@node9/proxy 2.47.0 → 2.47.2

package/dist/index.mjs

@@ -13,6 +13,15 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// node_modules/tsup/assets/esm_shims.js
+import path from "path";
+import { fileURLToPath } from "url";
+var init_esm_shims = __esm({
+  "node_modules/tsup/assets/esm_shims.js"() {
+    "use strict";
+  }
+});
+
 // src/audit/hasher.ts
 import { createHash } from "crypto";
 function canonicalise(value) {
@@ -44,6 +53,7 @@ function hashArgs(args) {
 var init_hasher = __esm({
   "src/audit/hasher.ts"() {
     "use strict";
+    init_esm_shims();
   }
 });
 
@@ -59,17 +69,17 @@ var als;
 var init_forecast_context = __esm({
   "src/auth/forecast-context.ts"() {
     "use strict";
+    init_esm_shims();
     als = new AsyncLocalStorage();
   }
 });
 
 // packages/policy-engine/dist/index.mjs
+import { fileURLToPath as fileURLToPath2 } from "url";
 import picomatch from "picomatch";
 import safeRegex from "safe-regex2";
 import pm from "picomatch";
-import mvdanSh2 from "mvdan-sh";
-import mvdanSh from "mvdan-sh";
-import mvdanSh3 from "mvdan-sh";
+import { createRequire } from "module";
 import safeRegex2 from "safe-regex2";
 import { createHash as createHash2 } from "crypto";
 import { createHash as createHash22 } from "crypto";
@@ -655,11 +665,29 @@ function resolveCheckMap(settings) {
   for (const c of CHECKS) out[c.id] = checkValue(settings, c.id);
   return out;
 }
+function getSyntax() {
+  if (syntax === null) {
+    const req = createRequire(__filename2);
+    syntax = req("mvdan-sh").syntax;
+  }
+  return syntax;
+}
+function lazy(compute) {
+  let done = false;
+  let value;
+  return () => {
+    if (!done) {
+      value = compute();
+      done = true;
+    }
+    return value;
+  };
+}
 function isGoNode(v) {
   return v !== null && typeof v === "object" && typeof v.Pos === "function";
 }
 function toPlainTree(goNode) {
-  const kind = syntax.NodeType(goNode);
+  const kind = getSyntax().NodeType(goNode);
   const out = { kind, pos: goNode.Pos().Offset(), end: goNode.End().Offset() };
   const spec = KINDS[kind];
   if (!spec) {
@@ -849,12 +877,12 @@ function judgeInlineCode(language, code, isProtected) {
       category
     };
   }
-  const path31 = protectedLiteral(text, isProtected);
-  if (path31) {
+  const path210 = protectedLiteral(text, isProtected);
+  if (path210) {
     return {
       outcome: "dangerous",
       what: WHAT["reads-protected"],
-      evidence: path31.slice(0, 60),
+      evidence: path210.slice(0, 60),
       category: "reads-protected"
     };
   }
@@ -890,7 +918,7 @@ function parseShared(command) {
   }
   let parsed;
   try {
-    parsed = toPlainTree(sharedParser.Parse(command, "cmd"));
+    parsed = toPlainTree(sharedParser().Parse(command, "cmd"));
   } catch {
     parsed = PARSE_FAIL;
   }
@@ -1438,7 +1466,7 @@ function redirStdinOps() {
 }
 function deriveBinaryOp(sample) {
   try {
-    const f = toPlainTree(sharedParser.Parse(sample, "cmd"));
+    const f = toPlainTree(sharedParser().Parse(sample, "cmd"));
     let op = -1;
     walk(f, (node) => {
       const n = node;
@@ -1882,7 +1910,7 @@ function recordTopLevelAssignments(f) {
 }
 function probeBinOp(src) {
   try {
-    const cmd = toPlainTree(syntax2.NewParser().Parse(src, "probe"))?.Stmts?.[0]?.Cmd;
+    const cmd = toPlainTree(getSyntax().NewParser().Parse(src, "probe"))?.Stmts?.[0]?.Cmd;
     if (cmd && cmd.kind === "BinaryCmd") return cmd.Op;
   } catch {
   }
@@ -1892,9 +1920,9 @@ function recordTopLevelStmt(stmt) {
   if (!stmt || !stmt.Cmd) return false;
   const t = stmt.Cmd.kind;
   if (t === "BinaryCmd") {
-    if (!AND_OR_OPS.has(stmt.Cmd.Op)) return false;
+    if (!andOrOps().AND_OR_OPS.has(stmt.Cmd.Op)) return false;
     if (!recordTopLevelStmt(stmt.Cmd.X)) return false;
-    if (stmt.Cmd.Op === AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
+    if (stmt.Cmd.Op === andOrOps().AND_OP) return recordTopLevelStmt(stmt.Cmd.Y);
     return true;
   }
   if (t !== "CallExpr" && t !== "DeclClause") return false;
@@ -2345,7 +2373,7 @@ function isWaivableCleanupTarget(p) {
 }
 function deriveRedirOp(sample) {
   try {
-    const f = toPlainTree(sharedParser.Parse(sample, "cmd"));
+    const f = toPlainTree(sharedParser().Parse(sample, "cmd"));
     let op = -1;
     walk(f, (node) => {
       const n = node;
@@ -2364,9 +2392,9 @@ function collectSameCommandCreations(f) {
     for (const stmt of stmts) {
       if (!stmt || !stmt.Cmd || stmt.Cmd.kind !== "CallExpr") continue;
       const redirs = stmt.Redirs || [];
-      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS.has(r.Op))) continue;
+      if (!redirs.some((r) => r && REDIR_HEREDOC_OPS().has(r.Op))) continue;
       for (const r of redirs) {
-        if (r && REDIR_TRUNCATE_OPS.has(r.Op) && r.N == null) {
+        if (r && REDIR_TRUNCATE_OPS().has(r.Op) && r.N == null) {
           const w = resolveWordLiteral(r.Word);
           if (w) created.add(stripDotSlash(w));
         }
@@ -2936,7 +2964,7 @@ function literalShellPayload(words, name) {
 function jailedRedirectRead(stmt) {
   const redirs = stmt.Redirs || [];
   for (const r of redirs) {
-    if (!r || !REDIR_FILE_IN_OPS.has(r.Op)) continue;
+    if (!r || !REDIR_FILE_IN_OPS().has(r.Op)) continue;
     const p = resolveWordLiteral(r.Word);
     if (p === null || p === "") continue;
     const hit = matchSensitivePath(p);
@@ -3018,9 +3046,9 @@ function ruleServerMatches(rule, serverLabel) {
   if (rule.notServer && label2 && matchesPattern(label2, rule.notServer)) return false;
   return true;
 }
-function getNestedValue(obj, path31) {
+function getNestedValue(obj, path210) {
   if (!obj || typeof obj !== "object") return null;
-  const segments2 = path31.split(".");
+  const segments2 = path210.split(".");
   for (const seg of segments2) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -3232,7 +3260,7 @@ function runnablePrefix(command) {
   let text = command;
   for (let attempt = 0; attempt < 32; attempt++) {
     try {
-      return toPlainTree(syntax3.NewParser().Parse(text, ""));
+      return toPlainTree(getSyntax().NewParser().Parse(text, ""));
     } catch (error) {
       const message = String(typeof error?.Error === "function" ? error.Error() : error?.message);
       const line = Number(/^(\d+):/.exec(message)?.[1]);
@@ -3277,7 +3305,7 @@ function wordValues(word, state) {
     const name = node.Param?.Value;
     const known = name === "PWD" ? state.cwd : state.vars.get(name);
     if (node.Exp) {
-      if (!DEFAULT_OPS.has(node.Exp.Op)) return null;
+      if (!ops().DEFAULT_OPS.has(node.Exp.Op)) return null;
       if (known && known.length) return toWords(known, quoted);
       const fallback = expand(node.Exp.Word?.Parts ?? [], quoted);
       return fallback.dynamic ? null : fallback.out.map(asWord);
@@ -3802,7 +3830,7 @@ function collectShellFileAccesses(command, context = {}) {
   function stdinText(stmt) {
     for (const redir of stmt?.Redirs ?? []) {
       if (redir.Hdoc) return resolveWordLiteral(redir.Hdoc);
