@node9/proxy 2.50.0 → 2.51.0

package/dist/index.mjs

@@ -2091,9 +2091,15 @@ function detectDangerousShellExec(command) {
     if (f === PARSE_FAIL) return null;
     let result = null;
     const assigned = assignedNames(f);
-    walk(f, (node) => {
+    const known = plainlyNamedPrograms(f);
+    const calledByName = literallyCalledFunctions(f);
+    const bodies = [];
+    const inBody = (pos) => bodies.some(([a, b]) => pos >= a && pos < b);
+    walkWithCalls(f, (node) => {
       if (!node || result === "block") return false;
       const n = node;
+      if (n.kind === "FuncDecl" && n.Body && callDepth === 0 && calledByName.has(n.Name?.Value))
+        bodies.push([n.Body.pos, n.Body.end]);
       if (n.kind === "BinaryCmd" && n.Y && !listOps().has(n.Op)) {
         const call = n.Y.Cmd;
         if (call && call.kind === "CallExpr") {
@@ -2117,7 +2123,8 @@ function detectDangerousShellExec(command) {
       );
       const head = unwrapCommandHead(headWords, false, true);
       const lookup = headWords[0]?.toLowerCase() === "command" && headWords.slice(1).some((w) => w === "-v" || w === "-V");
-      if (!lookup && (opaqueExecutable(args[0], assigned) || opaqueExecutable(args[head], assigned)))
+      const unboundBody = callDepth === 0 && inBody(n.pos ?? -1);
+      if (!lookup && !unboundBody && (opaqueExecutable(args[0], assigned, known) || opaqueExecutable(args[head], assigned, known)))
         result = "review";
       const firstParts = args[0].Parts || [];
       if (firstParts.length !== 1 || firstParts[0].kind !== "Lit") return true;
@@ -2177,11 +2184,105 @@ function assignedNames(f) {
   });
   return names;
 }
-function executableParts(word, assigned, quoted = false) {
+function literallyCalledFunctions(f) {
+  const declared = /* @__PURE__ */ new Set();
+  const called = /* @__PURE__ */ new Set();
+  walk(f, (node) => {
+    if (!node) return false;
+    if (node.kind === "FuncDecl" && node.Name?.Value) declared.add(node.Name.Value);
+    if (node.kind === "CallExpr") {
+      const head = resolveWordLiteral(node.Args?.[0]);
+      if (head) called.add(head);
+    }
+    return true;
+  });
+  return new Set([...declared].filter((name) => called.has(name)));
+}
+function plainlyNamedPrograms(f) {
+  const values = /* @__PURE__ */ new Map();
+  const arrays = /* @__PURE__ */ new Set();
+  const give = (name, value) => {
+    if (value === null || !PLAIN_PROGRAM_NAME.test(value)) {
+      values.set(name, null);
+      return;
+    }
+    const cur = values.get(name);
+    if (cur === null) return;
+    if (cur === void 0) values.set(name, /* @__PURE__ */ new Set([value]));
+    else cur.add(value);
+  };
+  const literalOnly = (w) => {
+    const parts = w?.Parts ?? [];
+    if (parts.length !== 1) return null;
+    const p = parts[0];
+    if (p.kind === "Lit") return p.Value ?? null;
+    if (p.kind === "ParamExp" && expansionName(p) === "FUNCNAME") return "FUNCNAME";
+    if (p.kind === "SglQuoted" && !p.Dollar) return p.Value ?? null;
+    if (p.kind === "DblQuoted") {
+      const inner = p.Parts ?? [];
+      return inner.length === 1 && inner[0].kind === "Lit" ? inner[0].Value ?? null : null;
+    }
+    return null;
+  };
+  let ifsTouched = false;
+  walk(f, (node) => {
+    if (!node) return false;
+    const kind = node.kind;
+    if (kind === "FuncDecl" && node.Name?.Value) give(node.Name.Value, node.Name.Value);
+    if (kind === "Assign" && node.Name?.Value) {
+      const name = node.Name.Value;
+      if (name === "IFS") ifsTouched = true;
+      if (node.Append) values.set(name, null);
+      else if (node.Array) {
+        arrays.add(name);
+        for (const el of node.Array.Elems ?? []) give(name, literalOnly(el.Value));
+      } else if (node.Index) {
+        arrays.add(name);
+        give(name, node.Value ? literalOnly(node.Value) : null);
+      } else give(name, node.Value ? literalOnly(node.Value) : null);
+    }
+    if (kind === "ForClause" && node.Loop?.Name?.Value) values.set(node.Loop.Name.Value, null);
+    if (kind === "CallExpr") {
+      const words = (node.Args ?? []).map((a) => resolveWordLiteral(a));
+      if (VARIABLE_READERS.has(words[0] ?? "")) {
+        for (const w of words.slice(1)) if (w && /^[A-Za-z_]\w*$/.test(w)) values.set(w, null);
+      }
+    }
+    return true;
+  });
+  if (ifsTouched) return /* @__PURE__ */ new Set();
+  const functions = /* @__PURE__ */ new Set();
+  walk(f, (node) => {
+    if (node && node.kind === "FuncDecl" && node.Name?.Value) functions.add(node.Name.Value);
+    return true;
+  });
+  const callable = (v) => functions.has(v) || v === "FUNCNAME" || v === "true" || v === "false" || v === ":";
+  for (const [name, vals] of values) {
+    if (vals && ![...vals].every(callable)) values.set(name, null);
+  }
+  const known = /* @__PURE__ */ new Set();
+  for (const [name, vals] of values)
+    if (vals && (vals.size === 1 || arrays.has(name) && vals.size > 0)) known.add(name);
+  return known;
+}
+function expansionName(part) {
+  if (part.kind !== "ParamExp") return null;
+  if (part.Excl || part.Length || part.Width || part.Slice || part.Repl || part.Exp) return null;
+  return part.Param?.Value ?? null;
+}
+function executableParts(word, assigned, quoted = false, known = EMPTY_NAMES) {
   return (word?.Parts ?? []).flatMap((part) => {
     const kind = part.kind;
-    if (kind === "DblQuoted") return executableParts(part, assigned, true);
+    if (kind === "DblQuoted") return executableParts(part, assigned, true, known);
     if (kind === "Lit") return [{ kind: "Lit", value: part.Value ?? "", quoted }];
+    const name = expansionName(part);
+    if (name !== null && (known.has(name) || name === "FUNCNAME"))
+      return [{ kind: "Lit", value: name, quoted }];
+    if (name !== null) {
+      const bound = recordedExpansion(name === "@" || name === "*" ? "1" : name);
+      if (typeof bound === "string" && PLAIN_PROGRAM_NAME.test(bound))
+        return [{ kind: "Lit", value: bound, quoted }];
+    }
     if (kind === "SglQuoted")
       return [{ kind: part.Dollar ? "Dynamic" : "Lit", value: part.Value ?? "", quoted: true }];
     if (kind === "ParamExp" && isDefaultExpansion(part) && !assigned.has(part.Param?.Value)) {
@@ -2189,14 +2290,14 @@ function executableParts(word, assigned, quoted = false) {
       if (fallback !== null) return [{ kind: "Lit", value: fallback, quoted }];
     }
     if (kind === "CmdSubst") {
-      const name = lookupSubstitution(part);
-      if (name !== null) return [{ kind: "Lit", value: name, quoted }];
+      const name2 = lookupSubstitution(part);
+      if (name2 !== null) return [{ kind: "Lit", value: name2, quoted }];
     }
     return [{ kind: "Dynamic", value: "", quoted }];
   });
 }
-function opaqueExecutable(word, assigned) {
-  const parts = executableParts(word, assigned);
+function opaqueExecutable(word, assigned, known = EMPTY_NAMES) {
+  const parts = executableParts(word, assigned, false, known);
   let lastSlash = -1;
   parts.forEach((p, i) => {
     if (p.kind === "Lit" && p.value.includes("/")) lastSlash = i;
@@ -2318,6 +2419,9 @@ function deriveBinaryOp(sample) {
 function isListOp(op) {
   return listOps().has(op);
 }
+function isPipeOp(op) {
+  return pipeOps().has(op);
+}
 function listOps() {
   if (_listOps) return _listOps;
   _listOps = new Set(
@@ -2562,6 +2666,33 @@ function isProtectedCodePath(p) {
   if (matchSensitivePath(p) !== null) return true;
   return SYSTEM_AUTH_FILES.includes(p) || SYSTEM_AUTH_DIRS.some((d) => p === d || p.startsWith(d + "/"));
 }
+function isJailedCodePath(literal, jailPaths) {
+  const value = trimTrailingSlashes(literal.replace(/\\/g, "/"));
+  if (!value) return false;
+  for (const raw of jailPaths) {
+    const jail = trimTrailingSlashes(raw.trim().replace(/\\/g, "/"));
+    if (!jail) continue;
+    const home = homeTail(jail);
+    if (home === null) {
+      if (value === jail || value.startsWith(jail + "/")) return true;
+      continue;
+    }
+    if (!home) continue;
+    const tail = homeTail(value);
+    if (tail !== null && (tail === home || tail.startsWith(home + "/"))) return true;
+  }
+  return false;
+}
+function trimTrailingSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
+  return s.slice(0, end);
+}
+function homeTail(p) {
+  const m = /^(?:~|\$\{?HOME\}?|\/home\/[^/]+|\/Users\/[^/]+|\/root)(?:\/(.*))?$/.exec(p);
+  if (!m) return null;
+  return m[1] ?? "";
+}
 function inlineExecDescription(r) {
   const lead = r ? `The AI is running code directly from the command line: ${inlineExecReason(r).replace(/^This/, "this")}.` : "The AI is running code directly from the command line.";
   return `${lead} Review the full script below before allowing it to execute.`;
@@ -2570,7 +2701,8 @@ function inlineExecReason(r) {
   const who = r.interp ? `This inline ${r.interp} code` : "This inline code";
   return r.evidence ? `${who} ${r.what} (${r.evidence})` : `${who} ${r.what}`;
 }
-function inlineExecReview(command) {
+function inlineExecReview(command, jailPaths = []) {
+  const isProtected = jailPaths.length === 0 ? isProtectedCodePath : (p) => isProtectedCodePath(p) || isJailedCodePath(p, jailPaths);
   const calls = inlineExecCalls(command);
   if (calls === PARSE_FAIL) {
     return INLINE_EXEC_FALLBACK.test(command) ? { outcome: "unreadable", interp: "", what: "could not be parsed" } : null;
@@ -2593,7 +2725,7 @@ function inlineExecReview(command) {
           what: `is ${call.interp} code, which node9 does not read`
         };
       } else {
-        const judged = judgeInlineCode(language, code, isProtectedCodePath);
+        const judged = judgeInlineCode(language, code, isProtected);
         if (judged) finding = { ...judged, interp: call.interp };
       }
       if (finding?.outcome === "dangerous") return finding;
@@ -2774,6 +2906,11 @@ function recordTopLevelStmt(stmt) {
   if (t === "DeclClause") return ASSIGNMENT_HEADS.has(stmt.Cmd.Variant?.Value ?? "");
   return (stmt.Cmd.Args || []).length === 0 && (stmt.Cmd.Assigns || []).length > 0;
 }
+function arrayElements(value) {
+  if (typeof value !== "string" || !value.startsWith(ARRAY_MARK)) return null;
+  const body = value.slice(ARRAY_MARK.length);
+  return body === "" ? [] : body.split(ARRAY_SEP);
+}
 function recordAssignments(n, at) {
   if (!assignmentTable) return;
   const t = n.kind;
@@ -2787,7 +2924,19 @@ function recordAssignments(n, at) {
   } else return;
   for (const a of assigns) {
     const name = a?.Name?.Value;
-    if (!name || !a.Value || a.Append) continue;
+    if (!name) continue;
+    if (a.Array) {
+      const elems = (a.Array.Elems || []).map(
+        (e) => e?.Index ? null : resolveWordLiteral(e?.Value)
+      );
+      const literal = elems.every((v) => v !== null);
+      assignmentTable.set(name, {
+        value: literal && !a.Append ? ARRAY_MARK + elems.join(ARRAY_SEP) : null,
+        at
+      });
+      continue;
+    }
+    if (!a.Value || a.Append) continue;
     assignmentTable.set(name, { value: resolveWordLiteral(a.Value), at });
   }
 }
@@ -2798,7 +2947,33 @@ function resolveTrivialSubst(part) {
   const st = stmts[0];
   if ((st.Redirs || []).length > 0 || st.Negated || st.Background) return void 0;
   const cmd = st.Cmd;
-  if (!cmd || cmd.kind !== "CallExpr") return void 0;
+  if (!cmd) return void 0;
+  if (cmd.kind === "BinaryCmd" && pipeOps().has(cmd.Op)) {
+    const left = cmd.X?.Cmd;
