cc-safety-net 2.2.0 → 2.2.2

package/dist/chunks/{index-pb6n3mp5.js → index-z08yh4sm.js}

@@ -1,46 +1,46 @@
-import{accessSync as Cp,constants as al,realpathSync as bp,statSync as ll}from"node:fs";import{isAbsolute as cl,relative as Sp,resolve as vp,sep as Rp}from"node:path";import{dirname as dp,isAbsolute as mp,parse as fp,sep as pp}from"node:path";function Tt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function bt(e,t,n){if(Tt(t))throw Error("Unsupported Windows namespace path");let r=mp(t)?hp(t):"",o=r||e;for(let i of yp(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=dp(o);continue}let s=gp(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function gp(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${pp}${t}`}function hp(e){return fp(e).root}function yp(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}function oP(e){try{if(!ll(e).isDirectory())return!1;return Cp(e,al.R_OK|al.X_OK),!0}catch{return!1}}function iP(e,t){if(Tt(e))return;let n=t.flatMap((o)=>Ni(o));if(!n[0])return;let r=Ni(cl(e)?e:vp(n[0],e))[0];if(!r)return;return n.some((o)=>xp(r,o))?r:void 0}function sP(e){return e.flatMap((t)=>Ni(t))[0]}function Ni(e){try{let t=bp(e);return ll(t).isDirectory()?[t]:[]}catch{return[]}}function xp(e,t){let n=Sp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Rp}`)&&!cl(n)}var St="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",lt="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",ul="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",dl="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",ml="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function fl(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}function I(e){return e.provenance==="command-substitution"?e.raw:e.text}function rn(e,t){return e==="posix"?t:G(t.map((n)=>n.text))}function Fr(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function G(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}import{existsSync as zi,lstatSync as Tp,readFileSync as Br,realpathSync as Gn,statSync as Fn}from"node:fs";import{dirname as $i,isAbsolute as Bi,join as Ur,resolve as Hr}from"node:path";import{lstatSync as Ep,realpathSync as wp}from"node:fs";import{homedir as Pp,tmpdir as _p}from"node:os";var De={realpath:(e)=>{try{return wp(e)}catch{return null}},entryKind:(e)=>{let t=Ep(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}};function pe(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function It(){return pe(process.env.HOME||Pp())}function ct(){return{env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:It(),tmpdir:_p(),paths:De}}var Wi=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Ap=new Set(Wi);var pl=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Gr=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),kp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Fi(e){return Ap.has(e)}function Wn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Gi(e){return Fi(e)||pl.has(e)||Gr.has(e)||Wn(e)}function we(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function zr(e,t){let n=we("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=1024?{state:"valid",count:r}:{state:"invalid"}}function $r(e,t,n){let o=e.match(kp)?.[1];if(!o||!Gi(o))return null;let i=e.indexOf("=");return{name:o,value:`${we(o,t,n)??""}${e.slice(i+1)}`}}function gl(e){return yl(e,Gr)}function hl(e){return yl(e,pl)}function yl(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Ye=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]);function Sl(e,t){return Wi.some((n)=>t?.has(n)||e.has(n))}function vl(e,t){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let n;try{n=Gn(Hr(t))}catch{return{gitCwd:null,hasExplicitGitContext:!1}}if(!El(n))return{gitCwd:null,hasExplicitGitContext:!1};let r=!1,o=1;while(o<e.length){let i=e[o];if(!i)break;if(i==="--")break;if(!i.startsWith("-"))break;if(i==="-C"){let s=e[o+1];if(!s)return{gitCwd:null,hasExplicitGitContext:r};let a=bl(n,s);if(!a)return{gitCwd:null,hasExplicitGitContext:r};n=a,o+=2;continue}if(i.startsWith("-C")&&i.length>2){let s=bl(n,i.slice(2));if(!s)return{gitCwd:null,hasExplicitGitContext:r};n=s,o++;continue}if(i==="--git-dir"||i==="--work-tree"){r=!0,o+=2;continue}if(i.startsWith("--git-dir=")||i.startsWith("--work-tree=")){r=!0,o++;continue}if(Ye.has(i))o+=2;else if(i.startsWith("-c")&&i.length>2)o++;else o++}return{gitCwd:n,hasExplicitGitContext:r}}function Rl(e){let t=Hp(e);if(!t)return!1;try{let n=Tp(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=Ui(t);if(!r?.commonDir)return!1;if(!Mp(r.gitDir,t))return!1;return Dp(r.gitDir,$i(t))}catch{return!1}}function Ui(e){try{let t=Ip(e);if(!t)return null;let n=Gn(Bi(t)?t:Hr($i(e),t));if(!Fn(n).isDirectory())return null;return{gitDir:n,commonDir:Op(n)}}catch{return null}}function Ip(e){let t=Br(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Op(e){try{let t=Br(Ur(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Gn(Bi(t)?t:Hr(e,t));return Fn(n).isDirectory()?n:null}catch{return null}}function Mp(e,t){let n=Lp(e);return n===null?!1:xl(e,n,t)}function Dp(e,t){let n=Np(e);return n===null?!0:xl(e,n,t)}function Lp(e){let t=Ur(e,"gitdir");if(!zi(t))return null;let n=Br(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Np(e){let t=Ur(e,"config.worktree");return zi(t)?$p(t):null}function xl(e,t,n){return Fp(Wp(e,t),n)}function Wp(e,t){return Bi(t)?t:Hr(e,t)}function Fp(e,t){try{return Gp(e,t)}catch{return!1}}function Gp(e,t){try{let n=Fn(e),r=Fn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Cl(e)===Cl(t)}function Cl(e){return zp(Gn.native(e))}function zp(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"");if(t=t.replace(/\\/g,"/"),t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return process.platform==="win32"?t.toLowerCase():t}function $p(e){let t=Br(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Bp(s[1]??"")}return r}function Bp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Up(t.slice(1,-1))}function Up(e){let t="";for(let n=0;n<e.length;n++){let r=e[n];if(r!=="\\"){t+=r;continue}let o=e[n+1];if(o===void 0){t+=r;continue}switch(o){case"\\":case'"':t+=o;break;case"n":t+=`
-`;break;case"t":t+="\t";break;case"b":t+="\b";break;default:t+=`\\${o}`;break}n++}return t}function bl(e,t){try{let n=bt(e,t,De);return El(n)?n:null}catch{return null}}function El(e){try{return Fn(e).isDirectory()}catch{return!1}}function Hp(e){try{return zn(Gn(e))}catch{return null}}function zn(e){let t=e;while(!0){let n=Ur(t,".git");if(zi(n))return n;let r=$i(t);if(r===t)return null;t=r}}function Hi(e,t){return{value:e,work:t}}function v(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function X(e){return e.value.length}function $n(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function ge(e,t){$n(e,t)}function Ot(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function K(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ji(e){return e===`