-      if (redir.Op === HERE_STRING) return resolveWordLiteral(redir.Word);
+      if (redir.Op === ops().HERE_STRING) return resolveWordLiteral(redir.Word);
     }
     return null;
   }
@@ -3832,10 +3860,10 @@ function collectShellFileAccesses(command, context = {}) {
     for (const redir of stmt.Redirs ?? []) {
       substitutions(redir.Word, state, depth);
       for (const word of wordValues(redir.Word, state)) {
-        if (WRITES.has(redir.Op))
-          add("write", word, state, APPENDS.has(redir.Op) ? { append: true } : {});
-        if (READS.has(redir.Op)) add("read", word, state, sends ? { upload: true } : {});
-        if (redir.Op === DUP_OUT && word.value && !/^\d+$/.test(word.value))
+        if (ops().WRITES.has(redir.Op))
+          add("write", word, state, ops().APPENDS.has(redir.Op) ? { append: true } : {});
+        if (ops().READS.has(redir.Op)) add("read", word, state, sends ? { upload: true } : {});
+        if (redir.Op === ops().DUP_OUT && word.value && !/^\d+$/.test(word.value))
           add("write", word, state);
       }
       substitutions(redir.Hdoc, state, depth);
@@ -3867,16 +3895,17 @@ function collectShellFileAccesses(command, context = {}) {
         const seen = clone(state);
         let pureAnd = true;
         segments2.forEach(({ op, part }, i) => {
-          if (op === AND || op === OR) {
-            if (i > 0 && op === AND && pureAnd && state.onSuccess) state.cwd = state.onSuccess;
-            if (i > 0 && op === OR) merge(state, seen);
+          if (op === ops().AND || op === ops().OR) {
+            if (i > 0 && op === ops().AND && pureAnd && state.onSuccess)
+              state.cwd = state.onSuccess;
+            if (i > 0 && op === ops().OR) merge(state, seen);
             statement(part, state, depth + 1);
           } else {
             statement(part, clone(state), depth + 1);
             if (i > 0 && readsScriptFromStdin(part))
               nestedPayload(producedText(segments2[i - 1].part), clone(state), depth);
           }
-          if (i > 0 && op !== AND) pureAnd = false;
+          if (i > 0 && op !== ops().AND) pureAnd = false;
           merge(seen, state);
         });
         merge(state, seen);
@@ -4000,8 +4029,8 @@ function collectFileAccesses(tool, args, context = {}, inspection = {}) {
   }
   return out;
 }
-function within(path31, root) {
-  return path31 === root || path31.startsWith(root === "/" ? "/" : root + "/");
+function within(path210, root) {
+  return path210 === root || path210.startsWith(root === "/" ? "/" : root + "/");
 }
 function hits(access, paths, directories, context) {
   const home = context.homeDirs?.[0] ?? "~";
@@ -5204,7 +5233,7 @@ function shellWriteUnseen(command, target) {
       );
       const redirs = n.Redirs || [];
       const redirectsTo = redirs.some((r) => r.Word && resolveWordLiteral(r.Word) === target);
-      const readsFromFile = redirs.some((r) => r.Op === RDR_IN && r.Word && !r.Hdoc);
+      const readsFromFile = redirs.some((r) => r.Op === RDR_IN() && r.Word && !r.Hdoc);
       const named = words.includes(target);
       if (!redirectsTo && !named) return true;
       const head = unwrapCommandHead(words);
@@ -6320,14 +6349,14 @@ function mavenGet(words, from, out) {
   push(out, "Maven", "mvn dependency:get", coord, exact, artifact ?? coord);
 }
 function composerPackages(words, from, manager, out) {
-  const ops = operands(words, from, COMPOSER_VALUE_FLAGS);
-  const specs = manager === "composer create-project" ? ops.slice(0, 1) : ops;
+  const ops2 = operands(words, from, COMPOSER_VALUE_FLAGS);
+  const specs = manager === "composer create-project" ? ops2.slice(0, 1) : ops2;
   for (const raw of specs) {
     const sep = raw.search(/[:=]/);
     const name = sep < 0 ? raw : raw.slice(0, sep);
     if (!COMPOSER_NAME_RE.test(name)) continue;
     let ver = sep < 0 ? void 0 : raw.slice(sep + 1);
-    if (manager === "composer create-project" && ver === void 0) ver = ops[2] ?? void 0;
+    if (manager === "composer create-project" && ver === void 0) ver = ops2[2] ?? void 0;
     push(out, "Packagist", manager, name.toLowerCase(), exactVersion(ver), raw);
   }
 }
@@ -7258,9 +7287,9 @@ function bareToolName(toolName) {
   const parts = toolName.split("__");
   return (parts.length >= 3 ? parts.slice(2).join("__") : toolName).toLowerCase();
 }
-function valuesAt(args, path31) {
+function valuesAt(args, path210) {
   let cursors = [args];
-  for (const rawSegment of path31.split(".")) {
+  for (const rawSegment of path210.split(".")) {
     const isArray = rawSegment.endsWith("[]");
     const key = isArray ? rawSegment.slice(0, -2) : rawSegment;
     const next = [];
@@ -7291,8 +7320,8 @@ function extractToolDestinations(toolName, args) {
   try {
     const out = [];
     const paths = DESTINATION_ARGS.get(bareToolName(toolName)) ?? [];
-    for (const path31 of paths) {
-      for (const value of valuesAt(args, path31)) {
+    for (const path210 of paths) {
+      for (const value of valuesAt(args, path210)) {
         const host2 = hostOf(value);
         if (host2) out.push({ host: host2, binary: toolName, raw: value });
       }
@@ -7318,8 +7347,8 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
   try {
     const paths = DESTINATION_ARGS.get(bareToolName(toolName));
     if (!paths) return null;
-    for (const path31 of paths) {
-      for (const value of valuesAt(args, path31)) {
+    for (const path210 of paths) {
+      for (const value of valuesAt(args, path210)) {
         const host2 = hostOf(value);
         if (!host2) continue;
         const m = classifySsrf(host2);
@@ -7328,7 +7357,7 @@ function ssrfDestinationFloor(toolName, args, opts = {}) {
         const decision = ssrfFloorDecision(m, written, opts);
         if (decision === null) continue;
         const reason = decision === "review" ? ssrfDisguisedReason(m, written) : ssrfReason(m, host2);
-        return { ...m, argPath: path31, host: host2, reason, decision };
+        return { ...m, argPath: path210, host: host2, reason, decision };
       }
     }
     return null;
@@ -8982,10 +9011,13 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, syntax2, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, AND_OP, OR_OP, AND_OR_OPS, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, syntax3, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, WRITES, APPENDS, READS, DUP_OUT, HERE_STRING, AND, OR, DEFAULT_OPS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH, MAX_CALL_WALKS, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, MAX_ALTERNATIVES, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
+    init_esm_shims();
+    getFilename = () => fileURLToPath2(import.meta.url);
+    __filename2 = /* @__PURE__ */ getFilename();
     MAX_REGEX_LENGTH = 256;
     REGEX_CACHE_MAX = 500;
     regexCache = /* @__PURE__ */ new Map();
@@ -11630,7 +11662,7 @@ var init_dist = __esm({
         return s.untrustedContent.afterExposure === "log-only" ? "log" : "review";
       }
     };
