npm - @zuplo/cli - Versions diffs - 7.13.3 → 7.13.4 - Mend

@zuplo/cli 7.13.3 → 7.13.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (858) hide show

package/node_modules/@simple-git/argv-parser/dist/index.mjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.mjs","sources":["../src/flags/flags.helpers.ts","../src/config/config-operands.ts","../src/config/detect-config-action.ts","../src/config/analyse-config.ts","../src/tokens/flag-specs.ts","../src/tokens/token-expander.ts","../src/flags/parse-global-flags.ts","../src/flags/parse-task-flags.ts","../src/vulnerabilities/detect-vulnerable-config-writes.ts","../src/vulnerabilities/detect-vulnerable-flags.ts","../src/vulnerabilities/vulnerability-analysis.ts","../src/args/parse-argv.ts","../src/env/parse-env.ts","../src/vulnerabilities/vulnerability-check.ts"],"sourcesContent":["export interface Flag {\n name: string;\n value?: string;\n /** Value came from the next token rather than being embedded after `=`. /\n absorbedNext: boolean;\n /* Switch appeared before the git sub-command. /\n isGlobal: boolean;\n}\n\nexport function scopedFlags(flags: Flag[], scope: 'global' \| 'task') {\n const findGlobal = scope === 'global';\n for (const flag of flags) {\n if (flag.isGlobal === findGlobal) {\n yield flag;\n }\n }\n}\n","// Flags that unambiguously signal a write operation on git config.\nexport const CONFIG_WRITE_FLAGS = new Set([\n '--add',\n '--edit',\n '--remove-section',\n '--rename-section',\n '--replace-all',\n '--unset',\n '--unset-all',\n '-e',\n]);\n\n// Flags that unambiguously signal a read operation.\nexport const CONFIG_READ_FLAGS = new Set([\n '--get',\n '--get-all',\n '--get-color',\n '--get-colorbool',\n '--get-regexp',\n '--get-urlmatch',\n '--list',\n '-l',\n]);\n\n// Sub-command verbs accepted as the first positional by newer git versions.\nexport const CONFIG_WRITE_VERBS = new Set([\n 'edit',\n 'remove-section',\n 'rename-section',\n 'set',\n 'unset',\n]);\nexport const CONFIG_READ_VERBS = new Set(['get', 'get-color', 'get-colorbool', 'list']);\n","import type { ConfigScope } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport {\n CONFIG_READ_FLAGS,\n CONFIG_READ_VERBS,\n CONFIG_WRITE_FLAGS,\n CONFIG_WRITE_VERBS,\n} from './config-operands';\n\nexport function detectConfigAction(flags: Flag[], positionals: string[]): ConfigOperation \| null {\n for (const { name } of scopedFlags(flags, 'task')) {\n if (CONFIG_WRITE_FLAGS.has(name)) {\n return configOperation(true, positionals);\n }\n if (CONFIG_READ_FLAGS.has(name)) {\n return configOperation(false, positionals);\n }\n }\n\n const verb = positionals.at(0)?.toLowerCase();\n\n if (verb === undefined) {\n return null;\n }\n\n if (CONFIG_WRITE_VERBS.has(verb)) {\n return configOperation(true, positionals.slice(1));\n }\n\n if (CONFIG_READ_VERBS.has(verb)) {\n return configOperation(false, positionals.slice(1));\n }\n\n if (positionals.length === 1) {\n return configOperation(false, positionals);\n }\n\n return configOperation(true, positionals);\n}\n\nfunction configOperation(isWrite = false, positionals: string[] = []): ConfigOperation \| null {\n const key = positionals.at(0)?.toLowerCase();\n\n if (key === undefined) {\n return null;\n }\n\n return {\n isWrite,\n isRead: !isWrite,\n key,\n value: positionals.at(1),\n };\n}\n\nexport function toOperation(scope: ConfigScope, operation: ConfigOperation) {\n if (operation.isWrite && operation.value !== undefined) {\n return { key: operation.key, value: operation.value, scope };\n }\n return { key: operation.key, scope };\n}\n","import type { ConfigScope, ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport { detectConfigAction, toOperation } from './detect-config-action';\n\nfunction parseAssignment(raw: string \| undefined): { key: string; value: string } \| null {\n const eq = raw?.indexOf('=') \|\| -1;\n\n if (!raw \|\| eq < 0) {\n return null;\n }\n\n return {\n key: raw.slice(0, eq).trim().toLowerCase(),\n value: raw.slice(eq + 1),\n };\n}\n\nfunction detectConfigScope(flags: Flag[]): ConfigScope {\n for (const { name } of scopedFlags(flags, 'task')) {\n switch (name) {\n case '--global':\n return 'global';\n case '--system':\n return 'system';\n case '--worktree':\n return 'worktree';\n case '--local':\n return 'local';\n case '--file':\n case '-f':\n return 'file';\n }\n }\n return 'local';\n}\n\nfunction detectConfigOverrideScope({ name }: Flag): ConfigScope \| void {\n if (name === '-c' \|\| name === '--config') {\n return 'inline';\n }\n if (name === '--config-env') {\n return 'env';\n }\n}\n\n/*\n Generates the stream of ConfigWrite settings found in the supplied flags,\n * triggered by `-c` and `--config` for inline configuration and `--config-env`\n * to set a config setting based on environment variable.\n /\nfunction collectWriteFlags(flags: Flag[]): Generator<ConfigWrite> {\n for (const flag of flags) {\n const scope = detectConfigOverrideScope(flag);\n const assignment = scope && parseAssignment(flag.value);\n\n if (assignment) {\n yield {\n ...assignment,\n scope,\n };\n }\n }\n}\n\nexport function collectConfigAccess(\n task: string \| null,\n flags: Flag[],\n positionals: string[]\n): ParsedConfigActivity {\n const parsedConfig: ParsedConfigActivity = {\n read: [],\n write: [...collectWriteFlags(flags)],\n };\n\n if (task === 'config') {\n appendParsedConfigAction(\n parsedConfig,\n detectConfigScope(flags),\n detectConfigAction(flags, positionals)\n );\n }\n\n return parsedConfig;\n}\n\nfunction appendParsedConfigAction(\n parsedConfig: ParsedConfigActivity,\n scope: ConfigScope,\n action: ConfigOperation \| null\n) {\n if (action === null) {\n return;\n }\n\n const config = toOperation(scope, action);\n if (action.isWrite) {\n parsedConfig.write.push(config);\n } else {\n parsedConfig.read.push(config);\n }\n}\n","// ── Option tables ─────────────────────────────────────────────────────────────\n//\n// Each scope has:\n// short – Map<char, consumesNext> (known single-letter switches; true = takes next token)\n// long – Set<stem> (long switch stems, without --, that take the next token)\n//\n// Only switches listed here are \"known\". An unknown char anywhere in a combined\n// cluster causes the entire cluster to be kept as one opaque token.\n\nexport interface FlagSpec {\n readonly short: ReadonlyMap<string, boolean>;\n readonly long: ReadonlySet<string>;\n}\n\nconst UNIVERSAL: FlagSpec = {\n short: new Map([\n ['c', true], // -c <k=v> set config key for this invocation\n ]),\n long: new Set(),\n};\n\nexport const GLOBAL: FlagSpec = {\n short: new Map([\n ['C', true], // -C <path> change working directory\n ['P', false], // -P no pager (alias for --no-pager)\n ['h', false], // -h help\n ['p', false], // -p paginate\n ['v', false], // -v version\n ...UNIVERSAL.short.entries(),\n ]),\n long: new Set([\n 'attr-source',\n 'config-env',\n 'exec-path',\n 'git-dir',\n 'list-cmds',\n 'namespace',\n 'super-prefix',\n 'work-tree',\n ]),\n};\n\nconst COMMANDS: Record<string, FlagSpec> = {\n clone: {\n short: new Map([\n ['b', true], // -b <branch>\n ['j', true], // -j <n> parallel jobs\n ['l', false], // -l local\n ['n', false], // -n no-checkout\n ['o', true], // -o <name> remote name\n ['q', false], // -q quiet\n ['s', false], // -s shared\n ['u', true], // -u <upload-pack>\n ]),\n long: new Set(['branch', 'config', 'jobs', 'origin', 'upload-pack', 'u', 'template']),\n },\n commit: {\n short: new Map([\n ['C', true], // -C <commit> reuse message\n ['F', true], // -F <file> read message from file\n ['c', true], // -c <commit> reedit message\n ['m', true], // -m <msg>\n ['t', true], // -t <template>\n ]),\n long: new Set(['file', 'message', 'reedit-message', 'reuse-message', 'template']),\n },\n config: {\n short: new Map([\n ['e', false], // -e open editor\n ['f', true], // -f <file>\n ['l', false], // -l list\n ]),\n long: new Set(['blob', 'comment', 'default', 'file', 'type', 'value']),\n },\n fetch: {\n short: new Map(),\n long: new Set(['upload-pack']),\n },\n init: {\n short: new Map(),\n long: new Set(['template']),\n },\n pull: {\n short: new Map(),\n long: new Set(['upload-pack']),\n },\n push: {\n short: new Map(),\n long: new Set(['exec', 'receive-pack']),\n },\n};\n\nconst EMPTY: FlagSpec = { short: new Map(), long: new Set() };\n\nexport function getFlagSpecForTask(task?: string \| null) {\n const spec = COMMANDS[task ?? ''] ?? EMPTY;\n\n return {\n short: new Map([...UNIVERSAL.short.entries(), ...spec.short.entries()]),\n long: spec.long,\n };\n}\n","import { GLOBAL } from './flag-specs';\n\n/** Parse a single raw token (e.g. `'-m'`, `'--amend'`, `'-uc'`) into one or\n * more switch descriptors. Values are not yet resolved for needsNext=true. /\nexport function expandToken(\n raw: string,\n spec = GLOBAL\n): Array<{\n name: string;\n value?: string;\n needsNext: boolean;\n}> {\n if (raw.startsWith('--')) {\n const eq = raw.indexOf('=');\n if (eq > 2) {\n return [{ name: raw.slice(0, eq), value: raw.slice(eq + 1), needsNext: false }];\n }\n const stem = raw.slice(2);\n return [{ name: raw, needsNext: spec.long.has(stem) }];\n }\n\n // Single short switch\n if (raw.length === 2) {\n const char = raw.charAt(1);\n const consumes = spec.short.get(char);\n return [{ name: raw, needsNext: consumes === true }];\n }\n\n // Combined short cluster: try to expand char-by-char\n return expandCluster(raw, spec.short);\n}\n\nfunction expandCluster(\n raw: string,\n shortSpec: ReadonlyMap<string, boolean>\n): Array<{ name: string; value?: string; needsNext: boolean }> {\n const chars = raw.slice(1).split('');\n const result: Array<{ name: string; value?: string; needsNext: boolean }> = [];\n\n for (let i = 0; i < chars.length; i++) {\n const char = chars[i];\n const consumes = shortSpec.get(char);\n\n if (consumes === undefined) {\n // Unknown char: keep the whole raw token as opaque\n return [{ name: raw, needsNext: false }];\n }\n\n if (consumes) {\n const remainder = chars.slice(i + 1).join('');\n if (remainder) {\n const remainderAllKnown = [...remainder].every((c) => shortSpec.has(c));\n if (!remainderAllKnown) {\n // Remaining chars are the embedded value, not separate flags\n result.push({ name: `-${char}`, value: remainder, needsNext: false });\n return result;\n }\n }\n }\n\n result.push({ name: `-${char}`, needsNext: consumes });\n }\n\n return result;\n}\n","import { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\nexport interface GlobalFlags {\n flags: Flag[];\n taskIndex: number;\n}\n\nexport function parseGlobalFlags(tokens: readonly unknown[], flags: Flag[] = []): GlobalFlags {\n let i = 0;\n\n while (i < tokens.length) {\n const raw = String(tokens[i]);\n if (!raw.startsWith('-') \|\| raw.length < 2) break;\n\n const parsed = expandToken(raw);\n let next = i + 1;\n\n for (const token of parsed) {\n const flag: Flag = {\n name: token.name,\n value: token.value,\n absorbedNext: false,\n isGlobal: true,\n };\n if (token.needsNext && flag.value === undefined && next < tokens.length) {\n flag.value = String(tokens[next]);\n flag.absorbedNext = true;\n next++;\n }\n flags.push(flag);\n }\n\n i = next;\n }\n\n return { flags, taskIndex: i };\n}\n","import { isPathSpec, toPaths } from '@simple-git/args-pathspec';\n\nimport { getFlagSpecForTask } from '../tokens/flag-specs';\nimport { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\ntype TaskFlags = {\n flags: Flag[];\n positionals: string[];\n pathspecs: string[];\n};\n\nexport function parseTaskFlags(\n tokens: readonly unknown[],\n task: string \| null,\n flags: Flag[] = []\n): TaskFlags {\n const spec = getFlagSpecForTask(task);\n const positionals: string[] = [];\n const pathspecs: string[] = [];\n\n let i = 0;\n while (i < tokens.length) {\n const current = tokens[i];\n\n if (isPathSpec(current)) {\n pathspecs.push(...toPaths(current as string));\n i++;\n continue;\n }\n\n const raw = String(current);\n\n if (raw === '--') {\n for (let j = i + 1; j < tokens.length; j++) {\n const t = tokens[j];\n isPathSpec(t) ? pathspecs.push(...toPaths(t as string)) : pathspecs.push(String(t));\n }\n break;\n }\n\n if (!raw.startsWith('-') \|\| raw.length < 2) {\n positionals.push(raw);\n i++;\n continue;\n }\n\n const parsed = expandToken(raw, spec);\n let next = i + 1;\n\n for (const token of parsed) {\n const flag: Flag = {\n name: token.name,\n value: token.value,\n absorbedNext: false,\n isGlobal: false,\n };\n if (\n token.needsNext &&\n flag.value === undefined &&\n next < tokens.length &&\n !isPathSpec(tokens[next])\n ) {\n flag.value = String(tokens[next]);\n flag.absorbedNext = true;\n next++;\n }\n flags.push(flag);\n }\n\n i = next;\n }\n\n return { flags, positionals, pathspecs };\n}\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function detectVulnerableConfigWrites({\n write,\n}: ParsedConfigActivity): Generator<Vulnerability> {\n for (const config of write) {\n for (const helper of preventUnsafeConfig) {\n const vulnerability = helper(config.key);\n if (vulnerability) {\n yield vulnerability;\n }\n }\n }\n}\n\nfunction preventConfigBuilder(\n config: string \| RegExp,\n category: VulnerabilityCategory,\n message = String(config)\n) {\n const regex = typeof config === 'string' ? new RegExp(`\\\\s${config.toLowerCase()}`) : config;\n\n return function preventCommand(key: string): Vulnerability \| void {\n if (regex.test(key)) {\n return {\n category,\n message: `Configuring ${message} is not permitted without enabling ${category}`,\n };\n }\n };\n}\n\nfunction preventExpandedConfigBuilder(config: string, category: VulnerabilityCategory) {\n const regex = new RegExp(`\\\\s${config.toLowerCase().replace(/\\./g, '(\\..