(command.CommandList
  children: [
    (command.ShAssignment
      pairs: [
        (assign_pair
          lhs: (sh_lhs_expr.Name name:tid)
          op: assign_op.Equal
          rhs: {(DQ <'forced command'>)}
          spids: [7]
        )
      ]
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy_bak'>}
    )
    (C {<cp>} {<'/dev/null'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> ($ Id.VSub_DollarName '$USER')}
    )
    (command.ForEach
      iter_name: t
      iter_words: [{(${ Id.VSub_Name SSH_KEYTYPES)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.Simple
              words: [{<printf>} {(SQ <'command="true" '>)}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: 
                    {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> 
                      ($ Id.VSub_DollarName '$USER')
                    }
                )
              ]
              do_fork: T
            )
            (command.Simple
              words: [{<cat>} {($ Id.VSub_DollarName '$OBJ') <'/'> ($ Id.VSub_DollarName '$t') <.pub>}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: 
                    {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> 
                      ($ Id.VSub_DollarName '$USER')
                    }
                )
              ]
              do_fork: T
            )
          ]
        )
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} {(DQ <'forced command in key option proto '> ($ Id.VSub_DollarName '$p'))})
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-> ($ Id.VSub_DollarName '$p')} {<-F>} 
                  {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>} {<somehost>} {<false>} {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\ '>)}
                )
                (C {<fail>} {(DQ <'forced command in key proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
          ]
        )
    )
    (C {<cp>} {<'/dev/null'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> ($ Id.VSub_DollarName '$USER')}
    )
    (command.ForEach
      iter_name: t
      iter_words: [{(${ Id.VSub_Name SSH_KEYTYPES)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (command.Simple
              words: [{<printf>} {(SQ <'command="false" '>)}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: 
                    {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> 
                      ($ Id.VSub_DollarName '$USER')
                    }
                )
              ]
              do_fork: T
            )
            (command.Simple
              words: [{<cat>} {($ Id.VSub_DollarName '$OBJ') <'/'> ($ Id.VSub_DollarName '$t') <.pub>}]
              redirects: [
                (redir
                  op: <Id.Redir_DGreat '>>'>
                  loc: (redir_loc.Fd fd:1)
                  arg: 
                    {($ Id.VSub_DollarName '$OBJ') <'/authorized_keys_'> 
                      ($ Id.VSub_DollarName '$USER')
                    }
                )
              ]
              do_fork: T
            )
          ]
        )
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy_bak'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
    )
    (command.Simple
      words: [{<echo>} {(DQ <'ForceCommand true'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} 
              {
                (DQ <'forced command in sshd_config overrides key option proto '> 
                  ($ Id.VSub_DollarName '$p')
                )
              }
            )
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-> ($ Id.VSub_DollarName '$p')} {<-F>} 
                  {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>} {<somehost>} {<false>} {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\ '>)}
                )
                (C {<fail>} {(DQ <'forced command in key proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
          ]
        )
    )
    (C {<cp>} {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy_bak'>} 
      {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
    )
    (command.Simple
      words: [{<echo>} {(DQ <'ForceCommand false'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'Match User '> ($ Id.VSub_DollarName '$USER'))}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.Simple
      words: [{<echo>} {(DQ <'    ForceCommand true'>)}]
      redirects: [
        (redir
          op: <Id.Redir_DGreat '>>'>
          loc: (redir_loc.Fd fd:1)
          arg: {($ Id.VSub_DollarName '$OBJ') <'/sshd_proxy'>}
        )
      ]
      do_fork: T
    )
    (command.ForEach
      iter_name: p
      iter_words: [{(${ Id.VSub_Name SSH_PROTOCOLS)}]
      do_arg_iter: F
      body: 
        (command.DoGroup
          children: [
            (C {<trace>} {(DQ <'forced command with match proto '> ($ Id.VSub_DollarName '$p'))})
            (command.AndOr
              ops: [Id.Op_DPipe]
              children: [
                (C {(${ Id.VSub_Name SSH)} {<-> ($ Id.VSub_DollarName '$p')} {<-F>} 
                  {($ Id.VSub_DollarName '$OBJ') <'/ssh_proxy'>} {<somehost>} {<false>} {(word_part.EscapedLiteral token:<Id.Lit_EscapedChar '\\ '>)}
                )
                (C {<fail>} {(DQ <'forced command in key proto '> ($ Id.VSub_DollarName '$p'))})
              ]
            )
          ]
        )
    )
  ]
)