinaryCmd") {
     if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
     if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
@@ -1856,7 +1912,7 @@ function recordTopLevelStmt(stmt) {
   if (t !== "CallExpr" && t !== "DeclClause") return false;
   let at = 0;
   try {
-    at = stmt.Pos().Offset();
+    at = stmt.pos;
   } catch {
     at = 0;
   }
@@ -1867,14 +1923,14 @@ function recordTopLevelStmt(stmt) {
 }
 function recordAssignments(n, at) {
   if (!assignmentTable) return;
-  const t = syntax.NodeType(n);
+  const t = n.kind;
   let assigns = [];
   if (t === "CallExpr") {
     if ((n.Args || []).length > 0) return;
     assigns = n.Assigns || [];
   } else if (t === "DeclClause") {
     if (!ASSIGNMENT_HEADS.has(n.Variant?.Value ?? "")) return;
-    assigns = (n.Args || []).filter((a) => syntax.NodeType(a) === "Assign");
+    assigns = (n.Args || []).filter((a) => a.kind === "Assign");
   } else return;
   for (const a of assigns) {
     const name = a?.Name?.Value;
@@ -1883,13 +1939,13 @@ function recordAssignments(n, at) {
   }
 }
 function resolveTrivialSubst(part) {
-  if (syntax.NodeType(part) !== "CmdSubst") return void 0;
+  if (part.kind !== "CmdSubst") return void 0;
   const stmts = part.Stmts || [];
   if (stmts.length !== 1) return void 0;
   const st = stmts[0];
   if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
   const cmd = st.Cmd;
-  if (!cmd || syntax.NodeType(cmd) !== "CallExpr") return void 0;
+  if (!cmd || cmd.kind !== "CallExpr") return void 0;
   if ((cmd.Assigns || []).length > 0) return void 0;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
   if (words.length === 0 || words.some((w) => w === null)) return void 0;
@@ -1914,7 +1970,7 @@ function recordedExpansion(name) {
   return rec.value;
 }
 function isPlainParam(p) {
-  if (syntax.NodeType(p) !== "ParamExp") return false;
+  if (p.kind !== "ParamExp") return false;
   return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
 }
 function expandPlainParam(p) {
@@ -1926,9 +1982,9 @@ function expandPlainParam(p) {
 }
 function functionBodies(f) {
   const out = /* @__PURE__ */ new Map();
-  syntax.Walk(f, (node) => {
+  walk(f, (node) => {
     const n = node;
-    if (n && syntax.NodeType(n) === "FuncDecl" && n.Name?.Value && n.Body) {
+    if (n && n.kind === "FuncDecl" && n.Name?.Value && n.Body) {
       const list = out.get(n.Name.Value) ?? [];
       list.push(n.Body);
       out.set(n.Name.Value, list);
@@ -1939,10 +1995,10 @@ function functionBodies(f) {
 }
 function rebindsPositionals(body) {
   let found = false;
-  syntax.Walk(body, (node) => {
+  walk(body, (node) => {
     const n = node;
     if (found || !n) return false;
-    if (syntax.NodeType(n) === "CallExpr") {
+    if (n.kind === "CallExpr") {
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words[0] === "shift") found = true;
       else if (words[0] === "set" && words.slice(1).some((w) => w === null || w === "--" || !/^[-+]/.test(w)))
@@ -1962,7 +2018,7 @@ function tableBindings() {
 function walkWithCalls(f, visit) {
   const bodies = functionBodies(f);
   if (bodies.size === 0) {
-    syntax.Walk(f, visit);
+    walk(f, visit);
     return;
   }
   const seenCalls = /* @__PURE__ */ new Set();
@@ -1996,8 +2052,8 @@ function walkWithCalls(f, visit) {
       currentStmtOffset = Number.MAX_SAFE_INTEGER;
       callDepth++;
       try {
-        if (body.Cmd && syntax.NodeType(body.Cmd) === "Block") recordTopLevelAssignments(body.Cmd);
-        syntax.Walk(body, step);
+        if (body.Cmd && body.Cmd.kind === "Block") recordTopLevelAssignments(body.Cmd);
+        walk(body, step);
       } finally {
         callDepth--;
         assignmentTable = outerTable;
@@ -2008,10 +2064,10 @@ function walkWithCalls(f, visit) {
   const step = (node) => {
     if (!node) return false;
     const go = visit(node);
-    if (go !== false && syntax.NodeType(node) === "CallExpr") inline(node);
+    if (go !== false && node.kind === "CallExpr") inline(node);
     return go;
   };
-  syntax.Walk(f, step);
+  walk(f, step);
 }
 function withAssignments(f, body) {
   const outerTable = assignmentTable;
@@ -2036,7 +2092,7 @@ function walkCommandScope(command, visit) {
   if (f === PARSE_FAIL) return "parse-fail";
   withAssignments(f, () => {
     walkWithCalls(f, (node) => {
-      if (node && syntax.NodeType(node) === "Stmt") trackStatement(node);
+      if (node && node.kind === "Stmt") trackStatement(node);
       return visit(node);
     });
   });
@@ -2044,7 +2100,7 @@ function walkCommandScope(command, visit) {
 }
 function trackStatement(n) {
   try {
-    currentStmtOffset = n.Pos().Offset();
+    currentStmtOffset = n.pos;
   } catch {
     currentStmtOffset = Number.MAX_SAFE_INTEGER;
   }
