@pushary/agent-hooks 1.9.29 → 1.9.30

package/dist/{chunk-H7QTZTIE.js → chunk-JBVKA3UR.js}

@@ -296,12 +296,27 @@ var normalizeAgentId = (value, accepted) => {
   return accepted.find((candidate) => names.includes(candidate)) ?? null;
 };
 
+// ../contracts/src/shell-tools.ts
+var SHELL_TOOL = "Bash";
+var POWERSHELL_TOOL = "PowerShell";
+var MONITOR_TOOL = "Monitor";
+var SHELL_DIALECT_BY_TOOL = /* @__PURE__ */ new Map([
+  [SHELL_TOOL, "posix"],
+  [MONITOR_TOOL, "posix"],
+  [POWERSHELL_TOOL, "powershell"]
+]);
+var shellDialectOf = (toolName) => SHELL_DIALECT_BY_TOOL.get(toolName);
+var POSIX_SHELL_TOOLS = new Set(
+  [...SHELL_DIALECT_BY_TOOL].filter(([, dialect]) => dialect === "posix").map(([toolName]) => toolName)
+);
+var toolNameForAPosixReading = (toolName) => shellDialectOf(toolName) === "posix" ? SHELL_TOOL : toolName;
+
 // ../contracts/src/agent-wiring.ts
 var COMPATIBLE_AGENT_TYPES = ["qwen_code", "codebuddy", "qoder", "droid", "devin", "antigravity_cli"];
 var isCompatibleAgentType = (value) => typeof value === "string" && COMPATIBLE_AGENT_TYPES.includes(value);
 var CANONICAL_PATH_KEYS = ["file_path", "path", "notebook_path"];
 var CANONICAL_COMMAND_KEYS = ["command"];
-var SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "PowerShell"]);
+var SHELL_TOOLS = /* @__PURE__ */ new Set([SHELL_TOOL, POWERSHELL_TOOL]);
 var PATH_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "MultiEdit", "NotebookEdit", "Read"]);
 var PHONE_ANSWERED_TOOLS = /* @__PURE__ */ new Set(["AskUserQuestion", "ExitPlanMode"]);
 var firstString = (record, keys) => {
@@ -319,15 +334,15 @@ var canonicalToolName = (profile, toolName) => profile.toolAliases[toolName] ??
 var TASK_OUTPUT_TOOL = "BashOutput";
 var TASK_STOP_TOOL = "KillShell";
 var BLANK_TASK_INPUT_TOOL = "TaskInput";
-var SHELL_TOOL = "Bash";
 var typesText = (value) => typeof value === "string" && value.trim().length > 0;
 var taskIdOf = (control, toolInput) => typeof toolInput[control.taskKey] === "string" ? { task_id: toolInput[control.taskKey] } : {};
 var typedIntoTask = (control, toolInput) => {
   const text = toolInput[control.inputKey];
   if (typesText(text)) return { tool: SHELL_TOOL, input: { command: text }, unreadable: false };
+  if (text !== void 0 && typeof text !== "string") return { tool: control.name, input: toolInput, unreadable: true };
   return {
     tool: BLANK_TASK_INPUT_TOOL,
-    input: { ...taskIdOf(control, toolInput), input: typeof text === "string" ? text : "" },
+    input: { ...taskIdOf(control, toolInput), input: text ?? "" },
     unreadable: false
   };
 };
@@ -925,6 +940,816 @@ var shellWordsOf = (command) => {
   return words;
 };
 
+// ../contracts/src/powershell-analysis.ts
+var SINGLE_QUOTES = /* @__PURE__ */ new Set(["'", "\u2018", "\u2019", "\u201A", "\u201B"]);
+var DOUBLE_QUOTES = /* @__PURE__ */ new Set(['"', "\u201C", "\u201D", "\u201E"]);
+var ESCAPE = "`";
+var NEWLINE = "\n";
+var CARRIAGE_RETURN = "\r";
+var WORD_SPACE = /[ \t\r\f\v ]/;
+var GROUP_CLOSERS = /* @__PURE__ */ new Map([["(", ")"], ["{", "}"]]);
+var STRAY_CLOSERS = /* @__PURE__ */ new Set([")", "}"]);
+var SIGILS_THAT_OPEN_A_GROUP = /* @__PURE__ */ new Set(["$", "@"]);
+var LINE_COMMENT = "#";
+var BLOCK_COMMENT_OPEN = "<#";
+var BLOCK_COMMENT_CLOSE = "#>";
+var COMMENT_MAY_FOLLOW = /[\s;|&({]/;
+var HERE_STRING_SIGIL = "@";
+var HERE_STRING_HEADER_REST = /^[ \t\r]*\n/;
+var TRAILING_CARRIAGE_RETURN = /\r$/;
+var BRACED_VARIABLE_OPEN = "${";
+var BRACED_VARIABLE_CLOSE = "}";
+var VARIABLE_SIGIL = "$";
+var SUBEXPRESSION_OPEN = "$(";
+var SUBEXPRESSION_PLACEHOLDER = "$()";
+var VARIABLE_NAME_START = /[A-Za-z0-9_?^$:{(]/;
+var REDIRECTION_OPERATOR = /^[1-6*]?>>?(?:&[1-6])?/;
+var STREAM_NUMBER = /[1-6*]/;
+var OUTPUT_REDIRECT = ">";
+var MERGES_INTO_A_STREAM = "&";
+var PIPE2 = "|";
+var AMPERSAND = "&";
+var STATEMENT_SEPARATOR = ";";
+var ASSIGNMENT_OPERATORS = /* @__PURE__ */ new Set(["=", "+=", "-=", "*=", "/=", "%=", "??="]);
+var CALL_OPERATOR_WORD = { text: AMPERSAND, quoted: false, expands: false, nested: [] };
+var NOT_FOUND = -1;
+var TOP_LEVEL = 0;
+var MAX_GROUP_NESTING = 128;
+var opensAVariable = (source, index) => source.charAt(index) === VARIABLE_SIGIL && VARIABLE_NAME_START.test(source.charAt(index + 1));
+var endOfLine = (source, index) => {
+  const newline = source.indexOf(NEWLINE, index);
+  return newline === NOT_FOUND ? source.length : newline;
+};
+var endOfBlockComment = (source, index) => {
+  const close = source.indexOf(BLOCK_COMMENT_CLOSE, index + BLOCK_COMMENT_OPEN.length);
+  return close === NOT_FOUND ? null : close + BLOCK_COMMENT_CLOSE.length;
+};
+var commentMayStartAt = (source, index) => index === 0 || COMMENT_MAY_FOLLOW.test(source.charAt(index - 1));
+var opensAHereString = (source, index) => {
+  const quote = source.charAt(index + 1);
+  return source.charAt(index) === HERE_STRING_SIGIL && (SINGLE_QUOTES.has(quote) || DOUBLE_QUOTES.has(quote)) && HERE_STRING_HEADER_REST.test(source.slice(index + 2));
+};
+var singleQuotedTextAt = (source, open) => {
+  let text = "";
+  for (let index = open + 1; index < source.length; index += 1) {
+    const char = source.charAt(index);
+    if (!SINGLE_QUOTES.has(char)) {
+      text += char;
+    } else if (SINGLE_QUOTES.has(source.charAt(index + 1))) {
+      text += char;
+      index += 1;
+    } else {
+      return { end: index + 1, text, expands: false, nested: [] };
+    }
+  }
+  return null;
+};
+var expandableTextUntil = (source, start, closesAt, nesting) => {
+  let text = "";
+  let expands = false;
+  const nested = [];
+  for (let index = start; index < source.length; index += 1) {
+    const char = source.charAt(index);
+    if (closesAt(index)) return { end: index + 1, text, expands, nested };
+    if (char === ESCAPE || DOUBLE_QUOTES.has(char) && DOUBLE_QUOTES.has(source.charAt(index + 1))) {
+      text += source.charAt(index + 1);
+      index += 1;
+    } else if (source.startsWith(SUBEXPRESSION_OPEN, index)) {
+      const group = groupAt(source, index + SUBEXPRESSION_OPEN.length, ")", nesting + 1);
+      if (group === null) return null;
+      nested.push(group.inner);
+      text += SUBEXPRESSION_PLACEHOLDER;
+      expands = true;
+      index = group.end - 1;
+    } else {
+      expands ||= opensAVariable(source, index);
+      text += char;
+    }
+  }
+  return null;
+};
+var closesADoubleQuote = (source) => (index) => DOUBLE_QUOTES.has(source.charAt(index)) && !DOUBLE_QUOTES.has(source.charAt(index + 1));
+var doubleQuotedTextAt = (source, open, nesting) => expandableTextUntil(source, open + 1, closesADoubleQuote(source), nesting);
+var hereStringBody = (body, end, expandable, nesting) => {
+  if (!expandable) return { end, text: body, expands: false, nested: [] };
+  const scanned = expandableTextUntil(`${body}${NEWLINE}`, 0, (index) => index === body.length, nesting);
+  return scanned === null ? null : { ...scanned, end };
+};
+var hereStringAt = (source, open, nesting) => {
+  const quote = source.charAt(open + 1);
+  const quotes = SINGLE_QUOTES.has(quote) ? SINGLE_QUOTES : DOUBLE_QUOTES;
+  const header = HERE_STRING_HEADER_REST.exec(source.slice(open + 2));
+  if (header === null) return null;
+  const bodyStart = open + 2 + header[0].length;
+  for (let lineStart = bodyStart; lineStart < source.length; ) {
+    if (quotes.has(source.charAt(lineStart)) && source.charAt(lineStart + 1) === HERE_STRING_SIGIL) {
+      const body = source.slice(bodyStart, Math.max(bodyStart, lineStart - 1)).replace(TRAILING_CARRIAGE_RETURN, "");
+      return hereStringBody(body, lineStart + 2, quotes === DOUBLE_QUOTES, nesting);
+    }
+    const newline = source.indexOf(NEWLINE, lineStart);
+    if (newline === NOT_FOUND) return null;
+    lineStart = newline + 1;
+  }
+  return null;
+};
+var quotedTextAt = (source, index, nesting) => {
+  if (opensAHereString(source, index)) return hereStringAt(source, index, nesting);