+    const right = cmd.Y?.Cmd;
+    if (!left || !right || left.kind !== "CallExpr" || right.kind !== "CallExpr") return void 0;
+    if ((cmd.X.Redirs || []).length > 0 || (cmd.Y.Redirs || []).length > 0) return void 0;
+    const input = trivialCallOutput(left);
+    if (input === void 0) return void 0;
+    const filter = (right.Args || []).map((a) => resolveWordLiteral(a));
+    if (filter.some((w) => w === null)) return void 0;
+    const f = baseWord(filter[0]);
+    const flags = filter.slice(1);
+    if (f === "base64" && flags.length === 1 && /^(-d|-D|--decode)$/.test(flags[0])) {
+      try {
+        const out = Buffer.from(input, "base64").toString("utf8");
+        return /^[\x20-\x7e]*$/.test(out) ? out : void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    if (f === "rev" && flags.length === 0) return [...input].reverse().join("");
+    return void 0;
+  }
+  if (cmd.kind !== "CallExpr") return void 0;
+  return trivialCallOutput(cmd);
+}
+function trivialCallOutput(cmd) {
   if ((cmd.Assigns || []).length > 0) return void 0;
   const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
   if (words.length === 0 || words.some((w) => w === null)) return void 0;
@@ -2810,9 +2985,16 @@ function resolveTrivialSubst(part) {
     return rest.slice(i).join(" ");
   }
   if (head === "printf") {
+    if (rest.length === 1 && /^(?:\\(?:[0-7]{1,3}|x[0-9A-Fa-f]{1,2}))+$/.test(rest[0])) {
+      return rest[0].replace(
+        /\\(?:x([0-9A-Fa-f]{1,2})|([0-7]{1,3}))/g,
+        (_, hex, oct) => String.fromCharCode(hex ? parseInt(hex, 16) : parseInt(oct, 8))
+      );
+    }
     if (rest.length !== 2) return void 0;
-    if (!/^%s(\\n)?$/.test(rest[0])) return void 0;
-    return rest[1];
+    const m = /^([^%]*)%s([^%]*?)(\\n)?$/.exec(rest[0]);
+    if (!m) return void 0;
+    return m[1] + rest[1] + m[2];
   }
   return void 0;
 }
@@ -2826,11 +3008,28 @@ function isPlainParam(p) {
   if (p.kind !== "ParamExp") return false;
   return !(p.Excl || p.Length || p.Width || p.Index || p.Slice || p.Repl || p.Exp);
 }
+function indexedParam(p) {
+  if (p.kind !== "ParamExp" || !p.Index) return null;
+  if (p.Excl || p.Length || p.Width || p.Slice || p.Repl || p.Exp) return null;
+  const index = resolveWordLiteral(p.Index);
+  const name = p.Param?.Value;
+  return name && index !== null ? { name, index } : null;
+}
 function expandPlainParam(p) {
   if (!assignmentTable) return void 0;
+  const indexed = indexedParam(p);
+  if (indexed) {
+    const elems = arrayElements(recordedExpansion(indexed.name));
+    if (elems === null) return void 0;
+    if (indexed.index === "@" || indexed.index === "*") return elems.join(" ");
+    return /^\d+$/.test(indexed.index) ? elems[Number(indexed.index)] ?? null : null;
+  }
   if (!isPlainParam(p)) return void 0;
   const recorded = recordedExpansion(p.Param?.Value);
-  if (recorded !== void 0) return recorded;
+  if (recorded !== void 0) {
+    const elems = arrayElements(recorded);
+    return elems === null ? recorded : elems[0] ?? "";
+  }
   return HOME_VARIABLES.has(p.Param?.Value) ? "~" : void 0;
 }
 function functionBodies(f) {
@@ -5777,7 +5976,59 @@ function dynamicOptionWord(word) {
   if (/^--[a-z-]+=/.test(prefix) || /^-[cC]/.test(prefix)) return `${prefix}$\u2026`;
   return null;
 }
-function resolveGitWords(word) {
+function arrayExpansionWords(word) {
+  let parts = word?.Parts || [];
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1 || parts[0].kind !== "ParamExp" || !parts[0].Index) return null;
+  const index = resolveWordLiteral(parts[0].Index);
+  if (index !== "@" && index !== "*") return null;
+  const elems = arrayElements(recordedExpansion(parts[0].Param?.Value));
+  return elems;
+}
+function producedLiteral(call) {
+  if ((call.Assigns || []).length > 0) return null;
+  const words = (call.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.length === 0 || words.some((w) => w === null)) return null;
+  const head = baseWord(words[0]);
+  const rest = words.slice(1);
+  if (head === "git" && rest[0] === "rev-parse" && rest[1] === "--show-toplevel" && rest.length === 2)
+    return ":/";
+  if (head === "echo") {
+    let i = 0;
+    while (i < rest.length && /^-[neE]+$/.test(rest[i])) i++;
+    return rest.length - i === 1 ? rest[i] : null;
+  }
+  if (head === "printf" && rest.length === 2 && /^%s(\\[0n])?$/.test(rest[0])) return rest[1];
+  return null;
+}
+function treeTopWord(word, treeTopVars = NO_VARS) {
+  let parts = word?.Parts || [];
+  if (parts.length === 1 && parts[0].kind === "DblQuoted") parts = parts[0].Parts || [];
+  if (parts.length !== 1) return false;
+  const p = parts[0];
+  if (p.kind === "ParamExp") {
+    const name = plainParamName(word)?.name;
+    return name === "PWD" || name !== void 0 && treeTopVars.has(name);
+  }
+  if (p.kind !== "CmdSubst") return false;
+  const stmts = p.Stmts || [];
+  if (stmts.length !== 1 || !stmts[0].Cmd || stmts[0].Cmd.kind !== "CallExpr") return false;
+  const words = (stmts[0].Cmd.Args || []).map((a) => resolveWordLiteral(a));
+  if (words.some((w) => w === null)) return false;
+  const head = baseWord(words[0]);
+  if (head === "pwd") return words.length === 1 || words[1] === "-P" || words[1] === "-L";
+  return head === "git" && words[1] === "rev-parse" && words[2] === "--show-toplevel";
+}
+function resolveGitWords(word, treeTopVars = NO_VARS, appended = NO_APPENDS) {
+  if (treeTopWord(word, treeTopVars)) return [":/"];
+  const plain = plainParamName(word);
+  if (plain && appended.has(plain.name)) {
+    const v = appended.get(plain.name);
+    if (v === null || v === void 0) return [null];
+    return plain.quoted ? [v] : splitFields(v);
+  }
+  const elems = arrayExpansionWords(word);
+  if (elems !== null) return elems;
   const value = resolveWordLiteral(word);
   if (value === null) {
     if (isPositionalParam(word)) return boundPositionals() ?? [POSITIONAL2];
@@ -5885,6 +6136,8 @@ function classify(inv) {
       if (o.flags.has("-n") || o.flags.has("--dry-run")) break;
       const forced = o.flags.has("-f") || o.flags.has("--force") || o.flags.has("--force-with-lease") || o.flags.has("--force-if-includes") || o.flags.has("--mirror") || o.operands.some((r) => r.startsWith("+"));
       if (forced) found(FORCE_PUSH);
+      const deletes = o.flags.has("-d") || o.flags.has("--delete") || o.operands.some((r) => /^:[^:]/.test(r));
+      if (deletes) found(DESTRUCTIVE);
       break;
     }
     case "reset": {
@@ -5912,11 +6165,72 @@ function classify(inv) {
       if (o.flags.has("-d") || o.flags.has("--delete")) found(DESTRUCTIVE);
       break;
     }
+    // node9Firewall#385: history and work discarded through plumbing. A ref
+    // deleted by hand, a stash dropped, the reflog expired or pruned: the
+    // commits behind them are gone the way `branch -D` loses them.
+    case "update-ref": {
+      const o = parseOptions(inv.args, "m", /* @__PURE__ */ new Set());
+      if (o.flags.has("-d") && (o.dynamic || o.operands.some(isHistoryRef))) found(DESTRUCTIVE);
+      break;
+    }
+    case "reflog": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "expire" || o.operands[0] === "delete") found(DESTRUCTIVE);
+      break;
+    }
+    case "gc": {
+      if (inv.config.get("gc.reflogexpire") === "now") found(DESTRUCTIVE);
+      break;
+    }
+    case "stash": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "clear" || o.operands[0] === "drop") found(DESTRUCTIVE);
+      break;
+    }
+    case "worktree": {
+      const o = parseOptions(inv.args, "", /* @__PURE__ */ new Set());
+      if (o.operands[0] === "remove" && (o.flags.has("-f") || o.flags.has("--force")))
+        found(DESTRUCTIVE);
+      break;
+    }
+    // The working tree overwritten: `restore` from another ref, a forced
+    // checkout, or `checkout -- .` (every local change dropped). A bare
+    // `restore .` or `checkout .` stays an ordinary undo, as pinned.
+    case "restore": {
+      const o = parseOptions(inv.args, "s", RESTORE_LONG_VALUE);
+      const src = restoreSource(inv.args);
+      const whole = o.dynamic || o.operands.some(wholeTree);
+      if (src !== null && src !== "HEAD" && whole) found(DESTRUCTIVE);
+      break;
+    }
+    case "checkout": {
+      const o = parseOptions(inv.args, "bB", CHECKOUT_LONG_VALUE);
+      const forced = o.flags.has("-f") || o.flags.has("--force");
+      const dropAll = inv.args.includes("--") && o.operands.some(wholeTree);
+      if (forced || dropAll) found(DESTRUCTIVE);
+      break;
+    }
     default:
       break;
   }
   return out;
 }
+function isExcludePathspec(operand) {
+  return /^:[!^]/.test(operand) || /^:\([^)]*\bexclude\b[^)]*\)/.test(operand);
+}
+function restoreSource(args) {
+  for (let i = 0; i < args.length; i++) {
+    const w = args[i];
+    if (w === null) continue;
+    if (w.startsWith("--source=")) return w.slice("--source=".length);
+    if (w === "--source" || w === "-s") return args[i + 1] ?? null;
+    if (/^-s./.test(w)) return w.slice(2);
+  }
+  return null;
+}
+function isHistoryRef(ref) {
+  return /^refs\/(heads|stash)(\/|$)/.test(ref);
+}
 function killSwitchSet(name, value) {
   if (value === null) return false;
   switch (name) {
@@ -5974,6 +6288,7 @@ function hooksBypass(inv) {
     const o = parseOptions(inv.args, "mFCcut", COMMIT_LONG_VALUE);
     return o.flags.has("-n") || o.flags.has("--no-verify");
   }
+  if (sub === "commit-tree") return true;
   if (sub !== void 0 && NO_VERIFY_SUBS.has(sub)) {
     return inv.args.some((a) => a === "--no-verify");
   }
@@ -6011,7 +6326,20 @@ function configWritesHooksPath(args) {
   return write;
 }
 function isHookPath(word) {
-  return /(^|[\\/])(\.git[\\/]hooks|\.husky)([\\/]|$)/.test(word);
+  return /(^|[\\/])(\.git[\\/]hooks|\.husky|\.githooks)([\\/]|$)/.test(word);
+}
+function isLiveHookFile(word) {
+  if (!isHookPath(word)) return false;
+  const m = /(^|[\\/])(\.git[\\/]hooks|\.husky|\.githooks)(?:[\\/](.*))?$/.exec(word);
+  if (!m) return false;
+  const rest = m[3] ?? "";
+  if (rest === "" || rest === "_") return true;
+  const leaf = rest.replace(/^_[\\/]/, "");
+  return /^[a-z-]+$/.test(leaf);
+}
+function hookBodyIsEmpty(text) {
+  const lines = text.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== "" && !l.startsWith("#"));
+  return lines.every((l) => /^(exit(\s+0)?|true|:|set\s+-[a-zA-Z]+|set\s+-o\s+\w+)$/.test(l));
 }
 function modeRemovesExecute(mode) {
   if (/^[0-7]{3,4}$/.test(mode)) {
@@ -6020,6 +6348,22 @@ function modeRemovesExecute(mode) {
   }
   return mode.split(",").some((part) => /^[ugoa]*-[rwst]*x/.test(part));
 }
+function redirOpIsAppend(redir) {
+  return redir?.Op === appendOp();
+}
+function appendOp() {
+  if (_appendOp !== null) return _appendOp;
+  try {
+    const f = parseShared("echo x >> y");
+    _appendOp = typeof f === "symbol" ? -1 : f.Stmts[0].Redirs[0].Op;
+  } catch {
+    _appendOp = -1;
+  }
+  return _appendOp;
+}
+function hooksBypassed(shown) {
+  return { ...HOOKS_BYPASS, shown, reason: `${HOOKS_BYPASS.reason}: ${shown}` };
+}
 function chmodDisarmsHook(args, shown) {
   let i = 0;
   while (i < args.length) {
@@ -6062,6 +6406,7 @@ function stagesEverything(inv) {
   const sub = inv.sub?.toLowerCase();
   const prefix = chdirPrefix(inv);
   const judge = (operands2) => {
+    if (operands2.length > 0 && operands2.every(isExcludePathspec)) return {};
