cc-safety-net 2.0.6 → 2.0.8

package/dist/chunks/index-3a1zwkma.js

@@ -1,64 +0,0 @@
-var AX=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function K0($){let Z=$.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return HZ(Z)}function HZ($){let Z=$.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let J of AX)Z=Z.replace(J,"<redacted>");return Z.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function EX($){return jZ($).reduceRight((J,Q)=>`${J.slice(0,Q.valueStart)}<redacted>${J.slice(Q.valueEnd)}`,$)}function GM($){return HZ(EX($))}function HM($){return jZ($).map((Z)=>$.slice(Z.valueStart,Z.valueEnd))}function jM($){return/[A-Za-z_][A-Za-z0-9_]*=/.test($)}function jZ($){let Z=[],J=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let Q of $.matchAll(J)){let X=Q.index,K=$[X-1];if(X>0&&K&&!/[\s"'([{]/.test(K))continue;let W=X+Q[0].length;if(W>=$.length)continue;Z.push({valueStart:W,valueEnd:TX($,W)})}return Z}function TX($,Z){if($.startsWith("$(",Z))return SX($,Z);let J=$[Z];if(J==='"'||J==="'"){for(let X=Z+1;X<$.length;X++)if(J==='"'&&$[X]==="\\")X++;else if($[X]===J)return X+1}let Q=Z;while(Q<$.length&&!/\s/.test($[Q]??""))Q++;return Q}function SX($,Z){let J=0,Q;for(let X=Z;X<$.length;X++){let K=$[X];if(Q){if(Q==='"'&&K==="\\")X++;else if(K===Q)Q=void 0;continue}if(K==='"'||K==="'"){Q=K;continue}if(K==="$"&&$[X+1]==="("){J++,X++;continue}if(K!==")")continue;if(J--,J===0)return X+1}return $.length}import{randomBytes as yX}from"node:crypto";import{closeSync as l3,constants as k$,fstatSync as k3,fsyncSync as wX,lstatSync as V0,mkdirSync as _Z,openSync as OZ,readdirSync as m3,readFileSync as vX,realpathSync as E0,renameSync as uX,rmdirSync as hX,statSync as x3,unlinkSync as p3,writeFileSync as gX}from"node:fs";import{isAbsolute as LZ,join as Q$,normalize as kX,parse as MZ,relative as c3,resolve as d3,sep as l$}from"node:path";var xX=Symbol("PolicyFilesystemScope"),lX=Symbol("PolicyFilesystemTarget"),FZ=k$.O_NOFOLLOW??0;class u extends Error{constructor($){super(`Unable to access ${$} filesystem safely.`);this.name="PolicyFilesystemError"}}function z1($,Z){return{[xX]:!0,root:d3($),label:Z}}function m$($,Z){let J=kX(Z);if(Z===""||LZ(Z)||J===".."||J.startsWith(`..${l$}`))throw new u($.label);return{[lX]:!0,scope:$,relativePath:J,path:Q$($.root,J)}}function X1($,Z){let J=c3($.root,d3(Z));return m$($,J)}function k2($,Z="rules policy"){let J=d3($),Q=MZ(J).dir;return m$(z1(Q,Z),c3(Q,J))}function W0($){try{if(!B1($,!1).exists)return null;let J=OZ($.path,k$.O_RDONLY|FZ);try{let Q=k3(J);if(!Q.isFile())throw new u($.scope.label);let X=vX(J,"utf-8"),K=V0($.path);if(!K.isFile()||K.isSymbolicLink()||Q.dev!==K.dev||Q.ino!==K.ino)throw new u($.scope.label);return B1($,!1),X}finally{l3(J)}}catch(Z){R0($.scope.label,Z)}}function NZ($,Z,J=384,Q){let X=`${$.path}.${yX(8).toString("hex")}.tmp`,K=null;try{cX($),B1($,!0),K=OZ(X,k$.O_CREAT|k$.O_EXCL|k$.O_WRONLY|FZ,J);let W=k3(K);if(!W.isFile())throw new u($.scope.label);gX(K,Z,"utf-8"),wX(K);let Y=k3(K);if(!Y.isFile()||Y.dev!==W.dev||Y.ino!==W.ino)throw new u($.scope.label);l3(K),K=null,B1($,!0),iX($,X,Y.dev,Y.ino),uX(X,$.path),Q?.($.path),B1($,!1)}catch(W){if(K!==null)rX(K);nX(X),R0($.scope.label,W)}}function VZ($,Z){if($.path===Z.path)return!0;try{if(!B1($,!1).exists||!B1(Z,!1).exists)return!1;return E0($.path)===E0(Z.path)}catch(J){if(J instanceof u)throw J;throw new u($.scope.label)}}function mX($){try{if(!B1($,!1,"directory").exists)return null;let J=m3($.path);return B1($,!1,"directory"),J}catch(Z){R0($.scope.label,Z)}}function FM($){let Z=mX($);if(!Z)return null;try{let J=Z.map((Q)=>{let X=m$($.scope,Q$($.relativePath,Q)),K=V0(X.path);if(K.isSymbolicLink()||!K.isFile()&&!K.isDirectory())throw new u($.scope.label);return x2(IZ($.scope),E0(X.path),$.scope.label),{name:Q,kind:K.isDirectory()?"directory":"file"}});return B1($,!1,"directory"),J}catch(J){R0($.scope.label,J)}}function NM($){try{if(!B1($,!0).exists)return;p3($.path),B1($,!0)}catch(Z){R0($.scope.label,Z)}}function VM($){try{zZ($,$.relativePath.split(l$))}catch(Z){R0($.scope.label,Z)}}function RM($){try{if(!pX($))return;DZ($),B1($,!0,"directory")}catch(Z){R0($.scope.label,Z)}}function pX($){try{if(!B1($,!0,"directory").exists)return!1;return RZ($),!0}catch(Z){R0($.scope.label,Z)}}function B1($,Z,J="file"){let Q=i3($.scope);if(!Q)return{exists:!1};let X=$.relativePath.split(l$);for(let K of X.keys()){let W=Q$($.scope.root,...X.slice(0,K+1)),Y=x$(W);if(!Y){if(K===X.length-1&&Z)return{exists:!1};return{exists:!1}}if(Y.isSymbolicLink())throw new u($.scope.label);if(K<X.length-1&&!Y.isDirectory())throw new u($.scope.label);if(K===X.length-1&&(J==="file"?!Y.isFile():!Y.isDirectory()))throw new u($.scope.label);x2(Q,E0(W),$.scope.label)}return{exists:!0}}function RZ($){for(let Z of m3($.path)){let J=m$($.scope,Q$($.relativePath,Z)),Q=V0(J.path);if(Q.isSymbolicLink()||!Q.isDirectory()&&!Q.isFile())throw new u($.scope.label);if(Q.isDirectory())RZ(J)}B1($,!1,"directory")}function DZ($){for(let Z of m3($.path)){let J=m$($.scope,Q$($.relativePath,Z)),Q=V0(J.path);if(Q.isSymbolicLink())throw new u($.scope.label);if(Q.isDirectory()){DZ(J);continue}if(!Q.isFile())throw new u($.scope.label);p3(J.path)}hX($.path)}function cX($){zZ($,$.relativePath.split(l$).slice(0,-1))}function zZ($,Z){dX($.scope);let J=IZ($.scope);for(let Q of Z.keys()){let X=Q$($.scope.root,...Z.slice(0,Q+1));if(!x$(X))_Z(X,{mode:448});let W=V0(X);if(!W.isDirectory()||W.isSymbolicLink())throw new u($.scope.label);x2(J,E0(X),$.scope.label)}}function dX($){if(x$($.root)){if(!x3($.root).isDirectory())throw new u($.label);return}let Z=[],J=$.root;while(!x$(J)){Z.unshift(J);let Q=MZ(J).dir;if(Q===J)throw new u($.label);J=Q}if(!x3(J).isDirectory())throw new u($.label);for(let Q of Z){_Z(Q,{mode:448});let X=V0(Q);if(!X.isDirectory()||X.isSymbolicLink())throw new u($.label)}}function i3($){if(!x$($.root))return null;if(!x3($.root).isDirectory())throw new u($.label);return E0($.root)}function IZ($){let Z=i3($);if(!Z)throw new u($.label);return Z}function iX($,Z,J,Q){let X=V0(Z);if(!X.isFile()||X.isSymbolicLink()||X.dev!==J||X.ino!==Q)throw new u($.scope.label);let K=i3($.scope);if(!K)throw new u($.scope.label);x2(K,E0(Z),$.scope.label)}function x2($,Z,J){let Q=c3($,Z);if(Q===".."||Q.startsWith(`..${l$}`)||LZ(Q))throw new u(J)}function x$($){try{return V0($)}catch(Z){if(sX(Z)&&Z.code==="ENOENT")return null;throw Z}}function R0($,Z){if(Z instanceof u)throw Z;throw new u($)}function sX($){return $ instanceof Error&&"code"in $}function rX($){try{l3($)}catch{}}function nX($){try{p3($)}catch{}}import{homedir as $K}from"node:os";import{dirname as c1,isAbsolute as ZK,join as y1,relative as JK,resolve as d1,sep as QK}from"node:path";var I1=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,l2="rulebook.json",m2=".cc-safety-net/rules";var bZ=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,aX=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,oX=/^[A-Za-z0-9._-]+$/,tX=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),eX="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),s3=new RegExp(`^${tX}/(${I1.source.slice(1,-1)})/${eX}$`);function fZ($){return`.cc-safety-net/rules/${$}/rulebook.json`}function p$($){if(K$($))try{return X$($),null}catch(Z){return Z instanceof Error?Z.message:String(Z)}return I1.test($)?null:`Local rulebook sources must be bare names matching ${I1}: ${$}`}function X$($){if($.startsWith("github:"))throw Error(`Invalid rulebook source: ${$}`);let Z=$.match(bZ);if(!Z?.[1]||!Z[2]||!Z[3])throw Error(`Invalid GitHub rulebook source: ${$}`);let[J,Q,...X]=Z[3].split("/");if(!J||!oX.test(J))throw Error(`GitHub rulebook refs must be a single path segment: ${$}`);if(!Q||X.length>0||!I1.test(Q))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${$}`);return{owner:Z[1],repo:Z[2],ref:J,path:fZ(Q),name:Q}}function PZ($){return aX.test($)}function K$($){return bZ.test($)}function r3($){if(!I1.test($))throw Error(`Local rulebook sources must be bare names matching ${I1}: ${$}`)}var AZ="rule.json",p2="policy.json",EZ="rule.lock",XK="config.json",TZ=".cc-safety-net",KK="rules",CZ="cache",WK="CC_SAFETY_NET_HOME",w1="`cc-safety-net rule sync`";function YK($){return d1($??process.cwd(),m2)}function SZ($){return y1(YK($),AZ)}function Y0($){return $?.userConfigDir??($?.userConfigPath?c1($.userConfigPath):y1(BK(),KK))}function BK(){let $=process.env[WK];return $?d1($):y1($K(),TZ)}function yZ($){return y1(Y0($),AZ)}function AM($){return y1(Y0($),EZ)}function T0($){return y1(c1($),EZ)}function EM($={}){return y1(c1(Y0($)),XK)}function TM($={}){return d1($.cwd??process.cwd(),".safety-net.json")}function wZ($){let Z=$.userConfigPath??yZ($),J=$.projectConfigPath??SZ($.cwd),Q=vZ(Z,$),X=uZ(J,$);return{userConfigPath:Z,projectConfigPath:J,userLockPath:T0(Z),projectLockPath:T0(J),userScope:Q,projectScope:X,userConfigTarget:X1(Q,Z),projectConfigTarget:X1(X,J),userLockTarget:X1(Q,T0(Z)),projectLockTarget:X1(X,T0(J))}}function SM($){let Z=$.global?$.userConfigPath??yZ($):$.projectConfigPath??SZ($.cwd),J=$.global?vZ(Z,$):uZ(Z,$),Q=T0(Z);return{configDir:c1(Z),configPath:Z,lockPath:Q,filesystemScope:J,configTarget:X1(J,Z),lockTarget:X1(J,Q)}}function vZ($,Z){let J=Z.userConfigPath?c1(c1(d1(Z.userConfigPath))):c1(d1(Z.userConfigDir??Y0(Z)));return z1(J,"user policy")}function uZ($,Z){let J=d1(Z.cwd??process.cwd()),Q=d1($),X=JK(J,Q);if(X!==".."&&!X.startsWith(`..${QK}`)&&!ZK(X))return z1(J,"project policy");return z1(c1(c1(Q)),"project policy")}function hZ($){if($.kind==="github"&&$.display_ref)return`${$.owner}/${$.repo}#${$.display_ref}/${$.name}`;return $.spec}function c2($,Z){let J=$.digest.startsWith("sha256:")?$.digest.slice(7):$.digest;return y1(gZ(Z),"rulebooks",`${qK($)}--${J.slice(0,12)}`,l2)}function yM($){return y1(gZ($),"rulebooks")}function d2($,Z){let J=Z;return{cacheConfigDir:$,cwd:Z.cwd,global:J.global}}function qK($){return($.kind==="github"&&$.display_ref?`${$.owner}/${$.repo}#${$.display_ref}/${$.name}`:$.spec).toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"rulebook"}function gZ($){let Z=$?.cacheConfigDir??Y0($),J=$;if(J&&!J.global&&J.cwd&&d1(Z)===d1(J.cwd))return y1(d1(J.cwd),TZ,CZ);return y1(c1(Z),CZ)}import{lstatSync as kZ,readdirSync as UK,readFileSync as pZ,rmdirSync as GK,statSync as xZ,unlinkSync as HK,utimesSync as jK,writeFileSync as _K}from"node:fs";import{dirname as OK,join as W$}from"node:path";var i2=30,n3=1,a3=365;function s2($){if(typeof $!=="number"||!Number.isInteger($))return 30;if($<1)return 1;return $>365?365:$}var t3=86400000,LK=".last-prune",MK=/^\d{4}-\d{2}$/,FK=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,lZ=($)=>Math.floor($/t3);function NK($){try{let Z=W$(OK(Y0($)),p2),J=JSON.parse(pZ(Z,"utf-8"));return s2(J?.audit?.retention_days)}catch{return i2}}function cZ($,Z=()=>new Date){try{let J=Z().getTime();if(!xZ($,{throwIfNoEntry:!1})?.isDirectory())return;let Q=W$($,LK),X=xZ(Q,{throwIfNoEntry:!1})?.mtimeMs;if(X!==void 0&&lZ(X)===lZ(J))return;let K=J-NK()*t3,W=new Date(J).toISOString().slice(0,7);for(let Y of o3($)){if(Y.isDirectory()){VK(W$($,Y.name),K,W);continue}if(Y.isFile()&&Y.name.endsWith(".jsonl"))RK(W$($,Y.name),K)}_K(Q,"",{mode:384}),jK(Q,J/1000,J/1000)}catch{}}function VK($,Z,J){for(let Q of o3($)){if(!Q.isDirectory()||!MK.test(Q.name))continue;let X=W$($,Q.name);for(let K of o3(X)){if(!K.isFile())continue;let W=FK.exec(K.name);if(!W||W[2]!==Q.name)continue;let Y=Date.parse(`${W[1]}T00:00:00.000Z`)+t3;if(!Number.isFinite(Y)||Y>=Z)continue;dZ(W$(X,K.name))}if(Q.name!==J)mZ(X)}mZ($)}function RK($,Z){try{let J=kZ($);if(J.mtimeMs>=Z)return;let Q=pZ($,"utf-8").split(`
-`).filter((X)=>X.trim()).map(DK);if(Q.length===0)return;if(Q.some((X)=>X===void 0||X>=Z))return;if(kZ($).mtimeMs!==J.mtimeMs)return;dZ($)}catch{}}function DK($){try{let Z=JSON.parse($).ts,J=typeof Z==="string"?Date.parse(Z):Number.NaN;return Number.isFinite(J)?J:void 0}catch{return}}function o3($){try{return UK($,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dZ($){try{HK($)}catch{}}function mZ($){try{GK($)}catch{}}import{randomBytes as zK}from"node:crypto";import{appendFileSync as IK,mkdirSync as bK}from"node:fs";import{homedir as fK,userInfo as PK}from"node:os";import{isAbsolute as CK,join as e3}from"node:path";var AK="2.0.6",EK=1e4,TK=2000,SK=256,yK=32768;function wK($){let Z=$.trim();if(!Z)return null;let J=Z.replace(/[^A-Za-z0-9_.-]+/g,"_");if(J=J.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!J||J==="."||J==="..")return null;return J}function vK($){return($??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function $6($,Z,J,Q,X,K={}){let W=wK($);if(!W)return;let Y=K.homeDir??iZ();if(!Y)return;let B=uK(Y);if(!B)return;try{let q=(K.now??(()=>new Date))().toISOString(),U=r2(K0(Z),EK),G=r2(K0(J),TK),j=K.toolName?r2(K0(K.toolName),SK):void 0,H=X===null?void 0:r2(K0(X),yK),_=e3(B,vK(H?.value??null),q.slice(0,7));bK(_,{recursive:!0,mode:448});let O=e3(_,`${q.slice(0,10)}-${W}.jsonl`),M={ts:q,id:(K.createId??(()=>zK(8).toString("hex")))(),v:AK,sessionId:W,decision:K.decision??"deny",agent:K.agent,shape:K.shape,level:K.level,configFallback:K.configFallback,toolName:j?.value,command:U.value,segment:G.value,...U.truncated||G.truncated||j?.truncated||H?.truncated?{truncated:!0}:{},reason:Q,ruleId:K.ruleId,intent:K.intent,failureStage:K.failureStage,errorCode:K.errorCode,cwd:H?.value??null};IK(O,`${JSON.stringify(M)}
-`,{encoding:"utf-8",mode:384}),cZ(B,K.now)}catch{}}function r2($,Z){return{value:$.slice(0,Z),truncated:$.length>Z}}function iZ($=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let Z=$||fK()||PK().homedir;return Z&&CK(Z)?Z:null}function uK($=iZ()){return $?e3($,".cc-safety-net","logs"):null}function rZ($,Z,J,Q=!0,X){if(Z.decision.kind==="allow"){if(!J||$.route.kind!=="command")return;let Y=sZ($);return{decision:"allow",command:Y,segment:Y,reason:"allowed",cwd:$.context.executionCwd,toolName:$.toolName,level:Z.level,...Z.configFallback?{configFallback:!0}:{}}}let K=Z.decision.evidence.find((Y)=>Y.kind==="command"),W=K?.command??(Q?sZ($):"");return{decision:"deny",command:W,segment:K?.segment??W,reason:Z.decision.reason,cwd:$.context.executionCwd,toolName:$.toolName,level:Z.level,...Z.configFallback?{configFallback:!0}:{},ruleId:Z.decision.ruleId,intent:Z.decision.intent,failureStage:X?.stage,errorCode:X?.errorCode}}function sZ($){return"command"in $?$.command??"":""}function nZ($,Z,J){if(!$)return;let Q;try{Q=Z()}catch{return}if(typeof Q!=="string"||!Q.trim())return;$6(Q,$.command,$.segment,$.reason,$.cwd,{homeDir:J.homeDir,decision:$.decision,agent:J.agent,shape:J.shape,level:$.level,configFallback:$.configFallback,toolName:$.toolName,ruleId:$.ruleId,intent:$.intent,failureStage:$.failureStage,errorCode:$.errorCode})}function oM($,Z,J){let Q;try{Q=Z()}catch{return}if(typeof Q!=="string"||!Q.trim())return;$6(Q,$.command??"",$.segment??$.command??"",$.reason,J.cwd??null,{homeDir:J.homeDir,decision:"deny",agent:J.agent,shape:J.shape,toolName:J.toolName??$.toolName,ruleId:$.ruleId,intent:$.intent})}var D0="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",B0="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",aZ="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",n2="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function tZ($){let{reason:Z,command:J,segment:Q,toolName:X}=$,K=$.maxLen??200,W=$.redact??((B)=>B),Y=`BLOCKED by CC Safety Net
-
-Reason: ${W(Z)}`;if($.ruleId)Y+=`
-
-Rule: ${$.ruleId}`;if(X)Y+=`
-
-Tool: ${X}`;if(J){let B=W(J);Y+=`
-
-Command: ${oZ(B,K)}`}if(Q&&Q!==J){let B=W(Q);Y+=`
-
-Segment: ${oZ(B,K)}`}if($.configWarning)Y+=`
-
-Config warning: ${W($.configWarning)}`;return Y+=`
-
-${hK($.intent??"manual_only")}`,Y}function hK($){switch($){case"hard_stop":return"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.";case"use_alternative":return"Do not retry the blocked form. Continue the task using the safer alternative described above.";case"scope_down":return"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.";case"manual_only":return"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.";case"stop_and_explain":return"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."}}function oZ($,Z){return $.length>Z?`${$.slice(0,Z)}...`:$}function XF($,Z){if($.decision.kind!=="deny")return;let J=Z.includeEvidence?$.decision.evidence.find((Q)=>Q.kind==="command"):void 0;return{reason:$.decision.reason,ruleId:$.decision.ruleId,intent:$.decision.intent,command:J?.command,segment:J?.segment,toolName:Z.toolName,...$.configFallback?{configWarning:$.configFallback.reason}:{}}}function KF($={}){return{reason:n2,intent:"stop_and_explain",command:$.command,segment:$.segment??$.command,toolName:$.toolName}}function WF($){return tZ({...$,redact:K0})}function YF($){return K0($ instanceof Error?$.message:String($))}import{lstatSync as gK,realpathSync as kK}from"node:fs";import{homedir as xK,tmpdir as lK}from"node:os";var b1={realpath:($)=>{try{return kK($)}catch{return null}},entryKind:($)=>{let Z=gK($,{throwIfNoEntry:!1});if(!Z)return"missing";return Z.isSymbolicLink()?"symlink":"present"}};function S0(){return process.env.HOME||xK()}function q0(){return{env:new Map(Object.entries(process.env).flatMap(([$,Z])=>Z===void 0?[]:[[$,Z]])),home:S0(),tmpdir:lK(),paths:b1}}var mK=["git.ssh-env","git.alias-config","git.checkout-force","git.checkout-double-dash","git.checkout-ref-path","git.checkout-pathspec-from-file","git.checkout-ambiguous","git.switch-discard-changes","git.switch-force","git.restore-worktree","git.restore-unstaged","git.reset-hard","git.reset-merge","git.clean-force","git.push-force","git.push-delete","git.push-mirror","git.branch-force-delete","git.rebase-abort","git.merge-abort","git.tag-delete","git.reflog-delete","git.stash-drop","git.stash-clear","git.worktree-remove-force","rm.recursive-force-root-or-home","rm.git-metadata","rm.recursive-force-dynamic-target","rm.recursive-force-home-cwd","rm.recursive-force-cwd-self","rm.recursive-force-outside-cwd","rm.recursive-force-paranoid","powershell.remove-item-root-or-home","powershell.remove-item-recursive-force-root-or-home","powershell.remove-item-git-metadata","powershell.remove-item-recursive-force-dynamic-target","powershell.remove-item-recursive-force-home-cwd","powershell.remove-item-recursive-force-cwd-self","powershell.remove-item-recursive-force-outside-cwd","powershell.remove-item-recursive-force-paranoid","powershell.remove-item-pipeline-dynamic-target","find.delete","find.delete-git-metadata","find.exec-rm-recursive-force","dd.device-write","mkfs.device","shred.target","interpreter.dangerous-command","interpreter.one-liner-paranoid","awk.system-dynamic","xargs.rm-recursive-force-dynamic","xargs.shell-dynamic","parallel.rm-recursive-force-dynamic","parallel.shell-dynamic","parallel.command-stream-dynamic","shell.dynamic-structure","shell.dynamic-executable","raw-text.dangerous-command"],a2=new Set(mK),o2=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],pK=new Map(o2.map(($)=>[$.id,$.intent])),eZ=new Set(o2.filter(($)=>$.catastrophic).map(($)=>$.id));function N($,Z){return{id:$,reason:Z,intent:pK.get($)??"manual_only"}}function T($,Z){if(!$)return null;if(eZ.has($.id))return $;if(Z?.destructiveCommandProtectionEnabled===!1)return null;let J=Z?.effectiveDestructiveCommandRules?.[$.id];if(J)return J.enabled?$:null;return Z?.destructiveCommandRuleOverrides[$.id]==="off"?null:$}function o($,Z,J){if(eZ.has(Z))return!0;if($?.destructiveCommandProtectionEnabled===!1)return!1;let Q=$?.effectiveDestructiveCommandRules?.[Z];if(Q)return Q.enabled;let X=$?.destructiveCommandRuleOverrides[Z];return X?X==="on":J}function Z6($,Z){return Object.freeze(Object.fromEntries(o2.map((J)=>{let Q=J.activationCapability?Z[J.activationCapability]:void 0,X=Q?.enabled??!0,K=$.destructiveCommandRuleOverrides[J.id],W=J.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...K?{override:K}:{}}:$.destructiveCommandProtectionEnabled?K?{enabled:K==="on",inheritedEnabled:X,changesInherited:K==="on"!==X,source:"rule_override",...J.activationCapability?{activationCapability:J.activationCapability}:{},override:K}:{enabled:X,inheritedEnabled:X,changesInherited:!1,source:Q?.source??"built_in_default",...J.activationCapability?{activationCapability:J.activationCapability}:{}}:{enabled:!1,inheritedEnabled:X,changesInherited:!1,source:"master_disabled",...J.activationCapability?{activationCapability:J.activationCapability}:{},...K?{override:K}:{}};return[J.id,Object.freeze(W)]})))}function $8($,Z){return Object.freeze({...$,effectiveDestructiveCommandRules:Z6($,Z)})}var t2=10,Y$=20,y0=/^[a-zA-Z][a-zA-Z0-9_-]*$/,B$=256,$1=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Z8=new Set(["python","python3","python2","node","ruby","perl"]),J8=/^python(?:[23](?:\.\d+)*)?$/,e2=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);import{types as cK}from"node:util";var dK=new Set(["applypatch","patch"]),iK=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),sK=new Set(["grep","grepsearch","rg"]),rK=new Set(["findbyname","glob"]),nK=new Set(["findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),aK=new Set(["command","diff","input","patch","patchtext"]),Q8=new TextEncoder,oK=new TextDecoder,tK=/\s/,eK=64;class U0 extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var c$=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function B8($){return $.replace(/[-_\s]/g,"").toLowerCase()}function Z4($){return nK.has(B8($))}function $W($){let Z=B8($);if(dK.has(Z))return"patch";if(sK.has(Z))return"grep";if(rK.has(Z))return"glob";if(iK.has(Z))return"path";return"unknown"}function q$($){if(!$||typeof $!=="object")return;j8($);let Z=Object.getOwnPropertyDescriptor($,"command");if(!Z){if("command"in $)i1();return}if(Z.get||Z.set)i1();let J=Z.value;return typeof J==="string"&&J!==""?J:void 0}function K6($,Z){return q8($,Z,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function q8($,Z,J,Q){let X=H8($,J,Q);if(!X)return[];let K=X.entries.flatMap(([W,Y])=>{let B=q8(Y,Z,J,Q+1);return typeof Y==="string"&&Z.has(U8(W))?[Y]:B});return J.ancestors.delete(X.object),K}function U8($){return $.replace(/-/g,"_").toLowerCase()}function W6($){return G8($,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(JW)}function G8($,Z,J,Q){let X=H8($,J,Q);if(typeof $==="string")return Z?[$]:[];if(!X)return[];let K=X.entries.flatMap(([W,Y])=>G8(Y,X.array?Z:aK.has(U8(W)),J,Q+1));return J.ancestors.delete(X.object),K}function ZW($,Z,J){if(Z.nodes++,$!==null&&typeof $==="object"&&J>c$.maxDepth||Z.nodes>c$.maxNodes)i1();if(typeof $!=="string")return;let Q=Buffer.byteLength($);if(Z.stringBytes+=Q,Q>c$.maxStringBytes||Z.stringBytes>c$.maxAggregateStringBytes)i1()}function H8($,Z,J){if(ZW($,Z,J),!$||typeof $!=="object")return null;let Q=j8($);if(Z.ancestors.has($))i1();let X=Reflect.ownKeys($);if(Z.keys+=X.length,Z.keys>c$.maxKeys)i1();let K=X.flatMap((W)=>{let Y=Object.getOwnPropertyDescriptor($,W);if(!Y||Y.get||Y.set)i1();return typeof W==="string"&&Y.enumerable?[[W,Y.value]]:[]});return Z.ancestors.add($),{object:$,array:Q,entries:K}}function j8($){if(cK.isProxy($))i1();let Z=Array.isArray($),J=Object.getPrototypeOf($);if(Z&&J!==Array.prototype||!Z&&J!==Object.prototype&&J!==null)i1();return Z}function i1(){throw new U0}function JW($){let Z=[],J=$.split(/\r?\n/),Q=!1,X=!1,K=null,W=null,Y=()=>{X=!1,K=null,W=null};for(let B=0;B<J.length;B++){let q=J[B]??"";if(q==="*** Begin Patch"){Q=!0,Y();continue}if(q==="*** End Patch"){Q=!1,Y();continue}if(q.startsWith("@@")){let U=QW(q);if(X=!0,K=U?.oldLines??null,W=U?.newLines??null,K===0&&W===0)Y();continue}if(X&&K!==null&&W!==null){let U=q.startsWith(" ")||q.startsWith("-")?1:0,G=q.startsWith(" ")||q.startsWith("+")?1:0;if(K=Math.max(0,K-U),W=Math.max(0,W-G),K===0&&W===0)Y();continue}if(q.startsWith("*** ")){Y(),Z.push(...J6(q));continue}if(X)continue;if(q.startsWith("diff --git ")){Z.push(...J6(q));continue}if(q.startsWith("--- ")){let U=J[B+1]??"";if(!U.startsWith("+++ "))continue;Z.push(...X6($4(q.slice(4),!0),$4(U.slice(4),!0))),B++;continue}if(!Q)Z.push(...J6(q))}return Z}function QW($){let Z=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec($);if(!Z)return null;return{oldLines:Number(Z[1]??1),newLines:Number(Z[2]??1)}}function J6($){let Z=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec($);if(Z?.[1])return Y8(Z[1]);let J=/^\*\*\* Move to: (.+)$/.exec($);if(J?.[1])return Y8(J[1]);if($.startsWith("diff --git "))return XW($.slice(11));let Q=/^--- (.+)$/.exec($);if(Q?.[1])return W8(Q[1]);let X=/^\+\+\+ (.+)$/.exec($);if(X?.[1])return W8(X[1]);let K=/^(?:rename|copy) (?:from|to) (.+)$/.exec($);if(K?.[1])return GW(K[1]);return[]}function XW($){let Z=KW($);if(Z.length===2&&Z[0]&&Z[1])return X6(Z[0],Z[1]);let J=WW($);return J?X6($.slice(J.oldStart,J.oldEnd),$.slice(J.newStart,J.newEnd)):[]}function KW($){let Z=[],J=0;while(J<$.length&&Z.length<2){while(w0($[J]))J++;if(J>=$.length)break;let Q=$[J]==='"'||$[J]==="'"?$[J]:void 0;if(!Q){let K=J;while(J<$.length&&!w0($[J]))J++;Z.push($.slice(K,J));continue}let X=_8($,J,Q);if(!X)return[];Z.push(X.value),J=X.end}while(w0($[J]))J++;return J===$.length?Z:[]}function WW($){let Z=0;while(Z<$.length&&w0($[Z]))Z++;let J=$.length;while(J>Z&&w0($[J-1]))J--;let Q=0,X=Z;while(X<J){if(!w0($[X])){X++;continue}let K=X;while(X<J&&w0($[X]))X++;if(K===Z||X===J)continue;if(Q++,Q>eK)i1();if(YW($,Z,K,X,J))return{oldStart:Z,oldEnd:K,newStart:X,newEnd:J}}return null}function YW($,Z,J,Q,X){if(Q6($,Z,J,Q,X))return!0;let K=X8($,"/",Z,J),W=X8($,"/",Q,X);if(K<=Z||W<=Q)return!1;if(Q6($,Z,K,Q,W))return!1;return Q6($,K+1,J,W+1,X)}function Q6($,Z,J,Q,X){if(J-Z!==X-Q)return!1;for(let K=0;K<J-Z;K++)if($[Z+K]!==$[Q+K])return!1;return!0}function X8($,Z,J,Q){for(let X=J;X<Q;X++)if($[X]===Z)return X;return-1}function w0($){return $!==void 0&&tK.test($)}function _8($,Z,J){let Q=[],X=Z+1;while(X<$.length){let K=$[X]??"";if(K===J)return{value:oK.decode(Uint8Array.from(Q)),end:X+1};if(K!=="\\"||J==="'"){Q.push(...Q8.encode(K)),X++;continue}let W=$.slice(X+1),Y=/^[0-7]{1,3}/.exec(W)?.[0];if(Y){Q.push(Number.parseInt(Y,8)),X+=Y.length+1;continue}Q.push(...Q8.encode(BW(W[0]??""))),X+=2}return null}function BW($){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[$]??$}function qW($){return d$(HW($))}function X6($,Z){if($==="/dev/null")return K8(Z);if(Z==="/dev/null")return K8($);if($.startsWith("a/")&&Z.startsWith("b/"))return[$.slice(2),Z.slice(2)].flatMap(d$);let J=UW($,Z)??($===Z?O8($):null);return[$,Z,...J?[J]:[]].flatMap(d$)}function K8($){let Z=O8($);return[$,...Z?[Z]:[]].flatMap(d$)}function O8($){let Z=$.indexOf("/");return Z>0&&Z<$.length-1?$.slice(Z+1):null}function UW($,Z){let J=$.indexOf("/"),Q=Z.indexOf("/");if(J<1||Q<1)return null;if($.slice(0,J)===Z.slice(0,Q))return null;let X=$.slice(J+1);return X===Z.slice(Q+1)?X:null}function W8($){return qW($4($,!0))}function GW($){return d$($4($,!1))}function $4($,Z){let J=$.trim(),Q=J[0]==='"'||J[0]==="'"?J[0]:void 0;if(Q){let X=_8(J,0,Q);if(X&&(Z||J.slice(X.end).trim()===""))return X.value}return Z?J.split("\t",1)[0]?.trim()??"":J}function HW($){return $.startsWith("a/")||$.startsWith("b/")?$.slice(2):$}function d$($){return $===""||$==="/dev/null"?[]:[$]}function Y8($){let Z=$.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return Z===""||Z==="/dev/null"?[]:[Z]}import{basename as jW,dirname as _W,join as L8}from"node:path";var J4=Object.freeze({maxEnvironmentExpansionDepth:64,maxMissingSuffixComponents:256,maxRealpathAttempts:1024,maxProcessedCandidateBytes:4194304});class _1 extends Error{name="PathCanonicalizationLimitError";constructor(){super("Path canonicalization work limit exceeded.")}}function i$(){return{realpathAttempts:0,processedCandidateBytes:0,resolvedPaths:new Map}}function v0($){return{...i$(),environment:$}}var Q4=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function X4($,Z){return Y6($,0,Z)}function Y6($,Z,J){let Q="",X=0;while(X<$.length){if($[X]!=="$"){Q+=$[X],X++;continue}if($[X+1]==="{"){let W=B6($,X+2),Y=OW($,X,Z);if(Y===null){if(Q4.has(W))throw new _1;Q+=$.slice(X);break}let B=$.slice(X,Y+1);Q+=LW(B,Z,J),X=Y+1;continue}let K=B6($,X+1);if(!K){Q+="$",X++;continue}Q+=q6(K,J)??`$${K}`,X+=K.length+1}return Q}function OW($,Z,J){let Q=1;for(let X=Z+2;X<$.length;X++){if($[X]==="\\"){X++;continue}if($[X]==="$"&&$[X+1]==="{"){if(Q++,J+Q>J4.maxEnvironmentExpansionDepth)throw new _1;X++;continue}if($[X]!=="}")continue;if(Q--,Q===0)return X}return null}function LW($,Z,J){let Q=$.slice(2,-1),X=B6(Q,0);if(!X)return $;let K=Q.slice(X.length);if(!K)return q6(X,J)??$;let W=[":-",":+",":=",":?","-","+","=","?"].find((q)=>K.startsWith(q));if(!W){if(Q4.has(X))throw new _1;return $}if(!Q4.has(X))return $;if(W.endsWith("="))throw new _1;let Y=q6(X,J),B=W.startsWith(":")?Y!==null&&Y!=="":Y!==null;if(W.endsWith("?")&&!B)throw new _1;if(W.endsWith("-")||W.endsWith("?"))return B?Y??"":Y6(K.slice(W.length),Z+1,J);return B?Y6(K.slice(W.length),Z+1,J):""}function B6($,Z){if(!/[A-Za-z_]/.test($[Z]??""))return"";let J=Z+1;while(/[A-Za-z0-9_]/.test($[J]??""))J++;return $.slice(Z,J)}function l($,Z,J=i$()){if(!$)return $;let Q=J.resolvedPaths.get($);if(Q!==void 0)return Q;let X=[],K=$;while(!0){if(J.realpathAttempts++,J.processedCandidateBytes+=Buffer.byteLength(K),J.realpathAttempts>J4.maxRealpathAttempts||J.processedCandidateBytes>J4.maxProcessedCandidateBytes)throw new _1;let W=Z.realpath(K);if(W!==null){let B=X.length===0?W:L8(W,...X.reverse());return J.resolvedPaths.set($,B),B}let Y=_W(K);if(Y===K){let B=X.length===0?K:L8(K,...X.reverse());return J.resolvedPaths.set($,B),B}if(X.length>=J4.maxMissingSuffixComponents)throw new _1;X.push(jW(K)),K=Y}}function q6($,Z){if(!Q4.has($))return null;if($==="HOME")return Z.env.get("HOME")??Z.home;return Z.env.get($)??null}function K4(){return[]}function W4(){return[]}function Y4(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function MW($){return Object.freeze({...$,span:Object.freeze($.span),words:Object.freeze($.words),redirections:Object.freeze($.redirections.map((Z)=>Object.freeze({...Z,span:Object.freeze(Z.span),...Z.heredoc?{heredoc:Object.freeze({...Z.heredoc,bodySpan:Object.freeze(Z.heredoc.bodySpan),terminatorSpan:Object.freeze(Z.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze($.nested.map((Z)=>U1(Z)))})}function B4($,Z,J){$.push(J),Z.reset()}function FW($,Z,J,Q,X){if(Q<=J)return;$.push({raw:Z.slice(J,Q),span:{start:J,end:Q},provenance:X})}function q4($){let Z=[];return{parts:Z,push:(J,Q,X)=>FW(Z,$,J,Q,X)}}function U6($){let Z=$.parts??[{raw:$.raw,span:$.span,provenance:$.provenance}];return Object.freeze({kind:"word",...$,span:Object.freeze($.span),parts:Object.freeze(Z.map((J)=>Object.freeze({...J,span:Object.freeze(J.span)})))})}function U$($,Z,J,Q,X,K,W){return U6({text:Q,raw:$.slice(Z,J),span:{start:Z,end:J},provenance:X,quoted:K,...W?{parts:W}:{}})}function U1($){return Object.freeze({...$,span:Object.freeze($.span),issues:Object.freeze($.issues.map((Z)=>Object.freeze({...Z,span:Object.freeze(Z.span)}))),nodes:Object.freeze($.nodes.map((Z)=>{if(Z.kind==="command")return MW(Z);if(Z.kind==="group"||Z.kind==="function")return Object.freeze({...Z,span:Object.freeze(Z.span),body:U1(Z.body)});return Object.freeze({...Z,span:Object.freeze(Z.span)})}))})}function G6($,Z,J){if(Z>=J||F8($[Z]??""))return null;let Q="",X=!1,K=!1,W=Z;while(W<J&&!F8($[W]??"")){let Y=$[W]??"";if(Y==="'"){X=!0;let B=M8($,W+1,J,"'");Q+=B.text,K||=!B.closed,W=B.next;continue}if(Y==='"'){X=!0;let B=M8($,W+1,J,'"');Q+=B.text,K||=!B.closed,W=B.next;continue}if(Y==="\\"){X=!0;let B=$[W+1];if(!B||B===`
-`||B==="\r"){K=!0;break}Q+=B,W+=2;continue}if(Y==="`"||$.startsWith("$(",W)||$.startsWith("${",W)||$.startsWith("<(",W)||$.startsWith(">(",W))K=!0;Q+=Y,W++}return{delimiter:Q,quoted:X,next:W,span:{start:Z,end:W},ambiguous:K}}function H6($,Z,J,Q){let X=[],K=Z;for(let W of Q){let Y=K,B=!1;while(K<J){let q=NW($,K,J);if((W.stripTabs?q.text.replace(/^\t+/,""):q.text)===W.delimiter){W.attach({body:W.stripTabs?VW($.slice(Y,K)):$.slice(Y,K),delimiter:W.delimiter,quotedDelimiter:W.quotedDelimiter,stripTabs:W.stripTabs,bodySpan:{start:Y,end:K},terminatorSpan:{start:K,end:q.contentEnd}}),K=q.next,B=!0;break}if(q.next<=K)break;K=q.next}if(B)continue;return X.push({code:"unterminated-heredoc",message:`heredoc delimiter ${W.delimiter} was not found`,span:W.declarationSpan}),{next:J,issues:X,terminated:!1}}return{next:K,issues:X,terminated:!0}}function M8($,Z,J,Q){let X="",K=Z;while(K<J&&$[K]!==`
-`&&$[K]!=="\r"){let W=$[K]??"";if(W===Q)return{text:X,next:K+1,closed:!0};if(Q==='"'&&W==="\\"&&$[K+1]){let Y=$[K+1]??"";X+=["$","`",'"',"\\"].includes(Y)?Y:`\\${Y}`,K+=2;continue}X+=W,K++}return{text:X,next:K,closed:!1}}function F8($){return/[\s;&|<>)]/u.test($)||$==="`"}function NW($,Z,J){let Q=Z;while(Q<J&&$[Q]!==`
-`&&$[Q]!=="\r")Q++;let X=Q>=J?J:$[Q]==="\r"&&$[Q+1]===`
-`?Q+2:Q+1;return{text:$.slice(Z,Q),contentEnd:Q,next:X}}function VW($){return $.replace(/(^|\r\n?|\n)\t+/g,"$1")}var z8=new Set(["&&","||","|","|&"]);function I8($,Z,J){let Q={start:0,end:$.length};if($.length>J.maxInputLength)return U1({kind:"program",dialect:Z,source:$,span:Q,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${J.maxInputLength} UTF-16 code units`,span:Q}],nodes:[]});let X=H4($,0,$.length,Z,J,{used:0,max:J.maxWords},0);return U1({kind:"program",dialect:Z,source:$,span:Q,status:O4(X.issues,X.limited),issues:X.issues,nodes:X.nodes})}function H4($,Z,J,Q,X,K,W,Y){let B=K4(),q=W4(),U=Y4(),G=[],j=()=>{if(U.words.length===0&&U.redirections.length===0)return;let _={start:U.start,end:U.end},O=U.words.map((M)=>M.text);B4(B,U,{kind:"command",dialect:Q,source:$.slice(_.start,_.end),span:_,words:U.words,redirections:U.redirections,nested:U.nested,dynamicExecutable:U.words[0]?.provenance==="command-substitution",displayText:q.length>0&&B.length===0?$.slice(Z,J):O.join(" ")})},H=Z;while(H<J){let _=$[H];if(!_)break;if(Y&&_===Y)return j(),D8(B,q),{nodes:B,issues:q,next:H+1,closed:!0,limited:!1,pendingHeredocs:G};if(_4(_)){if(_===`
-`||_==="\r"){j();let A=_==="\r"&&$[H+1]===`
-`?H+2:H+1,F=B.at(-1);if(F?.kind!=="connector"||!z8.has(F.operator))B.push(Object.freeze({kind:"connector",operator:$.slice(H,A),span:Object.freeze({start:H,end:A})}));if(G.length>0){let R=H6($,A,J,G.splice(0));q.push(...R.issues),H=R.next;continue}H=A;continue}H++;continue}if(_==="#"){while(H<J&&$[H]!==`
-`&&$[H]!=="\r")H++;continue}let O=U.start===-1?kW($,H,J):void 0;if(O){if(_6(B,q,H),W>=X.maxDepth)return G$(B,q,H,"depth-limit",X.maxDepth);if(!j6(K))return G$(B,q,H,"word-limit",X.maxWords);let A=H4($,O.braceIndex+1,J,Q,X,K,W+1,"}"),F=A.next,R={start:O.braceIndex+1,end:A.closed?F-1:F},I=N8($,Q,R,A);if(B.push({kind:"function",name:O.name,span:{start:H,end:F},body:I}),q.push(...A.issues),A.pendingHeredocs.length>0||r$(A.nodes))q.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:H,end:F}});if(G.push(...A.pendingHeredocs),A.limited)return G4(B,q,A.next);if(!A.closed)q.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:O.braceIndex,end:F}});H=F;continue}let M=j4($,H);if(M){if(j(),!S8(B.at(-1)))q.push({code:"unexpected-connector",message:`connector ${M} has no preceding command`,span:{start:H,end:H+M.length}});B.push(Object.freeze({kind:"connector",operator:M,span:Object.freeze({start:H,end:H+M.length})})),H+=M.length;continue}if(_===")"){j(),q.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:H,end:H+1}}),B.push({kind:"unknown",source:_,span:{start:H,end:H+1}}),H++;continue}if((_==="("||_==="{"&&PW($,H,J))&&U.start===-1){if(_6(B,q,H),W>=X.maxDepth)return G$(B,q,H,"depth-limit",X.maxDepth);let A=_==="("?")":"}",F=H4($,H+1,J,Q,X,K,W+1,A),R=F.next,I={start:H+1,end:F.closed?R-1:R},b=N8($,Q,I,F);if(B.push({kind:"group",style:_==="("?"subshell":"brace",span:{start:H,end:R},body:b}),q.push(...F.issues),F.pendingHeredocs.length>0||r$(F.nodes))q.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:H,end:R}});if(G.push(...F.pendingHeredocs),F.limited)return G4(B,q,F.next);if(!F.closed)q.push({code:_==="("?"unclosed-subshell":"unclosed-brace-group",message:`${_} group is not closed`,span:{start:H,end:R}});H=R;continue}let L=(_==="<"||_===">")&&$[H+1]!=="("?zW($,H):null;if(L){let A=U.words.at(-1),F=A&&A.span.end===H&&/^[0-9]+$/.test(A.raw)?Number(A.raw):void 0;if(F!==void 0)U.words.pop();let R=F===void 0?H:A?.span.start??H;U.start=U.start===-1?H:U.start;let I=H+L.length;while(I<J&&/[ \t]/.test($[I]??""))I++;let b=$[I],C=I>H+L.length&&b==="#",y=!b||_4(b)||!!j4($,I)||b===Y||b===")"||C||(b==="<"||b===">")&&$[I+1]!=="(",w=L==="<<"||L==="<<-"?G6($,I,J):void 0,k=w?{word:U$($,I,w.next,w.delimiter,"literal",w.quoted),nested:[],issues:[],next:w.next,limited:!1}:!y?O6($,I,J,Q,X,K,W):void 0;if(k){if(q.push(...k.issues),k.limited)return G4(B,q,k.next);if(!j6(K))return G$(B,q,k.next,"word-limit",X.maxWords)}let Y1=k?.next??H+L.length,P={kind:"redirection",operator:L,span:{start:R,end:Y1},...F===void 0?{}:{fd:F},...k?{target:k.word}:{}};if(U.redirections.push(P),L==="<<"||L==="<<-")if(!w)q.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:H,end:H+L.length}});else{if(w.ambiguous||w.delimiter.length===0)q.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:w.span});G.push({delimiter:w.delimiter,quotedDelimiter:w.quoted,stripTabs:L==="<<-",declarationSpan:{start:R,end:Y1},attach:(v)=>{P.heredoc=v}})}else if(!k)q.push({code:"missing-redirection-target",message:`redirection ${L} requires a target word`,span:{start:H,end:H+L.length}});if(k)U.nested.push(...k.nested);U.end=Y1,H=Y1;continue}if(U.start===-1)_6(B,q,H);let D=O6($,H,J,Q,X,K,W);if(q.push(...D.issues),D.limited)return G4(B,q,D.next);let z=EW(U.words)?vW($,D.word,K.max-K.used,X.maxDepth,X.maxInputLength):void 0;if(z?.limitCode)return G$(B,q,D.next,z.limitCode,z.limitCode==="word-limit"?X.maxWords:z.limitCode==="depth-limit"?X.maxDepth:X.maxInputLength);let f=z?.words??[D.word];for(let A of f){if(!j6(K))return G$(B,q,D.next,"word-limit",X.maxWords);U.words.push(A)}U.start=U.start===-1?H:U.start,U.end=D.next,U.nested.push(...D.nested),H=D.next>H?D.next:H+1}return j(),D8(B,q),q.push(...xW(G)),{nodes:B,issues:q,next:H,closed:Y===void 0,limited:!1,pendingHeredocs:[]}}function N8($,Z,J,Q){return{kind:"program",dialect:Z,source:$.slice(J.start,J.end),span:J,status:O4(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes}}function O6($,Z,J,Q,X,K,W){let Y="",B=Z,q=!1,U="literal",G=[],j=[],H=!1;while(B<J){let _=$[B],O=(_==="<"||_===">")&&$[B+1]==="(";if(!_||_4(_)||(_===";"||_==="|"||_==="&")&&j4($,B)||(_==="<"||_===">")&&!O)break;if(_===")")break;if(_==="'"){q=!0;let L=$.indexOf("'",B+1);if(L===-1||L>=J){Y+=$.slice(B+1,J),j.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:B,end:J}}),B=J;break}Y+=$.slice(B+1,L),B=L+1;continue}if(_==='"'){q=!0;let L=RW($,B,J,Q,X,K,W);if(Y+=L.text,G.push(...L.nested),j.push(...L.issues),H||=L.limited,U=s$(U,L.provenance),B=L.next,H)break;continue}if($.startsWith("$'",B)){q=!0;let L=IW($,B+2,J);if(Y+=L.text,j.push(...L.issues),!L.closed)j.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:B,end:J}});B=L.next;continue}if(_==="\\"){let L=$[B+1];if(!L){j.push({code:"trailing-escape",message:"escape has no following character",span:{start:B,end:B+1}}),B++;break}if(L===`