@@ -2060,11 +2116,11 @@ function resolveWordLiteral(w) {
   return s;
 }
 function resolveWordPrefix(w) {
-  const walk2 = (parts) => {
+  const walk3 = (parts) => {
     let s = "";
     for (const p of parts) {
       if (p && typeof p === "object" && Array.isArray(p.Parts) && p.Dollar !== void 0) {
-        const inner = walk2(p.Parts);
+        const inner = walk3(p.Parts);
         s += inner.prefix;
         if (inner.dynamic) return { prefix: s, dynamic: true };
         continue;
@@ -2075,10 +2131,10 @@ function resolveWordPrefix(w) {
     }
     return { prefix: s, dynamic: false };
   };
-  return walk2(w?.Parts || []);
+  return walk3(w?.Parts || []);
 }
 function resolvePart(p, inQuotes) {
-  const t = syntax.NodeType(p);
+  const t = p.kind;
   if (t === "Lit") {
     const raw = p.Value ?? "";
     if (!inQuotes) return raw.replace(/\\(.)/g, "$1");
@@ -2174,7 +2230,7 @@ function extractShellDestinations(command) {
       () => walkWithCalls(f, (node) => {
         if (!node) return false;
         const n = node;
-        if (syntax.NodeType(n) === "Stmt") {
+        if (n.kind === "Stmt") {
           trackStatement(n);
           for (const raw of redirectWords(n)) {
             const host2 = devNetRedirectHost(raw);
@@ -2186,7 +2242,7 @@ function extractShellDestinations(command) {
             out.push({ host: host2, binary, raw });
           }
         }
-        if (syntax.NodeType(n) !== "CallExpr") return true;
+        if (n.kind !== "CallExpr") return true;
         const callArgs = n.Args || [];
         if (callArgs.length === 0) return true;
         const words = callArgs.map((a) => resolveWordLiteral(a));
@@ -2221,7 +2277,7 @@ function extractShellDestTokens(command) {
       () => walkWithCalls(f, (node) => {
         if (!node) return false;
         const n = node;
-        if (syntax.NodeType(n) === "Stmt") {
+        if (n.kind === "Stmt") {
           trackStatement(n);
           for (const raw of redirectWords(n)) {
             const host2 = devNetRedirectHost(raw);
@@ -2233,7 +2289,7 @@ function extractShellDestTokens(command) {
             out.push({ token: host2, binary });
           }
         }
-        if (syntax.NodeType(n) !== "CallExpr") return true;
+        if (n.kind !== "CallExpr") return true;
         const callArgs = n.Args || [];
         if (callArgs.length === 0) return true;
         const words = callArgs.map((a) => resolveWordLiteral(a));
@@ -2301,11 +2357,11 @@ function isWaivableCleanupTarget(p) {
 }
 function deriveRedirOp(sample) {
   try {
-    const f = sharedParser.Parse(sample, "cmd");
+    const f = toPlainTree(sharedParser.Parse(sample, "cmd"));
     let op = -1;
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       const n = node;
-      if (n && syntax.NodeType(n) === "Redirect" && op < 0) op = n.Op;
+      if (n && n.kind === "Redirect" && op < 0) op = n.Op;
       return true;
     });
     return op;
@@ -2318,7 +2374,7 @@ function collectSameCommandCreations(f) {
   try {
     const stmts = Array.isArray(f?.Stmts) ? f.Stmts : [];
     for (const stmt of stmts) {
-      if (!stmt || !stmt.Cmd || syntax.NodeType(stmt.Cmd) !== "CallExpr") continue;
+      if (!stmt || !stmt.Cmd || stmt.Cmd.kind !== "CallExpr") continue;
       const redirs = stmt.Redirs || [];
       if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
       for (const r of redirs) {
@@ -2342,10 +2398,10 @@ function isRmCreatedInCommandCleanup(command) {
   let sawRm = false;
   let ok = true;
   try {
-    syntax.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || !ok) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const args = n.Args || [];
       const name = (resolveWordLiteral(args[0]) ?? "").toLowerCase();
       if (name !== "rm") return true;
@@ -2395,10 +2451,10 @@ function analyzeFsOperationImpl(command, depth = 0) {
     walkWithCalls(f, (node) => {
       if (!node || result?.verdict === "block") return false;
       const n = node;
-      const nodeType = syntax.NodeType(n);
+      const nodeType = n.kind;
       if (nodeType === "Stmt") {
         try {
-          currentStmtOffset = n.Pos().Offset();
+          currentStmtOffset = n.pos;
         } catch {
           currentStmtOffset = Number.MAX_SAFE_INTEGER;
         }
@@ -2911,11 +2967,12 @@ function analyzeShellCommand(command) {
     if (lower2.startsWith("-")) allTokens.push(lower2.replace(/^-+/, ""));
   };
   try {
-    const f = sharedParser.Parse(command, "cmd");
-    syntax.Walk(f, (node) => {
+    const f = parseShared(command);
+    if (f === PARSE_FAIL) throw new Error("parse failed");
+    walk(f, (node) => {
       if (!node) return false;
       const n = node;
-      if (syntax.NodeType(n) !== "CallExpr") return true;
+      if (n.kind !== "CallExpr") return true;