     let conditional = false;
     for (const operand of operands2) {
       if (!wholeTree(operand)) continue;
@@ -6354,7 +6699,7 @@ function evaluateAgentFileWrite(args, accesses, context, settings, shell, hooks
   }
   return null;
 }
-function isPipeOp(op) {
+function isPipeOp2(op) {
   return !isListOp(op);
 }
 function isDupInOp(op) {
@@ -8387,7 +8732,7 @@ async function evaluatePolicyCore(config, toolName, args, context = {}, hooks =
       if (v?.logged) noteLogged(v);
       else if (v) candidates.push(v);
     };
-    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand);
+    const inline = reviewsEveryInline(config.settings.mode) ? detectInlineExec(shellCommand) ? void 0 : null : inlineExecReview(shellCommand, config.policy.jailPaths);
     if (inline !== null) {
       consider("commands.inline-exec", {
         decision: "review",
@@ -8730,7 +9075,7 @@ function* validCardRuns(text, base2, exemptFractions = true) {
   let m;
   while ((m = re.exec(text)) !== null) {
     const digits = m[0].replace(/\D/g, "");
-    const fraction = exemptFractions && isDecimalFraction(text, m.index, digits.length === m[0].length);
+    const fraction = exemptFractions && (isDecimalFraction(text, m.index, digits.length === m[0].length) || isInteriorDotNumber(m[0]));
     if (!fraction && validateLuhn(digits)) {
       yield { index: m.index, length: m[0].length, digits };
     } else {
@@ -8757,6 +9102,12 @@ function replaceValidCards(text, replace, { exemptFractions = true } = {}) {
   }
   return out;
 }
+function isInteriorDotNumber(run) {
+  const first = run.indexOf(".");
+  if (first <= 0 || first === run.length - 1) return false;
+  if (run.indexOf(".", first + 1) !== -1) return false;
+  return !/[-\s]/.test(run);
+}
 function isDecimalFraction(text, index, unseparated) {
   if (!unseparated) return false;
   const sep = text[index - 1];
@@ -9480,7 +9831,7 @@ function matchCanaryArgs(args, values) {
     return null;
   }
 }
-var getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, VARIABLE_READERS, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
+var getFilename, __filename2, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, finance_default, identity_default, publishing_default, settings_default, branches_default, ACTION_TEMPLATES, ACTION_CHECKS, GAP, prog, httpTo, httpWrite, HTTP_WRITE, HTTP_WRITE_ANY, NOT_STRIPE_TEST, postTo, STRIPE_OBJECTS, APP_SHIELD_SPECS, APP_SHIELDS, APP_SHIELD_NAMES, APP_SERVER_GLOB, GENERAL_ACTION_RULES, BUILTIN_SHIELDS, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, CHECK_TEXT, LEVELS, MODE_VALUES, SOFT, STRICT, BLOCK_ALL, LEVEL_CHECKS, ASI, ASI_IDS, PACK_SHIELD_OWASP, PACK_RULE_OWASP, VERDICTS, CHECK_VERDICT_RANK, ALL, BUILTIN_DANGEROUS_WORDS, PRODUCT_CHECKS, SHIELD_RULE_NAME, SHIELD_RULES_FOLDED_INTO_PRODUCT, CHECKS, CHECK_BY_ID, LEGACY_TO_ID, PROJECT_JAIL_BLOCK_READ, OVERRIDE_PREFIX, LABEL_WRAPPERS, LEGACY_READERS, syntax, KINDS, STRUCTS, unknownKinds, INVISIBLE_RE, INVISIBLE_ONE, HOMOGLYPHS, HOMOGLYPH_RE, MAX_BLOBS, MIN_DECODED, BASE64_RUN_RE, HEX_RUN_RE, HEX_ESCAPE_RUN_RE, SYSTEM_AUTH_FILES, SYSTEM_AUTH_DIRS, PASSWORD_HASH_FILES, STARTUP_NAMES, SYSTEM_DIRS, SYSTEM_DIRS_EXEMPT, UPLOAD_SYSTEM_DIRS, AGENT_INSTRUCTION_FILES, AGENT_INSTRUCTION_DIRS, LEGACY_SYSTEM_PATH_RE, MAX_ALTERNATIVES, MAX_CALL_DEPTH, MAX_CALL_WALKS, MAX_XARGS_PAYLOAD, POSITIONAL, MAX_DEPTH, MAX_PAYLOAD_DEPTH, unique, clone, SENDING_STDIN, DOWNLOAD_SHORT_VALUE, DOWNLOAD_LONG_VALUE, DOWNLOAD_OUTPUT_FLAGS, DOWNLOAD_DIR_FLAGS, base, quoteGlob, asWord, ops, MAX_INLINE_CODE, WHAT, OUTSIDE, pyImport, either, PYTHON, NODE, PERL, RUBY, PHP, TABLES, STRING_LITERAL, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, codeBodiesCache, AST_CACHE_MAX, astCache, PARSE_FAIL, INTERPRETER_LINE, PROGRAM_DIR, ACCESS_VIEW_CACHE_MAX, accessViewCache, MAX_READING_PAYLOADS, STDIN_CODE_INTERPRETERS, RUNS_TEXT_ELSEWHERE, defaultExpansionOps, EMPTY_NAMES, VARIABLE_READERS, PLAIN_PROGRAM_NAME, FS_READ_TOOLS, GREP_SHAPE, PATTERN_VERBS, PATTERN_VERB_NAMES, GREP_FILE_OPERANDS, READER_VALUE_LETTERS, FILE_OPERAND_FLAGS, SCP_VALUE_FLAGS, CURL_SOURCE_FLAGS, CURL_VALUE_LETTERS, WGET_VALUE_LETTERS, TAR_VALUE_LETTERS, ZIP_VALUE_LETTERS, RSYNC_VALUE_LETTERS, RSYNC_SKIP, CP_VALUE_LETTERS, INSTALL_VALUE_LETTERS, COPY_VERBS, TAR_MODE_WORD, COPY_VERB_HEADS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, FIND_EXEC_FLAGS, FS_MUTATION_TOOLS, INTERP_LEADING_TARGET, MAX_PAYLOAD_NESTING, payloadNesting, MAX_INLINE_CALLS, INLINE_EXEC_FALLBACK, UNREADABLE_SOURCE, SCRIPT_RUNNERS, SCRIPT_RUNNER_VALUE_FLAGS, MAX_SCRIPT_OPERANDS, NET_BINARIES, VALUE_FLAGS, HOME_VARIABLES, assignmentTable, currentStmtOffset, PAYLOAD_BUDGET, payloadBudget, seenPayloads, UNANALYSABLE_NESTING, ASSIGNMENT_HEADS, andOrOps, ARRAY_MARK, ARRAY_SEP, MAX_CALL_DEPTH2, MAX_CALL_WALKS2, callDepth, callWalks, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_FILE_IN_OPS, REDIR_HEREDOC_OPS, FIND_OPTIONS, COPY_RULE_OF, INDIRECT_SHAPE_RE, SOURCES_FILE_RE, SHELL_SET_VARS, pipeOps, callWords, JAILED_GLOB_NAMES, JAILED_DIR_NAMES, shellGlob, GLOB_META, isReaderWord, positionalAfter, NONE, UNKNOWN, FORBIDDEN_PATH_SEGMENTS, BASH_TOOL_NAMES, MCP_EXECUTORS, BUILTIN_FIELDS, ARGV_FIELDS, BARE_WORD, MAX_ARGV_CHARACTERS, exempt, RANK, SEQUENCE_OPS, BIP39_ENGLISH, BIP39_PUBLIC_VECTORS, indices, lengths, hash, MAX_MNEMONIC_HASHES, SECRET_VIEW_LIMITS, IBAN_LENGTH, IBAN_BBAN_SHAPE, B58, B58_INDEX, XPRV_VERSIONS, B62, CRC32_TABLE, GITHUB_TOKEN_RE, B64URL, B64URL_INDEX, CASK_TWO_ZERO_SUFFIX, CASK_FOUR_ZERO_SUFFIX, CF_ODD, CF_EVEN, SPANISH_LETTERS, HETU_CHARS, VERHOEFF_D, VERHOEFF_P, MAX, UNTRUSTED_TOOLS, INJECTION_SIGNALS, MENTION_QUOTE_RE, MENTION_WORD_RE, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, REFERENCE_VALUE_RE, IDENTIFIER_VALUE_RE, PATH_VALUE_RE, DOTTED_REFERENCE_RE, CONCATENATION_RE, EMAIL_VALUE_RE, FIXTURE_NAME_RE, DERIVATIVE_NAME_RE, QUERY_CREDENTIAL_VALUE_RE, OTP_SECRET_RE, OTP_DOC_SECRETS, ASSIGNED_SECRET_VALUE_RE, ASSIGNED_SECRET_NAME_RE, NAME_KEYWORD_RE, ARN_CONTEXT_RE, CIPHER_KEY_NAME_RE, CIPHER_NAME_PARTS, CIPHER_KEY_VALUE_RE, LARAVEL_KEY_VALUE_RE, SQL_PASSWORD_VALUE_RE, GRAFANA_KEY_VALUE_RE, BASIC_VALUE_RE, BASIC_PAIR_RE, BASIC_HEADER_RE, BASIC_HEADER_PAIR_RE, BASIC_PLACEHOLDER_RE, BASIC_TEMPLATE_MARKERS, DROPBOX_SECRET_RE, OTP_CAPTURE_RE, DB_URL_PASSWORD_RE, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, SENSITIVE_PATH_REGEXES, MAX_DEPTH2, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, BATCH_SEPARATOR, IMPERATIVE, SECRET_TARGET, GUARD, SIGNALS, DESTINATION_RE, REUSED_SIGNALS, NEVER_NEGATED, NEGATION_BEFORE, RDR_IN, COPY_VERBS2, LITERAL_VERBS, GIT_PRESCREEN_RE, MAX_PAYLOAD_DEPTH2, MAX_ALIAS_DEPTH, CACHE_MAX, cache, PAYLOAD_SHELLS, CONFIG_SCOPE_FLAGS, CONFIG_VALUE_FLAGS, GLOBAL_VALUE_OPTIONS, GLOBAL_FLAG_OPTIONS, MAX_LOOP_ITEMS, GitWalk, POSITIONAL2, NO_VARS, NO_APPENDS, FORCE_PUSH, DESTRUCTIVE, UNREADABLE, PUSH_LONG_VALUE, BRANCH_LONG_VALUE, TAG_LONG_VALUE, CLEAN_LONG_VALUE, RESTORE_LONG_VALUE, CHECKOUT_LONG_VALUE, HOOKS_BYPASS, NO_VERIFY_SUBS, HOOK_KILL_SWITCHES, COMMIT_LONG_VALUE, CHMOD_OPTION_RE, _appendOp, STAGE_ALL, ADD_LONG_VALUE, CHECK_ID, RULE_NAME, INERT_LINE_RE, CHECK_ID2, INSTRUCTION_NAMES, SETTINGS_RE, HOOK_WORDS_RE, SHELLS, NETCATS, NET_CLIENTS, SENDERS, NETCAT_EXEC_LONG, DECL_DUMPS, PROC_ENVIRON_RE, DEV_NET_RE, SOCAT_PROGRAM_RE, SOCAT_NET_RE, PRESCREEN_RE, MAX_PAYLOAD_DEPTH3, CACHE_MAX2, cache2, dupInOp, REVERSE_SHELL_DESCRIPTION, ENV_EXFIL_DESCRIPTION, DYNAMIC_WORD, MULTICALL, SHELL_VALUE_OPTIONS, INTERPRETERS, OutboundWalk, NPM_INSTALL_VERBS, NPM_EXEC_VERBS, PNPM_INSTALL_VERBS, YARN_INSTALL_VERBS, BUN_INSTALL_VERBS, DLX_VERBS, NON_REGISTRY_RE, NPM_NAME_RE, EXACT_SEMVER_RE, NPM_VALUE_FLAGS, PNPM_VALUE_FLAGS, YARN_VALUE_FLAGS, BUN_VALUE_FLAGS, PIP_VALUE_FLAGS, UV_VALUE_FLAGS, POETRY_VALUE_FLAGS, PIPENV_VALUE_FLAGS, PIPX_VALUE_FLAGS, PY_SPEC_RE, PY_EXACT_RE, EXACT_VERSION_RE, GEM_NAME_RE, GEM_VALUE_FLAGS, BUNDLE_VALUE_FLAGS, CRATE_NAME_RE, CARGO_ADD_VALUE_FLAGS, CARGO_INSTALL_VALUE_FLAGS, GO_VALUE_FLAGS, GO_PATH_RE, NUGET_NAME_RE, DOTNET_ADD_VALUE_FLAGS, DOTNET_TOOL_VALUE_FLAGS, NUGET_VALUE_FLAGS, MAVEN_COORD_RE, COMPOSER_NAME_RE, COMPOSER_VALUE_FLAGS, EDITOR_HEADS, EXTENSION_ID_RE, MANAGER_HEADS, SHELLS2, MAX_NESTING, SHELL_VALUE_FLAGS, NPM_FAMILY, PIP_FAMILY, NPM_FETCH_VERBS, PIP_FETCH_VERBS, NPM_FLAGS, PIP_FLAGS, NPM_VARS, PIP_VARS, PRESCREEN_RE2, PIP_ATTACHED_RE, MAX_PAYLOAD_DEPTH4, PUBLIC_REGISTRY_HOSTS, TUNING_FIELDS, MAP_GOVERNED, KNOB_GOVERNED, CONFIGURABLE_CHECK_IDS, DEFAULT_EGRESS_ALLOWLIST, PRIVATE_HOST_SUFFIXES, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, DESTINATION_ARGS, MCP_DESTINATION_KEYS, ARGUMENT_SCAN_LIMITS, RUN_CHAR, runChar, VERDICT_RANK, SQL_DML_KEYWORDS, MAX_DESTINATIONS, MAX_SCAN_CHARS, EMAIL_RE, URL_RE, IBAN_RE, RECIPIENT_KEYS, DESTRUCTIVE_VERB_RE, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_CC14_RE, PII_CC13_RE, PII_CC19_RE, CARD_PATTERNS, PII_ROUTING_RE, ROUTING_LABEL_RE, ROUTING_LABEL_WINDOW, NATIONAL_ID_SHAPES, NATIONAL_ID_LABEL_RE, NATIONAL_ID_LABEL_CS_RE, idLabelIn, NATIONAL_ID_LABEL_WINDOW, NATIONAL_ID_GUARD_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, IBAN_DESTINATION_KEYS, WHOLE_IBAN_RE, JSON_ESCAPE_RE, JSON_ESCAPES, MASKED_KINDS, ENTRY_RE, IBAN_TEXT_RE, EMAIL_TEXT_RE, ACCOUNT_KEY_RE, ACCOUNT_VALUE_RE, MAX_MASK_DEPTH, EMPTY, CURL_SEND_FLAGS, WGET_SEND_FLAGS, IWR_SEND_FLAGS, WRITE_METHODS, GH_READ, GH_WRITE, GH_HOSTNAME_FLAGS, GH_REPO_VALUE_FLAGS, GH_API_VALUE_FLAGS, GIT_FETCH, PUBLISH, SHELLS3, OWN_HEADS, MAX_DEPTH3, CWD_CHANGERS, TERMINAL_ESCAPE_RE, LOOP_MAX_RECORDS, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH4, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -12747,6 +13098,7 @@ var init_dist = __esm({
       "sqlite3"
     ]);
     defaultExpansionOps = null;
+    EMPTY_NAMES = /* @__PURE__ */ new Set();
     VARIABLE_READERS = /* @__PURE__ */ new Set([
       "read",
       "mapfile",
@@ -12759,6 +13111,7 @@ var init_dist = __esm({
       "readonly",
       "printf"
     ]);
+    PLAIN_PROGRAM_NAME = /^[A-Za-z_][\w.+-]*$/;
     FS_READ_TOOLS = /* @__PURE__ */ new Set([
       "cat",
       "less",
@@ -13653,6 +14006,8 @@ var init_dist = __esm({
         AND_OR_OPS: new Set([and, or].filter((o) => o !== null))
       };
     });
+    ARRAY_MARK = "
array
";
+    ARRAY_SEP = "
";
     MAX_CALL_DEPTH2 = 4;
     MAX_CALL_WALKS2 = 256;
     callDepth = 0;
@@ -16982,7 +17337,22 @@ zoo`.split("\n");
       found;
       /** Aliases defined earlier in this command: name -> value (null = dynamic). */
       aliases = /* @__PURE__ */ new Map();
+      /** node9Firewall#385: variables assigned a tree-top word (`scope="$PWD"`,
+       *  `root=$(git rev-parse --show-toplevel)`, `DIR=$(pwd)`), so the
+       *  variable reads as the top where it is used. */
+      treeTopVars = /* @__PURE__ */ new Set();
+      /** node9Firewall#385 (c): a string a script builds with `+=` from
+       *  literals (`mode=--ha; mode+=rd`). The jail's table does not follow an
+       *  append (JAIL-14a); the git rules read the built word, since a flag
+       *  spelled in two halves is still that flag. name -> value, null once a
+       *  half is unknown. */
+      appended = /* @__PURE__ */ new Map();
       payloads = /* @__PURE__ */ new Set();
+      /** node9Firewall#385 (a): the text this command writes to each path
+       *  (`cat > /tmp/x.sh <<'SH' ... SH`, `echo '...' > f`, `>>` appends), so
