cc-safety-net 2.1.1 → 2.2.1

package/dist/chunks/index-4g6x1r63.js

@@ -1,46 +0,0 @@
-import{accessSync as yp,constants as sl,realpathSync as Cp,statSync as al}from"node:fs";import{isAbsolute as ll,relative as bp,resolve as Sp,sep as vp}from"node:path";import{dirname as up,isAbsolute as dp,parse as mp,sep as fp}from"node:path";function kt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ct(e,t,n){if(kt(t))throw Error("Unsupported Windows namespace path");let r=dp(t)?gp(t):"",o=r||e;for(let i of hp(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=up(o);continue}let s=pp(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function pp(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${fp}${t}`}function gp(e){return mp(e).root}function hp(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}function rP(e){try{if(!al(e).isDirectory())return!1;return yp(e,sl.R_OK|sl.X_OK),!0}catch{return!1}}function oP(e,t){if(kt(e))return;let n=t.flatMap((o)=>Li(o));if(!n[0])return;let r=Li(ll(e)?e:Sp(n[0],e))[0];if(!r)return;return n.some((o)=>Rp(r,o))?r:void 0}function iP(e){return e.flatMap((t)=>Li(t))[0]}function Li(e){try{let t=Cp(e);return al(t).isDirectory()?[t]:[]}catch{return[]}}function Rp(e,t){let n=bp(t,e);return n===""||n!==".."&&!n.startsWith(`..${vp}`)&&!ll(n)}var bt="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",st="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",cl="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",ul="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",dl="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function ml(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}function I(e){return e.provenance==="command-substitution"?e.raw:e.text}function nn(e,t){return e==="posix"?t:G(t.map((n)=>n.text))}function Wr(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function G(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}import{existsSync as Gi,lstatSync as kp,readFileSync as $r,realpathSync as Fn,statSync as Wn}from"node:fs";import{dirname as zi,isAbsolute as $i,join as Br,resolve as Ur}from"node:path";import{lstatSync as xp,realpathSync as Ep}from"node:fs";import{homedir as wp,tmpdir as Pp}from"node:os";var Me={realpath:(e)=>{try{return Ep(e)}catch{return null}},entryKind:(e)=>{let t=xp(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}};function Tt(){return process.env.HOME||wp()}function at(){return{env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Tt(),tmpdir:Pp(),paths:Me}}var Ni=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],_p=new Set(Ni);var fl=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Fr=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Ap=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Wi(e){return _p.has(e)}function Nn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Fi(e){return Wi(e)||fl.has(e)||Fr.has(e)||Nn(e)}function Ee(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Gr(e,t){let n=Ee("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=1024?{state:"valid",count:r}:{state:"invalid"}}function zr(e,t,n){let o=e.match(Ap)?.[1];if(!o||!Fi(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ee(o,t,n)??""}${e.slice(i+1)}`}}function pl(e){return hl(e,Fr)}function gl(e){return hl(e,fl)}function hl(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Ke=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]);function bl(e,t){return Ni.some((n)=>t?.has(n)||e.has(n))}function Sl(e,t){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let n;try{n=Fn(Ur(t))}catch{return{gitCwd:null,hasExplicitGitContext:!1}}if(!xl(n))return{gitCwd:null,hasExplicitGitContext:!1};let r=!1,o=1;while(o<e.length){let i=e[o];if(!i)break;if(i==="--")break;if(!i.startsWith("-"))break;if(i==="-C"){let s=e[o+1];if(!s)return{gitCwd:null,hasExplicitGitContext:r};let a=Cl(n,s);if(!a)return{gitCwd:null,hasExplicitGitContext:r};n=a,o+=2;continue}if(i.startsWith("-C")&&i.length>2){let s=Cl(n,i.slice(2));if(!s)return{gitCwd:null,hasExplicitGitContext:r};n=s,o++;continue}if(i==="--git-dir"||i==="--work-tree"){r=!0,o+=2;continue}if(i.startsWith("--git-dir=")||i.startsWith("--work-tree=")){r=!0,o++;continue}if(Ke.has(i))o+=2;else if(i.startsWith("-c")&&i.length>2)o++;else o++}return{gitCwd:n,hasExplicitGitContext:r}}function vl(e){let t=Up(e);if(!t)return!1;try{let n=kp(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=Bi(t);if(!r?.commonDir)return!1;if(!Op(r.gitDir,t))return!1;return Mp(r.gitDir,zi(t))}catch{return!1}}function Bi(e){try{let t=Tp(e);if(!t)return null;let n=Fn($i(t)?t:Ur(zi(e),t));if(!Wn(n).isDirectory())return null;return{gitDir:n,commonDir:Ip(n)}}catch{return null}}function Tp(e){let t=$r(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Ip(e){try{let t=$r(Br(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Fn($i(t)?t:Ur(e,t));return Wn(n).isDirectory()?n:null}catch{return null}}function Op(e,t){let n=Dp(e);return n===null?!1:Rl(e,n,t)}function Mp(e,t){let n=Lp(e);return n===null?!0:Rl(e,n,t)}function Dp(e){let t=Br(e,"gitdir");if(!Gi(t))return null;let n=$r(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Lp(e){let t=Br(e,"config.worktree");return Gi(t)?zp(t):null}function Rl(e,t,n){return Wp(Np(e,t),n)}function Np(e,t){return $i(t)?t:Ur(e,t)}function Wp(e,t){try{return Fp(e,t)}catch{return!1}}function Fp(e,t){try{let n=Wn(e),r=Wn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return yl(e)===yl(t)}function yl(e){return Gp(Fn.native(e))}function Gp(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"");if(t=t.replace(/\\/g,"/"),t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return process.platform==="win32"?t.toLowerCase():t}function zp(e){let t=$r(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=$p(s[1]??"")}return r}function $p(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Bp(t.slice(1,-1))}function Bp(e){let t="";for(let n=0;n<e.length;n++){let r=e[n];if(r!=="\\"){t+=r;continue}let o=e[n+1];if(o===void 0){t+=r;continue}switch(o){case"\\":case'"':t+=o;break;case"n":t+=`
-`;break;case"t":t+="\t";break;case"b":t+="\b";break;default:t+=`\\${o}`;break}n++}return t}function Cl(e,t){try{let n=Ct(e,t,Me);return xl(n)?n:null}catch{return null}}function xl(e){try{return Wn(e).isDirectory()}catch{return!1}}function Up(e){try{return Gn(Fn(e))}catch{return null}}function Gn(e){let t=e;while(!0){let n=Br(t,".git");if(Gi(n))return n;let r=zi(t);if(r===t)return null;t=r}}function Ui(e,t){return{value:e,work:t}}function v(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function X(e){return e.value.length}function zn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function pe(e,t){zn(e,t)}function It(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function j(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Hi(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function V(e,t,n){if(t+n.length>X(e))return!1;for(let r=0;r<n.length;r++)if(v(e,t+r)!==n[r])return!1;return!0}function lt(e,t,n){return!It(v(e,t-1))&&V(e,t,n)&&!It(v(e,t+n.length))}function ct(e,t){return It(v(e,t-1))!==It(v(e,t))}function te(e){return e===`
-`||e===";"||e==="&"||e==="|"}function rn(e){return e==="|"||e===";"}function Hr(e,t,n){let r=Ui(e,n);if(t==="rm")return Hp(r);if(t==="dd")return Vp(r);return kl(r,!0)}function jr(e,t,n){let r=Ui(e,n);if(t==="rm")return qp(r);if(t==="reset-hard")return _l(r,"--ha","rd");if(t==="reset-merge")return _l(r,"--me","rge");if(t==="clean")return Xp(r);if(t==="checkout")return Qp(r);if(t==="push-force")return eg(r);if(t==="push-refspec")return tg(r);if(t==="push-delete")return ng(r);if(t==="branch")return rg(r);if(t==="tag")return sg(r);if(t==="restore")return ag(r);return kl(r,!1)}function Hp(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=X(e);i++){let s=v(e,i);if(!t){let l=v(e,i+2);if(lt(e,i,"rm")&&j(l)&&l!==`
-`)t=!0,i++;continue}let a=jp(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===X(e)){if(o>=0){let l=El(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(j(s)){if(o>=0){if(V(e,o,"--")&&i-o===2)t=!1,n=!1,r=!1;else{let l=El(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0}o=-1}continue}if(o<0)o=i}return!1}function jp(e,t){if(v(e,t)!=="\\"||v(e,t-1)==="\\")return-1;if(V(e,t,String.raw`\n`))return t+2;if(V(e,t,String.raw`\x0a`)||V(e,t,String.raw`\x0A`))return t+5;if(V(e,t,String.raw`\u000a`)||V(e,t,String.raw`\u000A`))return t+7;return V(e,t,String.raw`\012`)?t+4:-1}function El(e,t,n){if(wl(e,t,n,"recursive"))return{recursive:!0,force:!1};if(wl(e,t,n,"force"))return{recursive:!1,force:!0};if(v(e,t)!=="-"||v(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=v(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function wl(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!V(e,t,"--"))return!1;for(let i=0;i<o;i++)if(v(e,t+i+2)!==r[i])return!1;return!0}function Vp(e){let t=!1;for(let n=0;n<X(e);n++){if(te(v(e,n))){t=!1;continue}if(lt(e,n,"dd")){t=!0,n++;continue}if(!t||!lt(e,n,"of")||!V(e,n,"of=/dev/"))continue;let r=n+8;if(r<X(e)&&!j(v(e,r))&&v(e,r)!=="'"&&v(e,r)!=='"')return!0}return!1}function qp(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);){let i=v(e,o);if(o===X(e)||te(i)){t=!1,n=!1,r=!1,o++;continue}let s=Yp(e,o);if(s>=0){if(Kp(e,s))return!0;let a=s,l=!1;while(j(v(e,a)))l||=v(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(V(e,o,"--")&&(o===0||j(v(e,o-1)))&&(!v(e,o+2)||j(v(e,o+2))||te(v(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=V(e,o,"--recursive")&&ct(e,o+11)||ji(e,o,"recursive"),r||=V(e,o,"--force")&&ct(e,o+7)||ji(e,o,"force"),n&&r)return!0;o++}return!1}function ji(e,t,n){if(!V(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=v(e,t+r+2);if(!o||j(o)||te(o))break;if(o!==n[r])return!1;r++}return r>0&&ct(e,t+r+2)}function Kp(e,t){let n=t,r=!1,o=!1;while(n<X(e)){while(j(v(e,n)))n++;let i=n;while(n<X(e)&&!j(v(e,n)))n++;if(v(e,i)!=="-"||n-i===2&&V(e,i,"--"))return!1;let s=Pl(e,i,"recursive"),a=Pl(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,v(e,i+1)==="-")continue;let l=Zp(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Pl(e,t,n){return V(e,t,`--${n}`)&&ct(e,t+n.length+2)||ji(e,t,n)}function Yp(e,t){if(t>0&&It(v(e,t-1)))return-1;let n=t;if(v(e,n)==="\\")n++;if(v(e,n)!=="r")return-1;if(n++,v(e,n)==="\\")n++;if(v(e,n)!=="m"||!j(v(e,n+1)))return-1;return n+1}function Zp(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(v(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=v(e,c)??"",m=(u==="r"||u==="f")&&ct(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function _l(e,t,n){return Bn(e,"reset",rn,!0,(r)=>v(e,r)==="-"&&on(e,r,t,n)?!0:r)}function Xp(e){return Bn(e,"clean",rn,!0,(t)=>{if(v(e,t)!=="-")return t;if(on(e,t,"--fo","rce"))return!0;let n=$n(e,t,rn);for(let r=t+1;r<n;r++)if(v(e,r)==="f")return!0;return n-1})}function Vr(e,t,n){if(!lt(e,t,"git"))return null;let r=t+3;if(!j(v(e,r)))return{commandEnd:-1,next:r};while(j(v(e,r)))r++;while(r<X(e)){if(te(v(e,r)))return{commandEnd:-1,next:r};let o=$n(e,r,te);if(lt(e,r,n))return{commandEnd:r+n.length,next:o};if(v(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&V(e,r,"--"),s=Jp(e,r,o);r=o;while(j(v(e,r)))r++;if(i)return{commandEnd:lt(e,r,n)?r+n.length:-1,next:$n(e,r,te)};if(!s)continue;if(r>=X(e)||te(v(e,r)))return{commandEnd:-1,next:r};r=$n(e,r,te);while(j(v(e,r)))r++}return{commandEnd:-1,next:r}}function Jp(e,t,n){for(let r of Ke)if(n-t===r.length&&V(e,t,r))return!0;return!1}function Qp(e){return Al(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function eg(e){return Bn(e,"push",rn,!0,(t)=>{if(v(e,t)!=="-")return t;if(v(e,t+1)==="f"&&!It(v(e,t+2))&&!V(e,t+2,"-with-lease"))return!0;let n=Tl(e,t,"--fo","rce");if(n>=0&&!V(e,n,"-with-lease"))return!0;return t})}function tg(e){return Bn(e,"push",te,!1,(t)=>{if(j(v(e,t))&&v(e,t+1)==="+"&&t+2<X(e)&&!te(v(e,t+2))&&!j(v(e,t+2)))return!0;if(v(e,t)===":"&&v(e,t+1)==="+")return!0;return t})}function ng(e){return Bn(e,"push",te,!1,(t)=>{if(v(e,t)==="-"&&on(e,t,"--de","lete"))return!0;if(j(v(e,t))&&v(e,t+1)===":"&&t+2<X(e)&&!j(v(e,t+2))&&!te(v(e,t+2)))return!0;return t})}function rg(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);o++){if(o===X(e)||te(v(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Vr(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||v(e,o)!=="-")continue;let i=$n(e,o,te),s=og(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function og(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(v(e,i)!=="-")continue;if(on(e,i,"--de","lete"))r=!0;if(on(e,i,"--fo","rce"))o=!0;if(v(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&ig(v(e,s))){let u=v(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!ct(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function ig(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function sg(e){return Al(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Al(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<X(e);r++){let o=v(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&v(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(j(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Vr(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&j(v(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(on(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(v(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&ct(e,r+1))return!0;if(rn(o))i.outerActive=!1}return!1}function Bn(e,t,n,r,o){let i=!1;for(let s=0;s<X(e);s++){let a=v(e,s),l=n(a);if(!i&&!l){let c=Vr(e,s,t);if(c){i=c.commandEnd>=0&&(!r||j(v(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(v(e,u)))i=!1;s=c}if(l)i=!1}return!1}function ag(e){let t=!1;for(let n=0;n<X(e);n++){if(Hi(v(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Vr(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&v(e,n)==="-"&&v(e,n+1)==="-"&&(V(e,n+2,"staged")||V(e,n+2,"help")))t=!1}return t}function kl(e,t){let n=!1;for(let r=0;r<X(e);r++){let o=v(e,r),i=t?Hi(o):te(o);if(n&&j(o)&&v(e,r+1)==="-"&&lt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(lt(e,r,"find"))n=!0,r+=3}return!1}function $n(e,t,n){let r=t;while(r<X(e)&&!j(v(e,r))&&!n(v(e,r)))r++;return r}function Tl(e,t,n,r){if(!V(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&v(e,o)===r[i];i++)o++;return ct(e,o)?o:-1}function on(e,t,n,r){return Tl(e,t,n,r)>=0}var lg=["git.ssh-env","git.alias-config","git.checkout-force","git.checkout-double-dash","git.checkout-ref-path","git.checkout-pathspec-from-file","git.checkout-ambiguous","git.switch-discard-changes","git.switch-force","git.restore-worktree","git.restore-unstaged","git.reset-hard","git.reset-merge","git.clean-force","git.rm-force","git.push-force","git.push-delete","git.push-mirror","git.branch-force-delete","git.rebase-abort","git.merge-abort","git.tag-delete","git.reflog-delete","git.stash-drop","git.stash-clear","git.worktree-remove-force","rm.recursive-force-root-or-home","rm.git-metadata","rm.recursive-force-dynamic-target","rm.recursive-force-home-cwd","rm.recursive-force-cwd-self","rm.recursive-force-outside-cwd","rm.recursive-force-paranoid","powershell.remove-item-root-or-home","powershell.remove-item-recursive-force-root-or-home","powershell.remove-item-git-metadata","powershell.remove-item-recursive-force-dynamic-target","powershell.remove-item-recursive-force-home-cwd","powershell.remove-item-recursive-force-cwd-self","powershell.remove-item-recursive-force-outside-cwd","powershell.remove-item-recursive-force-paranoid","powershell.remove-item-pipeline-dynamic-target","find.delete","find.delete-git-metadata","find.exec-rm-recursive-force","dd.device-write","mkfs.device","shred.target","interpreter.dangerous-command","interpreter.one-liner-paranoid","awk.system-dynamic","xargs.rm-recursive-force-dynamic","xargs.shell-dynamic","parallel.rm-recursive-force-dynamic","parallel.shell-dynamic","parallel.command-stream-dynamic","shell.dynamic-structure","shell.dynamic-executable","raw-text.dangerous-command"],qr=new Set(lg),Kr=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],cg=new Map(Kr.map((e)=>[e.id,e.intent])),Il=new Set(Kr.filter((e)=>e.catastrophic).map((e)=>e.id));function b(e,t){return{id:e,reason:t,intent:cg.get(e)??"manual_only"}}function k(e,t){if(!e)return null;if(Il.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function Q(e,t,n){if(Il.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Vi(e,t){return Object.freeze(Object.fromEntries(Kr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Ol(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Vi(e,t)})}function ut(e,t){zn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)pe(t,a);if((s.regex?.test(a)??!1)||s.scan&&jr(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var ug=/^[A-Za-z_][A-Za-z0-9_]*=/;function Dl(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;zn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Ll(t.nodes,r,i)}function Ll(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Ll(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return dg(r,t,n)})}function dg(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!ug.test(o.text));return e.words.every((o,i)=>o===t||Ml(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Ml(o.target.raw,n.anchored,!0)))}function Ml(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var Nl=Object.freeze({maxDerivedTokens:16384}),Wl="Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.";class ge extends Error{constructor(){super("Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.");this.name="DerivedCommandWorkLimitError"}}function Yr(){return{derivedTokens:0}}function De(e,t){if(!Number.isSafeInteger(e.derivedTokens)||e.derivedTokens<0||e.derivedTokens>Nl.maxDerivedTokens||!Number.isSafeInteger(t)||t<0||t>Nl.maxDerivedTokens-e.derivedTokens)throw new ge;e.derivedTokens+=t}import{isAbsolute as hg,resolve as Gl}from"node:path";import{basename as mg,dirname as fg,join as qi}from"node:path";var sn=Object.freeze({maxEnvironmentExpansionDepth:64,maxMissingSuffixComponents:256,maxRealpathAttempts:16384,maxProcessedCandidateBytes:4194304});class we extends Error{name="PathCanonicalizationLimitError";constructor(){super("Path canonicalization work limit exceeded.")}}function Xr(){return{realpathAttempts:0,processedCandidateBytes:0,resolvedPaths:new Map}}function Ot(e){return{...Xr(),environment:e}}var Zr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Jr(e,t){return Ki(e,0,t)}function Ki(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Yi(e,o+2),a=pg(e,o,t);if(a===null){if(Zr.has(s))throw new we;r+=e.slice(o);break}let l=e.slice(o,a+1);r+=gg(l,t,n),o=a+1;continue}let i=Yi(e,o+1);if(!i){r+="$",o++;continue}r+=Zi(i,n)??`$${i}`,o+=i.length+1}return r}function pg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>sn.maxEnvironmentExpansionDepth)throw new we;o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function gg(e,t,n){let r=e.slice(2,-1),o=Yi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Zi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Zr.has(o))throw new we;return e}if(!Zr.has(o))return e;if(s.endsWith("="))throw new we;let a=Zi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new we;if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ki(i.slice(s.length),t+1,n);return l?Ki(i.slice(s.length),t+1,n):""}function Yi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function U(e,t,n=Xr()){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(i),n.realpathAttempts>sn.maxRealpathAttempts||n.processedCandidateBytes>sn.maxProcessedCandidateBytes)throw new we;let s=t.realpath(i);if(s!==null){let l=o.length===0?s:qi(s,...o.reverse());return n.resolvedPaths.set(e,l),l}let a=fg(i);if(a===i){let l=o.length===0?i:qi(i,...o.reverse());return n.resolvedPaths.set(e,l),l}if(o.length>=sn.maxMissingSuffixComponents){let l=qi(i,...o.reverse());return n.resolvedPaths.set(e,l),l}o.push(mg(i)),i=a}}function Fl(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(e),n.realpathAttempts>sn.maxRealpathAttempts||n.processedCandidateBytes>sn.maxProcessedCandidateBytes)throw new we;let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Zi(e,t){if(!Zr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}var zl=64;function Un(e,t,n){let r=hg(e)?Gl(e):t?Gl(t,e):void 0;if(!r)return;try{return U(r,n)}catch{return r}}function $l(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}function z(e){return D(e).toLowerCase()}function D(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}var Qr=10,an=20,Mt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ln=256,ee=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Bl=new Set(["python","python3","python2","node","ruby","perl"]),Ul=/^python(?:[23](?:\.\d+)*)?$/,eo=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Dt="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",cn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",to=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),yg=new Set(["-p","--print"]),Cg=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),bg=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Sg=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),vg=new Map([["python",new Set(["m"])]]),Rg=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),xg=new Set(["always","default","never"]),Eg=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),wg=/\\\r?\n/g,Pg=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function no(e){return oo(e).code}function ro(e){return oo(e).sources}function jl(e){return Pg.get(so(e))??[]}function oo(e){let t=so(e[0]??"");if(!to.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Le(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Le(t,n,r,o,i,s);if(t==="node"&&yg.has(s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(Ag(t,s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Le(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(kg(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=_g(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let f=e[i+1];if(f===void 0||f.startsWith("-"))return o=!1,Le(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:f}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Le(t,n,r,o);if(Rg.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&Eg.has(s))||t==="python"&&!xg.has(m))return Le(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let f=s[m];if(f===void 0)break;if(vg.get(t)?.has(f)){let d=s.slice(m+1),p=d||e[i+1];if(p!==void 0)r.push({tokenIndex:d?i:i+1,kind:"module-file",value:p});return Le(t,n,r,o)}if(Cg.get(t)?.has(f)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&f==="r"){if(s==="-r"){let d=e[i+1];if(o&&=d!==void 0&&!d.startsWith("-"),o&&d!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:d});i++}else o=!1;break}if(t==="ruby"&&f==="r"){let d=s.slice(m+1),p=d||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:d?i:i+1,kind:"module-file",value:p});if(!d)i++;break}if(t==="perl"&&(f==="M"||f==="m")){let d=s.slice(m+1);if(d)r.push({tokenIndex:i,kind:"module-file",value:d});else if(o=!1,m+1===s.length)i++;break}if(bg.get(t)?.has(f)){if(m+1===s.length)i++;break}if(Sg.get(t)?.has(f)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Le(t,n,r,o);if(c)i++}return Le(t,n,r,o,void 0,void 0,!0)}function Le(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function _g(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function he(e){return to.has(so(e))}function io(e,t){return so(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function so(e){let t=D(e).toLowerCase();return Ul.test(t)?"python":t}function Ag(e,t){return to.get(e)?.has(t)??!1}function kg(e){return to.get(e)?.has("--eval")??!1}function un(e,t){let n=Og(e,t);if(!Hl(n,t))return!1;pe(t,n);let r=Ig(n);if(Hl(r,t))return!0;return pe(t,r),Tg.test(r)}var Tg=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Ig(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Hl(e,t){if(Hr(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(pe(t,e),r.test(e))return!0;if(Hr(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(pe(t,e),r.test(e))return!0;if(Hr(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(pe(t,e),n.some((o)=>jr(o,r))))}function Og(e,t){return pe(t,e),e.replace(wg,"")}var B=Object.freeze({maxChildAnalyses:1024,maxDerivedTokens:16384,maxDerivedBytes:1048576,maxPlaceholderReplacements:16384}),Vl="Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.";class lo extends Error{constructor(){super("Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.");this.name="ParallelAnalysisLimitError"}}function ql(){return{childAnalyses:0,derivedTokens:0,derivedBytes:0,placeholderReplacements:0}}function ye(e,t){let n=t.childAnalyses??0,r=t.derivedTokens??0,o=t.derivedBytes??0,i=t.placeholderReplacements??0;if(ao(e.childAnalyses,n,B.maxChildAnalyses)||ao(e.derivedTokens,r,B.maxDerivedTokens)||ao(e.derivedBytes,o,B.maxDerivedBytes)||ao(e.placeholderReplacements,i,B.maxPlaceholderReplacements))throw new lo;e.childAnalyses+=n,e.derivedTokens+=r,e.derivedBytes+=o,e.placeholderReplacements+=i}function ao(e,t,n){return!Number.isSafeInteger(e)||e<0||e>n||!Number.isSafeInteger(t)||t<0||t>n-e}import{isAbsolute as Ps,normalize as Hy,parse as jy,posix as fu,resolve as hn,sep as ws}from"node:path";import{isAbsolute as Mg,join as Kl,normalize as Xl,parse as Dg,sep as Yl}from"node:path";var Lg=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Ng=` 	
