@hasna/hooks 0.12.3 → 0.12.4

package/bin/native-safety-entry.js

@@ -1,21 +1,21 @@
 // @bun
-import{homedir as I0}from"os";import{isAbsolute as q1}from"path";import{isAbsolute as R1,join as $Z,normalize as v1,resolve as y1,sep as dZ}from"path";import{dirname as e,isAbsolute as EZ,join as mZ,resolve as s}from"path";import{accessSync as _1,closeSync as W1,constants as PZ,fstatSync as T1,lstatSync as BZ,openSync as C1,readFileSync as I1,readlinkSync as D1,readSync as A1,realpathSync as cZ,statSync as pZ}from"fs";import{spawnSync as L1}from"child_process";var P0={missing:"No verified @hasna/trash guard was found on PATH.",unsafe_executable:"The Trash candidate is not an owned executable file or is writable by group or others.",unsafe_manifest:"The Trash package manifest is not a safe owned regular file.",unsafe_directory:"A Trash PATH or package directory is not owned safely or is writable by group or others.",unsafe_interpreter:"The Trash interpreter is missing, unsupported, or not a safe owned executable on its actual PATH.",unrecognized_package:"The candidate is not the registered @hasna/trash executable.",identity_failed:"The installed Trash identity probe failed or exceeded its deadline.",unsupported_protocol:"The installed Trash version does not expose the required guard protocol."};function UZ(Z){return Z===0||Z===process.getuid?.()}function OZ(Z,J=!1){let $=Z;for(let X=0;X<32;X++){if(!EZ($)||$.length>4096||!VZ("/"))return!1;let z=$.split("/"),Q=z.pop();if(!Q||Q==="."||Q==="..")return!1;let Y="/";for(let H of z){if(!H||H===".")continue;if(H===".."){Y=e(Y);continue}let B=mZ(Y,H),U=BZ(B);if(J&&B==="/bin"&&U.isSymbolicLink()&&U.uid===0){let V=cZ(B);if(!VZ(V))return!1;Y=V;continue}if(!U.isDirectory()||!UZ(U.uid)||U.mode&18)return!1;Y=B}let G=mZ(Y,Q),K=BZ(G);if(!UZ(K.uid))return!1;if(K.isSymbolicLink()){let H=D1(G);$=EZ(H)?H:Y+"/"+H;continue}return K.isFile()&&Boolean(K.mode&73)&&!(K.mode&18)}return!1}function P1(Z){if(!EZ(Z)||s(Z)!==(Z.replace(/\/+$/,"")||"/"))return!1;for(let J=s(Z);;J=e(J)){try{return BZ(J),VZ(J)}catch($){if($.code!=="ENOENT")return!1}if(e(J)===J)return!1}}function O1(Z,J){let $=C1(Z,PZ.O_RDONLY|PZ.O_NONBLOCK|PZ.O_NOFOLLOW),X;try{if(!T1($).isFile())return!1;let Q=Buffer.alloc(256),Y=A1($,Q,0,Q.length,0);X=Q.subarray(0,Y).toString("utf8").split(`
-`)[0]}finally{W1($)}let z=/^#!(\/[A-Za-z0-9_./-]+)$/.exec(X);if(z&&z[1]!=="/usr/bin/env")return OZ(z[1],!0);if(X!=="#!/usr/bin/env bun"||!OZ("/usr/bin/env",!0))return!1;for(let Q of J.split(":").slice(0,64)){if(!P1(Q))return!1;let Y=s(Q,"bun");try{if(!pZ(Y).isFile())continue;_1(Y,PZ.X_OK)}catch{continue}return OZ(Y,!0)}return!1}function VZ(Z){let J=Z;for(;;){let $=BZ(J);if(!$.isDirectory()||!UZ($.uid)||($.mode&18)!==0)return!1;let X=e(J);if(X===J)return!0;J=X}}function MZ(Z=process.env){let J=Z.PATH??"",$=Date.now()+2000,X="missing",z=(Q)=>{if(X==="missing"||X==="unrecognized_package"||Q.startsWith("unsafe_"))X=Q};for(let Q of J.split(":").slice(0,64)){if(!EZ(Q)||Date.now()>=$)continue;let Y=s(Q,"trash");try{let G=pZ(Y);if(!G.isFile()||!UZ(G.uid)||(G.mode&73)===0||(G.mode&18)!==0){z("unsafe_executable");continue}let K=cZ(Y);if(!VZ(s(Q))||!VZ(e(K))){z("unsafe_directory");continue}if(!OZ(Y)){z("unsafe_directory");continue}let H=s(e(K),"../.."),B=mZ(H,"package.json"),U=pZ(B);if(!U.isFile()||!UZ(U.uid)||U.size>16384||(U.mode&18)!==0||BZ(B).isSymbolicLink()){z("unsafe_manifest");continue}let V=JSON.parse(I1(B,"utf8"));if(V.name!=="@hasna/trash"||typeof V.version!=="string"||typeof V.bin?.trash!=="string"||cZ(s(H,V.bin.trash))!==K){z("unrecognized_package");continue}try{if(!O1(K,J)){z("unsafe_interpreter");continue}}catch{z("unsafe_interpreter");continue}let I=$-Date.now();if(I<=0){z("identity_failed");break}let _=L1(Y,["--identity"],{encoding:"utf8",timeout:I,maxBuffer:2048,env:{PATH:J},stdio:["ignore","pipe","pipe"]});if(_.error||_.status!==0||Date.now()>=$){z("identity_failed");continue}let P=JSON.parse(_.stdout);if(P.name==="@hasna/trash"&&P.version===V.version&&P.guardProtocol==="hasna.trash.guard.v1")return{ok:!0,path:Y,version:V.version};z("unsupported_protocol")}catch{}}return{ok:!1,code:X}}function RZ(Z=process.env){let J=MZ(Z);return J.ok?J.path:null}function ZZ(Z){let J=Z.tool_input?.command;return typeof J==="string"?J:""}var O0=["/","/bin","/boot","/dev","/etc","/home","/lib","/lib32","/lib64","/libx32","/opt","/proc","/root","/run","/sbin","/srv","/sys","/usr","/var","/Applications","/Library","/System","/Users","/Volumes","/private"];var S1=600000,b1="Delete via trash guard (rm intercepted and made recoverable)",f1=[".hasna/repos/clones","workspace/repos"],k1=[".hasna",".ssh",".aws"],E0={rmdir:"`rmdir` is a delete that trash-guard does not rewrite (it takes rmdir's flags, not rm's). Re-run it as `rm -d -- <path>` for an empty directory, or `rm -r -- <path>` for a non-empty one, and it is redirected into trash.",unlink:"`unlink` is a delete that trash-guard does not rewrite. Re-run it as `rm -- <path>` and it is redirected into trash.",shred:"`shred` destroys content irrecoverably and is never allowed. Re-run it as `rm -- <path>` and it is redirected into trash."},w1=new Set(["sh","bash","zsh","dash","ksh","ash","eval","source",".","su","runuser","env"]),x1={sudo:["-u","--user","-g","--group","-p","--prompt","-C","--chdir","-h","--host","-r","--role","-t","--type","-U","--other-user"],doas:["-u","-C"],env:["-u","--unset","-C","--chdir","-S","--split-string"],nice:["-n","--adjustment"],ionice:["-c","--class","-n","--classdata","-p","--pid"],stdbuf:["-i","-o","-e","--input","--output","--error"],time:["-f","--format","-o","--output"],timeout:["-s","--signal","-k","--kill-after"],nohup:[],setsid:[],command:[],builtin:[],exec:["-a"]},g1={timeout:1},h1=new Set(["busybox","toybox"]),u1=new Set(["!","{","}","then","do","else","elif","if","while","until","for","case","esac","fi","done","select","function"]),l1=new Set(["-C","-c","--git-dir","--work-tree","--namespace","--exec-path","--config-env"]),m1=/(^|[^A-Za-z0-9_.-])(rm|rmdir|unlink|shred)(?![A-Za-z0-9_.-])/;function qZ(Z){return m1.test(A(Z))}function jZ(Z){return Z.map((J)=>J.replace(/^-[iv0]*S|^--split-string=/," ")).join(" ")}var S0=/^[A-Za-z_][A-Za-z0-9_]*=/;function NZ(Z){let J=Z.lastIndexOf("/");return J>=0?Z.slice(J+1):Z}function b0(Z,J){let $=Z.indexOf("'",J+1);return $===-1?-1:$+1}function sZ(Z,J){let $=J+1;while($<Z.length){if(Z[$]==="\\"){$+=2;continue}if(Z[$]==="`")return $+1;$++}return-1}function f0(Z,J){let $=J+1;while($<Z.length){let X=Z[$];if(X==="\\"){$+=2;continue}if(X==='"')return $+1;if(X==="`"){let z=sZ(Z,$);if(z<0)return-1;$=z;continue}if(X==="$"&&Z[$+1]==="("){let z=_Z(Z,$+1);if(z<0)return-1;$=z;continue}$++}return-1}function JZ(Z,J){if(Z[J]!=="<"||Z[J+1]!=="<"||Z[J+2]==="<")return null;let $=J+2,X=Z[$]==="-";if(X)$++;while(Z[$]===" "||Z[$]==="\t")$++;let z="",Q=!1;while($<Z.length&&!/[\s;|&<>()]/.test(Z[$])){let Y=Z[$];if(Y==="'"||Y==='"'){let G=Z.indexOf(Y,$+1);if(G<0)return null;z+=Z.slice($+1,G),Q=!0,$=G+1;continue}if(Y==="\\"){if($+1>=Z.length)return null;z+=Z[$+1],Q=!0,$+=2;continue}z+=Y,$++}return z?{delimiter:z,stripTabs:X,quoted:Q,end:$}:null}function vZ(Z,J,$){let X=J+1;for(let z of $)for(;;){if(X>Z.length)return-1;let Q=Z.indexOf(`
-`,X),Y=Q===-1?Z.length:Q,G=Z.slice(X,Y);if(G.endsWith("\r"))G=G.slice(0,-1);let K=z.stripTabs?G.length-G.replace(/^\t+/,"").length:0;if(z.stripTabs)G=G.slice(K);if(G===z.delimiter){X=Y+1;break}if(G.startsWith(z.delimiter)&&/^\s*\)/.test(G.slice(z.delimiter.length))){if(z===$[$.length-1])return X+K+z.delimiter.length;return-1}if(Q===-1)return-1;X=Q+1}return X-1}function _Z(Z,J){let $=Z.length,X=Z[J+1]==="(",z=0,Q=J,Y=[];while(Q<$){let G=Z[Q];if(G==="\\"){Q+=2;continue}if(G==="'"){let K=b0(Z,Q);if(K<0)return-1;Q=K;continue}if(G==='"'){let K=f0(Z,Q);if(K<0)return-1;Q=K;continue}if(G==="`"){let K=sZ(Z,Q);if(K<0)return-1;Q=K;continue}if(!X&&G==="<"&&Z[Q+1]==="<"){if(Z[Q+2]==="<"){Q+=3;continue}let K=JZ(Z,Q);if(!K)return-1;Y.push(K),Q=K.end;continue}if(G===`
-`&&Y.length>0){let K=vZ(Z,Q,Y);if(K<0)return-1;Y=[],Q=K;continue}if(!X&&G==="#"&&/[\s;&|(]/.test(Z[Q-1])){let K=Z.indexOf(`
-`,Q);if(K<0)return-1;Q=K;continue}if(G==="(")z++;else if(G===")"){if(z--,z===0)return Y.length>0?-1:Q+1}Q++}return-1}function a(Z){let J=[],$=[],X=[],z=new Set,Q=-1,Y=!1,G=!0,K=0,H=Z.length,B=(M)=>{if(Q>=0){let j=X.length;if(X.push({text:Z.slice(Q,M),start:Q,end:M}),Y)z.add(j);Q=-1,Y=!1}},U=(M)=>{if(B(M),X.length>0)J.push({words:X,redirects:z});X=[],z=new Set,Y=!1},V=(M)=>b0(Z,M),I=(M)=>sZ(Z,M),_=(M)=>_Z(Z,M),P=(M)=>f0(Z,M);while(K<H){let M=Z[K];if(M===" "||M==="\t"||M==="\r"){B(K),K++;continue}if(M===`
-`){U(K),K++;continue}if(M===";"){U(K),K++;continue}if(M==="&"){U(K),K+=Z[K+1]==="&"?2:1;continue}if(M==="|"){U(K),K+=Z[K+1]==="|"?2:1;continue}if(M==="("||M===")"){U(K),K++;continue}if(M==="<"&&Z[K+1]==="<"&&Z[K+2]!=="<"){let j=Z.slice(K+2).match(/^-?[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);if(!j){G=!1,K=H;continue}let h=Z.indexOf(`
-`,K+2+j[0].length);if(h===-1){G=!1,K=H;continue}let u=Z.slice(h+1),d=c1(u,j[2]);if(d===-1){G=!1,K=H;continue}B(K),K=h+1+d+j[2].length;continue}if(M===">"||M==="<"){if(Q>=0&&/^\d+$/.test(Z.slice(Q,K)))Q=-1;if(B(K),Y=!0,K++,Z[K]===M||Z[K]==="&"||M===">"&&Z[K]==="|"||M==="<"&&Z[K]===">")K++;continue}if(M==="'"){if(Q<0)Q=K;let j=V(K);if(j<0)G=!1,K=H;else K=j;continue}if(M==='"'){if(Q<0)Q=K;let j=P(K);if(j<0)G=!1,K=H;else K=j;continue}if(M==="`"){if(Q<0)Q=K;let j=I(K);if(j<0)G=!1,K=H;else $.push(Z.slice(K+1,j-1)),K=j;continue}if(M==="$"&&Z[K+1]==="("){if(Q<0)Q=K;let j=_(K+1);if(j<0)G=!1,K=H;else $.push(Z.slice(K+2,j-1)),K=j;continue}if(M==="\\"){if(Q<0)Q=K;if(K+1>=H)G=!1,K=H;else K+=2;continue}if(Q<0)Q=K;K++}return U(H),{segments:J,trustworthy:G,substitutions:$}}function c1(Z,J){let $=0;while($<=Z.length){let X=Z.indexOf(J,$);if(X===-1)return-1;let z=X===0||Z[X-1]===`
+import{homedir as F0}from"os";import{isAbsolute as z1}from"path";import{isAbsolute as T1,join as e,normalize as C1,resolve as I1,sep as uZ}from"path";import{dirname as o,isAbsolute as PZ,join as xZ,resolve as d}from"path";import{accessSync as H1,closeSync as B1,constants as LZ,fstatSync as U1,lstatSync as GZ,openSync as V1,readFileSync as M1,readlinkSync as F1,readSync as q1,realpathSync as gZ,statSync as hZ}from"fs";import{spawnSync as N1}from"child_process";var j0={missing:"No verified @hasna/trash guard was found on PATH.",unsafe_executable:"The Trash candidate is not an owned executable file or is writable by group or others.",unsafe_manifest:"The Trash package manifest is not a safe owned regular file.",unsafe_directory:"A Trash PATH or package directory is not owned safely or is writable by group or others.",unsafe_interpreter:"The Trash interpreter is missing, unsupported, or not a safe owned executable on its actual PATH.",unrecognized_package:"The candidate is not the registered @hasna/trash executable.",identity_failed:"The installed Trash identity probe failed or exceeded its deadline.",unsupported_protocol:"The installed Trash version does not expose the required guard protocol."};function HZ(Z){return Z===0||Z===process.getuid?.()}function AZ(Z,J=!1){let $=Z;for(let X=0;X<32;X++){if(!PZ($)||$.length>4096||!BZ("/"))return!1;let z=$.split("/"),Q=z.pop();if(!Q||Q==="."||Q==="..")return!1;let Y="/";for(let H of z){if(!H||H===".")continue;if(H===".."){Y=o(Y);continue}let B=xZ(Y,H),U=GZ(B);if(J&&B==="/bin"&&U.isSymbolicLink()&&U.uid===0){let V=gZ(B);if(!BZ(V))return!1;Y=V;continue}if(!U.isDirectory()||!HZ(U.uid)||U.mode&18)return!1;Y=B}let G=xZ(Y,Q),K=GZ(G);if(!HZ(K.uid))return!1;if(K.isSymbolicLink()){let H=F1(G);$=PZ(H)?H:Y+"/"+H;continue}return K.isFile()&&Boolean(K.mode&73)&&!(K.mode&18)}return!1}function _1(Z){if(!PZ(Z)||d(Z)!==(Z.replace(/\/+$/,"")||"/"))return!1;for(let J=d(Z);;J=o(J)){try{return GZ(J),BZ(J)}catch($){if($.code!=="ENOENT")return!1}if(o(J)===J)return!1}}function j1(Z,J){let $=V1(Z,LZ.O_RDONLY|LZ.O_NONBLOCK|LZ.O_NOFOLLOW),X;try{if(!U1($).isFile())return!1;let Q=Buffer.alloc(256),Y=q1($,Q,0,Q.length,0);X=Q.subarray(0,Y).toString("utf8").split(`
+`)[0]}finally{B1($)}let z=/^#!(\/[A-Za-z0-9_./-]+)$/.exec(X);if(z&&z[1]!=="/usr/bin/env")return AZ(z[1],!0);if(X!=="#!/usr/bin/env bun"||!AZ("/usr/bin/env",!0))return!1;for(let Q of J.split(":").slice(0,64)){if(!_1(Q))return!1;let Y=d(Q,"bun");try{if(!hZ(Y).isFile())continue;H1(Y,LZ.X_OK)}catch{continue}return AZ(Y,!0)}return!1}function BZ(Z){let J=Z;for(;;){let $=GZ(J);if(!$.isDirectory()||!HZ($.uid)||($.mode&18)!==0)return!1;let X=o(J);if(X===J)return!0;J=X}}function UZ(Z=process.env){let J=Z.PATH??"",$=Date.now()+2000,X="missing",z=(Q)=>{if(X==="missing"||X==="unrecognized_package"||Q.startsWith("unsafe_"))X=Q};for(let Q of J.split(":").slice(0,64)){if(!PZ(Q)||Date.now()>=$)continue;let Y=d(Q,"trash");try{let G=hZ(Y);if(!G.isFile()||!HZ(G.uid)||(G.mode&73)===0||(G.mode&18)!==0){z("unsafe_executable");continue}let K=gZ(Y);if(!BZ(d(Q))||!BZ(o(K))){z("unsafe_directory");continue}if(!AZ(Y)){z("unsafe_directory");continue}let H=d(o(K),"../.."),B=xZ(H,"package.json"),U=hZ(B);if(!U.isFile()||!HZ(U.uid)||U.size>16384||(U.mode&18)!==0||GZ(B).isSymbolicLink()){z("unsafe_manifest");continue}let V=JSON.parse(M1(B,"utf8"));if(V.name!=="@hasna/trash"||typeof V.version!=="string"||typeof V.bin?.trash!=="string"||gZ(d(H,V.bin.trash))!==K){z("unrecognized_package");continue}try{if(!j1(K,J)){z("unsafe_interpreter");continue}}catch{z("unsafe_interpreter");continue}let W=$-Date.now();if(W<=0){z("identity_failed");break}let _=N1(Y,["--identity"],{encoding:"utf8",timeout:W,maxBuffer:2048,env:{PATH:J},stdio:["ignore","pipe","pipe"]});if(_.error||_.status!==0||Date.now()>=$){z("identity_failed");continue}let L=JSON.parse(_.stdout);if(L.name==="@hasna/trash"&&L.version===V.version&&L.guardProtocol==="hasna.trash.guard.v1")return{ok:!0,path:Y,version:V.version};z("unsupported_protocol")}catch{}}return{ok:!1,code:X}}function OZ(Z=process.env){let J=UZ(Z);return J.ok?J.path:null}function t(Z){let J=Z.tool_input?.command;return typeof J==="string"?J:""}var W0=["/","/bin","/boot","/dev","/etc","/home","/lib","/lib32","/lib64","/libx32","/opt","/proc","/root","/run","/sbin","/srv","/sys","/usr","/var","/Applications","/Library","/System","/Users","/Volumes","/private"];var D1=600000,L1="Delete via trash guard (rm intercepted and made recoverable)",A1=[".hasna/repos/clones","workspace/repos"],P1=[".hasna",".ssh",".aws"],T0={rmdir:"`rmdir` is a delete that trash-guard does not rewrite (it takes rmdir's flags, not rm's). Re-run it as `rm -d -- <path>` for an empty directory, or `rm -r -- <path>` for a non-empty one, and it is redirected into trash.",unlink:"`unlink` is a delete that trash-guard does not rewrite. Re-run it as `rm -- <path>` and it is redirected into trash.",shred:"`shred` destroys content irrecoverably and is never allowed. Re-run it as `rm -- <path>` and it is redirected into trash."},O1=new Set(["sh","bash","zsh","dash","ksh","ash","eval","source",".","su","runuser","env"]),E1={sudo:["-u","--user","-g","--group","-p","--prompt","-C","--chdir","-h","--host","-r","--role","-t","--type","-U","--other-user"],doas:["-u","-C"],env:["-u","--unset","-C","--chdir","-S","--split-string"],nice:["-n","--adjustment"],ionice:["-c","--class","-n","--classdata","-p","--pid"],stdbuf:["-i","-o","-e","--input","--output","--error"],time:["-f","--format","-o","--output"],timeout:["-s","--signal","-k","--kill-after"],nohup:[],setsid:[],command:[],builtin:[],exec:["-a"]},R1={timeout:1},v1=new Set(["busybox","toybox"]),y1=new Set(["!","{","}","then","do","else","elif","if","while","until","for","case","esac","fi","done","select","function"]),S1=new Set(["-C","-c","--git-dir","--work-tree","--namespace","--exec-path","--config-env"]),b1=/(^|[^A-Za-z0-9_.-])(rm|rmdir|unlink|shred)(?![A-Za-z0-9_.-])/;function MZ(Z){return b1.test(D(Z))}function qZ(Z){return Z.map((J)=>J.replace(/^-[iv0]*S|^--split-string=/," ")).join(" ")}var L0=/^[A-Za-z_][A-Za-z0-9_]*=/;function FZ(Z){let J=Z.lastIndexOf("/");return J>=0?Z.slice(J+1):Z}function A0(Z,J){let $=Z.indexOf("'",J+1);return $===-1?-1:$+1}function mZ(Z,J){let $=J+1;while($<Z.length){if(Z[$]==="\\"){$+=2;continue}if(Z[$]==="`")return $+1;$++}return-1}function P0(Z,J){let $=J+1;while($<Z.length){let X=Z[$];if(X==="\\"){$+=2;continue}if(X==='"')return $+1;if(X==="`"){let z=mZ(Z,$);if(z<0)return-1;$=z;continue}if(X==="$"&&Z[$+1]==="("){let z=NZ(Z,$+1);if(z<0)return-1;$=z;continue}$++}return-1}function ZZ(Z,J){if(Z[J]!=="<"||Z[J+1]!=="<"||Z[J+2]==="<")return null;let $=J+2,X=Z[$]==="-";if(X)$++;while(Z[$]===" "||Z[$]==="\t")$++;let z="",Q=!1;while($<Z.length&&!/[\s;|&<>()]/.test(Z[$])){let Y=Z[$];if(Y==="'"||Y==='"'){let G=Z.indexOf(Y,$+1);if(G<0)return null;z+=Z.slice($+1,G),Q=!0,$=G+1;continue}if(Y==="\\"){if($+1>=Z.length)return null;z+=Z[$+1],Q=!0,$+=2;continue}z+=Y,$++}return z?{delimiter:z,stripTabs:X,quoted:Q,end:$}:null}function EZ(Z,J,$){let X=J+1;for(let z of $)for(;;){if(X>Z.length)return-1;let Q=Z.indexOf(`
+`,X),Y=Q===-1?Z.length:Q,G=Z.slice(X,Y);if(G.endsWith("\r"))G=G.slice(0,-1);let K=z.stripTabs?G.length-G.replace(/^\t+/,"").length:0;if(z.stripTabs)G=G.slice(K);if(G===z.delimiter){X=Y+1;break}if(G.startsWith(z.delimiter)&&/^\s*\)/.test(G.slice(z.delimiter.length))){if(z===$[$.length-1])return X+K+z.delimiter.length;return-1}if(Q===-1)return-1;X=Q+1}return X-1}function NZ(Z,J){let $=Z.length,X=Z[J+1]==="(",z=0,Q=J,Y=[];while(Q<$){let G=Z[Q];if(G==="\\"){Q+=2;continue}if(G==="'"){let K=A0(Z,Q);if(K<0)return-1;Q=K;continue}if(G==='"'){let K=P0(Z,Q);if(K<0)return-1;Q=K;continue}if(G==="`"){let K=mZ(Z,Q);if(K<0)return-1;Q=K;continue}if(!X&&G==="<"&&Z[Q+1]==="<"){if(Z[Q+2]==="<"){Q+=3;continue}let K=ZZ(Z,Q);if(!K)return-1;Y.push(K),Q=K.end;continue}if(G===`
+`&&Y.length>0){let K=EZ(Z,Q,Y);if(K<0)return-1;Y=[],Q=K;continue}if(!X&&G==="#"&&/[\s;&|(]/.test(Z[Q-1])){let K=Z.indexOf(`
+`,Q);if(K<0)return-1;Q=K;continue}if(G==="(")z++;else if(G===")"){if(z--,z===0)return Y.length>0?-1:Q+1}Q++}return-1}function i(Z){let J=[],$=[],X=[],z=new Set,Q=-1,Y=!1,G=!0,K=0,H=Z.length,B=(M)=>{if(Q>=0){let j=X.length;if(X.push({text:Z.slice(Q,M),start:Q,end:M}),Y)z.add(j);Q=-1,Y=!1}},U=(M)=>{if(B(M),X.length>0)J.push({words:X,redirects:z});X=[],z=new Set,Y=!1},V=(M)=>A0(Z,M),W=(M)=>mZ(Z,M),_=(M)=>NZ(Z,M),L=(M)=>P0(Z,M);while(K<H){let M=Z[K];if(M===" "||M==="\t"||M==="\r"){B(K),K++;continue}if(M===`
+`){U(K),K++;continue}if(M===";"){U(K),K++;continue}if(M==="&"){U(K),K+=Z[K+1]==="&"?2:1;continue}if(M==="|"){U(K),K+=Z[K+1]==="|"?2:1;continue}if(M==="("||M===")"){U(K),K++;continue}if(M==="<"&&Z[K+1]==="<"&&Z[K+2]!=="<"){let j=Z.slice(K+2).match(/^-?[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1/);if(!j){G=!1,K=H;continue}let g=Z.indexOf(`
+`,K+2+j[0].length);if(g===-1){G=!1,K=H;continue}let h=Z.slice(g+1),c=f1(h,j[2]);if(c===-1){G=!1,K=H;continue}B(K),K=g+1+c+j[2].length;continue}if(M===">"||M==="<"){if(Q>=0&&/^\d+$/.test(Z.slice(Q,K)))Q=-1;if(B(K),Y=!0,K++,Z[K]===M||Z[K]==="&"||M===">"&&Z[K]==="|"||M==="<"&&Z[K]===">")K++;continue}if(M==="'"){if(Q<0)Q=K;let j=V(K);if(j<0)G=!1,K=H;else K=j;continue}if(M==='"'){if(Q<0)Q=K;let j=L(K);if(j<0)G=!1,K=H;else K=j;continue}if(M==="`"){if(Q<0)Q=K;let j=W(K);if(j<0)G=!1,K=H;else $.push(Z.slice(K+1,j-1)),K=j;continue}if(M==="$"&&Z[K+1]==="("){if(Q<0)Q=K;let j=_(K+1);if(j<0)G=!1,K=H;else $.push(Z.slice(K+2,j-1)),K=j;continue}if(M==="\\"){if(Q<0)Q=K;if(K+1>=H)G=!1,K=H;else K+=2;continue}if(Q<0)Q=K;K++}return U(H),{segments:J,trustworthy:G,substitutions:$}}function f1(Z,J){let $=0;while($<=Z.length){let X=Z.indexOf(J,$);if(X===-1)return-1;let z=X===0||Z[X-1]===`
 `,Q=X+J.length,Y=Q===Z.length||Z[Q]===`