+import{accessSync as bp,constants as ll,realpathSync as Sp,statSync as cl}from"node:fs";import{isAbsolute as ul,relative as vp,resolve as Rp,sep as xp}from"node:path";import{dirname as mp,isAbsolute as fp,parse as pp,sep as gp}from"node:path";function Tt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function bt(e,t,n){if(Tt(t))throw Error("Unsupported Windows namespace path");let r=fp(t)?yp(t):"",o=r||e;for(let i of Cp(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=mp(o);continue}let s=hp(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function hp(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${gp}${t}`}function yp(e){return pp(e).root}function Cp(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}function iP(e){try{if(!cl(e).isDirectory())return!1;return bp(e,ll.R_OK|ll.X_OK),!0}catch{return!1}}function sP(e,t){if(Tt(e))return;let n=t.flatMap((o)=>Wi(o));if(!n[0])return;let r=Wi(ul(e)?e:Rp(n[0],e))[0];if(!r)return;return n.some((o)=>Ep(r,o))?r:void 0}function aP(e){return e.flatMap((t)=>Wi(t))[0]}function Wi(e){try{let t=Sp(e);return cl(t).isDirectory()?[t]:[]}catch{return[]}}function Ep(e,t){let n=vp(t,e);return n===""||n!==".."&&!n.startsWith(`..${xp}`)&&!ul(n)}var St="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",lt="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",dl="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",ml="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",fl="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function pl(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}function I(e){return e.provenance==="command-substitution"?e.raw:e.text}function rn(e,t){return e==="posix"?t:G(t.map((n)=>n.text))}function Fr(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function G(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}import{existsSync as $i,lstatSync as Ip,readFileSync as Br,realpathSync as Gn,statSync as Fn}from"node:fs";import{dirname as Bi,isAbsolute as Ui,join as Ur,resolve as Hr}from"node:path";import{lstatSync as wp,realpathSync as Pp}from"node:fs";import{homedir as _p,tmpdir as Ap}from"node:os";var De={realpath:(e)=>{try{return Pp(e)}catch{return null}},entryKind:(e)=>{let t=wp(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}};function pe(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function It(){return pe(process.env.HOME||_p())}function ct(){return{env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:It(),tmpdir:Ap(),paths:De}}var Fi=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],kp=new Set(Fi);var gl=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Gr=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Tp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Gi(e){return kp.has(e)}function Wn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function zi(e){return Gi(e)||gl.has(e)||Gr.has(e)||Wn(e)}function we(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function zr(e,t){let n=we("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=1024?{state:"valid",count:r}:{state:"invalid"}}function $r(e,t,n){let o=e.match(Tp)?.[1];if(!o||!zi(o))return null;let i=e.indexOf("=");return{name:o,value:`${we(o,t,n)??""}${e.slice(i+1)}`}}function hl(e){return Cl(e,Gr)}function yl(e){return Cl(e,gl)}function Cl(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Ye=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]);function vl(e,t){return Fi.some((n)=>t?.has(n)||e.has(n))}function Rl(e,t){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let n;try{n=Gn(Hr(t))}catch{return{gitCwd:null,hasExplicitGitContext:!1}}if(!wl(n))return{gitCwd:null,hasExplicitGitContext:!1};let r=!1,o=1;while(o<e.length){let i=e[o];if(!i)break;if(i==="--")break;if(!i.startsWith("-"))break;if(i==="-C"){let s=e[o+1];if(!s)return{gitCwd:null,hasExplicitGitContext:r};let a=Sl(n,s);if(!a)return{gitCwd:null,hasExplicitGitContext:r};n=a,o+=2;continue}if(i.startsWith("-C")&&i.length>2){let s=Sl(n,i.slice(2));if(!s)return{gitCwd:null,hasExplicitGitContext:r};n=s,o++;continue}if(i==="--git-dir"||i==="--work-tree"){r=!0,o+=2;continue}if(i.startsWith("--git-dir=")||i.startsWith("--work-tree=")){r=!0,o++;continue}if(Ye.has(i))o+=2;else if(i.startsWith("-c")&&i.length>2)o++;else o++}return{gitCwd:n,hasExplicitGitContext:r}}function xl(e){let t=jp(e);if(!t)return!1;try{let n=Ip(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=Hi(t);if(!r?.commonDir)return!1;if(!Dp(r.gitDir,t))return!1;return Lp(r.gitDir,Bi(t))}catch{return!1}}function Hi(e){try{let t=Op(e);if(!t)return null;let n=Gn(Ui(t)?t:Hr(Bi(e),t));if(!Fn(n).isDirectory())return null;return{gitDir:n,commonDir:Mp(n)}}catch{return null}}function Op(e){let t=Br(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Mp(e){try{let t=Br(Ur(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Gn(Ui(t)?t:Hr(e,t));return Fn(n).isDirectory()?n:null}catch{return null}}function Dp(e,t){let n=Np(e);return n===null?!1:El(e,n,t)}function Lp(e,t){let n=Wp(e);return n===null?!0:El(e,n,t)}function Np(e){let t=Ur(e,"gitdir");if(!$i(t))return null;let n=Br(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Wp(e){let t=Ur(e,"config.worktree");return $i(t)?Bp(t):null}function El(e,t,n){return Gp(Fp(e,t),n)}function Fp(e,t){return Ui(t)?t:Hr(e,t)}function Gp(e,t){try{return zp(e,t)}catch{return!1}}function zp(e,t){try{let n=Fn(e),r=Fn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return bl(e)===bl(t)}function bl(e){return $p(Gn.native(e))}function $p(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"");if(t=t.replace(/\\/g,"/"),t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return process.platform==="win32"?t.toLowerCase():t}function Bp(e){let t=Br(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Up(s[1]??"")}return r}function Up(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Hp(t.slice(1,-1))}function Hp(e){let t="";for(let n=0;n<e.length;n++){let r=e[n];if(r!=="\\"){t+=r;continue}let o=e[n+1];if(o===void 0){t+=r;continue}switch(o){case"\\":case'"':t+=o;break;case"n":t+=`
+`;break;case"t":t+="\t";break;case"b":t+="\b";break;default:t+=`\\${o}`;break}n++}return t}function Sl(e,t){try{let n=bt(e,t,De);return wl(n)?n:null}catch{return null}}function wl(e){try{return Fn(e).isDirectory()}catch{return!1}}function jp(e){try{return zn(Gn(e))}catch{return null}}function zn(e){let t=e;while(!0){let n=Ur(t,".git");if($i(n))return n;let r=Bi(t);if(r===t)return null;t=r}}function ji(e,t){return{value:e,work:t}}function v(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function X(e){return e.value.length}function $n(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function ge(e,t){$n(e,t)}function Ot(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function K(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Vi(e){return e===`
 `||e==="\r"||e==="\u2028"||e==="\u2029"}function Y(e,t,n){if(t+n.length>X(e))return!1;for(let r=0;r<n.length;r++)if(v(e,t+r)!==n[r])return!1;return!0}function ut(e,t,n){return!Ot(v(e,t-1))&&Y(e,t,n)&&!Ot(v(e,t+n.length))}function dt(e,t){return Ot(v(e,t-1))!==Ot(v(e,t))}function te(e){return e===`
-`||e===";"||e==="&"||e==="|"}function on(e){return e==="|"||e===";"}function jr(e,t,n){let r=Hi(e,n);if(t==="rm")return jp(r);if(t==="dd")return qp(r);return Tl(r,!0)}function Vr(e,t,n){let r=Hi(e,n);if(t==="rm")return Kp(r);if(t==="reset-hard")return Al(r,"--ha","rd");if(t==="reset-merge")return Al(r,"--me","rge");if(t==="clean")return Jp(r);if(t==="checkout")return eg(r);if(t==="push-force")return tg(r);if(t==="push-refspec")return ng(r);if(t==="push-delete")return rg(r);if(t==="branch")return og(r);if(t==="tag")return ag(r);if(t==="restore")return lg(r);return Tl(r,!1)}function jp(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=X(e);i++){let s=v(e,i);if(!t){let l=v(e,i+2);if(ut(e,i,"rm")&&K(l)&&l!==`