-`){B+=2;continue}Y+=L,B+=2;continue}let M=_==="$"||_==="<"||_===">"||_==="`"?L6($,B,J,Q,X,K,W):null;if(M){let L=b8(M,G,j);if(H||=L.limited,U=s$(U,L.provenance),B=L.next,H)break;continue}if(_==="$"){let L=C8($,B,J,Y,U);Y=L.text,U=L.provenance,B=L.next;continue}if(_==="*"||_==="?"||_==="[")U=s$(U,"glob");Y+=_,B++}return{word:U$($,Z,B,Y,U,q,U==="literal"?void 0:fW($,Z,B)),nested:G,issues:j,next:B,limited:H}}function RW($,Z,J,Q,X,K,W){let Y="",B="literal",q=[],U=[],G=!1,j=Z+1;while(j<J){let H=$[j];if(H==='"')return{text:Y,provenance:B,nested:q,issues:U,next:j+1,limited:G};if(H==="\\"&&$[j+1]){let O=$[j+1]??"";if(O===`
-`){j+=2;continue}if(O==="\r"&&$[j+2]===`
-`){j+=3;continue}Y+=["$","`",'"',"\\"].includes(O)?O:`\\${O}`,j+=2;continue}if($.startsWith("$((",j)){let O=M6($,j+3,J,"))"),M=O===-1?J:O+2;if(Y+=$.slice(j,M),O===-1)U.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:j,end:M}});j=M;continue}let _=L6($,j,J,Q,X,K,W);if(_){let O=b8(_,q,U);if(j=O.next,G||=O.limited,B=s$(B,O.provenance),G)return{text:Y,provenance:B,nested:q,issues:U,next:j,limited:G};continue}if(H==="$"){let O=C8($,j,J,Y,B);Y=O.text,B=O.provenance,j=O.next;continue}Y+=H??"",j++}return U.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:Z,end:J}}),{text:Y,provenance:B,nested:q,issues:U,next:J,limited:G}}function L6($,Z,J,Q,X,K,W){let Y=$.startsWith("$((",Z),B=$.startsWith("$(",Z)&&!Y,q=($.startsWith("<(",Z)||$.startsWith(">(",Z))&&!0,U=$[Z]==="`";if(!Y&&!B&&!q&&!U)return null;let G=Y?3:U?1:2,j=Y?"))":U?"`":")",H=M6($,Z+G,J,j),_=H===-1?J:H,O=H===-1?J:H+j.length;if(W>=X.maxDepth)return{program:gW($,Z+G,_,Q,"depth-limit"),next:O,provenance:Y?"arithmetic":"command-substitution"};if(Y){let z=[],f=[],A=!1,F=Z+G;while(F<_){let R=L6($,F,_,Q,X,K,W+1);if(!R){F++;continue}if(z.push(...R.program.nodes),f.push(...R.program.issues),A||=R.program.status==="limited",F=R.next,A)break}if(H===-1)f.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:Z,end:O}});return{program:U1({kind:"program",dialect:Q,source:$.slice(Z+G,_),span:{start:Z+G,end:_},status:O4(f,A),issues:f,nodes:z}),next:O,provenance:"arithmetic"}}let M=H4($,Z+G,_,Q,X,K,W+1),L=H===-1?[{code:Y?"unclosed-arithmetic":"unclosed-command-substitution",message:`${$.slice(Z,Z+G)} substitution is not closed`,span:{start:Z,end:O}}]:[],D=(U||q)&&r$(M.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:Z,end:O}}]:[];return{program:U1({kind:"program",dialect:Q,source:$.slice(Z+G,_),span:{start:Z+G,end:_},status:O4([...M.issues,...L,...D],M.limited),issues:[...M.issues,...L,...D],nodes:M.nodes}),next:O,provenance:Y?"arithmetic":"command-substitution"}}function b8($,Z,J){return Z.push($.program),J.push(...$.program.issues),{provenance:$.provenance,next:$.next,limited:$.program.status==="limited"}}function M6($,Z,J,Q){if(Q==="`"){for(let Y=Z;Y<J;Y++)if($[Y]==="\\")Y++;else if($[Y]==="`")return Y;return-1}let X=1,K={single:!1,double:!1},W=[];for(let Y=Z;Y<J;Y++){let B=$[Y];if((B===`
-`||B==="\r")&&W.length>0){let U=B==="\r"&&$[Y+1]===`
-`?Y+2:Y+1,G=H6($,U,J,W.splice(0));if(!G.terminated)return-1;Y=G.next-1;continue}let q=f8($,Y,Z,J,K);if(q!==null){Y=q;continue}if(!K.double&&$.startsWith("$((",Y)){let U=DW($,Y+3,J);if(U===-1)return-1;Y=U+1;continue}if(Q===")"&&!K.double&&B==="<"&&$[Y+1]==="<"&&$[Y+2]!=="<"){let U=$[Y+2]==="-",G=Y+(U?3:2);while(G<J&&/[ \t]/.test($[G]??""))G++;let j=G6($,G,J);if(j){W.push({delimiter:j.delimiter,quotedDelimiter:j.quoted,stripTabs:U,declarationSpan:{start:Y,end:j.next},attach:()=>{return}}),Y=j.next-1;continue}}if($.startsWith("$(",Y)&&!$.startsWith("$((",Y)){X++,Y++;continue}if(B==="("&&!K.double)X++;if(B===")"&&!K.double){if(X--,X===0)return Q==="))"&&$[Y+1]!==")"?-1:Y}}return-1}function DW($,Z,J){let Q=1,X={single:!1,double:!1};for(let K=Z;K<J;K++){let W=$[K],Y=f8($,K,Z,J,X);if(Y!==null){K=Y;continue}if($.startsWith("$(",K)&&!$.startsWith("$((",K)){Q++,K++;continue}if(W==="("&&!X.double)Q++;if(W!==")"||X.double)continue;if(Q--,Q===0)return $[K+1]===")"?K:-1}return-1}function f8($,Z,J,Q,X){let K=$[Z];if(K==="\\"&&!X.single)return Z+1;if(!X.double&&K==="'")X.single=!X.single;if(!X.single&&K==='"')X.double=!X.double;if(X.single)return Z;if(X.double||K!=="#"||!lW($,Z,J))return null;let W=Z;while(W+1<Q&&$[W+1]!==`
-`&&$[W+1]!=="\r")W++;return W}function j4($,Z){let J=$[Z];if(J===";")return";";if(J==="&")return $[Z+1]==="&"?"&&":"&";if(J==="|")return $[Z+1]==="|"?"||":$[Z+1]==="&"?"|&":"|";return null}function zW($,Z){let J=$[Z];if(J===">"){if($[Z+1]===">")return">>";if($[Z+1]==="&")return">&";return $[Z+1]==="|"?">|":">"}if(J!=="<")return null;if($.startsWith("<<<",Z))return"<<<";if($.startsWith("<<-",Z))return"<<-";if($[Z+1]==="<")return"<<";if($[Z+1]==="&")return"<&";if($[Z+1]===">")return"<>";return"<"}function _4($){let Z=$.charCodeAt(0);if(Z===32||Z>=9&&Z<=13)return!0;if(Z<128)return!1;return/\s/u.test($)}function P8($,Z,J){if($[Z+1]==="{"){let X=$.indexOf("}",Z+2);return X===-1||X>=J?J:X+1}let Q=Z+1;while(Q<J&&/[A-Za-z0-9_?@#$!*-]/.test($[Q]??""))Q++;return Q===Z+1?Z+1:Q}function IW($,Z,J){let Q="",X=[],K=Z;while(K<J){let W=$[K];if(W==="'")return{text:Q,next:K+1,closed:!0,issues:X};if(W!=="\\"){Q+=W??"",K++;continue}let Y=bW($,K+1,J);if(Q+=Y.text,Y.invalidCodePoint!==void 0)X.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${Y.invalidCodePoint}`,span:{start:K,end:Y.next}});K=Y.next}return{text:Q,next:J,closed:!1,issues:X}}function bW($,Z,J){let Q=$[Z];if(!Q||Z>=J)return{text:"\\",next:Z};let X=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(X.has(Q))return{text:X.get(Q)??Q,next:Z+1};if(Q==="x")return U4($,Z+1,J,16,2,Z+1);if(Q==="u")return U4($,Z+1,J,16,4,Z+1);if(Q==="U")return U4($,Z+1,J,16,8,Z+1);if(/[0-7]/.test(Q))return U4($,Z,J,8,3,Z+1);return{text:Q,next:Z+1}}function U4($,Z,J,Q,X,K){let W=Q===16?/[0-9a-fA-F]/:/[0-7]/,Y="",B=Z;while(B<J&&Y.length<X&&W.test($[B]??""))Y+=$[B],B++;if(!Y)return{text:$[K-1]??"",next:K};let q=Number.parseInt(Y,Q);return q>1114111||q>=55296&&q<=57343?{text:"�",next:B,invalidCodePoint:q}:{text:String.fromCodePoint(q),next:B}}function O4($,Z=!1){if(Z)return"limited";if($.some((J)=>J.code==="invalid-ansi-c-code-point"||J.code==="missing-heredoc-delimiter"||J.code==="ambiguous-heredoc-delimiter"||J.code==="unterminated-heredoc"||J.code==="unsupported-heredoc-context"))return"invalid";return $.length>0?"partial":"complete"}function C8($,Z,J,Q,X){let K=P8($,Z,J);return{text:Q+$.slice(Z,K),provenance:s$(X,"variable"),next:K}}function fW($,Z,J){let Q=q4($),X=Z,K=!1,W=!1,Y=Z;while(Y<J){let B=$[Y];if(B==="\\"&&!K){Y+=2;continue}if(!W&&B==="'"){K=!K,Y++;continue}if(!K&&B==='"'){W=!W,Y++;continue}if(K){Y++;continue}let q=$.startsWith("$((",Y),U=$.startsWith("$(",Y)&&!q,G=!W&&($.startsWith("<(",Y)||$.startsWith(">(",Y)),j=B==="`";if(q||U||G||j){let H=q?3:j?1:2,_=q?"))":j?"`":")",O=M6($,Y+H,J,_),M=O===-1?J:O+_.length;Q.push(X,Y,"literal"),Q.push(Y,M,q?"arithmetic":"command-substitution"),Y=M,X=M;continue}if(B==="$"){let H=P8($,Y,J);if(H>Y+1){Q.push(X,Y,"literal"),Q.push(Y,H,"variable"),Y=H,X=H;continue}}if(!W&&(B==="*"||B==="?"||B==="[")){Q.push(X,Y,"literal"),Q.push(Y,Y+1,"glob"),Y++,X=Y;continue}Y++}return Q.push(X,J,"literal"),Q.parts}function s$($,Z){if(Z==="command-substitution"||$==="command-substitution")return"command-substitution";if(Z==="arithmetic"||$==="arithmetic")return"arithmetic";if(Z==="variable"||$==="variable")return"variable";if(Z==="glob"||$==="glob")return"glob";return $}function PW($,Z,J){return Z+1>=J||_4($[Z+1]??"")||j4($,Z+1)!==null}var CW=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),AW=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function EW($){let Z=0;while(Z<=$.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test($[Z]?.text??""))Z++;if(Z===$.length)return!0;let J=TW($,Z);if(J===void 0||J===null)return!1;Z=J}return!1}function TW($,Z){let J=$[Z]?.text.toLowerCase();if(J==="command")return SW($,Z);if(J==="env")return yW($,Z);if(J==="sudo")return wW($,Z);return}function SW($,Z){if($[Z+1]?.text==="-v")return null;for(let J=Z+1;J<$.length;J++){let Q=$[J]?.text??"";if(Q==="--")return J+1;if(Q==="-p"||Q==="-v"||Q==="-V"||/^-[pvV]+$/.test(Q))continue;return J}return $.length}function yW($,Z){for(let J=Z+1;J<$.length;J++){let Q=$[J]?.text??"";if(Q==="--")return J+1;if(CW.has(Q)){if($[J+1]===void 0)return null;J++;continue}if(Q.startsWith("-u=")||Q.startsWith("--unset=")||Q.startsWith("-C")&&Q.length>2||Q.startsWith("--chdir=")||Q.startsWith("-S")&&Q.length>2||Q.startsWith("--split-string=")||Q.startsWith("-P"))continue;if(Q.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(Q))continue;return J}return $.length}function wW($,Z){for(let J=Z+1;J<$.length;J++){let Q=$[J]?.text??"";if(Q==="--")return J+1;if(AW.has(Q)){if($[J+1]===void 0)return null;J++;continue}if(Q.startsWith("-"))continue;return J}return $.length}function A8($,Z,J,Q){if($.provenance!=="literal"||!$.raw.includes("{"))return;let X=[$.raw],K=$.raw.length,W=0;while(!0){let B=X.findIndex((_)=>R8(_));if(B===-1)break;if(++W>J)return{limited:!0};let q=X[B]??"",U=R8(q);if(!U||U.kind==="range")return{limited:!0};let G=U.start+q.length-U.end,j=U.alternatives.reduce((_,O)=>_+G+O.length,0);if(K-q.length+j>Q||X.length-1+U.alternatives.length>Z)return{limited:!0};let H=E8(q,U);X.splice(B,1,...H),K+=j-q.length}if(W===0)return;let Y=X.map((B)=>hW(B,J));if(Y.some((B)=>B===null))return{limited:!0};return{words:[...new Set(Y.filter((B)=>B!==null&&B!==""))]}}function vW($,Z,J,Q,X){if(Z.provenance!=="literal"||Z.quoted||Z.raw!==Z.text||!Z.raw.includes("{"))return;let K=[Z.text],W=Z.text.length,Y=0;while(!0){let q=K.findIndex((M)=>V8(M));if(q===-1)break;if(++Y>Q)return{limitCode:"depth-limit"};let U=K[q]??"",G=V8(U);if(!G)break;let j=G.start+U.length-G.end,H=G.alternatives.filter((M)=>j+M.length>0),_=H.reduce((M,L)=>M+j+L.length,0);if(W-U.length+_>X)return{limitCode:"brace-expansion-limit"};if(K.length-1+H.length>J)return{limitCode:"word-limit"};let O=E8(U,{...G,alternatives:H});K.splice(q,1,...O),W+=_-U.length}let B=K.filter((q)=>q.length>0);if(Y===0)return;return{words:B.map((q)=>U$($,Z.span.start,Z.span.end,q,"literal",!1))}}function V8($){let Z=[],J;for(let Q=0;Q<$.length;Q++){let X=$[Q];if(X==="{"){Z.push({start:Q,commas:[]});continue}if(X===","&&Z.length>0){Z.at(-1)?.commas.push(Q);continue}if(X!=="}"||Z.length===0)continue;let K=Z.pop();if(!K||K.commas.length===0)continue;if(!J||K.start<J.start)J={start:K.start,end:Q+1,commas:K.commas}}if(!J)return;return{start:J.start,end:J.end,alternatives:T8($,J)}}function R8($){let Z=[],J,Q=null,X=!1;for(let K=0;K<$.length;K++){let W=$[K];if(X){X=!1;continue}if(W==="\\"&&Q!=="'"){X=!0;continue}if(W===Q){Q=null;continue}if(Q===null&&(W==="'"||W==='"')){Q=W;continue}if(Q!==null)continue;if(W==="{"){Z.push({start:K,commas:[]});continue}if(W===","&&Z.length>0){Z.at(-1)?.commas.push(K);continue}if(W!=="}"||Z.length===0)continue;let Y=Z.pop();if(!Y)continue;let B=Y.commas.length>0?{kind:"alternatives",start:Y.start,end:K+1,commas:Y.commas}:uW($.slice(Y.start+1,K))?{kind:"range",start:Y.start,end:K+1}:void 0;if(B&&(!J||B.start<J.start))J=B}if(!J||J.kind==="range")return J;return{kind:J.kind,start:J.start,end:J.end,alternatives:T8($,J)}}function E8($,Z){return Z.alternatives.map((J)=>`${$.slice(0,Z.start)}${J}${$.slice(Z.end)}`)}function T8($,Z){let J=[Z.start,...Z.commas,Z.end-1];return J.slice(0,-1).map((Q,X)=>$.slice(Q+1,J[X+1]))}function uW($){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test($)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test($)}function hW($,Z){let J=`x${$}`,Q=O6(J,0,J.length,"posix",{maxInputLength:J.length,maxWords:1,maxDepth:Z},{used:0,max:1},0);if(Q.limited||Q.issues.length>0||Q.next!==J.length||Q.word.provenance!=="literal")return null;return Q.word.text.slice(1)}function gW($,Z,J,Q,X){return U1({kind:"program",dialect:Q,source:$.slice(Z,J),span:{start:Z,end:J},status:"limited",issues:[{code:X,message:"command structure exceeds parser limit",span:{start:Z,end:J}}],nodes:[]})}function G$($,Z,J,Q,X){return{nodes:$,issues:[...Z,{code:Q,message:`command structure exceeds parser limit ${X}`,span:{start:J,end:J}}],next:J,closed:!1,limited:!0,pendingHeredocs:[]}}function G4($,Z,J){return{nodes:$,issues:Z,next:J,closed:!1,limited:!0,pendingHeredocs:[]}}function j6($){return $.used++,$.used<=$.max}function kW($,Z,J){let Q=/^([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec($.slice(Z,J)),X=Q?.[1];if(!Q||!X)return;return{name:X,braceIndex:Z+Q[0].lastIndexOf("{")}}function r$($){return $.some((Z)=>{if(Z.kind==="command")return Z.redirections.some((J)=>J.heredoc)||Z.nested.some((J)=>r$(J.nodes));return(Z.kind==="group"||Z.kind==="function")&&r$(Z.body.nodes)})}function xW($){return $.map((Z)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${Z.delimiter} was not found`,span:Z.declarationSpan}))}function S8($){return $?.kind==="command"||$?.kind==="group"||$?.kind==="function"}function D8($,Z){let J=$.at(-1);if(J?.kind!=="connector"||!z8.has(J.operator))return;Z.push({code:"missing-command-after-connector",message:`connector ${J.operator} requires a following command`,span:J.span})}function _6($,Z,J){if(!S8($.at(-1)))return;Z.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:J,end:J+1}})}function lW($,Z,J){return Z===J||/[\s;&|()]/u.test($[Z-1]??"")}var y8=new Set(["remove-item","ri","del","erase","rd","rmdir"]),w8=["-rec","-for","-path","-literalpath","-whatif"],L4={maxInputLength:131072,maxWords:16384,maxDepth:64};function v8($){let Z=$.toLowerCase().replaceAll("`","");if(![...y8].some((Q)=>Z.includes(Q))&&!(Z.includes("rm")&&w8.some((Q)=>Z.includes(Q)))&&!Z.includes("<#"))return!1;let J=dW($);return J.invalidComment||J.commands.some(mW)}function mW($){let Z=$[0]==="&"||$[0]==="."?1:0,J=$[Z]?.toLowerCase();if(J&&y8.has(J))return!0;if(J!=="rm")return!1;return $.slice(Z+1).some((Q)=>{let X=Q.toLowerCase().split(":",1)[0]??"";return w8.some((K)=>X.startsWith(K))})}function u8($,Z){let J={start:0,end:$.length};if($.length>Z.maxInputLength)return U1({kind:"program",dialect:"powershell",source:$,span:J,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${Z.maxInputLength} UTF-16 code units`,span:J}],nodes:[]});let Q=D6($,0,$.length,Z,0);return U1({kind:"program",dialect:"powershell",source:$,span:J,status:iW(Q.issues,Q.limited),issues:Q.issues,nodes:Q.nodes})}function D6($,Z,J,Q,X,K=!1){let W=K4(),Y=W4(),B=Y4(),q=0,U=!1,G=()=>{if(B.words.length===0&&B.redirections.length===0)return;let H={start:B.start,end:B.end};B4(W,B,{kind:"command",dialect:"powershell",source:$.slice(H.start,H.end),span:H,words:B.words,redirections:B.redirections,nested:B.nested,dynamicExecutable:B.words[0]?.provenance!=="literal",displayText:B.words.map((_)=>_.text).join(" ")})},j=Z;while(j<J){let H=$[j];if(!H)break;if(K&&H==="}")return G(),{nodes:W,issues:Y,next:j+1,closed:!0,words:q,limited:U};let _=k8($,j,J,Q.maxDepth);if(_){if(_.issue)Y.push(_.issue);if(_.limited)return G(),{nodes:W,issues:Y,next:_.next,closed:!1,words:q,limited:!0};j=_.next;continue}if(/\s/.test(H)){if(H==="\r"||H===`
-`){G();let L=H==="\r"&&$[j+1]===`
-`?j+2:j+1;W.push(F6($,j,L)),j=L;continue}j++;continue}let O=z6($,j);if(O){G(),W.push(F6($,j,j+O.length)),j+=O.length;continue}if(H==="{"){if(G(),X>=Q.maxDepth)return Y.push(g8(j,Q.maxDepth)),{nodes:W,issues:Y,next:J,closed:!1,words:q,limited:!0};let L=D6($,j+1,J,Q,X+1,!0),D=L.closed?L.next-1:L.next,z=U1({kind:"program",dialect:"powershell",source:$.slice(j+1,D),span:{start:j+1,end:D},status:L.limited?"limited":L.issues.length>0?"partial":"complete",issues:L.issues,nodes:L.nodes});if(W.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:j,end:L.next}),body:z})),Y.push(...L.issues),!L.closed)Y.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:j,end:L.next}});q+=L.words,U||=L.limited,j=L.next;continue}if(H==="}"){G(),W.push(F6($,j,j+1)),j++;continue}if(H===">"||H==="<"){B.start=B.start===-1?j:B.start;let L=$[j+1]===H?j+2:j+1,D=L;while(/[ \t]/.test($[D]??""))D++;let z=D<J?N6($,D,J,Q,X):void 0,f=z?.next??L;if(B.redirections.push(Object.freeze({kind:"redirection",operator:$.slice(j,L),span:Object.freeze({start:j,end:f}),...z?{target:z.word}:{}})),z)Y.push(...z.issues),B.nested.push(...z.nested),q+=z.words,U||=z.limited;B.end=f,j=f;continue}if(H===","){B.start=B.start===-1?j:B.start,B.words.push(U6({text:",",raw:",",span:{start:j,end:j+1},provenance:"literal",quoted:!1})),B.end=++j;continue}let M=N6($,j,J,Q,X);if(B.start=B.start===-1?j:B.start,B.end=M.next,B.words.push(M.word),Y.push(...M.issues),B.nested.push(...M.nested),q+=1+M.words,U||=M.limited,q>Q.maxWords)return Y.push({code:"word-limit",message:`command exceeds ${Q.maxWords} words`,span:{start:j,end:M.next}}),G(),{nodes:W,issues:Y,next:M.next,closed:!1,words:q,limited:!0};j=M.next>j?M.next:j+1}return G(),{nodes:W,issues:Y,next:j,closed:!K,words:q,limited:U}}function N6($,Z,J,Q,X){let K="",W="literal",Y=!1,B=[],q=[],U=0,G=!1,j=(_)=>{let O=pW($,_,J,Q,X);return K+=$.slice(_,O.next),q.push(O.program),B.push(...O.program.issues),U+=V6(O.program),G||=O.program.status==="limited",W="command-substitution",O.next},H=Z;while(H<J){let _=$[H];if(!_||/\s/.test(_)||z6($,H)||_===">"||_==="<"||_==="#")break;if(_===",")break;if(_==="`"){let O=$[H+1];if(!O){B.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:H,end:H+1}}),H++;break}K+=O,H+=2;continue}if($.startsWith("$(",H)){H=j(H);continue}if(_==="'"){Y=!0,H++;let O=!1;while(H<$.length){if($[H]==="'"&&$[H+1]==="'"){K+="'",H+=2;continue}if($[H]==="'"){O=!0,H++;break}K+=$[H]??"",H++}if(!O)B.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:Z,end:$.length}});continue}if(_==='"'){Y=!0;let O=H++,M=!1;while(H<J){let L=$[H];if(L==="`"&&$[H+1]){K+=$[H+1],H+=2;continue}if(L==='"'){M=!0,H++;break}if($.startsWith("$(",H)){H=j(H);continue}if(L==="$")W=$[H+1]==="("?"command-substitution":"variable";K+=L??"",H++}if(!M)B.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:O,end:$.length}});continue}if(_==="$")W=$[H+1]==="("?"command-substitution":"variable";if(_==="@"&&H===Z)W="variable";K+=_,H++}return{word:U$($,Z,H,K,W,Y,W==="literal"?void 0:cW($,Z,H)),next:H,issues:B,nested:q,words:U,limited:G}}function pW($,Z,J,Q,X){let K=h8($,Z+2,J),W=K===-1?J:K,Y=K===-1?J:K+1;if(X>=Q.maxDepth)return{program:U1({kind:"program",dialect:"powershell",source:$.slice(Z+2,W),span:{start:Z+2,end:W},status:"limited",issues:[g8(Z,Q.maxDepth)],nodes:[]}),next:Y};let B=D6($,Z+2,W,Q,X+1),q=K===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:Z,end:Y}}]:[];return{program:U1({kind:"program",dialect:"powershell",source:$.slice(Z+2,W),span:{start:Z+2,end:W},status:B.limited?"limited":B.issues.length+q.length>0?"partial":"complete",issues:[...B.issues,...q],nodes:B.nodes}),next:Y}}function h8($,Z,J){let Q=1,X=!1,K=!1;for(let W=Z;W<J;W++){let Y=$[W];if(Y==="`"){W++;continue}if(!K&&Y==="'"){if(X&&$[W+1]==="'"){W++;continue}X=!X;continue}if(!X&&Y==='"'){K=!K;continue}if(X)continue;if($.startsWith("$(",W)){Q++,W++;continue}if(!K&&Y==="(")Q++;if(Y!==")")continue;if(Q--,Q===0)return W}return-1}function V6($){let Z=0;for(let J of $.nodes){if(J.kind==="group")Z+=V6(J.body);if(J.kind==="command"){Z+=J.words.length;for(let Q of J.nested)Z+=V6(Q)}}return Z}function cW($,Z,J){let Q=q4($),X=Z,K=!1,W=Z;while(W<J){let Y=$[W];if(Y==="`"){W+=2;continue}if(Y==="'"){if(K&&$[W+1]==="'"){W+=2;continue}K=!K,W++;continue}if(K){W++;continue}if($.startsWith("$(",W)){let B=h8($,W+2,J),q=B===-1?J:B+1;Q.push(X,W,"literal"),Q.push(W,q,"command-substitution"),W=q,X=q;continue}if(Y==="$"||Y==="@"&&W===Z){let B=W+1;if($[B]==="{"){let q=$.indexOf("}",B+1);B=q===-1||q>=J?J:q+1}else while(B<J&&/[A-Za-z0-9_:?]/.test($[B]??""))B++;Q.push(X,W,"literal"),Q.push(W,B,"variable"),W=B,X=B;continue}W++}return Q.push(X,J,"literal"),Q.parts}function g8($,Z){return{code:"depth-limit",message:`command structure exceeds parser limit ${Z}`,span:{start:$,end:$}}}function dW($){let Z=[],J=[],Q=0,X=0,K=!1,W=()=>{if(J.length>0)Z.push(J);J=[]};while(Q<$.length&&Q<131072&&X<16384){let Y=$[Q];if(Y==="\r"||Y===`
-`){W(),Q+=Y==="\r"&&$[Q+1]===`
-`?2:1;continue}if(/\s/.test(Y??"")){Q++;continue}let B=k8($,Q,Math.min($.length,L4.maxInputLength),L4.maxDepth);if(B){K||=!!B.issue||B.limited,Q=B.next;continue}let q=z6($,Q);if(q){W(),Q+=q.length;continue}if(Y==="{"||Y==="}"){W(),Q++;continue}let U=N6($,Q,Math.min($.length,L4.maxInputLength),L4,0);if(U.word.text)J.push(U.word.text);for(let G of U.nested)Z.push(...R6(G));X++,Q=U.next>Q?U.next:Q+1}return W(),{commands:Z,invalidComment:K}}function R6($){return $.nodes.flatMap((Z)=>{if(Z.kind==="group")return R6(Z.body);if(Z.kind!=="command")return[];return[Z.words.map((J)=>J.text),...Z.nested.flatMap(R6)]})}function z6($,Z){for(let J of["&&","||",";","|"])if($.startsWith(J,Z))return J;return null}function k8($,Z,J,Q){if($[Z]==="#"&&$[Z+1]!==">"){let W=Z+1;while(W<J&&$[W]!=="\r"&&$[W]!==`
-`)W++;return{next:W,limited:!1}}if(!$.startsWith("<#",Z))return null;let X=1,K=Z+2;while(K<J){if($.startsWith("<#",K)){if(X++,X>Q)return{next:J,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${Q}`,span:{start:Z,end:K+2}},limited:!0};K+=2;continue}if($.startsWith("#>",K)){if(X--,K+=2,X===0)return{next:K,limited:!1};continue}K++}return{next:J,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:Z,end:J}},limited:!1}}function iW($,Z){if(Z)return"limited";if($.some((J)=>J.code==="unclosed-block-comment"))return"invalid";return $.length>0?"partial":"complete"}function F6($,Z,J){return Object.freeze({kind:"connector",operator:$.slice(Z,J),span:Object.freeze({start:Z,end:J})})}var u0=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function v1($,Z="auto",J=u0){if(Z==="powershell"||Z==="auto"&&v8($.slice(0,J.maxInputLength)))return u8($,J);return I8($,"posix",J)}function I6($,Z){if($!=="powershell")return Z[0]?.provenance==="command-substitution";let J=Z[0]?.text==="&"||Z[0]?.text==="."?1:0,Q=Z[J]?.provenance;return Q!==void 0&&Q!=="literal"}var sW=/^[A-Za-z_][A-Za-z0-9_]*=/;function M4($,Z){return $?.provenance==="literal"&&!$.quoted&&$.raw===Z&&$.text===Z}function F4($){let Z=M4($.words[0],"time")?1:0,J=Z===1&&M4($.words[Z],"-p")?Z+1:Z,Q=Z===1&&M4($.words[J],"--")?J+1:J,X=M4($.words[Q],"!")?Q+1:Q,K=$.words.slice(X).find((W)=>!sW.test(W.text));return K?.provenance==="literal"?K.text:void 0}function n$($,Z){if(Z.escaped)return Z.escaped=!1,!0;if($==="\\"&&!Z.inSingle)return Z.escaped=!0,!0;if($==="'"&&!Z.inDouble)return Z.inSingle=!Z.inSingle,!0;if($==='"'&&!Z.inSingle)return Z.inDouble=!Z.inDouble,!0;return!1}function H$($){let Z={inSingle:!1,inDouble:!1,escaped:!1};for(let J of rW($))n$(J,Z);return Z.inSingle||Z.inDouble}function rW($){let Z="",J={inSingle:!1,inDouble:!1,escaped:!1},Q=!1,X=!0;for(let K=0;K<$.length;K++){let W=$[K];if(!W)break;if(Q){if(W===`
-`||W==="\r")Z+=W,Q=!1,J.escaped=!1;continue}if(W==="#"&&!J.inSingle&&!J.inDouble&&X){Q=!0;continue}if(Z+=W,!J.inSingle&&!J.inDouble&&!J.escaped)X=/[\s;&|()<>]/.test(W);n$(W,J)}return Z}var nW=new Set(["&&","||","|&","|","&",";"]),aW=new Set(["<<","<<<",">|"]),oW=/[*@#?$!_-]/,b6=Object.freeze([]),tW=Object.freeze([]),eW=256;function c8($,Z){let J=Z.status==="complete"?new Set(P6(Z)):new Set,Q=[...J].reduce((W,Y)=>W.slice(0,Y.start)+" ".repeat(Y.end-Y.start)+W.slice(Y.end),$);if(H$(Q))return N4("unclosed-quote",Q,b6);let X={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},K=a$(Z,{source:Q,suppressed:J,flags:X,depth:0,functions:new Map});if(X.limited)return N4("structural-limit",Q,b6);if(X.invalid)return N4("invalid",Q,b6);return N4("complete",Q,K,X.assignmentFallbacks)}function N4($,Z,J,Q=tW){return Object.freeze({status:$,source:Z,entries:Object.freeze(J),assignmentFallbacks:Object.freeze(Q)})}function a$($,Z){return $.nodes.flatMap((J,Q)=>$Y(J,$,Q,Z)).sort((J,Q)=>J.start-Q.start).flatMap((J)=>[...J.entries])}function $Y($,Z,J,Q){if($.kind==="connector")return[{start:$.span.start,entries:[u1(KY($.operator))]}];if($.kind==="unknown")return[{start:$.span.start,entries:[u1($.source)]}];if($.kind==="function")return Q.functions.set($.name,$.body),[];if($.kind==="group"){let K=$.style!=="subshell",W=Q.source[$.span.end-1]===(K?"}":")"),Y=K?Q:{...Q,functions:new Map(Q.functions)};return[{start:$.span.start,entries:[K?V4("{"):u1("("),...a$($.body,Y),...W?[K?V4("}"):u1(")")]:[]]}]}let X=YY($,Q.functions);if(X){if(Q.depth>=u0.maxDepth||++Q.flags.expansions>eW)return Q.flags.limited=!0,[];return[{start:$.span.start,entries:[...x8($,Q),V4(";"),...a$(X,{...Q,depth:Q.depth+1}),V4(";")]},...l8($,Z,J,Q)]}return[{start:$.span.start,entries:x8($,Q)},...l8($,Z,J,Q)]}function x8($,Z){return[...$.words.map((J)=>({start:J.span.start,entries:i8(J,$,Z,!1)})),...$.redirections.map((J)=>({start:J.span.start,entries:ZY(J,$,Z)}))].sort((J,Q)=>J.start-Q.start).flatMap((J)=>J.entries)}function ZY($,Z,J){let Q=$.operator==="<<-"?"<<":$.operator,X=$.target?i8($.target,Z,J,!0):[],K=X[0],W=K?.kind==="word"?K.text:void 0;return[...$.fd===void 0?[]:[C6(String($.fd))],Object.freeze({kind:"redirection",operator:Q,role:WY(Q),targetOrder:aW.has(Q)?"legacy-segment":"immediate",...W===void 0?{}:{target:W}}),...W===void 0?X:X.slice(1)]}function l8($,Z,J,Q){let X=$.redirections.filter((K)=>K.operator==="<<"||K.operator==="<<-");return[...X.flatMap((K)=>{let W=K.heredoc;if(!W)return[];let Y=[C6(W.delimiter),.../[\r\n]/.test(Q.source[W.terminatorSpan.end]??"")?[u1(";")]:[]];if(Q.suppressed.has(W.bodySpan))return[{start:W.bodySpan.start,entries:Y}];return[{start:W.bodySpan.start,entries:[...d8(Q.source.slice(W.bodySpan.start,W.bodySpan.end),Q),...Y]}]}),...X.some((K)=>!K.heredoc&&K.target)?JY(Z,J,Q):[]]}function JY($,Z,J){let Q=$.nodes.slice(Z+1).find((X)=>X.kind==="connector");if(!Q||Q.span.end>=$.span.end)return[];return[{start:Q.span.end,entries:d8(J.source.slice(Q.span.end,$.span.end),J)}]}function d8($,Z){if(Z.depth>=u0.maxDepth)return Z.flags.limited=!0,[];let J=v1($,"posix");if(J.status==="limited")return Z.flags.limited=!0,[];let Q={invalid:!1,limited:!1,expansions:Z.flags.expansions,assignmentFallbacks:Z.flags.assignmentFallbacks},X=a$(J,{source:$,suppressed:new Set,flags:Q,depth:Z.depth+1,functions:new Map});return Z.flags.limited||=Q.limited,Z.flags.expansions=Q.expansions,X}function i8($,Z,J,Q){let X=[],K={single:!1,double:!1},W="",Y=!1,B=()=>{if(Y&&!Q)X.push(u1("glob"));else if(W!==""||$.quoted&&X.length===0)X.push(C6(W));W="",Y=!1};for(let q of $.parts){if(q.provenance!=="command-substitution"&&q.provenance!=="arithmetic"){for(let H of f6(q.raw,K,J.flags)){if(typeof H==="string"){B(),X.push(u1(H));continue}W+=H.text,Y||=H.glob}continue}if(K.double){let H=J.source.slice(q.span.start,q.span.end);W+=f6(H,{single:!1,double:!0},J.flags).map((_)=>typeof _==="string"?_:_.text).join("");continue}let U=Z.nested.find((H)=>H.span.start>=q.span.start&&H.span.end<=q.span.end),G=U?a$(U,J):[];if(q.raw.startsWith("`")){W+="${}",B(),X.push(...G);continue}if(q.raw.startsWith("<(")||q.raw.startsWith(">(")){B(),X.push(q.raw.startsWith("<(")?u1("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),...G,...q.raw.endsWith(")")?[u1(")")]:[]);continue}let j=q.raw.startsWith("$((")?2:1;W+="${}",B(),X.push(...Array.from({length:j},()=>u1("(")),...G,...q.raw.endsWith(")".repeat(j))?Array.from({length:j},()=>u1(")")):[])}return B(),X}function f6($,Z,J){let Q=[],X="",K=!1,W=0;while(W<$.length){let Y=$[W]??"";if(!Z.single&&!Z.double&&(Y==="("||Y===")")){Q.push({text:X,glob:K},Y),X="",K=!1,W++;continue}if(Z.single){if(Y==="'")Z.single=!1;else X+=Y;W++;continue}if(Z.double){if(Y==='"'){Z.double=!1,W++;continue}if(Y==="\\"){let B=$[W+1]??"";X+=['"',"\\","$"].includes(B)?B:`\\${B}`,W+=2;continue}if(Y==="$"){let B=m8($,W,Z,J);X+=B.text,W=B.next;continue}X+=Y,W++;continue}if(Y==="'"||Y==='"'){Z.single=Y==="'",Z.double=Y==='"',W++;continue}if(Y==="\\"){let B=$[W+1]??"";K||=B==="*"||B==="?",X+=B,W+=2;continue}if(Y==="$"){let B=m8($,W,Z,J);X+=B.text,W=B.next;continue}K||=Y==="*"||Y==="?",X+=Y,W++}return[...Q,{text:X,glob:K}]}function m8($,Z,J,Q){let X=$[Z+1];if(X==="{"){let W=XY($,Z+2);if(W===-1)return Q.invalid=!0,{text:"",next:$.length};let Y=$.slice(Z,W+1);return QY(Y,J,Q),{text:Y,next:W+1}}if(X!==void 0&&oW.test(X))return{text:`\${${X}}`,next:Z+2};let K=/^\w*/.exec($.slice(Z+1))?.[0]??"";return{text:`\${${K}}`,next:Z+1+K.length}}function QY($,Z,J){let Q=$.slice(2,-1),X=/^[A-Za-z_][A-Za-z0-9_]*/.exec(Q)?.[0];if(!X)return;let K=Q.slice(X.length),W=[":=","="].find((B)=>K.startsWith(B));if(!W)return;let Y=f6(K.slice(W.length),{...Z},J);J.assignmentFallbacks.push(...Y.flatMap((B)=>typeof B==="string"||!B.text?[]:[B.text]))}function XY($,Z){let J=1,Q=Z;while(J>0&&Q<$.length){if($[Q]==="{"&&$[Q-1]==="$")J++;else if($[Q]==="}")J--;Q++}return J===0?Q-1:-1}function KY($){return/^[\r\n]+$/.test($)?";":$}function u1($){return Object.freeze({kind:"operator",operator:$,boundary:nW.has($)})}function V4($){return Object.freeze({kind:"operator",operator:$,boundary:!0})}function C6($){return Object.freeze({kind:"word",text:$})}function WY($){if($==="<<"||$==="<<<")return"here-data";if($==="<"||$==="<&")return"file-read";return"file-write"}function P6($){return $.nodes.flatMap((Z,J)=>{if(Z.kind==="group"||Z.kind==="function")return P6(Z.body);if(Z.kind!=="command")return[];let Q=Z.nested.flatMap((W)=>P6(W)),X=$.nodes[J+1];if(X?.kind==="connector"&&(X.operator==="|"||X.operator==="|&")||!qY(Z))return Q;return[...Q,...Z.redirections.flatMap((W)=>W.heredoc?.quotedDelimiter?[W.heredoc.bodySpan]:[])]})}function YY($,Z){let J=F4($);return J===void 0?void 0:Z.get(J)}function z0($,Z){return $!==void 0&&$.provenance==="literal"&&!$.quoted&&$.raw===$.text&&$.text===Z}function BY($){if(z0($.words[0],"git"))return z0($.words[1],"commit");if(!z0($.words[0],"gh")||!z0($.words[2],"create"))return!1;return z0($.words[1],"pr")||z0($.words[1],"issue")}function qY($){return(z0($.words[0],"cat")||z0($.words[0],"tee")||BY($))&&!$.words.some(p8)&&!$.redirections.some((J)=>p8(J.target))}function p8($){return $?.parts.some((Z)=>Z.provenance==="command-substitution"&&Z.raw.startsWith(">("))??!1}var r8=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),n8=new Set([...r8,"glob"]),UY=new Set([...n8,"pattern"]),GY=Object.freeze([]),a8={parseCommand:v1,projectShellSyntax:c8};class I0 extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function R4($,Z={}){let J=HY({...a8,...Z}),Q=q$($.input),X=[];if(($.route.kind==="command"||$.route.kind==="unknown")&&Q)X.push({usage:"input-candidate",source:Q});if($.route.kind==="command"&&"command"in $&&$.command)X.push({usage:"declared-command",source:$.command});let K=X.reduce((W,Y)=>{let B=W.findIndex((G)=>G.source===Y.source);if(B!==-1){let G=W[B];if(!G)return W;return W[B]=s8({...G,usages:[...G.usages,Y.usage]}),W}let q=$.route.kind==="command"?$.route.shell:"posix",U=J.getCommandProgram(Y.source,q);return W.push(s8({usages:[Y.usage],source:Y.source,program:U,views:A6(U),uncertainties:U.issues,shell:J.getShellSyntax(Y.source,U)})),W},[]);return Object.freeze({invocation:Object.freeze({toolName:$.toolName,route:Object.freeze({...$.route}),context:Object.freeze({...$.context,...$.context.policyConfigCwds?{policyConfigCwds:Object.freeze([...$.context.policyConfigCwds])}:{}})}),commands:Object.freeze(K),paths:Object.freeze(jY($)),store:J})}function O1($,Z){return $.commands.find((J)=>J.usages.includes(Z))}function s1($){if(!$.includes("$"))return $;return X4($,q0())}function HY($={}){let Z={...a8,...$},J=new Map,Q=new Map,X=new WeakMap,K=(Y,B)=>{let q=`${B}\x00${Y}`,U=Q.get(q);if(U)return U;let G=Z.parseCommand(Y,B);return Q.set(q,G),G};return Object.freeze({getShellSyntax:(Y,B)=>{if(B&&B.source!==Y)throw TypeError("Shell syntax source does not match command program source.");let q=B??K(Y,"posix");if(q.status==="limited"){let j=X.get(q);if(j)return j;let H=Object.freeze({status:"structural-limit",source:Y,entries:GY,assignmentFallbacks:Object.freeze([])});return X.set(q,H),H}let U=J.get(Y);if(U)return U;let G=Z.projectShellSyntax(Y,q);return J.set(Y,G),G},getCommandProgram:K})}function s8($){return Object.freeze({...$,usages:Object.freeze([...$.usages]),views:Object.freeze([...$.views]),uncertainties:Object.freeze([...$.uncertainties])})}function A6($){return Object.freeze($.nodes.flatMap((Z)=>{if(Z.kind==="group")return[...A6(Z.body)];if(Z.kind!=="command")return[];return[...Z.nested.flatMap((J)=>[...A6(J)]),Z]}))}function jY($){let Z=$.route.kind==="grep"?n8:$.route.kind==="glob"?UY:r8,J=$.route.kind==="grep"||$.route.kind==="glob"?"read":$.route.kind==="patch"?"write":"unknown";return[...K6($.input,Z).map((Q)=>Object.freeze({raw:Q,role:"tool-path",access:J})),...$.route.kind==="patch"?W6($.input).map((Q)=>Object.freeze({raw:Q,role:"patch-target",access:"write"})):[]]}import{statSync as GB}from"node:fs";import{isAbsolute as M7,join as HB,relative as F7}from"node:path";import{existsSync as S6,lstatSync as IY,readFileSync as b4,realpathSync as e$,statSync as t$}from"node:fs";import{dirname as y6,isAbsolute as w6,join as f4,resolve as P4}from"node:path";import{dirname as _Y,isAbsolute as OY,parse as LY,sep as MY}from"node:path";function h0($,Z=process.platform){if(Z!=="win32")return!1;return($[0]==="/"||$[0]==="\\")&&($[1]==="/"||$[1]==="\\")}function b0($,Z,J){if(h0(Z))throw Error("Unsupported Windows namespace path");let Q=OY(Z)?NY(Z):"",X=Q||$;for(let K of VY(Q?Z.slice(Q.length):Z)){if(K===""||K===".")continue;if(K===".."){X=_Y(X);continue}let W=FY(X,K),Y=J.entryKind(W),B=Y==="symlink"?J.realpath(W):W;if(Y==="missing"||B===null)throw Error(`Cannot resolve path component: ${W}`);X=B}return X}function FY($,Z){return $.endsWith("/")||$.endsWith("\\")?`${$}${Z}`:`${$}${MY}${Z}`}function NY($){return LY($).root}function VY($){let Z=process.platform==="win32"?/[\\/]+/:/\/+/;return $.split(Z)}var E6=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],RY=new Set(E6);var o8=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),D4=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),DY=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function zY($){return RY.has($)}function o$($){return $==="GIT_CONFIG_COUNT"||$==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test($)}function T6($){return zY($)||o8.has($)||D4.has($)||o$($)}function f1($,Z,J){return J?.has($)?J.get($):Z.get($)}function z4($,Z){let J=f1("GIT_CONFIG_COUNT",$,Z);if(J===void 0)return{state:"absent"};if(J==="")return{state:"valid",count:0};if(!/^\d+$/.test(J))return{state:"invalid"};let Q=Number(J);return Number.isSafeInteger(Q)&&Q<=1024?{state:"valid",count:Q}:{state:"invalid"}}function I4($,Z,J){let X=$.match(DY)?.[1];if(!X||!T6(X))return null;let K=$.indexOf("=");return{name:X,value:`${f1(X,Z,J)??""}${$.slice(K+1)}`}}function t8($){return $7($,D4)}function e8($){return $7($,o8)}function $7($,Z){if(!$)return!1;for(let J of $.keys())if(Z.has(J))return!0;return!1}var r1=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]);function Q7($,Z){return E6.some((J)=>Z?.has(J)||$.has(J))}function X7($,Z){if(!Z)return{gitCwd:null,hasExplicitGitContext:!1};let J;try{J=e$(P4(Z))}catch{return{gitCwd:null,hasExplicitGitContext:!1}}if(!Y7(J))return{gitCwd:null,hasExplicitGitContext:!1};let Q=!1,X=1;while(X<$.length){let K=$[X];if(!K)break;if(K==="--")break;if(!K.startsWith("-"))break;if(K==="-C"){let W=$[X+1];if(!W)return{gitCwd:null,hasExplicitGitContext:Q};let Y=J7(J,W);if(!Y)return{gitCwd:null,hasExplicitGitContext:Q};J=Y,X+=2;continue}if(K.startsWith("-C")&&K.length>2){let W=J7(J,K.slice(2));if(!W)return{gitCwd:null,hasExplicitGitContext:Q};J=W,X++;continue}if(K==="--git-dir"||K==="--work-tree"){Q=!0,X+=2;continue}if(K.startsWith("--git-dir=")||K.startsWith("--work-tree=")){Q=!0,X++;continue}if(r1.has(K))X+=2;else if(K.startsWith("-c")&&K.length>2)X++;else X++}return{gitCwd:J,hasExplicitGitContext:Q}}function K7($){let Z=gY($);if(!Z)return!1;try{let J=IY(Z);if(J.isSymbolicLink()||!J.isFile())return!1;let Q=v6(Z);if(!Q?.commonDir)return!1;if(!PY(Q.gitDir,Z))return!1;return CY(Q.gitDir,y6(Z))}catch{return!1}}function v6($){try{let Z=bY($);if(!Z)return null;let J=e$(w6(Z)?Z:P4(y6($),Z));if(!t$(J).isDirectory())return null;return{gitDir:J,commonDir:fY(J)}}catch{return null}}function bY($){let Z=b4($,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!Z.startsWith("gitdir:"))return null;return Z.slice(7).trim()||null}function fY($){try{let Z=b4(f4($,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!Z)return null;let J=e$(w6(Z)?Z:P4($,Z));return t$(J).isDirectory()?J:null}catch{return null}}function PY($,Z){let J=AY($);return J===null?!1:W7($,J,Z)}function CY($,Z){let J=EY($);return J===null?!0:W7($,J,Z)}function AY($){let Z=f4($,"gitdir");if(!S6(Z))return null;let J=b4(Z,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return J===""?null:J}function EY($){let Z=f4($,"config.worktree");return S6(Z)?vY(Z):null}function W7($,Z,J){return SY(TY($,Z),J)}function TY($,Z){return w6(Z)?Z:P4($,Z)}function SY($,Z){try{return yY($,Z)}catch{return!1}}function yY($,Z){try{let J=t$($),Q=t$(Z);if(J.ino!==0&&Q.ino!==0&&J.dev===Q.dev&&J.ino===Q.ino)return!0}catch{}return Z7($)===Z7(Z)}function Z7($){return wY(e$.native($))}function wY($){let Z=$.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"");if(Z=Z.replace(/\\/g,"/"),Z.length>1&&Z.endsWith("/"))Z=Z.slice(0,-1);return process.platform==="win32"?Z.toLowerCase():Z}function vY($){let Z=b4($,"utf-8"),J=!1,Q=null;for(let X of Z.split(/\r?\n/)){let K=X.trim();if(K===""||K.startsWith("#")||K.startsWith(";"))continue;if(K.startsWith("[")){J=/^\[core\]$/i.test(K);continue}if(!J)continue;let W=K.match(/^worktree\s*=\s*(.*)$/i);if(W)Q=uY(W[1]??"")}return Q}function uY($){let Z=$.trim();if(!Z.startsWith('"')||!Z.endsWith('"'))return Z;return hY(Z.slice(1,-1))}function hY($){let Z="";for(let J=0;J<$.length;J++){let Q=$[J];if(Q!=="\\"){Z+=Q;continue}let X=$[J+1];if(X===void 0){Z+=Q;continue}switch(X){case"\\":case'"':Z+=X;break;case"n":Z+=`
