import "./paths-C9FmTW1x.js";
import { H as isRich, U as theme } from "./agent-paths-BySKyq9I.js";
import "./agent-scope-CLn_Ws3B.js";
import { t as DEFAULT_AGENT_ID } from "./session-key-LmCHAJTQ.js";
import { d as defaultRuntime } from "./errors-Dx3S3Nrp.js";
import "./github-copilot-token-BA45-q56.js";
import "./chat-envelope-D_wSv26N.js";
import "./pairing-token-BFGorDQo.js";
import "./ip-D_T5zbZS.js";
import "./ws-cvQhrVP3.js";
import "./device-identity-DzUZ06fL.js";
import "./call-s6DNIELo.js";
import "./exec-approvals-allowlist-C5bxRc7H.js";
import { d as readExecApprovalsSnapshot, g as saveExecApprovals, h as resolveExecApprovalsFromFile } from "./node-match-BNTZ8TY5.js";
import { n as formatTimeAgo } from "./format-relative-BXoxEQVN.js";
import { t as formatDocsLink } from "./links-BeUKckiL.js";
import "./progress-CDqdg8f8.js";
import { n as callGatewayFromCli } from "./gateway-rpc-C9uKnQRG.js";
import "./systemd-ZvgpcrfV.js";
import "./service-DbZp-Ejz.js";
import { t as renderTable } from "./table-DEEHcEaS.js";
import { t as describeUnknownError } from "./shared-DPVx88-C.js";
import { i as resolveNodeId, r as nodesCallOpts } from "./rpc-BXcqHhDG.js";
import JSON5 from "json5";
import fs from "node:fs/promises";

//#region src/infra/exec-approvals-effective.ts
function normalizePolicyAgentId(agentId) {
	return (agentId?.trim() ?? "") || DEFAULT_AGENT_ID;
}
function policyOverrides(entry) {
	return {
		...entry?.security ? { security: entry.security } : {},
		...entry?.ask ? { ask: entry.ask } : {},
		...entry?.askFallback ? { askFallback: entry.askFallback } : {},
		...typeof entry?.autoAllowSkills === "boolean" ? { autoAllowSkills: entry.autoAllowSkills } : {}
	};
}
function allowlistPatterns(entry) {
	return (Array.isArray(entry?.allowlist) ? entry.allowlist : []).map((item) => item?.pattern?.trim() ?? "").filter(Boolean);
}
function resolveExecApprovalsEffectivePolicy(params) {
	const agentId = normalizePolicyAgentId(params.agentId);
	const resolved = resolveExecApprovalsFromFile({
		file: params.file,
		agentId,
		path: params.path,
		token: ""
	});
	const file = resolved.file;
	const wildcard = file.agents?.["*"];
	const agent = file.agents?.[agentId];
	const wildcardPatterns = allowlistPatterns(wildcard);
	const agentPatterns = agentId === "*" ? [] : allowlistPatterns(agent);
	const allowlist = [...wildcardPatterns, ...agentPatterns];
	return {
		version: 1,
		source: params.source,
		target: params.target,
		agentId,
		path: params.path,
		exists: params.exists,
		hash: params.hash,
		policy: resolved.agent,
		defaults: resolved.defaults,
		allowlistCount: allowlist.length,
		allowlistPatterns: allowlist,
		raw: {
			defaults: policyOverrides(file.defaults),
			wildcard: {
				...policyOverrides(wildcard),
				allowlistCount: wildcardPatterns.length
			},
			agent: {
				...policyOverrides(agent),
				allowlistCount: agentId === "*" ? wildcardPatterns.length : agentPatterns.length
			}
		}
	};
}

//#endregion
//#region src/cli/exec-approvals-cli.ts
const EXEC_APPROVAL_POLICY_PRESETS = {
	"locked-down": {
		security: "deny",
		ask: "off",
		askFallback: "deny",
		autoAllowSkills: false
	},
	cautious: {
		security: "allowlist",
		ask: "on-miss",
		askFallback: "deny",
		autoAllowSkills: false
	},
	reviewed: {
		security: "allowlist",
		ask: "always",
		askFallback: "deny",
		autoAllowSkills: false
	},
	"trusted-operator": {
		security: "full",
		ask: "off",
		askFallback: "full",
		autoAllowSkills: false
	}
};
async function readStdin() {
	const chunks = [];
	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
	return Buffer.concat(chunks).toString("utf8");
}
async function resolveTargetNodeId(opts) {
	if (opts.gateway) return null;
	const raw = opts.node?.trim() ?? "";