-`)t=!0,i++;continue}let a=Vp(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===X(e)){if(o>=0){let l=wl(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(K(s)){if(o>=0){if(Y(e,o,"--")&&i-o===2)t=!1,n=!1,r=!1;else{let l=wl(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0}o=-1}continue}if(o<0)o=i}return!1}function Vp(e,t){if(v(e,t)!=="\\"||v(e,t-1)==="\\")return-1;if(Y(e,t,String.raw`\n`))return t+2;if(Y(e,t,String.raw`\x0a`)||Y(e,t,String.raw`\x0A`))return t+5;if(Y(e,t,String.raw`\u000a`)||Y(e,t,String.raw`\u000A`))return t+7;return Y(e,t,String.raw`\012`)?t+4:-1}function wl(e,t,n){if(Pl(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Pl(e,t,n,"force"))return{recursive:!1,force:!0};if(v(e,t)!=="-"||v(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=v(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Pl(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Y(e,t,"--"))return!1;for(let i=0;i<o;i++)if(v(e,t+i+2)!==r[i])return!1;return!0}function qp(e){let t=!1;for(let n=0;n<X(e);n++){if(te(v(e,n))){t=!1;continue}if(ut(e,n,"dd")){t=!0,n++;continue}if(!t||!ut(e,n,"of")||!Y(e,n,"of=/dev/"))continue;let r=n+8;if(r<X(e)&&!K(v(e,r))&&v(e,r)!=="'"&&v(e,r)!=='"')return!0}return!1}function Kp(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);){let i=v(e,o);if(o===X(e)||te(i)){t=!1,n=!1,r=!1,o++;continue}let s=Zp(e,o);if(s>=0){if(Yp(e,s))return!0;let a=s,l=!1;while(K(v(e,a)))l||=v(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Y(e,o,"--")&&(o===0||K(v(e,o-1)))&&(!v(e,o+2)||K(v(e,o+2))||te(v(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Y(e,o,"--recursive")&&dt(e,o+11)||Vi(e,o,"recursive"),r||=Y(e,o,"--force")&&dt(e,o+7)||Vi(e,o,"force"),n&&r)return!0;o++}return!1}function Vi(e,t,n){if(!Y(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=v(e,t+r+2);if(!o||K(o)||te(o))break;if(o!==n[r])return!1;r++}return r>0&&dt(e,t+r+2)}function Yp(e,t){let n=t,r=!1,o=!1;while(n<X(e)){while(K(v(e,n)))n++;let i=n;while(n<X(e)&&!K(v(e,n)))n++;if(v(e,i)!=="-"||n-i===2&&Y(e,i,"--"))return!1;let s=_l(e,i,"recursive"),a=_l(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,v(e,i+1)==="-")continue;let l=Xp(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function _l(e,t,n){return Y(e,t,`--${n}`)&&dt(e,t+n.length+2)||Vi(e,t,n)}function Zp(e,t){if(t>0&&Ot(v(e,t-1)))return-1;let n=t;if(v(e,n)==="\\")n++;if(v(e,n)!=="r")return-1;if(n++,v(e,n)==="\\")n++;if(v(e,n)!=="m"||!K(v(e,n+1)))return-1;return n+1}function Xp(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(v(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=v(e,c)??"",m=(u==="r"||u==="f")&&dt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Al(e,t,n){return Un(e,"reset",on,!0,(r)=>v(e,r)==="-"&&sn(e,r,t,n)?!0:r)}function Jp(e){return Un(e,"clean",on,!0,(t)=>{if(v(e,t)!=="-")return t;if(sn(e,t,"--fo","rce"))return!0;let n=Bn(e,t,on);for(let r=t+1;r<n;r++)if(v(e,r)==="f")return!0;return n-1})}function qr(e,t,n){if(!ut(e,t,"git"))return null;let r=t+3;if(!K(v(e,r)))return{commandEnd:-1,next:r};while(K(v(e,r)))r++;while(r<X(e)){if(te(v(e,r)))return{commandEnd:-1,next:r};let o=Bn(e,r,te);if(ut(e,r,n))return{commandEnd:r+n.length,next:o};if(v(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Y(e,r,"--"),s=Qp(e,r,o);r=o;while(K(v(e,r)))r++;if(i)return{commandEnd:ut(e,r,n)?r+n.length:-1,next:Bn(e,r,te)};if(!s)continue;if(r>=X(e)||te(v(e,r)))return{commandEnd:-1,next:r};r=Bn(e,r,te);while(K(v(e,r)))r++}return{commandEnd:-1,next:r}}function Qp(e,t,n){for(let r of Ye)if(n-t===r.length&&Y(e,t,r))return!0;return!1}function eg(e){return kl(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function tg(e){return Un(e,"push",on,!0,(t)=>{if(v(e,t)!=="-")return t;if(v(e,t+1)==="f"&&!Ot(v(e,t+2))&&!Y(e,t+2,"-with-lease"))return!0;let n=Il(e,t,"--fo","rce");if(n>=0&&!Y(e,n,"-with-lease"))return!0;return t})}function ng(e){return Un(e,"push",te,!1,(t)=>{if(K(v(e,t))&&v(e,t+1)==="+"&&t+2<X(e)&&!te(v(e,t+2))&&!K(v(e,t+2)))return!0;if(v(e,t)===":"&&v(e,t+1)==="+")return!0;return t})}function rg(e){return Un(e,"push",te,!1,(t)=>{if(v(e,t)==="-"&&sn(e,t,"--de","lete"))return!0;if(K(v(e,t))&&v(e,t+1)===":"&&t+2<X(e)&&!K(v(e,t+2))&&!te(v(e,t+2)))return!0;return t})}function og(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);o++){if(o===X(e)||te(v(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=qr(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||v(e,o)!=="-")continue;let i=Bn(e,o,te),s=ig(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function ig(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(v(e,i)!=="-")continue;if(sn(e,i,"--de","lete"))r=!0;if(sn(e,i,"--fo","rce"))o=!0;if(v(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&sg(v(e,s))){let u=v(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!dt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function sg(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function ag(e){return kl(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function kl(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<X(e);r++){let o=v(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&v(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(K(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=qr(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&K(v(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(sn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(v(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&dt(e,r+1))return!0;if(on(o))i.outerActive=!1}return!1}function Un(e,t,n,r,o){let i=!1;for(let s=0;s<X(e);s++){let a=v(e,s),l=n(a);if(!i&&!l){let c=qr(e,s,t);if(c){i=c.commandEnd>=0&&(!r||K(v(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(v(e,u)))i=!1;s=c}if(l)i=!1}return!1}function lg(e){let t=!1;for(let n=0;n<X(e);n++){if(ji(v(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=qr(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&v(e,n)==="-"&&v(e,n+1)==="-"&&(Y(e,n+2,"staged")||Y(e,n+2,"help")))t=!1}return t}function Tl(e,t){let n=!1;for(let r=0;r<X(e);r++){let o=v(e,r),i=t?ji(o):te(o);if(n&&K(o)&&v(e,r+1)==="-"&&ut(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(ut(e,r,"find"))n=!0,r+=3}return!1}function Bn(e,t,n){let r=t;while(r<X(e)&&!K(v(e,r))&&!n(v(e,r)))r++;return r}function Il(e,t,n,r){if(!Y(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&v(e,o)===r[i];i++)o++;return dt(e,o)?o:-1}function sn(e,t,n,r){return Il(e,t,n,r)>=0}var cg=["git.ssh-env","git.alias-config","git.checkout-force","git.checkout-double-dash","git.checkout-ref-path","git.checkout-pathspec-from-file","git.checkout-ambiguous","git.switch-discard-changes","git.switch-force","git.restore-worktree","git.restore-unstaged","git.reset-hard","git.reset-merge","git.clean-force","git.rm-force","git.push-force","git.push-delete","git.push-mirror","git.branch-force-delete","git.rebase-abort","git.merge-abort","git.tag-delete","git.reflog-delete","git.stash-drop","git.stash-clear","git.worktree-remove-force","rm.recursive-force-root-or-home","rm.git-metadata","rm.recursive-force-dynamic-target","rm.recursive-force-home-cwd","rm.recursive-force-cwd-self","rm.recursive-force-outside-cwd","rm.recursive-force-paranoid","powershell.remove-item-root-or-home","powershell.remove-item-recursive-force-root-or-home","powershell.remove-item-git-metadata","powershell.remove-item-recursive-force-dynamic-target","powershell.remove-item-recursive-force-home-cwd","powershell.remove-item-recursive-force-cwd-self","powershell.remove-item-recursive-force-outside-cwd","powershell.remove-item-recursive-force-paranoid","powershell.remove-item-pipeline-dynamic-target","find.delete","find.delete-git-metadata","find.exec-rm-recursive-force","dd.device-write","mkfs.device","shred.target","interpreter.dangerous-command","interpreter.one-liner-paranoid","awk.system-dynamic","xargs.rm-recursive-force-dynamic","xargs.shell-dynamic","parallel.rm-recursive-force-dynamic","parallel.shell-dynamic","parallel.command-stream-dynamic","shell.dynamic-structure","shell.dynamic-executable","raw-text.dangerous-command"],Kr=new Set(cg),Yr=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ug=new Map(Yr.map((e)=>[e.id,e.intent])),Ol=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function b(e,t){return{id:e,reason:t,intent:ug.get(e)??"manual_only"}}function k(e,t){if(!e)return null;if(Ol.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function Q(e,t,n){if(Ol.