-`;break;case"t":Z+="\t";break;case"b":Z+="\b";break;default:Z+=`\\${X}`;break}J++}return Z}function J7($,Z){try{let J=b0($,Z,b1);return Y7(J)?J:null}catch{return null}}function Y7($){try{return t$($).isDirectory()}catch{return!1}}function gY($){try{return $2(e$($))}catch{return null}}function $2($){let Z=$;while(!0){let J=f4(Z,".git");if(S6(J))return J;let Q=y6(Z);if(Q===Z)return null;Z=Q}}import{isAbsolute as B7,parse as kY}from"node:path";function S($){return $.provenance==="command-substitution"?$.raw:$.text}function j$($,Z){return $==="posix"?Z:g(Z.map((J)=>J.text))}function C4($,Z){return $&&$.provenance!=="unknown"?$.provenance==="literal":!/[$`*?[\]]/.test(Z)}function g($){return $.map((Z)=>({kind:"word",text:Z,raw:Z,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}var G7=/^[A-Za-z_][A-Za-z0-9_]*=/,xY=/^\$\{([A-Za-z_][A-Za-z0-9_]*)\}/,H7=131072,lY=16384;function n1($){if(!G7.test($))return null;let Z=$.indexOf("=");return{name:$.slice(0,Z),value:$.slice(Z+1)}}function A4($){let Z=new Map,J=0;while(J<$.length){let Q=$[J];if(!Q)break;let X=n1(S(Q));if(!X)break;Z.set(X.name,X.value),J++}return{words:$.slice(J),envAssignments:Z}}function j7($){let Z=$.toLowerCase();return $.includes("=")||Z==="sudo"||Z==="env"||Z==="command"||Z==="builtin"}function g0($,Z,J,Q){if(!j7(_$($)))return{words:$,envAssignments:new Map,cwd:J,rewritten:!1};let X=new Set($),K=$,W=new Map,Y=new Map(Q??[]),B=J;for(let U=0;U<Y$;U++){let G=U7(K),j=A4(K);for(let[_,O]of j.envAssignments)W.set(_,O),Y.set(_,O);if(K=j.words,K.length===0)break;while(K.length>0&&_$(K).includes("=")&&!mY(K)){let _=pY(_$(K),Y,Z.env)??I4(_$(K),Z.env,Y);if(_)W.set(_.name,_.value),Y.set(_.name,_.value);K=K.slice(1)}if(K.length===0)break;let H=_$(K).toLowerCase();if(H!=="sudo"&&H!=="env"&&H!=="command"&&H!=="builtin")break;if(H==="sudo"){let _=dY(K,Z.paths,B);if(K=_.words,_.cwd!==void 0)B=_.cwd}if(H==="env"){let _=rY(K,B,Y,Z);if(_.unverifiableEnvSplit)return{words:K,envAssignments:W,cwd:B,unverifiableEnvSplit:!0,rewritten:q7(K,X)};if(K=_.words,_.cwd!==void 0)B=_.cwd;for(let[O,M]of _.envAssignments)W.set(O,M),Y.set(O,M)}if(H==="command")K=$B(K);if(H==="builtin")K=K.slice(h1(K,1)==="--"?2:1);if(U7(K)===G)break}let q=A4(K);for(let[U,G]of q.envAssignments)W.set(U,G),Y.set(U,G);return{words:q.words,envAssignments:W,cwd:B,rewritten:q7(q.words,X)}}function q7($,Z){return $.some((J)=>!Z.has(J))}function U7($){return $.map(S).join(" ")}function _$($){let Z=$[0];return Z?S(Z):""}function h1($,Z){let J=$[Z];return J?S(J):void 0}function mY($){return G7.test(_$($))}function pY($,Z,J){if(!$.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${Z.get("TMPDIR")??J.get("TMPDIR")??""}${$.slice(8)}`}}var cY=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function dY($,Z,J){let Q=1,X=J;while(Q<$.length){let K=h1($,Q);if(!K)break;if(K==="--")return{words:$.slice(Q+1),cwd:X};if(!K.startsWith("-"))break;if(K==="-D"||K==="--chdir"){let W=h1($,Q+1);X=W?Z2(X,W,Z):null,Q+=2;continue}if(K.startsWith("--chdir=")){X=Z2(X,K.slice(8),Z),Q++;continue}if(K.startsWith("-D")&&K.length>2){X=Z2(X,K.slice(2),Z),Q++;continue}if(K==="-i"||K==="--login"){X=null,Q++;continue}if(cY.has(K)){Q+=2;continue}Q++}return{words:$.slice(Q),cwd:X}}var iY=new Set(["-i","-0","--null"]),sY=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]);function rY($,Z,J,Q){let X=new Map,K=Z,W=$,Y=new Set,B=1;while(B<W.length){let q=h1(W,B);if(!q)break;if(q==="--")return{words:W.slice(B+1),envAssignments:X,cwd:K};if(q==="-i"||q==="--ignore-environment"||q==="-"){X.clear();for(let G of J.keys())X.set(G,"");X.set("TMPDIR",""),B++;continue}if(iY.has(q)){B++;continue}if(q==="-u"||q==="--unset"){let G=h1(W,B+1);if(G!==void 0)Y.add(G),X.set(G,"");B+=2;continue}if(q.startsWith("-u")&&q.length>2&&!q.startsWith("-u=")){let G=q.slice(2);Y.add(G),X.set(G,""),B++;continue}if(q.startsWith("--unset=")){let G=q.slice(8);Y.add(G),X.set(G,""),B++;continue}let U=q==="-S"||q==="--split-string"?{value:h1(W,B+1),consumed:2}:q.startsWith("-S")&&q.length>2?{value:q.slice(2),consumed:1}:q.startsWith("--split-string=")?{value:q.slice(15),consumed:1}:null;if(U){let G=nY(W,B,U.value,U.consumed,J,Y,K,Q.env);if(G.done)return G.result;W=G.expanded,K=G.currentCwd,B=G.nextIndex;continue}if(sY.has(q)){if(q==="-C"||q==="--chdir"){let G=h1(W,B+1);K=G?Z2(K,G,Q.paths):null}B+=2;continue}if(q.startsWith("-u=")){B++;continue}if(q.startsWith("-C")&&q.length>2||q.startsWith("--chdir=")){let G=q.startsWith("--chdir=")?q.slice(8):q.startsWith("-C=")?q.slice(3):q.slice(2);K=Z2(K,G,Q.paths),B++;continue}if(q.startsWith("-P")){B++;continue}if(q.startsWith("-")){B++;continue}if(!n1(q))break;while(B<W.length){let G=n1(h1(W,B)??"");if(!G)break;X.set(G.name,G.value),B++}if(h1(W,B)==="--")B++;return{words:W.slice(B),envAssignments:X,cwd:K}}return{words:W.slice(B),envAssignments:X,cwd:K}}function nY($,Z,J,Q,X,K,W,Y){let B=J!==void 0?aY(J,X,K,Y):{tokens:null,unverifiableEnvSplit:!1};if(B.unverifiableEnvSplit)return{done:!0,result:{words:$,envAssignments:new Map,cwd:W,unverifiableEnvSplit:!0}};if(!B.tokens)return{done:!1,expanded:$,currentCwd:null,nextIndex:Z+Q};return{done:!1,expanded:[...$.slice(0,Z),...g(B.tokens),...$.slice(Z+Q)],currentCwd:W,nextIndex:Z}}function aY($,Z,J,Q){if($.length>H7)return{tokens:null,unverifiableEnvSplit:!0};let X=oY($,(K)=>{if(J.has(K))return"";if(Z.has(K))return Z.get(K)??"";return Q.get(K)??""});return{tokens:X.tokens,unverifiableEnvSplit:X.limited}}function oY($,Z){let J=[],Q=[],X=0,K=!1,W=!1,Y=!1,B=!1,q=(G)=>{if(X+G.length>H7)return B=!0,!1;return Q.push(G),X+=G.length,K=!0,!0},U=()=>{if(!K)return!0;if(J.length>=lY)return B=!0,!1;return J.push(Q.join("")),Q=[],K=!1,!0};for(let G=0;G<$.length;G++){let j=$[G]??"";if(j==="'"&&!Y){W=!W,K=!0;continue}if(j==='"'&&!W){Y=!Y,K=!0;continue}if(!W&&!Y&&eY(j)){if(!U())return{tokens:null,limited:B};continue}if(!W&&!Y&&j==="#"&&!K)break;if(j==="$"&&!W){let O=$.slice(G).match(xY);if(!O?.[1]||!q(Z(O[1])))return{tokens:null,limited:B};G+=O[0].length-1;continue}if(j!=="\\"){if(!q(j))return{tokens:null,limited:B};continue}let H=$[G+1];if(H===void 0)return{tokens:null,limited:B};if(W&&H!=="'"&&H!=="\\"){if(!q("\\"))return{tokens:null,limited:B};continue}if(H==="c"){if(Y)return{tokens:null,limited:B};break}if(H==="_"&&!W&&!Y){if(!U())return{tokens:null,limited:B};G++;continue}let _=tY(H);if(_===void 0||!q(_))return{tokens:null,limited:B};G++}if(W||Y||!U())return{tokens:null,limited:B};return{tokens:J,limited:!1}}function tY($){if($==="f")return"\f";if($==="n")return`
-`;if($==="r")return"\r";if($==="t")return"\t";if($==="v")return"\v";if($==="_")return" ";if($==="#"||$==="$"||$==='"'||$==="'")return $;if($==="\\")return"\\";return}function eY($){return $===" "||$==="\t"||$===`
-`||$==="\r"||$==="\f"||$==="\v"}function Z2($,Z,J){if(Z==="")return null;if(!$&&!B7(Z))return null;let Q=B7(Z)?kY(Z).root:J.realpath($??"/");if(Q===null)return null;try{return b0(Q,Z,J)}catch{return null}}function $B($){if(h1($,1)==="-v")return[...g(["type"]),...$.slice(2)];let Z=1;while(Z<$.length){let J=h1($,Z);if(!J)break;if(J==="-p"||J==="-v"||J==="-V"){Z++;continue}if(J==="--")return $.slice(Z+1);if(J.startsWith("-")&&!J.startsWith("--")&&J.length>1){if(!/^[pvV]+$/.test(J.slice(1)))break;Z++;continue}break}return $.slice(Z)}function P1($,Z,J){return u6($,Z,J).tokens}function u6($,Z,J,Q){if(!j7($[0]??""))return{tokens:[...$],envAssignments:new Map,cwd:J};let X=g0(g($),Z,J,Q);return{tokens:X.words.map(S),envAssignments:X.envAssignments,cwd:X.cwd,unverifiableEnvSplit:X.unverifiableEnvSplit}}import{isAbsolute as WB,normalize as YB,resolve as O7}from"node:path";function x($){return h($).toLowerCase()}function h($){return $.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??$}function L1($,Z){let J=new Set,Q=!1;for(let X of $){if(X==="--"){Q=!0;continue}if(Q)continue;if(X.startsWith("-")&&!X.startsWith("--")&&X.length>1)for(let K=1;K<X.length;K++){let W=X[K];if(!W||!/[a-zA-Z]/.test(W))break;let Y=`-${W}`;if(J.add(Y),Z?.shortOptsWithValue?.has(Y))break}}return J}var ZB=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),JB=new Map([["zsh",new Set(["o"])]]),QB=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function _7($,Z){for(let J=0;J<Z.length;J++){let Q=Z[J];if(Q===void 0||Q==="--"||Q==="-"||Q[0]!=="-"&&Q[0]!=="+")return null;if(Q.startsWith("--")){let W=QB.get($);if(KB(Q,W))continue;if(!W?.has(Q))continue;if(Z[J+1]===void 0)return null;J++;continue}let X=XB($,Q);if(X.commandSelected)return Z[J+X.followingValues+1]??null;let K=Z[J+1];if($==="ksh"&&(Q==="-o"||Q==="+o")&&K!==void 0&&K[0]!=="-"&&K[0]!=="+")J++;J+=X.followingValues}return null}function XB($,Z){let J=ZB.get($),Q=JB.get($),X=!1,K=0;for(let W=1;W<Z.length;W++){let Y=Z[W];if(Y===void 0)break;if(Z[0]==="-"&&Y==="c")X=!0;if($==="ksh"&&Y==="o"){if(W+1<Z.length){let B=Z.slice(W+1);if(!X&&Z[0]==="-"&&B==="c")continue;if(!X&&Z[0]==="-"&&B[0]==="-"&&B.endsWith("c"))X=!0;break}if(X)K++;continue}if(!J?.has(Y))continue;if(Q?.has(Y)&&W+1<Z.length)break;K++}return{commandSelected:X,followingValues:K}}function KB($,Z){return Z!==void 0&&[...Z].some((J)=>$.startsWith(`${J}=`))}var BB=new Set(["-S","--suffix"]);function E4($,Z,J,Q){if($.status==="structural-limit")throw new I0;if($.status!=="complete")return Q.findMalformedTarget($.source);let X={cwd:Z,variables:new Map},K=[];for(let W of $.entries){if(W.kind==="operator"){if(!W.boundary)continue;let Y=Q.findSegmentTarget(K,X);if(Y)return Y;X=qB(K,X,J,Q.normalizeCwd),K=[];continue}if(W.kind==="redirection"){if(W.role==="file-write"&&W.target&&Q.isRedirectionTarget(M1(W.target,X.variables),X))return W.target;continue}K.push(W.text)}return Q.findSegmentTarget(K,X)}function M1($,Z){return $.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(J,Q,X,K)=>{let W=Z.get(Q);if(W===void 0)return J;let Y=X.startsWith(":")?W!=="":!0;if(X.endsWith("-"))return Y?W:M1(K,Z);return Y?M1(K,Z):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(J,Q)=>Z.get(Q)??J).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(J,Q)=>Z.get(Q)??J)}function J2($){return $.length>0&&$.every((Z)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(Z))}function K1($,Z,J){let Q=J.environment.home,X=X4($.trim(),J.environment).replace(/\\/g,"/");if(!X)return"";let K=X==="~"?Q:X.startsWith("~/")?O7(Q,X.slice(2)):X;return l(YB(WB(K)?K:O7(Z,K)),J.environment.paths,J).replace(/\\/g,"/")}function T4($){let Z=[],J=null,Q=!1;for(let X=0;X<$.length;X++){let K=$[X];if(K===void 0)break;if(!Q&&K==="--"){Q=!0;continue}if(!Q&&(K==="-t"||K==="--target-directory")){J=$[++X]??null;continue}if(!Q&&K.startsWith("--target-directory=")){J=K.slice(19);continue}if(!Q&&K.startsWith("-t")&&K.length>2){J=K.slice(2);continue}if(!Q&&BB.has(K)){X++;continue}if(!Q&&(K.startsWith("--suffix=")||K.startsWith("--backup=")))continue;if(!Q&&K.startsWith("-"))continue;Z.push(K)}return J?{sources:Z,destination:J}:{sources:Z.slice(0,-1),destination:Z.at(-1)??null}}function qB($,Z,J,Q){let X=J2($)?new Map([...Z.variables,...UB($,Z.variables)]):Z.variables,K=P1([...$],J.environment),W=h(K[0]??"").toLowerCase()==="cd"?K[1]:void 0;return{cwd:!W||W==="-"?Z.cwd:Q(M1(W,X),Z.cwd,J),variables:X}}function UB($,Z){return $.flatMap((J)=>{let Q=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(J),X=Q?.[2]?.startsWith("=")?Q[2].slice(1):void 0;return Q?.[1]!==void 0&&X!==void 0?[[Q[1],M1(X,Z)]]:[]})}var C1="Git metadata and hooks are protected. Ask the user before modifying them.";function N7($,Z=g6($.invocation.context.executionCwd)){let J=v0(q0()),Q=$.invocation.context.executionCwd;if(!Z)return null;if($.invocation.route.kind==="patch"||$.invocation.route.kind==="path"||$.invocation.route.kind==="unknown"){if(Z4($.invocation.toolName))return null;let W=$.paths.find((Y)=>LB(Y.raw,Q,Z,J))?.raw;return W?{target:W}:null}if($.invocation.route.kind!=="command")return null;let X=O1($,"input-candidate");if(!X)return null;let K=E4(X.shell,Q,J,{findSegmentTarget:(W,Y)=>FB(W,Y,Z,J),isRedirectionTarget:(W,Y)=>MB(W,Y.cwd,Z,J),findMalformedTarget:()=>null,normalizeCwd:K1});return K?{target:K}:null}function g6($,Z=v0(q0())){if(typeof $!=="string"||!$)return null;let J=$2(K1($,$,Z));if(!J)return null;try{let Q=K1(J,$,Z),X=GB(J),K=X.isFile()?Q:null,W=X.isFile()?v6(J):null,Y=(X.isDirectory()?[Q]:[W?.gitDir,W?.commonDir]).flatMap((q)=>q?[a1(K1(q,$,Z))]:[]),B=[...new Set(X.isDirectory()?[a1(J.replace(/\\/g,"/")),...Y]:Y)];return Object.freeze({entry:a1(Q),markerFile:K?a1(K):null,directories:Object.freeze(B),hooksDirectories:Object.freeze([...new Set(B.flatMap((q)=>{let U=a1(HB(q,"hooks"));return[U,a1(K1(U,$,Z))]}))])})}catch{return null}}function k0($,Z,J,Q,X,K=!1){if(!J)return!1;let W=a1(K1($,Z,X)),Y=W.replace(/(\/\.?\*+)+$/,"");if(Y!==W&&Y!==""){if(h6(Y,J))return!0;let B=K||W.slice(Y.length).includes("/."),q=(U)=>B?S4(U,Y):jB(U,Y);if(J.markerFile&&q(J.markerFile))return!0;return Q&&L7(J).some(q)}if(h6(W,J))return!0;return Q&&L7(J).some((B)=>S4(B,W))}function jB($,Z){let J=F7(Z,$);if(J===""||J.startsWith("..")||M7(J))return!1;return!J.split(/[\\/]/)[0]?.startsWith(".")}function _B($,Z,J,Q){return k0($,Z,J,!0,Q)}function OB($,Z,J,Q){if(!J)return!1;return h6(a1(K1($,Z,Q)),J)}function LB($,Z,J,Q){if(!J)return!1;return V7($,Z,J,Q,J.entry)}function MB($,Z,J,Q){if(!J)return!1;return V7($,Z,J,Q,J.markerFile)}function V7($,Z,J,Q,X){let K=a1(K1($,Z,Q));return K===X||D7(K,J)}function R7($,Z,J,Q){if(!J)return!1;return J.hooksDirectories.some((X)=>$.some((K)=>S4(X,a1(K1(K,Z,Q)))))}function h6($,Z){return $===Z.entry||Z.directories.includes($)||D7($,Z)}function D7($,Z){return Z.hooksDirectories.some((J)=>S4($,J))}function L7($){return[$.entry,...$.directories,...$.hooksDirectories]}function S4($,Z){let J=F7(Z,$);return J===""||!/^\.\.(?:[\\/]|$)/.test(J)&&!M7(J)}function a1($){return process.platform==="win32"?$.toLowerCase():$}function FB($,Z,J,Q){if(J2($))return null;let X=P1([...$],Q.environment);if(h(X[0]??"").toLowerCase()!=="mv")return null;let K=T4(X.slice(1)),W=K.sources.find((Y)=>_B(M1(Y,Z.variables),Z.cwd,J,Q));if(W)return W;return K.destination&&OB(M1(K.destination,Z.variables),Z.cwd,J,Q)?K.destination:null}function k6($,Z){return{value:$,work:Z}}function V($,Z){if($.work)$.work.units=Math.min(Number.MAX_SAFE_INTEGER,$.work.units+1);return $.value[Z]}function a($){return $.value.length}function Q2($,Z,J=1){if($)$.units=Math.min(Number.MAX_SAFE_INTEGER,$.units+Z.length*J)}function F1($,Z){Q2($,Z)}function x0($){if(!$)return!1;let Z=$.charCodeAt(0);return Z>=48&&Z<=57||Z>=65&&Z<=90||Z===95||Z>=97&&Z<=122}function c($){if(!$)return!1;let Z=$.charCodeAt(0);return Z===9||Z===10||Z===11||Z===12||Z===13||Z===32||Z===160||Z===65279||Z===5760||Z>=8192&&Z<=8202||Z===8232||Z===8233||Z===8239||Z===8287||Z===12288}function x6($){return $===`
-`||$==="\r"||$==="\u2028"||$==="\u2029"}function d($,Z,J){if(Z+J.length>a($))return!1;for(let Q=0;Q<J.length;Q++)if(V($,Z+Q)!==J[Q])return!1;return!0}function G0($,Z,J){return!x0(V($,Z-1))&&d($,Z,J)&&!x0(V($,Z+J.length))}function H0($,Z){return x0(V($,Z-1))!==x0(V($,Z))}function J1($){return $===`
-`||$===";"||$==="&"||$==="|"}function O$($){return $==="|"||$===";"}var N1=new Set(["awk","gawk","nawk","mawk"]),NB=new Set(["-e","--source"]),VB=new Set(["-F","-v","--assign","--field-separator"]),z7=new Set(["-f","--file"]),RB=new Set(["print","printf","return"]),I7=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],DB="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function v4($,Z,J){let Q=!1;for(let X of zB($)){let K=IB(X,J);if(!K)continue;for(let W of K.commands){let Y=Z(W);if(Y)return Y;if(W.includes("{}")||/[$`]/.test(W))Q=!0}Q||=K.dynamic}return Q?N("awk.system-dynamic",DB):null}function m6($){let Z=[],J=!1,Q=!1,X=!0,K=!0;for(let W=1;W<$.length;W++){let Y=$[W];if(Y===void 0)break;if(X&&Y==="--"){X=!1;continue}if(X&&NB.has(Y)){J=!0;let B=$[W+1];if(B!==void 0)Z.push({tokenIndex:W+1,kind:"inline-code",value:B});else K=!1;W++;continue}if(X&&Y.startsWith("--source=")){J=!0,Z.push({tokenIndex:W,kind:"inline-code",value:Y.slice(9)});continue}if(X&&Y.startsWith("-e")&&Y.length>2){J=!0,Z.push({tokenIndex:W,kind:"inline-code",value:Y.slice(2)});continue}if(X&&(VB.has(Y)||z7.has(Y))){if(z7.has(Y)){Q=!0;let B=$[W+1];if(B!==void 0)Z.push({tokenIndex:W+1,kind:"program-file",value:B});else K=!1}else if($[W+1]===void 0)K=!1;W++;continue}if(X&&(Y.startsWith("-F")||Y.startsWith("-v")&&Y.slice(2).includes("=")))continue;if(X&&Y.startsWith("-f")&&Y.length>2){Q=!0,Z.push({tokenIndex:W,kind:"program-file",value:Y.slice(2)});continue}if(X&&(Y.startsWith("--assign=")||Y.startsWith("--field-separator=")))continue;if(X&&Y.startsWith("--file=")){Q=!0,Z.push({tokenIndex:W,kind:"program-file",value:Y.slice(7)});continue}if(X&&Y.startsWith("-")&&Y!=="-")continue;if(X=!1,!J&&!Q)Z.push({tokenIndex:W,kind:"main-program",value:Y});return{sources:Z,optionsOpen:!1}}return{sources:K?Z:[],optionsOpen:X&&K}}function K2($){return m6($).sources}function zB($){return K2($).filter((Z)=>Z.kind!=="program-file").map((Z)=>Z.value)}function IB($,Z){F1(Z,$);let J=$.includes("system")?p6($,Z):null,Q=bB($,Z);if(!J&&!Q)return null;return{dynamic:!!J?.dynamic||!!Q?.dynamic,commands:[...J?.commands??[],...Q?.commands??[]]}}function p6($,Z){F1(Z,$);let J=[],Q=!1,X=!1,K=0;while(K<$.length){let W=$[K];if(W==='"'||W==="'"){K=w4($,K,W)?.endIndex??K+1;continue}if(W==="#"){K=b7($,K+1);continue}if(W==="/"&&f7($,K)){K=P7($,K+1)??K+1;continue}if(!$.startsWith("system",K)){K++;continue}let Y=K;if(K+=6,X2($[Y-1])||X2($[K]))continue;let B=y4($,K);if($[B]!=="(")continue;B=y4($,B+1);let q=$[B];if(q!=='"'&&q!=="'"){Q=!0,X=!0;continue}let U=w4($,B,q);if(!U){Q=!0,X=!0;continue}if(B=y4($,U.endIndex),Q=!0,$[B]!==")"){X=!0,K=U.endIndex;continue}J.push(U.value),K=B+1}if(!Q)return null;return{dynamic:X,commands:J}}function bB($,Z){F1(Z,$);let J=[],Q=!1,X=!1,K=0,W=0,Y=null,B=null,q=0;while(K<$.length){let U=$[K];if(!U)break;if(U==='"'||U==="'"){let H=w4($,K,U);if(H&&q===W)B={...H,startIndex:K};q=H?.endIndex??K+1,K=H?.endIndex??K+1;continue}if(U==="#"){K=b7($,K+1),W=K,Y=null,B=null,q=K;continue}if(U==="/"&&f7($,K)){let H=P7($,K+1);q=H??K+1,K=H??K+1;continue}if(`;
-{}`.includes(U)){K++,W=K,Y=null,B=null,q=K;continue}if(Y===null&&(l6($,K,"print")||l6($,K,"printf")))Y=K;if(U!=="|"||$[K-1]==="|"||$[K+1]==="|"){if(!/\s/.test(U))q=K+1;K++;continue}let G=$[K+1]==="&"?K+2:K+1,j=y4($,G);if(l6($,j,"getline")){X=!0;let H=CB(W,B,q);if(H===null)Q=!0;else J.push(H);q=G,K=G;continue}if(EB(W,Y)){X=!0;let H=PB($,j);if(!H){Q=!0,q=G,K=G;continue}if(!fB($,H.endIndex)){Q=!0,q=H.endIndex,K=H.endIndex;continue}J.push(H.value),q=H.endIndex,K=H.endIndex;continue}q=G,K++}if(!X)return null;return{dynamic:Q,commands:J}}function X2($){return!!$&&/[A-Za-z0-9_]/.test($)}function y4($,Z){let J=Z;while(/\s/.test($[J]??""))J++;return J}function fB($,Z){let J=Z;while(/[\t\f\v\r ]/.test($[J]??""))J++;let Q=$[J];return!Q||`;
-}#`.includes(Q)}function w4($,Z,J){let Q="",X=!1;for(let K=Z+1;K<$.length;K++){let W=$[K];if(!W)break;if(X){let Y=AB($,K);if(!Y)return null;Q+=Y.value,K=Y.endIndex,X=!1;continue}if(W==="\\"){X=!0;continue}if(W===J)return{value:Q,endIndex:K+1};Q+=W}return null}function PB($,Z){let J=$[Z];if(J!=='"'&&J!=="'")return null;return w4($,Z,J)}function CB($,Z,J){if(!Z)return null;return Z.startIndex>=$&&Z.endIndex===J?Z.value:null}function AB($,Z){let J=$[Z];if(!J)return null;if(J==="x"){let X=$.slice(Z+1,Z+3);if(!/^[0-9A-Fa-f]{2}$/.test(X))return null;return{value:String.fromCharCode(Number.parseInt(X,16)),endIndex:Z+2}}if(/[0-7]/.test(J)){let X=/^[0-7]{1,3}/.exec($.slice(Z));if(!X)return null;return{value:String.fromCharCode(Number.parseInt(X[0],8)),endIndex:Z+X[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[J]??J,endIndex:Z}}function l6($,Z,J){return $.startsWith(J,Z)&&!X2($[Z-1])&&!X2($[Z+J.length])}function EB($,Z){return Z!==null&&Z>=$}function b7($,Z){let J=$.indexOf(`
-`,Z);return J===-1?$.length:J+1}function f7($,Z){let J=TB($,Z);if(J===-1)return!0;if("{([,;!~=".includes($[J]??""))return!0;let Q=J;while(X2($[Q-1]))Q--;return RB.has($.slice(Q,J+1))}function TB($,Z){for(let J=Z-1;J>=0;J--)if(!/\s/.test($[J]??""))return J;return-1}function P7($,Z){let J=!1;for(let Q=Z;Q<$.length;Q++){let X=$[Q];if(!X)break;if(J){J=!1;continue}if(X==="\\"){J=!0;continue}if(X==="/")return Q+1}return null}function u4($,Z,J){let Q=k6($,J);if(Z==="rm")return SB(Q);if(Z==="dd")return wB(Q);return y7(Q,!0)}function h4($,Z,J){let Q=k6($,J);if(Z==="rm")return vB(Q);if(Z==="reset-hard")return T7(Q,"--ha","rd");if(Z==="reset-merge")return T7(Q,"--me","rge");if(Z==="clean")return kB(Q);if(Z==="checkout")return lB(Q);if(Z==="push-force")return mB(Q);if(Z==="push-refspec")return pB(Q);if(Z==="push-delete")return cB(Q);if(Z==="branch")return dB(Q);if(Z==="tag")return rB(Q);if(Z==="restore")return nB(Q);return y7(Q,!1)}function SB($){let Z=!1,J=!1,Q=!1,X=-1;for(let K=0;K<=a($);K++){let W=V($,K);if(!Z){let B=V($,K+2);if(G0($,K,"rm")&&c(B)&&B!==`
-`)Z=!0,K++;continue}let Y=yB($,K);if(W===`
-`||Y!==-1){if(Z=!1,J=!1,Q=!1,X=-1,Y!==-1)K=Y-1;continue}if(W===";"||W==="&"||W==="|"||K===a($)){if(X>=0){let B=C7($,X,K);J||=B.recursive,Q||=B.force}if(J&&Q)return!0;Z=!1,J=!1,Q=!1,X=-1;continue}if(c(W)){if(X>=0){if(d($,X,"--")&&K-X===2)Z=!1,J=!1,Q=!1;else{let B=C7($,X,K);if(J||=B.recursive,Q||=B.force,J&&Q)return!0}X=-1}continue}if(X<0)X=K}return!1}function yB($,Z){if(V($,Z)!=="\\"||V($,Z-1)==="\\")return-1;if(d($,Z,String.raw`\n`))return Z+2;if(d($,Z,String.raw`\x0a`)||d($,Z,String.raw`\x0A`))return Z+5;if(d($,Z,String.raw`\u000a`)||d($,Z,String.raw`\u000A`))return Z+7;return d($,Z,String.raw`\012`)?Z+4:-1}function C7($,Z,J){if(A7($,Z,J,"recursive"))return{recursive:!0,force:!1};if(A7($,Z,J,"force"))return{recursive:!1,force:!0};if(V($,Z)!=="-"||V($,Z+1)==="-")return{recursive:!1,force:!1};let Q=!1,X=!1;for(let K=Z+1;K<J;K++){let W=V($,K);Q||=W==="r"||W==="R",X||=W==="f"||W==="F"}return{recursive:Q,force:X}}function A7($,Z,J,Q){let X=J-Z-2;if(X<1||X>Q.length||!d($,Z,"--"))return!1;for(let K=0;K<X;K++)if(V($,Z+K+2)!==Q[K])return!1;return!0}function wB($){let Z=!1;for(let J=0;J<a($);J++){if(J1(V($,J))){Z=!1;continue}if(G0($,J,"dd")){Z=!0,J++;continue}if(!Z||!G0($,J,"of")||!d($,J,"of=/dev/"))continue;let Q=J+8;if(Q<a($)&&!c(V($,Q))&&V($,Q)!=="'"&&V($,Q)!=='"')return!0}return!1}function vB($){let Z=!1,J=!1,Q=!1;for(let X=0;X<=a($);){let K=V($,X);if(X===a($)||J1(K)){Z=!1,J=!1,Q=!1,X++;continue}let W=hB($,X);if(W>=0){if(uB($,W))return!0;let Y=W,B=!1;while(c(V($,Y)))B||=V($,Y)===`
-`,Y++;if(B)J=!1,Q=!1;Z=!0,X=Y;continue}if(!Z){X++;continue}if(d($,X,"--")&&(X===0||c(V($,X-1)))&&(!V($,X+2)||c(V($,X+2))||J1(V($,X+2)))){Z=!1,J=!1,Q=!1,X+=2;continue}if(J||=d($,X,"--recursive")&&H0($,X+11)||c6($,X,"recursive"),Q||=d($,X,"--force")&&H0($,X+7)||c6($,X,"force"),J&&Q)return!0;X++}return!1}function c6($,Z,J){if(!d($,Z,"--"))return!1;let Q=0;while(Q<=J.length){let X=V($,Z+Q+2);if(!X||c(X)||J1(X))break;if(X!==J[Q])return!1;Q++}return Q>0&&H0($,Z+Q+2)}function uB($,Z){let J=Z,Q=!1,X=!1;while(J<a($)){while(c(V($,J)))J++;let K=J;while(J<a($)&&!c(V($,J)))J++;if(V($,K)!=="-"||J-K===2&&d($,K,"--"))return!1;let W=E7($,K,"recursive"),Y=E7($,K,"force");if(Q&&Y||X&&W)return!0;if(Q||=W,X||=Y,V($,K+1)==="-")continue;let B=gB($,K,J);if(B.combined||Q&&B.forceAtBoundary||X&&B.recursiveAtBoundary)return!0;Q||=B.recursive,X||=B.force}return!1}function E7($,Z,J){return d($,Z,`--${J}`)&&H0($,Z+J.length+2)||c6($,Z,J)}function hB($,Z){if(Z>0&&x0(V($,Z-1)))return-1;let J=Z;if(V($,J)==="\\")J++;if(V($,J)!=="r")return-1;if(J++,V($,J)==="\\")J++;if(V($,J)!=="m"||!c(V($,J+1)))return-1;return J+1}function gB($,Z,J){let Q=!1,X=!1,K=!1,W=!1,Y=!1;if(V($,Z)!=="-")return{recursive:Q,force:X,recursiveAtBoundary:K,forceAtBoundary:W,combined:Y};let B="";for(let q=Z+1;q<J;q++){let U=V($,q)??"",G=(U==="r"||U==="f")&&H0($,q+1);Q||=U==="r",X||=U==="f",K||=U==="r"&&G,W||=U==="f"&&G,Y||=(B==="r"&&U==="f"||B==="f"&&U==="r")&&G,B=U}return{recursive:Q,force:X,recursiveAtBoundary:K,forceAtBoundary:W,combined:Y}}function T7($,Z,J){return Y2($,"reset",O$,!0,(Q)=>V($,Q)==="-"&&L$($,Q,Z,J)?!0:Q)}function kB($){return Y2($,"clean",O$,!0,(Z)=>{if(V($,Z)!=="-")return Z;if(L$($,Z,"--fo","rce"))return!0;let J=W2($,Z,O$);for(let Q=Z+1;Q<J;Q++)if(V($,Q)==="f")return!0;return J-1})}function g4($,Z,J){if(!G0($,Z,"git"))return null;let Q=Z+3;if(!c(V($,Q)))return{commandEnd:-1,next:Q};while(c(V($,Q)))Q++;while(Q<a($)){if(J1(V($,Q)))return{commandEnd:-1,next:Q};let X=W2($,Q,J1);if(G0($,Q,J))return{commandEnd:Q+J.length,next:X};if(V($,Q)!=="-")return{commandEnd:-1,next:X};let K=X-Q===2&&d($,Q,"--"),W=xB($,Q,X);Q=X;while(c(V($,Q)))Q++;if(K)return{commandEnd:G0($,Q,J)?Q+J.length:-1,next:W2($,Q,J1)};if(!W)continue;if(Q>=a($)||J1(V($,Q)))return{commandEnd:-1,next:Q};Q=W2($,Q,J1);while(c(V($,Q)))Q++}return{commandEnd:-1,next:Q}}function xB($,Z,J){for(let Q of r1)if(J-Z===Q.length&&d($,Z,Q))return!0;return!1}function lB($){return S7($,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function mB($){return Y2($,"push",O$,!0,(Z)=>{if(V($,Z)!=="-")return Z;if(V($,Z+1)==="f"&&!x0(V($,Z+2))&&!d($,Z+2,"-with-lease"))return!0;let J=w7($,Z,"--fo","rce");if(J>=0&&!d($,J,"-with-lease"))return!0;return Z})}function pB($){return Y2($,"push",J1,!1,(Z)=>{if(c(V($,Z))&&V($,Z+1)==="+"&&Z+2<a($)&&!J1(V($,Z+2))&&!c(V($,Z+2)))return!0;if(V($,Z)===":"&&V($,Z+1)==="+")return!0;return Z})}function cB($){return Y2($,"push",J1,!1,(Z)=>{if(V($,Z)==="-"&&L$($,Z,"--de","lete"))return!0;if(c(V($,Z))&&V($,Z+1)===":"&&Z+2<a($)&&!c(V($,Z+2))&&!J1(V($,Z+2)))return!0;return Z})}function dB($){let Z=!1,J=!1,Q=!1;for(let X=0;X<=a($);X++){if(X===a($)||J1(V($,X))){if(J&&Q)return!0;Z=!1,J=!1,Q=!1;continue}if(!Z){let Y=g4($,X,"branch");if(Y){Z=Y.commandEnd>=0,X=Math.max(X,(Z?Y.commandEnd:Y.next)-1);continue}}if(!Z||V($,X)!=="-")continue;let K=W2($,X,J1),W=iB($,X,K);if(J||=W.deletion,Q||=W.force,J&&Q)return!0;X=K-1}return!1}function iB($,Z,J){let Q=!1,X=!1;for(let K=Z;K<J;K++){if(V($,K)!=="-")continue;if(L$($,K,"--de","lete"))Q=!0;if(L$($,K,"--fo","rce"))X=!0;if(V($,K+1)==="-")continue;let W=K+1,Y=!1,B=!1,q=!1;while(W<J&&sB(V($,W))){let U=V($,W);Y||=U==="d"||U==="D",B||=U==="f",q||=U==="D",W++}if(!H0($,W))continue;Q||=Y,X||=B||q}return{deletion:Q,force:X}}function sB($){if(!$)return!1;let Z=$.charCodeAt(0);return Z>=65&&Z<=90||Z>=97&&Z<=122}function rB($){return S7($,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function S7($,Z){let J=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let Q=0;Q<a($);Q++){let X=V($,Q),K=J[J.length-1];if(!K)return!1;let W=K.escaped;if(K.escaped=!W&&K.quote!=="'"&&X==="\\",!W&&X==="'"&&K.quote!=='"')K.quote=K.quote==="'"?"":"'";if(!W&&X==='"'&&K.quote!=="'")K.quote=K.quote==='"'?"":'"';if(X==="$"&&V($,Q+1)==="("&&(J.length===1||!W&&K.quote!=="'")){J.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),Q++;continue}if(!W&&!K.quote&&J.length>1&&X==="("){K.depth++;continue}if(!W&&!K.quote&&J.length>1&&X===")"){if(K.depth--,K.depth===0)J.pop();continue}if(c(X))K.shortActive=!1,K.hasShortFlag=!1;if(!K.outerActive){let Y=g4($,Q,Z.command);if(Y){K.outerActive=Y.commandEnd>=0&&c(V($,Y.commandEnd)),K.shortActive=!1,K.hasShortFlag=!1,Q=Math.max(Q,(K.outerActive?Y.commandEnd:Y.next)-1);continue}}if(K.outerActive&&X==="-"){if(L$($,Q,Z.longPrefix,Z.longOptional))return!0;K.shortActive||=!Z.excludedShortStarts.includes(V($,Q+1)??"")}if(K.hasShortFlag||=K.shortActive&&X===Z.shortFlag,K.hasShortFlag&&H0($,Q+1))return!0;if(O$(X))K.outerActive=!1}return!1}function Y2($,Z,J,Q,X){let K=!1;for(let W=0;W<a($);W++){let Y=V($,W),B=J(Y);if(!K&&!B){let q=g4($,W,Z);if(q){K=q.commandEnd>=0&&(!Q||c(V($,q.commandEnd))),W=Math.max(W,(K?q.commandEnd:q.next)-1);continue}}if(K){let q=X(W);if(q===!0)return!0;for(let U=W;U<=q;U++)if(J(V($,U)))K=!1;W=q}if(B)K=!1}return!1}function nB($){let Z=!1;for(let J=0;J<a($);J++){if(x6(V($,J))){if(Z)return!0;Z=!1;continue}if(!Z){let Q=g4($,J,"restore");if(Q){Z=Q.commandEnd>=0,J=Math.max(J,(Z?Q.commandEnd:Q.next)-1);continue}}if(Z&&V($,J)==="-"&&V($,J+1)==="-"&&(d($,J+2,"staged")||d($,J+2,"help")))Z=!1}return Z}function y7($,Z){let J=!1;for(let Q=0;Q<a($);Q++){let X=V($,Q),K=Z?x6(X):J1(X);if(J&&c(X)&&V($,Q+1)==="-"&&G0($,Q+2,"delete"))return!0;if(K){J=!1;continue}if(G0($,Q,"find"))J=!0,Q+=3}return!1}function W2($,Z,J){let Q=Z;while(Q<a($)&&!c(V($,Q))&&!J(V($,Q)))Q++;return Q}function w7($,Z,J,Q){if(!d($,Z,J))return-1;let X=Z+J.length;for(let K=0;K<Q.length&&V($,X)===Q[K];K++)X++;return H0($,X)?X:-1}function L$($,Z,J,Q){return w7($,Z,J,Q)>=0}var l0="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",M$="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",k4=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),aB=new Set(["-p","--print"]),oB=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),tB=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),eB=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),$q=new Map([["python",new Set(["m"])]]),Zq=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Jq=new Set(["always","default","never"]),Qq=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Xq=/\\\r?\n/g,Kq=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function x4($){return m4($).code}function l4($){return m4($).sources}function u7($){return Kq.get(c4($))??[]}function m4($){let Z=c4($[0]??"");if(!k4.has(Z))return{code:null,sources:[],optionsOpen:!1};let J=[],Q=[],X=!0;for(let K=1;K<$.length;K++){let W=$[K];if(W===void 0)break;if(W==="--")return g1(Z,J,Q,X,$[K+1]===void 0?void 0:K+1,$[K+1]);if(W===""||W==="-"||!W.startsWith("-"))return g1(Z,J,Q,X,K,W);if(Z==="node"&&aB.has(W)){let G=$[K+1];if(G===void 0)return g1(Z,J,Q,X);if(G.startsWith("-"))continue;J.push({tokenIndex:K+1,value:G}),Q.push({tokenIndex:K+1,kind:"inline-code",value:G}),K++;continue}if(Yq(Z,W)){let G=$[K+1];if(G===void 0)return g1(Z,J,Q,X);if(J.push({tokenIndex:K+1,value:G}),Q.push({tokenIndex:K+1,kind:"inline-code",value:G}),Z==="python")return g1(Z,J,Q,X);K++;continue}let Y=/^--eval=(.*)$/s.exec(W);if(Bq(Z)&&Y){let G=Y[1]??"";J.push({tokenIndex:K,value:G}),Q.push({tokenIndex:K,kind:"inline-code",value:G});continue}if(Z==="node"){let G=Wq(W);if(G){if(G.attached){if(X&&=G.value!=="",G.value!=="")Q.push({tokenIndex:K,kind:"module-file",value:G.value});continue}let j=$[K+1];if(j===void 0||j.startsWith("-"))return X=!1,g1(Z,J,Q,X);Q.push({tokenIndex:K+1,kind:"module-file",value:j}),K++;continue}}if(Z==="python"&&W.startsWith("--check-hash-based-pycs=")||Z==="node"&&(W==="--conditions="||W==="--diagnostic-dir="||W==="--title=")||Z==="ruby"&&(W==="--disable="||W==="--enable="))return g1(Z,J,Q,X);if(Zq.get(Z)?.has(W)){let G=$[K+1];if(G===void 0||G.startsWith("-")&&!(Z==="ruby"&&Qq.has(W))||Z==="python"&&!Jq.has(G))return g1(Z,J,Q,X);K++;continue}if(W.startsWith("--"))continue;let B,q=!1;for(let G=1;G<W.length;G++){let j=W[G];if(j===void 0)break;if($q.get(Z)?.has(j)){let H=W.slice(G+1),_=H||$[K+1];if(_!==void 0)Q.push({tokenIndex:H?K:K+1,kind:"module-file",value:_});return g1(Z,J,Q,X)}if(oB.get(Z)?.has(j)){B=W.slice(G+1)||$[K+1],q=G+1===W.length;break}if(Z==="node"&&j==="r"){if(W==="-r"){let H=$[K+1];if(X&&=H!==void 0&&!H.startsWith("-"),X&&H!==void 0)Q.push({tokenIndex:K+1,kind:"module-file",value:H});K++}else X=!1;break}if(Z==="ruby"&&j==="r"){let H=W.slice(G+1),_=H||$[K+1];if(X&&=_!==void 0,_!==void 0)Q.push({tokenIndex:H?K:K+1,kind:"module-file",value:_});if(!H)K++;break}if(Z==="perl"&&(j==="M"||j==="m")){let H=W.slice(G+1);if(H)Q.push({tokenIndex:K,kind:"module-file",value:H});else if(X=!1,G+1===W.length)K++;break}if(tB.get(Z)?.has(j)){if(G+1===W.length)K++;break}if(eB.get(Z)?.has(j)&&G+1<W.length)break}if(B===void 0)continue;let U=q?K+1:K;if(J.push({tokenIndex:U,value:B}),Q.push({tokenIndex:U,kind:"inline-code",value:B}),Z==="python")return g1(Z,J,Q,X);if(q)K++}return g1(Z,J,Q,X,void 0,void 0,!0)}function g1($,Z,J,Q,X,K,W=!1){let Y=$==="node"?Z.slice(-1):Z,B=new Set(Y.map((U)=>U.tokenIndex)),q=J.filter((U)=>U.kind!=="inline-code"||B.has(U.tokenIndex));if(Q&&Z.length===0&&X!==void 0&&K!==void 0)q.push({tokenIndex:X,kind:"main-script",value:K});return{code:($==="node"?Y[0]?.value:Y.map((U)=>U.value).join(`
