these 5 derivations will be built:
  /nix/store/g7srgmn7dygdw74pb2az1av4v3rygnfg-pi-agent-environment-policy-external.d.ts.drv
  /nix/store/hv6wp6w9absfpxghxhvzsfdvaa3v64mq-pi-agent-environment-policy-tsconfig.json.drv
  /nix/store/q4bikbwm4dbq2wy99jjric1d6xp3wk81-pi-agent-environment-policy-cases.json.drv
  /nix/store/vp9fpf056yzykzg0hnnd3whc5s1f7ym5-pi-agent-environment-policy-test.ts.drv
  /nix/store/n2fpq81l00d5b7asm6n5gkvi693b9yyd-pi-agent-environment-policy.drv
this path will be fetched (9.1 MiB download, 26.6 MiB unpacked):
  /nix/store/cr53f8n3x4knbwcymv1hxmwam7a0sdql-typescript-7.0.2
building '/nix/store/q4bikbwm4dbq2wy99jjric1d6xp3wk81-pi-agent-environment-policy-cases.json.drv'
building '/nix/store/g7srgmn7dygdw74pb2az1av4v3rygnfg-pi-agent-environment-policy-external.d.ts.drv'
building '/nix/store/vp9fpf056yzykzg0hnnd3whc5s1f7ym5-pi-agent-environment-policy-test.ts.drv'
building '/nix/store/hv6wp6w9absfpxghxhvzsfdvaa3v64mq-pi-agent-environment-policy-tsconfig.json.drv'
pi-agent-environment-policy-cases.json> structuredAttrs is enabled
pi-agent-environment-policy-external.d.ts> structuredAttrs is enabled
pi-agent-environment-policy-test.ts> structuredAttrs is enabled
pi-agent-environment-policy-tsconfig.json> structuredAttrs is enabled
building '/nix/store/n2fpq81l00d5b7asm6n5gkvi693b9yyd-pi-agent-environment-policy.drv'
pi-agent-environment-policy>   🔍 Resolving [1/1]   🔍 @mariozechner/pi-tui [7/6]   🔍 Resolving [7/7]   🔍 @mariozechner/jiti [13/12]   🔍 Resolving [13/12]   🔍 Resolving [13/12]   🔍 Resolving [13/12]   🔍 Resolving [13/12] PASS: safe command is allowed
pi-agent-environment-policy> PASS: safe curl GET is allowed
pi-agent-environment-policy> PASS: safe wget GET is allowed
pi-agent-environment-policy> PASS: safe curl HEAD is allowed
pi-agent-environment-policy> PASS: safe curl silent flag is allowed
pi-agent-environment-policy> PASS: safe curl head flag is allowed
pi-agent-environment-policy> PASS: safe curl location flag is allowed
pi-agent-environment-policy> PASS: safe curl combined long flags are allowed
pi-agent-environment-policy> PASS: safe curl negated long flag is allowed
pi-agent-environment-policy> PASS: safe curl combined silent short flags are allowed
pi-agent-environment-policy> PASS: safe curl combined head and location short flags are allowed
pi-agent-environment-policy> PASS: safe curl ordinary short flag cluster is allowed
pi-agent-environment-policy> PASS: safe wget OPTIONS is allowed
pi-agent-environment-policy> PASS: dangerous built-in sudo prompts
pi-agent-environment-policy> PASS: direct rm blocks
pi-agent-environment-policy> PASS: composed rm blocks
pi-agent-environment-policy> PASS: deferred rm blocks
pi-agent-environment-policy> PASS: git worktree creation prompts
pi-agent-environment-policy> PASS: jj workspace creation prompts
pi-agent-environment-policy> PASS: git global option before worktree prompts
pi-agent-environment-policy> PASS: wrapped Git global option before worktree prompts
pi-agent-environment-policy> PASS: composed jj global option before workspace prompts
pi-agent-environment-policy> PASS: git short paginate alias before worktree prompts
pi-agent-environment-policy> PASS: wrapped Git short no-pager alias before worktree prompts
pi-agent-environment-policy> PASS: composed jj debug flag before workspace prompts
pi-agent-environment-policy> PASS: unknown Git global cannot hide worktree creation
pi-agent-environment-policy> PASS: wrapped unknown jj global cannot hide workspace creation
pi-agent-environment-policy> PASS: composed unknown Git global cannot hide worktree creation
pi-agent-environment-policy> PASS: Git global option value is not a worktree subcommand
pi-agent-environment-policy> PASS: jj global option value followed by unresolved alias prompts
pi-agent-environment-policy> PASS: argv-injected Git worktree alias prompts
