@node9/proxy 2.50.0 → 2.51.0

package/dist/hook.js

@@ -2050,9 +2050,15 @@ function detectDangerousShellExec(command) {
     if (f === PARSE_FAIL) return null;
     let result = null;
     const assigned = assignedNames(f);
-    walk(f, (node) => {
+    const known = plainlyNamedPrograms(f);
+    const calledByName = literallyCalledFunctions(f);
+    const bodies = [];
+    const inBody = (pos) => bodies.some(([a, b]) => pos >= a && pos < b);
+    walkWithCalls(f, (node) => {
       if (!node || result === "block") return false;
       const n = node;
+      if (n.kind === "FuncDecl" && n.Body && callDepth === 0 && calledByName.has(n.Name?.Value))
+        bodies.push([n.Body.pos, n.Body.end]);
       if (n.kind === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
         const call = n.Y.Cmd;
         if (call && call.kind === "CallExpr") {
@@ -2076,7 +2082,8 @@ function detectDangerousShellExec(command) {
       );
       const head = unwrapCommandHead(headWords, false, true);
       const lookup = headWords[0]?.toLowerCase() === "command" && headWords.slice(1).some((w) => w === "-v" || w === "-V");
-      if (!lookup && (opaqueExecutable(args[0], assigned) || opaqueExecutable(args[head], assigned)))
+      const unboundBody = callDepth === 0 && inBody(n.pos ?? -1);
+      if (!lookup && !unboundBody && (opaqueExecutable(args[0], assigned, known) || opaqueExecutable(args[head], assigned, known)))
         result = "review";
       const firstParts = args[0].Parts || [];
       if (firstParts.length !== 1 || firstParts[0].kind !== "Lit") return true;
@@ -2136,11 +2143,105 @@ function assignedNames(f) {
   });
   return names;
 }
-function executableParts(word, assigned, quoted = false) {
+function literallyCalledFunctions(f) {
+  const declared = /* @__PURE__ */ new Set();
+  const called = /* @__PURE__ */ new Set();
+  walk(f, (node) => {
+    if (!node) return false;
+    if (node.kind === "FuncDecl" && node.Name?.Value) declared.add(node.Name.Value);
+    if (node.kind === "CallExpr") {
+      const head = resolveWordLiteral(node.Args?.[0]);
+      if (head) called.add(head);
+    }
+    return true;
+  });
+  return new Set([...declared].filter((name) => called.has(name)));
+}
+function plainlyNamedPrograms(f) {
+  const values = /* @__PURE__ */ new Map();
+  const arrays = /* @__PURE__ */ new Set();
+  const give = (name, value) => {
+    if (value === null || !PLAIN_PROGRAM_NAME.test(value)) {
+      values.set(name, null);
+      return;
+    }
+    const cur = values.get(name);
+    if (cur === null) return;
+    if (cur === void 0) values.set(name, /* @__PURE__ */ new Set([value]));
+    else cur.add(value);
+  };
+  const literalOnly = (w) => {
+    const parts = w?.Parts ?? [];
+    if (parts.length !== 1) return null;
+    const p = parts[0];
+    if (p.kind === "Lit") return p.Value ?? null;
+    if (p.kind === "ParamExp" && expansionName(p) === "FUNCNAME") return "FUNCNAME";
+    if (p.kind === "SglQuoted" && !p.Dollar) return p.Value ?? null;
+    if (p.kind === "DblQuoted") {
+      const inner = p.Parts ?? [];
+      return inner.length === 1 && inner[0].kind === "Lit" ? inner[0].Value ?? null : null;
+    }
+    return null;
+  };
+  let ifsTouched = false;
+  walk(f, (node) => {
+    if (!node) return false;
+    const kind = node.kind;
+    if (kind === "FuncDecl" && node.Name?.Value) give(node.Name.Value, node.Name.Value);
+    if (kind === "Assign" && node.Name?.Value) {
+      const name = node.Name.Value;
+      if (name === "IFS") ifsTouched = true;
+      if (node.Append) values.set(name, null);
+      else if (node.Array) {
+        arrays.add(name);
+        for (const el of node.Array.Elems ?? []) give(name, literalOnly(el.Value));
+      } else if (node.Index) {
+        arrays.add(name);
+        give(name, node.Value ? literalOnly(node.Value) : null);
+      } else give(name, node.Value ? literalOnly(node.Value) : null);
+    }
+    if (kind === "ForClause" && node.Loop?.Name?.Value) values.set(node.Loop.Name.Value, null);
+    if (kind === "CallExpr") {
+      const words = (node.Args ?? []).map((a) => resolveWordLiteral(a));
+      if (VARIABLE_READERS.has(words[0] ?? "")) {
+        for (const w of words.slice(1)) if (w && /^[A-Za-z_]\w*$/.test(w)) values.set(w, null);
+      }
+    }
+    return true;
+  });
+  if (ifsTouched) return /* @__PURE__ */ new Set();
+  const functions = /* @__PURE__ */ new Set();
+  walk(f, (node) => {
+    if (node && node.kind === "FuncDecl" && node.Name?.Value) functions.add(node.Name.Value);
+    return true;
+  });
+  const callable = (v) => functions.has(v) || v === "FUNCNAME" || v === "true" || v === "false" || v === ":";
+  for (const [name, vals] of values) {