-`;function Hn(e,t){if(Ye(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Xi(e.get("TMPDIR")??"",t)}function dt(e,t){if(e.has("TMPDIR"))return Xi(e.get("TMPDIR")??"",t);let n=Ji(e,t);if(n===void 0)return!0;return Xi(n,t)}function Ji(e,t){return ec(e,t,"TMPDIR")}function Xi(e,t){if(!e)return!1;if(Fg(e))return!1;return Qi(e,t)}function Ye(e,t){let n=ec(e,t,"IFS");return n!==void 0&&n!==""&&n!==Ng}function Qi(e,t){let n=co(e,t.paths);return n!==null&&Ql(t).some((r)=>zg(n,r))}function Jl(e,t){let n=co(e,t.paths);return n!==null&&Ql(t).includes(n)}var Zl=new WeakMap;function Ql(e){let t=Zl.get(e);if(t)return t;let n=Wg(e);return Zl.set(e,n),n}function Wg(e){let t=Lg.map((r)=>co(r,e.paths)??Xl(r)),n=co(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Gg(n))return[...t,n];return t}function Fg(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function ec(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Gg(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function co(e,t){try{let n=Xl(e);if(!Mg(n))return n;let r=Dg(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Kl(i,o[s]??"");if(t.entryKind(a)==="missing")return Kl(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function zg(e,t){if(e===t)return!0;let n=t.endsWith(Yl)?t:`${t}${Yl}`;return e.startsWith(n)}import{statSync as ky}from"node:fs";import{isAbsolute as ou,join as Ty,relative as iu}from"node:path";import{isAbsolute as tc,parse as $g}from"node:path";var rc=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!rc.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function uo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(I(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function oc(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Lt(e,t,n,r){if(!oc(dn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<an;m++){let f=nc(i),d=uo(i);for(let[g,y]of d.envAssignments)s.set(g,y),a.set(g,y);if(i=d.words,i.length===0)break;while(i.length>0&&dn(i).includes("=")&&!Ug(i)){let g=Hg(dn(i),a,t.env)??zr(dn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=dn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Vg(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Yg(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[y,h]of g.envAssignments)s.set(y,h),a.set(y,h)}if(p==="command")i=Zg(i);if(p==="builtin")i=i.slice(Ne(i,1)==="--"?2:1);if(nc(i)===f)break}let u=uo(i);for(let[m,f]of u.envAssignments)s.set(m,f),a.set(m,f);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Bg(u.words,o)}}function Bg(e,t){return e.some((n)=>!t.has(n))}function nc(e){return e.map(I).join(" ")}function dn(e){let t=e[0];return t?I(t):""}function Ne(e,t){let n=e[t];return n?I(n):void 0}function Ug(e){return rc.test(dn(e))}function Hg(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var jg=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Vg(e,t,n){let r=1,o=n;while(r<e.length){let i=Ne(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ne(e,r+1);o=s?jn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=jn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=jn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(jg.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var qg=new Set(["-i","-0","--null"]),Kg=new Set(["-u","--unset","-C","--chdir","-P"]);function Yg(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ne(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(qg.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Ne(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Ne(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Kg.has(c)){if(c==="-C"||c==="--chdir"){let m=Ne(e,a+1);s=m?jn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=jn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Ne(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Ne(e,a)==="--")a++;return l(a)}return l(a)}function jn(e,t,n){if(t==="")return null;if(!e&&!tc(t))return null;let r=tc(t)?$g(t).root:n.realpath(e??"/");if(r===null)return null;try{return Ct(r,t,n)}catch{return null}}function Zg(e){if(Ne(e,1)==="-v")return[...G(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ne(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Xg=/['"\\$`{}#]/;function mo(e,t){if(e.some((r)=>Xg.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function mn(e,t,n){return fo(e,t,n).tokens}function Jg(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function St(e,t,n,r=0){let o=fo(e,t,n),i=(o.envSplitValues??[]).flatMap(Jg);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return St(s,t,n,r+1)}function fo(e,t,n,r){if(!oc(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Lt(G(e),t,n,r);return{tokens:o.words.map(I),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}import{basename as xy,isAbsolute as Ey,normalize as wy,resolve as eu}from"node:path";function po(){return[]}function go(){return[]}function ho(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Qg(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>ue(t)))})}function yo(e,t,n){e.push(n),t.reset()}function eh(e,t,n,r,o){if(r<=n)return;e.push({raw:t.slice(n,r),span:{start:n,end:r},provenance:o})}function Co(e){let t=[];return{parts:t,push:(n,r,o)=>eh(t,e,n,r,o)}}function es(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function fn(e,t,n,r,o,i,s){return es({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function ue(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Qg(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:ue(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function ts(e,t,n){if(t>=n||sc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!sc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=ic(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=ic(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function ns(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=th(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?nh(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function ic(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function sc(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function th(e,t,n){let r=t;while(r<n&&e[r]!==`
-`&&e[r]!=="\r")r++;let o=r>=n?n:e[r]==="\r"&&e[r+1]===`
-`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function nh(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var dc=new Set(["&&","||","|","|&"]);function mc(e,t,n){let r={start:0,end:e.length};if(e.length>n.maxInputLength)return ue({kind:"program",dialect:t,source:e,span:r,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${n.maxInputLength} UTF-16 code units`,span:r}],nodes:[]});let o=vo(e,0,e.length,t,n,{used:0,max:n.maxWords},0);return ue({kind:"program",dialect:t,source:e,span:r,status:Eo(o.issues,o.limited),issues:o.issues,nodes:o.nodes})}function vo(e,t,n,r,o,i,s,a){let l=po(),c=go(),u=ho(),m=[],f=()=>{if(u.words.length===0&&u.redirections.length===0)return;let p={start:u.start,end:u.end},g=u.words.map((y)=>y.text);yo(l,u,{kind:"command",dialect:r,source:e.slice(p.start,p.end),span:p,words:u.words,redirections:u.redirections,nested:u.nested,displayText:c.length>0&&l.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let p=e[d];if(!p)break;if(a&&p===a)return f(),uc(l,c),{nodes:l,issues:c,next:d+1,closed:!0,limited:!1,pendingHeredocs:m};if(xo(p)){if(p===`
-`||p==="\r"){f();let P=p==="\r"&&e[d+1]===`
-`?d+2:d+1,S=l.at(-1);if(S?.kind!=="connector"||!dc.has(S.operator))l.push(Object.freeze({kind:"connector",operator:e.slice(d,P),span:Object.freeze({start:d,end:P})}));if(m.length>0){let C=ns(e,P,n,m.splice(0));c.push(...C.issues),d=C.next;continue}d=P;continue}d++;continue}if(p==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let g=u.start===-1?vh(e,d,n):void 0;if(g){if(os(l,c,d),s>=o.maxDepth)return pn(l,c,d,"depth-limit",o.maxDepth);if(!rs(i))return pn(l,c,d,"word-limit",o.maxWords);let P=vo(e,g.braceIndex+1,n,r,o,i,s+1,"}"),S=P.next,C={start:g.braceIndex+1,end:P.closed?S-1:S},_=ac(e,r,C,P);if(l.push({kind:"function",name:g.name,span:{start:d,end:S},body:_}),c.push(...P.issues),P.pendingHeredocs.length>0||qn(P.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:d,end:S}});if(m.push(...P.pendingHeredocs),P.limited)return So(l,c,P.next);if(!P.closed)c.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:g.braceIndex,end:S}});d=S;continue}let y=Ro(e,d);if(y){if(f(),!Sc(l.at(-1)))c.push({code:"unexpected-connector",message:`connector ${y} has no preceding command`,span:{start:d,end:d+y.length}});l.push(Object.freeze({kind:"connector",operator:y,span:Object.freeze({start:d,end:d+y.length})})),d+=y.length;continue}if(p===")"){f(),c.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:d,end:d+1}}),l.push({kind:"unknown",source:p,span:{start:d,end:d+1}}),d++;continue}if((p==="("||p==="{"&&ch(e,d,n))&&u.start===-1){if(os(l,c,d),s>=o.maxDepth)return pn(l,c,d,"depth-limit",o.maxDepth);let P=p==="("?")":"}",S=vo(e,d+1,n,r,o,i,s+1,P),C=S.next,_={start:d+1,end:S.closed?C-1:C},E=ac(e,r,_,S);if(l.push({kind:"group",style:p==="("?"subshell":"brace",span:{start:d,end:C},body:E}),c.push(...S.issues),S.pendingHeredocs.length>0||qn(S.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:d,end:C}});if(m.push(...S.pendingHeredocs),S.limited)return So(l,c,S.next);if(!S.closed)c.push({code:p==="("?"unclosed-subshell":"unclosed-brace-group",message:`${p} group is not closed`,span:{start:d,end:C}});d=C;continue}let h=(p==="<"||p===">")&&e[d+1]!=="("?ih(e,d):null;if(h){let P=u.words.at(-1),S=P&&P.span.end===d&&/^[0-9]+$/.test(P.raw)?Number(P.raw):void 0;if(S!==void 0)u.words.pop();let C=S===void 0?d:P?.span.start??d;u.start=u.start===-1?d:u.start;let _=d+h.length;while(_<n&&/[ \t]/.test(e[_]??""))_++;let E=e[_],T=_>d+h.length&&E==="#",O=!E||xo(E)||!!Ro(e,_)||E===a||E===")"||T||(E==="<"||E===">")&&e[_+1]!=="(",M=h==="<<"||h==="<<-"?ts(e,_,n):void 0,F=M?{word:fn(e,_,M.next,M.delimiter,"literal",M.quoted),nested:[],issues:[],next:M.next,limited:!1}:!O?is(e,_,n,r,o,i,s):void 0;if(F){if(c.push(...F.issues),F.limited)return So(l,c,F.next);if(!rs(i))return pn(l,c,F.next,"word-limit",o.maxWords)}let oe=F?.next??d+h.length,xe={kind:"redirection",operator:h,span:{start:C,end:oe},...S===void 0?{}:{fd:S},...F?{target:F.word}:{}};if(u.redirections.push(xe),h==="<<"||h==="<<-")if(!M)c.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:d,end:d+h.length}});else{if(M.ambiguous||M.delimiter.length===0)c.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:M.span});m.push({delimiter:M.delimiter,quotedDelimiter:M.quoted,stripTabs:h==="<<-",declarationSpan:{start:C,end:oe},attach:(w)=>{xe.heredoc=w}})}else if(!F)c.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`,span:{start:d,end:d+h.length}});if(F)u.nested.push(...F.nested);u.end=oe,d=oe;continue}if(u.start===-1)os(l,c,d);let R=is(e,d,n,r,o,i,s);if(c.push(...R.issues),R.limited)return So(l,c,R.next);let x=mh(u.words)?yh(e,R.word,i.max-i.used,o.maxDepth,o.maxInputLength):void 0;if(x?.limitCode)return pn(l,c,R.next,x.limitCode,x.limitCode==="word-limit"?o.maxWords:x.limitCode==="depth-limit"?o.maxDepth:o.maxInputLength);let A=x?.words??[R.word];for(let P of A){if(!rs(i))return pn(l,c,R.next,"word-limit",o.maxWords);u.words.push(P)}u.start=u.start===-1?d:u.start,u.end=R.next,u.nested.push(...R.nested),d=R.next>d?R.next:d+1}return f(),uc(l,c),c.push(...Rh(m)),{nodes:l,issues:c,next:d,closed:a===void 0,limited:!1,pendingHeredocs:[]}}function ac(e,t,n,r){return{kind:"program",dialect:t,source:e.slice(n.start,n.end),span:n,status:Eo(r.issues,r.limited),issues:r.issues,nodes:r.nodes}}function is(e,t,n,r,o,i,s){let a="",l=t,c=!1,u="literal",m=[],f=[],d=!1;while(l<n){let p=e[l],g=(p==="<"||p===">")&&e[l+1]==="(";if(!p||xo(p)||(p===";"||p==="|"||p==="&")&&Ro(e,l)||(p==="<"||p===">")&&!g)break;if(p===")")break;if(p==="'"){c=!0;let h=e.indexOf("'",l+1);if(h===-1||h>=n){a+=e.slice(l+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:l,end:n}}),l=n;break}a+=e.slice(l+1,h),l=h+1;continue}if(p==='"'){c=!0;let h=rh(e,l,n,r,o,i,s);if(a+=h.text,m.push(...h.nested),f.push(...h.issues),d||=h.limited,u=Vn(u,h.provenance),l=h.next,d)break;continue}if(e.startsWith("$'",l)){c=!0;let h=sh(e,l+2,n);if(a+=h.text,f.push(...h.issues),!h.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:l,end:n}});l=h.next;continue}if(p==="\\"){let h=e[l+1];if(!h){f.push({code:"trailing-escape",message:"escape has no following character",span:{start:l,end:l+1}}),l++;break}if(h===`
-`){l+=2;continue}a+=h,l+=2;continue}let y=p==="$"||p==="<"||p===">"||p==="`"?ss(e,l,n,r,o,i,s):null;if(y){let h=fc(y,m,f);if(d||=h.limited,u=Vn(u,h.provenance),l=h.next,d)break;continue}if(p==="$"){let h=hc(e,l,n,a,u);a=h.text,u=h.provenance,l=h.next;continue}if(p==="*"||p==="?"||p==="[")u=Vn(u,"glob");a+=p,l++}return{word:fn(e,t,l,a,u,c,u==="literal"?void 0:lh(e,t,l)),nested:m,issues:f,next:l,limited:d}}function rh(e,t,n,r,o,i,s){let a="",l="literal",c=[],u=[],m=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:a,provenance:l,nested:c,issues:u,next:f+1,limited:m};if(d==="\\"&&e[f+1]){let g=e[f+1]??"";if(g===`
-`){f+=2;continue}if(g==="\r"&&e[f+2]===`
-`){f+=3;continue}a+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,f+=2;continue}if(e.startsWith("$((",f)){let g=as(e,f+3,n,"))"),y=g===-1?n:g+2;if(a+=e.slice(f,y),g===-1)u.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:f,end:y}});f=y;continue}let p=ss(e,f,n,r,o,i,s);if(p){let g=fc(p,c,u);if(f=g.next,m||=g.limited,l=Vn(l,g.provenance),m)return{text:a,provenance:l,nested:c,issues:u,next:f,limited:m};continue}if(d==="$"){let g=hc(e,f,n,a,l);a=g.text,l=g.provenance,f=g.next;continue}a+=d??"",f++}return u.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:a,provenance:l,nested:c,issues:u,next:n,limited:m}}function ss(e,t,n,r,o,i,s){let a=e.startsWith("$((",t),l=e.startsWith("$(",t)&&!a,c=(e.startsWith("<(",t)||e.startsWith(">(",t))&&!0,u=e[t]==="`";if(!a&&!l&&!c&&!u)return null;let m=a?3:u?1:2,f=a?"))":u?"`":")",d=as(e,t+m,n,f),p=d===-1?n:d,g=d===-1?n:d+f.length;if(s>=o.maxDepth)return{program:Sh(e,t+m,p,r,"depth-limit"),next:g,provenance:a?"arithmetic":"command-substitution"};if(a){let x=[],A=[],P=!1,S=t+m;while(S<p){let C=ss(e,S,p,r,o,i,s+1);if(!C){S++;continue}if(x.push(...C.program.nodes),A.push(...C.program.issues),P||=C.program.status==="limited",S=C.next,P)break}if(d===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:g}});return{program:ue({kind:"program",dialect:r,source:e.slice(t+m,p),span:{start:t+m,end:p},status:Eo(A,P),issues:A,nodes:x}),next:g,provenance:"arithmetic"}}let y=vo(e,t+m,p,r,o,i,s+1),h=d===-1?[{code:a?"unclosed-arithmetic":"unclosed-command-substitution",message:`${e.slice(t,t+m)} substitution is not closed`,span:{start:t,end:g}}]:[],R=(u||c)&&qn(y.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:g}}]:[];return{program:ue({kind:"program",dialect:r,source:e.slice(t+m,p),span:{start:t+m,end:p},status:Eo([...y.issues,...h,...R],y.limited),issues:[...y.issues,...h,...R],nodes:y.nodes}),next:g,provenance:a?"arithmetic":"command-substitution"}}function fc(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function as(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++)if(e[a]==="\\")a++;else if(e[a]==="`")return a;return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=ns(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=pc(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=oh(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let f=ts(e,m,n);if(f){s.push({delimiter:f.delimiter,quotedDelimiter:f.quoted,stripTabs:u,declarationSpan:{start:a,end:f.next},attach:()=>{return}}),a=f.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function oh(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=pc(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function pc(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!xh(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function Ro(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function ih(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function xo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function gc(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function sh(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ah(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ah(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return bo(e,t+1,n,16,2,t+1);if(r==="u")return bo(e,t+1,n,16,4,t+1);if(r==="U")return bo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return bo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function bo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Eo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function hc(e,t,n,r,o){let i=gc(e,t,n);return{text:r+e.slice(t,i),provenance:Vn(o,"variable"),next:i}}function lh(e,t,n){let r=Co(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),f=l==="`";if(c||u||m||f){let d=c?3:f?1:2,p=c?"))":f?"`":")",g=as(e,a+d,n,p),y=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,y,c?"arithmetic":"command-substitution"),a=y,o=y;continue}if(l==="$"){let d=gc(e,a,n);if(d>a+1){r.push(o,a,"literal"),r.push(a,d,"variable"),a=d,o=d;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Vn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function ch(e,t,n){return t+1>=n||xo(e[t+1]??"")||Ro(e,t+1)!==null}var uh=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),dh=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function mh(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=fh(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function fh(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return ph(e,t);if(n==="env")return gh(e,t);if(n==="sudo")return hh(e,t);return}function ph(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function gh(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(uh.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function hh(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(dh.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function yc(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let l=o.findIndex((p)=>cc(p));if(l===-1)break;if(++s>n)return{limited:!0};let c=o[l]??"",u=cc(c);if(!u||u.kind==="range")return{limited:!0};let m=u.start+c.length-u.end,f=u.alternatives.reduce((p,g)=>p+m+g.length,0);if(i-c.length+f>r||o.length-1+u.alternatives.length>t)return{limited:!0};let d=Cc(c,u);o.splice(l,1,...d),i+=f-c.length}if(s===0)return;let a=o.map((l)=>bh(l,n));if(a.some((l)=>l===null))return{limited:!0};return{words:[...new Set(a.filter((l)=>l!==null&&l!==""))]}}function yh(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let c=i.findIndex((y)=>lc(y));if(c===-1)break;if(++a>r)return{limitCode:"depth-limit"};let u=i[c]??"",m=lc(u);if(!m)break;let f=m.start+u.length-m.end,d=m.alternatives.filter((y)=>f+y.length>0),p=d.reduce((y,h)=>y+f+h.length,0);if(s-u.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+d.length>n)return{limitCode:"word-limit"};let g=Cc(u,{...m,alternatives:d});i.splice(c,1,...g),s+=p-u.length}let l=i.filter((c)=>c.length>0);if(a===0)return;return{words:l.map((c)=>fn(e,t.span.start,t.span.end,c,"literal",!1))}}function lc(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:bc(e,n)}}function cc(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let l=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:Ch(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(l&&(!n||l.start<n.start))n=l}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:bc(e,n)}}function Cc(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function bc(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Ch(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function bh(e,t){let n=`x${e}`,r=is(n,0,n.length,"posix",{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function Sh(e,t,n,r,o){return ue({kind:"program",dialect:r,source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:o,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function pn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function So(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function rs(e){return e.used++,e.used<=e.max}function vh(e,t,n){let r=/^([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(e.slice(t,n)),o=r?.[1];if(!r||!o)return;return{name:o,braceIndex:t+r[0].lastIndexOf("{")}}function qn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>qn(n.nodes));return(t.kind==="group"||t.kind==="function")&&qn(t.body.nodes)})}function Rh(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function Sc(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function uc(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!dc.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function os(e,t,n){if(!Sc(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function xh(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var vc=new Set(["remove-item","ri","del","erase","rd","rmdir"]),Rc=["-rec","-for","-path","-literalpath","-whatif"],wo={maxInputLength:131072,maxWords:16384,maxDepth:64};function xc(e){let t=e.toLowerCase().replaceAll("`","");if(![...vc].some((r)=>t.includes(r))&&!(t.includes("rm")&&Rc.some((r)=>t.includes(r)))&&!t.includes("<#"))return!1;let n=_h(e);return n.invalidComment||n.commands.some(Eh)}function Eh(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&vc.has(n))return!0;if(n!=="rm")return!1;return e.slice(t+1).some((r)=>{let o=r.toLowerCase().split(":",1)[0]??"";return Rc.some((i)=>o.startsWith(i))})}function Ec(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return ue({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=ms(e,0,e.length,t,0);return ue({kind:"program",dialect:"powershell",source:e,span:n,status:Ah(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ms(e,t,n,r,o,i=!1){let s=po(),a=go(),l=ho(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let d={start:l.start,end:l.end};yo(s,l,{kind:"command",dialect:"powershell",source:e.slice(d.start,d.end),span:d,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},f=t;while(f<n){let d=e[f];if(!d)break;if(i&&d==="}")return m(),{nodes:s,issues:a,next:f+1,closed:!0,words:c,limited:u};let p=_c(e,f,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};f=p.next;continue}if(/\s/.test(d)){if(d==="\r"||d===`
-`){m();let h=d==="\r"&&e[f+1]===`
-`?f+2:f+1;s.push(ls(e,f,h)),f=h;continue}f++;continue}let g=fs(e,f);if(g){m(),s.push(ls(e,f,f+g.length)),f+=g.length;continue}if(d==="{"){if(m(),o>=r.maxDepth)return a.push(Pc(f,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let h=ms(e,f+1,n,r,o+1,!0),R=h.closed?h.next-1:h.next,x=ue({kind:"program",dialect:"powershell",source:e.slice(f+1,R),span:{start:f+1,end:R},status:h.limited?"limited":h.issues.length>0?"partial":"complete",issues:h.issues,nodes:h.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:f,end:h.next}),body:x})),a.push(...h.issues),!h.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:f,end:h.next}});c+=h.words,u||=h.limited,f=h.next;continue}if(d==="}"){m(),s.push(ls(e,f,f+1)),f++;continue}if(d===">"||d==="<"){l.start=l.start===-1?f:l.start;let h=e[f+1]===d?f+2:f+1,R=h;while(/[ \t]/.test(e[R]??""))R++;let x=R<n?cs(e,R,n,r,o):void 0,A=x?.next??h;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(f,h),span:Object.freeze({start:f,end:A}),...x?{target:x.word}:{}})),x)a.push(...x.issues),l.nested.push(...x.nested),c+=x.words,u||=x.limited;l.end=A,f=A;continue}if(d===","){l.start=l.start===-1?f:l.start,l.words.push(es({text:",",raw:",",span:{start:f,end:f+1},provenance:"literal",quoted:!1})),l.end=++f;continue}let y=cs(e,f,n,r,o);if(l.start=l.start===-1?f:l.start,l.end=y.next,l.words.push(y.word),a.push(...y.issues),l.nested.push(...y.nested),c+=1+y.words,u||=y.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:f,end:y.next}}),m(),{nodes:s,issues:a,next:y.next,closed:!1,words:c,limited:!0};f=y.next>f?y.next:f+1}return m(),{nodes:s,issues:a,next:f,closed:!i,words:c,limited:u}}function cs(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,f=(p)=>{let g=wh(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=us(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},d=t;while(d<n){let p=e[d];if(!p||/\s/.test(p)||fs(e,d)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[d+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:d,end:d+1}}),d++;break}i+=g,d+=2;continue}if(e.startsWith("$(",d)){d=f(d);continue}if(p==="'"){a=!0,d++;let g=!1;while(d<e.length){if(e[d]==="'"&&e[d+1]==="'"){i+="'",d+=2;continue}if(e[d]==="'"){g=!0,d++;break}i+=e[d]??"",d++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let g=d++,y=!1;while(d<n){let h=e[d];if(h==="`"&&e[d+1]){i+=e[d+1],d+=2;continue}if(h==='"'){y=!0,d++;break}if(e.startsWith("$(",d)){d=f(d);continue}if(h==="$")s=e[d+1]==="("?"command-substitution":"variable";i+=h??"",d++}if(!y)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:g,end:e.length}});continue}if(p==="$")s=e[d+1]==="("?"command-substitution":"variable";if(p==="@"&&d===t)s="variable";i+=p,d++}return{word:fn(e,t,d,i,s,a,s==="literal"?void 0:Ph(e,t,d)),next:d,issues:l,nested:c,words:u,limited:m}}function wh(e,t,n,r,o){let i=wc(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:ue({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Pc(t,r.maxDepth)],nodes:[]}),next:a};let l=ms(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:ue({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function wc(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function us(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=us(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=us(r)}}return t}function Ph(e,t,n){let r=Co(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=wc(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=s+1;if(e[l]==="{"){let c=e.indexOf("}",l+1);l=c===-1||c>=n?n:c+1}else while(l<n&&/[A-Za-z0-9_:?]/.test(e[l]??""))l++;r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Pc(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function _h(e){let t=[],n=[],r=0,o=0,i=!1,s=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let a=e[r];if(a==="\r"||a===`
-`){s(),r+=a==="\r"&&e[r+1]===`
-`?2:1;continue}if(/\s/.test(a??"")){r++;continue}let l=_c(e,r,Math.min(e.length,wo.maxInputLength),wo.maxDepth);if(l){i||=!!l.issue||l.limited,r=l.next;continue}let c=fs(e,r);if(c){s(),r+=c.length;continue}if(a==="{"||a==="}"){s(),r++;continue}let u=cs(e,r,Math.min(e.length,wo.maxInputLength),wo,0);if(u.word.text)n.push(u.word.text);for(let m of u.nested)t.push(...ds(m));o++,r=u.next>r?u.next:r+1}return s(),{commands:t,invalidComment:i}}function ds(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return ds(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(ds)]})}function fs(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function _c(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function Ah(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ls(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var Nt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function We(e,t="auto",n=Nt){if(t==="powershell"||t==="auto"&&xc(e.slice(0,n.maxInputLength)))return Ec(e,n);return mc(e,"posix",n)}function Kn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var kh=/^[A-Za-z_][A-Za-z0-9_]*=/;function Po(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function _o(e){let t=Po(e.words[0],"time")?1:0,n=t===1&&Po(e.words[t],"-p")?t+1:t,r=t===1&&Po(e.words[n],"--")?n+1:n,o=Po(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!kh.test(s.text));return i?.provenance==="literal"?i.text:void 0}function Yn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function gn(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Th(e))Yn(n,t);return t.inSingle||t.inDouble}function Th(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Yn(s,n)}return t}var Ih=new Set(["&&","||","|&","|","&",";"]),Oh=new Set(["<<","<<<",">|"]),Mh=/[*@#?$!_-]/,ps=Object.freeze([]),Dh=Object.freeze([]),Lh=256;function Oc(e,t){let n=t.status==="complete"?new Set(hs(t)):new Set,r=[...n].reduce((s,a)=>s.slice(0,a.start)+" ".repeat(a.end-a.start)+s.slice(a.end),e);if(gn(r))return Ao("unclosed-quote",r,ps);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Zn(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map});if(o.limited)return Ao("structural-limit",r,ps);if(o.invalid)return Ao("invalid",r,ps);return Ao("complete",r,i,o.assignmentFallbacks)}function Ao(e,t,n,r=Dh){return Object.freeze({status:e,source:t,entries:Object.freeze(n),assignmentFallbacks:Object.freeze(r)})}function Zn(e,t){return e.nodes.flatMap((n,r)=>Nh(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.entries])}function Nh(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,entries:[Fe($h(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,entries:[Fe(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,entries:[i?ko("{"):Fe("("),...Zn(e.body,a),...s?[i?ko("}"):Fe(")")]:[]]}]}let o=Uh(e,r.functions);if(o){if(r.depth>=Nt.maxDepth||++r.flags.expansions>Lh)return r.flags.limited=!0,[];return[{start:e.span.start,entries:[...Ac(e,r),ko(";"),...Zn(o,{...r,depth:r.depth+1}),ko(";")]},...kc(e,t,n,r)]}return[{start:e.span.start,entries:Ac(e,r)},...kc(e,t,n,r)]}function Ac(e,t){return[...e.words.map((n)=>({start:n.span.start,entries:Dc(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,entries:Wh(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.entries)}function Wh(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Dc(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ys(String(e.fd))],Object.freeze({kind:"redirection",operator:r,role:Bh(r),targetOrder:Oh.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s}}),...s===void 0?o:o.slice(1)]}function kc(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ys(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Fe(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,entries:a}];return[{start:s.bodySpan.start,entries:[...Mc(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Fh(t,n,r):[]]}function Fh(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,entries:Mc(n.source.slice(r.span.end,e.span.end),n)}]}function Mc(e,t){if(t.depth>=Nt.maxDepth)return t.flags.limited=!0,[];let n=We(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Zn(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Dc(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{if(a&&!r)o.push(Fe("glob"));else if(s!==""||e.quoted&&o.length===0)o.push(ys(s));s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let d of gs(c.raw,i,n.flags)){if(typeof d==="string"){l(),o.push(Fe(d));continue}s+=d.text,a||=d.glob}continue}if(i.double){let d=n.source.slice(c.span.start,c.span.end);s+=gs(d,{single:!1,double:!0},n.flags).map((p)=>typeof p==="string"?p:p.text).join("");continue}let u=t.nested.find((d)=>d.span.start>=c.span.start&&d.span.end<=c.span.end),m=u?Zn(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(...m);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Fe("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),...m,...c.raw.endsWith(")")?