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function qi(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Ml(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:qi(e,t)})}function mt(e,t){$n(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)ge(t,a);if((s.regex?.test(a)??!1)||s.scan&&Vr(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var dg=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ll(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;$n(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Nl(t.nodes,r,i)}function Nl(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Nl(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return mg(r,t,n)})}function mg(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!dg.test(o.text));return e.words.every((o,i)=>o===t||Dl(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Dl(o.target.raw,n.anchored,!0)))}function Dl(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var Wl=Object.freeze({maxDerivedTokens:16384}),Fl="Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.";class he extends Error{constructor(){super("Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.");this.name="DerivedCommandWorkLimitError"}}function Zr(){return{derivedTokens:0}}function Le(e,t){if(!Number.isSafeInteger(e.derivedTokens)||e.derivedTokens<0||e.derivedTokens>Wl.maxDerivedTokens||!Number.isSafeInteger(t)||t<0||t>Wl.maxDerivedTokens-e.derivedTokens)throw new he;e.derivedTokens+=t}import{isAbsolute as yg,resolve as zl}from"node:path";import{basename as fg,dirname as pg,join as Ki}from"node:path";var an=Object.freeze({maxEnvironmentExpansionDepth:64,maxMissingSuffixComponents:256,maxRealpathAttempts:16384,maxProcessedCandidateBytes:4194304});class Pe extends Error{name="PathCanonicalizationLimitError";constructor(){super("Path canonicalization work limit exceeded.")}}function Jr(){return{realpathAttempts:0,processedCandidateBytes:0,resolvedPaths:new Map}}function Mt(e){return{...Jr(),environment:e}}var Xr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Qr(e,t){return Yi(e,0,t)}function Yi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Zi(e,o+2),a=gg(e,o,t);if(a===null){if(Xr.has(s))throw new Pe;r+=e.slice(o);break}let l=e.slice(o,a+1);r+=hg(l,t,n),o=a+1;continue}let i=Zi(e,o+1);if(!i){r+="$",o++;continue}r+=Xi(i,n)??`$${i}`,o+=i.length+1}return r}function gg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>an.maxEnvironmentExpansionDepth)throw new Pe;o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function hg(e,t,n){let r=e.slice(2,-1),o=Zi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Xi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Xr.has(o))throw new Pe;return e}if(!Xr.has(o))return e;if(s.endsWith("="))throw new Pe;let a=Xi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new Pe;if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Yi(i.slice(s.length),t+1,n);return l?Yi(i.slice(s.length),t+1,n):""}function Zi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function H(e,t,n=Jr()){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(i),n.realpathAttempts>an.maxRealpathAttempts||n.processedCandidateBytes>an.maxProcessedCandidateBytes)throw new Pe;let s=t.realpath(i);if(s!==null){let l=o.length===0?s:Ki(s,...o.reverse());return n.resolvedPaths.set(e,l),l}let a=pg(i);if(a===i){let l=o.length===0?i:Ki(i,...o.reverse());return n.resolvedPaths.set(e,l),l}if(o.length>=an.maxMissingSuffixComponents){let l=Ki(i,...o.reverse());return n.resolvedPaths.set(e,l),l}o.push(fg(i)),i=a}}function Gl(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(e),n.realpathAttempts>an.maxRealpathAttempts||n.processedCandidateBytes>an.maxProcessedCandidateBytes)throw new Pe;let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Xi(e,t){if(!Xr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}var $l=64;function Hn(e,t,n){let r=yg(e)?zl(e):t?zl(t,e):void 0;if(!r)return;try{return H(r,n)}catch{return r}}function Bl(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}function z(e){return D(e).toLowerCase()}function D(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}var eo=10,ln=20,Dt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,cn=256,ee=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Ul=new Set(["python","python3","python2","node","ruby","perl"]),Hl=/^python(?:[23](?:\.\d+)*)?$/,to=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Lt="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",un="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",no=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),Cg=new Set(["-p","--print"]),bg=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Sg=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),vg=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Rg=new Map([["python",new Set(["m"])]]),xg=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Eg=new Set(["always","default","never"]),wg=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Pg=/\\\r?\n/g,_g=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function ro(e){return io(e).code}function oo(e){return io(e).sources}function Vl(e){return _g.get(ao(e))??[]}function io(e){let t=ao(e[0]??"");if(!no.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&Cg.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(kg(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Tg(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=Ag(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let f=e[i+1];if(f===void 0||f.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:f}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(xg.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&wg.has(s))||t==="python"&&!Eg.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let f=s[m];if(f===void 0)break;if(Rg.get(t)?.has(f)){let d=s.slice(m+1),p=d||e[i+1];if(p!==void 0)r.push({tokenIndex:d?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(bg.get(t)?.has(f)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&f==="r"){if(s==="-r"){let d=e[i+1];if(o&&=d!==void 0&&!d.startsWith("-"),o&&d!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:d});i++}else o=!1;break}if(t==="ruby"&&f==="r"){let d=s.slice(m+1),p=d||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:d?i:i+1,kind:"module-file",value:p});if(!d)i++;break}if(t==="perl"&&(f==="M"||f==="m")){let d=s.slice(m+1);if(d)r.push({tokenIndex:i,kind:"module-file",value:d});else if(o=!1,m+1===s.length)i++;break}if(Sg.get(t)?.has(f)){if(m+1===s.length)i++;break}if(vg.get(t)?.has(f)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function Ag(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ye(e){return no.has(ao(e))}function so(e,t){return ao(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function ao(e){let t=D(e).toLowerCase();return Hl.test(t)?"python":t}function kg(e,t){return no.get(e)?.has(t)??!1}function Tg(e){return no.get(e)?.has("--eval")??!1}function dn(e,t){let n=Mg(e,t);if(!jl(n,t))return!1;ge(t,n);let r=Og(n);if(jl(r,t))return!0;return ge(t,r),Ig.test(r)}var Ig=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Og(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function jl(e,t){if(jr(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(ge(t,e),r.test(e))return!0;if(jr(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(ge(t,e),r.test(e))return!0;if(jr(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(ge(t,e),n.some((o)=>Vr(o,r))))}function Mg(e,t){return ge(t,e),e.replace(Pg,"")}var B=Object.freeze({maxChildAnalyses:1024,maxDerivedTokens:16384,maxDerivedBytes:1048576,maxPlaceholderReplacements:16384}),ql="Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.";class co extends Error{constructor(){super("Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.");this.name="ParallelAnalysisLimitError"}}function Kl(){return{childAnalyses:0,derivedTokens:0,derivedBytes:0,placeholderReplacements:0}}function Ce(e,t){let n=t.childAnalyses??0,r=t.derivedTokens??0,o=t.derivedBytes??0,i=t.placeholderReplacements??0;if(lo(e.childAnalyses,n,B.maxChildAnalyses)||lo(e.derivedTokens,r,B.maxDerivedTokens)||lo(e.derivedBytes,o,B.maxDerivedBytes)||lo(e.placeholderReplacements,i,B.maxPlaceholderReplacements))throw new co;e.childAnalyses+=n,e.derivedTokens+=r,e.derivedBytes+=o,e.placeholderReplacements+=i}function lo(e,t,n){return!Number.isSafeInteger(e)||e<0||e>n||!Number.isSafeInteger(t)||t<0||t>n-e}import{isAbsolute as _s,normalize as jy,parse as Vy,posix as pu,resolve as yn,sep as Ps}from"node:path";import{isAbsolute as Dg,join as Yl,normalize as Jl,parse as Lg,sep as Zl}from"node:path";var Ng=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Wg=` 	