+    if (vals && ![...vals].every(callable)) values.set(name, null);
+  }
+  const known = /* @__PURE__ */ new Set();
+  for (const [name, vals] of values)
+    if (vals && (vals.size === 1 || arrays.has(name) && vals.size > 0)) known.add(name);
+  return known;
+}
+function expansionName(part) {
+  if (part.kind !== "ParamExp") return null;
+  if (part.Excl || part.Length || part.Width || part.Slice || part.Repl || part.Exp) return null;
+  return part.Param?.Value ?? null;
+}
+function executableParts(word, assigned, quoted = false, known = EMPTY_NAMES) {
   return (word?.Parts ?? []).flatMap((part) => {
     const kind = part.kind;
-    if (kind === "DblQuoted") return executableParts(part, assigned, true);
+    if (kind === "DblQuoted") return executableParts(part, assigned, true, known);
     if (kind === "Lit") return [{ kind: "Lit", value: part.Value ?? "", quoted }];
+    const name = expansionName(part);
+    if (name !== null && (known.has(name) || name === "FUNCNAME"))
+      return [{ kind: "Lit", value: name, quoted }];
+    if (name !== null) {
+      const bound = recordedExpansion(name === "@" || name === "*" ? "1" : name);
+      if (typeof bound === "string" && PLAIN_PROGRAM_NAME.test(bound))
+        return [{ kind: "Lit", value: bound, quoted }];
+    }
     if (kind === "SglQuoted")
       return [{ kind: part.Dollar ? "Dynamic" : "Lit", value: part.Value ?? "", quoted: true }];
     if (kind === "ParamExp" && isDefaultExpansion(part) && !assigned.has(part.Param?.Value)) {
@@ -2148,14 +2249,14 @@ function executableParts(word, assigned, quoted = false) {
       if (fallback !== null) return [{ kind: "Lit", value: fallback, quoted }];
     }
     if (kind === "CmdSubst") {
-      const name = lookupSubstitution(part);
-      if (name !== null) return [{ kind: "Lit", value: name, quoted }];
+      const name2 = lookupSubstitution(part);
+      if (name2 !== null) return [{ kind: "Lit", value: name2, quoted }];
     }
     return [{ kind: "Dynamic", value: "", quoted }];
   });
 }
-function opaqueExecutable(word, assigned) {
-  const parts = executableParts(word, assigned);
+function opaqueExecutable(word, assigned, known = EMPTY_NAMES) {
+  const parts = executableParts(word, assigned, false, known);
   let lastSlash = -1;
   parts.forEach((p, i) => {
     if (p.kind === "Lit" && p.value.includes("/")) lastSlash = i;
@@ -2277,6 +2378,9 @@ function deriveBinaryOp(sample) {
 function isListOp(op) {
   return listOps().has(op);
 }
+function isPipeOp(op) {
+  return pipeOps().has(op);
+}
 function listOps() {
   if (_listOps) return _listOps;
   _listOps = new Set(
@@ -2521,6 +2625,33 @@ function isProtectedCodePath(p) {
   if (matchSensitivePath(p) !== null) return true;
   return SYSTEM_AUTH_FILES.includes(p) || SYSTEM_AUTH_DIRS.some((d) => p === d || p.startsWith(d + "/"));
 }
+function isJailedCodePath(literal, jailPaths) {
+  const value = trimTrailingSlashes(literal.replace(/\\/g, "/"));
+  if (!value) return false;
+  for (const raw of jailPaths) {
+    const jail = trimTrailingSlashes(raw.trim().replace(/\\/g, "/"));
+    if (!jail) continue;
+    const home = homeTail(jail);
+    if (home === null) {
+      if (value === jail || value.startsWith(jail + "/")) return true;
+      continue;
+    }
+    if (!home) continue;
+    const tail = homeTail(value);
+    if (tail !== null && (tail === home || tail.startsWith(home + "/"))) return true;
+  }
+  return false;
+}
+function trimTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
+  return s.slice(0, end);
+}
+function homeTail(p) {
+  const m = /^(?:~|\$\{?HOME\}?|\/home\/[^/]+|\/Users\/[^/]+|\/root)(?:\/(.*))?$/.exec(p);
+  if (!m) return null;
+  return m[1] ?? "";
+}
 function inlineExecDescription(r) {
   const lead = r ? `The AI is running code directly from the command line: ${inlineExecReason(r).replace(/^This/, "this")}.` : "The AI is running code directly from the command line.";
   return `${lead} Review the full script below before allowing it to execute.`;
@@ -2529,7 +2660,8 @@ function inlineExecReason(r) {
   const who = r.interp ? `This inline ${r.interp} code` : "This inline code";
   return r.evidence ? `${who} ${r.what} (${r.evidence})` : `${who} ${r.what}`;
 }
-function inlineExecReview(command) {
+function inlineExecReview(command, jailPaths = []) {
+  const isProtected = jailPaths.length === 0 ? isProtectedCodePath : (p) => isProtectedCodePath(p) || isJailedCodePath(p, jailPaths);
   const calls = inlineExecCalls(command);
   if (calls === PARSE_FAIL) {
     return INLINE_EXEC_FALLBACK.test(command) ? { outcome: "unreadable", interp: "", what: "could not be parsed" } : null;
@@ -2552,7 +2684,7 @@ function inlineExecReview(command) {
           what: `is ${call.interp} code, which node9 does not read`