[Fe(")")]:[]);continue}let f=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:f},()=>Fe("(")),...m,...c.raw.endsWith(")".repeat(f))?Array.from({length:f},()=>Fe(")")):[])}return l(),o}function gs(e,t,n){let r=[],o="",i=!1,s=0;while(s<e.length){let a=e[s]??"";if(!t.single&&!t.double&&(a==="("||a===")")){r.push({text:o,glob:i},a),o="",i=!1,s++;continue}if(t.single){if(a==="'")t.single=!1;else o+=a;s++;continue}if(t.double){if(a==='"'){t.double=!1,s++;continue}if(a==="\\"){let l=e[s+1]??"";o+=['"',"\\","$"].includes(l)?l:`\\${l}`,s+=2;continue}if(a==="$"){let l=Tc(e,s,t,n);o+=l.text,s=l.next;continue}o+=a,s++;continue}if(a==="'"||a==='"'){t.single=a==="'",t.double=a==='"',s++;continue}if(a==="\\"){let l=e[s+1]??"";i||=l==="*"||l==="?",o+=l,s+=2;continue}if(a==="$"){let l=Tc(e,s,t,n);o+=l.text,s=l.next;continue}i||=a==="*"||a==="?",o+=a,s++}return[...r,{text:o,glob:i}]}function Tc(e,t,n,r){let o=e[t+1];if(o==="{"){let s=zh(e,t+2);if(s===-1)return r.invalid=!0,{text:"",next:e.length};let a=e.slice(t,s+1);return Gh(a,n,r),{text:a,next:s+1}}if(o!==void 0&&Mh.test(o))return{text:`\${${o}}`,next:t+2};let i=/^\w*/.exec(e.slice(t+1))?.[0]??"";return{text:`\${${i}}`,next:t+1+i.length}}function Gh(e,t,n){let r=e.slice(2,-1),o=/^[A-Za-z_][A-Za-z0-9_]*/.exec(r)?.[0];if(!o)return;let i=r.slice(o.length),s=[":=","="].find((l)=>i.startsWith(l));if(!s)return;let a=gs(i.slice(s.length),{...t},n);n.assignmentFallbacks.push(...a.flatMap((l)=>typeof l==="string"||!l.text?[]:[l.text]))}function zh(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;else if(e[r]==="}")n--;r++}return n===0?r-1:-1}function $h(e){return/^[\r\n]+$/.test(e)?";":e}function Fe(e){return Object.freeze({kind:"operator",operator:e,boundary:Ih.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ys(e){return Object.freeze({kind:"word",text:e})}function Bh(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function hs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return hs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((s)=>hs(s)),o=e.nodes[n+1];if(o?.kind==="connector"&&(o.operator==="|"||o.operator==="|&")||!jh(t))return r;return[...r,...t.redirections.flatMap((s)=>s.heredoc?.quotedDelimiter?[s.heredoc.bodySpan]:[])]})}function Uh(e,t){let n=_o(e);return n===void 0?void 0:t.get(n)}function vt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Hh(e){if(vt(e.words[0],"git"))return vt(e.words[1],"commit");if(!vt(e.words[0],"gh")||!vt(e.words[2],"create"))return!1;return vt(e.words[1],"pr")||vt(e.words[1],"issue")}function jh(e){return(vt(e.words[0],"cat")||vt(e.words[0],"tee")||Hh(e))&&!e.words.some(Ic)&&!e.redirections.some((n)=>Ic(n.target))}function Ic(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}import{types as Vh}from"node:util";var qh=new Set(["applypatch","patch"]),Kh=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Yh=new Set(["grep","grepsearch","rg"]),Zh=new Set(["find","findbyname","glob"]),Xh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Jh=new Set(["command","diff","input","patch","patchtext"]),Lc=new TextEncoder,Qh=new TextDecoder,ey=/\s/,ty=64;class Qn extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Xn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function zc(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Io(e){return Xh.has(zc(e))}function h_(e){let t=zc(e);if(qh.has(t))return"patch";if(Yh.has(t))return"grep";if(Zh.has(t))return"glob";if(Kh.has(t))return"path";return"unknown"}function Oo(e){if(!e||typeof e!=="object")return;qc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ze();return}if(t.get||t.set)Ze();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function $c(e,t){return Bc(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Bc(e,t,n,r){let o=Vc(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Bc(a,t,n,r+1);return typeof a==="string"&&t.has(Uc(s))?[a]:l});return n.ancestors.delete(o.object),i}function Uc(e){return e.replace(/-/g,"_").toLowerCase()}function Hc(e){return jc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(ry)}function jc(e,t,n,r){let o=Vc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>jc(a,o.array?t:Jh.has(Uc(s)),n,r+1));return n.ancestors.delete(o.object),i}function ny(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Xn.maxDepth||t.nodes>Xn.maxNodes)Ze();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Xn.maxStringBytes||t.stringBytes>Xn.maxAggregateStringBytes)Ze()}function Vc(e,t,n){if(ny(e,t,n),!e||typeof e!=="object")return null;let r=qc(e);if(t.ancestors.has(e))Ze();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Xn.maxKeys)Ze();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ze();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function qc(e){if(Vh.isProxy(e))Ze();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ze();return t}function Ze(){throw new Qn}function ry(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=oy(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Cs(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Cs(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ss(To(c.slice(4),!0),To(u.slice(4),!0))),l++;continue}if(!r)t.push(...Cs(c))}return t}function oy(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Cs(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Gc(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Gc(n[1]);if(e.startsWith("diff --git "))return iy(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Fc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Fc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return my(i[1]);return[]}function iy(e){let t=sy(e);if(t.length===2&&t[0]&&t[1])return Ss(t[0],t[1]);let n=ay(e);return n?Ss(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function sy(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Wt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Wt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Kc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Wt(e[n]))n++;return n===e.length?t:[]}function ay(e){let t=0;while(t<e.length&&Wt(e[t]))t++;let n=e.length;while(n>t&&Wt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Wt(e[o])){o++;continue}let i=o;while(o<n&&Wt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>ty)Ze();if(ly(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function ly(e,t,n,r,o){if(bs(e,t,n,r,o))return!0;let i=Nc(e,"/",t,n),s=Nc(e,"/",r,o);if(i<=t||s<=r)return!1;if(bs(e,t,i,r,s))return!1;return bs(e,i+1,n,s+1,o)}function bs(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Nc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Wt(e){return e!==void 0&&ey.test(e)}function Kc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=e[o]??"";if(i===n)return{value:Qh.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Lc.encode(i)),o++;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Lc.encode(cy(s[0]??""))),o+=2}return null}function cy(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function uy(e){return Jn(fy(e))}function Ss(e,t){if(e==="/dev/null")return Wc(t);if(t==="/dev/null")return Wc(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Jn);let n=dy(e,t)??(e===t?Yc(e):null);return[e,t,...n?[n]:[]].flatMap(Jn)}function Wc(e){let t=Yc(e);return[e,...t?[t]:[]].flatMap(Jn)}function Yc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function dy(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Fc(e){return uy(To(e,!0))}function my(e){return Jn(To(e,!1))}function To(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Kc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function fy(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Jn(e){return e===""||e==="/dev/null"?[]:[e]}function Gc(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var Zc=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Xc=new Set([...Zc,"glob"]),py=new Set([...Xc,"pattern"]),gy=[],Jc={parseCommand:We,projectShellSyntax:Oc};class Rt extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Mo(e,t={}){let n=hy({...Jc,...t}),r=Oo(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let l=s.findIndex((m)=>m.source===a.source);if(l!==-1){let m=s[l];if(!m)return s;return s[l]={...m,usages:[...m.usages,a.usage]},s}let c=e.route.kind==="command"?e.route.shell:"posix",u=n.getCommandProgram(a.source,c);return s.push({usages:[a.usage],source:a.source,program:u,shell:n.getShellSyntax(a.source,u)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:yy(e),store:n}}function Ce(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e){if(!e.includes("$"))return e;return Jr(e,at())}function hy(e={}){let t={...Jc,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,l)=>{let c=`${l}\x00${a}`,u=r.get(c);if(u)return u;let m=t.parseCommand(a,l);return r.set(c,m),m};return{getShellSyntax:(a,l)=>{if(l&&l.source!==a)throw TypeError("Shell syntax source does not match command program source.");let c=l??i(a,"posix");if(c.status==="limited"){let f=o.get(c);if(f)return f;let d={status:"structural-limit",source:a,entries:gy,assignmentFallbacks:[]};return o.set(c,d),d}let u=n.get(a);if(u)return u;let m=t.projectShellSyntax(a,c);return n.set(a,m),m},getCommandProgram:i}}function yy(e){let t=e.route.kind==="grep"?Xc:e.route.kind==="glob"?py:Zc;return[...$c(e.input,t),...e.route.kind==="patch"?Hc(e.input):[]]}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Cy=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),by=new Map([["zsh",new Set(["o"])]]),Sy=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function Qc(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=Sy.get(e);if(Ry(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=vy(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function vy(e,t){let n=Cy.get(e),r=by.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let l=t.slice(s+1);if(!o&&t[0]==="-"&&l==="c")continue;if(!o&&t[0]==="-"&&l[0]==="-"&&l.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function Ry(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}var Py=new Set(["-S","--suffix"]);function Do(e,t,n,r){if(e.status==="structural-limit")throw new Rt;if(e.status!=="complete")return r.findMalformedTarget(e.source);let o={cwd:t,variables:new Map},i=[];for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;let a=r.findSegmentTarget(i,o);if(a)return a;o=_y(i,o,n,r.normalizeCwd),i=[];continue}if(s.kind==="redirection"){if(s.role==="file-write"&&s.target&&r.isRedirectionTarget(be(s.target,o.variables),o))return s.target;continue}i.push(s.text)}return r.findSegmentTarget(i,o)}function be(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:be(i,t);return a?be(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function er(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function tu(e,t,n){let r=n.environment.home,o=Jr(e.trim(),n.environment).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?eu(r,o.slice(2)):o;return wy(Ey(i)?i:eu(t,i))}function le(e,t,n){let r=tu(e,t,n);if(!r)return"";return U(r,n.environment.paths,n).replace(/\\/g,"/")}function nu(e,t,n,r){let o=tu(e,t,n);if(!o)return null;if(r(xy(o)))return U(o,n.environment.paths,n).replace(/\\/g,"/");let i=Fl(o,n.environment.paths,n);return i===null?null:i.replace(/\\/g,"/")}function Lo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Py.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}function _y(e,t,n,r){let o=er(e)?new Map([...t.variables,...Ay(e,t.variables)]):t.variables,i=mn([...e],n.environment),s=D(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;return{cwd:!s||s==="-"?t.cwd:r(be(s,o),t.cwd,n),variables:o}}function Ay(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],be(o,t)]]:[]})}var _e="Git metadata and hooks are protected. Ask the user before modifying them.";function su(e,t=Rs([e.invocation.context.executionCwd,e.invocation.context.configCwd])){let n=Ot(at()),r=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Io(e.invocation.toolName))return null;let s=e.paths.find((a)=>Ly(a,r,t,n));return s?{target:s}:null}if(e.invocation.route.kind!=="command")return null;let o=Ce(e,"input-candidate");if(!o)return null;let i=Do(o.shell,r,n,{findSegmentTarget:(s,a)=>Wy(s,a,t,n),isRedirectionTarget:(s,a)=>Ny(s,a.cwd,t,n),findMalformedTarget:()=>null,normalizeCwd:le});return i?{target:i}:null}function Rs(e,t=Ot(at())){let n=[...new Map(e.filter((r)=>typeof r==="string"&&r!=="").flatMap((r)=>{let o=Gn(le(r,r,t));return o?[[Ge(o),{dotGitPath:o,cwd:r}]]:[]})).values()].flatMap((r)=>Iy(r.dotGitPath,r.cwd,t));if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.map((r)=>r.entry))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFile?[r.markerFile]:[]))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Iy(e,t,n){try{let r=le(e,t,n),o=ky(e),i=o.isFile()?r:null,s=o.isFile()?Bi(e):null,a=(o.isDirectory()?[r]:[s?.gitDir,s?.commonDir]).flatMap((c)=>c?[Ge(le(c,t,n))]:[]),l=[...new Set(o.isDirectory()?[Ge(e.replace(/\\/g,"/")),...a]:a)];return[{entry:Ge(r),markerFile:i?Ge(i):null,directories:l,hooksDirectories:[...new Set(l.flatMap((c)=>{let u=Ge(Ty(c,"hooks"));return[u,Ge(le(u,t,n))]}))]}]}catch{return[]}}function Ft(e,t,n,r,o,i=!1){if(!n)return!1;let s=Ge(le(e,t,o)),a=s.replace(/(\/\.?\*+)+$/,"");if(a!==s&&a!==""){if(vs(a,n))return!0;let l=i||s.slice(a.length).includes("/."),c=(u)=>l?No(u,a):Oy(u,a);if(n.markerFiles.some(c))return!0;return r&&ru(n).some(c)}if(vs(s,n))return!0;return r&&ru(n).some((l)=>No(l,s))}function Oy(e,t){let n=iu(t,e);if(n===""||n.startsWith("..")||ou(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function My(e,t,n,r){return Ft(e,t,n,!0,r)}function Dy(e,t,n,r){if(!n)return!1;return vs(Ge(le(e,t,r)),n)}function Ly(e,t,n,r){if(!n)return!1;return au(e,t,n,r,n.entries)}function Ny(e,t,n,r){if(!n)return!1;return au(e,t,n,r,n.markerFiles)}function au(e,t,n,r,o){let i=Ge(le(e,t,r));return o.includes(i)||cu(i,n)}function lu(e,t,n,r){if(!n)return!1;return n.hooksDirectories.some((o)=>e.some((i)=>No(o,Ge(le(i,t,r)))))}function vs(e,t){return t.entries.includes(e)||t.directories.includes(e)||cu(e,t)}function cu(e,t){return t.hooksDirectories.some((n)=>No(e,n))}function ru(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=iu(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!ou(n)}function Ge(e){return process.platform==="win32"?e.toLowerCase():e}function Wy(e,t,n,r){if(er(e))return null;let o=St([...e],r.environment);if(D(o[0]??"").toLowerCase()!=="mv")return null;let i=Lo(o.slice(1)),s=i.sources.find((a)=>My(be(a,t.variables),t.cwd,n,r));if(s)return s;return i.destination&&Dy(be(i.destination,t.variables),t.cwd,n,r)?i.destination:null}import{isAbsolute as xs,join as Fy,normalize as Gy,sep as Wo}from"node:path";var uu=process.platform==="win32",zy=/[*?]/;function tr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Go(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=tr(e.trim(),t);if(!xs(n))return"must be an absolute path or start with ~/";return nr(n,t)}function zo(e,t){let n=du(e,t);if(n===null)return"must be a non-empty path string";if(!xs(n))return null;if(nr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var $y="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",By="cannot cover the guard's own configuration";function du(e,t){if(typeof e!=="string"||e.trim()==="")return null;return tr(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function $o(e,t){let n=du(e,t);if(n===null)return"must be a non-empty path string";if(zy.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!xs(n))return null;if(nr(n,t)!==null)return $y;return Uy(n,t)?By:null}function Uy(e,t){let n=Fo(e),r=Fo(Fy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Wo}`)}function nr(e,t){let n=Fo(e),r=Fo(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Wo)?n:`${n}${Wo}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Fo(e){let t=Gy(e);if(uu)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(uu?3:1)&&t.endsWith(Wo))t=t.slice(0,-1);return t}var Vy=process.platform==="win32",mu=64,qy=16384;function rr(e){let t=yc(e,mu,mu,qy);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:Ky(e)}}function Ky(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Yy(e.raw,n.span.start-e.span.start))}function Yy(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=Ot(e.environment);return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:eC(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,pathCanonicalizationContext:r}}function ze(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&nC(e))return{kind:"outside_anchored_cwd"};let o=!r&&hu(e,t.posixShell);if(kt(e))return{kind:"outside_anchored_cwd"};if(_s(e,r))return{kind:"root_or_home_target"};if(Zy(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Ft(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.pathCanonicalizationContext,!t.posixShell))return{kind:"git_metadata_target"};if(Xy(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(tC(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&sC(i,t.environment.home,t.environment.paths,t.pathCanonicalizationContext))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&aC(e,t.resolvedCwd??i,t.environment.paths,t.pathCanonicalizationContext))return{kind:"cwd_self_target"};if(lC(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.pathCanonicalizationContext))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function pu(e,t,n={}){let{containmentTarget:r,...o}=n;if(ze(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(Qy(i))return!1;if(Jl(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>cC(r??i,s,t.environment.paths,t.pathCanonicalizationContext))}function _s(e,t=!1){let n=e.trim(),r=fu.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Zy(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Ps(o)?o:t.resolvedCwd?hn(t.resolvedCwd,o):null;if(!i)return!1;let s=me(U(i,t.environment.paths,t.pathCanonicalizationContext));if(s===jy(s).root)return!0;return s===me(U(t.environment.home,t.environment.paths,t.pathCanonicalizationContext))}catch{return!1}}function me(e){let t=Hy(e);if(Vy){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function Xy(e,t,n,r,o,i,s,a){let l=e.trim();if(gu(l))return!1;if(!r&&Qi(l,a))return!0;return(t||i&&s)&&n&&!o&&Jy(l,n)}function Jy(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!hu(e.slice(n.length+1),t)})}function Qy(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return fu.normalize(`/${t[1]??""}`)==="/"}function gu(e){return e.split(/[\\/]+/).includes("..")}function eC(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=tr(o.trim(),t);if(!Ps(i))return[];try{let s=U(i,n,r);if(nr(s,U(t,n,r)))return[];return[me(s)]}catch{return[]}})}function tC(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(gu(r))return!1;let o=n?r:tr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Ps(o)?o:i?hn(i,o):null;if(!s)return!1;try{let a=me(U(s,t.environment.paths,t.pathCanonicalizationContext));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(ws)?l:`${l}${ws}`))}catch{return!1}}function nC(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function hu(e,t=!1){return e.includes("$")||e.includes("`")||rC(e)||t&&oC(e)}function rC(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function oC(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&iC(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function iC(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function sC(e,t,n,r){try{return me(U(e,n,r))===me(U(t,n,r))}catch{try{return me(e)===me(t)}catch{return!1}}}function aC(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return me(U(hn(t,e),n,r))===me(U(t,n,r))}catch{try{return me(hn(t,e))===me(t)}catch{return!1}}}function lC(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Es(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Es(hn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Es(hn(a,e),t,i,s)}catch{return!1}}function Es(e,t,n,r){try{return yu(U(e,n,r),U(t,n,r))}catch{return!1}}function cC(e,t,n,r){if(!t)return!1;try{return yu(U(t,n,r),U(e,n,r))}catch{return!0}}function yu(e,t){let n=me(e),r=me(t);return n.startsWith(`${r}${ws}`)||n===r}var uC=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Cu="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",dC="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",bu="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Su="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",mC="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",fC="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function vu(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return pC(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function pC(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=hC(o),s=o[i];if(!s||!uC.has(wC(s.text)))return null;let a=gC(o.slice(i+1));if(a.whatIfProtected)return null;if(Q(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",fC);for(let l of a.targets)if(!kt(l.text)&&_s(ks(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Su);for(let l of a.targets)if(n.resolvedCwd&&Ft(ks(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.pathCanonicalizationContext,!0))return b("powershell.remove-item-git-metadata",_e);if(!a.recursive||!a.force)return null;if(Q(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",bu);for(let l of a.targets){let c=PC(ze(ks(l.text),n),n,r);if(c)return c}return null}function gC(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(yC(l))continue;if(s){t.push(As(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=bC(l.text);if(!c){t.push(As(l)),i=i||l.dynamic;continue}if(SC(c.name)){let u=c.value?CC(c.value,l):e[++a];if(u?.kind==="word")t.push(As(u)),i=i||u.dynamic;else i=!0;continue}if(vC(c.name)){n=!0;continue}if(RC(c.name)){r=!0;continue}if(xC(c.name))o=EC(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function hC(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function As(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function yC(e){return e.kind==="word"&&e.text===","}function ks(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function CC(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function bC(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function SC(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function vC(e){return"recurse".startsWith(e)}function RC(e){return e.length>=2&&"force".startsWith(e)}function xC(e){return e==="wi"||"whatif".startsWith(e)}function EC(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function wC(e){return e.toLowerCase()}function PC(e,t,n){switch(e.kind){case"root_or_home_target":return b("powershell.remove-item-recursive-force-root-or-home",Su);case"git_metadata_target":return b("powershell.remove-item-git-metadata",_e);case"temp_target":return null;case"dynamic_target":if(!Q(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return b("powershell.remove-item-recursive-force-dynamic-target",bu);case"home_cwd_target":return b("powershell.remove-item-recursive-force-home-cwd",mC);case"cwd_self_target":return b("powershell.remove-item-recursive-force-cwd-self",Cu);case"within_anchored_cwd":if(!Q(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return b("powershell.remove-item-recursive-force-paranoid",dC);case"outside_anchored_cwd":return b("powershell.remove-item-recursive-force-outside-cwd",Cu)}}import{normalize as ri}from"node:path";var Se=new Set(["awk","gawk","nawk","mawk"]),_C=new Set(["-e","--source"]),AC=new Set(["-F","-v","--assign","--field-separator"]),Ru=new Set(["-f","--file"]),kC=new Set(["print","printf","return"]),xu=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],TC="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ho(e,t,n){let r=!1;for(let o of IC(e)){let i=OC(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",TC):null}function Is(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&_C.has(a)){n=!0;let l=e[s+1];if(l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});else i=!1;s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(AC.has(a)||Ru.has(a))){if(Ru.has(a)){r=!0;let l=e[s+1];if(l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l});else i=!1}else if(e[s+1]===void 0)i=!1;s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ir(e){return Is(e).sources}function IC(e){return ir(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function OC(e,t){pe(t,e);let n=e.includes("system")?Os(e,t):null,r=MC(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Os(e,t){pe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Eu(e,i+1);continue}if(s==="/"&&wu(e,i)){i=Pu(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,or(e[a-1])||or(e[i]))continue;let l=Bo(e,i);if(e[l]!=="(")continue;l=Bo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Uo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Bo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function MC(e,t){pe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let d=Uo(e,i,u);if(d&&c===s)l={...d,startIndex:i};c=d?.endIndex??i+1,i=d?.endIndex??i+1;continue}if(u==="#"){i=Eu(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&wu(e,i)){let d=Pu(e,i+1);c=d??i+1,i=d??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Ts(e,i,"print")||Ts(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,f=Bo(e,m);if(Ts(e,f,"getline")){o=!0;let d=NC(s,l,c);if(d===null)r=!0;else n.push(d);c=m,i=m;continue}if(FC(s,a)){o=!0;let d=LC(e,f);if(!d){r=!0,c=m,i=m;continue}if(!DC(e,d.endIndex)){r=!0,c=d.endIndex,i=d.endIndex;continue}n.push(d.value),c=d.endIndex,i=d.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function or(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Bo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function DC(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=WC(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function LC(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function NC(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function WC(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Ts(e,t,n){return e.startsWith(n,t)&&!or(e[t-1])&&!or(e[t+n.length])}function FC(e,t){return t!==null&&t>=e}function Eu(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function wu(e,t){let n=GC(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(or(e[r-1]))r--;return kC.has(e.slice(r,n+1))}function GC(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Pu(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var _u=new Set(["rm","find","xargs","parallel"]),zC=new Set(["sudo","env","command","builtin"]),$C=new Set(["git","busybox",..._u,...ee,...Bl,...Se]);function jo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(D(n)))return null;let r=D(n),o=e[1]==="--"?2:1,i=BC(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function BC(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;if(D(a)!