	if (!raw) return null;
	return await resolveNodeId(opts, raw);
}
async function loadSnapshot(opts, nodeId) {
	return await callGatewayFromCli(nodeId ? "exec.approvals.node.get" : "exec.approvals.get", opts, nodeId ? { nodeId } : {});
}
function loadSnapshotLocal() {
	const snapshot = readExecApprovalsSnapshot();
	return {
		path: snapshot.path,
		exists: snapshot.exists,
		hash: snapshot.hash,
		file: snapshot.file
	};
}
function saveSnapshotLocal(file) {
	saveExecApprovals(file);
	return loadSnapshotLocal();
}
async function loadSnapshotTarget(opts) {
	if (!opts.gateway && !opts.node) return {
		snapshot: loadSnapshotLocal(),
		nodeId: null,
		source: "local"
	};
	const nodeId = await resolveTargetNodeId(opts);
	return {
		snapshot: await loadSnapshot(opts, nodeId),
		nodeId,
		source: nodeId ? "node" : "gateway"
	};
}
function exitWithError(message) {
	defaultRuntime.error(message);
	defaultRuntime.exit(1);
	throw new Error(message);
}
function requireTrimmedNonEmpty(value, message) {
	const trimmed = value.trim();
	if (!trimmed) exitWithError(message);
	return trimmed;
}
function parseExecSecurity(value, label) {
	if (value === void 0) return;
	const trimmed = value.trim();
	if (trimmed === "deny" || trimmed === "allowlist" || trimmed === "full") return trimmed;
	exitWithError(`${label} must be one of: deny, allowlist, full.`);
}
function parseExecAsk(value) {
	if (value === void 0) return;
	const trimmed = value.trim();
	if (trimmed === "off" || trimmed === "on-miss" || trimmed === "always") return trimmed;
	exitWithError("Ask must be one of: off, on-miss, always.");
}
function parsePolicyBoolean(value, label) {
	if (value === void 0) return;
	const trimmed = value.trim().toLowerCase();
	if (trimmed === "on" || trimmed === "true" || trimmed === "yes" || trimmed === "1") return true;
	if (trimmed === "off" || trimmed === "false" || trimmed === "no" || trimmed === "0") return false;
	exitWithError(`${label} must be on or off.`);
}
function parsePolicyPresetName(value) {
	const trimmed = value.trim();
	if (trimmed === "locked-down" || trimmed === "cautious" || trimmed === "reviewed" || trimmed === "trusted-operator") return trimmed;
	exitWithError("Preset must be one of: locked-down, cautious, reviewed, trusted-operator.");
}
async function loadWritableSnapshotTarget(opts) {
	const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
	if (source === "local") defaultRuntime.log(theme.muted("Writing local approvals."));
	const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
	const baseHash = snapshot.hash;
	if (!baseHash) exitWithError("Exec approvals hash missing; reload and retry.");
	return {
		snapshot,
		nodeId,
		source,
		targetLabel,
		baseHash
	};
}
async function saveSnapshotTargeted(params) {
	const next = params.source === "local" ? saveSnapshotLocal(params.file) : await saveSnapshot(params.opts, params.nodeId, params.file, params.baseHash);
	if (params.opts.json) {
		defaultRuntime.log(JSON.stringify(next));
		return;
	}
	defaultRuntime.log(theme.muted(`Target: ${params.targetLabel}`));
	renderApprovalsSnapshot(next, params.targetLabel);
}
function formatCliError(err) {
	const msg = describeUnknownError(err);
	return msg.includes("\n") ? msg.split("\n")[0] : msg;
}
function renderApprovalsSnapshot(snapshot, targetLabel) {
	const rich = isRich();
	const heading = (text) => rich ? theme.heading(text) : text;
	const muted = (text) => rich ? theme.muted(text) : text;
	const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
	const file = snapshot.file ?? { version: 1 };
	const defaults = file.defaults ?? {};
	const defaultsParts = [
		defaults.security ? `security=${defaults.security}` : null,
		defaults.ask ? `ask=${defaults.ask}` : null,
		defaults.askFallback ? `askFallback=${defaults.askFallback}` : null,