+       *  a later statement that runs the path (`bash f`, `sh f`, `./f`) is
+       *  judged on what it runs. null once a write to the path is unknown. */
+      written = /* @__PURE__ */ new Map();
       /** `for NAME in a b c`: the literal items, or null when one is dynamic. */
       loopVars = /* @__PURE__ */ new Map();
       /** Walk one command string. Returns false when it did not parse. */
@@ -17001,6 +17371,25 @@ zoo`.split("\n");
         const type = n.kind;
         if (type === "Stmt") {
           this.visitHeredocShell(n, depth);
+          this.visitPipeline(n, depth);
+          this.visitHookWrite(n);
+          this.recordScriptWrite(n);
+          this.visitWrittenScript(n, depth);
+          return true;
+        }
+        if (type === "Assign" && n.Name?.Value && n.Value) {
+          const name = n.Name.Value;
+          if (n.Append) {
+            const prev = this.appended.has(name) ? this.appended.get(name) : resolveWordLiteral(n.Value) === null ? null : void 0;
+            const base2 = prev === void 0 ? recordedExpansion(name) : prev;
+            const piece = resolveWordLiteral(n.Value);
+            this.appended.set(name, typeof base2 === "string" && piece !== null ? base2 + piece : null);
+            this.treeTopVars.delete(name);
+            return true;
+          }
+          this.appended.delete(name);
+          if (treeTopWord(n.Value, this.treeTopVars)) this.treeTopVars.add(name);
+          else this.treeTopVars.delete(name);
           return true;
         }
         if (type === "ForClause") {
@@ -17029,13 +17418,13 @@ zoo`.split("\n");
           const param = plainParamName(rawArgs[loopArg]);
           for (const item of this.loopVars.get(param.name)) {
             const words2 = rawArgs.flatMap(
-              (a, i) => i === loopArg ? param.quoted ? [item] : splitFields(item) : resolveGitWords(a)
+              (a, i) => i === loopArg ? param.quoted ? [item] : splitFields(item) : resolveGitWords(a, this.treeTopVars, this.appended)
             );
             this.visitWords(words2, new Map(prefixEnv), depth, false);
           }
           return true;
         }
-        const words = rawArgs.flatMap((a) => resolveGitWords(a));
+        const words = rawArgs.flatMap((a) => resolveGitWords(a, this.treeTopVars, this.appended));
         this.visitWords(words, prefixEnv, depth, false);
         return true;
       }
@@ -17060,6 +17449,23 @@ zoo`.split("\n");
           if (f) this.found(f);
           return;
         }
+        if (headWord === "rm" || headWord === "unlink") {
+          if (words.slice(head + 1).some((w) => w !== null && isLiveHookFile(w)))
+            this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
+        if (headWord === "mv") {
+          const operands2 = words.slice(head + 1).filter((w) => w === null || !w.startsWith("-"));
+          const src = operands2[0];
+          if (typeof src === "string" && isLiveHookFile(src)) this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
+        if (headWord === "perl") {
+          const code = words.slice(head + 1).find((w) => w !== null && /\brename\b/.test(w));
+          const m = code ? /rename\s*\(?\s*q[qw]?\s*[(\[{<'"]([^)\]}>'"]+)/.exec(code) : null;
+          if (m && isLiveHookFile(m[1])) this.found(hooksBypassed(shownOf(words)));
+          return;
+        }
         if (depth < MAX_PAYLOAD_DEPTH2) {
           const payload = literalShellPayload(words, baseWord(words[0]));
           if (payload !== null) this.runPayload(payload, depth);
@@ -17070,6 +17476,127 @@ zoo`.split("\n");
         this.payloads.add(payload);
         this.run(payload, depth + 1);
       }
+      /**
+       * node9Firewall#385: a pipeline whose last stage reads its pathspec from
+       * stdin (`git add --pathspec-from-file=-`) or runs git over the names it
+       * is fed (`xargs -0 git add --`), with a producer that is one literal
+       * (`git rev-parse --show-toplevel`, `printf '%s\0' .`): the literal is
+       * the operand, and the call is judged with it.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitPipeline(stmt, depth) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "BinaryCmd" || !isPipeOp(cmd.Op)) return;
+        const stages = [];
+        let cur = cmd;
+        while (cur?.kind === "BinaryCmd" && isPipeOp(cur.Op)) {
+          stages.unshift(cur.Y);
+          const left = cur.X;
+          if (left?.Cmd?.kind === "BinaryCmd" && isPipeOp(left.Cmd.Op)) cur = left.Cmd;
+          else {
+            stages.unshift(left);
+            break;
+          }
+        }
+        if (stages.length < 2) return;
+        const producer = stages[stages.length - 2]?.Cmd;
+        const consumer = stages[stages.length - 1]?.Cmd;
+        if (!producer || !consumer || producer.kind !== "CallExpr" || consumer.kind !== "CallExpr")
+          return;
+        const fed = producedLiteral(producer);
+        if (fed === null) return;
+        const words = (consumer.Args || []).flatMap(
+          (a) => resolveGitWords(a, this.treeTopVars, this.appended)
+        );
+        const head = unwrapCommandHead(words);
+        const viaXargs = words.slice(0, head).some((w) => baseWord(w) === "xargs");
+        const fromFile = words.findIndex(
+          (w) => w === "--pathspec-from-file=-" || w === "--pathspec-from-file"
+        );
+        if (!viaXargs && fromFile < 0) return;
+        let fedWords;
+        if (fromFile >= 0) {
+          fedWords = words.filter(
+            (w, k) => !(k === fromFile || w === "-" && words[k - 1] === "--pathspec-from-file")
+          );
+          fedWords.push(fed);
+        } else fedWords = [...words, fed];
+        this.visitWords(fedWords, /* @__PURE__ */ new Map(), depth, false);
+      }
+      /**
+       * node9Firewall#385 (e): a hook file written with a body that checks
+       * nothing (`cat > .githooks/pre-commit <<'SH' exit 0 SH`, `echo 'exit 0'
+       * > .git/hooks/pre-push`, `: > .githooks/pre-commit`). A real body (a
+       * test, a linter) is ordinary work on the hooks.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitHookWrite(stmt) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr") return;
+        const redirs = stmt.Redirs || [];
+        const target = redirs.find((r) => r?.Word && !r.Hdoc && (r.N == null || r.N.Value === "1"));
+        if (!target) return;
+        const path210 = resolveWordLiteral(target.Word);
+        if (path210 === null || !isLiveHookFile(path210)) return;
+        const hdoc = redirs.find((r) => r?.Hdoc);
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = baseWord(words[0]);
+        let body = null;
+        if (hdoc) body = resolveWordLiteral(hdoc.Hdoc);
+        else if (head === ":" || head === "true" || words.length === 0) body = "";
+        else if (head === "echo" || head === "printf") {
+          const rest = words.slice(1);
+          body = rest.some((w) => w === null) ? null : rest.filter((w) => !/^-[neE]+$/.test(w)).join(" ");
+          if (body !== null) body = body.replace(/\\n/g, "\n");
+        }
+        if (body !== null && hookBodyIsEmpty(body)) this.found(hooksBypassed(shownOf(words)));
+      }
+      /** A statement that writes a literal text to a path, by redirect. */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      recordScriptWrite(stmt) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr") return;
+        const redirs = stmt.Redirs || [];
+        const target = redirs.find((r) => r?.Word && !r.Hdoc && (r.N == null || r.N.Value === "1"));
+        if (!target) return;
+        const path210 = resolveWordLiteral(target.Word);
+        if (path210 === null) return;
+        const append = /^>>/.test(target.Op?.toString() ?? "") || redirOpIsAppend(target);
+        const hdoc = redirs.find((r) => r?.Hdoc);
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = baseWord(words[0]);
+        let text = null;
+        if (hdoc && (head === "cat" || head === "tee")) text = resolveWordLiteral(hdoc.Hdoc);
+        else if (head === "echo" || head === "printf") {
+          const rest = words.slice(1);
+          text = rest.some((w) => w === null) ? null : rest.filter((w) => !/^-[neE]+$/.test(w)).join(" ");
+          if (text !== null && head === "printf") text = text.replace(/\\n/g, "\n");
+        } else return;
+        const prev = this.written.get(path210);
+        if (text === null || append && prev === null) this.written.set(path210, null);
+        else this.written.set(path210, append && typeof prev === "string" ? `${prev}
+${text}` : text);
+      }
+      /** A statement that runs a path this command wrote: the text is the script. */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      visitWrittenScript(stmt, depth) {
+        const cmd = stmt.Cmd;
+        if (!cmd || cmd.kind !== "CallExpr" || this.written.size === 0 || depth >= MAX_PAYLOAD_DEPTH2)
+          return;
+        const words = (cmd.Args || []).map((a) => resolveWordLiteral(a));
+        const head = unwrapCommandHead(words);
+        const name = baseWord(words[head]);
+        let ran = null;
+        if (PAYLOAD_SHELLS.has(name) && name !== "eval") {
+          const operand = words.slice(head + 1).find((w) => w === null || !w.startsWith("-"));
+          if (typeof operand === "string") ran = operand;
+        } else if (typeof words[head] === "string" && this.written.has(words[head])) {
+          ran = words[head];
+        }
+        if (ran === null) return;
+        const text = this.written.get(ran);
+        if (typeof text === "string") this.runPayload(text, depth);
+      }
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       visitHeredocShell(stmt, depth) {
         const cmd = stmt.Cmd;
@@ -17221,6 +17748,8 @@ zoo`.split("\n");
       }
     };
     POSITIONAL2 = "\0positional";
+    NO_VARS = /* @__PURE__ */ new Set();
+    NO_APPENDS = /* @__PURE__ */ new Map();
     FORCE_PUSH = {
       checkId: "commands.git-destructive",
       ruleName: "review-force-push",
@@ -17279,6 +17808,8 @@ zoo`.split("\n");
       "--cleanup"
     ]);
     CLEAN_LONG_VALUE = /* @__PURE__ */ new Set(["--exclude"]);
+    RESTORE_LONG_VALUE = /* @__PURE__ */ new Set(["--source", "--pathspec-from-file"]);
+    CHECKOUT_LONG_VALUE = /* @__PURE__ */ new Set(["--pathspec-from-file", "--orphan", "--conflict"]);
     HOOKS_BYPASS = {
       checkId: "commands.git-hooks-bypass",
       ruleName: "review-git-hooks-bypass",
@@ -17304,6 +17835,7 @@ zoo`.split("\n");
       "--gpg-sign"
     ]);
     CHMOD_OPTION_RE = /^-[RvcfHLP]+$/;
+    _appendOp = null;
     STAGE_ALL = {
       checkId: "commands.git-stage-all",
       ruleName: "review-git-stage-all",
@@ -17428,7 +17960,7 @@ zoo`.split("\n");
           this.visitStmt(n, depth);
           return true;
         }
-        if (type === "BinaryCmd" && isPipeOp(n.Op)) {
+        if (type === "BinaryCmd" && isPipeOp2(n.Op)) {
           this.visitPipeline(n);
           return true;
         }
@@ -17529,7 +18061,7 @@ zoo`.split("\n");
         const stages = [];
         const flatten = (s) => {
           const c = s?.Cmd;
-          if (c && c.kind === "BinaryCmd" && isPipeOp(c.Op)) {
+          if (c && c.kind === "BinaryCmd" && isPipeOp2(c.Op)) {
             flatten(c.X);
             flatten(c.Y);
           } else stages.push(s);
@@ -18942,9 +19474,9 @@ init_audit();
 