-`||Z[Q]==="\r";if(z&&Y)return X;$=X+1}return-1}function A(Z){let J="",$=0;while($<Z.length){let X=Z[$];if(X==="\\"){if($+1<Z.length)J+=Z[$+1];$+=2;continue}if(X==="'"){let z=Z.indexOf("'",$+1);if(z===-1){J+=Z.slice($+1);break}J+=Z.slice($+1,z),$=z+1;continue}if(X==='"'){$++;while($<Z.length&&Z[$]!=='"'){if(Z[$]==="\\"&&$+1<Z.length){J+=Z[$+1],$+=2;continue}J+=Z[$],$++}$++;continue}J+=X,$++}return J}function x(Z){let J=0,$=0;while(J<Z.words.length&&$++<32){if(Z.redirects.has(J)){J++;continue}let X=Z.words[J].text,z=A(X);if(S0.test(z)&&!z.startsWith("-")){J++;continue}if(u1.has(z)){J++;continue}let Q=NZ(z);if(Q==="command")for(let G of Z.words.filter((K,H)=>H>J&&!Z.redirects.has(H))){let K=A(G.text);if(K==="--"||!K.startsWith("-"))break;if(/^-[pvV]*[vV][pvV]*$/.test(K))return-1}let Y=x1[Q];if(Y){let G=J;J++;while(J<Z.words.length){if(Z.redirects.has(J)){J++;continue}let H=A(Z.words[J].text);if(!H.startsWith("-")||H==="-")break;if(H==="--"){J++;break}if(Q==="env"&&(/^-[iv0]*S/.test(H)||/^--split-string(?:=|$)/.test(H)))return G;if(J++,Y.includes(H)||Q==="exec"&&/^-[cl]*a$/.test(H)){while(Z.redirects.has(J))J++;J++}}let K=g1[Q]??0;while(K>0&&J<Z.words.length){let H=A(Z.words[J].text);if(H.startsWith("-")&&H!=="-")break;J++,K--}continue}return J}return-1}function p1(Z,J){let $=[],X=!1;for(let z=J+1;z<Z.words.length;z++){if(Z.redirects.has(z))continue;let Q=A(Z.words[z].text);if(!X){if(Q==="--"){X=!0;continue}if(Q.startsWith("-")&&Q!=="-")continue}$.push(Z.words[z])}return $}function d1(Z){return f1.map((J)=>$Z(Z,...J.split("/")))}function i1(Z,J){if(Z==="~"||Z==="$HOME"||Z==="${HOME}")return J;if(Z.startsWith("~/"))return $Z(J,Z.slice(2));if(Z.startsWith("$HOME/"))return $Z(J,Z.slice(6));if(Z.startsWith("${HOME}/"))return $Z(J,Z.slice(8));return Z}function iZ(Z,J,$){let X=A(Z);if(!X)return null;if(X.includes("`"))return null;if(X==="$HOME"||X==="${HOME}"||X==="$HOME/"||X==="${HOME}/")return $;if(X.replace(/\$\{HOME\}/g,"").replace(/\$HOME/g,"").includes("$"))return null;if(/[*?[\]]/.test(X))return null;if(X.startsWith("~")){let G=i1(X,$);if(G===X)return null;X=G}let Y=(R1(X)?v1(X):y1(J,X)).replace(/\/+$/,"");return Y===""?"/":Y}function FZ(Z,J){return Z===J||Z.startsWith(`${J}${dZ}`)}function s1(Z,J){let $=`${$Z(J,".hasna","scratchpad","scratch")}${dZ}`;if(!Z.startsWith($))return!1;let[X,z]=Z.slice($.length).split(dZ);if(!X||!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(X)||X.endsWith(".")||!z)return!1;let Q=z.normalize("NFKC").toLowerCase();return Q!=="meta.json"&&Q!==".lock"}function a1(Z,J){if(Z===J)return`\`${Z}\` is the home directory itself, which is never deleted or trashed. Delete a specific file or directory inside it instead.`;for(let $ of O0){if(Z!==$&&!FZ($,Z))continue;return $==="/"?`\`${Z}\` is the filesystem root, which is never deleted.`:`\`${Z}\` is the system root \`${$}\` (or an ancestor of it), which is never deleted or trashed.`}for(let $ of k1){let X=$Z(J,$);if($===".hasna"&&s1(Z,J))continue;if(!FZ(Z,X)&&!FZ(X,Z))continue;return`\`${Z}\` is the protected \`~/${$}\` path (or contains it), which is never deleted or trashed. Delete a specific file inside it, and only when you are sure.`}return null}function n1(Z,J,$){let X=d1($);if(X.some((z)=>FZ(J,z)))return!0;for(let z of Z){let Q=iZ(z.text,J,$);if(Q&&X.some((Y)=>FZ(Q,Y)))return!0}return!1}function WZ(Z,J){let $={cwd:J.cwd,home:J.home,depth:J.depth??0},X={rmHits:[],handoffHits:[],refusals:[],protectedHits:[],trustworthy:!0},z=a(Z);if(X.trustworthy=z.trustworthy,!z.trustworthy)return X;let Q=$.cwd;for(let Y of z.segments){let G=x(Y);if(G<0)continue;let K=NZ(A(Y.words[G].text));if(K==="cd"){let U=Y.words[G+1];if(U){let V=iZ(U.text,Q,$.home);if(V)Q=V;else Q=$.cwd}continue}let H=E0[K];if(H){X.refusals.push({reason:H});continue}if(K==="rm"){let U=p1(Y,G);if(U.length===0)continue;let V={word:Y.words[G],operands:U};if(n1(V.operands,Q,$.home)){X.handoffHits.push(V);continue}X.rmHits.push(V);for(let I of V.operands){let _=iZ(I.text,Q,$.home);if(!_)continue;let P=a1(_,$.home);if(P){X.protectedHits.push({reason:P});break}}continue}if(h1.has(K)){let U=Y.words.findIndex((I,_)=>_>G&&!A(I.text).startsWith("-")),V=U>=0?NZ(A(Y.words[U].text)):"";if(V==="rm"||V in E0)X.refusals.push({reason:`\`${K} ${V}\` runs the ${K} applet, whose own \`rm\` is not GNU \`rm\` and cannot be rewritten in place. Run the delete as \`rm -- <path>\`, which is redirected into trash.`});continue}if(K==="git"){let U=aZ(Y,G);if(U==="rm"||U==="clean"){if(!(U==="rm"?o1(Y,G):k0(Y,G)))X.refusals.push({reason:U==="rm"?"`git rm` is refused: without `--cached` it deletes the working-tree file, and its semantics are not `rm`'s. Use `rm -- <path>` (intercepted and redirected into trash) to remove the file, or `git rm --cached -- <path>` to unstage it without deleting.":"`git clean` deletes untracked files irrecoverably and is refused. Remove them explicitly with `rm -- <path>` (intercepted and redirected into trash), or preview with `git clean -n`."})}continue}if(K==="find"){let U=Y.words.map((_)=>A(_.text));if(U.indexOf("-delete")>=0){X.refusals.push({reason:"`find -delete` deletes files irrecoverably and is refused. List the paths first (`find \u2026 -print`), then remove them explicitly with `rm -- <path>` so the delete is redirected into trash."});continue}let I=U.findIndex((_)=>_==="-exec"||_==="-execdir"||_==="-ok");if(I>=0&&U.slice(I).some((_)=>_==="rm"||_==="rmdir"||_==="unlink"||_==="shred")){X.refusals.push({reason:"`find -exec <delete>` is refused: the delete runs through find, not through `rm`, and cannot be redirected into trash. Remove the paths explicitly with `rm -- <path>`."});continue}continue}if(K==="xargs"&&Y.words.some((U)=>A(U.text)==="rm")){X.refusals.push({reason:"`xargs rm` takes its targets from stdin, so this hook cannot verify what would be deleted. Pipe the paths into an explicit `rm -- <path> \u2026` instead, which is redirected into trash."});continue}let B=K==="env"?jZ(Y.words.map((U)=>A(U.text))):r1(Y);if(w1.has(K)&&qZ(B)){X.refusals.push({reason:`\`${K}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`});continue}}if($.depth<3)for(let Y of z.substitutions){let G=WZ(Y,{cwd:Q,home:$.home,depth:$.depth+1});if(G.rmHits.length>0||G.refusals.length>0||G.handoffHits.length>0||G.protectedHits.length>0){X.refusals.push({reason:"This command runs a delete inside a command substitution `$(\u2026)`, which this hook cannot rewrite. Run the delete as a separate `rm -- <path>` command, which is redirected into trash."});break}}else if(z.substitutions.some((Y)=>qZ(Y)))X.refusals.push({reason:"This command nests a delete inside command substitutions deeper than this hook will follow. Run the delete as a separate `rm -- <path>` command."});return X}function r1(Z){return Z.words.map((J)=>J.text).join(" ")}function aZ(Z,J){let $=J+1;while($<Z.words.length){let X=A(Z.words[$].text);if(!X.startsWith("-"))return X;if($++,l1.has(X))$++}return null}function o1(Z,J){if(Z.words.slice(J+1).map((X)=>A(X.text)).includes("--cached"))return!0;return k0(Z,J)}function k0(Z,J){let $=Z.words.slice(J+1).map((X)=>A(X.text));return $.includes("-n")||$.includes("--dry-run")}function R0(Z){if(/^[A-Za-z0-9_\-./+=:,@%^]+$/.test(Z))return Z;return`'${Z.replace(/'/g,"'\\''")}'`}function t1(Z,J,$,X){let z=X?["/usr/bin/env","-i",`HOME=${X.home}`,`PATH=${X.path}`,`HASNA_TRASH_AGENT=${X.agent}`,X.runtime,"--config=/dev/null","--no-env-file","--no-macros","--no-install",$,"guard"].map(R0).join(" "):`${R0($)} guard`,Q=[...J].sort((G,K)=>K.word.start-G.word.start),Y=Z;for(let G of Q)Y=`${Y.slice(0,G.word.start)}${z}${Y.slice(G.word.end)}`;return Y}function e1(Z,J,$,X,z){if(!J||J===Z)return!1;if($.length===0)return!1;let Q=WZ(J,{cwd:X,home:z});if(!Q.trustworthy)return!1;if(Q.rmHits.length>0||Q.handoffHits.length>0)return!1;return Q.refusals.length===0}function Z2(Z,J){let $={};for(let[X,z]of Object.entries(Z??{}))$[X]=z;if($.command=J,typeof $.description!=="string"||$.description.trim()==="")$.description=b1;if(typeof $.timeout!=="number"||!Number.isFinite($.timeout)||$.timeout<=0)$.timeout=S1;if(typeof $.run_in_background!=="boolean")$.run_in_background=!1;if("dangerouslyDisableSandbox"in $&&typeof $.dangerouslyDisableSandbox!=="boolean")delete $.dangerouslyDisableSandbox;return $}function $2(Z,J,$,X,z){if(typeof Z.command!=="string"||Z.command.trim()==="")return!1;if(typeof Z.description!=="string"||Z.description.trim()==="")return!1;if(typeof Z.timeout!=="number"||!Number.isFinite(Z.timeout)||Z.timeout<=0)return!1;if(typeof Z.run_in_background!=="boolean")return!1;if("dangerouslyDisableSandbox"in Z&&typeof Z.dangerouslyDisableSandbox!=="boolean")return!1;return e1(J,Z.command,$,X,z)}function J2(Z){let J=new Set(["export","set","unset","readonly","declare","typeset","local","alias","unalias","read","readarray","mapfile","getopts","trap","enable","function","env","sudo","doas","stdbuf"]);return a(Z).segments.some((X)=>{let z=x(X);if(X.words.slice(0,z<0?X.words.length:z).some((G)=>S0.test(A(G.text))||J.has(NZ(A(G.text)))))return!0;if(z<0)return!1;let Y=X.words[z];return J.has(NZ(A(Y.text)))||/^\s*\(\s*\)\s*\{/.test(Z.slice(Y.end))})}function k(Z){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Z}}}function X2(Z){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",updatedInput:Z}}}function z2(Z){try{if(Z.inspectTrash){let J=Z.inspectTrash();return J.ok?{path:J.path,error:null}:{path:null,error:`${J.code}: ${P0[J.code]}`}}return{path:Z.findTrash(),error:null}}catch(J){return{path:null,error:J instanceof Error?J.message:String(J)}}}var K2="[trash-guard] No verified @hasna/trash guard was found on PATH. This deletion is refused. Install the current @hasna/trash package with Bun and run its setup; the operating-system trash utility is not a compatible guard.";function w0(Z,J){if(Z.hook_event_name!=="PreToolUse")return{continue:!0};if(["apply_patch","ApplyPatch","functions.apply_patch"].includes(Z.tool_name??"")){let H=Z.tool_input?.command;if(typeof H!=="string")return k("[trash-guard] Unreadable patch input; deletion safety cannot be checked.");if(/^\s*\*\*\* Delete File:/m.test(H))return k("[trash-guard] Delete File would bypass recoverable deletion. First use `trash put -- <path>` or the trash_put MCP tool, then submit any remaining edits without the deletion block.");return{continue:!0}}if(Z.tool_name!=="Bash")return{continue:!0};if(typeof Z.tool_input?.command!=="string")return k("[trash-guard] The Bash tool call carried no readable `command`, so this hook cannot verify what would run. Refusing a call it cannot verify. Re-run the delete explicitly as `rm -- <path>` so it can be redirected into trash.");let X=ZZ(Z);if(!X.trim())return{continue:!0};let z=WZ(X,{cwd:J.cwd,home:J.home});if(z.refusals.length>0)return k(`[trash-guard] ${z.refusals[0].reason}`);if(z.protectedHits.length>0)return k(`[trash-guard] ${z.protectedHits[0].reason}`);if(!z.trustworthy)return qZ(X)?k("[trash-guard] This command could not be parsed to the end (unterminated quote, substitution or here-document), so a delete inside it cannot be redirected. Re-run the delete as a plain `rm -- <path>` command."):{continue:!0};if(z.rmHits.length===0){if(z.handoffHits.length>0)return{continue:!0};return{continue:!0}}if(z.handoffHits.length>0)return k("[trash-guard] This command mixes a delete under the protected repo-checkout roots (owned by workspace-repos-guard) with a delete outside them, and a partial rewrite would leave one of them unredirected. Re-run them as separate commands, so each delete is handled by the hook that owns it.");let Q=z2(J);if(Q.error!==null)return k(`[trash-guard] The guard could not resolve the \`trash\` binary (${Q.error}), so this \`rm\` cannot be redirected into a recoverable delete \u2014 and an unrecoverable delete is never allowed, so the command is refused rather than run. Fix the environment (PATH, permissions) and re-run the same command.`);if(Q.path===null)return k(K2);let Y=Q.path;if(J.execution&&J2(X))return k("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");let G=t1(X,z.rmHits,Y,J.execution),K=Z2(Z.tool_input,G);if(J.execution)K.hasna_execution="hasna.hooks.execution.v1";if(!$2(K,X,z.rmHits,J.cwd,J.home))return k("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");return X2(K)}import{closeSync as Q2,constants as x0,fstatSync as Y2,lstatSync as G2,openSync as H2,readFileSync as B2,statSync as U2}from"fs";import{homedir as l0}from"os";import{dirname as nZ,isAbsolute as m0,join as XZ,normalize as zZ,relative as V2,resolve as DZ,sep as eZ}from"path";var M2=new Set(["Write","Edit","MultiEdit","NotebookEdit"]),F2=new Set(["apply_patch","ApplyPatch","functions.apply_patch"]),q2=["hasna","hasnaxyz","hasna-products"],TZ="workspace-repos-guard";function N2(Z){return XZ(Z,".hasna","repos","clones")}function j2(Z){return XZ(Z,"workspace","repos")}function c0(Z){return[N2(Z),j2(Z)]}function _2(Z){return XZ(Z,".hasna","hooks","config","workspace-repos-guard-orgs")}var W2=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;function rZ(Z){let J=process.getuid?.();return J!==void 0&&(Z.uid===0||Z.uid===J)&&(Z.mode&18)===0}function T2(Z){let J=_2(Z),$;try{let z=H2(J,x0.O_RDONLY|x0.O_NOFOLLOW);try{let Y=Y2(z);if(!Y.isFile()||!rZ(Y)||Y.size>4096)return null;$=B2(z,"utf8")}finally{Q2(z)}let Q=zZ(Z);for(let Y=nZ(J);Y!==Q;Y=nZ(Y)){let G=G2(Y);if(!G.isDirectory()||!rZ(G)||Y===nZ(Y))return null}if(!rZ(U2(Q)))return null}catch{return null}let X=$.replace(/#[^\n]*/g,"").split(/[\s,]+/).filter(Boolean);return X.length>0&&X.every((z)=>W2.test(z))?new Set(X):null}function C2(Z=process.env,J=l0()){let $=Z.WORKSPACE_REPOS_GUARD_ORGS;if(typeof $==="string"&&$.trim())return new Set($.split(",").map((X)=>X.trim()).filter(Boolean));return T2(J)??new Set(q2)}function oZ(Z,J,$,X){if(X==="read")return{blocked:!1};let z=V2(J,Z);if(z===""){if(X==="delete")return{blocked:!0,reason:`[${TZ}] delete of the protected repo-checkout root is forbidden: ${J}`};return{blocked:!0,reason:`[${TZ}] writes directly to the protected repo-checkout root are forbidden: ${J}`}}if(z.startsWith(`..${eZ}`)||z===".."||m0(z))return{blocked:!1};let Q=z.split(eZ).filter(Boolean);if(X==="delete")return{blocked:!0,reason:`[${TZ}] delete under the protected repo-checkout root (${J}) is forbidden at any depth: ${Z}`};if(Q.length<=1)return{blocked:!0,reason:`[${TZ}] writing would create a top-level entry directly under the protected repo-checkout root (${J}); only GitHub-org folders belong there: ${Z}`};let Y=Q[0];if(!$.has(Y))return{blocked:!0,reason:`[${TZ}] '${Y}' is not an allowed GitHub org under the protected repo-checkout root (${J}); allowed: ${[...$].join(", ")}: ${Z}`};return{blocked:!1}}var p0=/\b(?:-o|--output|-O|--output-document|-out)\b/,I2=/\d*[<>]&\s*(?:\d+|-)(?=$|[\s;&|)])/g,D2=/(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;function d0(Z){return Z.replace(I2," ")}function A2(Z){let J=[],$=null,X=0,z=0,Q=!1,Y=0;for(let G=0;G<Z.length;G++){let K=Z[G];if($==="'"){if(K==="'")$=null;continue}if(K==="\\"){G++;continue}if(K==="("){X++;continue}if(K===")"){if(--X<0)return[Z];continue}if(K==="$"&&Z[G+1]==="{"){z++,G++;continue}if(K==="}"&&z>0){z--;continue}if(K==="`"){Q=!Q;continue}if($==='"'){if(K==='"')$=null;continue}if(K==="'"||K==='"'){$=K;continue}if(K!=="|"||X>0||z>0||Q||Z[G-1]===">")continue;if(J.push(Z.slice(Y,G)),Z[G+1]==="&")G++;Y=G+1}if($||X!==0||z!==0||Q)return[Z];return J.push(Z.slice(Y)),J}function L2(Z){let J=[],$="",X="",z=null,Q=!1,Y=()=>{if(!Q)return;let G=X.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/,""),K=$.startsWith("~")&&!/^~(?:\/|$)/.test(X);J.push({text:K?`./${$}`:$,opaque:/[$\x60*?[]/.test(G)||/[()]/.test(G)}),$="",X="",Q=!1};for(let G=0;G<Z.length;G++){let K=Z[G];if(z==="'"){if(K==="'")z=null;else $+=K;X+=K;continue}if(K==="\\"&&G+1<Z.length){let H=Z[G+1];$+=z==='"'&&!/[$\x60"\\\n]/.test(H)?K+H:H,X+=K+H,Q=!0,G++;continue}if(z==='"'){if(K==='"')z=null;else $+=K;X+=K;continue}if(/\s/.test(K)){Y();continue}if(Q=!0,X+=K,K==="'"||K==='"')z=K;else $+=K}if(z)X+="$";return Y(),J}function tZ(Z,J,$){let X=Z[J];return X==="--help"||X==="--version"||$&&(X==="-h"||X==="-V")}function P2(Z){let J=Z.trim();if(!J)return"read";let $=a(J);if(!$.trustworthy||$.substitutions.length||/\$\{[^}]*[|;()]|[<>]\(/.test(J))return g0(J);let X=$.segments.map((z)=>{let Q=x(z);if(Q<0)return"read";let Y=z.words.filter((K,H)=>H>=Q&&!z.redirects.has(H)).map((K)=>A(K.text)),G=Y[0].split("/").pop();if(["rm","rmdir","shred"].includes(G??""))return tZ(Y,1,!1)?"read":"delete";if(["unlink","rmtree","del"].includes(G??""))return"delete";if(G==="trash"){let K=1;while(K<Y.length&&Y[K].startsWith("-")){let H=Y[K++];if(["--help","-h","--version","-V","--identity"].includes(H))return"read";if(["--agent","--spool","--files","--info","--config"].includes(H))K++;else if(!["--json","--local"].includes(H))return"delete"}if(K===Y.length||["status","doctor","list","info","get","pending","station","setup","backup","storage","retrieval","backup-storage","backup-inspect","backup-refresh","help"].includes(Y[K]))return"read";if(["restore","restore-capsule"].includes(Y[K]))return"write";if(["put","rm","delete","remove"].includes(Y[K])&&tZ(Y,K+1,!0))return"read";return"delete"}if(G==="git"){let K=aZ(z,Q);if(K==="clean"||K==="rm")return Y[1]===K&&tZ(Y,2,!0)?"read":"delete";return K==="clone"||K==="init"?"write":"read"}if(G==="env"&&qZ(jZ(Y)))return"delete";if(["sh","bash","zsh","dash","ksh","ash","eval","source",".","su","runuser","env","xargs","find","busybox","toybox"].includes(G??""))return g0(Y.join(" "));if(["mkdir","mkfile","touch","mv","cp","ln","tee","install","dd","rsync","scp","truncate"].includes(G??""))return"write";if(G==="curl"||G==="wget")return p0.test(Y.join(" "))?"write":"read";if(G==="sed"&&Y.slice(1).some((K)=>/^-i|^--in-place(?:=|$)/.test(K)))return"write";if(["python","python3","node","bun"].includes(G??"")&&Y.some((K)=>K==="-c"||K==="-e"))return"write";return"read"});return X.includes("delete")?"delete":X.includes("write")?"write":"read"}function g0(Z){let J=Z.trim();if(!J)return"read";if(/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(J))return"delete";if(/\bgit\b/.test(J)){if(/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(J))return"delete";if(/\bgit\b[^;&|]*\b(?:clone|init)\b/.test(J))return"write";return"read"}if(/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(J))return"write";if(/\b(?:curl|wget)\b/.test(J)){if(p0.test(J))return"write";return"read"}if(/\bsed\b/.test(J)){if(/(?:^|\s)-i\S*(?:\s|$)|--in-place(?:\s|$)/.test(J))return"write"}else if(/\b(?:rsync|scp|truncate)\b/.test(J))return"write";else if(/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(J))return"write";if(/(?:^|[;&|])\s*echo\b/.test(J)||/>/.test(d0(J)))return"write";return"read"}function IZ(Z,J){let $=Z.trim(),X=$.match(/^(['"])([\s\S]*)\1$/);if(X)$=X[2];if($=$.replace(/^"*\$HOME"*\//,"$HOME/"),$=$.replace(/^"*\$\{HOME\}"*\//,"${HOME}/"),$==="~")return J;if($.startsWith("~/"))return XZ(J,$.slice(2));if($==="$HOME"||$==="${HOME}")return J;if($.startsWith("$HOME/"))return XZ(J,$.slice(6));if($.startsWith("${HOME}/"))return XZ(J,$.slice(8));let z=$.match(new RegExp(`^"*${Z0(J)}"*/`));if(z)return J+"/"+$.slice(z[0].length);return Z}function O2(Z){let J=Z.trim();while(J.startsWith("(")||J.startsWith("{"))J=J.slice(1).trim();while(J.endsWith(")")||J.endsWith("}"))J=J.slice(0,-1).trim();return J}function Z0(Z){return Z.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function h0(Z,J,$){if(Z===void 0)return[$];let X=IZ(Z,$),z=X.match(/^(['"])(.*)\1$/);if(z)X=z[2];if(!X||X==="-"||/[$\x60*?[\]{}~\\'"]/.test(X))return null;return[...new Set(J.map((Q)=>DZ(Q,X)))]}var E2=/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/;function R2(Z){let J=Z.split(`
