@north-light/crouter 0.3.318 → 0.3.319

package/dist/core/bash-guard.js

@@ -1,393 +1,11 @@
-// bash-guard.ts — the refusals the bash valve applies to a command's TEXT
-// before any of it runs. Pure: command text and the node's cwd in, a refusal
-// message or null out.
-//
-// Two refusals live here, for the same reason: both are things no correct
-// agent command ever does, and both are cheaper to stop than to recover from.
-//
-//  - A long leading `sleep` burns a live window on a clock the runtime already
-//    owns a cheaper primitive for.
-//  - A destructive command aimed at the home directory, a system root, or a
-//    directory above the node's own working directory is unrecoverable.
-//
-// The second exists because of a real incident. A node ran:
-//
-//   cd star-theory-2 && HOME="$(mktemp -d …)" godot … ; rm -rf "$HOME" …
-//
-// A `VAR=value cmd` prefix applies only to that ONE command, so the trailing
-// `rm -rf "$HOME"` used the real home directory and deleted for 108 seconds
-// before another node killed it. A memory doc telling agents not to do this
-// already exists; it is advisory and did not survive contact. This is the
-// block.
-//
-// What this is NOT: a sandbox. Command text is read best-effort — expansions,
-// subshells, `eval`, and a script the command invokes are all out of reach. It
-// stops the plausible mistake a competent agent makes, not an agent trying to
-// get around it. Anything it cannot resolve, it allows: a guard that guesses
-// would refuse ordinary work, and an agent that learns the guard is noisy
-// starts routing around it.
-import { homedir, userInfo } from 'node:os';
-import { isAbsolute, resolve, sep } from 'node:path';
-import { commandSegments, stripHeredocs } from './shell-segments.js';
-// Long-sleep guard. A command that opens with `sleep <long>` is a node burning
-// a live window to wait on a clock — the runtime already has waiting primitives
-// that cost nothing (`crtr cron` for a scheduled wake, `crtr node wait deadline`
-// for an inbox-vs-deadline race). Anything over 10s is refused before it runs.
-const MAX_INLINE_SLEEP_SECONDS = 10;
-const SLEEP_UNIT_SECONDS = { s: 1, m: 60, h: 3600, d: 86400 };
-/** Seconds a leading `sleep ...` will block for, or null when the command does
- *  not open with a sleep (or its duration isn't statically knowable). */
-export function leadingSleepSeconds(command) {
-    const match = /^\s*sleep(\s+[^;&|\n]+)/.exec(command);
-    if (!match)
-        return null;
-    // `sleep 1 2m 3` sums its operands.
-    let total = 0;
-    for (const operand of match[1].trim().split(/\s+/)) {
-        const parsed = /^([0-9]*\.?[0-9]+)([smhd]?)$/.exec(operand);
-        if (!parsed)
-            return null; // variable/expansion/flag — not statically knowable
-        total += Number(parsed[1]) * SLEEP_UNIT_SECONDS[parsed[2] || 's'];
-    }
-    return total;
-}
-function longSleepRefusal(command) {
-    const seconds = leadingSleepSeconds(command);
-    if (seconds === null || seconds <= MAX_INLINE_SLEEP_SECONDS)
-        return null;
-    return (`Refused: this command starts by sleeping ${seconds}s, over the ${MAX_INLINE_SLEEP_SECONDS}s inline limit.\n` +
-        `Holding a live window on a clock is never how you wait here. Instead:\n` +
-        `  - schedule the wake and end your turn: crtr cron -h (one-shot at a time, or recurring)\n` +
-        `  - race an inbox message against a deadline: crtr node wait deadline -h\n` +
-        `  - waiting on a child, a reply from the user, or any spine event: just stop — the runtime wakes you.\n` +
-        `If you truly need a short pause inline, sleep ${MAX_INLINE_SLEEP_SECONDS}s or less.`);
-}
-// Protected paths
-/** System directories whose removal, relocation, or recursive permission
- *  change breaks the machine rather than the task. Matched EXACTLY after
- *  resolution — `/tmp` is protected, `/tmp/build-1234` is ordinary work. */
-const PROTECTED_SYSTEM_PATHS = [
-    '/',
-    '/Applications',
-    '/bin',
-    '/dev',
-    '/etc',
-    '/home',
-    '/Library',
-    '/opt',
-    '/private',
-    '/private/etc',
-    '/private/tmp',
-    '/private/var',
-    '/sbin',
-    '/System',
-    '/tmp',
-    '/usr',
-    '/Users',
-    '/var',
-    '/Volumes',
-];
-/** Why a resolved target is protected, in the words the refusal uses. `null`
- *  when the target is ordinary and the command may run. */
-function protectedReason(target, home, cwd) {
-    if (PROTECTED_SYSTEM_PATHS.includes(target))
-        return 'a system directory';
-    if (target === home)
-        return 'your home directory';
-    if (target === `${home}/.crouter`)
-        return 'the canvas home — every node\u2019s conversation and state';
-    // Strict ancestors only: a node may delete its OWN working directory (a
-    // merged worktree is a real case), just nothing that contains it.