-`;function jn(e,t){if(Ze(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Ji(e.get("TMPDIR")??"",t)}function ft(e,t){if(e.has("TMPDIR"))return Ji(e.get("TMPDIR")??"",t);let n=Qi(e,t);if(n===void 0)return!0;return Ji(n,t)}function Qi(e,t){return tc(e,t,"TMPDIR")}function Ji(e,t){if(!e)return!1;if(Gg(e))return!1;return es(e,t)}function Ze(e,t){let n=tc(e,t,"IFS");return n!==void 0&&n!==""&&n!==Wg}function es(e,t){let n=uo(e,t.paths);return n!==null&&ec(t).some((r)=>$g(n,r))}function Ql(e,t){let n=uo(e,t.paths);return n!==null&&ec(t).includes(n)}var Xl=new WeakMap;function ec(e){let t=Xl.get(e);if(t)return t;let n=Fg(e);return Xl.set(e,n),n}function Fg(e){let t=Ng.map((r)=>uo(r,e.paths)??Jl(r)),n=uo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&zg(n))return[...t,n];return t}function Gg(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function tc(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function zg(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function uo(e,t){try{let n=Jl(e);if(!Dg(n))return n;let r=Lg(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Yl(i,o[s]??"");if(t.entryKind(a)==="missing")return Yl(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function $g(e,t){if(e===t)return!0;let n=t.endsWith(Zl)?t:`${t}${Zl}`;return e.startsWith(n)}import{statSync as Ty}from"node:fs";import{isAbsolute as iu,join as Iy,relative as su}from"node:path";import{isAbsolute as nc,parse as Bg}from"node:path";var oc=/^[A-Za-z_][A-Za-z0-9_]*=/;function _e(e){if(!oc.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function mo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=_e(I(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function ic(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Nt(e,t,n,r){if(!ic(mn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<ln;m++){let f=rc(i),d=mo(i);for(let[g,y]of d.envAssignments)s.set(g,y),a.set(g,y);if(i=d.words,i.length===0)break;while(i.length>0&&mn(i).includes("=")&&!Hg(i)){let g=jg(mn(i),a,t.env)??$r(mn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=mn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=qg(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Zg(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[y,h]of g.envAssignments)s.set(y,h),a.set(y,h)}if(p==="command")i=Xg(i);if(p==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(rc(i)===f)break}let u=mo(i);for(let[m,f]of u.envAssignments)s.set(m,f),a.set(m,f);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Ug(u.words,o)}}function Ug(e,t){return e.some((n)=>!t.has(n))}function rc(e){return e.map(I).join(" ")}function mn(e){let t=e[0];return t?I(t):""}function We(e,t){let n=e[t];return n?I(n):void 0}function Hg(e){return oc.test(mn(e))}function jg(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Vg=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function qg(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?Vn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Vn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Vn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Vg.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Kg=new Set(["-i","-0","--null"]),Yg=new Set(["-u","--unset","-C","--chdir","-P"]);function Zg(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Kg.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=We(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Yg.has(c)){if(c==="-C"||c==="--chdir"){let m=We(e,a+1);s=m?Vn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Vn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!_e(c))break;while(a<e.length){let m=_e(We(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function Vn(e,t,n){if(t==="")return null;if(!e&&!nc(t))return null;let r=nc(t)?Bg(t).root:n.realpath(e??"/");if(r===null)return null;try{return bt(r,t,n)}catch{return null}}function Xg(e){if(We(e,1)==="-v")return[...G(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Jg=/['"\\$`{}#]/;function fo(e,t){if(e.some((r)=>Jg.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function fn(e,t,n){return po(e,t,n).tokens}function Qg(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function vt(e,t,n,r=0){let o=po(e,t,n),i=(o.envSplitValues??[]).flatMap(Qg);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return vt(s,t,n,r+1)}function po(e,t,n,r){if(!ic(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Nt(G(e),t,n,r);return{tokens:o.words.map(I),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}import{basename as Ey,isAbsolute as wy,normalize as Py,resolve as tu}from"node:path";function go(){return[]}function ho(){return[]}function yo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function eh(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>ue(t)))})}function Co(e,t,n){e.push(n),t.reset()}function th(e,t,n,r,o){if(r<=n)return;e.push({raw:t.slice(n,r),span:{start:n,end:r},provenance:o})}function bo(e){let t=[];return{parts:t,push:(n,r,o)=>th(t,e,n,r,o)}}function ts(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function pn(e,t,n,r,o,i,s){return ts({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function ue(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return eh(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:ue(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function ns(e,t,n){if(t>=n||ac(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!ac(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=sc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=sc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function rs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=nh(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?rh(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function sc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function ac(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function nh(e,t,n){let r=t;while(r<n&&e[r]!==`
+`||e===";"||e==="&"||e==="|"}function on(e){return e==="|"||e===";"}function jr(e,t,n){let r=ji(e,n);if(t==="rm")return Vp(r);if(t==="dd")return Kp(r);return Il(r,!0)}function Vr(e,t,n){let r=ji(e,n);if(t==="rm")return Yp(r);if(t==="reset-hard")return kl(r,"--ha","rd");if(t==="reset-merge")return kl(r,"--me","rge");if(t==="clean")return Qp(r);if(t==="checkout")return tg(r);if(t==="push-force")return ng(r);if(t==="push-refspec")return rg(r);if(t==="push-delete")return og(r);if(t==="branch")return ig(r);if(t==="tag")return lg(r);if(t==="restore")return cg(r);return Il(r,!1)}function Vp(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=X(e);i++){let s=v(e,i);if(!t){let l=v(e,i+2);if(ut(e,i,"rm")&&K(l)&&l!==`