-`),$=[],X=[],z=0;while(z<J.length){let Q=z,Y=J[z++].replace(/\r$/,""),G=[];for(let K=0;K<Y.length;K++){let H=Y[K],B=X[X.length-1];if(H==="\\"){K++;continue}if(H==="$"&&Y[K+1]==="("&&Y[K+2]==="("){let U=Y.indexOf("))",K+3);if(U<0)return null;K=U+1;continue}if(H==="$"&&Y[K+1]==="("){X.push(0),K++;continue}if(H==="$"&&Y[K+1]==="[")return null;if(H==="$"&&Y[K+1]==="{"){let U=Y.indexOf("}",K+2);if(U<0||/['"\x60$]|<</.test(Y.slice(K+2,U)))return null;K=U;continue}if(H==="`"){let U=Y.indexOf("`",K+1);if(U<0)return null;K=U;continue}if(B==='"'){if(H==='"')X.pop();continue}if(H==="'"){let U=Y.indexOf("'",K+1);if(U<0)return null;K=U;continue}if(H==='"'){X.push('"');continue}if(H==="#"&&(K===0||/[\s;&|()]/.test(Y[K-1])))break;if(H==="("&&Y[K+1]==="("&&(K===0||/[\s;&|(]/.test(Y[K-1]))){let U=Y.indexOf("))",K+2);if(U<0)return null;K=U+1;continue}if(typeof B==="number"&&(H==="("||H===")")){if(H==="(")X[X.length-1]=B+1;else if(B===0)X.pop();else X[X.length-1]=B-1;continue}if(H==="<"&&Y[K+1]==="<"){if(Y[K+2]==="<"){K+=2;continue}let U=JZ(Y,K);if(!U)return null;G.push({marker:U,from:K}),K=U.end-1}}for(let{marker:K,from:H}of G){let B=z;for(;;){if(z>=J.length)return null;let U=J[z++].replace(/\r$/,"");if(K.stripTabs)U=U.replace(/^\t+/,"");if(U===K.delimiter)break}$.push({line:Q,from:H,to:K.end,start:B,end:z-1,quoted:K.quoted})}}return X.length===0?$:null}var v2=new Set(["sh","bash","zsh","dash","ksh","mksh","ash","fish","csh","tcsh","nu","xonsh","elvish","busybox","toybox","ssh","su","runuser","sudo","doas","pkexec","xargs","parallel","expect","script","at","batch","crontab","watch","flock","chroot","nsenter","unshare","docker","podman","kubectl","lxc","python","pypy","node","nodejs","bun","deno","tsx","ts-node","zx","npx","bunx","pnpx","perl","ruby","irb","php","lua","luajit","osascript","pwsh","powershell","Rscript","R","julia","tclsh","wish","awk","gawk","mawk","nawk","sed","make","gmake","gdb","lldb","sqlite3","psql","mysql","sftp","ftp","lftp","vim","vi","nvim","ex","ed","emacs","chmod"]),y2=new Set([".","source","eval","env","alias","hash"]),S2=new Set(["tee","cp","mv","install","ln"]),b2=new Set(["cat","tac","tee","head","tail","wc","cut","tr","nl","rev","fold","fmt","paste","uniq","grep","egrep","fgrep","jq","diff","cmp","comm","iconv","od","xxd","hexdump","base64","base32","md5sum","sha1sum","sha224sum","sha256sum","sha384sum","sha512sum","b2sum","cksum","echo","printf","true","false",":","test","[","read","cd","pwd","ls","mkdir","touch","stat","sleep","cp","mv","ln","rm","rmdir","unlink","shred","trash","todos","conversations","mementos","knowledge","files","asks"]),f2=new Set(["add","commit","tag","notes","status","diff","log","show","rev-parse","branch","switch","push","fetch","hash-object","apply"]),k2=new Set(["pr","issue","api","release","gist"]),w2=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function x2(Z,J){let $=Z[J];if($==="gh")return k2.has(Z[J+1]??"");if($!=="git")return b2.has($);for(let X=J+1;X<Z.length;X++){let z=Z[X];if(z==="-C")X++;else if(z==="--no-pager"||z==="-P")continue;else return!z.startsWith("-")&&f2.has(z)}return!1}var CZ=(Z)=>Z.split("/").pop()??"";function g2(Z,J){for(let $=J+1;$<Z.length;$++){let X=Z[$];if(X==="\\")$++;else if(X==='"')return $;else if(X==="$"&&Z[$+1]==="("){if($=i0(Z,$+1),$<0)return-1}else if(X==="`"){if($=Z.indexOf("`",$+1),$<0)return-1}}return-1}function i0(Z,J){let $=0;for(let X=J;X<Z.length;X++){let z=Z[X];if(z==="\\")X++;else if(z==="'"||z==="`"){if(X=Z.indexOf(z,X+1),X<0)return-1}else if(z==='"'){if(X=g2(Z,X),X<0)return-1}else if(z==="(")$++;else if(z===")"&&--$===0)return X}return-1}function h2(Z){let J=[],$=!1;for(let X=0;X<Z.length;X++){let z=Z[X];if(z==="\\")X++;else if(z==="'"&&!$){let Q=Z.indexOf("'",X+1);if(Q<0)return null;X=Q}else if(z==='"')$=!$;else if(z==="$"&&Z[X+1]==="("){let Q=i0(Z,X+1);if(Q<0)return null;let Y=Z.slice(X+2,Q);if(Z[X+2]==="("){if(/\$\(|\x60/.test(Y))return null}else J.push(Y);X=Q}else if(z==="`"){let Q=Z.indexOf("`",X+1);if(Q<0)return null;J.push(Z.slice(X+1,Q)),X=Q}}return $?null:J}function u2(Z){if(/[<>]\(/.test(Z))return!0;let J=[],$=[Z];for(let z=0;$.length>0;z++){if(z>64)return!0;let Q=$.shift(),Y=a(Q),G=h2(Q);if(!Y.trustworthy||!G)return!0;J.push(...Y.segments),$.push(...new Set([...Y.substitutions,...G]))}let X=new Set;for(let z of J){let Q=z.words.map((K)=>A(K.text));for(let K of z.redirects)X.add(CZ(Q[K]??""));let Y=x(z);if(Y<0)continue;let G=CZ(Q[Y]);if(S2.has(G)){for(let K of Q.slice(Y+1))if(!K.startsWith("-"))X.add(CZ(K))}if(G==="dd"){for(let K of Q)if(K.startsWith("of="))X.add(CZ(K.slice(3)))}}X.delete("");for(let z of J){for(let H of z.words){let B=CZ(A(H.text));if(v2.has(B)||/^(?:python|pypy|node|perl|ruby|php|lua)[0-9.]+$/.test(B))return!0}let Q=x(z),Y=z.words.map((H,B)=>({text:A(H.text),at:B})).filter(({at:H})=>!z.redirects.has(H));if(Y.some(({text:H,at:B})=>(Q<0||B<Q)&&w2.test(H)))return!0;if(Q<0)continue;let G=z.words[Q].text,K=A(G);if(/[$\x60]/.test(G)||K.includes("/")||y2.has(K)||X.has(K))return!0;if(!x2(Y.filter(({at:H})=>H>=Q).map(({text:H})=>H),0))return!0}return!1}function l2(Z){if(!Z.includes("<<"))return null;let J=R2(Z);if(!J||J.length===0)return null;let $=Z.split(`
+`||Z[Q]==="\r";if(z&&Y)return X;$=X+1}return-1}function D(Z){let J="",$=0;while($<Z.length){let X=Z[$];if(X==="\\"){if($+1<Z.length)J+=Z[$+1];$+=2;continue}if(X==="'"){let z=Z.indexOf("'",$+1);if(z===-1){J+=Z.slice($+1);break}J+=Z.slice($+1,z),$=z+1;continue}if(X==='"'){$++;while($<Z.length&&Z[$]!=='"'){if(Z[$]==="\\"&&$+1<Z.length){J+=Z[$+1],$+=2;continue}J+=Z[$],$++}$++;continue}J+=X,$++}return J}function w(Z){let J=0,$=0;while(J<Z.words.length&&$++<32){if(Z.redirects.has(J)){J++;continue}let X=Z.words[J].text,z=D(X);if(L0.test(z)&&!z.startsWith("-")){J++;continue}if(y1.has(z)){J++;continue}let Q=FZ(z);if(Q==="command")for(let G of Z.words.filter((K,H)=>H>J&&!Z.redirects.has(H))){let K=D(G.text);if(K==="--"||!K.startsWith("-"))break;if(/^-[pvV]*[vV][pvV]*$/.test(K))return-1}let Y=E1[Q];if(Y){let G=J;J++;while(J<Z.words.length){if(Z.redirects.has(J)){J++;continue}let H=D(Z.words[J].text);if(!H.startsWith("-")||H==="-")break;if(H==="--"){J++;break}if(Q==="env"&&(/^-[iv0]*S/.test(H)||/^--split-string(?:=|$)/.test(H)))return G;if(J++,Y.includes(H)||Q==="exec"&&/^-[cl]*a$/.test(H)){while(Z.redirects.has(J))J++;J++}}let K=R1[Q]??0;while(K>0&&J<Z.words.length){let H=D(Z.words[J].text);if(H.startsWith("-")&&H!=="-")break;J++,K--}continue}return J}return-1}function k1(Z,J){let $=[],X=!1;for(let z=J+1;z<Z.words.length;z++){if(Z.redirects.has(z))continue;let Q=D(Z.words[z].text);if(!X){if(Q==="--"){X=!0;continue}if(Q.startsWith("-")&&Q!=="-")continue}$.push(Z.words[z])}return $}function w1(Z){return A1.map((J)=>e(Z,...J.split("/")))}function x1(Z,J){if(Z==="~"||Z==="$HOME"||Z==="${HOME}")return J;if(Z.startsWith("~/"))return e(J,Z.slice(2));if(Z.startsWith("$HOME/"))return e(J,Z.slice(6));if(Z.startsWith("${HOME}/"))return e(J,Z.slice(8));return Z}function lZ(Z,J,$){let X=D(Z);if(!X)return null;if(X.includes("`"))return null;if(X==="$HOME"||X==="${HOME}"||X==="$HOME/"||X==="${HOME}/")return $;if(X.replace(/\$\{HOME\}/g,"").replace(/\$HOME/g,"").includes("$"))return null;if(/[*?[\]]/.test(X))return null;if(X.startsWith("~")){let G=x1(X,$);if(G===X)return null;X=G}let Y=(T1(X)?C1(X):I1(J,X)).replace(/\/+$/,"");return Y===""?"/":Y}function VZ(Z,J){return Z===J||Z.startsWith(`${J}${uZ}`)}function g1(Z,J){let $=`${e(J,".hasna","scratchpad","scratch")}${uZ}`;if(!Z.startsWith($))return!1;let[X,z]=Z.slice($.length).split(uZ);if(!X||!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(X)||X.endsWith(".")||!z)return!1;let Q=z.normalize("NFKC").toLowerCase();return Q!=="meta.json"&&Q!==".lock"}function h1(Z,J){if(Z===J)return`\`${Z}\` is the home directory itself, which is never deleted or trashed. Delete a specific file or directory inside it instead.`;for(let $ of W0){if(Z!==$&&!VZ($,Z))continue;return $==="/"?`\`${Z}\` is the filesystem root, which is never deleted.`:`\`${Z}\` is the system root \`${$}\` (or an ancestor of it), which is never deleted or trashed.`}for(let $ of P1){let X=e(J,$);if($===".hasna"&&g1(Z,J))continue;if(!VZ(Z,X)&&!VZ(X,Z))continue;return`\`${Z}\` is the protected \`~/${$}\` path (or contains it), which is never deleted or trashed. Delete a specific file inside it, and only when you are sure.`}return null}function u1(Z,J,$){let X=w1($);if(X.some((z)=>VZ(J,z)))return!0;for(let z of Z){let Q=lZ(z.text,J,$);if(Q&&X.some((Y)=>VZ(Q,Y)))return!0}return!1}function _Z(Z,J){let $={cwd:J.cwd,home:J.home,depth:J.depth??0},X={rmHits:[],handoffHits:[],refusals:[],protectedHits:[],trustworthy:!0},z=i(Z);if(X.trustworthy=z.trustworthy,!z.trustworthy)return X;let Q=$.cwd;for(let Y of z.segments){let G=w(Y);if(G<0)continue;let K=FZ(D(Y.words[G].text));if(K==="cd"){let U=Y.words[G+1];if(U){let V=lZ(U.text,Q,$.home);if(V)Q=V;else Q=$.cwd}continue}let H=T0[K];if(H){X.refusals.push({reason:H});continue}if(K==="rm"){let U=k1(Y,G);if(U.length===0)continue;let V={word:Y.words[G],operands:U};if(u1(V.operands,Q,$.home)){X.handoffHits.push(V);continue}X.rmHits.push(V);for(let W of V.operands){let _=lZ(W.text,Q,$.home);if(!_)continue;let L=h1(_,$.home);if(L){X.protectedHits.push({reason:L});break}}continue}if(v1.has(K)){let U=Y.words.findIndex((W,_)=>_>G&&!D(W.text).startsWith("-")),V=U>=0?FZ(D(Y.words[U].text)):"";if(V==="rm"||V in T0)X.refusals.push({reason:`\`${K} ${V}\` runs the ${K} applet, whose own \`rm\` is not GNU \`rm\` and cannot be rewritten in place. Run the delete as \`rm -- <path>\`, which is redirected into trash.`});continue}if(K==="git"){let U=cZ(Y,G);if(U==="rm"||U==="clean"){if(!(U==="rm"?m1(Y,G):O0(Y,G)))X.refusals.push({reason:U==="rm"?"`git rm` is refused: without `--cached` it deletes the working-tree file, and its semantics are not `rm`'s. Use `rm -- <path>` (intercepted and redirected into trash) to remove the file, or `git rm --cached -- <path>` to unstage it without deleting.":"`git clean` deletes untracked files irrecoverably and is refused. Remove them explicitly with `rm -- <path>` (intercepted and redirected into trash), or preview with `git clean -n`."})}continue}if(K==="find"){let U=Y.words.map((_)=>D(_.text));if(U.indexOf("-delete")>=0){X.refusals.push({reason:"`find -delete` deletes files irrecoverably and is refused. List the paths first (`find \u2026 -print`), then remove them explicitly with `rm -- <path>` so the delete is redirected into trash."});continue}let W=U.findIndex((_)=>_==="-exec"||_==="-execdir"||_==="-ok");if(W>=0&&U.slice(W).some((_)=>_==="rm"||_==="rmdir"||_==="unlink"||_==="shred")){X.refusals.push({reason:"`find -exec <delete>` is refused: the delete runs through find, not through `rm`, and cannot be redirected into trash. Remove the paths explicitly with `rm -- <path>`."});continue}continue}if(K==="xargs"&&Y.words.some((U)=>D(U.text)==="rm")){X.refusals.push({reason:"`xargs rm` takes its targets from stdin, so this hook cannot verify what would be deleted. Pipe the paths into an explicit `rm -- <path> \u2026` instead, which is redirected into trash."});continue}let B=K==="env"?qZ(Y.words.map((U)=>D(U.text))):l1(Y);if(O1.has(K)&&MZ(B)){X.refusals.push({reason:`\`${K}\` runs a command string this hook cannot rewrite in place. Run the delete directly as \`rm -- <path>\` (intercepted and redirected into trash), or as a script that uses \`trash guard\` itself.`});continue}}if($.depth<3)for(let Y of z.substitutions){let G=_Z(Y,{cwd:Q,home:$.home,depth:$.depth+1});if(G.rmHits.length>0||G.refusals.length>0||G.handoffHits.length>0||G.protectedHits.length>0){X.refusals.push({reason:"This command runs a delete inside a command substitution `$(\u2026)`, which this hook cannot rewrite. Run the delete as a separate `rm -- <path>` command, which is redirected into trash."});break}}else if(z.substitutions.some((Y)=>MZ(Y)))X.refusals.push({reason:"This command nests a delete inside command substitutions deeper than this hook will follow. Run the delete as a separate `rm -- <path>` command."});return X}function l1(Z){return Z.words.map((J)=>J.text).join(" ")}function cZ(Z,J){let $=J+1;while($<Z.words.length){let X=D(Z.words[$].text);if(!X.startsWith("-"))return X;if($++,S1.has(X))$++}return null}function m1(Z,J){if(Z.words.slice(J+1).map((X)=>D(X.text)).includes("--cached"))return!0;return O0(Z,J)}function O0(Z,J){let $=Z.words.slice(J+1).map((X)=>D(X.text));return $.includes("-n")||$.includes("--dry-run")}function C0(Z){if(/^[A-Za-z0-9_\-./+=:,@%^]+$/.test(Z))return Z;return`'${Z.replace(/'/g,"'\\''")}'`}function c1(Z,J,$,X){let z=X?["/usr/bin/env","-i",`HOME=${X.home}`,`PATH=${X.path}`,`HASNA_TRASH_AGENT=${X.agent}`,X.runtime,"--config=/dev/null","--no-env-file","--no-macros","--no-install",$,"guard"].map(C0).join(" "):`${C0($)} guard`,Q=[...J].sort((G,K)=>K.word.start-G.word.start),Y=Z;for(let G of Q)Y=`${Y.slice(0,G.word.start)}${z}${Y.slice(G.word.end)}`;return Y}function p1(Z,J,$,X,z){if(!J||J===Z)return!1;if($.length===0)return!1;let Q=_Z(J,{cwd:X,home:z});if(!Q.trustworthy)return!1;if(Q.rmHits.length>0||Q.handoffHits.length>0)return!1;return Q.refusals.length===0}function d1(Z,J){let $={};for(let[X,z]of Object.entries(Z??{}))$[X]=z;if($.command=J,typeof $.description!=="string"||$.description.trim()==="")$.description=L1;if(typeof $.timeout!=="number"||!Number.isFinite($.timeout)||$.timeout<=0)$.timeout=D1;if(typeof $.run_in_background!=="boolean")$.run_in_background=!1;if("dangerouslyDisableSandbox"in $&&typeof $.dangerouslyDisableSandbox!=="boolean")delete $.dangerouslyDisableSandbox;return $}function i1(Z,J,$,X,z){if(typeof Z.command!=="string"||Z.command.trim()==="")return!1;if(typeof Z.description!=="string"||Z.description.trim()==="")return!1;if(typeof Z.timeout!=="number"||!Number.isFinite(Z.timeout)||Z.timeout<=0)return!1;if(typeof Z.run_in_background!=="boolean")return!1;if("dangerouslyDisableSandbox"in Z&&typeof Z.dangerouslyDisableSandbox!=="boolean")return!1;return p1(J,Z.command,$,X,z)}function s1(Z){let J=new Set(["export","set","unset","readonly","declare","typeset","local","alias","unalias","read","readarray","mapfile","getopts","trap","enable","function","env","sudo","doas","stdbuf"]);return i(Z).segments.some((X)=>{let z=w(X);if(X.words.slice(0,z<0?X.words.length:z).some((G)=>L0.test(D(G.text))||J.has(FZ(D(G.text)))))return!0;if(z<0)return!1;let Y=X.words[z];return J.has(FZ(D(Y.text)))||/^\s*\(\s*\)\s*\{/.test(Z.slice(Y.end))})}function f(Z){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Z}}}function a1(Z){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow",updatedInput:Z}}}function n1(Z){try{if(Z.inspectTrash){let J=Z.inspectTrash();return J.ok?{path:J.path,error:null}:{path:null,error:`${J.code}: ${j0[J.code]}`}}return{path:Z.findTrash(),error:null}}catch(J){return{path:null,error:J instanceof Error?J.message:String(J)}}}var r1="[trash-guard] No verified @hasna/trash guard was found on PATH. This deletion is refused. Install the current @hasna/trash package with Bun and run its setup; the operating-system trash utility is not a compatible guard.";function E0(Z,J){if(Z.hook_event_name!=="PreToolUse")return{continue:!0};if(["apply_patch","ApplyPatch","functions.apply_patch"].includes(Z.tool_name??"")){let H=Z.tool_input?.command;if(typeof H!=="string")return f("[trash-guard] Unreadable patch input; deletion safety cannot be checked.");if(/^\s*\*\*\* Delete File:/m.test(H))return f("[trash-guard] Delete File would bypass recoverable deletion. First use `trash put -- <path>` or the trash_put MCP tool, then submit any remaining edits without the deletion block.");return{continue:!0}}if(Z.tool_name!=="Bash")return{continue:!0};if(typeof Z.tool_input?.command!=="string")return f("[trash-guard] The Bash tool call carried no readable `command`, so this hook cannot verify what would run. Refusing a call it cannot verify. Re-run the delete explicitly as `rm -- <path>` so it can be redirected into trash.");let X=t(Z);if(!X.trim())return{continue:!0};let z=_Z(X,{cwd:J.cwd,home:J.home});if(z.refusals.length>0)return f(`[trash-guard] ${z.refusals[0].reason}`);if(z.protectedHits.length>0)return f(`[trash-guard] ${z.protectedHits[0].reason}`);if(!z.trustworthy)return MZ(X)?f("[trash-guard] This command could not be parsed to the end (unterminated quote, substitution or here-document), so a delete inside it cannot be redirected. Re-run the delete as a plain `rm -- <path>` command."):{continue:!0};if(z.rmHits.length===0){if(z.handoffHits.length>0)return{continue:!0};return{continue:!0}}if(z.handoffHits.length>0)return f("[trash-guard] This command mixes a delete under the protected repo-checkout roots (owned by workspace-repos-guard) with a delete outside them, and a partial rewrite would leave one of them unredirected. Re-run them as separate commands, so each delete is handled by the hook that owns it.");let Q=n1(J);if(Q.error!==null)return f(`[trash-guard] The guard could not resolve the \`trash\` binary (${Q.error}), so this \`rm\` cannot be redirected into a recoverable delete \u2014 and an unrecoverable delete is never allowed, so the command is refused rather than run. Fix the environment (PATH, permissions) and re-run the same command.`);if(Q.path===null)return f(r1);let Y=Q.path;if(J.execution&&s1(X))return f("[trash-guard] A deletion combined with shell environment changes cannot use the verified native execution context. Run the deletion as a separate plain rm command.");let G=c1(X,z.rmHits,Y,J.execution),K=d1(Z.tool_input,G);if(J.execution)K.hasna_execution="hasna.hooks.execution.v1";if(!i1(K,X,z.rmHits,J.cwd,J.home))return f("[trash-guard] The rewrite of this command did not verify (the delete could not be redirected cleanly), so the command is refused rather than run unredirected. Re-run the delete as a plain `rm -- <path>` command.");return a1(K)}import{closeSync as o1,constants as R0,fstatSync as t1,lstatSync as e1,openSync as Z2,readFileSync as $2,statSync as J2}from"fs";import{homedir as b0}from"os";import{dirname as pZ,isAbsolute as f0,join as $Z,normalize as JZ,relative as X2,resolve as CZ,sep as aZ}from"path";var z2=new Set(["Write","Edit","MultiEdit","NotebookEdit"]),K2=new Set(["apply_patch","ApplyPatch","functions.apply_patch"]),Q2=["hasna","hasnaxyz","hasna-products"],jZ="workspace-repos-guard";function Y2(Z){return $Z(Z,".hasna","repos","clones")}function G2(Z){return $Z(Z,"workspace","repos")}function k0(Z){return[Y2(Z),G2(Z)]}function H2(Z){return $Z(Z,".hasna","hooks","config","workspace-repos-guard-orgs")}var B2=/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;function dZ(Z){let J=process.getuid?.();return J!==void 0&&(Z.uid===0||Z.uid===J)&&(Z.mode&18)===0}function U2(Z){let J=H2(Z),$;try{let z=Z2(J,R0.O_RDONLY|R0.O_NOFOLLOW);try{let Y=t1(z);if(!Y.isFile()||!dZ(Y)||Y.size>4096)return null;$=$2(z,"utf8")}finally{o1(z)}let Q=JZ(Z);for(let Y=pZ(J);Y!==Q;Y=pZ(Y)){let G=e1(Y);if(!G.isDirectory()||!dZ(G)||Y===pZ(Y))return null}if(!dZ(J2(Q)))return null}catch{return null}let X=$.replace(/#[^\n]*/g,"").split(/[\s,]+/).filter(Boolean);return X.length>0&&X.every((z)=>B2.test(z))?new Set(X):null}function V2(Z=process.env,J=b0()){let $=Z.WORKSPACE_REPOS_GUARD_ORGS;if(typeof $==="string"&&$.trim())return new Set($.split(",").map((X)=>X.trim()).filter(Boolean));return U2(J)??new Set(Q2)}function iZ(Z,J,$,X){if(X==="read")return{blocked:!1};let z=X2(J,Z);if(z===""){if(X==="delete")return{blocked:!0,reason:`[${jZ}] delete of the protected repo-checkout root is forbidden: ${J}`};return{blocked:!0,reason:`[${jZ}] writes directly to the protected repo-checkout root are forbidden: ${J}`}}if(z.startsWith(`..${aZ}`)||z===".."||f0(z))return{blocked:!1};let Q=z.split(aZ).filter(Boolean);if(X==="delete")return{blocked:!0,reason:`[${jZ}] delete under the protected repo-checkout root (${J}) is forbidden at any depth: ${Z}`};if(Q.length<=1)return{blocked:!0,reason:`[${jZ}] writing would create a top-level entry directly under the protected repo-checkout root (${J}); only GitHub-org folders belong there: ${Z}`};let Y=Q[0];if(!$.has(Y))return{blocked:!0,reason:`[${jZ}] '${Y}' is not an allowed GitHub org under the protected repo-checkout root (${J}); allowed: ${[...$].join(", ")}: ${Z}`};return{blocked:!1}}var w0=/\b(?:-o|--output|-O|--output-document|-out)\b/,M2=/\d*[<>]&\s*(?:\d+|-)(?=$|[\s;&|)])/g,F2=/(?:\d+|&)?(?:>>|>\||>&|<>|>)\s*([^\s;&|<>()\x60]*)/g;function x0(Z){return Z.replace(M2," ")}function q2(Z){let J=[],$=null,X=0,z=0,Q=!1,Y=0;for(let G=0;G<Z.length;G++){let K=Z[G];if($==="'"){if(K==="'")$=null;continue}if(K==="\\"){G++;continue}if(K==="("){X++;continue}if(K===")"){if(--X<0)return[Z];continue}if(K==="$"&&Z[G+1]==="{"){z++,G++;continue}if(K==="}"&&z>0){z--;continue}if(K==="`"){Q=!Q;continue}if($==='"'){if(K==='"')$=null;continue}if(K==="'"||K==='"'){$=K;continue}if(K!=="|"||X>0||z>0||Q||Z[G-1]===">")continue;if(J.push(Z.slice(Y,G)),Z[G+1]==="&")G++;Y=G+1}if($||X!==0||z!==0||Q)return[Z];return J.push(Z.slice(Y)),J}function N2(Z){let J=[],$="",X="",z=null,Q=!1,Y=()=>{if(!Q)return;let G=X.replace(/^"?\$\{?HOME\}?"?(?=\/|$)/,""),K=$.startsWith("~")&&!/^~(?:\/|$)/.test(X);J.push({text:K?`./${$}`:$,opaque:/[$\x60*?[]/.test(G)||/[()]/.test(G)}),$="",X="",Q=!1};for(let G=0;G<Z.length;G++){let K=Z[G];if(z==="'"){if(K==="'")z=null;else $+=K;X+=K;continue}if(K==="\\"&&G+1<Z.length){let H=Z[G+1];$+=z==='"'&&!/[$\x60"\\\n]/.test(H)?K+H:H,X+=K+H,Q=!0,G++;continue}if(z==='"'){if(K==='"')z=null;else $+=K;X+=K;continue}if(/\s/.test(K)){Y();continue}if(Q=!0,X+=K,K==="'"||K==='"')z=K;else $+=K}if(z)X+="$";return Y(),J}function sZ(Z,J,$){let X=Z[J];return X==="--help"||X==="--version"||$&&(X==="-h"||X==="-V")}function _2(Z){let J=Z.trim();if(!J)return"read";let $=i(J);if(!