 // src/config/index.ts
 init_esm_shims();
-import fs4 from "fs";
-import path5 from "path";
-import os4 from "os";
+import fs5 from "fs";
+import path6 from "path";
+import os5 from "os";
 
 // src/config-schema.ts
 init_esm_shims();
@@ -19237,11 +19769,18 @@ function slug(s) {
 var B = "[\\s/\\\\]";
 var SEP = "[/\\\\]";
 function pathToRegexFragment(rawPath) {
-  const tail = rawPath.trim().replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
+  const trimmed = rawPath.trim();
+  const tail = trimmed.replace(/^~[\\/]?/, "").replace(/^\$\{?HOME\}?[\\/]?/, "").replace(/^\/(?:home|Users)\/[^\\/]+[\\/]?/, "").replace(/^[A-Za-z]:[\\/]Users[\\/][^\\/]+[\\/]?/, "").replace(/^[\\/]+/, "").replace(/[\\/]+$/, "");
   const segments2 = tail.split(/[\\/]+/).filter(Boolean).map(escapeRegex);
   if (segments2.length === 0) return "";
+  if (isAbsoluteOutsideHome(trimmed)) {
+    return `(^|[^A-Za-z0-9_.~\\/-])/${segments2.join(SEP)}(${B}|$)`;
+  }
   return `(^|${B})${segments2.join(SEP)}(${B}|$)`;
 }
+function isAbsoluteOutsideHome(p) {
+  return p.startsWith("/") && !/^\/(?:home|Users|root)(?:\/|$)/.test(p);
+}
 function pathMatchesFragment(candidate, rawPath) {
   const value = pathToRegexFragment(rawPath);
   if (!value || !candidate) return false;
@@ -19507,17 +20046,57 @@ function applyManagedApprovers(local, managed) {
   };
 }
 
-// src/auth/trusted-hosts.ts
+// src/shields/jail.ts
 init_esm_shims();
 import fs3 from "fs";
-import path4 from "path";
 import os3 from "os";
+import path4 from "path";
+init_dist();
+var USER_JAIL_SHIELD = "user-jail";
+function jailStorePath() {
+  return path4.join(os3.homedir(), ".node9", "jail-paths.json");
+}
+function readJailPaths() {
+  let text;
+  try {
+    text = fs3.readFileSync(jailStorePath(), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
+  }
+  if (!Array.isArray(parsed.paths)) return [];
+  return parsed.paths.filter(
+    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
+  );
+}
+function findJailedPath(candidate) {
+  return findJailedPathIn(candidate, readJailPaths());
+}
+function findJailedPathIn(candidate, paths) {
+  if (!candidate) return null;
+  for (const entry of paths) {
+    if (pathMatchesFragment(candidate, entry.path)) return entry;
+  }
+  return null;
+}
+
+// src/auth/trusted-hosts.ts
+init_esm_shims();
+import fs4 from "fs";
+import path5 from "path";
+import os4 from "os";
 function getTrustedHostsPath() {
-  return path4.join(os3.homedir(), ".node9", "trusted-hosts.json");
+  return path5.join(os4.homedir(), ".node9", "trusted-hosts.json");
 }
 function readTrustedHosts() {
   try {
-    const raw = fs3.readFileSync(getTrustedHostsPath(), "utf8");
+    const raw = fs4.readFileSync(getTrustedHostsPath(), "utf8");
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed.hosts) ? parsed.hosts : [];
   } catch {
@@ -19528,7 +20107,7 @@ var _cache = null;
 var CACHE_TTL_MS = 5e3;
 function getFileMtime() {
   try {
-    return fs3.statSync(getTrustedHostsPath()).mtimeMs;
+    return fs4.statSync(getTrustedHostsPath()).mtimeMs;
   } catch {
     return 0;
   }
@@ -20013,7 +20592,8 @@ var DEFAULT_CONFIG = {
     trustedHostsManaged: false,
     appPermissions: {},
     appLinks: {},
-    managedJailPaths: []
+    managedJailPaths: [],
+    jailPaths: []
   },
   environments: {}
 };
@@ -20082,8 +20662,8 @@ function noteRejectedApiUrl(raw) {
   if (rejectedApiUrlsSeen.has(key)) return;
   rejectedApiUrlsSeen.add(key);
   try {
-    fs4.appendFileSync(
-      path5.join(os4.homedir(), ".node9", "hook-debug.log"),
+    fs5.appendFileSync(
+      path6.join(os5.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] REFUSED apiUrl, using the default instead: ${String(raw).slice(0, 200).replace(/[\r\n]+/g, " ")}
 `
     );
@@ -20100,9 +20680,9 @@ function getCredentials() {
     };
   }
   try {
-    const credPath = path5.join(os4.homedir(), ".node9", "credentials.json");
-    if (fs4.existsSync(credPath)) {
-      const creds = JSON.parse(fs4.readFileSync(credPath, "utf-8"));
+    const credPath = path6.join(os5.homedir(), ".node9", "credentials.json");
+    if (fs5.existsSync(credPath)) {
+      const creds = JSON.parse(fs5.readFileSync(credPath, "utf-8"));
       const profileName = process.env.NODE9_PROFILE || "default";
       const profile = creds[profileName];
       if (typeof profile?.apiKey === "string" && profile.apiKey.length > 0) {
@@ -20134,7 +20714,7 @@ function readRulesCacheResilient(cacheFile) {
   for (let attempt = 0; attempt < 3; attempt++) {
     let content;
     try {
-      content = fs4.readFileSync(cacheFile, "utf-8");
+      content = fs5.readFileSync(cacheFile, "utf-8");
       existed = true;
     } catch (err) {
       if (err.code === "ENOENT") return {};
@@ -20149,10 +20729,10 @@ function readRulesCacheResilient(cacheFile) {
     }
   }
   if (existed || sawReadError) {
-    const backup = path5.join(path5.dirname(cacheFile), "rules-cache.last-good.json");
+    const backup = path6.join(path6.dirname(cacheFile), "rules-cache.last-good.json");
     if (backup !== cacheFile) {
       try {
-        const raw = JSON.parse(fs4.readFileSync(backup, "utf-8"));
+        const raw = JSON.parse(fs5.readFileSync(backup, "utf-8"));
         logCacheReadIssue(cacheFile, "RULES_CACHE_CORRUPT_USED_BACKUP");
         lastParsedRulesCache = raw;
         return raw;
@@ -20175,8 +20755,8 @@ function logCacheReadIssue(cacheFile, kind) {
   if (now - cacheReadLastLoggedAt < CACHE_LOG_REARM_MS) return;
   cacheReadLastLoggedAt = now;
   try {
-    fs4.appendFileSync(
-      path5.join(os4.homedir(), ".node9", "hook-debug.log"),
+    fs5.appendFileSync(
+      path6.join(os5.homedir(), ".node9", "hook-debug.log"),
       `[${(/* @__PURE__ */ new Date()).toISOString()}] ${kind} ${cacheFile}
 `
     );
@@ -20202,8 +20782,8 @@ function catalogSettingsFrom(settings, policy) {
 }
 function getConfig(cwd) {
   if (!cwd && cachedConfig) return cachedConfig;
-  const globalPath = path5.join(os4.homedir(), ".node9", "config.json");
-  const projectPath = path5.join(cwd ?? process.cwd(), "node9.config.json");
+  const globalPath = path6.join(os5.homedir(), ".node9", "config.json");
+  const projectPath = path6.join(cwd ?? process.cwd(), "node9.config.json");
   const globalConfig = tryLoadConfig(globalPath);
   const projectConfig = tryLoadConfig(projectPath, { project: true });
   const mergedSettings = {
@@ -20253,7 +20833,8 @@ function getConfig(cwd) {
     trustedHostsManaged: false,
     appPermissions: {},
     appLinks: {},
-    managedJailPaths: []
+    managedJailPaths: [],
+    jailPaths: []
   };
   const mergedEnvironments = { ...DEFAULT_CONFIG.environments };
   const rank = (v) => {
@@ -20448,7 +21029,7 @@ function getConfig(cwd) {
   let cloudMandatesEnforcement = false;
   let cloudMandatesAppPerm = false;
   {
-    const cacheFile = path5.join(os4.homedir(), ".node9", "rules-cache.json");
+    const cacheFile = path6.join(os5.homedir(), ".node9", "rules-cache.json");
     try {
       const raw = readRulesCacheResilient(cacheFile);
       if (Array.isArray(raw.rules) && raw.rules.length > 0) {
@@ -20648,6 +21229,7 @@ function getConfig(cwd) {
               mergedPolicy.smartRules.push({ ...r, name: `org:${r.name}` });
             }
             mergedPolicy.managedJailPaths.push({ path: path33, verdict });
+            mergedPolicy.jailPaths.push(path33);
           }
         }
         if (Array.isArray(mc.trustedHosts)) {
@@ -20723,6 +21305,11 @@ function getConfig(cwd) {
     }
   }
   mergedPolicy.appliedShields = appliedShields.sort();
+  if (appliedShields.includes(USER_JAIL_SHIELD)) {
+    for (const { path: path33 } of readJailPaths()) {
+      if (!mergedPolicy.jailPaths.includes(path33)) mergedPolicy.jailPaths.push(path33);
+    }
+  }
   const existingAdvisoryNames = new Set(mergedPolicy.smartRules.map((r) => r.name));
   const cc = mergedPolicy.commandChecks ?? {};
   const advisoryKnobKey = (name) => {
@@ -20880,10 +21467,10 @@ function getConfig(cwd) {
 }
 function tryLoadConfig(filePath, options = {}) {
   v2ChecksByPath.delete(filePath);
-  if (!fs4.existsSync(filePath)) return null;
+  if (!fs5.existsSync(filePath)) return null;
   let raw;
   try {
-    raw = JSON.parse(fs4.readFileSync(filePath, "utf-8"));
+    raw = JSON.parse(fs5.readFileSync(filePath, "utf-8"));
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(
@@ -20989,27 +21576,27 @@ init_dist();
 // src/policy/index.ts
 init_esm_shims();
 init_dist();
-import fs13 from "fs";
+import fs14 from "fs";
 
