@qwen-code/qwen-code 0.21.12-preview.5 → 0.21.13

package/chunks/daemon-git-worktree-guard-DXYIMWFT.js

@@ -0,0 +1,2062 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  EXTERNAL_TOOL_GUARD_MAX_DENIAL_REASON_CHARS,
+  SHELL_EXECUTING_TOOL_NAMES
+} from "./chunk-3VUENPWF.js";
+import {
+  GitWorktreeService,
+  require_shell_quote,
+  splitCommands
+} from "./chunk-4S5337WV.js";
+import "./chunk-GOFAQQZA.js";
+import "./chunk-5M6IDOMF.js";
+import "./chunk-TWPJO254.js";
+import "./chunk-CQ35AJ4Z.js";
+import "./chunk-DGZEMW5R.js";
+import "./chunk-WSH6GRKG.js";
+import "./chunk-CKSJECTU.js";
+import "./chunk-OVZPVYZB.js";
+import "./chunk-6PVPNMXU.js";
+import "./chunk-5EYKMUUY.js";
+import "./chunk-IRH27ZC2.js";
+import "./chunk-QHWCP53L.js";
+import "./chunk-Y3YCSWG5.js";
+import "./chunk-UPDOZBWO.js";
+import "./chunk-O6GEWCJA.js";
+import "./chunk-T26EAKDL.js";
+import "./chunk-ZPJWUGCS.js";
+import "./chunk-CPBF7KYF.js";
+import "./chunk-RWDNJBWN.js";
+import "./chunk-25EYDK42.js";
+import "./chunk-MIPFDQAF.js";
+import "./chunk-MLXTMF7H.js";
+import "./chunk-KV27IEHM.js";
+import "./chunk-E3DYKPYZ.js";
+import "./chunk-OMLJNPBE.js";
+import "./chunk-OXCMMLED.js";
+import "./chunk-TIGA2IVL.js";
+import "./chunk-SAH4BD2J.js";
+import "./chunk-XLLKYULU.js";
+import "./chunk-PT4I7NBA.js";
+import "./chunk-S6LOFUVP.js";
+import "./chunk-2J3OJGTL.js";
+import "./chunk-SG7ZP5PG.js";
+import "./chunk-K623ENWT.js";
+import "./chunk-AQ37AY7B.js";
+import "./chunk-KBXKR5R2.js";
+import "./chunk-GMIEIY3Y.js";
+import "./chunk-NAVJD2PQ.js";
+import "./chunk-ROIYNTHJ.js";
+import "./chunk-2B2BF7P7.js";
+import "./chunk-P3QQPMQA.js";
+import "./chunk-YZHRN3CF.js";
+import "./chunk-FAAUPSY2.js";
+import "./chunk-KM73TBQ4.js";
+import "./chunk-MPHPFVKK.js";
+import "./chunk-AXMWHKXA.js";
+import "./chunk-GLCZKT5V.js";
+import "./chunk-DJ2GSRLV.js";
+import "./chunk-QFJ5JHQR.js";
+import {
+  isWithinRoot
+} from "./chunk-RVOJ2FBP.js";
+import "./chunk-YRLW2MSX.js";
+import "./chunk-VGC4I5JJ.js";
+import "./chunk-CHHABXPE.js";
+import "./chunk-MA2HEDVP.js";
+import "./chunk-XUJNK7Y6.js";
+import "./chunk-6HY6IF3Z.js";
+import "./chunk-4PKCUT7F.js";
+import "./chunk-F6WFNA7U.js";
+import "./chunk-46UV252V.js";
+import "./chunk-FPGTNKCP.js";
+import "./chunk-CPHEPGAO.js";
+import "./chunk-P7MPQI75.js";
+import "./chunk-FDGGZIYW.js";
+import "./chunk-EL5SXY3T.js";
+import "./chunk-HHJLM3WQ.js";
+import "./chunk-K5IDV3PC.js";
+import {
+  realpathNearestExistingAsync
+} from "./chunk-BUQDLC2G.js";
+import "./chunk-VOQXFAY5.js";
+import "./chunk-75DOP5OR.js";
+import "./chunk-DMTGGOSA.js";
+import "./chunk-YQ3U5MUC.js";
+import "./chunk-AMDSOFFV.js";
+import "./chunk-QUGAUQGJ.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name,
+  __toESM
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/cli/src/serve/daemon-git-worktree-guard.ts
+init_esbuild_shims();
+var import_shell_quote = __toESM(require_shell_quote(), 1);
+import { realpath, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+var RELOCATED_READ_ONLY_GIT_SUBCOMMANDS = /* @__PURE__ */ new Set(["cat-file", "rev-parse"]);
+var RELOCATED_READ_ONLY_DISQUALIFYING_FLAGS = /* @__PURE__ */ new Set([
+  "--filters",
+  "--output",
+  "--textconv"
+]);
+var GIT_GLOBAL_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set([
+  "--attr-source",
+  "--namespace",
+  "--shallow-file",
+  "--super-prefix"
+]);
+var GIT_COMMAND_CONFIG_KEY_PATTERNS = [
+  /^alias\./,
+  /^core\.(askpass|editor|fsmonitor|pager|sshcommand)$/,
+  /^credential\.helper$/,
+  /^diff\..+\.(command|textconv)$/,
+  /^difftool\./,
+  /^filter\./,
+  /^core\.hookspath$/,
+  /^gpg\.(.+\.)?program$/,
+  /^merge\..+\.driver$/,
+  /^mergetool\./,
+  /^pager\./,
+  /^sequence\.editor$/,
+  /^uploadpack\.packobjectshook$/,
+  /^browser\..+\.cmd$/,
+  /^core\.gitproxy$/,
+  /^credential\..+\.helper$/,
+  /^diff\.external$/,
+  /^gc\.recentobjectshook$/,
+  /^help\.browser$/,
+  /^interactive\.difffilter$/,
+  /^remote\..+\.(proxy|receivepack|uploadpack)$/,
+  /^ssh\.variant$/,
+  /^tar\..+\.command$/,
+  /^trailer\..+\.command$/,
+  /^man\..+\.cmd$/,
+  /^sendemail\.(sendmailcmd|tocmd|cccmd)$/,
+  /^web\.browser$/,
+  // Pulls in a config file the guard cannot read: it can carry a
+  // `core.worktree` redirect or any command-executing key, so it is
+  // undecidable and fails closed.
+  /^include\.path$/,
+  /^includeif\..+\.path$/,
+  /^imap\.tunnel$/,
+  /^instaweb\.httpd$/
+];
+var GIT_DIR_ENV_KEYS = /* @__PURE__ */ new Set(["GIT_COMMON_DIR", "GIT_DIR"]);
+var GIT_WORK_TREE_ENV_KEYS = /* @__PURE__ */ new Set(["GIT_INDEX_FILE", "GIT_WORK_TREE"]);
+var GIT_UNRESOLVABLE_ENV_KEYS = /* @__PURE__ */ new Set([
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_ASKPASS",
+  "GIT_CONFIG",
+  "GIT_CONFIG_COUNT",
+  "GIT_CONFIG_GLOBAL",
+  "GIT_CONFIG_PARAMETERS",
+  "GIT_CONFIG_SYSTEM",
+  "GIT_EDITOR",
+  "GIT_DIFFTOOL_EXTCMD",
+  "GIT_EXTERNAL_DIFF",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_PAGER",
+  "GIT_SEQUENCE_EDITOR",
+  "GIT_SSH",
+  "GIT_SSH_COMMAND"
+]);
+var GIT_NUMBERED_CONFIG_ENV_PATTERN = /^GIT_CONFIG_(KEY|VALUE)_\d+$/;
+var SHELL_WRAPPER_PROGRAMS = /* @__PURE__ */ new Set(["bash", "dash", "ksh", "sh", "zsh"]);
+var SHELL_WRAPPER_VALUE_FLAGS = /* @__PURE__ */ new Set(["-o", "-O"]);
+function shellBundleRequestsCommand(flag) {
+  if (!flag.startsWith("-") || flag.startsWith("--")) return false;
+  return flag.slice(1).includes("c");
+}
+__name(shellBundleRequestsCommand, "shellBundleRequestsCommand");
+function shellBundleValueFlagsBeforeCommand(flag) {
+  let consumed = 0;
+  for (const character of flag.slice(1)) {
+    if (character === "c") return consumed;
+    if (character === "o" || character === "O") consumed++;
+  }
+  return consumed;
+}
+__name(shellBundleValueFlagsBeforeCommand, "shellBundleValueFlagsBeforeCommand");
+var ENV_CHDIR_FLAGS = /* @__PURE__ */ new Set(["-C", "--chdir"]);
+var ENV_VALUE_FLAGS = /* @__PURE__ */ new Set(["-S", "--split-string", "-u", "--unset"]);
+var ENV_KNOWN_FLAG_ONLY = /* @__PURE__ */ new Set([
+  "-",
+  "-0",
+  "-i",
+  "-v",
+  "--null",
+  "--ignore-environment",
+  "--debug"
+]);
+var ENV_CLEARS_ENVIRONMENT = /* @__PURE__ */ new Set(["-", "-i", "--ignore-environment"]);
+var SUDO_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-C",
+  "-D",
+  "-T",
+  "-g",
+  "-h",
+  "-p",
+  "-r",
+  "-t",
+  "-u",
+  "--chdir",
+  "--close-from",
+  "--command-timeout",
+  "--group",
+  "--host",
+  "--prompt",
+  "--role",
+  "--type",
+  "--user"
+]);
+var SUDO_CHDIR_FLAGS = /* @__PURE__ */ new Set(["-D", "--chdir"]);
+var SUDO_CHROOT_FLAGS = /* @__PURE__ */ new Set(["-R", "--chroot"]);
+var TIMEOUT_VALUE_FLAGS = /* @__PURE__ */ new Set(["-k", "-s", "--kill-after", "--signal"]);
+var PATH_RELINKING_PROGRAMS = /* @__PURE__ */ new Set(["cp", "ln", "mv"]);
+var PATH_EXTRACTING_PROGRAMS = /* @__PURE__ */ new Set(["cpio", "rsync", "tar", "unzip"]);
+var PROGRAMS_WITH_OWN_C_FLAG = /* @__PURE__ */ new Set([
+  "cmake",
+  "curl",
+  "cpio",
+  "diff",
+  "grep",
+  "install",
+  "make",
+  "patch",
+  "rsync",
+  "tar",
+  "unzip"
+]);
+var EXTERNAL_GUARD_UNSUPPORTED_TOOLS = /* @__PURE__ */ new Set([
+  "agent",
+  "workflow",
+  "create_sub_session",
+  "send_message"
+]);
+var DYNAMIC_RELOCATION_DENIAL = "Daemon shell guard denied a mutating Git command with a dynamic repository location.";
+var UNPARSEABLE_COMMAND_DENIAL = "Daemon shell guard denied a shell command that could not be parsed before execution.";
+var UNRESOLVED_TARGET_DENIAL_PREFIX = "Daemon shell guard denied a mutating Git command with an unresolvable repository location: ";
+var OUTSIDE_TARGET_DENIAL_PREFIX = "Daemon shell guard denied a mutating Git command outside the session working directory: ";
+var UNDECIDABLE_PAYLOAD_DENIAL = "Daemon shell guard denied a shell command whose payload could not be resolved before execution.";
+var UNRECOGNIZED_PROGRAM_DENIAL = "Daemon shell guard denied a shell command that may run a relocated Git command through an unrecognized program.";
+var SHADOW_REMOVAL_DENIAL = "Daemon shell guard denied a shell command that removes a tracked shell definition in a way it cannot model.";
+var PROMPTLESS_PROVIDER_DENIAL = "Managed external tool guard cannot consult an external provider without an active prompt binding.";