+  return SINGLE_QUOTES.has(source.charAt(index)) ? singleQuotedTextAt(source, index) : doubleQuotedTextAt(source, index, nesting);
+};
+var opensQuotedText = (source, index) => SINGLE_QUOTES.has(source.charAt(index)) || DOUBLE_QUOTES.has(source.charAt(index)) || opensAHereString(source, index);
+var indexAfterGroupContent = (source, index, nesting) => {
+  const char = source.charAt(index);
+  if (char === ESCAPE) return index + 2;
+  if (opensQuotedText(source, index)) return quotedTextAt(source, index, nesting)?.end ?? null;
+  if (source.startsWith(BLOCK_COMMENT_OPEN, index)) return endOfBlockComment(source, index);
+  if (char === LINE_COMMENT && commentMayStartAt(source, index)) return endOfLine(source, index);
+  const closer = GROUP_CLOSERS.get(char);
+  if (closer !== void 0) return groupAt(source, index + 1, closer, nesting + 1)?.end ?? null;
+  return STRAY_CLOSERS.has(char) ? null : index + 1;
+};
+var groupAt = (source, start, closer, nesting) => {
+  if (nesting > MAX_GROUP_NESTING) return null;
+  for (let index = start; index < source.length; ) {
+    if (source.charAt(index) === closer) return { end: index + 1, inner: source.slice(start, index) };
+    const after = indexAfterGroupContent(source, index, nesting);
+    if (after === null) return null;
+    index = after;
+  }
+  return null;
+};
+var lineContinuationLength = (source, index) => {
+  if (source.charAt(index) === NEWLINE) return 1;
+  return source.charAt(index) === CARRIAGE_RETURN && source.charAt(index + 1) === NEWLINE ? 2 : 0;
+};
+var continuesWithAPipe = (source, from) => {
+  const rest = source.slice(from).trimStart();
+  return rest.startsWith(PIPE2) && !rest.startsWith(`${PIPE2}${PIPE2}`);
+};
+var isPowerShellAssignmentOperator = (word) => word !== void 0 && !word.quoted && ASSIGNMENT_OPERATORS.has(word.text);
+var opensARedirection = (source, index, wordStarted) => source.charAt(index) === OUTPUT_REDIRECT || !wordStarted && STREAM_NUMBER.test(source.charAt(index)) && source.charAt(index + 1) === OUTPUT_REDIRECT;
+var powerShellStatementsOf = (source) => {
+  const statements = [];
+  let stages = [];
+  let words = [];
+  let redirectTargets = [];
+  let draft = null;
+  let readsAPipe = false;
+  let stageStart = 0;
+  let targetsARedirect = false;
+  const startWord = () => {
+    draft ??= { text: "", quoted: false, expands: false, nested: [] };
+    return draft;
+  };
+  const finishWord = () => {
+    if (draft === null) return;
+    if (targetsARedirect) redirectTargets.push(draft);
+    else words.push(draft);
+    draft = null;
+    targetsARedirect = false;
+  };
+  const finishStage = (end, next) => {
+    finishWord();
+    if (words.length > 0 || redirectTargets.length > 0) {
+      stages.push({ words, redirectTargets, readsAPipe, source: source.slice(stageStart, end).trim() });
+    }
+    words = [];
+    redirectTargets = [];
+    readsAPipe = false;
+    stageStart = next;
+  };
+  const finishStatement = () => {
+    if (stages.length > 0) statements.push({ stages });
+    stages = [];
+  };
+  const awaitsAPipedStage = () => readsAPipe && words.length === 0 && draft === null;
+  const startsACommand = () => draft === null && (words.length === 0 || isPowerShellAssignmentOperator(words.at(-1)));
+  const groupAttachesToTheWord = () => draft !== null && SIGILS_THAT_OPEN_A_GROUP.has(draft.text.slice(-1));
+  let index = 0;
+  while (index < source.length) {
+    const char = source.charAt(index);
+    const next = source.charAt(index + 1);
+    if (char === ESCAPE) {
+      const continuation = lineContinuationLength(source, index + 1);
+      if (continuation === 0) {
+        const word = startWord();
+        word.text += next;
+        word.quoted = true;
+      }
+      index += 1 + Math.max(continuation, 1);
+    } else if (char === NEWLINE) {
+      if (!awaitsAPipedStage()) {
+        finishStage(index, index + 1);
+        if (!continuesWithAPipe(source, index + 1)) finishStatement();
+      }
+      index += 1;
+    } else if (WORD_SPACE.test(char)) {
+      finishWord();
+      index += 1;
+    } else if (char === STATEMENT_SEPARATOR) {
+      finishStage(index, index + 1);
+      finishStatement();
+      index += 1;
+    } else if (char === PIPE2) {
+      const chained = next === PIPE2;
+      finishStage(index, index + (chained ? 2 : 1));
+      if (chained) finishStatement();
+      else readsAPipe = true;
+      index += chained ? 2 : 1;
+    } else if (char === AMPERSAND && next !== AMPERSAND && startsACommand()) {
+      words.push(CALL_OPERATOR_WORD);
+      index += 1;
+    } else if (char === AMPERSAND) {
+      const chained = next === AMPERSAND;
+      finishStage(index, index + (chained ? 2 : 1));
+      finishStatement();
+      index += chained ? 2 : 1;
+    } else if (opensARedirection(source, index, draft !== null)) {
+      finishWord();
+      const operator = REDIRECTION_OPERATOR.exec(source.slice(index))?.[0] ?? char;
+      targetsARedirect = !operator.includes(MERGES_INTO_A_STREAM);
+      index += operator.length;
+    } else if (draft === null && char === LINE_COMMENT) {
+      index = endOfLine(source, index);
+    } else if (draft === null && source.startsWith(BLOCK_COMMENT_OPEN, index)) {
+      const end = endOfBlockComment(source, index);
+      if (end === null) return null;
+      index = end;
+    } else if (SINGLE_QUOTES.has(char) || DOUBLE_QUOTES.has(char) || draft === null && opensAHereString(source, index)) {
+      const quoted = quotedTextAt(source, index, TOP_LEVEL);
+      if (quoted === null) return null;
+      const word = startWord();
+      word.text += quoted.text;
+      word.quoted = true;
+      word.expands ||= quoted.expands;
+      word.nested.push(...quoted.nested);
+      index = quoted.end;
+    } else if (source.startsWith(BRACED_VARIABLE_OPEN, index)) {
+      const close = source.indexOf(BRACED_VARIABLE_CLOSE, index + BRACED_VARIABLE_OPEN.length);
+      if (close === NOT_FOUND) return null;
+      const word = startWord();
+      word.text += source.slice(index, close + 1);
+      word.expands = true;
+      index = close + 1;
+    } else if (GROUP_CLOSERS.has(char)) {
+      const closer = GROUP_CLOSERS.get(char) ?? "";
+      const group = groupAt(source, index + 1, closer, TOP_LEVEL);
+      if (group === null) return null;
+      if (!groupAttachesToTheWord()) finishWord();
+      const word = startWord();
+      word.text += `${char}${closer}`;
+      word.expands = true;
+      word.nested.push(group.inner);
+      index = group.end;
+    } else if (STRAY_CLOSERS.has(char)) {
+      return null;
+    } else {
+      const word = startWord();
+      word.expands ||= opensAVariable(source, index);
+      word.text += char;
+      index += 1;
+    }
+  }
+  finishStage(source.length, source.length);
+  finishStatement();
+  return statements;
+};
+
+// ../contracts/src/powershell-consequences.ts
+var POWERSHELL_ALIASES = /* @__PURE__ */ new Map([
+  ["rm", "remove-item"],
+  ["del", "remove-item"],
+  ["erase", "remove-item"],
+  ["rd", "remove-item"],
+  ["rmdir", "remove-item"],
+  ["ri", "remove-item"],
+  ["cp", "copy-item"],
+  ["copy", "copy-item"],
+  ["cpi", "copy-item"],
+  ["mv", "move-item"],
+  ["move", "move-item"],
+  ["mi", "move-item"],
+  ["ren", "rename-item"],
+  ["rni", "rename-item"],
+  ["sc", "set-content"],
+  ["ac", "add-content"],
+  ["clc", "clear-content"],
+  ["ni", "new-item"],
+  ["tee", "tee-object"],
+  ["iwr", "invoke-webrequest"],
+  ["curl", "invoke-webrequest"],
+  ["wget", "invoke-webrequest"],
+  ["irm", "invoke-restmethod"],
+  ["iex", "invoke-expression"],
+  ["icm", "invoke-command"],
+  ["saps", "start-process"],
+  ["start", "start-process"],
+  ["spsv", "stop-service"],
+  ["sasv", "start-service"],
+  ["%", "foreach-object"],
+  ["foreach", "foreach-object"],
+  ["?", "where-object"],
+  ["where", "where-object"],
+  ["ls", "get-childitem"],
+  ["dir", "get-childitem"],
+  ["gci", "get-childitem"],
+  ["cat", "get-content"],