-    ({ syntax } = mvdanSh);
+    syntax = null;
     KINDS = {
       File: { nodes: ["Stmts"] },
       Stmt: { nodes: ["Cmd", "Redirs"], scalars: ["Negated", "Background", "Coprocess"] },
@@ -11970,8 +12002,7 @@ var init_dist = __esm({
       php: PHP
     };
     STRING_LITERAL = /(['"`])((?:\\.|(?!\1)[^\\\n]){1,4096})\1/g;
-    ({ syntax: syntax2 } = mvdanSh2);
-    sharedParser = syntax2.NewParser();
+    sharedParser = lazy(() => getSyntax().NewParser());
     MESSAGE_FLAGS = /* @__PURE__ */ new Set([
       "-m",
       "--message",
@@ -12936,9 +12967,14 @@ var init_dist = __esm({
       path: ""
     };
     ASSIGNMENT_HEADS = /* @__PURE__ */ new Set(["export", "declare", "local", "readonly", "typeset"]);
-    AND_OP = probeBinOp("a && b");
-    OR_OP = probeBinOp("a || b");
-    AND_OR_OPS = new Set([AND_OP, OR_OP].filter((o) => o !== null));
+    andOrOps = lazy(() => {
+      const and = probeBinOp("a && b");
+      const or = probeBinOp("a || b");
+      return {
+        AND_OP: and,
+        AND_OR_OPS: new Set([and, or].filter((o) => o !== null))
+      };
+    });
     MAX_CALL_DEPTH = 4;
     MAX_CALL_WALKS = 256;
     callDepth = 0;
@@ -12946,14 +12982,13 @@ var init_dist = __esm({
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
     stripDotSlash = (p) => p.replace(/^\.\//, "");
-    REDIR_TRUNCATE_OPS = /* @__PURE__ */ new Set([deriveRedirOp(">_f")]);
-    REDIR_FILE_IN_OPS = new Set(
-      [deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0)
+    REDIR_TRUNCATE_OPS = lazy(() => /* @__PURE__ */ new Set([deriveRedirOp(">_f")]));
+    REDIR_FILE_IN_OPS = lazy(
+      () => new Set([deriveRedirOp("cat < f"), deriveRedirOp("cat <> f")].filter((op) => op >= 0))
+    );
+    REDIR_HEREDOC_OPS = lazy(
+      () => /* @__PURE__ */ new Set([deriveRedirOp("cat <<X\nX"), deriveRedirOp("cat <<-X\nX")])
     );
-    REDIR_HEREDOC_OPS = /* @__PURE__ */ new Set([
-      deriveRedirOp("cat <<X\nX"),
-      deriveRedirOp("cat <<-X\nX")
-    ]);
     FIND_OPTIONS = /* @__PURE__ */ new Set(["-H", "-L", "-P"]);
     COPY_RULE_OF = {
       "shield:project-jail:block-read-ssh": "shield:project-jail:review-copy-ssh",
@@ -12990,7 +13025,6 @@ var init_dist = __esm({
     ARGV_FIELDS = ["args", "argv"];
     BARE_WORD = /^[A-Za-z0-9_./+:@%,-]+$/;
     MAX_ARGV_CHARACTERS = 262144;
-    ({ syntax: syntax3 } = mvdanSh3);
     MAX_ALTERNATIVES = 64;
     MAX_CALL_DEPTH2 = 4;
     MAX_CALL_WALKS2 = 256;
@@ -13068,31 +13102,35 @@ var init_dist = __esm({
     base = (s) => (s ?? "").replace(/\/+$/, "").split("/").pop() ?? "";
     quoteGlob = (s) => s.replace(/[\\*?\[\]{}()!+@]/g, "\\$&");
     asWord = (p) => ({ value: p.value, ...p.glob ? { pattern: p.pattern } : {} });
-    WRITES = new Set([">x", ">>x", ">|x", "&>x", "&>>x", "<>x"].map(opOf));
-    APPENDS = new Set([">>x", "&>>x"].map(opOf));
-    READS = new Set(["<x", "<>x"].map(opOf));
-    DUP_OUT = opOf(">&x");
-    HERE_STRING = opOf("<<<x");
-    AND = parseShared("a && b").Stmts[0].Cmd.Op;
-    OR = parseShared("a || b").Stmts[0].Cmd.Op;
-    DEFAULT_OPS = new Set(
-      ["${x:-y}", "${x-y}", "${x:=y}", "${x=y}"].map(
-        (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
+    ops = lazy(() => ({
+      WRITES: new Set([">x", ">>x", ">|x", "&>x", "&>>x", "<>x"].map(opOf)),
+      APPENDS: new Set([">>x", "&>>x"].map(opOf)),
+      READS: new Set(["<x", "<>x"].map(opOf)),
+      /** `>&word` with a non-numeric word is `&>word` in bash. */
+      DUP_OUT: opOf(">&x"),
+      HERE_STRING: opOf("<<<x"),
+      AND: parseShared("a && b").Stmts[0].Cmd.Op,
+      OR: parseShared("a || b").Stmts[0].Cmd.Op,
+      /** `${x:-d}` `${x-d}` `${x:=d}` `${x=d}`: the default is the value when x is unset. */
+      DEFAULT_OPS: new Set(
+        ["${x:-y}", "${x-y}", "${x:=y}", "${x=y}"].map(
+          (s) => parseShared(`echo ${s}`).Stmts[0].Cmd.Args[1].Parts[0].Exp.Op
+        )
       )
-    );
+    }));
     exempt = (p) => SYSTEM_DIRS_EXEMPT.some((d) => within(p, d));
     RANK = { allow: 0, review: 1, block: 2 };
-    SEQUENCE_OPS = (() => {
-      const ops = /* @__PURE__ */ new Set();
+    SEQUENCE_OPS = lazy(() => {
+      const ops2 = /* @__PURE__ */ new Set();
       for (const text of ["x && y", "x || y"]) {
         try {
           const f = parseShared(text);
-          if (typeof f !== "symbol") ops.add(f.Stmts[0].Cmd.Op);
+          if (typeof f !== "symbol") ops2.add(f.Stmts[0].Cmd.Op);
         } catch {
         }
       }
-      return ops;
-    })();
+      return ops2;
+    });
     BIP39_ENGLISH = `abandon
 ability
 able
@@ -16242,13 +16280,13 @@ zoo`.split("\n");
     );
     NEVER_NEGATED = /* @__PURE__ */ new Set([SIGNALS[1].any[0]]);
     NEGATION_BEFORE = /\b(never|do not|don'?t|must not|mustn'?t|should not|shouldn'?t|not allowed to|forbidden to|avoid|without|no|not)\b[^.!?;:\n]{0,24}$/i;
-    RDR_IN = (() => {
+    RDR_IN = lazy(() => {
       try {
         return parseShared("x <y").Stmts[0].Redirs[0].Op;
       } catch {
         return null;
       }
-    })();
+    });
     COPY_VERBS2 = /* @__PURE__ */ new Set([
       "cp",
       "mv",
@@ -18076,7 +18114,7 @@ __export(audit_exports, {
   truncateAuditPreview: () => truncateAuditPreview
 });
 import fs from "fs";
-import path from "path";
+import path2 from "path";
 import os from "os";
 import crypto2 from "crypto";
 function generateEventId() {
@@ -18123,7 +18161,7 @@ function truncateAuditPreview(text) {
 function appendToLog(logPath, entry) {
   if (forecastRun()) return;
   try {
-    const dir2 = path.dirname(logPath);
+    const dir2 = path2.dirname(logPath);
     if (!fs.existsSync(dir2)) fs.mkdirSync(dir2, { recursive: true });
     fs.appendFileSync(logPath, JSON.stringify(entry) + "\n");
   } catch {
@@ -18202,7 +18240,7 @@ function appendLocalAudit(toolName, args, decision, checkedBy, meta, auditHashAr
   } : {};
   const cloudLinkField = meta?.cloudRequestId ? { cloudRequestId: meta.cloudRequestId } : {};
   const workingDirField = meta?.workingDir ? { workingDir: meta.workingDir } : {};
-  const shell = process.env.SHELL ? path.basename(process.env.SHELL) : void 0;
+  const shell = process.env.SHELL ? path2.basename(process.env.SHELL) : void 0;
   const shellTypeField = shell ? { shellType: shell } : {};
   const editFilePath = filePathFromArgs(args);
   const editFilePathField = editFilePath ? { editFilePath } : {};
@@ -18262,24 +18300,31 @@ var LOCAL_AUDIT_LOG, HOOK_DEBUG_LOG, TEST_COMMAND_RE;
 var init_audit = __esm({
   "src/audit/index.ts"() {
     "use strict";
+    init_esm_shims();
     init_hasher();
     init_forecast_context();
     init_dist();
-    LOCAL_AUDIT_LOG = path.join(os.homedir(), ".node9", "audit.log");
-    HOOK_DEBUG_LOG = path.join(os.homedir(), ".node9", "hook-debug.log");
+    LOCAL_AUDIT_LOG = path2.join(os.homedir(), ".node9", "audit.log");
+    HOOK_DEBUG_LOG = path2.join(os.homedir(), ".node9", "hook-debug.log");
     TEST_COMMAND_RE = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
   }
 });
 