+var MAX_PAYLOAD_RECURSION_DEPTH = 3;
+var UNVERIFIABLE_SCOPE_DENIAL_PREFIX = "Daemon shell guard could not establish the execution directory of this call: ";
+function envUnsetRemovesFunction(name, state) {
+  const keys = state.unsetEnvKeys;
+  return keys !== void 0 && (keys.has(`BASH_FUNC_${name}%%`) || keys.has(`BASH_FUNC_${name}()`));
+}
+__name(envUnsetRemovesFunction, "envUnsetRemovesFunction");
+function sanitizeDenialPath(value, prefix) {
+  const stripped = [...value].filter((character) => {
+    const code = character.charCodeAt(0);
+    return code >= 32 && !(code >= 127 && code <= 159) && code !== 8232 && code !== 8233;
+  }).join("");
+  const budget = EXTERNAL_TOOL_GUARD_MAX_DENIAL_REASON_CHARS - prefix.length;
+  if (stripped.length <= budget) return stripped;
+  return `${stripped.slice(0, Math.max(1, budget - 1))}\u2026`;
+}
+__name(sanitizeDenialPath, "sanitizeDenialPath");
+function denyDynamicRelocation() {
+  return { allowed: false, reason: DYNAMIC_RELOCATION_DENIAL };
+}
+__name(denyDynamicRelocation, "denyDynamicRelocation");
+function denyTarget(prefix, target) {
+  return {
+    allowed: false,
+    reason: `${prefix}${sanitizeDenialPath(target, prefix)}`
+  };
+}
+__name(denyTarget, "denyTarget");
+var BRACE_EXPANSION_PATTERN = /\{[^{}]*,[^{}]*\}/;
+function isDynamicPathValue(token) {
+  return token === void 0 || token.dynamic || token.text.includes("`") || token.text.startsWith("~") || BRACE_EXPANSION_PATTERN.test(token.text);
+}
+__name(isDynamicPathValue, "isDynamicPathValue");
+function leadingEnvAssignmentKey(token) {
+  const match = /^([A-Za-z_][A-Za-z0-9_]*)\+?=/.exec(token);
+  return match ? match[1] : null;
+}
+__name(leadingEnvAssignmentKey, "leadingEnvAssignmentKey");
+function isAppendAssignment(token) {
+  return /^[A-Za-z_][A-Za-z0-9_]*\+=/.test(token);
+}
+__name(isAppendAssignment, "isAppendAssignment");
+function executableBaseName(token) {
+  const base = token.text.split(/[\\/]/).pop() ?? token.text;
+  return base.toLowerCase().replace(/\.exe$/i, "");
+}
+__name(executableBaseName, "executableBaseName");
+var SUBSHELL_OPENING_OPERATORS = /* @__PURE__ */ new Set([
+  "(",
+  "<(",
+  ">("
+]);
+var REDIRECT_OPERATORS = /* @__PURE__ */ new Set([
+  "<",
+  ">",
+  ">>",
+  "<<",
+  "<<<",
+  "<>",
+  ">&",
+  "<&",
+  ">|",
+  "&>",
+  "&>>"
+]);
+function tokenizeSegment(segment, startDepth) {
+  let parsed;
+  try {
+    parsed = (0, import_shell_quote.parse)(segment, (key) => `$${key}`);
+  } catch {
+    return null;
+  }
+  let depth = startDepth;
+  const runs = [{ tokens: [], depth }];
+  let redirectOperand = false;
+  for (let index = 0; index < parsed.length; index++) {
+    const token = parsed[index];
+    if (typeof token === "string") {
+      const isRedirectOperand = redirectOperand;
+      redirectOperand = false;
+      if (token.endsWith("$")) {
+        const next = parsed[index + 1];
+        if (next !== null && typeof next === "object" && "op" in next && next.op === "(") {
+          let depth2 = 0;
+          index++;
+          for (; index < parsed.length; index++) {
+            const inner = parsed[index];
+            if (inner !== null && typeof inner === "object" && "op" in inner) {
+              if (inner.op === "(") depth2++;
+              else if (inner.op === ")") {
+                depth2--;
+                if (depth2 === 0) break;
+              }
+            }
+          }
+          runs.at(-1).tokens.push({
+            text: token,
+            dynamic: true,
+            ...isRedirectOperand ? { redirect: true } : {}
+          });
+          continue;
+        }
+      }
+      runs.at(-1).tokens.push({
+        text: token,
+        dynamic: token.includes("$") || token.includes("`"),
+        ...isRedirectOperand ? { redirect: true } : {}
+      });
+      continue;
+    }
+    if (token === null || typeof token !== "object") return null;
+    if ("comment" in token) break;
+    if (!("op" in token)) return null;
+    const op = token.op;
+    if (op === "glob") {
+      const pattern = "pattern" in token && typeof token.pattern === "string" ? token.pattern : "";
+      runs.at(-1).tokens.push({ text: pattern, dynamic: true });
+      continue;
+    }
+    if (SUBSHELL_OPENING_OPERATORS.has(op)) {
+      depth++;
+      runs.push({ tokens: [], depth });
+      continue;
+    }
+    if (op === ")") {
+      depth = Math.max(0, depth - 1);
+      runs.push({ tokens: [], depth });
+      continue;
+    }
+    if (REDIRECT_OPERATORS.has(op)) {
+      const tokens = runs.at(-1).tokens;
+      const previous = tokens.at(-1);
+      if (previous && !previous.redirect && /^\d+$/.test(previous.text)) {
+        tokens[tokens.length - 1] = { ...previous, ambiguousFd: true };
+      }
+      redirectOperand = true;
+      continue;
+    }
+    runs.push({ tokens: [], depth });
+  }
+  return { runs: runs.filter((run) => run.tokens.length > 0), endDepth: depth };
+}
+__name(tokenizeSegment, "tokenizeSegment");
+function expandShellLocals(token, shellLocals) {
+  if (!token.dynamic || shellLocals.size === 0) return token;
+  let resolved = true;
+  const text = token.text.replace(
+    /\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/g,
+    (match, name) => {
+      const local = shellLocals.get(name);
+      if (local === void 0 || local.dynamic) {
+        resolved = false;
+        return match;
+      }
+      return local.text.slice(local.text.indexOf("=") + 1);
+    }
+  );
+  if (text === token.text) return token;
+  return { text, dynamic: !resolved };
+}
+__name(expandShellLocals, "expandShellLocals");
+function quoteForRejoin(text) {
+  if (text.length === 0) return "''";
+  if (!/[\s"'`$\\|&;<>()*?[\]{}!#~]/.test(text)) return text;
+  return `'${text.replaceAll("'", `'\\''`)}'`;
+}
+__name(quoteForRejoin, "quoteForRejoin");
+function joinTokenTexts(tokens) {
+  return tokens.filter((token) => !token.redirect).map((token) => token.text).join(" ");
+}
+__name(joinTokenTexts, "joinTokenTexts");
+function joinArgvTexts(tokens) {
+  return tokens.filter((token) => !token.redirect).map((token) => quoteForRejoin(token.text)).join(" ");
+}
+__name(joinArgvTexts, "joinArgvTexts");
+function hasGitRelocationMarker(tokens) {
+  return tokens.some((token) => {
+    if (token.text === "-C" || token.text.startsWith("-C")) return true;
+    if (/^--(?:git-dir|work-tree)(?:=|$)/.test(token.text)) return true;
+    const key = leadingEnvAssignmentKey(token.text);
+    return key !== null && (GIT_DIR_ENV_KEYS.has(key) || GIT_WORK_TREE_ENV_KEYS.has(key) || // `PATH=`/`GIT_EXEC_PATH=` choose which git binary runs — a relocation
+    // the direct path already denies, so the wrapper backstop must too.
+    GIT_PROGRAM_ENV_KEYS.has(key));
+  });
+}
+__name(hasGitRelocationMarker, "hasGitRelocationMarker");
+var GIT_WORD_PATTERN = /\bgit\b/i;
+var TEXT_RELOCATION_MARKER_WITHOUT_C_PATTERN = /(^|\s)(--git-dir=?|--work-tree=?|-execdir)|(^|[\s;&|(){}])(cd|pushd)([\s;&|]|$)|(^|[\s;&|(){}])(GIT_DIR|GIT_WORK_TREE|GIT_COMMON_DIR|GIT_INDEX_FILE|GIT_EXEC_PATH|PATH)\+?=/;
+var TEXT_RELOCATION_MARKER_PATTERN = /(^|\s)(-C|--git-dir=?|--work-tree=?|-execdir)|(^|[\s;&|(){}])(cd|pushd)([\s;&|]|$)|(^|[\s;&|(){}])(GIT_DIR|GIT_WORK_TREE|GIT_COMMON_DIR|GIT_INDEX_FILE|GIT_EXEC_PATH|PATH)\+?=/;
+var GIT_PROGRAM_ENV_KEYS = /* @__PURE__ */ new Set(["GIT_EXEC_PATH", "PATH"]);
+function recordEnvAssignment(token, state) {
+  const key = leadingEnvAssignmentKey(token.text);
+  if (key === null) return;
+  if (GIT_PROGRAM_ENV_KEYS.has(key) || GIT_UNRESOLVABLE_ENV_KEYS.has(key) || GIT_NUMBERED_CONFIG_ENV_PATTERN.test(key)) {
+    state.unresolved = true;
+    return;
+  }
+  if (!GIT_DIR_ENV_KEYS.has(key) && !GIT_WORK_TREE_ENV_KEYS.has(key)) return;
+  const value = token.text.slice(token.text.indexOf("=") + 1);
+  if (token.dynamic || isAppendAssignment(token.text) || isDynamicPathValue({ text: value, dynamic: false })) {
+    state.unresolved = true;
+    return;
+  }
+  state.relocations.push({
+    target: value,
+    // GIT_COMMON_DIR and GIT_INDEX_FILE cannot be mapped onto a repository
+    // root the way `--git-dir` targets are; checking the concrete path they
+    // name is the conservative approximation.
