type WrapperScanDirective = "continue" | "consume-next" | "stop" | "invalid";

export function isEnvAssignment(token: string): boolean {

function isEnvAssignment(token: string): boolean {

return /^[A-Za-z_][A-Za-z0-9_]*=.*/.test(token);

}

DISPATCH_WRAPPER_SPECS.map((spec) => [spec.name, spec] as const),

);

export type DispatchWrapperUnwrapResult =

type DispatchWrapperUnwrapResult =

| { kind: "not-wrapper" }

| { kind: "blocked"; wrapper: string }

| { kind: "unwrapped"; wrapper: string; argv: string[] };

export type DispatchWrapperTrustPlan = {

type DispatchWrapperTrustPlan = {

argv: string[];

wrappers: string[];

policyBlocked: boolean;

} from "./plugin-approvals.js";

const log = createSubsystemLogger("gateway/exec-approvals");

export type { ExecApprovalRequest, ExecApprovalResolved };

type DeliverOutboundPayloads = typeof import("./outbound/deliver.js").deliverOutboundPayloads;

type MaybePromise<T> = T | Promise<T>;

type ResolveSessionTargetFn = (params: {

stop: () => void;

};

export type ExecApprovalForwarderDeps = {

type ExecApprovalForwarderDeps = {

getConfig?: () => OpenClawConfig;

deliver?: DeliverOutboundPayloads;

nowMs?: () => number;

ask?: ExecAsk;

};

export type ExecPolicyHostSummary = {

type ExecPolicyHostSummary = {

requested: ExecTarget;

requestedSource: string;

};

export type ExecPolicyFieldSummary<TValue extends ExecSecurity | ExecAsk> = {

type ExecPolicyFieldSummary<TValue extends ExecSecurity | ExecAsk> = {

requested: TValue;

requestedSource: string;

host: TValue;

allowedDecisions: readonly ExecApprovalDecision[];

};

export type ExecPolicyScopeSummary = Omit<ExecPolicyScopeSnapshot, "allowedDecisions">;

type ExecPolicyScopeSummary = Omit<ExecPolicyScopeSnapshot, "allowedDecisions">;

type ExecPolicyRequestedField = "security" | "ask";

});

}

export type ShellParserParityFixtureCase = {

type ShellParserParityFixtureCase = {

id: string;

command: string;

ok: boolean;

cases: ShellParserParityFixtureCase[];

};

export type WrapperResolutionParityFixtureCase = {

type WrapperResolutionParityFixtureCase = {

id: string;

argv: string[];

expectedRawExecutable: string | null;

error?: string | null;

};

export type ExecHostError = {

type ExecHostError = {

code: string;

message: string;

reason?: string;

import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";

import { normalizeExecutableToken } from "./exec-wrapper-resolution.js";

export type InterpreterInlineEvalHit = {

type InterpreterInlineEvalHit = {

executable: string;

normalizedExecutable: string;

flag: string;

type WritableTrustedSafeBinDir,

} from "./exec-safe-bin-trust.js";

export type ExecSafeBinConfigScope = {

type ExecSafeBinConfigScope = {

safeBins?: string[] | null;

safeBinProfiles?: SafeBinProfileFixtures | null;

safeBinTrustedDirs?: string[] | null;

import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";

export type SafeBinSemanticValidationParams = {

type SafeBinSemanticValidationParams = {

binName?: string;

positional: readonly string[];

};

return normalized.replace(/\.(?:exe|cmd|bat|com)$/i, "");

}

export function getSafeBinSemanticRule(binName?: string): SafeBinSemanticRule | undefined {

function getSafeBinSemanticRule(binName?: string): SafeBinSemanticRule | undefined {

const normalized = typeof binName === "string" ? normalizeSafeBinName(binName) : "";

return normalized ? SAFE_BIN_SEMANTIC_RULES[normalized] : undefined;

}

unwrapKnownShellMultiplexerInvocation,

} from "./shell-wrapper-resolution.js";

export type ExecWrapperTrustPlan = {

type ExecWrapperTrustPlan = {

argv: string[];

policyArgv: string[];

wrapperChain: string[];

import { normalizeLowercaseStringOrEmpty } from "../shared/string-coerce.js";

import { expandHomePrefix } from "./home-dir.js";

export function isDriveLessWindowsRootedPath(value: string): boolean {

function isDriveLessWindowsRootedPath(value: string): boolean {

return process.platform === "win32" && /^:[\\/]/.test(value);

}