-`))||null,sources:Q?q:[],optionsOpen:Q&&W}}function Wq($){for(let Z of["--import","--loader","--experimental-loader","--require"]){if($===Z)return{attached:!1,value:""};if($.startsWith(`${Z}=`))return{attached:!0,value:$.slice(Z.length+1)}}return}function V1($){return k4.has(c4($))}function p4($,Z){return c4($)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(Z)}function c4($){let Z=h($).toLowerCase();return J8.test(Z)?"python":Z}function Yq($,Z){return k4.get($)?.has(Z)??!1}function Bq($){return k4.get($)?.has("--eval")??!1}function F$($,Z){let J=Gq($,Z);if(!v7(J,Z))return!1;F1(Z,J);let Q=Uq(J);if(v7(Q,Z))return!0;return F1(Z,Q),qq.test(Q)}var qq=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Uq($){let Z=[],J=0,Q=0;while(Q<$.length){let X=$[Q];if(X!=="'"&&X!=='"'){Q++;continue}let K=$.startsWith(X.repeat(3),Q)?X.repeat(3):X,W=Q+K.length;while(W<$.length&&!$.startsWith(K,W))W+=$[W]==="\\"?2:1;if(W>=$.length)break;Z.push($.slice(J,Q)," "),Q=W+K.length,J=Q}return Z.push($.slice(J)),Z.join("")}function v7($,Z){if(u4($,"rm",Z))return!0;for(let Q of[/\bgit[^\S\n]+reset[^\S\n]+--ha(?:r(?:d)?)?\b/,/\bgit[^\S\n]+reset[^\S\n]+--me(?:r(?:g(?:e)?)?)?\b/,/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+clean[^\S\n]+(-[^\s]*f[^\s]*|--fo(?:r(?:c(?:e)?)?)?)\b/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(F1(Z,$),Q.test($))return!0;if(u4($,"dd",Z))return!0;for(let Q of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(F1(Z,$),Q.test($))return!0;if(u4($,"find",Z))return!0;let J=$.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((Q)=>{return F1(Z,$),J.some((X)=>h4(X,Q))})}function Gq($,Z){return F1(Z,$),$.replace(Xq,"")}var h7=new Set(["rm","find","xargs","parallel"]),Hq=new Set(["sudo","env","command","builtin"]),jq=new Set(["git","busybox",...h7,...$1,...Z8,...N1]);function d4($,Z){let J=$[0];if(!J||!Z.transparentWrappers.includes(h(J)))return null;let Q=h(J),X=$[1]==="--"?2:1,K=_q($,X,Q,Z),W=K[0];if(W===void 0)return null;return{wrapper:Q,tokens:[...$.slice(W)],childIndex:W,alternativeChildIndices:K.slice(1)}}function _q($,Z,J,Q){let X=$[1]==="--",K=[];for(let W=Z;W<$.length;W++){let Y=$[W];if(!Y)continue;if(h(Y)!==J&&Oq(Y,Q))K.push(W);else if(e2.has(x(Y)))break;if(X)break}return K}function Oq($,Z){let J=h($),Q=x($);return Q==="git"||J==="busybox"||B2($)||h7.has(J)||Z.transparentWrappers.includes(J)||$1.has(Q)||$==="$SHELL"||V1(Q)||N1.has(Q)||Z.rules.some((X)=>X.command===J)}function B2($){return Hq.has($.toLowerCase())}function g7($){let Z=x($);return jq.has(Z)||V1(Z)}var t={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},i4=["standard","strict","paranoid"];function Lq($){return{failClosed:$==="strict"||$==="paranoid",paranoidRm:$==="paranoid",paranoidInterpreters:$==="paranoid"}}function Mq($,Z){if(!Z)return $;return i4.indexOf(Z)>i4.indexOf($)?Z:$}function Fq(){let $=i6(t.level);if($===void 0||$==="")return;if(i4.includes($))return $;console.error(`CC Safety Net: ignored invalid ${t.level.name}=${JSON.stringify($.slice(0,40))}. Use ${i4.join(", ")}.`);return}function Nq($){if($===void 0||$==="all")return"all";if($==="blocked")return"blocked";return"invalid"}function Vq(){return Nq(i6(t.auditScope))==="all"}function d6($){if($.failClosed&&$.paranoidRm&&$.paranoidInterpreters)return"paranoid";if($.failClosed&&!$.paranoidRm&&!$.paranoidInterpreters)return"strict";if(!$.failClosed&&!$.paranoidRm&&!$.paranoidInterpreters)return"standard";return"custom"}function s4($={}){let Z=$.safety?.level??"standard",J=Fq(),Q=Mq(Z,J),X=Lq(Q),K={failClosed:Q===Z?"preset":"environment",paranoidRm:Q===Z?"preset":"environment",paranoidInterpreters:Q===Z?"preset":"environment"},W={failClosed:[`policy safety.level=${Z}`],paranoidRm:[`policy safety.level=${Z}`],paranoidInterpreters:[`policy safety.level=${Z}`],worktreeMode:[]};if(Q!==Z)W.failClosed.push(`env ${t.level.name}=${J}`),W.paranoidRm.push(`env ${t.level.name}=${J}`),W.paranoidInterpreters.push(`env ${t.level.name}=${J}`);if($.safety?.overrides?.failClosed!==void 0)X.failClosed=$.safety.overrides.failClosed,K.failClosed="capability_override",W.failClosed.push("policy safety.overrides.fail_closed");if($.safety?.overrides?.paranoidRm!==void 0)X.paranoidRm=$.safety.overrides.paranoidRm,K.paranoidRm="capability_override",W.paranoidRm.push("policy safety.overrides.paranoid_rm");if($.safety?.overrides?.paranoidInterpreters!==void 0)X.paranoidInterpreters=$.safety.overrides.paranoidInterpreters,K.paranoidInterpreters="capability_override",W.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(m0(t.strict))X.failClosed=!0,K.failClosed="environment",W.failClosed.push(`env ${t.strict.name}`);if(m0(t.paranoid))X.paranoidRm=!0,X.paranoidInterpreters=!0,K.paranoidRm="environment",K.paranoidInterpreters="environment",W.paranoidRm.push(`env ${t.paranoid.name}`),W.paranoidInterpreters.push(`env ${t.paranoid.name}`);if(m0(t.paranoidRm))X.paranoidRm=!0,K.paranoidRm="environment",W.paranoidRm.push(`env ${t.paranoidRm.name}`);if(m0(t.paranoidInterpreters))X.paranoidInterpreters=!0,K.paranoidInterpreters="environment",W.paranoidInterpreters.push(`env ${t.paranoidInterpreters.name}`);let Y=!!$.worktreeMode||m0(t.worktree);if($.worktreeMode)W.worktreeMode.push("policy workflow.worktree_mode");if(m0(t.worktree))W.worktreeMode.push(`env ${t.worktree.name}`);return{strict:X.failClosed,paranoidRm:X.paranoidRm,paranoidInterpreters:X.paranoidInterpreters,worktreeMode:Y,effectiveLevel:d6(X),capabilities:{fail_closed:{enabled:X.failClosed,source:K.failClosed,sources:W.failClosed},paranoid_rm:{enabled:X.paranoidRm,source:K.paranoidRm,sources:W.paranoidRm},paranoid_interpreters:{enabled:X.paranoidInterpreters,source:K.paranoidInterpreters,sources:W.paranoidInterpreters}},sources:W}}function m0($){let Z=typeof $==="string"?q2($):i6($);return Z==="1"||Z?.toLowerCase()==="true"}function q2($){return Object.hasOwn(process.env,$)?process.env[$]:void 0}function i6($){let Z=q2($.name);if(Z!==void 0)return Z;if($.legacyName)return q2($.legacyName);return}function pN($){return q2($.name)!==void 0||!!$.legacyName&&q2($.legacyName)!==void 0}function k7($){let Z=$.effectiveCapabilities,J=$.strict??Z.fail_closed.enabled,Q=$.paranoidRm??Z.paranoid_rm.enabled,X=$.paranoidInterpreters??Z.paranoid_interpreters.enabled,K={fail_closed:s6(Z.fail_closed,$.strict,"strict"),paranoid_rm:s6(Z.paranoid_rm,$.paranoidRm,"paranoidRm"),paranoid_interpreters:s6(Z.paranoid_interpreters,$.paranoidInterpreters,"paranoidInterpreters")};return{policy:$8($.policySnapshot.policy,K),effectiveCapabilities:K,effectiveLevel:d6({failClosed:J,paranoidRm:Q,paranoidInterpreters:X}),strict:J,paranoidRm:Q,paranoidInterpreters:X,worktreeMode:$.worktreeMode??!1}}function s6($,Z,J){if(Z===void 0||Z===$.enabled)return $;return{enabled:Z,source:"capability_override",sources:[...$.sources,`analysis options.${J}`]}}function U2($,Z){Q2(Z,$,2);let J=$.toLowerCase(),Q=J.trimStart(),X=Q.startsWith("echo ")||Q.startsWith("rg "),K=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0}];for(let W of K){if(W.skipForEchoRg&&X)continue;let Y=W.caseSensitive?$:J;if(W.regex)F1(Z,Y);if((W.regex?.test(Y)??!1)||W.scan&&h4(Y,W.scan,Z))return N("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${W.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Rq=/^[A-Za-z_][A-Za-z0-9_]*=/;function l7($,Z,J){let Q=$.words[0];if(!Z||!Q||$.words.length!==1||$.dialect!=="posix")return!1;if(!Q.quoted||Q.provenance!=="literal")return!1;let X=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(Q.text)?.[1];if(!X)return!1;Q2(J,Z.source,2);let K={anchored:new RegExp(`^\\$\\{?${X}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${X}(?![A-Za-z0-9_])`)};return m7(Z.nodes,Q,K)}function m7($,Z,J){return $.every((Q)=>{if(Q.kind==="connector")return!0;if(Q.kind==="group"||Q.kind==="function")return m7(Q.body.nodes,Z,J);if(Q.kind==="unknown")return!J.loose.test(Q.source);return Dq(Q,Z,J)})}function Dq($,Z,J){if($.nested.some((X)=>J.loose.test(X.source)))return!1;let Q=$.words.findIndex((X)=>!Rq.test(X.text));return $.words.every((X,K)=>X===Z||x7(X.raw,J.anchored,K!==Q))&&$.redirections.every((X)=>(!X.heredoc||X.heredoc.quotedDelimiter||!J.loose.test(X.heredoc.body))&&(!X.target||x7(X.target.raw,J.anchored,!0)))}function x7($,Z,J){let Q=!1,X=!1;for(let K=0;K<$.length;K++){let W=$[K];if(W==="\\"&&!Q){K++;continue}if(!X&&W==="'"){Q=!Q;continue}if(!Q&&W==='"'){X=!X;continue}if(Q||W!=="$")continue;if(!Z.test($.slice(K)))continue;if(!X||!J)return!1}return!0}var p7=Object.freeze({maxDerivedTokens:16384}),c7="Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.",d7="env -S split-string variables cannot be resolved safely. Use literal values or expand the command explicitly.";class A1 extends Error{constructor(){super("Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.");this.name="DerivedCommandWorkLimitError"}}class p0 extends Error{constructor(){super("env -S split-string variables cannot be resolved safely. Use literal values or expand the command explicitly.");this.name="EnvSplitStringExpansionError"}}function r4(){return{derivedTokens:0}}function o1($,Z){if(!Number.isSafeInteger($.derivedTokens)||$.derivedTokens<0||$.derivedTokens>p7.maxDerivedTokens||!Number.isSafeInteger(Z)||Z<0||Z>p7.maxDerivedTokens-$.derivedTokens)throw new A1;$.derivedTokens+=Z}import{isAbsolute as zq,resolve as i7}from"node:path";var s7=64;function G2($,Z,J){let Q=zq($)?i7($):Z?i7(Z,$):void 0;if(!Q)return;try{return l(Q,J)}catch{return Q}}function r7($){return!["/dev","/proc","/sys"].some((Z)=>$===Z||$.startsWith(`${Z}/`))}var E=Object.freeze({maxChildAnalyses:1024,maxDerivedTokens:16384,maxDerivedBytes:1048576,maxPlaceholderReplacements:16384}),n7="Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.";class a4 extends Error{constructor(){super("Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.");this.name="ParallelAnalysisLimitError"}}function a7(){return{childAnalyses:0,derivedTokens:0,derivedBytes:0,placeholderReplacements:0}}function R1($,Z){let J=Z.childAnalyses??0,Q=Z.derivedTokens??0,X=Z.derivedBytes??0,K=Z.placeholderReplacements??0;if(n4($.childAnalyses,J,E.maxChildAnalyses)||n4($.derivedTokens,Q,E.maxDerivedTokens)||n4($.derivedBytes,X,E.maxDerivedBytes)||n4($.placeholderReplacements,K,E.maxPlaceholderReplacements))throw new a4;$.childAnalyses+=J,$.derivedTokens+=Q,$.derivedBytes+=X,$.placeholderReplacements+=K}function n4($,Z,J){return!Number.isSafeInteger($)||$<0||$>J||!Number.isSafeInteger(Z)||Z<0||Z>J-$}import{isAbsolute as $9,normalize as gq,parse as kq,posix as Y5,resolve as N$,sep as e6}from"node:path";import{isAbsolute as Iq,join as o7,normalize as $5,parse as bq,sep as t7}from"node:path";var fq=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Pq=` 	
-`;function H2($,Z){if(t1($,Z))return!0;if(!$.has("TMPDIR"))return!1;return!r6($.get("TMPDIR")??"",Z)}function j0($,Z){if($.has("TMPDIR"))return r6($.get("TMPDIR")??"",Z);let J=n6($,Z);if(J===void 0)return!0;return r6(J,Z)}function n6($,Z){return Q5($,Z,"TMPDIR")}function r6($,Z){if(!$)return!1;if(Aq($))return!1;return a6($,Z)}function t1($,Z){let J=Q5($,Z,"IFS");return J!==void 0&&J!==""&&J!==Pq}function a6($,Z){let J=o4($,Z.paths);return J!==null&&J5(Z).some((Q)=>Tq(J,Q))}function Z5($,Z){let J=o4($,Z.paths);return J!==null&&J5(Z).includes(J)}var e7=new WeakMap;function J5($){let Z=e7.get($);if(Z)return Z;let J=Cq($);return e7.set($,J),J}function Cq($){let Z=fq.map((Q)=>o4(Q,$.paths)??$5(Q)),J=o4($.tmpdir,$.paths);if(!J)return Z;if(process.platform==="win32")return[...Z,J];if(process.platform==="darwin"&&Eq(J))return[...Z,J];return Z}function Aq($){return/[\s$`*?[]/.test($)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test($)||/[+@!]\([^)]*\)/.test($)}function Q5($,Z,J){return $.has(J)?$.get(J):Z.env.get(J)}function Eq($){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test($)}function o4($,Z){try{let J=$5($);if(!Iq(J))return J;let Q=bq(J).root,X=J.slice(Q.length).split(/[\\/]+/).filter(Boolean),K=Q;for(let W=0;W<X.length;W++){let Y=o7(K,X[W]??"");if(Z.entryKind(Y)==="missing")return o7(Y,...X.slice(W+1));let B=Z.realpath(Y);if(B===null)return null;K=B}return K}catch{return null}}function Tq($,Z){if($===Z)return!0;let J=Z.endsWith(t7)?Z:`${Z}${t7}`;return $.startsWith(J)}import{isAbsolute as o6,join as Sq,normalize as yq,sep as t4}from"node:path";var X5=process.platform==="win32",wq=/[*?]/;function j2($,Z){if($==="~")return Z;if($.startsWith("~/"))return`${Z}${$.slice(1)}`;return $}function $3($,Z){if(typeof $!=="string"||$.trim()==="")return"must be a non-empty path string";let J=j2($.trim(),Z);if(!o6(J))return"must be an absolute path or start with ~/";return _2(J,Z)}function Z3($,Z){let J=K5($,Z);if(J===null)return"must be a non-empty path string";if(!o6(J))return null;if(_2(J,Z)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var vq="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",uq="cannot cover the guard's own configuration";function K5($,Z){if(typeof $!=="string"||$.trim()==="")return null;return j2($.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),Z)}function J3($,Z){let J=K5($,Z);if(J===null)return"must be a non-empty path string";if(wq.test(J))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!o6(J))return null;if(_2(J,Z)!==null)return vq;return hq(J,Z)?uq:null}function hq($,Z){let J=e4($),Q=e4(Sq(Z,".cc-safety-net"));return J===Q||J.startsWith(`${Q}${t4}`)}function _2($,Z){let J=e4($),Q=e4(Z);if(J===Q)return"cannot be the home directory";let X=J.endsWith(t4)?J:`${J}${t4}`;if(Q.startsWith(X))return"cannot contain the home directory";return null}function e4($){let Z=yq($);if(X5)Z=Z.replace(/\//g,"\\").toLowerCase();if(Z.length>(X5?3:1)&&Z.endsWith(t4))Z=Z.slice(0,-1);return Z}var xq=process.platform==="win32",W5=64,lq=16384;function O2($){let Z=A8($,W5,W5,lq);return{expandedTargets:Z&&"words"in Z?Z.words:void 0,unsafeBraceExpansion:Z!==void 0&&"limited"in Z,targetIsLiteral:Z===void 0&&$.provenance==="literal"&&($.quoted||$.raw!==$.text),tmpdirWordSplittingProtected:mq($)}}function mq($){let Z=$.parts.filter((J)=>J.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(J.raw));return Z.length>0&&Z.every((J)=>pq($.raw,J.span.start-$.span.start))}function pq($,Z){let J=null,Q=!1;for(let X=0;X<Z;X++){let K=$[X];if(Q){Q=!1;continue}if(K==="\\"&&J!=="'"){Q=!0;continue}if(J===K){J=null;continue}if(J===null&&(K==="'"||K==='"'))J=K}return J==='"'}function c0($){let Z=$.environment.home,J=$.environment.paths,Q=v0($.environment);return{anchoredCwd:$.originalCwd??$.cwd??null,resolvedCwd:$.cwd??null,strict:$.strict??!1,paranoid:$.paranoid??!1,trustTmpdirVar:$.allowTmpdirVar??!0,posixShell:$.posixShell??!1,tmpdirWordSplittingUnsafe:$.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:$.trustedTmpdirValue??$.allowTmpdirVar??!0,environment:$.environment,allowRoots:rq($.allowPaths,Z,J,Q),protectedGitMetadata:$.protectedGitMetadata,pathCanonicalizationContext:Q}}function k1($,Z,J={}){let Q=J.targetIsLiteral??!1;if(!Q&&Z.tmpdirWordSplittingUnsafe&&!J.tmpdirWordSplittingProtected&&aq($))return{kind:"outside_anchored_cwd"};let X=!Q&&U5($,Z.posixShell);if(h0($))return{kind:"outside_anchored_cwd"};if(Z9($,Q))return{kind:"root_or_home_target"};if(cq($,Z))return{kind:"root_or_home_target"};if(Z.resolvedCwd&&k0($,Z.resolvedCwd,Z.protectedGitMetadata,!0,Z.pathCanonicalizationContext,!Z.posixShell))return{kind:"git_metadata_target"};if(dq($,Z.trustTmpdirVar,Z.posixShell,X,Q,J.tmpdirWordSplittingProtected??!1,Z.trustedTmpdirValue,Z.environment))return{kind:"temp_target"};if(X)return{kind:"dynamic_target"};if(nq($,Z,Q))return{kind:"temp_target"};let K=Z.anchoredCwd;if(K){if(!J.skipHomeCwd&&$U(K,Z.environment.home,Z.environment.paths,Z.pathCanonicalizationContext))return{kind:"home_cwd_target"};if(!J.skipCwdSelf&&ZU($,Z.resolvedCwd??K,Z.environment.paths,Z.pathCanonicalizationContext))return{kind:"cwd_self_target"};if(JU($,K,Z.resolvedCwd??K,X,Q,Z.environment.paths,Z.pathCanonicalizationContext))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function B5($,Z,J={}){let{containmentTarget:Q,...X}=J;if(k1($,Z,X).kind!=="temp_target")return!1;let K=$.trim();if(sq(K))return!1;if(Z5(K,Z.environment))return!1;return![Z.anchoredCwd,Z.resolvedCwd].some((W)=>QU(Q??K,W,Z.environment.paths,Z.pathCanonicalizationContext))}function Z9($,Z=!1){let J=$.trim(),Q=Y5.normalize(J),X=J.replace(/\\/g,"/"),K=Q==="/"?Q:Q.replace(/\/+$/,"");if(K==="/"||K.startsWith("/")&&K.slice(1).split("/").every((W)=>/^\*+$/.test(W)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(X)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(X))return!0;if(!Z&&(Q==="~"||Q==="~/"||Q==="~/*"))return!0;if(!Z&&(Q==="$HOME"||Q==="$HOME/"||Q==="$HOME/*"))return!0;if(!Z&&(Q==="${HOME}"||Q==="${HOME}/"||Q==="${HOME}/*"))return!0;return!1}function cq($,Z){let J=$.trim(),Q=J.endsWith("/*")?J.slice(0,-2):J;if(!Q)return!1;try{let X=$9(Q)?Q:Z.resolvedCwd?N$(Z.resolvedCwd,Q):null;if(!X)return!1;let K=G1(l(X,Z.environment.paths,Z.pathCanonicalizationContext));if(K===kq(K).root)return!0;return K===G1(l(Z.environment.home,Z.environment.paths,Z.pathCanonicalizationContext))}catch{return!1}}function G1($){let Z=gq($);if(xq){if(Z=Z.replace(/\//g,"\\").toLowerCase(),Z.length>3&&Z.endsWith("\\"))Z=Z.slice(0,-1);return Z}if(Z.length>1&&Z.endsWith("/"))Z=Z.slice(0,-1);return Z}function dq($,Z,J,Q,X,K,W,Y){let B=$.trim();if(q5(B))return!1;if(!Q&&a6(B,Y))return!0;return(Z||K&&W)&&J&&!X&&iq(B,J)}function iq($,Z){return["$TMPDIR","${TMPDIR}"].some((J)=>{if($===J)return!0;if(!$.startsWith(`${J}/`))return!1;return!U5($.slice(J.length+1),Z)})}function sq($){let Z=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec($);if(!Z)return!1;return Y5.normalize(`/${Z[1]??""}`)==="/"}function q5($){return $.split(/[\\/]+/).includes("..")}function rq($,Z,J,Q){if(!$?.length)return[];return $.flatMap((X)=>{let K=j2(X.trim(),Z);if(!$9(K))return[];try{let W=l(K,J,Q);if(_2(W,l(Z,J,Q)))return[];return[G1(W)]}catch{return[]}})}function nq($,Z,J){if(Z.allowRoots.length===0)return!1;let Q=$.trim();if(q5(Q))return!1;let X=J?Q:j2(Q,Z.environment.home),K=Z.resolvedCwd??Z.anchoredCwd,W=$9(X)?X:K?N$(K,X):null;if(!W)return!1;try{let Y=G1(l(W,Z.environment.paths,Z.pathCanonicalizationContext));return Z.allowRoots.some((B)=>Y===B||Y.startsWith(B.endsWith(e6)?B:`${B}${e6}`))}catch{return!1}}function aq($){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test($)}function U5($,Z=!1){return $.includes("$")||$.includes("`")||oq($)||Z&&tq($)}function oq($){let Z=!1;for(let J of $){if(Z){Z=!1;continue}if(J==="\\"){Z=!0;continue}if(J==="*"||J==="?"||J==="[")return!0}return!1}function tq($){let Z=!1;for(let J=0;J<$.length;J++){let Q=$[J];if(Z){Z=!1;continue}if(Q==="\\"){Z=!0;continue}if(Q==="{"&&eq($,J)||(Q==="+"||Q==="@"||Q==="!")&&$[J+1]==="(")return!0}return!1}function eq($,Z){let J=$.indexOf("}",Z+1);if(J===-1)return!1;let Q=$.slice(Z+1,J);return Q.includes(",")||Q.includes("..")}function $U($,Z,J,Q){try{return G1(l($,J,Q))===G1(l(Z,J,Q))}catch{try{return G1($)===G1(Z)}catch{return!1}}}function ZU($,Z,J,Q){if($==="."||$==="./"||$===".\\")return!0;try{return G1(l(N$(Z,$),J,Q))===G1(l(Z,J,Q))}catch{try{return G1(N$(Z,$))===G1(Z)}catch{return!1}}}function JU($,Z,J,Q,X,K,W){let Y=J??Z;if(!X&&($.startsWith("~")||$.startsWith("$HOME")||$.startsWith("${HOME}")))return!1;if(Q)return!1;if($.startsWith("/")||/^[A-Za-z]:[\\/]/.test($))try{return t6($,Z,K,W)}catch{return!1}if($.startsWith("./")||$.startsWith(".\\")||!$.includes("/")&&!$.includes("\\"))try{return t6(N$(Y,$),Z,K,W)}catch{return!1}if($.startsWith("../"))return!1;try{return t6(N$(Y,$),Z,K,W)}catch{return!1}}function t6($,Z,J,Q){try{return G5(l($,J,Q),l(Z,J,Q))}catch{return!1}}function QU($,Z,J,Q){if(!Z)return!1;try{return G5(l(Z,J,Q),l($,J,Q))}catch{return!0}}function G5($,Z){let J=G1($),Q=G1(Z);return J.startsWith(`${Q}${e6}`)||J===Q}var XU=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),H5="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",KU="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",j5="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",_5="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",WU="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",YU="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function O5($,Z,J,Q=c0({...J,allowPaths:J.policy?.destructiveCommandAllowPaths})){return BU($.words.map((X)=>({kind:"word",text:X.text,dynamic:X.provenance!=="literal"})),Z,Q,J.policy)}function BU($,Z,J,Q){let X=$.filter((B)=>B.kind==="word"),K=UU(X),W=X[K];if(!W||!XU.has(NU(W.text)))return null;let Y=qU(X.slice(K+1));if(Y.whatIfProtected)return null;if(o(Q,"powershell.remove-item-pipeline-dynamic-target",J.strict)&&Z&&(Y.targets.length===0||Y.recursive))return N("powershell.remove-item-pipeline-dynamic-target",YU);for(let B of Y.targets)if(!h0(B.text)&&Z9(Q9(B.text)))return N(Y.recursive&&Y.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",_5);for(let B of Y.targets)if(J.resolvedCwd&&k0(Q9(B.text),J.resolvedCwd,J.protectedGitMetadata,Y.recursive,J.pathCanonicalizationContext,!0))return N("powershell.remove-item-git-metadata",C1);if(!Y.recursive||!Y.force)return null;if(o(Q,"powershell.remove-item-recursive-force-dynamic-target",J.strict)&&(Y.hasDynamicTarget||Y.targets.length===0))return N("powershell.remove-item-recursive-force-dynamic-target",j5);for(let B of Y.targets){let q=VU(k1(Q9(B.text),J),J,Q);if(q)return q}return null}function qU($){let Z=[],J=!1,Q=!1,X=!1,K=!1,W=!1;for(let Y=0;Y<$.length;Y++){let B=$[Y];if(!B||B.kind!=="word")continue;if(GU(B))continue;if(W){Z.push(J9(B)),K=K||B.dynamic;continue}if(B.text==="--"){W=!0;continue}let q=jU(B.text);if(!q){Z.push(J9(B)),K=K||B.dynamic;continue}if(_U(q.name)){let U=q.value?HU(q.value,B):$[++Y];if(U?.kind==="word")Z.push(J9(U)),K=K||U.dynamic;else K=!0;continue}if(OU(q.name)){J=!0;continue}if(LU(q.name)){Q=!0;continue}if(MU(q.name))X=FU(q.value)}return{targets:Z,recursive:J,force:Q,whatIfProtected:X,hasDynamicTarget:K}}function UU($){let Z=$[0];if(Z?.kind==="word"&&Z.text==="&"||Z?.text===".")return $.length>1?1:0;return 0}function J9($){return{text:$.kind==="word"?$.text:"",dynamic:$.kind==="word"&&$.dynamic}}function GU($){return $.kind==="word"&&$.text===","}function Q9($){let Z=$.replace(/\\/g,"/"),J=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(Z);return J?`$HOME${Z.slice(J[0].length)}`:Z}function HU($,Z){return{kind:"word",text:$,dynamic:Z.kind==="word"&&(Z.dynamic||$.includes("$"))}}function jU($){if(!$.startsWith("-")||$==="-")return null;let Z=$.slice(1),J=Z.indexOf(":");if(J===-1)return{name:Z.toLowerCase()};return{name:Z.slice(0,J).toLowerCase(),value:Z.slice(J+1)}}function _U($){return"path".startsWith($)||"literalpath".startsWith($)}function OU($){return"recurse".startsWith($)}function LU($){return $.length>=2&&"force".startsWith($)}function MU($){return $==="wi"||"whatif".startsWith($)}function FU($){if($===void 0||$==="")return!0;let Z=$.toLowerCase();return Z==="$true"||Z==="true"}function NU($){return $.toLowerCase()}function VU($,Z,J){switch($.kind){case"root_or_home_target":return N("powershell.remove-item-recursive-force-root-or-home",_5);case"git_metadata_target":return N("powershell.remove-item-git-metadata",C1);case"temp_target":return null;case"dynamic_target":if(!o(J,"powershell.remove-item-recursive-force-dynamic-target",Z.strict))return null;return N("powershell.remove-item-recursive-force-dynamic-target",j5);case"home_cwd_target":return N("powershell.remove-item-recursive-force-home-cwd",WU);case"cwd_self_target":return N("powershell.remove-item-recursive-force-cwd-self",H5);case"within_anchored_cwd":if(!o(J,"powershell.remove-item-recursive-force-paranoid",Z.paranoid))return null;return N("powershell.remove-item-recursive-force-paranoid",KU);case"outside_anchored_cwd":return N("powershell.remove-item-recursive-force-outside-cwd",H5)}}import{normalize as j3}from"node:path";function x1($,Z){let J=Z.policy??{rules:[],transparentWrappers:[]};return X9([...$],Z.environment,Z.cwd,Z.cwd,new Map,new Map(Z.envAssignments??[]),J,{iterations:0},!1)}function*X9($,Z,J,Q,X,K,W,Y,B){let q=u6($,Z,J,K);if(q.unverifiableEnvSplit)throw new p0;for(let[H,_]of q.envAssignments)K.set(H,_),X.set(H,_);let{tokens:U,cwd:G}=q;if(B2(U[0]??""))throw new A1;let j=d4(U,W);if(j){for(let H of[j.childIndex,...j.alternativeChildIndices])L5(Y),yield*X9(H===j.childIndex?j.tokens:[...U.slice(H)],Z,G,Q,new Map(X),new Map(K),W,Y,!0);return}if(DU(U)){L5(Y),yield*X9([...U.slice(1)],Z,G,Q,X,K,W,Y,B);return}yield RU(U,G,Q,X,K,B)}function RU($,Z,J,Q,X,K){return{tokens:$,cwd:Z===null?void 0:Z??J,wrapperCwd:Z,wrapperEnvAssignments:Q,envAssignments:X,head:h($[0]??"").toLowerCase(),wrappedByTransparent:K}}function L5($){if($.iterations>=Y$)throw new A1;$.iterations++}function DU($){return h($[0]??"").toLowerCase()==="busybox"&&$.length>1}function K9($,Z){let J=[],Q=Z;while(Q<$.length){let X=$[Q];if(X===void 0||X===":::")break;J.push(X),Q++}return{markerIndex:Q<$.length&&$[Q]===":::"?Q:-1,templateTokens:J}}function _0($){let Z=!1,J=!1;for(let Q of $){if(Q==="--")break;if(Q==="-r"||Q==="-R"||W9(Q,"recursive"))Z=!0;else if(Q==="-f"||W9(Q,"force"))J=!0;else if(Q.startsWith("-")&&!Q.startsWith("--")){if(Q.includes("r")||Q.includes("R"))Z=!0;if(Q.includes("f"))J=!0}}return Z&&J}function M5($){let Z=$.indexOf("--");return $.slice(1,Z===-1?void 0:Z).some((J)=>W9(J,"recursive")||/^-[A-Za-z]+$/.test(J)&&/[rR]/.test(J.slice(1)))}function W9($,Z){return $.length>2&&$.startsWith("--")&&Z.startsWith($.slice(2))}var zU="find -delete permanently removes files. Use -print first to preview.",IU="find -exec rm -rf is dangerous. Use explicit file list instead.",bU=new Set(["-exec","-execdir","-ok","-okdir"]),fU=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map(($)=>[$,1]),["-fprintf",2]]);function Q3($,Z){let J=$.map(S),Q=PU($,J,Z);if(Q)return Q;if(K3(J,1)&&!AU($,J,Z)){let W=T(N("find.delete",zU),Z.policy);if(W)return W}let X=Z.derivedCommandWorkBudget??r4(),K=0;while(K<J.length){let W=J[K],Y=f0(W??"");if(Y>0){K+=Y+1;continue}if(!O0(W)){K++;continue}o1(X,J.length-K-1);let B=L2(J,K);K=B.nextIndex;let q=TU(B.tokens,Z.environment);if(q){let H=T(q,Z.policy);if(H)return H}let U=W==="-execdir"||W==="-okdir",G=Z.analyzeTokens?Z.analyzeTokens(B.tokens,U?null:Z.cwd):Z.analyzeNested?Z.analyzeNested(B.tokens.join(" "),{effectiveCwd:U?void 0:Z.cwd,envAssignments:Z.envAssignments}):null,j=G?.id.startsWith("custom.")?G:T(G,Z.policy);if(j)return j}return null}function PU($,Z,J){if(!K3(Z,1)&&!Y9(Z,J.environment))return null;let X=X3($)??g(["."]),K=c0({...J,allowPaths:J.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let W of X){let Y=O2(W);for(let B of Y.expandedTargets??[S(W)]){let q=k1(B,K,{targetIsLiteral:Y.expandedTargets!==void 0||Y.targetIsLiteral,tmpdirWordSplittingProtected:Y.tmpdirWordSplittingProtected});if(q.kind==="root_or_home_target")return N("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(q.kind==="git_metadata_target")return N("find.delete-git-metadata",C1)}}if(CU(Z)&&K.resolvedCwd&&R7(X.map(S),K.resolvedCwd,K.protectedGitMetadata,K.pathCanonicalizationContext))return N("find.delete-git-metadata",C1);return null}function Y9($,Z){let J=0;while(J<$.length){if(!O0($[J])){J++;continue}let Q=L2($,J),X=P1([...Q.tokens],Z),K=h(X[0]??"").toLowerCase();if((K==="rm"||K==="rmdir")&&X.some((W)=>W.includes("{}")))return!0;J=Q.nextIndex}return!1}function CU($){return $.some((Z,J)=>{if(!["-name","-iname"].includes(Z))return!1;return $[J+1]?.toLowerCase()==="hooks"})}function AU($,Z,J){if(Z.includes("-L")||Z.includes("-f")||Z.includes("-follow"))return!1;let Q=X3($);if(!Q)return!1;let X=J.envAssignments??new Map,K=n6(X,J.environment),W=J.trustedTmpdirValue??j0(X,J.environment),Y=J.allowTmpdirVar??!H2(X,J.environment),B=c0({environment:J.environment,protectedGitMetadata:J.protectedGitMetadata,cwd:J.cwd,originalCwd:J.originalCwd,strict:J.strict,allowTmpdirVar:Y&&W&&Boolean(K),allowPaths:J.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:J.tmpdirWordSplittingUnsafe??t1(X,J.environment),trustedTmpdirValue:W});return Q.every((q)=>{let U=O2(q);if(U.unsafeBraceExpansion)return!1;return(U.expandedTargets??[S(q)]).every((G)=>B5(G,B,{containmentTarget:EU(G,K),targetIsLiteral:U.expandedTargets!==void 0||U.targetIsLiteral,tmpdirWordSplittingProtected:U.tmpdirWordSplittingProtected}))})}function EU($,Z){if(!Z)return $;return $.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>Z)}function X3($){let Z=(X)=>{let K=$[X];return K?S(K):void 0},J=1;while(Z(J)==="-H"||Z(J)==="-P")J++;if(Z(J)==="--")J++;let Q=[];while(J<$.length){let X=Z(J),K=$[J];if(!X||!K||X.startsWith("-")||["!","(",")"].includes(X))break;Q.push(K),J++}return Q.length>0?Q:null}function TU($,Z){let J=P1([...$],Z);if(J.length===0)return null;let Q=h(J[0]??"");if(Q==="busybox"&&J.length>1)J=J.slice(1),Q=h(J[0]??"");if(Q==="rm"&&_0(J))return N("find.exec-rm-recursive-force",IU);return null}function L2($,Z){let J=Z+1;while(J<$.length&&$[J]!==";"&&!($[J]==="+"&&$[J-1]==="{}"))J++;return{tokens:$.slice(Z+1,J),nextIndex:Math.min(J+1,$.length)}}function K3($,Z){let J=Z;while(J<$.length){let Q=$[J];if(!Q){J++;continue}if(O0(Q)){J=L2($,J).nextIndex;continue}let X=f0(Q);if(X>0){J+=X+1;continue}if(Q==="-delete")return!0;J++}return!1}function f0($){return fU.get($)??(/^-newer[A-Za-z]{2}$/.test($)?1:0)}function O0($){return $!==void 0&&bU.has($)}function*B9($){for(let Z of $.nodes)yield*yU(Z)}function SU($){return Object.freeze([...B9($)])}function xV($){return Object.freeze(SU($).map((Z)=>Object.freeze(Z.words.map((J)=>J.text))))}function M2($){let Z=v1($,"posix");if(Z.status!=="complete"||Z.nodes.length!==1)return null;let J=Z.nodes[0];if(J?.kind!=="command")return null;if(J.redirections.length>0||J.nested.length>0)return null;if(J.words.some((Q)=>Q.provenance==="command-substitution"))return null;return J.words.map((Q)=>Q.text)}function*yU($){if($.kind==="command"){yield $;for(let Z of $.nested)yield*B9(Z);return}if($.kind==="group")yield*B9($.body)}var wU=5,q9="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function H1($){let Z=$.indexOf("--");if(Z===-1)return{index:-1,before:$,after:[]};return{index:Z,before:$.slice(0,Z),after:$.slice(Z+1)}}function N5($,Z,J){let Q=R5($,Z,J),X=vU(Q.entries);if(X.size===0)return{blockedReason:Q.blockedReason,expanded:!1,tokens:$};let K=$,W=!1;for(let Y=0;Y<wU;Y++){let{subcommand:B,rest:q}=l1(K),U=B?.toLowerCase();if(!U||!X.has(U))return{blockedReason:Q.blockedReason,expanded:W,tokens:K};let G=X.get(U),j=xU(G);if(j===null||j.length===0)return{blockedReason:q9,expanded:!0,tokens:K};K=["git",...j,...q],W=!0}return{blockedReason:q9,expanded:!0,tokens:K}}function V5($,Z,J){return R5($,Z,J).entries.some((Q)=>Q.key.toLowerCase()==="core.sshcommand")}function l1($){if($.length===0)return{subcommand:null,rest:[]};let Z=$[0];if((Z?h(Z).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let Q=1;while(Q<$.length){let X=$[Q];if(!X)break;if(X==="--"){let K=$[Q+1];if(K&&!K.startsWith("-"))return{subcommand:K,rest:$.slice(Q+2)};return{subcommand:null,rest:$.slice(Q+1)}}if(X.startsWith("-"))if(r1.has(X))Q+=2;else if(X.startsWith("-c")&&X.length>2)Q++;else if(X.startsWith("-C")&&X.length>2)Q++;else Q++;else return{subcommand:X,rest:$.slice(Q+1)}}return{subcommand:null,rest:[]}}function vU($){let Z=new Map;for(let J of $){let Q=J.key.toLowerCase();if(!Q.startsWith("alias."))continue;let X=Q.slice(6);if(X!=="")Z.set(X,J.value)}return Z}function R5($,Z,J){if($.length===0)return{blockedReason:null,entries:[]};let Q=$[0];if((Q?h(Q).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let K=hU(Z,J);return{blockedReason:K.blockedReason,entries:[...K.entries,...uU($,Z,J)]}}function uU($,Z,J){let Q=[],X=1;while(X<$.length){let K=$[X];if(!K||K==="--"||!K.startsWith("-"))return Q;if(K==="-c"){let W=U9($[X+1]);if(W)Q.push(W);X+=2;continue}if(K.startsWith("-c")&&K.length>2){let W=U9(K.slice(2));if(W)Q.push(W);X++;continue}if(K==="--config-env"){let W=F5($[X+1],Z,J);if(W)Q.push(W);X+=2;continue}if(K.startsWith("--config-env=")){let W=F5(K.slice(13),Z,J);if(W)Q.push(W);X++;continue}if(r1.has(K)){X+=2;continue}X++}return Q}function hU($,Z){let J=gU($,Z),Q=kU($,Z);return{blockedReason:J===null||Q===null?q9:null,entries:[...J??[],...Q??[]]}}function gU($,Z){let J=f1("GIT_CONFIG_PARAMETERS",$,Z);if(J===void 0)return[];let Q=[],X=M2(J);if(!X)return null;for(let K of X){let W=U9(K);if(!W)return null;Q.push(W)}return Q}function kU($,Z){let J=z4($,Z);if(J.state==="absent")return[];if(J.state==="invalid")return null;let Q=[];for(let X=0;X<J.count;X++){let K=f1(`GIT_CONFIG_KEY_${X}`,$,Z)?.trim(),W=f1(`GIT_CONFIG_VALUE_${X}`,$,Z);if(!K||W===void 0)return null;Q.push({key:K,value:W})}return Q}function U9($){if(!$)return null;let Z=$.indexOf("=");return{key:(Z===-1?$:$.slice(0,Z)).trim(),value:Z===-1?void 0:$.slice(Z+1)}}function F5($,Z,J){let Q=$?.indexOf("=")??-1;if(!$||Q===-1)return null;return{key:$.slice(0,Q).trim(),value:f1($.slice(Q+1),Z,J)}}function xU($){let Z=$?.trimStart();if(!Z||Z.startsWith("!"))return null;return M2(Z)}var lU="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mU="git checkout --force discards uncommitted changes. Use 'git stash' first.",pU="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",cU="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",dU="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",iU="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",sU="git switch --force discards uncommitted changes. Use 'git stash' first.",rU="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",nU="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",aU="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",oU="git reset --merge can lose uncommitted changes. Use 'git stash' first.",tU="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",eU="git push --force destroys remote history. Use --force-with-lease for safer force push.",$G="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",ZG="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",JG="git branch -D force-deletes without merge check. Use -d for safe delete.",QG="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",XG="git merge --abort discards merge conflict resolutions. Use 'git status' first.",KG="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",WG="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",YG="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",BG="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",qG="git worktree remove --force can delete uncommitted changes. Remove --force flag.",D5=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),z5=new Set(["--recurse-submodules","--track","-t"]),G9=new Set(["-b","-B","-U"]),H9=new Set(["-c","-C"]),UG=new Set(["--source","--conflict","--unified","--inter-hunk-context"]),GG=new Set(["-q","--quiet","--no-quiet","-f","--force","--no-force","-d","--detach","--no-detach","-m","--merge","--no-merge","-p","--patch","--no-patch","--guess","--no-guess","--overlay","--no-overlay","--ours","--theirs","--ignore-skip-worktree-bits","--no-ignore-skip-worktree-bits","--no-track","--overwrite-ignore","--no-overwrite-ignore","--ignore-other-worktrees","--no-ignore-other-worktrees","--progress","--no-progress","--pathspec-file-nul","--no-pathspec-file-nul","--no-recurse-submodules"]);function p($,Z){let J=$.split("=",1)[0]??$;return J.length>=4&&Z.startsWith(J)&&J.startsWith("--")&&J.slice(2).length>=2}function b5($){let{subcommand:Z,rest:J}=l1($);if(!Z)return null;switch(Z.toLowerCase()){case"checkout":return d0(HG(J));case"switch":return d0(jG(J));case"restore":return d0(OG(J));case"reset":return MG(J);case"clean":return d0(NG(J));case"push":return i0(VG(J));case"branch":return i0(zG(J));case"stash":return i0(CG(J));case"worktree":return i0(AG(J));case"rebase":return d0(IG(J));case"merge":return d0(bG(J));case"tag":return i0(fG(J));case"reflog":return i0(PG(J));default:return null}}function d0($){return $?{...$,localDiscard:!0}:null}function i0($){return $?{...$,localDiscard:!1}:null}function HG($){let{index:Z,before:J}=H1($),Q=L1(J,{shortOptsWithValue:G9});if(J.some((K)=>p(K,"--force"))||Q.has("-f"))return N("git.checkout-force",mU);for(let K of $){if(K==="-b"||K==="-B"||K==="--orphan")return null;if(p(K,"--pathspec-from-file"))return N("git.checkout-pathspec-from-file",cU)}if(Z!==-1){if(J.some((W)=>!W.startsWith("-")))return N("git.checkout-ref-path",pU);return N("git.checkout-double-dash",lU)}if(_G($).length>=2)return N("git.checkout-ambiguous",dU);return null}function jG($){let{before:Z}=H1($);if(Z.some((Q)=>p(Q,"--discard-changes")))return N("git.switch-discard-changes",iU);let J=L1(Z,{shortOptsWithValue:H9});if(Z.some((Q)=>p(Q,"--force"))||J.has("-f"))return N("git.switch-force",sU);return null}function _G($){let Z=[],J=0;while(J<$.length){let Q=$[J];if(!Q)break;if(Q==="--")break;if(Q.startsWith("-"))if(D5.has(Q))J+=2;else if(Q.startsWith("--")&&Q.includes("="))J++;else if(z5.has(Q)){let X=$[J+1];if(X&&!X.startsWith("-")&&(Q==="--recurse-submodules"||Q==="--track"||Q==="-t"))if((Q==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"]).includes(X))J+=2;else J++;else J++}else if(Q.startsWith("--")&&!GG.has(Q)&&!D5.has(Q)&&!z5.has(Q))J++;else J++;else Z.push(Q),J++}return Z}function OG($){let Z=LG($);if(Z.isTerminal||!Z.hasPathspec&&!Z.hasPatch||!Z.hasWorktree)return null;return Z.hasExplicitLocation?N("git.restore-worktree",nU):N("git.restore-unstaged",rU)}function LG($){let Z=!1,J=!1,Q=!0,X=!1,K=(W)=>{if(!X)Q=!1,X=!0;if(W!==void 0)Q=W};for(let W=0;W<$.length;W++){let Y=$[W];if(Y===void 0)break;if(Y==="--"){Z||=W+1<$.length;break}if(Y==="--pathspec-from-file"){Z=!0,W++;continue}if(Y.startsWith("--pathspec-from-file=")){Z=!0;continue}if(Y==="-h"||Y==="--help"||Y==="--version")return{hasPathspec:Z,hasPatch:J,hasWorktree:Q,hasExplicitLocation:X,isTerminal:!0};if(Y==="--staged"){K();continue}if(Y==="--no-staged"){K();continue}if(Y==="--worktree"){K(!0);continue}if(Y==="--no-worktree"){K(!1);continue}if(Y==="--patch"){J=!0;continue}if(Y==="--no-patch"){J=!1;continue}if(UG.has(Y)){W++;continue}if(Y.startsWith("--"))continue;if(Y==="-"){Z=!0;continue}if(!Y.startsWith("-")){Z=!0;continue}for(let B=1;B<Y.length;B++){let q=Y.charAt(B);if(q==="h")return{hasPathspec:Z,hasPatch:J,hasWorktree:Q,hasExplicitLocation:X,isTerminal:!0};if(q==="S"){K();continue}if(q==="W"){K(!0);continue}if(q==="p"){J=!0;continue}if(q==="s"||q==="U"){if(B===Y.length-1)W++;break}}}return{hasPathspec:Z,hasPatch:J,hasWorktree:Q,hasExplicitLocation:X,isTerminal:!1}}function MG($){let Z=null;for(let J of $){if(p(J,"--hard")){Z=N("git.reset-hard",aU);break}if(p(J,"--merge")){Z=N("git.reset-merge",oU);break}}if(!Z)return null;return FG($)?i0(Z):d0(Z)}function FG($){for(let Z of $){if(Z==="--")return!1;if(!Z.startsWith("-"))return!0}return!1}function NG($){for(let J of $)if(J==="-n"||p(J,"--dry-run"))return null;let Z=L1($.filter((J)=>J!=="--"));if($.some((J)=>p(J,"--force"))||Z.has("-f"))return N("git.clean-force",tU);return null}function VG($){let{before:Z,after:J}=H1($),Q=L1(Z);if(Z.some((W)=>p(W,"--mirror")))return N("git.push-mirror",ZG);if(Z.some((W)=>p(W,"--force"))||Q.has("-f")||I5(Z,J).some(RG))return N("git.push-force",eU);if(Z.some((W)=>p(W,"--delete"))||Q.has("-d")||I5(Z,J).some(DG))return N("git.push-delete",$G);return null}function I5($,Z){return[...$.filter((J)=>J!