+// src/index.ts
+init_esm_shims();
+
 // src/core.ts
+init_esm_shims();
 init_audit();
 
 // src/config/index.ts
+init_esm_shims();
 import fs4 from "fs";
-import path4 from "path";
+import path5 from "path";
 import os4 from "os";
 
 // src/config-schema.ts
+init_esm_shims();
 import { z } from "zod";
 var noNewlines = z.string().refine((s) => !s.includes("\n") && !s.includes("\r"), {
   message: "Value must not contain literal newline characters (use \\n instead)"
@@ -18469,8 +18514,8 @@ var ConfigFileSchema = z.object({
 }).strict();
 function formatIssues(issues) {
   const lines = issues.map((issue) => {
-    const path31 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  \u2022 ${path31}: ${issue.message}`;
+    const path32 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  \u2022 ${path32}: ${issue.message}`;
   });
   return `Invalid config:
 ${lines.join("\n")}`;
@@ -18483,9 +18528,9 @@ function prunePaths(root, paths) {
     const yi = y[y.length - 1];
     return typeof xi === "number" && typeof yi === "number" ? yi - xi : 0;
   });
-  for (const path31 of ordered) {
+  for (const path32 of ordered) {
     let cur = root;
-    for (const key of path31.slice(0, -1)) {
+    for (const key of path32.slice(0, -1)) {
       if (cur === null || typeof cur !== "object") {
         cur = void 0;
         break;
@@ -18493,7 +18538,7 @@ function prunePaths(root, paths) {
       cur = cur[key];
     }
     if (cur === null || typeof cur !== "object") continue;
-    const last = path31[path31.length - 1];
+    const last = path32[path32.length - 1];
     if (Array.isArray(cur)) {
       const i = Number(last);
       if (Number.isInteger(i) && i >= 0 && i < cur.length) {
@@ -18529,7 +18574,7 @@ function sanitizeConfig(raw) {
           return issue.keys.map((k) => [...at, k]);
         }
         return [at.slice(0, -level || void 0)];
-      }).filter((path31) => path31.length > 0);
+      }).filter((path32) => path32.length > 0);
       if (paths.length === 0 || !prunePaths(working, paths)) break;
     }
     if (ConfigFileSchema.safeParse(working).success) break;
@@ -18551,12 +18596,14 @@ function sanitizeConfig(raw) {
 }
 
 // src/shields.ts
+init_esm_shims();
 import fs2 from "fs";
-import path2 from "path";
+import path3 from "path";
 import os2 from "os";
 init_dist();
 
 // src/shields/build.ts
+init_esm_shims();
 init_dist();
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -18635,7 +18682,7 @@ function withAccessReading(def) {
 
 // src/shields.ts
 init_dist();
-var USER_SHIELDS_DIR = path2.join(os2.homedir(), ".node9", "shields");
+var USER_SHIELDS_DIR = path3.join(os2.homedir(), ".node9", "shields");
 function loadUserShields() {
   const result = {};
   let entries;
@@ -18651,7 +18698,7 @@ function loadUserShields() {
     return result;
   }
   for (const file2 of entries) {
-    const filePath = path2.join(USER_SHIELDS_DIR, file2);
+    const filePath = path3.join(USER_SHIELDS_DIR, file2);
     try {
       const raw = JSON.parse(fs2.readFileSync(filePath, "utf-8"));
       const v = validateShieldDefinition(raw);
@@ -18684,7 +18731,7 @@ function getShield(name) {
   const resolved = resolveShieldName(name);
   return resolved ? SHIELDS[resolved] : null;
 }
-var SHIELDS_STATE_FILE = path2.join(os2.homedir(), ".node9", "shields.json");
+var SHIELDS_STATE_FILE = path3.join(os2.homedir(), ".node9", "shields.json");
 function readShieldsFile() {
   try {
     const raw = fs2.readFileSync(SHIELDS_STATE_FILE, "utf-8");
@@ -18715,6 +18762,7 @@ function readShieldOverrides() {
 }
 
 // src/config/managed.ts
+init_esm_shims();
 var MODE_ORDER = ["observe", "audit", "soft", "standard", "strict", "block-all"];
 var EGRESS_MODE_ORDER = ["off", "review", "block"];
 function rankIn(order, value) {
@@ -18837,11 +18885,12 @@ function applyManagedApprovers(local, managed) {
 }
 
 // src/auth/trusted-hosts.ts
+init_esm_shims();
 import fs3 from "fs";
-import path3 from "path";
+import path4 from "path";
 import os3 from "os";
 function getTrustedHostsPath() {
-  return path3.join(os3.homedir(), ".node9", "trusted-hosts.json");
+  return path4.join(os3.homedir(), ".node9", "trusted-hosts.json");
 }
 function readTrustedHosts() {
   try {
@@ -18897,6 +18946,7 @@ init_dist();
 init_dist();
 
 // src/config/v2.ts
+init_esm_shims();
 init_dist();
 init_dist();
 var CONFIG_FILE_VERSION_2 = "2";
@@ -19023,6 +19073,7 @@ init_dist();
 init_dist();
 
 // src/auth/api-url.ts
+init_esm_shims();
 var DEFAULT_API_URL = "https://api.node9.ai/api/v1/intercept";
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]", "0.0.0.0"]);
 var HOST_ALLOW_ENV = "NODE9_API_HOST_ALLOW";
@@ -19409,7 +19460,7 @@ function noteRejectedApiUrl(raw) {
   rejectedApiUrlsSeen.add(key);
   try {
     fs4.appendFileSync(
-      path4.join(os4.homedir(), ".node9", "hook-debug.log"),
+      path5.join(os4.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
 `
     );
@@ -19426,7 +19477,7 @@ function getCredentials() {
     };
   }
   try {
-    const credPath = path4.join(os4.homedir(), ".node9", "credentials.json");
+    const credPath = path5.join(os4.homedir(), ".node9", "credentials.json");
     if (fs4.existsSync(credPath)) {
       const creds = JSON.parse(fs4.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
@@ -19475,7 +19526,7 @@ function readRulesCacheResilient(cacheFile) {
     }
   }
   if (existed || sawReadError) {
-    const backup = path4.join(path4.dirname(cacheFile), "rules-cache.last-good.json");
+    const backup = path5.join(path5.dirname(cacheFile), "rules-cache.last-good.json");
     if (backup !== cacheFile) {
       try {
         const raw = JSON.parse(fs4.readFileSync(backup, "utf-8"));
@@ -19502,7 +19553,7 @@ function logCacheReadIssue(cacheFile, kind) {
   cacheReadLastLoggedAt = now;
   try {
     fs4.appendFileSync(
-      path4.join(os4.homedir(), ".node9", "hook-debug.log"),
+      path5.join(os4.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] ${kind} ${cacheFile}
 `
     );
@@ -19528,8 +19579,8 @@ function catalogSettingsFrom(settings, policy) {
 }
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
-  const globalPath = path4.join(os4.homedir(), ".node9", "config.json");
-  const projectPath = path4.join(cwd ?? process.cwd(), "node9.config.json");
+  const globalPath = path5.join(os4.homedir(), ".node9", "config.json");
+  const projectPath = path5.join(cwd ?? process.cwd(), "node9.config.json");
   const globalConfig = tryLoadConfig(globalPath);
   const projectConfig = tryLoadConfig(projectPath, { project: true });
   const mergedSettings = {
@@ -19774,7 +19825,7 @@ function getConfig(cwd) {
   let cloudMandatesEnforcement = false;
   let cloudMandatesAppPerm = false;
   {
-    const cacheFile = path4.join(os4.homedir(), ".node9", "rules-cache.json");
+    const cacheFile = path5.join(os4.homedir(), ".node9", "rules-cache.json");
     try {
       const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
@@ -19967,13 +20018,13 @@ function getConfig(cwd) {
         }
         if (Array.isArray(mc.jailPaths)) {
           for (const jp of mc.jailPaths) {
-            const path31 = typeof jp?.path === "string" ? jp.path.trim() : "";
-            if (!path31) continue;
+            const path32 = typeof jp?.path === "string" ? jp.path.trim() : "";
+            if (!path32) continue;
             const verdict = jp?.verdict === "review" ? "review" : "block";
-            for (const r of pathRules(path31, verdict, "org-managed jail")) {
+            for (const r of pathRules(path32, verdict, "org-managed jail")) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
-            mergedPolicy.managedJailPaths.push({ path: path31, verdict });
+            mergedPolicy.managedJailPaths.push({ path: path32, verdict });
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -20309,13 +20360,16 @@ function applyUntrustedContent(cur, raw, replaceLists = false, isProject = false
 }
 
 // src/utils/regex.ts
+init_esm_shims();
 init_dist();
 
 // src/policy/index.ts
+init_esm_shims();
 init_dist();
 import fs13 from "fs";
 