		typeof defaults.autoAllowSkills === "boolean" ? `autoAllowSkills=${defaults.autoAllowSkills ? "on" : "off"}` : null
	].filter(Boolean);
	const agents = file.agents ?? {};
	const allowlistRows = [];
	const now = Date.now();
	for (const [agentId, agent] of Object.entries(agents)) {
		const allowlist = Array.isArray(agent.allowlist) ? agent.allowlist : [];
		for (const entry of allowlist) {
			const pattern = entry?.pattern?.trim() ?? "";
			if (!pattern) continue;
			const lastUsedAt = typeof entry.lastUsedAt === "number" ? entry.lastUsedAt : null;
			allowlistRows.push({
				Target: targetLabel,
				Agent: agentId,
				Pattern: pattern,
				LastUsed: lastUsedAt ? formatTimeAgo(Math.max(0, now - lastUsedAt)) : muted("unknown")
			});
		}
	}
	const summaryRows = [
		{
			Field: "Target",
			Value: targetLabel
		},
		{
			Field: "Path",
			Value: snapshot.path
		},
		{
			Field: "Exists",
			Value: snapshot.exists ? "yes" : "no"
		},
		{
			Field: "Hash",
			Value: snapshot.hash
		},
		{
			Field: "Version",
			Value: String(file.version ?? 1)
		},
		{
			Field: "Socket",
			Value: file.socket?.path ?? "default"
		},
		{
			Field: "Defaults",
			Value: defaultsParts.length > 0 ? defaultsParts.join(", ") : "none"
		},
		{
			Field: "Agents",
			Value: String(Object.keys(agents).length)
		},
		{
			Field: "Allowlist",
			Value: String(allowlistRows.length)
		}
	];
	defaultRuntime.log(heading("Approvals"));
	defaultRuntime.log(renderTable({
		width: tableWidth,
		columns: [{
			key: "Field",
			header: "Field",
			minWidth: 8
		}, {
			key: "Value",
			header: "Value",
			minWidth: 24,
			flex: true
		}],
		rows: summaryRows
	}).trimEnd());
	if (allowlistRows.length === 0) {
		defaultRuntime.log("");
		defaultRuntime.log(muted("No allowlist entries."));
		return;
	}
	defaultRuntime.log("");
	defaultRuntime.log(heading("Allowlist"));
	defaultRuntime.log(renderTable({
		width: tableWidth,
		columns: [
			{
				key: "Target",
				header: "Target",
				minWidth: 10
			},
			{
				key: "Agent",
				header: "Agent",
				minWidth: 8
			},
			{
				key: "Pattern",
				header: "Pattern",
				minWidth: 20,
				flex: true
			},
			{
				key: "LastUsed",
				header: "Last Used",
				minWidth: 10
			}
		],
		rows: allowlistRows
	}).trimEnd());
}
function renderPolicySnapshot(policy) {
	const tableWidth = Math.max(60, (process.stdout.columns ?? 120) - 1);
	const heading = (text) => isRich() ? theme.heading(text) : text;
	const muted = (text) => isRich() ? theme.muted(text) : text;
	const boolText = (value) => value ? "on" : "off";
	const overrideCount = (entry) => Object.entries(entry).some(([key, value]) => key === "allowlistCount" ? value !== 0 : value !== void 0) ? "yes" : "no";
	const rows = [
		{
			Field: "Target",
			Value: policy.target
		},
		{
			Field: "Source",
			Value: policy.source
		},
		{
			Field: "Agent",
			Value: policy.agentId
		},
		{
			Field: "Path",
			Value: policy.path
		},
		{
			Field: "Exists",
			Value: policy.exists ? "yes" : "no"
		},
		{
			Field: "Hash",
			Value: policy.hash
		},
		{
			Field: "Security",
			Value: policy.policy.security
		},
		{
			Field: "Ask",
			Value: policy.policy.ask
		},
		{
			Field: "Ask fallback",
			Value: policy.policy.askFallback
		},
		{
			Field: "Auto-allow skills",
			Value: boolText(policy.policy.autoAllowSkills)
		},
		{
			Field: "Allowlist entries",
			Value: String(policy.allowlistCount)
		},
		{
			Field: "Default overrides",
			Value: overrideCount(policy.raw.defaults)
		},
		{
			Field: "Wildcard overrides",
			Value: overrideCount(policy.raw.wildcard)
		},
		{
			Field: "Agent overrides",
			Value: overrideCount(policy.raw.agent)
		}
	];
	defaultRuntime.log(heading("Approvals policy"));
	defaultRuntime.log(renderTable({