+)?.')}`);\n return preventConfigBuilder(regex, category, config);\n}\n\nconst preventUnsafeConfig = [\n preventConfigBuilder('alias', 'allowUnsafeAlias'),\n preventConfigBuilder('core.askPass', 'allowUnsafeAskPass'),\n preventConfigBuilder('core.editor', 'allowUnsafeEditor'),\n preventConfigBuilder('core.fsmonitor', 'allowUnsafeFsMonitor'),\n preventConfigBuilder('core.gitProxy', 'allowUnsafeGitProxy'),\n preventConfigBuilder('core.hooksPath', 'allowUnsafeHooksPath'),\n preventConfigBuilder('core.pager', 'allowUnsafePager'),\n preventConfigBuilder('core.sshCommand', 'allowUnsafeSshCommand'),\n preventExpandedConfigBuilder('credential.helper', 'allowUnsafeCredentialHelper'),\n preventExpandedConfigBuilder('diff.command', 'allowUnsafeDiffExternal'),\n preventConfigBuilder('diff.external', 'allowUnsafeDiffExternal'),\n preventExpandedConfigBuilder('diff.textconv', 'allowUnsafeDiffTextConv'),\n preventExpandedConfigBuilder('filter.clean', 'allowUnsafeFilter'),\n preventExpandedConfigBuilder('filter.smudge', 'allowUnsafeFilter'),\n preventExpandedConfigBuilder('gpg.program', 'allowUnsafeGpgProgram'),\n preventConfigBuilder('init.templateDir', 'allowUnsafeTemplateDir'),\n preventExpandedConfigBuilder('merge.driver', 'allowUnsafeMergeDriver'),\n preventExpandedConfigBuilder('mergetool.path', 'allowUnsafeMergeDriver'),\n preventExpandedConfigBuilder('mergetool.cmd', 'allowUnsafeMergeDriver'),\n preventExpandedConfigBuilder('protocol.allow', 'allowUnsafeProtocolOverride'),\n preventExpandedConfigBuilder('remote.receivepack', 'allowUnsafePack'),\n preventExpandedConfigBuilder('remote.uploadpack', 'allowUnsafePack'),\n preventConfigBuilder('sequence.editor', 'allowUnsafeEditor'),\n];\n","import type { Flag } from '../flags/flags.helpers';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function* detectVulnerableFlags(\n task: null \| string,\n flags: Flag[]\n): Generator<Vulnerability> {\n for (const flag of flags) {\n for (const helper of preventUnsafeFlags) {\n const vulnerability = helper(task, flag.name);\n if (vulnerability) {\n yield vulnerability;\n }\n }\n }\n}\n\nfunction preventFlagBuilder(\n task: string \| null,\n flag: string \| RegExp,\n category: VulnerabilityCategory,\n name = String(flag)\n) {\n const regex = typeof flag === 'string' ? new RegExp(`\\\\s${flag.toLowerCase()}`) : flag;\n const message = `Use of ${task ? `${task} with option ` : ''}${name} is not permitted without enabling ${category}`;\n\n return function preventFlag(currentTask: string \| null, flagName: string): Vulnerability \| void {\n if ((!task \|\| currentTask === task) && regex.test(flagName)) {\n return {\n category,\n message,\n };\n }\n };\n}\n\nconst preventUnsafeFlags = [\n preventFlagBuilder(\n null,\n /--(upload\|receive)-pack/,\n 'allowUnsafePack',\n '--upload-pack or --receive-pack'\n ),\n preventFlagBuilder('clone', /^-\\wu/, 'allowUnsafePack'),\n preventFlagBuilder('clone', '--u', 'allowUnsafePack'),\n preventFlagBuilder('push', '--exec', 'allowUnsafePack'),\n preventFlagBuilder(null, '--template', 'allowUnsafeTemplateDir'),\n];\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Flag } from '../flags/flags.helpers';\nimport { detectVulnerableConfigWrites } from './detect-vulnerable-config-writes';\nimport { detectVulnerableFlags } from './detect-vulnerable-flags';\nimport type { Vulnerability } from './vulnerability.types';\n\nexport function vulnerabilityAnalysis(\n task: null \| string,\n flags: Flag[],\n config: ParsedConfigActivity\n): Vulnerability[] {\n return [...detectVulnerableFlags(task, flags), ...detectVulnerableConfigWrites(config)];\n}\n","import { collectConfigAccess } from '../config/analyse-config';\nimport type { Flag } from '../flags/flags.helpers';\nimport { parseGlobalFlags } from '../flags/parse-global-flags';\nimport { parseTaskFlags } from '../flags/parse-task-flags';\nimport type { Vulnerability } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\nimport type { ParsedArgv, ParsedFlag } from './parse-argv.types';\n\n/*\n Parse the tokens that would be forwarded to a `git` child-process and\n * return a structured summary of what the invocation does.\n /\nexport function parseArgv(...tokens: readonly unknown[]): ParsedArgv {\n const { flags, taskIndex } = parseGlobalFlags(tokens);\n\n const task = taskIndex < tokens.length ? String(tokens[taskIndex]).toLowerCase() : null;\n const taskTokens = task !== null ? tokens.slice(taskIndex + 1) : [];\n\n const { positionals, pathspecs } = parseTaskFlags(taskTokens, task, flags);\n const config = collectConfigAccess(task, flags, positionals);\n\n return {\n task,\n flags: flags.map(toParsedFlag),\n paths: pathspecs,\n config,\n vulnerabilities: vulnerabilityList(vulnerabilityAnalysis(task, flags, config)),\n };\n}\n\nfunction vulnerabilityList(vulnerabilities: Vulnerability[]) {\n return Object.defineProperty(vulnerabilities, 'vulnerabilities', {\n value: vulnerabilities,\n });\n}\n\nfunction toParsedFlag({ value, name }: Flag): ParsedFlag {\n return value !== undefined ? { name, value } : { name };\n}\n","import type { ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\n\nconst GitEnvKeys = {\n 'editor': 'allowUnsafeEditor',\n 'git_askpass': 'allowUnsafeAskPass',\n 'git_config_global': 'allowUnsafeConfigPaths',\n 'git_config_system': 'allowUnsafeConfigPaths',\n 'git_config_count': 'allowUnsafeConfigEnvCount',\n 'git_config': 'allowUnsafeConfigPaths',\n 'git_editor': 'allowUnsafeEditor',\n 'git_exec_path': 'allowUnsafeConfigPaths',\n 'git_external_diff': 'allowUnsafeDiffExternal',\n 'git_pager': 'allowUnsafePager',\n 'git_proxy_command': 'allowUnsafeGitProxy',\n 'git_template_dir': 'allowUnsafeTemplateDir',\n 'git_sequence_editor': 'allowUnsafeEditor',\n 'git_ssh': 'allowUnsafeSshCommand',\n 'git_ssh_command': 'allowUnsafeSshCommand',\n 'pager': 'allowUnsafePager',\n 'prefix': 'allowUnsafeConfigPaths',\n 'ssh_askpass': 'allowUnsafeAskPass',\n} as const satisfies Record<string, VulnerabilityCategory>;\n\ntype GitEnv = Record<string, string> & {\n git_config_count?: string;\n};\n\nfunction collectConfigByCount(env: GitEnv): Generator<ConfigWrite> {\n const count = parseInt(env.git_config_count ?? '0', 10);\n for (let index = 0; index < count; index++) {\n const key = env[`git_config_key_${index}`];\n const value = env[`git_config_value_${index}`];\n\n if (key !== undefined) {\n yield { key: key.toLowerCase().trim(), value, scope: 'env' };\n }\n }\n}\n\nfunction* collectConfigVulnerabilities(env: GitEnv): Generator<Vulnerability> {\n for (const key of Object.keys(env)) {\n if (isGitEnvKey(key)) {\n const category = GitEnvKeys[key];\n yield {\n category,\n message: `Use of \"${key.toUpperCase()}\" is not permitted without enabling ${category}`,\n };\n }\n }\n}\n\nfunction isGitEnvKey(key: string): key is keyof typeof GitEnvKeys {\n return Object.hasOwn(GitEnvKeys, key);\n}\n\nfunction prepareEnv(env: Record<string, unknown>): GitEnv {\n const gitEnv: GitEnv = {};\n for (const [key, value] of Object.entries(env)) {\n const envKey = key.toLowerCase().trim();\n if (isGitEnvKey(envKey) \|\| envKey.startsWith('git')) {\n gitEnv[envKey] = String(value);\n }\n }\n return gitEnv;\n}\n\nexport function parseEnv(raw: Record<string, unknown>) {\n const env = prepareEnv(raw);\n const config: ParsedConfigActivity = {\n read: [],\n write: [...collectConfigByCount(env)],\n };\n const vulnerabilities = [\n ...collectConfigVulnerabilities(env),\n ...vulnerabilityAnalysis(null, [], config),\n ];\n\n return {\n config,\n vulnerabilities,\n };\n}\n","import { parseArgv } from '../args/parse-argv';\nimport { parseEnv } from '../env/parse-env';\n\n/*\n Retrieves just the vulnerabilities identified in the supplied varargs tokens\n * and environment variables.\n */\nexport function vulnerabilityCheck(tokens: readonly string[], env: Record<string, unknown>) {\n return [...parseArgv(...tokens).vulnerabilities, ...parseEnv(env).vulnerabilities];\n}\n"],"names":["scopedFlags","flags","scope","findGlobal","flag","CONFIG_WRITE_FLAGS","CONFIG_READ_FLAGS","CONFIG_WRITE_VERBS","CONFIG_READ_VERBS","detectConfigAction","positionals","name","configOperation","verb","isWrite","key","toOperation","operation","parseAssignment","raw","eq","detectConfigScope","detectConfigOverrideScope","collectWriteFlags","assignment","collectConfigAccess","task","parsedConfig","appendParsedConfigAction","action","config","UNIVERSAL","GLOBAL","COMMANDS","EMPTY","getFlagSpecForTask","spec","expandToken","stem","char","consumes","expandCluster","shortSpec","chars","result","i","remainder","c","parseGlobalFlags","tokens","parsed","next","token","parseTaskFlags","pathspecs","current","isPathSpec","toPaths","j","t","detectVulnerableConfigWrites","write","helper","preventUnsafeConfig","vulnerability","preventConfigBuilder","category","message","regex","preventExpandedConfigBuilder","detectVulnerableFlags","preventUnsafeFlags","preventFlagBuilder","currentTask","flagName","vulnerabilityAnalysis","parseArgv","taskIndex","taskTokens","toParsedFlag","vulnerabilityList","vulnerabilities","value","GitEnvKeys","collectConfigByCount","env","count","index","collectConfigVulnerabilities","isGitEnvKey","prepareEnv","gitEnv","envKey","parseEnv","vulnerabilityCheck"],"mappings":";AASO,UAAUA,EAAYC,GAAeC,GAA0B;AACnE,QAAMC,IAAaD,MAAU;AAC7B,aAAWE,KAAQH;AAChB,IAAIG,EAAK,aAAaD,MACnB,MAAMC;AAGf;ACfO,MAAMC,wBAAyB,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACH,CAAC,GAGYC,wBAAwB,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACH,CAAC,GAGYC,wBAAyB,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACH,CAAC,GACYC,wBAAwB,IAAI,CAAC,OAAO,aAAa,iBAAiB,MAAM,CAAC;ACtB/E,SAASC,EAAmBR,GAAeS,GAA+C;AAC9F,aAAW,EAAE,MAAAC,EAAA,KAAUX,EAAYC,GAAO,MAAM,GAAG;AAChD,QAAII,EAAmB,IAAIM,CAAI;AAC5B,aAAOC,EAAgB,IAAMF,CAAW;AAE3C,QAAIJ,EAAkB,IAAIK,CAAI;AAC3B,aAAOC,EAAgB,IAAOF,CAAW;AAAA,EAE/C;AAEA,QAAMG,IAAOH,EAAY,GAAG,CAAC,GAAG,YAAA;AAEhC,SAAIG,MAAS,SACH,OAGNN,EAAmB,IAAIM,CAAI,IACrBD,EAAgB,IAAMF,EAAY,MAAM,CAAC,CAAC,IAGhDF,EAAkB,IAAIK,CAAI,IACpBD,EAAgB,IAAOF,EAAY,MAAM,CAAC,CAAC,IAGjDA,EAAY,WAAW,IACjBE,EAAgB,IAAOF,CAAW,IAGrCE,EAAgB,IAAMF,CAAW;AAC3C;AAEA,SAASE,EAAgBE,IAAU,IAAOJ,IAAwB,CAAA,GAA4B;AAC3F,QAAMK,IAAML,EAAY,GAAG,CAAC,GAAG,YAAA;AAE/B,SAAIK,MAAQ,SACF,OAGH;AAAA,IACJ,SAAAD;AAAA,IACA,QAAQ,CAACA;AAAA,IACT,KAAAC;AAAA,IACA,OAAOL,EAAY,GAAG,CAAC;AAAA,EAAA;AAE7B;AAEO,SAASM,EAAYd,GAAoBe,GAA4B;AACzE,SAAIA,EAAU,WAAWA,EAAU,UAAU,SACnC,EAAE,KAAKA,EAAU,KAAK,OAAOA,EAAU,OAAO,OAAAf,EAAA,IAEjD,EAAE,KAAKe,EAAU,KAAK,OAAAf,EAAA;AAChC;ACxDA,SAASgB,EAAgBC,GAAgE;AACtF,QAAMC,IAAKD,GAAK,QAAQ,GAAG,KAAK;AAEhC,SAAI,CAACA,KAAOC,IAAK,IACP,OAGH;AAAA,IACJ,KAAKD,EAAI,MAAM,GAAGC,CAAE,EAAE,KAAA,EAAO,YAAA;AAAA,IAC7B,OAAOD,EAAI,MAAMC,IAAK,CAAC;AAAA,EAAA;AAE7B;AAEA,SAASC,EAAkBpB,GAA4B;AACpD,aAAW,EAAE,MAAAU,EAAA,KAAUX,EAAYC,GAAO,MAAM;AAC7C,YAAQU,GAAA;AAAA,MACL,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AAAA,MACL,KAAK;AACF,eAAO;AAAA,IAAA;AAGhB,SAAO;AACV;AAEA,SAASW,EAA0B,EAAE,MAAAX,KAAkC;AACpE,MAAIA,MAAS,QAAQA,MAAS;AAC3B,WAAO;AAEV,MAAIA,MAAS;AACV,WAAO;AAEb;AAOA,UAAUY,EAAkBtB,GAAuC;AAChE,aAAWG,KAAQH,GAAO;AACvB,UAAMC,IAAQoB,EAA0BlB,CAAI,GACtCoB,IAAatB,KAASgB,EAAgBd,EAAK,KAAK;AAEtD,IAAIoB,MACD,MAAM;AAAA,MACH,GAAGA;AAAA,MACH,OAAAtB;AAAA,IAAA;AAAA,EAGT;AACH;AAEO,SAASuB,EACbC,GACAzB,GACAS,GACqB;AACrB,QAAMiB,IAAqC;AAAA,IACxC,MAAM,CAAA;AAAA,IACN,OAAO,CAAC,GAAGJ,EAAkBtB,CAAK,CAAC;AAAA,EAAA;AAGtC,SAAIyB,MAAS,YACVE;AAAA,IACGD;AAAA,IACAN,EAAkBpB,CAAK;AAAA,IACvBQ,EAAmBR,GAAOS,CAAW;AAAA,EAAA,GAIpCiB;AACV;AAEA,SAASC,EACND,GACAzB,GACA2B,GACD;AACC,MAAIA,MAAW;AACZ;AAGH,QAAMC,IAASd,EAAYd,GAAO2B,CAAM;AACxC,EAAIA,EAAO,UACRF,EAAa,MAAM,KAAKG,CAAM,IAE9BH,EAAa,KAAK,KAAKG,CAAM;AAEnC;ACvFA,MAAMC,IAAsB;AAAA,EACzB,2BAAW,IAAI;AAAA,IACZ,CAAC,KAAK,EAAI;AAAA;AAAA,EAAA,CACZ;AAEJ,GAEaC,IAAmB;AAAA,EAC7B,OAAO,IAAI,IAAI;AAAA,IACZ,CAAC,KAAK,EAAI;AAAA;AAAA,IACV,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,GAAGD,EAAU,MAAM,QAAA;AAAA,EAAQ,CAC7B;AAAA,EACD,0BAAU,IAAI;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,CACF;AACJ,GAEME,IAAqC;AAAA,EACxC,OAAO;AAAA,IACJ,2BAAW,IAAI;AAAA,MACZ,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,IAAA,CACZ;AAAA,IACD,MAAM,oBAAI,IAAI,CAAC,UAAU,UAAU,QAAQ,UAAU,eAAe,KAAK,UAAU,CAAC;AAAA,EAAA;AAAA,EAEvF,QAAQ;AAAA,IACL,2BAAW,IAAI;AAAA,MACZ,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,IAAA,CACZ;AAAA,IACD,0BAAU,IAAI,CAAC,QAAQ,WAAW,kBAAkB,iBAAiB,UAAU,CAAC;AAAA,EAAA;AAAA,EAEnF,QAAQ;AAAA,IACL,2BAAW,IAAI;AAAA,MACZ,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,IAAA,CACb;AAAA,IACD,MAAM,oBAAI,IAAI,CAAC,QAAQ,WAAW,WAAW,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAAA;AAAA,EAExE,OAAO;AAAA,IACJ,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,aAAa,CAAC;AAAA,EAAA;AAAA,EAEhC,MAAM;AAAA,IACH,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,UAAU,CAAC;AAAA,EAAA;AAAA,EAE7B,MAAM;AAAA,IACH,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,aAAa,CAAC;AAAA,EAAA;AAAA,EAEhC,MAAM;AAAA,IACH,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;AAAA,EAAA;AAE5C,GAEMC,IAAkB,EAAE,OAAO,oBAAI,OAAO,MAAM,oBAAI,MAAI;AAEnD,SAASC,EAAmBT,GAAsB;AACtD,QAAMU,IAAOH,EAASP,KAAQ,EAAE,KAAKQ;AAErC,SAAO;AAAA,IACJ,OAAO,IAAI,IAAI,CAAC,GAAGH,EAAU,MAAM,QAAA,GAAW,GAAGK,EAAK,MAAM,QAAA,CAAS,CAAC;AAAA,IACtE,MAAMA,EAAK;AAAA,EAAA;AAEjB;ACjGO,SAASC,EACblB,GACAiB,IAAOJ,GAKP;AACA,MAAIb,EAAI,WAAW,IAAI,GAAG;AACvB,UAAMC,IAAKD,EAAI,QAAQ,GAAG;AAC1B,QAAIC,IAAK;AACN,aAAO,CAAC,EAAE,MAAMD,EAAI,MAAM,GAAGC,CAAE,GAAG,OAAOD,EAAI,MAAMC,IAAK,CAAC,GAAG,WAAW,IAAO;AAEjF,UAAMkB,IAAOnB,EAAI,MAAM,CAAC;AACxB,WAAO,CAAC,EAAE,MAAMA,GAAK,WAAWiB,EAAK,KAAK,IAAIE,CAAI,GAAG;AAAA,EACxD;AAGA,MAAInB,EAAI,WAAW,GAAG;AACnB,UAAMoB,IAAOpB,EAAI,OAAO,CAAC,GACnBqB,IAAWJ,EAAK,MAAM,IAAIG,CAAI;AACpC,WAAO,CAAC,EAAE,MAAMpB,GAAK,WAAWqB,MAAa,IAAM;AAAA,EACtD;AAGA,SAAOC,EAActB,GAAKiB,EAAK,KAAK;AACvC;AAEA,SAASK,EACNtB,GACAuB,GAC4D;AAC5D,QAAMC,IAAQxB,EAAI,MAAM,CAAC,EAAE,MAAM,EAAE,GAC7ByB,IAAsE,CAAA;AAE5E,WAASC,IAAI,GAAGA,IAAIF,EAAM,QAAQE,KAAK;AACpC,UAAMN,IAAOI,EAAME,CAAC,GACdL,IAAWE,EAAU,IAAIH,CAAI;AAEnC,QAAIC,MAAa;AAEd,aAAO,CAAC,EAAE,MAAMrB,GAAK,WAAW,IAAO;AAG1C,QAAIqB,GAAU;AACX,YAAMM,IAAYH,EAAM,MAAME,IAAI,CAAC,EAAE,KAAK,EAAE;AAC5C,UAAIC,KAEG,CADsB,CAAC,GAAGA,CAAS,EAAE,MAAM,CAACC,MAAML,EAAU,IAAIK,CAAC,CAAC;AAGnE,eAAAH,EAAO,KAAK,EAAE,MAAM,IAAIL,CAAI,IAAI,OAAOO,GAAW,WAAW,GAAA,CAAO,GAC7DF;AAAA,IAGhB;AAEA,IAAAA,EAAO,KAAK,EAAE,MAAM,IAAIL,CAAI,IAAI,WAAWC,GAAU;AAAA,EACxD;AAEA,SAAOI;AACV;ACxDO,SAASI,EAAiBC,GAA4BhD,IAAgB,IAAiB;AAC3F,MAAI4C,IAAI;AAER,SAAOA,IAAII,EAAO,UAAQ;AACvB,UAAM9B,IAAM,OAAO8B,EAAOJ,CAAC,CAAC;AAC5B,QAAI,CAAC1B,EAAI,WAAW,GAAG,KAAKA,EAAI,SAAS,EAAG;AAE5C,UAAM+B,IAASb,EAAYlB,CAAG;AAC9B,QAAIgC,IAAON,IAAI;AAEf,eAAWO,KAASF,GAAQ;AACzB,YAAM9C,IAAa;AAAA,QAChB,MAAMgD,EAAM;AAAA,QACZ,OAAOA,EAAM;AAAA,QACb,cAAc;AAAA,QACd,UAAU;AAAA,MAAA;AAEb,MAAIA,EAAM,aAAahD,EAAK,UAAU,UAAa+C,IAAOF,EAAO,WAC9D7C,EAAK,QAAQ,OAAO6C,EAAOE,CAAI,CAAC,GAChC/C,EAAK,eAAe,IACpB+C,MAEHlD,EAAM,KAAKG,CAAI;AAAA,IAClB;AAEA,IAAAyC,IAAIM;AAAA,EACP;AAEA,SAAO,EAAE,OAAAlD,GAAO,WAAW4C,EAAA;AAC9B;ACzBO,SAASQ,EACbJ,GACAvB,GACAzB,IAAgB,CAAA,GACN;AACV,QAAMmC,IAAOD,EAAmBT,CAAI,GAC9BhB,IAAwB,CAAA,GACxB4C,IAAsB,CAAA;AAE5B,MAAIT,IAAI;AACR,SAAOA,IAAII,EAAO,UAAQ;AACvB,UAAMM,IAAUN,EAAOJ,CAAC;AAExB,QAAIW,EAAWD,CAAO,GAAG;AACtB,MAAAD,EAAU,KAAK,GAAGG,EAAQF,CAAiB,CAAC,GAC5CV;AACA;AAAA,IACH;AAEA,UAAM1B,IAAM,OAAOoC,CAAO;AAE1B,QAAIpC,MAAQ,MAAM;AACf,eAASuC,IAAIb,IAAI,GAAGa,IAAIT,EAAO,QAAQS,KAAK;AACzC,cAAMC,IAAIV,EAAOS,CAAC;AAClB,QAAAF,EAAWG,CAAC,IAAIL,EAAU,KAAK,GAAGG,EAAQE,CAAW,CAAC,IAAIL,EAAU,KAAK,OAAOK,CAAC,CAAC;AAAA,MACrF;AACA;AAAA,IACH;AAEA,QAAI,CAACxC,EAAI,WAAW,GAAG,KAAKA,EAAI,SAAS,GAAG;AACzC,MAAAT,EAAY,KAAKS,CAAG,GACpB0B;AACA;AAAA,IACH;AAEA,UAAMK,IAASb,EAAYlB,GAAKiB,CAAI;AACpC,QAAIe,IAAON,IAAI;AAEf,eAAWO,KAASF,GAAQ;AACzB,YAAM9C,IAAa;AAAA,QAChB,MAAMgD,EAAM;AAAA,QACZ,OAAOA,EAAM;AAAA,QACb,cAAc;AAAA,QACd,UAAU;AAAA,MAAA;AAEb,MACGA,EAAM,aACNhD,EAAK,UAAU,UACf+C,IAAOF,EAAO,UACd,CAACO,EAAWP,EAAOE,CAAI,CAAC,MAExB/C,EAAK,QAAQ,OAAO6C,EAAOE,CAAI,CAAC,GAChC/C,EAAK,eAAe,IACpB+C,MAEHlD,EAAM,KAAKG,CAAI;AAAA,IAClB;AAEA,IAAAyC,IAAIM;AAAA,EACP;AAEA,SAAO,EAAE,OAAAlD,GAAO,aAAAS,GAAa,WAAA4C,EAAA;AAChC;ACvEO,UAAUM,EAA6B;AAAA,EAC3C,OAAAC;AACH,GAAmD;AAChD,aAAW/B,KAAU+B;AAClB,eAAWC,KAAUC,GAAqB;AACvC,YAAMC,IAAgBF,EAAOhC,EAAO,GAAG;AACvC,MAAIkC,MACD,MAAMA;AAAA,IAEZ;AAEN;AAEA,SAASC,EACNnC,GACAoC,GACAC,IAAU,OAAOrC,CAAM,GACxB;AACC,QAAMsC,IAAQ,OAAOtC,KAAW,WAAW,IAAI,OAAO,OAAOA,EAAO,aAAa,EAAE,IAAIA;AAEvF,SAAO,SAAwBf,GAAmC;AAC/D,QAAIqD,EAAM,KAAKrD,CAAG;AACf,aAAO;AAAA,QACJ,UAAAmD;AAAA,QACA,SAAS,eAAeC,CAAO,sCAAsCD,CAAQ;AAAA,MAAA;AAAA,EAGtF;AACH;AAEA,SAASG,EAA6BvC,GAAgBoC,GAAiC;AACpF,QAAME,IAAQ,IAAI,OAAO,OAAOtC,EAAO,YAAA,EAAc,QAAQ,OAAO,SAAU,CAAC,EAAE;AACjF,SAAOmC,EAAqBG,GAAOF,GAAUpC,CAAM;AACtD;AAEA,MAAMiC,IAAsB;AAAA,EACzBE,EAAqB,SAAS,kBAAkB;AAAA,EAChDA,EAAqB,gBAAgB,oBAAoB;AAAA,EACzDA,EAAqB,eAAe,mBAAmB;AAAA,EACvDA,EAAqB,kBAAkB,sBAAsB;AAAA,EAC7DA,EAAqB,iBAAiB,qBAAqB;AAAA,EAC3DA,EAAqB,kBAAkB,sBAAsB;AAAA,EAC7DA,EAAqB,cAAc,kBAAkB;AAAA,EACrDA,EAAqB,mBAAmB,uBAAuB;AAAA,EAC/DI,EAA6B,qBAAqB,6BAA6B;AAAA,EAC/EA,EAA6B,gBAAgB,yBAAyB;AAAA,EACtEJ,EAAqB,iBAAiB,yBAAyB;AAAA,EAC/DI,EAA6B,iBAAiB,yBAAyB;AAAA,EACvEA,EAA6B,gBAAgB,mBAAmB;AAAA,EAChEA,EAA6B,iBAAiB,mBAAmB;AAAA,EACjEA,EAA6B,eAAe,uBAAuB;AAAA,EACnEJ,EAAqB,oBAAoB,wBAAwB;AAAA,EACjEI,EAA6B,gBAAgB,wBAAwB;AAAA,EACrEA,EAA6B,kBAAkB,wBAAwB;AAAA,EACvEA,EAA6B,iBAAiB,wBAAwB;AAAA,EACtEA,EAA6B,kBAAkB,6BAA6B;AAAA,EAC5EA,EAA6B,sBAAsB,iBAAiB;AAAA,EACpEA,EAA6B,qBAAqB,iBAAiB;AAAA,EACnEJ,EAAqB,mBAAmB,mBAAmB;AAC9D;AC3DO,UAAUK,EACd5C,GACAzB,GACyB;AACzB,aAAWG,KAAQH;AAChB,eAAW6D,KAAUS,GAAoB;AACtC,YAAMP,IAAgBF,EAAOpC,GAAMtB,EAAK,IAAI;AAC5C,MAAI4D,MACD,MAAMA;AAAA,IAEZ;AAEN;AAEA,SAASQ,EACN9C,GACAtB,GACA8D,GACAvD,IAAO,OAAOP,CAAI,GACnB;AACC,QAAMgE,IAAQ,OAAOhE,KAAS,WAAW,IAAI,OAAO,OAAOA,EAAK,aAAa,EAAE,IAAIA,GAC7E+D,IAAU,UAAUzC,IAAO,GAAGA,CAAI,kBAAkB,EAAE,GAAGf,CAAI,sCAAsCuD,CAAQ;AAEjH,SAAO,SAAqBO,GAA4BC,GAAwC;AAC7F,SAAK,CAAChD,KAAQ+C,MAAgB/C,MAAS0C,EAAM,KAAKM,CAAQ;AACvD,aAAO;AAAA,QACJ,UAAAR;AAAA,QACA,SAAAC;AAAA,MAAA;AAAA,EAGT;AACH;AAEA,MAAMI,IAAqB;AAAA,EACxBC;AAAA,IACG;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA;AAAA,EAEHA,EAAmB,SAAS,UAAU,iBAAiB;AAAA,EACvDA,EAAmB,SAAS,OAAO,iBAAiB;AAAA,EACpDA,EAAmB,QAAQ,UAAU,iBAAiB;AAAA,EACtDA,EAAmB,MAAM,cAAc,wBAAwB;AAClE;ACzCO,SAASG,EACbjD,GACAzB,GACA6B,GACgB;AAChB,SAAO,CAAC,GAAGwC,EAAsB5C,GAAMzB,CAAK,GAAG,GAAG2D,EAA6B9B,CAAM,CAAC;AACzF;ACAO,SAAS8C,KAAa3B,GAAwC;AAClE,QAAM,EAAE,OAAAhD,GAAO,WAAA4E,MAAc7B,EAAiBC,CAAM,GAE9CvB,IAAOmD,IAAY5B,EAAO,SAAS,OAAOA,EAAO4B,CAAS,CAAC,EAAE,YAAA,IAAgB,MAC7EC,IAAapD,MAAS,OAAOuB,EAAO,MAAM4B,IAAY,CAAC,IAAI,CAAA,GAE3D,EAAE,aAAAnE,GAAa,WAAA4C,EAAA,IAAcD,EAAeyB,GAAYpD,GAAMzB,CAAK,GACnE6B,IAASL,EAAoBC,GAAMzB,GAAOS,CAAW;AAE3D,SAAO;AAAA,IACJ,MAAAgB;AAAA,IACA,OAAOzB,EAAM,IAAI8E,CAAY;AAAA,IAC7B,OAAOzB;AAAA,IACP,QAAAxB;AAAA,IACA,iBAAiBkD,EAAkBL,EAAsBjD,GAAMzB,GAAO6B,CAAM,CAAC;AAAA,EAAA;AAEnF;AAEA,SAASkD,EAAkBC,GAAkC;AAC1D,SAAO,OAAO,eAAeA,GAAiB,mBAAmB;AAAA,IAC9D,OAAOA;AAAA,EAAA,CACT;AACJ;AAEA,SAASF,EAAa,EAAE,OAAAG,GAAO,MAAAvE,KAA0B;AACtD,SAAOuE,MAAU,SAAY,EAAE,MAAAvE,GAAM,OAAAuE,EAAA,IAAU,EAAE,MAAAvE,EAAA;AACpD;AClCA,MAAMwE,IAAa;AAAA,EAChB,QAAU;AAAA,EACV,aAAe;AAAA,EACf,mBAAqB;AAAA,EACrB,mBAAqB;AAAA,EACrB,kBAAoB;AAAA,EACpB,YAAc;AAAA,EACd,YAAc;AAAA,EACd,eAAiB;AAAA,EACjB,mBAAqB;AAAA,EACrB,WAAa;AAAA,EACb,mBAAqB;AAAA,EACrB,kBAAoB;AAAA,EACpB,qBAAuB;AAAA,EACvB,SAAW;AAAA,EACX,iBAAmB;AAAA,EACnB,OAAS;AAAA,EACT,QAAU;AAAA,EACV,aAAe;AAClB;AAMA,UAAUC,EAAqBC,GAAqC;AACjE,QAAMC,IAAQ,SAASD,EAAI,oBAAoB,KAAK,EAAE;AACtD,WAASE,IAAQ,GAAGA,IAAQD,GAAOC,KAAS;AACzC,UAAMxE,IAAMsE,EAAI,kBAAkBE,CAAK,EAAE,GACnCL,IAAQG,EAAI,oBAAoBE,CAAK,EAAE;AAE7C,IAAIxE,MAAQ,WACT,MAAM,EAAE,KAAKA,EAAI,YAAA,EAAc,QAAQ,OAAAmE,GAAO,OAAO,MAAA;AAAA,EAE3D;AACH;AAEA,UAAUM,EAA6BH,GAAuC;AAC3E,aAAWtE,KAAO,OAAO,KAAKsE,CAAG;AAC9B,QAAII,EAAY1E,CAAG,GAAG;AACnB,YAAMmD,IAAWiB,EAAWpE,CAAG;AAC/B,YAAM;AAAA,QACH,UAAAmD;AAAA,QACA,SAAS,WAAWnD,EAAI,YAAA,CAAa,uCAAuCmD,CAAQ;AAAA,MAAA;AAAA,IAE1F;AAEN;AAEA,SAASuB,EAAY1E,GAA6C;AAC/D,SAAO,OAAO,OAAOoE,GAAYpE,CAAG;AACvC;AAEA,SAAS2E,EAAWL,GAAsC;AACvD,QAAMM,IAAiB,CAAA;AACvB,aAAW,CAAC5E,GAAKmE,CAAK,KAAK,OAAO,QAAQG,CAAG,GAAG;AAC7C,UAAMO,IAAS7E,EAAI,YAAA,EAAc,KAAA;AACjC,KAAI0E,EAAYG,CAAM,KAAKA,EAAO,WAAW,KAAK,OAC/CD,EAAOC,CAAM,IAAI,OAAOV,CAAK;AAAA,EAEnC;AACA,SAAOS;AACV;AAEO,SAASE,GAAS1E,GAA8B;AACpD,QAAMkE,IAAMK,EAAWvE,CAAG,GACpBW,IAA+B;AAAA,IAClC,MAAM,CAAA;AAAA,IACN,OAAO,CAAC,GAAGsD,EAAqBC,CAAG,CAAC;AAAA,EAAA,GAEjCJ,IAAkB;AAAA,IACrB,GAAGO,EAA6BH,CAAG;AAAA,IACnC,GAAGV,EAAsB,MAAM,CAAA,GAAI7C,CAAM;AAAA,EAAA;AAG5C,SAAO;AAAA,IACJ,QAAAA;AAAA,IACA,iBAAAmD;AAAA,EAAA;AAEN;AC5EO,SAASa,GAAmB7C,GAA2BoC,GAA8B;AACzF,SAAO,CAAC,GAAGT,EAAU,GAAG3B,CAAM,EAAE,iBAAiB,GAAG4C,GAASR,CAAG,EAAE,eAAe;AACpF;"}
1	+ {"version":3,"file":"index.mjs","sources":["../src/flags/flags.helpers.ts","../src/config/config-operands.ts","../src/config/detect-config-action.ts","../src/config/analyse-config.ts","../src/tokens/flag-specs.ts","../src/tokens/token-expander.ts","../src/flags/parse-global-flags.ts","../src/flags/parse-task-flags.ts","../src/vulnerabilities/detect-vulnerable-config-writes.ts","../src/vulnerabilities/detect-vulnerable-flags.ts","../src/vulnerabilities/vulnerability-analysis.ts","../src/args/parse-argv.ts","../src/env/parse-env.ts","../src/vulnerabilities/vulnerability-check.ts"],"sourcesContent":["export interface Flag {\n name: string;\n value?: string;\n /** Value came from the next token rather than being embedded after `=`. /\n absorbedNext: boolean;\n /* Switch appeared before the git sub-command. /\n isGlobal: boolean;\n}\n\nexport function scopedFlags(flags: Flag[], scope: 'global' \| 'task') {\n const findGlobal = scope === 'global';\n for (const flag of flags) {\n if (flag.isGlobal === findGlobal) {\n yield flag;\n }\n }\n}\n","// Flags that unambiguously signal a write operation on git config.\nexport const CONFIG_WRITE_FLAGS = new Set([\n '--add',\n '--edit',\n '--remove-section',\n '--rename-section',\n '--replace-all',\n '--unset',\n '--unset-all',\n '-e',\n]);\n\n// Flags that unambiguously signal a read operation.\nexport const CONFIG_READ_FLAGS = new Set([\n '--get',\n '--get-all',\n '--get-color',\n '--get-colorbool',\n '--get-regexp',\n '--get-urlmatch',\n '--list',\n '-l',\n]);\n\n// Sub-command verbs accepted as the first positional by newer git versions.