       const wordValues2 = (n.Args || []).map((arg) => {
         return (arg.Parts || []).map((p) => (p.Value ?? "").replace(/\\(.)/g, "$1")).join("");
       }).filter((s) => s.length > 0);
@@ -3187,7 +3244,7 @@ function runnablePrefix(command) {
   let text = command;
   for (let attempt = 0; attempt < 32; attempt++) {
     try {
-      return syntax2.NewParser().Parse(text, "");
+      return toPlainTree(syntax3.NewParser().Parse(text, ""));
     } catch (error) {
       const message = String(typeof error?.Error === "function" ? error.Error() : error?.message);
       const line = Number(/^(\d+):/.exec(message)?.[1]);
@@ -3255,7 +3312,7 @@ function wordValues(word, state) {
       out2 = next.slice(0, MAX_ALTERNATIVES);
     };
     for (const node of nodes) {
-      const kind = syntax2.NodeType(node);
+      const kind = node.kind;
       let pieces;
       if (kind === "ParamExp") pieces = paramValues(node, quoted);
       else if (kind === "DblQuoted") {
@@ -3323,9 +3380,9 @@ function collectShellFileAccesses(command, context = {}) {
   }
   function substitutions(word, state, depth) {
     if (!word) return;
-    syntax2.Walk(word, (node) => {
+    walk(word, (node) => {
       if (!node) return false;
-      if (["CmdSubst", "ProcSubst"].includes(syntax2.NodeType(node))) {
+      if (["CmdSubst", "ProcSubst"].includes(node.kind)) {
         statements(node.Stmts ?? [], clone(state), depth + 1);
         return false;
       }
@@ -3749,7 +3806,7 @@ function collectShellFileAccesses(command, context = {}) {
   }
   function readsScriptFromStdin(stmt) {
     const cmd = stmt?.Cmd;
-    if (!cmd || syntax2.NodeType(cmd) !== "CallExpr") return false;
+    if (!cmd || cmd.kind !== "CallExpr") return false;
     const words = (cmd.Args ?? []).map((a) => resolveWordLiteral(a));
     const head = unwrapCommandHead(words);
     return SHELL_INTERPRETERS.has(base(words[head])) && shellConsumesPipe(words.slice(head + 1));
@@ -3763,7 +3820,7 @@ function collectShellFileAccesses(command, context = {}) {
   }
   function producedText(stmt) {
     const cmd = stmt?.Cmd;
-    if (!cmd || syntax2.NodeType(cmd) !== "CallExpr") return null;
+    if (!cmd || cmd.kind !== "CallExpr") return null;
     const words = (cmd.Args ?? []).map((a) => resolveWordLiteral(a));
     if (words.some((w) => w === null)) return null;
     const head = unwrapCommandHead(words);
@@ -3782,7 +3839,7 @@ function collectShellFileAccesses(command, context = {}) {
     if (!stmt || depth > MAX_DEPTH) return;
     state.onSuccess = void 0;
     if (stmt.Background) state = clone(state);
-    const headWord = stmt.Cmd && syntax2.NodeType(stmt.Cmd) === "CallExpr" ? base(resolveWordLiteral(stmt.Cmd.Args?.[0])) : "";
+    const headWord = stmt.Cmd && stmt.Cmd.kind === "CallExpr" ? base(resolveWordLiteral(stmt.Cmd.Args?.[0])) : "";
     const sends = SENDING_STDIN.has(headWord);
     for (const redir of stmt.Redirs ?? []) {
       substitutions(redir.Word, state, depth);
@@ -3798,7 +3855,7 @@ function collectShellFileAccesses(command, context = {}) {
     const cmd = stmt.Cmd;
     if (!cmd) return;
     stdinScript(stmt, state, depth);
-    switch (syntax2.NodeType(cmd)) {
+    switch (cmd.kind) {
       case "CallExpr":
         call(cmd, state, depth);
         break;
@@ -3812,7 +3869,7 @@ function collectShellFileAccesses(command, context = {}) {
         for (; ; ) {
           segments2.unshift({ op: node.Op, part: node.Y });
           const left = node.X;
-          if (left?.Cmd && syntax2.NodeType(left.Cmd) === "BinaryCmd" && !left.Redirs?.length && !left.Negated && !left.Background)
+          if (left?.Cmd && left.Cmd.kind === "BinaryCmd" && !left.Redirs?.length && !left.Negated && !left.Background)
             node = left.Cmd;
           else {
             segments2.unshift({ op: node.Op, part: left });
@@ -5150,11 +5207,10 @@ function shellWriteUnseen(command, target) {
   let unseen = false;
   let seen = false;
   try {
-    syntax4.Walk(f, (node) => {
+    walk(f, (node) => {
       if (!node || unseen) return false;
       const n = node;
-      if (syntax4.NodeType(n) !== "Stmt" || !n.Cmd || syntax4.NodeType(n.Cmd) !== "CallExpr")
-        return true;
+      if (n.kind !== "Stmt" || !n.Cmd || n.Cmd.kind !== "CallExpr") return true;
       const words = (n.Cmd.Args || []).map(
         (a) => resolveWordLiteral(a)
       );
@@ -5209,14 +5265,14 @@ function analyzeGitImpl(command) {
     seen.add(key);
     findings.push(f);
   };
-  const walk2 = new GitWalk((inv) => classify(inv).forEach(found), found);
-  const parsed = walk2.run(command, 0);
+  const walk3 = new GitWalk((inv) => classify(inv).forEach(found), found);
+  const parsed = walk3.run(command, 0);
   return { parsed, findings };
 }