+    kind: GIT_WORK_TREE_ENV_KEYS.has(key) ? "work-tree" : "git-dir"
+  });
+}
+__name(recordEnvAssignment, "recordEnvAssignment");
+function attachedChdirValue(flag, set) {
+  for (const candidate of set) {
+    if (candidate.startsWith("--") && flag.startsWith(`${candidate}=`)) {
+      return flag.slice(candidate.length + 1);
+    }
+    if (candidate.length === 2 && flag.startsWith(candidate) && flag.length > candidate.length) {
+      return flag.slice(candidate.length);
+    }
+  }
+  return void 0;
+}
+__name(attachedChdirValue, "attachedChdirValue");
+function recordChdirValue(value, state) {
+  if (isDynamicPathValue(value)) {
+    state.unresolved = true;
+    return;
+  }
+  state.relocations.push({ target: value.text, kind: "cwd" });
+}
+__name(recordChdirValue, "recordChdirValue");
+function consumeEnvWrapper(run, start, state) {
+  let index = start + 1;
+  while (index < run.length) {
+    const token = run[index];
+    if (token.dynamic) {
+      state.unresolved = true;
+      index++;
+      continue;
+    }
+    if (token.text === "--") {
+      index++;
+      break;
+    }
+    if (ENV_KNOWN_FLAG_ONLY.has(token.text)) {
+      if (ENV_CLEARS_ENVIRONMENT.has(token.text)) {
+        state.clearsEnvironment = true;
+      }
+      index++;
+      continue;
+    }
+    if (ENV_CHDIR_FLAGS.has(token.text)) {
+      recordChdirValue(run[index + 1], state);
+      index += 2;
+      continue;
+    }
+    const attached = attachedChdirValue(token.text, ENV_CHDIR_FLAGS);
+    if (attached !== void 0) {
+      recordChdirValue({ text: attached, dynamic: false }, state);
+      index++;
+      continue;
+    }
+    if (token.text === "-S" || token.text === "--split-string") {
+      const payloadToken = run[index + 1];
+      if (payloadToken === void 0) return { next: run.length };
+      if (payloadToken.dynamic) return { next: run.length, undecidable: true };
+      const rest = joinArgvTexts(run.slice(index + 2));
+      return {
+        next: run.length,
+        payload: rest ? `${payloadToken.text} ${rest}` : payloadToken.text
+      };
+    }
+    if (/^-[A-Za-z]*S/.test(token.text) && !token.text.startsWith("--")) {
+      const fused = token.text.slice(token.text.indexOf("S") + 1);
+      if (fused.length > 0) {
+        const rest2 = joinArgvTexts(run.slice(index + 1));
+        return {
+          next: run.length,
+          payload: rest2 ? `${fused} ${rest2}` : fused
+        };
+      }
+      const payloadToken = run[index + 1];
+      if (payloadToken === void 0) return { next: run.length };
+      if (payloadToken.dynamic) return { next: run.length, undecidable: true };
+      const rest = joinArgvTexts(run.slice(index + 2));
+      return {
+        next: run.length,
+        payload: rest ? `${payloadToken.text} ${rest}` : payloadToken.text
+      };
+    }
+    if (ENV_VALUE_FLAGS.has(token.text)) {
+      const removed = run[index + 1];
+      if (removed !== void 0 && !removed.dynamic) {
+        (state.unsetEnvKeys ??= /* @__PURE__ */ new Set()).add(removed.text);
+      }
+      index += 2;
+      continue;
+    }
+    if (/^-u./.test(token.text) || token.text.startsWith("--unset=") || token.text.startsWith("--split-string=")) {
+      if (token.text.startsWith("--split-string=")) {
+        const fused = token.text.slice("--split-string=".length);
+        const rest = joinArgvTexts(run.slice(index + 1));
+        return { next: run.length, payload: rest ? `${fused} ${rest}` : fused };
+      }
+      const removedName = token.text.startsWith("--unset=") ? token.text.slice("--unset=".length) : token.text.slice(2);
+      (state.unsetEnvKeys ??= /* @__PURE__ */ new Set()).add(removedName);
+      index++;
+      continue;
+    }
+    if (leadingEnvAssignmentKey(token.text) !== null) {
+      recordEnvAssignment(token, state);
+      index++;
+      continue;
+    }
+    if (token.text.startsWith("-")) {
+      state.unresolved = true;
+      index++;
+      continue;
+    }
+    break;
+  }
+  return { next: index };
+}
+__name(consumeEnvWrapper, "consumeEnvWrapper");
+function consumeSudoWrapper(run, start, state) {
+  let index = start + 1;
+  while (index < run.length) {
+    const token = run[index];
+    if (token.dynamic) {
+      state.unresolved = true;
+      index++;
+      continue;
+    }
+    if (leadingEnvAssignmentKey(token.text) !== null) {
+      recordEnvAssignment(token, state);
+      index++;
+      continue;
+    }
+    if (!token.text.startsWith("-")) break;
+    if (SUDO_CHDIR_FLAGS.has(token.text)) {
+      recordChdirValue(run[index + 1], state);
+      index += 2;
+      continue;
+    }
+    if (SUDO_CHROOT_FLAGS.has(token.text) || token.text.startsWith("--chroot=") || /^-R./.test(token.text)) {
+      state.unresolved = true;
+      index += SUDO_CHROOT_FLAGS.has(token.text) ? 2 : 1;
+      continue;
+    }
+    const attached = attachedChdirValue(token.text, SUDO_CHDIR_FLAGS);
+    if (attached !== void 0) {
+      recordChdirValue({ text: attached, dynamic: false }, state);
+      index++;
+      continue;
+    }
+    if (SUDO_VALUE_FLAGS.has(token.text)) {
+      index += 2;
+      continue;
+    }
+    index++;
+  }
+  return { next: index };
+}
+__name(consumeSudoWrapper, "consumeSudoWrapper");
+function consumeTimeoutWrapper(run, start) {
+  let index = start + 1;
+  while (index < run.length) {
+    const token = run[index];
+    if (!token.text.startsWith("-")) break;
+    if (TIMEOUT_VALUE_FLAGS.has(token.text) && !token.text.includes("=")) {
+      index += 2;
+      continue;
+    }
+    index++;
+  }
+  if (index < run.length) index++;
+  return index;
+}
+__name(consumeTimeoutWrapper, "consumeTimeoutWrapper");
+function nextArgvIndex(run, from) {
+  let index = from;
+  while (index < run.length && (run[index].redirect || run[index].ambiguousFd)) {
+    index++;
+  }
+  return index;
+}
+__name(nextArgvIndex, "nextArgvIndex");
+function consumeShellWrapper(run, start) {
+  let index = start + 1;
+  while (index < run.length) {
+    const token = run[index];
+    if (token.text === "-c") {
+      const payloadToken = run[nextArgvIndex(run, index + 1)];
+      if (payloadToken === void 0) {
+        return { kind: "static", payload: "" };
+      }
+      if (payloadToken.dynamic) return { kind: "dynamic" };
+      return { kind: "static", payload: payloadToken.text };
+    }
+    if (token.dynamic) {
+      return { kind: "dynamic" };
+    }
+    if (shellBundleRequestsCommand(token.text)) {
+      const remainder = token.text.slice(token.text.indexOf("c") + 1);
+      if (remainder.length > 0 && !/^[A-Za-z]+$/.test(remainder)) {
+        return { kind: "static", payload: remainder };
+      }
+      let payloadIndex = nextArgvIndex(run, index + 1);
+      let toSkip = shellBundleValueFlagsBeforeCommand(token.text) + (remainder.match(/[oO]/g)?.length ?? 0);
+      while (toSkip-- > 0) {
+        payloadIndex = nextArgvIndex(run, payloadIndex + 1);
+      }
+      const payloadToken = run[payloadIndex];
+      if (payloadToken === void 0) {
+        return { kind: "static", payload: "" };
+      }
+      if (payloadToken.dynamic) return { kind: "dynamic" };
+      return { kind: "static", payload: payloadToken.text };
+    }
+    if (token.text.startsWith("+")) {
+      index++;
+      continue;
+    }
+    if (!token.text.startsWith("-")) return { kind: "none" };
+    if (token.text === "--") return { kind: "none" };
+    index += SHELL_WRAPPER_VALUE_FLAGS.has(token.text) ? 2 : 1;
+  }
+  return { kind: "none" };
+}
+__name(consumeShellWrapper, "consumeShellWrapper");
+var LEADING_SHELL_KEYWORDS = /* @__PURE__ */ new Set([
+  "{",
+  "}",
+  "!",
+  "if",
+  "then",
+  "else",
+  "elif",
+  "fi",
+  "for",
+  "do",
+  "done",
+  "while",
+  "until",
+  "in",
+  "case",
+  "esac",
+  "time",
+  "coproc"
+]);
+var EXPORT_BUILTINS = /* @__PURE__ */ new Set([
+  "declare",
+  "export",
+  "local",
+  "readonly",
+  "typeset"
+]);
+var CHDIR_OPTION_PATTERN = /^-[LPe@qs]+$/;
+function findChdirTarget(run, start, variant) {
+  let index = start;
+  while (index < run.length) {
+    const token = run[index];
+    if (token.text === "--") return run[index + 1];
+    if (variant === "cd" && CHDIR_OPTION_PATTERN.test(token.text)) {
+      index++;
+      continue;
+    }
+    if (/^[-+]/.test(token.text)) return void 0;
+    return token;
+  }
+  return void 0;
+}
+__name(findChdirTarget, "findChdirTarget");
+function requestsAllExport(run, start) {
+  for (let index = start; index < run.length; index++) {
+    const token = run[index];
+    const text = token.text;
+    if (token.dynamic) return true;
+    if (text === "-o" || text === "--") {
+      if (run[index + 1]?.text === "allexport") return true;
+      continue;
+    }
+    if (text === "allexport" || text === "--allexport") return true;
+    if (/^-[a-zA-Z]*a/.test(text)) return true;
+  }
+  return false;
+}
+__name(requestsAllExport, "requestsAllExport");
+function disablesAllExport(run, start) {
+  for (let index = start; index < run.length; index++) {
+    const text = run[index].text;
+    if (text === "+o" && run[index + 1]?.text === "allexport") return true;
+    if (/^\+[a-zA-Z]*a/.test(text)) return true;
+  }
+  return false;
+}
+__name(disablesAllExport, "disablesAllExport");
+function readProgramWord(run) {
+  for (const token of run) {
+    if (token.redirect || token.ambiguousFd) continue;
+    if (leadingEnvAssignmentKey(token.text) !== null) continue;
+    if (LEADING_SHELL_KEYWORDS.has(token.text)) continue;
+    return token.text;