$.trustworthy||$.substitutions.length||/\$\{[^}]*[|;()]|[<>]\(/.test(J))return v0(J);let X=$.segments.map((z)=>{let Q=w(z);if(Q<0)return"read";let Y=z.words.filter((K,H)=>H>=Q&&!z.redirects.has(H)).map((K)=>D(K.text)),G=Y[0].split("/").pop();if(["rm","rmdir","shred"].includes(G??""))return sZ(Y,1,!1)?"read":"delete";if(["unlink","rmtree","del"].includes(G??""))return"delete";if(G==="trash"){let K=1;while(K<Y.length&&Y[K].startsWith("-")){let H=Y[K++];if(["--help","-h","--version","-V","--identity"].includes(H))return"read";if(["--agent","--spool","--files","--info","--config"].includes(H))K++;else if(!["--json","--local"].includes(H))return"delete"}if(K===Y.length||["status","doctor","list","info","get","pending","station","setup","backup","storage","retrieval","backup-storage","backup-inspect","backup-refresh","help"].includes(Y[K]))return"read";if(["restore","restore-capsule"].includes(Y[K]))return"write";if(["put","rm","delete","remove"].includes(Y[K])&&sZ(Y,K+1,!0))return"read";return"delete"}if(G==="git"){let K=cZ(z,Q);if(K==="clean"||K==="rm")return Y[1]===K&&sZ(Y,2,!0)?"read":"delete";return K==="clone"||K==="init"?"write":"read"}if(G==="env"&&MZ(qZ(Y)))return"delete";if(["sh","bash","zsh","dash","ksh","ash","eval","source",".","su","runuser","env","xargs","find","busybox","toybox"].includes(G??""))return v0(Y.join(" "));if(["mkdir","mkfile","touch","mv","cp","ln","tee","install","dd","rsync","scp","truncate"].includes(G??""))return"write";if(G==="curl"||G==="wget")return w0.test(Y.join(" "))?"write":"read";if(G==="sed"&&Y.slice(1).some((K)=>/^-i|^--in-place(?:=|$)/.test(K)))return"write";if(["python","python3","node","bun"].includes(G??"")&&Y.some((K)=>K==="-c"||K==="-e"))return"write";return"read"});return X.includes("delete")?"delete":X.includes("write")?"write":"read"}function v0(Z){let J=Z.trim();if(!J)return"read";if(/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:rm|rmdir|unlink|shred|trash|rmtree|del)(?:\s|$)/.test(J))return"delete";if(/\bgit\b/.test(J)){if(/\bgit\b[^;&|]*\b(?:clean|rm)\b/.test(J))return"delete";if(/\bgit\b[^;&|]*\b(?:clone|init)\b/.test(J))return"write";return"read"}if(/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|mv|cp|ln|tee|install|dd)(?:\s|$)/.test(J))return"write";if(/\b(?:curl|wget)\b/.test(J)){if(w0.test(J))return"write";return"read"}if(/\bsed\b/.test(J)){if(/(?:^|\s)-i\S*(?:\s|$)|--in-place(?:\s|$)/.test(J))return"write"}else if(/\b(?:rsync|scp|truncate)\b/.test(J))return"write";else if(/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(J))return"write";if(/(?:^|[;&|])\s*echo\b/.test(J)||/>/.test(x0(J)))return"write";return"read"}function TZ(Z,J){let $=Z.trim(),X=$.match(/^(['"])([\s\S]*)\1$/);if(X)$=X[2];if($=$.replace(/^"*\$HOME"*\//,"$HOME/"),$=$.replace(/^"*\$\{HOME\}"*\//,"${HOME}/"),$==="~")return J;if($.startsWith("~/"))return $Z(J,$.slice(2));if($==="$HOME"||$==="${HOME}")return J;if($.startsWith("$HOME/"))return $Z(J,$.slice(6));if($.startsWith("${HOME}/"))return $Z(J,$.slice(8));let z=$.match(new RegExp(`^"*${nZ(J)}"*/`));if(z)return J+"/"+$.slice(z[0].length);return Z}function j2(Z){let J=Z.trim();while(J.startsWith("(")||J.startsWith("{"))J=J.slice(1).trim();while(J.endsWith(")")||J.endsWith("}"))J=J.slice(0,-1).trim();return J}function nZ(Z){return Z.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function y0(Z,J,$){if(Z===void 0)return[$];let X=TZ(Z,$),z=X.match(/^(['"])(.*)\1$/);if(z)X=z[2];if(!X||X==="-"||/[$\x60*?[\]{}~\\'"]/.test(X))return null;return[...new Set(J.map((Q)=>CZ(Q,X)))]}var W2=/(?:^|\s)(\.\.?|[^\s"';&|<>()\x60/]+(?:\/[^\s"';&|<>()\x60]*)?)\s*$/;function T2(Z){let J=Z.split(`
+`),$=[],X=[],z=0;while(z<J.length){let Q=z,Y=J[z++].replace(/\r$/,""),G=[];for(let K=0;K<Y.length;K++){let H=Y[K],B=X[X.length-1];if(H==="\\"){K++;continue}if(H==="$"&&Y[K+1]==="("&&Y[K+2]==="("){let U=Y.indexOf("))",K+3);if(U<0)return null;K=U+1;continue}if(H==="$"&&Y[K+1]==="("){X.push(0),K++;continue}if(H==="$"&&Y[K+1]==="[")return null;if(H==="$"&&Y[K+1]==="{"){let U=Y.indexOf("}",K+2);if(U<0||/['"\x60$]|<</.test(Y.slice(K+2,U)))return null;K=U;continue}if(H==="`"){let U=Y.indexOf("`",K+1);if(U<0)return null;K=U;continue}if(B==='"'){if(H==='"')X.pop();continue}if(H==="'"){let U=Y.indexOf("'",K+1);if(U<0)return null;K=U;continue}if(H==='"'){X.push('"');continue}if(H==="#"&&(K===0||/[\s;&|()]/.test(Y[K-1])))break;if(H==="("&&Y[K+1]==="("&&(K===0||/[\s;&|(]/.test(Y[K-1]))){let U=Y.indexOf("))",K+2);if(U<0)return null;K=U+1;continue}if(typeof B==="number"&&(H==="("||H===")")){if(H==="(")X[X.length-1]=B+1;else if(B===0)X.pop();else X[X.length-1]=B-1;continue}if(H==="<"&&Y[K+1]==="<"){if(Y[K+2]==="<"){K+=2;continue}let U=ZZ(Y,K);if(!U)return null;G.push({marker:U,from:K}),K=U.end-1}}for(let{marker:K,from:H}of G){let B=z;for(;;){if(z>=J.length)return null;let U=J[z++].replace(/\r$/,"");if(K.stripTabs)U=U.replace(/^\t+/,"");if(U===K.delimiter)break}$.push({line:Q,from:H,to:K.end,start:B,end:z-1,quoted:K.quoted})}}return X.length===0?$:null}var C2=new Set(["sh","bash","zsh","dash","ksh","mksh","ash","fish","csh","tcsh","nu","xonsh","elvish","busybox","toybox","ssh","su","runuser","sudo","doas","pkexec","xargs","parallel","expect","script","at","batch","crontab","watch","flock","chroot","nsenter","unshare","docker","podman","kubectl","lxc","python","pypy","node","nodejs","bun","deno","tsx","ts-node","zx","npx","bunx","pnpx","perl","ruby","irb","php","lua","luajit","osascript","pwsh","powershell","Rscript","R","julia","tclsh","wish","awk","gawk","mawk","nawk","sed","make","gmake","gdb","lldb","sqlite3","psql","mysql","sftp","ftp","lftp","vim","vi","nvim","ex","ed","emacs","chmod"]),I2=new Set([".","source","eval","env","alias","hash"]),D2=new Set(["tee","cp","mv","install","ln"]),L2=new Set(["cat","tac","tee","head","tail","wc","cut","tr","nl","rev","fold","fmt","paste","uniq","grep","egrep","fgrep","jq","diff","cmp","comm","iconv","od","xxd","hexdump","base64","base32","md5sum","sha1sum","sha224sum","sha256sum","sha384sum","sha512sum","b2sum","cksum","echo","printf","true","false",":","test","[","read","cd","pwd","ls","mkdir","touch","stat","sleep","cp","mv","ln","rm","rmdir","unlink","shred","trash","todos","conversations","mementos","knowledge","files","asks"]),A2=new Set(["add","commit","tag","notes","status","diff","log","show","rev-parse","branch","switch","push","fetch","hash-object","apply"]),P2=new Set(["pr","issue","api","release","gist"]),O2=/^[A-Za-z_][A-Za-z0-9_]*\+?=/;function E2(Z,J){let $=Z[J];if($==="gh")return P2.has(Z[J+1]??"");if($!=="git")return L2.has($);for(let X=J+1;X<Z.length;X++){let z=Z[X];if(z==="-C")X++;else if(z==="--no-pager"||z==="-P")continue;else return!z.startsWith("-")&&A2.has(z)}return!1}var WZ=(Z)=>Z.split("/").pop()??"";function R2(Z,J){for(let $=J+1;$<Z.length;$++){let X=Z[$];if(X==="\\")$++;else if(X==='"')return $;else if(X==="$"&&Z[$+1]==="("){if($=g0(Z,$+1),$<0)return-1}else if(X==="`"){if($=Z.indexOf("`",$+1),$<0)return-1}}return-1}function g0(Z,J){let $=0;for(let X=J;X<Z.length;X++){let z=Z[X];if(z==="\\")X++;else if(z==="'"||z==="`"){if(X=Z.indexOf(z,X+1),X<0)return-1}else if(z==='"'){if(X=R2(Z,X),X<0)return-1}else if(z==="(")$++;else if(z===")"&&--$===0)return X}return-1}function v2(Z){let J=[],$=!1;for(let X=0;X<Z.length;X++){let z=Z[X];if(z==="\\")X++;else if(z==="'"&&!$){let Q=Z.indexOf("'",X+1);if(Q<0)return null;X=Q}else if(z==='"')$=!$;else if(z==="$"&&Z[X+1]==="("){let Q=g0(Z,X+1);if(Q<0)return null;let Y=Z.slice(X+2,Q);if(Z[X+2]==="("){if(/\$\(|\x60/.test(Y))return null}else J.push(Y);X=Q}else if(z==="`"){let Q=Z.indexOf("`",X+1);if(Q<0)return null;J.push(Z.slice(X+1,Q)),X=Q}}return $?null:J}function y2(Z){if(/[<>]\(/.test(Z))return!0;let J=[],$=[Z];for(let z=0;$.length>0;z++){if(z>64)return!0;let Q=$.shift(),Y=i(Q),G=v2(Q);if(!Y.trustworthy||!G)return!0;J.push(...Y.segments),$.push(...new Set([...Y.substitutions,...G]))}let X=new Set;for(let z of J){let Q=z.words.map((K)=>D(K.text));for(let K of z.redirects)X.add(WZ(Q[K]??""));let Y=w(z);if(Y<0)continue;let G=WZ(Q[Y]);if(D2.has(G)){for(let K of Q.slice(Y+1))if(!K.startsWith("-"))X.add(WZ(K))}if(G==="dd"){for(let K of Q)if(K.startsWith("of="))X.add(WZ(K.slice(3)))}}X.delete("");for(let z of J){for(let H of z.words){let B=WZ(D(H.text));if(C2.has(B)||/^(?:python|pypy|node|perl|ruby|php|lua)[0-9.]+$/.test(B))return!0}let Q=w(z),Y=z.words.map((H,B)=>({text:D(H.text),at:B})).filter(({at:H})=>!z.redirects.has(H));if(Y.some(({text:H,at:B})=>(Q<0||B<Q)&&O2.test(H)))return!0;if(Q<0)continue;let G=z.words[Q].text,K=D(G);if(/[$\x60]/.test(G)||K.includes("/")||I2.has(K)||X.has(K))return!0;if(!E2(Y.filter(({at:H})=>H>=Q).map(({text:H})=>H),0))return!0}return!1}function S2(Z){if(!Z.includes("<<"))return null;let J=T2(Z);if(!J||J.length===0)return null;let $=Z.split(`
 `),X=[...$],z=[];for(let Y of J){let G=$.slice(Y.start,Y.end);if(!Y.quoted&&G.some((K)=>/\$\(|\x60/.test(K)))return null;z.push(G.join(`
-`));for(let K=Y.start;K<=Y.end;K++)X[K]=""}let Q=[...X];for(let Y of[...J].reverse()){let G=Q[Y.line];Q[Y.line]=G.slice(0,Y.from)+" ".repeat(Y.to-Y.from)+G.slice(Y.to)}return u2(Q.join(`
+`));for(let K=Y.start;K<=Y.end;K++)X[K]=""}let Q=[...X];for(let Y of[...J].reverse()){let G=Q[Y.line];Q[Y.line]=G.slice(0,Y.from)+" ".repeat(Y.to-Y.from)+G.slice(Y.to)}return y2(Q.join(`
 `))?null:{outer:X.join(`
-`),bodies:z}}var m2="/";function s0(Z,J,$){if(!Z)return[];let X=l2(Z);if(!X)return u0(Z,J,$);return[...u0(X.outer,J,$),...X.bodies.flatMap((z)=>s0(z,J,m2))]}function u0(Z,J,$){if(!Z)return[];let X=c0(J),z=(U)=>X.some((V)=>U===V||U.startsWith(`${V}${eZ}`)),Q=Z.split(/(\s*&&\s*|\s*\|\|\s*|;\s*|\n+)/),Y=[],G=[$],K=new Set([$]),H=!0,B=[];for(let U=0;U<Q.length;U+=2){let V=U===0?"":Q[U-1].trim();if(V==="||")H=!1;else if(V!=="&&")H=!0;if(V!=="&&"||!H)G=[...K];let I=Q[U],_=(I.match(/^[\s({]*/)?.[0].match(/\(/g)??[]).length,P=(I.match(/[\s)}]*$/)?.[0].match(/\)/g)??[]).length;for(let N=0;N<_;N++)B.push({current:[...G],reachable:new Set(K),certain:H});let M=O2(I),j=M.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/),h=j?null:M.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);if(h){for(let N of h0(h[1],G,J)??[])K.add(N);H=!1,G=[...K]}let u=Z0(J),d=X.map((N)=>Z0(N.slice(J.length+1))).join("|"),D=new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${u}"*)/(?:${d})`),O=new RegExp(`(${D.source})([^\\s"';&|<>()\`]*|$)`,"g"),y=(N)=>{let w=[],R;O.lastIndex=0;while((R=O.exec(N))!==null)w.push(zZ(IZ(R[0],J)).replace(/\/+$/,""));return w},S=A2(M).map((N)=>{let w=[],R=!1,o=d0(N).replace(D2,(GZ,i)=>{if(!i||/[$\x60]/.test(i))R=!0;if(i)w.push(i);return" "}),YZ=P2(o);return{commandPart:o,operands:w,op:R&&YZ==="read"?"write":YZ}}),N1=S.some((N)=>N.op==="delete")?"delete":S.some((N)=>N.op==="write")?"write":"read",A0=G.filter(z);for(let N of S){let w=!1;for(let L of y(N.commandPart))w=!0,Y.push({path:L,op:N1});for(let L of N.operands){let f=y(L);for(let v of f)Y.push({path:v,op:"write"});if(f.length>0)continue;for(let v of A0)Y.push({path:zZ(DZ(v,IZ(L,J))),op:"write"})}if(w||N.op==="read")continue;let R=L2(N.commandPart),o=1,YZ=(R[0]?.text??"").split("/").pop();if(YZ==="trash"&&["put","rm","delete","remove"].includes(R[1]?.text??""))o=2;if(YZ==="git"){let L=R.findIndex((f,v)=>v>0&&(f.text==="rm"||f.text==="clean"));if(L>0)o=L+1}let GZ=!1,i=R.slice(o).flatMap((L)=>{if(!GZ&&L.text==="--")return GZ=!0,[];if(!GZ&&L.text.startsWith("-"))return[];return GZ=!0,[L.opaque?".":L.text]}),j1=N.op==="delete"||/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(N.commandPart)||/(?:^|\s)sed(?:\s|$)/.test(N.commandPart)&&/(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(N.commandPart),HZ=[];if(j1)for(let L of i.length>0?i:["."])HZ.push({operand:L,op:N.op});else{let L=N.commandPart.match(E2),f=R.at(-1);if(HZ.push({operand:L?L[1]:!f||f.opaque?".":f.text,op:N.op}),/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(N.commandPart))R.forEach((v,L0)=>{let t,lZ=v.text.match(/^-[A-Za-z]*?t(.*)$/),LZ=v.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);if(lZ&&!v.text.startsWith("--"))t=lZ[1]?{text:lZ[1],opaque:v.opaque}:R[L0+1];else if(LZ&&"--target-directory".startsWith(LZ[1]))t=LZ[2]!==void 0?{text:LZ[2],opaque:v.opaque}:R[L0+1];if(t)HZ.push({operand:t.opaque||!t.text?".":t.text,op:N.op})});if(/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(N.commandPart))HZ.push({operand:".",op:N.op})}for(let L of A0)for(let{operand:f,op:v}of HZ)Y.push({path:zZ(DZ(L,IZ(f,J))),op:v})}if(j){let N=h0(j[1],G,J);if(N){for(let w of N)K.add(w);if(H)G=N}else H=!1}for(let N=0;N<P&&B.length>0;N++)({current:G,reachable:K,certain:H}=B.pop())}return Y}var c2=/^\s*\*\*\*\s+(Add File|Update File|Delete File):\s+(\S+)\s*$/gm;function p2(Z,J){let $=[],X;while((X=c2.exec(Z))!==null){let z=X[1]==="Delete File"?"delete":"write";$.push({path:zZ(DZ(J,X[2])),op:z})}return $}function a0(Z,J={}){let $=[];if(Z.hook_event_name!=="PreToolUse")return{output:{continue:!0},warnings:$};let X=typeof Z.tool_name==="string"?Z.tool_name:"",z=J.home??l0(),Q=c0(z),Y=C2(process.env,z);if(X==="Bash"){let V=ZZ(Z);if(!V)return{output:{continue:!0},warnings:$};let I=typeof Z.cwd==="string"&&Z.cwd?Z.cwd:process.cwd(),_=s0(V,z,I);for(let P of _)for(let M of Q){let j=oZ(P.path,M,Y,P.op);if(j.blocked)return{output:{decision:"block",reason:j.reason},warnings:$}}return{output:{continue:!0},warnings:$}}let G=Z.tool_input??{},K=typeof Z.cwd==="string"&&Z.cwd?Z.cwd:process.cwd();if(F2.has(X)){let V=typeof G.patch==="string"?G.patch:"";if(!V)return{output:{continue:!0},warnings:$};let I=p2(V,K);for(let _ of I)for(let P of Q){let M=oZ(_.path,P,Y,_.op);if(M.blocked)return{output:{decision:"block",reason:M.reason},warnings:$}}return{output:{continue:!0},warnings:$}}if(!M2.has(X))return{output:{continue:!0},warnings:$};let H=typeof G.file_path==="string"?G.file_path:typeof G.path==="string"?G.path:typeof G.notebook_path==="string"?G.notebook_path:null;if(!H)return{output:{continue:!0},warnings:$};let B=IZ(H,z),U=m0(B)?zZ(B):DZ(K,B);for(let V of Q){let I=oZ(U,V,Y,"write");if(I.blocked)return{output:{decision:"block",reason:I.reason},warnings:$}}return{output:{continue:!0},warnings:$}}var d2=new Set(["id","node_id","databaseId","fullDatabaseId","number","state","state_reason","stateReason","status","conclusion","bucket","name","login","sha","oid","abbreviatedOid","ref","headRefName","baseRefName","headRefOid","baseRefOid","head_sha","headSha","head_branch","headBranch","merged","mergeable","mergeable_state","mergeStateStatus","draft","isDraft","locked","isLocked","title","displayTitle","display_title","created_at","updated_at","closed_at","merged_at","started_at","completed_at","submitted_at","pushed_at","published_at","createdAt","updatedAt","closedAt","mergedAt","startedAt","completedAt","submittedAt","pushedAt","publishedAt","tag_name","tagName","total_count","totalCount","count","additions","deletions","changes","changed_files","changedFiles","filename","path","event","workflow","workflowName","workflow_id","workflowDatabaseId","run_id","run_number","run_attempt","attempt","check_suite_id","default_branch","defaultBranch","full_name","fullName","nameWithOwner","private","isPrivate","visibility","archived","isArchived","fork","isFork","isRequired","is_required","required","context","type","__typename","role","permission","size","reviewDecision","author_association","authorAssociation","isCrossRepository","maintainerCanModify","maintainer_can_modify","commentsCount","language","digest","size_in_bytes","run_started_at","date","wait_timer","ahead_by","behind_by","total_commits","expired","current_user_can_approve","environment","html_url"]),i2=new Set(["payload","client_payload","inputs","config","metadata","output","properties","custom_properties","variables"]),t0=new Set(["length","utf8bytelength","not","type","any","all","isempty","empty","test","startswith","endswith","contains","inside","has","in","index","rindex","indices","floor","ceil","round","fabs","sqrt","isinfinite","isnan","isnormal","infinite","nan","true","false","null"]),e0=new Set(["tostring","tojson","ascii_downcase","ascii_upcase","ltrimstr","rtrimstr","trim","ltrim","rtrim","sort","unique","reverse","first","last","min","max","add","flatten","join","split","values","nulls","strings","numbers","booleans","arrays","objects","iterables","scalars","sort_by","group_by","unique_by","min_by","max_by","select","limit","to_entries","from_entries"]),s2=new Set(["test","startswith","endswith","contains","inside","has","in","index","rindex","indices","ltrimstr","rtrimstr","join","split","flatten","limit"]),a2=new Set(["@text","@json","@csv","@tsv","@sh","@base64","@uri","@html"]);class X0 extends Error{}var T=()=>{throw new X0};function $0(Z,J){let $=[],X="",z=J+1;while(z<Z.length){let Q=Z[z];if(Q==='"'){if(X)$.push(X);return{end:z+1,parts:$}}if(Q==="\\"){let Y=Z[z+1];if(Y==="("){let G=1,K=z+2;while(K<Z.length&&G>0){let H=Z[K];if(H==='"'){K=$0(Z,K).end;continue}if(H==="(")G++;else if(H===")")G--;K++}if(G!==0)T();if(X)$.push(X),X="";$.push({src:Z.slice(z+2,K-1)}),z=K;continue}if(Y===void 0)T();X+=Y,z+=2;continue}X+=Q,z++}return T()}function Z1(Z){let J=[],$=0,X=["?//","|=","+=","-=","*=","/=","%=","//=","==","!=","<=",">=","//","|",",","+","-","*","/","%","<",">","=","(",")","[","]","{","}",":",";","?"];while($<Z.length){let z=Z[$];if(/\s/.test(z)){$++;continue}if(z==="#")T();if(z==='"'){let K=$0(Z,$);J.push({t:"str",parts:K.parts}),$=K.end;continue}if(z==="."){if(Z[$+1]===".")T();let K=/^[A-Za-z_][A-Za-z0-9_]*/.exec(Z.slice($+1));if(K){J.push({t:"field",name:K[0]}),$+=1+K[0].length;continue}if(Z[$+1]==='"'){let H=$0(Z,$+1);if(H.parts.some((B)=>typeof B!=="string"))T();J.push({t:"field",name:H.parts.join("")}),$=H.end;continue}J.push({t:"dot"}),$++;continue}if(z==="$"||z==="@"){let K=/^[@$][A-Za-z_][A-Za-z0-9_]*/.exec(Z.slice($));if(!K||z==="$")T();J.push({t:"fmt",name:K[0]}),$+=K[0].length;continue}let Q=/^[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(Z.slice($));if(Q){J.push({t:"num"}),$+=Q[0].length;continue}let Y=/^[A-Za-z_][A-Za-z0-9_]*(?:::[A-Za-z_][A-Za-z0-9_]*)*/.exec(Z.slice($));if(Y){J.push({t:"ident",name:Y[0]}),$+=Y[0].length;continue}let G=X.find((K)=>Z.startsWith(K,$));if(!G)T();J.push({t:"op",v:G}),$+=G.length}return J}var n2=new Set(["if","then","elif","else","end","as","def","reduce","foreach","try","catch","label","import","include","and","or","__loc__","error","input","inputs","debug","stderr","env","halt","halt_error","input_filename","input_line_number","recurse","paths","leaf_paths","getpath","setpath","delpaths","del","path","splits","sub","gsub","capture","match","scan","keys","keys_unsorted","map_values","with_entries","tostream","fromstream","truncate_stream","walk","tonumber","implode","explode","ascii","fromjson"]);class z0{tokens;at=0;constructor(Z){this.tokens=Z}parse(){if(this.tokens.length===0)T();let Z=this.pipe();if(this.at!==this.tokens.length)T();return Z}peek(){return this.tokens[this.at]}isOp(Z){let J=this.peek();return!!J&&J.t==="op"&&J.v===Z}isIdent(Z){let J=this.peek();return!!J&&J.t==="ident"&&J.name===Z}expectOp(Z){if(!this.isOp(Z))T();this.at++}pipe(){let Z=this.comma();if(this.isIdent("as"))T();if(this.isOp("|"))this.at++,Z={k:"pipe",a:Z,b:this.pipe()};return Z}comma(){let Z=this.alt();while(this.isOp(","))this.at++,Z={k:"comma",a:Z,b:this.alt()};return Z}alt(){let Z=this.or();if(this.isOp("//"))return this.at++,{k:"alt",a:Z,b:this.alt()};return Z}or(){let Z=this.and();while(this.isIdent("or"))this.at++,Z={k:"bool",a:Z,b:this.and()};return Z}and(){let Z=this.cmp();while(this.isIdent("and"))this.at++,Z={k:"bool",a:Z,b:this.cmp()};return Z}cmp(){let Z=this.add();for(let J of["==","!=","<=",">=","<",">"])if(this.isOp(J))return this.at++,{k:"bool",a:Z,b:this.add()};for(let J of["=","|=","+=","-=","*=","/=","%=","//=","?