claude-warden 2.0.1 → 2.3.2

package/dist/codex-export.cjs

@@ -166,9 +166,9 @@ var require_compose_function = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/shell-lexer.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/shell-lexer.js
 var require_shell_lexer = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/shell-lexer.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/shell-lexer.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var posixShellLexer = (mode, options) => ({
@@ -220,9 +220,9 @@ var require_shell_lexer = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/logger-phase.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/logger-phase.js
 var require_logger_phase = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/logger-phase.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/logger-phase.js"(exports2, module2) {
     "use strict";
     var logger = (name) => () => function* (tokens) {
       for (const tk of tokens) {
@@ -273,9 +273,9 @@ var require_filter_obj = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/operators.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/operators.js
 var require_operators = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/operators.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/operators.js"(exports2, module2) {
     "use strict";
     var operators = {
       "&": "AND",
@@ -300,9 +300,9 @@ var require_operators = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/tokens.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/tokens.js
 var require_tokens = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/tokens.js"(exports2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/tokens.js"(exports2) {
     "use strict";
     var hasOwnProperty = require_has_own_property();
     var filter = require_filter_obj();
@@ -340,7 +340,7 @@ var require_tokens = __commonJS({
     exports2.token = (args2) => new Token(args2);
     function mkToken(type, value, loc, expansion) {
       const tk = new Token({ type, value, loc });
-      if (expansion && expansion.length) {
+      if (expansion && expansion.length > 0) {
         tk.expansion = expansion;
       }
       return tk;
@@ -366,12 +366,15 @@ var require_tokens = __commonJS({
     exports2.setExpansions = (tk, expansion) => tk.setExpansions(expansion);
     exports2.tokenOrEmpty = function tokenOrEmpty(state) {
       if (state.current !== "" && state.current !== "\n") {
-        const expansion = (state.expansion || []).map((xp) => {
-          return Object.assign({}, xp, { loc: {
-            start: xp.loc.start.char - state.loc.start.char,
-            end: xp.loc.end.char - state.loc.start.char
-          } });
-        });
+        const expansion = (state.expansion || []).map(
+          (xp) => (
+            // console.log('aaa', {token: state.loc, xp: xp.loc});
+            Object.assign({}, xp, { loc: {
+              start: xp.loc.start.char - state.loc.start.char,
+              end: xp.loc.end.char - state.loc.start.char
+            } })
+          )
+        );
         const token = mkToken("TOKEN", state.current, {
           start: Object.assign({}, state.loc.start),
           end: Object.assign({}, state.loc.previous)
@@ -420,12 +423,12 @@ var require_tokens = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/is-valid-name.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/is-valid-name.js
 var require_is_valid_name = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/is-valid-name.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/is-valid-name.js"(exports2, module2) {
     "use strict";
     module2.exports = function isValidName(text) {
-      return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(text);
+      return /^[a-zA-Z_]\w*$/.test(text);
     };
   }
 });
@@ -554,9 +557,9 @@ var require_iterable_transform_replace = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/index.js
 var require_utils = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/index.js"(exports2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/index.js"(exports2) {
     "use strict";
     exports2.loggerPhase = require_logger_phase();
     exports2.tokens = require_tokens();
@@ -655,9 +658,9 @@ var require_transform_spread_iterable = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/bash/rules/alias-substitution.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/bash/rules/alias-substitution.js
 var require_alias_substitution = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/bash/rules/alias-substitution.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/bash/rules/alias-substitution.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var identity = require_identity_function();
@@ -667,7 +670,7 @@ var require_alias_substitution = __commonJS({
     var tokens = require_tokens();
     var expandAlias = (preAliasLexer, resolveAlias, reservedWords) => {
       function* tryExpandToken(token, expandingAliases) {
-        if (expandingAliases.indexOf(token.value) !== -1) {
+        if (expandingAliases.includes(token.value)) {
           yield token;
           return;
         }
@@ -693,9 +696,9 @@ var require_alias_substitution = __commonJS({
       const visitor = {
         WORD: expandToken
       };
-      reservedWords.forEach((w) => {
+      for (const w of reservedWords) {
         visitor[w] = expandToken;
-      });
+      }
       return visitor;
     };
     module2.exports = (options, mode, previousPhases) => {
@@ -714,9 +717,9 @@ var require_alias_substitution = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/bash/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/bash/index.js
 var require_bash = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/bash/index.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/bash/index.js"(exports2, module2) {
     "use strict";
     var bashAliasSubstitution = require_alias_substitution();
     var name = "[a-zA-Z_][a-zA-Z0-9_]*";
@@ -727,8 +730,8 @@ var require_bash = __commonJS({
       [`^(${name}):([^:]*):?([^:]*)$`]: {
         op: "substring",
         parameter: (m) => m[1],
-        offset: (m) => parseInt(m[2], 10),
-        length: (m) => parseInt(m[3], 10) || void 0
+        offset: (m) => Number.parseInt(m[2], 10),
+        length: (m) => Number.parseInt(m[3], 10) || void 0
       },
       // Expands to the names of variables whose names begin with prefix,
       // separated by the first character of the IFS special variable.
@@ -806,18 +809,24 @@ var require_bash = __commonJS({
         parameter: (m) => m[1],
         kind: (m) => {
           switch (m[2]) {
-            case "Q":
+            case "Q": {
               return "quoted";
-            case "E":
+            }
+            case "E": {
               return "escape";
-            case "P":
+            }
+            case "P": {
               return "prompt";
-            case "A":
+            }
+            case "A": {
               return "assignment";
-            case "a":
+            }
+            case "a": {
               return "flags";
-            default:
+            }
+            default: {
               return "unknown";
+            }
           }
         }
       },
@@ -830,7 +839,7 @@ var require_bash = __commonJS({
       // performing the complete indirect expansion. The exceptions to this are the expansions
       // of ${!prefix*} and ${!name[@]} described below. The exclamation point must immediately
       // follow the left brace in order to introduce indirection.
-      [`^!(.+)$`]: {
+      "^!(.+)$": {
         op: "indirection",
         word: (m) => m[1],
         parameter: () => void 0
@@ -910,9 +919,9 @@ var require_array_last = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/ast-builder.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/ast-builder.js
 var require_ast_builder = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/ast-builder.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/ast-builder.js"(exports2, module2) {
     "use strict";
     module2.exports = (options) => {
       const builder = {};
@@ -959,7 +968,7 @@ var require_ast_builder = __commonJS({
         return node;
       };
       function isAsyncSeparator(separator) {
-        return separator.text.indexOf("&") !== -1;
+        return separator.text.includes("&");
       }
       const last = require_array_last();
       builder.checkAsync = (list, separator) => {
@@ -981,7 +990,7 @@ var require_ast_builder = __commonJS({
       builder.addRedirections = (compoundCommand, redirectList) => {
         compoundCommand.redirections = redirectList;
         if (options.insertLOC) {
-          const lastRedirect = redirectList[redirectList.length - 1];
+          const lastRedirect = redirectList.at(-1);
           setLocEnd(compoundCommand.loc, lastRedirect.loc);
         }
         return compoundCommand;
@@ -1123,12 +1132,12 @@ var require_ast_builder = __commonJS({
             node.loc.start = command.loc.start;
           }
           if (suffix) {
-            const lastSuffix = suffix[suffix.length - 1];
+            const lastSuffix = suffix.at(-1);
             node.loc.end = lastSuffix.loc.end;
           } else if (command) {
             node.loc.end = command.loc.end;
           } else {
-            const lastPrefix = prefix[prefix.length - 1];
+            const lastPrefix = prefix.at(-1);
             node.loc.end = lastPrefix.loc.end;
           }
         }
@@ -1169,9 +1178,7 @@ var require_ast_builder = __commonJS({
       return target;
     }
     function mkListHelper(builder, listName) {
-      builder[listName] = (item) => {
-        return [item];
-      };
+      builder[listName] = (item) => [item];
       builder[`${listName}Append`] = (list, item) => {
         list.push(item);
         return list;