         };
       } else {
-        const judged = judgeInlineCode(language, code, isProtectedCodePath);
+        const judged = judgeInlineCode(language, code, isProtected);
         if (judged) finding = { ...judged, interp: call.interp };
       }
       if (finding?.outcome === "dangerous") return finding;
@@ -2733,6 +2865,11 @@ function recordTopLevelStmt(stmt) {
   if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
   return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
 }
+function arrayElements(value) {
+  if (typeof value !== "string" || !value.startsWith(ARRAY_MARK)) return null;
+  const body = value.slice(ARRAY_MARK.length);
+  return body === "" ? [] : body.split(ARRAY_SEP);
+}
 function recordAssignments(n, at) {
   if (!assignmentTable) return;
   const t = n.kind;
@@ -2746,7 +2883,19 @@ function recordAssignments(n, at) {
   } else return;
   for (const a of assigns) {
     const name = a?.Name?.Value;
-    if (!name || !a.Value || a.Append) continue;
+    if (!name) continue;
+    if (a.Array) {
+      const elems = (a.Array.Elems || []).map(
+        (e) => e?.Index ? null : resolveWordLiteral(e?.Value)
+      );
+      const literal = elems.every((v) => v !== null);
+      assignmentTable.set(name, {
+        value: literal && !a.Append ? ARRAY_MARK + elems.join(ARRAY_SEP) : null,
+        at
+      });
+      continue;
+    }
+    if (!a.Value || a.Append) continue;
     assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
   }
 }
@@ -2757,7 +2906,33 @@ function resolveTrivialSubst(part) {
   const st = stmts[0];
   if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
   const cmd = st.Cmd;
-  if (!cmd || cmd.kind !== "CallExpr") return void 0;
+  if (!cmd) return void 0;
+  if (cmd.kind === "BinaryCmd" && pipeOps().has(cmd.Op)) {
+    const left = cmd.X?.Cmd;
+    const right = cmd.Y?.Cmd;
+    if (!left || !right || left.kind !== "CallExpr" || right.kind !== "CallExpr") return void 0;
+    if ((cmd.X.Redirs || []).length > 0 || (cmd.Y.Redirs || []).length > 0) return void 0;
+    const input = trivialCallOutput(left);
+    if (input === void 0) return void 0;
+    const filter = (right.Args || []).map((a) => resolveWordLiteral(a));
+    if (filter.some((w) => w === null)) return void 0;
+    const f = baseWord(filter[0]);
+    const flags = filter.slice(1);
+    if (f === "base64" && flags.length === 1 && /^(-d|-D|--decode)$/.test(flags[0])) {
+      try {
+        const out = Buffer.from(input, "base64").toString("utf8");
+        return /^[\x20-\x7e]*$/.test(out) ? out : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    if (f === "rev" && flags.length === 0) return [...input].reverse().join("");
+    return void 0;
+  }
+  if (cmd.kind !== "CallExpr") return void 0;
+  return trivialCallOutput(cmd);
+}
+function trivialCallOutput(cmd) {
   if ((cmd.Assigns || []).length > 0) return void 0;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
   if (words.length === 0 || words.some((w) => w === null)) return void 0;
@@ -2769,9 +2944,16 @@ function resolveTrivialSubst(part) {
     return rest.slice(i).join(" ");
   }
   if (head === "printf") {
+    if (rest.length === 1 && /^(?:\\(?:[0-7]{1,3}|x[0-9A-Fa-f]{1,2}))+$/.test(rest[0])) {
+      return rest[0].replace(
+        /\\(?:x([0-9A-Fa-f]{1,2})|([0-7]{1,3}))/g,
+        (_, hex, oct) => String.fromCharCode(hex ? parseInt(hex, 16) : parseInt(oct, 8))
+      );
+    }
     if (rest.length !== 2) return void 0;
-    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
-    return rest[1];
+    const m = /^([^%]*)%s([^%]*?)(\\n)?$/.exec(rest[0]);
+    if (!m) return void 0;
+    return m[1] + rest[1] + m[2];
   }
   return void 0;
 }
@@ -2785,11 +2967,28 @@ function isPlainParam(p) {
   if (p.kind !== "ParamExp") return false;
   return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
 }
+function indexedParam(p) {
+  if (p.kind !== "ParamExp" || !p.Index) return null;
+  if (p.Excl || p.Length || p.Width || p.Slice || p.Repl || p.Exp) return null;
+  const index = resolveWordLiteral(p.Index);
+  const name = p.Param?.Value;
+  return name && index !== null ? { name, index } : null;
+}
 function expandPlainParam(p) {
   if (!assignmentTable) return void 0;
+  const indexed = indexedParam(p);
+  if (indexed) {
+    const elems = arrayElements(recordedExpansion(indexed.name));
+    if (elems === null) return void 0;
+    if (indexed.index === "@" || indexed.index === "*") return elems.join(" ");
+    return /^\d+$/.test(indexed.index) ? elems[Number(indexed.index)] ?? null : null;
+  }
   if (!isPlainParam(p)) return void 0;
   const recorded = recordedExpansion(p.Param?.Value);
-  if (recorded !== void 0) return recorded;