+  ["type", "get-content"],
+  ["gc", "get-content"],
+  ["echo", "write-output"],
+  ["write", "write-output"],
+  ["select", "select-object"],
+  ["sort", "sort-object"],
+  ["group", "group-object"],
+  ["measure", "measure-object"],
+  ["diff", "compare-object"],
+  ["compare", "compare-object"],
+  ["ft", "format-table"],
+  ["fl", "format-list"],
+  ["fw", "format-wide"],
+  ["gi", "get-item"],
+  ["gp", "get-itemproperty"],
+  ["gl", "get-location"],
+  ["pwd", "get-location"],
+  ["cd", "set-location"],
+  ["chdir", "set-location"],
+  ["sl", "set-location"],
+  ["pushd", "push-location"],
+  ["popd", "pop-location"],
+  ["gcm", "get-command"],
+  ["gps", "get-process"],
+  ["ps", "get-process"],
+  ["gsv", "get-service"],
+  ["sls", "select-string"],
+  ["gm", "get-member"],
+  ["gal", "get-alias"],
+  ["gv", "get-variable"],
+  ["h", "get-history"],
+  ["history", "get-history"],
+  ["cls", "clear-host"],
+  ["clear", "clear-host"],
+  ["sleep", "start-sleep"],
+  ["kill", "stop-process"],
+  ["spps", "stop-process"]
+]);
+var POWERSHELL_READ_VERBS = /* @__PURE__ */ new Set([
+  "get",
+  "test",
+  "select",
+  "measure",
+  "compare",
+  "resolve",
+  "convertto",
+  "convertfrom",
+  "find",
+  "search",
+  "wait",
+  "read",
+  "format"
+]);
+var POWERSHELL_READ_CMDLETS = /* @__PURE__ */ new Set([
+  "sort-object",
+  "group-object",
+  "where-object",
+  "write-output",
+  "write-host",
+  "write-verbose",
+  "write-debug",
+  "write-information",
+  "write-warning",
+  "write-error",
+  "write-progress",
+  "out-string",
+  "out-host",
+  "out-null",
+  "out-default",
+  "split-path",
+  "join-path",
+  "set-location",
+  "push-location",
+  "pop-location",
+  "clear-host",
+  "start-sleep"
+]);
+var POWERSHELL_WRITERS_WITH_A_READ_VERB = /* @__PURE__ */ new Set(["format-volume"]);
+var POWERSHELL_VERB_SEPARATOR = "-";
+var POWERSHELL_LANGUAGE_KEYWORDS = /* @__PURE__ */ new Set([
+  "if",
+  "elseif",
+  "else",
+  "foreach",
+  "for",
+  "while",
+  "do",
+  "until",
+  "switch",
+  "try",
+  "catch",
+  "finally",
+  "trap",
+  "function",
+  "filter",
+  "workflow",
+  "param",
+  "begin",
+  "process",
+  "end",
+  "dynamicparam",
+  "break",
+  "continue",
+  "exit",
+  "throw",
+  "data",
+  "class",
+  "enum",
+  "using",
+  "configuration",
+  "in"
+]);
+var POWERSHELL_CALL_OPERATORS = /* @__PURE__ */ new Set(["&", "."]);
+var POWERSHELL_RETURN_KEYWORD = "return";
+var POWERSHELL_ASSIGNMENT_TARGET = /^[$[]/;
+var POWERSHELL_ARRAY_SEPARATOR = ",";
+var POWERSHELL_ATTACHED_ASSIGNMENT = /^\$[^=\s]*?(?:[+\-*/%]|\?\?)?=(?!=)([\s\S]+)$/;
+var POWERSHELL_EXPRESSION_START = /^[$({@[\-–—―]/;
+var POWERSHELL_NUMBER_OR_RANGE = /^\d[\d.]*$/;
+var POWERSHELL_PARAMETER = /^[-–—―]([A-Za-z][\w-]*)(?::([\s\S]*))?$/;
+var POWERSHELL_SWITCH_OFF = "$false";
+var EXECUTABLE_EXTENSION = /\.(?:exe|cmd|bat|com)$/;
+var REMOVE_ITEM = "remove-item";
+var COPY_ITEM = "copy-item";
+var GET_CHILD_ITEM = "get-childitem";
+var FOREACH_OBJECT = "foreach-object";
+var INVOKE_EXPRESSION = "invoke-expression";
+var DELETE_METHOD = "delete";
+var RECURSE_PARAMETER = "recurse";
+var DEPTH_PARAMETER = "depth";
+var WHAT_IF_PARAMETER = "whatif";
+var DESTINATION_PARAMETER = "destination";
+var MEMBER_NAME_PARAMETER = "membername";
+var FILE_PARAMETER = "file";
+var FILE_PATH_PARAMETER = "filepath";
+var SHORTEST_PARAMETER_PREFIX = 1;
+var SHORTEST_DEPTH_PREFIX = 3;
+var SHORTEST_DESTINATION_PREFIX = 3;
+var SHORTEST_FILE_PATH_PREFIX = 2;
+var POWERSHELL_FILE_WRITERS = /* @__PURE__ */ new Set([
+  "set-content",
+  "add-content",
+  "clear-content",
+  "out-file",
+  "new-item",
+  REMOVE_ITEM,
+  "move-item",
+  "rename-item",
+  "tee-object",
+  "invoke-webrequest",
+  "invoke-restmethod",
+  "start-bitstransfer"
+]);
+var POWERSHELL_FETCHERS = /* @__PURE__ */ new Set(["invoke-webrequest", "invoke-restmethod", "start-bitstransfer"]);
+var DISK_ERASERS = /* @__PURE__ */ new Set(["format-volume", "clear-disk", "initialize-disk", "remove-partition", "format"]);
+var WINDOWS_SERVICE_CHANGERS = /* @__PURE__ */ new Set([
+  "start-service",
+  "stop-service",
+  "restart-service",
+  "suspend-service",
+  "resume-service",
+  "set-service",
+  "new-service",
+  "remove-service"
+]);
+var SERVICE_CONTROL_PROGRAM = "sc";
+var SERVICE_CONTROL_VERBS_THAT_CHANGE = /* @__PURE__ */ new Set([
+  "start",
+  "stop",
+  "pause",
+  "continue",
+  "config",
+  "create",
+  "delete",
+  "failure",
+  "failureflag",
+  "sidtype",
+  "privs",
+  "managedaccount",
+  "description",
+  "sdset",
+  "control",
+  "triggerinfo",
+  "preferrednode"
+]);
+var REMOTE_MACHINE_PREFIX = "\\\\";
+var NET_PROGRAMS = /* @__PURE__ */ new Set(["net", "net1"]);
+var NET_VERBS_THAT_CHANGE_A_SERVICE = /* @__PURE__ */ new Set(["stop", "pause", "continue"]);
+var NET_START = "start";
+var SCHEDULED_TASK_CHANGERS = /* @__PURE__ */ new Set([
+  "register-scheduledtask",
+  "unregister-scheduledtask",
+  "set-scheduledtask",
+  "enable-scheduledtask",
+  "disable-scheduledtask",
+  "start-scheduledtask",
+  "stop-scheduledtask"
+]);
+var SCHTASKS_PROGRAM = "schtasks";
+var SCHTASKS_SWITCHES_THAT_CHANGE = /^[/-](?:create|delete|change|run|end)$/i;
+var DOTNET_RECURSIVE_DELETE = /::Delete\s*\([^()]*,\s*(?:\$true|1)\s*\)|\.Delete\s*\(\s*\$true\s*\)/i;
+var DOTNET_DOWNLOAD = /\.Download(?:String|Data|File)(?:Async|TaskAsync)?\s*\(/i;
+var SCRIPTBLOCK_FROM_TEXT = /\[(?:System\.Management\.Automation\.)?ScriptBlock\]::Create\s*\(/i;
+var POWERSHELL_HOSTS = /* @__PURE__ */ new Set(["powershell", "pwsh", "powershell_ise"]);
+var WINDOWS_POWERSHELL_HOST = "powershell";
+var POWERSHELL_HOST_COMMAND_SWITCHES = /* @__PURE__ */ new Set(["-c", "-command", "--command", "/c", "/command"]);
+var POWERSHELL_HOST_SWITCHES_THAT_HIDE_THE_COMMAND = /* @__PURE__ */ new Set([
+  "-f",
+  "-file",
+  "/f",
+  "/file",
+  "-e",
+  "-ec",
+  "-enc",
+  "-encodedcommand",
+  "/encodedcommand"
+]);
+var POWERSHELL_HOST_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set([
+  "-executionpolicy",
+  "-ep",
+  "-ex",
+  "-windowstyle",
+  "-w",
+  "-workingdirectory",
+  "-wd",
+  "-configurationname",
+  "-config",
+  "-inputformat",
+  "-inf",
+  "-if",
+  "-outputformat",
+  "-of",
+  "-o",
+  "-version",
+  "-v",
+  "-settingsfile",
+  "-custompipename",
+  "-psconsolefile"
+]);
+var POWERSHELL_HOST_SWITCH = /^[-/]/;
+var POWERSHELL_FILE_RUNNERS = /* @__PURE__ */ new Set(["start-process", "invoke-item", "msiexec"]);
+var WINDOWS_SWITCH = /^[-/–—―]/;
+var CMD_PROGRAM = "cmd";
+var CMD_RUNS_THE_REST = /^\/[ck]$/i;
+var CMD_SEPARATORS = ["&&", "||", "&", "|"];
+var CMD_ESCAPE = "^";
+var CMD_QUOTE = '"';
+var CMD_WORD_SEPARATOR = /\s+/;
+var CMD_RECURSIVE_REMOVERS = /* @__PURE__ */ new Set(["rd", "rmdir", "del", "erase"]);
+var CMD_SWITCH_PREFIX = "/";
+var CMD_RECURSE_SWITCH = "s";
+var WSL_PROGRAM = "wsl";
+var WSL_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set(["-d", "--distribution", "-u", "--user", "--cd", "--shell-type"]);
+var WSL_COMMAND_MARKERS = /* @__PURE__ */ new Set(["-e", "--exec", "--"]);
+var NO_SCRIPTS_INSIDE = { powerShell: [], cmd: [], posix: [] };
+var MAX_NESTED_SCRIPT_DEPTH = 4;
+var TOP_LEVEL_SCRIPT = 0;
+var POSIX_FLAG = /^-/;
+var PATH_SEPARATORS = /[/\\]/;
+var URL_QUERY_OR_FRAGMENT = /[?#].*$/;
+var fileNameOf = (path) => path.split(PATH_SEPARATORS).at(-1) ?? path;
+var parameterOf = (word) => {
+  if (word === void 0 || word.quoted) return null;
+  const match = POWERSHELL_PARAMETER.exec(word.text);
+  return match === null ? null : { name: (match[1] ?? "").toLowerCase(), value: match[2] };
+};
+var namesTheParameter = (parameter, fullName, shortestPrefix) => parameter !== null && parameter.name.length >= shortestPrefix && fullName.startsWith(parameter.name);
+var turnsOn = (command, fullName, shortestPrefix) => command.args.some((arg) => {
+  const parameter = parameterOf(arg);
+  return namesTheParameter(parameter, fullName, shortestPrefix) && parameter?.value?.toLowerCase() !== POWERSHELL_SWITCH_OFF;