==""&&!J.startsWith("-")),...Z]}function RG($){return $.startsWith("+")||$.includes(":+")}function DG($){return $.length>1&&$.startsWith(":")}function zG($){let{before:Z}=H1($),J=L1(Z),Q=J.has("-D")||J.has("-d")||Z.some((K)=>p(K,"--delete")),X=J.has("-D")||J.has("-f")||Z.some((K)=>p(K,"--force"));if(Q&&X)return N("git.branch-force-delete",JG);return null}function IG($){let{before:Z}=H1($);return Z.some((J)=>p(J,"--abort"))?N("git.rebase-abort",QG):null}function bG($){let{before:Z}=H1($);return Z.some((J)=>p(J,"--abort"))?N("git.merge-abort",XG):null}function fG($){let{before:Z}=H1($);return L1(Z).has("-d")||Z.some((Q)=>p(Q,"--delete"))?N("git.tag-delete",KG):null}function PG($){return $[0]==="delete"?N("git.reflog-delete",WG):null}function CG($){for(let Z of $){if(Z==="drop")return N("git.stash-drop",YG);if(Z==="clear")return N("git.stash-clear",BG)}return null}function AG($){let{before:Z}=H1($);if(!Z.includes("remove"))return null;let Q=L1(Z);if(Z.some((X)=>p(X,"--force"))||Q.has("-f"))return N("git.worktree-remove-force",qG);return null}import{execFileSync as EG}from"node:child_process";import{existsSync as _9,readFileSync as O9}from"node:fs";import{dirname as TG,isAbsolute as C5,join as j9,resolve as A5}from"node:path";var SG=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"];function E5($,Z,J,Q){let X=yG($,Z,J);if(X!==null)return X;let K=wG(Z,J);if(K!==null)return K;if(e8(J))return!0;return vG(Q)}function yG($,Z,J){let Q=null,X=1;while(X<$.length){let K=$[X];if(!K||K==="--")return Q;if(!K.startsWith("-"))return Q;if(K==="-c"){let W=f5($[X+1]);if(W!==null)Q=W;X+=2;continue}if(K.startsWith("-c")&&K.length>2){let W=f5(K.slice(2));if(W!==null)Q=W;X++;continue}if(K==="--config-env"){let W=P5($[X+1],Z,J);if(W!==null)Q=W;X+=2;continue}if(K.startsWith("--config-env=")){let W=P5(K.slice(13),Z,J);if(W!==null)Q=W;X++;continue}if(r1.has(K))X+=2;else X++}return Q}function wG($,Z){if(f1("GIT_CONFIG_PARAMETERS",$,Z)!==void 0)return!0;let J=z4($,Z);if(J.state==="absent")return null;if(J.state==="invalid")return!0;let Q=null;for(let X=0;X<J.count;X++){let K=f1(`GIT_CONFIG_KEY_${X}`,$,Z),W=f1(`GIT_CONFIG_VALUE_${X}`,$,Z);if(!K?.trim()||W===void 0)return!0;let Y=K.trim().toLowerCase();if(L9(Y))return!0;if(Y!=="submodule.recurse")continue;Q=F2(W)}return Q}function vG($,Z=hG()){let J=uG($);if(J===null||J)return!0;if(Z===null)return!0;try{let Q=EG(Z,["config","--get","submodule.recurse"],{cwd:$,encoding:"utf8",env:gG(process.env),stdio:["ignore","pipe","ignore"]}).trim();return F2(Q)}catch(Q){return!kG(Q)}}function uG($){let Z=xG($);if(Z===null)return null;for(let J of Z){if(!_9(J))continue;if(pG(J))return!0}return!1}function hG(){for(let $ of SG)if(_9($))return $;return null}function gG($){let Z={...$};for(let J of Object.keys(Z))if(o$(J))delete Z[J];return Z}function kG($){return typeof $==="object"&&$!==null&&"status"in $&&$.status===1}function xG($){let Z=$2($);if(Z===null)return null;let J=lG(Z);if(J===null)return null;let Q=mG(J);if(Q===null)return null;return[j9(Q,"config"),j9(J,"config.worktree")]}function lG($){try{let J=O9($,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!J.startsWith("gitdir:"))return $;let Q=J.slice(7).trim();if(Q==="")return null;return C5(Q)?Q:A5(TG($),Q)}catch{return null}}function mG($){let Z=j9($,"commondir");if(!_9(Z))return $;try{let J=O9(Z,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(J==="")return null;return C5(J)?J:A5($,J)}catch{return null}}function pG($){let Z;try{Z=O9($,"utf-8")}catch{return!0}let J="",Q=!1;for(let X of Z.split(/\r?\n/)){let K=X.trim();if(K===""||K.startsWith("#")||K.startsWith(";"))continue;let W=K.match(/^\[([^\]]+)\]$/);if(W){J=W[1]?.trim().toLowerCase()??"";continue}let Y=K.indexOf("="),B=(Y===-1?K:K.slice(0,Y)).trim().toLowerCase(),q=Y===-1?"true":K.slice(Y+1).trim();if(cG(J)&&B==="path")return!0;if(J==="submodule"&&B==="recurse")Q=F2(q)}return Q}function cG($){return $==="include"||$.startsWith("includeif ")}function f5($){if(!$)return null;let Z=$.indexOf("="),J=(Z===-1?$:$.slice(0,Z)).toLowerCase();if(L9(J))return!0;if(J!=="submodule.recurse")return null;let Q=Z===-1?"true":$.slice(Z+1).toLowerCase();return F2(Q)}function F2($){let Z=$.toLowerCase();return Z!=="false"&&Z!=="no"&&Z!=="off"&&Z!=="0"}function P5($,Z,J){let Q=$?.indexOf("=")??-1;if(!$||Q===-1)return null;let X=$.slice(0,Q).toLowerCase();if(L9(X))return!0;if(X!=="submodule.recurse")return null;let K=f1($.slice(Q+1),Z,J);return K===void 0||F2(K)}function L9($){return $==="include.path"||$.startsWith("includeif.")&&$.endsWith(".path")}function T5($,Z,J){if(!Z.localDiscard||!J.worktreeMode||Q7(J.env,J.envAssignments))return null;let Q=X7($,J.cwd);if(!Q.gitCwd||Q.hasExplicitGitContext)return null;if(!K7(Q.gitCwd))return null;if(dG($,J,Q.gitCwd))return null;return{originalReason:Z.reason,gitCwd:Q.gitCwd}}function dG($,Z,J){let{subcommand:Q,rest:X}=l1($),K=Q?.toLowerCase();if(Z.dynamicArguments||iG(X)||E5($,Z.env,Z.envAssignments,J)||nG(X)||sG(K,X))return!0;return K==="clean"&&aG(X)>1}function iG($){return $.some((Z)=>/[$*?[]/.test(Z))}function sG($,Z){if($==="checkout"){let{before:J}=H1(Z),Q=L1(J,{shortOptsWithValue:G9}),X=J.some((W)=>p(W,"--force"))||Q.has("-f"),K=Q.has("-B")||J.some((W)=>W==="-B"||W.startsWith("-B"));return X&&K}if($==="switch"){let{before:J}=H1(Z),Q=L1(J,{shortOptsWithValue:H9}),X=J.some((W)=>p(W,"--force"))||J.some((W)=>p(W,"--discard-changes"))||Q.has("-f"),K=J.some((W)=>W==="-C"||W.startsWith("-C")||rG(W))||Q.has("-C");return X&&K}return!1}function rG($){let Z=$.split("=",1)[0]??$;return Z==="--force-create"||Z.length>=9&&"--force-create".startsWith(Z)}function nG($){return $.some((Z)=>Z.startsWith("--recurse-sub"))}function aG($){let Z=0;for(let J of $){if(J==="--force"){Z++;continue}if(J.startsWith("-")&&!J.startsWith("--")){for(let Q of J.slice(1))if(Q==="f")Z++}}return Z}var oG="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",tG=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function V$($,Z){return S5($.map(S),Z)}function S5($,Z,J){let Q=N5($,Z.env,Z.envAssignments),X=Z.policy?.destructiveCommandRuleOverrides["git.alias-config"]==="off";if(Q.blockedReason&&!X)return N("git.alias-config",Q.blockedReason);let K=Q.tokens;if((t8(Z.envAssignments)||V5($,Z.env,Z.envAssignments))&&eG(K))return N("git.ssh-env",oG);let W=b5(K);if(!W)return null;if(Q.expanded||Q.blockedReason)return W;let Y=T5($,W,Z);if(!Y)return W;return J?.(Y),null}function y5($,Z){let J=null;return{match:S5($.map(S),Z,(X)=>{J=X}),relaxation:J}}function eG($){let{subcommand:Z,rest:J}=l1($),Q=Z?.toLowerCase();if(!Q)return!1;if(tG.has(Q))return!0;if(Q==="archive")return H1(J).before.some((X)=>p(X,"--remote"));return Q==="remote"&&$H(J)}function $H($){return $.find((Z)=>!ZH(Z))?.toLowerCase()==="update"}function ZH($){return $==="-v"||p($,"--verbose")||p($,"--no-verbose")}import{isAbsolute as dH}from"node:path";var w5="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",JH="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QH="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",u5="rm -rf targeting root or home directory is extremely dangerous and always blocked.",XH="rm -rf in home directory is dangerous. Change to a project directory first.";function R$($,Z){let J=c0({...Z,allowPaths:Z.policy?.destructiveCommandAllowPaths,posixShell:!0}),Q=$.map(S),X=_0(Q),K=M5(Q),W=WH($);for(let Y of W){let B=O2(Y.word);if(X&&B.unsafeBraceExpansion){let q=T(v5({kind:"outside_anchored_cwd"},J,Z.policy),Z.policy);if(q)return q;continue}for(let q of B.expandedTargets??[Y.text]){let U={targetIsLiteral:B.expandedTargets!==void 0||B.targetIsLiteral,tmpdirWordSplittingProtected:B.tmpdirWordSplittingProtected};if(!K&&J.resolvedCwd&&k0(q,J.resolvedCwd,J.protectedGitMetadata,K,J.pathCanonicalizationContext))return N("rm.git-metadata",C1);if(K&&!X){let G=k1(q,J,U);if(G.kind==="root_or_home_target")return N("rm.recursive-force-root-or-home",u5);if(G.kind==="git_metadata_target")return N("rm.git-metadata",C1);continue}if(!X)continue;for(let G of KH(q,J,U)){let j=v5(G,J,Z.policy),H=T(j,Z.policy);if(H)return H}}}return null}function KH($,Z,J){let Q=k1($,Z,J);if(Q.kind==="cwd_self_target")return[Q,k1($,Z,{...J,skipCwdSelf:!0})];if(Q.kind!=="home_cwd_target")return[Q];let X=k1($,Z,{...J,skipHomeCwd:!0});if(X.kind!=="cwd_self_target")return[Q,X];return[Q,X,k1($,Z,{...J,skipHomeCwd:!0,skipCwdSelf:!0})]}function WH($){let Z=[],J=!1;for(let Q of $.slice(1)){let X=S(Q);if(!X)continue;if(X==="--"){J=!0;continue}if(J){Z.push({text:X,word:Q});continue}if(!X.startsWith("-"))Z.push({text:X,word:Q})}return Z}function v5($,Z,J){switch($.kind){case"root_or_home_target":return N("rm.recursive-force-root-or-home",u5);case"git_metadata_target":return N("rm.git-metadata",C1);case"temp_target":return null;case"dynamic_target":if(!o(J,"rm.recursive-force-dynamic-target",Z.strict))return null;return N("rm.recursive-force-dynamic-target",QH);case"home_cwd_target":return N("rm.recursive-force-home-cwd",XH);case"cwd_self_target":return N("rm.recursive-force-cwd-self",w5);case"within_anchored_cwd":if(o(J,"rm.recursive-force-paranoid",Z.paranoid))return N("rm.recursive-force-paranoid",JH);return null;case"outside_anchored_cwd":return N("rm.recursive-force-outside-cwd",w5)}}var YH={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},g5=new Set(["--init-file","--rcfile"]),BH=["--init-file","--rcfile"],qH=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function e1($){for(let Z=1;Z<$.length;Z++){let J=$[Z];if(!J)continue;if(J==="-c")return h5($,Z,!0);if(J.startsWith("-")&&J.includes("c")&&!J.startsWith("--")){let Q=h5($,Z,!1);if(Q!==null)return Q}}return null}function E1($){let Z=h($[0]??"").toLowerCase();if(Z==="zsh"||Z==="ksh")return $0($).syntaxCheck;let J=!1;for(let Q of $.slice(1)){if(Q==="--")return J;if(Q.startsWith("+")&&!Q.startsWith("++")){if(Q.slice(1).includes("n"))J=!1;continue}if(!Q.startsWith("-")||Q.startsWith("--"))return J;let X=Q.slice(1);if(X.includes("n"))J=!0;if(X.includes("c"))return J}return J}function h5($,Z,J){if($[Z+1]==="--")return $[Z+2]||null;let Q=$[Z+1];if(!Q||!J&&Q.startsWith("-"))return null;return Q}function k5($){let Z=h($[0]??"").toLowerCase(),J=UH($,Z),Q=qH.get(Z)??null,X=J.argvSource?.kind!=="absent";return{argvSource:Z==="bash"?J.argvSource:null,argvSourceApplies:Z==="bash"&&J.interactive&&J.argvSource?.kind==="literal",envName:Q,envSourceApplies:X&&(Q==="BASH_ENV"?!J.interactive:Q==="ENV"&&J.interactive)}}function UH($,Z){let J=$0($),Q=J.commandIndex??J.scriptIndex??$.length,X=[],K=!1,W=!0;for(let Y=1;Y<Q;Y++){let B=$[Y];if(B===void 0||B==="--"||B==="-"||B[0]!=="-"&&B[0]!=="+")break;if(B.startsWith("--")){if(Z==="bash"&&W?BH.find((j)=>B===j):void 0){let j=$[Y+1];X.push(j===void 0?{kind:"absent"}:{kind:"literal",value:j}),Y++;continue}let G=B.split("=",1)[0]??B;if(Z==="bash"&&g5.has(G)&&!B.includes("="))Y++;continue}if(Z==="bash")W=!1;let q=x5(Z,B,$[Y+1],"startup");if(q.interactive)K=B[0]==="-";Y+=q.followingValues}return{argvSource:X.at(-1)??null,interactive:K}}function x5($,Z,J,Q){let X=!1,K=0,W=!1,Y=!1,B=!1;for(let q=1;q<Z.length;q++){let U=Z[q];if(U===void 0)break;if($==="ksh"&&U==="o"&&q+1<Z.length){if(Q==="argv"){let G=Z.slice(q+1);if(Z[0]==="-"&&(G==="c"||G[0]==="-"&&G.endsWith("c")))W=!0}break}if($==="ksh"&&U==="o"&&q+1===Z.length&&(J?.startsWith("-")||J?.startsWith("+")))break;if($==="zsh"&&U==="o"&&q+1<Z.length)break;if(Q==="startup"&&U==="i")X=Z[0]==="-";if(Q==="argv"&&Z[0]==="-"&&U==="c")W=!0;if(Q==="argv"&&U==="n")B=Z[0]==="-";if(Q==="argv"&&U==="s")Y=Z[0]==="-";if(!YH[$]?.includes(U))continue;if(q+1===Z.length)K++;break}return{interactive:X,followingValues:K,commandSelected:W,stdinMode:Y,syntaxCheck:B}}function $0($){let Z=h($[0]??"").toLowerCase(),J=!1,Q=!1,X=!1;for(let K=1;K<$.length;K++){let W=$[K];if(W===void 0)break;if(W==="--"){let B=J&&$[K+1]!==void 0?K+1:null;return{command:B===null?null:$[B]??null,commandIndex:B,scriptIndex:!J&&!Q&&$[K+1]!==void 0?K+1:null,readsStdinAsCommands:!J&&(Q||$[K+1]===void 0),syntaxCheck:X}}if(W==="-"||W[0]!=="-"&&W[0]!=="+")return{command:J?W:null,commandIndex:J?K:null,scriptIndex:!J&&!Q&&W!=="-"?K:null,readsStdinAsCommands:!J&&(Q||W==="-"),syntaxCheck:X};if(W.startsWith("--")){let B=W.split("=",1)[0]??W;if(Z==="bash"&&g5.has(B)&&!W.includes("="))K++;continue}let Y=x5(Z,W,$[K+1],"argv");if(Y.commandSelected)J=!0;if(Y.syntaxCheck)X=!0;if(Y.stdinMode)Q=!0;K+=Y.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!J,syntaxCheck:X}}var P0={kind:"none"},s0={kind:"dynamic"},GH=new Set(["<","<<","<<-","<<<","<&","<>"]),m5=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,HH=/^(?:[0-9]+|[@*])$/,jH=u0.maxWords,_H=u0.maxInputLength;function p5($){if(!$||h(x($.words[0]?.text??""))!=="printf")return;if($.words.some((X)=>X.provenance!=="literal"))return;let Z=$.words.slice($.words[1]?.text==="--"?2:1),J=Z[0]?.text;if(J===void 0)return"";let Q=Z.slice(1).map((X)=>X.text);if(J==="%s")return Q.join("");if(J==="%s\\n"||J===`%s
-`)return`${Q.join(`
-`)}
-`;if(J.includes("%")||/\\(?![\\nrt])/.test(J))return;return J.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function D$($){let Z=N2($[1])==="--"?2:1;if($.length<=Z)return P0;let J=$.slice(Z);if(!J.every(Y3))return s0;return{kind:"literal",source:J.map(S).join(" ")}}function c5($){let Z=N2($[1])==="--"?2:1,J=$[Z],Q=N2(J);if(J===void 0||$.length<=Z+1||Q==="-"||Q===""||Q==="-l"||Q==="-p")return P0;if(!Y3(J))return s0;return{kind:"literal",source:Q}}function W3($,Z){let J=OH($);if(J===-1)return P0;let Q=LH(Z);if(!Q)return P0;let X=[],K=Q.command?.length??0;for(let W of Q.references){let Y=FH(W,$,J,Q.ifs);if(!Y)return s0;if(K+=Y.reduce((B,q)=>B+q.length+3,0),X.length+Y.length>jH||K>_H)return s0;X.push(...Y)}if(Q.command==="eval")return{kind:"literal",source:X.join(" ")};if(X.length===0||/\s/.test(X[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[Q.command,Q.command&&Q.optionTerminator?"--":null,...X.map(VH)].filter((W)=>W!==null).join(" ")}}function d5($,Z,J,Q){if(!$0($.map(S)).readsStdinAsCommands)return P0;let X=Z.filter((K)=>(K.fd===void 0||K.fd===0)&&GH.has(K.operator)).at(-1);if(X){if(X.operator==="<<"||X.operator==="<<-")return P0;if(X.operator!=="<<<"||X.target?.provenance!=="literal")return s0;return{kind:"literal",source:X.target.text}}if(!J)return P0;return Q===void 0?s0:{kind:"literal",source:Q}}function Z0($){let Z=$0($.map(S)).scriptIndex;if(Z===null)return P0;let J=$[Z],Q=N2(J);return C4(J,Q)?{kind:"literal",source:Q}:s0}function OH($){return $0($.map(S)).commandIndex??-1}function LH($){let Z=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec($.trim()),J=Z?.[4]??$.trim(),Q=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(J),X=(Q?.[3]??J).split(/\s+/).map(MH);if(X.length===0||X.some((K)=>K===null))return null;return{command:Q?.[1]??null,optionTerminator:Q?.[2]!==void 0,references:X.filter((K)=>!!K),ifs:Z?Z[1]??Z[2]??Z[3]??"":` 	
-`}}function MH($){let Z=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec($),J=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec($),Q=Z??J;if(!Q)return null;let X=Q[1]??Q[2];return{parameter:X==="@"||X==="*"?X:Number(X),quoted:Z!==null}}function FH($,Z,J,Q){let X=Z.slice(J+2);if($.parameter==="@")return $.quoted?M9(X):NH(X,Q);if($.parameter==="*"){let Y=M9(X);if(!Y)return;let B=Y.join(Q[0]??"");return $.quoted?[B]:F9(B,Q)}let K=Z[J+1+$.parameter];if(K&&!Y3(K))return;let W=N2(K);return $.quoted?[W]:F9(W,Q)}function M9($){return $.every(Y3)?$.map(S):void 0}function NH($,Z){let J=M9($);if(!J)return;let Q=J.map((X)=>F9(X,Z));return Q.some((X)=>X===void 0)?void 0:Q.flatMap((X)=>X??[])}function F9($,Z){if(["*","?","[","]"].some((J)=>$.includes(J)))return;if(Z==="")return $===""?[]:[$];if(Z===` 	
-`)return $.trim().split(/\s+/).filter(Boolean);if(Z.length!==1)return;return Z===" "||Z==="\t"||Z===`
-`?$.trim().split(/\s+/).filter(Boolean):$.split(Z).filter(Boolean)}function Y3($){if(!$)return!0;return $.provenance==="unknown"?!/[$`]/.test(S($)):$.provenance==="literal"}function N2($){return $?S($):""}function VH($){return`'${$.replaceAll("'",`'"'"'`)}'`}function V9($,Z){return N9(v1($,"posix"),Z)}function z$($){return V9($,new Set(Array.from($.matchAll(m5)).flatMap((Z)=>{let J=Z[1]??Z[2];return J===void 0?[]:[J]})))}function N9($,Z){if($.status==="invalid"||$.status==="limited")return!1;let J=new Set(Z);for(let Q of $.nodes){if(Q.kind==="group"){if(N9(Q.body,J))return!0;continue}if(Q.kind!=="command")continue;if(Q.nested.some((X)=>N9(X,J))||i5(Q.words,J))return!0;bH(Q,J)}return!1}function i5($,Z){let J=$.findIndex((W)=>n1(W.text)===null);if(J===-1)return!1;let Q=$[J];if(!Q)return!1;if(V2(Q,Z))return!0;let X=x(Q.text);if(X==="source"||X==="."){let W=$[J+1]?.text==="--"?J+2:J+1;return l5($[W],Z)}if($1.has(X)){let W=$.slice(J),Y=$0(W.map((q)=>q.text)),B=Y.commandIndex??Y.scriptIndex;return!Y.syntaxCheck&&B!==null&&l5(W[B],Z)}let K=RH($,J,Z);if(K===null)return!1;if(K===-1)return!0;return i5($.slice(K),Z)}function RH($,Z,J){let Q=x($[Z]?.text??"");if(Q==="command")return DH($,Z+1);if(Q==="exec")return zH($,Z+1);if(Q==="env")return IH($,Z+1,J);return null}function DH($,Z){for(let J=Z;J<$.length;J++){let Q=$[J]?.text??"";if(Q==="--")return $[J+1]?J+1:null;if(/^-[p]*[vV][pvV]*$/.test(Q))return null;if(/^-p+$/.test(Q))continue;return J}return null}function zH($,Z){for(let J=Z;J<$.length;J++){let Q=$[J]?.text??"";if(Q==="--")return $[J+1]?J+1:null;if(Q==="-a"){J++;continue}if(/^-a.+/.test(Q)||/^-[cl]+$/.test(Q))continue;return J}return null}function IH($,Z,J){for(let Q=Z;Q<$.length;Q++){let X=$[Q],K=X?.text??"";if(K==="--")return $[Q+1]?Q+1:null;if(K==="-S"||K==="--split-string")return V2($[Q+1],J)?-1:Q+2;if(K.startsWith("-S")||K.startsWith("--split-string="))return V2(X,J)?-1:Q+1;if(K==="-u"||K==="--unset"||K==="-C"||K==="--chdir"||K==="-P"){Q++;continue}if(K==="-i"||K==="-0"||K==="--null"||K.startsWith("-u=")||K.startsWith("--unset=")||K.startsWith("-C")||K.startsWith("--chdir=")||K.startsWith("-P"))continue;if(K.startsWith("-"))continue;if(n1(K))continue;return Q}return null}function bH($,Z){if(!$.words.every((J)=>n1(J.text)!==null))return;for(let J of $.words){let Q=n1(J.text);if(!Q)continue;if(V2(J,Z))Z.add(Q.name)}}function V2($,Z){if(!$)return!1;return $.parts.filter((J)=>J.provenance==="variable").some((J)=>Array.from(J.raw.matchAll(m5)).some((Q)=>{let X=Q[1]??Q[2];return X!==void 0&&(HH.test(X)||Z.has(X))}))}function l5($,Z){return!!$&&($.parts.some((J)=>J.provenance!=="literal"&&J.provenance!=="variable")||V2($,Z))}var fH=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--config-env"]),PH=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),CH=new Set;function s5($){if($==="git")return fH;if($==="docker")return PH;return CH}function Q1($,Z){if($.length===0||Z.length===0)return null;let J=x($[0]??""),Q=L1($);for(let X of Z){if(!AH(J,X.command))continue;if(!EH(J,$,X.subcommand))continue;if(SH($,new Set(X.block_args),Q))return{id:`custom.${X.name}`,reason:`[${X.name}] ${X.reason}`,intent:X.intent??"manual_only"}}return null}function AH($,Z){return $===x(Z)}function EH($,Z,J){if(!J)return!0;return r5(Z,1,J,s5($))}function r5($,Z,J,Q){let X=!1;for(let K=Z;K<$.length;K++){let W=$[K];if(!W)continue;if(X){X=!1;continue}if(W==="--"){let Y=$[K+1];if(Y&&!Y.startsWith("-"))return Y===J;return!1}if(Q.has(W)){X=!0;continue}if(W.startsWith("-")){if(!W.includes("=")&&TH($,K,J,Q))return!0;continue}return W===J}return!1}function TH($,Z,J,Q){let X=$[Z+1];if(!X||X.startsWith("-"))return!1;return r5($,Z+2,J,Q)}function SH($,Z,J){for(let Q of $)if(Z.has(Q))return!0;for(let Q of J)if(Z.has(Q))return!0;return!1}function C0($,Z,J={}){if($.length===0)return null;let Q=$[0];if(!Q)return null;let X=x(Q);if(X==="eval"){let K=D$(g($));if(K.kind==="dynamic")return I$(J,Z);if(K.kind==="literal"&&Z.analyzeNested){let W=Z.analyzeNested(K.source,{effectiveCwd:Z.cwd,envAssignments:Z.envAssignments});if(W)return W}return J0(J,Z)}if($1.has(X)){if(E1($))return null;let K=e1($);if(K){if(J.dynamicSourceInput??J.dynamicInput){let B=I$(J,Z);if(B)return B}if(z$(K)){let B=I$(J,Z);if(B)return B}if(!Z.analyzeNested)return null;let Y=Z.analyzeNested(K,{effectiveCwd:Z.cwd,envAssignments:Z.envAssignments});if(Y)return Y;return null}let W=Z0(g($));if(W.kind==="dynamic")return I$(J,Z);if(W.kind==="literal"){if(J.dynamicSourceInput)return I$(J,Z);return null}if(J.dynamicSourceInput??J.dynamicInput)return I$(J,Z);return null}if(N1.has(X))return T(v4($,(K)=>Z.analyzeNested?Z.analyzeNested(K,{effectiveCwd:Z.cwd,envAssignments:Z.envAssignments}):null),Z.policy)??Q1($,Z.policy?.rules??[])??J0(J,Z);if(V1(X)){let K=x4($);if(!K)return J0(J,Z);if(o(Z.policy,"interpreter.one-liner-paranoid",!!Z.paranoidInterpreters)){let Y=T(N("interpreter.one-liner-paranoid",M$),Z.policy);if(Y)return Y}if(p4(X,K))return J0(J,Z);let W=Z.analyzeNested?.(K,{effectiveCwd:Z.cwd,envAssignments:Z.envAssignments});if(W&&W.id!=="raw-text.dangerous-command"&&(W.reason!==D0||H$(K)))return W;if(F$(K,Z.scanWork))return T(N("interpreter.dangerous-command",l0),Z.policy)??J0(J,Z);return J0(J,Z)}if(X==="rm"||X==="rmdir"){let K=X==="rm"&&(_0($)||J.dynamicRmInput);return T(R$(g($),{environment:Z.environment,cwd:Z.cwd,originalCwd:Z.originalCwd,strict:Z.strict,paranoid:Z.paranoidRm,allowTmpdirVar:Z.allowTmpdirVar,tmpdirWordSplittingUnsafe:t1(Z.envAssignments,Z.environment),trustedTmpdirValue:j0(Z.envAssignments,Z.environment),protectedGitMetadata:Z.protectedGitMetadata,policy:Z.policy}),Z.policy)??(K&&J.dynamicRmInput?J0(J,Z):null)??(K?yH(J,Z):null)}if(X==="find")return Q3(g($),{...Z,derivedCommandWorkBudget:Z.derivedCommandWorkBudget,analyzeTokens:(K,W)=>C0(K,{...Z,cwd:W??void 0,derivedCommandWorkBudget:Z.derivedCommandWorkBudget},J)})??Q1($,Z.policy?.rules??[])??J0(J,Z);if(X==="git")return T(V$(g($),{env:Z.environment.env,cwd:Z.cwd,envAssignments:Z.envAssignments,policy:Z.policy,worktreeMode:J.dynamicInput?!1:Z.worktreeMode}),Z.policy)??Q1($,Z.policy?.rules??[])??J0(J,Z);return Q1($,Z.policy?.rules??[])??J0(J,Z)}function I$($,Z){return $.shellDynamicMatch?T($.shellDynamicMatch,Z.policy):null}function J0($,Z){return $.dynamicSourceInput&&$.dynamicSourceMatch?T($.dynamicSourceMatch,Z.policy):null}function yH($,Z){return $.dynamicInput&&$.rmDynamicMatch?T($.rmDynamicMatch,Z.policy):null}var R9="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",D9="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",wH="__CC_SAFETY_NET_XARGS_INPUT__",B3="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",q3="rm",vH=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uH=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,hH=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,gH=/^(?:[0-9]+|[@*])$/,kH=new Set(["branch","checkout","clean","push","reset","restore","switch","tag"]);function o5($,Z){let J=$.map(S),{childStart:Q,replacementToken:X}=r0(J),K=J.slice(Q),W=N("xargs.shell-dynamic",D9);if(lH(K,X,Z)&&T(W,Z.policy))return T(W,Z.policy);for(let Y of x1(K,Z)){let B=Y.tokens,q=X!==null&&B[0]!==K[0]&&(B[0]?.includes(X)??!1)?T(W,Z.policy):null;if(q)return q;let U=ZJ(B,X,Y.wrapperEnvAssignments),G=Y.head==="rm"&&X!==null&&e5(B,X),j=C0(B,{...Z,cwd:Y.cwd,envAssignments:Y.envAssignments},{dynamicInput:U,dynamicSourceInput:G||t5(B,Y.head,X,Y.wrapperEnvAssignments,U,Z.scanWork,Z.environment),dynamicRmInput:G,shellDynamicMatch:W,dynamicSourceMatch:W,rmDynamicMatch:N("xargs.rm-recursive-force-dynamic",R9)});if(j)return j;let H=xH(B,X,Z.policy?.rules??[]);if(H)return H;if(Y.head==="git"){let O=X===null?[...B,wH]:B,M=X!==null&&(B.some((D)=>D.includes(X))||Array.from(Y.envAssignments.values()).some((D)=>D.includes(X))),L=C0(O,{...Z,cwd:Y.cwd,envAssignments:Y.envAssignments,worktreeMode:X===null||M?!1:Z.worktreeMode});if(L)return L}let _=Q1(B,Z.policy?.rules??[]);if(_)return _}return null}function xH($,Z,J){if(J.length===0)return null;if(Z===null){for(let X of J){let K=Q1([...$,...X.subcommand?[X.subcommand]:[],...X.block_args],J);if(K)return K}return null}let Q=new Set(J.flatMap((X)=>[X.subcommand,...X.block_args].flatMap((K)=>K?$.flatMap((W)=>z9(W,Z,K)):[])));for(let X of Q){let K=Q1($.map((W)=>W.replaceAll(Z,X)),J);if(K)return K}return null}function z9($,Z,J){let Q=$.indexOf(Z);if(Q===-1||$.indexOf(Z,Q+Z.length)!==-1)return[];let X=$.slice(0,Q),K=$.slice(Q+Z.length);return J.startsWith(X)&&J.endsWith(K)?[J.slice(X.length,J.length-K.length)]:[]}function t5($,Z,J,Q,X,K,W){if($1.has(Z)){if(E1($))return!1;if(J!==null&&mH($,J))return!0;let Y=e1($);if(!Y){let B=Z0(g($));if(B.kind==="literal")return J!==null&&B.source.includes(J);return B.kind==="none"&&X}if(J!==null&&Y.includes(J))return!0;if(U2(Y,K))return!0;return pH(Y,J,Q)}if(V1(Z))return n5($,J,m4,u7(Z));if(N1.has(Z))return n5($,J,m6,I7);if(Z==="eval"){let Y=D$(g($));if(Y.kind==="dynamic")return!0;if(J!==null)return Y.kind==="literal"&&Y.source.includes(J);return X}if(Z==="find")return cH($,J,K,W);if(Z==="git"){let Y=l1($);return J===null?Y.subcommand===null:(Y.subcommand?.includes(J)??!1)||Y.subcommand!==null&&kH.has(Y.subcommand.toLowerCase())&&$J(Y.rest,J).some((B)=>B.includes(J))}return!1}function n5($,Z,J,Q){let X=J($);if(Z===null)return X.optionsOpen||J([...$,B3]).sources.some((B)=>B.value===B3);if(X.sources.some((B)=>B.value.includes(Z)))return!0;let K=new Set(X.sources.map((B)=>`${B.tokenIndex}\x00${B.kind}\x00${B.value}`)),W=Q.flatMap((B)=>[B.selector,...B.valueForm==="attached-only"||B.valueForm==="attached-or-separate"?[`${B.selector}${B3}`]:[],...B.valueForm==="equals-or-separate"?[`${B.selector}=${B3}`]:[]]),Y=new Set(W.flatMap((B)=>$.flatMap((q)=>z9(q,Z,B))));return Array.from(Y).some((B)=>J($.map((q)=>q.replaceAll(Z,B))).sources.some((q)=>!K.has(`${q.tokenIndex}\x00${q.kind}\x00${q.value}`)))}function lH($,Z,J){if($.length===0||($[0]??"").toLowerCase()==="command")return!1;let Q=new Set(Array.from(x1($,J),(K)=>K.head)),X=Z===null?[...$,q3]:$.map((K,W)=>W===0?K:K.replaceAll(Z,q3));return Array.from(x1(X,J)).some((K)=>K.head===q3&&!Q.has(q3))}function e5($,Z){return $J($.slice(1),Z).some((J)=>J.includes(Z)&&(J.startsWith("-")||J.startsWith(Z)))}function $J($,Z){let J=$.findIndex((Q)=>Q==="--"&&!Q.includes(Z));return J===-1?$:$.slice(0,J)}function ZJ($,Z,J){if(Z===null)return!0;return $.some((Q)=>Q.includes(Z))||Array.from(J.values()).some((Q)=>Q.includes(Z))}function mH($,Z){let J=$0($);if(J.commandIndex!==null&&($[J.commandIndex]??"").includes(Z)||J.scriptIndex!==null&&($[J.scriptIndex]??"").includes(Z))return!0;return["-c","-nc","-cn",`--${Z}`,Z].some((X)=>$.some((K,W)=>{if(W===0||!K.includes(Z))return!1;return z9(K,Z,X).some((B)=>{let q=$.map((G,j)=>j===W?G.replaceAll(Z,B):G),U=$0(q);if(U.commandIndex===null&&U.scriptIndex===null)return!1;if(J.commandIndex===null&&U.commandIndex!==null)return!0;if(J.scriptIndex===null&&U.scriptIndex!==null)return!0;if(U.commandIndex!==null&&(q[U.commandIndex]??"").includes(B))return!0;return U.scriptIndex!==null&&(q[U.scriptIndex]??"").includes(B)})}))}function pH($,Z,J){let Q=new Set(Z===null?[]:Array.from(J).filter(([,X])=>X.includes(Z)).map(([X])=>X));for(let X of $.matchAll(vH))if(a5(X,Q))return!0;for(let X of $.matchAll(uH))for(let K of(X[1]??"").matchAll(hH))if(a5(K,Q))return!0;return V9($,Q)}function a5($,Z){let J=$[1]??$[2];return J!==void 0&&(gH.test(J)||Z.has(J))}function cH($,Z,J,Q){if(Z===null)return!0;let X=!1,K=0;for(let W=1;W<$.length;W++){let Y=$[W]??"";if(!X&&!Y.startsWith("-")&&Y!=="!"&&Y!=="("){if(Y.indexOf(Z)===0)return!0;continue}if(X=!0,K>0){K--;continue}if(O0(Y)){let q=L2($,W);W=q.nextIndex-1;for(let U of x1(q.tokens,{environment:Q,cwd:void 0})){let G=ZJ(U.tokens,Z,U.wrapperEnvAssignments);if(U.head==="rm"&&e5(U.tokens,Z)||t5(U.tokens,U.head,Z,U.wrapperEnvAssignments,G,J,Q))return!0}continue}let B=f0(Y);if(B>0){if(K=B,Y.includes(Z))return!0;continue}if(Y.includes(Z))return!0}return!1}function r0($){let Z=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),J=null,Q=1;while(Q<$.length){let X=$[Q];if(!X)break;if(X==="--")return{childStart:Q+1,replacementToken:J};if(X.startsWith("-")){if(X==="-I"){J=$[Q+1]??"{}",Q+=2;continue}if(X.startsWith("-I")&&X.length>2){J=X.slice(2),Q++;continue}if(X==="--replace"){J="{}",Q++;continue}if(X.startsWith("--replace=")){let K=X.slice(10);J=K===""?"{}":K,Q++;continue}if(X==="-J"){J=$[Q+1]??"{}",Q+=2;continue}if(Z.has(X))Q+=2;else Q++}else return{childStart:Q,replacementToken:J}}return{childStart:$.length,replacementToken:J}}var R2="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",D2="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",iH="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",sH="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",rH=/\{[^{}\s]*\}/,UJ=/\{\}|\{-?\d+\}/g,nH=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","stash","switch","tag","worktree"]),aH=["e","f","source","file","-e","-f","--source","--file"],oH=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],tH=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),eH=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),JJ=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),$j=new Set(["--workdir","--wd"]),QJ="__CC_SAFETY_NET_PARALLEL_SOURCE__",Zj=new TextEncoder,G3=E.maxDerivedBytes+4*E.maxPlaceholderReplacements;function q1($,Z){for(let J of $){let Q=Z(J);if(Q)return Q}return null}function GJ($,Z){let J=$.map(S);if((Z.envAssignments?.has("PARALLEL")?Z.envAssignments.get("PARALLEL"):Z.environment.env.get("PARALLEL"))?.trim()){let O=a0(Z);if(O)return O}if(J.length===2&&(J[1]==="--version"||J[1]==="--help"))return null;let X=zJ(J),{template:K,jobs:W,runsRemotely:Y,envNames:B,readsCommandsFromInput:q,unsupported:U,workdir:G,dryRun:j}=X;if(U){let O=a0(Z);if(O)return O}if(q){let O=qj(Z);if(O)return O}if(G!==void 0&&Y){let O=a0(Z);if(O)return O}let H=_j(G,Z.cwd,Z.environment.paths);if(H===null){let O=a0(Z);if(O)return O}let _=Y?{...Z,cwd:void 0,originalCwd:void 0}:H===null||H===void 0||H===Z.cwd?Z:{...Z,cwd:H};if(j){let O=[...x1(K,_)];if((O.length===0?f9(B,Z.envAssignments,new Map).values:O.flatMap((L)=>f9(B,Z.envAssignments,L.envAssignments).values)).some(A9)){let L=a0(Z);if(L)return L}return null}if(K.length===0){if(B.length>0||W.some((L)=>L.length!==1)){let L=a0(Z);if(L)return L}let O=W.map((L)=>L[0]??"");R1(Z.budget,b9(O));let M=NJ(_.envAssignments,_.cwd,Y);return q1(O,(L)=>Z.analyzeNested(L,M))}return q1(x1(K,_),(O)=>Jj(O,X,Z,_))}function Jj($,Z,J,Q){let{jobs:X,templateHasPlaceholder:K,runsRemotely:W,usesStdin:Y,envNames:B}=Z,q=$.tokens,U={...Q,cwd:$.cwd,envAssignments:$.envAssignments},G=f9(B,J.envAssignments,$.envAssignments);if(G.entries.some((L)=>RJ(L.value))){let L=a0(J);if(L)return L}let j=G.entries.some((L)=>L.hasPlaceholder),H=K||j,_=Y&&H,O=NJ($.envAssignments,$.wrapperCwd,W||_);if($1.has($.head)){let L=()=>{if(!K||X.length===0)return null;return R1(J.budget,U3(q,X,"generic")),q1(X,(f)=>C0(q.map((A)=>Q0(A,f)),U))};if(E1(q))return L();let D=e1(q);if(D){if(DJ(D)){let I=n0(J);if(I)return I;if(X.length===0)return null;return R1(J.budget,BJ(D,X)),q1(X,(b)=>J.analyzeNested(Q0(D,b),O))}if(m(D)){if(X.length>0)return R1(J.budget,BJ(D,X)),q1(X,(C)=>J.analyzeNested(Q0(D,C),O));R1(J.budget,WJ(D));let I=M2(D);if(I?.[0]&&x(I[0])==="rm"&&_0(I)){let C=KJ(J);if(C)return C}let b=I?C0(I,U,{dynamicInput:Y,shellDynamicMatch:N("parallel.shell-dynamic",D2),rmDynamicMatch:N("parallel.rm-recursive-force-dynamic",R2)}):null;if(b)return b;return J.analyzeNested(D,O)}let f=!j&&(!K||X.length>0)?(X.length>0?X:[void 0]).map((I)=>W3(g(I===void 0?q:K?q.map((b)=>Q0(b,I)):[...q,...I]),D)):[];if(f.some((I)=>I.kind==="dynamic")){let I=n0(J);if(I)return I}let A=f.flatMap((I)=>I.kind==="literal"?[I.source]:[]);if(A.length>0)return R1(J.budget,b9(A)),q1(A,(I)=>J.analyzeNested(I,O));R1(J.budget,Gj(WJ(D),Uj(G.entries,X)));let F=z$(D);if(F&&G.entries.length>0){let I=qJ(G,X,Q,W);if(I)return I}if(F){let I=n0(J);if(I)return I}let R=J.analyzeNested(D,O);if(R)return R;if(!F){let I=qJ(G,X,Q,W);if(I)return I}if(H)return n0(J);return null}let z=Z0(g(q));if(z.kind==="dynamic"||z.kind==="literal"&&m(z.source))return n0(J)??L();if(z.kind==="literal")return L();if(X.length>0){let f=n0(J);if(f)return f;let A=L();if(A)return A;if(K)return null;let F=X.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return R1(J.budget,b9(F)),q1(F,(R)=>J.analyzeNested(R,O))}if(H||Y)return n0(J)??L();return null}if($.head==="rm"&&_0(q)){if(K&&X.length>0)return R1(J.budget,U3(q,X,"rm")),q1(X,(D)=>I9(q.map((z)=>P9(z,D)),$.cwd,Q));if(X.length>0)return R1(J.budget,YJ(q,X)),q1(X,(D)=>I9([...q,...D],$.cwd,Q));let L=I9(q.flatMap((D,z)=>{if(z===0||!m(D))return[D];return D.startsWith("-")?[P9(D,[""])]:[]}),$.cwd,Q);if(L)return L;return KJ(J)}R1(J.budget,K&&X.length>0?U3(q,X,"generic"):X.length>0?YJ(q,X):OJ(q));let M=X.length>0?X:[void 0];return q1(M,(L)=>{let D=L===void 0?q:K?q.map((C)=>Q0(C,L)):[...q,...L],z=N("parallel.shell-dynamic",D2),f=Y&&$.head==="find"?Bj(D,Q):null,A=jJ(D,Y,J.policy?.rules??[],J.budget)??f?.customResult??null,F=x($.head),R=Y&&(F==="rm"&&C9(D)||F==="xargs"&&_J(D)||f?.rmOptions===!0),I=Y&&(R||f?.executedSource===!0||f===null&&HJ(D,F)),b=C0(D,{...U,worktreeMode:W||Y||H?!1:J.worktreeMode},{dynamicInput:Y||H,dynamicRmInput:R,dynamicSourceInput:A!==null||I,shellDynamicMatch:z,dynamicSourceMatch:z,rmDynamicMatch:N("parallel.rm-recursive-force-dynamic",R2)});if(I){let C=T(z,J.policy);if(C)return C}return b??A??Q1(D,J.policy?.rules??[])})}function HJ($,Z){if(m($[0]??""))return!0;if(Z==="eval"||Z==="source"||Z===".")return!0;if(Z==="parallel"||Z==="xargs")return!0;if($1.has(Z))return Kj($);if(Z==="git")return Qj($);if(Z==="find")return!0;if(N1.has(Z))return XJ($,aH,K2);if(V1(Z))return XJ($,oH,l4);return!1}function C9($){let Z=$.indexOf("--"),J=$.slice(1,Z===-1?void 0:Z);if(!$.some(m))return Z===-1;return J.some((X)=>m(X)&&(X.startsWith("-")||DJ(X)))}function Qj($){if(Xj($))return!0;let Z=l1($);if(Z.subcommand===null||m(Z.subcommand))return!0;if(!nH.has(Z.subcommand.toLowerCase()))return!1;let J=Z.rest.indexOf("--"),Q=Z.rest.slice(0,J===-1?void 0:J);if(!$.some(m))return J===-1;return Q.some(m)}function Xj($){for(let Z=1;Z<$.length;Z++){let J=$[Z];if(!J||J==="--"||!J.startsWith("-"))return!1;if(J==="-c"||J==="--config-env"){if(m($[Z+1]??""))return!0;Z++;continue}if(J.startsWith("-c")&&J.length>2||J.startsWith("--config-env=")){if(m(J))return!0;continue}if(m(J))return!0}return!1}function Kj($){if(E1($))return!1;let Z=e1($);if(Z!==null)return m(Z);let J=Z0(g($));if(J.kind==="literal")return m(J.source);if(J.kind==="dynamic")return!0;return!$.some(m)}function XJ($,Z,J){let Q=J($);if(Q.some((K)=>m(K.value)))return!0;if(!$.some(m))return J([...$,QJ]).some((K)=>K.value===QJ);let X=new Set(Q.map((K)=>`${K.tokenIndex}\x00${K.kind}\x00${K.value}`));return Z.some((K)=>J($.map((W)=>Q0(W,[K]))).some((W)=>!X.has(`${W.tokenIndex}\x00${W.kind}\x00${W.value}`)))}function jJ($,Z,J,Q){if(!Z||J.length===0)return null;let X=J.filter((W)=>x(W.command)===x($[0]??""));if(X.length===0)return null;let K=$.some(m);if(R1(Q,Wj($,X,K)),!K)return q1(X,(W)=>Q1([...$,...W.subcommand?[W.subcommand]:[],...W.block_args],[W]));return q1(X,(W)=>{let Y=new Set([W.subcommand,...W.block_args].flatMap((B)=>B?Yj($,B):[]));return q1(Y,(B)=>Q1($.map((q)=>Q0(q,[B])),[W]))})}function Wj($,Z,J){let Q=J?j1(e(Z.map((X)=>X.block_args.length+(X.subcommand?1:0)),E.maxChildAnalyses),2*Math.max($.length,1),E.maxChildAnalyses):Z.length;return{childAnalyses:Q,derivedTokens:j1(Q,$.length,E.maxDerivedTokens)}}function Yj($,Z){return $.flatMap((J)=>{let Q=[...J.matchAll(/\{[^{}\s]*\}/g)];if(Q.length!==1)return[];let X=Q[0];if(!X||X.index===void 0)return[];let K=J.slice(0,X.index),W=J.slice(X.index+X[0].length);if(!Z.startsWith(K)||!Z.endsWith(W))return[Z];let Y=Z.slice(K.length,Z.length-W.length);return Y!==Z?[Z,Y]:[Z]})}function Bj($,Z){let J={customResult:null,executedSource:!$.some(m),rmOptions:!1},Q=!1,X=0,K=null,W=()=>{if(!K?.some(m))return;for(let Y of x1(K,Z))J.executedSource||=HJ(Y.tokens,Y.head),J.rmOptions||=Y.head==="rm"&&C9(Y.tokens)||Y.head==="xargs"&&_J(Y.tokens),J.customResult??=jJ(Y.tokens,!0,Z.policy?.rules??[],Z.budget)};for(let Y of $.slice(1)){if(!Q&&!Y.startsWith("-")&&Y!=="!"&&Y!=="("){J.executedSource||=m(Y);continue}if(Q=!0,K){if(Y===";"||Y==="+"){W(),K=null;continue}K.push(Y);continue}if(X>0){X--;continue}if(O0(Y)){K=[],J.executedSource||=m(Y);continue}let B=f0(Y);if(B>0){X=B,J.executedSource||=m(Y);continue}J.executedSource||=m(Y)}return W(),J}function _J($){let Z=$.slice(r0($).childStart);return x(Z[0]??"")