		width: tableWidth,
		columns: [{
			key: "Field",
			header: "Field",
			minWidth: 14
		}, {
			key: "Value",
			header: "Value",
			minWidth: 24,
			flex: true
		}],
		rows
	}).trimEnd());
	defaultRuntime.log("");
	defaultRuntime.log(muted("This is read-only. Use approvals get/set or allowlist commands to change current policy."));
}
async function saveSnapshot(opts, nodeId, file, baseHash) {
	return await callGatewayFromCli(nodeId ? "exec.approvals.node.set" : "exec.approvals.set", opts, nodeId ? {
		nodeId,
		file,
		baseHash
	} : {
		file,
		baseHash
	});
}
function resolveAgentKey(value) {
	const trimmed = value?.trim() ?? "";
	return trimmed ? trimmed : "*";
}
function normalizeAllowlistEntry(entry) {
	const pattern = entry?.pattern?.trim() ?? "";
	return pattern ? pattern : null;
}
function ensureAgent(file, agentKey) {
	const agents = file.agents ?? {};
	const entry = agents[agentKey] ?? {};
	file.agents = agents;
	return entry;
}
function buildPolicySetPatch(opts) {
	const security = parseExecSecurity(opts.security, "Security");
	const ask = parseExecAsk(opts.ask);
	const askFallback = parseExecSecurity(opts.askFallback, "Ask fallback");
	const autoAllowSkills = parsePolicyBoolean(opts.autoAllowSkills, "Auto-allow skills");
	if (!(security !== void 0 || ask !== void 0 || askFallback !== void 0 || autoAllowSkills !== void 0)) exitWithError("Provide at least one policy field: --security, --ask, --ask-fallback, or --auto-allow-skills.");
	return {
		...security !== void 0 ? { security } : {},
		...ask !== void 0 ? { ask } : {},
		...askFallback !== void 0 ? { askFallback } : {},
		...autoAllowSkills !== void 0 ? { autoAllowSkills } : {}
	};
}
function applyPolicySetPatch(file, opts, patch) {
	file.version = 1;
	const agentKey = opts.agent?.trim();
	const target = agentKey ? ensureAgent(file, agentKey) : file.defaults ?? {};
	if (patch.security !== void 0) target.security = patch.security;
	if (patch.ask !== void 0) target.ask = patch.ask;
	if (patch.askFallback !== void 0) target.askFallback = patch.askFallback;
	if (patch.autoAllowSkills !== void 0) target.autoAllowSkills = patch.autoAllowSkills;
	if (agentKey) file.agents = {
		...file.agents,
		[agentKey]: target
	};
	else file.defaults = target;
}
function buildPolicyPresetPatch(rawPreset, opts) {
	const preset = parsePolicyPresetName(rawPreset);
	if (preset === "trusted-operator" && opts.yes !== true) exitWithError("The trusted-operator preset requires --yes.");
	return EXEC_APPROVAL_POLICY_PRESETS[preset];
}
function isEmptyAgent(agent) {
	const allowlist = Array.isArray(agent.allowlist) ? agent.allowlist : [];
	return !agent.security && !agent.ask && !agent.askFallback && agent.autoAllowSkills === void 0 && allowlist.length === 0;
}
async function loadWritableAllowlistAgent(opts) {
	const { snapshot, nodeId, source, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
	const file = snapshot.file ?? { version: 1 };
	file.version = 1;
	const agentKey = resolveAgentKey(opts.agent);
	const agent = ensureAgent(file, agentKey);
	return {
		nodeId,
		source,
		targetLabel,
		baseHash,
		file,
		agentKey,
		agent,
		allowlistEntries: Array.isArray(agent.allowlist) ? agent.allowlist : []
	};
}
async function runAllowlistMutation(pattern, opts, mutate) {
	try {
		const trimmedPattern = requireTrimmedNonEmpty(pattern, "Pattern required.");
		const context = await loadWritableAllowlistAgent(opts);
		if (!await mutate({
			...context,
			trimmedPattern
		})) return;
		await saveSnapshotTargeted({
			opts,
			source: context.source,
			nodeId: context.nodeId,
			file: context.file,
			baseHash: context.baseHash,
			targetLabel: context.targetLabel
		});
	} catch (err) {
		defaultRuntime.error(formatCliError(err));
		defaultRuntime.exit(1);
	}
}