+  }
+  return void 0;
+}
+__name(readProgramWord, "readProgramWord");
+function runFromProgramWord(run) {
+  let index = 0;
+  while (index < run.length) {
+    const token = run[index];
+    if (token.redirect || token.ambiguousFd || leadingEnvAssignmentKey(token.text) !== null || LEADING_SHELL_KEYWORDS.has(token.text)) {
+      index++;
+      continue;
+    }
+    break;
+  }
+  return run.slice(index);
+}
+__name(runFromProgramWord, "runFromProgramWord");
+function readFunctionName(run) {
+  const body = runFromProgramWord(run);
+  if (body.length === 0) return void 0;
+  const first = body[0].text;
+  if (first.endsWith("()") && first.length > 2) return first.slice(0, -2);
+  if (body[1]?.text === "()") return first;
+  return void 0;
+}
+__name(readFunctionName, "readFunctionName");
+function readAliasDefinitions(run) {
+  const body = runFromProgramWord(run);
+  if (body.length === 0 || executableBaseName(body[0]) !== "alias") return [];
+  const definitions = [];
+  for (const token of body.slice(1)) {
+    const separator = token.text.indexOf("=");
+    if (separator <= 0) continue;
+    definitions.push({
+      name: token.text.slice(0, separator),
+      body: token.text.slice(separator + 1)
+    });
+  }
+  return definitions;
+}
+__name(readAliasDefinitions, "readAliasDefinitions");
+function readDefinition(run) {
+  const body = runFromProgramWord(run);
+  if (body.length === 0) return void 0;
+  const first = body[0].text;
+  const name = first.endsWith("()") ? first.slice(0, -2) : body[1]?.text === "()" ? first : void 0;
+  if (!name) return void 0;
+  const bodyTokens = body.slice(first.endsWith("()") ? 1 : 2).filter((token) => token.text !== "{" && token.text !== "}");
+  if (bodyTokens.length === 0) return void 0;
+  return { name, body: joinArgvTexts(bodyTokens) };
+}
+__name(readDefinition, "readDefinition");
+function analyzeRun(run) {
+  const state = { relocations: [], unresolved: false };
+  let index = 0;
+  let assignments = 0;
+  while (index < run.length && LEADING_SHELL_KEYWORDS.has(run[index].text)) {
+    index++;
+  }
+  while (index < run.length) {
+    const token = run[index];
+    if (leadingEnvAssignmentKey(token.text) !== null) {
+      recordEnvAssignment(token, state);
+      assignments++;
+      index++;
+      continue;
+    }
+    if (token.dynamic) {
+      return { kind: "dynamic-program", rest: run.slice(index), state };
+    }
+    const program = executableBaseName(token);
+    if (program === "command" || program === "builtin") {
+      index++;
+      while (index < run.length && run[index].text.startsWith("-")) index++;
+      continue;
+    }
+    if (EXPORT_BUILTINS.has(program)) {
+      const operands = run.slice(index + 1);
+      for (const operand of operands) recordEnvAssignment(operand, state);
+      return { kind: "export", state, operands };
+    }
+    if (program === "set") {
+      if (requestsAllExport(run, index + 1)) {
+        return { kind: "all-export", state };
+      }
+      if (disablesAllExport(run, index + 1)) {
+        return { kind: "all-export-off", state };
+      }
+    }
+    if (program === "env") {
+      const scan = consumeEnvWrapper(run, index, state);
+      if (scan.undecidable) return { kind: "undecidable" };
+      if (scan.payload !== void 0) {
+        return {
+          kind: "payload",
+          payload: scan.payload,
+          state,
+          propagatesCwd: false
+        };
+      }
+      index = scan.next;
+      continue;
+    }
+    if (program === "sudo") {
+      index = consumeSudoWrapper(run, index, state).next;
+      continue;
+    }
+    if (program === "timeout") {
+      index = consumeTimeoutWrapper(run, index);
+      continue;
+    }
+    if (program === "eval") {
+      const payloadTokens = run.slice(index + 1);
+      if (payloadTokens.some(
+        (payloadToken) => payloadToken.dynamic || payloadToken.ambiguousFd
+      )) {
+        return { kind: "undecidable" };
+      }
+      return {
+        kind: "payload",
+        payload: joinTokenTexts(payloadTokens),
+        state,
+        // `eval` runs in the current shell, so a `cd` inside the payload
+        // relocates subsequent commands in this run's scope.
+        propagatesCwd: true
+      };
+    }
+    if (SHELL_WRAPPER_PROGRAMS.has(program)) {
+      const scan = consumeShellWrapper(run, index);
+      if (scan.kind === "none") {
+        return { kind: "other", state, assignmentsOnly: false };
+      }
+      if (scan.kind === "dynamic") return { kind: "undecidable" };
+      return {
+        kind: "payload",
+        payload: scan.payload,
+        state,
+        propagatesCwd: false,
+        // Only bash imports `export -f` functions, and only when it inherits
+        // the environment carrying them — `env -i bash -c` wipes them first.
+        importsExportedFunctions: program === "bash" && !state.clearsEnvironment
+      };
+    }
+    if (program === "nohup" || program === "exec") {
+      index++;
+      continue;
+    }
+    if (program === "git") {
+      return { kind: "git", tokens: run.slice(index), state };
+    }
+    if (program === "cd" || program === "pushd" || program === "popd") {
+      return {
+        kind: "cd",
+        variant: program,
+        target: findChdirTarget(run, index + 1, program),
+        // `cd -P` resolves each component through its symlinks before
+        // applying `..`, which a lexical resolve cannot reproduce.
+        physical: run.slice(index + 1).some((token2) => /^-[A-Za-z]*P/.test(token2.text))
+      };
+    }
+    return { kind: "other", state, assignmentsOnly: false };
+  }
+  return { kind: "other", state, assignmentsOnly: assignments > 0 };
+}
+__name(analyzeRun, "analyzeRun");
+function readGitInvocation(tokens) {
+  const cwdTargets = [];
+  const gitDirTargets = [];
+  const workTreeTargets = [];
+  let subcommand;
+  let unresolved = false;
+  let dangerousConfig = false;
+  const recordConfigAssignment = /* @__PURE__ */ __name((value) => {
+    const separator = value.indexOf("=");
+    const key = (separator >= 0 ? value.slice(0, separator) : value).toLowerCase();
+    const assignment = separator >= 0 ? value.slice(separator + 1) : "";
+    if (GIT_COMMAND_CONFIG_KEY_PATTERNS.some((pattern) => pattern.test(key)) || assignment.trimStart().startsWith("!")) {
+      dangerousConfig = true;
+    }
+  }, "recordConfigAssignment");
+  const pushRelocation = /* @__PURE__ */ __name((kind, value, emptyIsNoop) => {
+    if (value === void 0) {
+      unresolved = true;
+      return false;
+    }
+    if (value.text === "" && !value.dynamic) {
+      if (emptyIsNoop) return true;
+      unresolved = true;
+      return false;
+    }
+    if (isDynamicPathValue(value)) {
+      unresolved = true;
+      return true;
+    }
+    if (kind === "cwd") cwdTargets.push(value);
+    else if (kind === "git-dir") gitDirTargets.push(value);
+    else workTreeTargets.push(value);
+    return true;
+  }, "pushRelocation");
+  let index = 1;
+  while (index < tokens.length) {
+    const token = tokens[index];
+    if (token.redirect || token.ambiguousFd) {
+      index++;
+      continue;
+    }
+    if (token.dynamic || BRACE_EXPANSION_PATTERN.test(token.text)) {
+      unresolved = true;
+      index++;
+      continue;
+    }
+    if (token.text === "-C") {
+      if (!pushRelocation("cwd", tokens[index + 1], true)) break;
+      index += 2;
+      continue;
+    }
+    if (token.text === "--git-dir" || token.text === "--work-tree") {
+      const kind = token.text === "--git-dir" ? "git-dir" : "work-tree";
+      if (!pushRelocation(kind, tokens[index + 1], false)) break;
+      index += 2;
+      continue;
+    }
+    if (token.text.length > 2 && token.text.startsWith("-C")) {
+      if (!pushRelocation(
+        "cwd",
+        { text: token.text.slice(2), dynamic: false },
+        false
+      )) {
+        break;
+      }
+      index++;
+      continue;
+    }
+    if (token.text.startsWith("--git-dir=") || token.text.startsWith("--work-tree=")) {
+      const kind = token.text.startsWith("--git-dir=") ? "git-dir" : "work-tree";
+      const value = token.text.slice(token.text.indexOf("=") + 1);
+      if (!pushRelocation(kind, { text: value, dynamic: false }, false)) {
+        break;
+      }
+      index++;
+      continue;
+    }
+    if (token.text === "-c" || token.text === "--config-env") {
+      const value = tokens[index + 1];
+      if (value === void 0) break;
+      if (value.dynamic) dangerousConfig = true;
+      else recordConfigAssignment(value.text);
+      index += 2;
+      continue;
+    }
+    if (token.text.startsWith("--config-env=")) {
+      recordConfigAssignment(token.text.slice("--config-env=".length));
+      index++;
+      continue;
+    }
+    if (token.text.length > 2 && token.text.startsWith("-c") && !token.text.startsWith("--")) {
+      recordConfigAssignment(token.text.slice(2));
+      index++;
+      continue;
+    }
+    if (GIT_GLOBAL_OPTIONS_WITH_VALUES.has(token.text)) {
+      if (tokens[index + 1] === void 0) break;
+      index += 2;
+      continue;
+    }
+    if (token.text.startsWith("-")) {
+      index++;
+      continue;
+    }
+    subcommand = token.text;
+    break;
+  }
+  const hasDisqualifyingFlag = tokens.some((token) => {
+    const separator = token.text.indexOf("=");
+    const flag = separator >= 0 ? token.text.slice(0, separator) : token.text;
+    return RELOCATED_READ_ONLY_DISQUALIFYING_FLAGS.has(flag);
+  });
+  return {
+    cwdTargets,