==n&&UC(a,r))i.push(s);else if(eo.has(z(a)))break;if(o)break}return i}function UC(e,t){let n=D(e),r=z(e);return r==="git"||n==="busybox"||zt(e)||_u.has(n)||t.transparentWrappers.includes(n)||ee.has(r)||e==="$SHELL"||he(r)||Se.has(r)||t.rules.some((o)=>o.command===n)}function zt(e){return zC.has(e.toLowerCase())}function Au(e){let t=z(e);return $C.has(t)||he(t)}function $e(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Vo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Vo(e,t,n,r,o,i,s,a,l){let c=fo(e,t,n,i);for(let[d,p]of c.envAssignments)i.set(d,p),o.set(d,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let d=mo(c.envSplitValues,u);if(!d)throw new ge;Ms(a),yield*Vo(d,t,m,r,o,i,s,a,l);return}if(zt(u[0]??""))throw new ge;let f=jo(u,s);if(f){for(let d of[f.childIndex,...f.alternativeChildIndices])Ms(a),yield*Vo(d===f.childIndex?f.tokens:[...u.slice(d)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(jC(u)){Ms(a),yield*Vo([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield HC(u,m,r,o,i,l)}function HC(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:D(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ms(e){if(e.iterations>=an)throw new ge;e.iterations++}function jC(e){return D(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Ds(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Ls(r,"recursive"))t=!0;else if(r==="-f"||Ls(r,"force"))n=!0;else if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function ku(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Ls(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Ls(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var VC="find -delete permanently removes files. Use -print first to preview.",qC="find -exec rm -rf is dangerous. Use explicit file list instead.",KC=new Set(["-exec","-execdir","-ok","-okdir"]),YC=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function qo(e,t){let n=e.map(I),r=ZC(e,n,t);if(r)return r;if(Yo(n,1)&&!JC(e,n,t)){let s=k(b("find.delete",VC),t.policy);if(s)return s}let o=t.derivedCommandWorkBudget??Yr(),i=0;while(i<n.length){let s=n[i],a=xt(s??"");if(a>0){i+=a+1;continue}if(!mt(s)){i++;continue}De(o,n.length-i-1);let l=sr(n,i);i=l.nextIndex;let c=eb(l.tokens,t.environment);if(c){let d=k(c,t.policy);if(d)return d}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,f=m?.id.startsWith("custom.")?m:k(m,t.policy);if(f)return f}return null}function ZC(e,t,n){if(!Yo(t,1)&&!Ns(t,n.environment))return null;let o=Ko(e)??G(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=rr(s);for(let l of a.expandedTargets??[I(s)]){let c=ze(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",_e)}}if(XC(t)&&i.resolvedCwd&&lu(o.map(I),i.resolvedCwd,i.protectedGitMetadata,i.pathCanonicalizationContext))return b("find.delete-git-metadata",_e);return null}function Ns(e,t){let n=0;while(n<e.length){if(!mt(e[n])){n++;continue}let r=sr(e,n),o=St([...r.tokens],t),i=D(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function XC(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function JC(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Ko(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ji(o,n.environment),s=n.trustedTmpdirValue??dt(o,n.environment),a=n.allowTmpdirVar??!Hn(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Ye(o,n.environment),trustedTmpdirValue:s});return r.every((c)=>{let u=rr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[I(c)]).every((m)=>pu(m,l,{containmentTarget:QC(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function QC(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Ko(e){let t=(o)=>{let i=e[o];return i?I(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function eb(e,t){let n=mn([...e],t);if(n.length===0)return null;let r=D(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=D(n[0]??"");if(r==="rm"&&Be(n))return b("find.exec-rm-recursive-force",qC);return null}function sr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Yo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(mt(r)){n=sr(e,n).nextIndex;continue}let o=xt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function xt(e){return YC.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function mt(e){return e!==void 0&&KC.has(e)}function*Ws(e){for(let t of e.nodes)yield*nb(t)}function tb(e){return Object.freeze([...Ws(e)])}function DA(e){return Object.freeze(tb(e).map((t)=>Object.freeze(t.words.map((n)=>n.text))))}function ar(e){let t=We(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}function*nb(e){if(e.kind==="command"){yield e;for(let t of e.nested)yield*Ws(t);return}if(e.kind==="group")yield*Ws(e.body)}var rb=5,Fs="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Iu(e,t,n){let r=Mu(e,t,n),o=ob(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<rb;a++){let{subcommand:l,rest:c}=Ue(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),f=cb(m);if(f===null||f.length===0)return{blockedReason:Fs,expanded:!0,tokens:i};i=["git",...f,...c],s=!0}return{blockedReason:Fs,expanded:!0,tokens:i}}function Ou(e,t,n){return Mu(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ue(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?D(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(o.startsWith("-"))if(Ke.has(o))r+=2;else if(o.startsWith("-c")&&o.length>2)r++;else if(o.startsWith("-C")&&o.length>2)r++;else r++;else return{subcommand:o,rest:e.slice(r+1)}}return{subcommand:null,rest:[]}}function ob(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Mu(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?D(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=sb(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...ib(e,t,n)]}}function ib(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Gs(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Gs(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Tu(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Tu(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ke.has(i)){o+=2;continue}o++}return r}function sb(e,t){let n=ab(e,t),r=lb(e,t);return{blockedReason:n===null||r===null?Fs:null,entries:[...n??[],...r??[]]}}function ab(e,t){let n=Ee("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ar(n);if(!o)return null;for(let i of o){let s=Gs(i);if(!s)return null;r.push(s)}return r}function lb(e,t){let n=Gr(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ee(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ee(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Gs(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Tu(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ee(e.slice(r+1),t,n)}}function cb(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ar(t)}var ub="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",db="git checkout --force discards uncommitted changes. Use 'git stash' first.",mb="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",fb="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",pb="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",gb="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",hb="git switch --force discards uncommitted changes. Use 'git stash' first.",yb="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Cb="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",bb="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Sb="git reset --merge can lose uncommitted changes. Use 'git stash' first.",vb="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Rb="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",xb="git push --force destroys remote history. Use --force-with-lease for safer force push.",Eb="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",wb="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Pb="git branch -D force-deletes without merge check. Use -d for safe delete.",_b="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Ab="git merge --abort discards merge conflict resolutions. Use 'git status' first.",kb="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Tb="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Ib="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Ob="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Mb="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Du=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Lu=new Set(["--recurse-submodules","--track","-t"]),zs=new Set(["-b","-B","-U"]),$s=new Set(["-c","-C"]),Db=new Set(["--source","--conflict","--unified","--inter-hunk-context"]),Lb=new Set(["-q","--quiet","--no-quiet","-f","--force","--no-force","-d","--detach","--no-detach","-m","--merge","--no-merge","-p","--patch","--no-patch","--guess","--no-guess","--overlay","--no-overlay","--ours","--theirs","--ignore-skip-worktree-bits","--no-ignore-skip-worktree-bits","--no-track","--overwrite-ignore","--no-overwrite-ignore","--ignore-other-worktrees","--no-ignore-other-worktrees","--progress","--no-progress","--pathspec-file-nul","--no-pathspec-file-nul","--no-recurse-submodules"]);function W(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var yn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Wu(e){let{subcommand:t,rest:n}=Ue(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return Et(Nb(n));case"switch":return Et(Wb(n));case"restore":return Et(Gb(n));case"reset":return $b(n);case"clean":return Et(Ub(n));case"rm":return Et(Hb(n));case"push":return $t(jb(n));case"branch":return $t(Kb(n));case"stash":return $t(Qb(n));case"worktree":return $t(eS(n));case"rebase":return Et(Yb(n));case"merge":return Et(Zb(n));case"tag":return $t(Xb(n));case"reflog":return $t(Jb(n));default:return null}}function Et(e){return e?{...e,localDiscard:!0}:null}function $t(e){return e?{...e,localDiscard:!1}:null}function Nb(e){let{index:t,before:n}=ce(e),r=de(n,{shortOptsWithValue:zs});if(n.some((i)=>W(i,"--force"))||r.has("-f"))return b("git.checkout-force",db);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(W(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",fb)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",mb);return b("git.checkout-double-dash",ub)}if(Fb(e).length>=2)return b("git.checkout-ambiguous",pb);return null}function Wb(e){let{before:t}=ce(e);if(t.some((r)=>W(r,"--discard-changes")))return b("git.switch-discard-changes",gb);let n=de(t,{shortOptsWithValue:$s});if(t.some((r)=>W(r,"--force"))||n.has("-f"))return b("git.switch-force",hb);return null}function Fb(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(r.startsWith("-"))if(Du.has(r))n+=2;else if(r.startsWith("--")&&r.includes("="))n++;else if(Lu.has(r)){let o=e[n+1];if(o&&!o.startsWith("-")&&(r==="--recurse-submodules"||r==="--track"||r==="-t"))if((r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"]).includes(o))n+=2;else n++;else n++}else if(r.startsWith("--")&&!Lb.has(r)&&!Du.has(r)&&!Lu.has(r))n++;else n++;else t.push(r),n++}return t}function Gb(e){let t=zb(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Cb):b("git.restore-unstaged",yb)}function zb(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Db.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function $b(e){let t=null;for(let n of e){if(W(n,"--hard")){t=b("git.reset-hard",bb);break}if(W(n,"--merge")){t=b("git.reset-merge",Sb);break}}if(!t)return null;return Bb(e)?$t(t):Et(t)}function Bb(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function Ub(e){for(let n of e)if(n==="-n"||W(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>W(n,"--force"))||t.has("-f"))return b("git.clean-force",vb);return null}function Hb(e){let t=!1,n=!1,r=!1;for(let o of ce(e).before){if(W(o,"--no-force")){t=!1;continue}if(W(o,"--force")){t=!0;continue}if(W(o,"--no-cached")){n=!1;continue}if(W(o,"--cached")){n=!0;continue}if(W(o,"--no-dry-run")){r=!1;continue}if(W(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Rb):null}function jb(e){let{before:t,after:n}=ce(e),r=de(t);if(t.some((s)=>W(s,"--mirror")))return b("git.push-mirror",wb);if(t.some((s)=>W(s,"--force"))||r.has("-f")||Nu(t,n).some(Vb))return b("git.push-force",xb);if(t.some((s)=>W(s,"--delete"))||r.has("-d")||Nu(t,n).some(qb))return b("git.push-delete",Eb);return null}function Nu(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Vb(e){return e.startsWith("+")||e.includes(":+")}function qb(e){return e.length>1&&e.startsWith(":")}function Kb(e){let{before:t}=ce(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>W(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>W(i,"--force"));if(r&&o)return b("git.branch-force-delete",Pb);return null}function Yb(e){let{before:t}=ce(e);return t.some((n)=>W(n,"--abort"))?b("git.rebase-abort",_b):null}function Zb(e){let{before:t}=ce(e);return t.some((n)=>W(n,"--abort"))?b("git.merge-abort",Ab):null}function Xb(e){let{before:t}=ce(e);return de(t).has("-d")||t.some((r)=>W(r,"--delete"))?b("git.tag-delete",kb):null}function Jb(e){return e[0]==="delete"?b("git.reflog-delete",Tb):null}function Qb(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Ib);if(t==="clear")return b("git.stash-clear",Ob)}return null}function eS(e){let{before:t}=ce(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>W(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Mb);return null}import{execFileSync as tS}from"node:child_process";import{existsSync as Us,readFileSync as Hs}from"node:fs";import{dirname as nS,isAbsolute as zu,join as Bs,resolve as $u}from"node:path";var rS=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"];function Bu(e,t,n,r){let o=oS(e,t,n);if(o!==null)return o;let i=iS(t,n);if(i!==null)return i;if(gl(n))return!0;return sS(r)}function oS(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=Fu(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Fu(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=Gu(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=Gu(i.slice(13),t,n);if(s!==null)r=s;o++;continue}if(Ke.has(i))o+=2;else o++}return r}function iS(e,t){if(Ee("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=Gr(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=Ee(`GIT_CONFIG_KEY_${o}`,e,t),s=Ee(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(js(a))return!0;if(a!=="submodule.recurse")continue;r=lr(s)}return r}function sS(e,t=lS()){let n=aS(e);if(n===null||n)return!0;if(t===null)return!0;try{let r=tS(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:cS(process.env),stdio:["ignore","pipe","ignore"]}).trim();return lr(r)}catch(r){return!uS(r)}}function aS(e){let t=dS(e);if(t===null)return null;for(let n of t){if(!Us(n))continue;if(pS(n))return!0}return!1}function lS(){for(let e of rS)if(Us(e))return e;return null}function cS(e){let t={...e};for(let n of Object.keys(t))if(Nn(n))delete t[n];return t}function uS(e){return typeof e==="object"&&e!==null&&"status"in e&&e.status===1}function dS(e){let t=Gn(e);if(t===null)return null;let n=mS(t);if(n===null)return null;let r=fS(n);if(r===null)return null;return[Bs(r,"config"),Bs(n,"config.worktree")]}function mS(e){try{let n=Hs(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return zu(r)?r:$u(nS(e),r)}catch{return null}}function fS(e){let t=Bs(e,"commondir");if(!Us(t))return e;try{let n=Hs(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return zu(n)?n:$u(e,n)}catch{return null}}function pS(e){let t;try{t=Hs(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(gS(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=lr(c)}return r}function gS(e){return e==="include"||e.startsWith("includeif ")}function Fu(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(js(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return lr(r)}function lr(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Gu(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(js(o))return!0;if(o!=="submodule.recurse")return null;let i=Ee(e.slice(r+1),t,n);return i===void 0||lr(i)}function js(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Uu(e,t,n){if(!t.localDiscard||!n.worktreeMode||bl(n.env,n.envAssignments))return null;let r=Sl(e,n.cwd);if(!r.gitCwd||r.hasExplicitGitContext)return null;if(!vl(r.gitCwd))return null;if(hS(e,n,r.gitCwd))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function hS(e,t,n){let{subcommand:r,rest:o}=Ue(e),i=r?.toLowerCase();if(t.dynamicArguments||yS(o)||Bu(e,t.env,t.envAssignments,n)||SS(o)||CS(i,o))return!0;return i==="clean"&&vS(o)>1}function yS(e){return e.some((t)=>/[$*?[]/.test(t))}function CS(e,t){if(e==="checkout"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:zs}),o=n.some((s)=>W(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:$s}),o=n.some((s)=>W(s,"--force"))||n.some((s)=>W(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||bS(s))||r.has("-C");return o&&i}return!1}function bS(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function SS(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function vS(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}var RS="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",xS=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Cn(e,t){return Hu(e.map(I),t)}function Hu(e,t,n){let r=Iu(e,t.env,t.envAssignments),o=r.blockedReason?k(b("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((pl(t.envAssignments)||Ou(e,t.env,t.envAssignments))&&ES(i))return b("git.ssh-env",RS);let s=Wu(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=Uu(e,s,t);if(!a)return s;return n?.(a),null}function ju(e,t){let n=null;return{match:Hu(e.map(I),t,(o)=>{n=o}),relaxation:n}}function ES(e){let{subcommand:t,rest:n}=Ue(e),r=t?.toLowerCase();if(!r)return!1;if(xS.has(r))return!0;if(r==="archive")return ce(n).before.some((o)=>W(o,"--remote"));return r==="remote"&&wS(n)}function wS(e){return e.find((t)=>!PS(t))?.toLowerCase()==="update"}function PS(e){return e==="-v"||W(e,"--verbose")||W(e,"--no-verbose")}import{isAbsolute as hv}from"node:path";var Vu="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",_S="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",AS="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Ku="rm -rf targeting root or home directory is extremely dangerous and always blocked.",kS="rm -rf in home directory is dangerous. Change to a project directory first.";function bn(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(I),o=Be(r),i=ku(r),s=IS(e);for(let a of s){let l=rr(a.word);if(o&&l.unsafeBraceExpansion){let c=k(qu({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Ft(c,n.resolvedCwd,n.protectedGitMetadata,i,n.pathCanonicalizationContext))return b("rm.git-metadata",_e);if(i&&!o){let m=ze(c,n,u);if(m.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",Ku);if(m.kind==="git_metadata_target")return b("rm.git-metadata",_e);continue}if(!o)continue;for(let m of TS(c,n,u)){let f=qu(m,n,t.policy),d=k(f,t.policy);if(d)return d}}}return null}function TS(e,t,n){let r=ze(e,t,n);if(r.kind==="cwd_self_target")return[r,ze(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=ze(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,ze(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function IS(e){let t=[],n=!1;for(let r of e.slice(1)){let o=I(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function qu(e,t,n){switch(e.kind){case"root_or_home_target":return b("rm.recursive-force-root-or-home",Ku);case"git_metadata_target":return b("rm.git-metadata",_e);case"temp_target":return null;case"dynamic_target":if(!Q(n,"rm.recursive-force-dynamic-target",t.strict))return null;return b("rm.recursive-force-dynamic-target",AS);case"home_cwd_target":return b("rm.recursive-force-home-cwd",kS);case"cwd_self_target":return b("rm.recursive-force-cwd-self",Vu);case"within_anchored_cwd":if(Q(n,"rm.recursive-force-paranoid",t.paranoid))return b("rm.recursive-force-paranoid",_S);return null;case"outside_anchored_cwd":return b("rm.recursive-force-outside-cwd",Vu)}}var OS={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Zu=new Set(["--init-file","--rcfile"]),MS=["--init-file","--rcfile"],DS=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Je(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Yu(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Yu(e,t,!1);if(r!==null)return r}}return null}function Ae(e){let t=D(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Qe(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Yu(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Xu(e){let t=D(e[0]??"").toLowerCase(),n=LS(e,t),r=DS.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function LS(e,t){let n=Qe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?MS.find((f)=>l===f):void 0){let f=e[a+1];o.push(f===void 0?{kind:"absent"}:{kind:"literal",value:f}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Zu.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Ju(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function Ju(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!OS[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Qe(e){let t=D(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Zu.has(l)&&!s.includes("="))i++;continue}let a=Ju(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var wt={kind:"none"},Bt={kind:"dynamic"},NS=new Set(["<","<<","<<-","<<<","<&","<>"]),ed=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,WS=/^(?:[0-9]+|[@*])$/,FS=Nt.maxWords,GS=Nt.maxInputLength;function td(e){if(!e||D(z(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
-`)return`${r.join(`
-`)}
-`;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Sn(e){let t=cr(e[1])==="--"?2:1;if(e.length<=t)return wt;let n=e.slice(t);if(!n.every(Xo))return Bt;return{kind:"literal",source:n.map(I).join(" ")}}function nd(e){let t=cr(e[1])==="--"?2:1,n=e[t],r=cr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return wt;if(!Xo(n))return Bt;return{kind:"literal",source:r}}function Zo(e,t){let n=$S(e);if(n===-1)return wt;let r=BS(t);if(!r)return wt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=HS(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>FS||i>GS)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(VS)].filter((s)=>s!==null).join(" ")}}function rd(e,t,n,r){if(!Qe(e.map(I)).readsStdinAsCommands)return wt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&NS.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return wt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return wt;return r===void 0?Bt:{kind:"literal",source:r}}function et(e){let t=Qe(e.map(I)).scriptIndex;if(t===null)return wt;let n=e[t],r=cr(n);return Wr(n,r)?{kind:"literal",source:r}:Bt}var zS=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ys(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=D(z(s));return!zS.has(a)&&!ee.has(a)&&!zt(a)}function $S(e){return Qe(e.map(I)).commandIndex??-1}function BS(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(US);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function US(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function HS(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Vs(o):jS(o,r);if(e.parameter==="*"){let a=Vs(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:qs(l,r)}let i=t[n+1+e.parameter];if(i&&!Xo(i))return;let s=cr(i);return e.quoted?[s]:qs(s,r)}function Vs(e){return e.every(Xo)?e.map(I):void 0}function jS(e,t){let n=Vs(e);if(!n)return;let r=n.map((o)=>qs(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function qs(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
-`)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Xo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(I(e)):e.provenance==="literal"}function cr(e){return e?I(e):""}function VS(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Zs(e,t){return Ks(We(e,"posix"),t)}function vn(e){return Zs(e,new Set(Array.from(e.matchAll(ed)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ks(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ks(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ks(o,n))||od(r.words,n))return!0;XS(r,n)}return!1}function od(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(ur(r,t))return!0;let o=z(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Qu(e[s],t)}if(ee.has(o)){let s=e.slice(n),a=Qe(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Qu(s[l],t)}let i=qS(e,n,t);if(i===null)return!1;if(i===-1)return!0;return od(e.slice(i),t)}function qS(e,t,n){let r=z(e[t]?.text??"");if(r==="command")return KS(e,t+1);if(r==="exec")return YS(e,t+1);if(r==="env")return ZS(e,t+1,n);return null}function KS(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function YS(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function ZS(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return ur(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return ur(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function XS(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(ur(n,t))t.add(r.name)}}function ur(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(ed)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(WS.test(o)||t.has(o))}))}function Qu(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||ur(e,t))}var JS=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--config-env"]),QS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),ev=new Set;function id(e){if(e==="git")return JS;if(e==="docker")return QS;return ev}function ne(e,t){if(e.length===0||t.length===0)return null;let n=z(e[0]??""),r=de(e);for(let o of t){if(!tv(n,o.command))continue;if(!nv(n,e,o.subcommand))continue;if(ov(e,new Set(o.block_args),r))return{id:`custom.${o.name}`,reason:`[${o.name}] ${o.reason}`,intent:o.intent??"manual_only"}}return null}function tv(e,t){return e===z(t)}function nv(e,t,n){if(!n)return!0;return sd(t,1,n,id(e))}function sd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&rv(e,i,n,r))return!0;continue}return s===n}return!1}function rv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return sd(e,t+2,n,r)}function ov(e,t,n){for(let r of e)if(t.has(r))return!0;for(let r of n)if(t.has(r))return!0;return!1}function Pt(e,t,n={}){if(e.length===0)return null;let r=e[0];if(!r)return null;let o=z(r);if(o==="eval"){let i=Sn(G(e));if(i.kind==="dynamic")return Rn(n,t);if(i.kind==="literal"&&t.analyzeNested){let s=t.analyzeNested(i.source,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s)return s}return tt(n,t)}if(ee.has(o)){if(Ae(e))return null;let i=Je(e);if(i){if(n.dynamicSourceInput??n.dynamicInput){let l=Rn(n,t);if(l)return l}if(vn(i)){let l=Rn(n,t);if(l)return l}if(!t.analyzeNested)return null;let a=t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(a)return a;return null}let s=et(G(e));if(s.kind==="dynamic")return Rn(n,t);if(s.kind==="literal"){if(n.dynamicSourceInput)return Rn(n,t);return null}if(n.dynamicSourceInput??n.dynamicInput)return Rn(n,t);return null}if(Se.has(o))return k(Ho(e,(i)=>t.analyzeNested?t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments}):null),t.policy)??ne(e,t.policy?.rules??[])??tt(n,t);if(he(o)){let i=no(e);if(!i)return tt(n,t);if(Q(t.policy,"interpreter.one-liner-paranoid",!!t.paranoidInterpreters)){let a=k(b("interpreter.one-liner-paranoid",cn),t.policy);if(a)return a}if(io(o,i))return tt(n,t);let s=t.analyzeNested?.(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s&&s.id!=="raw-text.dangerous-command"&&(s.reason!==bt||gn(i)))return s;if(un(i,t.scanWork))return k(b("interpreter.dangerous-command",Dt),t.policy)??tt(n,t);return tt(n,t)}if(o==="rm"||o==="rmdir"){let i=o==="rm"&&(Be(e)||n.dynamicRmInput);return k(bn(G(e),{environment:t.environment,cwd:t.cwd,originalCwd:t.originalCwd,strict:t.strict,paranoid:t.paranoidRm,allowTmpdirVar:t.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ye(t.envAssignments,t.environment),trustedTmpdirValue:dt(t.envAssignments,t.environment),protectedGitMetadata:t.protectedGitMetadata,policy:t.policy}),t.policy)??(i&&n.dynamicRmInput?tt(n,t):null)??(i?iv(n,t):null)}if(o==="find")return qo(G(e),{...t,derivedCommandWorkBudget:t.derivedCommandWorkBudget,analyzeTokens:(i,s)=>Pt(i,{...t,cwd:s??void 0,derivedCommandWorkBudget:t.derivedCommandWorkBudget},n)})??ne(e,t.policy?.rules??[])??tt(n,t);if(o==="git")return k(Cn(G(e),{env:t.environment.env,cwd:t.cwd,envAssignments:t.envAssignments,policy:t.policy,worktreeMode:n.dynamicInput?!1:t.worktreeMode}),t.policy)??ne(e,t.policy?.rules??[])??tt(n,t);return ne(e,t.policy?.rules??[])??tt(n,t)}function Rn(e,t){return e.shellDynamicMatch?k(e.shellDynamicMatch,t.policy):null}function tt(e,t){return e.dynamicSourceInput&&e.dynamicSourceMatch?k(e.dynamicSourceMatch,t.policy):null}function iv(e,t){return e.dynamicInput&&e.rmDynamicMatch?k(e.rmDynamicMatch,t.policy):null}var Xs="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Js="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",sv="__CC_SAFETY_NET_XARGS_INPUT__",Jo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Qo="rm",av=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,lv=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,cv=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uv=/^(?:[0-9]+|[@*])$/;function cd(e,t){let n=e.map(I),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Js);if(mv(i,o,t)&&k(s,t.policy))return k(s,t.policy);for(let a of $e(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?k(s,t.policy):null;if(c)return c;let u=fd(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&dd(l,o),f=Pt(l,{...t,cwd:a.cwd,envAssignments:a.envAssignments},{dynamicInput:u,dynamicSourceInput:m||ud(l,a.head,o,a.wrapperEnvAssignments,u,t.scanWork,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",Xs)});if(f)return f;let d=dv(l,o,t.policy?.rules??