-    if (cwd === target || !cwd.startsWith(target.endsWith(sep) ? target : target + sep))
-        return null;
-    return `a directory containing your working directory (${cwd})`;
-}
-function initialVariables(home, cwd) {
-    const user = userInfo().username;
-    return new Map([['HOME', home], ['PWD', cwd], ['USER', user], ['LOGNAME', user]]);
-}
-/** The text with `~` and every known `$VAR` substituted, or null when what is
- *  left still depends on something the guard cannot see. */
-function expandText(text, vars) {
-    let t = text;
-    if (t === '~' || t.startsWith('~/')) {
-        const home = vars.get('HOME');
-        if (home === undefined)
-            return null;
-        t = home + t.slice(1);
-    }
-    else if (t.startsWith('~')) {
-        return null; // ~otheruser — not ours to resolve
-    }
-    t = t.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g, (whole, braced, bare) => vars.get(braced ?? bare) ?? whole);
-    // Anything still carrying an expansion or a glob is not statically knowable.
-    return /[$`*?[]/.test(t) ? null : t;
-}
-/** The absolute path an operand names, or null when it is not statically
- *  knowable. A trailing `/*` or `/.` is stripped first: `rm -rf ~/*` empties
- *  the same tree as `rm -rf ~`. A relative operand resolves against `base` —
- *  null when an earlier `cd` in the same line went somewhere the guard cannot
- *  follow. */
-function resolveTarget(text, vars, base) {
-    const expanded = expandText(text.replace(/\/+\*?\.?$/, '') || '/', vars);
-    if (expanded === null)
-        return null;
-    if (isAbsolute(expanded))
-        return resolve(expanded);
-    return base === null ? null : resolve(base, expanded);
-}
-/** Fold `VAR=value` assignments into a variable map. A value the guard cannot
- *  expand deletes the variable rather than leaving a stale one behind: reading
- *  a later `$HOME` as the real home when the line reassigned it is exactly the
- *  false refusal that would teach agents to route around this guard. */
-function applyAssignments(vars, assignments) {
-    for (const assignment of assignments) {
-        const eq = assignment.indexOf('=');
-        if (eq <= 0)
-            continue;
-        const name = assignment.slice(0, eq);
-        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
-            continue;
-        const value = expandText(assignment.slice(eq + 1), vars);
-        if (value === null)
-            vars.delete(name);
-        else
-            vars.set(name, value);
-    }
-}
-// The destructive operations
-/** A redirection, whole (`2>/dev/null`) or as its bare operator (`>`), which
- *  takes the next word as its file. Neither is an operand of the command. */
-const REDIRECTION = /^[0-9]*(&?>>?|<<?|>&|<&)/;
-/** Operands of a segment, minus flags, the `--` end-of-flags marker, and
- *  redirections. */
-function operands(tokens) {
-    const out = [];
-    let flagsEnded = false;
-    let skipNext = false;
-    for (const token of tokens.slice(1)) {
-        if (skipNext) {
-            skipNext = false;
-            continue;
-        }
-        const redirection = REDIRECTION.exec(token.text);
-        if (redirection !== null && !token.opaque) {
-            skipNext = token.text === redirection[0]; // bare operator — its file is the next word
-            continue;
-        }
-        if (!flagsEnded && token.text === '--') {
-            flagsEnded = true;
-            continue;
-        }
-        if (!flagsEnded && token.text.startsWith('-') && token.text !== '-')
-            continue;
-        out.push(token.text);
-    }
-    return out;
-}
-/** Short and long flags of a segment, short combinations split into letters. */
-function flagLetters(tokens) {
-    const letters = new Set();
-    const long = new Set();
-    for (const token of tokens.slice(1)) {
-        if (token.text === '--')
-            break;
-        if (token.text.startsWith('--'))
-            long.add(token.text.slice(2));
-        else if (token.text.startsWith('-') && token.text.length > 1)
-            for (const ch of token.text.slice(1))
-                letters.add(ch);
-    }
-    return { letters, long };
-}
-function isRecursive(tokens) {
-    const { letters, long } = flagLetters(tokens);
-    return letters.has('r') || letters.has('R') || long.has('recursive');