+});
+var parameterValueOf = (command, fullName, shortestPrefix) => {
+  const index = command.args.findIndex((arg) => namesTheParameter(parameterOf(arg), fullName, shortestPrefix));
+  return index === -1 ? void 0 : parameterOf(command.args[index])?.value ?? command.args[index + 1]?.text;
+};
+var operandTextsOf = (command) => command.args.flatMap((arg) => {
+  const parameter = parameterOf(arg);
+  const text = parameter === null ? arg.text : parameter.value;
+  return text === void 0 ? [] : text.split(POWERSHELL_ARRAY_SEPARATOR);
+});
+var positionalTextsOf = (command) => command.args.filter((arg) => parameterOf(arg) === null).map((arg) => arg.text);
+var firstOperandOf = (command, isSwitch) => command.args.find((arg) => !isSwitch.test(arg.text))?.text;
+var namesASecretPath = (text, judge) => judge.namesASecretFile(fileNameOf(text.trim()));
+var isAssignmentTarget = (word) => POWERSHELL_ASSIGNMENT_TARGET.test(word.text) || word.text === POWERSHELL_ARRAY_SEPARATOR;
+var wordsAfterAnAssignment = (words) => {
+  const operator = words.findIndex((word) => isPowerShellAssignmentOperator(word));
+  if (operator > 0 && words.slice(0, operator).every(isAssignmentTarget)) return words.slice(operator + 1);
+  const [first, ...rest] = words;
+  const assigned = first === void 0 ? void 0 : POWERSHELL_ATTACHED_ASSIGNMENT.exec(first.text)?.[1];
+  return first === void 0 || assigned === void 0 ? words : [{ ...first, text: assigned }, ...rest];
+};
+var commandWordsOf = (words) => {
+  const assigned = wordsAfterAnAssignment(words);
+  const returned = assigned[0] !== void 0 && !assigned[0].quoted && assigned[0].text.toLowerCase() === POWERSHELL_RETURN_KEYWORD ? assigned.slice(1) : assigned;
+  const first = returned[0];
+  const viaCallOperator = first !== void 0 && !first.quoted && POWERSHELL_CALL_OPERATORS.has(first.text);
+  return { words: viaCallOperator ? returned.slice(1) : returned, viaCallOperator };
+};
+var namesAPowerShellCommand = (program, viaCallOperator, readsAPipe) => {
+  if (program.text.length === 0 || POWERSHELL_EXPRESSION_START.test(program.text) || POWERSHELL_NUMBER_OR_RANGE.test(program.text)) {
+    return false;
+  }
+  if (viaCallOperator) return true;
+  return !program.quoted && (readsAPipe || !POWERSHELL_LANGUAGE_KEYWORDS.has(program.text.toLowerCase()));
+};
+var powerShellCommandOf = (stage) => {
+  const { words, viaCallOperator } = commandWordsOf(stage.words);
+  const [program, ...args] = words;
+  if (program === void 0 || !namesAPowerShellCommand(program, viaCallOperator, stage.readsAPipe)) return null;
+  const fileName = fileNameOf(program.text).toLowerCase();
+  const name = fileName.replace(EXECUTABLE_EXTENSION, "");
+  return { stage, program, args, fileName, name, cmdlet: POWERSHELL_ALIASES.get(fileName) ?? name };
+};
+var posixWordOf = (word) => ({ text: word.text, plain: !word.quoted, expands: word.expands, comment: false });
+var posixProgramWordOf = (command) => ({ ...posixWordOf(command.program), text: command.name });
+var posixInvocationOf = (command) => ({ program: posixProgramWordOf(command), args: command.args.map(posixWordOf) });
+var verbOfCmdlet = (cmdlet) => {
+  const separator = cmdlet.indexOf(POWERSHELL_VERB_SEPARATOR);
+  return separator === -1 ? "" : cmdlet.slice(0, separator);
+};
+var cmdletOnlyReads = (cmdlet) => POWERSHELL_READ_CMDLETS.has(cmdlet) || POWERSHELL_READ_VERBS.has(verbOfCmdlet(cmdlet)) && !POWERSHELL_WRITERS_WITH_A_READ_VERB.has(cmdlet);
+var readsLikeAPosixRead = (command, judge) => !command.program.expands && !command.args.some((arg) => arg.expands) && command.stage.redirectTargets.length === 0 && judge.onlyReads([command.name, ...command.args.map((arg) => arg.text)]);
+var onlyReads = (command, judge) => cmdletOnlyReads(command.cmdlet) || readsLikeAPosixRead(command, judge);
+var onlyPreviewsInPowerShell = (command) => turnsOn(command, WHAT_IF_PARAMETER, WHAT_IF_PARAMETER.length);
+var removesRecursively = (command) => command.cmdlet === REMOVE_ITEM && turnsOn(command, RECURSE_PARAMETER, SHORTEST_PARAMETER_PREFIX) && !onlyPreviewsInPowerShell(command);
+var listsRecursively = (command) => command.cmdlet === GET_CHILD_ITEM && (turnsOn(command, RECURSE_PARAMETER, SHORTEST_PARAMETER_PREFIX) || parameterValueOf(command, DEPTH_PARAMETER, SHORTEST_DEPTH_PREFIX) !== void 0);
+var calledMemberOf = (command) => (parameterValueOf(command, MEMBER_NAME_PARAMETER, SHORTEST_PARAMETER_PREFIX) ?? firstOperandOf(command, WINDOWS_SWITCH))?.toLowerCase();
+var removesWhatItIsGiven = (command) => !onlyPreviewsInPowerShell(command) && (command.cmdlet === REMOVE_ITEM || command.cmdlet === FOREACH_OBJECT && calledMemberOf(command) === DELETE_METHOD);
+var commandsOfStatement = (statement) => statement.stages.map(powerShellCommandOf);
+var listsRecursivelyIntoARemoval = (statement) => {
+  const commands = commandsOfStatement(statement);
+  const listing = commands.findIndex((command) => command !== null && listsRecursively(command));
+  return listing !== -1 && commands.slice(listing + 1).some((command) => command !== null && removesWhatItIsGiven(command));
+};
+var copyDestinationOf = (command) => {
+  const named = parameterValueOf(command, DESTINATION_PARAMETER, SHORTEST_DESTINATION_PREFIX);
+  const positional = positionalTextsOf(command);
+  return named ?? (positional.length > 1 ? positional.at(-1) : void 0);
+};
+var writesASecretFileFromPowerShell = (command, judge) => {
+  if (command.cmdlet !== COPY_ITEM) {
+    return POWERSHELL_FILE_WRITERS.has(command.cmdlet) && operandTextsOf(command).some((text) => namesASecretPath(text, judge));
+  }
+  const destination = copyDestinationOf(command);
+  return destination !== void 0 && namesASecretPath(destination, judge);
+};
+var formatsADisk = (command) => DISK_ERASERS.has(command.cmdlet);
+var changesAWindowsService = (command) => {
+  if (WINDOWS_SERVICE_CHANGERS.has(command.cmdlet)) return true;
+  const [verb, ...operands] = command.args.map((arg) => arg.text.toLowerCase()).filter((text) => !text.startsWith(REMOTE_MACHINE_PREFIX));
+  if (command.name === SERVICE_CONTROL_PROGRAM) return SERVICE_CONTROL_VERBS_THAT_CHANGE.has(verb ?? "");
+  return NET_PROGRAMS.has(command.name) && (NET_VERBS_THAT_CHANGE_A_SERVICE.has(verb ?? "") || verb === NET_START && operands.length > 0);
+};
+var changesAScheduledTask = (command) => SCHEDULED_TASK_CHANGERS.has(command.cmdlet) || command.name === SCHTASKS_PROGRAM && command.args.some((arg) => SCHTASKS_SWITCHES_THAT_CHANGE.test(arg.text));
+var powerShellCommandChangesSomething = (command, judge) => judge.invocationShowsAConsequence(posixInvocationOf(command)) || !onlyPreviewsInPowerShell(command) && (writesASecretFileFromPowerShell(command, judge) || formatsADisk(command) || changesAWindowsService(command) || changesAScheduledTask(command));
+var keywordTextOf = (command) => [command.name, ...[...command.args, ...command.stage.redirectTargets].map((word) => word.text)].join(" ");
+var stageIsDestructive = (stage, judge) => {
+  const command = powerShellCommandOf(stage);
+  return DOTNET_RECURSIVE_DELETE.test(stage.source) || command !== null && (removesRecursively(command) || !onlyReads(command, judge) && judge.namesADestructiveAction(keywordTextOf(command)));
+};
+var stageHasAVisibleConsequence = (stage, judge) => {
+  const command = powerShellCommandOf(stage);
+  return stage.redirectTargets.some((target) => namesASecretPath(target.text, judge)) || command !== null && !onlyReads(command, judge) && powerShellCommandChangesSomething(command, judge);
+};
+var fetchesWithPowerShell = (stage, judge) => {
+  const command = powerShellCommandOf(stage);
+  return DOTNET_DOWNLOAD.test(stage.source) || command !== null && (POWERSHELL_FETCHERS.has(command.cmdlet) || judge.fetches(posixInvocationOf(command)));
+};
+var runsTextAsCode = (stage, judge) => {
+  const command = powerShellCommandOf(stage);