+`)t=!0,i++;continue}let a=qp(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===X(e)){if(o>=0){let l=Pl(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(K(s)){if(o>=0){if(Y(e,o,"--")&&i-o===2)t=!1,n=!1,r=!1;else{let l=Pl(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0}o=-1}continue}if(o<0)o=i}return!1}function qp(e,t){if(v(e,t)!=="\\"||v(e,t-1)==="\\")return-1;if(Y(e,t,String.raw`\n`))return t+2;if(Y(e,t,String.raw`\x0a`)||Y(e,t,String.raw`\x0A`))return t+5;if(Y(e,t,String.raw`\u000a`)||Y(e,t,String.raw`\u000A`))return t+7;return Y(e,t,String.raw`\012`)?t+4:-1}function Pl(e,t,n){if(_l(e,t,n,"recursive"))return{recursive:!0,force:!1};if(_l(e,t,n,"force"))return{recursive:!1,force:!0};if(v(e,t)!=="-"||v(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=v(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function _l(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!Y(e,t,"--"))return!1;for(let i=0;i<o;i++)if(v(e,t+i+2)!==r[i])return!1;return!0}function Kp(e){let t=!1;for(let n=0;n<X(e);n++){if(te(v(e,n))){t=!1;continue}if(ut(e,n,"dd")){t=!0,n++;continue}if(!t||!ut(e,n,"of")||!Y(e,n,"of=/dev/"))continue;let r=n+8;if(r<X(e)&&!K(v(e,r))&&v(e,r)!=="'"&&v(e,r)!=='"')return!0}return!1}function Yp(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);){let i=v(e,o);if(o===X(e)||te(i)){t=!1,n=!1,r=!1,o++;continue}let s=Xp(e,o);if(s>=0){if(Zp(e,s))return!0;let a=s,l=!1;while(K(v(e,a)))l||=v(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(Y(e,o,"--")&&(o===0||K(v(e,o-1)))&&(!v(e,o+2)||K(v(e,o+2))||te(v(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=Y(e,o,"--recursive")&&dt(e,o+11)||qi(e,o,"recursive"),r||=Y(e,o,"--force")&&dt(e,o+7)||qi(e,o,"force"),n&&r)return!0;o++}return!1}function qi(e,t,n){if(!Y(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=v(e,t+r+2);if(!o||K(o)||te(o))break;if(o!==n[r])return!1;r++}return r>0&&dt(e,t+r+2)}function Zp(e,t){let n=t,r=!1,o=!1;while(n<X(e)){while(K(v(e,n)))n++;let i=n;while(n<X(e)&&!K(v(e,n)))n++;if(v(e,i)!=="-"||n-i===2&&Y(e,i,"--"))return!1;let s=Al(e,i,"recursive"),a=Al(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,v(e,i+1)==="-")continue;let l=Jp(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Al(e,t,n){return Y(e,t,`--${n}`)&&dt(e,t+n.length+2)||qi(e,t,n)}function Xp(e,t){if(t>0&&Ot(v(e,t-1)))return-1;let n=t;if(v(e,n)==="\\")n++;if(v(e,n)!=="r")return-1;if(n++,v(e,n)==="\\")n++;if(v(e,n)!=="m"||!K(v(e,n+1)))return-1;return n+1}function Jp(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(v(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=v(e,c)??"",m=(u==="r"||u==="f")&&dt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function kl(e,t,n){return Un(e,"reset",on,!0,(r)=>v(e,r)==="-"&&sn(e,r,t,n)?!0:r)}function Qp(e){return Un(e,"clean",on,!0,(t)=>{if(v(e,t)!=="-")return t;if(sn(e,t,"--fo","rce"))return!0;let n=Bn(e,t,on);for(let r=t+1;r<n;r++)if(v(e,r)==="f")return!0;return n-1})}function qr(e,t,n){if(!ut(e,t,"git"))return null;let r=t+3;if(!K(v(e,r)))return{commandEnd:-1,next:r};while(K(v(e,r)))r++;while(r<X(e)){if(te(v(e,r)))return{commandEnd:-1,next:r};let o=Bn(e,r,te);if(ut(e,r,n))return{commandEnd:r+n.length,next:o};if(v(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&Y(e,r,"--"),s=eg(e,r,o);r=o;while(K(v(e,r)))r++;if(i)return{commandEnd:ut(e,r,n)?r+n.length:-1,next:Bn(e,r,te)};if(!s)continue;if(r>=X(e)||te(v(e,r)))return{commandEnd:-1,next:r};r=Bn(e,r,te);while(K(v(e,r)))r++}return{commandEnd:-1,next:r}}function eg(e,t,n){for(let r of Ye)if(n-t===r.length&&Y(e,t,r))return!0;return!1}function tg(e){return Tl(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function ng(e){return Un(e,"push",on,!0,(t)=>{if(v(e,t)!=="-")return t;if(v(e,t+1)==="f"&&!Ot(v(e,t+2))&&!Y(e,t+2,"-with-lease"))return!0;let n=Ol(e,t,"--fo","rce");if(n>=0&&!Y(e,n,"-with-lease"))return!0;return t})}function rg(e){return Un(e,"push",te,!1,(t)=>{if(K(v(e,t))&&v(e,t+1)==="+"&&t+2<X(e)&&!te(v(e,t+2))&&!K(v(e,t+2)))return!0;if(v(e,t)===":"&&v(e,t+1)==="+")return!0;return t})}function og(e){return Un(e,"push",te,!1,(t)=>{if(v(e,t)==="-"&&sn(e,t,"--de","lete"))return!0;if(K(v(e,t))&&v(e,t+1)===":"&&t+2<X(e)&&!K(v(e,t+2))&&!te(v(e,t+2)))return!0;return t})}function ig(e){let t=!1,n=!1,r=!1;for(let o=0;o<=X(e);o++){if(o===X(e)||te(v(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=qr(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||v(e,o)!=="-")continue;let i=Bn(e,o,te),s=sg(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function sg(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(v(e,i)!=="-")continue;if(sn(e,i,"--de","lete"))r=!0;if(sn(e,i,"--fo","rce"))o=!0;if(v(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&ag(v(e,s))){let u=v(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!dt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function ag(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function lg(e){return Tl(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Tl(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<X(e);r++){let o=v(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&v(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(K(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=qr(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&K(v(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(sn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(v(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&dt(e,r+1))return!0;if(on(o))i.outerActive=!1}return!1}function Un(e,t,n,r,o){let i=!1;for(let s=0;s<X(e);s++){let a=v(e,s),l=n(a);if(!i&&!l){let c=qr(e,s,t);if(c){i=c.commandEnd>=0&&(!r||K(v(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(v(e,u)))i=!1;s=c}if(l)i=!1}return!1}function cg(e){let t=!1;for(let n=0;n<X(e);n++){if(Vi(v(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=qr(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&v(e,n)==="-"&&v(e,n+1)==="-"&&(Y(e,n+2,"staged")||Y(e,n+2,"help")))t=!1}return t}function Il(e,t){let n=!1;for(let r=0;r<X(e);r++){let o=v(e,r),i=t?Vi(o):te(o);if(n&&K(o)&&v(e,r+1)==="-"&&ut(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(ut(e,r,"find"))n=!0,r+=3}return!1}function Bn(e,t,n){let r=t;while(r<X(e)&&!K(v(e,r))&&!n(v(e,r)))r++;return r}function Ol(e,t,n,r){if(!Y(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&v(e,o)===r[i];i++)o++;return dt(e,o)?o:-1}function sn(e,t,n,r){return Ol(e,t,n,r)>=0}var ug=["git.ssh-env","git.alias-config","git.checkout-force","git.checkout-double-dash","git.checkout-ref-path","git.checkout-pathspec-from-file","git.checkout-ambiguous","git.switch-discard-changes","git.switch-force","git.restore-worktree","git.restore-unstaged","git.reset-hard","git.reset-merge","git.clean-force","git.rm-force","git.push-force","git.push-delete","git.push-mirror","git.branch-force-delete","git.rebase-abort","git.merge-abort","git.tag-delete","git.reflog-delete","git.stash-drop","git.stash-clear","git.worktree-remove-force","rm.recursive-force-root-or-home","rm.git-metadata","rm.recursive-force-dynamic-target","rm.recursive-force-home-cwd","rm.recursive-force-cwd-self","rm.recursive-force-outside-cwd","rm.recursive-force-paranoid","powershell.remove-item-root-or-home","powershell.remove-item-recursive-force-root-or-home","powershell.remove-item-git-metadata","powershell.remove-item-recursive-force-dynamic-target","powershell.remove-item-recursive-force-home-cwd","powershell.remove-item-recursive-force-cwd-self","powershell.remove-item-recursive-force-outside-cwd","powershell.remove-item-recursive-force-paranoid","powershell.remove-item-pipeline-dynamic-target","find.delete","find.delete-git-metadata","find.exec-rm-recursive-force","dd.device-write","mkfs.device","shred.target","interpreter.dangerous-command","interpreter.one-liner-paranoid","awk.system-dynamic","xargs.rm-recursive-force-dynamic","xargs.shell-dynamic","parallel.rm-recursive-force-dynamic","parallel.shell-dynamic","parallel.command-stream-dynamic","shell.dynamic-structure","shell.dynamic-executable","raw-text.dangerous-command"],Kr=new Set(ug),Yr=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],dg=new Map(Yr.map((e)=>[e.id,e.intent])),Ml=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function b(e,t){return{id:e,reason:t,intent:dg.get(e)??"manual_only"}}function k(e,t){if(!e)return null;if(Ml.