[]);if(d)return d;if(a.head==="git"){let g=o===null?[...l,sv]:l,y=o!==null&&(l.some((R)=>R.includes(o))||Array.from(a.envAssignments.values()).some((R)=>R.includes(o))),h=Pt(g,{...t,cwd:a.cwd,envAssignments:a.envAssignments,worktreeMode:o===null||y?!1:t.worktreeMode});if(h)return h}let p=ne(l,t.policy?.rules??[]);if(p)return p}return null}function dv(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ne([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>Qs(s,t,i)):[])));for(let o of r){let i=ne(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function Qs(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function ud(e,t,n,r,o,i,s){if(ee.has(t)){if(Ae(e))return!1;if(n!==null&&fv(e,n))return!0;let a=Je(e);if(!a){let l=et(G(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(ut(a,i))return!0;return pv(a,n,r)}if(he(t))return ad(e,n,oo,jl(t));if(Se.has(t))return ad(e,n,Is,xu);if(t==="eval"){let a=Sn(G(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return gv(e,n,i,s);if(t==="git"){let a=Ue(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&yn.has(a.subcommand.toLowerCase())&&md(a.rest,n).some((l)=>l.includes(n))}return!1}function ad(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Jo]).sources.some((l)=>l.value===Jo);if(o.sources.some((l)=>l.value.includes(t)))return!0;let i=new Set(o.sources.map((l)=>`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)),s=r.flatMap((l)=>[l.selector,...l.valueForm==="attached-only"||l.valueForm==="attached-or-separate"?[`${l.selector}${Jo}`]:[],...l.valueForm==="equals-or-separate"?[`${l.selector}=${Jo}`]:[]]),a=new Set(s.flatMap((l)=>e.flatMap((c)=>Qs(c,t,l))));return Array.from(a).some((l)=>n(e.map((c)=>c.replaceAll(t,l))).sources.some((c)=>!i.has(`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)))}function mv(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from($e(e,n),(i)=>i.head)),o=t===null?[...e,Qo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Qo));return Array.from($e(o,n)).some((i)=>i.head===Qo&&!r.has(Qo))}function dd(e,t){return md(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function md(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function fd(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function fv(e,t){let n=Qe(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return Qs(i,t,o).some((l)=>{let c=e.map((m,f)=>f===s?m.replaceAll(t,l):m),u=Qe(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function pv(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(av))if(ld(o,r))return!0;for(let o of e.matchAll(lv))for(let i of(o[1]??"").matchAll(cv))if(ld(i,r))return!0;return Zs(e,r)}function ld(e,t){let n=e[1]??e[2];return n!==void 0&&(uv.test(n)||t.has(n))}function gv(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(mt(a)){let c=sr(e,s);s=c.nextIndex-1;for(let u of $e(c.tokens,{environment:r,cwd:void 0})){let m=fd(u.tokens,t,u.wrapperEnvAssignments);if(u.head==="rm"&&dd(u.tokens,t)||ud(u.tokens,u.head,t,u.wrapperEnvAssignments,m,n,r))return!0}continue}let l=xt(a);if(l>0){if(i=l,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(o.startsWith("-")){if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}if(t.has(o))r+=2;else r++}else return{childStart:r,replacementToken:n}}return{childStart:e.length,replacementToken:n}}var mr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",fr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",yv="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Cv="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",bv=/\{[^{}\s]*\}/,vd=/\{\}|\{-?\d+\}/g,Sv=["e","f","source","file","-e","-f","--source","--file"],vv=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Rv=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),xv=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),pd=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Ev=new Set(["--workdir","--wd"]),gd="__CC_SAFETY_NET_PARALLEL_SOURCE__",wv=new TextEncoder,ta=B.maxDerivedBytes+4*B.maxPlaceholderReplacements;function fe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Rd(e,t){return fe([...e],(n)=>ut(n,t.scanWork))}function xd(e,t){let n=e.map(I);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=jt(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Od(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=jt(t);if(p)return p;let g=Rd(t.envAssignments?.values()??[],t);if(g)return g}if(l){let p=Mv(t);if(p)return p}if(u!==void 0&&a){let p=jt(t);if(p)return p}let f=Wv(u,t.cwd,t.environment.paths);if(f===null){let p=jt(t);if(p)return p}let d=a?{...t,cwd:void 0,originalCwd:void 0}:f===null||f===void 0||f===t.cwd?t:{...t,cwd:f};if(m){if([...$e(i,d)].flatMap((g)=>[...g.envAssignments.values()]).some(ia)){let g=jt(t);if(g)return g}return null}if(i.length===0){if(s.some((y)=>y.length!==1)){let y=jt(t);if(y)return y}let p=s.map((y)=>y[0]??"");ye(t.budget,na(p));let g=Ad(d.envAssignments,d.cwd,a);return fe(p,(y)=>t.analyzeNested(y,g))}return fe($e(i,d),(p)=>Pv(p,o,t,d))}function Pv(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c={...r,cwd:e.cwd,envAssignments:e.envAssignments},u=[...e.envAssignments.values()];if(u.some(Td)){let h=jt(n);if(h)return h}let m=Rd(u,n);if(m)return m;let f=u.some(H),d=i||f,p=a&&d,g=Ad(e.envAssignments,e.wrapperCwd,s||p);if(ee.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return ye(n.budget,ei(l,o,"generic")),fe(o,(A)=>Pt(l.map((P)=>_t(P,A)),c))};if(Ae(l))return h();let R=Je(l);if(R){if(Id(R)){let C=Ht(n);if(C)return C;if(o.length===0)return null;return ye(n.budget,Sd(R,o)),fe(o,(_)=>n.analyzeNested(_t(R,_),g))}if(H(R)){if(o.length>0)return ye(n.budget,Sd(R,o)),fe(o,(E)=>n.analyzeNested(_t(R,E),g));ye(n.budget,Cd(R));let C=ar(R);if(C?.[0]&&z(C[0])==="rm"&&Be(C)){let E=yd(n);if(E)return E}let _=C?Pt(C,c,{dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",fr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",mr)}):null;if(_)return _;return n.analyzeNested(R,g)}let A=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((C)=>Zo(G(C===void 0?l:i?l.map((_)=>_t(_,C)):[...l,...C]),R)):[];if(A.some((C)=>C.kind==="dynamic")){let C=Ht(n);if(C)return C}let P=A.flatMap((C)=>C.kind==="literal"?[C.source]:[]);if(P.length>0)return ye(n.budget,na(P)),fe(P,(C)=>n.analyzeNested(C,g));if(ye(n.budget,Cd(R)),vn(R)){let C=Ht(n);if(C)return C}let S=n.analyzeNested(R,g);if(S)return S;if(d)return Ht(n);return null}let x=et(G(l));if(x.kind==="dynamic"||x.kind==="literal"&&H(x.source))return Ht(n)??h();if(x.kind==="literal")return h();if(o.length>0){let A=Ht(n);if(A)return A;let P=h();if(P)return P;if(i)return null;let S=o.flatMap((C)=>C[0]===void 0?[]:[C[0]]);return ye(n.budget,na(S)),fe(S,(C)=>n.analyzeNested(C,g))}if(d||a)return Ht(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return ye(n.budget,ei(l,o,"rm")),fe(o,(R)=>ea(l.map((x)=>ra(x,R)),e.cwd,r));if(o.length>0)return ye(n.budget,bd(l,o)),fe(o,(R)=>ea([...l,...R],e.cwd,r));let h=ea(l.flatMap((R,x)=>{if(x===0||!H(R))return[R];return R.startsWith("-")?[ra(R,[""])]:[]}),e.cwd,r);if(h)return h;return yd(n)}ye(n.budget,i&&o.length>0?ei(l,o,"generic"):o.length>0?bd(l,o):_d(l));let y=o.length>0?o:[void 0];return fe(y,(h)=>{let R=h===void 0?l:i?l.map((T)=>_t(T,h)):[...l,...h],x=b("parallel.shell-dynamic",fr),A=a&&e.head==="find"?Ov(R,r):null,P=wd(R,a,n.policy?.rules??[],n.budget)??A?.customResult??null,S=z(e.head),C=a&&(S==="rm"&&oa(R)||S==="xargs"&&Pd(R)||A?.rmOptions===!0),_=a&&(C||A?.executedSource===!0||A===null&&Ed(R,S)),E=Pt(R,{...c,worktreeMode:s||a||d?!1:n.worktreeMode},{dynamicInput:a||d,dynamicRmInput:C,dynamicSourceInput:P!==null||_,shellDynamicMatch:x,dynamicSourceMatch:x,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",mr)});if(_){let T=k(x,n.policy);if(T)return T}return E??P??ne(R,n.policy?.rules??[])})}function Ed(e,t){if(H(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(ee.has(t))return kv(e);if(t==="git")return _v(e);if(t==="find")return!0;if(Se.has(t))return hd(e,Sv,ir);if(he(t))return hd(e,vv,ro);return!1}function oa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(H))return t===-1;return n.some((o)=>H(o)&&(o.startsWith("-")||Id(o)))}function _v(e){if(Av(e))return!0;let t=Ue(e);if(t.subcommand===null||H(t.subcommand))return!0;if(!yn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(H))return n===-1;return r.some(H)}function Av(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(H(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(H(n))return!0;continue}if(H(n))return!0}return!1}function kv(e){if(Ae(e))return!1;let t=Je(e);if(t!==null)return H(t);let n=et(G(e));if(n.kind==="literal")return H(n.source);if(n.kind==="dynamic")return!0;return!e.some(H)}function hd(e,t,n){let r=n(e);if(r.some((i)=>H(i.value)))return!0;if(!e.some(H))return n([...e,gd]).some((i)=>i.value===gd);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>_t(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function wd(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>z(s.command)===z(e[0]??""));if(o.length===0)return null;let i=e.some(H);if(ye(r,Tv(e,o,i)),!i)return fe(o,(s)=>ne([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return fe(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((l)=>l?Iv(e,l):[]));return fe(a,(l)=>ne(e.map((c)=>_t(c,[l])),[s]))})}function Tv(e,t,n){let r=n?Vt(ke(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),B.maxChildAnalyses),2*Math.max(e.length,1),B.maxChildAnalyses):t.length;return{childAnalyses:r,derivedTokens:Vt(r,e.length,B.maxDerivedTokens)}}function Iv(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function Ov(e,t){let n={customResult:null,executedSource:!e.some(H),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(H))return;for(let a of $e(i,t))n.executedSource||=Ed(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&oa(a.tokens)||a.head==="xargs"&&Pd(a.tokens),n.customResult??=wd(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=H(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(mt(a)){i=[],n.executedSource||=H(a);continue}let l=xt(a);if(l>0){o=l,n.executedSource||=H(a);continue}n.executedSource||=H(a)}return s(),n}function Pd(e){let t=e.slice(Ut(e).childStart);return z(t[0]??"")==="rm"&&oa(t)}function ti(e,t){return(n)=>k(b(e,t),n.policy)}var Ht=ti("parallel.shell-dynamic",fr),Mv=ti("parallel.command-stream-dynamic",yv),jt=ti("parallel.command-stream-dynamic",Cv),yd=ti("parallel.rm-recursive-force-dynamic",mr);function ea(e,t,n){return k(bn(G(e),{environment:n.environment,cwd:t,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ye(n.envAssignments??new Map,n.environment),trustedTmpdirValue:dt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function na(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:pr(e)}}function Cd(e){return _d([e])}function _d(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:pr(e)}}function bd(e,t){if(t.length>B.maxChildAnalyses)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:ke(t.map((n)=>e.length+n.length),B.maxDerivedTokens),derivedBytes:ke([Vt(pr(e),t.length,B.maxDerivedBytes),ke(t.map((n)=>pr(n)),B.maxDerivedBytes)],B.maxDerivedBytes)}}function Sd(e,t){return ei([e],t,"generic")}function ei(e,t,n){if(t.length>B.maxChildAnalyses)return{childAnalyses:t.length};let r=Vt(e.length,t.length,B.maxDerivedTokens);if(r>B.maxDerivedTokens)return{childAnalyses:t.length,derivedTokens:r};let o=Nv(e.map((l)=>Lv(l,n))),i=Vt(o.occurrences,t.length,B.maxPlaceholderReplacements);if(i>B.maxPlaceholderReplacements)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(Dv(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:B.maxDerivedBytes+1,placeholderReplacements:i};let s=n==="generic"?_t:ra,a=ke(t.map((l)=>pr(e.map((c)=>s(c,l)))),B.maxDerivedBytes);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function Dv(e,t,n){let r=B.maxDerivedBytes+4*n;return ke([Vt(e.fixedBytes,t.length,r),Vt(e.occurrences,ke(t.map((o)=>o.reduce((i,s)=>Math.max(i,dr(s)),0)),r),r)],r)>r}function Lv(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(vd),r=0,o=0,i=0;for(let s of n){if(r>=B.maxPlaceholderReplacements)return{occurrences:B.maxPlaceholderReplacements+1,fixedBytes:0};o=ke([o,dr(e.slice(i,s.index))],ta),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?dr(e):ke([o,dr(e.slice(i))],ta)}}function Nv(e){return{occurrences:ke(e.map((t)=>t.occurrences),B.maxPlaceholderReplacements),fixedBytes:ke(e.map((t)=>t.fixedBytes),ta)}}function pr(e,t=B.maxDerivedBytes){return ke(e.map(dr),t)}function dr(e){return wv.encode(e).byteLength}function ke(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function Vt(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function Ad(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function _t(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>kd(n,t))}function ra(e,t){return e.replace(vd,(n)=>kd(n,t))}function kd(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function H(e){return bv.test(e)}function Td(e){if(ia(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function ia(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Id(e){return/^\{[^{}\s]*\}$/.test(e)}function Od(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let x=Ds(e,t+1);n.push(...x.templateTokens),r=t+1,o=x.markerIndex;break}if(!p.startsWith("-")){let x=Ds(e,t);n.push(...x.templateTokens),r=t,o=x.markerIndex;break}let g=e[t+1],y=p.indexOf("="),h=y===-1?p:p.slice(0,y),R=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(h==="--replace"||p.startsWith("-i")&&p.length>2){let x=h==="--replace"?R:p.slice(2);c||=x!==""&&x!=="{}",t++;continue}if(p==="-a"||xv.has(h)){c=!0,t+=R===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(h==="--env"){c=!0,t+=R===void 0?2:1;continue}if(pd.has(h)||p.startsWith("-S")&&p.length>2){i=!0,t+=pd.has(p)?2:1;continue}if(Ev.has(h)){let x=R??g;if(x===void 0||x===":::"||x==="--"){c=!0,t++;continue}l=x,c||=R!==void 0&&x==="",t+=R===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&R!==void 0){t++;continue}if(Rv.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(a?ia:Td);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let y=e[g];if(y===":::"){u.push(p),p=[];continue}if(y!==void 0)p.push(y)}u.push(p)}let m=Fv(u),f=n.some(H),d=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:f,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:d,unsupported:c,workdir:l,dryRun:a}}function Wv(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!hv(e))return null;try{return Ct(t??e,e,n)}catch{return null}}function Fv(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>B.maxChildAnalyses)return r;t=r}return t}function Md(e){return Od(e).childStart}var Gv="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ni="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function aa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function sa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ld(e,t,n,r,o=!1,i){let a=(Kn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&Q(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",Gv):null;return k(a,i)??Nd(e,t,n,o,i)}function Nd(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>aa(a)?[l]:[]);if(i.length===0)return null;let s=z(t[0]?.text??"");if(s==="git"){let a=nn(e,t),l=$v(a);if(Q(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return k(b("shell.dynamic-structure",ni),o);if(k(Cn(a,{env:n.env}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,f)=>f>l&&I(m)==="--");if(Q(o,"shell.dynamic-structure",r)&&c&&yn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return k(b("shell.dynamic-structure",ni),o);return null}if(s==="find")return Q(o,"shell.dynamic-structure",r)&&Bv(t)?k(b("shell.dynamic-structure",ni),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&I(c)==="--"),l=Be(t.map(I));return Q(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?k(b("shell.dynamic-structure",ni),o):null}if(s==="xargs")return Dd(e,t.slice(Ut(t.map(I)).childStart),"xargs",n,r,o);if(s==="parallel")return Dd(e,t.slice(Md(t.map(I))),"parallel",n,r,o);return null}function Dd(e,t,n,r,o,i){if(t.length===0)return null;let s=zv(t,r);if(Kn(e,s)){let l=k(b(`${n}.shell-dynamic`,n==="xargs"?Js:fr),i);if(l)return l}let a=Nd(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>aa(l)&&sa(l)))return k(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Xs:mr),i);return null}function zv(e,t){let n=Lt(e,t),r=n.rewritten?G(n.words.map(I)):n.words,o=r[0];return o&&I(o)==="busybox"?r.slice(1):r}function $v(e){let t=1;while(t<e.length){let n=e[t],r=n?I(n):"";if(Ke.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function Bv(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=aa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||sa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||sa(s)))return!0;continue}if(t=!0,a)return!0;let l=xt(s.text);if(l>0){n=l;continue}if(mt(s.text))o=!0,r=!0}return!1}function la(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Wr(t[n.tokenIndex],n.value)})}var Uv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Hv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",jv="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Wd(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",Uv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",Hv);if(e==="shred"&&n.length>0)return b("shred.target",jv);return null}var Gd=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>bn(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ye(e.envAssignments,e.options.environment),trustedTmpdirValue:dt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy})},{heads:new Set(["git"]),analyze:(e)=>Cn(e.words,ca(e))},{heads:new Set(["find"]),analyze:(e)=>qo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ye(e.envAssignments,e.options.environment),trustedTmpdirValue:dt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>cd(e.words,{...Fd(e),analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>xd(e.words,{...Fd(e),budget:e.options.parallelBudget,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})}];function Fd(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function qt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function ca(e){return{env:e.options.environment.env,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var Ud="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function Hd(e){return Gd.find((t)=>t.heads.has(e))?.analyze}function gr(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(w)=>w.map((N)=>o==="posix"?I(N):N.text),s=n.effectiveCwd===null,a=s?void 0:n.effectiveCwd??n.cwd,l=s?void 0:n.cwd,c=uo(e);if(c.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...c.envAssignments.keys()],output:i(c.words)});let u=Lt(c.words,n.environment,a,new Map([...n.envAssignments??[],...c.envAssignments])),m=u.envSplitValues??[];if(m.length>0){let w=[...m,...i(u.words)].join(" "),N=ut(w,n.scanWork);if(N)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:N.reason}),nt(N);if(n.strict)return ve(r);let Y=mo(m,i(u.words));if(Y){De(n.derivedCommandWorkBudget,Y.length);let J=n.analyzeNested(Y.join(" "),{effectiveCwd:u.cwd===void 0?n.effectiveCwd:u.cwd,envAssignments:new Map([...n.envAssignments??[],...c.envAssignments,...u.envAssignments])});if(J)return J}}let f=u.rewritten?G(i(u.words)):nn(o,u.words),d=i(f),p={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&c.words.length>f.length){let w=i(c.words);r.recordSegment({type:"leading-tokens-stripped",input:w,removed:w.slice(0,w.length-f.length),output:d})}let g=new Map([...n.envAssignments??[],...c.envAssignments,...u.envAssignments]),y=d[0];if(!y)return null;if(zt(y))throw new ge;let h=z(y),R=u.cwd===null?void 0:u.cwd??a,x=u.cwd===null?void 0:l,A=u.cwd===void 0?n.effectiveCwd:u.cwd,P=!Hn(g,n.environment),S=Ld(o,u.words,n.environment,t===0,n.strict,n.policy);if(S)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:S.reason}),nt(S);let C=jo(d,n.policy);if(C){for(let w of[C.childIndex,...C.alternativeChildIndices]){zd(p.wrapperNormalizationBudget);let N=f.slice(w);r?.recordSegment({type:"transparent-wrapper",wrapper:C.wrapper,output:i(N)});let Y=gr(N,t,{...p,effectiveCwd:A,envAssignments:g});if(Y)return Y}return null}let _=h==="eval"?Sn(f):h==="trap"?nd(f):void 0;if(_?.kind==="dynamic"&&(n.strict||!n.commandView||!Ys(n.commandView)))return ve(r);if(_?.kind==="literal"){r?.recordSegment({type:"recurse",reason:h==="eval"?"shell-eval":"shell-trap",innerCommand:_.source,depth:t+1});let w=n.analyzeNested(_.source,{effectiveCwd:A,envAssignments:g,functionDefinitions:n.functionDefinitions});if(w)return w}if(Vd(y,h)){if(Ae(d))return null;let w=Vv(d,g,A,n,r,t);if(w)return w;let N=Je(d);if(N){let tn=Zo(f,N);if(tn.kind==="dynamic")return ve(r);let Di=tn.kind==="literal"?tn.source:N,ol=qv(Di);r?.recordSegment({type:"shell-wrapper",wrapper:h,innerCommand:ol}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:ol,depth:t+1});let il=n.analyzeNested(Di,{effectiveCwd:A,envAssignments:g});if(il)return il;return vn(Di)?ve(r):null}let Y=et(f);if(Y.kind==="dynamic")return ve(r);if(Y.kind==="literal")return ii(Y.source,A,g,n,r,t);let J=rd(f,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(J.kind==="dynamic")return ve(r);if(J.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:J.source,depth:t+1}),n.analyzeNested(J.source,{effectiveCwd:A,envAssignments:g})}if(h==="source"||h==="."){let w=d[1]==="-p"?2:null;if(w!==null){let tn=n.commandView?f[w]:void 0;if(!tn)return null;if(tn.provenance!=="literal")return ve(r)}let N=w===null?1:3,Y=d[N]==="--"?N+1:N,J=n.commandView?f[Y]:void 0;if(!J)return null;if(J.provenance==="literal")return ii(J.text,A,g,n,r,t);if(n.strict||!n.commandView||!Ys(n.commandView))return ve(r)}if(Se.has(h)){if(n.strict&&la(ir(d),f))return ve(r);let w=Ho(d,(Y)=>qt(n.analyzeNested(Y,{effectiveCwd:A,envAssignments:g}))),N=k(w,n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:N.reason}),nt(N)}if(he(h)){if(n.strict&&la(ro(d),f))return ve(r);let w=no(d);if(w){let N=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:h,codeArg:w,paranoidBlocked:N}),N){let J=k(b("interpreter.one-liner-paranoid",cn),n.policy);if(J)return nt(J)}if(io(h,w))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:w,depth:t+1});let Y=n.analyzeNested(w,{effectiveCwd:A,envAssignments:g});if(Y&&Y.ruleId!=="raw-text.dangerous-command"&&(Y.reason!==bt||gn(w)))return Y;if(un(w,n.scanWork)){let J=k(b("interpreter.dangerous-command",Dt),n.policy);if(J)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:Dt}),nt(J)}r=void 0}}if(h==="busybox"&&d.length>1)return zd(p.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:d[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:d.slice(1).join(" "),depth:t+1}),gr(f.slice(1),t,{...p,effectiveCwd:A,envAssignments:g});let E=k(Wd(h,d),n.policy);if(E)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:E.reason}),nt(E);let T=r===p.trace?p:{...p,trace:r},O={words:f,head:h,cwd:R,originalCwd:x,envAssignments:g,allowTmpdirVar:P,dynamicArguments:u.words.some((w)=>w.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:T,analyzeChildTokens:(w,N)=>qt(gr(G(w),t+1,{...T,commandView:void 0,effectiveCwd:N,envAssignments:g}))??ne(w,T.policy.rules)},M=Hd(h);if(h==="rm"||h==="xargs"||h==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:g.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!P,allowTmpdirVar:P});let F=r&&h==="git"?ju(O.words,ca(O)):void 0,oe=$d(F?F.match:M?.(O)??null,n.policy);if(r)Kv(O,oe,F?.relaxation??null);if(oe)return nt(oe);let xe=M!==void 0;if(!xe)if(!eo.has(h)){let w=r?[]:void 0;for(let N=1;N<d.length;N++){let Y=d[N];if(!Y)continue;w?.push(Y);let J=$d(Yv(O,d,N),n.policy);if(J)return r?.recordSegment({type:"fallback-scan",tokensScanned:w??[],embeddedCommandFound:z(Y)}),nt(J)}r?.recordSegment({type:"fallback-scan",tokensScanned:w??[]})}else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});if(t===0||!xe){let w=ne(d,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!w,reason:w?.reason}),w)return nt(w)}else r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1});return null}function Vv(e,t,n,r,o,i){let s=Xu(e);if(s.argvSource?.kind==="absent")return ve(o);if(s.argvSourceApplies&&s.argvSource){let l=ii(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ii(a,n,t,r,o,i,!0)}function ii(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ve(o);let a=Un(e,t,r.environment.paths),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ve(o):null;return De(r.derivedCommandWorkBudget,1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function qv(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Kv(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function zd(e){if(e.iterations>=an)throw new ge;e.iterations++}function nt(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ve(e){return e?.recordSegment({type:"error",message:Ud}),nt(jd())}function jd(){return{id:"",reason:Ud,intent:"stop_and_explain"}}function Vd(e,t){return ee.has(t)||e==="$SHELL"||e==="${SHELL}"||ee.has(D(t))}function Yv(e,t,n){let r=$e(t.slice(n),{environment:e.options.environment,cwd:e.cwd,envAssignments:e.envAssignments,policy:e.options.policy});for(let o of r){let i=Zv(e,n,o);if(i)return i}return null}function Zv(e,t,n){let r=n.tokens[0];if(!r)return null;let o=z(r);if(Vd(r,o)){De(e.options.derivedCommandWorkBudget,e.words.length-t);let l=n.tokens;if(Ae(l))return null;let c=Je(l);if(!c){if(et(G(l)).kind==="dynamic")return jd();return oi(e,n)}let u=e.options.analyzeNested(c,{effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,envAssignments:n.envAssignments});return u?qt(u):oi(e,n)}let i=Hd(o);if(!i||o==="xargs"||o==="parallel"){if(n.wrappedByTransparent&&e.options.policy.rules.length>0)De(e.options.derivedCommandWorkBudget,e.words.length-t);return oi(e,n)}De(e.options.derivedCommandWorkBudget,e.words.length-t);let s=[o,...n.tokens.slice(1)],a={...e,words:G(s),head:o,cwd:n.cwd,originalCwd:n.wrapperCwd===null?void 0:e.originalCwd,envAssignments:n.envAssignments,allowTmpdirVar:!Hn(n.envAssignments,e.options.environment),effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,options:o==="git"?{...e.options,worktreeMode:!1}:e.options};return i(a)??oi(e,n)}function oi(e,t){return t.wrappedByTransparent?ne(t.tokens,e.options.policy.rules):null}function $d(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:k(e,t)}var Xv=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Jv=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Qv(e,t){let n=Yd(e,t);if(n.length===0)return!1;let r=n[Kd(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return Xv.test(e.join(" "))}function qd(e,t,n,r){if(e.dialect==="powershell"){let a=eR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Bd(oR(a.target),t,n.paths)}let o=e.words.map(I);if(!Qv(o,n))return;if(!t)return null;let i=Yd(o,n,t),s=Kd(i);if(s===-1||i[s]!=="cd")return null;return Bd(i[s+1],t,n.paths)}function Bd(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return iR(Ct(t,e,n),t,n)?t:null}catch{return null}}function eR(e,t){let n=tR(e[0])?1:0,r=e[n];if(!nR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Jv.