@@ -1196,9 +1203,9 @@ var require_deep_freeze = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/end.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/end.js
 var require_end = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/end.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/end.js"(exports2, module2) {
     "use strict";
     var eof = require_tokens().eof;
     module2.exports = function end() {
@@ -1210,9 +1217,9 @@ var require_end = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/operator.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/operator.js
 var require_operator = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/operator.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/operator.js"(exports2, module2) {
     "use strict";
     var t = require_tokens();
     var isPartOfOperator = t.isPartOfOperator;
@@ -1257,9 +1264,9 @@ var require_operator = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/comment.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/comment.js
 var require_comment = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/comment.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/comment.js"(exports2, module2) {
     "use strict";
     var newLine = require_tokens().newLine;
     module2.exports = function comment(state, source, reducers) {
@@ -1285,9 +1292,9 @@ var require_comment = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/single-quoting.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/single-quoting.js
 var require_single_quoting = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/single-quoting.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/single-quoting.js"(exports2, module2) {
     "use strict";
     var t = require_tokens();
     var tokenOrEmpty = t.tokenOrEmpty;
@@ -1315,9 +1322,9 @@ var require_single_quoting = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/double-quoting.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/double-quoting.js
 var require_double_quoting = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/double-quoting.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/double-quoting.js"(exports2, module2) {
     "use strict";
     var t = require_tokens();
     var tokenOrEmpty = t.tokenOrEmpty;
@@ -1364,12 +1371,12 @@ var require_double_quoting = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-start.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-start.js
 var require_expansion_start = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-start.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-start.js"(exports2, module2) {
     "use strict";
     function isSpecialParameter(char) {
-      return char.match(/^[0-9\-!@#\?\*\$]$/);
+      return char.match(/^[\d\-!@#?*$]$/);
     }
     module2.exports = function expansionStart(state, source, reducers) {
       const char = source && source.shift();
@@ -1385,7 +1392,7 @@ var require_expansion_start = __commonJS({
           nextState: state.appendChar(char)
         };
       }
-      if (char.match(/[a-zA-Z_]/)) {
+      if (/[a-zA-Z_]/.test(char)) {
         return {
           nextReduction: reducers.expansionParameter,
           nextState: state.appendChar(char).replaceLastExpansion({
@@ -1395,16 +1402,17 @@ var require_expansion_start = __commonJS({
         };
       }
       if (isSpecialParameter(char)) {
-        return reducers.expansionSpecialParameter(state, [char].concat(source));
+        return reducers.expansionSpecialParameter(state, [char].concat(source), reducers);
       }
-      return state.previousReducer(state, [char].concat(source));
+      const cleanState = state.removeLastExpansion();
+      return cleanState.previousReducer(cleanState, [char].concat(source), reducers);
     };
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-tick.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-tick.js
 var require_expansion_command_tick = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-tick.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-tick.js"(exports2, module2) {
     "use strict";
     var last = require_array_last();
     var t = require_tokens();
@@ -1444,9 +1452,9 @@ var require_expansion_command_tick = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/start.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/start.js
 var require_start = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/start.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/start.js"(exports2, module2) {
     "use strict";
     var t = require_tokens();
     var tokenOrEmpty = t.tokenOrEmpty;
@@ -1504,7 +1512,7 @@ var require_start = __commonJS({
           nextState: state.appendChar(char)
         };
       }
-      if (!state.escaping && char.match(/\s/)) {
+      if (!state.escaping && /\s/.test(char)) {
         return {
           nextReduction: reducers.start,
           tokensToEmit: tokenOrEmpty(state),
@@ -1531,9 +1539,9 @@ var require_start = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-arithmetic.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-arithmetic.js
 var require_expansion_arithmetic = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-arithmetic.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-arithmetic.js"(exports2, module2) {
     "use strict";
     var last = require_array_last();
     var t = require_tokens();
@@ -1541,7 +1549,7 @@ var require_expansion_arithmetic = __commonJS({
     module2.exports = function expansionArithmetic(state, source) {
       const char = source && source.shift();
       const xp = last(state.expansion);
-      if (char === ")" && state.current.slice(-1)[0] === ")") {
+      if (char === ")" && state.current.at(-1) === ")") {
         return {
           nextReduction: state.previousReducer,
           nextState: state.appendChar(char).replaceLastExpansion({
@@ -1568,12 +1576,12 @@ var require_expansion_arithmetic = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-special-parameter.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-special-parameter.js
 var require_expansion_special_parameter = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-special-parameter.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-special-parameter.js"(exports2, module2) {
     "use strict";
     var last = require_array_last();
-    module2.exports = function expansionSpecialParameter(state, source) {
+    module2.exports = function expansionSpecialParameter(state, source, _reducers) {
       const char = source && source.shift();
       const xp = last(state.expansion);
       return {
@@ -1588,9 +1596,9 @@ var require_expansion_special_parameter = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter.js
 var require_expansion_parameter = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter.js"(exports2, module2) {
     "use strict";
     var last = require_array_last();
     module2.exports = function expansionParameter(state, source, reducers) {
@@ -1604,7 +1612,7 @@ var require_expansion_parameter = __commonJS({
           })
         };
       }
-      if (char.match(/[0-9a-zA-Z_]/)) {
+      if (/\w/.test(char)) {
         return {
           nextReduction: reducers.expansionParameter,
           nextState: state.appendChar(char).replaceLastExpansion({
@@ -1621,9 +1629,9 @@ var require_expansion_parameter = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-or-arithmetic.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-or-arithmetic.js
 var require_expansion_command_or_arithmetic = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-or-arithmetic.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-command-or-arithmetic.js"(exports2, module2) {
     "use strict";
     var last = require_array_last();
     var t = require_tokens();
@@ -1665,9 +1673,9 @@ var require_expansion_command_or_arithmetic = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter-extended.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter-extended.js
 var require_expansion_parameter_extended = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter-extended.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/expansion-parameter-extended.js"(exports2, module2) {
     "use strict";
     var last = require_array_last();
     var t = require_tokens();
@@ -1701,9 +1709,9 @@ var require_expansion_parameter_extended = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/index.js
 var require_reducers = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/reducers/index.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/reducers/index.js"(exports2, module2) {
     "use strict";
     var end = require_end();
     var operator = require_operator();
@@ -1736,9 +1744,9 @@ var require_reducers = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/index.js
 var require_tokenizer = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/tokenizer/index.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/tokenizer/index.js"(exports2, module2) {
     "use strict";
     var deepFreeze = require_deep_freeze();
     var last = require_array_last();
@@ -1778,6 +1786,9 @@ var require_tokenizer = __commonJS({
         });
         return this.setExpansion(expansion);
       }
+      removeLastExpansion() {
+        return this.setExpansion((this.expansion || []).slice(0, -1));
+      }
       appendChar(char) {
         return new ImmutableState(Object.assign({}, this, { current: this.current + char }));
       }
@@ -1806,7 +1817,7 @@ var require_tokenizer = __commonJS({
           loc.current.col++;
         }
         loc.current.char++;
-        if (char && char.match(/\s/) && this.current === "") {
+        if (char && /\s/.test(char) && this.current === "") {
           loc.start = Object.assign({}, loc.current);
         }
         return this.setLoc(loc);
@@ -1843,8 +1854,12 @@ var require_tokenizer = __commonJS({
         });