 function isPositionalParam(word) {
   let parts = word?.Parts || [];
-  if (parts.length === 1 && syntax5.NodeType(parts[0]) === "DblQuoted") parts = parts[0].Parts || [];
-  if (parts.length !== 1 || syntax5.NodeType(parts[0]) !== "ParamExp") return false;
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp") return false;
   return /^(\d+|@|\*)$/.test(parts[0].Param?.Value ?? "");
 }
 function boundPositionals() {
@@ -5230,11 +5286,11 @@ function boundPositionals() {
 function plainParamName(word) {
   let parts = word?.Parts || [];
   let quoted = false;
-  if (parts.length === 1 && syntax5.NodeType(parts[0]) === "DblQuoted") {
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") {
     parts = parts[0].Parts || [];
     quoted = true;
   }
-  if (parts.length !== 1 || syntax5.NodeType(parts[0]) !== "ParamExp") return null;
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp") return null;
   const p = parts[0];
   if (p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp) return null;
   const name = p.Param?.Value;
@@ -5259,7 +5315,7 @@ function resolveGitWords(word) {
   }
   const parts = word?.Parts || [];
   const expansion = parts.some((p) => {
-    const t = syntax5.NodeType(p);
+    const t = p.kind;
     return t === "ParamExp" || t === "CmdSubst";
   });
   return expansion ? splitFields(value) : [value];
@@ -5660,14 +5716,14 @@ function hookCommands(text) {
   const root = parsed?.hooks;
   if (!root || typeof root !== "object") return null;
   const out = [];
-  const walk2 = (v, depth) => {
+  const walk3 = (v, depth) => {
     if (depth > 8 || !v || typeof v !== "object") return;
     for (const [k, x] of Object.entries(v)) {
       if (k === "command" && typeof x === "string") out.push(x);
-      else walk2(x, depth + 1);
+      else walk3(x, depth + 1);
     }
   };
-  walk2(root, 0);
+  walk3(root, 0);
   return out;
 }
 function hooksDisarmed(text) {
@@ -5834,9 +5890,9 @@ function isDupInOp(op) {
   if (dupInOp === null) {
     let found = -1;
     try {
-      syntax6.Walk(parseShared("cat <&3"), (node) => {
+      walk(parseShared("cat <&3"), (node) => {
         const n = node;
-        if (found === -1 && n && syntax6.NodeType(n) === "Stmt" && n.Redirs?.[0]) {
+        if (found === -1 && n && n.kind === "Stmt" && n.Redirs?.[0]) {
           found = n.Redirs[0].Op;
         }
         return true;
@@ -5857,10 +5913,10 @@ function analyzeOutbound(command) {
     return hit;
   }
   const findings = [];
-  const walk2 = new OutboundWalk(findings);
-  const parsed = walk2.run(command, 0);
+  const walk3 = new OutboundWalk(findings);
+  const parsed = walk3.run(command, 0);
   const envOut = findings.find((f) => f.checkId === "data.env-exfil");
-  if (envOut) envOut.destinations = walk2.envDestinations();
+  if (envOut) envOut.destinations = walk3.envDestinations();
   const computed = { parsed, findings };
   if (cache2.size >= CACHE_MAX2) {
     const oldest = cache2.keys().next().value;
@@ -5876,7 +5932,7 @@ function wordShape(word) {
   const parts = word?.Parts || [];
   let out = "";
   for (const p of parts) {
-    const t = syntax6.NodeType(p);
+    const t = p.kind;
     if (t === "Lit" || t === "SglQuoted") out += p.Value ?? "";
     else if (t === "DblQuoted") out += wordShape(p);
     else out += "X";
@@ -6011,16 +6067,16 @@ function declDumpsEnv(decl) {
 }
 function paramName(word) {
   let parts = word?.Parts || [];
-  if (parts.length === 1 && syntax6.NodeType(parts[0]) === "DblQuoted") parts = parts[0].Parts || [];
-  if (parts.length !== 1 || syntax6.NodeType(parts[0]) !== "ParamExp") return null;
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp") return null;
   return parts[0].Param?.Value ?? null;
 }
 function refersTo(word, names) {
   let hit = false;
-  syntax6.Walk(word, (node) => {
+  walk(word, (node) => {
     if (hit || !node) return false;
     const n = node;
-    if (syntax6.NodeType(n) === "ParamExp" && names.has(n.Param?.Value)) hit = true;
+    if (n.kind === "ParamExp" && names.has(n.Param?.Value)) hit = true;
     return !hit;
   });
   return hit;
@@ -6028,10 +6084,10 @@ function refersTo(word, names) {
 function runsCommandsIn(stmt) {
   const readVars = /* @__PURE__ */ new Set();
   let hit = false;
-  syntax6.Walk(stmt, (node) => {
+  walk(stmt, (node) => {
     if (hit || !node) return false;
     const n = node;
-    if (syntax6.NodeType(n) !== "CallExpr") return true;
+    if (n.kind !== "CallExpr") return true;
     const words = wordsOf(n);
     if (words.length === 0) return true;
     const { head, at } = headOf(words);
@@ -6608,7 +6664,7 @@ function localContexts(file2) {
     if (depth > 64) return null;
     if (!stmt || stmt.Background || stmt.Negated || stmt.Redirs?.length) return null;
     const cmd = stmt.Cmd;