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return rR(e.slice(n+1),t)}function tR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function nR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function rR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function oR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Kd(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Yd(e,t,n){let r=sR(e);return mn([...r],t,n)}function iR(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ri(e)===ri(t);return ri(r)===ri(o)}function sR(e){let t=0;while(t<e.length){let n=e[t];if(n==="{"||n==="("||n==="$(")t++;else break}return e.slice(t)}var da="TMPDIR",ma="IFS",Zd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Xd=/^[A-Za-z_][A-Za-z0-9_]*$/,Jd=new Set(["export","typeset","declare","readonly"]),aR=new Set(["builtin","command","time"]);function Qd(e,t){return{env:e,effectiveEnvAssignments:mR(e,t),shellAssignments:new Map}}function em(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function fa(e,t){let n=nm(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),pa(t,s)});let r=n.commandIndex;if(r!==-1&&Jd.has(e[r]??""))e.filter((s)=>Xd.test(s)&&ua(s)).forEach((s)=>{fR(t,s)});let o=r===-1?-1:rm(e,r);if(o===-1||e[o]!=="unset")return;let i=gR(e,o);if(i===null)return;e.slice(i).forEach((s)=>{pR(t,s)})}function tm(e,t){let n=nm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function nm(e,t){let n=e.findIndex((s)=>!lR(s)),r=n!==-1&&Jd.has(e[rm(e,n)]??""),o=dR(t);return{assignments:e.flatMap((s,a)=>{let l=cR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Wi(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function rm(e,t){let n=t;while(aR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function lR(e){return Pe(e)!==null||Zd.test(e)}function cR(e,t,n){return Pe(e)??uR(e,t,n)}function uR(e,t,n){let r=zr(e,n,t);if(r)return r;let o=e.match(Zd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ua(e){return e===da||e===ma||Fi(e)}function dR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function mR(e,t){let n=[...Fr,da,ma].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function pa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function fR(e,t){pa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function pR(e,t){if(!ua(t)&&!Xd.test(t))return;if(e.shellAssignments.set(t,""),!ua(t)||t===da||t===ma||Nn(t)){pa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function gR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var hR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Kt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.",yR=64;function ba(e,t,n,r){let o=n.derivedCommandWorkBudget===void 0,i=n.parallelBudget===void 0;try{return CR(e,t,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget??Yr(),parallelBudget:n.parallelBudget??ql()},r)}catch(s){let a=s instanceof ge&&o?Wl:s instanceof lo&&i?Vl:void 0;if(!a)throw s;if(n.trace?.currentSegmentIndex!==void 0)n.trace.recordSegment({type:"error",message:a});else n.trace?.recordGlobal({type:"error",message:a});return{reason:a,segment:e,intent:"stop_and_explain"}}}function CR(e,t,n,r){if(t>=Qr)return n.trace?.recordSegment({type:"error",message:st}),{reason:st,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??We(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:st}),{reason:st,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Ca(e,n);let u=`Unsupported heredoc syntax: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return cm(e,n),{reason:bt,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return cm(e,n),{reason:bt,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote"))&&!n.analyzePartialProgram)return Ca(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Qd(n.environment.env,n.envAssignments);return li(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function li(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,f=bR(e,l,c,a,m),d=a==="&&"||a==="||",p=d?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],h=a==="&&"?p?.failure??[]:[],R=d||xn(m);if(c.kind==="function"){let E=g.flatMap((O)=>{let M=hr(O);return M.functionDefinitions.set(c.name,c.body),ga(O,[M],f,m==="&",xn(m))}),T=ha(E,[],y,h,a,m);i=T.states,s=T.conditionalStates,a=void 0;continue}if(c.kind==="group"){let E=[],T=[];for(let M of g){let F=li(c.body,t,n,r,[hr(M)]);if(F.result)return F;if(E.push(...ga(M,F.states,f,m==="&",xn(m))),R)T.push(M,...f?F.states.map((oe)=>si(M,oe)):F.states)}let O=ha(E,T,y,h,a,m);i=O.states,s=O.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let x=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),A=e.nodes[l-2],P=ci(a)&&A?.kind==="command"?td(A)??vR(A):void 0,S=[],C=[];for(let E of g){let T=RR(c,t,n,r,[hr(E)]);if(T.result)return{result:T.result,states:i};let O=e.dialect==="powershell"?T.states:T.states.map((M)=>si(E,M));for(let M of O){let F=hr(M),oe=wR(c,t,n.trace?{...n,trace:um(n.trace,x)}:n,r,F,ci(a),P);if(oe)return{result:oe,states:i};let xe=FR(c,F.functionDefinitions);if(xe)De(n.derivedCommandWorkBudget,ui(xe));let w=xe?t+1>=Qr?ya(c.displayText,n,[F]):li(xe,t+1,n,r,[F]):{result:null,states:[F]};if(w.result)return w;if(S.push(...ga(E,w.states,f,m==="&",xn(m))),R)C.push(E),C.push(...w.states.map((N)=>f?si(E,N):N))}}let _=ha(S,C,y,h,a,m);i=_.states,s=_.conditionalStates,a=void 0}return{result:null,states:i}}function bR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ci(r)||ci(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&SR(e,t)}function ga(e,t,n,r,o){let i=n?t.map((a)=>si(e,a)):[...t],s=o?i.flatMap((a)=>yr(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function si(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function SR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(xR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ci(e){return e==="|"||e==="|&"}function vR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function xn(e){return e==="&&"||e==="||"}function ha(e,t,n,r,o,i){let s={success:ai([...n,...e]),failure:ai([...r,...t])},a=xn(i)?s:void 0;return{states:xn(o)||a?ai([...s.success,...s.failure]):s.success,conditionalStates:a}}function um(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function RR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=ER(e);if(s){if(t+1>=Qr)return ya(s,n,o);let a=We(s,"powershell");if(a.status==="limited")return ya(s,n,o);if(a.status!=="complete")return om(i,n,r,o);De(n.derivedCommandWorkBudget,ui(a)),i.push({program:a,depth:t+1})}}return om(i,n,r,o)}function xR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function om(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=li(i.program,i.depth,t,n,[hr(a)]);if(l.result)return l;s.push(...l.states)}o=ai(s)}return{result:null,states:o}}function ER(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function ui(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+ui(o),0):n.kind==="group"||n.kind==="function"?ui(n.body):0),0)}function ya(e,t,n){return t.trace?.recordSegment({type:"error",message:st}),{result:{reason:st,segment:e,intent:"stop_and_explain"},states:[...n]}}function wR(e,t,n,r,o,i,s){let a=OR(e);if(a&&n.strict)return n.trace?.recordSegment({type:"error",message:a}),{reason:a,segment:e.source,intent:"stop_and_explain"};dm(e,o,"before-consumer",n.environment.paths);let l=nn(e.dialect,e.words).map(I),c=e.displayText,u=tm(l,o.shellGitContextState);if(e.dialect==="powershell"){let d=k(vu(e,i,zR(n,o.effectiveCwd)),n.policy);if(n.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!d,reason:d?.reason}),d)return GR(c,d)}if(l.length===1&&l[0]?.includes(" ")&&!Kn(e.dialect,e.words)){let d=k(ut(l[0],n.scanWork),n.policy),p=d!==null&&!n.strict&&Dl(e,n.rootProgram,n.scanWork);if(d&&!p)return n.trace?.recordSegment({type:"dangerous-text",token:l[0],matched:!0,reason:d.reason}),{reason:d.reason,segment:c,ruleId:d.id,intent:d.intent};n.trace?.recordSegment({type:"dangerous-text",token:l[0],matched:!1});let g=im(e,a,o,u,s,n);if(g)return g;return fa(l,o.shellGitContextState),null}let m=gr(e.words,t,{...n,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(d,p)=>{let g=p&&Object.hasOwn(p,"effectiveCwd")?p.effectiveCwd:o.effectiveCwd,y=ba(d,t+1,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget,effectiveCwd:g,envAssignments:p?.envAssignments??u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:p?.functionDefinitions,worktreeMode:p?.worktreeMode??n.worktreeMode,trace:n.trace?um(n.trace,n.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(m)return{...m,segment:c};let f=im(e,a,o,u,s,n);if(f)return f;return fa(l,o.shellGitContextState),null}function im(e,t,n,r,o,i){let s=MR(e,t,n,r??new Map,i);if(s)return s;return dm(e,n,"after-consumer",i.environment.paths),n.literalHeredocFiles.clear(),AR(e,t,n,i.environment.paths),NR(e,n,o,i.environment,i.trace),null}var PR=new Set([">>","<>"]);function dm(e,t,n,r){for(let i of e.redirections){if(!(n==="before-consumer"?_R(i):PR.has(i.operator)))continue;sm(i.target,t,r)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let o=mm(e.words.slice(1));if(!o)return;for(let i of o.operands)sm(i,t,r)}function _R(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function sm(e,t,n){let r=e?.provenance==="literal"?Un(e.text,t.effectiveCwd,n):void 0;if(!r)return;t.literalHeredocFiles.delete(r)}function AR(e,t,n,r){if(t)return;let o=e.redirections.find((i)=>i.operator==="<<"||i.operator==="<<-")?.heredoc;if(!o||!di(o))return;for(let i of kR(e)){let s=Un(i.text,n.effectiveCwd,r);if(!s||!$l(s))continue;if(!n.literalHeredocFiles.has(s)&&n.literalHeredocFiles.size>=zl)throw new ge;n.literalHeredocFiles.set(s,o.body)}}function kR(e){let t=IR(e.redirections)?.target,n=am(t)?[t]:[];if(Re(e.words[0],"cat"))return TR(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=mm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(am))return[];return[...r.operands,...n]}function TR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function IR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function mm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function am(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function di(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function OR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Kt;let n=t[0];if(!n?.heredoc)return Kt;if(!di(n.heredoc))return hR;if(n.fd!==void 0&&n.fd!==0)return Kt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Kt;let r=e.redirections.some((s)=>s!==n&&lm(s.target));if(Re(e.words[0],"cat"))return r?Kt:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(lm)?Kt:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return Kt}function lm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function MR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(LR(e,i,n,r,o))return null;let a=DR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ca(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function DR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!di(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!he(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=k(b("interpreter.one-liner-paranoid",cn),n.policy);if(c)return c}if(!un(s,n.scanWork))return null;let l=k(b("interpreter.dangerous-command",Dt),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function LR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!di(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Lt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(I),l=z(a[0]??"");if((s.envSplitValues?.length??0)>0||!ee.has(l)&&!ee.has(D(l)))return!1;return Ae(a)}function NR(e,t,n,r,o){let i=qd(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(I).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function hr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:em(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ai(e){let t=[];for(let n of e){if(!t.some((r)=>WR(r,n)))t.push(n);if(t.length>yR)throw new ge}return t}function WR(e,t){return e.effectiveCwd===t.effectiveCwd&&yr(e.literalHeredocFiles,t.literalHeredocFiles)&&yr(e.functionDefinitions,t.functionDefinitions)&&yr(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&yr(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function yr(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function FR(e,t){let n=_o(e);return n===void 0?void 0:t.get(n)}function GR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function zR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy}}function Ca(e,t){let n=k(ut(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function cm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:bt};if(t.trace?.currentSegmentIndex===void 0)t.trace?.recordGlobal(n);else t.trace.recordSegment(n)}var ie={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},mi=["standard","strict","paranoid"];function $R(e){return{failClosed:e==="strict"||e==="paranoid",paranoidRm:e==="paranoid",paranoidInterpreters:e==="paranoid"}}function BR(e,t){if(!t)return e;return mi.indexOf(t)>mi.indexOf(e)?t:e}function UR(){let e=va(ie.level);if(e===void 0||e==="")return;if(mi.includes(e))return e;console.error(`CC Safety Net: ignored invalid ${ie.level.name}=${JSON.stringify(e.slice(0,40))}. Use ${mi.join(", ")}.`);return}function HR(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function KI(){return HR(va(ie.auditScope))==="all"}function Sa(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function fi(e={}){let t=e.safety?.level??"standard",n=UR(),r=BR(t,n),o=$R(r),i={failClosed:r===t?"preset":"environment",paranoidRm:r===t?"preset":"environment",paranoidInterpreters:r===t?"preset":"environment"},s={failClosed:[`policy safety.level=${t}`],paranoidRm:[`policy safety.level=${t}`],paranoidInterpreters:[`policy safety.level=${t}`]};if(r!==t)s.failClosed.push(`env ${ie.level.name}=${n}`),s.paranoidRm.push(`env ${ie.level.name}=${n}`),s.paranoidInterpreters.push(`env ${ie.level.name}=${n}`);if(e.safety?.overrides?.failClosed!==void 0)o.failClosed=e.safety.overrides.failClosed,i.failClosed="capability_override",s.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)o.paranoidRm=e.safety.overrides.paranoidRm,i.paranoidRm="capability_override",s.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)o.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,i.paranoidInterpreters="capability_override",s.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Cr(ie.strict))o.failClosed=!0,i.failClosed="environment",s.failClosed.push(`env ${ie.strict.name}`);if(Cr(ie.paranoid))o.paranoidRm=!0,o.paranoidInterpreters=!0,i.paranoidRm="environment",i.paranoidInterpreters="environment",s.paranoidRm.push(`env ${ie.paranoid.name}`),s.paranoidInterpreters.push(`env ${ie.paranoid.name}`);if(Cr(ie.paranoidRm))o.paranoidRm=!0,i.paranoidRm="environment",s.paranoidRm.push(`env ${ie.paranoidRm.name}`);if(Cr(ie.paranoidInterpreters))o.paranoidInterpreters=!0,i.paranoidInterpreters="environment",s.paranoidInterpreters.push(`env ${ie.paranoidInterpreters.name}`);let a=!!e.worktreeMode||Cr(ie.worktree);return{strict:o.failClosed,paranoidRm:o.paranoidRm,paranoidInterpreters:o.paranoidInterpreters,worktreeMode:a,effectiveLevel:Sa(o),capabilities:{fail_closed:{enabled:o.failClosed,source:i.failClosed,sources:s.failClosed},paranoid_rm:{enabled:o.paranoidRm,source:i.paranoidRm,sources:s.paranoidRm},paranoid_interpreters:{enabled:o.paranoidInterpreters,source:i.paranoidInterpreters,sources:s.paranoidInterpreters}}}}function Cr(e){let t=typeof e==="string"?br(e):va(e);return t==="1"||t?.toLowerCase()==="true"}function br(e){return Object.hasOwn(process.env,e)?process.env[e]:void 0}function va(e){let t=br(e.name);if(t!==void 0)return t;if(e.legacyName)return br(e.legacyName);return}function YI(e){return br(e.name)!==void 0||!!e.legacyName&&br(e.legacyName)!==void 0}function fm(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ra(t.fail_closed,e.strict,"strict"),paranoid_rm:Ra(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ra(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Ol(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Sa({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ra(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function nO(e,t){return xa(e,t)}function xa(e,t,n,r){let o=ba(e,0,{...t,...fm(t),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}import{basename as Kx,dirname as ja}from"node:path";import{chmodSync as Fx,existsSync as Ua,mkdirSync as Gx,readFileSync as Ha}from"node:fs";import{dirname as df,join as zx}from"node:path";import{createRequire as QR}from"node:module";var pm=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var gm=30,Ea=1,wa=365;function hm(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Sr=64,Cm="Rule config exceeds CC Safety Net's safe source limit.";var ym=Object.freeze({maxSources:64,concurrency:4,maxRequests:131,maxResponseBytes:67108864});function pi(e={}){return{requests:0,responseBytes:0,maxRequests:e.maxRequests??ym.maxRequests,maxResponseBytes:e.maxResponseBytes??ym.maxResponseBytes}}function gi(e){return{controller:new AbortController,budget:pi(),resolveUrl:e}}function bm(e){if(e.requests>=e.maxRequests)throw Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");e.requests++}function Sm(e,t){if(t>e.maxResponseBytes-e.responseBytes)throw e.responseBytes+=t,Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");e.responseBytes+=t}var Te=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,hi="rulebook.json",yi=".cc-safety-net/rules";var vm=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,jR=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,VR=/^[A-Za-z0-9._-]+$/,qR=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),KR="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Pa=new RegExp(`^${qR}/(${Te.source.slice(1,-1)})/${KR}$`);function Rm(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function vr(e){if(wn(e))try{return En(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Te.test(e)?null:`Local rulebook sources must be bare names matching ${Te}: ${e}`}function En(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(vm);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let[n,r,...o]=t[3].split("/");if(!n||!VR.test(n))throw Error(`GitHub rulebook refs must be a single path segment: ${e}`);if(!r||o.length>0||!Te.test(r))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:n,path:Rm(r),name:r}}function xm(e){return jR.test(e)}function wn(e){return vm.test(e)}function _a(e){if(!Te.test(e))throw Error(`Local rulebook sources must be bare names matching ${Te}: ${e}`)}var Aa=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Ci={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},YR=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],ZR=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ka=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...ZR.flatMap((e)=>YR.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var bi=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]}],Em=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],XR=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ta=Em.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Ia=Em.flatMap((e)=>XR.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Rr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Oa=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Ma=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],wm=[...Aa,Ci,...ka,...Ta,...Ia,Rr,...Oa,...Ma,...bi].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Pm=new Set(bi.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),JR=wm.map((e)=>e.id),Si=new Set(JR);var ex=QR(import.meta.url),_m,tx=Array(Sr+1).fill("over-limit"),Am=/^[^/]+\/[^/]+$/,nx=/^sha256:[a-f0-9]{64}$/,vi=`must be an integer between ${Ea} and ${wa}`,rx=["version","rules","overrides","transparent_wrappers"],ox=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function km(e){if(!Ie(e)||!Array.isArray(e.rules)||e.rules.length<=Sr)return e;return{$schema:e.$schema,version:e.version,rules:tx,overrides:e.overrides,transparent_wrappers:e.transparent_wrappers}}function ix(){let e=ex("../vendor/zod.cjs"),t=(S)=>{let C=e.superRefine(S);return C._zod.def.when=()=>!0,C},n=e.enum(pm),r=e.union([e.literal("off"),e.looseObject({reason:e.string({error:"required non-empty string"}).min(1,"required non-empty string").max(ln,`must be at most ${ln} characters`).describe("Replacement block reason"),intent:n.optional()})],{error:'must be "off" or an object'}).describe("Disable a rule or replace its block reason and intent."),o=e.string({error:"must be a rulebook source string"}).min(1,"must be a non-empty rulebook source string"),i=e.string({error:"must be a command string"}).regex(Mt,"must match command pattern").describe("Command name such as 'git', 'docker', or 'rtk'."),s=e.looseObject({$schema:e.unknown().optional().describe("JSON Schema reference for IDE support"),version:e.literal(1).describe("Schema version (must be 1)"),rules:e.array(o,{error:"must be an array of rulebook source strings"}).max(Sr,Cm).default([]).describe("Rulebook source strings such as project-rules or owner/repo#main/team-rules"),overrides:e.record(e.string().meta({pattern:Am.source}),r).default({}).describe("Rule overrides by id"),transparent_wrappers:e.array(i,{error:"must be an array of command strings"}).default([]).describe("Commands that transparently execute a visible protected child command")}),a=(S,C)=>{if(!Ie(S))return;if(Array.isArray(S.rules)&&S.rules.length<=Sr){let E=new Set;S.rules.forEach((T,O)=>{if(typeof T!=="string"||T==="")return;if(T.trim()===""){C.addIssue({code:"custom",message:"must be a non-empty rulebook source string",path:["rules",O]});return}let M=vr(T);if(M){C.addIssue({code:"custom",message:M,path:["rules",O]});return}if(E.has(T)){C.addIssue({code:"custom",message:`duplicate rulebook source "${T}"`,path:["rules",O]});return}E.add(T)})}if(Ie(S.overrides))for(let E of Object.keys(S.overrides)){if(Am.test(E))continue;C.addIssue({code:"custom",message:"must use <rulebook-name>/<rule-name>",path:["overrides",E]})}if(!Array.isArray(S.transparent_wrappers))return;let _=new Set;S.transparent_wrappers.forEach((E,T)=>{if(typeof E!=="string"||!Mt.test(E))return;if(_.has(E)){C.addIssue({code:"custom",message:`duplicate command "${E}"`,path:["transparent_wrappers",T]});return}if(Au(E)){C.addIssue({code:"custom",message:`reserved command "${E}" cannot be a wrapper`,path:["transparent_wrappers",T]});return}_.add(E)})},l=e.preprocess(km,s.check(e.superRefine(a))),c=e.preprocess(km,s.check(t(a))),u=e.strictObject({fail_closed:e.boolean().optional(),paranoid_rm:e.boolean().optional(),paranoid_interpreters:e.boolean().optional()}),m=(S,C)=>e.intersection(e.record(e.string().refine((_)=>S.has(_),{error:(_)=>`unknown ${C} rule id "${String(_.input)}"`}),e.unknown()),e.record(e.string(),e.enum(["on","off"]))),f=(S)=>e.array(e.string({error:"must be a non-empty path string"}),{error:"must be an array of paths"}).check(t((C,_)=>{if(!Array.isArray(C))return;let E=Tt();C.forEach((T,O)=>{if(typeof T!=="string")return;let M=S(T,E);if(M)_.addIssue({code:"custom",message:M,path:[O]})})})),d=e.strictObject({version:e.literal(1),safety:e.strictObject({level:e.enum(["standard","strict","paranoid"]).optional(),overrides:u.optional()}).optional(),workflow:e.strictObject({worktree_mode:e.boolean().optional()}).optional(),destructive_command_protection:e.strictObject({enabled:e.boolean().optional(),overrides:m(qr,"destructive command").optional(),allow_paths:f(Go).optional()}).optional(),secret_protection:e.strictObject({enabled:e.boolean().optional(),overrides:m(Si,"secret protection").optional(),deny_paths:f(zo).optional(),allow_paths:f($o).optional()}).optional(),audit:e.strictObject({retention_days:e.number({error:vi}).int(vi).min(Ea,vi).max(wa,vi).optional().describe("Days of audit log history to keep before the sweep deletes it")}).optional()}),p=(S)=>{let C=(O,M)=>S==="legacy"?O:M,_=C("must match pattern (letters, numbers, hyphens, underscores)","must match command pattern"),E=`required non-empty string up to ${ln} characters`,T=e.looseObject({name:e.string({error:"required string"}).regex(Te,C("must match pattern (letters, numbers, hyphens, underscores; max 64 chars)","must match rule name pattern")),command:e.string({error:C("required string","required string matching command pattern")}).regex(Mt,C(_,"required string matching command pattern")),subcommand:e.string({error:C("must be a string if provided","must match command pattern")}).regex(Mt,_).optional(),block_args:e.array(e.string({error:C("must be a string","must be a non-empty string")}).refine((O)=>O!=="",{error:C("must not be empty","must be a non-empty string")}),{error:C("required array","required non-empty array")}).refine((O)=>O.length>0,{error:C("must have at least one element","required non-empty array")}),reason:e.string({error:C("required string",E)}).refine((O)=>O!=="",{error:C("must not be empty",E)}).refine((O)=>O.length<=ln,{error:C(`must be at most ${ln} characters`,E)}),intent:n.optional()},{error:"must be an object"});return e.array(T,{error:C("must be an array","required array")}).check(t((O,M)=>{if(!Array.isArray(O))return;let F=new Set;O.forEach((oe,xe)=>{let w=Ie(oe)?oe.name:void 0;if(typeof w!=="string")return;if(F.has(w.toLowerCase())){M.addIssue({code:"custom",message:`duplicate rule name "${w}"`,path:[xe,"name"]});return}F.add(w.toLowerCase())})}))},g=e.looseObject({version:e.literal(1),rules:p("legacy").optional()}),y="required string matching rule name pattern",h=e.looseObject({command:e.string({error:"required non-empty string"}).refine((S)=>S.trim()!=="",{error:"required non-empty string"}),expect:e.enum(["blocked","allowed"]),rule:e.string({error:"must be a string if provided"}).optional()},{error:"must be an object"}).check(t((S,C)=>{if(!Ie(S))return;if(S.expect!=="blocked"||typeof S.rule==="string")return;C.addIssue({code:"custom",message:"required string for blocked fixtures",path:["rule"]})})),R=e.looseObject({name:e.string({error:"required string matching rule name pattern"}).regex(Te,"required string matching rule name pattern"),version:e.string({error:"required non-empty string"}).refine((S)=>S!=="",{error:"required non-empty string"}),allowed_commands:e.array(e.string({error:"must match command pattern"}).regex(Mt,"must match command pattern"),{error:"required array"}).check(t((S,C)=>{if(!Array.isArray(S))return;let _=new Set;S.forEach((E,T)=>{if(typeof E!=="string"||!Mt.test(E))return;if(_.has(E)){C.addIssue({code:"custom",message:`duplicate command "${E}"`,path:[T]});return}_.add(E)})})),rules:p("rulebook"),tests:e.array(h,{error:"must be an array if provided"}).optional()}).check(t((S,C)=>{if(!Ie(S))return;let _=new Set(Da(S));if(Array.isArray(S.tests)){let T=new Set(S.tests.flatMap((O)=>Ie(O)&&O.expect==="blocked"&&typeof O.rule==="string"?[O.rule]:[]));for(let O of T){if(_.has(O))continue;C.addIssue({code:"custom",message:`blocked fixture references unknown rule "${O}"`,path:["tests"]})}}if(!Array.isArray(S.allowed_commands)||!Array.isArray(S.rules))return;let E=new Set(S.allowed_commands.filter((T)=>typeof T==="string"));S.rules.forEach((T,O)=>{let M=Ie(T)?T.command:void 0;if(typeof M!=="string"||E.has(M))return;C.addIssue({code:"custom",message:`"${M}" must be listed in allowed_commands`,path:["rules",O,"command"]})})})),x=e.string({error:"required string"}).refine((S)=>S.trim()!=="",{error:"required string"}),A=e.looseObject({spec:x,name:x,version:x,digest:e.string({error:"required sha256 digest"}).regex(nx,"required sha256 digest")},{error:"must be an object"}),P=e.looseObject({rulebooks:e.array(e.intersection(A,e.discriminatedUnion("kind",[e.object({kind:e.literal("local-directory"),path:x}),e.object({kind:e.literal("github"),owner:x,repo:x,ref:x,commit:x,path:x,display_ref:e.unknown().optional()})],{error:(S)=>{if(!Ie(S.input))return"must be an object";let C=S.input.kind;return typeof C==="string"?`unknown kind "${C}"`:"required string"}})))});return{RulesConfigSchema:l,RulesConfigDiagnosticSchema:c,RuleOverrideSchema:r,UserPolicySchema:d,LegacyConfigSchema:g,RulebookSchema:R,RulesLockfileSchema:P}}function Pn(){return _m??