 // src/utils/read-capped.ts
+init_esm_shims();
 import fs5 from "fs";
 function readCapped(file2, maxBytes, openFlags = "r") {
   if (maxBytes < 0) return null;
@@ -20355,23 +20409,24 @@ function readCappedText(file2, maxBytes, openFlags = "r") {
 }
 
 // src/policy/index.ts
-import path13 from "path";
+import path14 from "path";
 
 // src/dlp.ts
+init_esm_shims();
 init_dist();
 init_dist();
 import fs6 from "fs";
-import path5 from "path";
+import path6 from "path";
 function scanFilePath(filePath, cwd = process.cwd(), options = {}) {
   if (!filePath) return null;
   let resolved;
   try {
-    const absolute2 = path5.resolve(cwd, filePath);
+    const absolute2 = path6.resolve(cwd, filePath);
     resolved = fs6.realpathSync.native(absolute2);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR") {
-      resolved = path5.resolve(cwd, filePath);
+      resolved = path6.resolve(cwd, filePath);
     } else {
       return sensitivePathMatch(filePath);
     }
@@ -20380,6 +20435,7 @@ function scanFilePath(filePath, cwd = process.cwd(), options = {}) {
 }
 
 // src/policy/gate-order.ts
+init_esm_shims();
 var PRE_ENGINE_GATES = ["file", "dlp", "pii", "package"];
 var GATE_LABELS = {
   dlpBlock: "\u{1F6A8} Node9 DLP (Secret Detected)",
@@ -20591,19 +20647,20 @@ function combineWithEngine(gates, engine, opts = { panicMode: false }) {
 }
 
 // src/policy/file-access.ts
+init_esm_shims();
 init_dist();
 import fs7 from "fs";
 import os5 from "os";
-import path6 from "path";
+import path7 from "path";
 function absoluteSpelling(p, cwd, home) {
   if (p === "~" || p.startsWith("~/")) p = home + p.slice(1);
-  return path6.isAbsolute(p) ? p : `${cwd}/${p}`;
+  return path7.isAbsolute(p) ? p : `${cwd}/${p}`;
 }
 function physical(p, followFinal, links = 0) {
   if (links > 40) throw new Error("Too many symbolic links");
   if (!followFinal) {
-    const parent = physical(path6.dirname(p), true, links);
-    return { path: `${parent.path}/${path6.basename(p)}`, missing: parent.missing };
+    const parent = physical(path7.dirname(p), true, links);
+    return { path: `${parent.path}/${path7.basename(p)}`, missing: parent.missing };
   }
   try {
     return { path: fs7.realpathSync.native(p), missing: false };
@@ -20614,7 +20671,7 @@ function physical(p, followFinal, links = 0) {
       if (fs7.lstatSync(p).isSymbolicLink()) {
         const target = fs7.readlinkSync(p);
         return physical(
-          path6.isAbsolute(target) ? target : `${path6.dirname(p)}/${target}`,
+          path7.isAbsolute(target) ? target : `${path7.dirname(p)}/${target}`,
           true,
           links + 1
         );
@@ -20623,10 +20680,10 @@ function physical(p, followFinal, links = 0) {
       if (!["ENOENT", "ENOTDIR"].includes(linkError.code ?? ""))
         throw linkError;
     }
-    const parent = path6.dirname(p);
+    const parent = path7.dirname(p);
     if (parent === p) return { path: p, missing: true };
     const resolved = physical(parent, true, links);
-    return { path: `${resolved.path}/${path6.basename(p)}`, missing: true };
+    return { path: `${resolved.path}/${path7.basename(p)}`, missing: true };
   }
 }
 function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, home = os5.homedir()) {
@@ -20708,23 +20765,26 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
 }
 
 // src/supply-chain/check.ts
+init_esm_shims();
 init_dist();
 import picomatch2 from "picomatch";
-import path10 from "path";
+import path11 from "path";
 
 // src/supply-chain/osv-index.ts
+init_esm_shims();
 init_dist();
 import fs9 from "fs";
 import os6 from "os";
-import path8 from "path";
+import path9 from "path";
 import { createHash as createHash4 } from "crypto";
 
 // src/utils/atomic-write.ts
+init_esm_shims();
 import fs8 from "fs";
-import path7 from "path";
+import path8 from "path";
 import { randomUUID } from "crypto";
 function atomicWriteSync(filePath, data, options) {
-  const dir2 = path7.dirname(filePath);
+  const dir2 = path8.dirname(filePath);
   if (!fs8.existsSync(dir2)) fs8.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${filePath}.${randomUUID()}.tmp`;
   try {
@@ -20750,10 +20810,10 @@ function atomicWriteSync(filePath, data, options) {
 // src/supply-chain/osv-index.ts
 var INDEX_FRESH_MS = 72 * 60 * 60 * 1e3;
 function osvRoot() {
-  return path8.join(os6.homedir(), ".node9", "osv");
+  return path9.join(os6.homedir(), ".node9", "osv");
 }
 function ecoDir(eco) {
-  return path8.join(osvRoot(), eco);
+  return path9.join(osvRoot(), eco);
 }
 function indexKey(eco, name) {
   switch (eco) {
@@ -20772,11 +20832,11 @@ function shardOf(key) {
   return createHash4("sha1").update(key).digest("hex").slice(0, 2);
 }
 function shardPath(eco, shard) {
-  return path8.join(ecoDir(eco), "shards", `${shard}.json`);
+  return path9.join(ecoDir(eco), "shards", `${shard}.json`);
 }
 function readMeta(eco) {
   try {
-    const m = JSON.parse(fs9.readFileSync(path8.join(ecoDir(eco), "meta.json"), "utf8"));
+    const m = JSON.parse(fs9.readFileSync(path9.join(ecoDir(eco), "meta.json"), "utf8"));
     if (typeof m?.syncedAt !== "string" || typeof m?.lastModifiedMs !== "number") return null;
     return m;
   } catch {
@@ -20829,7 +20889,11 @@ function entryCovers(entry, version) {
   return (entry.ranges ?? []).some((r) => inRange(version, r));
 }
 
+// src/supply-chain/osv-online.ts
+init_esm_shims();
+
 // src/supply-chain/net.ts
+init_esm_shims();
 var DEFAULTS = {
   osvBucket: "https://osv-vulnerabilities.storage.googleapis.com",
   osvApi: "https://api.osv.dev",
@@ -20911,9 +20975,11 @@ async function queryOsvMalicious(queries) {
 }
 
 // src/supply-chain/registry.ts
+init_esm_shims();
 import { maxSatisfying, satisfies, validRange } from "semver";
 
 // src/supply-chain/provenance.ts
+init_esm_shims();
 import { prerelease, rcompare, valid } from "semver";
 var TIMEOUT_MS2 = 1500;
 var MAX_BYTES = 256 * 1024;
@@ -21132,17 +21198,18 @@ async function registryInfo(eco, name, version, freshWindowMs, raw) {
 }
 
 // src/supply-chain/local-resolve.ts
+init_esm_shims();
 import fs10 from "fs";
-import path9 from "path";
+import path10 from "path";
 var MAX_LEVELS = 32;
 var LOCAL_FIRST_MANAGERS = /* @__PURE__ */ new Set(["npx", "bunx", "npm exec"]);
 function resolveInstalled(name, cwd) {
-  if (!cwd || !path9.isAbsolute(cwd)) return null;
+  if (!cwd || !path10.isAbsolute(cwd)) return null;
   if (!/^(?:@[^/\\]+\/)?[^/\\]+$/.test(name)) return null;
-  let dir2 = path9.resolve(cwd);
+  let dir2 = path10.resolve(cwd);
   for (let i = 0; i < MAX_LEVELS; i++) {
-    const pkgDir = path9.join(dir2, "node_modules", ...name.split("/"));
-    const manifest = path9.join(pkgDir, "package.json");
+    const pkgDir = path10.join(dir2, "node_modules", ...name.split("/"));
+    const manifest = path10.join(pkgDir, "package.json");
     try {
       const raw = fs10.readFileSync(manifest, "utf8");
       const parsed = JSON.parse(raw);
@@ -21152,7 +21219,7 @@ function resolveInstalled(name, cwd) {
       return null;
     } catch {
     }
-    const parent = path9.dirname(dir2);
+    const parent = path10.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -21274,7 +21341,7 @@ function checkInstalled(p, version, misses) {
 }
 async function checkOne(p, cfg, misses, networkCapped, cwd) {
   if (p.ecosystem === "npm" && LOCAL_FIRST_MANAGERS.has(p.manager) && p.localCwd !== null && (p.raw === p.name || p.version)) {
-    const localCwd = cwd && path10.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => path10.resolve(dir2, step), cwd) : void 0;
+    const localCwd = cwd && path11.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => path11.resolve(dir2, step), cwd) : void 0;
     const installed = resolveInstalled(p.name, localCwd);
     if (installed && (!p.version || p.version === installed.version))
       return checkInstalled(p, installed.version, misses);
@@ -21418,9 +21485,10 @@ async function runPackageCheck(toolName, args, cfg, cwd, opts = {}) {
 }
 