-    const kind = syntax7.NodeType(cmd);
+    const kind = cmd.kind;
     if (kind === "BinaryCmd" && cmd.Op === andOp) {
       const next = visit(cmd.X, steps, depth + 1);
       return next === null ? null : visit(cmd.Y, next, depth + 1);
@@ -6624,7 +6680,7 @@ function localContexts(file2) {
       )
     ))
       return null;
-    contexts.set(cmd.Pos().Offset(), steps);
+    contexts.set(cmd.pos, steps);
     return null;
   }
   if (file2.Stmts?.length === 1) visit(file2.Stmts[0], []);
@@ -6635,12 +6691,12 @@ function collect(command, out, depth) {
   const f = parseShared(command);
   if (typeof f === "symbol") return;
   const contexts = depth === 0 ? localContexts(f) : /* @__PURE__ */ new Map();
-  syntax7.Walk(f, (node) => {
-    if (node && syntax7.NodeType(node) === "CallExpr") {
+  walk(f, (node) => {
+    if (node && node.kind === "CallExpr") {
       const words = (node.Args || []).map((a) => resolveWordLiteral(a));
       const start = out.length;
       if (words.length > 0) fromCall(words, out, depth);
-      const steps = contexts.get(node.Pos().Offset());
+      const steps = contexts.get(node.pos);
       for (let i = start; i < out.length; i++) {
         if (["npx", "bunx", "npm exec"].includes(out[i].manager)) {
           if (!steps) out[i].localCwd = null;
@@ -6687,7 +6743,7 @@ function collect2(command, out, depth) {
   try {
     walkCommandScope(command, (node) => {
       const n = node;
-      if (!n || syntax8.NodeType(n) !== "CallExpr") return true;
+      if (!n || n.kind !== "CallExpr") return true;
       const words = (n.Args || []).map((a) => resolveWordLiteral(a));
       if (words.length === 0) return true;
       const prefix = (n.Assigns || []).filter((a) => a?.Name?.Value).map(
@@ -8072,12 +8128,12 @@ function extractContentDestinations(text) {
 function extractArgDestinations(args) {
   const out = /* @__PURE__ */ new Set();
   try {
-    walk(args, void 0, out, 0);
+    walk2(args, void 0, out, 0);
   } catch {
   }
   return [...out];
 }
-function walk(value, key, out, depth) {
+function walk2(value, key, out, depth) {
   if (out.size >= MAX_DESTINATIONS || depth > 12) return;
   if (typeof value === "string") {
     const s = value.length > MAX_SCAN_CHARS ? value.slice(0, MAX_SCAN_CHARS) : value;
@@ -8096,12 +8152,12 @@ function walk(value, key, out, depth) {
     return;
   }
   if (Array.isArray(value)) {
-    for (const v of value) walk(v, key, out, depth + 1);
+    for (const v of value) walk2(v, key, out, depth + 1);
     return;
   }
   if (value && typeof value === "object") {
     for (const [k, v] of Object.entries(value))
-      walk(v, k, out, depth + 1);
+      walk2(v, k, out, depth + 1);
   }
 }
 function destinationDomain(dest) {
@@ -8753,9 +8809,9 @@ function classifyCall(head, args, prefixes, env, state, out) {
 function walkCalls(command, out, depth, state) {
   const f = parseShared(command);
   if (typeof f === "symbol" || !f) return;
-  syntax9.Walk(f, (node) => {
+  walk(f, (node) => {
     if (!node) return false;
-    const type = syntax9.NodeType(node);
+    const type = node.kind;
     if (type === "DeclClause") {
       for (const a of node.Args || []) if (a?.Name?.Value) state.env.add(a.Name.Value);
       return true;
@@ -8896,7 +8952,7 @@ function matchCanaryArgs(args, values) {
   if (values.length === 0) return null;
   const needles = prepare(values);
   if (needles.length === 0) return null;
-  const walk2 = (v, depth, fieldPath) => {
+  const walk3 = (v, depth, fieldPath) => {
     if (depth > MAX_DEPTH4) return null;
     if (typeof v === "string") {
       const hit = matchPrepared(v, needles);
@@ -8905,31 +8961,31 @@ function matchCanaryArgs(args, values) {
         const trimmed = v.trim();
         if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
           try {
-            return walk2(JSON.parse(v), depth + 1, fieldPath);
+            return walk3(JSON.parse(v), depth + 1, fieldPath);
           } catch {
           }
         }
       }
       return null;
     }
-    if (typeof v === "number" && Number.isFinite(v)) return walk2(String(v), depth, fieldPath);
+    if (typeof v === "number" && Number.isFinite(v)) return walk3(String(v), depth, fieldPath);
     if (Array.isArray(v)) {
       for (let i = 0; i < v.length; i++) {
-        const h = walk2(v[i], depth + 1, `${fieldPath}[${i}]`);
+        const h = walk3(v[i], depth + 1, `${fieldPath}[${i}]`);
         if (h) return h;
       }
       return null;
     }
     if (v && typeof v === "object") {
       for (const [k, child] of Object.entries(v)) {
-        const h = walk2(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
+        const h = walk3(child, depth + 1, fieldPath ? `${fieldPath}.${k}` : k);
         if (h) return h;