-}
-/** A block device holding a filesystem. `/dev/null`, `/dev/stdout`, and
- *  `/dev/zero` are ordinary output; a disk node is not. */
-const RAW_DISK_DEVICE = /^\/dev\/r?(disk|sd[a-z]|nvme|hd[a-z]|vd[a-z]|mmcblk|md)/;
-/** `find`'s start paths: the words between its leading global options and the
- *  first predicate of the expression. Those options are why the paths cannot
- *  simply be "everything before the first `-` word" — `find -H ~ -delete` and
- *  `find -- ~ -delete` both walk the home tree. */
-function findPaths(tokens) {
-    const paths = [];
-    let i = 1;
-    while (i < tokens.length) {
-        const text = tokens[i].text;
-        if (text === '--' || /^-[HLPEdsx]$/.test(text))
-            i += 1;
-        else if (text === '-D' || text === '-O')
-            i += 2; // GNU debug/optimisation, each with a value
-        else if (text === '-f') { // BSD's explicit start path
-            if (i + 1 < tokens.length)
-                paths.push(tokens[i + 1].text);
-            i += 2;
-        }
-        else
-            break;
-    }
-    for (; i < tokens.length; i += 1) {
-        if (tokens[i].text.startsWith('-'))
-            break;
-        paths.push(tokens[i].text);
-    }
-    return paths;
-}
-/** Command names that stand in front of the real command and must be stepped
- *  over before it can be read. Their own flags are skipped with them. */
-const COMMAND_PREFIXES = new Set(['sudo', 'doas', 'command', 'env', 'nice', 'nohup', 'time', 'stdbuf', 'xargs', 'exec', 'builtin']);
-/** Strip every leading prefix command and its flags, leaving the real command
- *  as `tokens[0]`. `sudo -E nice -n 10 rm -rf ~` reads as `rm -rf ~`. */
-function stripCommandPrefixes(tokens) {
-    let rest = tokens;
-    while (rest.length > 0 && !rest[0].opaque && COMMAND_PREFIXES.has(rest[0].text)) {
-        let i = 1;
-        while (i < rest.length && rest[i].text.startsWith('-')) {
-            // `nice -n 10` and `env -u VAR` take a value; a lone flag does not.
-            const takesValue = /^-[nu]$/.test(rest[i].text);
-            i += takesValue ? 2 : 1;
-        }
-        // `env FOO=bar cmd` — the assignments belong to env, not to the command.
-        while (i < rest.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(rest[i].text))
-            i += 1;
-        if (i >= rest.length)
-            return [];
-        rest = rest.slice(i);
-    }
-    return rest;
-}
-/** Targets this segment would destroy: the operands whose loss the guard
- *  cares about, or `[]` when the segment is not a destructive operation. A
- *  verb appears here only when ONE invocation of it can take out a whole tree.
- *  A device or subcommand named directly (`mkfs.ext4`, `diskutil eraseDisk`)
- *  has no path operand to resolve, so it reports itself. */
-function destructiveTargets(tokens) {
-    const none = { targets: [], named: null };
-    const head = tokens[0];
-    if (head === undefined || head.opaque)
-        return none;
-    const name = head.text.slice(head.text.lastIndexOf('/') + 1);
-    const args = operands(tokens);
-    switch (name) {
-        // `rm` without a recursive flag cannot remove a directory at all.
-        case 'rm':
-            return isRecursive(tokens) ? { targets: args, named: null } : none;
-        // Every operand but the destination is a source that stops existing.
-        case 'mv':
-            return args.length >= 2 ? { targets: args.slice(0, -1), named: null } : none;
-        // A recursive mode or ownership sweep over a system tree is as final as a
-        // deletion. The first operand is the mode/owner, not a path.
-        case 'chmod':
-        case 'chown':
-        case 'chgrp':
-            return isRecursive(tokens) && args.length >= 2 ? { targets: args.slice(1), named: null } : none;
-        // `find <path> … -delete` and `-exec` walk the tree and act on every hit.
-        case 'find': {
-            const acts = tokens.some((t) => !t.opaque && (t.text === '-delete' || t.text === '-exec' || t.text === '-execdir'));
-            return acts ? { targets: findPaths(tokens), named: null } : none;
-        }
-        // `dd of=…` overwrites its output in place; a raw disk is unrecoverable,
-        // while `of=/dev/null` and friends are ordinary output redirection.