+    gitDirTargets,
+    workTreeTargets,
+    subcommand,
+    unresolved,
+    dangerousConfig,
+    hasDisqualifyingFlag
+  };
+}
+__name(readGitInvocation, "readGitInvocation");
+async function resolveGitDirRepository(canonicalGitDir) {
+  let current = canonicalGitDir;
+  for (let depth = 0; depth < 3; depth++) {
+    const stats = await stat(current);
+    if (stats.isFile()) {
+      const [firstLine] = (await readFile(current, "utf8")).split(/\r?\n/);
+      const match = /^gitdir:\s*(.+)$/.exec(firstLine ?? "");
+      if (!match) throw new Error("unrecognized gitfile");
+      current = path.resolve(path.dirname(current), match[1].trim());
+      continue;
+    }
+    if (path.basename(current) === ".git") {
+      return path.dirname(current);
+    }
+    if (/[/\\]\.git[/\\]worktrees[/\\][^/\\]+$/.test(current)) {
+      const worktreeGitPointer = (await readFile(path.join(current, "gitdir"), "utf8")).trim();
+      if (!worktreeGitPointer) throw new Error("empty worktree gitdir file");
+      return path.dirname(path.resolve(current, worktreeGitPointer));
+    }
+    return current;
+  }
+  throw new Error("gitdir indirection too deep");
+}
+__name(resolveGitDirRepository, "resolveGitDirRepository");
+async function resolvePhysicalPath(base, target) {
+  let current = path.isAbsolute(target) ? path.parse(target).root : base;
+  const separators = path.sep === "\\" ? /[\\/]+/ : /\/+/;
+  for (const segment of target.split(separators)) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      current = path.dirname(await realpathNearestExistingAsync(current));
+      continue;
+    }
+    current = await realpathNearestExistingAsync(path.join(current, segment));
+  }
+  return current;
+}
+__name(resolvePhysicalPath, "resolvePhysicalPath");
+async function resolveDiscoveredRepository(startDirectory, boundary) {
+  let current = startDirectory;
+  for (let depth = 0; depth < 64; depth++) {
+    const candidate = path.join(current, ".git");
+    let exists = true;
+    try {
+      await stat(candidate);
+    } catch {
+      exists = false;
+    }
+    if (exists) {
+      return resolveGitDirRepository(
+        await realpathNearestExistingAsync(candidate)
+      );
+    }
+    if (current === boundary) return void 0;
+    const parent = path.dirname(current);
+    if (parent === current) return void 0;
+    current = parent;
+  }
+  return void 0;
+}
+__name(resolveDiscoveredRepository, "resolveDiscoveredRepository");
+async function evaluateGitInvocation(invocation, state, basisCwd, entryCwd, context) {
+  if (invocation.unresolved || invocation.dangerousConfig || state.unresolved || context.ambientUnresolved) {
+    return denyDynamicRelocation();
+  }
+  if (RELOCATED_READ_ONLY_GIT_SUBCOMMANDS.has(invocation.subcommand ?? "") && !invocation.hasDisqualifyingFlag) {
+    return void 0;
+  }
+  const cwdRelocations = [];
+  const repositoryRelocations = [];
+  for (const relocation of [
+    ...context.ambientRelocations,
+    ...state.relocations
+  ]) {
+    if (relocation.kind === "cwd") cwdRelocations.push(relocation);
+    else repositoryRelocations.push(relocation);
+  }
+  for (const target of invocation.cwdTargets) {
+    cwdRelocations.push({ target: target.text, kind: "cwd" });
+  }
+  for (const target of invocation.gitDirTargets) {
+    repositoryRelocations.push({ target: target.text, kind: "git-dir" });
+  }
+  for (const target of invocation.workTreeTargets) {
+    repositoryRelocations.push({ target: target.text, kind: "work-tree" });
+  }
+  const relocated = basisCwd === void 0 || basisCwd !== entryCwd || cwdRelocations.length > 0 || repositoryRelocations.length > 0;
+  if (!relocated) {
+    return basisCwd === void 0 ? void 0 : denyOutsideDiscoveredRepository(basisCwd, context);
+  }
+  let gitCwd = basisCwd;
+  for (const relocation of cwdRelocations) {
+    if (gitCwd === void 0 && !path.isAbsolute(relocation.target)) break;
+    gitCwd = await resolvePhysicalPath(gitCwd ?? "", relocation.target);
+  }
+  if (gitCwd === void 0) {
+    return denyDynamicRelocation();
+  }
+  const checkedTargets = [];
+  for (const relocation of repositoryRelocations) {
+    checkedTargets.push({
+      target: path.isAbsolute(relocation.target) ? relocation.target : path.resolve(gitCwd, relocation.target),
+      kind: relocation.kind
+    });
+  }
+  if (basisCwd === void 0 || basisCwd !== entryCwd || cwdRelocations.length > 0) {
+    checkedTargets.push({ target: gitCwd, kind: "cwd" });
+  }
+  for (const { target, kind } of checkedTargets) {
+    const canonicalTarget = await realpathNearestExistingAsync(target);
+    let repositoryTarget;
+    if (kind === "git-dir") {
+      try {
+        repositoryTarget = await resolveGitDirRepository(canonicalTarget);
+      } catch {
+        return denyTarget(UNRESOLVED_TARGET_DENIAL_PREFIX, canonicalTarget);
+      }
+    } else {
+      try {
+        await realpath(canonicalTarget);
+        repositoryTarget = canonicalTarget;
+      } catch {
+        return denyTarget(UNRESOLVED_TARGET_DENIAL_PREFIX, canonicalTarget);
+      }
+    }
+    repositoryTarget = await realpathNearestExistingAsync(repositoryTarget);
+    if (!isWithinRoot(repositoryTarget, context.canonicalEffectiveCwd)) {
+      return denyTarget(OUTSIDE_TARGET_DENIAL_PREFIX, repositoryTarget);
+    }
+  }
+  if (repositoryRelocations.every((relocation) => relocation.kind !== "git-dir")) {
+    const denial = await denyOutsideDiscoveredRepository(gitCwd, context);
+    if (denial) return denial;
+  }
+  return void 0;
+}
+__name(evaluateGitInvocation, "evaluateGitInvocation");
+async function denyOutsideDiscoveredRepository(startDirectory, context) {
+  const canonicalStart = await realpathNearestExistingAsync(startDirectory);
+  let discovered;
+  try {
+    discovered = await resolveDiscoveredRepository(
+      canonicalStart,
+      context.canonicalEffectiveCwd
+    );
+  } catch {
+    return denyTarget(UNRESOLVED_TARGET_DENIAL_PREFIX, canonicalStart);
+  }
+  if (discovered === void 0) return void 0;
+  const canonicalDiscovered = await realpathNearestExistingAsync(discovered);
+  if (!isWithinRoot(canonicalDiscovered, context.canonicalEffectiveCwd)) {
+    return denyTarget(OUTSIDE_TARGET_DENIAL_PREFIX, canonicalDiscovered);
+  }
+  return void 0;
+}
+__name(denyOutsideDiscoveredRepository, "denyOutsideDiscoveredRepository");
+function skipAnsiCQuote(segment, start) {
+  let index = start + 2;
+  while (index < segment.length && segment[index] !== "'") {
+    if (segment[index] === "\\") index++;
+    index++;
+  }
+  return index + 1;
+}
+__name(skipAnsiCQuote, "skipAnsiCQuote");
+function extractCommandSubstitutions(segment) {
+  const bodies = [];
+  let single = false;
+  let double = false;
+  let index = 0;
+  while (index < segment.length) {
+    const character = segment[index];
+    if (!single && character === "\\" && index + 1 < segment.length) {
+      index += 2;
+      continue;
+    }
+    if (!single && !double && character === "$" && segment[index + 1] === "'") {
+      index = skipAnsiCQuote(segment, index);
+      continue;
+    }
+    if (!single && character === "$" && segment[index + 1] === "(") {
+      if (segment[index + 2] === "(") {
+        index += 3;
+        continue;
+      }
+      const end = findSubstitutionEnd(segment, index + 2);
+      if (end === -1) return null;
+      bodies.push(segment.slice(index + 2, end));
+      index = end + 1;
+      continue;
+    }
+    if (!single && character === "`") {
+      let end = index + 1;
+      while (end < segment.length && segment[end] !== "`") {
+        if (segment[end] === "\\") end++;
+        end++;
+      }
+      if (end >= segment.length) return null;
+      bodies.push(segment.slice(index + 1, end));
+      index = end + 1;
+      continue;
+    }
+    if (character === "'" && !double) single = !single;
+    else if (character === '"' && !single) double = !double;
+    index++;
+  }
+  return bodies;
+}
+__name(extractCommandSubstitutions, "extractCommandSubstitutions");
+function findSubstitutionEnd(segment, start) {
+  let single = false;
+  let double = false;
+  let depth = 0;
+  for (let index = start; index < segment.length; index++) {
+    const character = segment[index];
+    if (!single && character === "\\") {
+      index++;
+      continue;
+    }
+    if (!single && !double && character === "$" && segment[index + 1] === "'") {
+      index = skipAnsiCQuote(segment, index) - 1;
+      continue;
+    }
+    if (character === "'" && !double) {
+      single = !single;
+      continue;
+    }
+    if (character === '"' && !single) {
+      double = !double;
+      continue;
+    }
+    if (single || double) continue;
+    if (character === "(") depth++;
+    else if (character === ")") {
+      if (depth === 0) return index;
+      depth--;
+    }
+  }
+  return -1;
+}
+__name(findSubstitutionEnd, "findSubstitutionEnd");
+async function evaluateUnrecognizedRun(run, state, basisCwd, context, relink) {
+  if (!run.some((token) => GIT_WORD_PATTERN.test(token.text))) return void 0;
+  if (relink?.gitDir) {
+    return { allowed: false, reason: UNRECOGNIZED_PROGRAM_DENIAL };
+  }
+  const gitIndex = run.findIndex(
+    (token) => executableBaseName(token) === "git"
+  );
+  if (gitIndex >= 0 && readGitInvocation(run.slice(gitIndex)).dangerousConfig) {
+    return { allowed: false, reason: UNRECOGNIZED_PROGRAM_DENIAL };
+  }
+  const ownsCFlag = run.length > 0 && PROGRAMS_WITH_OWN_C_FLAG.has(executableBaseName(run[0]));