=ix(),_m}function Tm(){return Pn().RulesConfigSchema}function sx(){return Pn().UserPolicySchema}function SO(){return Pn().LegacyConfigSchema}function Im(){return Pn().RulebookSchema}function Om(){return Pn().RulesLockfileSchema}function Da(e){let t=Ie(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Ie(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Mm(e){let t=Pn().RulesConfigDiagnosticSchema.safeParse(e);if(t.success)return{errors:[],sources:new Set(t.data.rules)};return{errors:_n(Lm(t.error.issues,rx)),sources:ux(e,t.error.issues)}}function xr(e){let t=sx().safeParse(e);if(t.success)return[];return _n(Lm(t.error.issues,ox)," ")}function _n(e,t=": ",n=" "){return[...new Set(e.flatMap((r)=>Dm(r,t,n,[])))]}function Dm(e,t,n,r){let o=[...r,...e.path],i=cx(o);if(e.code==="unrecognized_keys")return e.keys.map((s)=>`${i?`${i}.`:""}unknown field "${s}"`);if(e.code==="invalid_key")return e.issues.map((s)=>s.message);if(e.code==="invalid_union"){let s=e.errors.flat().filter((a)=>a.path.length>0);if(s.length>0)return s.flatMap((a)=>Dm(a,t,n,o))}if(o.length===0)return[e.code==="invalid_type"?"Config must be an object":e.message];if(o.length===1&&(e.code==="too_big"||e.code==="too_small")&&e.origin==="array")return[e.message];return[`${i}${o.length===1?n:t}${ax(e)}`]}function ax(e){if(e.code==="invalid_value")return`must be ${lx(e.values)}`;if(e.code!=="invalid_type"||!e.message.startsWith("Invalid input:"))return e.message;if(e.expected==="object"||e.expected==="record")return"must be an object if provided";return e.expected==="boolean"?"must be a boolean":e.message}function lx(e){if(e.length>3)return`one of ${e.join(", ")}`;let t=e.map((n)=>typeof n==="string"?`"${n}"`:String(n));if(t.length<2)return`${t[0]}`;return`${t.slice(0,-1).join(", ")}${t.length>2?",":""} or ${t.at(-1)}`}function cx(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Lm(e,t){let n=e.map((i)=>i.path[1]),r=[...new Set(n.filter((i)=>typeof i==="string"))],o=(i,s)=>[i.path.length===0?-1:t.indexOf(String(i.path[0])),typeof s==="number"?s:r.indexOf(String(s)),i.code==="custom"?0:1];return e.map((i,s)=>({issue:i,rank:o(i,n[s])})).sort((i,s)=>i.rank[0]-s.rank[0]||i.rank[1]-s.rank[1]||i.rank[2]-s.rank[2]).map((i)=>i.issue)}function ux(e,t){let n=Ie(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Ie(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}import{randomBytes as dx}from"node:crypto";import{closeSync as Wa,constants as Er,fstatSync as La,fsyncSync as mx,lstatSync as At,mkdirSync as Nm,openSync as Wm,readdirSync as Fa,readFileSync as fx,realpathSync as Yt,renameSync as px,rmdirSync as Fm,statSync as Na,unlinkSync as Ga,writeFileSync as gx}from"node:fs";import{isAbsolute as Gm,join as An,normalize as hx,parse as zm,relative as za,resolve as $a,sep as Pr}from"node:path";var yx=Symbol("PolicyFilesystemScope"),Cx=Symbol("PolicyFilesystemTarget"),$m=Er.O_NOFOLLOW??0;class L extends Error{constructor(e){super(`Unable to access ${e} filesystem safely.`);this.name="PolicyFilesystemError"}}function Oe(e,t){return{[yx]:!0,root:$a(e),label:t}}function _r(e,t){let n=hx(t);if(t===""||Gm(t)||n===".."||n.startsWith(`..${Pr}`))throw new L(e.label);return{[Cx]:!0,scope:e,relativePath:n,path:An(e.root,n)}}function se(e,t){let n=za(e.root,$a(t));return _r(e,n)}function Ri(e,t="rules policy"){let n=$a(e),r=zm(n).dir;return _r(Oe(r,t),za(r,n))}function ft(e){try{if(!re(e,!1).exists)return null;let n=Wm(e.path,Er.O_RDONLY|$m);try{let r=La(n);if(!r.isFile())throw new L(e.scope.label);let o=fx(n,"utf-8"),i=At(e.path);if(!i.isFile()||i.isSymbolicLink()||r.dev!==i.dev||r.ino!==i.ino)throw new L(e.scope.label);return re(e,!1),o}finally{Wa(n)}}catch(t){pt(e.scope.label,t)}}function Bm(e,t,n=384,r){let o=`${e.path}.${dx(8).toString("hex")}.tmp`,i=null;try{vx(e),re(e,!0),i=Wm(o,Er.O_CREAT|Er.O_EXCL|Er.O_WRONLY|$m,n);let s=La(i);if(!s.isFile())throw new L(e.scope.label);gx(i,t,"utf-8"),mx(i);let a=La(i);if(!a.isFile()||a.dev!==s.dev||a.ino!==s.ino)throw new L(e.scope.label);Wa(i),i=null,re(e,!0),xx(e,o,a.dev,a.ino),px(o,e.path),r?.(e.path),re(e,!1)}catch(s){if(i!==null)wx(i);Px(o),pt(e.scope.label,s)}}function Um(e,t){if(e.path===t.path)return!0;try{if(!re(e,!1).exists||!re(t,!1).exists)return!1;return Yt(e.path)===Yt(t.path)}catch(n){if(n instanceof L)throw n;throw new L(e.scope.label)}}function bx(e){try{if(!re(e,!1,"directory").exists)return null;let n=Fa(e.path);return re(e,!1,"directory"),n}catch(t){pt(e.scope.label,t)}}function wO(e){let t=bx(e);if(!t)return null;try{let n=t.map((r)=>{let o=_r(e.scope,An(e.relativePath,r)),i=At(o.path);if(i.isSymbolicLink()||!i.isFile()&&!i.isDirectory())throw new L(e.scope.label);return xi(qm(e.scope),Yt(o.path),e.scope.label),{name:r,kind:i.isDirectory()?"directory":"file"}});return re(e,!1,"directory"),n}catch(n){pt(e.scope.label,n)}}function PO(e){try{if(!re(e,!0).exists)return;Ga(e.path),re(e,!0)}catch(t){pt(e.scope.label,t)}}function _O(e){try{Vm(e,e.relativePath.split(Pr))}catch(t){pt(e.scope.label,t)}}function AO(e){try{if(!Sx(e))return;jm(e),re(e,!0,"directory")}catch(t){pt(e.scope.label,t)}}function kO(e){try{if(!re(e,!0,"directory").exists)return;Fm(e.path),re(e,!0,"directory")}catch(t){pt(e.scope.label,t)}}function Sx(e){try{if(!re(e,!0,"directory").exists)return!1;return Hm(e),!0}catch(t){pt(e.scope.label,t)}}function re(e,t,n="file"){let r=Ba(e.scope);if(!r)return{exists:!1};let o=e.relativePath.split(Pr);for(let i of o.keys()){let s=An(e.scope.root,...o.slice(0,i+1)),a=wr(s);if(!a){if(i===o.length-1&&t)return{exists:!1};return{exists:!1}}if(a.isSymbolicLink())throw new L(e.scope.label);if(i<o.length-1&&!a.isDirectory())throw new L(e.scope.label);if(i===o.length-1&&(n==="file"?!a.isFile():!a.isDirectory()))throw new L(e.scope.label);xi(r,Yt(s),e.scope.label)}return{exists:!0}}function Hm(e){for(let t of Fa(e.path)){let n=_r(e.scope,An(e.relativePath,t)),r=At(n.path);if(r.isSymbolicLink()||!r.isDirectory()&&!r.isFile())throw new L(e.scope.label);if(r.isDirectory())Hm(n)}re(e,!1,"directory")}function jm(e){for(let t of Fa(e.path)){let n=_r(e.scope,An(e.relativePath,t)),r=At(n.path);if(r.isSymbolicLink())throw new L(e.scope.label);if(r.isDirectory()){jm(n);continue}if(!r.isFile())throw new L(e.scope.label);Ga(n.path)}Fm(e.path)}function vx(e){Vm(e,e.relativePath.split(Pr).slice(0,-1))}function Vm(e,t){Rx(e.scope);let n=qm(e.scope);for(let r of t.keys()){let o=An(e.scope.root,...t.slice(0,r+1));if(!wr(o))Nm(o,{mode:448});let s=At(o);if(!s.isDirectory()||s.isSymbolicLink())throw new L(e.scope.label);xi(n,Yt(o),e.scope.label)}}function Rx(e){if(wr(e.root)){if(!Na(e.root).isDirectory())throw new L(e.label);return}let t=[],n=e.root;while(!wr(n)){t.unshift(n);let r=zm(n).dir;if(r===n)throw new L(e.label);n=r}if(!Na(n).isDirectory())throw new L(e.label);for(let r of t){Nm(r,{mode:448});let o=At(r);if(!o.isDirectory()||o.isSymbolicLink())throw new L(e.label)}}function Ba(e){if(!wr(e.root))return null;if(!Na(e.root).isDirectory())throw new L(e.label);return Yt(e.root)}function qm(e){let t=Ba(e);if(!t)throw new L(e.label);return t}function xx(e,t,n,r){let o=At(t);if(!o.isFile()||o.isSymbolicLink()||o.dev!==n||o.ino!==r)throw new L(e.scope.label);let i=Ba(e.scope);if(!i)throw new L(e.scope.label);xi(i,Yt(t),e.scope.label)}function xi(e,t,n){let r=za(e,t);if(r===".."||r.startsWith(`..${Pr}`)||Gm(r))throw new L(n)}function wr(e){try{return At(e)}catch(t){if(Ex(t)&&t.code==="ENOENT")return null;throw t}}function pt(e,t){if(t instanceof L)throw t;throw new L(e)}function Ex(e){return e instanceof Error&&"code"in e}function wx(e){try{Wa(e)}catch{}}function Px(e){try{Ga(e)}catch{}}var Km={version:1,rules:[],overrides:{},transparent_wrappers:[]};function _x(e){return Mm(e)}function kn(e){try{let t=ft(Ym(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=_x(n);if(r.errors.length>0)return{config:null,errors:r.errors};let o=Tm().parse(n);return{config:{version:1,rules:o.rules??[],overrides:o.overrides??{},transparent_wrappers:o.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof L)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function LO(e){let t=kn(e);if(t.errors.length>0)return{ok:!1,result:{ok:!1,errors:t.errors,warnings:[],entries:[]}};return{ok:!0,config:t.config??Km}}function NO(e,t=[]){Ei(e,{version:1,rules:t,overrides:{},transparent_wrappers:[]})}function WO(e,t="project-rules"){Ei(e,{rulebook_version:1,name:t,version:"1.0.0",description:t==="project-rules"?"Project-specific CC Safety Net rules.":"User-specific CC Safety Net rules.",author:t==="project-rules"?"project":"user",allowed_commands:["docker"],rules:[{name:"block-docker-system-prune",command:"docker",subcommand:"system",block_args:["prune"],reason:"Use targeted cleanup instead."}],tests:[{command:"docker system prune",expect:"blocked",rule:"block-docker-system-prune"}]})}function Ei(e,t,n,r){Bm(Ym(e),`${JSON.stringify(t,null,2)}
-`,n,r)}function Ym(e){return typeof e==="string"?Ri(e):e}import{homedir as Ax}from"node:os";import{dirname as rt,isAbsolute as kx,join as He,relative as Tx,resolve as ot,sep as Ix}from"node:path";var Xm="rule.json",Jm="policy.json",Qm="rule.lock",Ox="config.json",ef=".cc-safety-net",Mx="rules",Zm="cache",Dx="CC_SAFETY_NET_HOME",je="`cc-safety-net rule sync`";function Lx(e){return ot(e??process.cwd(),yi)}function tf(e){return He(Lx(e),Xm)}function Xt(e){return e?.userConfigDir??(e?.userConfigPath?rt(e.userConfigPath):He(Nx(),Mx))}function Nx(){let e=process.env[Dx];return e?ot(e):He(Ax(),ef)}function nf(e){return He(Xt(e),Xm)}function HO(e){return He(Xt(e),Qm)}function Zt(e){return He(rt(e),Qm)}function jO(e={}){return He(rt(Xt(e)),Ox)}function VO(e={}){return ot(e.cwd??process.cwd(),".safety-net.json")}function rf(e){let t=e.userConfigPath??nf(e),n=e.projectConfigPath??tf(e.cwd),r=of(t,e),o=sf(n,e);return{userConfigPath:t,projectConfigPath:n,userLockPath:Zt(t),projectLockPath:Zt(n),userScope:r,projectScope:o,userConfigTarget:se(r,t),projectConfigTarget:se(o,n),userLockTarget:se(r,Zt(t)),projectLockTarget:se(o,Zt(n))}}function qO(e){let t=e.global?e.userConfigPath??nf(e):e.projectConfigPath??tf(e.cwd),n=e.global?of(t,e):sf(t,e),r=Zt(t);return{configDir:rt(t),configPath:t,lockPath:r,filesystemScope:n,configTarget:se(n,t),lockTarget:se(n,r)}}function of(e,t){let n=t.userConfigPath?rt(rt(ot(t.userConfigPath))):rt(ot(t.userConfigDir??Xt(t)));return Oe(n,"user policy")}function sf(e,t){let n=ot(t.cwd??process.cwd()),r=ot(e),o=Tx(n,r);if(o!==".."&&!o.startsWith(`..${Ix}`)&&!kx(o))return Oe(n,"project policy");return Oe(rt(rt(r)),"project policy")}function af(e){if(e.kind==="github"&&e.display_ref)return`${e.owner}/${e.repo}#${e.display_ref}/${e.name}`;return e.spec}function wi(e,t){let n=e.digest.startsWith("sha256:")?e.digest.slice(7):e.digest;return He(lf(t),"rulebooks",`${Wx(e)}--${n.slice(0,12)}`,hi)}function KO(e){return He(lf(e),"rulebooks")}function Pi(e,t){let n=t;return{cacheConfigDir:e,cwd:t.cwd,global:n.global}}function Wx(e){return(e.kind==="github"&&e.display_ref?`${e.owner}/${e.repo}#${e.display_ref}/${e.name}`:e.spec).toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"rulebook"}function lf(e){let t=e?.cacheConfigDir??Xt(e),n=e;if(n&&!n.global&&n.cwd&&ot(t)===ot(n.cwd))return He(ot(n.cwd),ef,Zm);return He(rt(t),Zm)}var $x=new Set(["standard","strict","paranoid"]),Ai={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:gm}};function In(e){return zx(df(Xt(e)),Jm)}function lM(e={}){let t=In(e);if(!Ua(t))return{path:t,exists:!1,raw:"",policy:Ar(),errors:[]};let n=Ha(t,"utf-8");if(!n.trim())return{path:t,exists:!0,raw:n,policy:Ar(),errors:["Config file is empty"]};try{let r=JSON.parse(n),o=xr(r);return{path:t,exists:!0,raw:n,policy:Tn(r),errors:o}}catch(r){return{path:t,exists:!0,raw:n,policy:Ar(),errors:[`Invalid JSON: ${r instanceof Error?r.message:String(r)}`]}}}function _i(e,t={}){let n=In(t),r=xr(e),o=r.length>0?Ar():Tn(e);if(r.length>0)return{path:n,policy:o,errors:r};return Gx(df(n),{recursive:!0,mode:448}),Ei(n,o,384),Fx(n,384),{path:n,policy:o,errors:[]}}function cM(e){let t=xr(e);if(t.length>0)return{errors:t};return{preview:Bx(Tn(e)),errors:[]}}function Bx(e){let t=fi({safety:pf(e.safety)}),n=Vi({destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides},t.capabilities),r=Object.values(n),o=r.filter((i)=>i.source!=="catastrophic");return{selectedPreset:e.safety.level,effectiveLevel:t.effectiveLevel,capabilities:t.capabilities,rules:n,counts:{enabled:o.filter((i)=>i.enabled).length,disabled:o.filter((i)=>!i.enabled).length,effectiveCustomizations:r.filter((i)=>i.changesInherited).length}}}function uM(e={}){let t=In(e);if(!Ua(t))return _i(Ai,e);let n=Ha(t,"utf-8");if(!n.trim())return _i(Ai,e);try{return _i(Tn(JSON.parse(n)),e)}catch{return _i(Ai,e)}}function mf(e={}){let t=Vx(In(e));return{...t.policy,errors:t.errors,...t.fallback?{fallback:t.fallback}:{}}}function Tn(e){if(!it(e))return Ar();let t=it(e.safety)?e.safety:{},n=it(t.overrides)?t.overrides:{},r=it(e.workflow)?e.workflow:{},o=it(e.destructive_command_protection)?e.destructive_command_protection:{},i=it(e.secret_protection)?e.secret_protection:{};return{version:1,safety:{level:$x.has(t.level)?t.level:"standard",overrides:{...typeof n.fail_closed==="boolean"?{fail_closed:n.fail_closed}:{},...typeof n.paranoid_rm==="boolean"?{paranoid_rm:n.paranoid_rm}:{},...typeof n.paranoid_interpreters==="boolean"?{paranoid_interpreters:n.paranoid_interpreters}:{}}},workflow:{worktree_mode:typeof r.worktree_mode==="boolean"?r.worktree_mode:!1},destructive_command_protection:{enabled:typeof o.enabled==="boolean"?o.enabled:!0,overrides:cf(o.overrides,qr),allow_paths:Hx(o.allow_paths)},secret_protection:{enabled:typeof i.enabled==="boolean"?i.enabled:!0,overrides:cf(i.overrides,Si),deny_paths:Ux(i.deny_paths),allow_paths:jx(i.allow_paths)},audit:{retention_days:hm(it(e.audit)?e.audit.retention_days:void 0)}}}function cf(e,t){if(!it(e))return{};return Object.fromEntries(Object.entries(e).flatMap(([n,r])=>t.has(n)&&(r==="on"||r==="off")?[[n,r]]:[]))}function Ux(e){if(!Array.isArray(e))return[];let t=Tt();return e.filter((n)=>zo(n,t)===null)}function Hx(e){if(!Array.isArray(e))return[];let t=Tt();return e.filter((n)=>Go(n,t)===null)}function jx(e){if(!Array.isArray(e))return[];let t=Tt();return e.filter((n)=>$o(n,t)===null)}function it(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ar(){return structuredClone(Ai)}function Vx(e){let t=qx();if(!Ua(e)){let n=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!it(n))return{policy:t,errors:[]};return{policy:uf(Tn(n)),errors:[]}}try{let n=Ha(e,"utf-8");if(!n.trim())return{policy:t,errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=xr(r),i=uf(Tn(r));if(o.length>0)return{policy:i,errors:o.map((s)=>`${e}: ${s}`),fallback:it(r)?"salvaged":"defaults"};return{policy:i,errors:[]}}catch(n){let r=n instanceof Error?n.message:String(n);return{policy:t,errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}function ff(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Pm].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function qx(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:ff({}),denyPaths:[],allowPaths:[]}}}function uf(e){return{safety:pf(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:ff(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function pf(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}var Cf="This path contains the protected policy config and you must not modify or delete it.",Yx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function bf(e){let t=Ot(at()),n=tE(e.invocation.context.executionCwd,t);if(e.invocation.route.kind==="patch")return gf(e.paths,!1,e.invocation.context.executionCwd,n,t);let r=Ce(e,"input-candidate");if(e.invocation.route.kind==="command")return r?hf(r.shell,e.invocation.context.executionCwd,n,t):null;if(e.invocation.route.kind==="unknown"&&r){let o=hf(r.shell,e.invocation.context.executionCwd,n,t);if(o)return o}return gf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Io(e.invocation.toolName),e.invocation.context.executionCwd,n,t)}function gf(e,t,n,r,o){if(t)return null;let i=e.find((s)=>kr(s,n,r,o));return i?{target:i}:null}function hf(e,t,n,r){let o=Do(e,t,r,{findSegmentTarget:(i,s)=>Zx(i,s,n,r)?.target??null,isRedirectionTarget:(i,s)=>kr(i,s.cwd,n,r),findMalformedTarget:(i)=>eE(i,t,n,r)?.target??null,normalizeCwd:le});return o?{target:o}:null}function Zx(e,t,n,r){if(er(e))return null;let o=r.environment,i=St([...e],o),s=D(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&Xx(a)){let l=Jx(a).find((c)=>yf(be(c,t.variables),t.cwd,n,r));if(l)return{target:l}}if(s==="find"){if(Yo(i,1)||Ns(i,o)){let c=(Ko(G(i))??G(["."])).find((u)=>{let m=be(u.text,t.variables);return kr(m,t.cwd,n,r)||yf(m,t.cwd,n,r)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Lo(a).sources.find((c)=>nE(be(c,t.variables),t.cwd,n,r));if(l)return{target:l}}if(Qx(e,o))return null;for(let l of[...e,...i])for(let c of Sf(l))if(kr(be(c,t.variables),t.cwd,n,r))return{target:c};return null}function Xx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Jx(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Qx(e,t){let n=St([...e],t);if(n.length===0)return!1;let r=D(n[0]??"").toLowerCase();if(!Yx.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function eE(e,t,n,r){for(let o of e.split(/\s+/))for(let i of Sf(o))if(kr(i,t,n,r))return{target:i};return null}function Sf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function tE(e,t){let n=le(In(),e,t),r=ja(n),o=new Set;for(let i=r;;i=ja(i))if(o.add(On(i)),ja(i)===i)break;return{file:On(n),directoryAndAncestors:o}}function kr(e,t,n,r){let o=nu(e,t,r,(i)=>On(i)===Kx(n.file));return o!==null&&On(o)===n.file}function yf(e,t,n,r){return n.directoryAndAncestors.has(On(le(e,t,r)))}function nE(e,t,n,r){let o=On(le(e,t,r));return o===n.file||n.directoryAndAncestors.has(o)}function On(e){return process.platform==="win32"?e.toLowerCase():e}import{homedir as qa}from"node:os";import{isAbsolute as ki,posix as rE,resolve as Ii,win32 as oE}from"node:path";import{fileURLToPath as iE}from"node:url";var If="Access to a sensitive path is not allowed.",Of=new Set(["echo","printf"]),sE=new Set(["find"]),aE=new Set(["-exec","-execdir"]),lE=new Set([";","+"]),cE=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),uE=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),dE=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),mE=new Set(["node","bun"]),fE=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),pE=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","popen","read","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Mf=new Set(["-c","-e","-r","-E","--eval","--exec"]),gE=new Set(["src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js"]),vf=new Set(["cc-safety-net","ccsn"]),hE=new Set(["bunx","npx","pnpx"]),yE=new Set(["bun","node"]),CE=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),bE=new Set(["grep","rg"]),Rf="f",xf="file",SE="files",vE=new Set(["e","f"]),RE=new Set(["regexp","file"]),xE=new Set(["e","f","A","B","C","m"]),EE=new Set(["regexp","file","after-context","before-context","context","max-count"]),wE=new Set(["|","|&"]),Va="__CC_SAFETY_NET_PIPE_INPUT__",Df=new Set(["bash","sh","zsh","dash","ksh"]),PE=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Ef(e,t,n,r,o){let i=Xr();for(let s of e){if(fw(s,t,n?.denyPaths??[],r,i))return{target:s,ruleId:"secret.deny-path"};if(o&&!o.has(s))continue;let a=dw(s,t,n,i);if(a){if(!a.startsWith("secret.cli.")&&pw(s,t,n?.allowPaths??[],r,i))continue;return{target:s,ruleId:a}}}return null}function Lf(e,t,n={}){let r=wf(e),o=Ef(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd),i=o?.ruleId!=="secret.deny-path"&&n.strict===!1?wf(e,{refineJavaScriptInlineData:!0}):r,s=i.length===r.length?o:Ef(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd,new Set(i));if(s?.ruleId!=="secret.deny-path"&&n.strict===!1&&_E(e))return null;return s}function _E(e){if(e.invocation.route.kind!=="command")return!1;let t=Ce(e,"input-candidate")??Ce(e,"declared-command");if(!t)return!1;if(t.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let n=[];for(let s of t.shell.entries){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind!=="operator")n.push(Xe(s.text))}let r=Mn(n);if(r.length===0)return!1;let o=Qt(r[0]??"").toLowerCase(),i=r.slice(1);if(o==="ls"||o==="stat")return!0;if(o==="test")return i.length===2&&(i[0]==="-e"||i[0]==="-f");if(o!=="find")return!1;return!i.some((s)=>cE.has(s))}function wf(e,t={}){if(e.invocation.route.kind==="command"){let r=Ce(e,"input-candidate");return r?Or(r.shell,e.store,t):[]}if(e.invocation.route.kind!=="unknown")return[...e.paths];let n=Ce(e,"input-candidate");return[...n?Or(n.shell,e.store,t):[],...e.paths]}function Or(e,t,n){if(e.status==="structural-limit")throw new Rt;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let r=[...e.assignmentFallbacks,...qE(Xe(e.source),t,n)],o=[],i=null;for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;if(o.length>0){if(r.push(...Ti(o,t,n)),i!==null)r.push(..._f(i,o,t,n));i=wE.has(s.operator)?o:null,o=[]}else i=null;continue}if(s.kind==="redirection"){let a=s.target?Xe(s.target):void 0;if(a&&s.targetOrder==="legacy-segment")o.push(a);else if(a)r.push(a);continue}o.push(Xe(s.text))}if(o.length>0){if(r.push(...Ti(o,t,n)),i!==null)r.push(..._f(i,o,t,n))}return r}function Ti(e,t,n){let r=WE(e),o=Mn(e);if(o.length===0)return r;let i=o[0]??"",s=Qt(i).toLowerCase(),a=o.slice(1),l=kE(i,s,a);if(l)return[...r,...l];if(Of.has(s))return r;if(bE.has(s))return[...r,...tw(a)];if(sE.has(s))return[...r,...FE(a,t,n)];if(Se.has(s))return[...r,...a.flatMap((c)=>Af("awk",c)),...a.flatMap((c)=>zE(c,t,n)),...a.flatMap($E)];if(Ff(s)){if(Df.has(s)){let c=Qc(s,a);if(c!==null&&t.getShellSyntax(c).status==="structural-limit")throw new Rt}return[...r,...GE(s,a,n)]}return[...r,...a.flatMap((c)=>Af(s,c))]}function AE(e,t){if(vf.has(e))return t[0]==="explain"?0:null;if(hE.has(e)){let n=t[0]==="-y"||t[0]==="--yes"?1:0;return vf.has(t[n]??"")&&t[n+1]==="explain"?n+1:null}if(yE.has(e)){if(Pf(t[0])&&t[1]==="explain")return 1;if(e==="bun"&&t[0]==="run"&&Pf(t[1])&&t[2]==="explain")return 2}return null}function kE(e,t,n){let r=AE(t,n);if(r===null)return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Pf(e){let t=e?.replaceAll("\\","/");return[...gE].some((n)=>t===n||t?.endsWith(`/${n}`))}function _f(e,t,n,r){if(DE(t,n,r))return TE(e);let o=LE(t);if(o===null)return[];return IE(e).flatMap((i)=>Df.has(o)?Or(n.getShellSyntax(i),n,r):zf(i))}function TE(e){let t=Mn(e);if(t.length===0)return[];let n=Qt(t[0]??"").toLowerCase();if(!Of.has(n))return[];return t.slice(1)}function IE(e){let t=Mn(e);if(t.length===0)return[];let n=Qt(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return OE(r);return[]}function OE(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Nf(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>ME(t,r.slice(i*n,(i+1)*n)))}function ME(e,t){let n=0;return Nf(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Nf(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function DE(e,t,n){let r=Mn(e);if(r.length===0||Qt(r[0]??"").toLowerCase()!=="xargs")return!1;let o=Ut(r),i=r.slice(o.childStart);if(i.length===0)return!1;if(o.replacementToken==="")return!1;let s=o.replacementToken,a=s===null?[...i,Va]:i.map((l)=>l.split(s).join(Va));return Ti(a,t,n).some((l)=>l.includes(Va))}function LE(e){let t=Mn(e);if(t.length===0)return null;let n=Qt(t[0]??"").toLowerCase();if(!Ff(n))return null;return NE(n,t.slice(1))?n:null}function NE(e,t){let n=Wf(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Mf.has(o)||Gf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(PE.get(n)?.has(o))r++;continue}return!1}return!0}function Wf(e){return/^python\d/.test(e)?"python":e}function WE(e){let t=[];for(let n of e){if(Uf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}function Af(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function FE(e,t,n){let r=e.findIndex((i)=>i.startsWith("-")||i==="("||i==="!"||i===";"),o=[...e.slice(0,r===-1?e.length:r)];for(let i=0;i<e.length;i++){if(!aE.has(e[i]??""))continue;let s=e.slice(i+1),a=s.findIndex((u)=>lE.has(u)),l=a===-1?s:s.slice(0,a),c=Ti(l,t,n);if(o.push(...c.filter((u)=>u!=="{}")),!c.includes("{}"))continue;o.push(...e.slice(0,i).flatMap((u,m,f)=>{if(!uE.has(u))return[];let d=f[m+1];return d===void 0?[]:[d,d.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return o}function Ff(e){return dE.has(e)||/^python\d/.test(e)}function GE(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o];if(i===void 0)break;if(Mf.has(i)||Gf(e,i)){let a=t[o+1];if(a!==void 0)r.push(...kf(e,a,n)),o++;continue}let s=/^--(?:eval|exec)=(.*)$/.exec(i);if(s!==null&&s[1]!==void 0){r.push(...kf(e,s[1],n));continue}if(!i.startsWith("-"))r.push(i)}return r}function Gf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return CE.get(t[t.length-1]??"")?.has(Wf(e))??!1}function zE(e,t,n){if(!e.includes("system"))return[];return Os(e)?.commands.flatMap((r)=>Or(t.getShellSyntax(r),t,n))??[]}function $E(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function zf(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(/[\w./~@+-]*[./~][\w./~@+-]*/g)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap($f),...n]}function kf(e,t,n){let r=zf(t);if(!n.refineJavaScriptInlineData||!mE.has(e)||r.length===0)return r;let o=BE(t);return o!==null&&!HE(o)?[]:r}function BE(e){let t=e.split("");for(let n=0;n<e.length;n++){let r=e[n];if(r!=="'"&&r!=='"'&&r!=="`")continue;if(r==="`"&&UE(e,n))return null;t[n]=" ";let o=!1;for(let i=n+1;i<e.length;i++){let s=e[i];if(t[i]=" ",s==="\\"){if(i++,i<e.length)t[i]=" ";continue}if(r==="`"&&s==="$"&&e[i+1]==="{")return null;if(r!=="`"&&(s===`