 // src/supply-chain/registries.ts
+init_esm_shims();
 init_dist();
 import os7 from "os";
-import path11 from "path";
+import path12 from "path";
 import fs11 from "fs";
 var MAX_CONFIG_BYTES = 256 * 1024;
 var MAX_PARENT_DIRS = 12;
@@ -21462,29 +21530,29 @@ var REGISTRY_KEY_RE = /registry|index|find-links|mirror/i;
 var REGISTRY_SECTION_RE = /index|source|registr|scopes|mirror/i;
 var URL_RE2 = /https?:\/\/[^\s"'<>,;]+/gi;
 function userFiles(home, env) {
-  const xdg = env.XDG_CONFIG_HOME || path11.join(home, ".config");
+  const xdg = env.XDG_CONFIG_HOME || path12.join(home, ".config");
   return [
-    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || path11.join(home, ".npmrc"),
-    path11.join(home, ".yarnrc"),
-    path11.join(home, ".yarnrc.yml"),
-    path11.join(home, ".bunfig.toml"),
+    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || path12.join(home, ".npmrc"),
+    path12.join(home, ".yarnrc"),
+    path12.join(home, ".yarnrc.yml"),
+    path12.join(home, ".bunfig.toml"),
     env.PIP_CONFIG_FILE || "",
-    path11.join(xdg, "pip", "pip.conf"),
-    path11.join(home, ".pip", "pip.conf"),
+    path12.join(xdg, "pip", "pip.conf"),
+    path12.join(home, ".pip", "pip.conf"),
     "/etc/pip.conf",
-    env.VIRTUAL_ENV ? path11.join(env.VIRTUAL_ENV, "pip.conf") : "",
+    env.VIRTUAL_ENV ? path12.join(env.VIRTUAL_ENV, "pip.conf") : "",
     env.UV_CONFIG_FILE || "",
-    path11.join(xdg, "uv", "uv.toml"),
+    path12.join(xdg, "uv", "uv.toml"),
     "/etc/uv/uv.toml"
   ].filter(Boolean);
 }
 function projectFiles(cwd) {
-  if (!cwd || !path11.isAbsolute(cwd)) return [];
+  if (!cwd || !path12.isAbsolute(cwd)) return [];
   const out = [];
   let dir2 = cwd;
   for (let i = 0; i < MAX_PARENT_DIRS; i++) {
-    for (const f of PROJECT_FILES) out.push(path11.join(dir2, f));
-    const parent = path11.dirname(dir2);
+    for (const f of PROJECT_FILES) out.push(path12.join(dir2, f));
+    const parent = path12.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -21555,25 +21623,26 @@ function configuredRegistryHosts(cwd, env = process.env, home = os7.homedir()) {
 }
 
 // src/utils/provenance.ts
+init_esm_shims();
 import fs12 from "fs";
-import path12 from "path";
+import path13 from "path";
 import os8 from "os";
 var SYSTEM_PREFIXES = ["/usr/bin", "/usr/sbin", "/bin", "/sbin"];
 var MANAGED_PREFIXES = ["/usr/local/bin", "/opt/homebrew", "/home/linuxbrew", "/nix/store"];
 var USER_PREFIXES = [
-  path12.join(os8.homedir(), "bin"),
-  path12.join(os8.homedir(), ".local", "bin"),
-  path12.join(os8.homedir(), ".cargo", "bin"),
-  path12.join(os8.homedir(), ".npm-global", "bin"),
-  path12.join(os8.homedir(), ".volta", "bin")
+  path13.join(os8.homedir(), "bin"),
+  path13.join(os8.homedir(), ".local", "bin"),
+  path13.join(os8.homedir(), ".cargo", "bin"),
+  path13.join(os8.homedir(), ".npm-global", "bin"),
+  path13.join(os8.homedir(), ".volta", "bin")
 ];
 var SUSPECT_PREFIXES = ["/tmp", "/var/tmp", "/dev/shm"];
 function findInPath(cmd) {
-  if (path12.posix.isAbsolute(cmd)) return cmd;
+  if (path13.posix.isAbsolute(cmd)) return cmd;
   const pathEnv = process.env.PATH ?? "";
-  for (const dir2 of pathEnv.split(path12.delimiter)) {
+  for (const dir2 of pathEnv.split(path13.delimiter)) {
     if (!dir2) continue;
-    const full = path12.join(dir2, cmd);
+    const full = path13.join(dir2, cmd);
     try {
       fs12.accessSync(full, fs12.constants.X_OK);
       return full;
@@ -21604,7 +21673,7 @@ function _classifyPath(resolved, cwd) {
 }
 function checkProvenance(cmd, cwd) {
   const bare = cmd.startsWith("./") ? cmd.slice(2) : cmd;
-  if (path12.posix.isAbsolute(bare)) {
+  if (path13.posix.isAbsolute(bare)) {
     const early = _classifyPath(bare, cwd);
     if (early.trustLevel === "suspect") {
       return { resolvedPath: bare, ...early };
@@ -21683,9 +21752,9 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
   );
 }
 function isGitWorkTreeTop(dir2, cwd) {
-  if (!path13.isAbsolute(cwd)) return true;
+  if (!path14.isAbsolute(cwd)) return true;
   try {
-    return fs13.existsSync(path13.join(path13.resolve(cwd, dir2), ".git"));
+    return fs13.existsSync(path14.join(path14.resolve(cwd, dir2), ".git"));
   } catch {
     return true;
   }
@@ -21704,12 +21773,13 @@ function isIgnoredTool2(toolName) {
 }
 
 // src/auth/state.ts
+init_esm_shims();
 import fs14 from "fs";
-import path14 from "path";
+import path15 from "path";
 import os9 from "os";
 init_forecast_context();
-var PAUSED_FILE = path14.join(os9.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = path14.join(os9.homedir(), ".node9", "trust.json");
+var PAUSED_FILE = path15.join(os9.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = path15.join(os9.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower2 = toolName.toLowerCase();
   if (lower2 !== "bash" && lower2 !== "execute_bash" && lower2 !== "shell") return void 0;
@@ -21786,7 +21856,7 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = path14.join(os9.homedir(), ".node9", "decisions.json");
+    const file2 = path15.join(os9.homedir(), ".node9", "decisions.json");
     if (!fs14.existsSync(file2)) return null;
     const decisions = JSON.parse(fs14.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
@@ -21797,14 +21867,16 @@ function getPersistentDecision(toolName) {
 }
 
 // src/auth/daemon.ts
+init_esm_shims();
 init_forecast_context();
 import fs15 from "fs";
 import http from "http";
 import net from "net";
-import path15 from "path";
+import path16 from "path";
 import os10 from "os";
 
 // src/auth/decision-record.ts
+init_esm_shims();
 var CHANNELS = ["terminal", "monitor", "native", "cloud"];
 var PERSON_CHANNELS = /* @__PURE__ */ new Set([
   "terminal",
@@ -21952,20 +22024,31 @@ function recordFromLegacyWait(body, now = Date.now()) {
 }
 