pi-agent-environment-policy> PASS: wrapped argv-injected jj workspace alias prompts
pi-agent-environment-policy> PASS: Git injected alias overriding known command prompts
pi-agent-environment-policy> PASS: jj injected alias overriding known command prompts
pi-agent-environment-policy> PASS: Git injected alias embedding worktree add prompts
pi-agent-environment-policy> PASS: wrapped Git injected alias embedding worktree add prompts
pi-agent-environment-policy> PASS: jj injected alias embedding workspace add prompts
pi-agent-environment-policy> PASS: wrapped jj injected alias embedding workspace add prompts
pi-agent-environment-policy> PASS: Git mixed-quoted embedded-add alias prompts
pi-agent-environment-policy> PASS: wrapped jj literal-string embedded-add alias prompts
pi-agent-environment-policy> PASS: unparseable invoked injected alias prompts
pi-agent-environment-policy> PASS: composed argv-injected jj TOML workspace alias prompts
pi-agent-environment-policy> PASS: persistent unknown Git alias-shaped add prompts
pi-agent-environment-policy> PASS: persistent Git alias embedding worktree add prompts without literal add
pi-agent-environment-policy> PASS: wrapped persistent unknown jj alias-shaped add prompts
pi-agent-environment-policy> PASS: persistent jj alias embedding workspace add prompts without literal add
pi-agent-environment-policy> PASS: unknown Git global cannot hide persistent alias-shaped add
pi-agent-environment-policy> PASS: known Git remote add remains allowed
pi-agent-environment-policy> PASS: ordinary Git status remains allowed
pi-agent-environment-policy> PASS: ordinary Git grep remains allowed
pi-agent-environment-policy> PASS: ordinary Git blame remains allowed
pi-agent-environment-policy> PASS: ordinary Git rev-parse remains allowed
pi-agent-environment-policy> PASS: ordinary Git ls-files remains allowed
pi-agent-environment-policy> PASS: ordinary Git archive remains allowed
pi-agent-environment-policy> PASS: ordinary Git show-ref remains allowed
pi-agent-environment-policy> PASS: Git global version information remains allowed
pi-agent-environment-policy> PASS: Git global version ignores mutation-shaped trailing argv
pi-agent-environment-policy> PASS: Git global help remains allowed
pi-agent-environment-policy> PASS: Git global help ignores worktree subcommand argv
pi-agent-environment-policy> PASS: Git global HTML path remains allowed
pi-agent-environment-policy> PASS: Git global man path remains allowed
pi-agent-environment-policy> PASS: Git global info path remains allowed
pi-agent-environment-policy> PASS: Git global exec path remains allowed
pi-agent-environment-policy> PASS: ordinary jj bookmark list remains allowed
pi-agent-environment-policy> PASS: ordinary jj log remains allowed
pi-agent-environment-policy> PASS: jj help remains allowed
pi-agent-environment-policy> PASS: jj revert remains allowed
pi-agent-environment-policy> PASS: jj bisect remains allowed
pi-agent-environment-policy> PASS: jj sign remains allowed
pi-agent-environment-policy> PASS: jj operation alias remains allowed
pi-agent-environment-policy> PASS: jj status alias remains allowed
pi-agent-environment-policy> PASS: jj long version remains allowed
pi-agent-environment-policy> PASS: jj short version remains allowed
pi-agent-environment-policy> PASS: jj long help remains allowed
pi-agent-environment-policy> PASS: jj short help remains allowed
pi-agent-environment-policy> PASS: jj subcommand help remains allowed
pi-agent-environment-policy> PASS: jj informational version short-circuits workspace add
pi-agent-environment-policy> PASS: jj informational help short-circuits workspace add
pi-agent-environment-policy> PASS: jj at-operation log remains allowed
pi-agent-environment-policy> PASS: jj at-operation workspace add still prompts
pi-agent-environment-policy> PASS: unknown jj command prompts