//"])if(this.isOp(J))T();return Z}add(){let Z=this.mul();while(this.isOp("+")||this.isOp("-"))this.at++,Z={k:"arith",a:Z,b:this.mul()};return Z}mul(){let Z=this.unary();while(this.isOp("*")||this.isOp("/")||this.isOp("%"))this.at++,Z={k:"arith",a:Z,b:this.unary()};return Z}unary(){if(this.isOp("-"))return this.at++,{k:"neg",of:this.postfix()};return this.postfix()}objectValue(){let Z=this.unary();if(this.isOp("|"))this.at++,Z={k:"pipe",a:Z,b:this.objectValue()};return Z}postfix(){let Z=this.primary();for(;;){let J=this.peek();if(!J)return Z;if(J.t==="field"){this.at++,Z={k:"field",name:J.name,of:Z};continue}if(J.t==="dot"&&this.tokens[this.at+1]?.t==="op"&&this.tokens[this.at+1].v==="["){this.at++;continue}if(J.t==="op"&&J.v==="?"){this.at++,Z={k:"opt",of:Z};continue}if(J.t==="op"&&J.v==="["){Z=this.bracket(Z);continue}return Z}}bracket(Z){if(this.expectOp("["),this.isOp("]"))return this.at++,{k:"iter",of:Z};if(this.isOp(":")){if(this.at++,!this.isOp("]"))this.pipe();return this.expectOp("]"),{k:"slice",of:Z}}let J=this.pipe();if(this.isOp(":")){if(this.at++,!this.isOp("]"))this.pipe();return this.expectOp("]"),{k:"slice",of:Z}}return this.expectOp("]"),{k:"index",of:Z,key:J}}primary(){let Z=this.peek();if(!Z)return T();switch(this.at++,Z.t){case"dot":return{k:"dot"};case"field":return{k:"field",name:Z.name};case"num":return{k:"lit"};case"str":return this.stringNode(Z.parts);case"fmt":{if(!a2.has(Z.name))T();let J=this.peek();if(J?.t==="str")return this.at++,{k:"fmt",name:Z.name,str:this.stringNode(J.parts)};return{k:"fmt",name:Z.name}}case"ident":{if(n2.has(Z.name))T();if(Z.name==="map"||t0.has(Z.name)||e0.has(Z.name)){let J=[];if(this.isOp("(")){this.at++,J.push(this.pipe());while(this.isOp(";"))this.at++,J.push(this.pipe());this.expectOp(")")}return{k:"call",name:Z.name,args:J}}return T()}case"op":{if(Z.v==="("){let J=this.pipe();return this.expectOp(")"),J}if(Z.v==="["){if(this.isOp("]"))return this.at++,{k:"array"};let J=this.pipe();return this.expectOp("]"),{k:"array",of:J}}if(Z.v==="{")return this.object();return T()}}return T()}stringNode(Z){let J=[];for(let $ of Z){if(typeof $==="string")continue;J.push(new z0(Z1($.src)).parse())}return J.length===0?{k:"str",parts:J,text:Z.join("")}:{k:"str",parts:J}}object(){let Z=[];if(this.isOp("}"))return this.at++,{k:"object",entries:Z};for(;;){let J=this.peek();if(!J)T();this.at++;let $;if(J.t==="ident")$=J.name;else if(J.t==="str"){if(J.parts.some((X)=>typeof X!=="string"))T();$=J.parts.join("")}else T();if(this.isOp(":"))this.at++,Z.push({key:"static",value:this.objectValue()});else Z.push({key:"static",value:{k:"field",name:$}});if(this.isOp(",")){this.at++;continue}return this.expectOp("}"),{k:"object",entries:Z}}}}function K0(Z){if(typeof Z==="object"&&"union"in Z)return Z.union.every(K0);return Z==="safe"||typeof Z==="object"&&d2.has(Z.leaf)}var AZ=(...Z)=>Z.every(K0)?"safe":"tainted";function J0(...Z){let J=[];for(let $ of Z)if(typeof $==="object"&&"union"in $)J.push(...$.union);else J.push($);return J.length===1?J[0]:{union:J}}function yZ(Z,J){return typeof Z==="object"&&"union"in Z?J0(...Z.union.map(J)):J(Z)}var SZ=(Z)=>typeof Z==="object"&&("leaf"in Z)&&i2.has(Z.leaf),l=(Z)=>yZ(Z,(J)=>J==="safe"?"safe":J==="tainted"||SZ(J)?"tainted":"unknown");function n0(Z){return Z.k==="lit"||Z.k==="str"&&Z.parts.length===0||Z.k==="call"&&["true","false","null"].includes(Z.name)&&Z.args.length===0}function r0(Z,J,$){return yZ(Z,(X)=>{if(X==="safe"||X==="tainted")return X;if(SZ(X))return"tainted";if(X==="root"&&$.rootScalars.has(J))return"safe";return{leaf:J}})}function C(Z,J,$){switch(Z.k){case"dot":return J;case"field":return r0(Z.of?C(Z.of,J,$):J,Z.name,$);case"iter":return l(C(Z.of,J,$));case"index":{let X=C(Z.of,J,$);if(Z.key.k==="str"&&Z.key.text!==void 0)return r0(X,Z.key.text,$);if(Z.key.k==="lit")return l(X);return C(Z.key,J,$),"tainted"}case"slice":return yZ(C(Z.of,J,$),(X)=>X==="root"?"unknown":SZ(X)?"tainted":X);case"opt":return C(Z.of,J,$);case"lit":return"safe";case"str":return AZ(...Z.parts.map((X)=>C(X,J,$)));case"fmt":return Z.str?C(Z.str,J,$):J;case"array":return Z.of?AZ(C(Z.of,J,$)):"safe";case"object":return AZ(...Z.entries.map((X)=>C(X.value,J,$)));case"pipe":return C(Z.b,C(Z.a,J,$),$);case"comma":return J0(C(Z.a,J,$),C(Z.b,J,$));case"alt":return J0(C(Z.a,J,$),C(Z.b,J,$));case"bool":return C(Z.a,J,$),C(Z.b,J,$),"safe";case"arith":return AZ(C(Z.a,J,$),C(Z.b,J,$));case"neg":return C(Z.of,J,$);case"call":return r2(Z,J,$)}}var o0=(Z)=>yZ(Z,(J)=>J==="root"?"unknown":SZ(J)?"tainted":J);function r2(Z,J,$){let{name:X,args:z}=Z;if(s2.has(X)&&X!=="limit"&&!z.every(n0))T();switch(X){case"map":if(z.length!==1)T();return AZ(C(z[0],l(J),$));case"select":if(z.length!==1)T();return C(z[0],J,$),J;case"limit":if(z.length!==2||!n0(z[0]))T();return C(z[1],J,$);case"first":case"last":if(z.length>1)T();return z.length===1?C(z[0],J,$):l(J);case"min":case"max":return l(J);case"sort_by":case"group_by":case"unique_by":if(z.length!==1)T();return C(z[0],l(J),$),o0(J);case"min_by":case"max_by":if(z.length!==1)T();return C(z[0],l(J),$),l(J);case"any":case"all":case"isempty":for(let Q of z)C(Q,"unknown",$);return"safe"}if(t0.has(X))return"safe";if(e0.has(X))return o0(J);return T()}function $1(Z,J={}){if(typeof Z!=="string"||!Z.trim()||Z.length>4096)return!1;try{let $=new z0(Z1(Z)).parse();return K0(C($,"root",{rootScalars:J.rootScalars??new Set}))}catch($){if($ instanceof X0)return!1;return!1}}var F0="composite output withheld: signed-link shape; use bounded scalar projections per class disposition 799310",q={refused:!1},F=(Z)=>({refused:!0,rule:Z}),Q0=new Set(["additions","assignees","author","baseRefName","baseRefOid","changedFiles","closed","closedAt","createdAt","deletions","files","fullDatabaseId","headRefName","headRefOid","headRepository","headRepositoryOwner","id","isCrossRepository","isDraft","labels","maintainerCanModify","mergeCommit","mergeStateStatus","mergeable","mergedAt","mergedBy","number","potentialMergeCommit","reactionGroups","reviewDecision","reviewRequests","state","title","updatedAt","url"]),Y0=new Set(["assignees","author","closed","closedAt","createdAt","id","isPinned","labels","number","reactionGroups","state","stateReason","subIssuesSummary","title","updatedAt","url"]),J1=new Set(["apiUrl","author","createdAt","databaseId","id","isDraft","isImmutable","isLatest","isPrerelease","name","publishedAt","tagName","tarballUrl","targetCommitish","uploadUrl","url","zipballUrl"]),X1=new Set(["answerChosenAt","answerChosenBy","answered","author","closed","closedAt","createdAt","id","labels","locked","number","reactionGroups","state","stateReason","title","updatedAt","url"]),o2=new Set(["assignees","author","authorAssociation","closedAt","commentsCount","createdAt","id","isDraft","isLocked","isPullRequest","labels","number","repository","state","title","updatedAt","url"]),t2=new Set(["author","committer","id","parents","repository","sha","url"]),e2=new Set(["bucket","completedAt","event","name","startedAt","state","workflow"]);function Q1(Z){let J=[];for(let $=0;$<Z.length;$++){let X=Z[$];if(X==="\\"){$++;continue}if(X==="'"){let z=Z.indexOf("'",$+1);if(z<0)return!1;$=z;continue}if(X==='"'){$++;while($<Z.length&&Z[$]!=='"')$+=Z[$]==="\\"?2:1;continue}if(X==="{"){J.push({list:!1});continue}if(J.length===0)continue;if(X===","||X==="."&&Z[$+1]===".")J[J.length-1].list=!0;else if(X==="}"&&J.pop().list)return!0}return!1}function KZ(Z){let J="",$=!1,X=0,z=(Q)=>Z[Q]==="`"||Z[Q]==="$"&&/[A-Za-z_{(@*#?$!0-9-]/.test(Z[Q+1]??"");while(X<Z.length){let Q=Z[X];if(Q==="\\"){J+=Z[X+1]??"",X+=2;continue}if(Q==="$"&&Z[X+1]==="'"){$=!0,J+=Q,X++;continue}if(Q==="'"){let Y=Z.indexOf("'",X+1);if(Y<0){$=!0,J+=Z.slice(X+1);break}J+=Z.slice(X+1,Y),X=Y+1;continue}if(Q==='"'){X++;while(X<Z.length&&Z[X]!=='"'){if(Z[X]==="\\"&&/[$`"\\\n]/.test(Z[X+1]??"")){J+=Z[X+1],X+=2;continue}if(z(X))$=!0;J+=Z[X],X++}if(X>=Z.length)$=!0;X++;continue}if(z(X)||Q==="*"||Q==="?"||Q==="[")$=!0;J+=Q,X++}if(!$&&Z.includes("{")&&Q1(Z))$=!0;return{value:J,opaque:$,raw:Z}}var n=(Z)=>Z.slice(Z.lastIndexOf("/")+1);function B0(Z,J="word"){let $=[],X=!1;for(let z=0;z<Z.length;z++){let Q=Z[z];if(Q==="\\"){z++;continue}if(J==="word"&&Q==="'"&&!X){let Y=Z.indexOf("'",z+1);if(Y<0)return{bodies:$,complete:!1};z=Y;continue}if(J==="word"&&Q==='"'){X=!X;continue}if(Q==="`"){let Y=z+1;while(Y<Z.length&&Z[Y]!=="`")Y+=Z[Y]==="\\"?2:1;if(Y>=Z.length)return{bodies:$,complete:!1};$.push(Z.slice(z+1,Y)),z=Y;continue}if(Q==="$"&&Z[z+1]==="("){let Y=_Z(Z,z+1);if(Y<0)return{bodies:$,complete:!1};$.push(Z.slice(z+2,Y-1)),z=Y-1}}return{bodies:$,complete:!0}}function QZ(Z,J){let $=new Set(J.values),X={flags:[],positionals:[]},z=(Q,Y)=>({value:Q,opaque:Y.opaque,raw:Y.raw});for(let Q=0;Q<Z.length;Q++){let Y=Z[Q],G=Y.value;if(G==="--"){X.positionals.push(...Z.slice(Q+1));break}if(G.startsWith("--")&&G.length>2){let K=G.indexOf("="),H=K>=0?G.slice(0,K):G;if(K>=0)X.flags.push({name:H,value:z(G.slice(K+1),Y),inline:!0});else if($.has(H)){let B=Z[Q+1];X.flags.push(B?{name:H,value:B}:{name:H,missing:!0}),Q++}else X.flags.push({name:H});continue}if(G.startsWith("-")&&G.length>1){for(let K=1;K<G.length;K++){let H="-"+G[K],B=G.slice(K+1);if(B.startsWith("=")){X.flags.push({name:H,value:z(B.slice(1),Y),inline:!0});break}if(!$.has(H)){X.flags.push({name:H});continue}if(B)X.flags.push({name:H,value:z(B,Y),inline:!0});else{let U=Z[Q+1];X.flags.push(U?{name:H,value:U}:{name:H,missing:!0}),Q++}break}continue}X.positionals.push(Y)}return X}function E(Z,...J){let $=!1;for(let X of Z.flags){if(!J.includes(X.name))continue;if(!X.inline){$=!0;continue}let z=X.value;$=!z.opaque&&["1","t","T","TRUE","true","True"].includes(z.value)}return $}var c=(Z,...J)=>Z.flags.filter(($)=>J.includes($.name)),b=["-R","--repo","-q","--jq","-t","--template","--json"],r={"pr view":{values:b},"issue view":{values:b},"release view":{values:b},"discussion view":{values:[...b,"--after","-L","--limit","--order"]},"pr list":{values:[...b,"--app","-a","--assignee","-A","--author","-B","--base","-H","--head","-l","--label","-L","--limit","-S","--search","-s","--state"]},"issue list":{values:[...b,"--app","-a","--assignee","-A","--author","-l","--label","-L","--limit","--mention","-m","--milestone","-S","--search","-s","--state"]},"discussion list":{values:[...b,"--after","-A","--author","-c","--category","-l","--label","-L","--limit","--order","-S","--search","--sort","-s","--state"]},"release list":{values:[...b,"-L","--limit","-O","--order"]},"pr status":{values:b},"issue status":{values:b},"pr checks":{values:[...b,"-i","--interval"]},"pr diff":{values:["-R","--repo"]},search:{values:[...b,"--app","--assignee","--author","--author-date","--author-email","--author-name","--base","--checks","--closed","--commenter","--committer","--committer-date","--committer-email","--committer-name","--created","--hash","--head","--interactions","--involves","--label","--language","--limit","-L","--match","--mentions","--merged-at","--milestone","--no-assignee","--no-label","--no-milestone","--no-project","--order","--owner","--parent","--project","--reactions","--review","--review-requested","--reviewed-by","--sort","--state","--team-mentions","--tree","--updated","--visibility","--extension","--filename","--size","--forks","--good-first-issue","--help-wanted-issues","--number-topics","--stars","--topic","--followers","--include-forks","--license"]},"project item-list":{values:["--format","-L","--limit","--owner","-q","--jq","-t","--template","--query","--field","--field-id"]},api:{values:["-X","--method","-H","--header","-f","--raw-field","-F","--field","-q","--jq","-t","--template","-p","--preview","--input","--hostname","--cache"]},group:{values:["-R","--repo"]}},Z3=new Set(["auth","browse","codespace","cs","gist","org","repo","skill","cache","run","workflow","co","agent-task","alias","attestation","completion","config","copilot","extension","ext","extensions","gpg-key","label","licenses","preview","ruleset","secret","ssh-key","variable","help","version","accessibility","actions","environment","exit-codes","formatting","mintty","reference","telemetry"]),$3=new Set(["pr","issue","release","discussion","search","project","api","status"]),J3=new Set(["create","new","checkout","co","close","comment","edit","lock","merge","ready","reopen","revert","review","unlock","update-branch"]),X3=new Set(["create","new","close","comment","delete","develop","edit","lock","pin","reopen","transfer","unlock","unpin"]),z3=new Set(["create","new","delete","delete-asset","download","edit","upload","verify","verify-asset"]),K3=new Set(["create","new","close","comment","delete","edit","lock","reopen","unlock","answer","unanswer"]);function wZ(Z,J){let $=c(Z,"--json"),X=[],z=!1;for(let Q of $){if(Q.missing){if(J.appendsArgs)z=!0;continue}if(!Q.value)continue;if(Q.value.opaque)z=!0;X.push(...Q.value.value.split(",").map((Y)=>Y.trim()).filter(Boolean))}return{present:$.length>0,opaque:z,fields:X}}function q0(Z,J){if(E(Z,"--verbose")||c(Z,"-t","--template").length>0)return!1;let $=c(Z,"-q","--jq");return $.length>0&&$.every((X)=>X.value!==void 0&&!X.value.opaque&&$1(X.value.value,{rootScalars:J}))}function N0(Z,J,$,X){let z=wZ(Z,$);if(z.opaque)return F("unclassifiable");if(z.fields.every((Q)=>J.has(Q)))return q;if($.debug)return F("debug-traffic");return q0(Z)?q:F(X)}function bZ(Z,J,$,X,z){let Q=QZ(Z,r[J]);if(E(Q,"-h","--help"))return q;if(E(Q,"-w","--web"))return X.debug?F("debug-traffic"):q;if(z&&E(Q,"-c","--comments"))return F("view-comments");if(!wZ(Q,X).present)return F(X.debug?"debug-traffic":"view-human");return N0(Q,$,X,"json-composite")}function m(Z,J,$,X){let z=QZ(Z,r[J]);if(E(z,"-h","--help"))return q;if(X.debug&&(E(z,"-w","--web")||!wZ(z,X).present))return F("debug-traffic");if(E(z,"-w","--web"))return q;return N0(z,$,X,"json-composite")}function Q3(Z,J){let $=QZ(Z,r["pr checks"]);if(E($,"-h","--help"))return q;if(J.debug)return F("debug-traffic");if(E($,"-w","--web"))return q;if(!wZ($,J).present)return F("checks-human");return N0($,e2,J,"checks-json")}function Y3(Z){let J=new Set(r.group.values);for(let $=0;$<Z.length;$++){let X=Z[$].value;if(X==="--")return{sub:Z[$+1],rest:Z.slice($+2)};if(!X.startsWith("-")||X==="-")return{sub:Z[$],rest:[...Z.slice(0,$),...Z.slice($+1)]};if(J.has(X))$++}return{rest:Z}}function G3(Z,J,$){let{sub:X,rest:z}=Y3(J);if(!X)return $.appendsArgs?F("unclassifiable"):q;if(X.opaque)return F("unclassifiable");let Q=X.value;if((Z==="pr"?J3:Z==="issue"?X3:Z==="release"?z3:Z==="discussion"?K3:new Set).has(Q))return $.debug?F("debug-traffic"):q;if($.appendsArgs&&!(Z==="project"&&Q!=="item-list"))return F("unclassifiable");switch(Z){case"pr":if(Q==="view")return bZ(z,"pr view",Q0,$,!0);if(Q==="list"||Q==="ls")return m(z,"pr list",Q0,$);if(Q==="status")return m(z,"pr status",Q0,$);if(Q==="checks")return Q3(z,$);if(Q==="diff"){let G=QZ(z,r["pr diff"]);if(E(G,"-h","--help"))return q;if($.debug)return F("debug-traffic");return E(G,"--patch")?F("composite-other"):q}return F("unclassifiable");case"issue":if(Q==="view")return bZ(z,"issue view",Y0,$,!0);if(Q==="list"||Q==="ls")return m(z,"issue list",Y0,$);if(Q==="status")return m(z,"issue status",Y0,$);return F("unclassifiable");case"release":if(Q==="view")return bZ(z,"release view",J1,$,!1);if(Q==="list"||Q==="ls")return m(z,"release list",J1,$);return F("unclassifiable");case"discussion":if(Q==="view")return bZ(z,"discussion view",X1,$,!0);if(Q==="list"||Q==="ls")return m(z,"discussion list",X1,$);return F("unclassifiable");case"search":if(Q==="prs"||Q==="issues")return m(z,"search",o2,$);if(Q==="commits")return m(z,"search",t2,$);if(Q==="code"||Q==="repos")return $.debug?F("debug-traffic"):q;return F("unclassifiable");case"project":{if($.debug)return F("debug-traffic");if(Q!=="item-list")return q;let G=QZ(z,r["project item-list"]);if(E(G,"-h","--help"))return q;let K=c(G,"--format");if(K.some((H)=>!H.value||H.value.opaque))return F("unclassifiable");if(K.every((H)=>H.value.value!=="json"))return q;return q0(G)?q:F("composite-other")}}return F("unclassifiable")}var Y1=new Set(["pulls","issues","commits","check-runs","check-suites","statuses","comments","releases","compare","events","discussions","deployments","milestones"]);function H3(Z){let J=Z.value.trim(),$=/^https?:\/\/([^/]+)(\/.*)?$/i.exec(J);if($){let Q=$[1].toLowerCase(),Y=$[2]??"/";if(Q==="api.github.com"||/^api\./.test(Q))J=Y;else if(/^\/api\/v3(?:\/|$)/i.test(Y))J=Y.replace(/^\/api\/v3/i,"");else if(/^\/api\/graphql(?:[/?#]|$)/i.test(Y))J="graphql";else return null}J=J.replace(/[?#].*$/,"");let X=[],z=[];for(let Q of J.split("/")){let Y;try{Y=decodeURIComponent(Q)}catch{return null}for(let G of Y.split("/")){if(G===""||G===".")continue;if(G===".."){X.pop(),z.pop();continue}X.push(G.toLowerCase()),z.push(Z.opaque&&/[$`]/.test(G)||/[*?[]/.test(G)||Q1(G))}}return{segments:X,opaque:z}}function B3(Z){let J=H3(Z);if(!J)return{kind:"unclassifiable",segments:[]};let{segments:$,opaque:X}=J,z=(K)=>({kind:K,segments:$});if($.length===1&&$[0]==="graphql")return z("graphql");if($.length===0)return z(Z.opaque?"unclassifiable":"other");if(X[0])return z("unclassifiable");let Q,Y=[];if($[0]==="repos")Q=$.slice(3),Y=X.slice(3);else if($[0]==="repositories")Q=$.slice(2),Y=X.slice(2);if(Q){if(($[0]==="repos"?X.slice(1,3):X.slice(1,2)).some(Boolean)){let H=X.findIndex(Boolean),B=$.findIndex((U,V)=>V>H&&!X[V]&&U3.has(U));return z(B<0?"unclassifiable":z1($.slice(B),X.slice(B)))}return z(z1(Q,Y))}let G=$[0];if(G==="issues")return z("sensitive");if(G==="user"&&$[1]==="issues")return z("sensitive");if(G==="orgs"&&$[2]==="issues")return z("sensitive");if(G==="search")return z($[1]==="issues"||$[1]==="commits"?"sensitive":$[1]!==void 0&&X[1]?"unclassifiable":"other");if(G==="events"||G==="networks")return z("sensitive");if((G==="users"||G==="orgs")&&$.slice(2).some((K)=>K==="events"||K==="received_events"||K==="discussions"))return z("sensitive");if((G==="users"||G==="orgs")&&$[2]==="projectsv2"&&$[4]==="items")return z("sensitive");if(G==="orgs"&&$[2]==="hooks"&&$[4]==="deliveries"&&$[5]!==void 0||G==="app"&&$[1]==="hook"&&$[2]==="deliveries"&&$[3]!==void 0)return z("sensitive");if(G==="teams"&&$.includes("discussions"))return z("sensitive");if(G==="projects"&&$.includes("cards"))return z("sensitive");if(X.some(Boolean))return z($.some((K)=>K==="events"||K==="discussions"||K==="issues")?"sensitive":"unclassifiable");return z("other")}var U3=new Set([...Y1,"branches","git","actions","hooks","zipball","tarball"]);function z1(Z,J){let[$,X]=Z;if($===void 0)return"other";if(J[0])return"unclassifiable";if($==="issues"&&/^\d+$/.test(X??"")&&Z[2]==="labels")return"other";if(Y1.has($))return"sensitive";if($==="branches"){if(Z.length===1||Z.slice(1).some((z)=>z==="protection")||Z[Z.length-1]==="rename")return"other";return J.slice(1).some(Boolean)?"unclassifiable":"sensitive"}if($==="git")return X===void 0||X==="commits"||X==="tags"?"sensitive":J[1]?"unclassifiable":"other";if($==="actions"){if(X===void 0)return"sensitive";if(J[1])return"unclassifiable";if(X==="runs"||X==="jobs"){if(Z[Z.length-1]==="logs"&&Z.length>=4&&!J.some(Boolean))return"download";return"sensitive"}if(X==="workflows"&&Z[3]==="runs")return"sensitive";if(X==="artifacts"&&Z.length===4)return"download";return"other"}if($==="hooks"&&Z[2]==="deliveries"&&Z[3]!==void 0)return"sensitive";if($==="zipball"||$==="tarball")return"download";return"other"}function V3(Z,J){if(J[0]!=="repos"||J.length<5)return!1;let $=J.slice(3),X=(Q)=>/^\d+$/.test($[Q]??""),z=(...Q)=>$.length===Q.length&&Q.every((Y,G)=>typeof Y==="number"?X(G):$[G]===Y);if(Z==="DELETE")return z("issues","comments",0)||z("pulls","comments",0)||z("comments",0)||z("issues","comments",0,"reactions",0)||z("pulls","comments",0,"reactions",0)||z("issues",0,"reactions",0)||z("issues",0,"labels")||$.length===4&&$[0]==="issues"&&X(1)&&$[2]==="labels"||z("releases",0)||z("releases","assets",0)||z("actions","runs",0)||z("actions","runs",0,"logs")||z("deployments",0)||z("milestones",0)||z("issues",0,"lock");if(Z==="POST")return $.length===4&&$[0]==="actions"&&$[1]==="runs"&&X(2)&&["rerun","rerun-failed-jobs","cancel","force-cancel","approve"].includes($[3])||z("actions","jobs",0,"rerun")||z("issues",0,"labels");if(Z==="PUT")return z("pulls",0,"merge")||z("pulls",0,"update-branch")||z("issues",0,"labels")||z("issues",0,"lock");if(Z==="GET")return z("pulls",0,"merge");return!1}function M3(Z){if(Z[0]!=="repos"||Z.length!==5||!/^\d+$/.test(Z[4]))return;if(Z[3]==="pulls")return new Set(["commits","comments","review_comments"]);if(Z[3]==="issues")return new Set(["comments"]);return}var F3=new Set(["body","bodyText","bodyHTML","bodyUrl","bodyResourcePath","comments","reviews","latestReviews","latestOpinionatedReviews","reviewThreads","url","permalink","summary","text","description","message","messageBody","messageHeadline","commitBody","commitHeadline","annotations","rawDetails","note","diff","readme","payload"]),q3=new Set(["checkRuns","checkRun","checkSuites","checkSuite","contexts","statusCheckRollup","annotations","CheckRun","CheckSuite","StatusContext","CheckAnnotation","latestStatus","status","statuses"]);function N3(Z){let J=[],$=0;while($<Z.length){let X=Z[$];if(/[\s,\uFEFF]/.test(X)){$++;continue}if(X==="#"){let Y=Z.indexOf(`