+  if (!ownsCFlag && hasGitRelocationMarker(run) || run.some(
+    (token) => (ownsCFlag ? TEXT_RELOCATION_MARKER_WITHOUT_C_PATTERN : TEXT_RELOCATION_MARKER_PATTERN).test(token.text)
+  ) || state.relocations.length > 0 || state.unresolved || context.ambientRelocations.length > 0 || context.ambientUnresolved) {
+    return { allowed: false, reason: UNRECOGNIZED_PROGRAM_DENIAL };
+  }
+  if (basisCwd === void 0) {
+    return { allowed: false, reason: UNRECOGNIZED_PROGRAM_DENIAL };
+  }
+  const canonicalBasis = await realpathNearestExistingAsync(basisCwd);
+  if (!isWithinRoot(canonicalBasis, context.canonicalEffectiveCwd)) {
+    return denyTarget(OUTSIDE_TARGET_DENIAL_PREFIX, canonicalBasis);
+  }
+  return denyOutsideDiscoveredRepository(canonicalBasis, context);
+}
+__name(evaluateUnrecognizedRun, "evaluateUnrecognizedRun");
+function stripHeredocBodies(command) {
+  const lines = command.split("\n");
+  const out = [];
+  for (let index = 0; index < lines.length; index++) {
+    const line = lines[index];
+    out.push(line);
+    const match = /<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/.exec(line);
+    if (!match) continue;
+    const delimiter = match[2];
+    const stripTabs = line.includes("<<-");
+    while (index + 1 < lines.length) {
+      index++;
+      const body = lines[index];
+      const trimmed = stripTabs ? body.replace(/^\t+/, "") : body;
+      if (trimmed === delimiter) break;
+    }
+  }
+  return out.join("\n");
+}
+__name(stripHeredocBodies, "stripHeredocBodies");
+function readTopLevelSeparators(command) {
+  const separators = [];
+  let single = false;
+  let double = false;
+  let backtick = false;
+  let substitution = 0;
+  const quoteStack = [];
+  for (let index = 0; index < command.length; index++) {
+    const character = command[index];
+    const next = command[index + 1];
+    if (!single && character === "\\" && index + 1 < command.length) {
+      index++;
+      continue;
+    }
+    if (!single && character === "`") {
+      backtick = !backtick;
+      continue;
+    }
+    if (!single && !backtick && character === "$" && next === "(") {
+      quoteStack.push([single, double]);
+      single = false;
+      double = false;
+      substitution++;
+      index++;
+      continue;
+    }
+    if (!backtick && substitution > 0 && character === ")" && !single && !double) {
+      const enclosing = quoteStack.pop();
+      single = enclosing?.[0] ?? false;
+      double = enclosing?.[1] ?? false;
+      substitution--;
+      continue;
+    }
+    if (!backtick && character === "'" && !double) {
+      single = !single;
+      continue;
+    }
+    if (!backtick && character === '"' && !single) {
+      double = !double;
+      continue;
+    }
+    if (single || double || backtick || substitution > 0) continue;
+    if (character === "&" && next === "&") {
+      separators.push("&&");
+      index++;
+    } else if (character === "&" && next === ">") {
+      index += command[index + 2] === ">" ? 2 : 1;
+    } else if (character === "&" && (command[index - 1] === ">" || command[index - 1] === "<")) {
+    } else if (character === "&") {
+      separators.push("&");
+    } else if (character === "|" && next === "|") {
+      separators.push("||");
+      index++;
+    } else if (character === "|") {
+      separators.push(command[index - 1] === ">" ? ">|" : "|");
+    } else if (character === ";") {
+      separators.push(";");
+    } else if (character === "\n") {
+      separators.push("\n");
+    }
+  }
+  return separators;
+}
+__name(readTopLevelSeparators, "readTopLevelSeparators");
+async function evaluateCommandWithCwd(command, startCwd, entryCwd, context, depth, scope = { relink: { targets: [], gitDir: false } }) {
+  let trackedCwd = startCwd;
+  const exported = { relocations: [], unresolved: false };
+  let allExport = scope.allExport ?? false;
+  const shellLocals = scope.locals ?? /* @__PURE__ */ new Map();
+  const definedBodies = scope.definedBodies ?? /* @__PURE__ */ new Map();
+  const exportedNames = scope.exportedNames ?? /* @__PURE__ */ new Set();
+  const gitShapedNames = scope.gitShapedNames ?? /* @__PURE__ */ new Set();
+  const exportedFunctions = scope.exportedFunctions ?? /* @__PURE__ */ new Set();
+  let insideDefinition;
+  let definitionBody = "";
+  const relinkedTargets = scope.relink.targets;
+  const activeContext = /* @__PURE__ */ __name(() => exported.relocations.length > 0 || exported.unresolved ? {
+    canonicalEffectiveCwd: context.canonicalEffectiveCwd,
+    ambientRelocations: [
+      ...context.ambientRelocations,
+      ...exported.relocations
+    ],
+    ambientUnresolved: context.ambientUnresolved || exported.unresolved
+  } : context, "activeContext");
+  let subshellDepth = 0;
+  const snapshotShellState = /* @__PURE__ */ __name(() => ({
+    cwd: trackedCwd,
+    relocations: [...exported.relocations],
+    unresolved: exported.unresolved,
+    allExport,
+    locals: [...shellLocals]
+  }), "snapshotShellState");
+  const restoreShellState = /* @__PURE__ */ __name((snapshot) => {
+    if (snapshot === void 0) return;
+    trackedCwd = snapshot.cwd;
+    exported.relocations.length = 0;
+    exported.relocations.push(...snapshot.relocations);
+    exported.unresolved = snapshot.unresolved;
+    allExport = snapshot.allExport;
+    shellLocals.clear();
+    for (const [key, token] of snapshot.locals) shellLocals.set(key, token);
+  }, "restoreShellState");
+  const subshellCwds = [];
+  const invokeDefinedBody = /* @__PURE__ */ __name(async (programToken, run) => {
+    const defined = definedBodies.get(programToken);
+    if (depth >= MAX_PAYLOAD_RECURSION_DEPTH) return denyDynamicRelocation();
+    let replay = defined.body;
+    const programIndex = run.findIndex(
+      (token) => !token.redirect && !token.ambiguousFd && token.text === programToken
+    );
+    if (defined.alias) {
+      const args = joinArgvTexts(run.slice(programIndex + 1));
+      if (args.length > 0) replay = `${replay} ${args}`;
+    }
+    const prefix = { relocations: [], unresolved: false };
+    for (const token of run.slice(0, programIndex)) {
+      if (leadingEnvAssignmentKey(token.text) !== null) {
+        recordEnvAssignment(token, prefix);
+      }
+    }
+    const base = activeContext();
+    const bodyContext = prefix.relocations.length > 0 || prefix.unresolved ? {
+      canonicalEffectiveCwd: base.canonicalEffectiveCwd,
+      ambientRelocations: [
+        ...base.ambientRelocations,
+        ...prefix.relocations
+      ],
+      ambientUnresolved: base.ambientUnresolved || prefix.unresolved
+    } : base;
+    const nested = await evaluateCommandWithCwd(
+      replay,
+      trackedCwd,
+      entryCwd,
+      bodyContext,
+      depth + 1,
+      {
+        relink: scope.relink,
+        locals: shellLocals,
+        exportedNames,
+        allExport,
+        definedBodies,
+        gitShapedNames,
+        exportedFunctions
+      }
+    );
+    if (nested.denial) return nested.denial;
+    trackedCwd = nested.cwdAfter;
+    if (nested.exportedAfter) {
+      exported.relocations.push(...nested.exportedAfter.relocations);
+      if (nested.exportedAfter.unresolved) exported.unresolved = true;
+    }
+    if (nested.allExportAfter !== void 0) allExport = nested.allExportAfter;
+    for (const [key, token] of nested.shellLocalsAfter ?? []) {
+      shellLocals.set(key, token);
+    }
+    return void 0;
+  }, "invokeDefinedBody");
+  const segments = splitCommands(stripHeredocBodies(command));
+  const separators = readTopLevelSeparators(stripHeredocBodies(command));
+  const separatorsMatch = separators.length === segments.length - 1;
+  const isPipeComponent = /* @__PURE__ */ __name((index) => separatorsMatch ? (
+    // Both sides of a pipe run in subshells; for `&` only the segment it
+    // follows (the backgrounded one) does — the next segment is
+    // foreground.
+    separators[index - 1] === "|" || separators[index] === "|" || separators[index] === "&"
+  ) : (
+    // Structural disagreement with `splitCommands`: scope every segment
+    // rather than guess which ones ran in a subshell.
+    separators.some((separator) => separator === "|" || separator === "&")
+  ), "isPipeComponent");
+  for (const [segmentIndex, segment] of segments.entries()) {
+    const pipeComponent = isPipeComponent(segmentIndex);
+    const cwdBeforeSegment = trackedCwd;
+    const definedBodiesBefore = pipeComponent ? new Map(definedBodies) : void 0;
+    const gitShapedNamesBefore = pipeComponent ? new Set(gitShapedNames) : void 0;
+    const exportedNamesBefore = pipeComponent ? new Set(exportedNames) : void 0;
+    const exportedFunctionsBefore = pipeComponent ? new Set(exportedFunctions) : void 0;
+    const shellLocalsBefore = pipeComponent ? new Map(shellLocals) : void 0;
+    const exportedBefore = pipeComponent ? {
+      relocations: [...exported.relocations],
+      unresolved: exported.unresolved
+    } : void 0;
+    const allExportBefore = allExport;
+    const substitutions = extractCommandSubstitutions(segment);
+    const tokenized = substitutions === null ? null : tokenizeSegment(segment, subshellDepth);
+    const runs = tokenized?.runs ?? null;
+    if (runs === null) {
+      return {
+        denial: { allowed: false, reason: UNPARSEABLE_COMMAND_DENIAL },
+        cwdAfter: trackedCwd
+      };
+    }
+    const functionHeader = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*\(\s*\)/.exec(segment) ?? // The `function NAME` keyword form, with the `()` optional.