pi-agent-environment-policy> PASS: pi install blocks
pi-agent-environment-policy> PASS: pi remove blocks through wrapper
pi-agent-environment-policy> PASS: pi uninstall blocks
pi-agent-environment-policy> PASS: pi update blocks
pi-agent-environment-policy> PASS: pi config blocks
pi-agent-environment-policy> PASS: pi list remains allowed
pi-agent-environment-policy> PASS: curl separate request mutation prompts
pi-agent-environment-policy> PASS: curl equals request mutation prompts
pi-agent-environment-policy> PASS: curl glued request mutation prompts
pi-agent-environment-policy> PASS: curl glued data value containing XGET prompts
pi-agent-environment-policy> PASS: curl glued header value containing XGET is allowed
pi-agent-environment-policy> PASS: curl valid short option cluster request mutation prompts
pi-agent-environment-policy> PASS: curl final request option controls mutation
pi-agent-environment-policy> PASS: curl next transfer cannot hide earlier mutation
pi-agent-environment-policy> PASS: curl short next alias cannot hide earlier mutation
pi-agent-environment-policy> PASS: curl long next token consumed as header value is allowed
pi-agent-environment-policy> PASS: curl short next token consumed as header value is allowed
pi-agent-environment-policy> PASS: curl next tokens after end-of-options are positional
pi-agent-environment-policy> PASS: curl safe long multi-transfer is allowed
pi-agent-environment-policy> PASS: curl safe short multi-transfer is allowed
pi-agent-environment-policy> PASS: curl mutation after long boundary prompts
pi-agent-environment-policy> PASS: curl mutation after short boundary prompts
pi-agent-environment-policy> PASS: curl WebDAV MKCOL prompts
pi-agent-environment-policy> PASS: curl custom explicit method prompts
pi-agent-environment-policy> PASS: curl lowercase method is not read-only GET
pi-agent-environment-policy> PASS: curl long config prompts
pi-agent-environment-policy> PASS: curl glued short config prompts
pi-agent-environment-policy> PASS: curl data mutation prompts
pi-agent-environment-policy> PASS: curl no-get after get restores data mutation
pi-agent-environment-policy> PASS: curl no-get after short get restores upload mutation
pi-agent-environment-policy> PASS: curl later get restores GET semantics
pi-agent-environment-policy> PASS: curl expand-data mutation prompts
pi-agent-environment-policy> PASS: curl unclassified future long option prompts
pi-agent-environment-policy> PASS: curl unclassified future short option prompts
pi-agent-environment-policy> PASS: curl upload mutation prompts
pi-agent-environment-policy> PASS: curl read-only method cannot mask data mutation
pi-agent-environment-policy> PASS: curl read-only method cannot mask upload mutation
pi-agent-environment-policy> PASS: curl get conversion with read-only method remains allowed
pi-agent-environment-policy> PASS: wget separate method mutation prompts
pi-agent-environment-policy> PASS: wget equals method mutation prompts
pi-agent-environment-policy> PASS: wget post data mutation prompts
pi-agent-environment-policy> PASS: wget read-only method cannot mask body mutation
pi-agent-environment-policy> PASS: wget WebDAV MOVE prompts
pi-agent-environment-policy> PASS: wget custom explicit method prompts
pi-agent-environment-policy> PASS: wget lowercase method is not read-only HEAD
pi-agent-environment-policy> PASS: wget header value resembling method cannot mask post data
pi-agent-environment-policy> PASS: composed wget body value resembling safe method prompts
pi-agent-environment-policy> PASS: wget ordinary header value remains allowed
pi-agent-environment-policy> PASS: wget opaque config prompts
pi-agent-environment-policy> PASS: wrapped wget short execute prompts
pi-agent-environment-policy> PASS: wget long execute prompts
pi-agent-environment-policy> PASS: wget malformed method prompts