+`),bodies:z}}var b2="/";function h0(Z,J,$){if(!Z)return[];let X=S2(Z);if(!X)return S0(Z,J,$);return[...S0(X.outer,J,$),...X.bodies.flatMap((z)=>h0(z,J,b2))]}function S0(Z,J,$){if(!Z)return[];let X=k0(J),z=(U)=>X.some((V)=>U===V||U.startsWith(`${V}${aZ}`)),Q=Z.split(/(\s*&&\s*|\s*\|\|\s*|;\s*|\n+)/),Y=[],G=[$],K=new Set([$]),H=!0,B=[];for(let U=0;U<Q.length;U+=2){let V=U===0?"":Q[U-1].trim();if(V==="||")H=!1;else if(V!=="&&")H=!0;if(V!=="&&"||!H)G=[...K];let W=Q[U],_=(W.match(/^[\s({]*/)?.[0].match(/\(/g)??[]).length,L=(W.match(/[\s)}]*$/)?.[0].match(/\)/g)??[]).length;for(let N=0;N<_;N++)B.push({current:[...G],reachable:new Set(K),certain:H});let M=j2(W),j=M.match(/^cd(?:\s+(?:-[A-Za-z@]+|--))*(?:\s+([^\s;&|<>()\x60]+))?$/),g=j?null:M.match(/(?:^|\s)cd(?:\s+(?:-[A-Za-z]+|--))*\s+([^\s;&|<>()\x60]+)/);if(g){for(let N of y0(g[1],G,J)??[])K.add(N);H=!1,G=[...K]}let h=nZ(J),c=X.map((N)=>nZ(N.slice(J.length+1))).join("|"),I=new RegExp(`(?:~|\\$HOME"*|\\$\\{HOME\\}"*|${h}"*)/(?:${c})`),P=new RegExp(`(${I.source})([^\\s"';&|<>()\`]*|$)`,"g"),v=(N)=>{let k=[],E;P.lastIndex=0;while((E=P.exec(N))!==null)k.push(JZ(TZ(E[0],J)).replace(/\/+$/,""));return k},y=q2(M).map((N)=>{let k=[],E=!1,n=x0(N).replace(F2,(QZ,p)=>{if(!p||/[$\x60]/.test(p))E=!0;if(p)k.push(p);return" "}),KZ=_2(n);return{commandPart:n,operands:k,op:E&&KZ==="read"?"write":KZ}}),Y1=y.some((N)=>N.op==="delete")?"delete":y.some((N)=>N.op==="write")?"write":"read",N0=G.filter(z);for(let N of y){let k=!1;for(let A of v(N.commandPart))k=!0,Y.push({path:A,op:Y1});for(let A of N.operands){let b=v(A);for(let R of b)Y.push({path:R,op:"write"});if(b.length>0)continue;for(let R of N0)Y.push({path:JZ(CZ(R,TZ(A,J))),op:"write"})}if(k||N.op==="read")continue;let E=N2(N.commandPart),n=1,KZ=(E[0]?.text??"").split("/").pop();if(KZ==="trash"&&["put","rm","delete","remove"].includes(E[1]?.text??""))n=2;if(KZ==="git"){let A=E.findIndex((b,R)=>R>0&&(b.text==="rm"||b.text==="clean"));if(A>0)n=A+1}let QZ=!1,p=E.slice(n).flatMap((A)=>{if(!QZ&&A.text==="--")return QZ=!0,[];if(!QZ&&A.text.startsWith("-"))return[];return QZ=!0,[A.opaque?".":A.text]}),G1=N.op==="delete"||/(?:^|\s)\\?(?:[^\s;&|<>()]*\/)?(?:mkdir|mkfile|touch|tee|truncate|install|mv)(?:\s|$)/.test(N.commandPart)||/(?:^|\s)sed(?:\s|$)/.test(N.commandPart)&&/(?:^|\s)(?:-i\S*|--in-place\S*)(?:\s|$)/.test(N.commandPart),YZ=[];if(G1)for(let A of p.length>0?p:["."])YZ.push({operand:A,op:N.op});else{let A=N.commandPart.match(W2),b=E.at(-1);if(YZ.push({operand:A?A[1]:!b||b.opaque?".":b.text,op:N.op}),/(?:^|\s)(?:cp|ln|install|mv)(?:\s|$)/.test(N.commandPart))E.forEach((R,_0)=>{let r,wZ=R.text.match(/^-[A-Za-z]*?t(.*)$/),DZ=R.text.match(/^(--t[a-z-]*)(?:=(.*))?$/);if(wZ&&!R.text.startsWith("--"))r=wZ[1]?{text:wZ[1],opaque:R.opaque}:E[_0+1];else if(DZ&&"--target-directory".startsWith(DZ[1]))r=DZ[2]!==void 0?{text:DZ[2],opaque:R.opaque}:E[_0+1];if(r)YZ.push({operand:r.opaque||!r.text?".":r.text,op:N.op})});if(/(?:^|\s)(?:python3?|node|bun)\b[^;&|]*\s+-[ce](?:\s|$)/.test(N.commandPart))YZ.push({operand:".",op:N.op})}for(let A of N0)for(let{operand:b,op:R}of YZ)Y.push({path:JZ(CZ(A,TZ(b,J))),op:R})}if(j){let N=y0(j[1],G,J);if(N){for(let k of N)K.add(k);if(H)G=N}else H=!1}for(let N=0;N<L&&B.length>0;N++)({current:G,reachable:K,certain:H}=B.pop())}return Y}var f2=/^\s*\*\*\*\s+(Add File|Update File|Delete File):\s+(\S+)\s*$/gm;function k2(Z,J){let $=[],X;while((X=f2.exec(Z))!==null){let z=X[1]==="Delete File"?"delete":"write";$.push({path:JZ(CZ(J,X[2])),op:z})}return $}function u0(Z,J={}){let $=[];if(Z.hook_event_name!=="PreToolUse")return{output:{continue:!0},warnings:$};let X=typeof Z.tool_name==="string"?Z.tool_name:"",z=J.home??b0(),Q=k0(z),Y=V2(process.env,z);if(X==="Bash"){let V=t(Z);if(!V)return{output:{continue:!0},warnings:$};let W=typeof Z.cwd==="string"&&Z.cwd?Z.cwd:process.cwd(),_=h0(V,z,W);for(let L of _)for(let M of Q){let j=iZ(L.path,M,Y,L.op);if(j.blocked)return{output:{decision:"block",reason:j.reason},warnings:$}}return{output:{continue:!0},warnings:$}}let G=Z.tool_input??{},K=typeof Z.cwd==="string"&&Z.cwd?Z.cwd:process.cwd();if(K2.has(X)){let V=typeof G.patch==="string"?G.patch:"";if(!V)return{output:{continue:!0},warnings:$};let W=k2(V,K);for(let _ of W)for(let L of Q){let M=iZ(_.path,L,Y,_.op);if(M.blocked)return{output:{decision:"block",reason:M.reason},warnings:$}}return{output:{continue:!0},warnings:$}}if(!z2.has(X))return{output:{continue:!0},warnings:$};let H=typeof G.file_path==="string"?G.file_path:typeof G.path==="string"?G.path:typeof G.notebook_path==="string"?G.notebook_path:null;if(!H)return{output:{continue:!0},warnings:$};let B=TZ(H,z),U=f0(B)?JZ(B):CZ(K,B);for(let V of Q){let W=iZ(U,V,Y,"write");if(W.blocked)return{output:{decision:"block",reason:W.reason},warnings:$}}return{output:{continue:!0},warnings:$}}var w2=new Set(["id","node_id","databaseId","fullDatabaseId","number","state","state_reason","stateReason","status","conclusion","bucket","name","login","sha","oid","abbreviatedOid","ref","headRefName","baseRefName","headRefOid","baseRefOid","head_sha","headSha","head_branch","headBranch","merged","mergeable","mergeable_state","mergeStateStatus","draft","isDraft","locked","isLocked","title","displayTitle","display_title","created_at","updated_at","closed_at","merged_at","started_at","completed_at","submitted_at","pushed_at","published_at","createdAt","updatedAt","closedAt","mergedAt","startedAt","completedAt","submittedAt","pushedAt","publishedAt","tag_name","tagName","total_count","totalCount","count","additions","deletions","changes","changed_files","changedFiles","filename","path","event","workflow","workflowName","workflow_id","workflowDatabaseId","run_id","run_number","run_attempt","attempt","check_suite_id","default_branch","defaultBranch","full_name","fullName","nameWithOwner","private","isPrivate","visibility","archived","isArchived","fork","isFork","isRequired","is_required","required","context","type","__typename","role","permission","size","reviewDecision","author_association","authorAssociation","isCrossRepository","maintainerCanModify","maintainer_can_modify","commentsCount","language","digest","size_in_bytes","run_started_at","date","wait_timer","ahead_by","behind_by","total_commits","expired","current_user_can_approve","environment","html_url"]),x2=new Set(["payload","client_payload","inputs","config","metadata","output","properties","custom_properties","variables"]),p0=new Set(["length","utf8bytelength","not","type","any","all","isempty","empty","test","startswith","endswith","contains","inside","has","in","index","rindex","indices","floor","ceil","round","fabs","sqrt","isinfinite","isnan","isnormal","infinite","nan","true","false","null"]),d0=new Set(["tostring","tojson","ascii_downcase","ascii_upcase","ltrimstr","rtrimstr","trim","ltrim","rtrim","sort","unique","reverse","first","last","min","max","add","flatten","join","split","values","nulls","strings","numbers","booleans","arrays","objects","iterables","scalars","sort_by","group_by","unique_by","min_by","max_by","select","limit","to_entries","from_entries"]),g2=new Set(["test","startswith","endswith","contains","inside","has","in","index","rindex","indices","ltrimstr","rtrimstr","join","split","flatten","limit"]),h2=new Set(["@text","@json","@csv","@tsv","@sh","@base64","@uri","@html"]);class tZ extends Error{}var T=()=>{throw new tZ};function rZ(Z,J){let $=[],X="",z=J+1;while(z<Z.length){let Q=Z[z];if(Q==='"'){if(X)$.push(X);return{end:z+1,parts:$}}if(Q==="\\"){let Y=Z[z+1];if(Y==="("){let G=1,K=z+2;while(K<Z.length&&G>0){let H=Z[K];if(H==='"'){K=rZ(Z,K).end;continue}if(H==="(")G++;else if(H===")")G--;K++}if(G!==0)T();if(X)$.push(X),X="";$.push({src:Z.slice(z+2,K-1)}),z=K;continue}if(Y===void 0)T();X+=Y,z+=2;continue}X+=Q,z++}return T()}function i0(Z){let J=[],$=0,X=["?//","|=","+=","-=","*=","/=","%=","//=","==","!=","<=",">=","//","|",",","+","-","*","/","%","<",">","=","(",")","[","]","{","}",":",";","?"];while($<Z.length){let z=Z[$];if(/\s/.test(z)){$++;continue}if(z==="#")T();if(z==='"'){let K=rZ(Z,$);J.push({t:"str",parts:K.parts}),$=K.end;continue}if(z==="."){if(Z[$+1]===".")T();let K=/^[A-Za-z_][A-Za-z0-9_]*/.exec(Z.slice($+1));if(K){J.push({t:"field",name:K[0]}),$+=1+K[0].length;continue}if(Z[$+1]==='"'){let H=rZ(Z,$+1);if(H.parts.some((B)=>typeof B!=="string"))T();J.push({t:"field",name:H.parts.join("")}),$=H.end;continue}J.push({t:"dot"}),$++;continue}if(z==="$"||z==="@"){let K=/^[@$][A-Za-z_][A-Za-z0-9_]*/.exec(Z.slice($));if(!K||z==="$")T();J.push({t:"fmt",name:K[0]}),$+=K[0].length;continue}let Q=/^[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/.exec(Z.slice($));if(Q){J.push({t:"num"}),$+=Q[0].length;continue}let Y=/^[A-Za-z_][A-Za-z0-9_]*(?:::[A-Za-z_][A-Za-z0-9_]*)*/.exec(Z.slice($));if(Y){J.push({t:"ident",name:Y[0]}),$+=Y[0].length;continue}let G=X.find((K)=>Z.startsWith(K,$));if(!G)T();J.push({t:"op",v:G}),$+=G.length}return J}var u2=new Set(["if","then","elif","else","end","as","def","reduce","foreach","try","catch","label","import","include","and","or","__loc__","error","input","inputs","debug","stderr","env","halt","halt_error","input_filename","input_line_number","recurse","paths","leaf_paths","getpath","setpath","delpaths","del","path","splits","sub","gsub","capture","match","scan","keys","keys_unsorted","map_values","with_entries","tostream","fromstream","truncate_stream","walk","tonumber","implode","explode","ascii","fromjson"]);class eZ{tokens;at=0;constructor(Z){this.tokens=Z}parse(){if(this.tokens.length===0)T();let Z=this.pipe();if(this.at!==this.tokens.length)T();return Z}peek(){return this.tokens[this.at]}isOp(Z){let J=this.peek();return!!J&&J.t==="op"&&J.v===Z}isIdent(Z){let J=this.peek();return!!J&&J.t==="ident"&&J.name===Z}expectOp(Z){if(!this.isOp(Z))T();this.at++}pipe(){let Z=this.comma();if(this.isIdent("as"))T();if(this.isOp("|"))this.at++,Z={k:"pipe",a:Z,b:this.pipe()};return Z}comma(){let Z=this.alt();while(this.isOp(","))this.at++,Z={k:"comma",a:Z,b:this.alt()};return Z}alt(){let Z=this.or();if(this.isOp("//"))return this.at++,{k:"alt",a:Z,b:this.alt()};return Z}or(){let Z=this.and();while(this.isIdent("or"))this.at++,Z={k:"bool",a:Z,b:this.and()};return Z}and(){let Z=this.cmp();while(this.isIdent("and"))this.at++,Z={k:"bool",a:Z,b:this.cmp()};return Z}cmp(){let Z=this.add();for(let J of["==","!=","<=",">=","<",">"])if(this.isOp(J))return this.at++,{k:"bool",a:Z,b:this.add()};for(let J of["=","|=","+=","-=","*=","/=","%=","//=","?//"])if(this.isOp(J))T();return Z}add(){let Z=this.mul();while(this.isOp("+")||this.isOp("-"))this.at++,Z={k:"arith",a:Z,b:this.mul()};return Z}mul(){let Z=this.unary();while(this.isOp("*")||this.isOp("/")||this.isOp("%"))this.at++,Z={k:"arith",a:Z,b:this.unary()};return Z}unary(){if(this.isOp("-"))return this.at++,{k:"neg",of:this.postfix()};return this.postfix()}objectValue(){let Z=this.unary();if(this.isOp("|"))this.at++,Z={k:"pipe",a:Z,b:this.objectValue()};return Z}postfix(){let Z=this.primary();for(;;){let J=this.peek();if(!J)return Z;if(J.t==="field"){this.at++,Z={k:"field",name:J.name,of:Z};continue}if(J.t==="dot"&&this.tokens[this.at+1]?.t==="op"&&this.tokens[this.at+1].v==="["){this.at++;continue}if(J.t==="op"&&J.v==="?"){this.at++,Z={k:"opt",of:Z};continue}if(J.t==="op"&&J.v==="["){Z=this.bracket(Z);continue}return Z}}bracket(Z){if(this.expectOp("["),this.isOp("]"))return this.at++,{k:"iter",of:Z};if(this.isOp(":")){if(this.at++,!this.isOp("]"))this.pipe();return this.expectOp("]"),{k:"slice",of:Z}}let J=this.pipe();if(this.isOp(":")){if(this.at++,!this.isOp("]"))this.pipe();return this.expectOp("]"),{k:"slice",of:Z}}return this.expectOp("]"),{k:"index",of:Z,key:J}}primary(){let Z=this.peek();if(!Z)return T();switch(this.at++,Z.t){case"dot":return{k:"dot"};case"field":return{k:"field",name:Z.name};case"num":return{k:"lit"};case"str":return this.stringNode(Z.parts);case"fmt":{if(!h2.has(Z.name))T();let J=this.peek();if(J?.t==="str")return this.at++,{k:"fmt",name:Z.name,str:this.stringNode(J.parts)};return{k:"fmt",name:Z.name}}case"ident":{if(u2.has(Z.name))T();if(Z.name==="map"||p0.has(Z.name)||d0.has(Z.name)){let J=[];if(this.isOp("(")){this.at++,J.push(this.pipe());while(this.isOp(";"))this.at++,J.push(this.pipe());this.expectOp(")")}return{k:"call",name:Z.name,args:J}}return T()}case"op":{if(Z.v==="("){let J=this.pipe();return this.expectOp(")"),J}if(Z.v==="["){if(this.isOp("]"))return this.at++,{k:"array"};let J=this.pipe();return this.expectOp("]"),{k:"array",of:J}}if(Z.v==="{")return this.object();return T()}}return T()}stringNode(Z){let J=[];for(let $ of Z){if(typeof $==="string")continue;J.push(new eZ(i0($.src)).parse())}return J.length===0?{k:"str",parts:J,text:Z.join("")}:{k:"str",parts:J}}object(){let Z=[];if(this.isOp("}"))return this.at++,{k:"object",entries:Z};for(;;){let J=this.peek();if(!J)T();this.at++;let $;if(J.t==="ident")$=J.name;else if(J.t==="str"){if(J.parts.some((X)=>typeof X!=="string"))T();$=J.parts.join("")}else T();if(this.isOp(":"))this.at++,Z.push({key:"static",value:this.objectValue()});else Z.push({key:"static",value:{k:"field",name:$}});if(this.isOp(",")){this.at++;continue}return this.expectOp("}"),{k:"object",entries:Z}}}}function Z0(Z){if(typeof Z==="object"&&"union"in Z)return Z.union.every(Z0);return Z==="safe"||typeof Z==="object"&&w2.has(Z.leaf)}var IZ=(...Z)=>Z.every(Z0)?"safe":"tainted";function oZ(...Z){let J=[];for(let $ of Z)if(typeof $==="object"&&"union"in $)J.push(...$.union);else J.push($);return J.length===1?J[0]:{union:J}}function RZ(Z,J){return typeof Z==="object"&&"union"in Z?oZ(...Z.union.map(J)):J(Z)}var vZ=(Z)=>typeof Z==="object"&&("leaf"in Z)&&x2.has(Z.leaf),u=(Z)=>RZ(Z,(J)=>J==="safe"?"safe":J==="tainted"||vZ(J)?"tainted":"unknown");function l0(Z){return Z.k==="lit"||Z.k==="str"&&Z.parts.length===0||Z.k==="call"&&["true","false","null"].includes(Z.name)&&Z.args.length===0}function m0(Z,J,$){return RZ(Z,(X)=>{if(X==="safe"||X==="tainted")return X;if(vZ(X))return"tainted";if(X==="root"&&$.rootScalars.has(J))return"safe";return{leaf:J}})}function C(Z,J,$){switch(Z.k){case"dot":return J;case"field":return m0(Z.of?C(Z.of,J,$):J,Z.name,$);case"iter":return u(C(Z.of,J,$));case"index":{let X=C(Z.of,J,$);if(Z.key.k==="str"&&Z.key.text!==void 0)return m0(X,Z.key.text,$);if(Z.key.k==="lit")return u(X);return C(Z.key,J,$),"tainted"}case"slice":return RZ(C(Z.of,J,$),(X)=>X==="root"?"unknown":vZ(X)?"tainted":X);case"opt":return C(Z.of,J,$);case"lit":return"safe";case"str":return IZ(...Z.parts.map((X)=>C(X,J,$)));case"fmt":return Z.str?C(Z.str,J,$):J;case"array":return Z.of?IZ(C(Z.of,J,$)):"safe";case"object":return IZ(...Z.entries.map((X)=>C(X.value,J,$)));case"pipe":return C(Z.b,C(Z.a,J,$),$);case"comma":return oZ(C(Z.a,J,$),C(Z.b,J,$));case"alt":return oZ(C(Z.a,J,$),C(Z.b,J,$));case"bool":return C(Z.a,J,$),C(Z.b,J,$),"safe";case"arith":return IZ(C(Z.a,J,$),C(Z.b,J,$));case"neg":return C(Z.of,J,$);case"call":return l2(Z,J,$)}}var c0=(Z)=>RZ(Z,(J)=>J==="root"?"unknown":vZ(J)?"tainted":J);function l2(Z,J,$){let{name:X,args:z}=Z;if(g2.has(X)&&X!=="limit"&&!z.every(l0))T();switch(X){case"map":if(z.length!==1)T();return IZ(C(z[0],u(J),$));case"select":if(z.length!==1)T();return C(z[0],J,$),J;case"limit":if(z.length!==2||!l0(z[0]))T();return C(z[1],J,$);case"first":case"last":if(z.length>1)T();return z.length===1?C(z[0],J,$):u(J);case"min":case"max":return u(J);case"sort_by":case"group_by":case"unique_by":if(z.length!==1)T();return C(z[0],u(J),$),c0(J);case"min_by":case"max_by":if(z.length!==1)T();return C(z[0],u(J),$),u(J);case"any":case"all":case"isempty":for(let Q of z)C(Q,"unknown",$);return"safe"}if(p0.has(X))return"safe";if(d0.has(X))return c0(J);return T()}function s0(Z,J={}){if(typeof Z!=="string"||!Z.trim()||Z.length>4096)return!1;try{let $=new eZ(i0(Z)).parse();return Z0(C($,"root",{rootScalars:J.rootScalars??new Set}))}catch($){if($ instanceof tZ)return!1;return!1}}var H0="composite output withheld: signed-link shape; use bounded scalar projections per class disposition 799310",q={refused:!1},F=(Z)=>({refused:!0,rule:Z}),$0=new Set(["additions","assignees","author","baseRefName","baseRefOid","changedFiles","closed","closedAt","createdAt","deletions","files","fullDatabaseId","headRefName","headRefOid","headRepository","headRepositoryOwner","id","isCrossRepository","isDraft","labels","maintainerCanModify","mergeCommit","mergeStateStatus","mergeable","mergedAt","mergedBy","number","potentialMergeCommit","reactionGroups","reviewDecision","reviewRequests","state","title","updatedAt","url"]),J0=new Set(["assignees","author","closed","closedAt","createdAt","id","isPinned","labels","number","reactionGroups","state","stateReason","subIssuesSummary","title","updatedAt","url"]),a0=new Set(["apiUrl","author","createdAt","databaseId","id","isDraft","isImmutable","isLatest","isPrerelease","name","publishedAt","tagName","tarballUrl","targetCommitish","uploadUrl","url","zipballUrl"]),n0=new Set(["answerChosenAt","answerChosenBy","answered","author","closed","closedAt","createdAt","id","labels","locked","number","reactionGroups","state","stateReason","title","updatedAt","url"]),m2=new Set(["assignees","author","authorAssociation","closedAt","commentsCount","createdAt","id","isDraft","isLocked","isPullRequest","labels","number","repository","state","title","updatedAt","url"]),c2=new Set(["author","committer","id","parents","repository","sha","url"]),p2=new Set(["bucket","completedAt","event","name","startedAt","state","workflow"]);function t0(Z){let J=[];for(let $=0;$<Z.length;$++){let X=Z[$];if(X==="\\"){$++;continue}if(X==="'"){let z=Z.indexOf("'",$+1);if(z<0)return!1;$=z;continue}if(X==='"'){$++;while($<Z.length&&Z[$]!=='"')$+=Z[$]==="\\"?2:1;continue}if(X==="{"){J.push({list:!1});continue}if(J.length===0)continue;if(X===","||X==="."&&Z[$+1]===".")J[J.length-1].list=!0;else if(X==="}"&&J.pop().list)return!0}return!1}function XZ(Z){let J="",$=!1,X=0,z=(Q)=>Z[Q]==="`"||Z[Q]==="$"&&/[A-Za-z_{(@*#?$!0-9-]/.test(Z[Q+1]??"");while(X<Z.length){let Q=Z[X];if(Q==="\\"){J+=Z[X+1]??"",X+=2;continue}if(Q==="$"&&Z[X+1]==="'"){$=!0,J+=Q,X++;continue}if(Q==="'"){let Y=Z.indexOf("'",X+1);if(Y<0){$=!0,J+=Z.slice(X+1);break}J+=Z.slice(X+1,Y),X=Y+1;continue}if(Q==='"'){X++;while(X<Z.length&&Z[X]!=='"'){if(Z[X]==="\\"&&/[$`"\\\n]/.test(Z[X+1]??"")){J+=Z[X+1],X+=2;continue}if(z(X))$=!0;J+=Z[X],X++}if(X>=Z.length)$=!0;X++;continue}if(z(X)||Q==="*"||Q==="?"||Q==="[")$=!0;J+=Q,X++}if(!$&&Z.includes("{")&&t0(Z))$=!0;return{value:J,opaque:$,raw:Z}}var s=(Z)=>Z.slice(Z.lastIndexOf("/")+1);function K0(Z,J="word"){let $=[],X=!1;for(let z=0;z<Z.length;z++){let Q=Z[z];if(Q==="\\"){z++;continue}if(J==="word"&&Q==="'"&&!X){let Y=Z.indexOf("'",z+1);if(Y<0)return{bodies:$,complete:!1};z=Y;continue}if(J==="word"&&Q==='"'){X=!X;continue}if(Q==="`"){let Y=z+1;while(Y<Z.length&&Z[Y]!=="`")Y+=Z[Y]==="\\"?2:1;if(Y>=Z.length)return{bodies:$,complete:!1};$.push(Z.slice(z+1,Y)),z=Y;continue}if(Q==="$"&&Z[z+1]==="("){let Y=NZ(Z,z+1);if(Y<0)return{bodies:$,complete:!1};$.push(Z.slice(z+2,Y-1)),z=Y-1}}return{bodies:$,complete:!0}}function zZ(Z,J){let $=new Set(J.values),X={flags:[],positionals:[]},z=(Q,Y)=>({value:Q,opaque:Y.opaque,raw:Y.raw});for(let Q=0;Q<Z.length;Q++){let Y=Z[Q],G=Y.value;if(G==="--"){X.positionals.push(...Z.slice(Q+1));break}if(G.startsWith("--")&&G.length>2){let K=G.indexOf("="),H=K>=0?G.slice(0,K):G;if(K>=0)X.flags.push({name:H,value:z(G.slice(K+1),Y),inline:!0});else if($.has(H)){let B=Z[Q+1];X.flags.push(B?{name:H,value:B}:{name:H,missing:!0}),Q++}else X.flags.push({name:H});continue}if(G.startsWith("-")&&G.length>1){for(let K=1;K<G.length;K++){let H="-"+G[K],B=G.slice(K+1);if(B.startsWith("=")){X.flags.push({name:H,value:z(B.slice(1),Y),inline:!0});break}if(!$.has(H)){X.flags.push({name:H});continue}if(B)X.flags.push({name:H,value:z(B,Y),inline:!0});else{let U=Z[Q+1];X.flags.push(U?