+  return SCRIPTBLOCK_FROM_TEXT.test(stage.source) || command !== null && (command.cmdlet === INVOKE_EXPRESSION || stage.readsAPipe && judge.runsWhatItReads(posixInvocationOf(command)));
+};
+var runsFetchedPowerShellCode = (stages, judge) => stages.some((stage) => fetchesWithPowerShell(stage, judge)) && stages.some((stage) => runsTextAsCode(stage, judge));
+var downloadedFileNameOf = (text) => fileNameOf(text.replace(URL_QUERY_OR_FRAGMENT, "")).toLowerCase();
+var downloadedFileNamesOf = (stages, judge) => new Set(stages.filter((stage) => fetchesWithPowerShell(stage, judge)).flatMap((stage) => {
+  const command = powerShellCommandOf(stage);
+  return command === null ? [] : operandTextsOf(command).map(downloadedFileNameOf);
+}).filter((fileName) => fileName.length > 0));
+var fileRunBy = (command, judge) => {
+  if (POWERSHELL_HOSTS.has(command.name)) return parameterValueOf(command, FILE_PARAMETER, SHORTEST_PARAMETER_PREFIX);
+  if (POWERSHELL_FILE_RUNNERS.has(command.cmdlet)) {
+    return parameterValueOf(command, FILE_PATH_PARAMETER, SHORTEST_FILE_PATH_PREFIX) ?? firstOperandOf(command, WINDOWS_SWITCH);
+  }
+  return judge.runsScripts(posixProgramWordOf(command)) ? firstOperandOf(command, POSIX_FLAG) : void 0;
+};
+var runsADownloadedFile = (stages, judge) => {
+  const downloaded = downloadedFileNamesOf(stages, judge);
+  return downloaded.size > 0 && stages.some((stage) => {
+    const command = powerShellCommandOf(stage);
+    if (command === null || fetchesWithPowerShell(stage, judge)) return false;
+    const file = fileRunBy(command, judge);
+    return downloaded.has(command.fileName) || file !== void 0 && downloaded.has(downloadedFileNameOf(file));
+  });
+};
+var invokedExpressionsOf = (command) => command.cmdlet === INVOKE_EXPRESSION ? positionalTextsOf(command) : [];
+var positionalHostCommandOf = (texts) => {
+  let index = 0;
+  while (index < texts.length && POWERSHELL_HOST_SWITCH.test(texts[index] ?? "")) {
+    index += POWERSHELL_HOST_OPTIONS_WITH_A_VALUE.has((texts[index] ?? "").toLowerCase()) ? 2 : 1;
+  }
+  return index < texts.length ? texts.slice(index).join(" ") : void 0;
+};
+var hostedPowerShellScriptOf = (command) => {
+  if (!POWERSHELL_HOSTS.has(command.name)) return void 0;
+  const texts = command.args.map((arg) => arg.text);
+  const lowered = texts.map((text) => text.toLowerCase());
+  const commandSwitch = lowered.findIndex((text) => POWERSHELL_HOST_COMMAND_SWITCHES.has(text));
+  if (commandSwitch !== -1) return texts.slice(commandSwitch + 1).join(" ");
+  if (command.name !== WINDOWS_POWERSHELL_HOST || lowered.some((text) => POWERSHELL_HOST_SWITCHES_THAT_HIDE_THE_COMMAND.has(text))) {
+    return void 0;
+  }
+  return positionalHostCommandOf(texts);
+};
+var cmdScriptOf = (command) => {
+  if (command.name !== CMD_PROGRAM) return void 0;
+  const start = command.args.findIndex((arg) => CMD_RUNS_THE_REST.test(arg.text));
+  return start === -1 ? void 0 : command.args.slice(start + 1).map((arg) => arg.text).join(" ");
+};
+var cmdPiecesOf = (script) => {
+  const pieces = [];
+  let current = "";
+  let quoted = false;
+  for (let index = 0; index < script.length; index += 1) {
+    const char = script.charAt(index);
+    const separator = quoted ? void 0 : CMD_SEPARATORS.find((candidate) => script.startsWith(candidate, index));
+    if (char === CMD_ESCAPE && !quoted) {
+      current += script.slice(index, index + 2);
+      index += 1;
+    } else if (separator !== void 0) {
+      pieces.push(current);
+      current = "";
+      index += separator.length - 1;
+    } else {
+      quoted = char === CMD_QUOTE ? !quoted : quoted;
+      current += char;
+    }
+  }
+  return [...pieces, current].map((piece) => piece.trim()).filter((piece) => piece.length > 0);
+};
+var namesTheCmdRecurseSwitch = (word) => word.startsWith(CMD_SWITCH_PREFIX) && word.toLowerCase().split(CMD_SWITCH_PREFIX).includes(CMD_RECURSE_SWITCH);
+var cmdPieceRemovesRecursively = (piece) => {
+  const [program = "", ...args] = piece.replaceAll(CMD_QUOTE, "").split(CMD_WORD_SEPARATOR);
+  return CMD_RECURSIVE_REMOVERS.has(program.toLowerCase()) && args.some(namesTheCmdRecurseSwitch);
+};
+var cmdScriptRemovesRecursively = (script) => cmdPiecesOf(script).some(cmdPieceRemovesRecursively);
+var wslCommandWordsOf = (command) => {
+  if (command.name !== WSL_PROGRAM) return void 0;
+  const texts = command.args.map((arg) => arg.text);
+  let index = 0;
+  while (index < texts.length && POSIX_FLAG.test(texts[index] ?? "")) {
+    const text = texts[index] ?? "";
+    index += WSL_OPTIONS_WITH_A_VALUE.has(text) ? 2 : 1;
+    if (WSL_COMMAND_MARKERS.has(text)) break;
+  }
+  return index < texts.length ? texts.slice(index) : void 0;
+};
+var presentOnly = (value) => value === void 0 ? [] : [value];
+var scriptsInsideTheStage = (stage) => {
+  const groups = [...stage.words, ...stage.redirectTargets].flatMap((word) => word.nested);
+  const command = powerShellCommandOf(stage);
+  if (command === null) return { ...NO_SCRIPTS_INSIDE, powerShell: groups };
+  const cmd = presentOnly(cmdScriptOf(command));
+  return {
+    powerShell: [...groups, ...invokedExpressionsOf(command), ...presentOnly(hostedPowerShellScriptOf(command)), ...cmd.flatMap(cmdPiecesOf)],
+    cmd,
+    posix: presentOnly(wslCommandWordsOf(command))
+  };
+};
+var powerShellReadingAt = (command, depth) => {
+  const statements = powerShellStatementsOf(command);
+  if (statements === null) return null;
+  const inside = depth >= MAX_NESTED_SCRIPT_DEPTH ? [] : statements.flatMap((statement) => statement.stages).map(scriptsInsideTheStage);
+  const nested = inside.flatMap((scripts) => scripts.powerShell).map((script) => ({ script, reading: powerShellReadingAt(script, depth + 1) }));
+  const readings = nested.flatMap(({ reading }) => reading === null ? [] : [reading]);
+  return {
+    statements: [...statements, ...readings.flatMap((reading) => reading.statements)],
+    cmdScripts: [...inside.flatMap((scripts) => scripts.cmd), ...readings.flatMap((reading) => reading.cmdScripts)],
+    posixCommands: [...inside.flatMap((scripts) => scripts.posix), ...readings.flatMap((reading) => reading.posixCommands)],
+    unreadScripts: [
+      ...nested.flatMap(({ script, reading }) => reading === null ? [script] : []),
+      ...readings.flatMap((reading) => reading.unreadScripts)
+    ]
+  };
+};
+var stagesOfTheReading = (reading) => reading.statements.flatMap((statement) => statement.stages);
+var powerShellReadingIsDestructive = (reading, judge) => stagesOfTheReading(reading).some((stage) => stageIsDestructive(stage, judge)) || reading.cmdScripts.some(cmdScriptRemovesRecursively) || reading.unreadScripts.some((script) => judge.namesADestructiveAction(script));
+var powerShellCommandIsDestructive = (command, judge) => {
+  const reading = powerShellReadingAt(command, TOP_LEVEL_SCRIPT);
+  return reading === null ? judge.namesADestructiveAction(command) : powerShellReadingIsDestructive(reading, judge);
+};
+var powerShellCommandHasAVisibleConsequence = (command, judge) => {
+  const reading = powerShellReadingAt(command, TOP_LEVEL_SCRIPT);
+  if (reading === null) return judge.namesADestructiveAction(command);
+  const stages = stagesOfTheReading(reading);
+  return powerShellReadingIsDestructive(reading, judge) || stages.some((stage) => stageHasAVisibleConsequence(stage, judge)) || reading.statements.some(listsRecursivelyIntoARemoval) || runsFetchedPowerShellCode(stages, judge) || runsADownloadedFile(stages, judge) || reading.posixCommands.some((words) => judge.commandShowsAConsequence(words));
+};
+
 // ../contracts/src/degraded.ts
 var DEGRADED_PREFIX = "[degraded]";
 var degradedPayload = (subsystem, report) => ({
@@ -1367,11 +2192,9 @@ var POLICY_PATH_KEYS = {
   NotebookEdit: "notebook_path",
   LS: "path"
 };
-var POLICY_COMMAND_KEYS = {
-  Bash: "command",
-  PowerShell: "command",
-  Monitor: "command"
-};
+var POLICY_COMMAND_KEYS = Object.fromEntries(