 // src/utils/read-capped.ts
 init_esm_shims();
-import fs5 from "fs";
+import fs6 from "fs";
 function readCapped(file2, maxBytes, openFlags = "r") {
   if (maxBytes < 0) return null;
   let fd;
   try {
-    fd = fs5.openSync(file2, openFlags);
+    fd = fs6.openSync(file2, openFlags);
   } catch {
     return null;
   }
   try {
-    const st = fs5.fstatSync(fd);
+    const st = fs6.fstatSync(fd);
     if (!st.isFile()) return null;
     const want = Math.min(st.size, maxBytes + 1);
     const buf = Buffer.alloc(want);
     let read2 = 0;
     while (read2 < want) {
-      const n = fs5.readSync(fd, buf, read2, want - read2, read2);
+      const n = fs6.readSync(fd, buf, read2, want - read2, read2);
       if (n <= 0) break;
       read2 += n;
     }
@@ -21021,7 +21608,7 @@ function readCapped(file2, maxBytes, openFlags = "r") {
     return null;
   } finally {
     try {
-      fs5.closeSync(fd);
+      fs6.closeSync(fd);
     } catch {
     }
   }
@@ -21032,24 +21619,24 @@ function readCappedText(file2, maxBytes, openFlags = "r") {
 }
 
 // src/policy/index.ts
-import path14 from "path";
+import path15 from "path";
 
 // src/dlp.ts
 init_esm_shims();
 init_dist();
 init_dist();
-import fs6 from "fs";
-import path6 from "path";
+import fs7 from "fs";
+import path7 from "path";
 function scanFilePath(filePath, cwd = process.cwd(), options = {}) {
   if (!filePath) return null;
   let resolved;
   try {
-    const absolute2 = path6.resolve(cwd, filePath);
-    resolved = fs6.realpathSync.native(absolute2);
+    const absolute2 = path7.resolve(cwd, filePath);
+    resolved = fs7.realpathSync.native(absolute2);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT" || code === "ENOTDIR") {
-      resolved = path6.resolve(cwd, filePath);
+      resolved = path7.resolve(cwd, filePath);
     } else {
       return sensitivePathMatch(filePath);
     }
@@ -21272,29 +21859,29 @@ function combineWithEngine(gates, engine, opts = { panicMode: false }) {
 // src/policy/file-access.ts
 init_esm_shims();
 init_dist();
-import fs7 from "fs";
-import os5 from "os";
-import path7 from "path";
+import fs8 from "fs";
+import os6 from "os";
+import path8 from "path";
 function absoluteSpelling(p, cwd, home) {
   if (p === "~" || p.startsWith("~/")) p = home + p.slice(1);
-  return path7.isAbsolute(p) ? p : `${cwd}/${p}`;
+  return path8.isAbsolute(p) ? p : `${cwd}/${p}`;
 }
 function physical(p, followFinal, links = 0) {
   if (links > 40) throw new Error("Too many symbolic links");
   if (!followFinal) {
-    const parent = physical(path7.dirname(p), true, links);
-    return { path: `${parent.path}/${path7.basename(p)}`, missing: parent.missing };
+    const parent = physical(path8.dirname(p), true, links);
+    return { path: `${parent.path}/${path8.basename(p)}`, missing: parent.missing };
   }
   try {
-    return { path: fs7.realpathSync.native(p), missing: false };
+    return { path: fs8.realpathSync.native(p), missing: false };
   } catch (error) {
     const code = error.code;
     if (!["ENOENT", "ENOTDIR"].includes(code ?? "")) throw error;
     try {
-      if (fs7.lstatSync(p).isSymbolicLink()) {
-        const target = fs7.readlinkSync(p);
+      if (fs8.lstatSync(p).isSymbolicLink()) {
+        const target = fs8.readlinkSync(p);
         return physical(
-          path7.isAbsolute(target) ? target : `${path7.dirname(p)}/${target}`,
+          path8.isAbsolute(target) ? target : `${path8.dirname(p)}/${target}`,
           true,
           links + 1
         );
@@ -21303,13 +21890,13 @@ function physical(p, followFinal, links = 0) {
       if (!["ENOENT", "ENOTDIR"].includes(linkError.code ?? ""))
         throw linkError;
     }
-    const parent = path7.dirname(p);
+    const parent = path8.dirname(p);
     if (parent === p) return { path: p, missing: true };
     const resolved = physical(parent, true, links);
-    return { path: `${resolved.path}/${path7.basename(p)}`, missing: true };
+    return { path: `${resolved.path}/${path8.basename(p)}`, missing: true };
   }
 }
-function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, home = os5.homedir()) {
+function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, home = os6.homedir()) {
   const context = { cwd, homeDirs: [home, "/root"] };
   const accesses = collectFileAccesses(tool, args, context, inspection);
   const handledPaths = /* @__PURE__ */ new Set();
@@ -21332,14 +21919,14 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
     const raw = absoluteSpelling(access.path, access.cwd ?? cwd, home);
     if (access.directoryTarget) {
       try {
-        if (!fs7.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
+        if (!fs8.statSync(absoluteSpelling(access.directoryTarget, access.cwd ?? cwd, home)).isDirectory())
           continue;
       } catch {
       }
     }
     if (access.operation === "create") {
       try {
-        fs7.statSync(raw);
+        fs8.statSync(raw);
         continue;
       } catch {
       }
@@ -21391,39 +21978,39 @@ function prepareFileAccesses(tool, args, cwd = process.cwd(), inspection = {}, h
 init_esm_shims();
 init_dist();
 import picomatch3 from "picomatch";
-import path11 from "path";
+import path12 from "path";
 
 // src/supply-chain/osv-index.ts
 init_esm_shims();
 init_dist();
-import fs9 from "fs";
-import os6 from "os";
-import path9 from "path";
+import fs10 from "fs";
+import os7 from "os";
+import path10 from "path";
 import { createHash as createHash4 } from "crypto";
 
 // src/utils/atomic-write.ts
 init_esm_shims();
-import fs8 from "fs";
-import path8 from "path";
+import fs9 from "fs";
+import path9 from "path";
 import { randomUUID } from "crypto";
 function atomicWriteSync(filePath, data, options) {
-  const dir2 = path8.dirname(filePath);
-  if (!fs8.existsSync(dir2)) fs8.mkdirSync(dir2, { recursive: true });
+  const dir2 = path9.dirname(filePath);
+  if (!fs9.existsSync(dir2)) fs9.mkdirSync(dir2, { recursive: true });
   const tmpPath = `${filePath}.${randomUUID()}.tmp`;
   try {
-    fs8.writeFileSync(tmpPath, data, options);
+    fs9.writeFileSync(tmpPath, data, options);
   } catch (err) {
     try {
-      fs8.unlinkSync(tmpPath);
+      fs9.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
   }
   try {
-    fs8.renameSync(tmpPath, filePath);
+    fs9.renameSync(tmpPath, filePath);
   } catch (err) {
     try {
-      fs8.unlinkSync(tmpPath);
+      fs9.unlinkSync(tmpPath);
     } catch {
     }
     throw err;
@@ -21433,10 +22020,10 @@ function atomicWriteSync(filePath, data, options) {
 // src/supply-chain/osv-index.ts
 var INDEX_FRESH_MS = 72 * 60 * 60 * 1e3;
 function osvRoot() {
-  return path9.join(os6.homedir(), ".node9", "osv");
+  return path10.join(os7.homedir(), ".node9", "osv");
 }
 function ecoDir(eco) {
-  return path9.join(osvRoot(), eco);
+  return path10.join(osvRoot(), eco);
 }
 function indexKey(eco, name) {
   switch (eco) {
@@ -21455,11 +22042,11 @@ function shardOf(key) {
   return createHash4("sha1").update(key).digest("hex").slice(0, 2);
 }
 function shardPath(eco, shard) {
-  return path9.join(ecoDir(eco), "shards", `${shard}.json`);
+  return path10.join(ecoDir(eco), "shards", `${shard}.json`);
 }
 function readMeta(eco) {
   try {
-    const m = JSON.parse(fs9.readFileSync(path9.join(ecoDir(eco), "meta.json"), "utf8"));
+    const m = JSON.parse(fs10.readFileSync(path10.join(ecoDir(eco), "meta.json"), "utf8"));
     if (typeof m?.syncedAt !== "string" || typeof m?.lastModifiedMs !== "number") return null;
     return m;
   } catch {
@@ -21468,7 +22055,7 @@ function readMeta(eco) {
 }
 function readShard(eco, shard) {
   try {
-    const s = JSON.parse(fs9.readFileSync(shardPath(eco, shard), "utf8"));
+    const s = JSON.parse(fs10.readFileSync(shardPath(eco, shard), "utf8"));
     return s && typeof s === "object" && !Array.isArray(s) ? s : {};
   } catch {
     return {};
@@ -21822,19 +22409,19 @@ async function registryInfo(eco, name, version, freshWindowMs, raw) {
 