 // src/auth/daemon.ts
-var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path15.join(os10.tmpdir(), "node9-activity.sock");
-function notifyActivitySocket(data) {
+var ACTIVITY_SOCKET_PATH = process.platform === "win32" ? "\\\\.\\pipe\\node9-activity" : path16.join(os10.tmpdir(), "node9-activity.sock");
+var ACTIVITY_SOCKET_TIMEOUT_MS = 500;
+function notifyActivitySocket(data, opts = {}) {
   if (forecastRun()) return Promise.resolve(false);
   return new Promise((resolve) => {
+    let settled = false;
+    let sock = null;
+    const finish = (ok) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (!ok) sock?.destroy();
+      resolve(ok);
+    };
+    const timer = setTimeout(() => finish(false), opts.timeoutMs ?? ACTIVITY_SOCKET_TIMEOUT_MS);
     try {
       const payload = JSON.stringify(data);
-      const sock = net.createConnection(ACTIVITY_SOCKET_PATH);
+      sock = net.createConnection(opts.socketPath ?? ACTIVITY_SOCKET_PATH);
       sock.on("connect", () => {
-        sock.on("close", () => resolve(true));
+        sock.on("close", () => finish(true));
         sock.end(payload);
       });
-      sock.on("error", () => resolve(false));
+      sock.on("error", () => finish(false));
     } catch {
-      resolve(false);
+      finish(false);
     }
   });
 }
@@ -21997,7 +22080,7 @@ var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = path15.join(os10.homedir(), ".node9", "daemon.pid");
+    const pidFile = path16.join(os10.homedir(), ".node9", "daemon.pid");
     if (!fs15.existsSync(pidFile)) return null;
     const data = JSON.parse(fs15.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
@@ -22008,7 +22091,7 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = path15.join(os10.homedir(), ".node9", "daemon.pid");
+  const pidFile = path16.join(os10.homedir(), ".node9", "daemon.pid");
   if (fs15.existsSync(pidFile)) {
     let pid;
     let port;
@@ -22366,14 +22449,17 @@ async function resolveViaDaemon(id, decision, internalToken, source, record) {
 }
 
 // src/auth/orchestrator.ts
+init_esm_shims();
 import { randomUUID as randomUUID2 } from "crypto";
 
 // src/apps/state.ts
+init_esm_shims();
 import fs17 from "fs";
 import os12 from "os";
-import path17 from "path";
+import path18 from "path";
 
 // src/apps/catalog.ts
+init_esm_shims();
 var APP_CATALOG = [
   {
     slug: "redis",
@@ -22503,11 +22589,17 @@ var APP_BY_SLUG = new Map(
 init_audit();
 
 // src/daemon/mcp-tools.ts
+init_esm_shims();
 import fs16 from "fs";
-import path16 from "path";
+import path17 from "path";
 import os11 from "os";
+
+// src/mcp-cmd.ts
+init_esm_shims();
+
+// src/daemon/mcp-tools.ts
 function getMcpToolsFile() {
-  return path16.join(os11.homedir(), ".node9", "mcp-tools.json");
+  return path17.join(os11.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
@@ -22522,7 +22614,7 @@ function readMcpToolsConfig() {
 
 // src/apps/state.ts
 function appsFilePath(home = os12.homedir()) {
-  return path17.join(home, ".node9", "apps.json");
+  return path18.join(home, ".node9", "apps.json");
 }
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["mcp-server", "command", "package", "env-name"]);
 function emptyFile() {
@@ -22626,14 +22718,16 @@ function resolveLinkedServer(label2, opts = {}) {
 
 // src/auth/orchestrator.ts
 import os21 from "os";
-import path30 from "path";
+import path31 from "path";
 
 // src/ui/native.ts
+init_esm_shims();
 import { spawn } from "child_process";
-import path19 from "path";
+import path20 from "path";
 
 // src/context-sniper.ts
-import path18 from "path";
+init_esm_shims();
+import path19 from "path";
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -22701,7 +22795,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = path18.basename(editFilePath);
+        editFileName = path19.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -22735,6 +22829,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
 }
 
 // src/utils/safe-text.ts
+init_esm_shims();
 init_dist();
 
 // src/ui/native.ts
@@ -22769,7 +22864,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? path19.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? path20.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -22972,19 +23067,21 @@ end run`;
 }
 
 // src/canary/registry.ts
+init_esm_shims();
 import fs19 from "fs";
 import os14 from "os";
-import path21 from "path";
+import path22 from "path";
 init_dist();
 
 // src/shields/jail.ts
+init_esm_shims();
 import fs18 from "fs";
 import os13 from "os";
-import path20 from "path";
+import path21 from "path";
 init_dist();
 var USER_JAIL_SHIELD = "user-jail";
 function jailStorePath() {
-  return path20.join(os13.homedir(), ".node9", "jail-paths.json");
+  return path21.join(os13.homedir(), ".node9", "jail-paths.json");
 }
 function readJailPaths() {
   let text;
@@ -23018,7 +23115,7 @@ function findJailedPathIn(candidate, paths) {
 
 // src/canary/registry.ts
 function canaryStorePath() {
-  return path21.join(os14.homedir(), ".node9", "canaries.json");
+  return path22.join(os14.homedir(), ".node9", "canaries.json");
 }
 function isRecord(x) {
   if (!x || typeof x !== "object") return false;
@@ -23055,10 +23152,11 @@ function canaryValues() {
 init_dist();
 
 // src/auth/session-script.ts
+init_esm_shims();
 init_dist();
 import fs20 from "fs";
 import os15 from "os";
-import path22 from "path";
+import path23 from "path";
 var MAX_SCRIPT_BYTES = 64 * 1024;
 var MAX_RECORDED_WRITES = 32;
 function readScriptFile(resolved) {
@@ -23089,7 +23187,7 @@ function readScriptFile(resolved) {
 }
 function absolute(p, cwd, home) {
   const spelled = p === "~" || p.startsWith("~/") ? home + p.slice(1) : p;
-  return path22.resolve(cwd, spelled);
+  return path23.resolve(cwd, spelled);
 }
 async function resolveSessionScript(toolName, args, cwd, layers, deps, home = os15.homedir()) {
   try {
@@ -23150,13 +23248,15 @@ init_audit();
 init_dist();
 
 // src/exposure/known-hosts.ts
+init_esm_shims();
 import fs22 from "fs";
-import path24 from "path";
+import path25 from "path";
 
 // src/utils/git-remotes.ts
+init_esm_shims();
 init_dist();
 import fs21 from "fs";
-import path23 from "path";
+import path24 from "path";
 function readSmallFile(p, max) {
   let fd;
   try {
@@ -23188,20 +23288,20 @@ function gitRemoteHost(url) {
   return null;
 }
 function findGitConfig(dir2, walkUp = true) {
-  let cur = path23.resolve(dir2);
+  let cur = path24.resolve(dir2);
   for (let i = 0; i < (walkUp ? 64 : 1); i++) {
-    const dotGit = path23.join(cur, ".git");
-    const direct = readSmallFile(path23.join(dotGit, "config"), 1e6);
+    const dotGit = path24.join(cur, ".git");
+    const direct = readSmallFile(path24.join(dotGit, "config"), 1e6);
     if (direct !== null) return direct;
     const pointer = readSmallFile(dotGit, 4096);
     const m = pointer && /^gitdir:\s*(.+?)\s*$/m.exec(pointer);
     if (m) {
-      let gitDir = path23.resolve(cur, m[1]);
-      const common = readSmallFile(path23.join(gitDir, "commondir"), 4096);
-      if (common !== null) gitDir = path23.resolve(gitDir, common.trim());
-      return readSmallFile(path23.join(gitDir, "config"), 1e6);
+      let gitDir = path24.resolve(cur, m[1]);
+      const common = readSmallFile(path24.join(gitDir, "commondir"), 4096);
+      if (common !== null) gitDir = path24.resolve(gitDir, common.trim());
+      return readSmallFile(path24.join(gitDir, "config"), 1e6);
     }
-    const parent = path23.dirname(cur);
+    const parent = path24.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23211,12 +23311,12 @@ var cache4 = /* @__PURE__ */ new Map();
 function readGitRemotes(dir2, opts = {}) {
   if (!dir2) return [];
   const walkUp = opts.walkUp !== false;
-  const key = `${walkUp ? "up" : "at"}:${path23.resolve(dir2)}`;
+  const key = `${walkUp ? "up" : "at"}:${path24.resolve(dir2)}`;
   const hit = cache4.get(key);
   if (hit) return hit;
   const out = [];
   try {
-    const cfg = findGitConfig(path23.resolve(dir2), walkUp);
+    const cfg = findGitConfig(path24.resolve(dir2), walkUp);
     if (cfg !== null) {
       let current = null;
       for (const line of cfg.split(/\r?\n/)) {
@@ -23252,15 +23352,15 @@ var ECOSYSTEMS = [
 ];
 var cache5 = /* @__PURE__ */ new Map();
 function manifestRoot(dir2) {
-  let cur = path24.resolve(dir2);
+  let cur = path25.resolve(dir2);
   for (let i = 0; i < 64; i++) {
     for (const [m] of ECOSYSTEMS) {
       try {
-        if (fs22.existsSync(path24.join(cur, m))) return cur;
+        if (fs22.existsSync(path25.join(cur, m))) return cur;
       } catch {
       }
     }
-    const parent = path24.dirname(cur);
+    const parent = path25.dirname(cur);
     if (parent === cur) return null;
     cur = parent;
   }
@@ -23269,7 +23369,7 @@ function manifestRoot(dir2) {
 function knownProjectHosts(dir2) {
   const empty = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
   if (!dir2) return empty;
-  const key = path24.resolve(dir2);
+  const key = path25.resolve(dir2);
   const hit = cache5.get(key);
   if (hit) return hit;
   const out = { hosts: /* @__PURE__ */ new Set(), repos: /* @__PURE__ */ new Set(), remotes: /* @__PURE__ */ new Map() };
@@ -23282,7 +23382,7 @@ function knownProjectHosts(dir2) {
     const root = manifestRoot(key);
     if (root !== null) {
       for (const [m, registry] of ECOSYSTEMS) {
-        if (fs22.existsSync(path24.join(root, m))) out.hosts.add(registry);
+        if (fs22.existsSync(path25.join(root, m))) out.hosts.add(registry);
       }
       try {
         if (fs22.readdirSync(root).some((f) => f.endsWith(".gemspec")))
@@ -23297,10 +23397,11 @@ function knownProjectHosts(dir2) {
 }
 