pi-agent-environment-policy> PASS: wget ambiguous unknown option prompts
pi-agent-environment-policy> PASS: headless HTTP prompt blocks
pi-agent-environment-policy> PASS: gate discovers the deployed rules module
pi-agent-environment-policy> PASS: throwing parser rule blocks diagnostically
pi-agent-environment-policy> PASS: project cannot replace rules
pi-agent-environment-policy> PASS: project cannot disable block rules
pi-agent-environment-policy> PASS: project cannot disable protected prompt rules
pi-agent-environment-policy> PASS: project cannot disable headless prompt rules
pi-agent-environment-policy> PASS: path outside any repository blocks as unrecoverable
pi-agent-environment-policy> PASS: git feature branch allows
pi-agent-environment-policy> PASS: git double-dot-prefixed child allows
pi-agent-environment-policy> PASS: git target outside the repository root blocks
pi-agent-environment-policy> PASS: git main notifies and allows
pi-agent-environment-policy> PASS: git master notifies and allows
pi-agent-environment-policy> PASS: indeterminate repository state allows
pi-agent-environment-policy> PASS: repository ordinary-healthy
pi-agent-environment-policy> PASS: repository ordinary-nonempty-at
pi-agent-environment-policy> PASS: repository ordinary-conflict
pi-agent-environment-policy> PASS: repository ordinary-divergent-at
pi-agent-environment-policy> PASS: repository ordinary-main-at
pi-agent-environment-policy> PASS: repository ordinary-master-at
pi-agent-environment-policy> PASS: repository diamond-healthy
pi-agent-environment-policy> PASS: repository diamond-nonempty-wip
pi-agent-environment-policy> PASS: repository diamond-resolved-nonempty-join
pi-agent-environment-policy> PASS: repository diamond-missing-wip
pi-agent-environment-policy> PASS: repository diamond-moved-wip
pi-agent-environment-policy> PASS: repository diamond-divergent-wip
pi-agent-environment-policy> PASS: repository diamond-divergent-wip-without-target
pi-agent-environment-policy> PASS: repository diamond-divergent-wip-malformed-resolution
pi-agent-environment-policy> PASS: repository diamond-nonsingle-parent-wip
pi-agent-environment-policy> PASS: repository diamond-single-parent-join
pi-agent-environment-policy> PASS: repository diamond-conflicted-join
pi-agent-environment-policy> PASS: repository diamond-conflicted-immediate-parent
pi-agent-environment-policy> PASS: repository diamond-join-parent-count-mismatch
pi-agent-environment-policy> PASS: repository diamond-malformed-join-probe
pi-agent-environment-policy> PASS: repository diamond-failing-join-probe
pi-agent-environment-policy> PASS: repository malformed-probe
pi-agent-environment-policy> PASS: repository malformed-parent-count-probe
pi-agent-environment-policy> PASS: repository failing-probe
pi-agent-environment-policy> PASS: repository ambiguous-probe
pi-agent-environment-policy> PASS: repository failing-root-probe
pi-agent-environment-policy> PASS: repository outside-jj-contradictory-stdout
pi-agent-environment-policy> PASS: repository outside-jj-wrong-status
pi-agent-environment-policy> PASS: repository outside-jj-mixed-diagnostics
pi-agent-environment-policy> PASS: repository outside-jj-hint-git-main
pi-agent-environment-policy> PASS: repository classification-whitespace-only
pi-agent-environment-policy> PASS: repository classification-padded
pi-agent-environment-policy> PASS: repository classification-extra-blank
pi-agent-environment-policy> PASS: repository root-padded
pi-agent-environment-policy> PASS: repository current-extra-blank
pi-agent-environment-policy> PASS: repository identity-padded
pi-agent-environment-policy> PASS: repository defaults-extra-blank
pi-agent-environment-policy> PASS: repository resolution-padded
pi-agent-environment-policy> PASS: repository parents-extra-blank