+  if (recorded !== void 0) {
+    const elems = arrayElements(recorded);
+    return elems === null ? recorded : elems[0] ?? "";
+  }
   return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
 }
 function functionBodies(f) {
@@ -5862,7 +6061,59 @@ function dynamicOptionWord(word) {
   if (/^--[a-z-]+=/.test(prefix) || /^-[cC]/.test(prefix)) return `${prefix}$\u2026`;
   return null;
 }
-function resolveGitWords(word) {
+function arrayExpansionWords(word) {
+  let parts = word?.Parts || [];
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp" || !parts[0].Index) return null;
+  const index = resolveWordLiteral(parts[0].Index);
+  if (index !== "@" && index !== "*") return null;
+  const elems = arrayElements(recordedExpansion(parts[0].Param?.Value));
+  return elems;
+}
+function producedLiteral(call) {
+  if ((call.Assigns || []).length > 0) return null;
+  const words = (call.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return null;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "git" && rest[0] === "rev-parse" && rest[1] === "--show-toplevel" && rest.length === 2)
+    return ":/";
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.length - i === 1 ? rest[i] : null;
+  }
+  if (head === "printf" && rest.length === 2 && /^%s(\\[0n])?$/.test(rest[0])) return rest[1];
+  return null;
+}
+function treeTopWord(word, treeTopVars = NO_VARS) {
+  let parts = word?.Parts || [];
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1) return false;
+  const p = parts[0];
+  if (p.kind === "ParamExp") {
+    const name = plainParamName(word)?.name;
+    return name === "PWD" || name !== void 0 && treeTopVars.has(name);
+  }
+  if (p.kind !== "CmdSubst") return false;
+  const stmts = p.Stmts || [];
+  if (stmts.length !== 1 || !stmts[0].Cmd || stmts[0].Cmd.kind !== "CallExpr") return false;
+  const words = (stmts[0].Cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.some((w) => w === null)) return false;
+  const head = baseWord(words[0]);
+  if (head === "pwd") return words.length === 1 || words[1] === "-P" || words[1] === "-L";
+  return head === "git" && words[1] === "rev-parse" && words[2] === "--show-toplevel";
+}
+function resolveGitWords(word, treeTopVars = NO_VARS, appended = NO_APPENDS) {
+  if (treeTopWord(word, treeTopVars)) return [":/"];
+  const plain = plainParamName(word);
+  if (plain && appended.has(plain.name)) {
+    const v = appended.get(plain.name);
+    if (v === null || v === void 0) return [null];
+    return plain.quoted ? [v] : splitFields(v);
+  }
+  const elems = arrayExpansionWords(word);
+  if (elems !== null) return elems;
   const value = resolveWordLiteral(word);
   if (value === null) {
     if (isPositionalParam(word)) return boundPositionals() ?? [POSITIONAL2];
@@ -5970,6 +6221,8 @@ function classify(inv) {
       if (o.flags.has("-n") || o.flags.has("--dry-run")) break;
       const forced = o.flags.has("-f") || o.flags.has("--force") || o.flags.has("--force-with-lease") || o.flags.has("--force-if-includes") || o.flags.has("--mirror") || o.operands.some((r) => r.startsWith("+"));
       if (forced) found(FORCE_PUSH);
+      const deletes = o.flags.has("-d") || o.flags.has("--delete") || o.operands.some((r) => /^:[^:]/.test(r));
+      if (deletes) found(DESTRUCTIVE);
       break;
     }
     case "reset": {
@@ -5997,11 +6250,72 @@ function classify(inv) {
       if (o.flags.has("-d") || o.flags.has("--delete")) found(DESTRUCTIVE);
       break;
     }
+    // node9Firewall#385: history and work discarded through plumbing. A ref
+    // deleted by hand, a stash dropped, the reflog expired or pruned: the
+    // commits behind them are gone the way `branch -D` loses them.
+    case "update-ref": {
+      const o = parseOptions(inv.args, "m", /* @__PURE__ */ new Set());
+      if (o.flags.has("-d") && (o.dynamic || o.operands.some(isHistoryRef))) found(DESTRUCTIVE);
+      break;
+    }
+    case "reflog": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "expire" || o.operands[0] === "delete") found(DESTRUCTIVE);
+      break;
+    }
+    case "gc": {
+      if (inv.config.get("gc.reflogexpire") === "now") found(DESTRUCTIVE);
+      break;
+    }
+    case "stash": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "clear" || o.operands[0] === "drop") found(DESTRUCTIVE);
+      break;
+    }
+    case "worktree": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "remove" && (o.flags.has("-f") || o.flags.has("--force")))
+        found(DESTRUCTIVE);
+      break;
+    }
+    // The working tree overwritten: `restore` from another ref, a forced
+    // checkout, or `checkout -- .` (every local change dropped). A bare
+    // `restore .` or `checkout .` stays an ordinary undo, as pinned.