-        case 'dd': {
-            const of = tokens.find((t) => t.text.startsWith('of='));
-            if (of === undefined)
-                return none;
-            const path = of.text.slice(3);
-            if (RAW_DISK_DEVICE.test(path))
-                return { targets: [], named: path };
-            return path.startsWith('/dev/') ? none : { targets: [path], named: null };
-        }
-        default:
-            // Filesystem creation and disk erasure destroy a volume outright; there
-            // is no safe target for them inside an agent's task.
-            if (/^(mkfs|newfs)([.-].+)?$/.test(name))
-                return { targets: [], named: name };
-            if (name === 'diskutil') {
-                const verb = args[0];
-                if (verb !== undefined && /^(erase|reformat|partition|zeroDisk|randomDisk|secureErase)/i.test(verb)) {
-                    return { targets: [], named: `diskutil ${verb}` };
-                }
-            }
-            return none;
-    }
-}
-/** Walk the line segment by segment, carrying the variable values and working
- *  directory the shell itself would carry, and refuse the first destructive
- *  segment aimed at a protected path.
- *
- *  Carrying that state IS the guard's core distinction. `export HOME=/tmp/x`
- *  as its own command changes `$HOME` for everything after it, so a later
- *  `rm -rf "$HOME"` is a scratch directory and runs. A `HOME=/tmp/x cmd`
- *  PREFIX applies to that one command only, so a later `rm -rf "$HOME"` is the
- *  real home — which is precisely the mistake that destroyed one. */
-function destructiveCommandRefusal(command, cwd, home) {
-    const vars = initialVariables(home, cwd);
-    // Every directory a relative operand might be resolved from. A `cd` ADDS its
-    // destination rather than replacing the previous one, because the guard
-    // cannot know whether the shell's `cd` succeeded: after `cd missing-dir`,
-    // bash stays put and `rm -rf ..` really is the ancestor. Refusing when ANY
-    // candidate is protected keeps that case caught; the refusal names the
-    // resolved path, and an absolute operand is never ambiguous.
-    let bases = [cwd];
-    for (const segment of commandSegments(stripHeredocs(command))) {
-        const tokens = stripCommandPrefixes(segment.tokens);
-        const head = tokens[0];
-        if (head !== undefined) {
-            // This segment's own prefix assignments apply to this command only.
-            const local = new Map(vars);
-            applyAssignments(local, segment.assignments);
-            const innermost = bases[bases.length - 1];
-            if (innermost !== undefined)
-                local.set('PWD', innermost);
-            const { targets, named } = destructiveTargets(tokens);
-            if (named !== null)
-                return refusalMessage(segment.text, named, 'a whole disk or volume — never a task boundary');
-            for (const target of targets) {
-                for (const base of bases.length === 0 ? [null] : bases) {
-                    const resolved = resolveTarget(target, local, base);
-                    if (resolved === null)
-                        continue;
-                    const reason = protectedReason(resolved, home, cwd);
-                    if (reason !== null)
-                        return refusalMessage(segment.text, resolved, reason);
-                }
-            }
-        }
-        // Then carry this segment's lasting effects into the rest of the line. A
-        // backgrounded segment runs in a subshell, so it has none.
-        if (segment.background)
-            continue;
-        if (head === undefined)
-            applyAssignments(vars, segment.assignments);
-        else if (!head.opaque && SHELL_VARIABLE_BUILTINS.has(head.text)) {
-            // A prefix assignment to a special builtin persists in the shell.
-            applyAssignments(vars, segment.assignments);
-            applyAssignments(vars, operands(tokens));
-        }
-        else if (!head.opaque && head.text === 'cd') {
-            const destination = operands(tokens)[0];
-            const next = destination === undefined ? vars.get('HOME') ?? null : resolveTarget(destination, vars, bases[bases.length - 1] ?? null);
-            // An unfollowable `cd` leaves no knowable base at all; a relative operand
-            // after it is unresolvable, and unresolvable always means allowed.