\nexport const CONFIG_WRITE_VERBS = new Set([\n 'edit',\n 'remove-section',\n 'rename-section',\n 'set',\n 'unset',\n]);\nexport const CONFIG_READ_VERBS = new Set(['get', 'get-color', 'get-colorbool', 'list']);\n","import type { ConfigScope } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport {\n CONFIG_READ_FLAGS,\n CONFIG_READ_VERBS,\n CONFIG_WRITE_FLAGS,\n CONFIG_WRITE_VERBS,\n} from './config-operands';\n\nexport function detectConfigAction(flags: Flag[], positionals: string[]): ConfigOperation \| null {\n for (const { name } of scopedFlags(flags, 'task')) {\n if (CONFIG_WRITE_FLAGS.has(name)) {\n return configOperation(true, positionals);\n }\n if (CONFIG_READ_FLAGS.has(name)) {\n return configOperation(false, positionals);\n }\n }\n\n const verb = positionals.at(0)?.toLowerCase();\n\n if (verb === undefined) {\n return null;\n }\n\n if (CONFIG_WRITE_VERBS.has(verb)) {\n return configOperation(true, positionals.slice(1));\n }\n\n if (CONFIG_READ_VERBS.has(verb)) {\n return configOperation(false, positionals.slice(1));\n }\n\n if (positionals.length === 1) {\n return configOperation(false, positionals);\n }\n\n return configOperation(true, positionals);\n}\n\nfunction configOperation(isWrite = false, positionals: string[] = []): ConfigOperation \| null {\n const key = positionals.at(0)?.toLowerCase();\n\n if (key === undefined) {\n return null;\n }\n\n return {\n isWrite,\n isRead: !isWrite,\n key,\n value: positionals.at(1),\n };\n}\n\nexport function toOperation(scope: ConfigScope, operation: ConfigOperation) {\n if (operation.isWrite && operation.value !== undefined) {\n return { key: operation.key, value: operation.value, scope };\n }\n return { key: operation.key, scope };\n}\n","import type { ConfigScope, ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport { type Flag, scopedFlags } from '../flags/flags.helpers';\nimport type { ConfigOperation } from './config.types';\nimport { detectConfigAction, toOperation } from './detect-config-action';\n\nfunction parseAssignment(raw: string \| undefined): { key: string; value: string } \| null {\n const eq = raw?.indexOf('=') \|\| -1;\n\n if (!raw \|\| eq < 0) {\n return null;\n }\n\n return {\n key: raw.slice(0, eq).trim().toLowerCase(),\n value: raw.slice(eq + 1),\n };\n}\n\nfunction detectConfigScope(flags: Flag[]): ConfigScope {\n for (const { name } of scopedFlags(flags, 'task')) {\n switch (name) {\n case '--global':\n return 'global';\n case '--system':\n return 'system';\n case '--worktree':\n return 'worktree';\n case '--local':\n return 'local';\n case '--file':\n case '-f':\n return 'file';\n }\n }\n return 'local';\n}\n\nfunction detectConfigOverrideScope({ name }: Flag): ConfigScope \| void {\n if (name === '-c' \|\| name === '--config') {\n return 'inline';\n }\n if (name === '--config-env') {\n return 'env';\n }\n}\n\n/*\n Generates the stream of ConfigWrite settings found in the supplied flags,\n * triggered by `-c` and `--config` for inline configuration and `--config-env`\n * to set a config setting based on environment variable.\n /\nfunction collectWriteFlags(flags: Flag[]): Generator<ConfigWrite> {\n for (const flag of flags) {\n const scope = detectConfigOverrideScope(flag);\n const assignment = scope && parseAssignment(flag.value);\n\n if (assignment) {\n yield {\n ...assignment,\n scope,\n };\n }\n }\n}\n\nexport function collectConfigAccess(\n task: string \| null,\n flags: Flag[],\n positionals: string[]\n): ParsedConfigActivity {\n const parsedConfig: ParsedConfigActivity = {\n read: [],\n write: [...collectWriteFlags(flags)],\n };\n\n if (task === 'config') {\n appendParsedConfigAction(\n parsedConfig,\n detectConfigScope(flags),\n detectConfigAction(flags, positionals)\n );\n }\n\n return parsedConfig;\n}\n\nfunction appendParsedConfigAction(\n parsedConfig: ParsedConfigActivity,\n scope: ConfigScope,\n action: ConfigOperation \| null\n) {\n if (action === null) {\n return;\n }\n\n const config = toOperation(scope, action);\n if (action.isWrite) {\n parsedConfig.write.push(config);\n } else {\n parsedConfig.read.push(config);\n }\n}\n","// ── Option tables ─────────────────────────────────────────────────────────────\n//\n// Each scope has:\n// short – Map<char, consumesNext> (known single-letter switches; true = takes next token)\n// long – Set<stem> (long switch stems, without --, that take the next token)\n//\n// Only switches listed here are \"known\". An unknown char anywhere in a combined\n// cluster causes the entire cluster to be kept as one opaque token.\n\nexport interface FlagSpec {\n readonly short: ReadonlyMap<string, boolean>;\n readonly long: ReadonlySet<string>;\n}\n\nconst UNIVERSAL: FlagSpec = {\n short: new Map([\n ['c', true], // -c <k=v> set config key for this invocation\n ]),\n long: new Set(),\n};\n\nexport const GLOBAL: FlagSpec = {\n short: new Map([\n ['C', true], // -C <path> change working directory\n ['P', false], // -P no pager (alias for --no-pager)\n ['h', false], // -h help\n ['p', false], // -p paginate\n ['v', false], // -v version\n ...UNIVERSAL.short.entries(),\n ]),\n long: new Set([\n 'attr-source',\n 'config-env',\n 'exec-path',\n 'git-dir',\n 'list-cmds',\n 'namespace',\n 'super-prefix',\n 'work-tree',\n ]),\n};\n\nconst COMMANDS: Record<string, FlagSpec> = {\n clone: {\n short: new Map([\n ['b', true], // -b <branch>\n ['j', true], // -j <n> parallel jobs\n ['l', false], // -l local\n ['n', false], // -n no-checkout\n ['o', true], // -o <name> remote name\n ['q', false], // -q quiet\n ['s', false], // -s shared\n ['u', true], // -u <upload-pack>\n ]),\n long: new Set(['branch', 'config', 'jobs', 'origin', 'upload-pack', 'u', 'template']),\n },\n commit: {\n short: new Map([\n ['C', true], // -C <commit> reuse message\n ['F', true], // -F <file> read message from file\n ['c', true], // -c <commit> reedit message\n ['m', true], // -m <msg>\n ['t', true], // -t <template>\n ]),\n long: new Set(['file', 'message', 'reedit-message', 'reuse-message', 'template']),\n },\n config: {\n short: new Map([\n ['e', false], // -e open editor\n ['f', true], // -f <file>\n ['l', false], // -l list\n ]),\n long: new Set(['blob', 'comment', 'default', 'file', 'type', 'value']),\n },\n fetch: {\n short: new Map(),\n long: new Set(['upload-pack']),\n },\n init: {\n short: new Map(),\n long: new Set(['template']),\n },\n pull: {\n short: new Map(),\n long: new Set(['upload-pack']),\n },\n push: {\n short: new Map(),\n long: new Set(['exec', 'receive-pack']),\n },\n rebase: {\n short: new Map([\n ['X', true], // -X <option> strategy option\n ['f', false], // -f force-rebase\n ['i', false], // -i interactive\n ['k', false], // -k keep-base\n ['m', false], // -m merge\n ['n', false], // -n no-stat\n ['q', false], // -q quiet\n ['r', false], // -r rebase-merges\n ['s', true], // -s <strategy>\n ['v', false], // -v verbose\n ['x', true], // -x <cmd> exec\n ]),\n long: new Set(['exec', 'onto', 'strategy', 'strategy-option']),\n },\n};\n\nconst EMPTY: FlagSpec = { short: new Map(), long: new Set() };\n\nexport function getFlagSpecForTask(task?: string \| null) {\n const spec = COMMANDS[task ?? ''] ?? EMPTY;\n\n return {\n short: new Map([...UNIVERSAL.short.entries(), ...spec.short.entries()]),\n long: spec.long,\n };\n}\n","import { GLOBAL } from './flag-specs';\n\n/** Parse a single raw token (e.g. `'-m'`, `'--amend'`, `'-uc'`) into one or\n * more switch descriptors. Values are not yet resolved for needsNext=true. /\nexport function expandToken(\n raw: string,\n spec = GLOBAL\n): Array<{\n name: string;\n value?: string;\n needsNext: boolean;\n}> {\n if (raw.startsWith('--')) {\n const eq = raw.indexOf('=');\n if (eq > 2) {\n return [{ name: raw.slice(0, eq), value: raw.slice(eq + 1), needsNext: false }];\n }\n const stem = raw.slice(2);\n return [{ name: raw, needsNext: spec.long.has(stem) }];\n }\n\n // Single short switch\n if (raw.length === 2) {\n const char = raw.charAt(1);\n const consumes = spec.short.get(char);\n return [{ name: raw, needsNext: consumes === true }];\n }\n\n // Combined short cluster: try to expand char-by-char\n return expandCluster(raw, spec.short);\n}\n\nfunction expandCluster(\n raw: string,\n shortSpec: ReadonlyMap<string, boolean>\n): Array<{ name: string; value?: string; needsNext: boolean }> {\n const chars = raw.slice(1).split('');\n const result: Array<{ name: string; value?: string; needsNext: boolean }> = [];\n\n for (let i = 0; i < chars.length; i++) {\n const char = chars[i];\n const consumes = shortSpec.get(char);\n\n if (consumes === undefined) {\n // Unknown char: keep the whole raw token as opaque\n return [{ name: raw, needsNext: false }];\n }\n\n if (consumes) {\n const remainder = chars.slice(i + 1).join('');\n if (remainder) {\n const remainderAllKnown = [...remainder].every((c) => shortSpec.has(c));\n if (!remainderAllKnown) {\n // Remaining chars are the embedded value, not separate flags\n result.push({ name: `-${char}`, value: remainder, needsNext: false });\n return result;\n }\n }\n }\n\n result.push({ name: `-${char}`, needsNext: consumes });\n }\n\n return result;\n}\n","import { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\nexport interface GlobalFlags {\n flags: Flag[];\n taskIndex: number;\n}\n\nexport function parseGlobalFlags(tokens: readonly unknown[], flags: Flag[] = []): GlobalFlags {\n let i = 0;\n\n while (i < tokens.length) {\n const raw = String(tokens[i]);\n if (!raw.startsWith('-') \|\| raw.length < 2) break;\n\n const parsed = expandToken(raw);\n let next = i + 1;\n\n for (const token of parsed) {\n const flag: Flag = {\n name: token.name,\n value: token.value,\n absorbedNext: false,\n isGlobal: true,\n };\n if (token.needsNext && flag.value === undefined && next < tokens.length) {\n flag.value = String(tokens[next]);\n flag.absorbedNext = true;\n next++;\n }\n flags.push(flag);\n }\n\n i = next;\n }\n\n return { flags, taskIndex: i };\n}\n","import { isPathSpec, toPaths } from '@simple-git/args-pathspec';\n\nimport { getFlagSpecForTask } from '../tokens/flag-specs';\nimport { expandToken } from '../tokens/token-expander';\nimport type { Flag } from './flags.helpers';\n\ntype TaskFlags = {\n flags: Flag[];\n positionals: string[];\n pathspecs: string[];\n};\n\nexport function parseTaskFlags(\n tokens: readonly unknown[],\n task: string \| null,\n flags: Flag[] = []\n): TaskFlags {\n const spec = getFlagSpecForTask(task);\n const positionals: string[] = [];\n const pathspecs: string[] = [];\n\n let i = 0;\n while (i < tokens.length) {\n const current = tokens[i];\n\n if (isPathSpec(current)) {\n pathspecs.push(...toPaths(current as string));\n i++;\n continue;\n }\n\n const raw = String(current);\n\n if (raw === '--') {\n for (let j = i + 1; j < tokens.length; j++) {\n const t = tokens[j];\n isPathSpec(t) ? pathspecs.push(...toPaths(t as string)) : pathspecs.push(String(t));\n }\n break;\n }\n\n if (!raw.startsWith('-') \|\| raw.length < 2) {\n positionals.push(raw);\n i++;\n continue;\n }\n\n const parsed = expandToken(raw, spec);\n let next = i + 1;\n\n for (const token of parsed) {\n const flag: Flag = {\n name: token.name,\n value: token.value,\n absorbedNext: false,\n isGlobal: false,\n };\n if (\n token.needsNext &&\n flag.value === undefined &&\n next < tokens.length &&\n !isPathSpec(tokens[next])\n ) {\n flag.value = String(tokens[next]);\n flag.absorbedNext = true;\n next++;\n }\n flags.push(flag);\n }\n\n i = next;\n }\n\n return { flags, positionals, pathspecs };\n}\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function detectVulnerableConfigWrites({\n write,\n}: ParsedConfigActivity): Generator<Vulnerability> {\n for (const config of write) {\n for (const helper of preventUnsafeConfig) {\n const vulnerability = helper(config.key);\n if (vulnerability) {\n yield vulnerability;\n }\n }\n }\n}\n\nfunction preventConfigBuilder(\n config: string \| RegExp,\n category: VulnerabilityCategory,\n message = String(config)\n) {\n const regex = typeof config === 'string' ? new RegExp(`\\\\s${config.toLowerCase()}`) : config;\n\n return function preventCommand(key: string): Vulnerability \| void {\n if (regex.test(key)) {\n return {\n category,\n message: `Configuring ${message} is not permitted without enabling ${category}`,\n };\n }\n };\n}\n\nfunction preventExpandedConfigBuilder(config: string, category: VulnerabilityCategory) {\n const regex = new RegExp(`\\\\s${config.toLowerCase().replace(/\\./g, '(..+)?.')