+    /^\s*function\s+([A-Za-z_][A-Za-z0-9_]*)\b/.exec(segment);
+    if (functionHeader) {
+      insideDefinition = functionHeader[1];
+      const braceAt = segment.indexOf("{");
+      definitionBody = braceAt >= 0 ? segment.slice(braceAt + 1) : "";
+    } else if (insideDefinition !== void 0) {
+      definitionBody += `
+${segment}`;
+    }
+    if (insideDefinition !== void 0) {
+      if (segment.includes("}")) {
+        const closeAt = definitionBody.lastIndexOf("}");
+        const body = (closeAt >= 0 ? definitionBody.slice(0, closeAt) : definitionBody).trim();
+        if (body.length > 0 && !pipeComponent) {
+          definedBodies.set(insideDefinition, { body, alias: false });
+        }
+        insideDefinition = void 0;
+      }
+      continue;
+    }
+    for (const body of substitutions) {
+      if (depth >= MAX_PAYLOAD_RECURSION_DEPTH) {
+        return { denial: denyDynamicRelocation(), cwdAfter: trackedCwd };
+      }
+      const nested = await evaluateCommandWithCwd(
+        body,
+        trackedCwd,
+        entryCwd,
+        activeContext(),
+        depth + 1,
+        // A substitution runs in a subshell: it inherits the variables, the
+        // option state and the definitions, but its own changes die with it,
+        // so it gets copies and nothing is merged back.
+        {
+          relink: scope.relink,
+          locals: new Map(shellLocals),
+          exportedNames: new Set(exportedNames),
+          allExport,
+          definedBodies: new Map(definedBodies),
+          gitShapedNames: new Set(gitShapedNames),
+          // A subshell inherits `export -f` functions too; copy so its own
+          // definitions and removals die with it.
+          exportedFunctions: new Set(exportedFunctions)
+        }
+      );
+      if (nested.denial) {
+        return { denial: nested.denial, cwdAfter: trackedCwd };
+      }
+    }
+    for (const { tokens: run, depth: runDepth } of runs) {
+      while (runDepth > subshellDepth) {
+        subshellCwds.push(snapshotShellState());
+        subshellDepth++;
+      }
+      while (runDepth < subshellDepth) {
+        restoreShellState(subshellCwds.pop());
+        subshellDepth--;
+      }
+      let removalStart = 0;
+      const skipRedirectOperands = /* @__PURE__ */ __name(() => {
+        while (removalStart < run.length && (run[removalStart].redirect || run[removalStart].ambiguousFd)) {
+          removalStart++;
+        }
+      }, "skipRedirectOperands");
+      skipRedirectOperands();
+      let hasCommandPrefix = false;
+      while (removalStart < run.length && (run[removalStart].text === "command" || run[removalStart].text === "builtin")) {
+        if (definedBodies.has(run[removalStart].text)) break;
+        hasCommandPrefix = true;
+        removalStart++;
+        while (removalStart < run.length && (run[removalStart].text.startsWith("-") || run[removalStart].redirect || run[removalStart].ambiguousFd)) {
+          removalStart++;
+        }
+      }
+      const removalTokens = run.slice(removalStart);
+      const removalProgram = readProgramWord(removalTokens);
+      const shadowedBuiltin = !hasCommandPrefix && removalProgram !== void 0 && definedBodies.has(removalProgram);
+      const isRemoval = !shadowedBuiltin && (removalProgram === "unset" || removalProgram === "unalias" || removalProgram === "export" && removalTokens.some((token) => /^-[A-Za-z]*n/.test(token.text)));
+      if (isRemoval) {
+        const clearsAll = removalTokens.some(
+          (token) => /^-[A-Za-z]*a/.test(token.text)
+        );
+        const touchesShadow = /* @__PURE__ */ __name((name) => definedBodies.has(name) || gitShapedNames.has(name) || exportedFunctions.has(name), "touchesShadow");
+        const anyShadow = definedBodies.size > 0 || gitShapedNames.size > 0 || exportedFunctions.size > 0;
+        const retractsShadow = clearsAll && anyShadow || removalTokens.slice(1).some(
+          (token) => !token.text.startsWith("-") && (token.dynamic || touchesShadow(token.text))
+        );
+        if (retractsShadow) {
+          return {
+            denial: { allowed: false, reason: SHADOW_REMOVAL_DENIAL },
+            cwdAfter: trackedCwd
+          };
+        }
+        if (removalProgram === "unset" && !removalTokens.some((token) => token.text === "-f")) {
+          for (const token of removalTokens.slice(1)) {
+            if (!token.text.startsWith("-")) shellLocals.delete(token.text);
+          }
+        }
+        continue;
+      }
+      const invoked = readProgramWord(run);
+      if (invoked !== void 0 && definedBodies.has(invoked) && readFunctionName(run) === void 0 && readAliasDefinitions(run).length === 0) {
+        const denial = await invokeDefinedBody(invoked, run);
+        if (denial) return { denial, cwdAfter: trackedCwd };
+        continue;
+      }
+      const analysis = analyzeRun(run);
+      switch (analysis.kind) {
+        case "cd": {
+          const target = analysis.target === void 0 ? void 0 : expandShellLocals(analysis.target, shellLocals);
+          if (analysis.variant === "popd" || target === void 0) {
+            trackedCwd = void 0;
+            break;
+          }
+          if (isDynamicPathValue(target)) {
+            trackedCwd = void 0;
+            break;
+          }
+          if (analysis.physical) {
+            trackedCwd = trackedCwd === void 0 && !path.isAbsolute(target.text) ? void 0 : await resolvePhysicalPath(trackedCwd ?? "", target.text);
+            break;
+          }
+          if (path.isAbsolute(target.text)) {
+            trackedCwd = target.text;
+            break;
+          }
+          trackedCwd = trackedCwd === void 0 ? void 0 : path.resolve(trackedCwd, target.text);
+          break;
+        }
+        case "payload": {
+          if (depth >= MAX_PAYLOAD_RECURSION_DEPTH) {
+            return { denial: denyDynamicRelocation(), cwdAfter: trackedCwd };
+          }
+          const inherited = activeContext();
+          const ambient = {
+            canonicalEffectiveCwd: inherited.canonicalEffectiveCwd,
+            ambientRelocations: [
+              ...inherited.ambientRelocations,
+              ...analysis.state.relocations
+            ],
+            ambientUnresolved: inherited.ambientUnresolved || analysis.state.unresolved
+          };
+          const nested = await evaluateCommandWithCwd(
+            analysis.payload,
+            trackedCwd,
+            entryCwd,
+            ambient,
+            depth + 1,
+            {
+              relink: scope.relink,
+              // `eval` runs in this very shell, so it sees these variables
+              // and the export attributes; a `sh -c` subprocess inherits only
+              // exported ones.
+              ...analysis.propagatesCwd ? {
+                locals: shellLocals,
+                exportedNames,
+                allExport,
+                definedBodies,
+                gitShapedNames,
+                exportedFunctions
+              } : analysis.importsExportedFunctions ? {
+                // Only bash imports `export -f` functions. A `-c`
+                // subprocess is a separate process: copy the set so a
+                // child `unset -f` cannot retract the parent's exports,
+                // and drop any function whose `BASH_FUNC_*` entry an
+                // `env -u` stripped before the child started.
+                definedBodies: new Map(
+                  [...definedBodies].filter(
+                    ([name]) => exportedFunctions.has(name) && !envUnsetRemovesFunction(name, analysis.state)
+                  )
+                ),
+                exportedFunctions: new Set(
+                  [...exportedFunctions].filter(
+                    (name) => !envUnsetRemovesFunction(name, analysis.state)
+                  )
+                )
+              } : {}
+            }
+          );
+          if (nested.denial) {
+            return { denial: nested.denial, cwdAfter: trackedCwd };
+          }
+          if (analysis.propagatesCwd) {
+            trackedCwd = nested.cwdAfter;
+            if (nested.exportedAfter) {
+              exported.relocations.push(...nested.exportedAfter.relocations);
+              if (nested.exportedAfter.unresolved) exported.unresolved = true;
+            }
+            if (nested.allExportAfter !== void 0) {
+              allExport = nested.allExportAfter;
+            }
+            for (const [key, token] of nested.shellLocalsAfter ?? []) {
+              shellLocals.set(key, token);
+            }
+          }
+          break;
+        }
+        case "git": {
+          const invocation = readGitInvocation(analysis.tokens);
+          const resolvedRelocations = [
+            ...invocation.cwdTargets,
+            ...invocation.gitDirTargets,
+            ...invocation.workTreeTargets
+          ].map(
+            (target) => trackedCwd === void 0 ? target.text : path.resolve(trackedCwd, target.text)
+          );
+          if (trackedCwd !== void 0 && trackedCwd !== entryCwd) {
+            resolvedRelocations.push(trackedCwd);
+          }
+          if (scope.relink.gitDir || resolvedRelocations.some(
+            (target) => relinkedTargets.some(
+              (relinked) => target === relinked || isWithinRoot(target, relinked) || isWithinRoot(relinked, target)
+            )
+          )) {
+            return {
+              denial: denyDynamicRelocation(),
+              cwdAfter: trackedCwd
+            };
+          }
+          const denial = await evaluateGitInvocation(
+            invocation,
+            analysis.state,
+            trackedCwd,
+            entryCwd,
+            activeContext()
+          );
+          if (denial) return { denial, cwdAfter: trackedCwd };
+          break;
+        }
+        case "dynamic-program": {
+          const inherited = activeContext();
+          const expanded = analysis.rest.map(
+            (token) => expandShellLocals(token, shellLocals)
+          );
+          for (const operand of expanded) {
+            if (operand.text.startsWith("-") || operand.dynamic) continue;
+            if (trackedCwd === void 0) {
+              scope.relink.gitDir = true;
+              continue;
+            }
+            const resolved = path.resolve(trackedCwd, operand.text);
+            if (path.basename(resolved) === ".git") scope.relink.gitDir = true;
+            else relinkedTargets.push(resolved);
+          }
+          if (analysis.state.unresolved || analysis.state.relocations.length > 0 || inherited.ambientUnresolved || inherited.ambientRelocations.length > 0 || hasGitRelocationMarker(expanded) || expanded.some(
+            (token) => TEXT_RELOCATION_MARKER_PATTERN.test(token.text)
+          )) {
+            return { denial: denyDynamicRelocation(), cwdAfter: trackedCwd };
+          }
+          if (trackedCwd === void 0 || !isWithinRoot(