function registerAllowlistMutationCommand(params) {
	const command = params.allowlist.command(`${params.name} <pattern>`).description(params.description).option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).option("--agent <id>", "Agent id (defaults to \"*\")").action(async (pattern, opts) => {
		await runAllowlistMutation(pattern, opts, params.mutate);
	});
	nodesCallOpts(command);
	return command;
}
function registerExecApprovalsCli(program) {
	const formatExample = (cmd, desc) => `  ${theme.command(cmd)}\n    ${theme.muted(desc)}`;
	const approvals = program.command("approvals").alias("exec-approvals").description("Manage exec approvals (gateway or node host)").addHelpText("after", () => `\n${theme.muted("Docs:")} ${formatDocsLink("/cli/approvals", "docs.fased.ai/cli/approvals")}\n`);
	nodesCallOpts(approvals.command("get").description("Fetch exec approvals snapshot").option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).action(async (opts) => {
		try {
			const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
			if (opts.json) {
				defaultRuntime.log(JSON.stringify(snapshot));
				return;
			}
			const muted = (text) => isRich() ? theme.muted(text) : text;
			if (source === "local") {
				defaultRuntime.log(muted("Showing local approvals."));
				defaultRuntime.log("");
			}
			renderApprovalsSnapshot(snapshot, source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway");
		} catch (err) {
			defaultRuntime.error(formatCliError(err));
			defaultRuntime.exit(1);
		}
	}));
	nodesCallOpts(approvals.command("set").description("Replace exec approvals with a JSON file").option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).option("--file <path>", "Path to JSON file to upload").option("--stdin", "Read JSON from stdin", false).action(async (opts) => {
		try {
			if (!opts.file && !opts.stdin) exitWithError("Provide --file or --stdin.");
			if (opts.file && opts.stdin) exitWithError("Use either --file or --stdin (not both).");
			const { source, nodeId, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
			const raw = opts.stdin ? await readStdin() : await fs.readFile(String(opts.file), "utf8");
			let file;
			try {
				file = JSON5.parse(raw);
			} catch (err) {
				exitWithError(`Failed to parse approvals JSON: ${String(err)}`);
			}
			file.version = 1;
			await saveSnapshotTargeted({
				opts,
				source,
				nodeId,
				file,
				baseHash,
				targetLabel
			});
		} catch (err) {
			defaultRuntime.error(formatCliError(err));
			defaultRuntime.exit(1);
		}
	}));
	const policy = approvals.command("policy").description("Inspect effective exec approval policy");
	nodesCallOpts(policy.command("show").description("Show effective exec approval policy").option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).option("--agent <id>", "Agent id (defaults to \"main\")").action(async (opts) => {
		try {
			const { snapshot, nodeId, source } = await loadSnapshotTarget(opts);
			const targetLabel = source === "local" ? "local" : nodeId ? `node:${nodeId}` : "gateway";
			const resolved = resolveExecApprovalsEffectivePolicy({
				file: snapshot.file,
				source,
				target: targetLabel,
				agentId: opts.agent,
				path: snapshot.path,
				exists: snapshot.exists,
				hash: snapshot.hash
			});
			if (opts.json) {
				defaultRuntime.log(JSON.stringify(resolved));
				return;
			}
			renderPolicySnapshot(resolved);
		} catch (err) {
			defaultRuntime.error(formatCliError(err));
			defaultRuntime.exit(1);
		}
	}));