}`);\n return preventConfigBuilder(regex, category, config);\n}\n\nconst preventUnsafeConfig = [\n preventConfigBuilder('alias', 'allowUnsafeAlias'),\n preventConfigBuilder('core.askPass', 'allowUnsafeAskPass'),\n preventConfigBuilder('core.editor', 'allowUnsafeEditor'),\n preventConfigBuilder('core.fsmonitor', 'allowUnsafeFsMonitor'),\n preventConfigBuilder('core.gitProxy', 'allowUnsafeGitProxy'),\n preventConfigBuilder('core.hooksPath', 'allowUnsafeHooksPath'),\n preventConfigBuilder('core.pager', 'allowUnsafePager'),\n preventConfigBuilder('core.sshCommand', 'allowUnsafeSshCommand'),\n preventExpandedConfigBuilder('credential.helper', 'allowUnsafeCredentialHelper'),\n preventExpandedConfigBuilder('diff.command', 'allowUnsafeDiffExternal'),\n preventConfigBuilder('diff.external', 'allowUnsafeDiffExternal'),\n preventExpandedConfigBuilder('difftool.cmd', 'allowUnsafeDiffExternal'),\n preventExpandedConfigBuilder('diff.textconv', 'allowUnsafeDiffTextConv'),\n preventExpandedConfigBuilder('filter.clean', 'allowUnsafeFilter'),\n preventExpandedConfigBuilder('filter.process', 'allowUnsafeFilter'),\n preventExpandedConfigBuilder('filter.smudge', 'allowUnsafeFilter'),\n preventExpandedConfigBuilder('gpg.program', 'allowUnsafeGpgProgram'),\n preventConfigBuilder('include.path', 'allowUnsafeInclude'),\n preventExpandedConfigBuilder('includeIf', 'allowUnsafeInclude'),\n preventConfigBuilder('init.templateDir', 'allowUnsafeTemplateDir'),\n preventExpandedConfigBuilder('pager.', 'allowUnsafePager'),\n preventExpandedConfigBuilder('merge.driver', 'allowUnsafeMergeDriver'),\n preventExpandedConfigBuilder('mergetool.path', 'allowUnsafeMergeDriver'),\n preventExpandedConfigBuilder('mergetool.cmd', 'allowUnsafeMergeDriver'),\n preventExpandedConfigBuilder('protocol.allow', 'allowUnsafeProtocolOverride'),\n preventExpandedConfigBuilder('remote.receivepack', 'allowUnsafePack'),\n preventExpandedConfigBuilder('remote.uploadpack', 'allowUnsafePack'),\n preventConfigBuilder('uploadpack.packObjectsHook', 'allowUnsafePack'),\n preventConfigBuilder('sequence.editor', 'allowUnsafeEditor'),\n preventExpandedConfigBuilder('submodule.update', 'allowUnsafeSubmodule'),\n preventExpandedConfigBuilder('tar.command', 'allowUnsafeCommandBinaries'),\n preventExpandedConfigBuilder('trailer.cmd', 'allowUnsafeCommandBinaries'),\n preventExpandedConfigBuilder('trailer.command', 'allowUnsafeCommandBinaries'),\n preventExpandedConfigBuilder('url.insteadOf', 'allowUnsafeUrlRewrite'),\n];\n","import type { Flag } from '../flags/flags.helpers';\nimport type { Vulnerability, VulnerabilityCategory } from './vulnerability.types';\n\nexport function* detectVulnerableFlags(\n task: null \| string,\n flags: Flag[]\n): Generator<Vulnerability> {\n for (const flag of flags) {\n for (const helper of preventUnsafeFlags) {\n const vulnerability = helper(task, flag);\n if (vulnerability) {\n yield vulnerability;\n }\n }\n }\n}\n\ninterface PreventFlagOptions {\n /** Label to use in the error message in place of the matcher itself /\n name?: string;\n\n /* Only match when the switch appears before the git sub-command /\n globalOnly?: boolean;\n\n /\n Only match when the switch was supplied with a value - without one switches\n * such as `--git-dir` and `--exec-path` are getters rather than setters.\n /\n withValue?: boolean;\n}\n\nfunction preventFlagBuilder(\n task: string \| null,\n flag: string \| RegExp,\n category: VulnerabilityCategory,\n { name = String(flag), globalOnly = false, withValue = false }: PreventFlagOptions = {}\n) {\n const regex = typeof flag === 'string' ? new RegExp(`\\\\s${flag.toLowerCase()}`) : flag;\n const message = `Use of ${task ? `${task} with option ` : ''}${name} is not permitted without enabling ${category}`;\n\n return function preventFlag(currentTask: string \| null, flag: Flag): Vulnerability \| void {\n if (task && currentTask !== task) {\n return;\n }\n\n if (globalOnly && !flag.isGlobal) {\n return;\n }\n\n if (withValue && flag.value === undefined) {\n return;\n }\n\n if (regex.test(flag.name)) {\n return {\n category,\n message,\n };\n }\n };\n}\n\nconst pathTakingGlobal: PreventFlagOptions = { globalOnly: true, withValue: true };\n\nconst preventUnsafeFlags = [\n preventFlagBuilder(null, /--(upload\|receive)-pack/, 'allowUnsafePack', {\n name: '--upload-pack or --receive-pack',\n }),\n preventFlagBuilder('clone', /^-\\wu/, 'allowUnsafePack'),\n preventFlagBuilder('clone', '--u', 'allowUnsafePack'),\n preventFlagBuilder('push', /^--exec$/, 'allowUnsafePack', { name: '--exec' }),\n // `git` accepts unambiguous abbreviations of long options, so `--ex` and `--exe` are `--exec`\n preventFlagBuilder('rebase', /^(-x\|--ex(ec?)?)$/, 'allowUnsafeExec', { name: '-x or --exec' }),\n preventFlagBuilder(null, '--template', 'allowUnsafeTemplateDir'),\n preventFlagBuilder(null, '--exec-path', 'allowUnsafeExec', pathTakingGlobal),\n // `git` reads the configuration of whichever repository these name, so the\n // directory alone is enough to deliver config the argv guards never see\n preventFlagBuilder(null, '--git-dir', 'allowUnsafeConfigPaths', pathTakingGlobal),\n preventFlagBuilder(null, '--work-tree', 'allowUnsafeConfigPaths', pathTakingGlobal),\n preventFlagBuilder(null, /^-C$/, 'allowUnsafeConfigPaths', { ...pathTakingGlobal, name: '-C' }),\n];\n","import type { ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Flag } from '../flags/flags.helpers';\nimport { detectVulnerableConfigWrites } from './detect-vulnerable-config-writes';\nimport { detectVulnerableFlags } from './detect-vulnerable-flags';\nimport type { Vulnerability } from './vulnerability.types';\n\nexport function vulnerabilityAnalysis(\n task: null \| string,\n flags: Flag[],\n config: ParsedConfigActivity\n): Vulnerability[] {\n return [...detectVulnerableFlags(task, flags), ...detectVulnerableConfigWrites(config)];\n}\n","import { collectConfigAccess } from '../config/analyse-config';\nimport type { Flag } from '../flags/flags.helpers';\nimport { parseGlobalFlags } from '../flags/parse-global-flags';\nimport { parseTaskFlags } from '../flags/parse-task-flags';\nimport type { Vulnerability } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\nimport type { ParsedArgv, ParsedFlag } from './parse-argv.types';\n\n/\n Parse the tokens that would be forwarded to a `git` child-process and\n * return a structured summary of what the invocation does.\n /\nexport function parseArgv(...tokens: readonly unknown[]): ParsedArgv {\n const { flags, taskIndex } = parseGlobalFlags(tokens);\n\n const task = taskIndex < tokens.length ? String(tokens[taskIndex]).toLowerCase() : null;\n const taskTokens = task !== null ? tokens.slice(taskIndex + 1) : [];\n\n const { positionals, pathspecs } = parseTaskFlags(taskTokens, task, flags);\n const config = collectConfigAccess(task, flags, positionals);\n\n return {\n task,\n flags: flags.map(toParsedFlag),\n paths: pathspecs,\n config,\n vulnerabilities: vulnerabilityList(vulnerabilityAnalysis(task, flags, config)),\n };\n}\n\nfunction vulnerabilityList(vulnerabilities: Vulnerability[]) {\n return Object.defineProperty(vulnerabilities, 'vulnerabilities', {\n value: vulnerabilities,\n });\n}\n\nfunction toParsedFlag({ value, name }: Flag): ParsedFlag {\n return value !== undefined ? { name, value } : { name };\n}\n","import type { ConfigWrite, ParsedConfigActivity } from '../args/parse-argv.types';\nimport type { Vulnerability, VulnerabilityCategory } from '../vulnerabilities/vulnerability.types';\nimport { vulnerabilityAnalysis } from '../vulnerabilities/vulnerability-analysis';\n\nconst GitEnvKeys = {\n 'editor': 'allowUnsafeEditor',\n 'git_askpass': 'allowUnsafeAskPass',\n 'git_config_global': 'allowUnsafeConfigPaths',\n 'git_config_system': 'allowUnsafeConfigPaths',\n 'git_config_count': 'allowUnsafeConfigEnvCount',\n 'git_config_parameters': 'allowUnsafeConfigEnvCount',\n 'git_config': 'allowUnsafeConfigPaths',\n 'git_editor': 'allowUnsafeEditor',\n 'git_exec_path': 'allowUnsafeExec',\n 'git_external_diff': 'allowUnsafeDiffExternal',\n 'git_pager': 'allowUnsafePager',\n 'git_proxy_command': 'allowUnsafeGitProxy',\n 'git_template_dir': 'allowUnsafeTemplateDir',\n 'git_sequence_editor': 'allowUnsafeEditor',\n 'git_ssh': 'allowUnsafeSshCommand',\n 'git_ssh_command': 'allowUnsafeSshCommand',\n 'pager': 'allowUnsafePager',\n 'prefix': 'allowUnsafeConfigPaths',\n 'ssh_askpass': 'allowUnsafeAskPass',\n 'visual': 'allowUnsafeEditor',\n} as const satisfies Record<string, VulnerabilityCategory>;\n\ntype GitEnv = Record<string, string> & {\n git_config_count?: string;\n};\n\nfunction collectConfigByCount(env: GitEnv): Generator<ConfigWrite> {\n const count = parseInt(env.git_config_count ?? '0', 10);\n for (let index = 0; index < count; index++) {\n const key = env[`git_config_key_${index}`];\n const value = env[`git_config_value_${index}`];\n\n if (key !== undefined) {\n yield { key: key.toLowerCase().trim(), value, scope: 'env' };\n }\n }\n}\n\nfunction* collectConfigVulnerabilities(env: GitEnv): Generator<Vulnerability> {\n for (const key of Object.keys(env)) {\n if (isGitEnvKey(key)) {\n const category = GitEnvKeys[key];\n yield {\n category,\n message: `Use of \"${key.toUpperCase()}\" is not permitted without enabling ${category}`,\n };\n }\n }\n}\n\nexport function isGitEnvKey(key: string): key is keyof typeof GitEnvKeys {\n return Object.hasOwn(GitEnvKeys, key);\n}\n\nfunction prepareEnv(env: Record<string, unknown>): GitEnv {\n const gitEnv: GitEnv = {};\n for (const [key, value] of Object.entries(env)) {\n const envKey = key.toLowerCase().trim();\n if (isGitEnvKey(envKey) \|\| envKey.startsWith('git')) {\n gitEnv[envKey] = String(value);\n }\n }\n return gitEnv;\n}\n\nexport function parseEnv(raw: Record<string, unknown>) {\n const env = prepareEnv(raw);\n const config: ParsedConfigActivity = {\n read: [],\n write: [...collectConfigByCount(env)],\n };\n const vulnerabilities = [\n ...collectConfigVulnerabilities(env),\n ...vulnerabilityAnalysis(null, [], config),\n ];\n\n return {\n config,\n vulnerabilities,\n };\n}\n","import { parseArgv } from '../args/parse-argv';\nimport { parseEnv } from '../env/parse-env';\n\n/*\n Retrieves just the vulnerabilities identified in the supplied varargs tokens\n * and environment variables.\n */\nexport function vulnerabilityCheck(tokens: readonly string[], env: Record<string, unknown>) {\n return [...parseArgv(...tokens).vulnerabilities, ...parseEnv(env).vulnerabilities];\n}\n"],"names":["scopedFlags","flags","scope","findGlobal","flag","CONFIG_WRITE_FLAGS","CONFIG_READ_FLAGS","CONFIG_WRITE_VERBS","CONFIG_READ_VERBS","detectConfigAction","positionals","name","configOperation","verb","isWrite","key","toOperation","operation","parseAssignment","raw","eq","detectConfigScope","detectConfigOverrideScope","collectWriteFlags","assignment","collectConfigAccess","task","parsedConfig","appendParsedConfigAction","action","config","UNIVERSAL","GLOBAL","COMMANDS","EMPTY","getFlagSpecForTask","spec","expandToken","stem","char","consumes","expandCluster","shortSpec","chars","result","i","remainder","c","parseGlobalFlags","tokens","parsed","next","token","parseTaskFlags","pathspecs","current","isPathSpec","toPaths","j","t","detectVulnerableConfigWrites","write","helper","preventUnsafeConfig","vulnerability","preventConfigBuilder","category","message","regex","preventExpandedConfigBuilder","detectVulnerableFlags","preventUnsafeFlags","preventFlagBuilder","globalOnly","withValue","currentTask","pathTakingGlobal","vulnerabilityAnalysis","parseArgv","taskIndex","taskTokens","toParsedFlag","vulnerabilityList","vulnerabilities","value","GitEnvKeys","collectConfigByCount","env","count","index","collectConfigVulnerabilities","isGitEnvKey","prepareEnv","gitEnv","envKey","parseEnv","vulnerabilityCheck"],"mappings":";AASO,UAAUA,EAAYC,GAAeC,GAA0B;AACnE,QAAMC,IAAaD,MAAU;AAC7B,aAAWE,KAAQH;AAChB,IAAIG,EAAK,aAAaD,MACnB,MAAMC;AAGf;ACfO,MAAMC,wBAAyB,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACH,CAAC,GAGYC,wBAAwB,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACH,CAAC,GAGYC,wBAAyB,IAAI;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACH,CAAC,GACYC,wBAAwB,IAAI,CAAC,OAAO,aAAa,iBAAiB,MAAM,CAAC;ACtB/E,SAASC,EAAmBR,GAAeS,GAA+C;AAC9F,aAAW,EAAE,MAAAC,EAAA,KAAUX,EAAYC,GAAO,MAAM,GAAG;AAChD,QAAII,EAAmB,IAAIM,CAAI;AAC5B,aAAOC,EAAgB,IAAMF,CAAW;AAE3C,QAAIJ,EAAkB,IAAIK,CAAI;AAC3B,aAAOC,EAAgB,IAAOF,CAAW;AAAA,EAE/C;AAEA,QAAMG,IAAOH,EAAY,GAAG,CAAC,GAAG,YAAA;AAEhC,SAAIG,MAAS,SACH,OAGNN,EAAmB,IAAIM,CAAI,IACrBD,EAAgB,IAAMF,EAAY,MAAM,CAAC,CAAC,IAGhDF,EAAkB,IAAIK,CAAI,IACpBD,EAAgB,IAAOF,EAAY,MAAM,CAAC,CAAC,IAGjDA,EAAY,WAAW,IACjBE,EAAgB,IAAOF,CAAW,IAGrCE,EAAgB,IAAMF,CAAW;AAC3C;AAEA,SAASE,EAAgBE,IAAU,IAAOJ,IAAwB,CAAA,GAA4B;AAC3F,QAAMK,IAAML,EAAY,GAAG,CAAC,GAAG,YAAA;AAE/B,SAAIK,MAAQ,SACF,OAGH;AAAA,IACJ,SAAAD;AAAA,IACA,QAAQ,CAACA;AAAA,IACT,KAAAC;AAAA,IACA,OAAOL,EAAY,GAAG,CAAC;AAAA,EAAA;AAE7B;AAEO,SAASM,EAAYd,GAAoBe,GAA4B;AACzE,SAAIA,EAAU,WAAWA,EAAU,UAAU,SACnC,EAAE,KAAKA,EAAU,KAAK,OAAOA,EAAU,OAAO,OAAAf,EAAA,IAEjD,EAAE,KAAKe,EAAU,KAAK,OAAAf,EAAA;AAChC;ACxDA,SAASgB,EAAgBC,GAAgE;AACtF,QAAMC,IAAKD,GAAK,QAAQ,GAAG,KAAK;AAEhC,SAAI,CAACA,KAAOC,IAAK,IACP,OAGH;AAAA,IACJ,KAAKD,EAAI,MAAM,GAAGC,CAAE,EAAE,KAAA,EAAO,YAAA;AAAA,IAC7B,OAAOD,EAAI,MAAMC,IAAK,CAAC;AAAA,EAAA;AAE7B;AAEA,SAASC,EAAkBpB,GAA4B;AACpD,aAAW,EAAE,MAAAU,EAAA,KAAUX,EAAYC,GAAO,MAAM;AAC7C,YAAQU,GAAA;AAAA,MACL,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AACF,eAAO;AAAA,MACV,KAAK;AAAA,MACL,KAAK;AACF,eAAO;AAAA,IAAA;AAGhB,SAAO;AACV;AAEA,SAASW,EAA0B,EAAE,MAAAX,KAAkC;AACpE,MAAIA,MAAS,QAAQA,MAAS;AAC3B,WAAO;AAEV,MAAIA,MAAS;AACV,WAAO;AAEb;AAOA,UAAUY,EAAkBtB,GAAuC;AAChE,aAAWG,KAAQH,GAAO;AACvB,UAAMC,IAAQoB,EAA0BlB,CAAI,GACtCoB,IAAatB,KAASgB,EAAgBd,EAAK,KAAK;AAEtD,IAAIoB,MACD,MAAM;AAAA,MACH,GAAGA;AAAA,MACH,OAAAtB;AAAA,IAAA;AAAA,EAGT;AACH;AAEO,SAASuB,EACbC,GACAzB,GACAS,GACqB;AACrB,QAAMiB,IAAqC;AAAA,IACxC,MAAM,CAAA;AAAA,IACN,OAAO,CAAC,GAAGJ,EAAkBtB,CAAK,CAAC;AAAA,EAAA;AAGtC,SAAIyB,MAAS,YACVE;AAAA,IACGD;AAAA,IACAN,EAAkBpB,CAAK;AAAA,IACvBQ,EAAmBR,GAAOS,CAAW;AAAA,EAAA,GAIpCiB;AACV;AAEA,SAASC,EACND,GACAzB,GACA2B,GACD;AACC,MAAIA,MAAW;AACZ;AAGH,QAAMC,IAASd,EAAYd,GAAO2B,CAAM;AACxC,EAAIA,EAAO,UACRF,EAAa,MAAM,KAAKG,CAAM,IAE9BH,EAAa,KAAK,KAAKG,CAAM;AAEnC;ACvFA,MAAMC,IAAsB;AAAA,EACzB,2BAAW,IAAI;AAAA,IACZ,CAAC,KAAK,EAAI;AAAA;AAAA,EAAA,CACZ;AAEJ,GAEaC,IAAmB;AAAA,EAC7B,OAAO,IAAI,IAAI;AAAA,IACZ,CAAC,KAAK,EAAI;AAAA;AAAA,IACV,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,CAAC,KAAK,EAAK;AAAA;AAAA,IACX,GAAGD,EAAU,MAAM,QAAA;AAAA,EAAQ,CAC7B;AAAA,EACD,0BAAU,IAAI;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EAAA,CACF;AACJ,GAEME,IAAqC;AAAA,EACxC,OAAO;AAAA,IACJ,2BAAW,IAAI;AAAA,MACZ,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,IAAA,CACZ;AAAA,IACD,MAAM,oBAAI,IAAI,CAAC,UAAU,UAAU,QAAQ,UAAU,eAAe,KAAK,UAAU,CAAC;AAAA,EAAA;AAAA,EAEvF,QAAQ;AAAA,IACL,2BAAW,IAAI;AAAA,MACZ,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAI;AAAA;AAAA,IAAA,CACZ;AAAA,IACD,0BAAU,IAAI,CAAC,QAAQ,WAAW,kBAAkB,iBAAiB,UAAU,CAAC;AAAA,EAAA;AAAA,EAEnF,QAAQ;AAAA,IACL,2BAAW,IAAI;AAAA,MACZ,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,IAAA,CACb;AAAA,IACD,MAAM,oBAAI,IAAI,CAAC,QAAQ,WAAW,WAAW,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAAA;AAAA,EAExE,OAAO;AAAA,IACJ,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,aAAa,CAAC;AAAA,EAAA;AAAA,EAEhC,MAAM;AAAA,IACH,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,UAAU,CAAC;AAAA,EAAA;AAAA,EAE7B,MAAM;AAAA,IACH,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,aAAa,CAAC;AAAA,EAAA;AAAA,EAEhC,MAAM;AAAA,IACH,2BAAW,IAAA;AAAA,IACX,MAAM,oBAAI,IAAI,CAAC,QAAQ,cAAc,CAAC;AAAA,EAAA;AAAA,EAEzC,QAAQ;AAAA,IACL,2BAAW,IAAI;AAAA,MACZ,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,MACV,CAAC,KAAK,EAAK;AAAA;AAAA,MACX,CAAC,KAAK,EAAI;AAAA;AAAA,IAAA,CACZ;AAAA,IACD,0BAAU,IAAI,CAAC,QAAQ,QAAQ,YAAY,iBAAiB,CAAC;AAAA,EAAA;AAEnE,GAEMC,IAAkB,EAAE,OAAO,oBAAI,OAAO,MAAM,oBAAI,MAAI;AAEnD,SAASC,EAAmBT,GAAsB;AACtD,QAAMU,IAAOH,EAASP,KAAQ,EAAE,KAAKQ;AAErC,SAAO;AAAA,IACJ,OAAO,IAAI,IAAI,CAAC,GAAGH,EAAU,MAAM,QAAA,GAAW,GAAGK,EAAK,MAAM,QAAA,CAAS,CAAC;AAAA,IACtE,MAAMA,EAAK;AAAA,EAAA;AAEjB;ACjHO,SAASC,EACblB,GACAiB,IAAOJ,GAKP;AACA,MAAIb,EAAI,WAAW,IAAI,GAAG;AACvB,UAAMC,IAAKD,EAAI,QAAQ,GAAG;AAC1B,QAAIC,IAAK;AACN,aAAO,CAAC,EAAE,MAAMD,EAAI,MAAM,GAAGC,CAAE,GAAG,OAAOD,EAAI,MAAMC,IAAK,CAAC,GAAG,WAAW,IAAO;AAEjF,UAAMkB,IAAOnB,EAAI,MAAM,CAAC;AACxB,WAAO,CAAC,EAAE,MAAMA,GAAK,WAAWiB,EAAK,KAAK,IAAIE,CAAI,GAAG;AAAA,EACxD;AAGA,MAAInB,EAAI,WAAW,GAAG;AACnB,UAAMoB,IAAOpB,EAAI,OAAO,CAAC,GACnBqB,IAAWJ,EAAK,MAAM,IAAIG,CAAI;AACpC,WAAO,CAAC,EAAE,MAAMpB,GAAK,WAAWqB,MAAa,IAAM;AAAA,EACtD;AAGA,SAAOC,EAActB,GAAKiB,EAAK,KAAK;AACvC;AAEA,SAASK,EACNtB,GACAuB,GAC4D;AAC5D,QAAMC,IAAQxB,EAAI,MAAM,CAAC,EAAE,MAAM,EAAE,GAC7ByB,IAAsE,CAAA;AAE5E,WAASC,IAAI,GAAGA,IAAIF,EAAM,QAAQE,KAAK;AACpC,UAAMN,IAAOI,EAAME,CAAC,GACdL,IAAWE,EAAU,IAAIH,CAAI;AAEnC,QAAIC,MAAa;AAEd,aAAO,CAAC,EAAE,MAAMrB,GAAK,WAAW,IAAO;AAG1C,QAAIqB,GAAU;AACX,YAAMM,IAAYH,EAAM,MAAME,IAAI,CAAC,EAAE,KAAK,EAAE;AAC5C,UAAIC,KAEG,CADsB,CAAC,GAAGA,CAAS,EAAE,MAAM,CAACC,MAAML,EAAU,IAAIK,CAAC,CAAC;AAGnE,eAAAH,EAAO,KAAK,EAAE,MAAM,IAAIL,CAAI,IAAI,OAAOO,GAAW,WAAW,GAAA,CAAO,GAC7DF;AAAA,IAGhB;AAEA,IAAAA,EAAO,KAAK,EAAE,MAAM,IAAIL,CAAI,IAAI,WAAWC,GAAU;AAAA,EACxD;AAEA,SAAOI;AACV;ACxDO,SAASI,EAAiBC,GAA4BhD,IAAgB,IAAiB;AAC3F,MAAI4C,IAAI;AAER,SAAOA,IAAII,EAAO,UAAQ;AACvB,UAAM9B,IAAM,OAAO8B,EAAOJ,CAAC,CAAC;AAC5B,QAAI,CAAC1B,EAAI,WAAW,GAAG,KAAKA,EAAI,SAAS,EAAG;AAE5C,UAAM+B,IAASb,EAAYlB,CAAG;AAC9B,QAAIgC,IAAON,IAAI;AAEf,eAAWO,KAASF,GAAQ;AACzB,YAAM9C,IAAa;AAAA,QAChB,MAAMgD,EAAM;AAAA,QACZ,OAAOA,EAAM;AAAA,QACb,cAAc;AAAA,QACd,UAAU;AAAA,MAAA;AAEb,MAAIA,EAAM,aAAahD,EAAK,UAAU,UAAa+C,IAAOF,EAAO,WAC9D7C,EAAK,QAAQ,OAAO6C,EAAOE,CAAI,CAAC,GAChC/C,EAAK,eAAe,IACpB+C,MAEHlD,EAAM,KAAKG,CAAI;AAAA,IAClB;AAEA,IAAAyC,IAAIM;AAAA,EACP;AAEA,SAAO,EAAE,OAAAlD,GAAO,WAAW4C,EAAA;AAC9B;ACzBO,SAASQ,EACbJ,GACAvB,GACAzB,IAAgB,CAAA,GACN;AACV,QAAMmC,IAAOD,EAAmBT,CAAI,GAC9BhB,IAAwB,CAAA,GACxB4C,IAAsB,CAAA;AAE5B,MAAIT,IAAI;AACR,SAAOA,IAAII,EAAO,UAAQ;AACvB,UAAMM,IAAUN,EAAOJ,CAAC;AAExB,QAAIW,EAAWD,CAAO,GAAG;AACtB,MAAAD,EAAU,KAAK,GAAGG,EAAQF,CAAiB,CAAC,GAC5CV;AACA;AAAA,IACH;AAEA,UAAM1B,IAAM,OAAOoC,CAAO;AAE1B,QAAIpC,MAAQ,MAAM;AACf,eAASuC,IAAIb,IAAI,GAAGa,IAAIT,EAAO,QAAQS,KAAK;AACzC,cAAMC,IAAIV,EAAOS,CAAC;AAClB,QAAAF,EAAWG,CAAC,IAAIL,EAAU,KAAK,GAAGG,EAAQE,CAAW,CAAC,IAAIL,EAAU,KAAK,OAAOK,CAAC,CAAC;AAAA,MACrF;AACA;AAAA,IACH;AAEA,QAAI,CAACxC,EAAI,WAAW,GAAG,KAAKA,EAAI,SAAS,GAAG;AACzC,MAAAT,EAAY,KAAKS,CAAG,GACpB0B;AACA;AAAA,IACH;AAEA,UAAMK,IAASb,EAAYlB,GAAKiB,CAAI;AACpC,QAAIe,IAAON,IAAI;AAEf,eAAWO,KAASF,GAAQ;AACzB,YAAM9C,IAAa;AAAA,QAChB,MAAMgD,EAAM;AAAA,QACZ,OAAOA,EAAM;AAAA,QACb,cAAc;AAAA,QACd,UAAU;AAAA,MAAA;AAEb,MACGA,EAAM,aACNhD,EAAK,UAAU,UACf+C,IAAOF,EAAO,UACd,CAACO,EAAWP,EAAOE,CAAI,CAAC,MAExB/C,EAAK,QAAQ,OAAO6C,EAAOE,CAAI,CAAC,GAChC/C,EAAK,eAAe,IACpB+C,MAEHlD,EAAM,KAAKG,CAAI;AAAA,IAClB;AAEA,IAAAyC,IAAIM;AAAA,EACP;AAEA,SAAO,EAAE,OAAAlD,GAAO,aAAAS,GAAa,WAAA4C,EAAA;AAChC;ACvEO,UAAUM,EAA6B;AAAA,EAC3C,OAAAC;AACH,GAAmD;AAChD,aAAW/B,KAAU+B;AAClB,eAAWC,KAAUC,GAAqB;AACvC,YAAMC,IAAgBF,EAAOhC,EAAO,GAAG;AACvC,MAAIkC,MACD,MAAMA;AAAA,IAEZ;AAEN;AAEA,SAASC,EACNnC,GACAoC,GACAC,IAAU,OAAOrC,CAAM,GACxB;AACC,QAAMsC,IAAQ,OAAOtC,KAAW,WAAW,IAAI,OAAO,OAAOA,EAAO,aAAa,EAAE,IAAIA;AAEvF,SAAO,SAAwBf,GAAmC;AAC/D,QAAIqD,EAAM,KAAKrD,CAAG;AACf,aAAO;AAAA,QACJ,UAAAmD;AAAA,QACA,SAAS,eAAeC,CAAO,sCAAsCD,CAAQ;AAAA,MAAA;AAAA,EAGtF;AACH;AAEA,SAASG,EAA6BvC,GAAgBoC,GAAiC;AACpF,QAAME,IAAQ,IAAI,OAAO,OAAOtC,EAAO,YAAA,EAAc,QAAQ,OAAO,SAAS,CAAC,EAAE;AAChF,SAAOmC,EAAqBG,GAAOF,GAAUpC,CAAM;AACtD;AAEA,MAAMiC,IAAsB;AAAA,EACzBE,EAAqB,SAAS,kBAAkB;AAAA,EAChDA,EAAqB,gBAAgB,oBAAoB;AAAA,EACzDA,EAAqB,eAAe,mBAAmB;AAAA,EACvDA,EAAqB,kBAAkB,sBAAsB;AAAA,EAC7DA,EAAqB,iBAAiB,qBAAqB;AAAA,EAC3DA,EAAqB,kBAAkB,sBAAsB;AAAA,EAC7DA,EAAqB,cAAc,kBAAkB;AAAA,EACrDA,EAAqB,mBAAmB,uBAAuB;AAAA,EAC/DI,EAA6B,qBAAqB,6BAA6B;AAAA,EAC/EA,EAA6B,gBAAgB,yBAAyB;AAAA,EACtEJ,EAAqB,iBAAiB,yBAAyB;AAAA,EAC/DI,EAA6B,gBAAgB,yBAAyB;AAAA,EACtEA,EAA6B,iBAAiB,yBAAyB;AAAA,EACvEA,EAA6B,gBAAgB,mBAAmB;AAAA,EAChEA,EAA6B,kBAAkB,mBAAmB;AAAA,EAClEA,EAA6B,iBAAiB,mBAAmB;AAAA,EACjEA,EAA6B,eAAe,uBAAuB;AAAA,EACnEJ,EAAqB,gBAAgB,oBAAoB;AAAA,EACzDI,EAA6B,aAAa,oBAAoB;AAAA,EAC9DJ,EAAqB,oBAAoB,wBAAwB;AAAA,EACjEI,EAA6B,UAAU,kBAAkB;AAAA,EACzDA,EAA6B,gBAAgB,wBAAwB;AAAA,EACrEA,EAA6B,kBAAkB,wBAAwB;AAAA,EACvEA,EAA6B,iBAAiB,wBAAwB;AAAA,EACtEA,EAA6B,kBAAkB,6BAA6B;AAAA,EAC5EA,EAA6B,sBAAsB,iBAAiB;AAAA,EACpEA,EAA6B,qBAAqB,iBAAiB;AAAA,EACnEJ,EAAqB,8BAA8B,iBAAiB;AAAA,EACpEA,EAAqB,mBAAmB,mBAAmB;AAAA,EAC3DI,EAA6B,oBAAoB,sBAAsB;AAAA,EACvEA,EAA6B,eAAe,4BAA4B;AAAA,EACxEA,EAA6B,eAAe,4BAA4B;AAAA,EACxEA,EAA6B,mBAAmB,4BAA4B;AAAA,EAC5EA,EAA6B,iBAAiB,uBAAuB;AACxE;ACtEO,UAAUC,EACd5C,GACAzB,GACyB;AACzB,aAAWG,KAAQH;AAChB,eAAW6D,KAAUS,GAAoB;AACtC,YAAMP,IAAgBF,EAAOpC,GAAMtB,CAAI;AACvC,MAAI4D,MACD,MAAMA;AAAA,IAEZ;AAEN;AAgBA,SAASQ,EACN9C,GACAtB,GACA8D,GACA,EAAE,MAAAvD,IAAO,OAAOP,CAAI,GAAG,YAAAqE,IAAa,IAAO,WAAAC,IAAY,GAAA,IAA8B,CAAA,GACtF;AACC,QAAMN,IAAQ,OAAOhE,KAAS,WAAW,IAAI,OAAO,OAAOA,EAAK,aAAa,EAAE,IAAIA,GAC7E+D,IAAU,UAAUzC,IAAO,GAAGA,CAAI,kBAAkB,EAAE,GAAGf,CAAI,sCAAsCuD,CAAQ;AAEjH,SAAO,SAAqBS,GAA4BvE,GAAkC;AACvF,QAAI,EAAAsB,KAAQiD,MAAgBjD,MAIxB,EAAA+C,KAAc,CAACrE,EAAK,aAIpB,EAAAsE,KAAatE,EAAK,UAAU,WAI5BgE,EAAM,KAAKhE,EAAK,IAAI;AACrB,aAAO;AAAA,QACJ,UAAA8D;AAAA,QACA,SAAAC;AAAA,MAAA;AAAA,EAGT;AACH;AAEA,MAAMS,IAAuC,EAAE,YAAY,IAAM,WAAW,GAAA,GAEtEL,IAAqB;AAAA,EACxBC,EAAmB,MAAM,2BAA2B,mBAAmB;AAAA,IACpE,MAAM;AAAA,EAAA,CACR;AAAA,EACDA,EAAmB,SAAS,UAAU,iBAAiB;AAAA,EACvDA,EAAmB,SAAS,OAAO,iBAAiB;AAAA,EACpDA,EAAmB,QAAQ,YAAY,mBAAmB,EAAE,MAAM,UAAU;AAAA;AAAA,EAE5EA,EAAmB,UAAU,qBAAqB,mBAAmB,EAAE,MAAM,gBAAgB;AAAA,EAC7FA,EAAmB,MAAM,cAAc,wBAAwB;AAAA,EAC/DA,EAAmB,MAAM,eAAe,mBAAmBI,CAAgB;AAAA;AAAA;AAAA,EAG3EJ,EAAmB,MAAM,aAAa,0BAA0BI,CAAgB;AAAA,EAChFJ,EAAmB,MAAM,eAAe,0BAA0BI,CAAgB;AAAA,EAClFJ,EAAmB,MAAM,QAAQ,0BAA0B,EAAE,GAAGI,GAAkB,MAAM,KAAA,CAAM;AACjG;AC1EO,SAASC,EACbnD,GACAzB,GACA6B,GACgB;AAChB,SAAO,CAAC,GAAGwC,EAAsB5C,GAAMzB,CAAK,GAAG,GAAG2D,EAA6B9B,CAAM,CAAC;AACzF;ACAO,SAASgD,KAAa7B,GAAwC;AAClE,QAAM,EAAE,OAAAhD,GAAO,WAAA8E,MAAc/B,EAAiBC,CAAM,GAE9CvB,IAAOqD,IAAY9B,EAAO,SAAS,OAAOA,EAAO8B,CAAS,CAAC,EAAE,YAAA,IAAgB,MAC7EC,IAAatD,MAAS,OAAOuB,EAAO,MAAM8B,IAAY,CAAC,IAAI,CAAA,GAE3D,EAAE,aAAArE,GAAa,WAAA4C,EAAA,IAAcD,EAAe2B,GAAYtD,GAAMzB,CAAK,GACnE6B,IAASL,EAAoBC,GAAMzB,GAAOS,CAAW;AAE3D,SAAO;AAAA,IACJ,MAAAgB;AAAA,IACA,OAAOzB,EAAM,IAAIgF,CAAY;AAAA,IAC7B,OAAO3B;AAAA,IACP,QAAAxB;AAAA,IACA,iBAAiBoD,EAAkBL,EAAsBnD,GAAMzB,GAAO6B,CAAM,CAAC;AAAA,EAAA;AAEnF;AAEA,SAASoD,EAAkBC,GAAkC;AAC1D,SAAO,OAAO,eAAeA,GAAiB,mBAAmB;AAAA,IAC9D,OAAOA;AAAA,EAAA,CACT;AACJ;AAEA,SAASF,EAAa,EAAE,OAAAG,GAAO,MAAAzE,KAA0B;AACtD,SAAOyE,MAAU,SAAY,EAAE,MAAAzE,GAAM,OAAAyE,EAAA,IAAU,EAAE,MAAAzE,EAAA;AACpD;AClCA,MAAM0E,IAAa;AAAA,EAChB,QAAU;AAAA,EACV,aAAe;AAAA,EACf,mBAAqB;AAAA,EACrB,mBAAqB;AAAA,EACrB,kBAAoB;AAAA,EACpB,uBAAyB;AAAA,EACzB,YAAc;AAAA,EACd,YAAc;AAAA,EACd,eAAiB;AAAA,EACjB,mBAAqB;AAAA,EACrB,WAAa;AAAA,EACb,mBAAqB;AAAA,EACrB,kBAAoB;AAAA,EACpB,qBAAuB;AAAA,EACvB,SAAW;AAAA,EACX,iBAAmB;AAAA,EACnB,OAAS;AAAA,EACT,QAAU;AAAA,EACV,aAAe;AAAA,EACf,QAAU;AACb;AAMA,UAAUC,EAAqBC,GAAqC;AACjE,QAAMC,IAAQ,SAASD,EAAI,oBAAoB,KAAK,EAAE;AACtD,WAASE,IAAQ,GAAGA,IAAQD,GAAOC,KAAS;AACzC,UAAM1E,IAAMwE,EAAI,kBAAkBE,CAAK,EAAE,GACnCL,IAAQG,EAAI,oBAAoBE,CAAK,EAAE;AAE7C,IAAI1E,MAAQ,WACT,MAAM,EAAE,KAAKA,EAAI,YAAA,EAAc,QAAQ,OAAAqE,GAAO,OAAO,MAAA;AAAA,EAE3D;AACH;AAEA,UAAUM,EAA6BH,GAAuC;AAC3E,aAAWxE,KAAO,OAAO,KAAKwE,CAAG;AAC9B,QAAII,EAAY5E,CAAG,GAAG;AACnB,YAAMmD,IAAWmB,EAAWtE,CAAG;AAC/B,YAAM;AAAA,QACH,UAAAmD;AAAA,QACA,SAAS,WAAWnD,EAAI,YAAA,CAAa,uCAAuCmD,CAAQ;AAAA,MAAA;AAAA,IAE1F;AAEN;AAEO,SAASyB,EAAY5E,GAA6C;AACtE,SAAO,OAAO,OAAOsE,GAAYtE,CAAG;AACvC;AAEA,SAAS6E,GAAWL,GAAsC;AACvD,QAAMM,IAAiB,CAAA;AACvB,aAAW,CAAC9E,GAAKqE,CAAK,KAAK,OAAO,QAAQG,CAAG,GAAG;AAC7C,UAAMO,IAAS/E,EAAI,YAAA,EAAc,KAAA;AACjC,KAAI4E,EAAYG,CAAM,KAAKA,EAAO,WAAW,KAAK,OAC/CD,EAAOC,CAAM,IAAI,OAAOV,CAAK;AAAA,EAEnC;AACA,SAAOS;AACV;AAEO,SAASE,GAAS5E,GAA8B;AACpD,QAAMoE,IAAMK,GAAWzE,CAAG,GACpBW,IAA+B;AAAA,IAClC,MAAM,CAAA;AAAA,IACN,OAAO,CAAC,GAAGwD,EAAqBC,CAAG,CAAC;AAAA,EAAA,GAEjCJ,IAAkB;AAAA,IACrB,GAAGO,EAA6BH,CAAG;AAAA,IACnC,GAAGV,EAAsB,MAAM,CAAA,GAAI/C,CAAM;AAAA,EAAA;AAG5C,SAAO;AAAA,IACJ,QAAAA;AAAA,IACA,iBAAAqD;AAAA,EAAA;AAEN;AC9EO,SAASa,GAAmB/C,GAA2BsC,GAA8B;AACzF,SAAO,CAAC,GAAGT,EAAU,GAAG7B,CAAM,EAAE,iBAAiB,GAAG8C,GAASR,CAAG,EAAE,eAAe;AACpF;"}