+    case "restore": {
+      const o = parseOptions(inv.args, "s", RESTORE_LONG_VALUE);
+      const src = restoreSource(inv.args);
+      const whole = o.dynamic || o.operands.some(wholeTree);
+      if (src !== null && src !== "HEAD" && whole) found(DESTRUCTIVE);
+      break;
+    }
+    case "checkout": {
+      const o = parseOptions(inv.args, "bB", CHECKOUT_LONG_VALUE);
+      const forced = o.flags.has("-f") || o.flags.has("--force");
+      const dropAll = inv.args.includes("--") && o.operands.some(wholeTree);
+      if (forced || dropAll) found(DESTRUCTIVE);
+      break;
+    }
     default:
       break;
   }
   return out;
 }
+function isExcludePathspec(operand) {
+  return /^:[!^]/.test(operand) || /^:\([^)]*\bexclude\b[^)]*\)/.test(operand);
+}
+function restoreSource(args) {
+  for (let i = 0; i < args.length; i++) {
+    const w = args[i];
+    if (w === null) continue;
+    if (w.startsWith("--source=")) return w.slice("--source=".length);
+    if (w === "--source" || w === "-s") return args[i + 1] ?? null;
+    if (/^-s./.test(w)) return w.slice(2);
+  }
+  return null;
+}
+function isHistoryRef(ref) {
+  return /^refs\/(heads|stash)(\/|$)/.test(ref);
+}
 function killSwitchSet(name, value) {
   if (value === null) return false;
   switch (name) {
@@ -6059,6 +6373,7 @@ function hooksBypass(inv) {
     const o = parseOptions(inv.args, "mFCcut", COMMIT_LONG_VALUE);
     return o.flags.has("-n") || o.flags.has("--no-verify");
   }
+  if (sub === "commit-tree") return true;
   if (sub !== void 0 && NO_VERIFY_SUBS.has(sub)) {
     return inv.args.some((a) => a === "--no-verify");
   }
@@ -6096,7 +6411,20 @@ function configWritesHooksPath(args) {
   return write2;
 }
 function isHookPath(word) {
-  return /(^|[\\/])(\.git[\\/]hooks|\.husky)([\\/]|$)/.test(word);
+  return /(^|[\\/])(\.git[\\/]hooks|\.husky|\.githooks)([\\/]|$)/.test(word);
+}
+function isLiveHookFile(word) {
+  if (!isHookPath(word)) return false;
+  const m = /(^|[\\/])(\.git[\\/]hooks|\.husky|\.githooks)(?:[\\/](.*))?$/.exec(word);
+  if (!m) return false;
+  const rest = m[3] ?? "";
+  if (rest === "" || rest === "_") return true;
+  const leaf = rest.replace(/^_[\\/]/, "");
+  return /^[a-z-]+$/.test(leaf);
+}
+function hookBodyIsEmpty(text) {
+  const lines = text.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== "" && !l.startsWith("#"));
+  return lines.every((l) => /^(exit(\s+0)?|true|:|set\s+-[a-zA-Z]+|set\s+-o\s+\w+)$/.test(l));
 }
 function modeRemovesExecute(mode) {
   if (/^[0-7]{3,4}$/.test(mode)) {
@@ -6105,6 +6433,22 @@ function modeRemovesExecute(mode) {
   }
   return mode.split(",").some((part) => /^[ugoa]*-[rwst]*x/.test(part));
 }
+function redirOpIsAppend(redir) {
+  return redir?.Op === appendOp();
+}
+function appendOp() {
+  if (_appendOp !== null) return _appendOp;
+  try {
+    const f = parseShared("echo x >> y");
+    _appendOp = typeof f === "symbol" ? -1 : f.Stmts[0].Redirs[0].Op;
+  } catch {
+    _appendOp = -1;
+  }
+  return _appendOp;
+}
+function hooksBypassed(shown) {
+  return { ...HOOKS_BYPASS, shown, reason: `${HOOKS_BYPASS.reason}: ${shown}` };
+}
 function chmodDisarmsHook(args, shown) {
   let i = 0;
   while (i < args.length) {
@@ -6147,6 +6491,7 @@ function stagesEverything(inv) {
   const sub = inv.sub?.toLowerCase();
   const prefix = chdirPrefix(inv);
   const judge = (operands2) => {
+    if (operands2.length > 0 && operands2.every(isExcludePathspec)) return {};
     let conditional = false;
     for (const operand of operands2) {
       if (!wholeTree(operand)) continue;
@@ -6439,7 +6784,7 @@ function evaluateAgentFileWrite(args, accesses, context, settings, shell, hooks
   }
   return null;
 }
-function isPipeOp(op) {
+function isPipeOp2(op) {
   return !isListOp(op);
 }
 function isDupInOp(op) {
@@ -8472,7 +8817,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       if (v?.logged) noteLogged(v);
       else if (v) candidates.push(v);
     };
-    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
+    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand, config.policy.jailPaths);
     if (inline !== null) {
       consider("commands.inline-exec", {
         decision: "review",
@@ -8815,7 +9160,7 @@ function* validCardRuns(text, base2, exemptFractions = true) {
   let m;
   while ((m = re.exec(text)) !== null) {
     const digits = m[0].replace(/\D/g, "");
-    const fraction = exemptFractions && isDecimalFraction(text, m.index, digits.length === m[0].length);
+    const fraction = exemptFractions && (isDecimalFraction(text, m.index, digits.length === m[0].length) || isInteriorDotNumber(m[0]));
     if (!fraction && validateLuhn(digits)) {
       yield { index: m.index, length: m[0].length, digits };
     } else {
@@ -8842,6 +9187,12 @@ function replaceValidCards(text, replace, { exemptFractions = true } = {}) {
   }
   return out;
 }
+function isInteriorDotNumber(run) {
+  const first = run.indexOf(".");
+  if (first <= 0 || first === run.length - 1) return false;
+  if (run.indexOf(".", first + 1) !== -1) return false;
+  return !/[-\s]/.test(run);
+}
 function isDecimalFraction(text, index, unseparated) {
   if (!unseparated) return false;
   const sep = text[index - 1];