 // src/supply-chain/local-resolve.ts
 init_esm_shims();
-import fs10 from "fs";
-import path10 from "path";
+import fs11 from "fs";
+import path11 from "path";
 var MAX_LEVELS = 32;
 var LOCAL_FIRST_MANAGERS = /* @__PURE__ */ new Set(["npx", "bunx", "npm exec"]);
 function resolveInstalled(name, cwd) {
-  if (!cwd || !path10.isAbsolute(cwd)) return null;
+  if (!cwd || !path11.isAbsolute(cwd)) return null;
   if (!/^(?:@[^/\\]+\/)?[^/\\]+$/.test(name)) return null;
-  let dir2 = path10.resolve(cwd);
+  let dir2 = path11.resolve(cwd);
   for (let i = 0; i < MAX_LEVELS; i++) {
-    const pkgDir = path10.join(dir2, "node_modules", ...name.split("/"));
-    const manifest = path10.join(pkgDir, "package.json");
+    const pkgDir = path11.join(dir2, "node_modules", ...name.split("/"));
+    const manifest = path11.join(pkgDir, "package.json");
     try {
-      const raw = fs10.readFileSync(manifest, "utf8");
+      const raw = fs11.readFileSync(manifest, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed.version === "string" && parsed.version.length > 0) {
         return { version: parsed.version, dir: pkgDir };
@@ -21842,7 +22429,7 @@ function resolveInstalled(name, cwd) {
       return null;
     } catch {
     }
-    const parent = path10.dirname(dir2);
+    const parent = path11.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -21964,7 +22551,7 @@ function checkInstalled(p, version, misses) {
 }
 async function checkOne(p, cfg, misses, networkCapped, cwd) {
   if (p.ecosystem === "npm" && LOCAL_FIRST_MANAGERS.has(p.manager) && p.localCwd !== null && (p.raw === p.name || p.version)) {
-    const localCwd = cwd && path11.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => path11.resolve(dir2, step), cwd) : void 0;
+    const localCwd = cwd && path12.isAbsolute(cwd) ? (p.localCwd ?? []).reduce((dir2, step) => path12.resolve(dir2, step), cwd) : void 0;
     const installed = resolveInstalled(p.name, localCwd);
     if (installed && (!p.version || p.version === installed.version))
       return checkInstalled(p, installed.version, misses);
@@ -22110,9 +22697,9 @@ async function runPackageCheck(toolName, args, cfg, cwd, opts = {}) {
 // src/supply-chain/registries.ts
 init_esm_shims();
 init_dist();
-import os7 from "os";
-import path12 from "path";
-import fs11 from "fs";
+import os8 from "os";
+import path13 from "path";
+import fs12 from "fs";
 var MAX_CONFIG_BYTES = 256 * 1024;
 var MAX_PARENT_DIRS = 12;
 var TTL_MS = 5e3;
@@ -22153,29 +22740,29 @@ var REGISTRY_KEY_RE = /registry|index|find-links|mirror/i;
 var REGISTRY_SECTION_RE = /index|source|registr|scopes|mirror/i;
 var URL_RE2 = /https?:\/\/[^\s"'<>,;]+/gi;
 function userFiles(home, env) {
-  const xdg = env.XDG_CONFIG_HOME || path12.join(home, ".config");
+  const xdg = env.XDG_CONFIG_HOME || path13.join(home, ".config");
   return [
-    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || path12.join(home, ".npmrc"),
-    path12.join(home, ".yarnrc"),
-    path12.join(home, ".yarnrc.yml"),
-    path12.join(home, ".bunfig.toml"),
+    env.NPM_CONFIG_USERCONFIG || env.npm_config_userconfig || path13.join(home, ".npmrc"),
+    path13.join(home, ".yarnrc"),
+    path13.join(home, ".yarnrc.yml"),
+    path13.join(home, ".bunfig.toml"),
     env.PIP_CONFIG_FILE || "",
-    path12.join(xdg, "pip", "pip.conf"),
-    path12.join(home, ".pip", "pip.conf"),
+    path13.join(xdg, "pip", "pip.conf"),
+    path13.join(home, ".pip", "pip.conf"),
     "/etc/pip.conf",
-    env.VIRTUAL_ENV ? path12.join(env.VIRTUAL_ENV, "pip.conf") : "",
+    env.VIRTUAL_ENV ? path13.join(env.VIRTUAL_ENV, "pip.conf") : "",
     env.UV_CONFIG_FILE || "",
-    path12.join(xdg, "uv", "uv.toml"),
+    path13.join(xdg, "uv", "uv.toml"),
     "/etc/uv/uv.toml"
   ].filter(Boolean);
 }
 function projectFiles(cwd) {
-  if (!cwd || !path12.isAbsolute(cwd)) return [];
+  if (!cwd || !path13.isAbsolute(cwd)) return [];
   const out = [];
   let dir2 = cwd;
   for (let i = 0; i < MAX_PARENT_DIRS; i++) {
-    for (const f of PROJECT_FILES) out.push(path12.join(dir2, f));
-    const parent = path12.dirname(dir2);
+    for (const f of PROJECT_FILES) out.push(path13.join(dir2, f));
+    const parent = path13.dirname(dir2);
     if (parent === dir2) break;
     dir2 = parent;
   }
@@ -22215,7 +22802,7 @@ function hostsInText(text, out) {
   }
 }
 var cache3 = /* @__PURE__ */ new Map();
-function configuredRegistryHosts(cwd, env = process.env, home = os7.homedir()) {
+function configuredRegistryHosts(cwd, env = process.env, home = os8.homedir()) {
   const key = [
     cwd ?? "",
     home,
@@ -22237,7 +22824,7 @@ function configuredRegistryHosts(cwd, env = process.env, home = os7.homedir()) {
     const r = readCappedText(
       file2,
       MAX_CONFIG_BYTES,
-      fs11.constants.O_RDONLY | (fs11.constants.O_NONBLOCK ?? 0)
+      fs12.constants.O_RDONLY | (fs12.constants.O_NONBLOCK ?? 0)
     );
     if (r) hostsInText(r.text, hosts);
   }
@@ -22247,27 +22834,27 @@ function configuredRegistryHosts(cwd, env = process.env, home = os7.homedir()) {
 
 // src/utils/provenance.ts
 init_esm_shims();
-import fs12 from "fs";
-import path13 from "path";
-import os8 from "os";
+import fs13 from "fs";
+import path14 from "path";
+import os9 from "os";
 var SYSTEM_PREFIXES = ["/usr/bin", "/usr/sbin", "/bin", "/sbin"];
 var MANAGED_PREFIXES = ["/usr/local/bin", "/opt/homebrew", "/home/linuxbrew", "/nix/store"];
 var USER_PREFIXES = [
-  path13.join(os8.homedir(), "bin"),
-  path13.join(os8.homedir(), ".local", "bin"),
-  path13.join(os8.homedir(), ".cargo", "bin"),
-  path13.join(os8.homedir(), ".npm-global", "bin"),
-  path13.join(os8.homedir(), ".volta", "bin")
+  path14.join(os9.homedir(), "bin"),
+  path14.join(os9.homedir(), ".local", "bin"),
+  path14.join(os9.homedir(), ".cargo", "bin"),
+  path14.join(os9.homedir(), ".npm-global", "bin"),
+  path14.join(os9.homedir(), ".volta", "bin")
 ];
 var SUSPECT_PREFIXES = ["/tmp", "/var/tmp", "/dev/shm"];
 function findInPath(cmd) {
-  if (path13.posix.isAbsolute(cmd)) return cmd;
+  if (path14.posix.isAbsolute(cmd)) return cmd;
   const pathEnv = process.env.PATH ?? "";
-  for (const dir2 of pathEnv.split(path13.delimiter)) {
+  for (const dir2 of pathEnv.split(path14.delimiter)) {
     if (!dir2) continue;
-    const full = path13.join(dir2, cmd);
+    const full = path14.join(dir2, cmd);
     try {
-      fs12.accessSync(full, fs12.constants.X_OK);
+      fs13.accessSync(full, fs13.constants.X_OK);
       return full;
     } catch {
     }
@@ -22278,7 +22865,7 @@ function _classifyPath(resolved, cwd) {
   if (cwd && resolved.startsWith(cwd + "/")) {
     return { trustLevel: "user", reason: "binary in project directory" };
   }
-  const osTmp = os8.tmpdir();
+  const osTmp = os9.tmpdir();
   const allSuspect = osTmp ? [...SUSPECT_PREFIXES, osTmp] : SUSPECT_PREFIXES;
   if (allSuspect.some((p) => resolved === p || resolved.startsWith(p + "/"))) {
     return { trustLevel: "suspect", reason: `binary in temp directory: ${resolved}` };
@@ -22296,7 +22883,7 @@ function _classifyPath(resolved, cwd) {
 }
 function checkProvenance(cmd, cwd) {
   const bare = cmd.startsWith("./") ? cmd.slice(2) : cmd;
-  if (path13.posix.isAbsolute(bare)) {
+  if (path14.posix.isAbsolute(bare)) {
     const early = _classifyPath(bare, cwd);
     if (early.trustLevel === "suspect") {
       return { resolvedPath: bare, ...early };
@@ -22312,7 +22899,7 @@ function checkProvenance(cmd, cwd) {
         reason: "binary not found in PATH"
       };
     }
-    resolved = fs12.realpathSync(found);
+    resolved = fs13.realpathSync(found);
   } catch {
     return {
       resolvedPath: cmd,
@@ -22321,7 +22908,7 @@ function checkProvenance(cmd, cwd) {
     };
   }
   try {
-    const stat = fs12.statSync(resolved);
+    const stat = fs13.statSync(resolved);
     if (stat.mode & 2) {
       return {
         resolvedPath: resolved,
@@ -22375,9 +22962,9 @@ async function evaluatePolicy2(toolName, args, agent, cwd, opts) {
   );
 }
 function isGitWorkTreeTop(dir2, cwd) {
-  if (!path14.isAbsolute(cwd)) return true;
+  if (!path15.isAbsolute(cwd)) return true;
   try {
-    return fs13.existsSync(path14.join(path14.resolve(cwd, dir2), ".git"));
+    return fs14.existsSync(path15.join(path15.resolve(cwd, dir2), ".git"));
   } catch {
     return true;
   }
@@ -22387,7 +22974,7 @@ function readAgentSettings(absPath) {
   const r = readCappedText(
     absPath,
     MAX_AGENT_SETTINGS_BYTES,
-    fs13.constants.O_RDONLY | (fs13.constants.O_NONBLOCK ?? 0)
+    fs14.constants.O_RDONLY | (fs14.constants.O_NONBLOCK ?? 0)
   );
   return r && !r.truncated ? r.text : null;
 }
@@ -22397,12 +22984,12 @@ function isIgnoredTool2(toolName) {
 