package/node_modules/@simple-git/argv-parser/dist/src/args/parse-argv.d.ts CHANGED Viewed

@@ -4,3 +4,4 @@ import type { ParsedArgv } from './parse-argv.types';
  * return a structured summary of what the invocation does.
  */
 export declare function parseArgv(...tokens: readonly unknown[]): ParsedArgv;
+//# sourceMappingURL=parse-argv.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/args/parse-argv.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"parse-argv.d.ts","sourceRoot":"","sources":["../../../src/args/parse-argv.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,oBAAoB,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,MAAM,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAgBnE"}

package/node_modules/@simple-git/argv-parser/dist/src/args/parse-argv.types.d.ts CHANGED Viewed

@@ -57,3 +57,4 @@ export interface ParsedArgv {
      */
     readonly vulnerabilities: Vulnerability[];
 }
+//# sourceMappingURL=parse-argv.types.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/args/parse-argv.types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"parse-argv.types.d.ts","sourceRoot":"","sources":["../../../src/args/parse-argv.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAE5E,gEAAgE;AAChE,MAAM,MAAM,WAAW,GAClB,QAAQ,GACR,KAAK,GACL,OAAO,GACP,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,MAAM,CAAC;AAEZ,uDAAuD;AACvD,MAAM,WAAW,UAAU;IACxB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACxB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;CACrB;AAED,gDAAgD;AAChD,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC5C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IAClC,yDAAyD;IACzD,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,yFAAyF;IACzF,KAAK,EAAE,WAAW,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACxB;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpB;;;OAGG;IACH,KAAK,EAAE,UAAU,EAAE,CAAC;IAEpB;;SAEK;IACL,KAAK,EAAE,MAAM,EAAE,CAAC;IAEhB;;OAEG;IACH,MAAM,EAAE,oBAAoB,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC;CAC5C"}