-            bases = next === null ? [] : [...bases, next];
-        }
-    }
-    return null;
-}
-/** Builtins that set shell variables for everything after them. */
-const SHELL_VARIABLE_BUILTINS = new Set(['export', 'declare', 'typeset', 'readonly']);
-function refusalMessage(segment, target, reason) {
-    return (`Refused: \`${segment}\` targets ${target}, which is ${reason}.\n` +
-        `Nothing an agent is asked to do requires destroying that path, and it cannot be undone.\n` +
-        `If you meant somewhere else, name that path explicitly and run the command again. Two traps to check first:\n` +
-        `  - a \`VAR=value cmd\` prefix applies ONLY to that one command, so a later \`$VAR\` in the same line is the SHELL's value — this is exactly how a node deleted a home directory.\n` +
-        `  - \`~\` and \`$HOME\` are the real home directory, never a scratch dir; build scratch paths with mktemp -d and hold them in a variable of your own.\n` +
-        `If you believe this path genuinely must be destroyed, ask the user — do not work around this refusal.`);
-}
-/** The refusal this command earns before it runs, or null when it may run.
- *  `cwd` is the directory the command will execute in. */
-export function bashCommandRefusal(command, cwd, home = homedir()) {
-    return longSleepRefusal(command) ?? destructiveCommandRefusal(command, cwd, home);
-}
+var $=Object.defineProperty;var a=(n,t)=>$(n,"name",{value:t,configurable:!0});import{homedir as I,userInfo as R}from"node:os";import{isAbsolute as k,resolve as x,sep as v}from"node:path";import{commandSegments as L,stripHeredocs as O}from"./shell-segments.js";const h=10,W={s:1,m:60,h:3600,d:86400};function N(n){const t=/^\s*sleep(\s+[^;&|\n]+)/.exec(n);if(!t)return null;let e=0;for(const s of t[1].trim().split(/\s+/)){const r=/^([0-9]*\.?[0-9]+)([smhd]?)$/.exec(s);if(!r)return null;e+=Number(r[1])*W[r[2]||"s"]}return e}a(N,"leadingSleepSeconds");function z(n){const t=N(n);return t===null||t<=h?null:`Refused: this command starts by sleeping ${t}s, over the ${h}s inline limit.
+Holding a live window on a clock is never how you wait here. Instead:
+  - schedule the wake and end your turn: crtr cron -h (one-shot at a time, or recurring)
+  - race an inbox message against a deadline: crtr node wait deadline -h
+  - waiting on a child, a reply from the user, or any spine event: just stop \u2014 the runtime wakes you.
+If you truly need a short pause inline, sleep ${h}s or less.`}a(z,"longSleepRefusal");const D=["/","/Applications","/bin","/dev","/etc","/home","/Library","/opt","/private","/private/etc","/private/tmp","/private/var","/sbin","/System","/tmp","/usr","/Users","/var","/Volumes"];function M(n,t,e){return D.includes(n)?"a system directory":n===t?"your home directory":n===`${t}/.crouter`?"the canvas home \u2014 every node\u2019s conversation and state":e===n||!e.startsWith(n.endsWith(v)?n:n+v)?null:`a directory containing your working directory (${e})`}a(M,"protectedReason");function T(n,t){const e=R().username;return new Map([["HOME",n],["PWD",t],["USER",e],["LOGNAME",e]])}a(T,"initialVariables");function y(n,t){let e=n;if(e==="~"||e.startsWith("~/")){const s=t.get("HOME");if(s===void 0)return null;e=s+e.slice(1)}else if(e.startsWith("~"))return null;return e=e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g,(s,r,i)=>t.get(r??i)??s),/[$`*?[]/.test(e)?null:e}a(y,"expandText");function E(n,t,e){const s=y(n.replace(/\/+\*?\.?$/,"")||"/",t);return s===null?null:k(s)?x(s):e===null?null:x(e,s)}a(E,"resolveTarget");function d(n,t){for(const e of t){const s=e.indexOf("=");if(s<=0)continue;const r=e.slice(0,s);if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(r))continue;const i=y(e.slice(s+1),n);i===null?n.delete(r):n.set(r,i)}}a(d,"applyAssignments");const H=/^[0-9]*(&?>>?|<<?|>&|<&)/;function m(n){const t=[];let e=!1,s=!1;for(const r of n.slice(1)){if(s){s=!1;continue}const i=H.exec(r.text);if(i!