@@ -9568,7 +9919,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto, import_crypto2, import_crypto3, import_crypto4, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var import_url, import_picomatch, import_safe_regex2, import_picomatch2, import_module, import_picomatch3, import_safe_regex22, import_crypto, import_crypto2, import_crypto3, import_crypto4, getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, BATCH_SEPARATOR, ENCODED_RUN_RE, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, CONTROL_CHAR_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -12846,6 +13197,7 @@ var init_dist = __esm({
       "sqlite3"
     ]);
     defaultExpansionOps = null;
+    EMPTY_NAMES = /* @__PURE__ */ new Set();
     VARIABLE_READERS = /* @__PURE__ */ new Set([
       "read",
       "mapfile",
@@ -12858,6 +13210,7 @@ var init_dist = __esm({
       "readonly",
       "printf"
     ]);
+    PLAIN_PROGRAM_NAME = /^[A-Za-z_][\w.+-]*$/;
     FS_READ_TOOLS = /* @__PURE__ */ new Set([
       "cat",
       "less",
@@ -13752,6 +14105,8 @@ var init_dist = __esm({
         AND_OR_OPS: new Set([and, or].filter((o) => o !== null))
       };
     });
+    ARRAY_MARK = "
array
";
+    ARRAY_SEP = "
";
     MAX_CALL_DEPTH2 = 4;
     MAX_CALL_WALKS2 = 256;
     callDepth = 0;
@@ -17089,7 +17444,22 @@ zoo`.split("\n");
       found;
       /** Aliases defined earlier in this command: name -> value (null = dynamic). */
       aliases = /* @__PURE__ */ new Map();
+      /** node9Firewall#385: variables assigned a tree-top word (`scope="$PWD"`,
+       *  `root=$(git rev-parse --show-toplevel)`, `DIR=$(pwd)`), so the
+       *  variable reads as the top where it is used. */
+      treeTopVars = /* @__PURE__ */ new Set();
+      /** node9Firewall#385 (c): a string a script builds with `+=` from
+       *  literals (`mode=--ha; mode+=rd`). The jail's table does not follow an
+       *  append (JAIL-14a); the git rules read the built word, since a flag
+       *  spelled in two halves is still that flag. name -> value, null once a
+       *  half is unknown. */
+      appended = /* @__PURE__ */ new Map();
       payloads = /* @__PURE__ */ new Set();
+      /** node9Firewall#385 (a): the text this command writes to each path
+       *  (`cat > /tmp/x.sh <<'SH' ... SH`, `echo '...' > f`, `>>` appends), so
+       *  a later statement that runs the path (`bash f`, `sh f`, `./f`) is
+       *  judged on what it runs. null once a write to the path is unknown. */
+      written = /* @__PURE__ */ new Map();
       /** `for NAME in a b c`: the literal items, or null when one is dynamic. */
       loopVars = /* @__PURE__ */ new Map();
       /** Walk one command string. Returns false when it did not parse. */
@@ -17108,6 +17478,25 @@ zoo`.split("\n");
         const type = n.kind;
         if (type === "Stmt") {
           this.visitHeredocShell(n, depth);
+          this.visitPipeline(n, depth);
+          this.visitHookWrite(n);
+          this.recordScriptWrite(n);
+          this.visitWrittenScript(n, depth);
+          return true;
+        }
+        if (type === "Assign" && n.Name?.Value && n.Value) {
+          const name = n.Name.Value;
+          if (n.Append) {
+            const prev = this.appended.has(name) ? this.appended.get(name) : resolveWordLiteral(n.Value) === null ? null : void 0;
+            const base2 = prev === void 0 ? recordedExpansion(name) : prev;
+            const piece = resolveWordLiteral(n.Value);
+            this.appended.set(name, typeof base2 === "string" && piece !== null ? base2 + piece : null);
+            this.treeTopVars.delete(name);
+            return true;
+          }
+          this.appended.delete(name);
+          if (treeTopWord(n.Value, this.treeTopVars)) this.treeTopVars.add(name);
+          else this.treeTopVars.delete(name);
           return true;
         }
         if (type === "ForClause") {
@@ -17136,13 +17525,13 @@ zoo`.split("\n");
           const param = plainParamName(rawArgs[loopArg]);
           for (const item of this.loopVars.get(param.name)) {
             const words2 = rawArgs.flatMap(
-              (a, i) => i === loopArg ? param.quoted ? [item] : splitFields(item) : resolveGitWords(a)
+              (a, i) => i === loopArg ? param.quoted ? [item] : splitFields(item) : resolveGitWords(a, this.treeTopVars, this.appended)
             );
             this.visitWords(words2, new Map(prefixEnv), depth, false);
           }
           return true;
         }
-        const words = rawArgs.flatMap((a) => resolveGitWords(a));
+        const words = rawArgs.flatMap((a) => resolveGitWords(a, this.treeTopVars, this.appended));
         this.visitWords(words, prefixEnv, depth, false);
         return true;
       }
@@ -17167,6 +17556,23 @@ zoo`.split("\n");
           if (f) this.found(f);
           return;
         }
+        if (headWord === "rm" || headWord === "unlink") {
+          if (words.slice(head + 1).some((w) => w !== null && isLiveHookFile(w)))
+            this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
+        if (headWord === "mv") {
+          const operands2 = words.slice(head + 1).filter((w) => w === null || !w.startsWith("-"));
+          const src = operands2[0];