{name:H,value:U}:{name:H,missing:!0}),Q++}break}continue}X.positionals.push(Y)}return X}function O(Z,...J){let $=!1;for(let X of Z.flags){if(!J.includes(X.name))continue;if(!X.inline){$=!0;continue}let z=X.value;$=!z.opaque&&["1","t","T","TRUE","true","True"].includes(z.value)}return $}var m=(Z,...J)=>Z.flags.filter(($)=>J.includes($.name)),S=["-R","--repo","-q","--jq","-t","--template","--json"],a={"pr view":{values:S},"issue view":{values:S},"release view":{values:S},"discussion view":{values:[...S,"--after","-L","--limit","--order"]},"pr list":{values:[...S,"--app","-a","--assignee","-A","--author","-B","--base","-H","--head","-l","--label","-L","--limit","-S","--search","-s","--state"]},"issue list":{values:[...S,"--app","-a","--assignee","-A","--author","-l","--label","-L","--limit","--mention","-m","--milestone","-S","--search","-s","--state"]},"discussion list":{values:[...S,"--after","-A","--author","-c","--category","-l","--label","-L","--limit","--order","-S","--search","--sort","-s","--state"]},"release list":{values:[...S,"-L","--limit","-O","--order"]},"pr status":{values:S},"issue status":{values:S},"pr checks":{values:[...S,"-i","--interval"]},"pr diff":{values:["-R","--repo"]},search:{values:[...S,"--app","--assignee","--author","--author-date","--author-email","--author-name","--base","--checks","--closed","--commenter","--committer","--committer-date","--committer-email","--committer-name","--created","--hash","--head","--interactions","--involves","--label","--language","--limit","-L","--match","--mentions","--merged-at","--milestone","--no-assignee","--no-label","--no-milestone","--no-project","--order","--owner","--parent","--project","--reactions","--review","--review-requested","--reviewed-by","--sort","--state","--team-mentions","--tree","--updated","--visibility","--extension","--filename","--size","--forks","--good-first-issue","--help-wanted-issues","--number-topics","--stars","--topic","--followers","--include-forks","--license"]},"project item-list":{values:["--format","-L","--limit","--owner","-q","--jq","-t","--template","--query","--field","--field-id"]},api:{values:["-X","--method","-H","--header","-f","--raw-field","-F","--field","-q","--jq","-t","--template","-p","--preview","--input","--hostname","--cache"]},group:{values:["-R","--repo"]}},d2=new Set(["auth","browse","codespace","cs","gist","org","repo","skill","cache","run","workflow","co","agent-task","alias","attestation","completion","config","copilot","extension","ext","extensions","gpg-key","label","licenses","preview","ruleset","secret","ssh-key","variable","help","version","accessibility","actions","environment","exit-codes","formatting","mintty","reference","telemetry"]),i2=new Set(["pr","issue","release","discussion","search","project","api","status"]),s2=new Set(["create","new","checkout","co","close","comment","edit","lock","merge","ready","reopen","revert","review","unlock","update-branch"]),a2=new Set(["create","new","close","comment","delete","develop","edit","lock","pin","reopen","transfer","unlock","unpin"]),n2=new Set(["create","new","delete","delete-asset","download","edit","upload","verify","verify-asset"]),r2=new Set(["create","new","close","comment","delete","edit","lock","reopen","unlock","answer","unanswer"]);function fZ(Z,J){let $=m(Z,"--json"),X=[],z=!1;for(let Q of $){if(Q.missing){if(J.appendsArgs)z=!0;continue}if(!Q.value)continue;if(Q.value.opaque)z=!0;X.push(...Q.value.value.split(",").map((Y)=>Y.trim()).filter(Boolean))}return{present:$.length>0,opaque:z,fields:X}}function B0(Z,J){if(O(Z,"--verbose")||m(Z,"-t","--template").length>0)return!1;let $=m(Z,"-q","--jq");return $.length>0&&$.every((X)=>X.value!==void 0&&!X.value.opaque&&s0(X.value.value,{rootScalars:J}))}function U0(Z,J,$,X){let z=fZ(Z,$);if(z.opaque)return F("unclassifiable");if(z.fields.every((Q)=>J.has(Q)))return q;if($.debug)return F("debug-traffic");return B0(Z)?q:F(X)}function yZ(Z,J,$,X,z){let Q=zZ(Z,a[J]);if(O(Q,"-h","--help"))return q;if(O(Q,"-w","--web"))return X.debug?F("debug-traffic"):q;if(z&&O(Q,"-c","--comments"))return F("view-comments");if(!fZ(Q,X).present)return F(X.debug?"debug-traffic":"view-human");return U0(Q,$,X,"json-composite")}function l(Z,J,$,X){let z=zZ(Z,a[J]);if(O(z,"-h","--help"))return q;if(X.debug&&(O(z,"-w","--web")||!fZ(z,X).present))return F("debug-traffic");if(O(z,"-w","--web"))return q;return U0(z,$,X,"json-composite")}function o2(Z,J){let $=zZ(Z,a["pr checks"]);if(O($,"-h","--help"))return q;if(J.debug)return F("debug-traffic");if(O($,"-w","--web"))return q;if(!fZ($,J).present)return F("checks-human");return U0($,p2,J,"checks-json")}function t2(Z){let J=new Set(a.group.values);for(let $=0;$<Z.length;$++){let X=Z[$].value;if(X==="--")return{sub:Z[$+1],rest:Z.slice($+2)};if(!X.startsWith("-")||X==="-")return{sub:Z[$],rest:[...Z.slice(0,$),...Z.slice($+1)]};if(J.has(X))$++}return{rest:Z}}function e2(Z,J,$){let{sub:X,rest:z}=t2(J);if(!X)return $.appendsArgs?F("unclassifiable"):q;if(X.opaque)return F("unclassifiable");let Q=X.value;if((Z==="pr"?s2:Z==="issue"?a2:Z==="release"?n2:Z==="discussion"?r2:new Set).has(Q))return $.debug?F("debug-traffic"):q;if($.appendsArgs&&!(Z==="project"&&Q!=="item-list"))return F("unclassifiable");switch(Z){case"pr":if(Q==="view")return yZ(z,"pr view",$0,$,!0);if(Q==="list"||Q==="ls")return l(z,"pr list",$0,$);if(Q==="status")return l(z,"pr status",$0,$);if(Q==="checks")return o2(z,$);if(Q==="diff"){let G=zZ(z,a["pr diff"]);if(O(G,"-h","--help"))return q;if($.debug)return F("debug-traffic");return O(G,"--patch")?F("composite-other"):q}return F("unclassifiable");case"issue":if(Q==="view")return yZ(z,"issue view",J0,$,!0);if(Q==="list"||Q==="ls")return l(z,"issue list",J0,$);if(Q==="status")return l(z,"issue status",J0,$);return F("unclassifiable");case"release":if(Q==="view")return yZ(z,"release view",a0,$,!1);if(Q==="list"||Q==="ls")return l(z,"release list",a0,$);return F("unclassifiable");case"discussion":if(Q==="view")return yZ(z,"discussion view",n0,$,!0);if(Q==="list"||Q==="ls")return l(z,"discussion list",n0,$);return F("unclassifiable");case"search":if(Q==="prs"||Q==="issues")return l(z,"search",m2,$);if(Q==="commits")return l(z,"search",c2,$);if(Q==="code"||Q==="repos")return $.debug?F("debug-traffic"):q;return F("unclassifiable");case"project":{if($.debug)return F("debug-traffic");if(Q!=="item-list")return q;let G=zZ(z,a["project item-list"]);if(O(G,"-h","--help"))return q;let K=m(G,"--format");if(K.some((H)=>!H.value||H.value.opaque))return F("unclassifiable");if(K.every((H)=>H.value.value!=="json"))return q;return B0(G)?q:F("composite-other")}}return F("unclassifiable")}var e0=new Set(["pulls","issues","commits","check-runs","check-suites","statuses","comments","releases","compare","events","discussions","deployments","milestones"]);function Z3(Z){let J=Z.value.trim(),$=/^https?:\/\/([^/]+)(\/.*)?$/i.exec(J);if($){let Q=$[1].toLowerCase(),Y=$[2]??"/";if(Q==="api.github.com"||/^api\./.test(Q))J=Y;else if(/^\/api\/v3(?:\/|$)/i.test(Y))J=Y.replace(/^\/api\/v3/i,"");else if(/^\/api\/graphql(?:[/?#]|$)/i.test(Y))J="graphql";else return null}J=J.replace(/[?#].*$/,"");let X=[],z=[];for(let Q of J.split("/")){let Y;try{Y=decodeURIComponent(Q)}catch{return null}for(let G of Y.split("/")){if(G===""||G===".")continue;if(G===".."){X.pop(),z.pop();continue}X.push(G.toLowerCase()),z.push(Z.opaque&&/[$`]/.test(G)||/[*?[]/.test(G)||t0(G))}}return{segments:X,opaque:z}}function $3(Z){let J=Z3(Z);if(!J)return{kind:"unclassifiable",segments:[]};let{segments:$,opaque:X}=J,z=(K)=>({kind:K,segments:$});if($.length===1&&$[0]==="graphql")return z("graphql");if($.length===0)return z(Z.opaque?"unclassifiable":"other");if(X[0])return z("unclassifiable");let Q,Y=[];if($[0]==="repos")Q=$.slice(3),Y=X.slice(3);else if($[0]==="repositories")Q=$.slice(2),Y=X.slice(2);if(Q){if(($[0]==="repos"?X.slice(1,3):X.slice(1,2)).some(Boolean)){let H=X.findIndex(Boolean),B=$.findIndex((U,V)=>V>H&&!X[V]&&J3.has(U));return z(B<0?"unclassifiable":r0($.slice(B),X.slice(B)))}return z(r0(Q,Y))}let G=$[0];if(G==="issues")return z("sensitive");if(G==="user"&&$[1]==="issues")return z("sensitive");if(G==="orgs"&&$[2]==="issues")return z("sensitive");if(G==="search")return z($[1]==="issues"||$[1]==="commits"?"sensitive":$[1]!==void 0&&X[1]?"unclassifiable":"other");if(G==="events"||G==="networks")return z("sensitive");if((G==="users"||G==="orgs")&&$.slice(2).some((K)=>K==="events"||K==="received_events"||K==="discussions"))return z("sensitive");if((G==="users"||G==="orgs")&&$[2]==="projectsv2"&&$[4]==="items")return z("sensitive");if(G==="orgs"&&$[2]==="hooks"&&$[4]==="deliveries"&&$[5]!==void 0||G==="app"&&$[1]==="hook"&&$[2]==="deliveries"&&$[3]!==void 0)return z("sensitive");if(G==="teams"&&$.includes("discussions"))return z("sensitive");if(G==="projects"&&$.includes("cards"))return z("sensitive");if(X.some(Boolean))return z($.some((K)=>K==="events"||K==="discussions"||K==="issues")?"sensitive":"unclassifiable");return z("other")}var J3=new Set([...e0,"branches","git","actions","hooks","zipball","tarball"]);function r0(Z,J){let[$,X]=Z;if($===void 0)return"other";if(J[0])return"unclassifiable";if($==="issues"&&/^\d+$/.test(X??"")&&Z[2]==="labels")return"other";if(e0.has($))return"sensitive";if($==="branches"){if(Z.length===1||Z.slice(1).some((z)=>z==="protection")||Z[Z.length-1]==="rename")return"other";return J.slice(1).some(Boolean)?"unclassifiable":"sensitive"}if($==="git")return X===void 0||X==="commits"||X==="tags"?"sensitive":J[1]?"unclassifiable":"other";if($==="actions"){if(X===void 0)return"sensitive";if(J[1])return"unclassifiable";if(X==="runs"||X==="jobs"){if(Z[Z.length-1]==="logs"&&Z.length>=4&&!J.some(Boolean))return"download";return"sensitive"}if(X==="workflows"&&Z[3]==="runs")return"sensitive";if(X==="artifacts"&&Z.length===4)return"download";return"other"}if($==="hooks"&&Z[2]==="deliveries"&&Z[3]!==void 0)return"sensitive";if($==="zipball"||$==="tarball")return"download";return"other"}function X3(Z,J){if(J[0]!=="repos"||J.length<5)return!1;let $=J.slice(3),X=(Q)=>/^\d+$/.test($[Q]??""),z=(...Q)=>$.length===Q.length&&Q.every((Y,G)=>typeof Y==="number"?X(G):$[G]===Y);if(Z==="DELETE")return z("issues","comments",0)||z("pulls","comments",0)||z("comments",0)||z("issues","comments",0,"reactions",0)||z("pulls","comments",0,"reactions",0)||z("issues",0,"reactions",0)||z("issues",0,"labels")||$.length===4&&$[0]==="issues"&&X(1)&&$[2]==="labels"||z("releases",0)||z("releases","assets",0)||z("actions","runs",0)||z("actions","runs",0,"logs")||z("deployments",0)||z("milestones",0)||z("issues",0,"lock");if(Z==="POST")return $.length===4&&$[0]==="actions"&&$[1]==="runs"&&X(2)&&["rerun","rerun-failed-jobs","cancel","force-cancel","approve"].includes($[3])||z("actions","jobs",0,"rerun")||z("issues",0,"labels");if(Z==="PUT")return z("pulls",0,"merge")||z("pulls",0,"update-branch")||z("issues",0,"labels")||z("issues",0,"lock");if(Z==="GET")return z("pulls",0,"merge");return!1}function z3(Z){if(Z[0]!=="repos"||Z.length!==5||!/^\d+$/.test(Z[4]))return;if(Z[3]==="pulls")return new Set(["commits","comments","review_comments"]);if(Z[3]==="issues")return new Set(["comments"]);return}var K3=new Set(["body","bodyText","bodyHTML","bodyUrl","bodyResourcePath","comments","reviews","latestReviews","latestOpinionatedReviews","reviewThreads","url","permalink","summary","text","description","message","messageBody","messageHeadline","commitBody","commitHeadline","annotations","rawDetails","note","diff","readme","payload"]),Q3=new Set(["checkRuns","checkRun","checkSuites","checkSuite","contexts","statusCheckRollup","annotations","CheckRun","CheckSuite","StatusContext","CheckAnnotation","latestStatus","status","statuses"]);function Y3(Z){let J=[],$=0;while($<Z.length){let X=Z[$];if(/[\s,\uFEFF]/.test(X)){$++;continue}if(X==="#"){let Y=Z.indexOf(`
 `,$);$=Y<0?Z.length:Y+1;continue}if(Z.startsWith('"""',$)){let Y=$+3;for(;;){let G=Z.indexOf('"""',Y);if(G<0)return null;if(Z[G-1]==="\\"){Y=G+3;continue}$=G+3;break}continue}if(X==='"'){let Y=$+1;while(Y<Z.length&&Z[Y]!=='"'&&Z[Y]!==`
-`)Y+=Z[Y]==="\\"?2:1;if(Z[Y]!=='"')return null;$=Y+1;continue}let z=/^[_A-Za-z][_0-9A-Za-z]*/.exec(Z.slice($,$+256));if(z){J.push({kind:"name",text:z[0]}),$+=z[0].length;continue}let Q=/^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(Z.slice($,$+64));if(Q){$+=Q[0].length;continue}if(Z.startsWith("...",$)){J.push({kind:"punct",text:"..."}),$+=3;continue}if("{}()[]:!$@=|&".includes(X)){J.push({kind:"punct",text:X}),$++;continue}return null}return J}function j3(Z){let J=N3(Z);if(!J)return!0;let $=[],X="",z=0;for(let Q=0;Q<J.length;Q++){let Y=J[Q];if(Y.kind==="punct"){if(Y.text==="(")z++;else if(Y.text===")"){if(z--,z<0)return!0}else if(z===0&&Y.text==="{")$.push(X),X="";else if(z===0&&Y.text==="}"){if($.pop()===void 0)return!0;X=""}continue}if(z>0)continue;let G=J[Q-1];if(G?.kind==="punct"&&(G.text==="@"||G.text==="$"))continue;if(J[Q+1]?.kind==="punct"&&J[Q+1].text===":")continue;if(Y.text==="on"&&G?.kind==="punct"&&G.text==="...")continue;if(G?.kind==="name"&&G.text==="on"){X=Y.text;continue}if($.length===0){X=Y.text;continue}if(F3.has(Y.text)||/(?:Url|URL|HTML|Html)$/.test(Y.text))return!0;if(Y.text==="title"&&$.some((K)=>q3.has(K)))return!0;X=Y.text}return z!==0||$.length!==0}function _3(Z,J){let $=QZ(Z,r.api);if(E($,"-h","--help"))return q;let X=$.positionals[0];if(!X)return J.appendsArgs?F("unclassifiable"):q;let z=B3(X),Q=c($,"-X","--method"),Y=Q[Q.length-1],G=c($,"-f","--raw-field","-F","--field","--input"),K=Y?Y.value&&!Y.value.opaque?Y.value.value.toUpperCase():"?":G.length>0?"POST":"GET",H=V3(K,z.segments),B=q;if(z.kind==="unclassifiable")B=F("unclassifiable");else if(z.kind==="sensitive"&&!H)B=F("api-rest");else if(z.kind==="graphql")B=W3($);if(J.debug||E($,"--verbose")){if(z.kind==="download"&&!B.refused)B=F("api-rest");if(B.refused)return J.debug?F("debug-traffic"):B;return q}if(J.appendsArgs&&z.kind!=="other"&&z.kind!=="download")return F("unclassifiable");if(!B.refused||E($,"--silent"))return q;if(q0($,M3(z.segments)))return q;return B}function W3(Z){if(c(Z,"--input").length>0)return F("unclassifiable");let J=c(Z,"-f","--raw-field","-F","--field"),$=J.filter((X)=>X.value&&/^query=/.test(X.value.value));if($.length===0||J.some((X)=>!X.value))return F("unclassifiable");for(let X of $){let z=X.value.value.slice(6);if((X.name==="-F"||X.name==="--field")&&z.startsWith("@")||X.value.opaque)return F("unclassifiable");if(j3(z))return F("api-graphql")}return q}function kZ(Z,J){let $=0;while($<Z.length&&Z[$].value.startsWith("-")&&!Z[$].opaque){if(["--help","-h","--version"].includes(Z[$].value))return q;$++}if($>=Z.length)return J.appendsArgs?F("unclassifiable"):q;let X=Z[$],z=Z.slice($+1);if(X.opaque)return F("unclassifiable");switch(X.value){case"pr":case"issue":case"release":case"discussion":case"search":case"project":return G3(X.value,z,J);case"api":return _3(z,J);case"status":return z.length>0&&z.every((Q)=>Q.value==="-h"||Q.value==="--help")?q:F("composite-other");case"help":case"version":return q;case"cs":case"codespace":{let Q=z.findIndex((Y)=>Y.value==="--");if(z.some((Y)=>Y.value==="ssh")&&Q>=0&&Q+1<z.length){let Y=g(z.slice(Q+1).map((G)=>G.value).join(" "),J.depth+1,J.debug);if(Y.refused)return Y}break}}if(!Z3.has(X.value))return F("unclassifiable");if(J.debug)return F("debug-traffic");return q}var xZ=new Set(["sh","bash","zsh","dash","ksh","ash","mksh","fish"]),T3=new Set(["su","runuser","script","flock"]),C3=new Set(["secrets","op","unbuffer","caffeinate","chronic","strace","ltrace","firejail","bwrap","nsenter","unshare","chroot","sg","retry","parallel","doppler","aws-vault","dotenv","direnv","faketime","taskset","numactl","cgexec","systemd-run","docker","podman","kubectl","mise","asdf","rtx","devbox","gosu","su-exec","setpriv","pkexec","with-contenv","uv","poetry","pipenv","npx","bunx","pnpm","yarn","nix","nix-shell","infisical","chamber","envchain","dotenvx","teller","vault","chrt","coproc","prlimit","ionice","cpulimit","trickle","proxychains","proxychains4","torsocks","tsocks","catchsegv","valgrind"]),I3=new Map([["bun",["x","exec"]],["npm",["exec","x"]],["deno",["run"]]]),D3=new Set(["-I","-L","-l","-n","-P","-s","-d","-E","-e","-a","--arg-file","--delimiter","--max-args","--max-lines","--max-procs","--max-chars","--replace","--eof","--process-slot-var"]),A3=new Set(["-b","-c","-D","-E","-e","-F","-I","-i","-J","-L","-l","-m","-O","-o","-p","-Q","-R","-S","-W","-w"]),fZ=/(?:^|[^A-Za-z0-9_.-])gh(?:$|[^A-Za-z0-9_.-])/,L3=/^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]*)$/,P3=6;function K1(Z,J){let $,X;for(let z of Z){let Q=L3.exec(z.value);if(!Q)continue;let Y={...z,value:Q[2]};if(Q[1]==="GH_DEBUG")$=Y;else if(Q[1]==="DEBUG")X=Y}if($)return $.opaque||!["","0","false","no"].includes($.value);if(X&&(X.opaque||["1","true","yes","api"].includes(X.value)))return!0;return J}function j0(Z){let J=a(Z),$=0;return{segments:J.segments.map((z)=>{let Q=z.words[0],Y=Z.slice($,Q.start);return $=z.words[z.words.length-1].end,{words:z.words,redirects:z.redirects,sepBefore:Y}}),trustworthy:J.trustworthy}}var G1=(Z)=>/(?:^|[^|])\|&?$/.test(Z.trim());function U0(Z,J){if(!xZ.has(Z))return!1;if(_0(J))return!1;for(let $=0;$<J.length;$++){let X=J[$].value;if(X==="--")return $+1>=J.length;if(X==="-"||X==="-s")return!0;if(/^[-+][A-Za-z]*[oO]$/.test(X)){$++;continue}if(!X.startsWith("-")&&!X.startsWith("+"))return!1}return!0}function V0(Z){let{segments:J}=j0(Z.trim());if(J.length!==1)return null;let $=J[0],X=x($);if(X<0)return null;let z=n(KZ($.words[X].text).value),Q=$.words.slice(X+1).filter((Y,G)=>!$.redirects.has(G+X+1)).map((Y)=>KZ(Y.text));if(z==="echo")return Q.filter((Y,G)=>!(G===0&&/^-[neE]+$/.test(Y.value))).map((Y)=>Y.value).join(" ");if(z==="printf"){let[Y,...G]=Q.filter((H)=>H.value!=="--");if(!Y)return null;let K=0;return Y.value.replace(/\\n/g,`
-`).replace(/%s/g,()=>G[K++]?.value??"")+(K<G.length?" "+G.slice(K).map((H)=>H.value).join(" "):"")}if(z==="cat"){let Y=Z.indexOf("<<");if(Y<0)return null;let G=JZ(Z,Y),K=Z.indexOf(`
-`,Y);if(!G||K<0)return null;let H=vZ(Z,K,[G]);if(H<0)return null;let B=Z.slice(K+1,H);return B.slice(0,B.lastIndexOf(G.delimiter)).replace(/\n$/,"")}return null}function G0(Z,J,$){for(let X of B0(Z).bodies){let z=V0(X);if(z===null)continue;let Q=g(z,J+1,$.debug);if(Q.refused)return Q}return q}function g(Z,J=0,$=!1){if(typeof Z!=="string"||!Z.trim())return q;if(J>P3)return fZ.test(Z)?F("unclassifiable"):q;let{segments:X,trustworthy:z}=j0(Z);if(!z)return fZ.test(Z)?F("unclassifiable"):q;let Q=$,Y=(G)=>g(G,J+1,Q);for(let G of R3(Z)){if(G.runsBody){let K=Y(G.body);if(K.refused)return K}if(!G.quoted){let K=B0(G.body,"heredoc");if(!K.complete&&fZ.test(G.body))return F("unclassifiable");for(let H of K.bodies){let B=Y(H);if(B.refused)return B}}}for(let G=0;G<X.length;G++){let K=X[G];for(let D of K.words){let O=B0(D.text);if(!O.complete&&fZ.test(D.text))return F("unclassifiable");for(let y of O.bodies){let S=Y(y);if(S.refused)return S}}let H=x(K),B=K.words.map((D,O)=>({word:KZ(D.text),redirect:K.redirects.has(O)})),U=B.slice(0,H<0?B.length:H).map((D)=>D.word),V=H>=0?n(B[H].word.value):"";if(H<0||["export","declare","typeset","readonly","local"].includes(V)){if(Q=K1([...U,...B.slice(H+1).map((D)=>D.word)],Q),H<0)continue}let I=K1(U,Q),_=B.slice(H+1).filter((D)=>!D.redirect).map((D)=>D.word),P=B.slice(H+1).filter((D)=>D.redirect).map((D)=>D.word),M=B[H].word,j=n(M.value),h={depth:J,appendsArgs:!1,debug:I};if(H>0&&B[H-1].word.value==="function"){let D=_.filter((y)=>!["{","()","(",")"].includes(y.value)),O=M0(D,h);if(O.refused)return O;continue}if(G>0&&G1(K.sepBefore)&&U0(j,_)){let D=X[G-1],O=O3(Z,D),y=O===null?null:V0(O);if(y!==null){let S=g(y,J+1,I);if(S.refused)return S}}let u=X[G+1];if(u&&/<\(\s*$/.test(u.sepBefore)&&(xZ.has(j)||j==="source"||j===".")){let D=u.words[0].start-u.sepBefore.length+u.sepBefore.lastIndexOf("("),O=_Z(Z,D),y=O<0?null:V0(Z.slice(D+1,O-1));if(y!==null){let S=g(y,J+1,I);if(S.refused)return S}}let d=H1(j,M,_,P,K.words.slice(0,H+1),h);if(d.refused)return d}return q}function O3(Z,J){let $=J.words[0],X=J.words[J.words.length-1];return $&&X?Z.slice($.start,X.end):null}function E3(Z){let J=n(Z.value);return/[$`]/.test(J)||J===""?void 0:J}function H1(Z,J,$,X,z,Q){let Y=Q.depth,G=(K)=>g(K,Y+1,Q.debug);if(J.opaque){let K=E3(J);if(K===void 0){let H=$.find((U)=>!U.value.startsWith("-")),B=kZ($,Q);if(!B.refused)return q;return B.rule!=="unclassifiable"||H!==void 0&&!H.opaque&&$3.has(H.value)?B:q}Z=K}if(Z==="gh")return kZ($,Q);if(xZ.has(Z)){let K=_0($);if(K){let H=G(K.value);if(H.refused||!K.opaque)return H;return G0(K.raw,Y,Q)}for(let H of X){let B=G(H.value);if(B.refused)return B;if(H.opaque){let U=G0(H.raw,Y,Q);if(U.refused)return U}}return q}if(T3.has(Z)){let K=$.findIndex((B)=>B.value==="-c"||B.value==="--command"||/^-[A-Za-z]*c$/.test(B.value)),H=K>=0?$[K+1]:void 0;return H?G(H.value):H0($,Q)}if(Z==="eval"||Z==="watch"){let K=$;if(Z==="watch"){let B=0;while(B<$.length&&$[B].value.startsWith("-")){if($[B].value==="--"){B++;break}if(["-n","--interval","-q","--equexit"].includes($[B].value))B++;B++}K=$.slice(B)}let H=G(K.map((B)=>B.value).join(" "));if(H.refused)return H;for(let B of K){let U=G0(B.raw,Y,Q);if(U.refused)return U}return q}if(Z==="env")return G(jZ([...z.map((K)=>KZ(K.text).value),...$.map((K)=>K.value)]));if(Z==="ssh"){let K=0;for(;K<$.length;K++){let U=$[K].value;if(!U.startsWith("-"))break;if(A3.has(U))K++}let H=$.slice(K+1);if(H[0]?.value==="--")H.shift();let B=H.map((U)=>U.value).join(" ");return B?G(B):q}if(Z==="xargs"){let K=0,H=!1;for(;K<$.length;K++){let B=$[K].value;if(B==="--"){K++;break}if(!B.startsWith("-"))break;if(/^-I|^-i|^--replace/.test(B))H=!0;if(D3.has(B))K++}return M0($.slice(K),{depth:Y,appendsArgs:!H,debug:Q.debug})}if(Z==="find"){for(let K=0;K<$.length;K++){if(!["-exec","-execdir","-ok","-okdir"].includes($[K].value))continue;let H=K+1;while(H<$.length&&$[H].value!==";"&&$[H].value!=="+")H++;let B=M0($.slice(K+1,H),Q);if(B.refused)return B;K=H}return q}if(C3.has(Z))return H0($,Q);if(I3.get(Z)?.includes($[0]?.value??""))return H0($.slice(1),Q);return q}function M0(Z,J){if(Z.length===0)return q;let $=n(Z[0].value);if($==="gh")return kZ(Z.slice(1),J);if(xZ.has($)){let X=_0(Z.slice(1));return X?g(X.value,J.depth+1,J.debug):q}return H1($,Z[0],Z.slice(1),[],[],J)}function H0(Z,J){let $=Z.findIndex((X)=>!X.opaque&&n(X.value)==="gh"&&(X.value==="gh"||X.value.includes("/")));return $>=0?kZ(Z.slice($+1),J):q}function _0(Z){for(let J=0;J<Z.length;J++){let $=Z[J].value;if($==="--")return;if(!$.startsWith("-")&&!$.startsWith("+"))return;if($==="-c"||/^-[A-Za-z]+$/.test($)&&$.includes("c"))return Z.slice(J+1).find((X)=>!X.value.startsWith("-")||X.value==="-");if(/^[-+][A-Za-z]*[oO]$/.test($))J++}return}function R3(Z){let J=[],$=0;for(;;){let X=Z.indexOf("<<",$);if(X<0)break;if($=X+2,Z[X+2]==="<"||X>0&&Z[X-1]==="<"){$=X+3;continue}let z=JZ(Z,X);if(!z)continue;let Q=Z.lastIndexOf(`