+  [...SHELL_DIALECT_BY_TOOL.keys()].map((toolName) => [toolName, "command"])
+);
 var POLICY_ARG_KEYS = { ...POLICY_COMMAND_KEYS, ...POLICY_PATH_KEYS };
 var extractPolicyArg = (toolName, toolInput) => {
   const key = POLICY_ARG_KEYS[toolName];
@@ -2234,40 +3057,47 @@ var writesASecretFile = ({ program, args }) => {
   if (WRITES_EVERY_OPERAND.has(name)) return operands.some(namesASecretFile);
   return EDITS_IN_PLACE.has(name) && args.some((arg) => IN_PLACE_FLAG.test(arg.text)) && operands.some(namesASecretFile);
 };
-var GITHUB_RESOURCE_NOUNS = /* @__PURE__ */ new Set([
-  "pr",
-  "issue",
-  "release",
-  "repo",
-  "gist",
-  "label",
-  "secret",
-  "variable",
-  "workflow",
-  "run",
-  "cache",
-  "project",
-  "ruleset",
-  "codespace",
-  "org",
-  "discussion"
-]);
-var GITHUB_READ_VERBS = /* @__PURE__ */ new Set([
-  "view",
-  "list",
-  "ls",
-  "status",
-  "diff",
-  "checks",
-  "check",
-  "watch",
+var GITHUB_COMMANDS_THAT_ONLY_READ = /* @__PURE__ */ new Set([
+  "search",
   "browse",
-  "download",
-  "clone",
-  "checkout",
-  "get",
-  "field-list",
-  "item-list"
+  "status",
+  "help",
+  "version",
+  "completion"
+]);
+var githubReadVerbs = (...verbs) => /* @__PURE__ */ new Set(["list", "ls", ...verbs]);
+var GITHUB_RULESET_READS = githubReadVerbs("view", "check");
+var GITHUB_CODESPACE_READS = githubReadVerbs("view");
+var GITHUB_EXTENSION_READS = githubReadVerbs("search");
+var GITHUB_ATTESTATION_READS = /* @__PURE__ */ new Set(["verify", "download", "trusted-root"]);
+var GITHUB_READ_COMMANDS = /* @__PURE__ */ new Map([
+  ["pr", githubReadVerbs("view", "status", "diff", "checks", "checkout", "co")],
+  ["issue", githubReadVerbs("view", "status")],
+  ["release", githubReadVerbs("view", "download")],
+  ["repo", githubReadVerbs("view", "clone")],
+  ["gist", githubReadVerbs("view", "clone")],
+  ["label", githubReadVerbs()],
+  ["secret", githubReadVerbs()],
+  ["variable", githubReadVerbs("get")],
+  ["workflow", githubReadVerbs("view")],
+  ["run", githubReadVerbs("view", "watch", "download")],
+  ["cache", githubReadVerbs()],
+  ["project", githubReadVerbs("view", "field-list", "item-list")],
+  ["ruleset", GITHUB_RULESET_READS],
+  ["rs", GITHUB_RULESET_READS],
+  ["codespace", GITHUB_CODESPACE_READS],
+  ["cs", GITHUB_CODESPACE_READS],
+  ["org", githubReadVerbs()],
+  ["auth", /* @__PURE__ */ new Set(["status"])],
+  ["extension", GITHUB_EXTENSION_READS],
+  ["extensions", GITHUB_EXTENSION_READS],
+  ["ext", GITHUB_EXTENSION_READS],
+  ["alias", githubReadVerbs()],
+  ["config", githubReadVerbs("get")],
+  ["ssh-key", githubReadVerbs()],
+  ["gpg-key", githubReadVerbs()],
+  ["attestation", GITHUB_ATTESTATION_READS],
+  ["at", GITHUB_ATTESTATION_READS]
 ]);
 var GITHUB_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set(["-R", "--repo", "--hostname"]);
 var GITHUB_API_SUBCOMMAND = "api";
@@ -2348,11 +3178,16 @@ var githubApiRequestWrites = (args) => {
   if (args.some((arg) => arg.text === GITHUB_GRAPHQL_ENDPOINT)) return graphqlRequestCanWrite(args);
   return args.some((arg) => GITHUB_API_BODY_FLAG.test(arg.text));
 };
+var githubCommandOnlyReads = (noun, verb) => {
+  if (noun === void 0 || GITHUB_COMMANDS_THAT_ONLY_READ.has(noun.text)) return true;
+  const readVerbs = GITHUB_READ_COMMANDS.get(noun.text);
+  return readVerbs !== void 0 && (verb === void 0 || readVerbs.has(verb.text));
+};
 var githubCliWrites = (args) => {
   const meaningful = argsAfterHarmlessGlobalFlags(args);
   const [noun, verb] = positionalWordsOf(meaningful, GITHUB_OPTIONS_WITH_VALUES);
   if (noun?.text === GITHUB_API_SUBCOMMAND) return githubApiRequestWrites(meaningful.slice(meaningful.indexOf(noun) + 1));
-  return noun !== void 0 && GITHUB_RESOURCE_NOUNS.has(noun.text) && verb !== void 0 && !GITHUB_READ_VERBS.has(verb.text);
+  return !githubCommandOnlyReads(noun, verb);
 };
 var stripeCliWrites = (args) => {
   const [command, operation] = positionalWordsOf(args, STRIPE_OPTIONS_WITH_VALUES);
@@ -2381,19 +3216,22 @@ var invocationWritesThroughARemoteApi = ({ program, args }) => {
   const writes = program === void 0 ? void 0 : REMOTE_API_CLI_WRITES.get(basenameOf(program.text));
   return writes !== void 0 && writes(args);
 };
-var commandWritesThroughARemoteApi = (command) => {
-  const segments = readableCommandSegments(command);
-  return segments !== null && segments.some((segment) => invocationWritesThroughARemoteApi(invocationOf(segment)));
+var segmentWritesThroughARemoteApi = (segment, depth) => {
+  const innermost = innermostInvocation(segment.invocation);
+  return invocationWritesThroughARemoteApi(innermost) || commandsNestedIn(innermost, inlineScriptsOf(innermost, segment.heredocs)).some((nested) => commandWritesThroughARemoteApiAt(nested, depth + 1));
 };
+var commandWritesThroughARemoteApiAt = (command, depth) => depth <= MAX_SPELLING_DEPTH && spelledSegmentsOf(command).some((segment) => segmentWritesThroughARemoteApi(segment, depth));
+var commandWritesThroughARemoteApi = (command) => commandWritesThroughARemoteApiAt(command, 0);
 var segmentNeedsAPerson = (toolName, segment) => {
   const invocation = invocationOf(segment);
   const normalized = normalizedInvocation(invocation);
   return invocationHidesItsEffect(invocation) || subcommandDestroys(invocation) || changesWhatIsDeployed(toolName, invocation, normalized) || sqlClientChangesData(invocation) || classifyDecisionRisk(toolName, normalized) !== "standard" || isCoveredByPolicy(CAPABILITY_PATTERNS.destructive, toolName, normalized) || isCoveredByPolicy(CAPABILITY_PATTERNS.network, toolName, normalized) || isCoveredByPolicy(DATA_LOSS_COMMAND_PATTERNS, toolName, normalized);
 };
 var commandNeedsAPerson = (toolName, command) => {
-  if (toolName === "Bash" && isSafeReadOnlyCommand(command)) return false;
+  const readingTool = toolNameForAPosixReading(toolName);
+  if (readingTool === SHELL_TOOL && isSafeReadOnlyCommand(command)) return false;
   const segments = readableCommandSegments(command);
-  return segments === null || classifyDecisionRisk(toolName, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(toolName, segment)) || pipesIntoASqlClient(command);
+  return segments === null || classifyDecisionRisk(readingTool, command) !== "standard" || segments.some((segment) => segmentNeedsAPerson(readingTool, segment)) || pipesIntoASqlClient(command) || shellDialectOf(toolName) === "powershell" && powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName));
 };
 var VISIBLE_DATA_LOSS_PATTERNS = [
   "Bash(git branch -D:*)",
@@ -2660,9 +3498,9 @@ var interpreterNameOf = (program) => basenameOf(program.text).replace(/\d+(?:\.\
 var runsScripts = (program) => SHELLS.has(basenameOf(program.text)) || INLINE_CODE_INTERPRETERS.has(interpreterNameOf(program));
 var runsWhatItReads = ({ program, args }) => program !== void 0 && runsScripts(program) && (args.length === 0 || args.every((arg) => arg.text.startsWith("-")) || args.some((arg) => arg.text === STANDARD_INPUT_ARGUMENT) || SHELLS.has(basenameOf(program.text)) && args.some((arg) => READS_ITS_SCRIPT_FROM_STANDARD_INPUT.test(arg.text)));
 var fetches = (invocation) => FETCHING_PROGRAMS.has(basenameOf(innermostInvocation(invocation).program?.text ?? ""));
-var URL_QUERY_OR_FRAGMENT = /[?#].*$/;
+var URL_QUERY_OR_FRAGMENT2 = /[?#].*$/;
 var SOURCES_A_SCRIPT = /* @__PURE__ */ new Set(["source", "."]);
-var downloadedNamesOf = (invocations) => new Set(invocations.filter(fetches).flatMap((invocation) => innermostInvocation(invocation).args.filter((arg) => !FLAG.test(arg.text)).map((arg) => basenameOf(arg.text.replace(URL_QUERY_OR_FRAGMENT, "")))));
+var downloadedNamesOf = (invocations) => new Set(invocations.filter(fetches).flatMap((invocation) => innermostInvocation(invocation).args.filter((arg) => !FLAG.test(arg.text)).map((arg) => basenameOf(arg.text.replace(URL_QUERY_OR_FRAGMENT2, "")))));
 var runsADownloadedScript = (invocations) => {
   const downloaded = downloadedNamesOf(invocations);