==null&&!r.opaque){s=r.text===i[0];continue}if(!e&&r.text==="--"){e=!0;continue}!e&&r.text.startsWith("-")&&r.text!=="-"||t.push(r.text)}return t}a(m,"operands");function P(n){const t=new Set,e=new Set;for(const s of n.slice(1)){if(s.text==="--")break;if(s.text.startsWith("--"))e.add(s.text.slice(2));else if(s.text.startsWith("-")&&s.text.length>1)for(const r of s.text.slice(1))t.add(r)}return{letters:t,long:e}}a(P,"flagLetters");function w(n){const{letters:t,long:e}=P(n);return t.has("r")||t.has("R")||e.has("recursive")}a(w,"isRecursive");const C=/^\/dev\/r?(disk|sd[a-z]|nvme|hd[a-z]|vd[a-z]|mmcblk|md)/;function q(n){const t=[];let e=1;for(;e<n.length;){const s=n[e].text;if(s==="--"||/^-[HLPEdsx]$/.test(s))e+=1;else if(s==="-D"||s==="-O")e+=2;else if(s==="-f")e+1<n.length&&t.push(n[e+1].text),e+=2;else break}for(;e<n.length&&!n[e].text.startsWith("-");e+=1)t.push(n[e].text);return t}a(q,"findPaths");const Z=new Set(["sudo","doas","command","env","nice","nohup","time","stdbuf","xargs","exec","builtin"]);function V(n){let t=n;for(;t.length>0&&!t[0].opaque&&Z.has(t[0].text);){let e=1;for(;e<t.length&&t[e].text.startsWith("-");){const s=/^-[nu]$/.test(t[e].text);e+=s?2:1}for(;e<t.length&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(t[e].text);)e+=1;if(e>=t.length)return[];t=t.slice(e)}return t}a(V,"stripCommandPrefixes");function U(n){const t={targets:[],named:null},e=n[0];if(e===void 0||e.opaque)return t;const s=e.text.slice(e.text.lastIndexOf("/")+1),r=m(n);switch(s){case"rm":return w(n)?{targets:r,named:null}:t;case"mv":return r.length>=2?{targets:r.slice(0,-1),named:null}:t;case"chmod":case"chown":case"chgrp":return w(n)&&r.length>=2?{targets:r.slice(1),named:null}:t;case"find":return n.some(o=>!o.opaque&&(o.text==="-delete"||o.text==="-exec"||o.text==="-execdir"))?{targets:q(n),named:null}:t;case"dd":{const i=n.find(l=>l.text.startsWith("of="));if(i===void 0)return t;const o=i.text.slice(3);return C.test(o)?{targets:[],named:o}:o.startsWith("/dev/")?t:{targets:[o],named:null}}default:if(/^(mkfs|newfs)([.-].+)?$/.test(s))return{targets:[],named:s};if(s==="diskutil"){const i=r[0];if(i!==void 0&&/^(erase|reformat|partition|zeroDisk|randomDisk|secureErase)/i.test(i))return{targets:[],named:`diskutil ${i}`}}return t}}a(U,"destructiveTargets");function B(n,t,e){const s=T(e,t);let r=[t];for(const i of L(O(n))){const o=V(i.tokens),l=o[0];if(l!==void 0){const u=new Map(s);d(u,i.assignments);const c=r[r.length-1];c!==void 0&&u.set("PWD",c);const{targets:S,named:p}=U(o);if(p!==null)return b(i.text,p,"a whole disk or volume \u2014 never a task boundary");for(const A of S)for(const _ of r.length===0?[null]:r){const f=E(A,u,_);if(f===null)continue;const g=M(f,e,t);if(g!==null)return b(i.text,f,g)}}if(!i.background){if(l===void 0)d(s,i.assignments);else if(!l.opaque&&X.has(l.text))d(s,i.assignments),d(s,m(o));else if(!l.opaque&&l.text==="cd"){const u=m(o)[0],c=u===void 0?s.get("HOME")??null:E(u,s,r[r.length-1]??null);r=c===null?[]:[...r,c]}}}return null}a(B,"destructiveCommandRefusal");const X=new Set(["export","declare","typeset","readonly"]);function b(n,t,e){return`Refused: \`${n}\` targets ${t}, which is ${e}.
+Nothing an agent is asked to do requires destroying that path, and it cannot be undone.
+If you meant somewhere else, name that path explicitly and run the command again. Two traps to check first:
+  - a \`VAR=value cmd\` prefix applies ONLY to that one command, so a later \`$VAR\` in the same line is the SHELL's value \u2014 this is exactly how a node deleted a home directory.
+  - \`~\` and \`$HOME\` are the real home directory, never a scratch dir; build scratch paths with mktemp -d and hold them in a variable of your own.
+If you believe this path genuinely must be destroyed, ask the user \u2014 do not work around this refusal.`}a(b,"refusalMessage");function K(n,t,e=I()){return z(n)??B(n,t,e)}a(K,"bashCommandRefusal");export{K as bashCommandRefusal,N as leadingSleepSeconds};