       }
     }
     return null;
   };
   try {
-    return walk2(args, 0, "");
+    return walk3(args, 0, "");
   } catch (e) {
     console.error(
       "[node9 engine] canary args walk failed:",
@@ -8938,26 +8994,20 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var import_mvdan_sh, import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh2, import_mvdan_sh3, import_safe_regex22, import_crypto2, import_crypto3, import_mvdan_sh4, import_mvdan_sh5, import_mvdan_sh6, import_mvdan_sh7, import_mvdan_sh8, import_crypto4, import_mvdan_sh9, import_crypto5, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax2, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, APPENDS, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, syntax3, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, syntax4, RDR_IN, COPY_VERBS2, LITERAL_VERBS, syntax5, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, syntax6, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, syntax7, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, syntax8, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, syntax9, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var import_picomatch, import_safe_regex2, import_picomatch2, import_mvdan_sh, import_mvdan_sh2, import_mvdan_sh3, import_safe_regex22, import_crypto2, import_crypto3, import_crypto4, import_crypto5, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax2, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax3, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, APPENDS, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
-    import_mvdan_sh = __toESM(require("mvdan-sh"), 1);
     import_picomatch = __toESM(require("picomatch"), 1);
     import_safe_regex2 = __toESM(require("safe-regex2"), 1);
     import_picomatch2 = __toESM(require("picomatch"), 1);
+    import_mvdan_sh = __toESM(require("mvdan-sh"), 1);
     import_mvdan_sh2 = __toESM(require("mvdan-sh"), 1);
     import_mvdan_sh3 = __toESM(require("mvdan-sh"), 1);
     import_safe_regex22 = __toESM(require("safe-regex2"), 1);
     import_crypto2 = require("crypto");
     import_crypto3 = require("crypto");
-    import_mvdan_sh4 = __toESM(require("mvdan-sh"), 1);
-    import_mvdan_sh5 = __toESM(require("mvdan-sh"), 1);
-    import_mvdan_sh6 = __toESM(require("mvdan-sh"), 1);
-    import_mvdan_sh7 = __toESM(require("mvdan-sh"), 1);
-    import_mvdan_sh8 = __toESM(require("mvdan-sh"), 1);
     import_crypto4 = require("crypto");
-    import_mvdan_sh9 = __toESM(require("mvdan-sh"), 1);
     import_crypto5 = __toESM(require("crypto"), 1);
     MAX_REGEX_LENGTH = 256;
     REGEX_CACHE_MAX = 500;
@@ -11603,6 +11653,61 @@ var init_dist = __esm({
         return s.untrustedContent.afterExposure === "log-only" ? "log" : "review";
       }
     };
+    ({ syntax } = import_mvdan_sh2.default);
+    KINDS = {
+      File: { nodes: ["Stmts"] },
+      Stmt: { nodes: ["Cmd", "Redirs"], scalars: ["Negated", "Background", "Coprocess"] },
+      CallExpr: { nodes: ["Assigns", "Args"] },
+      Assign: { nodes: ["Name", "Value", "Index", "Array"], scalars: ["Append", "Naked"] },
+      Word: { nodes: ["Parts"] },
+      Lit: { scalars: ["Value"] },
+      SglQuoted: { scalars: ["Value", "Dollar"] },
+      DblQuoted: { nodes: ["Parts"], scalars: ["Dollar"] },
+      ParamExp: {
+        nodes: ["Param", "Index", "Slice", "Repl", "Exp"],
+        scalars: ["Short", "Excl", "Length", "Width"]
+      },
+      CmdSubst: { nodes: ["Stmts"], scalars: ["Backquotes", "TempFile", "ReplyVar"] },
+      ArithmExp: { nodes: ["X"], scalars: ["Bracket", "Unsigned"] },
+      ArithmCmd: { nodes: ["X"], scalars: ["Unsigned"] },
+      ProcSubst: { nodes: ["Stmts"], scalars: ["Op"] },
+      ExtGlob: { nodes: ["Pattern"], scalars: ["Op"] },
+      BraceExp: { nodes: ["Elems"], scalars: ["Sequence"] },
+      // only with SplitBraces, unused here
+      BinaryCmd: { nodes: ["X", "Y"], scalars: ["Op"] },
+      BinaryArithm: { nodes: ["X", "Y"], scalars: ["Op"] },
+      UnaryArithm: { nodes: ["X"], scalars: ["Op", "Post"] },
+      ParenArithm: { nodes: ["X"] },
+      BinaryTest: { nodes: ["X", "Y"], scalars: ["Op"] },
+      UnaryTest: { nodes: ["X"], scalars: ["Op"] },
+      ParenTest: { nodes: ["X"] },
+      Redirect: { nodes: ["N", "Word", "Hdoc"], scalars: ["Op"] },
+      Block: { nodes: ["Stmts"] },
+      Subshell: { nodes: ["Stmts"] },
+      IfClause: { nodes: ["Cond", "Then", "Else"] },
+      WhileClause: { nodes: ["Cond", "Do"], scalars: ["Until"] },
+      ForClause: { nodes: ["Loop", "Do"], scalars: ["Select"] },
+      WordIter: { nodes: ["Name", "Items"] },
+      CStyleLoop: { nodes: ["Init", "Cond", "Post"] },
+      CaseClause: { nodes: ["Word", "Items"] },