+          if (typeof src === "string" && isLiveHookFile(src)) this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
+        if (headWord === "perl") {
+          const code = words.slice(head + 1).find((w) => w !== null && /\brename\b/.test(w));
+          const m = code ? /rename\s*\(?\s*q[qw]?\s*[(\[{<'"]([^)\]}>'"]+)/.exec(code) : null;
+          if (m && isLiveHookFile(m[1])) this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
         if (depth < MAX_PAYLOAD_DEPTH2) {
           const payload = literalShellPayload(words, baseWord(words[0]));
           if (payload !== null) this.runPayload(payload, depth);
@@ -17177,6 +17583,127 @@ zoo`.split("\n");
         this.payloads.add(payload);
         this.run(payload, depth + 1);
       }
+      /**
+       * node9Firewall#385: a pipeline whose last stage reads its pathspec from
+       * stdin (`git add --pathspec-from-file=-`) or runs git over the names it
+       * is fed (`xargs -0 git add --`), with a producer that is one literal
+       * (`git rev-parse --show-toplevel`, `printf '%s\0' .`): the literal is
+       * the operand, and the call is judged with it.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitPipeline(stmt, depth) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "BinaryCmd" || !isPipeOp(cmd.Op)) return;
+        const stages = [];
+        let cur = cmd;
+        while (cur?.kind === "BinaryCmd" && isPipeOp(cur.Op)) {
+          stages.unshift(cur.Y);
+          const left = cur.X;
+          if (left?.Cmd?.kind === "BinaryCmd" && isPipeOp(left.Cmd.Op)) cur = left.Cmd;
+          else {
+            stages.unshift(left);
+            break;
+          }
+        }
+        if (stages.length < 2) return;
+        const producer = stages[stages.length - 2]?.Cmd;
+        const consumer = stages[stages.length - 1]?.Cmd;
+        if (!producer || !consumer || producer.kind !== "CallExpr" || consumer.kind !== "CallExpr")
+          return;
+        const fed = producedLiteral(producer);
+        if (fed === null) return;
+        const words = (consumer.Args || []).flatMap(
+          (a) => resolveGitWords(a, this.treeTopVars, this.appended)
+        );
+        const head = unwrapCommandHead(words);
+        const viaXargs = words.slice(0, head).some((w) => baseWord(w) === "xargs");
+        const fromFile = words.findIndex(
+          (w) => w === "--pathspec-from-file=-" || w === "--pathspec-from-file"
+        );
+        if (!viaXargs && fromFile < 0) return;
+        let fedWords;
+        if (fromFile >= 0) {
+          fedWords = words.filter(
+            (w, k) => !(k === fromFile || w === "-" && words[k - 1] === "--pathspec-from-file")
+          );
+          fedWords.push(fed);
+        } else fedWords = [...words, fed];
+        this.visitWords(fedWords, /* @__PURE__ */ new Map(), depth, false);
+      }
+      /**
+       * node9Firewall#385 (e): a hook file written with a body that checks
+       * nothing (`cat > .githooks/pre-commit <<'SH' exit 0 SH`, `echo 'exit 0'
+       * > .git/hooks/pre-push`, `: > .githooks/pre-commit`). A real body (a
+       * test, a linter) is ordinary work on the hooks.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitHookWrite(stmt) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr") return;
+        const redirs = stmt.Redirs || [];
+        const target = redirs.find((r) => r?.Word && !r.Hdoc && (r.N == null || r.N.Value === "1"));
+        if (!target) return;
+        const path210 = resolveWordLiteral(target.Word);
+        if (path210 === null || !isLiveHookFile(path210)) return;
+        const hdoc = redirs.find((r) => r?.Hdoc);
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = baseWord(words[0]);
+        let body = null;
+        if (hdoc) body = resolveWordLiteral(hdoc.Hdoc);
+        else if (head === ":" || head === "true" || words.length === 0) body = "";
+        else if (head === "echo" || head === "printf") {
+          const rest = words.slice(1);
+          body = rest.some((w) => w === null) ? null : rest.filter((w) => !/^-[neE]+$/.test(w)).join(" ");
+          if (body !== null) body = body.replace(/\\n/g, "\n");
+        }
+        if (body !== null && hookBodyIsEmpty(body)) this.found(hooksBypassed(shownOf(words)));
+      }
+      /** A statement that writes a literal text to a path, by redirect. */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      recordScriptWrite(stmt) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr") return;
+        const redirs = stmt.Redirs || [];
+        const target = redirs.find((r) => r?.Word && !r.Hdoc && (r.N == null || r.N.Value === "1"));
+        if (!target) return;
+        const path210 = resolveWordLiteral(target.Word);
+        if (path210 === null) return;
+        const append = /^>>/.test(target.Op?.toString() ?? "") || redirOpIsAppend(target);
+        const hdoc = redirs.find((r) => r?.Hdoc);
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = baseWord(words[0]);
+        let text = null;
+        if (hdoc && (head === "cat" || head === "tee")) text = resolveWordLiteral(hdoc.Hdoc);
+        else if (head === "echo" || head === "printf") {
+          const rest = words.slice(1);