package/node_modules/@simple-git/argv-parser/dist/src/config/analyse-config.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 import type { ParsedConfigActivity } from '../args/parse-argv.types';
 import { type Flag } from '../flags/flags.helpers';
 export declare function collectConfigAccess(task: string | null, flags: Flag[], positionals: string[]): ParsedConfigActivity;
+//# sourceMappingURL=analyse-config.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/config/analyse-config.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"analyse-config.d.ts","sourceRoot":"","sources":["../../../src/config/analyse-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA4B,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,KAAK,IAAI,EAAe,MAAM,wBAAwB,CAAC;AAgEhE,wBAAgB,mBAAmB,CAChC,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,EAAE,IAAI,EAAE,EACb,WAAW,EAAE,MAAM,EAAE,GACrB,oBAAoB,CAetB"}

package/node_modules/@simple-git/argv-parser/dist/src/config/config-operands.d.ts CHANGED Viewed

@@ -2,3 +2,4 @@ export declare const CONFIG_WRITE_FLAGS: Set<string>;
 export declare const CONFIG_READ_FLAGS: Set<string>;
 export declare const CONFIG_WRITE_VERBS: Set<string>;
 export declare const CONFIG_READ_VERBS: Set<string>;
+//# sourceMappingURL=config-operands.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/config/config-operands.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"config-operands.d.ts","sourceRoot":"","sources":["../../../src/config/config-operands.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,kBAAkB,aAS7B,CAAC;AAGH,eAAO,MAAM,iBAAiB,aAS5B,CAAC;AAGH,eAAO,MAAM,kBAAkB,aAM7B,CAAC;AACH,eAAO,MAAM,iBAAiB,aAAyD,CAAC"}

package/node_modules/@simple-git/argv-parser/dist/src/config/config.types.d.ts CHANGED Viewed

@@ -4,3 +4,4 @@ export interface ConfigOperation {
     key: string;
     value?: string;
 }
+//# sourceMappingURL=config.types.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/config/config.types.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"config.types.d.ts","sourceRoot":"","sources":["../../../src/config/config.types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/node_modules/@simple-git/argv-parser/dist/src/config/detect-config-action.d.ts CHANGED Viewed

@@ -11,3 +11,4 @@ export declare function toOperation(scope: ConfigScope, operation: ConfigOperati
     scope: ConfigScope;
     value?: undefined;
 };
+//# sourceMappingURL=detect-config-action.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/config/detect-config-action.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"detect-config-action.d.ts","sourceRoot":"","sources":["../../../src/config/detect-config-action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,KAAK,IAAI,EAAe,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQtD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,eAAe,GAAG,IAAI,CA6B/F;AAiBD,wBAAgB,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe;;;;;;;;EAKzE"}

package/node_modules/@simple-git/argv-parser/dist/src/env/parse-env.d.ts CHANGED Viewed

@@ -1,6 +1,31 @@
 import type { ParsedConfigActivity } from '../args/parse-argv.types';
 import type { Vulnerability } from '../vulnerabilities/vulnerability.types';
+declare const GitEnvKeys: {
+    readonly editor: "allowUnsafeEditor";
+    readonly git_askpass: "allowUnsafeAskPass";
+    readonly git_config_global: "allowUnsafeConfigPaths";
+    readonly git_config_system: "allowUnsafeConfigPaths";
+    readonly git_config_count: "allowUnsafeConfigEnvCount";
+    readonly git_config_parameters: "allowUnsafeConfigEnvCount";
+    readonly git_config: "allowUnsafeConfigPaths";
+    readonly git_editor: "allowUnsafeEditor";
+    readonly git_exec_path: "allowUnsafeExec";
+    readonly git_external_diff: "allowUnsafeDiffExternal";
+    readonly git_pager: "allowUnsafePager";
+    readonly git_proxy_command: "allowUnsafeGitProxy";
+    readonly git_template_dir: "allowUnsafeTemplateDir";
+    readonly git_sequence_editor: "allowUnsafeEditor";
+    readonly git_ssh: "allowUnsafeSshCommand";
+    readonly git_ssh_command: "allowUnsafeSshCommand";
+    readonly pager: "allowUnsafePager";
+    readonly prefix: "allowUnsafeConfigPaths";
+    readonly ssh_askpass: "allowUnsafeAskPass";
+    readonly visual: "allowUnsafeEditor";
+};
+export declare function isGitEnvKey(key: string): key is keyof typeof GitEnvKeys;
 export declare function parseEnv(raw: Record<string, unknown>): {
     config: ParsedConfigActivity;
     vulnerabilities: Vulnerability[];
 };
+export {};
+//# sourceMappingURL=parse-env.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/env/parse-env.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"parse-env.d.ts","sourceRoot":"","sources":["../../../src/env/parse-env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,wCAAwC,CAAC;AAGnG,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;CAqB0C,CAAC;AA8B3D,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,IAAI,MAAM,OAAO,UAAU,CAEvE;AAaD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;EAepD"}

package/node_modules/@simple-git/argv-parser/dist/src/flags/flags.helpers.d.ts CHANGED Viewed

@@ -7,3 +7,4 @@ export interface Flag {
     isGlobal: boolean;
 }
 export declare function scopedFlags(flags: Flag[], scope: 'global' | 'task'): Generator<Flag, void, unknown>;
+//# sourceMappingURL=flags.helpers.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/flags/flags.helpers.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"flags.helpers.d.ts","sourceRoot":"","sources":["../../../src/flags/flags.helpers.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,IAAI;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,YAAY,EAAE,OAAO,CAAC;IACtB,kDAAkD;IAClD,QAAQ,EAAE,OAAO,CAAC;CACpB;AAED,wBAAiB,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,kCAOnE"}

package/node_modules/@simple-git/argv-parser/dist/src/flags/parse-global-flags.d.ts CHANGED Viewed

@@ -4,3 +4,4 @@ export interface GlobalFlags {
     taskIndex: number;
 }
 export declare function parseGlobalFlags(tokens: readonly unknown[], flags?: Flag[]): GlobalFlags;
+//# sourceMappingURL=parse-global-flags.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/flags/parse-global-flags.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"parse-global-flags.d.ts","sourceRoot":"","sources":["../../../src/flags/parse-global-flags.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,WAAW,WAAW;IACzB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,OAAO,EAAE,EAAE,KAAK,GAAE,IAAI,EAAO,GAAG,WAAW,CA6B5F"}

package/node_modules/@simple-git/argv-parser/dist/src/flags/parse-task-flags.d.ts CHANGED Viewed

@@ -6,3 +6,4 @@ type TaskFlags = {
 };
 export declare function parseTaskFlags(tokens: readonly unknown[], task: string | null, flags?: Flag[]): TaskFlags;
 export {};
+//# sourceMappingURL=parse-task-flags.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/flags/parse-task-flags.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"parse-task-flags.d.ts","sourceRoot":"","sources":["../../../src/flags/parse-task-flags.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAE5C,KAAK,SAAS,GAAG;IACd,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,wBAAgB,cAAc,CAC3B,MAAM,EAAE,SAAS,OAAO,EAAE,EAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,GAAE,IAAI,EAAO,GAClB,SAAS,CA0DX"}

package/node_modules/@simple-git/argv-parser/dist/src/tokens/flag-specs.d.ts CHANGED Viewed

@@ -7,3 +7,4 @@ export declare function getFlagSpecForTask(task?: string | null): {
     short: Map<string, boolean>;
     long: ReadonlySet<string>;
 };
+//# sourceMappingURL=flag-specs.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/tokens/flag-specs.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"flag-specs.d.ts","sourceRoot":"","sources":["../../../src/tokens/flag-specs.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,QAAQ;IACtB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACrC;AASD,eAAO,MAAM,MAAM,EAAE,QAmBpB,CAAC;AAsEF,wBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;;;EAOtD"}

package/node_modules/@simple-git/argv-parser/dist/src/tokens/token-expander.d.ts CHANGED Viewed

@@ -5,3 +5,4 @@ export declare function expandToken(raw: string, spec?: import("./flag-specs").F
     value?: string;
     needsNext: boolean;
 }>;
+//# sourceMappingURL=token-expander.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/tokens/token-expander.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"token-expander.d.ts","sourceRoot":"","sources":["../../../src/tokens/token-expander.ts"],"names":[],"mappings":"AAEA;gFACgF;AAChF,wBAAgB,WAAW,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,kCAAS,GACb,KAAK,CAAC;IACN,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACrB,CAAC,CAmBD"}

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/detect-vulnerable-config-writes.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 import type { ParsedConfigActivity } from '../args/parse-argv.types';
 import type { Vulnerability } from './vulnerability.types';
 export declare function detectVulnerableConfigWrites({ write, }: ParsedConfigActivity): Generator<Vulnerability>;
+//# sourceMappingURL=detect-vulnerable-config-writes.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/detect-vulnerable-config-writes.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"detect-vulnerable-config-writes.d.ts","sourceRoot":"","sources":["../../../src/vulnerabilities/detect-vulnerable-config-writes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,uBAAuB,CAAC;AAElF,wBAAiB,4BAA4B,CAAC,EAC3C,KAAK,GACP,EAAE,oBAAoB,GAAG,SAAS,CAAC,aAAa,CAAC,CASjD"}

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/detect-vulnerable-flags.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
 import type { Flag } from '../flags/flags.helpers';
 import type { Vulnerability } from './vulnerability.types';
 export declare function detectVulnerableFlags(task: null | string, flags: Flag[]): Generator<Vulnerability>;
+//# sourceMappingURL=detect-vulnerable-flags.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/detect-vulnerable-flags.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"detect-vulnerable-flags.d.ts","sourceRoot":"","sources":["../../../src/vulnerabilities/detect-vulnerable-flags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,uBAAuB,CAAC;AAElF,wBAAiB,qBAAqB,CACnC,IAAI,EAAE,IAAI,GAAG,MAAM,EACnB,KAAK,EAAE,IAAI,EAAE,GACb,SAAS,CAAC,aAAa,CAAC,CAS1B"}

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/vulnerability-analysis.d.ts CHANGED Viewed

@@ -2,3 +2,4 @@ import type { ParsedConfigActivity } from '../args/parse-argv.types';
 import type { Flag } from '../flags/flags.helpers';
 import type { Vulnerability } from './vulnerability.types';
 export declare function vulnerabilityAnalysis(task: null | string, flags: Flag[], config: ParsedConfigActivity): Vulnerability[];
+//# sourceMappingURL=vulnerability-analysis.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/vulnerability-analysis.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"vulnerability-analysis.d.ts","sourceRoot":"","sources":["../../../src/vulnerabilities/vulnerability-analysis.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,wBAAgB,qBAAqB,CAClC,IAAI,EAAE,IAAI,GAAG,MAAM,EACnB,KAAK,EAAE,IAAI,EAAE,EACb,MAAM,EAAE,oBAAoB,GAC5B,aAAa,EAAE,CAEjB"}

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/vulnerability-check.d.ts CHANGED Viewed

@@ -3,3 +3,4 @@
  * and environment variables.
  */
 export declare function vulnerabilityCheck(tokens: readonly string[], env: Record<string, unknown>): import("./vulnerability.types").Vulnerability[];
+//# sourceMappingURL=vulnerability-check.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/vulnerability-check.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"vulnerability-check.d.ts","sourceRoot":"","sources":["../../../src/vulnerabilities/vulnerability-check.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,mDAEzF"}

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/vulnerability.types.d.ts CHANGED Viewed

@@ -12,6 +12,11 @@ export interface VulnerabilityCategoryFlags {
      * Use of the `core.askPass` configuration setting and environment variables in simple-git tasks
      */
     allowUnsafeAskPass: boolean;
+    /**
+     * Allows using overriding the internally configured Git command binaries - for example the `tar` command
+     * can be replaced by configuring `tar.command=/other/tar`.
+     */
+    allowUnsafeCommandBinaries: boolean;
     /**
      * Allows using environment variables to set configuration paths in simple-git tasks
      */
@@ -67,6 +72,11 @@ export interface VulnerabilityCategoryFlags {
      * exposes and attack vector for running arbitrary commands.
      */
     allowUnsafeGitProxy: boolean;
+    /**
+     * Use of the `--exec-path` and similar options can override the binaries executed during
+     * `git` operations.
+     */
+    allowUnsafeExec: boolean;
     /**
      * Using a `-c` switch to enable custom hooks path commands to be run automatically
      * exposes and attack vector for running arbitrary commands.
@@ -101,4 +111,23 @@ export interface VulnerabilityCategoryFlags {
      * Allows overriding template directory either by environment variable or configuration in simple-git tasks
      */
     allowUnsafeTemplateDir: boolean;
+    /**
+     * Allows using `include.path` to load an external git configuration file in simple-git tasks.
+     * An attacker-controlled path could direct git to load a malicious configuration, overriding any
+     * setting — including those that enable further command-execution vectors.
+     */
+    allowUnsafeInclude: boolean;
+    /**
+     * Allows setting `submodule.<name>.update` in simple-git tasks. When the update strategy begins
+     * with `!`, git executes the remainder as a shell command on every `git submodule update`
+     * invocation, providing an arbitrary code-execution path.
+     */
+    allowUnsafeSubmodule: boolean;
+    /**
+     * Allows using `url.<base>.insteadOf` configuration in simple-git tasks. URL rewriting can
+     * silently redirect git operations to attacker-controlled hosts, potentially intercepting
+     * credentials or substituting malicious repository content.
+     */
+    allowUnsafeUrlRewrite: boolean;
 }
+//# sourceMappingURL=vulnerability.types.d.ts.map

package/node_modules/@simple-git/argv-parser/dist/src/vulnerabilities/vulnerability.types.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"vulnerability.types.d.ts","sourceRoot":"","sources":["../../../src/vulnerabilities/vulnerability.types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAAG,MAAM,0BAA0B,CAAC;AAErE,MAAM,WAAW,aAAa;IAC3B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACxC;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;OAGG;IACH,0BAA0B,EAAE,OAAO,CAAC;IAEpC;;OAEG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,yBAAyB,EAAE,OAAO,CAAC;IAEnC;;OAEG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;OAEG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;OAEG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAEhC;;OAEG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAE1B;;;;;;;;;OASG;IACH,2BAA2B,EAAE,OAAO,CAAC;IAErC;;;;;;OAMG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,eAAe,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;OAGG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;OAEG;IACH,uBAAuB,EAAE,OAAO,CAAC;IAEjC;;;OAGG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;IAE/B;;OAEG;IACH,sBAAsB,EAAE,OAAO,CAAC;IAEhC;;;;OAIG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAE5B;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;;OAIG;IACH,qBAAqB,EAAE,OAAO,CAAC;CACjC"}

package/node_modules/@simple-git/argv-parser/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@simple-git/argv-parser",
-  "version": "1.1.1",
+  "version": "2.0.1",
   "main": "dist/index.cjs",
   "files": [
     "dist"
@@ -31,6 +31,6 @@
     }
   },
   "dependencies": {
-    "@simple-git/args-pathspec": "^1.0.3"
+    "@simple-git/args-pathspec": "^1.0.4"
   }
 }