   return downloaded.size > 0 && invocations.map((invocation) => innermostInvocation(invocation)).some(({ program, args }) => {
@@ -2716,7 +3554,7 @@ var OUTPUT_REDIRECTION = new RegExp(String.raw`(?:\d*|&)(?:>>?|>\||<>|>&|<&)\s*$
 var REDIRECTED_INPUT_MARK = "\uE000";
 var ROUGH_SEPARATORS = ["&&", "||", "$(", "\n", ";", "|", "&", "`", "(", ")", "{", "}"];
 var SEPARATORS_INSIDE_DOUBLE_QUOTES = /* @__PURE__ */ new Set(["$(", "`", ")"]);
-var PIPE2 = "|";
+var PIPE3 = "|";
 var SUBSTITUTION_OPENERS = /* @__PURE__ */ new Set(["$(", "`"]);
 var QUOTE_CHARACTERS = /['"]/g;
 var roughPiecesOf = (text) => {
@@ -2764,8 +3602,8 @@ var roughSegmentsOf = (command) => {
     heredocsSeen += heredocCount;
     return {
       invocation: invocationOfRoughPiece(piece.text),
-      readsInput: piece.text.includes(REDIRECTED_INPUT_MARK) || heredocCount > 0 || piece.before === PIPE2,
-      readsAPipe: piece.before === PIPE2,
+      readsInput: piece.text.includes(REDIRECTED_INPUT_MARK) || heredocCount > 0 || piece.before === PIPE3,
+      readsAPipe: piece.before === PIPE3,
       feedsASubstitution: SUBSTITUTION_OPENERS.has(pieces[index + 1]?.before ?? ""),
       heredocs
     };
@@ -2791,7 +3629,19 @@ var commandHasAVisibleConsequenceAt = (toolName, command, depth) => {
   const invocations = segments.map((segment) => invocationOf(withoutShellGrouping(segment)));
   return invocations.some((invocation) => invocationHasAVisibleConsequence(toolName, invocation, depth)) || pipesIntoASqlClient(command) || pipesFetchedCodeIntoAnInterpreter(command, invocations) || runsADownloadedScript(invocations);
 };
-var commandHasAVisibleConsequence = (toolName, command) => commandHasAVisibleConsequenceAt(toolName, command, 0);
+var posixCommandOf = (words) => words.map(asOneShellWord).join(" ");
+var posixShellJudgeFor = (toolName) => ({
+  namesADestructiveAction: (text) => classifyDecisionRisk(toolName, text) === "destructive",
+  invocationShowsAConsequence: (invocation) => invocationHasAVisibleConsequence(SHELL_TOOL, invocation, 0),
+  commandShowsAConsequence: (words) => commandHasAVisibleConsequenceAt(SHELL_TOOL, posixCommandOf(words), 1),
+  onlyReads: (words) => isSafeReadOnlyCommand(posixCommandOf(words)),
+  fetches,
+  runsWhatItReads,
+  runsScripts,
+  namesASecretFile: (fileName) => SECRET_FILE_NAME.test(fileName)
+});
+var commandIsDestructive = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandIsDestructive(command, posixShellJudgeFor(toolName)) : classifyDecisionRisk(toolNameForAPosixReading(toolName), command) === "destructive";
+var commandHasAVisibleConsequence = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName)) : commandHasAVisibleConsequenceAt(toolNameForAPosixReading(toolName), command, 0);
 var MAX_SPELLING_DEPTH = 3;
 var GIT_GLOBAL_OPTIONS_WITH_A_VALUE = /* @__PURE__ */ new Set([
   "-C",
@@ -2907,7 +3757,7 @@ var withoutSessionToolGrants = (config) => ({
   policies: config.policies.filter((policy) => !isSessionToolGrant(policy))
 });
 var SESSION_TOOL_GRANT_TOOLS = /* @__PURE__ */ new Set(["Bash"]);
-var isStandingShellAllow = (policy) => !policy.origin && !isSessionToolGrant(policy) && SESSION_TOOL_GRANT_TOOLS.has(policy.tool) && isAutoApprove(policy);
+var isStandingShellAllow = (policy) => !policy.origin && !isSessionToolGrant(policy) && SHELL_DIALECT_BY_TOOL.has(policy.tool) && isAutoApprove(policy);
 var MCP_TOOL_PREFIX = "mcp__";
 var parseMcpToolName = (toolName) => {
   if (!toolName.startsWith(MCP_TOOL_PREFIX)) return void 0;
@@ -3500,7 +4350,6 @@ var AGENT_TASK_CONTROL_TOOLS = [TASK_OUTPUT_TOOL, TASK_STOP_TOOL];
 var AGENT_TASK_CONTROL_TOOL_NAMES = new Set(AGENT_TASK_CONTROL_TOOLS);
 var readsOrStopsItsOwnWork = (toolName) => isCodexCoordinationTool(toolName) || AGENT_TASK_CONTROL_TOOL_NAMES.has(toolName);
 var coordinationFloorApplies = (toolName, rank) => readsOrStopsItsOwnWork(toolName) && !isNamedByARule(rank);
-var POSIX_SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "Monitor"]);
 var argumentsAsWritten = (args) => ({ forms: args, hidesWhatItRuns: false });
 var namesAnArgumentOf = (pattern, toolName) => pattern.startsWith(`${toolName}(`);
 var isSpelledOut = (form) => form.length > 0;
@@ -3517,7 +4366,7 @@ var restrictionReadingOf = (restrictingPatterns, toolName, args) => {
 };
 var restrictingPatternsOf = (policies) => policies.filter(restricts).map((policy) => policy.tool);
 var policyReadingOf = (policies, toolName, args) => restrictionReadingOf(restrictingPatternsOf(policies), toolName, args);
-var stricterRule = (current, challenger) => current !== void 0 && (challenger === void 0 || restraintRank(current.policy) > restraintRank(challenger.policy)) ? current : challenger;
+var stricterRule = (current, challenger) => current !== void 0 && (challenger === void 0 || comparePolicyStrictness(current.policy, challenger.policy) > 0) ? current : challenger;
 var restrictsAnArgumentOf = (policy, toolName) => restricts(policy) && namesAnArgumentOf(policy.tool, toolName);
 var strictestRuleNamingAnArgument = (pool, toolName, repoKey, sessionId) => pool.filter((policy) => restrictsAnArgumentOf(policy, toolName) && appliesToThisCall(policy, repoKey, sessionId)).reduce((strictest, policy) => stricterRule(strictest, { policy, rank: "prefix" }), void 0);
 var governingRuleForReading = (pool, toolName, args, reading, repoKey, sessionId) => {
@@ -3555,7 +4404,7 @@ var unmatchedPolicyOf = (config, toolName) => ({
   mode: config.defaultMode ?? "push_first",
   pushFirstSeconds: config.defaultPushFirstSeconds ?? 20
 });
-var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => restraintRank(asWritten?.policy ?? unmatched) > restraintRank(asSpelled?.policy ?? unmatched) ? asWritten : asSpelled;
+var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => comparePolicyStrictness(asWritten?.policy ?? unmatched, asSpelled?.policy ?? unmatched) > 0 ? asWritten : asSpelled;
 var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
@@ -3577,7 +4426,7 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
     base = autoApprove(base.tool);
   }
   const wouldAutoApprove = isAutoApprove(base);
-  if (!governedBySpecificRule && wouldAutoApprove && toolName === "Bash" && typeof arg === "string" && (classifyDecisionRisk(toolName, arg) === "destructive" || governedByStandingShellAllow && commandHasAVisibleConsequence(toolName, arg))) {
+  if (!governedBySpecificRule && wouldAutoApprove && SHELL_DIALECT_BY_TOOL.has(toolName) && typeof arg === "string" && (commandIsDestructive(toolName, arg) || governedByStandingShellAllow && commandHasAVisibleConsequence(toolName, arg))) {
     base = {
       tool: base.tool,
       timeoutSeconds: config.defaultTimeoutSeconds,
@@ -3598,7 +4447,14 @@ var restraintRank = (policy) => {
   if (policy.mode === "push_only") return 3;
   return policy.mode === "terminal_only" || policy.mode === "notify_only" ? 1 : 2;
 };
-var strictestPolicy = (a, b) => restraintRank(b) > restraintRank(a) ? b : a;
+var TIMEOUT_ACTION_STRICTNESS = {
+  approve: 0,
+  escalate: 1,
+  wait: 1,
+  deny: 2
+};
+var comparePolicyStrictness = (a, b) => restraintRank(a) - restraintRank(b) || TIMEOUT_ACTION_STRICTNESS[a.timeoutAction] - TIMEOUT_ACTION_STRICTNESS[b.timeoutAction];
+var strictestPolicy = (current, challenger) => comparePolicyStrictness(current, challenger) > 0 ? current : challenger;
 var resolvePolicyAcross = (config, toolName, modeOverride, toolInputs, cwd, repoKey, sessionId) => {
   if (toolInputs.length === 0) return resolvePolicy(config, toolName, modeOverride, void 0, cwd, repoKey, sessionId);
   return toolInputs.map((input) => resolvePolicy(config, toolName, modeOverride, input, cwd, repoKey, sessionId)).reduce(strictestPolicy);
@@ -3623,7 +4479,7 @@ var strictestScopeVerdict = (scope, paths) => {
 };
 var survivesDegraded = (config, toolName, toolInputs, cwd, repoKey, sessionId) => toolInputs.length === 1 && resolveAutoResolveOrigin(config, toolName, toolInputs[0], cwd, repoKey, sessionId) === "safe_readonly";