+`)Y+=Z[Y]==="\\"?2:1;if(Z[Y]!=='"')return null;$=Y+1;continue}let z=/^[_A-Za-z][_0-9A-Za-z]*/.exec(Z.slice($,$+256));if(z){J.push({kind:"name",text:z[0]}),$+=z[0].length;continue}let Q=/^-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/.exec(Z.slice($,$+64));if(Q){$+=Q[0].length;continue}if(Z.startsWith("...",$)){J.push({kind:"punct",text:"..."}),$+=3;continue}if("{}()[]:!$@=|&".includes(X)){J.push({kind:"punct",text:X}),$++;continue}return null}return J}function G3(Z){let J=Y3(Z);if(!J)return!0;let $=[],X="",z=0;for(let Q=0;Q<J.length;Q++){let Y=J[Q];if(Y.kind==="punct"){if(Y.text==="(")z++;else if(Y.text===")"){if(z--,z<0)return!0}else if(z===0&&Y.text==="{")$.push(X),X="";else if(z===0&&Y.text==="}"){if($.pop()===void 0)return!0;X=""}continue}if(z>0)continue;let G=J[Q-1];if(G?.kind==="punct"&&(G.text==="@"||G.text==="$"))continue;if(J[Q+1]?.kind==="punct"&&J[Q+1].text===":")continue;if(Y.text==="on"&&G?.kind==="punct"&&G.text==="...")continue;if(G?.kind==="name"&&G.text==="on"){X=Y.text;continue}if($.length===0){X=Y.text;continue}if(K3.has(Y.text)||/(?:Url|URL|HTML|Html)$/.test(Y.text))return!0;if(Y.text==="title"&&$.some((K)=>Q3.has(K)))return!0;X=Y.text}return z!==0||$.length!==0}function H3(Z,J){let $=zZ(Z,a.api);if(O($,"-h","--help"))return q;let X=$.positionals[0];if(!X)return J.appendsArgs?F("unclassifiable"):q;let z=$3(X),Q=m($,"-X","--method"),Y=Q[Q.length-1],G=m($,"-f","--raw-field","-F","--field","--input"),K=Y?Y.value&&!Y.value.opaque?Y.value.value.toUpperCase():"?":G.length>0?"POST":"GET",H=X3(K,z.segments),B=q;if(z.kind==="unclassifiable")B=F("unclassifiable");else if(z.kind==="sensitive"&&!H)B=F("api-rest");else if(z.kind==="graphql")B=B3($);if(J.debug||O($,"--verbose")){if(z.kind==="download"&&!B.refused)B=F("api-rest");if(B.refused)return J.debug?F("debug-traffic"):B;return q}if(J.appendsArgs&&z.kind!=="other"&&z.kind!=="download")return F("unclassifiable");if(!B.refused||O($,"--silent"))return q;if(B0($,z3(z.segments)))return q;return B}function B3(Z){if(m(Z,"--input").length>0)return F("unclassifiable");let J=m(Z,"-f","--raw-field","-F","--field"),$=J.filter((X)=>X.value&&/^query=/.test(X.value.value));if($.length===0||J.some((X)=>!X.value))return F("unclassifiable");for(let X of $){let z=X.value.value.slice(6);if((X.name==="-F"||X.name==="--field")&&z.startsWith("@")||X.value.opaque)return F("unclassifiable");if(G3(z))return F("api-graphql")}return q}function bZ(Z,J){let $=0;while($<Z.length&&Z[$].value.startsWith("-")&&!Z[$].opaque){if(["--help","-h","--version"].includes(Z[$].value))return q;$++}if($>=Z.length)return J.appendsArgs?F("unclassifiable"):q;let X=Z[$],z=Z.slice($+1);if(X.opaque)return F("unclassifiable");switch(X.value){case"pr":case"issue":case"release":case"discussion":case"search":case"project":return e2(X.value,z,J);case"api":return H3(z,J);case"status":return z.length>0&&z.every((Q)=>Q.value==="-h"||Q.value==="--help")?q:F("composite-other");case"help":case"version":return q;case"cs":case"codespace":{let Q=z.findIndex((Y)=>Y.value==="--");if(z.some((Y)=>Y.value==="ssh")&&Q>=0&&Q+1<z.length){let Y=x(z.slice(Q+1).map((G)=>G.value).join(" "),J.depth+1,J.debug);if(Y.refused)return Y}break}}if(!d2.has(X.value))return F("unclassifiable");if(J.debug)return F("debug-traffic");return q}var kZ=new Set(["sh","bash","zsh","dash","ksh","ash","mksh","fish"]),U3=new Set(["su","runuser","script","flock"]),V3=new Set(["secrets","op","unbuffer","caffeinate","chronic","strace","ltrace","firejail","bwrap","nsenter","unshare","chroot","sg","retry","parallel","doppler","aws-vault","dotenv","direnv","faketime","taskset","numactl","cgexec","systemd-run","docker","podman","kubectl","mise","asdf","rtx","devbox","gosu","su-exec","setpriv","pkexec","with-contenv","uv","poetry","pipenv","npx","bunx","pnpm","yarn","nix","nix-shell","infisical","chamber","envchain","dotenvx","teller","vault","chrt","coproc","prlimit","ionice","cpulimit","trickle","proxychains","proxychains4","torsocks","tsocks","catchsegv","valgrind"]),M3=new Map([["bun",["x","exec"]],["npm",["exec","x"]],["deno",["run"]]]),F3=new Set(["-I","-L","-l","-n","-P","-s","-d","-E","-e","-a","--arg-file","--delimiter","--max-args","--max-lines","--max-procs","--max-chars","--replace","--eof","--process-slot-var"]),q3=new Set(["-b","-c","-D","-E","-e","-F","-I","-i","-J","-L","-l","-m","-O","-o","-p","-Q","-R","-S","-W","-w"]),SZ=/(?:^|[^A-Za-z0-9_.-])gh(?:$|[^A-Za-z0-9_.-])/,N3=/^([A-Za-z_][A-Za-z0-9_]*)=([\s\S]*)$/,_3=6;function o0(Z,J){let $,X;for(let z of Z){let Q=N3.exec(z.value);if(!Q)continue;let Y={...z,value:Q[2]};if(Q[1]==="GH_DEBUG")$=Y;else if(Q[1]==="DEBUG")X=Y}if($)return $.opaque||!["","0","false","no"].includes($.value);if(X&&(X.opaque||["1","true","yes","api"].includes(X.value)))return!0;return J}function V0(Z){let J=i(Z),$=0;return{segments:J.segments.map((z)=>{let Q=z.words[0],Y=Z.slice($,Q.start);return $=z.words[z.words.length-1].end,{words:z.words,redirects:z.redirects,sepBefore:Y}}),trustworthy:J.trustworthy}}var Z1=(Z)=>/(?:^|[^|])\|&?$/.test(Z.trim());function Q0(Z,J){if(!kZ.has(Z))return!1;if(M0(J))return!1;for(let $=0;$<J.length;$++){let X=J[$].value;if(X==="--")return $+1>=J.length;if(X==="-"||X==="-s")return!0;if(/^[-+][A-Za-z]*[oO]$/.test(X)){$++;continue}if(!X.startsWith("-")&&!X.startsWith("+"))return!1}return!0}function Y0(Z){let{segments:J}=V0(Z.trim());if(J.length!==1)return null;let $=J[0],X=w($);if(X<0)return null;let z=s(XZ($.words[X].text).value),Q=$.words.slice(X+1).filter((Y,G)=>!$.redirects.has(G+X+1)).map((Y)=>XZ(Y.text));if(z==="echo")return Q.filter((Y,G)=>!(G===0&&/^-[neE]+$/.test(Y.value))).map((Y)=>Y.value).join(" ");if(z==="printf"){let[Y,...G]=Q.filter((H)=>H.value!=="--");if(!Y)return null;let K=0;return Y.value.replace(/\\n/g,`
+`).replace(/%s/g,()=>G[K++]?.value??"")+(K<G.length?" "+G.slice(K).map((H)=>H.value).join(" "):"")}if(z==="cat"){let Y=Z.indexOf("<<");if(Y<0)return null;let G=ZZ(Z,Y),K=Z.indexOf(`
+`,Y);if(!G||K<0)return null;let H=EZ(Z,K,[G]);if(H<0)return null;let B=Z.slice(K+1,H);return B.slice(0,B.lastIndexOf(G.delimiter)).replace(/\n$/,"")}return null}function X0(Z,J,$){for(let X of K0(Z).bodies){let z=Y0(X);if(z===null)continue;let Q=x(z,J+1,$.debug);if(Q.refused)return Q}return q}function x(Z,J=0,$=!1){if(typeof Z!=="string"||!Z.trim())return q;if(J>_3)return SZ.test(Z)?F("unclassifiable"):q;let{segments:X,trustworthy:z}=V0(Z);if(!z)return SZ.test(Z)?F("unclassifiable"):q;let Q=$,Y=(G)=>x(G,J+1,Q);for(let G of T3(Z)){if(G.runsBody){let K=Y(G.body);if(K.refused)return K}if(!G.quoted){let K=K0(G.body,"heredoc");if(!K.complete&&SZ.test(G.body))return F("unclassifiable");for(let H of K.bodies){let B=Y(H);if(B.refused)return B}}}for(let G=0;G<X.length;G++){let K=X[G];for(let I of K.words){let P=K0(I.text);if(!P.complete&&SZ.test(I.text))return F("unclassifiable");for(let v of P.bodies){let y=Y(v);if(y.refused)return y}}let H=w(K),B=K.words.map((I,P)=>({word:XZ(I.text),redirect:K.redirects.has(P)})),U=B.slice(0,H<0?B.length:H).map((I)=>I.word),V=H>=0?s(B[H].word.value):"";if(H<0||["export","declare","typeset","readonly","local"].includes(V)){if(Q=o0([...U,...B.slice(H+1).map((I)=>I.word)],Q),H<0)continue}let W=o0(U,Q),_=B.slice(H+1).filter((I)=>!I.redirect).map((I)=>I.word),L=B.slice(H+1).filter((I)=>I.redirect).map((I)=>I.word),M=B[H].word,j=s(M.value),g={depth:J,appendsArgs:!1,debug:W};if(H>0&&B[H-1].word.value==="function"){let I=_.filter((v)=>!["{","()","(",")"].includes(v.value)),P=G0(I,g);if(P.refused)return P;continue}if(G>0&&Z1(K.sepBefore)&&Q0(j,_)){let I=X[G-1],P=j3(Z,I),v=P===null?null:Y0(P);if(v!==null){let y=x(v,J+1,W);if(y.refused)return y}}let h=X[G+1];if(h&&/<\(\s*$/.test(h.sepBefore)&&(kZ.has(j)||j==="source"||j===".")){let I=h.words[0].start-h.sepBefore.length+h.sepBefore.lastIndexOf("("),P=NZ(Z,I),v=P<0?null:Y0(Z.slice(I+1,P-1));if(v!==null){let y=x(v,J+1,W);if(y.refused)return y}}let c=$1(j,M,_,L,K.words.slice(0,H+1),g);if(c.refused)return c}return q}function j3(Z,J){let $=J.words[0],X=J.words[J.words.length-1];return $&&X?Z.slice($.start,X.end):null}function W3(Z){let J=s(Z.value);return/[$`]/.test(J)||J===""?void 0:J}function $1(Z,J,$,X,z,Q){let Y=Q.depth,G=(K)=>x(K,Y+1,Q.debug);if(J.opaque){let K=W3(J);if(K===void 0){let H=$.find((U)=>!U.value.startsWith("-")),B=bZ($,Q);if(!B.refused)return q;return B.rule!=="unclassifiable"||H!==void 0&&!H.opaque&&i2.has(H.value)?B:q}Z=K}if(Z==="gh")return bZ($,Q);if(kZ.has(Z)){let K=M0($);if(K){let H=G(K.value);if(H.refused||!K.opaque)return H;return X0(K.raw,Y,Q)}for(let H of X){let B=G(H.value);if(B.refused)return B;if(H.opaque){let U=X0(H.raw,Y,Q);if(U.refused)return U}}return q}if(U3.has(Z)){let K=$.findIndex((B)=>B.value==="-c"||B.value==="--command"||/^-[A-Za-z]*c$/.test(B.value)),H=K>=0?$[K+1]:void 0;return H?G(H.value):z0($,Q)}if(Z==="eval"||Z==="watch"){let K=$;if(Z==="watch"){let B=0;while(B<$.length&&$[B].value.startsWith("-")){if($[B].value==="--"){B++;break}if(["-n","--interval","-q","--equexit"].includes($[B].value))B++;B++}K=$.slice(B)}let H=G(K.map((B)=>B.value).join(" "));if(H.refused)return H;for(let B of K){let U=X0(B.raw,Y,Q);if(U.refused)return U}return q}if(Z==="env")return G(qZ([...z.map((K)=>XZ(K.text).value),...$.map((K)=>K.value)]));if(Z==="ssh"){let K=0;for(;K<$.length;K++){let U=$[K].value;if(!U.startsWith("-"))break;if(q3.has(U))K++}let H=$.slice(K+1);if(H[0]?.value==="--")H.shift();let B=H.map((U)=>U.value).join(" ");return B?G(B):q}if(Z==="xargs"){let K=0,H=!1;for(;K<$.length;K++){let B=$[K].value;if(B==="--"){K++;break}if(!B.startsWith("-"))break;if(/^-I|^-i|^--replace/.test(B))H=!0;if(F3.has(B))K++}return G0($.slice(K),{depth:Y,appendsArgs:!H,debug:Q.debug})}if(Z==="find"){for(let K=0;K<$.length;K++){if(!["-exec","-execdir","-ok","-okdir"].includes($[K].value))continue;let H=K+1;while(H<$.length&&$[H].value!==";"&&$[H].value!=="+")H++;let B=G0($.slice(K+1,H),Q);if(B.refused)return B;K=H}return q}if(V3.has(Z))return z0($,Q);if(M3.get(Z)?.includes($[0]?.value??""))return z0($.slice(1),Q);return q}function G0(Z,J){if(Z.length===0)return q;let $=s(Z[0].value);if($==="gh")return bZ(Z.slice(1),J);if(kZ.has($)){let X=M0(Z.slice(1));return X?x(X.value,J.depth+1,J.debug):q}return $1($,Z[0],Z.slice(1),[],[],J)}function z0(Z,J){let $=Z.findIndex((X)=>!X.opaque&&s(X.value)==="gh"&&(X.value==="gh"||X.value.includes("/")));return $>=0?bZ(Z.slice($+1),J):q}function M0(Z){for(let J=0;J<Z.length;J++){let $=Z[J].value;if($==="--")return;if(!$.startsWith("-")&&!$.startsWith("+"))return;if($==="-c"||/^-[A-Za-z]+$/.test($)&&$.includes("c"))return Z.slice(J+1).find((X)=>!X.value.startsWith("-")||X.value==="-");if(/^[-+][A-Za-z]*[oO]$/.test($))J++}return}function T3(Z){let J=[],$=0;for(;;){let X=Z.indexOf("<<",$);if(X<0)break;if($=X+2,Z[X+2]==="<"||X>0&&Z[X-1]==="<"){$=X+3;continue}let z=ZZ(Z,X);if(!z)continue;let Q=Z.lastIndexOf(`
 `,X)+1,Y=Z.indexOf(`
-`,X);if(Y<0)continue;let G=vZ(Z,Y,[z]),K=G<0?Z.slice(Y+1):Z.slice(Y+1,G),H=G<0?K:K.slice(0,Math.max(0,K.lastIndexOf(z.delimiter))).replace(/\n$/,""),B=Z.slice(Q,X)+" HEREDOC_OPERATOR "+Z.slice(z.end,Y);J.push({body:H,runsBody:v3(B),quoted:z.quoted})}return J}function v3(Z){let{segments:J}=j0(Z),$=J.findIndex((G)=>G.words.some((K)=>K.text==="HEREDOC_OPERATOR"));if($<0)return!1;let X=(G)=>{let K=x(G);if(K<0)return{verb:"",args:[]};let H=G.words.slice(K+1).filter((B)=>B.text!=="HEREDOC_OPERATOR").map((B)=>KZ(B.text));return{verb:n(KZ(G.words[K].text).value),args:H}},{verb:z,args:Q}=X(J[$]);if(z==="ssh"||U0(z,Q))return!0;if((z==="source"||z===".")&&["/dev/stdin","/dev/fd/0","/proc/self/fd/0"].includes(Q[0]?.value??""))return!0;let Y=J[$+1];if(z==="cat"&&Y&&G1(Y.sepBefore)){let G=X(Y);return G.verb==="ssh"||U0(G.verb,G.args)}return!1}var y3=/(?:^|[^A-Za-z0-9_.-])gh(?:$|[^A-Za-z0-9_.-])/;function B1(){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:F0}}}var S3=new Set(["Bash","Monitor"]);function U1(Z){if(Z?.hook_event_name!=="PreToolUse"||!S3.has(Z.tool_name??""))return{continue:!0};let J=ZZ(Z);if(!J.trim())return{continue:!0};try{return g(J).refused?B1():{continue:!0}}catch{return y3.test(J)?B1():{continue:!0}}}var W0=process.argv[1];if(W0!=="trash-guard"&&W0!=="workspace-repos-guard")throw Error("Invalid safety capability");var W=JSON.parse(await Bun.stdin.text());if(!W||Array.isArray(W)||W.hook_event_name!=="PreToolUse"||typeof W.tool_name!=="string"||!W.tool_input||typeof W.tool_input!=="object"||Array.isArray(W.tool_input)||typeof W.cwd!=="string"||!q1(W.cwd))throw Error("Invalid safety input");if(W.tool_name==="Bash"&&typeof W.tool_input.command!=="string")throw Error("Invalid shell input");if(W.tool_name==="Monitor"&&W.tool_input.command!==void 0&&typeof W.tool_input.command!=="string")throw Error("Invalid monitor input");var p=W.hasna_execution;if(p!==void 0&&(!p||Object.keys(p).sort().join()!=="agent,schema"||p.schema!=="hasna.hooks.execution.v1"||typeof p.agent!=="string"||!/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(p.agent)))throw Error("Invalid execution capability");var gZ=p===void 0?void 0:{runtime:process.execPath,home:I0(),path:process.env.PATH,agent:p.agent};if(gZ&&(!q1(gZ.runtime)||!gZ.path))throw Error("Invalid bound execution context");if(["apply_patch","ApplyPatch","functions.apply_patch"].includes(W.tool_name)){if(W.tool_input.command!==void 0&&W.tool_input.patch!==void 0&&W.tool_input.command!==W.tool_input.patch)throw Error("Conflicting patch aliases");let Z=W.tool_input.command??W.tool_input.patch;if(typeof Z!=="string")throw Error("Invalid patch input");W.tool_input={...W.tool_input,command:Z,patch:Z}}var hZ=W.tool_name==="Monitor",D0=W.tool_name==="Bash"||hZ&&typeof W.tool_input.command==="string",uZ=hZ&&D0?{...W,tool_name:"Bash"}:W,T0=(Z)=>({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:Z}}),V1=a0(uZ).output,M1=U1(uZ),b3=D0&&WZ(uZ.tool_input.command,{home:I0(),cwd:W.cwd}).handoffHits.length>0,C0=W0==="trash-guard"&&(!hZ||D0)?w0(uZ,{home:I0(),cwd:W.cwd,findTrash:RZ,inspectTrash:MZ,execution:gZ}):{continue:!0};if(hZ&&C0.hookSpecificOutput?.permissionDecision==="allow")C0=T0("[trash-guard] A deletion inside a Monitor command is refused; run it with the Bash tool, where it is redirected into trash.");var F1=V1.decision==="block"?T0(V1.reason):M1.hookSpecificOutput?M1:b3?T0("[workspace-repos-guard] Deletion under a protected repository checkout is refused."):C0;process.stdout.write(JSON.stringify({verdict:"continue"in F1?null:F1}));
+`,X);if(Y<0)continue;let G=EZ(Z,Y,[z]),K=G<0?Z.slice(Y+1):Z.slice(Y+1,G),H=G<0?K:K.slice(0,Math.max(0,K.lastIndexOf(z.delimiter))).replace(/\n$/,""),B=Z.slice(Q,X)+" HEREDOC_OPERATOR "+Z.slice(z.end,Y);J.push({body:H,runsBody:C3(B),quoted:z.quoted})}return J}function C3(Z){let{segments:J}=V0(Z),$=J.findIndex((G)=>G.words.some((K)=>K.text==="HEREDOC_OPERATOR"));if($<0)return!1;let X=(G)=>{let K=w(G);if(K<0)return{verb:"",args:[]};let H=G.words.slice(K+1).filter((B)=>B.text!=="HEREDOC_OPERATOR").map((B)=>XZ(B.text));return{verb:s(XZ(G.words[K].text).value),args:H}},{verb:z,args:Q}=X(J[$]);if(z==="ssh"||Q0(z,Q))return!0;if((z==="source"||z===".")&&["/dev/stdin","/dev/fd/0","/proc/self/fd/0"].includes(Q[0]?.value??""))return!0;let Y=J[$+1];if(z==="cat"&&Y&&Z1(Y.sepBefore)){let G=X(Y);return G.verb==="ssh"||Q0(G.verb,G.args)}return!1}var I3=/(?:^|[^A-Za-z0-9_.-])gh(?:$|[^A-Za-z0-9_.-])/;function J1(){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:H0}}}var D3=new Set(["Bash","Monitor"]);function X1(Z){if(Z?.hook_event_name!=="PreToolUse"||!D3.has(Z.tool_name??""))return{continue:!0};let J=t(Z);if(!J.trim())return{continue:!0};try{return x(J).refused?J1():{continue:!0}}catch{return I3.test(J)?J1():{continue:!0}}}function q0(Z){if(Z!=="trash-guard"&&Z!=="workspace-repos-guard")throw Error("Invalid safety capability")}function K1(Z,J){q0(Z);let $=Z,X=JSON.parse(J);if(!X||Array.isArray(X)||X.hook_event_name!=="PreToolUse"||typeof X.tool_name!=="string"||!X.tool_input||typeof X.tool_input!=="object"||Array.isArray(X.tool_input)||typeof X.cwd!=="string"||!z1(X.cwd))throw Error("Invalid safety input");if(X.tool_name==="Bash"&&typeof X.tool_input.command!=="string")throw Error("Invalid shell input");if(X.tool_name==="Monitor"&&X.tool_input.command!==void 0&&typeof X.tool_input.command!=="string")throw Error("Invalid monitor input");let z=X.hasna_execution;if(z!==void 0&&(!z||Object.keys(z).sort().join()!=="agent,schema"||z.schema!=="hasna.hooks.execution.v1"||typeof z.agent!=="string"||!/^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/.test(z.agent)))throw Error("Invalid execution capability");let Q=z===void 0?void 0:{runtime:process.execPath,home:F0(),path:process.env.PATH,agent:z.agent};if(Q&&(!z1(Q.runtime)||!Q.path))throw Error("Invalid bound execution context");if(["apply_patch","ApplyPatch","functions.apply_patch"].includes(X.tool_name)){if(X.tool_input.command!==void 0&&X.tool_input.patch!==void 0&&X.tool_input.command!==X.tool_input.patch)throw Error("Conflicting patch aliases");let L=X.tool_input.command??X.tool_input.patch;if(typeof L!=="string")throw Error("Invalid patch input");X.tool_input={...X.tool_input,command:L,patch:L}}let Y=X.tool_name==="Monitor",G=X.tool_name==="Bash"||Y&&typeof X.tool_input.command==="string",K=Y&&G?{...X,tool_name:"Bash"}:X,H=(L)=>({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:L}}),B=u0(K).output,U=X1(K),V=G&&_Z(K.tool_input.command,{home:F0(),cwd:X.cwd}).handoffHits.length>0,W=$==="trash-guard"&&(!Y||G)?E0(K,{home:F0(),cwd:X.cwd,findTrash:OZ,inspectTrash:UZ,execution:Q}):{continue:!0};if(Y&&W.hookSpecificOutput?.permissionDecision==="allow")W=H("[trash-guard] A deletion inside a Monitor command is refused; run it with the Bash tool, where it is redirected into trash.");let _=B.decision==="block"?H(B.reason):U.hookSpecificOutput?U:V?H("[workspace-repos-guard] Deletion under a protected repository checkout is refused."):W;return JSON.stringify({verdict:"continue"in _?null:_})}var Q1=process.argv[1];q0(Q1);process.stdout.write(K1(Q1,await Bun.stdin.text()));