 // src/auth/state.ts
 init_esm_shims();
-import fs14 from "fs";
-import path15 from "path";
-import os9 from "os";
+import fs15 from "fs";
+import path16 from "path";
+import os10 from "os";
 init_forecast_context();
-var PAUSED_FILE = path15.join(os9.homedir(), ".node9", "PAUSED");
-var TRUST_FILE = path15.join(os9.homedir(), ".node9", "trust.json");
+var PAUSED_FILE = path16.join(os10.homedir(), ".node9", "PAUSED");
+var TRUST_FILE = path16.join(os10.homedir(), ".node9", "trust.json");
 function extractCommandPattern(toolName, args) {
   const lower2 = toolName.toLowerCase();
   if (lower2 !== "bash" && lower2 !== "execute_bash" && lower2 !== "shell") return void 0;
@@ -22415,11 +23002,11 @@ function extractCommandPattern(toolName, args) {
 function checkPause() {
   if (forecastRun()) return { paused: false };
   try {
-    if (!fs14.existsSync(PAUSED_FILE)) return { paused: false };
-    const state = JSON.parse(fs14.readFileSync(PAUSED_FILE, "utf-8"));
+    if (!fs15.existsSync(PAUSED_FILE)) return { paused: false };
+    const state = JSON.parse(fs15.readFileSync(PAUSED_FILE, "utf-8"));
     if (state.expiry > 0 && Date.now() >= state.expiry) {
       try {
-        fs14.unlinkSync(PAUSED_FILE);
+        fs15.unlinkSync(PAUSED_FILE);
       } catch {
       }
       return { paused: false };
@@ -22432,8 +23019,8 @@ function checkPause() {
 function getActiveTrustSession(toolName, args) {
   if (forecastRun()) return false;
   try {
-    if (!fs14.existsSync(TRUST_FILE)) return false;
-    const trust = JSON.parse(fs14.readFileSync(TRUST_FILE, "utf-8"));
+    if (!fs15.existsSync(TRUST_FILE)) return false;
+    const trust = JSON.parse(fs15.readFileSync(TRUST_FILE, "utf-8"));
     const now = Date.now();
     const active = trust.entries.filter((e) => e.expiry > now);
     if (active.length !== trust.entries.length) {
@@ -22456,8 +23043,8 @@ function writeTrustSession(toolName, durationMs, args) {
   try {
     let trust = { entries: [] };
     try {
-      if (fs14.existsSync(TRUST_FILE)) {
-        trust = JSON.parse(fs14.readFileSync(TRUST_FILE, "utf-8"));
+      if (fs15.existsSync(TRUST_FILE)) {
+        trust = JSON.parse(fs15.readFileSync(TRUST_FILE, "utf-8"));
       }
     } catch {
     }
@@ -22479,9 +23066,9 @@ function writeTrustSession(toolName, durationMs, args) {
 }
 function getPersistentDecision(toolName) {
   try {
-    const file2 = path15.join(os9.homedir(), ".node9", "decisions.json");
-    if (!fs14.existsSync(file2)) return null;
-    const decisions = JSON.parse(fs14.readFileSync(file2, "utf-8"));
+    const file2 = path16.join(os10.homedir(), ".node9", "decisions.json");
+    if (!fs15.existsSync(file2)) return null;
+    const decisions = JSON.parse(fs15.readFileSync(file2, "utf-8"));
     const d = decisions[toolName];
     if (d === "allow" || d === "deny") return d;
   } catch {
@@ -22492,16 +23079,16 @@ function getPersistentDecision(toolName) {
 // src/auth/daemon.ts
 init_esm_shims();
 init_forecast_context();
-import fs16 from "fs";
+import fs17 from "fs";
 import http from "http";
 import net from "net";
-import path17 from "path";
-import os10 from "os";
+import path18 from "path";
+import os11 from "os";
 
 // src/utils/activity-socket.ts
 init_esm_shims();
-import fs15 from "fs";
-import path16 from "path";
+import fs16 from "fs";
+import path17 from "path";
 
 // src/utils/own-dir.ts
 init_esm_shims();
@@ -22510,7 +23097,7 @@ init_esm_shims();
 var currentUid = () => typeof process.getuid === "function" ? process.getuid() : void 0;
 function isPrivateDir(dir2, uid = currentUid()) {
   try {
-    const st = fs15.lstatSync(dir2);
+    const st = fs16.lstatSync(dir2);
     if (st.isSymbolicLink() || !st.isDirectory()) return false;
     if (uid !== void 0 && st.uid !== uid) return false;
     return (st.mode & 18) === 0;
@@ -22522,13 +23109,13 @@ var WINDOWS_PIPE = /^\\\\\.\\pipe\\node9-activity-[0-9a-f]{32}$/;
 function isTrustedActivitySocket(socketPath, uid = currentUid()) {
   if (process.platform === "win32") return WINDOWS_PIPE.test(socketPath);
   try {
-    const st = fs15.lstatSync(socketPath);
+    const st = fs16.lstatSync(socketPath);
     if (!st.isSocket()) return false;
     if (uid !== void 0 && st.uid !== uid) return false;
   } catch {
     return false;
   }
-  return isPrivateDir(path16.dirname(socketPath), uid);
+  return isPrivateDir(path17.dirname(socketPath), uid);
 }
 
 // src/auth/decision-record.ts
@@ -22680,9 +23267,9 @@ function recordFromLegacyWait(body, now = Date.now()) {
 }
 
 // src/auth/daemon.ts
-function daemonActivitySocket(home = os10.homedir()) {
+function daemonActivitySocket(home = os11.homedir()) {
   try {
-    const raw = fs16.readFileSync(path17.join(home, ".node9", "daemon.pid"), "utf-8");
+    const raw = fs17.readFileSync(path18.join(home, ".node9", "daemon.pid"), "utf-8");
     const p = JSON.parse(raw).activitySocket;
     return typeof p === "string" && isTrustedActivitySocket(p) ? p : null;
   } catch {
@@ -22746,9 +23333,9 @@ var DAEMON_HOST = "127.0.0.1";
 function getInternalToken() {
   if (forecastRun()) return null;
   try {
-    const pidFile = path17.join(os10.homedir(), ".node9", "daemon.pid");
-    if (!fs16.existsSync(pidFile)) return null;
-    const data = JSON.parse(fs16.readFileSync(pidFile, "utf-8"));
+    const pidFile = path18.join(os11.homedir(), ".node9", "daemon.pid");
+    if (!fs17.existsSync(pidFile)) return null;
+    const data = JSON.parse(fs17.readFileSync(pidFile, "utf-8"));
     process.kill(data.pid, 0);
     return data.internalToken ?? null;
   } catch {
@@ -22757,12 +23344,12 @@ function getInternalToken() {
 }
 function isDaemonRunning() {
   if (forecastRun()) return false;
-  const pidFile = path17.join(os10.homedir(), ".node9", "daemon.pid");
-  if (fs16.existsSync(pidFile)) {
+  const pidFile = path18.join(os11.homedir(), ".node9", "daemon.pid");
+  if (fs17.existsSync(pidFile)) {
     let pid;
     let port;
     try {
-      const data = JSON.parse(fs16.readFileSync(pidFile, "utf-8"));
+      const data = JSON.parse(fs17.readFileSync(pidFile, "utf-8"));
       pid = data.pid;
       port = data.port;
     } catch {
@@ -22780,7 +23367,7 @@ function isDaemonRunning() {
     } catch (err) {
       if (err instanceof Error && "code" in err && err.code === "ESRCH") {
         try {
-          fs16.unlinkSync(pidFile);
+          fs17.unlinkSync(pidFile);
         } catch {
         }
       }
@@ -23120,9 +23707,9 @@ import { randomUUID as randomUUID2 } from "crypto";
 
 // src/apps/state.ts
 init_esm_shims();
-import fs18 from "fs";
-import os12 from "os";
-import path19 from "path";
+import fs19 from "fs";
+import os13 from "os";
+import path20 from "path";
 
 // src/apps/catalog.ts
 init_esm_shims();
@@ -23256,22 +23843,22 @@ init_audit();
 
 // src/daemon/mcp-tools.ts
 init_esm_shims();
-import fs17 from "fs";
-import path18 from "path";
-import os11 from "os";
+import fs18 from "fs";
+import path19 from "path";
+import os12 from "os";
 
 // src/mcp-cmd.ts
 init_esm_shims();
 
 // src/daemon/mcp-tools.ts
 function getMcpToolsFile() {
-  return path18.join(os11.homedir(), ".node9", "mcp-tools.json");
+  return path19.join(os12.homedir(), ".node9", "mcp-tools.json");
 }
 function readMcpToolsConfig() {
   try {
     const file2 = getMcpToolsFile();
-    if (!fs17.existsSync(file2)) return {};
-    const raw = fs17.readFileSync(file2, "utf-8");
+    if (!fs18.existsSync(file2)) return {};
+    const raw = fs18.readFileSync(file2, "utf-8");
     return JSON.parse(raw);
   } catch {
     return {};
@@ -23279,8 +23866,8 @@ function readMcpToolsConfig() {
 }
 
 // src/apps/state.ts
-function appsFilePath(home = os12.homedir()) {
-  return path19.join(home, ".node9", "apps.json");
+function appsFilePath(home = os13.homedir()) {
+  return path20.join(home, ".node9", "apps.json");
 }
 var SIGNAL_KINDS = /* @__PURE__ */ new Set(["mcp-server", "command", "package", "env-name"]);
 function emptyFile() {
@@ -23328,7 +23915,7 @@ function readAppsFile(home) {
 function readAppsFileStrict(home) {
   let text;
   try {
-    text = fs18.readFileSync(appsFilePath(home), "utf8");
+    text = fs19.readFileSync(appsFilePath(home), "utf8");
   } catch (e) {
     return e.code === "ENOENT" ? emptyFile() : null;
   }
@@ -23343,7 +23930,7 @@ var NO_LINKS = /* @__PURE__ */ Object.create(null);
 function localLinks() {
   const file2 = appsFilePath();
   try {
-    const mtimeMs = fs18.statSync(file2).mtimeMs;
+    const mtimeMs = fs19.statSync(file2).mtimeMs;
     if (!linkCache || linkCache.file !== file2 || linkCache.mtimeMs !== mtimeMs) {
       linkCache = { mtimeMs, file: file2, links: readAppsFile().links };
     }
@@ -23389,11 +23976,11 @@ import path32 from "path";
 // src/ui/native.ts
 init_esm_shims();
 import { spawn } from "child_process";
-import path21 from "path";
+import path22 from "path";
 
 // src/context-sniper.ts
 init_esm_shims();
-import path20 from "path";
+import path21 from "path";
 function smartTruncate(str, maxLen = 500) {
   if (str.length <= maxLen) return str;
   const edge = Math.floor(maxLen / 2) - 3;
@@ -23461,7 +24048,7 @@ function computeRiskMetadata(args, tier, blockedByLabel, matchedField, matchedWo
       intent = "EDIT";
       if (obj.file_path) {
         editFilePath = String(obj.file_path);
-        editFileName = path20.basename(editFilePath);
+        editFileName = path21.basename(editFilePath);
       }
       const result = extractContext(String(obj.new_string), matchedWord);
       contextSnippet = result.snippet;
@@ -23530,7 +24117,7 @@ function formatArgs(args, matchedField, matchedWord) {
   if (typeof parsed === "object" && !Array.isArray(parsed)) {
     const obj = parsed;
     if (obj.old_string !== void 0 && obj.new_string !== void 0) {
-      const file2 = obj.file_path ? path21.basename(String(obj.file_path)) : "file";
+      const file2 = obj.file_path ? path22.basename(String(obj.file_path)) : "file";
       const oldPreview = smartTruncate(String(obj.old_string), 120);
       const newPreview = extractContext(String(obj.new_string), matchedWord).snippet;
       return {
@@ -23738,48 +24325,6 @@ import fs20 from "fs";
 import os14 from "os";
 import path23 from "path";
 init_dist();
-
-// src/shields/jail.ts
-init_esm_shims();
-import fs19 from "fs";
-import os13 from "os";
-import path22 from "path";
-init_dist();
-var USER_JAIL_SHIELD = "user-jail";
-function jailStorePath() {
-  return path22.join(os13.homedir(), ".node9", "jail-paths.json");
-}
-function readJailPaths() {
-  let text;
-  try {
-    text = fs19.readFileSync(jailStorePath(), "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    throw new Error(`${jailStorePath()} is not valid JSON \u2014 fix it before changing the jail.`);
-  }
-  if (!Array.isArray(parsed.paths)) return [];
-  return parsed.paths.filter(
-    (p) => !!p && typeof p.path === "string" && (p.verdict === "block" || p.verdict === "review")
-  );
-}
-function findJailedPath(candidate) {
-  return findJailedPathIn(candidate, readJailPaths());
-}
-function findJailedPathIn(candidate, paths) {
-  if (!candidate) return null;
-  for (const entry of paths) {
-    if (pathMatchesFragment(candidate, entry.path)) return entry;
-  }
-  return null;
-}
-
-// src/canary/registry.ts
 function canaryStorePath() {
   return path23.join(os14.homedir(), ".node9", "canaries.json");
 }