 var FULL_DEFER_MODES = /* @__PURE__ */ new Set(["plan", "auto", "dontAsk"]);
-var ACCEPT_EDITS_DEFER_TOOLS = /* @__PURE__ */ new Set([
+var FILE_EDIT_TOOLS = /* @__PURE__ */ new Set([
   "Write",
   "Edit",
   "MultiEdit",
@@ -3633,7 +4489,7 @@ var shouldDeferToNativeMode = (permissionMode, toolName, options = {}) => {
   if (options.respectPermissionMode === false) return false;
   if (typeof permissionMode !== "string") return false;
   if (FULL_DEFER_MODES.has(permissionMode)) return true;
-  if (permissionMode === "acceptEdits" && ACCEPT_EDITS_DEFER_TOOLS.has(toolName)) return true;
+  if (permissionMode === "acceptEdits" && FILE_EDIT_TOOLS.has(toolName)) return true;
   if (permissionMode === "bypassPermissions") return options.deferBypass === true;
   return false;
 };
@@ -3726,7 +4582,7 @@ var resolveGate = (input) => {
     scopePath: scopeReason && "path" in scopeVerdict ? widenablePath(scopeVerdict.path) : void 0
   };
 };
-var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && (input.modeState.mode ?? input.config.modeOverride ?? null) === null && !aChosenRuleGoverns(input) && verdict.policy.mode === "push_first" && ACCEPT_EDITS_DEFER_TOOLS.has(input.toolName);
+var editAsksAtTheAgentsPrompt = (input, verdict) => verdict.kind === "gate" && !verdict.scopeReason && (input.modeState.mode ?? input.config.modeOverride ?? null) === null && !aChosenRuleGoverns(input) && verdict.policy.mode === "push_first" && FILE_EDIT_TOOLS.has(input.toolName);
 var claudePromptsBeforeAnEdit = (permissionMode) => permissionMode === "default";
 var runsTheClaudeHook = (source) => source === null || source === "claude" || hookCompatibleProfileBySource(source) !== void 0;
 var agentPromptsBeforeAnEdit = ({ source, event, permissionMode }) => {
@@ -3741,13 +4597,9 @@ var NO_RESPONSE_REASON = "No response within timeout";
 var codexRaisesItsOwnPrompts = (permissionMode) => permissionMode !== "bypassPermissions";
 var codexHasNoPromptOfItsOwn = (scopeReason, permissionMode) => scopeReason !== void 0 || !codexRaisesItsOwnPrompts(permissionMode);
 var CODEX_ASK_PASSES = { kind: "pass" };
-var CODEX_ASK_UNANSWERED = { kind: "deny", reason: NO_RESPONSE_REASON };
-var timeoutActionApplies = (ask) => ask.mode === "push_only" && ask.fullWindowServed;
-var codexUnansweredPreToolUse = (ask) => {
-  if (timeoutActionApplies(ask) && ask.timeoutAction === "approve") return CODEX_ASK_PASSES;
-  if (timeoutActionApplies(ask) && ask.timeoutAction === "deny") return CODEX_ASK_UNANSWERED;
-  return codexRaisesItsOwnPrompts(ask.permissionMode) ? CODEX_ASK_PASSES : CODEX_ASK_UNANSWERED;
-};
+var codexAskUnanswered = (ask) => ({ kind: "deny", reason: unansweredRefusalReason(ask.paused) });
+var ruleApprovesAfterItsFullWindow = (ask) => ask.mode === "push_only" && ask.fullWindowServed && ask.timeoutAction === "approve";
+var codexUnansweredPreToolUse = (ask) => ruleApprovesAfterItsFullWindow(ask) ? CODEX_ASK_PASSES : codexAskUnanswered(ask);
 var HANDED_BACK_REASON = "Handling on your machine";
 var HAND_BACK_WITHOUT_A_PROMPT = { kind: "refuse", reason: NO_AGENT_PROMPT_REASON };
 var CODEX_HAND_BACK_REASON = "You chose to handle this on your machine, so it did not run. Ask Codex to run it again while you are at your computer, or run it yourself.";
@@ -3756,18 +4608,18 @@ var codexDeferredPreToolUse = () => ({ kind: "deny", reason: CODEX_PRE_TOOL_USE_
 var isScopeReason = (scopeReason) => typeof scopeReason === "string" && scopeReason.length > 0;
 var scopeBreachReasonOf = (verdict) => verdict.kind === "gate" && isScopeReason(verdict.scopeReason) ? verdict.scopeReason : void 0;
 var onlyCodexPreToolUseCanAsk = (verdict, permissionMode) => verdict.kind === "gate" && (scopeBreachReasonOf(verdict) !== void 0 || !codexRaisesItsOwnPrompts(permissionMode));
-var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => toolName === "Bash" && toolInputs.some((toolInput) => {
+var runsACommandThatNeedsAPerson = ({ toolName, toolInputs }) => SHELL_DIALECT_BY_TOOL.has(toolName) && toolInputs.some((toolInput) => {
   const command = extractPolicyArg(toolName, toolInput);
   return command !== void 0 && (commandNeedsAPerson(toolName, command) || commandWritesThroughARemoteApi(command));
 });
-var CI_WORKFLOW_FILE = /(?:^|\/)\.github\/workflows\/[^/]+$/;
-var FILE_WRITING_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var CI_WORKFLOW_FILE = /(?:^|\/)\.github\/workflows\/[^/]+$/i;
 var namesASecretOrWorkflowFile = (path) => SECRET_FILE_NAME.test(basenameOf(path)) || CI_WORKFLOW_FILE.test(normalizeSeparators(path));
-var writesASecretOrWorkflowFile = ({ toolName, toolInputs }) => FILE_WRITING_TOOLS.has(toolName) && toolInputs.some((toolInput) => {
+var fileEditNeedsAPerson = (toolName, path) => FILE_EDIT_TOOLS.has(toolName) && namesASecretOrWorkflowFile(path);
+var editsAFileThatNeedsAPerson = ({ toolName, toolInputs }) => toolInputs.some((toolInput) => {
   const path = extractPolicyArg(toolName, toolInput);
-  return path !== void 0 && namesASecretOrWorkflowFile(path);
+  return path !== void 0 && fileEditNeedsAPerson(toolName, path);
 });
-var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input) || writesASecretOrWorkflowFile(input));
+var codexCallNeedsAPerson = (input, verdict, call) => onlyCodexPreToolUseCanAsk(verdict, call.permissionMode) || verdict.kind === "gate" && (aChosenRuleGoverns(input) || call.deletesFiles || runsACommandThatNeedsAPerson(input) || editsAFileThatNeedsAPerson(input));
 var MAX_AGENT_PERMISSION_RULES_PER_KIND = 256;
 var MAX_AGENT_PERMISSION_RULE_LENGTH = 512;
 var isAgentPermissionRule = (value) => typeof value === "string" && value.length > 0 && value.length <= MAX_AGENT_PERMISSION_RULE_LENGTH;
@@ -3802,7 +4654,8 @@ var allowRulesGrant = (rules, toolName, args) => {
 var inputNeedsAPerson = (toolName, toolInput) => {
   const arg = extractPolicyArg(toolName, toolInput);
   if (arg === void 0) return false;
-  return toolName in POLICY_COMMAND_KEYS ? commandNeedsAPerson(toolName, arg) : classifyDecisionRisk(toolName, arg) !== "standard";
+  if (toolName in POLICY_COMMAND_KEYS) return commandNeedsAPerson(toolName, arg);
+  return fileEditNeedsAPerson(toolName, arg) || classifyDecisionRisk(toolName, arg) !== "standard";
 };
 var agentRulesAllowEveryInput = (rules, toolName, toolInputs, cwd) => rules.allow.length > 0 && toolInputs.length > 0 && toolInputs.every((toolInput) => {
   const args = policyArgForms(toolName, toolInput, cwd);
@@ -4010,6 +4863,9 @@ var WITHDRAWN_APPROVAL_REASON = "The phone question was withdrawn. Approve in th
 var PLAN_DECLINED_REASON = "Plan declined from the phone. Ask what to change before coding.";
 var claudeStoppedPreToolUseOutput = (reason) => stoppedOutput(claudePreToolUseOutput("deny", reason), reason);
 var claudeStoppedPermissionRequestOutput = (reason) => stoppedOutput(claudePermissionRequestOutput("deny", reason), reason);
+var UNANSWERED_ASKS_BEFORE_PAUSE = 3;
+var SESSION_PAUSED_REASON = `Phone approvals for this session are paused because ${UNANSWERED_ASKS_BEFORE_PAUSE} of them went unanswered, so this was refused without asking anyone. A notification was sent to your phone: tap Approve on it to resume, then run this again.`;
+var unansweredRefusalReason = (paused) => paused ? SESSION_PAUSED_REASON : NO_RESPONSE_REASON;
 var UNHEARD_PUSH_WINDOW_DAYS = 14;
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var UNHEARD_PUSH_WINDOW_MS = UNHEARD_PUSH_WINDOW_DAYS * DAY_MS;
@@ -4411,7 +5267,6 @@ export {
   SCOPE_BATCH_REASON,
   UNREADABLE_CALL_REASON,
   unapprovedScopeReason,
-  NO_RESPONSE_REASON,
   codexHasNoPromptOfItsOwn,
   codexUnansweredPreToolUse,
   HANDED_BACK_REASON,
@@ -4444,6 +5299,8 @@ export {
   PLAN_DECLINED_REASON,
   claudeStoppedPreToolUseOutput,
   claudeStoppedPermissionRequestOutput,
+  SESSION_PAUSED_REASON,
+  unansweredRefusalReason,
   ELICITATION_ANSWERABLE_MODE,
   readElicitationFields,
   planElicitationAsk,