==="rm"&&C9(Z)}function H3($,Z){return(J)=>T(N($,Z),J.policy)}var n0=H3("parallel.shell-dynamic",D2),qj=H3("parallel.command-stream-dynamic",iH),a0=H3("parallel.command-stream-dynamic",sH),KJ=H3("parallel.rm-recursive-force-dynamic",R2);function I9($,Z,J){return T(R$(g($),{environment:J.environment,cwd:Z,originalCwd:J.originalCwd,strict:J.strict,paranoid:J.paranoidRm,allowTmpdirVar:J.allowTmpdirVar,tmpdirWordSplittingUnsafe:t1(J.envAssignments??new Map,J.environment),trustedTmpdirValue:j0(J.envAssignments??new Map,J.environment),protectedGitMetadata:J.protectedGitMetadata,policy:J.policy}),J.policy)}function b9($){return{childAnalyses:$.length,derivedTokens:$.length,derivedBytes:f$($)}}function WJ($){return OJ([$])}function OJ($){return{childAnalyses:1,derivedTokens:$.length,derivedBytes:f$($)}}function YJ($,Z){if(Z.length>E.maxChildAnalyses)return{childAnalyses:Z.length};return{childAnalyses:Z.length,derivedTokens:e(Z.map((J)=>$.length+J.length),E.maxDerivedTokens),derivedBytes:e([j1(f$($),Z.length,E.maxDerivedBytes),e(Z.map((J)=>f$(J)),E.maxDerivedBytes)],E.maxDerivedBytes)}}function BJ($,Z){return U3([$],Z,"generic")}function U3($,Z,J){if(Z.length>E.maxChildAnalyses)return{childAnalyses:Z.length};let Q=j1($.length,Z.length,E.maxDerivedTokens);if(Q>E.maxDerivedTokens)return{childAnalyses:Z.length,derivedTokens:Q};let X=FJ($.map((B)=>MJ(B,J))),K=j1(X.occurrences,Z.length,E.maxPlaceholderReplacements);if(K>E.maxPlaceholderReplacements)return{childAnalyses:Z.length,derivedTokens:Q,placeholderReplacements:K};if(LJ(X,Z,K))return{childAnalyses:Z.length,derivedTokens:Q,derivedBytes:E.maxDerivedBytes+1,placeholderReplacements:K};let W=J==="generic"?Q0:P9,Y=e(Z.map((B)=>f$($.map((q)=>W(q,B)))),E.maxDerivedBytes);return{childAnalyses:Z.length,derivedTokens:Q,derivedBytes:Y,placeholderReplacements:K}}function LJ($,Z,J){let Q=E.maxDerivedBytes+4*J;return e([j1($.fixedBytes,Z.length,Q),j1($.occurrences,e(Z.map((X)=>X.reduce((K,W)=>Math.max(K,b$(W)),0)),Q),Q)],Q)>Q}function Uj($,Z){let J=$.filter((U)=>U.hasPlaceholder),Q=Math.max(Z.length,1),X=e(J.map((U)=>U.frequency),E.maxChildAnalyses),K=j1(X,Q,E.maxChildAnalyses),W=j1(X,Q,E.maxDerivedTokens);if(K>E.maxChildAnalyses||W>E.maxDerivedTokens)return{childAnalyses:K,derivedTokens:W};if(Z.length===0)return{childAnalyses:K,derivedTokens:W,derivedBytes:e(J.map((U)=>j1(b$(U.value),U.frequency,E.maxDerivedBytes)),E.maxDerivedBytes)};let Y=FJ(J.map((U)=>Hj(MJ(U.value,"generic"),U.frequency))),B=j1(Y.occurrences,Q,E.maxPlaceholderReplacements);if(B>E.maxPlaceholderReplacements)return{childAnalyses:K,placeholderReplacements:B};if(LJ(Y,Z,B))return{childAnalyses:K,derivedTokens:W,derivedBytes:E.maxDerivedBytes+1,placeholderReplacements:B};let q=e(J.map((U)=>j1(f$(Z.map((G)=>Q0(U.value,G))),U.frequency,E.maxDerivedBytes)),E.maxDerivedBytes);return{childAnalyses:K,derivedTokens:W,derivedBytes:q,placeholderReplacements:B}}function Gj($,Z){return{childAnalyses:e([$.childAnalyses??0,Z.childAnalyses??0],E.maxChildAnalyses),derivedTokens:e([$.derivedTokens??0,Z.derivedTokens??0],E.maxDerivedTokens),derivedBytes:e([$.derivedBytes??0,Z.derivedBytes??0],E.maxDerivedBytes),placeholderReplacements:e([$.placeholderReplacements??0,Z.placeholderReplacements??0],E.maxPlaceholderReplacements)}}function MJ($,Z){let J=Z==="generic"?$.matchAll(/\{[^{}\s]*\}/g):$.matchAll(UJ),Q=0,X=0,K=0;for(let W of J){if(Q>=E.maxPlaceholderReplacements)return{occurrences:E.maxPlaceholderReplacements+1,fixedBytes:0};X=e([X,b$($.slice(K,W.index))],G3),Q++,K=W.index+W[0].length}return{occurrences:Q,fixedBytes:Q===0?b$($):e([X,b$($.slice(K))],G3)}}function Hj($,Z){return{occurrences:j1($.occurrences,Z,E.maxPlaceholderReplacements),fixedBytes:j1($.fixedBytes,Z,G3)}}function FJ($){return{occurrences:e($.map((Z)=>Z.occurrences),E.maxPlaceholderReplacements),fixedBytes:e($.map((Z)=>Z.fixedBytes),G3)}}function f$($,Z=E.maxDerivedBytes){return e($.map(b$),Z)}function b$($){return Zj.encode($).byteLength}function e($,Z){let J=0;for(let Q of $){if(!Number.isSafeInteger(Q)||Q<0||Q>Z-J)return Z+1;J+=Q}return J}function j1($,Z,J){if(!Number.isSafeInteger($)||!Number.isSafeInteger(Z)||$<0||Z<0||$!==0&&Z>Math.floor(J/$))return J+1;return $*Z}function f9($,Z,J){let Q=[];for(let X of $){let K=J.get(X)??Z?.get(X);if(K!==void 0)Q.push(K)}return Q.push(...J.values()),jj(Q)}function jj($){let Z=new Map;for(let Q of $)Z.set(Q,(Z.get(Q)??0)+1);let J=[...Z].map(([Q,X])=>({value:Q,frequency:X,hasPlaceholder:m(Q)}));return{values:$,entries:J,byValue:new Map(J.map((Q)=>[Q.value,Q]))}}function qJ($,Z,J,Q){return q1($.values,(X)=>{if(!$.byValue.get(X)?.hasPlaceholder)return null;let K=Z.length>0?Z:[void 0];return q1(K,(W)=>{let Y=W===void 0?X:Q0(X,W);return J.analyzeNested(Y,{envAssignments:J.envAssignments,effectiveCwd:Q?null:J.cwd})})})}function NJ($,Z,J){let Q={};if($)Q.envAssignments=$;if(J)return Q.effectiveCwd=null,Q.worktreeMode=!1,Q;if(Z!==void 0)Q.effectiveCwd=Z;return Object.keys(Q).length>0?Q:void 0}function Q0($,Z){return $.replace(/\{[^{}\s]*\}/g,(J)=>VJ(J,Z))}function P9($,Z){return $.replace(UJ,(J)=>VJ(J,Z))}function VJ($,Z){let J=/^\{(-?\d+)[^{}\s]*\}$/.exec($)?.[1];if(J===void 0)return Z[0]??"";let Q=Number(J),X=Q>0?Q-1:Z.length+Q;return Z[X]??""}function m($){return rH.test($)}function RJ($){if(A9($))return!0;for(let Z of $.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(Z[0]))return!0;return!1}function A9($){let Z=$.indexOf("{=");return Z!==-1&&$.indexOf("=}",Z+2)!==-1}function DJ($){return/^\{[^{}\s]*\}$/.test($)}function zJ($){let Z=1,J=[],Q=$.length,X=-1,K=!1,W=!1,Y=!1,B,q=$.some((O)=>O==="::::"||O==="::::+"||O===":::+"),U=[];while(Z<$.length){let O=$[Z];if(O===void 0)break;if(O===":::"){X=Z;break}if(O==="--"){let f=K9($,Z+1);J.push(...f.templateTokens),Q=Z+1,X=f.markerIndex;break}if(!O.startsWith("-")){let f=K9($,Z);J.push(...f.templateTokens),Q=Z,X=f.markerIndex;break}let M=$[Z+1],L=O.indexOf("="),D=L===-1?O:O.slice(0,L),z=L===-1?void 0:O.slice(L+1);if(O==="--dry-run"){Y=!0,Z++;continue}if(O==="-I"||O.startsWith("-I")&&O.length>2){q||=(O==="-I"?M:O.slice(2))!=="{}",Z+=O==="-I"?2:1;continue}if(O==="--replace"||O==="-i"){q=!0,Z+=2;continue}if(D==="--replace"||O.startsWith("-i")&&O.length>2){let f=D==="--replace"?z:O.slice(2);q||=f!==""&&f!=="{}",Z++;continue}if(O==="-a"||eH.has(D)){q=!0,Z+=z===void 0?2:1;continue}if(O==="--pipe"||O==="--pipepart"){W=!0,Z++;continue}if(D==="--env"){U.push(...Lj(z??M)),Z+=z===void 0?2:1;continue}if(JJ.has(D)||O.startsWith("-S")&&O.length>2){K=!0,Z+=JJ.has(O)?2:1;continue}if($j.has(D)){let f=z??M;if(f===void 0||f===":::"||f==="--"){q=!0,Z++;continue}B=f,q||=z!==void 0&&f==="",Z+=z===void 0?2:1;continue}if(O.startsWith("-j")&&O.length>2&&/^\d+$/.test(O.slice(2))){Z++;continue}if(O.startsWith("--")&&z!==void 0){Z++;continue}if(tH.has(O)){if(M===void 0||M===":::"||M==="--"){q=!0,Z++;continue}Z+=2;continue}Z+=O==="-j"||O==="--jobs"?2:1}q||=J.some(Y?A9:RJ);let G=[];if(X!==-1){let O=[];for(let M=X+1;M<$.length;M++){let L=$[M];if(L===":::"){G.push(O),O=[];continue}if(L!==void 0)O.push(L)}G.push(O)}let j=Oj(G),H=J.some(m),_=J.length===0&&X===-1;return{template:J,jobs:j,childStart:Q,templateHasPlaceholder:H,runsRemotely:K,usesStdin:W||X===-1,envNames:U,readsCommandsFromInput:_,unsupported:q,workdir:B,dryRun:Y}}function _j($,Z,J){if($===void 0)return;if($==="..."||/[{}$`*?~[]/.test($))return null;if(!Z&&!dH($))return null;try{return b0(Z??$,$,J)}catch{return null}}function Oj($){if($.length===0||$.some((J)=>J.length===0))return[];let Z=[[]];for(let J of $){if(J.length===1){let X=J[0];if(X===void 0)return[];for(let K of Z)K.push(X);continue}let Q=[];for(let X of Z)for(let K of J)if(Q.push([...X,K]),Q.length>E.maxChildAnalyses)return Q;Z=Q}return Z}function Lj($){return($??"").split(",").map((Z)=>Z.trim()).filter(Boolean)}function IJ($){return zJ($).childStart}var Mj="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",E9="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.",Fj=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","stash","switch","tag","worktree"]);function S9($){return $?.parts.some((Z)=>Z.provenance==="command-substitution")??!1}function T9($){return $?.parts.some((Z)=>Z.provenance==="literal"&&Z.raw.replace(/^["']/,"").startsWith("-"))??!1}function fJ($,Z,J,Q=!1,X){let K=I6($,Z)&&o(X,"shell.dynamic-executable",Q)?N("shell.dynamic-executable",Mj):null;return T(K,X)??PJ($,Z,J,Q,X)}function PJ($,Z,J,Q,X){if(Z.length<2)return null;let K=Z.flatMap((Y,B)=>S9(Y)?[B]:[]);if(K.length===0)return null;let W=x(Z[0]?.text??"");if(W==="git"){let Y=j$($,Z),B=Vj(Y);if(o(X,"shell.dynamic-structure",Q)&&K.some((G)=>G<=B))return T(N("shell.dynamic-structure",E9),X);if(T(V$(Y,{env:J.env}),X))return null;let q=Z[B]?.text.toLowerCase(),U=Y.findIndex((G,j)=>j>B&&S(G)==="--");if(o(X,"shell.dynamic-structure",Q)&&q&&Fj.has(q)&&K.some((G)=>G>B&&(U===-1||G<U)))return T(N("shell.dynamic-structure",E9),X);return null}if(W==="find")return o(X,"shell.dynamic-structure",Q)&&Rj(Z)?T(N("shell.dynamic-structure",E9),X):null;if(W==="xargs")return bJ($,Z.slice(r0(Z.map(S)).childStart),"xargs",J,Q,X);if(W==="parallel")return bJ($,Z.slice(IJ(Z.map(S))),"parallel",J,Q,X);return null}function bJ($,Z,J,Q,X,K){if(Z.length===0)return null;let W=Nj(Z,Q);if(I6($,W)){let B=T(N(`${J}.shell-dynamic`,J==="xargs"?D9:D2),K);if(B)return B}let Y=PJ($,W,Q,X,K);if(Y)return Y;if(W[0]?.text==="rm"&&W.slice(1).some((B)=>S9(B)&&T9(B)))return T(N(`${J}.rm-recursive-force-dynamic`,J==="xargs"?R9:R2),K);return null}function Nj($,Z){let J=g0($,Z),Q=J.rewritten?g(J.words.map(S)):J.words,X=Q[0];return X&&S(X)==="busybox"?Q.slice(1):Q}function Vj($){let Z=1;while(Z<$.length){let J=$[Z],Q=J?S(J):"";if(r1.has(Q)){Z+=2;continue}if(Q.startsWith("-")){Z++;continue}return Z}return Z}function Rj($){let Z=!1,J=0,Q=!1,X=!1;for(let K=1;K<$.length;K++){let W=$[K];if(!W)continue;let Y=S9(W);if(J>0){J--;continue}if(X){if(W.text===";"||W.text==="+"){X=!1,Z=!0,Q=!1;continue}if(Y&&(Q||T9(W)))return!0;Q=!1;continue}if(!Z&&!W.text.startsWith("-")){if(Y&&(K>1||T9(W)))return!0;continue}if(Z=!0,Y)return!0;let B=f0(W.text);if(B>0){J=B;continue}if(O0(W.text))X=!0,Q=!0}return!1}function y9($,Z){return $.some((J)=>{if(J.value==="-"&&(J.kind==="main-script"||J.kind==="program-file"))return!0;return!C4(Z[J.tokenIndex],J.value)})}var Dj="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",zj="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Ij="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function CJ($,Z){let J=Z.slice(1);if($==="dd"&&J.some((Q)=>/^of=\/dev\/.+/.test(Q)))return N("dd.device-write",Dj);if(($==="mkfs"||$.startsWith("mkfs."))&&J.some((Q)=>Q.startsWith("/dev/")))return N("mkfs.device",zj);if($==="shred"&&J.length>0)return N("shred.target",Ij);return null}var EJ=[{heads:new Set(["rm","rmdir"]),analyze:($)=>R$($.words,{environment:$.options.environment,cwd:$.cwd,originalCwd:$.originalCwd,strict:$.options.strict,paranoid:$.options.paranoidRm,allowTmpdirVar:$.allowTmpdirVar,tmpdirWordSplittingUnsafe:t1($.envAssignments,$.options.environment),trustedTmpdirValue:j0($.envAssignments,$.options.environment),protectedGitMetadata:$.options.protectedGitMetadata,policy:$.options.policy})},{heads:new Set(["git"]),analyze:($)=>V$($.words,w9($))},{heads:new Set(["find"]),analyze:($)=>Q3($.words,{environment:$.options.environment,cwd:$.cwd,originalCwd:$.originalCwd,strict:$.options.strict,allowTmpdirVar:$.allowTmpdirVar,tmpdirWordSplittingUnsafe:t1($.envAssignments,$.options.environment),trustedTmpdirValue:j0($.envAssignments,$.options.environment),protectedGitMetadata:$.options.protectedGitMetadata,derivedCommandWorkBudget:$.options.derivedCommandWorkBudget,envAssignments:$.envAssignments,policy:$.options.policy,analyzeTokens:$.analyzeChildTokens,analyzeNested:(Z,J)=>o0($.options.analyzeNested(Z,J))})},{heads:new Set(["xargs"]),analyze:($)=>o5($.words,{...AJ($),analyzeNested:(Z,J)=>o0($.options.analyzeNested(Z,J))})},{heads:new Set(["parallel"]),analyze:($)=>GJ($.words,{...AJ($),budget:$.options.parallelBudget,analyzeNested:(Z,J)=>o0($.options.analyzeNested(Z,J))})}];function AJ($){return{environment:$.options.environment,cwd:$.cwd,originalCwd:$.originalCwd,strict:$.options.strict,paranoidRm:$.options.paranoidRm,paranoidInterpreters:$.options.paranoidInterpreters,allowTmpdirVar:$.allowTmpdirVar,protectedGitMetadata:$.options.protectedGitMetadata,derivedCommandWorkBudget:$.options.derivedCommandWorkBudget,envAssignments:$.envAssignments,worktreeMode:$.options.worktreeMode,policy:$.options.policy,scanWork:$.options.scanWork}}function o0($){return $?{id:$.ruleId??"",reason:$.reason,intent:$.intent??"manual_only"}:null}function w9($){return{env:$.options.environment.env,cwd:$.cwd,dynamicArguments:$.dynamicArguments,envAssignments:$.envAssignments,policy:$.options.policy,worktreeMode:$.options.worktreeMode}}var wJ="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function vJ($){return EJ.find((Z)=>Z.heads.has($))?.analyze}function z2($,Z,J){let Q=J.trace;if($.length===0)return null;let X=J.commandView?.dialect??"posix",K=(P)=>P.map((v)=>X==="posix"?S(v):v.text),W=J.effectiveCwd===null,Y=W?void 0:J.effectiveCwd??J.cwd,B=W?void 0:J.cwd,q=A4($);if(q.envAssignments.size>0)Q?.recordSegment({type:"env-strip",input:K($),envVars:Object.fromEntries([...q.envAssignments.keys()].map((P)=>[P,"<redacted>"])),output:K(q.words)});let U=g0(q.words,J.environment,Y,new Map([...J.envAssignments??[],...q.envAssignments]));if(U.unverifiableEnvSplit)throw new p0;let G=U.rewritten?g(K(U.words)):j$(X,U.words),j=K(G),H={...J,wrapperNormalizationBudget:J.wrapperNormalizationBudget??{iterations:0}};if(Q&&q.words.length>G.length){let P=K(q.words);Q.recordSegment({type:"leading-tokens-stripped",input:P,removed:P.slice(0,P.length-G.length),output:j})}let _=new Map([...J.envAssignments??[],...q.envAssignments,...U.envAssignments]),O=j[0];if(!O)return null;if(B2(O))throw new A1;let M=x(O),L=U.cwd===null?void 0:U.cwd??Y,D=U.cwd===null?void 0:B,z=U.cwd===void 0?J.effectiveCwd:U.cwd,f=!H2(_,J.environment),A=fJ(X,U.words,J.environment,J.strict,J.policy);if(A)return Q?.recordSegment({type:"rule-check",ruleModule:"analyze/segment.ts",ruleFunction:"analyzeDynamicCommandStructure",matched:!0,reason:A.reason}),L0(A);let F=d4(j,J.policy);if(F){for(let P of[F.childIndex,...F.alternativeChildIndices]){TJ(H.wrapperNormalizationBudget);let v=G.slice(P);Q?.recordSegment({type:"transparent-wrapper",wrapper:F.wrapper,output:K(v)});let n=z2(v,Z,{...H,effectiveCwd:z,envAssignments:_});if(n)return n}return null}let R=M==="eval"?D$(G):M==="trap"?c5(G):void 0;if(R?.kind==="dynamic")return T1(Q);if(R?.kind==="literal"){Q?.recordSegment({type:"recurse",reason:M==="eval"?"shell-eval":"shell-trap",innerCommand:R.source,depth:Z+1});let P=J.analyzeNested(R.source,{effectiveCwd:z,envAssignments:_,functionDefinitions:J.functionDefinitions});if(P)return P}if(hJ(O,M)){if(E1(j))return null;let P=bj(j,_,z,J,Q,Z);if(P)return P;let v=e1(j);if(v){let J$=W3(G,v);if(J$.kind==="dynamic")return T1(Q);let g3=J$.kind==="literal"?J$.source:v,UZ=fj(g3);Q?.recordSegment({type:"shell-wrapper",wrapper:M,innerCommand:UZ}),Q?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:UZ,depth:Z+1});let GZ=J.analyzeNested(g3,{effectiveCwd:z,envAssignments:_});if(GZ)return GZ;return z$(g3)?T1(Q):null}let n=Z0(G);if(n.kind==="dynamic")return T1(Q);if(n.kind==="literal")return O3(n.source,z,_,J,Q,Z);let Z1=d5(G,J.commandView?.redirections??[],J.hasPipelineInput??!1,J.literalShellInput);if(Z1.kind==="dynamic")return T1(Q);if(Z1.kind==="literal")return Q?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:Z1.source,depth:Z+1}),J.analyzeNested(Z1.source,{effectiveCwd:z,envAssignments:_})}if(M==="source"||M==="."){let P=j[1]==="-p"?2:null;if(P!==null){let J$=J.commandView?G[P]:void 0;if(!J$)return null;if(J$.provenance!=="literal")return T1(Q)}let v=P===null?1:3,n=j[v]==="--"?v+1:v,Z1=J.commandView?G[n]:void 0;if(!Z1)return null;if(Z1.provenance!=="literal")return T1(Q);return O3(Z1.text,z,_,J,Q,Z)}if(N1.has(M)){if(J.strict&&y9(K2(j),G))return T1(Q);let P=v4(j,(n)=>o0(J.analyzeNested(n,{effectiveCwd:z,envAssignments:_}))),v=T(P,J.policy);if(v)return Q?.recordSegment({type:"rule-check",ruleModule:"awk",ruleFunction:"analyzeAwkSystemCalls",matched:!0,reason:v.reason}),L0(v)}if(V1(M)){if(J.strict&&y9(l4(j),G))return T1(Q);let P=x4(j);if(P){let v=o(J.policy,"interpreter.one-liner-paranoid",!!J.paranoidInterpreters);if(Q?.recordSegment({type:"interpreter",interpreter:M,codeArg:P,paranoidBlocked:v}),v){let Z1=T(N("interpreter.one-liner-paranoid",M$),J.policy);if(Z1)return L0(Z1)}if(p4(M,P))return null;Q?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:P,depth:Z+1});let n=J.analyzeNested(P,{effectiveCwd:z,envAssignments:_});if(n&&n.ruleId!=="raw-text.dangerous-command"&&(n.reason!==D0||H$(P)))return n;if(F$(P,J.scanWork)){let Z1=T(N("interpreter.dangerous-command",l0),J.policy);if(Z1)return Q?.recordSegment({type:"dangerous-text",token:P,matched:!0,reason:l0}),L0(Z1)}Q=void 0}}if(M==="busybox"&&j.length>1)return TJ(H.wrapperNormalizationBudget),Q?.recordSegment({type:"busybox",subcommand:j[1]??"unknown"}),Q?.recordSegment({type:"recurse",reason:"busybox",innerCommand:j.slice(1).join(" "),depth:Z+1}),z2(G.slice(1),Z,{...H,effectiveCwd:z,envAssignments:_});let I=T(CJ(M,j),J.policy);if(I)return Q?.recordSegment({type:"rule-check",ruleModule:"analyze/device.ts",ruleFunction:"analyzeDeviceCommand",matched:!0,reason:I.reason}),L0(I);let b=Q===H.trace?H:{...H,trace:Q},C={words:G,head:M,cwd:L,originalCwd:D,envAssignments:_,allowTmpdirVar:f,dynamicArguments:U.words.some((P)=>P.provenance==="command-substitution"),depth:Z,effectiveCwd:z,options:b,analyzeChildTokens:(P,v)=>o0(z2(g(P),Z+1,{...b,commandView:void 0,effectiveCwd:v,envAssignments:_}))??Q1(P,b.policy.rules)},y=vJ(M);if(M==="rm"||M==="xargs"||M==="parallel")Q?.recordSegment({type:"tmpdir-check",tmpdirValue:_.has("TMPDIR")||J.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!f,allowTmpdirVar:f});let w=Q&&M==="git"?y5(C.words,w9(C)):void 0,k=SJ(w?w.match:y?.(C)??null,J.policy);if(Q)Pj(C,k,w?.relaxation??null);if(k)return L0(k);let Y1=y!==void 0;if(!Y1)if(!e2.has(M)){let P=Q?[]:void 0;for(let v=1;v<j.length;v++){let n=j[v];if(!n)continue;P?.push(n);let Z1=SJ(Cj(C,j,v),J.policy);if(Z1)return Q?.recordSegment({type:"fallback-scan",tokensScanned:P??[],embeddedCommandFound:x(n)}),L0(Z1)}Q?.recordSegment({type:"fallback-scan",tokensScanned:P??[]})}else Q?.recordSegment({type:"fallback-scan",tokensScanned:[]});else Q?.recordSegment({type:"fallback-scan",tokensScanned:[]});if(Z===0||!Y1){let P=Q1(j,J.policy.rules);if(Q?.recordSegment({type:"custom-rules-check",rulesChecked:J.policy.rules.length>0,matched:!!P,reason:P?.reason}),P)return L0(P)}else Q?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1});return null}function bj($,Z,J,Q,X,K){let W=k5($);if(W.argvSource?.kind==="absent")return T1(X);if(W.argvSourceApplies&&W.argvSource){let B=O3(W.argvSource.value,J,Z,Q,X,K,!0);if(B)return B}if(!W.envSourceApplies||!W.envName)return null;let Y=Z.get(W.envName);if(!Y)return null;return O3(Y,J,Z,Q,X,K,!0)}function O3($,Z,J,Q,X,K,W=!1){if(W&&/[$`*?[\]]/.test($))return T1(X);let Y=G2($,Z,Q.environment.paths),B=Y?Q.literalHeredocFiles?.get(Y):void 0;if(B===void 0)return W?T1(X):null;return o1(Q.derivedCommandWorkBudget,1),X?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:B,depth:K+1}),Q.analyzeNested(B,{effectiveCwd:Z,envAssignments:J})}function fj($){let Z=$[0];return $.length>=2&&(Z==='"'||Z==="'")&&$.at(-1)===Z?$.slice(1,-1):$}function Pj($,Z,J){let Q={git:["git","analyzeGit"],rm:["analyze/rm.ts","analyzeRm"],find:["analyze/find.ts","analyzeFind"],xargs:["analyze/xargs.ts","analyzeXargs"],parallel:["analyze/parallel.ts","analyzeParallel"]}[$.head];if(!Q)return;if($.options.trace?.recordSegment({type:"rule-check",ruleModule:Q[0]??"",ruleFunction:Q[1]??"",matched:!!Z||!!J,reason:Z?.reason??J?.originalReason}),J)$.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:J.originalReason,gitCwd:J.gitCwd})}function TJ($){if($.iterations>=Y$)throw new A1;$.iterations++}function L0($){return{reason:$.reason,ruleId:$.id||void 0,intent:$.intent}}function T1($){return $?.recordSegment({type:"error",message:wJ}),L0(uJ())}function uJ(){return{id:"",reason:wJ,intent:"stop_and_explain"}}function hJ($,Z){return $1.has(Z)||$==="$SHELL"||$==="${SHELL}"||$1.has(h(Z))}function Cj($,Z,J){let Q=x1(Z.slice(J),{environment:$.options.environment,cwd:$.cwd,envAssignments:$.envAssignments,policy:$.options.policy});for(let X of Q){let K=Aj($,J,X);if(K)return K}return null}function Aj($,Z,J){let Q=J.tokens[0];if(!Q)return null;let X=x(Q);if(hJ(Q,X)){o1($.options.derivedCommandWorkBudget,$.words.length-Z);let B=J.tokens;if(E1(B))return null;let q=e1(B);if(!q){if(Z0(g(B)).kind==="dynamic")return uJ();return _3($,J)}let U=$.options.analyzeNested(q,{effectiveCwd:J.wrapperCwd===void 0?$.effectiveCwd:J.wrapperCwd,envAssignments:J.envAssignments});return U?o0(U):_3($,J)}let K=vJ(X);if(!K||X==="xargs"||X==="parallel"){if(J.wrappedByTransparent&&$.options.policy.rules.length>0)o1($.options.derivedCommandWorkBudget,$.words.length-Z);return _3($,J)}o1($.options.derivedCommandWorkBudget,$.words.length-Z);let W=[X,...J.tokens.slice(1)],Y={...$,words:g(W),head:X,cwd:J.cwd,originalCwd:J.wrapperCwd===null?void 0:$.originalCwd,envAssignments:J.envAssignments,allowTmpdirVar:!H2(J.envAssignments,$.options.environment),effectiveCwd:J.wrapperCwd===void 0?$.effectiveCwd:J.wrapperCwd,options:X==="git"?{...$.options,worktreeMode:!1}:$.options};return K(Y)??_3($,J)}function _3($,Z){return Z.wrappedByTransparent?Q1(Z.tokens,$.options.policy.rules):null}function SJ($,Z){return $?.id.startsWith("custom.")?$:T($,Z)}var Ej=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Tj=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Sj($,Z){let J=xJ($,Z);if(J.length===0)return!1;let Q=J[kJ(J)];if(Q==="cd"||Q==="pushd"||Q==="popd")return!0;return Ej.test($.join(" "))}function gJ($,Z,J,Q){if($.dialect==="powershell"){let Y=yj($.words,Q);if(Y.kind==="none")return;if(!Z||Y.kind==="unknown")return null;return yJ(hj(Y.target),Z,J.paths)}let X=$.words.map(S);if(!Sj(X,J))return;if(!Z)return null;let K=xJ(X,J,Z),W=kJ(K);if(W===-1||K[W]!=="cd")return null;return yJ(K[W+1],Z,J.paths)}function yJ($,Z,J){if(!$||$==="-"||$.includes("$")||$.includes("`"))return null;try{return gj(b0(Z,$,J),Z,J)?Z:null}catch{return null}}function yj($,Z){let J=wj($[0])?1:0,Q=$[J];if(!vj(Q,J===1))return{kind:"none"};let X=Q.text.toLowerCase(),K=X.split(/[\\/]/).pop()??X;if(!Tj.has(K))return{kind:"none"};if(X!==K||K==="pop-location"||K==="popd")return{kind:"unknown"};return uj($.slice(J+1),Z)}function wj($){return $?.provenance==="literal"&&!$.quoted&&$.raw===$.text&&($.text==="&"||$.text===".")}function vj($,Z){return $?.provenance==="literal"&&(Z||!$.quoted&&$.raw===$.text)}function uj($,Z){let J;for(let Q of $){if(Q.provenance!=="literal"||J!==void 0)return{kind:"unknown"};J=Q.text}if(J!==void 0)return{kind:"target",target:J};return Z===void 0?{kind:"unknown"}:{kind:"target",target:Z}}function hj($){return $.includes("::")?void 0:$.replaceAll("\\","/")}function kJ($){let Z=0;if($[0]==="builtin"&&$.length>1)Z=1;if($[Z]!=="time")return Z;let J=Z+1;while($[J]?.startsWith("-"))J++;return J}function xJ($,Z,J){let Q=kj($);return P1([...Q],Z,J)}function gj($,Z,J){let Q=J.realpath($),X=J.realpath(Z);if(Q===null||X===null)return j3($)===j3(Z);return j3(Q)===j3(X)}function kj($){let Z=0;while(Z<$.length){let J=$[Z];if(J==="{"||J==="("||J==="$(")Z++;else break}return $.slice(Z)}var I2="TMPDIR",b2="IFS",xj=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,v9=/^[A-Za-z_][A-Za-z0-9_]*$/;function mJ($,Z){let J=dj($,Z);return{env:$,effectiveEnvAssignments:J,shellAssignments:new Map,exportedNames:ij($,J),allexport:!1,keywordExport:!1}}function pJ($){return{env:$.env,effectiveEnvAssignments:$.effectiveEnvAssignments?new Map($.effectiveEnvAssignments):void 0,shellAssignments:new Map($.shellAssignments),exportedNames:new Set($.exportedNames),allexport:$.allexport,keywordExport:$.keywordExport}}function cJ($,Z){let J=lj($,Z);if(!J)return;let{command:Q,commandIndex:X,leadingAssignments:K,prefixAssignmentsPersist:W}=J;if(Q===null){for(let B of K.values())lJ(Z,B);return}if(W)for(let B of K.values())Z.shellAssignments.set(B.name,B.value),Z.exportedNames.add(B.name),A0(Z,B);if(Q==="set"){let B=ej($,X);if(B.allexport!==null)Z.allexport=B.allexport;if(B.keywordExport!==null)Z.keywordExport=B.keywordExport;return}if(Q==="unset"){let B=aj($,X);if(B===null)return;for(let q of $.slice(B))nj(Z,q);return}if(Q!=="export"&&Q!=="typeset"&&Q!=="declare"&&Q!=="readonly")return;for(let B of K.values())lJ(Z,B);if(Q==="export"){let B=oj($,X);if(B===null)return;for(let q of $.slice(B))sj(Z,q);return}let Y=tj($,X);if(Y===null)return;for(let B of $.slice(Y.operandsStart))rj(Z,B,Y.exports,Q==="readonly"?K:void 0)}function dJ($,Z){if(!Z.keywordExport)return Z.effectiveEnvAssignments;let J=null,Q=F3(Z);for(let X of $){let K=M3(X,Q,Z.env);if(!K)continue;J??=new Map(Z.effectiveEnvAssignments??[]),J.set(K.name,K.value),Q.set(K.name,K.value)}return J??Z.effectiveEnvAssignments}function lj($,Z){let J=new Map,Q=0;while(Q<$.length){let Y=$[Q];if(!Y)return null;let B=M3(Y,F3(Z,J),Z.env);if(!B)break;J.set(B.name,B),Q++}if(Q>=$.length)return{command:null,commandIndex:Q,leadingAssignments:J,prefixAssignmentsPersist:!1};let X=Q,K=Q,W=$[K]??null;while(W==="builtin"||W==="command"||W==="time"){if(W==="builtin"){if(K++,$[K]==="--")K++;W=$[K]??null;continue}if(W==="command"){let B=mj($,K);if(!B)return null;K=B.commandIndex,W=B.command;continue}let Y=pj($,K);if(!Y)return null;K=Y.commandIndex,W=Y.command}if(W===null)return null;return{command:W,commandIndex:K,leadingAssignments:J,prefixAssignmentsPersist:K===X&&(W==="unset"||W==="set"||W==="export"||W==="readonly")}}function mj($,Z){return iJ($,Z,(J)=>{if(J==="-p")return"skip";return J==="-v"||J==="-V"?"abort":"stop"})}function pj($,Z){return iJ($,Z,(J)=>J.startsWith("-")?"skip":"stop")}function iJ($,Z,J){let Q=Z+1;while(Q<$.length){let K=$[Q];if(!K)return null;if(K==="--"){Q++;break}let W=J(K);if(W==="abort")return null;if(W==="skip"){Q++;continue}break}let X=$[Q];return X?{command:X,commandIndex:Q}:null}function M3($,Z,J){return n1($)??cj($,Z,J)}function cj($,Z,J){let Q=I4($,J,Z);if(Q)return Q;let X=$.match(xj)?.[1];if(!X)return null;let K=$.indexOf("=");return{name:X,value:`${Z.has(X)?Z.get(X):J.get(X)??""}${$.slice(K+1)}`}}function L3($){return $===I2||$===b2||T6($)}function F3($,Z){return new Map([...$.effectiveEnvAssignments??[],...$.shellAssignments,...[...Z?.values()??[]].map((J)=>[J.name,J.value])])}function dj($,Z){let J=[...D4,I2,b2].map((Q)=>{let X=$.get(Q);return X===void 0?null:[Q,X]}).filter((Q)=>Q!==null);if(J.length===0)return Z;return new Map([...J,...Z??[]])}function ij($,Z){let J=new Set;for(let Q of $.keys())if(L3(Q))J.add(Q);for(let Q of Z?.keys()??[])if(L3(Q))J.add(Q);return J}function lJ($,Z){if($.shellAssignments.set(Z.name,Z.value),Z.name===I2||Z.name===b2||$.allexport||$.exportedNames.has(Z.name))A0($,Z)}function A0($,Z){let J=new Map($.effectiveEnvAssignments??[]);J.set(Z.name,Z.value),$.effectiveEnvAssignments=J}function sj($,Z){let J=M3(Z,F3($),$.env);if(J){$.shellAssignments.set(J.name,J.value),$.exportedNames.add(J.name),A0($,J);return}if(v9.test(Z))sJ($,Z)}function rj($,Z,J,Q){let X=M3(Z,F3($),$.env);if(X){if($.shellAssignments.set(X.name,X.value),J)$.exportedNames.add(X.name),A0($,X);else if(X.name===I2||X.name===b2||$.allexport||$.exportedNames.has(X.name))A0($,X);return}let K=Q?.get(Z);if(K){$.exportedNames.add(Z),A0($,K);return}if(J&&v9.test(Z))sJ($,Z)}function sJ($,Z){$.exportedNames.add(Z),A0($,{name:Z,value:$.shellAssignments.get(Z)??$.effectiveEnvAssignments?.get(Z)??$.env.get(Z)??""})}function nj($,Z){if(!L3(Z)&&!v9.test(Z))return;if($.shellAssignments.set(Z,""),$.exportedNames.delete(Z),!L3(Z)||Z===I2||Z===b2||o$(Z)){A0($,{name:Z,value:""});return}if(!$.effectiveEnvAssignments?.has(Z))return;let J=new Map($.effectiveEnvAssignments);J.delete(Z),$.effectiveEnvAssignments=J.size===0?void 0:J}function aj($,Z){return rJ($,Z,(J)=>J==="-v")}function oj($,Z){return rJ($,Z,(J)=>J==="-p")}function rJ($,Z,J){let Q=Z+1;while(Q<$.length){let X=$[Q];if(!X)return null;if(X==="--")return Q+1;if(J(X)){Q++;continue}if(X.startsWith("-"))return null;return Q}return Q}function tj($,Z){let J=Z+1,Q=!1;while(J<$.length){let X=$[J];if(!X)return null;if(X==="--")return{operandsStart:J+1,exports:Q};if(X.startsWith("-")){if(X.slice(1).includes("x"))Q=!0;J++;continue}if(X.startsWith("+")){if(X.slice(1).includes("x"))Q=!1;J++;continue}return{operandsStart:J,exports:Q}}return{operandsStart:J,exports:Q}}function ej($,Z){let J={allexport:null,keywordExport:null},Q=Z+1;while(Q<$.length){let X=$[Q];if(!X)return J;if(X==="--")return J;if(X==="-o"||X==="+o"){if($[Q+1]==="allexport")J.allexport=X==="-o";if($[Q+1]==="keyword")J.keywordExport=X==="-o";Q+=2;continue}if(X.startsWith("-")&&X.length>1){let K=X.slice(1);if(K.includes("a"))J.allexport=!0;if(K.includes("k"))J.keywordExport=!0;Q++;continue}if(X.startsWith("+")&&X.length>1){let K=X.slice(1);if(K.includes("a"))J.allexport=!1;if(K.includes("k"))J.keywordExport=!1;Q++;continue}return J}return J}var $_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",t0="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.",Z_=64;function x9($,Z,J,Q){let X=J.derivedCommandWorkBudget===void 0,K=J.parallelBudget===void 0;try{return J_($,Z,{...J,derivedCommandWorkBudget:J.derivedCommandWorkBudget??r4(),parallelBudget:J.parallelBudget??a7()},Q)}catch(W){let Y=W instanceof p0?d7:W instanceof A1&&X?c7:W instanceof a4&&K?n7:void 0;if(!Y)throw W;if(J.trace?.currentSegmentIndex!==void 0)J.trace.recordSegment({type:"error",message:Y});else J.trace?.recordGlobal({type:"error",message:Y});return{reason:Y,segment:$,intent:"stop_and_explain"}}}function J_($,Z,J,Q){if(Z>=t2)return J.trace?.recordSegment({type:"error",message:B0}),{reason:B0,segment:$,intent:"stop_and_explain"};let X=Q??J.factStore?.getCommandProgram($,J.shell??"auto")??v1($,J.shell);if(X.status==="limited")return J.trace?.recordSegment({type:"error",message:B0}),{reason:B0,segment:$,intent:"stop_and_explain"};if(X.status==="invalid"){let q=X.issues.find((U)=>U.code.includes("heredoc"));if(q){if(!J.strict)return k9($,J);let U=`Unsupported heredoc syntax: ${q.message}`;return J.trace?.recordGlobal({type:"error",message:U}),{reason:U,segment:$,intent:"stop_and_explain"}}return $Q($,J),{reason:D0,segment:$,intent:"stop_and_explain"}}if(J.strict&&X.status==="partial")return $Q($,J),{reason:D0,segment:$,intent:"stop_and_explain"};if(X.issues.some((q)=>q.code.includes("quote"))&&!J.analyzePartialProgram)return k9($,J);let W=J.cwd,Y=J.effectiveCwd!==void 0?J.effectiveCwd:J.cwd,B=mJ(J.environment.env,J.envAssignments);return R3(X,Z,{...J,rootProgram:X},W,[{effectiveCwd:Y,shellGitContextState:B,literalHeredocFiles:new Map(J.literalHeredocFiles),functionDefinitions:new Map(J.functionDefinitions)}]).result}function R3($,Z,J,Q,X){let K=[...X],W,Y;for(let[B,q]of $.nodes.entries()){if(q.kind==="connector"){Y=q.operator;continue}let U=$.nodes[B+1],G=U?.kind==="connector"?U.operator:void 0,j=Q_($,B,q,Y,G),H=Y==="&&"||Y==="||",_=H?W:void 0,O=Y==="&&"?_?.success??K:Y==="||"?_?.failure??K:K,M=Y==="||"?_?.success??[]:[],L=Y==="&&"?_?.failure??[]:[],D=H||P$(G);if(q.kind==="function"){let b=O.flatMap((y)=>{let w=f2(y);return w.functionDefinitions.set(q.name,q.body),u9(y,[w],j,G==="&",P$(G))}),C=h9(b,[],M,L,Y,G);K=C.states,W=C.conditionalStates,Y=void 0;continue}if(q.kind==="group"){let b=[],C=[];for(let w of O){let k=R3(q.body,Z,J,Q,[f2(w)]);if(k.result)return k;if(b.push(...u9(w,k.states,j,G==="&",P$(G))),D)C.push(w,...j?k.states.map((Y1)=>N3(w,Y1)):k.states)}let y=h9(b,C,M,L,Y,G);K=y.states,W=y.conditionalStates,Y=void 0;continue}if(q.kind!=="command")continue;let z=J.trace?.flattenNested?J.trace.currentSegmentIndex:J.trace?.allocateSegment(),f=$.nodes[B-2],A=D3(Y)&&f?.kind==="command"?p5(f)??K_(f):void 0,F=[],R=[];for(let b of O){let C=W_(q,Z,J,Q,[f2(b)]);if(C.result)return{result:C.result,states:K};let y=$.dialect==="powershell"?C.states:C.states.map((w)=>N3(b,w));for(let w of y){let k=f2(w),Y1=q_(q,Z,J.trace?{...J,trace:ZQ(J.trace,z)}:J,Q,k,D3(Y),A);if(Y1)return{result:Y1,states:K};let P=D_(q,k.functionDefinitions);if(P)o1(J.derivedCommandWorkBudget,z3(P));let v=P?Z+1>=t2?g9(q.displayText,J,[k]):R3(P,Z+1,J,Q,[k]):{result:null,states:[k]};if(v.result)return v;if(F.push(...u9(b,v.states,j,G==="&",P$(G))),D)R.push(b),R.push(...v.states.map((n)=>j?N3(b,n):n))}}let I=h9(F,R,M,L,Y,G);K=I.states,W=I.conditionalStates,Y=void 0}return{result:null,states:K}}function Q_($,Z,J,Q,X){if(J.kind==="group"&&J.style==="subshell")return!0;if($.dialect==="posix"&&(D3(Q)||D3(X)))return!0;if(X==="&")return!0;return $.dialect==="powershell"&&J.kind==="group"&&J.style==="brace"&&X_($,Z)}function u9($,Z,J,Q,X){let K=J?Z.map((Y)=>N3($,Y)):[...Z],W=X?K.flatMap((Y)=>P2($.literalHeredocFiles,Y.literalHeredocFiles)?[Y]:[{...Y,literalHeredocFiles:new Map($.literalHeredocFiles)},Y]):K;return Q?[$,...W]:W}function N3($,Z){return{...$,literalHeredocFiles:new Map(Z.literalHeredocFiles)}}function X_($,Z){let J=[...$.nodes.slice(0,Z)].reverse().find((X)=>X.kind==="command"||X.kind==="connector");if(!J||J.kind!=="command")return!0;let Q=J.words[0]?.text.toLowerCase();if(Q==="&"||Q===".")return!1;if(Q==="write-output"||Q==="function"||Q==="start-job")return!0;if(Y_(J))return!0;return J.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function D3($){return $==="|"||$==="|&"}function K_($){if($?.dialect!=="powershell")return;if($.words.length===1&&$.words[0]?.quoted&&$.words[0].provenance==="literal")return $.words[0].text;if($.words[0]?.text.toLowerCase()==="write-output"&&$.words.length===2&&$.words[1]?.provenance==="literal")return $.words[1].text;return}function P$($){return $==="&&"||$==="||"}function h9($,Z,J,Q,X,K){let W={success:V3([...J,...$]),failure:V3([...Q,...Z])},Y=P$(K)?W:void 0;return{states:P$(X)||Y?V3([...W.success,...W.failure]):W.success,conditionalStates:Y}}function ZQ($,Z,J=$.flattenNested){return{currentSegmentIndex:Z,flattenNested:J,allocateSegment:$.allocateSegment,getNextSegmentIndex:$.getNextSegmentIndex,recordGlobal:$.recordGlobal,recordSegment:(Q,X=Z)=>$.recordSegment(Q,X)}}function W_($,Z,J,Q,X){let K=$.nested.map((W)=>({program:W,depth:Z}));if($.dialect==="powershell"){let W=B_($);if(W){if(Z+1>=t2)return g9(W,J,X);let Y=v1(W,"powershell");if(Y.status==="limited")return g9(W,J,X);if(Y.status!=="complete")return nJ(K,J,Q,X);o1(J.derivedCommandWorkBudget,z3(Y)),K.push({program:Y,depth:Z+1})}}return nJ(K,J,Q,X)}function Y_($){let Z=$.words[0];return Z?.provenance==="variable"&&$.words.at(-1)?.text==="="?Z.text.toLowerCase():void 0}function nJ($,Z,J,Q){let X=[...Q];for(let K of $){let W=[];for(let Y of X){let B=R3(K.program,K.depth,Z,J,[f2(Y)]);if(B.result)return B;W.push(...B.states)}X=V3(W)}return{result:null,states:X}}function B_($){let Z=$.words[0]?.provenance==="literal"&&!$.words[0].quoted&&$.words[0].raw===$.words[0].text&&($.words[0].text==="&"||$.words[0].text==="."),J=Z?1:0,Q=$.words[J];if(Q?.provenance!=="literal"||!Z&&(Q.quoted||Q.raw!==Q.text)||!["iex","invoke-expression"].includes(Q.text.toLowerCase()))return;let X=$.words.slice(J+1),K=X[0]&&!X[0].quoted&&X[0].raw===X[0].text&&["-c","-command"].includes(X[0].text.toLowerCase())?1:0,W=X[K];return X.length===K+1&&W?.quoted&&W.provenance==="literal"?W.text:void 0}function z3($){return $.nodes.reduce((Z,J)=>Z+(J.kind==="command"?J.words.length+J.nested.reduce((Q,X)=>Q+z3(X),0):J.kind==="group"||J.kind==="function"?z3(J.body):0),0)}function g9($,Z,J){return Z.trace?.recordSegment({type:"error",message:B0}),{result:{reason:B0,segment:$,intent:"stop_and_explain"},states:[...J]}}function q_($,Z,J,Q,X,K,W){let Y=L_($);if(Y&&J.strict)return J.trace?.recordSegment({type:"error",message:Y}),{reason:Y,segment:$.source,intent:"stop_and_explain"};JQ($,X,"before-consumer",J.environment.paths);let B=j$($.dialect,$.words).map(S),q=$.displayText,U=dJ(B,X.shellGitContextState);if($.dialect==="powershell"){let H=T(O5($,K,b_(J,X.effectiveCwd)),J.policy);if(J.trace?.recordSegment({type:"rule-check",ruleModule:"analyze/powershell/remove-item.ts",ruleFunction:"analyzePowerShellCommandViewMatch",matched:!!H,reason:H?.reason}),H)return I_(q,H)}if(B.length===1&&B[0]?.includes(" ")&&!$.dynamicExecutable){let H=T(U2(B[0],J.scanWork),J.policy),_=H!==null&&!J.strict&&l7($,J.rootProgram,J.scanWork);if(H&&!_)return J.trace?.recordSegment({type:"dangerous-text",token:B[0],matched:!0,reason:H.reason}),{reason:H.reason,segment:q,ruleId:H.id,intent:H.intent};return J.trace?.recordSegment({type:"dangerous-text",token:B[0],matched:!1}),aJ($,Y,X,U,W,J)}let G=z2($.words,Z,{...J,commandView:$,cwd:Q,effectiveCwd:X.effectiveCwd,envAssignments:U,literalHeredocFiles:X.literalHeredocFiles,functionDefinitions:X.functionDefinitions,hasPipelineInput:K,literalShellInput:W,analyzeNested:(H,_)=>{let O=_&&Object.hasOwn(_,"effectiveCwd")?_.effectiveCwd:X.effectiveCwd,M=x9(H,Z+1,{...J,derivedCommandWorkBudget:J.derivedCommandWorkBudget,effectiveCwd:O,envAssignments:_?.envAssignments??U,literalHeredocFiles:X.literalHeredocFiles,functionDefinitions:_?.functionDefinitions,worktreeMode:_?.worktreeMode??J.worktreeMode,trace:J.trace?ZQ(J.trace,J.trace.currentSegmentIndex,!0):void 0});return M?{reason:M.reason,ruleId:M.ruleId,intent:M.intent}:null}});if(G)return{...G,segment:q};let j=aJ($,Y,X,U,W,J);if(j)return j;return cJ(B,X.shellGitContextState),null}function aJ($,Z,J,Q,X,K){let W=M_($,Z,J,Q??new Map,K);if(W)return W;return JQ($,J,"after-consumer",K.environment.paths),J.literalHeredocFiles.clear(),H_($,Z,J,K.environment.paths),V_($,J,X,K.environment,K.trace),null}var U_=new Set([">>","<>"]);function JQ($,Z,J,Q){for(let K of $.redirections){if(!(J==="before-consumer"?G_(K):U_.has(K.operator)))continue;oJ(K.target,Z,Q)}if(J!=="before-consumer"||!D1($.words[0],"tee"))return;let X=QQ($.words.slice(1));if(!X)return;for(let K of X.operands)oJ(K,Z,Q)}function G_($){if($.operator===">"||$.operator===">|")return!0;return $.operator===">&"&&$.fd===void 0&&$.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test($.target.text)}function oJ($,Z,J){let Q=$?.provenance==="literal"?G2($.text,Z.effectiveCwd,J):void 0;if(!Q)return;Z.literalHeredocFiles.delete(Q)}function H_($,Z,J,Q){if(Z)return;let X=$.redirections.find((K)=>K.operator==="<<"||K.operator==="<<-")?.heredoc;if(!X?.quotedDelimiter)return;for(let K of j_($)){let W=G2(K.text,J.effectiveCwd,Q);if(!W||!r7(W))continue;if(!J.literalHeredocFiles.has(W)&&J.literalHeredocFiles.size>=s7)throw new A1;J.literalHeredocFiles.set(W,X.body)}}function j_($){let Z=O_($.redirections)?.target,J=tJ(Z)?[Z]:[];if(D1($.words[0],"cat"))return __($.words)?J:[];if(!D1($.words[0],"tee"))return[];let Q=QQ($.words.slice(1));if(!Q||Q.append||Q.hasUnsupportedOptions||!Q.operands.every(tJ))return[];return[...Q.operands,...J]}function __($){let Z=!1;for(let J of $.slice(1)){if(Z||J.provenance!=="literal")return!1;if(J.text==="--"){Z=!0;continue}if(!/^-u+$/.test(J.text))return!1}return!0}function O_($){let Z=$.findLast((J)=>(J.fd??([">",">|",">>",">&"].includes(J.operator)?1:0))===1);return Z?.operator===">"||Z?.operator===">|"?Z:void 0}function QQ($){let Z=[],J=!0,Q=!1,X=!1;for(let K of $){if(K.provenance!=="literal")return;if(J&&D1(K,"--")){J=!1;continue}if(J&&!K.quoted&&K.raw===K.text&&/^-[^-]/.test(K.text)){Q||=K.text.slice(1).includes("a"),X||=[...K.text.slice(1)].some((W)=>W!=="a"&&W!=="i");continue}if(J&&!K.quoted&&K.raw===K.text&&K.text.startsWith("--")){Q||=K.text==="--append",X||=K.text!=="--append"&&K.text!=="--ignore-interrupts";continue}Z.push(K)}return{operands:Z,append:Q,hasUnsupportedOptions:X}}function tJ($){if(!$||$.provenance!=="literal"||$.text.length===0)return!1;if($.quoted||$.raw!==$.text)return!0;return!$.raw.startsWith("~")&&!/[{}]/.test($.raw)}function D1($,Z){return $?.text===Z&&$.raw===Z&&$.provenance==="literal"&&!$.quoted}function L_($){let Z=$.redirections.filter((W)=>W.operator==="<<"||W.operator==="<<-");if(Z.length===0)return;if(Z.length!==1)return t0;let J=Z[0];if(!J?.heredoc)return t0;if(!J.heredoc.quotedDelimiter)return $_;if(J.fd!==void 0&&J.fd!==0)return t0;if($.redirections.some((W)=>W!==J&&["<","<<","<<-","<<<","<&","<>"].includes(W.operator)))return t0;let Q=$.redirections.some((W)=>W!==J&&eJ(W.target));if(D1($.words[0],"cat"))return Q?t0:void 0;if(D1($.words[0],"tee"))return Q||$.words.slice(1).some(eJ)?t0:void 0;let X=$.words[0],K=$.words[1];if(D1(X,"git")&&(D1(K,"apply")||D1(K,"commit")))return;if(D1(X,"gh")&&(D1(K,"pr")||D1(K,"issue"))&&D1($.words[2],"create"))return;return t0}function eJ($){return $?.parts.some((Z)=>Z.provenance==="command-substitution"&&Z.raw.startsWith(">("))??!1}function M_($,Z,J,Q,X){if(!Z)return null;let K=$.redirections.filter((q)=>q.operator==="<<"||q.operator==="<<-"),W=K.flatMap((q)=>q.heredoc?[q.heredoc.body]:[]);if(N_($,K,J,Q,X))return null;let Y=F_($,K,X);if(Y!==void 0)return Y?{reason:Y.reason,segment:$.displayText,ruleId:Y.id,intent:Y.intent}:null;let B=k9(W.length===K.length?W.join(`