-`||s==="\r"))return null;if(s!==r)continue;n=i,o=!0;break}if(!o)return null}return t.join("")}function UE(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function HE(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(fE.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>pE.has(i)))continue;if(o.length>1)return!0;if(jE(e,r)===".")return!0;if(VE(e,r+n.length)==="(")return!0}return!1}function jE(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function VE(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function qE(e,t,n){return JE(e).flatMap((r)=>{let o=t.getShellSyntax(r);if(o.status==="invalid")return[];return[...Or(o,t,n),...KE(o)?YE(o):[]]})}function KE(e){let t=e.entries;for(let n=0;n<t.length;n++){let r=t[n];if(r?.kind!=="word"||Qt(Xe(r.text)).toLowerCase()!=="base64")continue;for(let o=n+1;o<t.length;o++){let i=t[o];if(i?.kind==="operator")break;if(i?.kind!=="word")continue;let s=Xe(i.text);if(s==="--decode"||!s.startsWith("--")&&s.startsWith("-")&&/[dD]/.test(s))return!0}}return!1}function YE(e){return e.entries.flatMap((t)=>t.kind==="word"?[Xe(t.text)]:t.kind==="redirection"&&t.target?[Xe(t.target)]:[]).flatMap($f)}function $f(e){let t=XE(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||ZE(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function ZE(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function XE(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function JE(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Yn(o,n))continue;if(Bf(e,r,n)){let i=QE(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=ew(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function QE(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Yn(i,n))continue;if(Bf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function ew(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Bf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function tw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",f=u[2];if(m===SE)o=!0;if(RE.has(m))r=!0;if(f!==void 0){if(m===xf)t.push(f);continue}if(EE.has(m)){let d=e[l+1];if(m===xf&&d!==void 0)t.push(d);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),f="",d="";for(let p=0;p<m.length;p++){let g=m[p]??"";if(vE.has(g))r=!0;if(xE.has(g)){f=g,d=m.slice(p+1);break}}if(f!=="")if(d.length>0){if(f===Rf)t.push(d)}else{let p=e[l+1];if(f===Rf&&p!==void 0)t.push(p);l++}continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Mn(e){let t=e.findIndex((n)=>!Uf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Uf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var nw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),rw=".env.",ow=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),iw=[".env.example.",".env.sample."];function sw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function aw(e){return e.length>0&&!/\s/.test(e)}function lw(e,t,n){try{let r=Mr(e,t,n);return r!==""&&Me.entryKind(r)!=="missing"}catch(r){if(r instanceof we)throw r;return!1}}var cw=new Set(["node_modules","__pycache__"]),uw=[["vendor","bundle"],["vendor","cache"]];function dw(e,t,n,r){if(sw(e))return null;let o=ht(e,t,r);if(!o)return null;let i=K(o.split("/").pop()??""),s=K(o),a=()=>aw(i)||lw(e,t,r);if(ow.has(i)||iw.some((m)=>i.startsWith(m)))return null;let l=K(yw(e,t,r));for(let m of ka){let f=`~/${m.suffixParts.join("/")}`;if((Tf(s,f)||Tf(l,f))&&gt(m.id,n))return m.id}let c=mw(o,t,n,r);if(c)return c;if(nw.has(i))return null;for(let m of Aa)if(i===m.basename&&gt(m.id,n))return m.id;if(i.startsWith(rw)&&gt(Ci.id,n)&&a())return Ci.id;for(let m of Ta)if(i.length>m.prefix.length&&i.startsWith(m.prefix)){let f=i.slice(m.prefix.length)[0];if((f==="-"||f==="_")&&gt(m.id,n)&&a())return m.id}for(let m of Ia)if(i.length>m.prefix.length&&i.startsWith(m.prefix)){if(i.slice(m.prefix.length)===m.suffix&&gt(m.id,n))return m.id}if(gw(s))return null;if(!i.includes(".")&&Rr.pattern.test(i)&&gt(Rr.id,n))return Rr.id;let u=hw(i,n);if(u)return u;return null}function mw(e,t,n,r){return bi.find((o)=>{if(!gt(o.id,n))return!1;switch(o.id){case"secret.cli.claude-code":return q(e,Z(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),[".credentials.json"]);case"secret.cli.claude-code.config":{let i=K(e).split("/");return q(e,Z(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),["settings.json","settings.local.json"])||Ir(e,"~/.claude.json",t,r)||i.at(-1)==="settings.local.json"&&i.at(-2)===".claude"||i.at(-1)===".mcp.json"}case"secret.cli.antigravity":return q(e,ht("~/.gemini/config",t,r),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let i=Z(process.env.CODEX_HOME,"~/.codex",t,r);return q(e,i,["auth.json",".credentials.json"])||Tr(e,i,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let i=Z(process.env.CODEX_HOME,"~/.codex",t,r),s=K(e).split("/").at(-1)??"";return q(e,i,["config.toml"])||s.endsWith(".config.toml")&&q(e,i,[s])}case"secret.cli.gemini":return q(e,ae(Z(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let i=K(e).split("/"),s=process.env.ProgramData?[ae(Z(process.env.ProgramData,"",t,r),"gemini-cli")]:[];return q(e,ae(Z(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["settings.json","google_accounts.json"])||i.at(-1)==="settings.json"&&i.at(-2)===".gemini"||(process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH?.trim()?Ir(e,process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH,t,r):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...s].some((a)=>q(e,ht(a,t,r),["settings.json"]))}case"secret.cli.copilot-cli":{let i=Z(process.env.COPILOT_HOME,"~/.copilot",t,r);return q(e,i,["config.json"])||Tr(e,i,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return q(e,Z(process.env.COPILOT_HOME,"~/.copilot",t,r),["mcp-config.json"]);case"secret.cli.kimi-code":{let i=Z(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),s=Z(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r);return q(e,i,["server.token"])||Tr(e,i,["credentials"])||Tr(e,s,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let i=["config.toml","mcp.json"],s=K(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".kimi-code"||q(e,Z(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),i)||q(e,Z(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r),[...i,"config.json","config.json.bak"])}case"secret.cli.opencode":{let i=ae(Z(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"opencode"),s=K(e).split("/").at(-1)??"",a=process.env.OPENCODE_DB?.trim(),l=a&&a!==":memory:"?[a,`${a}-wal`,`${a}-shm`]:[];return q(e,i,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(s)&&q(e,i,[s])||l.some((c)=>Ir(e,c,t,r))}case"secret.cli.opencode.config":{let i=process.env.OPENCODE_CONFIG_DIR?Z(process.env.OPENCODE_CONFIG_DIR,"~/.config/opencode",t,r):ae(Z(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"opencode"),s=process.env.ProgramData?[ae(Z(process.env.ProgramData,"",t,r),"opencode")]:[],a=["opencode.json","opencode.jsonc"];return a.includes(K(e).split("/").at(-1)??"")||q(e,i,a)||(process.env.OPENCODE_CONFIG?.trim()?Ir(e,process.env.OPENCODE_CONFIG,t,r):!1)||["/Library/Application Support/opencode","/etc/opencode",...s].some((l)=>q(e,ht(l,t,r),a))}case"secret.cli.pi":return q(e,Z(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["auth.json"]);case"secret.cli.pi.config":return q(e,Z(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["models.json"]);case"secret.cli.amp":{let i=ht("~",t,r);return[ae(Z(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"amp"),ae(i,".local","share","amp")].some((a)=>q(e,a,["secrets.json"]))||Tr(e,ae(i,".amp"),["oauth"])}case"secret.cli.amp.config":{let i=["settings.json","settings.jsonc"],s=[ae(Z(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"amp"),ae(ht("~",t,r),".config","amp")],a=K(e).split("/");return s.some((l)=>q(e,l,i))||a.at(-2)===".amp"&&i.includes(a.at(-1)??"")||(process.env.AMP_SETTINGS_FILE?.trim()?Ir(e,process.env.AMP_SETTINGS_FILE,t,r):!1)}case"secret.cli.cursor":{let i=ae(Z(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"cursor"),s=ae(Z(process.env.CURSOR_DATA_DIR,"~/.cursor",t,r),"projects");return q(e,ht("~/.cursor",t,r),["auth.json"])||q(e,i,["auth.json"])||K(e).split("/").at(-1)==="mcp-auth.json"&&Jt(K(e),K(s))}case"secret.cli.cursor.config":{let i=K(e).split("/");return i.at(-1)==="mcp.json"&&i.at(-2)===".cursor"}default:return!1}})?.id??null}function Z(e,t,n,r){return ht(e?.trim()?e:t,n,r)}function q(e,t,n){return n.some((r)=>Hf(e,ae(t,r)))}function Tr(e,t,n){return n.some((r)=>Jt(K(e),K(ae(t,r))))}function Ir(e,t,n,r){return Hf(e,ht(t,n,r))}function Hf(e,t){return K(e)===K(t)}function ae(e,...t){return Ve([e,...t].filter(Boolean).join("/"))}function fw(e,t,n,r,o){if(n.length===0)return!1;let i=K(Mr(e,t,o));return n.some((s)=>Jt(i,K(Mr(s,r,o))))}function pw(e,t,n,r,o){if(n.length===0)return!1;let i=K(Mr(e,t,o));if(!i)return!1;let s=process.env.HOME??qa(),a=s?Ve(U(s,Me,o)):"",l=K(a),c=process.env.CC_SAFETY_NET_HOME,u=K(c?Ve(U(Ii(c),Me,o)):a&&Ve(U(`${a}/.cc-safety-net`,Me,o)));if(u&&Jt(i,u))return!1;return n.some((m)=>{let f=K(Mr(m,r,o));if(!f)return!1;if(l&&(l===f||l.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Jt(i,f)})}function gw(e){let t=e.split("/");return t.some((n)=>cw.has(n))||uw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function hw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Oa)if(r===o.extension&&gt(o.id,t))return o.id;for(let o of Ma)if(o.pattern.test(r)&&gt(o.id,t))return o.id;return null}function K(e){return e.toLowerCase()}function gt(e,t){return!t?.disabledRules?.includes(e)}function ht(e,t,n){let{home:r,normalized:o}=Ka(e,n);if(!o)return"";if(!r)return o;let i=Ya(o,r),s=ki(i)?i:Ve(Ii(t,i)),a=Ve(U(s,Me,n));if(!Jt(a,r)){if(ki(i))return a;return a===s?o:a}let l=a.slice(r.length);return l?`~${l}`:"~"}function Tf(e,t){return e===t||e.startsWith(`${t}/`)}function yw(e,t,n){let{home:r,normalized:o}=Ka(e,n);if(!o||!r)return"";let i=Ya(o,r),s=rE.normalize(ki(i)?i:Ve(Ii(t,i))),a=Ve(process.env.HOME??qa()),l=(m)=>process.platform==="win32"?m.toLowerCase():m,c=[r,a].find((m)=>m!==""&&Jt(l(s),l(m)));if(c===void 0)return"";let u=s.slice(c.length);return u?`~${u}`:"~"}function Mr(e,t,n){let{home:r,normalized:o}=Ka(e,n);if(!o)return"";let i=r?Ya(o,r):o;return Ve(U(ki(i)?i:Ii(t,i),Me,n))}function Ka(e,t){let n=process.env.HOME??qa(),r=n?Ve(U(n,Me,t)):"",o=Ve(Cw(Xe(e)));return{home:r,normalized:o}}function Cw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return iE(e)}catch{return e}}function Ya(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function bw(e){if(process.platform==="win32")return!0;return oE.parse(e).root.length>1}function Ve(e){let t=e.trim(),n=(bw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Qt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}import{dirname as yt}from"node:path";var jf="Rulebook exceeds CC Safety Net's safe validation limits.",Vf="Additional rulebook validation errors were omitted.",qe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function qf(e){if(Za(e.allowed_commands,qe.maxAllowedCommands)||Za(e.rules,qe.maxRules)||Za(e.tests,qe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=qe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>qe.maxStringCodeUnits||i&&o.length>qe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;if(!Array.isArray(i.block_args))continue;if(i.block_args.length>qe.maxBlockArgsPerRule||i.block_args.length>n)return!1;n-=i.block_args.length;for(let s of i.block_args)if(!r(s))return!1}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Za(e,t){return Array.isArray(e)&&e.length>t}function Sw(e){if(!vw(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!qf(e))return{errors:[jf],ruleNames:new Set};let t=Im().safeParse(e),n=[...e.rulebook_version===1?[]:["rulebook_version must be 1"],...t.success?[]:_n(t.error.issues,": ",": ")];return{errors:n.length>qe.maxValidationErrors?[...n.slice(0,qe.maxValidationErrors),Vf]:n,ruleNames:new Set(Da(e).map((r)=>r.toLowerCase()))}}function Dn(e){let t=Sw(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}function vw(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}var Rw=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#([A-Za-z0-9._-]+)$/;function Oi(e){if(wn(e.spec))return Ew(e);return xw(e)}function xw(e){if(!Te.test(e.spec))return`Local rulebook sources must be bare names matching ${Te}: ${e.spec}`;if(e.kind!=="local-directory")return`lock entry for ${e.spec} must use local-directory kind`;if(e.path===e.spec&&e.name===e.spec)return null;return`lock entry for ${e.spec} does not match local source identity`}function Ew(e){let t=vr(e.spec);if(t)return t;let n=En(e.spec);if(e.kind!=="github")return`lock entry for ${e.spec} must use github kind`;if(e.owner===n.owner&&e.repo===n.repo&&e.ref===n.ref&&e.path===n.path&&e.name===n.name)return null;return`lock entry for ${e.spec} does not match GitHub source identity`}function VM(e,t,n){let r=Yf(e.rules,n);if(r.length>0)return{ok:!0,specs:r};if(!t)return{ok:!1,result:{ok:!1,errors:[`No lockfile available to match rulebook name ${n}; use the exact source or run ${je}`],warnings:[],entries:[]}};let o=new Set(e.rules),i=t.rulebooks.filter((s)=>s.name===n&&o.has(s.spec)).map((s)=>s.spec);if(i.length===1)return{ok:!0,specs:i};return Kf(n,i)}function qM(e,t,n){let r=Yf(e,n);if(r.length>0)return{ok:!0,specs:r};let o=ww(e,n);if(o.length>0)return{ok:!0,specs:o};let i=Pw(e,n);if(!i.ok)return i;if(i.specs.length>0)return{ok:!0,specs:i.specs};let s=t?e.filter((a)=>t.rulebooks.find((l)=>l.spec===a)?.name===n):[];if(s.length===1)return{ok:!0,specs:s};return Kf(n,s)}function Kf(e,t){return{ok:!1,result:{ok:!1,errors:t.length===0?[`No configured rulebook matches ${e}`]:[`Ambiguous rulebook match ${e}: ${t.join(", ")}`],warnings:[],entries:[]}}}function Yf(e,t){return e.filter((n)=>n===t)}function ww(e,t){let n=t.match(Rw),r=n?.[1],o=n?.[2],i=n?.[3];if(!r||!o||!i)return[];return Xf(e,(s)=>s.owner===r&&s.repo===o&&s.ref===i)}function Pw(e,t){if(!xm(t))return{ok:!0,specs:[]};let[n,r]=t.split("/"),o=Xf(e,(s)=>s.owner===n&&s.repo===r);if(new Set(o.map((s)=>Zf(s)?.ref).filter((s)=>!!s)).size<2)return{ok:!0,specs:o};return{ok:!1,result:{ok:!1,errors:[`Multiple refs are configured for ${t}. Use an explicit ref:`,`  cc-safety-net rule remove ${t}#<ref>`],warnings:[],entries:[]}}}function Zf(e){try{return En(e)}catch{return null}}function Xf(e,t){return e.filter((n)=>{let r=Zf(n);return r?t(r):!1})}function Xa(e){let t=typeof e==="string"?e:e.path;try{let n=ft(typeof e==="string"?Ri(e):e);if(n===null)return{lock:null,errors:[]};let r=JSON.parse(n);if(!r||typeof r!=="object")return{lock:null,errors:[`malformed lockfile ${t}: must be an object`]};let o=r;if(o.version!==1||!Array.isArray(o.rulebooks))return{lock:null,errors:[`malformed lockfile ${t}`]};let i=Om().safeParse(o),s=o.rulebooks.flatMap((l,c)=>{let u=i.success?[]:i.error.issues.filter((f)=>f.path[1]===c);if(u.length>0)return _n(u).map((f)=>`${t}: ${f}`);let m=Oi(l);return m?[`${t}: rulebooks[${c}]: ${m}`]:[]});if(!i.success||s.length>0)return{lock:null,errors:[`malformed lockfile ${t}`,...s]};return{lock:{version:1,rulebooks:i.data.rulebooks.map((l)=>{if(l.kind==="local-directory")return{spec:l.spec,kind:l.kind,path:l.path,name:l.name,version:l.version,digest:l.digest};let c={spec:l.spec,kind:l.kind,owner:l.owner,repo:l.repo,ref:l.ref,commit:l.commit,path:l.path,name:l.name,version:l.version,digest:l.digest};return typeof l.display_ref==="string"&&l.display_ref!==""?{...c,display_ref:l.display_ref}:c})},errors:[]}}catch(n){if(n instanceof L)return{lock:null,errors:[n.message]};return{lock:null,errors:["malformed lockfile"]}}}import{createHash as _w}from"node:crypto";import{dirname as Mi,join as Aw}from"node:path";var ep=Object.freeze({timeoutMs:15000,metadataBytes:524288,commitBytes:262144,treeBytes:16777216,rawBytes:4194304});async function Jf(e,t,n,r=Oe(Mi(Mi(t)),"rules policy"),o=gi()){if(wn(e))return Tw(e,o);return kw(e,t,n,r)}async function aD(e,t,n,r,o,i=gi()){if(!wn(e)||n.refresh)return Jf(e,t,n,o,i);let s=r?.rulebooks.find((a)=>a.spec===e);if(!s||s.kind!=="github")return Jf(e,t,n,o,i);return Iw(s,t,n,o,i)}async function lD(e,t=gi()){let[n,r]=e.split("/");if(!n||!r)throw Error(`Invalid GitHub repository source: ${e}`);let o=await Dr(`https://api.github.com/repos/${n}/${r}`,"metadata",t),i=o.response;if(!i.ok)throw Error(`Failed to inspect ${e}: GitHub returned ${i.status}`);let a=JSON.parse(o.content)?.default_branch;if(typeof a!=="string"||a==="")throw Error(`Failed to inspect ${e}: missing default branch`);let l=await np(n,r,a,e,t),c=await Dr(`https://api.github.com/repos/${n}/${r}/git/trees/${l}?recursive=1`,"tree",t),u=c.response;if(!u.ok)throw Error(`Failed to inspect ${e}: GitHub tree returned ${u.status}`);let m=JSON.parse(c.content);if(!Array.isArray(m?.tree))throw Error(`Failed to inspect ${e}: unexpected GitHub tree response`);let d=m.tree.flatMap((p)=>{if(!p||typeof p!=="object")return[];let g=p;if(g.type!=="blob"||typeof g.path!=="string")return[];let y=g.path.match(Pa);return y?.[1]?[y[1]]:[]}).sort();if(d.length===0)throw Error(`No rulebooks found in ${e} under ${yi}/`);return d.map((p)=>({spec:`${n}/${r}#${l}/${p}`,display_ref:a}))}function kw(e,t,n,r){_a(e);let o=Lw(t,e),i=ft(se(r,o));if(i===null)throw Error(`Rulebook source not found: ${e}`);let s=Dn(Ja(i,"Invalid local rulebook source."));if(s.name!==e)throw Error(`rulebook name "${s.name}" must match local source "${e}"`);return{rulebook:s,content:i,entry:{spec:e,kind:"local-directory",path:e,name:s.name,version:s.version,digest:Ln(i)}}}async function Tw(e,t){let n=En(e),r=await np(n.owner,n.repo,n.ref,e,t),o=await Dr(`https://raw.githubusercontent.com/${n.owner}/${n.repo}/${r}/${n.path}`,"raw",t),i=o.response;if(!i.ok)throw Error(`Failed to fetch ${e}: GitHub raw returned ${i.status}`);let s=o.content,a=Dn(Ja(s,"Invalid GitHub rulebook response."));if(a.name!==n.name)throw Error(`rulebook name "${a.name}" must match GitHub source "${n.name}"`);return{rulebook:a,content:s,entry:{spec:e,kind:"github",owner:n.owner,repo:n.repo,ref:n.ref,commit:r,path:n.path,name:a.name,version:a.version,digest:Ln(s)}}}async function Iw(e,t,n,r=Oe(Mi(Mi(t)),"rules policy"),o){let i=Oi(e);if(i)throw Error(`${i}; run ${je}`);let s=wi(e,Pi(t,n)),a=ft(se(r,s));if(a!==null){if(Ln(a)===e.digest)return{entry:e,rulebook:tp(a,e),content:a}}return Ow(e,o)}async function Ow(e,t){let n=await Dr(`https://raw.githubusercontent.com/${e.owner}/${e.repo}/${e.commit}/${e.path}`,"raw",t),r=n.response;if(!r.ok)throw Error(`Failed to restore ${e.spec}: GitHub raw returned ${r.status}`);let o=n.content;if(Ln(o)!==e.digest)throw Error(`locked GitHub digest mismatch for ${e.spec}; run ${je}`);return{entry:e,rulebook:tp(o,e),content:o}}function tp(e,t){let n=Dn(Ja(e,"Invalid cached rulebook."));if(n.name!==t.name)throw Error(`rulebook name "${n.name}" must match lock entry "${t.name}"`);return n}function Ja(e,t){try{return JSON.parse(e)}catch{throw Error(t)}}async function np(e,t,n,r,o){let i=await Dr(`https://api.github.com/repos/${e}/${t}/commits/${encodeURIComponent(n)}`,"commit",o),s=i.response;if(!s.ok)throw Error(`Failed to resolve ${r}: GitHub returned ${s.status}`);let a=JSON.parse(i.content);if(typeof a?.sha!=="string"||a.sha==="")throw Error(`Failed to resolve commit for ${r}`);return a.sha}async function Mw(e,t,n={}){if(n.signal?.aborted)throw n.signal.reason;let r=n.budget??pi(),o=new AbortController,i=()=>o.abort(n.signal?.reason);n.signal?.addEventListener("abort",i,{once:!0});let s=!1,a=setTimeout(()=>{if(o.signal.aborted)return;s=!0,o.abort()},n.timeoutMs??ep.timeoutMs);try{if(n.signal?.aborted)throw n.signal.reason;bm(r);let l=await(n.fetch??fetch)(e,{signal:o.signal,redirect:"error"});if(!l.ok)return rp(l),{response:l,content:""};return{response:l,content:await Dw(l,t,r,()=>o.abort())}}catch(l){if(s)throw Error("GitHub request timed out",{cause:l});if(n.signal?.aborted)throw n.signal.reason;throw l}finally{clearTimeout(a),n.signal?.removeEventListener("abort",i)}}function Dr(e,t,n){return Mw(n.resolveUrl?.(e)??e,t,{budget:n.budget,signal:n.controller.signal})}async function Dw(e,t,n=pi(),r){let o=ep[`${t}Bytes`],i=Number(e.headers.get("content-length"));if(Number.isFinite(i)&&i>o)throw rp(e),Error(`GitHub ${t} response exceeds ${o} bytes`);if(!e.body)return"";let s=e.body.getReader(),a=[],l=0;while(!0){let c=await s.read();if(c.done)break;try{Sm(n,c.value.byteLength)}catch(u){throw r?.(),Qf(s),u}if(l+=c.value.byteLength,l>o)throw r?.(),Qf(s),Error(`GitHub ${t} response exceeds ${o} bytes`);a.push(Buffer.from(c.value))}return Buffer.concat(a,l).toString("utf-8")}function rp(e){if(!e.body)return;op(()=>e.body?.cancel())}function Qf(e){op(()=>e.cancel())}function op(e){try{Promise.resolve(e()).catch(()=>{})}catch{}}function Lw(e,t){return Aw(e,t,hi)}function Ln(e){return`sha256:${_w("sha256").update(e).digest("hex")}`}function ap(e={}){let t=rf(e),n=!1;try{n=Um(t.userConfigTarget,t.projectConfigTarget)}catch(f){if(f instanceof L)return $w(t,f.message);throw f}let r=kn(t.userConfigTarget),o=n?{config:null,errors:[]}:kn(t.projectConfigTarget),i=sp(t.userConfigPath,r.errors),s=sp(t.projectConfigPath,o.errors),a=new Set,l=r.config?Qa(r.config,t.userLockPath,yt(t.userConfigPath),e,"user",t.userScope,a):Lr(),c=o.config?Qa(o.config,t.projectLockPath,yt(t.projectConfigPath),e,"project",t.projectScope,a):Lr(),u=r.config?.overrides??{},m=o.config?.overrides??{};return{rules:[...ip(l.rules,u),...ip(c.rules,m)],transparent_wrappers:Gw(r.config,o.config),rulebooks:[...l.rulebooks,...c.rulebooks],errors:[...i,...s,...l.errors,...c.errors],warnings:[...l.warnings,...c.warnings,...l.canValidateOverrides?el(u,l.knownRuleIds,t.userConfigPath):[],...l.canValidateOverrides?zw(m,l.knownRuleIds,t.projectConfigPath):[],...c.canValidateOverrides?el(m,c.knownRuleIds,t.projectConfigPath):[]],userConfig:r.config??void 0,projectConfig:o.config??void 0,...t}}function yD(e,t){let n=t??Oe(yt(yt(e)),"rules policy"),r=kn(se(n,e)).config,o=Xa(se(n,Zt(e))).lock;if(!r||!o)return new Map;let i=new Set(r.rules);return new Map(o.rulebooks.filter((s)=>i.has(s.spec)).map((s)=>[s.spec,af(s)]))}function CD(e,t,n,r){let o=Nw(e,t,n,r);if(!o)return[];return[...o.scope.errors,...o.scope.warnings,...Ww(o.config,o.scope,e)]}function Nw(e,t,n,r){let o=r??Oe(yt(yt(e)),"rules policy"),i=kn(se(o,e)).config;if(!i)return null;return{config:i,scope:Qa(i,t,yt(e),n,"project",o)}}function Ww(e,t,n){return t.canValidateOverrides?el(e.overrides??{},t.knownRuleIds,n):[]}function Qa(e,t,n,r,o,i=Oe(yt(yt(n)),o==="user"?"user policy":"project policy"),s=new Set){let a;try{a=se(i,t)}catch(y){if(y instanceof L)return{...Lr(),errors:[y.message],canValidateOverrides:!1};throw y}let l=Xa(a);if(l.errors.length>0)return{...Lr(),errors:l.errors,canValidateOverrides:!1};let c=l.lock;if(!c&&e.rules.length>0)return{...Lr(),errors:[`missing lockfile ${t}; run ${je}`],canValidateOverrides:!1};let u=c?.rulebooks??[],m=new Map(u.map((y)=>[y.spec,y])),f=[],d=[],p=e.rules.flatMap((y)=>{let h=m.get(y);if(!h)return f.push(`missing lock entry for ${y}; run ${je}`),[];let R=Fw(h,n,r,i);if(R.errors.length>0||!R.rulebook)return f.push(...R.errors),[];let x=R.rulebook;if(s.has(x.name))return d.push(`duplicate active rulebook name "${x.name}" for ${y}; keeping the first and ignoring this one, so its rules are not active; rename one of them, then run ${je}`),[];return s.add(x.name),[{rules:x.rules.map((A)=>({...A,name:`${x.name}/${A.name}`})),rulebook:{source:o,spec:h.spec,name:x.name,version:x.version,rules:x.rules.map((A)=>`${x.name}/${A.name}`)}}]}),g=p.flatMap((y)=>y.rules);return{rules:g,rulebooks:p.map((y)=>y.rulebook),entries:u,knownRuleIds:new Set(g.map((y)=>y.name)),errors:f,warnings:d,canValidateOverrides:f.length===0}}function Fw(e,t,n,r){let o=wi(e,Pi(t,n)),i;try{i=ft(se(r,o))}catch(a){if(a instanceof L)return{rulebook:null,errors:[a.message]};throw a}if(i===null)return{rulebook:null,errors:[`missing cache entry for ${e.spec}; run ${je}`]};if(Ln(i)!==e.digest)return{rulebook:null,errors:[`cache digest mismatch for ${e.spec}; run ${je}`]};let s;try{s=JSON.parse(i)}catch{return{rulebook:null,errors:[`invalid cached rulebook for ${e.spec}`]}}try{Dn(s)}catch(a){return{rulebook:null,errors:[`invalid cached rulebook for ${e.spec}: ${a instanceof Error?a.message:"invalid rulebook"}`]}}return{rulebook:s,errors:[]}}function Gw(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function ip(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function el(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function zw(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function sp(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function $w(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,userLockPath:e.userLockPath,projectLockPath:e.projectLockPath}}function Lr(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}function lp(e={}){let t=ap(e),n=mf(e),r={rules:t.rules,transparentWrappers:t.transparent_wrappers,safety:n.safety,worktreeMode:n.worktreeMode,destructiveCommandProtectionEnabled:n.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:n.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:n.destructiveCommandAllowPaths,secretProtection:{enabled:n.secretProtection.enabled??!0,disabledRules:n.secretProtection.disabledRules??[],denyPaths:n.secretProtection.denyPaths,allowPaths:n.secretProtection.allowPaths??[]}},o={...t.userConfig?.overrides??{},...t.projectConfig?.overrides??{}},i=Object.freeze(Object.fromEntries(r.rules.map((s)=>{let a=t.rulebooks.find((c)=>c.rules.includes(s.name)),l=o[s.name];return[s.name,Object.freeze({id:s.name,...a?{rulebook:Object.freeze({name:a.name,version:a.version}),...jw(a.spec)?{source:a.spec}:{}}:{},...l&&typeof l==="object"?{override:Object.freeze({type:"reason",reason:l.reason})}:{}})]})));return Vw(r,Bw(t,n),i)}function RD(e){if(e.state==="ready")return{state:e.state};return{state:e.state,reason:e.reason}}function Bw(e,t){let n=Hw(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:qw(e.errors.length>0?Uw(e.errors):void 0,e.warnings.length>0?tl(e.warnings.join("; ")):void 0,n)}}function Uw(e){return`${tl(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Hw(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function jw(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Vw(e,t,n=Object.freeze({})){let r=cp(structuredClone(e));if(!t)return Object.freeze({state:"ready",policy:r,diagnostics:Object.freeze([]),ruleMetadata:n});return Object.freeze({state:"degraded",policy:r,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n})}function cp(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))cp(t);return Object.freeze(e)}function qw(...e){return tl(e.filter((t)=>!!t).join("; "))}function tl(e){return/[.!?]$/.test(e)?e:`${e}.`}class nl extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Kw={findPolicyMutation:bf,findGitMetadataMutation:su,resolveGitMetadata:Rs,loadPolicySnapshot:lp,findSensitiveTarget:Lf,analyzeCommand:xa,getModes:fi};function LD(e,t={}){let n={...Kw,...t.dependencies},r=Xw(e),o=Nr(e)?e.command:r,i=en("policy-protection",o,()=>Mo(e,t.factParserDependencies)),s=Ce(i,"declared-command");if(Nr(e)&&e.command?.trim()&&s?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:st,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(Ce(i,"input-candidate")?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:cl,intent:"stop_and_explain",evidence:[]}};let a=en("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd])),l=en("policy-protection",o,()=>n.findPolicyMutation(i));if(l){let y=o??l.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Cf,intent:"hard_stop",evidence:[{kind:"command",command:y,segment:l.target}]}}}let c=en("policy-protection",o,()=>n.findGitMetadataMutation(i,a));if(c){let y=o??c.target;return{stage:"policy-protection",decision:{kind:"deny",reason:_e,intent:"hard_stop",evidence:[{kind:"command",command:y,segment:c.target}]}}}let u=en("config-load",o,()=>n.loadPolicySnapshot({...t.policyOptions,cwd:e.context.configCwd})),m=u.policy,f=n.getModes(m),d={level:f.effectiveLevel,...Yw(u)},p=m.secretProtection.enabled===!1?null:en("secret-protection",o,()=>n.findSensitiveTarget(i,m.secretProtection,{strict:Nr(e)?f.strict:void 0}));if(p){let y=o??p.target;return{stage:"secret-protection",...d,decision:{kind:"deny",reason:If,intent:"hard_stop",ruleId:p.ruleId,evidence:[{kind:"command",command:y,segment:p.target}]}}}if(!Nr(e))return{stage:"non-command",...d,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...rl("command-validation",o),...d};let g=en("command-analysis",o,()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:u,environment:at(),protectedGitMetadata:a,effectiveCapabilities:f.capabilities,strict:f.strict,paranoidRm:f.paranoidRm,paranoidInterpreters:f.paranoidInterpreters,worktreeMode:f.worktreeMode},Zw(i),i.store));if(g)return{stage:"command-analysis",...d,decision:g};return{stage:"command-analysis",...d,decision:{kind:"allow"}}}function Yw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Zw(e){return Ce(e,"declared-command")?.program}function Xw(e){try{return Oo(e.input)}catch(t){let n=Nr(e)?e.command:void 0;throw new nl("policy-protection",rl("policy-protection",t instanceof Qn?void 0:n,t),t)}}function en(e,t,n){try{return n()}catch(r){throw new nl(e,rl(e,r instanceof Qn?void 0:t,r),r)}}function rl(e,t,n){let r=n instanceof we||n instanceof Rt;return{stage:e,decision:{kind:"deny",reason:r?ul:dl,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function Nr(e){return e.route.kind==="command"}
-export{gm as q,hm as r,L as s,se as t,Ri as u,ft as v,Bm as w,Um as x,wO as y,PO as z,_O as A,AO as B,kO as C,Sx as D,Te as E,hi as F,yi as G,xm as H,Jm as I,je as J,tf as K,Xt as L,nf as M,HO as N,Zt as O,jO as P,VO as Q,rf as R,qO as S,af as T,wi as U,KO as V,Pi as W,rP as X,oP as Y,iP as Z,Rp as _,dl as $,we as aa,Xr as ba,U as ca,Me as da,at as ea,Kr as fa,Vi as ga,Mt as ha,Qn as ia,h_ as ja,Oo as ka,$c as la,Hc as ma,Rt as na,Mo as oa,hy as pa,_e as qa,su as ra,Rs as sa,Au as ta,DA as ua,ie as va,HR as wa,KI as xa,fi as ya,Cr as za,va as Aa,YI as Ba,fm as Ca,nO as Da,xa as Ea,ml as Fa,Sr as Ga,Cm as Ha,ym as Ia,gi as Ja,wm as Ka,SO as La,Da as Ma,xr as Na,_n as Oa,_x as Pa,kn as Qa,LO as Ra,NO as Sa,WO as Ta,Ei as Ua,Ai as Va,In as Wa,lM as Xa,_i as Ya,cM as Za,Bx as _a,uM as $a,Tn as ab,ff as bb,pf as cb,Cf as db,bf as eb,If as fb,Lf as gb,Dn as hb,VM as ib,qM as jb,Xa as kb,aD as lb,lD as mb,ap as nb,yD as ob,CD as pb,Qa as qb,lp as rb,RD as sb,Vw as tb,nl as ub,LD as vb};