         return this;
       }
+      removeLastExpansion() {
+        this.expansion = (this.expansion || []).slice(0, -1);
+        return this;
+      }
       appendChar(char) {
-        this.current = this.current + char;
+        this.current += char;
         return this;
       }
       removeLastChar() {
@@ -1879,7 +1894,7 @@ var require_tokenizer = __commonJS({
           loc.current.col++;
         }
         loc.current.char++;
-        if (char && char.match(/\s/) && this.current === "") {
+        if (char && /\s/.test(char) && this.current === "") {
           loc.start = Object.assign({}, loc.current);
         }
         return this.setLoc(loc);
@@ -1900,11 +1915,7 @@ var require_tokenizer = __commonJS({
         if (tokensToEmit) {
           yield* tokensToEmit;
         }
-        if (nextState) {
-          state = nextState.advanceLoc(char);
-        } else {
-          state = state.advanceLoc(char);
-        }
+        state = nextState ? nextState.advanceLoc(char) : state.advanceLoc(char);
         reduction = nextReduction;
       }
     };
@@ -2899,9 +2910,9 @@ var init_magic_string_es6 = __esm({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/field-splitting.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/field-splitting.js
 var require_field_splitting = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/field-splitting.js"(exports2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/field-splitting.js"(exports2) {
     "use strict";
     var map = require_map_iterable();
     var merge = require_transform_spread_iterable();
@@ -2911,7 +2922,7 @@ var require_field_splitting = __commonJS({
       if (typeof options.resolveEnv === "function" && text[0] !== "'" && text[0] !== '"') {
         const ifs = options.resolveEnv("IFS");
         if (ifs !== null) {
-          return result.replace(new RegExp(`[${ifs}]+`, "g"), "\0");
+          return result.replaceAll(new RegExp(`[${ifs}]+`, "g"), "\0");
         }
       }
       return result;
@@ -2934,9 +2945,9 @@ var require_field_splitting = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/parameter-expansion.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/parameter-expansion.js
 var require_parameter_expansion = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/parameter-expansion.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/parameter-expansion.js"(exports2, module2) {
     "use strict";
     var mapObj = require_map_obj();
     var filter = require_filter_obj();
@@ -2967,7 +2978,7 @@ var require_parameter_expansion = __commonJS({
       return ret;
     };
     function expandParameter(xp, enums) {
-      let parameter = xp.parameter;
+      const parameter = xp.parameter;
       for (const pair of pairs(enums.parameterOperators)) {
         const re = new RegExp(pair[0]);
         const match = parameter.match(re);
@@ -3021,9 +3032,9 @@ var require_parameter_expansion = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/command-expansion.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/command-expansion.js
 var require_command_expansion = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/command-expansion.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/command-expansion.js"(exports2, module2) {
     "use strict";
     var map = require_map_iterable();
     var MagicString2 = (init_magic_string_es6(), __toCommonJS(magic_string_es6_exports));
@@ -3032,7 +3043,7 @@ var require_command_expansion = __commonJS({
     function setCommandExpansion(xp, token) {
       let command = xp.command;
       if (token.value[xp.loc.start - 1] === "`") {
-        command = command.replace(/\\`/g, "`");
+        command = command.replaceAll("\\`", "`");
       }
       const bashParser = require_src();
       const commandAST = bashParser(command);
@@ -8656,9 +8667,9 @@ var require_lib = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/arithmetic-expansion.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/arithmetic-expansion.js
 var require_arithmetic_expansion = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/arithmetic-expansion.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/arithmetic-expansion.js"(exports2, module2) {
     "use strict";
     var map = require_map_iterable();
     var babylon = require_lib();
@@ -8669,8 +8680,8 @@ var require_arithmetic_expansion = __commonJS({
       let AST;
       try {
         AST = babylon.parse(xp.expression);
-      } catch (err) {
-        throw new SyntaxError(`Cannot parse arithmetic expression "${xp.expression}": ${err.message}`);
+      } catch (error) {
+        throw new SyntaxError(`Cannot parse arithmetic expression "${xp.expression}": ${error.message}`);
       }
       const expression = AST.program.body[0].expression;
       if (expression === void 0) {
@@ -8715,9 +8726,9 @@ var require_arithmetic_expansion = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/alias-substitution.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/alias-substitution.js
 var require_alias_substitution2 = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/alias-substitution.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/alias-substitution.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var identity = require_identity_function();
@@ -8726,7 +8737,7 @@ var require_alias_substitution2 = __commonJS({
     var tokens = require_tokens();
     var expandAlias = (preAliasLexer, resolveAlias) => {
       function* tryExpandToken(token, expandingAliases) {
-        if (expandingAliases.indexOf(token.value) !== -1 || !token._.maybeSimpleCommandName) {
+        if (expandingAliases.includes(token.value) || !token._.maybeSimpleCommandName) {
           yield token;
           return;
         }
@@ -8747,9 +8758,7 @@ var require_alias_substitution2 = __commonJS({
         }
       }
       return {
-        WORD: (tk) => {
-          return Array.from(tryExpandToken(tk, []));
-        }
+        WORD: (tk) => Array.from(tryExpandToken(tk, []))
       };
     };
     module2.exports = (options, mode, previousPhases) => {
@@ -8825,9 +8834,9 @@ var require_to_pascal_case = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/default-node-type.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/default-node-type.js
 var require_default_node_type = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/default-node-type.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/default-node-type.js"(exports2, module2) {
     "use strict";
     var toPascal = require_to_pascal_case();
     var map = require_map_iterable();
@@ -8835,11 +8844,7 @@ var require_default_node_type = __commonJS({
       const tk = Object.assign({}, token);
       if (tk.type) {
         tk.originalType = token.type;
-        if (token.is("WORD") || token.is("NAME") || token.is("ASSIGNMENT_WORD")) {
-          tk.type = toPascal(tk.type);
-        } else {
-          tk.type = token.type.toLowerCase();
-        }
+        tk.type = token.is("WORD") || token.is("NAME") || token.is("ASSIGNMENT_WORD") ? toPascal(tk.type) : token.type.toLowerCase();
         for (const xp of tk.expansion || []) {
           xp.type = toPascal(xp.type);
         }
@@ -8850,22 +8855,20 @@ var require_default_node_type = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/tilde-expanding.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/tilde-expanding.js
 var require_tilde_expanding = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/tilde-expanding.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/tilde-expanding.js"(exports2, module2) {
     "use strict";
     var map = require_map_iterable();
     var tokens = require_tokens();
     var replace = (text, resolveHomeUser) => {
       let replaced = false;
-      let result = text.replace(/^~([^\/]*)\//, (match, p1) => {
+      let result = text.replace(/^~([^/]*)\//, (match, p1) => {
         replaced = true;
         return resolveHomeUser(p1 || null) + "/";
       });
       if (!replaced) {
-        result = text.replace(/^~(.*)$/, (match, p1) => {
-          return resolveHomeUser(p1 || null);
-        });
+        result = text.replace(/^~(.*)$/, (match, p1) => resolveHomeUser(p1 || null));
       }
       return result;
     };
@@ -8885,9 +8888,9 @@ var require_tilde_expanding = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/path-expansion.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/path-expansion.js
 var require_path_expansion = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/path-expansion.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/path-expansion.js"(exports2, module2) {
     "use strict";
     var map = require_map_iterable();
     var tokens = require_tokens();
@@ -9097,9 +9100,9 @@ var require_dist = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/quote-removal.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/quote-removal.js
 var require_quote_removal = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/quote-removal.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/quote-removal.js"(exports2, module2) {
     "use strict";
     var parse2 = require_shell_quote_word();
     var unescape = require_dist();
@@ -9123,10 +9126,8 @@ var require_quote_removal = __commonJS({
       return unresolved.length > 0;
     }
     module2.exports = () => map((token) => {
-      if (token.is("WORD") || token.is("ASSIGNMENT_WORD")) {
-        if (!unresolvedExpansions(token)) {
-          return tokens.setValue(token, unquote(token.value));
-        }
+      if ((token.is("WORD") || token.is("ASSIGNMENT_WORD")) && !unresolvedExpansions(token)) {
+        return tokens.setValue(token, unquote(token.value));
       }
       return token;
     });
@@ -9208,9 +9209,9 @@ var require_iterable_lookahead = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/identify-simplecommand-names.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/identify-simplecommand-names.js
 var require_identify_simplecommand_names = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/identify-simplecommand-names.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/identify-simplecommand-names.js"(exports2, module2) {
     "use strict";
     var lookahead = require_iterable_lookahead();
     var compose = require_compose_function();
@@ -9253,9 +9254,9 @@ var require_identify_simplecommand_names = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/identify-maybe-simple-commands.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/identify-maybe-simple-commands.js
 var require_identify_maybe_simple_commands = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/identify-maybe-simple-commands.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/identify-maybe-simple-commands.js"(exports2, module2) {
     "use strict";
     var values = require_object_values();
     var compose = require_compose_function();
@@ -9273,9 +9274,9 @@ var require_identify_maybe_simple_commands = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/operator-tokens.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/operator-tokens.js
 var require_operator_tokens = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/operator-tokens.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/operator-tokens.js"(exports2, module2) {
     "use strict";
     var hasOwnProperty = require_has_own_property();
     var map = require_map_iterable();
@@ -9298,9 +9299,9 @@ var require_operator_tokens = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/reserved-words.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/reserved-words.js
 var require_reserved_words = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/reserved-words.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/reserved-words.js"(exports2, module2) {
     "use strict";
     var hasOwnProperty = require_has_own_property();
     var values = require_object_values();
@@ -9356,9 +9357,9 @@ var require_reverse_arguments = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/filter.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/filter.js
 var require_filter = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/filter.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/filter.js"(exports2, module2) {
     "use strict";
     var filterIterator = require_filter_iterator();
     var reverse = require_reverse_arguments();
@@ -9368,22 +9369,20 @@ var require_filter = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/non-null.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/non-null.js
 var require_non_null = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/utils/non-null.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/utils/non-null.js"(exports2, module2) {
     "use strict";
     var filter = require_filter();
-    var nonNull = (tk) => {
-      return tk !== null;
-    };
+    var nonNull = (tk) => tk !== null;
     module2.exports = filter(nonNull);
     filter.predicate = nonNull;
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/separator.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/separator.js
 var require_separator = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/separator.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/separator.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var map = require_map_iterable();
@@ -9433,9 +9432,9 @@ var require_separator = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/linebreak-in.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/linebreak-in.js
 var require_linebreak_in = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/linebreak-in.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/linebreak-in.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var map = require_map_iterable();
@@ -9472,9 +9471,9 @@ var require_linebreak_in = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/for-name-variable.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/for-name-variable.js
 var require_for_name_variable = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/for-name-variable.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/for-name-variable.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var map = require_map_iterable();
@@ -9482,7 +9481,7 @@ var require_for_name_variable = __commonJS({
     var isValidName = require_is_valid_name();
     module2.exports = function forNameVariable() {
       return compose(map((tk, idx, iterable) => {
-        let lastToken = iterable.behind(1) || { is: () => false };
+        const lastToken = iterable.behind(1) || { is: () => false };
         if (lastToken.is("For") && tk.is("WORD") && isValidName(tk.value)) {
           return tk.changeTokenType("NAME", tk.value);
         }
@@ -9492,9 +9491,9 @@ var require_for_name_variable = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/function-name.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/function-name.js
 var require_function_name = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/function-name.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/function-name.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var map = require_map_iterable();
@@ -9510,9 +9509,9 @@ var require_function_name = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/io-number.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/io-number.js
 var require_io_number = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/io-number.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/io-number.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var map = require_map_iterable();
@@ -9520,7 +9519,7 @@ var require_io_number = __commonJS({
     module2.exports = function ioNumber(options, mode) {
       return compose(map((tk, idx, iterable) => {
         const next = iterable.ahead(1);
-        if (tk && tk.is("WORD") && tk.value.match(/^[0-9]+$/) && mode.enums.IOFileOperators.isOperator(next)) {
+        if (tk && tk.is("WORD") && /^\d+$/.test(tk.value) && mode.enums.IOFileOperators.isOperator(next)) {
           return tk.changeTokenType("IO_NUMBER", tk.value);
         }
         return tk;
@@ -9529,9 +9528,9 @@ var require_io_number = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/new-line-list.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/new-line-list.js
 var require_new_line_list = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/new-line-list.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/new-line-list.js"(exports2, module2) {
     "use strict";
     var compose = require_compose_function();
     var map = require_map_iterable();
@@ -9557,9 +9556,9 @@ var require_new_line_list = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/assignment-word.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/assignment-word.js
 var require_assignment_word = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/assignment-word.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/assignment-word.js"(exports2, module2) {
     "use strict";
     var map = require_map_iterable();
     var isValidName = require_is_valid_name();
@@ -9579,9 +9578,9 @@ var require_assignment_word = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/syntaxerror-oncontinue.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/syntaxerror-oncontinue.js
 var require_syntaxerror_oncontinue = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/syntaxerror-oncontinue.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/syntaxerror-oncontinue.js"(exports2, module2) {
     "use strict";
     var map = require_map_iterable();
     module2.exports = function syntaxerrorOnContinue() {
@@ -9595,9 +9594,9 @@ var require_syntaxerror_oncontinue = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/index.js
 var require_rules = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/rules/index.js"(exports2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/rules/index.js"(exports2) {
     "use strict";
     exports2.parameterExpansion = require_parameter_expansion();
     exports2.commandExpansion = require_command_expansion();
@@ -9623,9 +9622,9 @@ var require_rules = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/grammar.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/grammar.js
 var require_grammar = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/grammar.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/grammar.js"(exports2, module2) {
     "use strict";
     module2.exports = {
       start: "complete_command",
@@ -10074,9 +10073,9 @@ var require_grammar = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/io-file-operators.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/io-file-operators.js
 var require_io_file_operators = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/io-file-operators.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/io-file-operators.js"(exports2, module2) {
     "use strict";
     var ioFileOperators = module2.exports = [
       "LESS",
@@ -10099,9 +10098,9 @@ var require_io_file_operators = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/parameter-operators.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/parameter-operators.js
 var require_parameter_operators = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/parameter-operators.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/parameter-operators.js"(exports2, module2) {
     "use strict";
     var name = "[a-zA-Z_][a-zA-Z0-9_]*";
     var parameterOps = {
@@ -10181,7 +10180,7 @@ var require_parameter_operators = __commonJS({
         op: "stringLength",
         parameter: (m) => m[1]
       },
-      [`^([1-9][0-9]*)$`]: {
+      "^([1-9][0-9]*)$": {
         kind: "positional",
         parameter: (m) => Number(m[1])
       },
@@ -10214,9 +10213,9 @@ var require_parameter_operators = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/reserved-words.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/reserved-words.js
 var require_reserved_words2 = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/reserved-words.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/reserved-words.js"(exports2, module2) {
     "use strict";
     module2.exports = {
       "if": "If",
@@ -10239,9 +10238,9 @@ var require_reserved_words2 = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/index.js
 var require_enums = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/enums/index.js"(exports2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/enums/index.js"(exports2) {
     "use strict";
     exports2.IOFileOperators = require_io_file_operators();
     exports2.operators = require_operators();
@@ -10250,9 +10249,9 @@ var require_enums = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/built-grammar.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/built-grammar.js
 var require_built_grammar = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/built-grammar.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/built-grammar.js"(exports2, module2) {
     "use strict";
     var parser = (function() {
       var o = function(k, v, o2, l) {
@@ -10483,13 +10482,9 @@ var require_built_grammar = __commonJS({
           if (hash.recoverable) {
             this.trace(str);
           } else {
-            let _parseError2 = function(msg, hash2) {
-              this.message = msg;
-              this.hash = hash2;
-            };
-            var _parseError = _parseError2;
-            _parseError2.prototype = Error;
-            throw new _parseError2(str, hash);
+            var error = new Error(str);
+            error.hash = hash;
+            throw error;
           }
         },
         parse: function parse2(input) {
@@ -10658,9 +10653,9 @@ var require_built_grammar = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/index.js
 var require_posix = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/posix/index.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/posix/index.js"(exports2, module2) {
     "use strict";
     var astBuilder = require_ast_builder();
     var tokenizer = require_tokenizer();
@@ -10702,7 +10697,7 @@ var require_posix = __commonJS({
         let grammar = null;
         try {
           grammar = require_built_grammar();
-        } catch (err) {
+        } catch {
         }
         return {
           enums,
@@ -10718,9 +10713,9 @@ var require_posix = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/word-expansion/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/word-expansion/index.js
 var require_word_expansion = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/modes/word-expansion/index.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/modes/word-expansion/index.js"(exports2, module2) {
     "use strict";
     var map = require_map_iterable();
     var tokenOrEmpty = require_tokens().tokenOrEmpty;
@@ -10806,9 +10801,9 @@ var require_word_expansion = __commonJS({
   }
 });
 
-// node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/index.js
+// node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/index.js
 var require_src = __commonJS({
-  "node_modules/.pnpm/bash-parser@0.5.0/node_modules/bash-parser/src/index.js"(exports2, module2) {
+  "node_modules/.pnpm/@banyudu+bash-parser@0.5.2/node_modules/@banyudu/bash-parser/src/index.js"(exports2, module2) {
     "use strict";
     var shellLexer = require_shell_lexer();
     var utils = require_utils();
@@ -10836,11 +10831,11 @@ var require_src = __commonJS({
         parser.yy = astBuilder(options);
         const ast = parser.parse(sourceCode);
         return ast;
-      } catch (err) {
-        if (err instanceof SyntaxError) {
-          throw err;
+      } catch (error) {
+        if (error instanceof SyntaxError) {
+          throw error;
         }
-        throw new Error(err.stack || err.message);
+        throw new Error(error.stack || error.message);
       }
     };
   }
@@ -18137,7 +18132,7 @@ var require_dist2 = __commonJS({
 
 // src/codex-export.ts
 var import_fs2 = require("fs");
-var import_path3 = require("path");
+var import_path4 = require("path");
 
 // src/evaluator.ts
 var import_os = require("os");
@@ -18359,7 +18354,7 @@ function parseCommand(input) {
         for (const cmd of cmdAst.commands) {
           walkNode(cmd, result);
         }
-        return { commands: result.commands, hasSubshell: true, subshellCommands: result.subshellCommands, parseError: false };
+        return { commands: result.commands, hasSubshell: result.hasSubshell, subshellCommands: result.subshellCommands, parseError: false };
       } catch {
         return { commands: [], hasSubshell: true, subshellCommands: [], parseError: true };
       }
@@ -18381,9 +18376,9 @@ function parseCommand(input) {
         for (const cmd of ast.commands) {
           walkNode(cmd, result);
         }
-        return { commands: result.commands, hasSubshell: true, subshellCommands: result.subshellCommands, parseError: false };
+        return { commands: result.commands, hasSubshell: result.hasSubshell, subshellCommands: result.subshellCommands, parseError: false };
       } catch {
-        return { commands: [], hasSubshell: true, subshellCommands: [], parseError: true };
+        return { commands: [], hasSubshell: false, subshellCommands: [], parseError: true };
       }
     }
     const fallback = regexFallbackParse(input);
@@ -18461,6 +18456,282 @@ function regexFallbackParse(input) {
   return { command, originalCommand, args: args2, envPrefixes, raw: trimmed };
 }
 
+// src/targets.ts
+var import_path2 = require("path");
+
+// src/glob.ts
+function globToRegex(pattern) {
+  let regex = "";
+  let i = 0;
+  while (i < pattern.length) {
+    const ch = pattern[i];
+    if (ch === "*") {
+      regex += ".*";
+    } else if (ch === "?") {
+      regex += ".";
+    } else if (ch === "[") {
+      i++;
+      if (i < pattern.length && pattern[i] === "!") {
+        regex += "[^";
+        i++;
+      } else {
+        regex += "[";
+      }
+      while (i < pattern.length && pattern[i] !== "]") {
+        regex += pattern[i];
+        i++;
+      }
+      if (i < pattern.length) regex += "]";
+    } else if (ch === "{") {
+      const end = pattern.indexOf("}", i);
+      if (end !== -1) {
+        const alternatives = pattern.slice(i + 1, end).split(",").map((s) => s.replace(/[.+^$|\\()]/g, "\\$&"));
+        regex += `(${alternatives.join("|")})`;
+        i = end;
+      } else {
+        regex += "\\{";
+      }
+    } else if (".+^$|\\()".includes(ch)) {
+      regex += "\\" + ch;
+    } else {
+      regex += ch;
+    }
+    i++;
+  }
+  return new RegExp(`^${regex}$`);
+}
+
+// src/targets.ts
+var PATH_COMMANDS = /* @__PURE__ */ new Set([
+  "rm",
+  "chmod",
+  "chown",
+  "cp",
+  "mv",
+  "tee",
+  "mkdir",
+  "rmdir",
+  "touch",
+  "ln"
+]);
+function evaluatePathTarget(cmd, cwd, targets) {
+  if (targets.length === 0) return null;
+  const positionalArgs = cmd.args.filter((a) => !a.startsWith("-"));
+  if (positionalArgs.length === 0) return null;
+  let bestMatch = null;
+  for (const target of targets) {
+    if (target.allowAll) {
+    } else {
+      if (target.commands && target.commands.length > 0 && !target.commands.includes(cmd.command)) {
+        continue;
+      }
+      if (!target.commands && !PATH_COMMANDS.has(cmd.command)) {
+        continue;
+      }
+    }
+    const targetPath = (0, import_path2.normalize)(target.path.replace(/\{\{cwd\}\}/g, cwd));
+    const recursive = target.recursive !== false;
+    for (const arg of positionalArgs) {
+      const resolvedArg = (0, import_path2.normalize)((0, import_path2.resolve)(cwd, arg));
+      const matches = recursive ? resolvedArg === targetPath || resolvedArg.startsWith(targetPath + "/") : resolvedArg === targetPath;
+      if (matches) {
+        const decision = target.allowAll ? "allow" : target.decision;
+        const detail = {
+          command: cmd.command,
+          args: cmd.args,
+          decision,
+          reason: target.reason || `Path "${resolvedArg}" matches trusted path "${target.path}" (${decision})`,
+          matchedRule: "trustedPaths"
+        };
+        if (decision === "deny") return detail;
+        if (!bestMatch || bestMatch.decision !== "deny") {
+          bestMatch = detail;
+        }
+      }
+    }
+  }
+  return bestMatch;
+}
+var DB_HOST_FLAGS = {
+  psql: ["-h", "--host"],
+  mysql: ["-h", "--host"],
+  mariadb: ["-h", "--host"],
+  "redis-cli": ["-h"],
+  mongosh: ["--host"]
+};
+var DB_DATABASE_FLAGS = {
+  psql: ["-d", "--dbname"],
+  mysql: ["-D", "--database"],
+  mariadb: ["-D", "--database"]
+};
+var DB_PORT_FLAGS = {
+  psql: ["-p", "--port"],
+  mysql: ["-P", "--port"],
+  mariadb: ["-P", "--port"],
+  "redis-cli": ["-p"],
+  mongosh: ["--port"]
+};
+function extractFlagValue(args2, flags) {
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    for (const f of flags) {
+      if (arg.startsWith(f + "=")) {
+        return arg.slice(f.length + 1);
+      }
+    }
+    if (flags.includes(arg) && i + 1 < args2.length) {
+      return args2[i + 1];
+    }
+  }
+  return void 0;
+}
+function parseDBConnection(cmd) {
+  const command = cmd.command;
+  const info = {};
+  for (const arg of cmd.args) {
+    if (arg.startsWith("postgresql://") || arg.startsWith("postgres://")) {
+      try {
+        const url = new URL(arg);
+        info.host = url.hostname;
+        if (url.port) info.port = parseInt(url.port, 10);
+        if (url.pathname.length > 1) info.database = url.pathname.slice(1);
+        return info;
+      } catch {
+      }
+    }
+    if (arg.startsWith("mongodb://") || arg.startsWith("mongodb+srv://")) {
+      try {
+        const url = new URL(arg);
+        info.host = url.hostname;
+        if (url.port) info.port = parseInt(url.port, 10);
+        if (url.pathname.length > 1) info.database = url.pathname.slice(1);
+        return info;
+      } catch {
+      }
+    }
+  }
+  const hostFlags = DB_HOST_FLAGS[command];
+  if (hostFlags) {
+    const h = extractFlagValue(cmd.args, hostFlags);
+    if (h) info.host = h;
+  }
+  const dbFlags = DB_DATABASE_FLAGS[command];
+  if (dbFlags) {
+    const d = extractFlagValue(cmd.args, dbFlags);
+    if (d) info.database = d;
+  }
+  const portFlags = DB_PORT_FLAGS[command];
+  if (portFlags) {
+    const p = extractFlagValue(cmd.args, portFlags);
+    if (p) info.port = parseInt(p, 10);
+  }
+  return info;
+}
+var DB_COMMANDS = new Set(Object.keys(DB_HOST_FLAGS));
+function evaluateDatabaseTarget(cmd, targets) {
+  if (targets.length === 0) return null;
+  const hasAllowAll = targets.some((t) => t.allowAll);
+  if (!hasAllowAll && !DB_COMMANDS.has(cmd.command)) return null;
+  const applicableTargets = targets.filter((t) => t.allowAll || DB_COMMANDS.has(cmd.command));
+  if (applicableTargets.length === 0) return null;
+  const conn = parseDBConnection(cmd);
+  if (!conn.host) return null;
+  let bestMatch = null;
+  for (const target of applicableTargets) {
+    if (!target.allowAll && target.commands && target.commands.length > 0 && !target.commands.includes(cmd.command)) {
+      continue;
+    }
+    const hostMatch = globToRegex(target.host).test(conn.host);
+    if (!hostMatch) continue;
+    if (target.port !== void 0 && conn.port !== void 0 && target.port !== conn.port) {
+      continue;
+    }
+    if (target.database) {
+      if (!conn.database || !globToRegex(target.database).test(conn.database)) continue;
+    }
+    const decision = target.allowAll ? "allow" : target.decision;
+    const detail = {
+      command: cmd.command,
+      args: cmd.args,
+      decision,
+      reason: target.reason || `Database "${conn.host}${conn.database ? "/" + conn.database : ""}" matches trusted database (${decision})`,
+      matchedRule: "trustedDatabases"
+    };
+    if (decision === "deny") return detail;
+    if (!bestMatch) bestMatch = detail;
+  }
+  return bestMatch;
+}
+var ENDPOINT_COMMANDS = /* @__PURE__ */ new Set(["curl", "wget", "http", "httpie"]);
+function extractURLs(cmd) {
+  const urls = [];
+  const args2 = cmd.args;
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--url" && i + 1 < args2.length) {
+      urls.push(args2[i + 1]);
+      i++;
+      continue;
+    }
+    if (arg.startsWith("http://") || arg.startsWith("https://")) {
+      urls.push(arg);
+    }
+  }
+  return urls;
+}
+function evaluateEndpointTarget(cmd, targets) {
+  if (targets.length === 0) return null;
+  const hasAllowAll = targets.some((t) => t.allowAll);
+  if (!hasAllowAll && !ENDPOINT_COMMANDS.has(cmd.command)) return null;
+  const urls = extractURLs(cmd);
+  if (urls.length === 0) return null;
+  let bestMatch = null;
+  for (const target of targets) {
+    if (!target.allowAll && target.commands && target.commands.length > 0 && !target.commands.includes(cmd.command)) {
+      continue;
+    }
+    for (const url of urls) {
+      if (globToRegex(target.pattern).test(url)) {
+        const decision = target.allowAll ? "allow" : target.decision;
+        const detail = {
+          command: cmd.command,
+          args: cmd.args,
+          decision,
+          reason: target.reason || `URL "${url}" matches trusted endpoint "${target.pattern}" (${decision})`,
+          matchedRule: "trustedEndpoints"
+        };
+        if (decision === "deny") return detail;
+        if (!bestMatch) bestMatch = detail;
+      }
+    }
+  }
+  return bestMatch;
+}
+function evaluateTargetPolicies(cmd, cwd, config) {
+  const policies = config.targetPolicies;
+  if (!policies?.length) return null;
+  const results = [];
+  const pathPolicies = policies.filter((p) => p.type === "path");
+  if (pathPolicies.length) {
+    const r = evaluatePathTarget(cmd, cwd, pathPolicies);
+    if (r) results.push(r);
+  }
+  const dbPolicies = policies.filter((p) => p.type === "database");
+  if (dbPolicies.length) {
+    const r = evaluateDatabaseTarget(cmd, dbPolicies);
+    if (r) results.push(r);
+  }
+  const endpointPolicies = policies.filter((p) => p.type === "endpoint");
+  if (endpointPolicies.length) {
+    const r = evaluateEndpointTarget(cmd, endpointPolicies);
+    if (r) results.push(r);
+  }
+  if (results.length === 0) return null;
+  const deny = results.find((r) => r.decision === "deny");
+  if (deny) return deny;
+  return results[0];
+}
+
 // src/evaluator.ts
 function safeRegexTest(pattern, input) {
   try {
@@ -18481,7 +18752,9 @@ function commandMatchesName(cmd, name) {
   return cmd.command === name;
 }
 var MAX_RECURSION_DEPTH = 10;
-function evaluate(parsed, config, depth = 0) {
+function evaluate(parsed, config, cwdOrDepth, maybeDepth) {
+  const cwd = typeof cwdOrDepth === "string" ? cwdOrDepth : void 0;
+  const depth = typeof cwdOrDepth === "number" ? cwdOrDepth : maybeDepth ?? 0;
   if (depth > MAX_RECURSION_DEPTH) {
     return { decision: "ask", reason: "Maximum recursion depth exceeded", details: [] };
   }
@@ -18494,7 +18767,7 @@ function evaluate(parsed, config, depth = 0) {
   if (parsed.hasSubshell && parsed.subshellCommands.length > 0) {
     for (const subCmd of parsed.subshellCommands) {
       const subParsed = parseCommand(subCmd);
-      const subResult = evaluate(subParsed, config, depth + 1);
+      const subResult = evaluate(subParsed, config, cwd, depth + 1);
       if (subResult.decision === "deny") {
         return { decision: "deny", reason: `Subshell command: ${subResult.reason}`, details: subResult.details };
       }
@@ -18507,7 +18780,7 @@ function evaluate(parsed, config, depth = 0) {
   }
   const details = [];
   for (const cmd of parsed.commands) {
-    details.push(evaluateCommand(cmd, config, depth));
+    details.push(evaluateCommand(cmd, config, cwd, depth));
   }
   const decisions = details.map((d) => d.decision);
   if (decisions.includes("deny")) {
@@ -18528,7 +18801,7 @@ function evaluate(parsed, config, depth = 0) {
   }
   return { decision: "allow", reason: "All commands are safe", details };
 }
-function evaluateCommand(cmd, config, depth = 0) {
+function evaluateCommand(cmd, config, cwd, depth = 0) {
   const { command, args: args2 } = cmd;
   for (const layer of config.layers) {
     if (layer.alwaysDeny.some((name) => commandMatchesName(cmd, name))) {
@@ -18538,27 +18811,51 @@ function evaluateCommand(cmd, config, depth = 0) {
       return { command, args: args2, decision: "allow", reason: `"${command}" is safe`, matchedRule: "alwaysAllow" };
     }
   }
-  if ((command === "ssh" || command === "scp" || command === "rsync") && config.trustedSSHHosts?.length) {
-    const sshResult = evaluateSSHCommand(cmd, config, depth);
-    if (sshResult) return sshResult;
+  if (cwd) {
+    const targetResult = evaluateTargetPolicies(cmd, cwd, config);
+    if (targetResult) return targetResult;
   }
-  if (command === "docker" && config.trustedDockerContainers?.length) {
-    const dockerResult = evaluateDockerExec(cmd, config, depth);
-    if (dockerResult) return dockerResult;
+  const remotes = config.trustedRemotes || [];
+  if (command === "ssh" || command === "scp" || command === "rsync") {
+    const sshTargets = remotes.filter((r) => r.context === "ssh");
+    if (sshTargets.length) {
+      const sshResult = evaluateSSHCommand(cmd, config, sshTargets, depth);
+      if (sshResult) return sshResult;
+    }
   }
-  if (command === "kubectl" && config.trustedKubectlContexts?.length) {
-    const kubectlResult = evaluateKubectlExec(cmd, config, depth);
-    if (kubectlResult) return kubectlResult;
+  if (command === "docker") {
+    const dockerTargets = remotes.filter((r) => r.context === "docker");
+    if (dockerTargets.length) {
+      const dockerResult = evaluateDockerExec(cmd, config, dockerTargets, depth);
+      if (dockerResult) return dockerResult;
+    }
   }
-  if (command === "sprite" && config.trustedSprites?.length) {
-    const spriteResult = evaluateSpriteExec(cmd, config, depth);
-    if (spriteResult) return spriteResult;
+  if (command === "kubectl") {
+    const kubectlTargets = remotes.filter((r) => r.context === "kubectl");
+    if (kubectlTargets.length) {
+      const kubectlResult = evaluateKubectlExec(cmd, config, kubectlTargets, depth);
+      if (kubectlResult) return kubectlResult;
+    }
+  }
+  if (command === "sprite") {
+    const spriteTargets = remotes.filter((r) => r.context === "sprite");
+    if (spriteTargets.length) {
+      const spriteResult = evaluateSpriteExec(cmd, config, spriteTargets, depth);
+      if (spriteResult) return spriteResult;
+    }
+  }
+  if (command === "fly" || command === "flyctl") {
+    const flyTargets = remotes.filter((r) => r.context === "fly");
+    if (flyTargets.length) {
+      const flyResult = evaluateFlyCommand(cmd, config, flyTargets, depth);
+      if (flyResult) return flyResult;
+    }
   }
   if (command === "xargs") {
-    return evaluateXargsCommand(cmd, config, depth);
+    return evaluateXargsCommand(cmd, config, cwd, depth);
   }
   if (command === "find") {
-    return evaluateFindCommand(cmd, config, depth);
+    return evaluateFindCommand(cmd, config, cwd, depth);
   }
   const mergedRule = collectMergedRule(cmd, config);
   if (mergedRule) {
@@ -18720,7 +19017,7 @@ function parseXargsSubcommand(args2) {
     }
   };
 }
-function evaluateXargsCommand(cmd, config, depth = 0) {
+function evaluateXargsCommand(cmd, config, cwd, depth = 0) {
   const { command, args: args2 } = cmd;
   const { subcommand, unresolved } = parseXargsSubcommand(args2);
   if (unresolved || !subcommand) {
@@ -18744,7 +19041,7 @@ function evaluateXargsCommand(cmd, config, depth = 0) {
   } else {
     parsed = { commands: [subcommand], hasSubshell: false, subshellCommands: [], parseError: false };
   }
-  const result = evaluate(parsed, config, depth + 1);
+  const result = evaluate(parsed, config, cwd, depth + 1);
   return {
     command,
     args: args2,
@@ -18782,7 +19079,7 @@ function parseFindExecCommands(args2) {
   }
   return commands;
 }
-function evaluateFindCommand(cmd, config, depth = 0) {
+function evaluateFindCommand(cmd, config, cwd, depth = 0) {
   const { command, args: args2 } = cmd;
   if (args2.some((a) => a === "-delete")) {
     return { command, args: args2, decision: "ask", reason: "find -delete can remove files", matchedRule: "find:delete" };
@@ -18801,7 +19098,7 @@ function evaluateFindCommand(cmd, config, depth = 0) {
       subshellCommands: [],
       parseError: false
     };
-    const result = evaluate(parsed, config, depth + 1);
+    const result = evaluate(parsed, config, cwd, depth + 1);
     if (result.decision === "deny") {
       return { command, args: args2, decision: "deny", reason: `find -exec: ${result.reason}`, matchedRule: "find:exec" };
     }
@@ -18833,48 +19130,6 @@ var SSH_FLAGS_WITH_VALUE = /* @__PURE__ */ new Set([
   "-W",
   "-w"
 ]);
-function globToRegex(pattern) {
-  let regex = "";
-  let i = 0;
-  while (i < pattern.length) {
-    const ch = pattern[i];
-    if (ch === "*") {
-      regex += ".*";
-    } else if (ch === "?") {
-      regex += ".";
-    } else if (ch === "[") {
-      i++;
-      if (i < pattern.length && pattern[i] === "!") {
-        regex += "[^";
-        i++;
-      } else {
-        regex += "[";
-      }
-      while (i < pattern.length && pattern[i] !== "]") {
-        regex += pattern[i];
-        i++;
-      }
-      if (i < pattern.length) {
-        regex += "]";
-      }
-    } else if (ch === "{") {
-      const end = pattern.indexOf("}", i);
-      if (end !== -1) {
-        const alternatives = pattern.slice(i + 1, end).split(",").map((s) => s.replace(/[.+^$|\\()]/g, "\\$&"));
-        regex += `(${alternatives.join("|")})`;
-        i = end;
-      } else {
-        regex += "\\{";
-      }
-    } else if (".+^$|\\()".includes(ch)) {
-      regex += "\\" + ch;
-    } else {
-      regex += ch;
-    }
-    i++;
-  }
-  return new RegExp(`^${regex}$`);
-}
 function findMatchingTarget(value, targets) {
   return targets.find((t) => globToRegex(t.name).test(value)) || null;
 }
@@ -18915,13 +19170,12 @@ function extractHostFromRemotePath(args2) {
   }
   return null;
 }
-function evaluateSSHCommand(cmd, config, depth = 0) {
+function evaluateSSHCommand(cmd, config, targets, depth = 0) {
   const { command, args: args2 } = cmd;
-  const trustedHosts = config.trustedSSHHosts || [];
   if (command === "scp" || command === "rsync") {
     const host2 = extractHostFromRemotePath(args2);
     if (!host2) return null;
-    const target2 = findMatchingTarget(host2, trustedHosts);
+    const target2 = findMatchingTarget(host2, targets);
     if (!target2) return null;
     if (target2.allowAll || !target2.overrides) {
       return {
@@ -18951,7 +19205,7 @@ function evaluateSSHCommand(cmd, config, depth = 0) {
   }
   const { host, remoteCommand } = parseSSHArgs(args2);
   if (!host) return null;
-  const target = findMatchingTarget(host, trustedHosts);
+  const target = findMatchingTarget(host, targets);
   if (!target) return null;
   if (!remoteCommand) {
     return {
@@ -19060,12 +19314,12 @@ function parseDockerExecArgs(args2) {
   }
   return { target, remoteArgs };
 }
-function evaluateDockerExec(cmd, config, depth = 0) {
+function evaluateDockerExec(cmd, config, targets, depth = 0) {
   const { command, args: args2 } = cmd;
   if (args2[0] !== "exec") return null;
   const { target: containerName, remoteArgs } = parseDockerExecArgs(args2.slice(1));
   if (!containerName) return null;
-  const matched = findMatchingTarget(containerName, config.trustedDockerContainers || []);
+  const matched = findMatchingTarget(containerName, targets);
   if (!matched) return null;
   const result = evaluateRemoteCommand(remoteArgs, config, matched, depth);
   return {
@@ -19140,12 +19394,12 @@ function parseKubectlExecArgs(args2) {
   }
   return { context, pod, remoteArgs };
 }
-function evaluateKubectlExec(cmd, config, depth = 0) {
+function evaluateKubectlExec(cmd, config, targets, depth = 0) {
   const { command, args: args2 } = cmd;
   if (args2[0] !== "exec") return null;
   const { context, pod, remoteArgs } = parseKubectlExecArgs(args2.slice(1));
   if (!context) return null;
-  const matched = findMatchingTarget(context, config.trustedKubectlContexts || []);
+  const matched = findMatchingTarget(context, targets);
   if (!matched) return null;
   const result = evaluateRemoteCommand(remoteArgs, config, matched, depth);
   return {
@@ -19207,11 +19461,11 @@ function parseSpriteExecArgs(args2) {
   }
   return { spriteName, remoteArgs };
 }
-function evaluateSpriteExec(cmd, config, depth = 0) {
+function evaluateSpriteExec(cmd, config, targets, depth = 0) {
   const { command, args: args2 } = cmd;
   const { spriteName, remoteArgs } = parseSpriteExecArgs(args2);
   if (!spriteName) return null;
-  const matched = findMatchingTarget(spriteName, config.trustedSprites || []);
+  const matched = findMatchingTarget(spriteName, targets);
   if (!matched) return null;
   const result = evaluateRemoteCommand(remoteArgs, config, matched, depth);
   return {
@@ -19222,6 +19476,93 @@ function evaluateSpriteExec(cmd, config, depth = 0) {
     matchedRule: "trustedSprites"
   };
 }
+var FLY_SSH_FLAGS_WITH_VALUE = /* @__PURE__ */ new Set([
+  "-a",
+  "--app",
+  "-C",
+  "--command",
+  "-o",
+  "--org",
+  "-r",
+  "--region",
+  "-u",
+  "--user",
+  "--address"
+]);
+function parseFlySSHArgs(args2) {
+  let app = null;
+  const remoteArgs = [];
+  let isSSH = false;
+  let foundConsole = false;
+  let i = 0;
+  while (i < args2.length) {
+    const arg = args2[i];
+    if (arg.startsWith("--app=")) {
+      app = arg.slice(6);
+      i++;
+      continue;
+    }
+    if (FLY_SSH_FLAGS_WITH_VALUE.has(arg)) {
+      if (arg === "-a" || arg === "--app") {
+        app = args2[i + 1] || null;
+      }
+      if ((arg === "-C" || arg === "--command") && foundConsole) {
+        const cmdValue = args2[i + 1];
+        if (cmdValue) {
+          const parsed = parseCommand(cmdValue);
+          if (!parsed.parseError && parsed.commands.length > 0) {
+            const cmd = parsed.commands[0];
+            remoteArgs.push(cmd.command, ...cmd.args);
+          }
+        }
+        i += 2;
+        continue;
+      }
+      i += 2;
+      continue;
+    }
+    if (arg === "--") {
+      i++;
+      while (i < args2.length) {
+        remoteArgs.push(args2[i]);
+        i++;
+      }
+      break;
+    }
+    if (arg.startsWith("-")) {
+      i++;
+      continue;
+    }
+    if (!isSSH && arg === "ssh") {
+      isSSH = true;
+      i++;
+      continue;
+    }
+    if (isSSH && !foundConsole && (arg === "console" || arg === "sftp")) {
+      foundConsole = true;
+      i++;
+      continue;
+    }
+    i++;
+  }
+  return { app, remoteArgs, isSSH: isSSH && foundConsole };
+}
+function evaluateFlyCommand(cmd, config, targets, depth = 0) {
+  const { command, args: args2 } = cmd;
+  const { app, remoteArgs, isSSH } = parseFlySSHArgs(args2);
+  if (!isSSH) return null;
+  if (!app) return null;
+  const matched = findMatchingTarget(app, targets);
+  if (!matched) return null;
+  const result = evaluateRemoteCommand(remoteArgs, config, matched, depth);
+  return {
+    command,
+    args: args2,
+    decision: result.decision,
+    reason: `Trusted Fly app "${app}" (${result.reason})`,
+    matchedRule: "trustedFlyApps"
+  };
+}
 
 // src/codex.ts
 function toCodexDecision(decision) {
@@ -19272,7 +19613,7 @@ function generateCodexRules(config) {
 var import_fs = require("fs");
 var import_yaml = __toESM(require_dist2(), 1);
 var import_os2 = require("os");
-var import_path2 = require("path");
+var import_path3 = require("path");
 
 // src/defaults.ts
 var SAFE_DEV_TOOLS = [
@@ -19420,10 +19761,8 @@ var DEFAULT_CONFIG = {
   askOnSubshell: true,
   notifyOnAsk: true,
   notifyOnDeny: true,
-  trustedSSHHosts: [],
-  trustedDockerContainers: [],
-  trustedKubectlContexts: [],
-  trustedSprites: [],
+  trustedRemotes: [],
+  targetPolicies: [],
   layers: [{
     alwaysAllow: [
       // Read-only file operations
@@ -19593,6 +19932,16 @@ var DEFAULT_CONFIG = {
       "ldd",
       "otool",
       "size",
+      // ImageMagick
+      "magick",
+      "convert",
+      "identify",
+      "mogrify",
+      "composite",
+      "montage",
+      "compare",
+      "conjure",
+      "stream",
       // macOS utilities (read-only)
       "mdfind",
       "mdls",
@@ -19665,7 +20014,8 @@ var DEFAULT_CONFIG = {
         command: "claude",
         default: "ask",
         argPatterns: [
-          { match: { anyArgMatches: ["^--(version|help)$", "^-[vh]$"] }, decision: "allow", description: "Version/help flags" }
+          { match: { anyArgMatches: ["^--(version|help)$", "^-[vh]$"] }, decision: "allow", description: "Version/help flags" },
+          { match: { argsMatch: ["^plugin(s)?\\s+(list|help|validate|marketplace\\s+(list|help))\\b"] }, decision: "allow", description: "Read-only plugin commands" }
         ]
       },
       // --- Shell sourcing ---
@@ -19846,8 +20196,8 @@ var DEFAULT_CONFIG = {
         command: "rm",
         default: "ask",
         argPatterns: [
-          { match: { argsMatch: ["-[^\\s]*r[^\\s]*f|-[^\\s]*f[^\\s]*r"] }, decision: "ask", reason: "Recursive force delete (rm -rf)" },
-          { match: { argsMatch: ["-[^\\s]*r"] }, decision: "ask", reason: "Recursive delete" },