+      CaseItem: { nodes: ["Patterns", "Stmts"], scalars: ["Op"] },
+      FuncDecl: { nodes: ["Name", "Body"], scalars: ["RsrvWord"] },
+      DeclClause: { nodes: ["Variant", "Args"], notWalked: ["Variant"] },
+      LetClause: { nodes: ["Exprs"] },
+      TimeClause: { nodes: ["Stmt"], scalars: ["PosixFormat"] },
+      CoprocClause: { nodes: ["Name", "Stmt"] },
+      TestClause: { nodes: ["X"] },
+      TestDecl: { nodes: ["Description", "Body"] },
+      ArrayExpr: { nodes: ["Elems"] },
+      ArrayElem: { nodes: ["Index", "Value"] },
+      Comment: { scalars: ["Text"] }
+    };
+    STRUCTS = {
+      "ParamExp.Slice": { nodes: ["Offset", "Length"], notWalked: ["Offset", "Length"] },
+      "ParamExp.Repl": { nodes: ["Orig", "With"], scalars: ["All"] },
+      "ParamExp.Exp": { nodes: ["Word"], scalars: ["Op"] }
+    };
+    unknownKinds = /* @__PURE__ */ new Set();
     INVISIBLE_RE = /[­͏؜᠎​-‏‪-‮⁠-⁤-︀-️]|[\u{E0000}-\u{E007F}]/gu;
     INVISIBLE_ONE = new RegExp(`^(?:${INVISIBLE_RE.source.split("|")[0]})$`, "u");
     HOMOGLYPHS = {
@@ -11888,8 +11993,8 @@ var init_dist = __esm({
       php: PHP
     };
     STRING_LITERAL = /(['"`])((?:\\.|(?!\1)[^\\\n]){1,4096})\1/g;
-    ({ syntax } = import_mvdan_sh2.default);
-    sharedParser = syntax.NewParser();
+    ({ syntax: syntax2 } = import_mvdan_sh.default);
+    sharedParser = syntax2.NewParser();
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
       "-m",
       "--message",
@@ -11923,7 +12028,7 @@ var init_dist = __esm({
     NORMALIZE_CACHE_MAX = 5e3;
     normalizeCache = /* @__PURE__ */ new Map();
     codeBodiesCache = /* @__PURE__ */ new Map();
-    AST_CACHE_MAX = 5e3;
+    AST_CACHE_MAX = 256;
     astCache = /* @__PURE__ */ new Map();
     PARSE_FAIL = /* @__PURE__ */ Symbol("parse-fail");
     INTERPRETER_LINE = /^#![ \t]*[\w./+-]+(?:[ \t]+[\w./+=:-]+)*[ \t]*\r?(?=\n|$)/;
@@ -12908,7 +13013,7 @@ var init_dist = __esm({
     ARGV_FIELDS = ["args", "argv"];
     BARE_WORD = /^[A-Za-z0-9_./+:@%,-]+$/;
     MAX_ARGV_CHARACTERS = 262144;
-    ({ syntax: syntax2 } = import_mvdan_sh3.default);
+    ({ syntax: syntax3 } = import_mvdan_sh3.default);
     MAX_ALTERNATIVES = 64;
     MAX_CALL_DEPTH2 = 4;
     MAX_CALL_WALKS2 = 256;
@@ -13000,7 +13105,6 @@ var init_dist = __esm({
     );
     exempt = (p) => SYSTEM_DIRS_EXEMPT.some((d) => within(p, d));
     RANK = { allow: 0, review: 1, block: 2 };
-    ({ syntax: syntax3 } = import_mvdan_sh.default);
     SEQUENCE_OPS = (() => {
       const ops = /* @__PURE__ */ new Set();
       for (const text of ["x && y", "x || y"]) {
@@ -16161,7 +16265,6 @@ zoo`.split("\n");
     );
     NEVER_NEGATED = /* @__PURE__ */ new Set([SIGNALS[1].any[0]]);
     NEGATION_BEFORE = /\b(never|do not|don'?t|must not|mustn'?t|should not|shouldn'?t|not allowed to|forbidden to|avoid|without|no|not)\b[^.!?;:\n]{0,24}$/i;
-    ({ syntax: syntax4 } = import_mvdan_sh4.default);
     RDR_IN = (() => {
       try {
         return parseShared("x <y").Stmts[0].Redirs[0].Op;
@@ -16190,7 +16293,6 @@ zoo`.split("\n");
       "tar"
     ]);
     LITERAL_VERBS = /* @__PURE__ */ new Set(["echo", "printf", ":", "true", "touch", "sed"]);
-    ({ syntax: syntax5 } = import_mvdan_sh5.default);
     GIT_PRESCREEN_RE = /git|husky/i;
     MAX_PAYLOAD_DEPTH2 = 8;
     MAX_ALIAS_DEPTH = 5;
@@ -16259,7 +16361,7 @@ zoo`.split("\n");
       visit(node, depth) {
         if (!node) return false;
         const n = node;
-        const type = syntax5.NodeType(n);
+        const type = n.kind;
         if (type === "Stmt") {
           this.visitHeredocShell(n, depth);
           return true;
@@ -16267,7 +16369,7 @@ zoo`.split("\n");
         if (type === "ForClause") {
           const loop = n.Loop;
           const name = loop?.Name?.Value;
-          if (name && syntax5.NodeType(loop) === "WordIter") {
+          if (name && loop.kind === "WordIter") {
             const items = (loop.Items || []).map((w) => resolveWordLiteral(w));
             const literal = items.length > 0 && items.every((v) => v !== null);
             this.loopVars.set(name, literal ? items.slice(0, MAX_LOOP_ITEMS) : null);
@@ -16334,7 +16436,7 @@ zoo`.split("\n");
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       visitHeredocShell(stmt, depth) {
         const cmd = stmt.Cmd;
-        if (!cmd || syntax5.NodeType(cmd) !== "CallExpr" || depth >= MAX_PAYLOAD_DEPTH2) return;
+        if (!cmd || cmd.kind !== "CallExpr" || depth >= MAX_PAYLOAD_DEPTH2) return;
         const redirs = stmt.Redirs || [];
         const hdoc = redirs.find((r) => r?.Hdoc && (r.N == null || r.N.Value === "0"));
         if (!hdoc) return;
@@ -16588,7 +16690,6 @@ zoo`.split("\n");
     ]);
     SETTINGS_RE = /\/(?:\.claude\/settings(?:\.local)?\.json|\.gemini\/settings\.json|\.codex\/hooks\.json|\.cursor\/hooks\.json)$/i;