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function Q(e,t,n){if(Ml.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Ki(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Dl(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Ki(e,t)})}function mt(e,t){$n(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)ge(t,a);if((s.regex?.test(a)??!1)||s.scan&&Vr(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var mg=/^[A-Za-z_][A-Za-z0-9_]*=/;function Nl(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;$n(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Wl(t.nodes,r,i)}function Wl(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Wl(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return fg(r,t,n)})}function fg(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!mg.test(o.text));return e.words.every((o,i)=>o===t||Ll(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Ll(o.target.raw,n.anchored,!0)))}function Ll(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}var Fl=Object.freeze({maxDerivedTokens:16384}),Gl="Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.";class he extends Error{constructor(){super("Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry.");this.name="DerivedCommandWorkLimitError"}}function Zr(){return{derivedTokens:0}}function Le(e,t){if(!Number.isSafeInteger(e.derivedTokens)||e.derivedTokens<0||e.derivedTokens>Fl.maxDerivedTokens||!Number.isSafeInteger(t)||t<0||t>Fl.maxDerivedTokens-e.derivedTokens)throw new he;e.derivedTokens+=t}import{isAbsolute as Cg,resolve as $l}from"node:path";import{basename as pg,dirname as gg,join as Yi}from"node:path";var an=Object.freeze({maxEnvironmentExpansionDepth:64,maxMissingSuffixComponents:256,maxRealpathAttempts:16384,maxProcessedCandidateBytes:4194304});class Pe extends Error{name="PathCanonicalizationLimitError";constructor(){super("Path canonicalization work limit exceeded.")}}function Jr(){return{realpathAttempts:0,processedCandidateBytes:0,resolvedPaths:new Map}}function Mt(e){return{...Jr(),environment:e}}var Xr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Qr(e,t){return Zi(e,0,t)}function Zi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Xi(e,o+2),a=hg(e,o,t);if(a===null){if(Xr.has(s))throw new Pe;r+=e.slice(o);break}let l=e.slice(o,a+1);r+=yg(l,t,n),o=a+1;continue}let i=Xi(e,o+1);if(!i){r+="$",o++;continue}r+=Ji(i,n)??`$${i}`,o+=i.length+1}return r}function hg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>an.maxEnvironmentExpansionDepth)throw new Pe;o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function yg(e,t,n){let r=e.slice(2,-1),o=Xi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ji(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Xr.has(o))throw new Pe;return e}if(!Xr.has(o))return e;if(s.endsWith("="))throw new Pe;let a=Ji(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new Pe;if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Zi(i.slice(s.length),t+1,n);return l?Zi(i.slice(s.length),t+1,n):""}function Xi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function H(e,t,n=Jr()){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(i),n.realpathAttempts>an.maxRealpathAttempts||n.processedCandidateBytes>an.maxProcessedCandidateBytes)throw new Pe;let s=t.realpath(i);if(s!==null){let l=o.length===0?s:Yi(s,...o.reverse());return n.resolvedPaths.set(e,l),l}let a=gg(i);if(a===i){let l=o.length===0?i:Yi(i,...o.reverse());return n.resolvedPaths.set(e,l),l}if(o.length>=an.maxMissingSuffixComponents){let l=Yi(i,...o.reverse());return n.resolvedPaths.set(e,l),l}o.push(pg(i)),i=a}}function zl(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;if(n.realpathAttempts++,n.processedCandidateBytes+=Buffer.byteLength(e),n.realpathAttempts>an.maxRealpathAttempts||n.processedCandidateBytes>an.maxProcessedCandidateBytes)throw new Pe;let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Ji(e,t){if(!Xr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}var Bl=64;function Hn(e,t,n){let r=Cg(e)?$l(e):t?$l(t,e):void 0;if(!r)return;try{return H(r,n)}catch{return r}}function Ul(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}function z(e){return D(e).toLowerCase()}function D(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}var eo=10,ln=20,Dt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,cn=256,ee=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Hl=new Set(["python","python3","python2","node","ruby","perl"]),jl=/^python(?:[23](?:\.\d+)*)?$/,to=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Lt="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",un="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",no=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),bg=new Set(["-p","--print"]),Sg=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),vg=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Rg=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),xg=new Map([["python",new Set(["m"])]]),Eg=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),wg=new Set(["always","default","never"]),Pg=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),_g=/\\\r?\n/g,Ag=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function ro(e){return io(e).code}function oo(e){return io(e).sources}function ql(e){return Ag.get(ao(e))??[]}function io(e){let t=ao(e[0]??"");if(!no.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&bg.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(Tg(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Ig(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=kg(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let f=e[i+1];if(f===void 0||f.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:f}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(Eg.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&Pg.has(s))||t==="python"&&!wg.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let f=s[m];if(f===void 0)break;if(xg.get(t)?.has(f)){let d=s.slice(m+1),p=d||e[i+1];if(p!==void 0)r.push({tokenIndex:d?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(Sg.get(t)?.has(f)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&f==="r"){if(s==="-r"){let d=e[i+1];if(o&&=d!==void 0&&!d.startsWith("-"),o&&d!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:d});i++}else o=!1;break}if(t==="ruby"&&f==="r"){let d=s.slice(m+1),p=d||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:d?i:i+1,kind:"module-file",value:p});if(!d)i++;break}if(t==="perl"&&(f==="M"||f==="m")){let d=s.slice(m+1);if(d)r.push({tokenIndex:i,kind:"module-file",value:d});else if(o=!1,m+1===s.length)i++;break}if(vg.get(t)?.has(f)){if(m+1===s.length)i++;break}if(Rg.get(t)?.has(f)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function kg(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function ye(e){return no.has(ao(e))}function so(e,t){return ao(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function ao(e){let t=D(e).toLowerCase();return jl.test(t)?"python":t}function Tg(e,t){return no.get(e)?.has(t)??!1}function Ig(e){return no.get(e)?.has("--eval")??!1}function dn(e,t){let n=Dg(e,t);if(!Vl(n,t))return!1;ge(t,n);let r=Mg(n);if(Vl(r,t))return!0;return ge(t,r),Og.test(r)}var Og=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Mg(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Vl(e,t){if(jr(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(ge(t,e),r.test(e))return!0;if(jr(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(ge(t,e),r.test(e))return!0;if(jr(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(ge(t,e),n.some((o)=>Vr(o,r))))}function Dg(e,t){return ge(t,e),e.replace(_g,"")}var B=Object.freeze({maxChildAnalyses:1024,maxDerivedTokens:16384,maxDerivedBytes:1048576,maxPlaceholderReplacements:16384}),Kl="Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.";class co extends Error{constructor(){super("Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry.");this.name="ParallelAnalysisLimitError"}}function Yl(){return{childAnalyses:0,derivedTokens:0,derivedBytes:0,placeholderReplacements:0}}function Ce(e,t){let n=t.childAnalyses??0,r=t.derivedTokens??0,o=t.derivedBytes??0,i=t.placeholderReplacements??0;if(lo(e.childAnalyses,n,B.maxChildAnalyses)||lo(e.derivedTokens,r,B.maxDerivedTokens)||lo(e.derivedBytes,o,B.maxDerivedBytes)||lo(e.placeholderReplacements,i,B.maxPlaceholderReplacements))throw new co;e.childAnalyses+=n,e.derivedTokens+=r,e.derivedBytes+=o,e.placeholderReplacements+=i}function lo(e,t,n){return!Number.isSafeInteger(e)||e<0||e>n||!Number.isSafeInteger(t)||t<0||t>n-e}import{isAbsolute as As,normalize as Vy,parse as qy,posix as gu,resolve as yn,sep as _s}from"node:path";import{isAbsolute as Lg,join as Zl,normalize as Ql,parse as Ng,sep as Xl}from"node:path";var Wg=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Fg=` 	