+            await realpathNearestExistingAsync(trackedCwd),
+            inherited.canonicalEffectiveCwd
+          )) {
+            return { denial: denyDynamicRelocation(), cwdAfter: trackedCwd };
+          }
+          const denial = await evaluateUnrecognizedRun(
+            expanded,
+            analysis.state,
+            trackedCwd,
+            inherited,
+            scope.relink
+          );
+          if (denial) return { denial, cwdAfter: trackedCwd };
+          break;
+        }
+        case "undecidable":
+          return {
+            denial: { allowed: false, reason: UNDECIDABLE_PAYLOAD_DENIAL },
+            cwdAfter: trackedCwd
+          };
+        case "export": {
+          exported.relocations.push(...analysis.state.relocations);
+          if (analysis.state.unresolved) exported.unresolved = true;
+          if (analysis.operands.some((op) => op.text === "-f")) {
+            for (const op of analysis.operands) {
+              if (!op.text.startsWith("-") && !op.dynamic) {
+                exportedFunctions.add(op.text);
+              }
+            }
+          }
+          for (const operand of analysis.operands) {
+            if (leadingEnvAssignmentKey(operand.text) !== null) continue;
+            if (operand.dynamic) {
+              exported.unresolved = true;
+              continue;
+            }
+            const pending = shellLocals.get(operand.text);
+            if (pending) recordEnvAssignment(pending, exported);
+            if (GIT_DIR_ENV_KEYS.has(operand.text) || GIT_WORK_TREE_ENV_KEYS.has(operand.text) || GIT_UNRESOLVABLE_ENV_KEYS.has(operand.text) || GIT_PROGRAM_ENV_KEYS.has(operand.text)) {
+              exportedNames.add(operand.text);
+            }
+          }
+          const denial = await evaluateUnrecognizedRun(
+            run,
+            analysis.state,
+            trackedCwd,
+            activeContext(),
+            scope.relink
+          );
+          if (denial) return { denial, cwdAfter: trackedCwd };
+          break;
+        }
+        case "all-export":
+          allExport = true;
+          exported.relocations.push(...analysis.state.relocations);
+          if (analysis.state.unresolved) exported.unresolved = true;
+          break;
+        case "all-export-off":
+          allExport = false;
+          break;
+        case "other": {
+          const aliasDefinitions = readAliasDefinitions(run);
+          if (aliasDefinitions.length > 0) {
+            for (const definition2 of aliasDefinitions) {
+              definedBodies.set(definition2.name, {
+                body: definition2.body,
+                alias: true
+              });
+            }
+            break;
+          }
+          const definition = readDefinition(run);
+          if (definition) {
+            definedBodies.set(definition.name, {
+              body: definition.body,
+              alias: false
+            });
+            break;
+          }
+          const programToken = readProgramWord(run);
+          const definitionName = readFunctionName(run);
+          if (definitionName) {
+            if (run.some((token) => GIT_WORD_PATTERN.test(token.text))) {
+              gitShapedNames.add(definitionName);
+            }
+            break;
+          }
+          if (programToken !== void 0 && gitShapedNames.has(programToken)) {
+            const denial2 = await evaluateUnrecognizedRun(
+              [
+                { text: programToken, dynamic: false },
+                { text: "git", dynamic: false }
+              ],
+              analysis.state,
+              trackedCwd,
+              activeContext(),
+              scope.relink
+            );
+            if (denial2) return { denial: denial2, cwdAfter: trackedCwd };
+            break;
+          }
+          if (programToken !== void 0 && definedBodies.has(programToken)) {
+            const denial2 = await invokeDefinedBody(programToken, run);
+            if (denial2) return { denial: denial2, cwdAfter: trackedCwd };
+            break;
+          }
+          if (run.some((t) => PATH_EXTRACTING_PROGRAMS.has(executableBaseName(t)))) {
+            if (trackedCwd !== void 0) relinkedTargets.push(trackedCwd);
+          }
+          if (run.some((t) => PATH_RELINKING_PROGRAMS.has(executableBaseName(t)))) {
+            for (const operand of run) {
+              if (operand.text.startsWith("-")) continue;
+              if (PATH_RELINKING_PROGRAMS.has(executableBaseName(operand))) {
+                continue;
+              }
+              if (operand.dynamic || trackedCwd === void 0) {
+                scope.relink.gitDir = true;
+                continue;
+              }
+              const resolved = path.resolve(trackedCwd, operand.text);
+              relinkedTargets.push(resolved);
+              if (path.basename(resolved) === ".git")
+                scope.relink.gitDir = true;
+            }
+          }
+          if (analysis.assignmentsOnly) {
+            if (allExport) {
+              exported.relocations.push(...analysis.state.relocations);
+              if (analysis.state.unresolved) exported.unresolved = true;
+            } else {
+              for (const token of run) {
+                const key = leadingEnvAssignmentKey(token.text);
+                if (key === null) continue;
+                if (exportedNames.has(key)) {
+                  recordEnvAssignment(token, exported);
+                  continue;
+                }
+                const previous = shellLocals.get(key);
+                if (!isAppendAssignment(token.text) || previous === void 0) {
+                  shellLocals.set(key, token);
+                  continue;
+                }
+                shellLocals.set(key, {
+                  text: previous.text + token.text.slice(token.text.indexOf("=") + 1),
+                  dynamic: previous.dynamic || token.dynamic
+                });
+              }
+            }
+          }
+          const denial = await evaluateUnrecognizedRun(
+            run,
+            analysis.state,
+            trackedCwd,
+            activeContext(),
+            scope.relink
+          );
+          if (denial) return { denial, cwdAfter: trackedCwd };
+          break;
+        }
+        default: {
+          const exhaustive = analysis;
+          void exhaustive;
+          break;
+        }
+      }
+    }
+    while (tokenized.endDepth < subshellDepth) {
+      restoreShellState(subshellCwds.pop());
+      subshellDepth--;
+    }
+    while (tokenized.endDepth > subshellDepth) {
+      subshellCwds.push(snapshotShellState());
+      subshellDepth++;
+    }
+    if (pipeComponent) {
+      trackedCwd = cwdBeforeSegment;
+      allExport = allExportBefore;
+      definedBodies.clear();
+      for (const [k, v] of definedBodiesBefore) definedBodies.set(k, v);
+      gitShapedNames.clear();
+      for (const k of gitShapedNamesBefore) gitShapedNames.add(k);
+      exportedNames.clear();
+      for (const k of exportedNamesBefore) exportedNames.add(k);
+      exportedFunctions.clear();
+      for (const k of exportedFunctionsBefore) exportedFunctions.add(k);
+      shellLocals.clear();
+      for (const [k, v] of shellLocalsBefore) shellLocals.set(k, v);
+      exported.relocations.length = 0;
+      exported.relocations.push(...exportedBefore.relocations);
+      exported.unresolved = exportedBefore.unresolved;
+    }
+  }
+  return {
+    cwdAfter: trackedCwd,
+    exportedAfter: exported,
+    allExportAfter: allExport,
+    shellLocalsAfter: shellLocals
+  };
+}
+__name(evaluateCommandWithCwd, "evaluateCommandWithCwd");
+async function evaluateBuiltInGuard(request) {
+  if (!SHELL_EXECUTING_TOOL_NAMES.has(request.toolName)) return { allowed: true };
+  const command = request.arguments["command"];
+  if (typeof command !== "string") return { allowed: true };
+  const sessionCwd = await realpathNearestExistingAsync(request.effectiveCwd);
+  let canonicalEffectiveCwd = sessionCwd;
+  const reportedCwd = request.invocationCwd;
+  if (typeof reportedCwd === "string" && reportedCwd.length > 0) {
+    const canonicalReported = await realpathNearestExistingAsync(reportedCwd);
+    if (isWithinRoot(canonicalReported, sessionCwd)) {
+      if (canonicalReported !== sessionCwd) {
+        let discovered;
+        try {
+          discovered = await resolveDiscoveredRepository(
+            canonicalReported,
+            sessionCwd
+          );
+        } catch {
+          return denyTarget(
+            UNVERIFIABLE_SCOPE_DENIAL_PREFIX,
+            canonicalReported
+          );
+        }
+        if (discovered !== void 0 && await realpathNearestExistingAsync(discovered) === canonicalReported) {
+          canonicalEffectiveCwd = canonicalReported;
+        }
+      }
+    } else {
+      const ownedWorktrees = await realpathNearestExistingAsync(
+        GitWorktreeService.getWorktreesDir(request.sessionId)
+      );
+      if (!isWithinRoot(canonicalReported, ownedWorktrees)) {
+        return denyTarget(UNVERIFIABLE_SCOPE_DENIAL_PREFIX, canonicalReported);
+      }
+      canonicalEffectiveCwd = canonicalReported;
+    }
+  }
+  let startDirectory = canonicalEffectiveCwd;
+  const startDirectoryValue = request.arguments["directory"];
+  if (typeof startDirectoryValue === "string") {
+    startDirectory = await realpathNearestExistingAsync(
+      path.resolve(canonicalEffectiveCwd, startDirectoryValue)
+    );
+    if (!isWithinRoot(startDirectory, canonicalEffectiveCwd)) {
+      return denyTarget(OUTSIDE_TARGET_DENIAL_PREFIX, startDirectory);
+    }
+  }
+  const { denial } = await evaluateCommandWithCwd(
+    command,
+    startDirectory,
+    startDirectory,
+    {
+      canonicalEffectiveCwd,
+      ambientRelocations: [],
+      ambientUnresolved: false
+    },
+    0
+  );
+  return denial ?? { allowed: true };
+}
+__name(evaluateBuiltInGuard, "evaluateBuiltInGuard");
+function createDaemonToolGuard(externalGuard) {
+  return async (request) => {
+    const trusted = request;
+    if (typeof trusted.effectiveCwd !== "string") {
+      throw new Error("Daemon tool guard requires trusted workspace context.");
+    }
+    const builtInDecision = await evaluateBuiltInGuard(trusted);
+    if (!builtInDecision.allowed || !externalGuard) return builtInDecision;
+    if (trusted.promptId === void 0) {
+      return { allowed: false, reason: PROMPTLESS_PROVIDER_DENIAL };
+    }
+    if (EXTERNAL_GUARD_UNSUPPORTED_TOOLS.has(request.toolName)) {
+      return {
+        allowed: false,
+        reason: "Managed external tool guard v1 does not support nested or delegated agent execution."
+      };
+    }
+    return externalGuard(request);
+  };
+}
+__name(createDaemonToolGuard, "createDaemonToolGuard");
+export {
+  createDaemonToolGuard
+};
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */