pushary 1.9.109 → 1.9.111

package/dist/{chunk-SALM3IYQ.js → chunk-DZE26BID.js}

@@ -3317,6 +3317,11 @@ var AUTH_REJECTION_REASONS = [
   "site_not_found",
   ...AGENT_SITE_REJECTION_REASONS
 ];
+var CREDENTIAL_REJECTION_HEADER = "x-pushary-credential";
+var CREDENTIAL_REJECTED = "rejected";
+var CREDENTIAL_REJECTION_STATUS = 401;
+var MCP_CREDENTIAL_REJECTION_BODY = JSON.stringify({ error: "invalid_token", error_description: "No authorization provided" });
+var responseRejectsCredential = (status, headers) => status === CREDENTIAL_REJECTION_STATUS && headers.get(CREDENTIAL_REJECTION_HEADER)?.trim() === CREDENTIAL_REJECTED;
 var TOOL_FAILURE_META_KEY = "pushary/failure";
 var TOOL_FAILURE_CODES = {
   questionLimit: "question_limit",
@@ -3480,6 +3485,16 @@ var readSetupOutcomeProperties = (body) => {
   };
 };
 
+// ../contracts/src/policy-capabilities.ts
+var POLICY_REQUEST_CAPABILITIES_HEADER = "x-pushary-policy-capabilities";
+var POLICY_REQUEST_CAPABILITY = {
+  readsCommandRunnersAndAVersionedCache: "command-runners-1"
+};
+var KNOWN_POLICY_REQUEST_CAPABILITIES = Object.values(POLICY_REQUEST_CAPABILITY);
+var CLI_POLICY_REQUEST_CAPABILITIES = [POLICY_REQUEST_CAPABILITY.readsCommandRunnersAndAVersionedCache];
+var POLICY_REQUEST_CAPABILITY_SEPARATOR = ",";
+var policyRequestCapabilitiesHeaderValue = (capabilities) => capabilities.join(POLICY_REQUEST_CAPABILITY_SEPARATOR);
+
 // ../contracts/src/declined-agents.ts
 var DECLINED_AGENTS_FILE = "declined-agents.json";
 var DECLINED_AGENTS_VERSION = 1;
@@ -6638,7 +6653,7 @@ var posixShellJudgeFor = (toolName, line = "standing_allow") => ({
   namesAFileThatNeedsAPerson: line === "permissions_off" ? pathNeedsAPersonToChange : namesASecretPowerShellPath,
   webRequestNeedsAPerson: line === "permissions_off" ? webRequestSendsDataOffThisMachine : noWebRequestNeedsAPerson
 });
-var commandIsDestructive = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandIsDestructive(command, posixShellJudgeFor(toolName)) : readingsThatCanAct(command).some((reading) => classifyDecisionRisk(toolNameForAPosixReading(toolName), reading) === "destructive");
+var commandIsDestructive = (toolName, command) => shellDialectOf(toolName) === "powershell" ? powerShellCommandIsDestructive(command, posixShellJudgeFor(toolName)) : aReadingIsDestructive(toolName, command);
 var commandHasAConsequenceOnTheLine = (toolName, command, line) => shellDialectOf(toolName) === "powershell" ? powerShellCommandHasAVisibleConsequence(command, posixShellJudgeFor(toolName, line)) : commandHasAVisibleConsequenceAt(toolNameForAPosixReading(toolName), command, 0, line);
 var commandHasAVisibleConsequence = (toolName, command) => commandHasAConsequenceOnTheLine(toolName, command, "standing_allow");
 var commandHasAConsequenceWithPermissionsOff = (toolName, command) => commandHasAConsequenceOnTheLine(toolName, command, "permissions_off");
@@ -6747,30 +6762,423 @@ var spelledSegmentsOf = (command) => {
   const parsed = readableCommandSegments(command);
   return parsed === null ? roughSegmentsOf(command).map(roughSpelledSegment) : parsed.map(parsedSpelledSegment);
 };
-var SPELLINGS_OF_AN_UNREADABLE_COMMAND = { forms: [], hidesWhatItRuns: true };
-var commandSpellingsAt = (command, depth) => {
-  if (depth > MAX_SPELLING_DEPTH) return SPELLINGS_OF_AN_UNREADABLE_COMMAND;
-  const forms = [];
-  let hidesWhatItRuns = runsASubstitutionAsAProgram(command);
-  for (const segment of spelledSegmentsOf(command)) {
+var SPELLINGS_OF_AN_UNREADABLE_COMMAND = { forms: [], hidesWhatItRuns: true, completeness: "unreadable" };
+var spellingsAreComplete = (spellings) => spellings.completeness === "complete";
+var SPELLS_WITHOUT_COMMAND_RUNNERS = "without_command_runners";
+var SPELLS_COMMAND_RUNNERS_TOO = "with_command_runners";
+var readsCommandRunners = (reach) => reach === SPELLS_COMMAND_RUNNERS_TOO;
+var NO_OPTIONS = /* @__PURE__ */ new Set();
+var runnerSyntax = (subcommands, optionReadings, { globalOptionsWithAValue = [], operandsBeforeTheCommand = [0], optionsWithAnOptionalValue = [] } = {}) => ({
+  subcommands: subcommands === null ? null : new Set(subcommands),
+  globalOptionsWithAValue: globalOptionsWithAValue.length === 0 ? NO_OPTIONS : new Set(globalOptionsWithAValue),
+  optionsWithAnOptionalValue: optionsWithAnOptionalValue.length === 0 ? NO_OPTIONS : new Set(optionsWithAnOptionalValue),
+  readings: optionReadings.flatMap((options) => operandsBeforeTheCommand.map((operands) => wrapperSyntax(options, operands)))
+});
+var UV_GLOBAL_OPTIONS_WITH_A_VALUE = [
+  "--directory",
+  "--project",
+  "--cache-dir",
+  "--config-file",
+  "--color",
+  "--python-preference",
+  "--allow-insecure-host"
+];
+var UV_RUN_OPTIONS_WITH_A_VALUE = [
+  ...UV_GLOBAL_OPTIONS_WITH_A_VALUE,
+  "--with",
+  "--with-editable",
+  "--with-requirements",
+  "--python",
+  "-p",
+  "--package",
+  "--extra",
+  "--group",
+  "--only-group",
+  "--no-group",
+  "--env-file",
+  "--index",
+  "--default-index",
+  "--index-url",
+  "-i",
+  "--extra-index-url",
+  "--find-links",
+  "-f",
+  "--index-strategy",
+  "--keyring-provider",
+  "--resolution",
+  "--prerelease",
+  "--exclude-newer",
+  "--link-mode",
+  "--config-setting",
+  "-C",
+  "--refresh-package",
+  "--reinstall-package",
+  "--upgrade-package",
+  "-P",
+  "--no-build-package",
+  "--no-binary-package"
+];
+var POETRY_OPTIONS_WITH_A_VALUE = ["-C", "--directory", "-P", "--project"];
+var OP_OPTIONS_WITH_A_VALUE = ["--env-file", "--account", "--config", "--encoding", "--session", "--cache"];
+var DOTENV_OPTIONS_WITH_A_VALUE = ["-e", "-v", "-p"];
+var DOTENV_OPTIONS_WITH_AN_OPTIONAL_VALUE = ["-c"];
+var SCRIPT_COMMAND_STRING_OPTIONS = /* @__PURE__ */ new Set(["-c", "--command"]);
+var SCRIPT_OPTIONS_WITH_A_VALUE = [
+  ...SCRIPT_COMMAND_STRING_OPTIONS,
+  "-t",
+  "-T",
+  "-E",
+  "--echo",
+  "-I",
+  "--log-in",
+  "-O",
+  "--log-out",
+  "-B",
+  "--log-io",
+  "--log-timing",
+  "-m",
+  "--logging-format",
+  "-o",
+  "--output-limit"
+];
+var SCRIPT = "script";
+var PNPM_OPTIONS_WITH_A_VALUE = ["-C", "--dir", "--filter", "-F", "--package", "--workspace-concurrency", "--reporter", "--loglevel"];
+var YARN_OPTIONS_WITH_A_VALUE = ["--cwd", "-p", "--package"];
+var NPM_OPTIONS_WITH_A_VALUE = ["--prefix", "-w", "--workspace", "--package", "--userconfig", "--cache", "--registry", "--loglevel"];
+var HATCH_OPTIONS_WITH_A_VALUE = ["-e", "--env", "-p", "--project", "--data-dir", "--cache-dir", "--config"];
+var PDM_OPTIONS_WITH_A_VALUE = ["-p", "--project"];
+var DOCKER_OPTIONS_WITH_A_VALUE = [
+  "--context",
+  "-H",
+  "--host",
+  "--config",
+  "-l",
+  "--log-level",
+  "-e",
+  "--env",
+  "--env-file",
+  "-u",
+  "--user",
+  "-w",
+  "--workdir",
+  "--detach-keys"
+];
+var KUBECTL_OPTIONS_WITH_A_VALUE = [
+  "-n",
+  "--namespace",
+  "--context",
+  "--kubeconfig",
+  "--cluster",
+  "--user",
+  "-s",
+  "--server",
+  "--token",
+  "--as",
+  "-c",
+  "--container",
+  "-f",
+  "--filename",
+  "--pod-running-timeout"
+];
+var PIXI_OPTIONS_WITH_A_VALUE = ["-e", "--environment", "--manifest-path"];
+var CONDA_OPTIONS_WITH_A_VALUE = ["-n", "--name", "-p", "--prefix", "--cwd"];
+var PIPX_OPTIONS_WITH_A_VALUE = ["--spec", "--python", "--index-url", "--pip-args"];
+var VOLTA_OPTIONS_WITH_A_VALUE = ["--node", "--npm", "--yarn", "--pnpm", "--env"];
+var DEVCONTAINER_OPTIONS_WITH_A_VALUE = [
+  "--workspace-folder",
+  "--container-id",
+  "--id-label",
+  "--config",
+  "--override-config",
+  "--remote-env",
+  "--docker-path",
+  "--docker-compose-path",
+  "--log-level",
+  "--log-format",
+  "--terminal-columns",
+  "--terminal-rows",
+  "--user-data-folder"
+];
+var FLOX_OPTIONS_WITH_A_VALUE = ["-d", "--dir", "-r", "--remote", "-m", "--mode", "-c", "--command"];
+var RUNNER_SYNTAX = /* @__PURE__ */ new Map([
+  ["uv", runnerSyntax(["run"], [UV_RUN_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: UV_GLOBAL_OPTIONS_WITH_A_VALUE })],
+  ["poetry", runnerSyntax(["run"], [POETRY_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: POETRY_OPTIONS_WITH_A_VALUE })],
+  ["bundle", runnerSyntax(["exec"], [[]])],
+  ["op", runnerSyntax(["run"], [OP_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: OP_OPTIONS_WITH_A_VALUE })],
+  ["dotenv", runnerSyntax(null, [DOTENV_OPTIONS_WITH_A_VALUE], { optionsWithAnOptionalValue: DOTENV_OPTIONS_WITH_AN_OPTIONAL_VALUE })],
+  [SCRIPT, runnerSyntax(null, [SCRIPT_OPTIONS_WITH_A_VALUE], { operandsBeforeTheCommand: [1] })],
+  ["pnpm", runnerSyntax(["exec", "dlx"], [PNPM_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: PNPM_OPTIONS_WITH_A_VALUE })],
+  ["yarn", runnerSyntax(["exec", "dlx"], [YARN_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: YARN_OPTIONS_WITH_A_VALUE })],
+  ["npm", runnerSyntax(["exec", "x"], [NPM_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: NPM_OPTIONS_WITH_A_VALUE })],
+  ["pipenv", runnerSyntax(["run"], [["--python"]], { globalOptionsWithAValue: ["--python"] })],
+  ["hatch", runnerSyntax(["run"], [HATCH_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: HATCH_OPTIONS_WITH_A_VALUE })],
+  ["rye", runnerSyntax(["run"], [["--pyproject"]], { globalOptionsWithAValue: ["--pyproject"] })],
+  ["pdm", runnerSyntax(["run"], [PDM_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: PDM_OPTIONS_WITH_A_VALUE })],
+  ["direnv", runnerSyntax(["exec"], [[]], { operandsBeforeTheCommand: [1] })],
+  ["docker", runnerSyntax(["exec"], [DOCKER_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: DOCKER_OPTIONS_WITH_A_VALUE, operandsBeforeTheCommand: [1] })],
+  ["kubectl", runnerSyntax(["exec"], [KUBECTL_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: KUBECTL_OPTIONS_WITH_A_VALUE, operandsBeforeTheCommand: [1] })],
+  ["bun", runnerSyntax(["x"], [["-p", "--package"]])],
+  ["pixi", runnerSyntax(["run"], [PIXI_OPTIONS_WITH_A_VALUE], { globalOptionsWithAValue: PIXI_OPTIONS_WITH_A_VALUE })],
+  ["conda", runnerSyntax(["run"], [CONDA_OPTIONS_WITH_A_VALUE])],
+  ["mamba", runnerSyntax(["run"], [CONDA_OPTIONS_WITH_A_VALUE])],
+  ["micromamba", runnerSyntax(["run"], [CONDA_OPTIONS_WITH_A_VALUE])],
+  ["asdf", runnerSyntax(["exec"], [[]])],
+  ["pipx", runnerSyntax(["run"], [PIPX_OPTIONS_WITH_A_VALUE])],
+  ["volta", runnerSyntax(["run"], [VOLTA_OPTIONS_WITH_A_VALUE])],
+  ["rbenv", runnerSyntax(["exec"], [[]])],
+  ["pyenv", runnerSyntax(["exec"], [[]])],
+  ["nodenv", runnerSyntax(["exec"], [[]])],
+  ["goenv", runnerSyntax(["exec"], [[]])],
+  ["jenv", runnerSyntax(["exec"], [[]])],
+  ["plenv", runnerSyntax(["exec"], [[]])],
+  ["nvm", runnerSyntax(["exec"], [[]], { operandsBeforeTheCommand: [0, 1] })],
+  ["devcontainer", runnerSyntax(["exec"], [DEVCONTAINER_OPTIONS_WITH_A_VALUE])],
+  ["flox", runnerSyntax(["activate"], [FLOX_OPTIONS_WITH_A_VALUE])]
+]);
+var MISE_OPTIONS_WITH_A_VALUE = ["-C", "--cd", "-E", "--env"];
+var endOfOptionsRunner = (subcommands, globalOptionsWithAValue = []) => ({ subcommands: new Set(subcommands), globalOptionsWithAValue: new Set(globalOptionsWithAValue) });
+var END_OF_OPTIONS_RUNNERS = /* @__PURE__ */ new Map([
+  ["doppler", endOfOptionsRunner(["run"], ["-p", "--project", "-c", "--config", "--token", "--scope"])],
+  ["infisical", endOfOptionsRunner(["run"], ["--domain", "--token"])],
+  ["aws-vault", endOfOptionsRunner(["exec"], ["--backend", "--keychain"])],
+  ["chamber", endOfOptionsRunner(["exec"], ["-b", "--backend"])],
+  ["mise", endOfOptionsRunner(["exec", "x"], MISE_OPTIONS_WITH_A_VALUE)],
+  ["rtx", endOfOptionsRunner(["exec", "x"], MISE_OPTIONS_WITH_A_VALUE)],
+  ["op", endOfOptionsRunner(["run"], OP_OPTIONS_WITH_A_VALUE)],
+  ["kubectl", endOfOptionsRunner(["exec", "run"], KUBECTL_OPTIONS_WITH_A_VALUE)],
+  ["oc", endOfOptionsRunner(["exec", "run"], KUBECTL_OPTIONS_WITH_A_VALUE)],
+  ["docker", endOfOptionsRunner(["exec", "compose"], DOCKER_OPTIONS_WITH_A_VALUE)],
+  ["docker-compose", endOfOptionsRunner(["exec", "run"], ["-f", "--file", "-p", "--project-name", "--env-file", "--profile"])],
+  ["podman", endOfOptionsRunner(["exec"], ["--url", "--connection", "-c", "--identity", "--root", "--runroot", "--log-level"])],
+  ["nerdctl", endOfOptionsRunner(["exec"], ["-n", "--namespace", "-a", "--address", "-H", "--host"])],
+  ["flox", endOfOptionsRunner(["activate"], FLOX_OPTIONS_WITH_A_VALUE)],
+  ["devbox", endOfOptionsRunner(["run"])],
+  ["fnm", endOfOptionsRunner(["exec"], ["--fnm-dir", "--log-level", "--node-dist-mirror", "--arch", "--version-file-strategy"])],
+  ["dotenvx", endOfOptionsRunner(["run"])],
+  ["teller", endOfOptionsRunner(["run"], ["-c", "--config"])],
+  ["berglas", endOfOptionsRunner(["exec"], ["-l", "--log-level", "--log-format"])],
+  ["nx", endOfOptionsRunner(["exec"])],
+  ["lerna", endOfOptionsRunner(["exec"], ["--loglevel"])],
+  ["stack", endOfOptionsRunner(["exec"], ["--stack-yaml", "--resolver", "--work-dir"])],
+  ["cabal", endOfOptionsRunner(["exec"], ["--project-file"])],
+  ["opam", endOfOptionsRunner(["exec"], ["--switch", "--root"])],
+  ["tox", endOfOptionsRunner(["exec"], ["-c", "--conf", "--root", "--workdir"])],
+  ["aqua", endOfOptionsRunner(["exec"], ["-c", "--config", "-l", "--log-level"])],
+  ["pixi", endOfOptionsRunner(["exec"], PIXI_OPTIONS_WITH_A_VALUE)],
+  ["hermit", endOfOptionsRunner(["exec"], ["--level"])],
+  ["toolbox", endOfOptionsRunner(["run"], ["--log-level"])],
+  ["railway", endOfOptionsRunner(["run"])],
+  ["heroku", endOfOptionsRunner(["run"])],
+  ["secrethub", endOfOptionsRunner(["run"])],
+  ["phase", endOfOptionsRunner(["run"])]
+]);
+var commandAfterARunnersEndOfOptions = ({ program, args }) => {
+  const syntax = END_OF_OPTIONS_RUNNERS.get(basenameOf(program?.text ?? ""));
+  const at = syntax === void 0 ? -1 : indexPastOptions(args, syntax.globalOptionsWithAValue);
+  if (syntax === void 0 || !syntax.subcommands.has(args[at]?.text ?? "")) return [];
+  const end = args.findIndex((arg, index) => index > at && arg.text === END_OF_OPTIONS3);
+  const command = end === -1 ? void 0 : args[end + 1];
+  return command === void 0 ? [] : [{ program: command, args: args.slice(end + 2) }];
+};
+var indexPastOptions = (words, optionsWithAValue) => {
+  let index = 0;
+  while (index < words.length && FLAG.test(words[index]?.text ?? "") && words[index]?.text !== END_OF_OPTIONS3) {
+    index += wrapperOptionConsumesNextWord(words[index]?.text ?? "", optionsWithAValue) ? 2 : 1;
+  }
+  return index;
+};
+var runnerArgsOf = (args, syntax) => {
+  if (syntax.subcommands === null) return args;
+  const at = indexPastOptions(args, syntax.globalOptionsWithAValue);
+  return syntax.subcommands.has(args[at]?.text ?? "") ? args.slice(at + 1) : null;
+};
+var optionalValueIsGiven = (words, index, optional) => optional.has(words[index]?.text ?? "") && !FLAG.test(words[index + 1]?.text ?? END_OF_OPTIONS3);
+var commandStartAfterRunnerOptions = (words, reading, optional) => {
+  let index = 0;
+  while (index < words.length) {
+    const text3 = words[index]?.text ?? "";
+    if (text3 === END_OF_OPTIONS3) return index + 1 + reading.operandsBeforeTheCommand;
+    if (!SHELL_ENV_ASSIGNMENT.test(text3) && (!FLAG.test(text3) || text3 === STANDARD_INPUT_ARGUMENT)) break;
+    const takesTheNextWord = wrapperOptionConsumesNextWord(text3, reading.optionsWithAValue) || optionalValueIsGiven(words, index, optional);
+    index += takesTheNextWord ? 2 : 1;
+  }
+  return index + reading.operandsBeforeTheCommand;
+};
+var pastAnEndOfOptions = (words, index) => words[index]?.text === END_OF_OPTIONS3 ? index + 1 : index;
+var commandARunnerReadingRuns = (words, reading, syntax) => {
+  const start = pastAnEndOfOptions(words, commandStartAfterRunnerOptions(words, reading, syntax.optionsWithAnOptionalValue));
+  const command = words[start];
+  return command === void 0 ? [] : [{ program: command, args: words.slice(start + 1) }];
+};
+var isANamedRunnerCall = ({ program, args }) => {
+  const syntax = RUNNER_SYNTAX.get(basenameOf(program?.text ?? ""));
+  return syntax !== void 0 && runnerArgsOf(args, syntax) !== null;
+};
+var runnerRunsWhatASubstitutionPrints = (segment, innermost) => segment.feedsASubstitution && isANamedRunnerCall(innermost) && commandsANamedRunnerRuns(innermost).length === 0;
+var commandsANamedRunnerRuns = ({ program, args }) => {
+  const syntax = RUNNER_SYNTAX.get(basenameOf(program?.text ?? ""));
+  const words = syntax === void 0 ? null : runnerArgsOf(args, syntax);
+  if (syntax === void 0 || words === null) return [];
+  return syntax.readings.flatMap((reading) => commandARunnerReadingRuns(words, reading, syntax));
+};
+var COMMAND_AFTER_AN_OPTION = /* @__PURE__ */ new Map([
+  ["nix", { subcommands: /* @__PURE__ */ new Set(["develop", "shell"]), options: /* @__PURE__ */ new Set(["-c", "--command"]) }]
+]);
+var commandAfterAnOption = ({ program, args }) => {
+  const syntax = COMMAND_AFTER_AN_OPTION.get(basenameOf(program?.text ?? ""));
+  if (syntax === void 0 || !args.some((arg) => syntax.subcommands.has(arg.text))) return [];
+  const option = args.findIndex((arg) => syntax.options.has(arg.text));
+  const command = option === -1 ? void 0 : args[option + 1];
+  return command === void 0 ? [] : [{ program: command, args: args.slice(option + 2) }];
+};
+var PROGRAM_TEXT_THAT_RUNS_A_SUBSTITUTION = /\$\(|`/;
+var runnerProgramIsHidden = (invocation) => programIsHidden(invocation) || PROGRAM_TEXT_THAT_RUNS_A_SUBSTITUTION.test(invocation.program?.text ?? "");
+var everyReadingHidesItsProgram = (readings) => readings.length > 0 && readings.every(runnerProgramIsHidden);
+var SHORT_OPTION_CLUSTER_ENDING_IN_C = /^-[A-Za-z]*c$/;
+var COMMAND_STRING_SYNTAX = /* @__PURE__ */ new Map([
+  [SCRIPT, { options: SCRIPT_COMMAND_STRING_OPTIONS, longOptionsWithAValue: ["--command="], cluster: SHORT_OPTION_CLUSTER_ENDING_IN_C }],
+  ["mise", { options: /* @__PURE__ */ new Set(["-c", "--command"]), longOptionsWithAValue: ["--command="], cluster: null }],
+  ["npm", { options: /* @__PURE__ */ new Set(["-c", "--call"]), longOptionsWithAValue: ["--call="], cluster: null }],
+  ["nix-shell", { options: /* @__PURE__ */ new Set(["--run", "--command"]), longOptionsWithAValue: [], cluster: null }],
+  ["flox", { options: /* @__PURE__ */ new Set(["-c", "--command"]), longOptionsWithAValue: ["--command="], cluster: null }],
+  ["doppler", { options: /* @__PURE__ */ new Set(["--command"]), longOptionsWithAValue: ["--command="], cluster: null }]
+]);
+var commandStringAt = (args, index, syntax) => {
+  const text3 = args[index]?.text ?? "";
+  const assignment = syntax.longOptionsWithAValue.find((option) => text3.startsWith(option));
+  if (assignment !== void 0) return text3.slice(assignment.length);
+  return syntax.options.has(text3) || (syntax.cluster?.test(text3) ?? false) ? args[index + 1] : void 0;
+};
+var COMMAND_STRING_OPERAND = /* @__PURE__ */ new Map([
+  ["sops", { subcommand: "exec-env", reading: wrapperSyntax(["--user"], 1) }]
+]);
+var commandStringOperandOf = ({ program, args }) => {
+  const syntax = COMMAND_STRING_OPERAND.get(basenameOf(program?.text ?? ""));
+  const at = syntax === void 0 ? -1 : args.findIndex((arg) => arg.text === syntax.subcommand);
+  if (syntax === void 0 || at === -1) return [];
+  const words = args.slice(at + 1);
+  const operand = words[commandStartAfterWrapper(words, syntax.reading)];
+  return operand === void 0 ? [] : [operand];
+};
+var isACommandString = (value) => value !== void 0;
+var commandStringExpands = (value) => typeof value !== "string" && value.expands;
+var commandStringText = (value) => typeof value === "string" ? value : value.text;
+var commandStringOptionsOf = ({ program, args }) => {
+  const syntax = COMMAND_STRING_SYNTAX.get(basenameOf(program?.text ?? ""));
+  return syntax === void 0 ? [] : args.map((_, index) => commandStringAt(args, index, syntax)).filter(isACommandString);
+};
+var commandStringsARunnerRuns = (invocation) => {
+  const values = [...commandStringOptionsOf(invocation), ...commandStringOperandOf(invocation)];
+  if (values.length === 0) return NO_INLINE_SCRIPT;
+  if (values.some(commandStringExpands)) return HIDDEN_INLINE_SCRIPT;
+  return { kind: "readable", scripts: values.map(commandStringText) };
+};
+var MAX_SHELL_FUNCTIONS_READ = 8;
+var SHELL_FUNCTION_HEADER = /(?:^|[;&|\n(]|\s)(?:function\s+([A-Za-z_][\w.-]*)\s*(?:\(\s*\))?|([A-Za-z_][\w.-]*)\s*\(\s*\))\s*\{/g;
+var OPENING_BRACE = "{";
+var CLOSING_BRACE = "}";
+var indexOfTheMatchingBrace = (visible, opening) => {
+  let depth = 0;
+  for (let index = opening; index < visible.length; index += 1) {
+    if (visible[index] === OPENING_BRACE) depth += 1;
+    if (visible[index] === CLOSING_BRACE && (depth -= 1) === 0) return index;
+  }
+  return -1;
+};
+var shellFunctionsDefinedIn = (command) => {
+  const visible = shellVisibleText(command);
+  if (visible === null || visible.length !== command.length) return [];
+  return [...visible.matchAll(SHELL_FUNCTION_HEADER)].slice(0, MAX_SHELL_FUNCTIONS_READ + 1).flatMap((match) => {
+    const opening = match.index + match[0].length - 1;
+    const closing = indexOfTheMatchingBrace(visible, opening);
+    const name = match[1] ?? match[2];
+    return name === void 0 || closing === -1 ? [] : [{ name, body: command.slice(opening + 1, closing).trim() }];
+  });
+};
+var segmentCalls = (segment, name) => segment.invocation.program?.text === name || innermostInvocation(segment.invocation).program?.text === name;
+var callsAProgramNamed = (segments, name) => segments.some((segment) => segmentCalls(segment, name));
+var TOO_MANY_FUNCTIONS = { kind: "too_many" };
+var bodiesOfFunctionsCalledIn = (command, segments) => {
+  const defined = shellFunctionsDefinedIn(command);
+  if (defined.length > MAX_SHELL_FUNCTIONS_READ) return TOO_MANY_FUNCTIONS;
+  return { kind: "readable", bodies: defined.filter((fn) => fn.body.length > 0 && callsAProgramNamed(segments, fn.name)).map((fn) => fn.body) };
+};
+var runnerReadingOf = (innermost) => {
+  const named = [...commandsANamedRunnerRuns(innermost), ...commandAfterAnOption(innermost)];
+  const afterEndOfOptions = commandAfterARunnersEndOfOptions(innermost);
+  const scripts = commandStringsARunnerRuns(innermost);
+  if (scripts.kind === "hidden" || everyReadingHidesItsProgram(named)) return HIDDEN_INLINE_SCRIPT;
+  const fromScript = scripts.kind === "readable" ? scripts.scripts : [];
+  const commands = [.../* @__PURE__ */ new Set([...fromScript, ...named.map(verbatimInvocationText), ...afterEndOfOptions.map(verbatimInvocationText)])];
+  return commands.length === 0 ? NO_INLINE_SCRIPT : { kind: "readable", scripts: commands };
+};
+var MAX_SPELLED_FORMS = 4096;
+var markTruncated = (accumulator) => {
+  accumulator.hidesWhatItRuns = true;
+  accumulator.truncated = true;
+};
+var addSpelledForm = (accumulator, form) => {
+  if (accumulator.forms.length >= MAX_SPELLED_FORMS) {
+    markTruncated(accumulator);
+    return;
+  }
+  accumulator.forms.push(form);
+};
+var addSpelledForms = (accumulator, forms) => {
+  for (const form of forms) addSpelledForm(accumulator, form);
+};
+var spellCommandInto = (accumulator, command, depth, reach) => {
+  if (depth > MAX_SPELLING_DEPTH) {
+    accumulator.hidesWhatItRuns = true;
+    return;
+  }
+  if (accumulator.forms.length >= MAX_SPELLED_FORMS) {
+    markTruncated(accumulator);
+    return;
+  }
+  accumulator.hidesWhatItRuns ||= runsASubstitutionAsAProgram(command);
+  const spellNested = (nested) => {
+    addSpelledForm(accumulator, nested);
+    spellCommandInto(accumulator, nested, depth + 1, reach);
+  };
+  const segments = spelledSegmentsOf(command);
+  for (const segment of segments) {
     const innermost = innermostInvocation(segment.invocation);
     const scripts = inlineScriptsOf(innermost, segment.heredocs);
-    forms.push(segment.text, ...spellingsOfAnInvocation(segment.invocation, innermost));
-    hidesWhatItRuns ||= segmentHidesWhatItRuns(segment, innermost, scripts);
-    for (const nested of commandsNestedIn(innermost, scripts)) {
-      const inner = commandSpellingsAt(nested, depth + 1);
-      forms.push(nested, ...inner.forms);
-      hidesWhatItRuns ||= inner.hidesWhatItRuns;
-    }
+    addSpelledForm(accumulator, segment.text);
+    addSpelledForms(accumulator, spellingsOfAnInvocation(segment.invocation, innermost));
+    accumulator.hidesWhatItRuns ||= segmentHidesWhatItRuns(segment, innermost, scripts);
+    for (const nested of commandsNestedIn(innermost, scripts)) spellNested(nested);
+    const ranOnBehalf = readsCommandRunners(reach) ? runnerReadingOf(innermost) : NO_INLINE_SCRIPT;
+    accumulator.hidesWhatItRuns ||= ranOnBehalf.kind === "hidden" || readsCommandRunners(reach) && runnerRunsWhatASubstitutionPrints(segment, innermost);
+    if (ranOnBehalf.kind === "readable") for (const nested of ranOnBehalf.scripts) spellNested(nested);
+  }
+  if (!readsCommandRunners(reach) || depth > 0) return;
+  const functions = bodiesOfFunctionsCalledIn(command, segments);
+  accumulator.hidesWhatItRuns ||= functions.kind === "too_many";
+  if (functions.kind === "readable") for (const body of functions.bodies) spellNested(body);
+};
+var commandSpellings = (command, reach) => {
+  const accumulator = { forms: [], hidesWhatItRuns: false, truncated: false };
+  try {
+    spellCommandInto(accumulator, command, 0, reach);
+  } catch {
+    return SPELLINGS_OF_AN_UNREADABLE_COMMAND;
   }
-  return { forms, hidesWhatItRuns };
+  const completeness = accumulator.truncated ? "truncated" : "complete";
+  return { forms: accumulator.forms, hidesWhatItRuns: accumulator.hidesWhatItRuns, completeness };
 };
-var commandSpellings = (command) => commandSpellingsAt(command, 0);
 var passesItsInputToSomethingThatCanAct = (segment) => segment.readsInput && !isSafeReadOnlyCommand(verbatimInvocationText(segment.invocation));
 var feedsTextToSomethingThatCanAct = (command) => roughSegmentsOf(command).some(passesItsInputToSomethingThatCanAct);
+var NOT_READ_IN_FULL = { kind: "not_read_in_full" };
 var readingsThatCanAct = (command) => {
-  const spellings = commandSpellings(command).forms;
-  return feedsTextToSomethingThatCanAct(command) ? [command, ...spellings] : spellings;
+  const spellings = commandSpellings(command, SPELLS_COMMAND_RUNNERS_TOO);
+  if (!spellingsAreComplete(spellings)) return NOT_READ_IN_FULL;
+  return { kind: "read", readings: feedsTextToSomethingThatCanAct(command) ? [command, ...spellings.forms] : spellings.forms };
+};
+var aReadingIsDestructive = (toolName, command) => {
+  const readings = readingsThatCanAct(command);
+  return readings.kind === "not_read_in_full" || readings.readings.some((reading) => classifyDecisionRisk(toolNameForAPosixReading(toolName), reading) === "destructive");
 };
 var withoutSessionToolGrants = (config) => ({
   ...config,
@@ -7791,20 +8199,20 @@ var coordinationFloorApplies = (toolName, rank) => readsOrStopsItsOwnWork(toolNa
 var argumentsAsWritten = (args) => ({ forms: args, hidesWhatItRuns: false });
 var namesAnArgumentOf = (pattern, toolName) => pattern.startsWith(`${toolName}(`);
 var isSpelledOut = (form) => form.length > 0;
-var restrictionReadingOf = (restrictingPatterns, toolName, args) => {
+var restrictionReadingOf = (restrictingPatterns, toolName, args, reach) => {
   const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
   if (command === void 0 || !restrictingPatterns.some((pattern) => namesAnArgumentOf(pattern, toolName))) {
     return argumentsAsWritten(args);
   }
-  const spellings = commandSpellings(command);
+  const spellings = commandSpellings(command, reach);
   return {
     forms: [.../* @__PURE__ */ new Set([...args, ...spellings.forms.filter(isSpelledOut)])],
     hidesWhatItRuns: POSIX_SHELL_TOOLS.has(toolName) && spellings.hidesWhatItRuns
   };
 };
-var formsOfEveryCandidate = (restrictingPatterns, toolName, args) => [...new Set(args.flatMap((arg) => restrictionReadingOf(restrictingPatterns, toolName, [arg]).forms))];
+var formsOfEveryCandidate = (restrictingPatterns, toolName, args) => [...new Set(args.flatMap((arg) => restrictionReadingOf(restrictingPatterns, toolName, [arg], SPELLS_COMMAND_RUNNERS_TOO).forms))];
 var restrictingPatternsOf = (policies) => policies.filter(restricts).map((policy) => policy.tool);
-var policyReadingOf = (policies, toolName, args) => restrictionReadingOf(restrictingPatternsOf(policies), toolName, args);
+var policyReadingOf = (policies, toolName, args, reach) => restrictionReadingOf(restrictingPatternsOf(policies), toolName, args, reach);
 var stricterRule = (current, challenger) => current !== void 0 && (challenger === void 0 || comparePolicyStrictness(current.policy, challenger.policy) > 0) ? current : challenger;
 var restrictsAnArgumentOf = (policy, toolName) => restricts(policy) && namesAnArgumentOf(policy.tool, toolName);
 var strictestRuleNamingAnArgument = (pool, toolName, repoKey, sessionId) => pool.filter((policy) => restrictsAnArgumentOf(policy, toolName) && appliesToThisCall(policy, repoKey, sessionId)).reduce((strictest, policy) => stricterRule(strictest, { policy, rank: "prefix" }), void 0);
@@ -7815,7 +8223,7 @@ var governingRuleForReading = (pool, toolName, args, reading, repoKey, sessionId
 var resolveAutoResolveOrigin = (config, toolName, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
-  const reading = policyReadingOf(config.policies, toolName, args);
+  const reading = policyReadingOf(config.policies, toolName, args, SPELLS_COMMAND_RUNNERS_TOO);
   const rank = governingRuleForReading(config.policies, toolName, args, reading, repoKey, sessionId)?.rank;
   if (shellReadOnlyFloorApplies(toolName, arg, rank) || coordinationFloorApplies(toolName, rank)) {
     return DECISION_ORIGIN.safeReadonly;
@@ -7845,12 +8253,12 @@ var unmatchedPolicyOf = (config, toolName) => ({
 });
 var sessionToolGrantCannotCover = (toolName, arg, toolInput) => typeof arg === "string" && commandNeedsAPerson(toolName, arg) || parseMcpToolName(toolName) !== void 0 && (toolInput === void 0 || !mcpToolInputOnlyReads(toolName, toolInput));
 var stricterOfTheReadings = (asWritten, asSpelled, unmatched) => comparePolicyStrictness(asWritten?.policy ?? unmatched, asSpelled?.policy ?? unmatched) > 0 ? asWritten : asSpelled;
-var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+var resolvePolicyReading = (reach, config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
   const args = toolInput ? policyArgForms(toolName, toolInput, cwd) : [];
   const arg = args[0];
   const unmatched = unmatchedPolicyOf(config, toolName);
   const asWritten = layeredGoverningRule(config, toolName, args, argumentsAsWritten(args), repoKey, sessionId);
-  const asSpelled = layeredGoverningRule(config, toolName, args, policyReadingOf(config.policies, toolName, args), repoKey, sessionId);
+  const asSpelled = layeredGoverningRule(config, toolName, args, policyReadingOf(config.policies, toolName, args, reach), repoKey, sessionId);
   const match = stricterOfTheReadings(asWritten, asSpelled, unmatched);
   let base = match?.policy ?? unmatched;
   const governedBySpecificRule = isSpecificArgumentRank(match?.rank);
@@ -7860,7 +8268,7 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
   const aRuleNamesASpelling = isSpecificArgumentRank(asSpelled?.rank);
   const approvedByReadOnlyFloor = !isAutoDeny(base) && (shellReadOnlyFloorApplies(toolName, arg, match?.rank) && !aRuleNamesASpelling || coordinationFloorApplies(toolName, match?.rank));
   if (governedBySessionToolGrant && !approvedByReadOnlyFloor && sessionToolGrantCannotCover(toolName, arg, toolInput)) {
-    return resolvePolicy(withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
+    return resolvePolicyReading(reach, withoutSessionToolGrants(config), toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
   }
   if (approvedByReadOnlyFloor) {
     base = autoApprove(base.tool);
@@ -7881,6 +8289,29 @@ var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, se
   }
   return base;
 };
+var resolvePolicy = (config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId) => {
+  const withoutRunners = resolvePolicyReading(SPELLS_WITHOUT_COMMAND_RUNNERS, config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
+  const withRunners = resolvePolicyReading(SPELLS_COMMAND_RUNNERS_TOO, config, toolName, modeOverride, toolInput, cwd, repoKey, sessionId);
+  return strictestReadingOf(withRunners, withoutRunners);
+};
+var VERDICT_RESTRAINT = { allow: 0, requires_human: 1, deny: 2 };
+var verdictRestraint = (policy) => VERDICT_RESTRAINT[verdictForPolicy(policy)];
+var asksAtLeastAsHard = (policy, than) => restraintRank(policy) >= restraintRank(than) && TIMEOUT_ACTION_STRICTNESS[policy.timeoutAction] >= TIMEOUT_ACTION_STRICTNESS[than.timeoutAction] && policy.timeoutSeconds >= than.timeoutSeconds && policy.pushFirstSeconds <= than.pushFirstSeconds;
+var stricterModeOf = (policy, other) => restraintRank(other) > restraintRank(policy) ? other.mode : policy.mode;
+var stricterTimeoutActionOf = (policy, other) => TIMEOUT_ACTION_STRICTNESS[other.timeoutAction] > TIMEOUT_ACTION_STRICTNESS[policy.timeoutAction] ? other.timeoutAction : policy.timeoutAction;
+var askingHardestOfBoth = (policy, other) => ({
+  ...policy,
+  mode: stricterModeOf(policy, other),
+  timeoutAction: stricterTimeoutActionOf(policy, other),
+  timeoutSeconds: Math.max(policy.timeoutSeconds, other.timeoutSeconds),
+  pushFirstSeconds: Math.min(policy.pushFirstSeconds, other.pushFirstSeconds)
+});
+var strictestReadingOf = (withRunners, withoutRunners) => {
+  const verdicts = verdictRestraint(withRunners) - verdictRestraint(withoutRunners);
+  if (verdicts !== 0) return verdicts > 0 ? withRunners : withoutRunners;
+  if (verdictForPolicy(withoutRunners) !== "requires_human" || asksAtLeastAsHard(withoutRunners, withRunners)) return withoutRunners;
+  return asksAtLeastAsHard(withRunners, withoutRunners) ? withRunners : askingHardestOfBoth(withoutRunners, withRunners);
+};
 var restraintRank = (policy) => {
   if (isAutoDeny(policy)) return 4;
   if (isAutoApprove(policy)) return 0;
@@ -8161,7 +8592,7 @@ var everyCommandSegmentGranted = (rules, toolName, command) => {
   return segments !== null && segments.every((segment) => isSafeReadOnlyCommand(segment) || anyRuleGrants(rules, toolName, [segment]));
 };
 var agentRuleReadingOf = (rules, toolName, args) => {
-  const reading = restrictionReadingOf([...rules.ask, ...rules.deny], toolName, args);
+  const reading = restrictionReadingOf([...rules.ask, ...rules.deny], toolName, args, SPELLS_COMMAND_RUNNERS_TOO);
   const command = toolName in POLICY_COMMAND_KEYS ? args[0] : void 0;
   const normalized = command === void 0 ? null : normalizedCommand(command);
   return normalized === null ? reading : { ...reading, forms: [...reading.forms, normalized] };
@@ -8195,7 +8626,7 @@ var aChosenRuleGoverns = (input, counts = everyRule) => {
   if (routes === null) return true;
   return input.toolInputs.some((toolInput) => {
     const args = policyArgForms(input.toolName, toolInput, input.cwd);
-    const reading = policyReadingOf(chosen, input.toolName, args);
+    const reading = policyReadingOf(chosen, input.toolName, args, SPELLS_COMMAND_RUNNERS_TOO);
     const governing = governingRuleForReading(chosen, input.toolName, args, reading, input.repoKey, input.sessionId);
     return governing !== void 0 && counts(governing.policy) || findBestRoute(routes, input.toolName, args, input.repoKey) !== void 0;
   });
@@ -8635,6 +9066,11 @@ export {
   hookActivationResult,
   CLIENT_REPORT_PATH,
   clientContextHeaders,
+  CREDENTIAL_REJECTION_HEADER,
+  CREDENTIAL_REJECTED,
+  CREDENTIAL_REJECTION_STATUS,
+  MCP_CREDENTIAL_REJECTION_BODY,
+  responseRejectsCredential,
   TOOL_FAILURE_CODES,
   isToolErrorResult,
   toolFailureCodeOfResult,
@@ -8646,6 +9082,9 @@ export {
   readSetupAgentFailures,
   isSetupConnectMode,
   readSetupOutcomeProperties,
+  POLICY_REQUEST_CAPABILITIES_HEADER,
+  CLI_POLICY_REQUEST_CAPABILITIES,
+  policyRequestCapabilitiesHeaderValue,
   DECLINED_AGENTS_FILE,
   parseDeclinedAgents,
   serializeDeclinedAgents,

package/dist/{chunk-FR25IWL7.js → chunk-EPMIBLCE.js}

@@ -1,17 +1,20 @@
 import {
   keyCheckFromResponse
-} from "./chunk-QNUGTQKZ.js";
+} from "./chunk-OECCPPO6.js";
 import {
   installNetworkDefaults
-} from "./chunk-G6PHMB3F.js";
+} from "./chunk-5RVL2CQK.js";
+import {
+  fetchAsCredential
+} from "./chunk-PYAPWXVP.js";
 import {
   getBaseUrl
-} from "./chunk-RXRKX646.js";
+} from "./chunk-O76PTPKP.js";
 import {
   isRecord,
   isToolErrorResult,
   toolFailureCodeOfResult
-} from "./chunk-SALM3IYQ.js";
+} from "./chunk-DZE26BID.js";
 
 // src/retry.ts
 var isRetryable = (err) => {
@@ -105,12 +108,12 @@ var sendMcpRequest = async (apiKey, message, options = {}) => {
     if (options.sessionId) {
       headers["Mcp-Session-Id"] = options.sessionId;
     }
-    const response = await fetchFn(`${baseUrl}/api/mcp/mcp`, {
+    const response = await fetchAsCredential(apiKey, `${baseUrl}/api/mcp/mcp`, {
       method: "POST",
       headers,
       body: JSON.stringify(message),
       signal: options.timeoutMs ? AbortSignal.any([AbortSignal.timeout(options.timeoutMs), ...options.signal ? [options.signal] : []]) : options.signal
-    });
+    }, fetchFn);
     const lock = response.ok ? null : await keyCheckFromResponse(response, baseUrl);
     if (lock?.kind === "locked") throw new SubscriptionRequiredError(lock.plan, lock.upgradeUrl);
     const body = await response.text();