pi-agent-environment-policy> PASS: repository canonical-root-mismatch
pi-agent-environment-policy> PASS: repository target-jj-cwd-other-repository
pi-agent-environment-policy> PASS: repository target-git-cwd-jj-repository
pi-agent-environment-policy> PASS: repository git-protected-head
pi-agent-environment-policy> PASS: repository git-feature-head
pi-agent-environment-policy> PASS: repository git-detached-head
pi-agent-environment-policy> PASS: repository git-malformed-head
pi-agent-environment-policy> PASS: repository git-multiline-head
pi-agent-environment-policy> PASS: repository colocated-healthy
pi-agent-environment-policy> PASS: repository colocated-divergent-roots
pi-agent-environment-policy> PASS: characterized Git outside result is accepted
pi-agent-environment-policy> PASS: Git outside result with contradictory stdout is invalid
pi-agent-environment-policy> PASS: Git outside result with wrong status is invalid
pi-agent-environment-policy> PASS: Git outside result with trailing diagnostics is accepted
pi-agent-environment-policy> PASS: adapter registers only tool_call handler
pi-agent-environment-policy> PASS: adapter translates edit allow
pi-agent-environment-policy> PASS: adapter translates write allow
pi-agent-environment-policy> PASS: adapter permits a notify decision and announces it
pi-agent-environment-policy> PASS: adapter blocks a target outside any repository
pi-agent-environment-policy> PASS: adapter strips a Pi at-prefix before resolving
pi-agent-environment-policy> PASS: adapter expands a leading tilde before resolving
pi-agent-environment-policy> PASS: adapter passes unrelated tools through
pi-agent-environment-policy> PASS: adapter blocks a non-string path
pi-agent-environment-policy> PASS: adapter blocks an empty path
pi-agent-environment-policy> PASS: adapter blocks a whitespace-only path
pi-agent-environment-policy> PASS: adapter blocks a missing path key
pi-agent-environment-policy> PASS: adapter cannot read atomic hashline edit input
pi-agent-environment-policy> PASS: adapter permits core exceptions
pi-agent-environment-policy> PASS: adapter permits capability exceptions
pi-agent-environment-policy> PASS: adapter permits a missing filesystem capability
pi-agent-environment-policy> PASS: adapter permits a throwing capability factory
pi-agent-environment-policy> PASS: adapter permits a throwing notification capability
pi-agent-environment-policy> PASS: normalize keeps an ordinary relative path
pi-agent-environment-policy> PASS: normalize strips a Pi at-prefix
pi-agent-environment-policy> PASS: normalize expands a bare tilde
pi-agent-environment-policy> PASS: normalize expands a tilde path
pi-agent-environment-policy> PASS: normalize expands a tilde path behind an at-prefix
pi-agent-environment-policy> PASS: normalize converts a file URL
pi-agent-environment-policy> PASS: normalize folds unicode space variants
pi-agent-environment-policy> PASS: normalize rejects a whitespace-only path
pi-agent-environment-policy> PASS: normalize rejects a bare at-prefix
pi-agent-environment-policy> PASS: classification reports a malformed current probe
pi-agent-environment-policy> PASS: classification reports a failing current probe
pi-agent-environment-policy> PASS: classification reports an ambiguous current probe
pi-agent-environment-policy> PASS: classification reports a failing root probe
pi-agent-environment-policy> PASS: classification reports a malformed join probe
pi-agent-environment-policy> PASS: classification reports a canonical root mismatch
pi-agent-environment-policy> PASS: classification reports ambiguous Git and jj identities
pi-agent-environment-policy> PASS: classification reports a healthy diamond
pi-agent-environment-policy> PASS: classification reports an ordinary jj repository
pi-agent-environment-policy> 237 pi-agent-environment policy cases passed

upload niks3: ok