+          { match: { anyArgMatches: ["^-[^\\s]*r[^\\s]*f$|^-[^\\s]*f[^\\s]*r$"] }, decision: "ask", reason: "Recursive force delete (rm -rf)" },
+          { match: { anyArgMatches: ["^-[^\\s]*r"] }, decision: "ask", reason: "Recursive delete" },
           { match: { argCount: { max: 3 }, not: false }, decision: "allow", description: "Deleting a small number of non-recursive files" }
         ]
       },
@@ -19935,6 +20285,17 @@ var DEFAULT_CONFIG = {
         { match: { anyArgMatches: ["^(list|search|show|status|get|template|version|env|history)$"] }, decision: "allow", description: "Read-only helm commands" },
         VERSION_HELP_FLAGS
       ] },
+      // --- Fly.io ---
+      ...["fly", "flyctl"].map((cmd) => ({
+        command: cmd,
+        default: "ask",
+        argPatterns: [
+          { match: { anyArgMatches: ["^(status|logs|info|version|platform|doctor|dig)$"] }, decision: "allow", description: "Read-only fly commands" },
+          { match: { argsMatch: ["^apps\\s+list"] }, decision: "allow", description: "List fly apps" },
+          { match: { anyArgMatches: ["^(deploy|destroy|scale|secrets)$"] }, decision: "ask", reason: "Destructive fly operation" },
+          VERSION_HELP_FLAGS
+        ]
+      })),
       // --- Screen/tmux ---
       ...["screen", "tmux"].map((cmd) => ({
         command: cmd,
@@ -19982,8 +20343,8 @@ function isValidDecision(value) {
   return VALID_DECISIONS.has(value);
 }
 var USER_CONFIG_PATHS = [
-  (0, import_path2.join)((0, import_os2.homedir)(), ".claude", "warden.yaml"),
-  (0, import_path2.join)((0, import_os2.homedir)(), ".claude", "warden.json")
+  (0, import_path3.join)((0, import_os2.homedir)(), ".claude", "warden.yaml"),
+  (0, import_path3.join)((0, import_os2.homedir)(), ".claude", "warden.json")
 ];
 var PROJECT_CONFIG_NAMES = [
   ".claude/warden.yaml",
@@ -20006,7 +20367,7 @@ function loadConfig(cwd) {
   let workspaceRaw = null;
   if (cwd) {
     for (const name of PROJECT_CONFIG_NAMES) {
-      const result = tryLoadFile((0, import_path2.join)(cwd, name));
+      const result = tryLoadFile((0, import_path3.join)(cwd, name));
       if (result) {
         workspaceLayer = extractLayer(result);
         workspaceRaw = result;
@@ -20108,18 +20469,153 @@ function parseTrustedList(raw) {
     return null;
   }).filter((t) => t !== null);
 }
+var VALID_REMOTE_CONTEXTS = /* @__PURE__ */ new Set(["ssh", "docker", "kubectl", "sprite", "fly"]);
+function parseTrustedRemotes(raw) {
+  const results = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const obj = entry;
+    const context = String(obj.context || "");
+    if (!VALID_REMOTE_CONTEXTS.has(context)) {
+      process.stderr.write(`[warden] Warning: unknown remote context "${context}", skipping
+`);
+      continue;
+    }
+    const name = String(obj.name || "");
+    if (!name) continue;
+    const remote = { name, context };
+    if (obj.allowAll === true) remote.allowAll = true;
+    if (obj.overrides && typeof obj.overrides === "object") {
+      remote.overrides = extractLayer(obj.overrides);
+    }
+    results.push(remote);
+  }
+  return results;
+}
+function parseTargetPolicies(raw) {
+  const results = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const obj = entry;
+    const type = String(obj.type || "");
+    const rawDecision = String(obj.decision || "allow");
+    const decision = isValidDecision(rawDecision) ? rawDecision : "allow";
+    const base = {
+      commands: Array.isArray(obj.commands) ? obj.commands.map(String) : void 0,
+      decision,
+      reason: obj.reason ? String(obj.reason) : void 0,
+      allowAll: obj.allowAll === true ? true : void 0
+    };
+    switch (type) {
+      case "path": {
+        const path = String(obj.path || "");
+        if (!path) continue;
+        const policy = { ...base, type: "path", path };
+        if (obj.recursive === false) policy.recursive = false;
+        results.push(policy);
+        break;
+      }
+      case "database": {
+        const host = String(obj.host || "");
+        if (!host) continue;
+        const policy = { ...base, type: "database", host };
+        if (typeof obj.port === "number") policy.port = obj.port;
+        if (obj.database) policy.database = String(obj.database);
+        results.push(policy);
+        break;
+      }
+      case "endpoint": {
+        const pattern = String(obj.pattern || "");
+        if (!pattern) continue;
+        results.push({ ...base, type: "endpoint", pattern });
+        break;
+      }
+      default:
+        process.stderr.write(`[warden] Warning: unknown target policy type "${type}", skipping
+`);
+    }
+  }
+  return results;
+}
+function parseLegacyPaths(raw) {
+  const results = [];
+  for (const e of raw) {
+    if (!e || typeof e !== "object") continue;
+    const obj = e;
+    const decision = String(obj.decision || "allow");
+    if (!isValidDecision(decision)) continue;
+    const path = String(obj.path || "");
+    if (!path) continue;
+    const tp = { type: "path", path, decision };
+    if (obj.recursive === false) tp.recursive = false;
+    if (Array.isArray(obj.commands)) tp.commands = obj.commands.map(String);
+    if (obj.reason) tp.reason = String(obj.reason);
+    results.push(tp);
+  }
+  return results;
+}
+function parseLegacyDatabases(raw) {
+  const results = [];
+  for (const e of raw) {
+    if (!e || typeof e !== "object") continue;
+    const obj = e;
+    const decision = String(obj.decision || "allow");
+    if (!isValidDecision(decision)) continue;
+    const host = String(obj.host || "");
+    if (!host) continue;
+    const td = { type: "database", host, decision };
+    if (typeof obj.port === "number") td.port = obj.port;
+    if (obj.database) td.database = String(obj.database);
+    if (Array.isArray(obj.commands)) td.commands = obj.commands.map(String);
+    if (obj.reason) td.reason = String(obj.reason);
+    results.push(td);
+  }
+  return results;
+}
+function parseLegacyEndpoints(raw) {
+  const results = [];
+  for (const e of raw) {
+    if (!e || typeof e !== "object") continue;
+    const obj = e;
+    const decision = String(obj.decision || "allow");
+    if (!isValidDecision(decision)) continue;
+    const pattern = String(obj.pattern || "");
+    if (!pattern) continue;
+    const te = { type: "endpoint", pattern, decision };
+    if (Array.isArray(obj.commands)) te.commands = obj.commands.map(String);
+    if (obj.reason) te.reason = String(obj.reason);
+    results.push(te);
+  }
+  return results;
+}
+var LEGACY_REMOTE_MAP = {
+  trustedSSHHosts: "ssh",
+  trustedDockerContainers: "docker",
+  trustedKubectlContexts: "kubectl",
+  trustedSprites: "sprite",
+  trustedFlyApps: "fly"
+};
 function mergeNonLayerFields(config, raw) {
-  if (Array.isArray(raw.trustedSSHHosts)) {
-    config.trustedSSHHosts = [...config.trustedSSHHosts || [], ...parseTrustedList(raw.trustedSSHHosts)];
+  if (Array.isArray(raw.trustedRemotes)) {
+    config.trustedRemotes = [...config.trustedRemotes || [], ...parseTrustedRemotes(raw.trustedRemotes)];
+  }
+  if (Array.isArray(raw.targetPolicies)) {
+    config.targetPolicies = [...config.targetPolicies || [], ...parseTargetPolicies(raw.targetPolicies)];
+  }
+  for (const [key, context] of Object.entries(LEGACY_REMOTE_MAP)) {
+    if (Array.isArray(raw[key])) {
+      const remotes = parseTrustedList(raw[key]).map((t) => ({ ...t, context }));
+      config.trustedRemotes = [...config.trustedRemotes || [], ...remotes];
+    }
   }
-  if (Array.isArray(raw.trustedDockerContainers)) {
-    config.trustedDockerContainers = [...config.trustedDockerContainers || [], ...parseTrustedList(raw.trustedDockerContainers)];
+  if (Array.isArray(raw.trustedPaths)) {
+    config.targetPolicies = [...config.targetPolicies || [], ...parseLegacyPaths(raw.trustedPaths)];
   }
-  if (Array.isArray(raw.trustedKubectlContexts)) {
-    config.trustedKubectlContexts = [...config.trustedKubectlContexts || [], ...parseTrustedList(raw.trustedKubectlContexts)];
+  if (Array.isArray(raw.trustedDatabases)) {
+    config.targetPolicies = [...config.targetPolicies || [], ...parseLegacyDatabases(raw.trustedDatabases)];
   }
-  if (Array.isArray(raw.trustedSprites)) {
-    config.trustedSprites = [...config.trustedSprites || [], ...parseTrustedList(raw.trustedSprites)];
+  if (Array.isArray(raw.trustedEndpoints)) {
+    config.targetPolicies = [...config.targetPolicies || [], ...parseLegacyEndpoints(raw.trustedEndpoints)];
   }
   if (typeof raw.defaultDecision === "string") {
     if (isValidDecision(raw.defaultDecision)) {
@@ -20160,7 +20656,7 @@ function parseArgs(argv) {
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
     if (arg === "--cwd" && argv[i + 1]) {
-      cwd = (0, import_path3.resolve)(argv[i + 1]);
+      cwd = (0, import_path4.resolve)(argv[i + 1]);
       i += 1;
       continue;
     }
@@ -20196,13 +20692,13 @@ function main() {
   const options = parseArgs(process.argv.slice(2));
   const config = loadConfig(options.cwd);
   const rules = generateCodexRules(config);
-  const target = options.outPath ?? (0, import_path3.join)(options.cwd, ".codex", "rules", "warden.rules");
+  const target = options.outPath ?? (0, import_path4.join)(options.cwd, ".codex", "rules", "warden.rules");
   if (target === "-") {
     process.stdout.write(rules);
     return;
   }
-  const resolvedTarget = (0, import_path3.isAbsolute)(target) ? target : (0, import_path3.resolve)(options.cwd, target);
-  (0, import_fs2.mkdirSync)((0, import_path3.dirname)(resolvedTarget), { recursive: true });
+  const resolvedTarget = (0, import_path4.isAbsolute)(target) ? target : (0, import_path4.resolve)(options.cwd, target);
+  (0, import_fs2.mkdirSync)((0, import_path4.dirname)(resolvedTarget), { recursive: true });
   (0, import_fs2.writeFileSync)(resolvedTarget, rules, "utf-8");
   process.stderr.write(`[warden] Wrote Codex rules to ${resolvedTarget}
 `);