	nodesCallOpts(policy.command("set").description("Set exec approval policy defaults or a per-agent override").option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).option("--agent <id>", "Agent id to update; omit to update host defaults").option("--security <mode>", "Security mode: deny, allowlist, full").option("--ask <mode>", "Prompt mode: off, on-miss, always").option("--ask-fallback <mode>", "Fallback when a prompt cannot be delivered: deny, allowlist, full").option("--auto-allow-skills <on|off>", "Auto-allow known skill CLI binaries").action(async (opts) => {
		try {
			const patch = buildPolicySetPatch(opts);
			const { snapshot, nodeId, source, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
			const file = snapshot.file ?? { version: 1 };
			applyPolicySetPatch(file, opts, patch);
			await saveSnapshotTargeted({
				opts,
				source,
				nodeId,
				file,
				baseHash,
				targetLabel
			});
		} catch (err) {
			defaultRuntime.error(formatCliError(err));
			defaultRuntime.exit(1);
		}
	}));
	nodesCallOpts(policy.command("preset <name>").description("Apply an exec approval policy preset").option("--node <node>", "Target node id/name/IP").option("--gateway", "Force gateway approvals", false).option("--agent <id>", "Agent id to update; omit to update host defaults").option("--yes", "Required for permissive presets", false).action(async (name, opts) => {
		try {
			const patch = buildPolicyPresetPatch(name, opts);
			const { snapshot, nodeId, source, targetLabel, baseHash } = await loadWritableSnapshotTarget(opts);
			const file = snapshot.file ?? { version: 1 };
			applyPolicySetPatch(file, opts, patch);
			await saveSnapshotTargeted({
				opts,
				source,
				nodeId,
				file,
				baseHash,
				targetLabel
			});
		} catch (err) {
			defaultRuntime.error(formatCliError(err));
			defaultRuntime.exit(1);
		}
	}));
	const allowlist = approvals.command("allowlist").description("Edit the per-agent allowlist").addHelpText("after", () => `\n${theme.heading("Examples:")}\n${formatExample("fased approvals allowlist add \"~/Projects/**/bin/rg\"", "Allowlist a local binary pattern for the main agent.")}\n${formatExample("fased approvals allowlist add --agent main --node <id|name|ip> \"/usr/bin/uptime\"", "Allowlist on a specific node/agent.")}\n${formatExample("fased approvals allowlist add --agent \"*\" \"/usr/bin/uname\"", "Allowlist for all agents (wildcard).")}\n${formatExample("fased approvals allowlist remove \"~/Projects/**/bin/rg\"", "Remove an allowlist pattern.")}\n\n${theme.muted("Docs:")} ${formatDocsLink("/cli/approvals", "docs.fased.ai/cli/approvals")}\n`);
	registerAllowlistMutationCommand({
		allowlist,
		name: "add",
		description: "Add a glob pattern to an allowlist",
		mutate: ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
			if (allowlistEntries.some((entry) => normalizeAllowlistEntry(entry) === trimmedPattern)) {
				defaultRuntime.log("Already allowlisted.");
				return false;
			}
			allowlistEntries.push({
				pattern: trimmedPattern,
				lastUsedAt: Date.now()
			});
			agent.allowlist = allowlistEntries;
			file.agents = {
				...file.agents,
				[agentKey]: agent
			};
			return true;
		}
	});
	registerAllowlistMutationCommand({
		allowlist,
		name: "remove",
		description: "Remove a glob pattern from an allowlist",
		mutate: ({ trimmedPattern, file, agent, agentKey, allowlistEntries }) => {
			const nextEntries = allowlistEntries.filter((entry) => normalizeAllowlistEntry(entry) !== trimmedPattern);
			if (nextEntries.length === allowlistEntries.length) {
				defaultRuntime.log("Pattern not found.");
				return false;
			}
			if (nextEntries.length === 0) delete agent.allowlist;
			else agent.allowlist = nextEntries;
			if (isEmptyAgent(agent)) {
				const agents = { ...file.agents };
				delete agents[agentKey];
				file.agents = Object.keys(agents).length > 0 ? agents : void 0;
			} else file.agents = {
				...file.agents,
				[agentKey]: agent
			};
			return true;
		}
	});
}

//#endregion
export { registerExecApprovalsCli };