 // src/exposure/writes.ts
+init_esm_shims();
 init_dist();
 import fs23 from "fs";
 import os16 from "os";
-import path25 from "path";
+import path26 from "path";
 var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "remove"]);
 var LIFECYCLE_RE = /"(scripts|preinstall|install|postinstall|prepare|prepublish|prepublishOnly|prepack|postpack|publish|postpublish)"\s*:/;
 function writtenContent(args) {
@@ -23350,7 +23451,7 @@ function judgeWritesAfterExposure(opts) {
     seen.add(p);
     if (p === "/dev" || p.startsWith("/dev/")) continue;
     if (root !== null && isInside(root, p)) {
-      if (isAgentInstructionPath(p, root) && (path25.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
+      if (isAgentInstructionPath(p, root) && (path26.basename(p) !== "package.json" || packageScriptsTouched(opts.args, p, opts.shellCommand)))
         holds.push({ path: p, why: "agent-instruction" });
       continue;
     }
@@ -23371,22 +23472,24 @@ function judgeWritesAfterExposure(opts) {
 }
 
 // src/exposure/marker.ts
+init_esm_shims();
 import crypto3 from "crypto";
 import fs24 from "fs";
 import os17 from "os";
-import path26 from "path";
+import path27 from "path";
 
 // src/daemon/exposure-store.ts
+init_esm_shims();
 var SESSION_EXPOSURE_TTL_MS = 4 * 60 * 60 * 1e3;
 
 // src/exposure/marker.ts
 init_forecast_context();
 function dir() {
-  return path26.join(os17.homedir(), ".node9", "exposure-sessions");
+  return path27.join(os17.homedir(), ".node9", "exposure-sessions");
 }
 function file(sessionId) {
   const id = crypto3.createHash("sha256").update(sessionId).digest("hex").slice(0, 32);
-  return path26.join(dir(), id);
+  return path27.join(dir(), id);
 }
 function maybeSessionExposed(sessionId) {
   if (!sessionId) return false;
@@ -23401,6 +23504,7 @@ function maybeSessionExposed(sessionId) {
 }
 
 // src/exposure/roles.ts
+init_esm_shims();
 import fs25 from "fs";
 var EXPOSURE_LABEL = "\u{1F6E1}\uFE0F Node9 Exposure";
 var AGENT_INTERNAL_PREFIXES = ["ccd_", "visualize"];
@@ -23495,12 +23599,13 @@ function sourceWord(toolName) {
 }
 
 // src/auth/trusted-recipients.ts
+init_esm_shims();
 init_dist();
 import fs26 from "fs";
-import path27 from "path";
+import path28 from "path";
 import os18 from "os";
 function getTrustedRecipientsPath() {
-  return path27.join(os18.homedir(), ".node9", "trusted-recipients.json");
+  return path28.join(os18.homedir(), ".node9", "trusted-recipients.json");
 }
 function readTrustedRecipients() {
   try {
@@ -23513,7 +23618,7 @@ function readTrustedRecipients() {
 }
 function writeTrustedRecipients(entries) {
   const filePath = getTrustedRecipientsPath();
-  fs26.mkdirSync(path27.dirname(filePath), { recursive: true });
+  fs26.mkdirSync(path28.dirname(filePath), { recursive: true });
   const tmp = filePath + ".node9-tmp";
   fs26.writeFileSync(tmp, JSON.stringify({ entries }, null, 2), { mode: 384 });
   fs26.renameSync(tmp, filePath);
@@ -23548,10 +23653,11 @@ function isTrustedRecipient(value) {
 init_forecast_context();
 
 // src/auth/cloud.ts
+init_esm_shims();
 init_audit();
 import fs27 from "fs";
 import os19 from "os";
-import path28 from "path";
+import path29 from "path";
 init_dist();
 var CLOUD_ARRAY_KEYS = /* @__PURE__ */ new Set(["exposureDestinations", "exposureDestinationHashes"]);
 function maskArgsForCloud(args) {
@@ -23586,7 +23692,7 @@ async function initNode9SaaS(toolName, args, creds, meta, riskMetadata, agentPol
   let ciContext;
   if (process.env.CI) {
     try {
-      const ciContextPath = path28.join(os19.homedir(), ".node9", "ci-context.json");
+      const ciContextPath = path29.join(os19.homedir(), ".node9", "ci-context.json");
       const ci = readCappedText(ciContextPath, 1e4);
       if (!ci) throw new Error("ci-context.json unreadable");
       if (ci.truncated) throw new Error("ci-context.json exceeds 10 KB");
@@ -23720,14 +23826,15 @@ async function resolveNode9SaaS(requestId, creds, approved, decidedBy) {
 }
 
 // src/loop-detector.ts
+init_esm_shims();
 init_dist();
 init_forecast_context();
 init_dist();
 import fs28 from "fs";
-import path29 from "path";
+import path30 from "path";
 import os20 from "os";
 function loopStateFile() {
-  return path29.join(os20.homedir(), ".node9", "loop-state.json");
+  return path30.join(os20.homedir(), ".node9", "loop-state.json");
 }
 function readState() {
   try {
@@ -23741,7 +23848,7 @@ function readState() {
   }
 }
 function writeState(records) {
-  const dir2 = path29.dirname(loopStateFile());
+  const dir2 = path30.dirname(loopStateFile());
   if (!fs28.existsSync(dir2)) fs28.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${loopStateFile()}.${os20.hostname()}.${process.pid}.tmp`;
   fs28.writeFileSync(tmpPath, JSON.stringify(records));
@@ -23771,6 +23878,7 @@ function recordAndCheck(tool, args, threshold = 3, windowMs = 12e4) {
 }
 
 // src/policy/negotiation.ts
+init_esm_shims();
 var BLOCKED_BY = " is blocked by ";
 var DASH_BLOCKED_BY = " \u2014 blocked by ";
 var SHIELD = " shield";
@@ -23789,6 +23897,7 @@ function asApprovalRequest(description) {
 }
 
 // src/auth/card-result.ts
+init_esm_shims();
 var CHANNEL_NAMES = {
   terminal: "Terminal (node9 tail)",
   monitor: "node9 monitor",
@@ -23941,9 +24050,9 @@ function isMcpToolName(toolName) {
   return /^mcp__[^_](?:[^_]|_(?!_))*?__/i.test(toolName);
 }
 function absoluteUploadPath(spelled, cwd) {
-  const expanded = spelled === "~" || spelled.startsWith("~/") ? path30.join(os21.homedir(), spelled.slice(1)) : spelled;
-  if (path30.isAbsolute(expanded)) return expanded;
-  return cwd && path30.isAbsolute(cwd) ? path30.resolve(cwd, expanded) : expanded;
+  const expanded = spelled === "~" || spelled.startsWith("~/") ? path31.join(os21.homedir(), spelled.slice(1)) : spelled;
+  if (path31.isAbsolute(expanded)) return expanded;
+  return cwd && path31.isAbsolute(cwd) ? path31.resolve(cwd, expanded) : expanded;
 }
 function extractFilePaths(toolName, args, shellCommand) {
   const paths = [];