     HOOK_WORDS_RE = /"hooks"|\b(PreToolUse|PostToolUse|UserPromptSubmit|Notification|Stop|SubagentStop|SessionStart|SessionEnd|PreCompact|BeforeTool|AfterTool)\b|"command"\s*:/;
-    ({ syntax: syntax6 } = import_mvdan_sh6.default);
     SHELLS = /* @__PURE__ */ new Set([...SHELL_INTERPRETERS, "mksh", "ash", "csh", "tcsh"]);
     NETCATS = /* @__PURE__ */ new Set(["nc", "ncat", "netcat", "nc.traditional", "nc.openbsd"]);
     NET_CLIENTS = /* @__PURE__ */ new Set([...NETCATS, "telnet", "socat"]);
@@ -16646,7 +16747,7 @@ zoo`.split("\n");
         const f = parseShared(command);
         if (!f || typeof f !== "object" || !f.Stmts) return false;
         try {
-          syntax6.Walk(f, (node) => this.visit(node, depth));
+          walk(f, (node) => this.visit(node, depth));
         } catch {
           return false;
         }
@@ -16685,7 +16786,7 @@ zoo`.split("\n");
       }
       visit(n, depth) {
         if (!n) return false;
-        const type = syntax6.NodeType(n);
+        const type = n.kind;
         if (type === "Stmt") {
           this.visitStmt(n, depth);
           return true;
@@ -16705,7 +16806,7 @@ zoo`.split("\n");
         const redirs = redirectWords(stmt);
         const toSocket = redirs.some((w) => w !== null && DEV_NET_RE.test(w));
         if (!cmd) return;
-        const type = syntax6.NodeType(cmd);
+        const type = cmd.kind;
         if (type !== "CallExpr" || wordsOf(cmd).length > 0) {
           if (this.readsNetFd(stmt) && runsCommandsIn(stmt)) {
             this.reverseShell("commands are read from a network socket opened with exec");
@@ -16791,7 +16892,7 @@ zoo`.split("\n");
         const stages = [];
         const flatten = (s) => {
           const c = s?.Cmd;
-          if (c && syntax6.NodeType(c) === "BinaryCmd" && isPipeOp(c.Op)) {
+          if (c && c.kind === "BinaryCmd" && isPipeOp(c.Op)) {
             flatten(c.X);
             flatten(c.Y);
           } else stages.push(s);
@@ -16813,8 +16914,8 @@ zoo`.split("\n");
             sinks.set(i, socketHosts(st));
           }
           if (!c) return;
-          if (syntax6.NodeType(c) === "DeclClause" && declDumpsEnv(c) && dump < 0) dump = i;
-          if (syntax6.NodeType(c) !== "CallExpr") {
+          if (c.kind === "DeclClause" && declDumpsEnv(c) && dump < 0) dump = i;
+          if (c.kind !== "CallExpr") {
             if (runsCommandsIn(st)) shell = i;
             return;
           }
@@ -16855,10 +16956,10 @@ zoo`.split("\n");
       /** A word (or assignment value) whose text includes an env dump's output. */
       carriesEnv(word) {
         let hit = false;
-        syntax6.Walk(word, (node) => {
+        walk(word, (node) => {
           if (hit || !node) return false;
           const n = node;
-          const t = syntax6.NodeType(n);
+          const t = n.kind;
           if (t === "ParamExp" && n.Param?.Value && this.envVars.has(n.Param.Value)) {
             hit = true;
             return false;
@@ -16875,11 +16976,11 @@ zoo`.split("\n");
       stmtsDumpEnv(stmts) {
         let hit = false;
         for (const s of stmts) {
-          syntax6.Walk(s, (node) => {
+          walk(s, (node) => {
             if (hit || !node) return false;
             const n = node;
-            const t = syntax6.NodeType(n);
-            if (t === "Stmt" && n.Cmd && syntax6.NodeType(n.Cmd) === "CallExpr") {
+            const t = n.kind;
+            if (t === "Stmt" && n.Cmd && n.Cmd.kind === "CallExpr") {
               const words = wordsOf(n.Cmd);
               if (words.length > 0 && dumpsEnv(words, n)) hit = true;
             }
@@ -16896,7 +16997,6 @@ zoo`.split("\n");
         this.run(payload, depth + 1);
       }
     };
-    ({ syntax: syntax7 } = import_mvdan_sh8.default);
     NPM_INSTALL_VERBS = /* @__PURE__ */ new Set([
       "install",
       "i",
@@ -17278,7 +17378,6 @@ zoo`.split("\n");
     SHELLS2 = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh", "ash"]);
     MAX_NESTING = 3;
     SHELL_VALUE_FLAGS = /* @__PURE__ */ new Set(["--rcfile", "--init-file", "-O", "+O", "-o", "+o"]);
-    ({ syntax: syntax8 } = import_mvdan_sh7.default);
     NPM_FAMILY = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun", "npx", "pnpx", "bunx"]);
     PIP_FAMILY = /* @__PURE__ */ new Set(["pip", "pip3", "uv", "uvx", "pipx", "pipenv"]);
     NPM_FETCH_VERBS = /* @__PURE__ */ new Set([
@@ -17810,7 +17909,6 @@ zoo`.split("\n");
     ACCOUNT_KEY_RE = /("(?:iban|account|account_number|accountNumber)"\s*:\s*")([A-Za-z0-9 .-]{6,40})(")/g;
     ACCOUNT_VALUE_RE = /"([A-Z]{2}\d{2}[A-Z0-9]{11,30})"/g;
     MAX_MASK_DEPTH = 64;
-    ({ syntax: syntax9 } = import_mvdan_sh9.default);
     EMPTY = {
       fetches: false,
       sends: false,