-`):$.source,X);return B?{...B,segment:$.displayText}:null}function F_($,Z,J){let Q=Z.length===1?Z[0]:void 0;if(!Q?.heredoc?.quotedDelimiter||Q.fd!==void 0&&Q.fd!==0)return;let X=$.words[0];if(X?.provenance!=="literal"||!V1(X.text))return;if(!$.words.slice(1).every((q)=>q.provenance==="literal"&&q.text.startsWith("-")))return;let W=Q.heredoc.body,Y=o(J.policy,"interpreter.one-liner-paranoid",!!J.paranoidInterpreters);if(J.trace?.recordSegment({type:"interpreter",interpreter:X.text,codeArg:W,paranoidBlocked:Y}),Y){let q=T(N("interpreter.one-liner-paranoid",M$),J.policy);if(q)return q}if(!F$(W,J.scanWork))return null;let B=T(N("interpreter.dangerous-command",l0),J.policy);if(!B)return null;return J.trace?.recordSegment({type:"dangerous-text",token:W,matched:!0,reason:B.reason}),B}function N_($,Z,J,Q,X){let K=Z.length===1?Z[0]:void 0;if(!K?.heredoc?.quotedDelimiter||K.fd!==void 0&&K.fd!==0)return!1;let W=g0($.words,X.environment,J.effectiveCwd,Q),Y=W.words.map(S),B=x(Y[0]??"");if(W.unverifiableEnvSplit||!$1.has(B)&&!$1.has(h(B)))return!1;return E1(Y)}function V_($,Z,J,Q,X){let K=gJ($,Z.effectiveCwd,Q,J);if(K===null)X?.recordSegment({type:"cwd-change",segment:$.words.map(S).join(" "),effectiveCwdNowUnknown:!0});if(K!==void 0)Z.effectiveCwd=K}function f2($){return{effectiveCwd:$.effectiveCwd,shellGitContextState:pJ($.shellGitContextState),literalHeredocFiles:new Map($.literalHeredocFiles),functionDefinitions:new Map($.functionDefinitions)}}function V3($){let Z=[];for(let J of $){if(!Z.some((Q)=>R_(Q,J)))Z.push(J);if(Z.length>Z_)throw new A1}return Z}function R_($,Z){return $.effectiveCwd===Z.effectiveCwd&&P2($.literalHeredocFiles,Z.literalHeredocFiles)&&P2($.functionDefinitions,Z.functionDefinitions)&&P2($.shellGitContextState.effectiveEnvAssignments,Z.shellGitContextState.effectiveEnvAssignments)&&P2($.shellGitContextState.shellAssignments,Z.shellGitContextState.shellAssignments)&&z_($.shellGitContextState.exportedNames,Z.shellGitContextState.exportedNames)&&$.shellGitContextState.allexport===Z.shellGitContextState.allexport&&$.shellGitContextState.keywordExport===Z.shellGitContextState.keywordExport}function P2($,Z){if($===Z)return!0;if(!$||!Z||$.size!==Z.size)return!1;return[...$].every(([J,Q])=>Z.get(J)===Q&&Z.has(J))}function D_($,Z){let J=F4($);return J===void 0?void 0:Z.get(J)}function z_($,Z){return $.size===Z.size&&[...$].every((J)=>Z.has(J))}function I_($,Z){if(!Z)return null;return{reason:Z.reason,segment:$,ruleId:Z.id,intent:Z.intent}}function b_($,Z=$.effectiveCwd){let J=Z===null;return{environment:$.environment,cwd:J?void 0:Z??$.cwd,originalCwd:J?void 0:$.cwd,strict:$.strict,paranoid:$.paranoidRm,allowTmpdirVar:$.allowTmpdirVar,protectedGitMetadata:$.protectedGitMetadata,policy:$.policy}}function k9($,Z){let J=T(U2($,Z.scanWork),Z.policy),Q=Z.trace?.currentSegmentIndex??Z.trace?.allocateSegment(),X={type:"dangerous-text",token:$,matched:!!J,reason:J?.reason};if(Z.trace?.recordSegment(X,Q),!J&&/^(?:cd|pushd)\s/.test($))Z.trace?.recordSegment({type:"cwd-change",segment:$,effectiveCwdNowUnknown:!0},Q);return J?{reason:J.reason,segment:$,ruleId:J.id,intent:J.intent}:null}function $Q($,Z){let J={type:"strict-unparseable",rawCommand:$,reason:D0};if(Z.trace?.currentSegmentIndex===void 0)Z.trace?.recordGlobal(J);else Z.trace.recordSegment(J)}function nz($,Z){return l9($,Z)}function l9($,Z,J,Q){let X=x9($,0,{...Z,...k7(Z),factStore:Q},J);if(!X)return null;return{kind:"deny",reason:X.reason,intent:X.intent??"manual_only",...X.ruleId?{ruleId:X.ruleId}:{},evidence:[{kind:"command",command:$,segment:X.segment}]}}function XQ($,Z,J,Q,X){if(J.kind!=="command")return{toolName:$,input:Z,route:J,context:Q};return{toolName:$,input:Z,route:J,context:Q,command:X}}var m9=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],I3={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},f_=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],P_=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],p9=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...P_.flatMap(($)=>f_.map((Z)=>({id:["secret.home",$.idSlug,Z.slice(1)].join("."),category:"Home path",label:[$.label,Z].join(""),description:["Blocks home ",$.label,Z," credential backup files."].join(""),suffixParts:[...$.directoryParts,[$.basename,Z].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var b3=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]}],KQ=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],C_=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],c9=KQ.map(($)=>({id:`secret.variant.${$.slug}.separator`,category:"Variant",label:`${$.label}-* / ${$.label}_*`,description:`Blocks ${$.label} variants with dash or underscore suffixes.`,prefix:$.prefix})),d9=KQ.flatMap(($)=>C_.map((Z)=>({id:`secret.variant.${$.slug}.${Z.slice(1)}`,category:"Variant",label:`${$.label}${Z}`,description:`Blocks ${$.label}${Z} private credential variants.`,prefix:$.prefix,suffix:Z}))),C2={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},i9=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map(($)=>({id:`secret.ext.${$}`,category:"Extension",label:`.${$}`,description:`Blocks files with the .${$} extension.`,extension:$})),s9=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],WQ=[...m9,I3,...p9,...c9,...d9,C2,...i9,...s9,...b3].map(($)=>({id:$.id,category:$.category,label:$.label,...$.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in $?{paths:$.paths}:{description:$.description}})),YQ=new Set(b3.flatMap(($)=>$.category==="Coding CLI config"?[$.id]:[])),A_=WQ.map(($)=>$.id),f3=new Set(A_);import{createRequire as E_}from"node:module";var BQ=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var A2=64,UQ="Rule config exceeds CC Safety Net's safe source limit.";var qQ=Object.freeze({maxSources:64,concurrency:4,maxRequests:131,maxResponseBytes:67108864});function P3($={}){return{requests:0,responseBytes:0,maxRequests:$.maxRequests??qQ.maxRequests,maxResponseBytes:$.maxResponseBytes??qQ.maxResponseBytes}}function C3($){return{controller:new AbortController,budget:P3(),resolveUrl:$}}function GQ($){if($.requests>=$.maxRequests)throw Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");$.requests++}function HQ($,Z){if(Z>$.maxResponseBytes-$.responseBytes)throw $.responseBytes+=Z,Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");$.responseBytes+=Z}var T_=E_(import.meta.url),jQ,S_=Array(A2+1).fill("over-limit"),_Q=/^[^/]+\/[^/]+$/,y_=/^sha256:[a-f0-9]{64}$/,A3=`must be an integer between ${n3} and ${a3}`,w_=["version","rules","overrides","transparent_wrappers"],v_=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function OQ($){if(!S1($)||!Array.isArray($.rules)||$.rules.length<=A2)return $;return{$schema:$.$schema,version:$.version,rules:S_,overrides:$.overrides,transparent_wrappers:$.transparent_wrappers}}function u_(){let $=T_("../vendor/zod.cjs"),Z=(F)=>{let R=$.superRefine(F);return R._zod.def.when=()=>!0,R},J=$.enum(BQ),Q=$.union([$.literal("off"),$.looseObject({reason:$.string({error:"required non-empty string"}).min(1,"required non-empty string").max(B$,`must be at most ${B$} characters`).describe("Replacement block reason"),intent:J.optional()})],{error:'must be "off" or an object'}).describe("Disable a rule or replace its block reason and intent."),X=$.string({error:"must be a rulebook source string"}).min(1,"must be a non-empty rulebook source string"),K=$.string({error:"must be a command string"}).regex(y0,"must match command pattern").describe("Command name such as 'git', 'docker', or 'rtk'."),W=$.looseObject({$schema:$.unknown().optional().describe("JSON Schema reference for IDE support"),version:$.literal(1).describe("Schema version (must be 1)"),rules:$.array(X,{error:"must be an array of rulebook source strings"}).max(A2,UQ).default([]).describe("Rulebook source strings such as project-rules or owner/repo#main/team-rules"),overrides:$.record($.string().meta({pattern:_Q.source}),Q).default({}).describe("Rule overrides by id"),transparent_wrappers:$.array(K,{error:"must be an array of command strings"}).default([]).describe("Commands that transparently execute a visible protected child command")}),Y=(F,R)=>{if(!S1(F))return;if(Array.isArray(F.rules)&&F.rules.length<=A2){let b=new Set;F.rules.forEach((C,y)=>{if(typeof C!=="string"||C==="")return;if(C.trim()===""){R.addIssue({code:"custom",message:"must be a non-empty rulebook source string",path:["rules",y]});return}let w=p$(C);if(w){R.addIssue({code:"custom",message:w,path:["rules",y]});return}if(b.has(C)){R.addIssue({code:"custom",message:`duplicate rulebook source "${C}"`,path:["rules",y]});return}b.add(C)})}if(S1(F.overrides))for(let b of Object.keys(F.overrides)){if(_Q.test(b))continue;R.addIssue({code:"custom",message:"must use <rulebook-name>/<rule-name>",path:["overrides",b]})}if(!Array.isArray(F.transparent_wrappers))return;let I=new Set;F.transparent_wrappers.forEach((b,C)=>{if(typeof b!=="string"||!y0.test(b))return;if(I.has(b)){R.addIssue({code:"custom",message:`duplicate command "${b}"`,path:["transparent_wrappers",C]});return}if(g7(b)){R.addIssue({code:"custom",message:`reserved command "${b}" cannot be a wrapper`,path:["transparent_wrappers",C]});return}I.add(b)})},B=$.preprocess(OQ,W.check($.superRefine(Y))),q=$.preprocess(OQ,W.check(Z(Y))),U=$.strictObject({fail_closed:$.boolean().optional(),paranoid_rm:$.boolean().optional(),paranoid_interpreters:$.boolean().optional()}),G=(F,R)=>$.intersection($.record($.string().refine((I)=>F.has(I),{error:(I)=>`unknown ${R} rule id "${String(I.input)}"`}),$.unknown()),$.record($.string(),$.enum(["on","off"]))),j=(F)=>$.array($.string({error:"must be a non-empty path string"}),{error:"must be an array of paths"}).check(Z((R,I)=>{if(!Array.isArray(R))return;let b=S0();R.forEach((C,y)=>{if(typeof C!=="string")return;let w=F(C,b);if(w)I.addIssue({code:"custom",message:w,path:[y]})})})),H=$.strictObject({version:$.literal(1),safety:$.strictObject({level:$.enum(["standard","strict","paranoid"]).optional(),overrides:U.optional()}).optional(),workflow:$.strictObject({worktree_mode:$.boolean().optional()}).optional(),destructive_command_protection:$.strictObject({enabled:$.boolean().optional(),overrides:G(a2,"destructive command").optional(),allow_paths:j($3).optional()}).optional(),secret_protection:$.strictObject({enabled:$.boolean().optional(),overrides:G(f3,"secret protection").optional(),deny_paths:j(Z3).optional(),allow_paths:j(J3).optional()}).optional(),audit:$.strictObject({retention_days:$.number({error:A3}).int(A3).min(n3,A3).max(a3,A3).optional().describe("Days of audit log history to keep before the sweep deletes it")}).optional()}),_=(F)=>{let R=(y,w)=>F==="legacy"?y:w,I=R("must match pattern (letters, numbers, hyphens, underscores)","must match command pattern"),b=`required non-empty string up to ${B$} characters`,C=$.looseObject({name:$.string({error:"required string"}).regex(I1,R("must match pattern (letters, numbers, hyphens, underscores; max 64 chars)","must match rule name pattern")),command:$.string({error:R("required string","required string matching command pattern")}).regex(y0,R(I,"required string matching command pattern")),subcommand:$.string({error:R("must be a string if provided","must match command pattern")}).regex(y0,I).optional(),block_args:$.array($.string({error:R("must be a string","must be a non-empty string")}).refine((y)=>y!=="",{error:R("must not be empty","must be a non-empty string")}),{error:R("required array","required non-empty array")}).refine((y)=>y.length>0,{error:R("must have at least one element","required non-empty array")}),reason:$.string({error:R("required string",b)}).refine((y)=>y!=="",{error:R("must not be empty",b)}).refine((y)=>y.length<=B$,{error:R(`must be at most ${B$} characters`,b)}),intent:J.optional()},{error:"must be an object"});return $.array(C,{error:R("must be an array","required array")}).check(Z((y,w)=>{if(!Array.isArray(y))return;let k=new Set;y.forEach((Y1,P)=>{let v=S1(Y1)?Y1.name:void 0;if(typeof v!=="string")return;if(k.has(v.toLowerCase())){w.addIssue({code:"custom",message:`duplicate rule name "${v}"`,path:[P,"name"]});return}k.add(v.toLowerCase())})}))},O=$.looseObject({version:$.literal(1),rules:_("legacy").optional()}),M="required string matching rule name pattern",L=$.looseObject({command:$.string({error:"required non-empty string"}).refine((F)=>F.trim()!=="",{error:"required non-empty string"}),expect:$.enum(["blocked","allowed"]),rule:$.string({error:"must be a string if provided"}).optional()},{error:"must be an object"}).check(Z((F,R)=>{if(!S1(F))return;if(F.expect!=="blocked"||typeof F.rule==="string")return;R.addIssue({code:"custom",message:"required string for blocked fixtures",path:["rule"]})})),D=$.looseObject({name:$.string({error:"required string matching rule name pattern"}).regex(I1,"required string matching rule name pattern"),version:$.string({error:"required non-empty string"}).refine((F)=>F!=="",{error:"required non-empty string"}),allowed_commands:$.array($.string({error:"must match command pattern"}).regex(y0,"must match command pattern"),{error:"required array"}).check(Z((F,R)=>{if(!Array.isArray(F))return;let I=new Set;F.forEach((b,C)=>{if(typeof b!=="string"||!y0.test(b))return;if(I.has(b)){R.addIssue({code:"custom",message:`duplicate command "${b}"`,path:[C]});return}I.add(b)})})),rules:_("rulebook"),tests:$.array(L,{error:"must be an array if provided"}).optional()}).check(Z((F,R)=>{if(!S1(F))return;let I=new Set(r9(F));if(Array.isArray(F.tests)){let C=new Set(F.tests.flatMap((y)=>S1(y)&&y.expect==="blocked"&&typeof y.rule==="string"?[y.rule]:[]));for(let y of C){if(I.has(y))continue;R.addIssue({code:"custom",message:`blocked fixture references unknown rule "${y}"`,path:["tests"]})}}if(!Array.isArray(F.allowed_commands)||!Array.isArray(F.rules))return;let b=new Set(F.allowed_commands.filter((C)=>typeof C==="string"));F.rules.forEach((C,y)=>{let w=S1(C)?C.command:void 0;if(typeof w!=="string"||b.has(w))return;R.addIssue({code:"custom",message:`"${w}" must be listed in allowed_commands`,path:["rules",y,"command"]})})})),z=$.string({error:"required string"}).refine((F)=>F.trim()!=="",{error:"required string"}),f=$.looseObject({spec:z,name:z,version:z,digest:$.string({error:"required sha256 digest"}).regex(y_,"required sha256 digest")},{error:"must be an object"}),A=$.looseObject({rulebooks:$.array($.intersection(f,$.discriminatedUnion("kind",[$.object({kind:$.literal("local-directory"),path:z}),$.object({kind:$.literal("github"),owner:z,repo:z,ref:z,commit:z,path:z,display_ref:$.unknown().optional()})],{error:(F)=>{if(!S1(F.input))return"must be an object";let R=F.input.kind;return typeof R==="string"?`unknown kind "${R}"`:"required string"}})))});return{RulesConfigSchema:B,RulesConfigDiagnosticSchema:q,RuleOverrideSchema:Q,UserPolicySchema:H,LegacyConfigSchema:O,RulebookSchema:D,RulesLockfileSchema:A}}function C$(){return jQ??=u_(),jQ}function LQ(){return C$().RulesConfigSchema}function h_(){return C$().UserPolicySchema}function HI(){return C$().LegacyConfigSchema}function MQ(){return C$().RulebookSchema}function FQ(){return C$().RulesLockfileSchema}function r9($){let Z=S1($)?$.rules:void 0;return(Array.isArray(Z)?Z:[]).flatMap((J)=>{let Q=S1(J)?J.name:void 0;return typeof Q==="string"?[Q]:[]})}function NQ($){let Z=C$().RulesConfigDiagnosticSchema.safeParse($);if(Z.success)return{errors:[],sources:new Set(Z.data.rules)};return{errors:A$(RQ(Z.error.issues,w_)),sources:l_($,Z.error.issues)}}function E2($){let Z=h_().safeParse($);if(Z.success)return[];return A$(RQ(Z.error.issues,v_)," ")}function A$($,Z=": ",J=" "){return[...new Set($.flatMap((Q)=>VQ(Q,Z,J,[])))]}function VQ($,Z,J,Q){let X=[...Q,...$.path],K=x_(X);if($.code==="unrecognized_keys")return $.keys.map((W)=>`${K?`${K}.`:""}unknown field "${W}"`);if($.code==="invalid_key")return $.issues.map((W)=>W.message);if($.code==="invalid_union"){let W=$.errors.flat().filter((Y)=>Y.path.length>0);if(W.length>0)return W.flatMap((Y)=>VQ(Y,Z,J,X))}if(X.length===0)return[$.code==="invalid_type"?"Config must be an object":$.message];if(X.length===1&&($.code==="too_big"||$.code==="too_small")&&$.origin==="array")return[$.message];return[`${K}${X.length===1?J:Z}${g_($)}`]}function g_($){if($.code==="invalid_value")return`must be ${k_($.values)}`;if($.code!=="invalid_type"||!$.message.startsWith("Invalid input:"))return $.message;if($.expected==="object"||$.expected==="record")return"must be an object if provided";return $.expected==="boolean"?"must be a boolean":$.message}function k_($){if($.length>3)return`one of ${$.join(", ")}`;let Z=$.map((J)=>typeof J==="string"?`"${J}"`:String(J));if(Z.length<2)return`${Z[0]}`;return`${Z.slice(0,-1).join(", ")}${Z.length>2?",":""} or ${Z.at(-1)}`}function x_($){return $.map((Z,J)=>{if(typeof Z==="number")return`[${Z}]`;return J===0?String(Z):`.${String(Z)}`}).join("")}function RQ($,Z){let J=$.map((K)=>K.path[1]),Q=[...new Set(J.filter((K)=>typeof K==="string"))],X=(K,W)=>[K.path.length===0?-1:Z.indexOf(String(K.path[0])),typeof W==="number"?W:Q.indexOf(String(W)),K.code==="custom"?0:1];return $.map((K,W)=>({issue:K,rank:X(K,J[W])})).sort((K,W)=>K.rank[0]-W.rank[0]||K.rank[1]-W.rank[1]||K.rank[2]-W.rank[2]).map((K)=>K.issue)}function l_($,Z){let J=S1($)?$.rules:void 0;if(!Array.isArray(J))return new Set;if(Z.some((X)=>X.path.length===1&&X.path[0]==="rules"))return new Set;let Q=new Set(Z.filter((X)=>X.path[0]==="rules"&&typeof X.path[1]==="number").map((X)=>X.path[1]));return new Set(J.filter((X,K)=>typeof X==="string"&&!Q.has(K)))}function S1($){return!!$&&typeof $==="object"&&!Array.isArray($)}var DQ={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m_($){return NQ($)}function E$($){try{let Z=W0(zQ($));if(Z===null)return{config:null,errors:[]};if(!Z.trim())return{config:null,errors:["Config file is empty"]};let J=JSON.parse(Z),Q=m_(J);if(Q.errors.length>0)return{config:null,errors:Q.errors};let X=LQ().parse(J);return{config:{version:1,rules:X.rules??[],overrides:X.overrides??{},transparent_wrappers:X.transparent_wrappers??[]},errors:[]}}catch(Z){if(Z instanceof u)return{config:null,errors:[Z.message]};let J=Z instanceof Error?Z.message:String(Z);return{config:null,errors:[Z instanceof SyntaxError?"Invalid JSON":J]}}}function FI($){let Z=E$($);if(Z.errors.length>0)return{ok:!1,result:{ok:!1,errors:Z.errors,warnings:[],entries:[]}};return{ok:!0,config:Z.config??DQ}}function NI($,Z=[]){E3($,{version:1,rules:Z,overrides:{},transparent_wrappers:[]})}function VI($,Z="project-rules"){E3($,{rulebook_version:1,name:Z,version:"1.0.0",description:Z==="project-rules"?"Project-specific CC Safety Net rules.":"User-specific CC Safety Net rules.",author:Z==="project-rules"?"project":"user",allowed_commands:["docker"],rules:[{name:"block-docker-system-prune",command:"docker",subcommand:"system",block_args:["prune"],reason:"Use targeted cleanup instead."}],tests:[{command:"docker system prune",expect:"blocked",rule:"block-docker-system-prune"}]})}function E3($,Z,J,Q){NZ(zQ($),`${JSON.stringify(Z,null,2)}
-`,J,Q)}function zQ($){return typeof $==="string"?k2($):$}import{chmodSync as p_,existsSync as n9,mkdirSync as c_,readFileSync as a9}from"node:fs";import{dirname as fQ,join as d_}from"node:path";var i_=new Set(["standard","strict","paranoid"]),S3={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:i2}};function y$($){return d_(fQ(Y0($)),p2)}function yI($={}){let Z=y$($);if(!n9(Z))return{path:Z,exists:!1,raw:"",policy:T$(),errors:[]};let J=a9(Z,"utf-8");if(!J.trim())return{path:Z,exists:!0,raw:J,policy:T$(),errors:["Config file is empty"]};try{let Q=JSON.parse(J),X=E2(Q);return{path:Z,exists:!0,raw:J,policy:X.length>0?T$():S$(Q),errors:X}}catch(Q){return{path:Z,exists:!0,raw:J,policy:T$(),errors:[`Invalid JSON: ${Q instanceof Error?Q.message:String(Q)}`]}}}function T3($,Z={}){let J=y$(Z),Q=E2($),X=Q.length>0?T$():S$($);if(Q.length>0)return{path:J,policy:X,errors:Q};return c_(fQ(J),{recursive:!0,mode:448}),E3(J,X,384),p_(J,384),{path:J,policy:X,errors:[]}}function wI($){let Z=E2($);if(Z.length>0)return{errors:Z};return{preview:s_(S$($)),errors:[]}}function s_($){let Z=s4({safety:AQ($.safety)}),J=Z6({destructiveCommandProtectionEnabled:$.destructive_command_protection.enabled,destructiveCommandRuleOverrides:$.destructive_command_protection.overrides},Z.capabilities),Q=Object.values(J),X=Q.filter((W)=>W.source!=="catastrophic"),K=Object.values($.destructive_command_protection.overrides);return{selectedPreset:$.safety.level,effectiveLevel:Z.effectiveLevel,capabilities:Z.capabilities,rules:J,counts:{enabled:X.filter((W)=>W.enabled).length,disabled:X.filter((W)=>!W.enabled).length,explicitOn:K.filter((W)=>W==="on").length,explicitOff:K.filter((W)=>W==="off").length,effectiveCustomizations:Q.filter((W)=>W.changesInherited).length,inheritedRequiresStrict:Q.filter((W)=>!W.enabled&&!W.override&&W.activationCapability==="fail_closed").length,inheritedRequiresParanoid:Q.filter((W)=>!W.enabled&&!W.override&&(W.activationCapability==="paranoid_rm"||W.activationCapability==="paranoid_interpreters")).length}}}function vI($={}){let Z=y$($);if(!n9(Z))return T3(S3,$);let J=a9(Z,"utf-8");if(!J.trim())return T3(S3,$);try{return T3(S$(JSON.parse(J)),$)}catch{return T3(S3,$)}}function PQ($={}){let Z=o_(y$($));return{safety:Z.policy.safety,worktreeMode:Z.policy.worktreeMode,destructiveCommandProtectionEnabled:Z.policy.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:{...Z.policy.destructiveCommandRuleOverrides},destructiveCommandAllowPaths:[...Z.policy.destructiveCommandAllowPaths],secretProtection:Z.policy.secretProtection,errors:Z.errors,...Z.fallback?{fallback:Z.fallback}:{}}}function S$($){if(!X0($))return T$();let Z=X0($.safety)?$.safety:{},J=X0(Z.overrides)?Z.overrides:{},Q=X0($.workflow)?$.workflow:{},X=X0($.destructive_command_protection)?$.destructive_command_protection:{},K=X0($.secret_protection)?$.secret_protection:{};return{version:1,safety:{level:i_.has(Z.level)?Z.level:"standard",overrides:{...typeof J.fail_closed==="boolean"?{fail_closed:J.fail_closed}:{},...typeof J.paranoid_rm==="boolean"?{paranoid_rm:J.paranoid_rm}:{},...typeof J.paranoid_interpreters==="boolean"?{paranoid_interpreters:J.paranoid_interpreters}:{}}},workflow:{worktree_mode:typeof Q.worktree_mode==="boolean"?Q.worktree_mode:!1},destructive_command_protection:{enabled:typeof X.enabled==="boolean"?X.enabled:!0,overrides:IQ(X.overrides,a2),allow_paths:n_(X.allow_paths)},secret_protection:{enabled:typeof K.enabled==="boolean"?K.enabled:!0,overrides:IQ(K.overrides,f3),deny_paths:r_(K.deny_paths),allow_paths:a_(K.allow_paths)},audit:{retention_days:s2(X0($.audit)?$.audit.retention_days:void 0)}}}function IQ($,Z){if(!X0($))return{};return Object.fromEntries(Object.entries($).flatMap(([J,Q])=>Z.has(J)&&(Q==="on"||Q==="off")?[[J,Q]]:[]))}function r_($){if(!Array.isArray($))return[];let Z=S0();return $.filter((J)=>Z3(J,Z)===null)}function n_($){if(!Array.isArray($))return[];let Z=S0();return $.filter((J)=>$3(J,Z)===null)}function a_($){if(!Array.isArray($))return[];let Z=S0();return $.filter((J)=>J3(J,Z)===null)}function X0($){return!!$&&typeof $==="object"&&!Array.isArray($)}function T$(){return structuredClone(S3)}function o_($){let Z=t_();if(!n9($)){let J=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!X0(J))return{policy:Z,errors:[]};return{policy:bQ(S$(J)),errors:[]}}try{let J=a9($,"utf-8");if(!J.trim())return{policy:Z,errors:[`${$}: Config file is empty`],fallback:"defaults"};let Q=JSON.parse(J),X=E2(Q),K=bQ(S$(Q));if(X.length>0)return{policy:K,errors:X.map((W)=>`${$}: ${W}`),fallback:X0(Q)?"salvaged":"defaults"};return{policy:K,errors:[]}}catch(J){let Q=J instanceof Error?J.message:String(J);return{policy:Z,errors:[`${$}: ${J instanceof SyntaxError?"Invalid JSON":Q}`],fallback:"defaults"}}}function CQ($){let Z=Object.entries($),J=new Set(Z.flatMap(([Q,X])=>X==="on"?[Q]:[]));return new Set([...[...YQ].filter((Q)=>!J.has(Q)),...Z.flatMap(([Q,X])=>X==="off"?[Q]:[])])}function t_(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:CQ({}),denyPaths:[],allowPaths:[]}}}function bQ($){return{safety:AQ($.safety),worktreeMode:$.workflow.worktree_mode,destructiveCommandProtectionEnabled:$.destructive_command_protection.enabled,destructiveCommandRuleOverrides:{...$.destructive_command_protection.overrides},destructiveCommandAllowPaths:[...$.destructive_command_protection.allow_paths],secretProtection:{enabled:$.secret_protection.enabled,disabledRules:CQ($.secret_protection.overrides),denyPaths:[...$.secret_protection.deny_paths],allowPaths:[...$.secret_protection.allow_paths]}}}function AQ($){return{level:$.level,overrides:{failClosed:$.overrides.fail_closed,paranoidRm:$.overrides.paranoid_rm,paranoidInterpreters:$.overrides.paranoid_interpreters}}}import{dirname as o9}from"node:path";var yQ="This path contains the protected policy config and you must not modify or delete it.",e_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function wQ($){let Z=v0(q0()),J=KO($.invocation.context.executionCwd,Z);if($.invocation.route.kind==="patch")return EQ($.paths.map((X)=>X.raw),!1,$.invocation.context.executionCwd,J,Z);let Q=O1($,"input-candidate");if($.invocation.route.kind==="command")return Q?TQ(Q.shell,$.invocation.context.executionCwd,J,Z):null;if($.invocation.route.kind==="unknown"&&Q){let X=TQ(Q.shell,$.invocation.context.executionCwd,J,Z);if(X)return X}return EQ($.paths.map((X)=>X.raw),$.invocation.route.kind==="grep"||$.invocation.route.kind==="glob"||Z4($.invocation.toolName),$.invocation.context.executionCwd,J,Z)}function EQ($,Z,J,Q,X){if(Z)return null;let K=$.find((W)=>T2(W,J,Q,X));return K?{target:K}:null}function TQ($,Z,J,Q){let X=E4($,Z,Q,{findSegmentTarget:(K,W)=>$O(K,W,J,Q)?.target??null,isRedirectionTarget:(K,W)=>T2(K,W.cwd,J,Q),findMalformedTarget:(K)=>XO(K,Z,J,Q)?.target??null,normalizeCwd:K1});return X?{target:X}:null}function $O($,Z,J,Q){if(J2($))return null;let X=Q.environment,K=P1([...$],X),W=h(K[0]??"").toLowerCase(),Y=K.slice(1);if(W==="rm"&&ZO(Y)){let B=JO(Y).find((q)=>SQ(M1(q,Z.variables),Z.cwd,J,Q));if(B)return{target:B}}if(W==="find"){if(K3(K,1)||Y9(K,X)){let q=(X3(g(K))??g(["."])).find((U)=>{let G=M1(U.text,Z.variables);return T2(G,Z.cwd,J,Q)||SQ(G,Z.cwd,J,Q)})?.text;if(q)return{target:q}}}if(W==="mv"){let B=T4(Y).sources.find((q)=>WO(M1(q,Z.variables),Z.cwd,J,Q));if(B)return{target:B}}if(QO($,X))return null;for(let B of $)for(let q of vQ(B))if(T2(M1(q,Z.variables),Z.cwd,J,Q))return{target:q};return null}function ZO($){return $.some((Z)=>Z==="--recursive"||Z.startsWith("-")&&!Z.startsWith("--")&&/[rR]/.test(Z.slice(1)))}function JO($){let Z=$.indexOf("--");if(Z!==-1)return[...$.slice(0,Z).filter((J)=>!J.startsWith("-")),...$.slice(Z+1)];return $.filter((J)=>!J.startsWith("-"))}function QO($,Z){let J=P1([...$],Z);if(J.length===0)return!1;let Q=h(J[0]??"").toLowerCase();if(!e_.has(Q))return!1;if(Q!=="sed")return!0;return!J.slice(1).some((X)=>X.startsWith("-i")||X==="--in-place"||X.startsWith("--in-place="))}function XO($,Z,J,Q){for(let X of $.split(/\s+/))for(let K of vQ(X))if(T2(K,Z,J,Q))return{target:K};return null}function vQ($){let Z=$.trim().replace(/^['"]|['"]$/g,""),J=Z.indexOf("=");return J===-1||J===Z.length-1?[Z]:[Z,Z.slice(J+1)]}function KO($,Z){let J=K1(y$(),$,Z),Q=o9(J),X=new Set;for(let K=Q;;K=o9(K))if(X.add(w$(K)),o9(K)===K)break;return{file:w$(J),directory:w$(Q),directoryAndAncestors:X}}function T2($,Z,J,Q){return w$(K1($,Z,Q))===J.file}function SQ($,Z,J,Q){return J.directoryAndAncestors.has(w$(K1($,Z,Q)))}function WO($,Z,J,Q){let X=w$(K1($,Z,Q));return X===J.file||J.directoryAndAncestors.has(X)}function w$($){return process.platform==="win32"?$.toLowerCase():$}import{homedir as e9}from"node:os";import{isAbsolute as y3,posix as YO,resolve as v3,win32 as BO}from"node:path";import{fileURLToPath as qO}from"node:url";var iQ="Access to a sensitive path is not allowed.",sQ=new Set(["echo","printf"]),UO=new Set(["find"]),GO=new Set(["-exec","-execdir"]),HO=new Set([";","+"]),jO=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),_O=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),OO=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),LO=new Set(["node","bun"]),MO=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),FO=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","popen","read","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),rQ=new Set(["-c","-e","-r","-E","--eval","--exec"]),NO=new Set(["src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js"]),uQ=new Set(["cc-safety-net","ccsn"]),VO=new Set(["bunx","npx","pnpx"]),RO=new Set(["bun","node"]),DO=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),zO=new Set(["grep","rg"]),hQ="f",gQ="file",IO="files",bO=new Set(["e","f"]),fO=new Set(["regexp","file"]),PO=new Set(["e","f","A","B","C","m"]),CO=new Set(["regexp","file","after-context","before-context","context","max-count"]),AO=new Set(["|","|&"]),t9="__CC_SAFETY_NET_PIPE_INPUT__",nQ=new Set(["bash","sh","zsh","dash","ksh"]),EO=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function kQ($,Z,J,Q,X){let K=i$();for(let W of $){if(ML(W,Z,J?.denyPaths??[],Q,K))return{target:W,ruleId:"secret.deny-path"};if(X&&!X.has(W))continue;let Y=OL(W,Z,J,K);if(Y){if(!Y.startsWith("secret.cli.")&&FL(W,Z,J?.allowPaths??[],Q,K))continue;return{target:W,ruleId:Y}}}return null}function aQ($,Z,J={}){let Q=xQ($),X=kQ(Q,$.invocation.context.executionCwd,Z,$.invocation.context.configCwd),K=X?.ruleId!=="secret.deny-path"&&J.strict===!1?xQ($,{refineJavaScriptInlineData:!0}):Q,W=K.length===Q.length?X:kQ(Q,$.invocation.context.executionCwd,Z,$.invocation.context.configCwd,new Set(K));if(W?.ruleId!=="secret.deny-path"&&J.strict===!1&&TO($))return null;return W}function TO($){if($.invocation.route.kind!=="command")return!1;let Z=O1($,"input-candidate")??O1($,"declared-command");if(!Z)return!1;if(Z.program.nodes.some((W)=>W.kind==="command"&&W.nested.length>0))return!1;let J=[];for(let W of Z.shell.entries){if(W.kind==="operator"&&W.boundary)return!1;if(W.kind==="redirection")return!1;if(W.kind!=="operator")J.push(s1(W.text))}let Q=v$(J);if(Q.length===0)return!1;let X=$$(Q[0]??"").toLowerCase(),K=Q.slice(1);if(X==="test")return K.length===2&&(K[0]==="-e"||K[0]==="-f");if(X!=="find")return!1;return!K.some((W)=>jO.has(W))}function xQ($,Z={}){if($.invocation.route.kind==="command"){let Q=O1($,"input-candidate");return Q?w2(Q.shell,$.store,Z):[]}if($.invocation.route.kind!=="unknown")return $.paths.map((Q)=>Q.raw);let J=O1($,"input-candidate");return[...J?w2(J.shell,$.store,Z):[],...$.paths.map((Q)=>Q.raw)]}function w2($,Z,J){if($.status==="structural-limit")throw new I0;if($.status==="unclosed-quote")return[];if($.status==="invalid")throw Error("Unable to parse command for secret protection");let Q=[...$.assignmentFallbacks,...oO(s1($.source),Z,J)],X=[],K=null;for(let W of $.entries){if(W.kind==="operator"){if(!W.boundary)continue;if(X.length>0){if(Q.push(...w3(X,Z,J)),K!==null)Q.push(...mQ(K,X,Z,J));K=AO.has(W.operator)?X:null,X=[]}else K=null;continue}if(W.kind==="redirection"){let Y=W.target?s1(W.target):void 0;if(Y&&W.targetOrder==="legacy-segment")X.push(Y);else if(Y)Q.push(Y);continue}X.push(s1(W.text))}if(X.length>0){if(Q.push(...w3(X,Z,J)),K!==null)Q.push(...mQ(K,X,Z,J))}return Q}function w3($,Z,J){let Q=lO($),X=v$($);if(X.length===0)return Q;let K=X[0]??"",W=$$(K).toLowerCase(),Y=X.slice(1),B=yO(K,W,Y);if(B)return[...Q,...B];if(sQ.has(W))return Q;if(zO.has(W))return[...Q,...KL(Y)];if(UO.has(W))return[...Q,...mO(Y,Z,J)];if(N1.has(W))return[...Q,...Y.flatMap((q)=>pQ("awk",q)),...Y.flatMap((q)=>cO(q,Z,J)),...Y.flatMap(dO)];if(eQ(W)){if(nQ.has(W)){let q=_7(W,Y);if(q!==null&&Z.getShellSyntax(q).status==="structural-limit")throw new I0}return[...Q,...pO(W,Y,J)]}return[...Q,...Y.flatMap((q)=>pQ(W,q))]}function SO($,Z){if(uQ.has($))return Z[0]==="explain"?0:null;if(VO.has($)){let J=Z[0]==="-y"||Z[0]==="--yes"?1:0;return uQ.has(Z[J]??"")&&Z[J+1]==="explain"?J+1:null}if(RO.has($)){if(lQ(Z[0])&&Z[1]==="explain")return 1;if($==="bun"&&Z[0]==="run"&&lQ(Z[1])&&Z[2]==="explain")return 2}return null}function yO($,Z,J){let Q=SO(Z,J);if(Q===null)return null;let X=[$,...J.slice(0,Q)],K=J.slice(Q+1);for(let W=0;W<K.length;W++){let Y=K[W];if(Y==="--json"||Y==="--help"||Y==="-h")continue;if(Y==="--cwd"){let B=K[W+1];if(B&&!B.startsWith("--"))X.push(B);W++;continue}return X}return X}function lQ($){let Z=$?.replaceAll("\\","/");return[...NO].some((J)=>Z===J||Z?.endsWith(`/${J}`))}function mQ($,Z,J,Q){if(gO(Z,J,Q))return wO($);let X=kO(Z);if(X===null)return[];return vO($).flatMap((K)=>nQ.has(X)?w2(J.getShellSyntax(K),J,Q):ZX(K))}function wO($){let Z=v$($);if(Z.length===0)return[];let J=$$(Z[0]??"").toLowerCase();if(!sQ.has(J))return[];return Z.slice(1)}function vO($){let Z=v$($);if(Z.length===0)return[];let J=$$(Z[0]??"").toLowerCase(),Q=Z.slice(1);if(J==="echo"){let X=Q.findIndex((K)=>!/^-[neE]+$/.test(K));return[(X===-1?[]:Q.slice(X)).join(" ")]}if(J==="printf")return uO(Q);return[]}function uO($){let Z=$[0];if(Z===void 0)return[];let J=(Z.match(/%%|%[bqs]/g)??[]).filter((X)=>X!=="%%").length;if(J===0||$.length===1)return[oQ(Z)];let Q=$.slice(1);return Array.from({length:Math.ceil(Q.length/J)},(X,K)=>hO(Z,Q.slice(K*J,(K+1)*J)))}function hO($,Z){let J=0;return oQ($.replace(/%%|%[bqs]/g,(Q)=>{if(Q==="%%")return"%";let X=Z[J]??"";return J++,X}))}function oQ($){return $.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function gO($,Z,J){let Q=v$($);if(Q.length===0||$$(Q[0]??"").toLowerCase()!=="xargs")return!1;let X=r0(Q),K=Q.slice(X.childStart);if(K.length===0)return!1;if(X.replacementToken==="")return!1;let W=X.replacementToken,Y=W===null?[...K,t9]:K.map((B)=>B.split(W).join(t9));return w3(Y,Z,J).some((B)=>B.includes(t9))}function kO($){let Z=v$($);if(Z.length===0)return null;let J=$$(Z[0]??"").toLowerCase();if(!eQ(J))return null;return xO(J,Z.slice(1))?J:null}function xO($,Z){let J=tQ($);for(let Q=0;Q<Z.length;Q++){let X=Z[Q];if(X===void 0)break;if(rQ.has(X)||$X($,X)||/^--(?:eval|exec)=/.test(X))return!1;if(X==="-")return!0;if(X.startsWith("-")){if(J==="python"&&X==="-m")return!1;if(EO.get(J)?.has(X))Q++;continue}return!1}return!0}function tQ($){return/^python\d/.test($)?"python":$}function lO($){let Z=[];for(let J of $){if(XX(J))continue;let Q=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(J);if(Q===null)break;if(Q[1]!==void 0&&Q[1]!=="")Z.push(Q[1])}return Z}function pQ($,Z){if(Z==="--")return[];let J=[],Q=Z.indexOf("=");if(Q>0&&Q<Z.length-1)J.push(Z.slice(Q+1));if(Z.startsWith("-"))return J;if($==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(Z))return J;if($==="zip"&&/\.zip$/i.test(Z))return J;return J.push(Z),J}function mO($,Z,J){let Q=$.findIndex((K)=>K.startsWith("-")||K==="("||K==="!"||K===";"),X=[...$.slice(0,Q===-1?$.length:Q)];for(let K=0;K<$.length;K++){if(!GO.has($[K]??""))continue;let W=$.slice(K+1),Y=W.findIndex((U)=>HO.has(U)),B=Y===-1?W:W.slice(0,Y),q=w3(B,Z,J);if(X.push(...q.filter((U)=>U!=="{}")),!q.includes("{}"))continue;X.push(...$.slice(0,K).flatMap((U,G,j)=>{if(!_O.has(U))return[];let H=j[G+1];return H===void 0?[]:[H,H.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return X}function eQ($){return OO.has($)||/^python\d/.test($)}function pO($,Z,J){let Q=[];for(let X=0;X<Z.length;X++){let K=Z[X];if(K===void 0)break;if(rQ.has(K)||$X($,K)){let Y=Z[X+1];if(Y!==void 0)Q.push(...cQ($,Y,J)),X++;continue}let W=/^--(?:eval|exec)=(.*)$/.exec(K);if(W!==null&&W[1]!==void 0){Q.push(...cQ($,W[1],J));continue}if(!K.startsWith("-"))Q.push(K)}return Q}function $X($,Z){if(!Z.startsWith("-")||Z.startsWith("--")||Z.length<=2)return!1;return DO.get(Z[Z.length-1]??"")?.has(tQ($))??!1}function cO($,Z,J){if(!$.includes("system"))return[];return p6($)?.commands.flatMap((Q)=>w2(Z.getShellSyntax(Q),Z,J))??[]}function dO($){return Array.from($.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((Z)=>Z[1]).filter((Z)=>Z!==void 0&&Z!=="")}function ZX($){let Z=Array.from($.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((Q)=>Q[2]).filter((Q)=>Q!==void 0&&Q!==""),J=($.match(/[\w./~@+-]*[./~][\w./~@+-]*/g)??[]).filter((Q)=>Q!=="process.versions.sqlite"||Z.some((X)=>X.includes(Q)));return[...Z,...Z.flatMap(JX),...J]}function cQ($,Z,J){let Q=ZX(Z);if(!J.refineJavaScriptInlineData||!LO.has($)||Q.length===0)return Q;let X=iO(Z);return X!==null&&!rO(X)?[]:Q}function iO($){let Z=$.split("");for(let J=0;J<$.length;J++){let Q=$[J];if(Q!=="'"&&Q!=='"'&&Q!=="`")continue;if(Q==="`"&&sO($,J))return null;Z[J]=" ";let X=!1;for(let K=J+1;K<$.length;K++){let W=$[K];if(Z[K]=" ",W==="\\"){if(K++,K<$.length)Z[K]=" ";continue}if(Q==="`"&&W==="$"&&$[K+1]==="{")return null;if(Q!=="`"&&(W===`