+          text = rest.some((w) => w === null) ? null : rest.filter((w) => !/^-[neE]+$/.test(w)).join(" ");
+          if (text !== null && head === "printf") text = text.replace(/\\n/g, "\n");
+        } else return;
+        const prev = this.written.get(path210);
+        if (text === null || append && prev === null) this.written.set(path210, null);
+        else this.written.set(path210, append && typeof prev === "string" ? `${prev}
+${text}` : text);
+      }
+      /** A statement that runs a path this command wrote: the text is the script. */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitWrittenScript(stmt, depth) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr" || this.written.size === 0 || depth >= MAX_PAYLOAD_DEPTH2)
+          return;
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = unwrapCommandHead(words);
+        const name = baseWord(words[head]);
+        let ran = null;
+        if (PAYLOAD_SHELLS.has(name) && name !== "eval") {
+          const operand = words.slice(head + 1).find((w) => w === null || !w.startsWith("-"));
+          if (typeof operand === "string") ran = operand;
+        } else if (typeof words[head] === "string" && this.written.has(words[head])) {
+          ran = words[head];
+        }
+        if (ran === null) return;
+        const text = this.written.get(ran);
+        if (typeof text === "string") this.runPayload(text, depth);
+      }
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       visitHeredocShell(stmt, depth) {
         const cmd = stmt.Cmd;
@@ -17328,6 +17855,8 @@ zoo`.split("\n");
       }
     };
     POSITIONAL2 = "\0positional";
+    NO_VARS = /* @__PURE__ */ new Set();
+    NO_APPENDS = /* @__PURE__ */ new Map();
     FORCE_PUSH = {
       checkId: "commands.git-destructive",
       ruleName: "review-force-push",
@@ -17386,6 +17915,8 @@ zoo`.split("\n");
       "--cleanup"
     ]);
     CLEAN_LONG_VALUE = /* @__PURE__ */ new Set(["--exclude"]);
+    RESTORE_LONG_VALUE = /* @__PURE__ */ new Set(["--source", "--pathspec-from-file"]);
+    CHECKOUT_LONG_VALUE = /* @__PURE__ */ new Set(["--pathspec-from-file", "--orphan", "--conflict"]);
     HOOKS_BYPASS = {
       checkId: "commands.git-hooks-bypass",
       ruleName: "review-git-hooks-bypass",
@@ -17411,6 +17942,7 @@ zoo`.split("\n");
       "--gpg-sign"
     ]);
     CHMOD_OPTION_RE = /^-[RvcfHLP]+$/;
+    _appendOp = null;
     STAGE_ALL = {
       checkId: "commands.git-stage-all",
       ruleName: "review-git-stage-all",
@@ -17535,7 +18067,7 @@ zoo`.split("\n");
           this.visitStmt(n, depth);
           return true;
         }
-        if (type === "BinaryCmd" && isPipeOp(n.Op)) {
+        if (type === "BinaryCmd" && isPipeOp2(n.Op)) {
           this.visitPipeline(n);
           return true;
         }
@@ -17636,7 +18168,7 @@ zoo`.split("\n");
         const stages = [];
         const flatten = (s) => {
           const c = s?.Cmd;
-          if (c && c.kind === "BinaryCmd" && isPipeOp(c.Op)) {
+          if (c && c.kind === "BinaryCmd" && isPipeOp2(c.Op)) {
             flatten(c.X);
             flatten(c.Y);
           } else stages.push(s);
@@ -19265,11 +19797,18 @@ function slug(s) {
 var B = "[\\s/\\\\]";
 var SEP = "[/\\\\]";
 function pathToRegexFragment(rawPath) {
-  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const trimmed = rawPath.trim();
+  const tail = trimmed.replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
   const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
   if (segments2.length === 0) return "";
+  if (isAbsoluteOutsideHome(trimmed)) {
+    return `(^|[^A-Za-z0-9_.~\\/-])/${segments2.join(SEP)}(${B}|$)`;
+  }
   return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
 }
+function isAbsoluteOutsideHome(p) {
+  return p.startsWith("/") && !/^\/(?:home|Users|root)(?:\/|$)/.test(p);
+}
 function pathMatchesFragment(candidate, rawPath) {
   const value = pathToRegexFragment(rawPath);
   if (!value || !candidate) return false;
@@ -22303,7 +22842,8 @@ var DEFAULT_CONFIG = {
     trustedHostsManaged: false,
     appPermissions: {},
     appLinks: {},
-    managedJailPaths: []
+    managedJailPaths: [],
+    jailPaths: []
   },
   environments: {}
 };
@@ -22543,7 +23083,8 @@ function getConfig(cwd) {
     trustedHostsManaged: false,
     appPermissions: {},
     appLinks: {},
-    managedJailPaths: []
+    managedJailPaths: [],
+    jailPaths: []
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const rank = (v) => {
@@ -22938,6 +23479,7 @@ function getConfig(cwd) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
             mergedPolicy.managedJailPaths.push({ path: path41, verdict });
+            mergedPolicy.jailPaths.push(path41);
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -23013,6 +23555,11 @@ function getConfig(cwd) {
     }
   }
   mergedPolicy.appliedShields = appliedShields.sort();
+  if (appliedShields.includes(USER_JAIL_SHIELD)) {
+    for (const { path: path41 } of readJailPaths()) {
+      if (!mergedPolicy.jailPaths.includes(path41)) mergedPolicy.jailPaths.push(path41);
+    }
+  }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   const cc = mergedPolicy.commandChecks ?? {};
   const advisoryKnobKey = (name) => {