-`||W==="\r"))return null;if(W!==Q)continue;J=K,X=!0;break}if(!X)return null}return Z.join("")}function sO($,Z){for(let J=Z-1;J>=0;J--){let Q=$[J];if(!Q||/\s/.test(Q))continue;return/[\w$\])]/.test(Q)}return!1}function rO($){for(let Z of $.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let J=Z[0],Q=Z.index;if(MO.has(J.toLowerCase()))return!0;let X=J.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((K)=>K.toLowerCase());if(!X.some((K)=>FO.has(K)))continue;if(X.length>1)return!0;if(nO($,Q)===".")return!0;if(aO($,Q+J.length)==="(")return!0}return!1}function nO($,Z){for(let J=Z-1;J>=0;J--)if(!/\s/.test($[J]??""))return $[J];return}function aO($,Z){for(let J=Z;J<$.length;J++)if(!/\s/.test($[J]??""))return $[J];return}function oO($,Z,J){return JL($).flatMap((Q)=>{let X=Z.getShellSyntax(Q);if(X.status==="invalid")return[];return[...w2(X,Z,J),...tO(X)?eO(X):[]]})}function tO($){let Z=$.entries;for(let J=0;J<Z.length;J++){let Q=Z[J];if(Q?.kind!=="word"||$$(s1(Q.text)).toLowerCase()!=="base64")continue;for(let X=J+1;X<Z.length;X++){let K=Z[X];if(K?.kind==="operator")break;if(K?.kind!=="word")continue;let W=s1(K.text);if(W==="--decode"||!W.startsWith("--")&&W.startsWith("-")&&/[dD]/.test(W))return!0}}return!1}function eO($){return $.entries.flatMap((Z)=>Z.kind==="word"?[s1(Z.text)]:Z.kind==="redirection"&&Z.target?[s1(Z.target)]:[]).flatMap(JX)}function JX($){let Z=ZL($);if(Z===null)return[];let J=Buffer.from(Z,"base64").toString("utf8");if(J===""||$L(J))return[];return Buffer.from(J,"utf8").toString("base64").replace(/=+$/g,"")===Z.replace(/=+$/g,"")?[J]:[]}function $L($){return Array.from($).some((Z)=>{let J=Z.charCodeAt(0);return J<32||J===127})}function ZL($){if($.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test($))return null;if(/=/.test($.replace(/=+$/g,"")))return null;let Z=$.replace(/=+$/g,"");if(Z.length%4===1)return null;return`${Z.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-Z.length%4)%4)}`}function JL($){let Z=[],J={inSingle:!1,inDouble:!1,escaped:!1};for(let Q=0;Q<$.length;Q++){let X=$[Q];if(!X)break;if(n$(X,J))continue;if(QX($,Q,J)){let K=QL($,Q+1);if(K!==null)Z.push(K.body),Q=K.endIndex;continue}if(!J.inSingle&&X==="`"){let K=XL($,Q);if(K!==null)Z.push(K.body),Q=K.endIndex}}return Z}function QL($,Z){let J={inSingle:!1,inDouble:!1,escaped:!1},Q=1;for(let X=Z+1;X<$.length;X++){let K=$[X];if(!K)break;if(n$(K,J))continue;if(QX($,X,J)){Q++,X++;continue}if(!J.inSingle&&!J.inDouble&&K===")"){if(Q--,Q===0)return{body:$.slice(Z+1,X),endIndex:X}}}return null}function XL($,Z){let J=!1;for(let Q=Z+1;Q<$.length;Q++){let X=$[Q];if(!X)break;if(J){J=!1;continue}if(X==="\\"){J=!0;continue}if(X==="`")return{body:$.slice(Z+1,Q),endIndex:Q}}return null}function QX($,Z,J){return!J.inSingle&&$[Z]==="$"&&$[Z+1]==="("&&$[Z+2]!=="("}function KL($){let Z=[],J=[],Q=!1,X=!1,K=!1;for(let B=0;B<$.length;B++){let q=$[B];if(q===void 0)break;if(!K&&q==="--"){K=!0;continue}if(K){J.push(q);continue}let U=/^--([^=]+)(?:=(.*))?$/.exec(q);if(U!==null){let G=U[1]??"",j=U[2];if(G===IO)X=!0;if(fO.has(G))Q=!0;if(j!==void 0){if(G===gQ)Z.push(j);continue}if(CO.has(G)){let H=$[B+1];if(G===gQ&&H!==void 0)Z.push(H);B++}continue}if(q.startsWith("-")&&q.length>1){let G=q.slice(1),j="",H="";for(let _=0;_<G.length;_++){let O=G[_]??"";if(bO.has(O))Q=!0;if(PO.has(O)){j=O,H=G.slice(_+1);break}}if(j!=="")if(H.length>0){if(j===hQ)Z.push(H)}else{let _=$[B+1];if(j===hQ&&_!==void 0)Z.push(_);B++}continue}J.push(q)}let Y=!Q&&!X?J.slice(1):J;return[...Z,...Y]}function v$($){let Z=$.findIndex((J)=>!XX(J)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(J));return Z===-1?[]:[...$.slice(Z)]}function XX($){return $==="env"||$==="command"||$==="builtin"||$==="sudo"}var WL=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),YL=".env.",BL=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),qL=[".env.example.",".env.sample."];function UL($){let Z;try{Z=new URL($.trim())}catch{return!1}return Z.protocol!=="file:"&&Z.host!==""}function GL($){return $.length>0&&!/\s/.test($)}function HL($,Z,J){try{let Q=v2($,Z,J);return Q!==""&&b1.entryKind(Q)!=="missing"}catch(Q){if(Q instanceof _1)throw Q;return!1}}var jL=new Set(["node_modules","__pycache__"]),_L=[["vendor","bundle"],["vendor","cache"]];function OL($,Z,J,Q){if(UL($))return null;let X=F0($,Z,Q);if(!X)return null;let K=s(X.split("/").pop()??""),W=s(X),Y=()=>GL(K)||HL($,Z,Q);if(BL.has(K)||qL.some((G)=>K.startsWith(G)))return null;let B=s(RL($,Z,Q));for(let G of p9){let j=`~/${G.suffixParts.join("/")}`;if((dQ(W,j)||dQ(B,j))&&M0(G.id,J))return G.id}let q=LL(X,Z,J,Q);if(q)return q;if(WL.has(K))return null;for(let G of m9)if(K===G.basename&&M0(G.id,J))return G.id;if(K.startsWith(YL)&&M0(I3.id,J)&&Y())return I3.id;for(let G of c9)if(K.length>G.prefix.length&&K.startsWith(G.prefix)){let j=K.slice(G.prefix.length)[0];if((j==="-"||j==="_")&&M0(G.id,J)&&Y())return G.id}for(let G of d9)if(K.length>G.prefix.length&&K.startsWith(G.prefix)){if(K.slice(G.prefix.length)===G.suffix&&M0(G.id,J))return G.id}if(NL(W))return null;if(!K.includes(".")&&C2.pattern.test(K)&&M0(C2.id,J))return C2.id;let U=VL(K,J);if(U)return U;return null}function LL($,Z,J,Q){return b3.find((X)=>{if(!M0(X.id,J))return!1;switch(X.id){case"secret.cli.claude-code":return i($,r(process.env.CLAUDE_CONFIG_DIR,"~/.claude",Z,Q),[".credentials.json"]);case"secret.cli.claude-code.config":{let K=s($).split("/");return i($,r(process.env.CLAUDE_CONFIG_DIR,"~/.claude",Z,Q),["settings.json","settings.local.json"])||y2($,"~/.claude.json",Z,Q)||K.at(-1)==="settings.local.json"&&K.at(-2)===".claude"||K.at(-1)===".mcp.json"}case"secret.cli.antigravity":return i($,F0("~/.gemini/config",Z,Q),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let K=r(process.env.CODEX_HOME,"~/.codex",Z,Q);return i($,K,["auth.json",".credentials.json"])||S2($,K,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let K=r(process.env.CODEX_HOME,"~/.codex",Z,Q),W=s($).split("/").at(-1)??"";return i($,K,["config.toml"])||W.endsWith(".config.toml")&&i($,K,[W])}case"secret.cli.gemini":return i($,W1(r(process.env.GEMINI_CLI_HOME,"~",Z,Q),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let K=s($).split("/"),W=process.env.ProgramData?[W1(r(process.env.ProgramData,"",Z,Q),"gemini-cli")]:[];return i($,W1(r(process.env.GEMINI_CLI_HOME,"~",Z,Q),".gemini"),["settings.json","google_accounts.json"])||K.at(-1)==="settings.json"&&K.at(-2)===".gemini"||(process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH?.trim()?y2($,process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH,Z,Q):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...W].some((Y)=>i($,F0(Y,Z,Q),["settings.json"]))}case"secret.cli.copilot-cli":{let K=r(process.env.COPILOT_HOME,"~/.copilot",Z,Q);return i($,K,["config.json"])||S2($,K,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return i($,r(process.env.COPILOT_HOME,"~/.copilot",Z,Q),["mcp-config.json"]);case"secret.cli.kimi-code":{let K=r(process.env.KIMI_CODE_HOME,"~/.kimi-code",Z,Q),W=r(process.env.KIMI_SHARE_DIR,"~/.kimi",Z,Q);return i($,K,["server.token"])||S2($,K,["credentials"])||S2($,W,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let K=["config.toml","mcp.json"],W=s($).split("/");return W.at(-1)==="mcp.json"&&W.at(-2)===".kimi-code"||i($,r(process.env.KIMI_CODE_HOME,"~/.kimi-code",Z,Q),K)||i($,r(process.env.KIMI_SHARE_DIR,"~/.kimi",Z,Q),[...K,"config.json","config.json.bak"])}case"secret.cli.opencode":{let K=W1(r(process.env.XDG_DATA_HOME,"~/.local/share",Z,Q),"opencode"),W=s($).split("/").at(-1)??"",Y=process.env.OPENCODE_DB?.trim(),B=Y&&Y!==":memory:"?[Y,`${Y}-wal`,`${Y}-shm`]:[];return i($,K,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(W)&&i($,K,[W])||B.some((q)=>y2($,q,Z,Q))}case"secret.cli.opencode.config":{let K=process.env.OPENCODE_CONFIG_DIR?r(process.env.OPENCODE_CONFIG_DIR,"~/.config/opencode",Z,Q):W1(r(process.env.XDG_CONFIG_HOME,"~/.config",Z,Q),"opencode"),W=process.env.ProgramData?[W1(r(process.env.ProgramData,"",Z,Q),"opencode")]:[],Y=["opencode.json","opencode.jsonc"];return Y.includes(s($).split("/").at(-1)??"")||i($,K,Y)||(process.env.OPENCODE_CONFIG?.trim()?y2($,process.env.OPENCODE_CONFIG,Z,Q):!1)||["/Library/Application Support/opencode","/etc/opencode",...W].some((B)=>i($,F0(B,Z,Q),Y))}case"secret.cli.pi":return i($,r(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",Z,Q),["auth.json"]);case"secret.cli.pi.config":return i($,r(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",Z,Q),["models.json"]);case"secret.cli.amp":{let K=F0("~",Z,Q);return[W1(r(process.env.XDG_DATA_HOME,"~/.local/share",Z,Q),"amp"),W1(K,".local","share","amp")].some((Y)=>i($,Y,["secrets.json"]))||S2($,W1(K,".amp"),["oauth"])}case"secret.cli.amp.config":{let K=["settings.json","settings.jsonc"],W=[W1(r(process.env.XDG_CONFIG_HOME,"~/.config",Z,Q),"amp"),W1(F0("~",Z,Q),".config","amp")],Y=s($).split("/");return W.some((B)=>i($,B,K))||Y.at(-2)===".amp"&&K.includes(Y.at(-1)??"")||(process.env.AMP_SETTINGS_FILE?.trim()?y2($,process.env.AMP_SETTINGS_FILE,Z,Q):!1)}case"secret.cli.cursor":{let K=W1(r(process.env.XDG_CONFIG_HOME,"~/.config",Z,Q),"cursor"),W=W1(r(process.env.CURSOR_DATA_DIR,"~/.cursor",Z,Q),"projects");return i($,F0("~/.cursor",Z,Q),["auth.json"])||i($,K,["auth.json"])||s($).split("/").at(-1)==="mcp-auth.json"&&e0(s($),s(W))}case"secret.cli.cursor.config":{let K=s($).split("/");return K.at(-1)==="mcp.json"&&K.at(-2)===".cursor"}default:return!1}})?.id??null}function r($,Z,J,Q){return F0($?.trim()?$:Z,J,Q)}function i($,Z,J){return J.some((Q)=>KX($,W1(Z,Q)))}function S2($,Z,J){return J.some((Q)=>e0(s($),s(W1(Z,Q))))}function y2($,Z,J,Q){return KX($,F0(Z,J,Q))}function KX($,Z){return s($)===s(Z)}function W1($,...Z){return m1([$,...Z].filter(Boolean).join("/"))}function ML($,Z,J,Q,X){if(J.length===0)return!1;let K=s(v2($,Z,X));return J.some((W)=>e0(K,s(v2(W,Q,X))))}function FL($,Z,J,Q,X){if(J.length===0)return!1;let K=s(v2($,Z,X));if(!K)return!1;let W=process.env.HOME??e9(),Y=W?m1(l(W,b1,X)):"",B=s(Y),q=process.env.CC_SAFETY_NET_HOME,U=s(q?m1(l(v3(q),b1,X)):Y&&m1(l(`${Y}/.cc-safety-net`,b1,X)));if(U&&e0(K,U))return!1;return J.some((G)=>{let j=s(v2(G,Q,X));if(!j)return!1;if(B&&(B===j||B.startsWith(j.endsWith("/")?j:`${j}/`)))return!1;return e0(K,j)})}function NL($){let Z=$.split("/");return Z.some((J)=>jL.has(J))||_L.some(([J,Q])=>Z.some((X,K)=>X===J&&Z[K+1]===Q))}function VL($,Z){let J=$.lastIndexOf("."),Q=J>0&&J<$.length-1?$.slice(J+1):"";if(Q==="")return null;for(let X of i9)if(Q===X.extension&&M0(X.id,Z))return X.id;for(let X of s9)if(X.pattern.test(Q)&&M0(X.id,Z))return X.id;return null}function s($){return $.toLowerCase()}function M0($,Z){if(!Z?.disabledRules)return!0;if(Array.isArray(Z.disabledRules))return!Z.disabledRules.includes($);return!Z.disabledRules.has($)}function F0($,Z,J){let{home:Q,normalized:X}=$Z($,J);if(!X)return"";if(!Q)return X;let K=ZZ(X,Q),W=y3(K)?K:m1(v3(Z,K)),Y=m1(l(W,b1,J));if(!e0(Y,Q)){if(y3(K))return Y;return Y===W?X:Y}let B=Y.slice(Q.length);return B?`~${B}`:"~"}function dQ($,Z){return $===Z||$.startsWith(`${Z}/`)}function RL($,Z,J){let{home:Q,normalized:X}=$Z($,J);if(!X||!Q)return"";let K=ZZ(X,Q),W=YO.normalize(y3(K)?K:m1(v3(Z,K))),Y=m1(process.env.HOME??e9()),B=(G)=>process.platform==="win32"?G.toLowerCase():G,q=[Q,Y].find((G)=>G!==""&&e0(B(W),B(G)));if(q===void 0)return"";let U=W.slice(q.length);return U?`~${U}`:"~"}function v2($,Z,J){let{home:Q,normalized:X}=$Z($,J);if(!X)return"";let K=Q?ZZ(X,Q):X;return m1(l(y3(K)?K:v3(Z,K),b1,J))}function $Z($,Z){let J=process.env.HOME??e9(),Q=J?m1(l(J,b1,Z)):"",X=m1(DL(s1($)));return{home:Q,normalized:X}}function DL($){if(!$.trim().toLowerCase().startsWith("file:"))return $;try{return qO($)}catch{return $}}function ZZ($,Z){if($==="~")return Z;if($.startsWith("~/"))return W1(Z,$.slice(2));return $}function zL($){if(process.platform==="win32")return!0;return BO.parse($).root.length>1}function m1($){let Z=$.trim(),J=(zL(Z)?Z.replace(/\\/g,"/"):Z).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(J==="/")return J;return J.replace(/\/+$/g,"")}function e0($,Z){return $===Z||$.startsWith(Z.endsWith("/")?Z:`${Z}/`)}function $$($){return $.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??$}import{dirname as N0}from"node:path";var WX="Rulebook exceeds CC Safety Net's safe validation limits.",YX="Additional rulebook validation errors were omitted.",p1=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function BX($){if(JZ($.allowed_commands,p1.maxAllowedCommands)||JZ($.rules,p1.maxRules)||JZ($.tests,p1.maxTests))return!1;let{maxAggregateStringCodeUnits:Z,maxTotalBlockArgs:J}=p1,Q=(X,K=!1)=>{if(typeof X!=="string")return!0;if(X.length>p1.maxStringCodeUnits||K&&X.length>p1.maxFixtureCommandCodeUnits||X.length>Z)return!1;return Z-=X.length,!0};if(!Q($.name)||!Q($.version)||!Q($.description)||!Q($.author)||!Q($.migrated_from))return!1;if(Array.isArray($.allowed_commands)){for(let X of $.allowed_commands)if(!Q(X))return!1}if(Array.isArray($.rules))for(let X of $.rules){if(!X||typeof X!=="object")continue;let K=X;if(!Q(K.name)||!Q(K.command)||!Q(K.subcommand)||!Q(K.reason)||!Q(K.intent))return!1;if(!Array.isArray(K.block_args))continue;if(K.block_args.length>p1.maxBlockArgsPerRule||K.block_args.length>J)return!1;J-=K.block_args.length;for(let W of K.block_args)if(!Q(W))return!1}if(Array.isArray($.tests))for(let X of $.tests){if(!X||typeof X!=="object")continue;let K=X;if(!Q(K.command,!0)||!Q(K.expect)||!Q(K.rule))return!1}return!0}function JZ($,Z){return Array.isArray($)&&$.length>Z}function IL($){if(!bL($))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!BX($))return{errors:[WX],ruleNames:new Set};let Z=MQ().safeParse($),J=[...$.rulebook_version===1?[]:["rulebook_version must be 1"],...Z.success?[]:A$(Z.error.issues,": ",": ")];return{errors:J.length>p1.maxValidationErrors?[...J.slice(0,p1.maxValidationErrors),YX]:J,ruleNames:new Set(r9($).map((Q)=>Q.toLowerCase()))}}function u$($){let Z=IL($);if(Z.errors.length>0)throw Error(Z.errors.join("; "));return $}function bL($){return!!$&&typeof $==="object"&&!Array.isArray($)}var fL=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#([A-Za-z0-9._-]+)$/;function u3($){if(K$($.spec))return CL($);return PL($)}function PL($){if(!I1.test($.spec))return`Local rulebook sources must be bare names matching ${I1}: ${$.spec}`;if($.kind!=="local-directory")return`lock entry for ${$.spec} must use local-directory kind`;if($.path===$.spec&&$.name===$.spec)return null;return`lock entry for ${$.spec} does not match local source identity`}function CL($){let Z=p$($.spec);if(Z)return Z;let J=X$($.spec);if($.kind!=="github")return`lock entry for ${$.spec} must use github kind`;if($.owner===J.owner&&$.repo===J.repo&&$.ref===J.ref&&$.path===J.path&&$.name===J.name)return null;return`lock entry for ${$.spec} does not match GitHub source identity`}function Fb($,Z,J){let Q=UX($.rules,J);if(Q.length>0)return{ok:!0,specs:Q};if(!Z)return{ok:!1,result:{ok:!1,errors:[`No lockfile available to match rulebook name ${J}; use the exact source or run ${w1}`],warnings:[],entries:[]}};let X=new Set($.rules),K=Z.rulebooks.filter((W)=>W.name===J&&X.has(W.spec)).map((W)=>W.spec);if(K.length===1)return{ok:!0,specs:K};return qX(J,K)}function Nb($,Z,J){let Q=UX($,J);if(Q.length>0)return{ok:!0,specs:Q};let X=AL($,J);if(X.length>0)return{ok:!0,specs:X};let K=EL($,J);if(!K.ok)return K;if(K.specs.length>0)return{ok:!0,specs:K.specs};let W=Z?$.filter((Y)=>Z.rulebooks.find((B)=>B.spec===Y)?.name===J):[];if(W.length===1)return{ok:!0,specs:W};return qX(J,W)}function qX($,Z){return{ok:!1,result:{ok:!1,errors:Z.length===0?[`No configured rulebook matches ${$}`]:[`Ambiguous rulebook match ${$}: ${Z.join(", ")}`],warnings:[],entries:[]}}}function UX($,Z){return $.filter((J)=>J===Z)}function AL($,Z){let J=Z.match(fL),Q=J?.[1],X=J?.[2],K=J?.[3];if(!Q||!X||!K)return[];return HX($,(W)=>{return W.owner===Q&&W.repo===X&&W.ref===K})}function EL($,Z){if(!PZ(Z))return{ok:!0,specs:[]};let[J,Q]=Z.split("/"),X=HX($,(W)=>{return W.owner===J&&W.repo===Q});if(new Set(X.map((W)=>GX(W)?.ref).filter((W)=>!!W)).size<2)return{ok:!0,specs:X};return{ok:!1,result:{ok:!1,errors:[`Multiple refs are configured for ${Z}. Use an explicit ref:`,`  cc-safety-net rule remove ${Z}#<ref>`],warnings:[],entries:[]}}}function GX($){try{return X$($)}catch{return null}}function HX($,Z){return $.filter((J)=>{let Q=GX(J);return Q?Z(Q):!1})}function QZ($){let Z=typeof $==="string"?$:$.path;try{let J=W0(typeof $==="string"?k2($):$);if(J===null)return{lock:null,errors:[]};let Q=JSON.parse(J);if(!Q||typeof Q!=="object")return{lock:null,errors:[`malformed lockfile ${Z}: must be an object`]};let X=Q;if(X.version!==1||!Array.isArray(X.rulebooks))return{lock:null,errors:[`malformed lockfile ${Z}`]};let K=FQ().safeParse(X),W=X.rulebooks.flatMap((B,q)=>{let U=K.success?[]:K.error.issues.filter((j)=>j.path[1]===q);if(U.length>0)return A$(U).map((j)=>`${Z}: ${j}`);let G=u3(B);return G?[`${Z}: rulebooks[${q}]: ${G}`]:[]});if(!K.success||W.length>0)return{lock:null,errors:[`malformed lockfile ${Z}`,...W]};return{lock:{version:1,rulebooks:K.data.rulebooks.map((B)=>{if(B.kind==="local-directory")return{spec:B.spec,kind:B.kind,path:B.path,name:B.name,version:B.version,digest:B.digest};let q={spec:B.spec,kind:B.kind,owner:B.owner,repo:B.repo,ref:B.ref,commit:B.commit,path:B.path,name:B.name,version:B.version,digest:B.digest};return typeof B.display_ref==="string"&&B.display_ref!==""?{...q,display_ref:B.display_ref}:q})},errors:[]}}catch(J){if(J instanceof u)return{lock:null,errors:[J.message]};return{lock:null,errors:["malformed lockfile"]}}}import{createHash as TL}from"node:crypto";import{dirname as h3,join as SL}from"node:path";var OX=Object.freeze({timeoutMs:15000,metadataBytes:524288,commitBytes:262144,treeBytes:16777216,rawBytes:4194304});async function jX($,Z,J,Q=z1(h3(h3(Z)),"rules policy"),X=C3()){if(K$($))return wL($,X);return yL($,Z,J,Q)}async function yb($,Z,J,Q,X,K=C3()){if(!K$($)||J.refresh)return jX($,Z,J,X,K);let W=Q?.rulebooks.find((Y)=>Y.spec===$);if(!W||W.kind!=="github")return jX($,Z,J,X,K);return vL(W,Z,J,X,K)}async function wb($,Z=C3()){let[J,Q]=$.split("/");if(!J||!Q)throw Error(`Invalid GitHub repository source: ${$}`);let X=await u2(`https://api.github.com/repos/${J}/${Q}`,"metadata",Z),K=X.response;if(!K.ok)throw Error(`Failed to inspect ${$}: GitHub returned ${K.status}`);let W=JSON.parse(X.content);if(!W.default_branch)throw Error(`Failed to inspect ${$}: missing default branch`);let Y=await MX(J,Q,W.default_branch,$,Z),B=await u2(`https://api.github.com/repos/${J}/${Q}/git/trees/${Y}?recursive=1`,"tree",Z),q=B.response;if(!q.ok)throw Error(`Failed to inspect ${$}: GitHub tree returned ${q.status}`);let G=(JSON.parse(B.content).tree??[]).flatMap((j)=>{if(j.type!=="blob"||typeof j.path!=="string")return[];let H=j.path.match(s3);return H?.[1]?[H[1]]:[]}).sort();if(G.length===0)throw Error(`No rulebooks found in ${$} under ${m2}/`);return G.map((j)=>({spec:`${J}/${Q}#${Y}/${j}`,display_ref:W.default_branch}))}function yL($,Z,J,Q){r3($);let X=kL(Z,$),K=W0(X1(Q,X));if(K===null)throw Error(`Rulebook source not found: ${$}`);let W=u$(XZ(K,"Invalid local rulebook source."));if(W.name!==$)throw Error(`rulebook name "${W.name}" must match local source "${$}"`);return{rulebook:W,content:K,entry:{spec:$,kind:"local-directory",path:$,name:W.name,version:W.version,digest:h$(K)}}}async function wL($,Z){let J=X$($),Q=await MX(J.owner,J.repo,J.ref,$,Z),X=await u2(`https://raw.githubusercontent.com/${J.owner}/${J.repo}/${Q}/${J.path}`,"raw",Z),K=X.response;if(!K.ok)throw Error(`Failed to fetch ${$}: GitHub raw returned ${K.status}`);let W=X.content,Y=u$(XZ(W,"Invalid GitHub rulebook response."));if(Y.name!==J.name)throw Error(`rulebook name "${Y.name}" must match GitHub source "${J.name}"`);return{rulebook:Y,content:W,entry:{spec:$,kind:"github",owner:J.owner,repo:J.repo,ref:J.ref,commit:Q,path:J.path,name:Y.name,version:Y.version,digest:h$(W)}}}async function vL($,Z,J,Q=z1(h3(h3(Z)),"rules policy"),X){let K=u3($);if(K)throw Error(`${K}; run ${w1}`);let W=c2($,d2(Z,J)),Y=W0(X1(Q,W));if(Y!==null){if(h$(Y)===$.digest)return{entry:$,rulebook:LX(Y,$),content:Y}}return uL($,X)}async function uL($,Z){let J=await u2(`https://raw.githubusercontent.com/${$.owner}/${$.repo}/${$.commit}/${$.path}`,"raw",Z),Q=J.response;if(!Q.ok)throw Error(`Failed to restore ${$.spec}: GitHub raw returned ${Q.status}`);let X=J.content;if(h$(X)!==$.digest)throw Error(`locked GitHub digest mismatch for ${$.spec}; run ${w1}`);return{entry:$,rulebook:LX(X,$),content:X}}function LX($,Z){let J=u$(XZ($,"Invalid cached rulebook."));if(J.name!==Z.name)throw Error(`rulebook name "${J.name}" must match lock entry "${Z.name}"`);return J}function XZ($,Z){try{return JSON.parse($)}catch{throw Error(Z)}}async function MX($,Z,J,Q,X){let K=await u2(`https://api.github.com/repos/${$}/${Z}/commits/${encodeURIComponent(J)}`,"commit",X),W=K.response;if(!W.ok)throw Error(`Failed to resolve ${Q}: GitHub returned ${W.status}`);let Y=JSON.parse(K.content);if(!Y.sha)throw Error(`Failed to resolve commit for ${Q}`);return Y.sha}async function hL($,Z,J={}){if(J.signal?.aborted)throw J.signal.reason;let Q=J.budget??P3(),X=new AbortController,K=()=>X.abort(J.signal?.reason);J.signal?.addEventListener("abort",K,{once:!0});let W=!1,Y=setTimeout(()=>{if(X.signal.aborted)return;W=!0,X.abort()},J.timeoutMs??OX.timeoutMs);try{if(J.signal?.aborted)throw J.signal.reason;GQ(Q);let B=await(J.fetch??fetch)($,{signal:X.signal,redirect:"error"});if(!B.ok)return FX(B),{response:B,content:""};return{response:B,content:await gL(B,Z,Q,()=>X.abort())}}catch(B){if(W)throw Error("GitHub request timed out",{cause:B});if(J.signal?.aborted)throw J.signal.reason;throw B}finally{clearTimeout(Y),J.signal?.removeEventListener("abort",K)}}function u2($,Z,J){return hL(J.resolveUrl?.($)??$,Z,{budget:J.budget,signal:J.controller.signal})}async function gL($,Z,J=P3(),Q){let X=OX[`${Z}Bytes`],K=Number($.headers.get("content-length"));if(Number.isFinite(K)&&K>X)throw FX($),Error(`GitHub ${Z} response exceeds ${X} bytes`);if(!$.body)return"";let W=$.body.getReader(),Y=[],B=0;while(!0){let q=await W.read();if(q.done)break;try{HQ(J,q.value.byteLength)}catch(U){throw Q?.(),_X(W),U}if(B+=q.value.byteLength,B>X)throw Q?.(),_X(W),Error(`GitHub ${Z} response exceeds ${X} bytes`);Y.push(Buffer.from(q.value))}return Buffer.concat(Y,B).toString("utf-8")}function FX($){if(!$.body)return;NX(()=>$.body?.cancel())}function _X($){NX(()=>$.cancel())}function NX($){try{Promise.resolve($()).catch(()=>{})}catch{}}function kL($,Z){return SL($,Z,l2)}function h$($){return`sha256:${TL("sha256").update($).digest("hex")}`}function DX($={}){let Z=wZ($),J=!1;try{J=VZ(Z.userConfigTarget,Z.projectConfigTarget)}catch(j){if(j instanceof u)return dL(Z,j.message);throw j}let Q=E$(Z.userConfigTarget),X=J?{config:null,errors:[]}:E$(Z.projectConfigTarget),K=RX(Z.userConfigPath,Q.errors),W=RX(Z.projectConfigPath,X.errors),Y=new Set,B=Q.config?KZ(Q.config,Z.userLockPath,N0(Z.userConfigPath),$,"user",Z.userScope,Y):h2(),q=X.config?KZ(X.config,Z.projectLockPath,N0(Z.projectConfigPath),$,"project",Z.projectScope,Y):h2(),U=Q.config?.overrides??{},G=X.config?.overrides??{};return{rules:[...VX(B.rules,U),...VX(q.rules,G)],transparent_wrappers:pL(Q.config,X.config),rulebooks:[...B.rulebooks,...q.rulebooks],errors:[...K,...W,...B.errors,...q.errors],warnings:[...B.warnings,...q.warnings,...B.canValidateOverrides?WZ(U,B.knownRuleIds,Z.userConfigPath):[],...B.canValidateOverrides?cL(G,B.knownRuleIds,Z.projectConfigPath):[],...q.canValidateOverrides?WZ(G,q.knownRuleIds,Z.projectConfigPath):[]],userConfig:Q.config??void 0,projectConfig:X.config??void 0,...Z}}function pb($,Z){let J=Z??z1(N0(N0($)),"rules policy"),Q=E$(X1(J,$)).config,X=QZ(X1(J,T0($))).lock;if(!Q||!X)return new Map;let K=new Set(Q.rules);return new Map(X.rulebooks.filter((W)=>K.has(W.spec)).map((W)=>[W.spec,hZ(W)]))}function cb($,Z,J,Q){let X=xL($,Z,J,Q);if(!X)return[];return[...X.scope.errors,...X.scope.warnings,...lL(X.config,X.scope,$)]}function xL($,Z,J,Q){let X=Q??z1(N0(N0($)),"rules policy"),K=E$(X1(X,$)).config;if(!K)return null;return{config:K,scope:KZ(K,Z,N0($),J,"project",X)}}function lL($,Z,J){return Z.canValidateOverrides?WZ($.overrides??{},Z.knownRuleIds,J):[]}function KZ($,Z,J,Q,X,K=z1(N0(N0(J)),X==="user"?"user policy":"project policy"),W=new Set){let Y;try{Y=X1(K,Z)}catch(M){if(M instanceof u)return{...h2(),errors:[M.message],canValidateOverrides:!1};throw M}let B=QZ(Y);if(B.errors.length>0)return{...h2(),errors:B.errors,canValidateOverrides:!1};let q=B.lock;if(!q&&$.rules.length>0)return{...h2(),errors:[`missing lockfile ${Z}; run ${w1}`],canValidateOverrides:!1};let U=q?.rulebooks??[],G=new Map(U.map((M)=>[M.spec,M])),j=[],H=[],_=$.rules.flatMap((M)=>{let L=G.get(M);if(!L)return j.push(`missing lock entry for ${M}; run ${w1}`),[];let D=mL(L,J,Q,K);if(D.errors.length>0||!D.rulebook)return j.push(...D.errors),[];let z=D.rulebook;if(W.has(z.name))return H.push(`duplicate active rulebook name "${z.name}" for ${M}; keeping the first and ignoring this one, so its rules are not active; rename one of them, then run ${w1}`),[];return W.add(z.name),[{rules:z.rules.map((f)=>({...f,name:`${z.name}/${f.name}`})),rulebook:{source:X,spec:L.spec,name:z.name,version:z.version,rules:z.rules.map((f)=>`${z.name}/${f.name}`)}}]}),O=_.flatMap((M)=>M.rules);return{rules:O,rulebooks:_.map((M)=>M.rulebook),entries:U,knownRuleIds:new Set(O.map((M)=>M.name)),errors:j,warnings:H,canValidateOverrides:j.length===0}}function mL($,Z,J,Q){let X=c2($,d2(Z,J)),K;try{K=W0(X1(Q,X))}catch(Y){if(Y instanceof u)return{rulebook:null,errors:[Y.message]};throw Y}if(K===null)return{rulebook:null,errors:[`missing cache entry for ${$.spec}; run ${w1}`]};if(h$(K)!==$.digest)return{rulebook:null,errors:[`cache digest mismatch for ${$.spec}; run ${w1}`]};let W;try{W=JSON.parse(K)}catch{return{rulebook:null,errors:[`invalid cached rulebook for ${$.spec}`]}}try{u$(W)}catch(Y){return{rulebook:null,errors:[`invalid cached rulebook for ${$.spec}: ${Y instanceof Error?Y.message:"invalid rulebook"}`]}}return{rulebook:W,errors:[]}}function pL($,Z){return[...new Set([...$?.transparent_wrappers??[],...Z?.transparent_wrappers??[]])]}function VX($,Z){return $.flatMap((J)=>{let Q=Z[J.name];if(Q==="off")return[];if(Q&&typeof Q==="object")return[{...J,intent:Q.intent??J.intent,reason:Q.reason}];return[J]})}function WZ($,Z,J){return Object.keys($).filter((Q)=>!Z.has(Q)).map((Q)=>`unknown override key "${Q}" in ${J}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function cL($,Z,J){return Object.keys($).filter((Q)=>Z.has(Q)).map((Q)=>`project override cannot target user-scoped rule "${Q}" in ${J}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function RX($,Z){return Z.map((J)=>J.startsWith("Unable to access ")?J:`${$}: ${J}`)}function dL($,Z){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[Z],warnings:[],userConfigPath:$.userConfigPath,projectConfigPath:$.projectConfigPath,userLockPath:$.userLockPath,projectLockPath:$.projectLockPath}}function h2(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}function zX($={}){let Z=DX($),J=PQ($),Q={rules:Z.rules,transparentWrappers:Z.transparent_wrappers,safety:oL(J.safety),worktreeMode:J.worktreeMode,destructiveCommandProtectionEnabled:J.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:{...J.destructiveCommandRuleOverrides},destructiveCommandAllowPaths:[...J.destructiveCommandAllowPaths],secretProtection:{enabled:J.secretProtection.enabled??!0,disabledRules:[...J.secretProtection.disabledRules??[]],denyPaths:[...J.secretProtection.denyPaths],allowPaths:[...J.secretProtection.allowPaths??[]]}},X={...Z.userConfig?.overrides??{},...Z.projectConfig?.overrides??{}},K=Object.freeze(Object.fromEntries(Q.rules.map((W)=>{let Y=Z.rulebooks.find((q)=>q.rules.includes(W.name)),B=X[W.name];return[W.name,Object.freeze({id:W.name,...Y?{rulebook:Object.freeze({name:Y.name,version:Y.version}),...nL(Y.spec)?{source:Y.spec}:{}}:{},...B&&typeof B==="object"?{override:Object.freeze({type:"reason",reason:B.reason})}:{}})]})));return aL(Q,iL(Z,J),K)}function rb($){if($.state==="ready")return{state:$.state};return{state:$.state,reason:$.reason}}function iL($,Z){let J=rL(Z);if($.errors.length===0&&$.warnings.length===0&&!J)return;return{diagnostics:[...$.errors,...$.warnings,...Z.errors],reason:tL($.errors.length>0?sL($.errors):void 0,$.warnings.length>0?YZ($.warnings.join("; ")):void 0,J)}}function sL($){return`${YZ($.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function rL($){if($.errors.length===0)return;let Z=$.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${$.errors.join("; ")}. Enforcing ${Z}; the invalid values are not active. Fix the policy file manually`}function nL($){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test($)}function aL($,Z,J=Object.freeze({})){let Q=IX(structuredClone($));if(!Z)return Object.freeze({state:"ready",policy:Q,diagnostics:Object.freeze([]),ruleMetadata:J});return Object.freeze({state:"degraded",policy:Q,diagnostics:Object.freeze([...Z.diagnostics]),reason:Z.reason,ruleMetadata:J})}function oL($){let Z=$.overrides,J={...Z?.failClosed!==void 0?{failClosed:Z.failClosed}:{},...Z?.paranoidRm!==void 0?{paranoidRm:Z.paranoidRm}:{},...Z?.paranoidInterpreters!==void 0?{paranoidInterpreters:Z.paranoidInterpreters}:{}};return{...$.level!==void 0?{level:$.level}:{},...Object.keys(J).length>0?{overrides:J}:{}}}function IX($){if(typeof $!=="object"||$===null)return $;for(let Z of Object.values($))IX(Z);return Object.freeze($)}function tL(...$){return YZ($.filter((Z)=>!!Z).join("; "))}function YZ($){return/[.!?]$/.test($)?$:`${$}.`}class g$ extends Error{stage;evaluation;name="GuardEvaluationError";constructor($,Z,J){super(`CC Safety Net ${$} dependency failed`,{cause:J});this.stage=$;this.evaluation=Z}}var eL={findPolicyMutation:wQ,findGitMetadataMutation:N7,resolveGitMetadata:g6,loadPolicySnapshot:zX,findSensitiveTarget:aQ,analyzeCommand:l9,getModes:s4};function bX($,Z={}){let J={...eL,...Z.dependencies},Q=JM($),X=g2($)?$.command:Q,K=Z$("policy-protection",X,()=>R4($,Z.factParserDependencies)),W=O1(K,"declared-command");if(g2($)&&$.command?.trim()&&W?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:B0,intent:"stop_and_explain",evidence:[{kind:"command",command:$.command,segment:$.command}]}};if(O1(K,"input-candidate")?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:aZ,intent:"stop_and_explain",evidence:[]}};let Y=Z$("policy-protection",X,()=>J.resolveGitMetadata($.context.executionCwd)),B=Z$("policy-protection",X,()=>J.findPolicyMutation(K));if(B){let M=X??B.target;return{stage:"policy-protection",decision:{kind:"deny",reason:yQ,intent:"hard_stop",evidence:[{kind:"command",command:M,segment:B.target},{kind:"path",target:B.target}]}}}let q=Z$("policy-protection",X,()=>J.findGitMetadataMutation(K,Y));if(q){let M=X??q.target;return{stage:"policy-protection",decision:{kind:"deny",reason:C1,intent:"hard_stop",evidence:[{kind:"command",command:M,segment:q.target},{kind:"path",target:q.target}]}}}let U=Z$("config-load",X,()=>J.loadPolicySnapshot({...Z.policyOptions,cwd:$.context.configCwd})),G=U.policy,j=J.getModes(G),H={level:j.effectiveLevel,...$M(U)},_=G.secretProtection.enabled===!1?null:Z$("secret-protection",X,()=>J.findSensitiveTarget(K,G.secretProtection,{strict:g2($)?j.strict:void 0}));if(_){let M=X??_.target;return{stage:"secret-protection",...H,decision:{kind:"deny",reason:iQ,intent:"hard_stop",ruleId:_.ruleId,evidence:[{kind:"command",command:M,segment:_.target},{kind:"path",target:_.target}]}}}if(!g2($))return{stage:"non-command",...H,decision:{kind:"allow"}};if(!$.command||$.command.trim()==="")return{...BZ("command-validation",X),...H};let O=Z$("command-analysis",X,()=>{return J.analyzeCommand($.command,{cwd:$.context.executionCwd,shell:$.route.shell,policySnapshot:U,environment:q0(),protectedGitMetadata:Y,effectiveCapabilities:j.capabilities,strict:j.strict,paranoidRm:j.paranoidRm,paranoidInterpreters:j.paranoidInterpreters,worktreeMode:j.worktreeMode},ZM(K),K.store)});if(O)return{stage:"command-analysis",...H,decision:O};return{stage:"command-analysis",...H,decision:{kind:"allow"}}}function $M($){if($.state==="ready")return{};return{configFallback:{reason:$.reason}}}function ZM($){return O1($,"declared-command")?.program}function JM($){try{return q$($.input)}catch(Z){let J=g2($)?$.command:void 0;throw new g$("policy-protection",BZ("policy-protection",Z instanceof U0?void 0:J),Z)}}function Z$($,Z,J){try{return J()}catch(Q){throw new g$($,BZ($,Q instanceof U0?void 0:Z),Q)}}function BZ($,Z){return{stage:$,decision:{kind:"deny",reason:n2,intent:"stop_and_explain",evidence:Z?[{kind:"command",command:Z,segment:Z}]:[]}}}function g2($){return $.route.kind==="command"}import{realpathSync as QM,statSync as XM}from"node:fs";import{isAbsolute as fX,relative as KM,resolve as WM,sep as YM}from"node:path";function BM($,Z){if(h0($))return;let J=Z.flatMap((X)=>qZ(X));if(!J[0])return;let Q=qZ(fX($)?$:WM(J[0],$))[0];if(!Q)return;return J.some((X)=>PX(Q,X))?Q:void 0}function qM($){return $.flatMap((Z)=>qZ(Z))[0]}function qZ($){try{let Z=QM($);return XM(Z).isDirectory()?[Z]:[]}catch{return[]}}function PX($,Z){let J=KM(Z,$);return J===""||J!==".."&&!J.startsWith(`..${YM}`)&&!fX(J)}function Lf($,Z){try{let J=bX($,Z.guard);return CX($,J,Z),J}catch(J){if(!(J instanceof g$))throw J;throw CX($,J.evaluation,Z,!(J.cause instanceof U0),{stage:J.stage,errorCode:UM(J.cause)}),J}}function CX($,Z,J,Q=!0,X){nZ(rZ($,Z,J.guard?.auditAllowed??!1,Q,X),J.audit.getSessionId,{agent:J.audit.agent,shape:J.audit.shape,homeDir:J.audit.homeDir})}function UM($){if($ instanceof _1)return"path-canonicalization-limit";if($ instanceof U0)return"tool-input-limit";if($ instanceof I0)return"structural-shell-syntax-limit";return"unexpected-error"}
-export{HZ as b,EX as c,GM as d,HM as e,jM as f,u as g,X1 as h,k2 as i,W0 as j,NZ as k,VZ as l,FM as m,NM as n,VM as o,RM as p,pX as q,I1 as r,l2 as s,m2 as t,PZ as u,w1 as v,SZ as w,yZ as x,AM as y,T0 as z,EM as A,TM as B,wZ as C,SM as D,hZ as E,c2 as F,yM as G,d2 as H,NK as I,cZ as J,iZ as K,uK as L,oM as M,XF as N,KF as O,WF as P,YF as Q,_1 as R,i$ as S,l as T,b1 as U,q0 as V,o2 as W,Z6 as X,y0 as Y,U0 as Z,$W as _,q$ as $,K6 as aa,W6 as ba,R4 as ca,HY as da,C1 as ea,N7 as fa,g6 as ga,g7 as ha,xV as ia,t as ja,Nq as ka,Vq as la,s4 as ma,m0 as na,i6 as oa,pN as pa,k7 as qa,nz as ra,l9 as sa,XQ as ta,A2 as ua,UQ as va,qQ as wa,C3 as xa,WQ as ya,HI as za,r9 as Aa,E2 as Ba,A$ as Ca,m_ as Da,E$ as Ea,FI as Fa,NI as Ga,VI as Ha,E3 as Ia,S3 as Ja,y$ as Ka,yI as La,T3 as Ma,wI as Na,s_ as Oa,vI as Pa,S$ as Qa,CQ as Ra,AQ as Sa,yQ as Ta,wQ as Ua,iQ as Va,aQ as Wa,u$ as Xa,Fb as Ya,Nb as Za,QZ as _a,yb as $a,wb as ab,DX as bb,pb as cb,cb as db,KZ as eb,zX as fb,rb as gb,aL as hb,g$ as ib,BM as jb,qM as kb,PX as lb,Lf as mb};