+`;function jn(e,t){if(Ze(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Qi(e.get("TMPDIR")??"",t)}function ft(e,t){if(e.has("TMPDIR"))return Qi(e.get("TMPDIR")??"",t);let n=es(e,t);if(n===void 0)return!0;return Qi(n,t)}function es(e,t){return nc(e,t,"TMPDIR")}function Qi(e,t){if(!e)return!1;if(zg(e))return!1;return ts(e,t)}function Ze(e,t){let n=nc(e,t,"IFS");return n!==void 0&&n!==""&&n!==Fg}function ts(e,t){let n=uo(e,t.paths);if(n===null)return!1;return tc(t).some((r)=>Bg(n,r))}function ec(e,t){let n=uo(e,t.paths);if(n===null)return!1;return tc(t).some((r)=>mo(r)===mo(n))}var Jl=new WeakMap;function tc(e){let t=Jl.get(e);if(t)return t;let n=Gg(e);return Jl.set(e,n),n}function Gg(e){let t=Wg.map((r)=>uo(r,e.paths)??Ql(r)),n=uo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&$g(n))return[...t,n];return t}function zg(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function nc(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function $g(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function uo(e,t){try{let n=Ql(e);if(!Lg(n))return n;let r=Ng(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Zl(i,o[s]??"");if(t.entryKind(a)==="missing")return Zl(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Bg(e,t){let n=mo(e),r=mo(t);if(n===r)return!0;let o=r.endsWith(Xl)?r:`${r}${Xl}`;return n.startsWith(o)}function mo(e){return process.platform==="win32"?e.toLowerCase():e}import{statSync as Iy}from"node:fs";import{isAbsolute as su,join as Oy,relative as au}from"node:path";import{isAbsolute as rc,parse as Ug}from"node:path";var ic=/^[A-Za-z_][A-Za-z0-9_]*=/;function _e(e){if(!ic.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function fo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=_e(I(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function sc(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Nt(e,t,n,r){if(!sc(mn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<ln;m++){let f=oc(i),d=fo(i);for(let[g,y]of d.envAssignments)s.set(g,y),a.set(g,y);if(i=d.words,i.length===0)break;while(i.length>0&&mn(i).includes("=")&&!jg(i)){let g=Vg(mn(i),a,t.env)??$r(mn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=mn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Kg(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Xg(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[y,h]of g.envAssignments)s.set(y,h),a.set(y,h)}if(p==="command")i=Jg(i);if(p==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(oc(i)===f)break}let u=fo(i);for(let[m,f]of u.envAssignments)s.set(m,f),a.set(m,f);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Hg(u.words,o)}}function Hg(e,t){return e.some((n)=>!t.has(n))}function oc(e){return e.map(I).join(" ")}function mn(e){let t=e[0];return t?I(t):""}function We(e,t){let n=e[t];return n?I(n):void 0}function jg(e){return ic.test(mn(e))}function Vg(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var qg=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Kg(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?Vn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Vn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Vn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(qg.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Yg=new Set(["-i","-0","--null"]),Zg=new Set(["-u","--unset","-C","--chdir","-P"]);function Xg(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Yg.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=We(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Zg.has(c)){if(c==="-C"||c==="--chdir"){let m=We(e,a+1);s=m?Vn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Vn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!_e(c))break;while(a<e.length){let m=_e(We(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function Vn(e,t,n){if(t==="")return null;if(!e&&!rc(t))return null;let r=rc(t)?Ug(t).root:n.realpath(e??"/");if(r===null)return null;try{return bt(r,t,n)}catch{return null}}function Jg(e){if(We(e,1)==="-v")return[...G(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Qg=/['"\\$`{}#]/;function po(e,t){if(e.some((r)=>Qg.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function fn(e,t,n){return go(e,t,n).tokens}function eh(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function vt(e,t,n,r=0){let o=go(e,t,n),i=(o.envSplitValues??[]).flatMap(eh);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return vt(s,t,n,r+1)}function go(e,t,n,r){if(!sc(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Nt(G(e),t,n,r);return{tokens:o.words.map(I),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}import{basename as wy,isAbsolute as Py,normalize as _y,resolve as nu}from"node:path";function ho(){return[]}function yo(){return[]}function Co(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function th(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>ue(t)))})}function bo(e,t,n){e.push(n),t.reset()}function nh(e,t,n,r,o){if(r<=n)return;e.push({raw:t.slice(n,r),span:{start:n,end:r},provenance:o})}function So(e){let t=[];return{parts:t,push:(n,r,o)=>nh(t,e,n,r,o)}}function ns(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function pn(e,t,n,r,o,i,s){return ns({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function ue(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return th(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:ue(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function rs(e,t,n){if(t>=n||lc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!lc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=ac(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=ac(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function os(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=rh(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?oh(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function ac(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function lc(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function rh(e,t,n){let r=t;while(r<n&&e[r]!==`
 `&&e[r]!=="\r")r++;let o=r>=n?n:e[r]==="\r"&&e[r+1]===`
-`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function rh(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var mc=new Set(["&&","||","|","|&"]);function fc(e,t,n){let r={start:0,end:e.length};if(e.length>n.maxInputLength)return ue({kind:"program",dialect:t,source:e,span:r,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${n.maxInputLength} UTF-16 code units`,span:r}],nodes:[]});let o=Ro(e,0,e.length,t,n,{used:0,max:n.maxWords},0);return ue({kind:"program",dialect:t,source:e,span:r,status:wo(o.issues,o.limited),issues:o.issues,nodes:o.nodes})}function Ro(e,t,n,r,o,i,s,a){let l=go(),c=ho(),u=yo(),m=[],f=()=>{if(u.words.length===0&&u.redirections.length===0)return;let p={start:u.start,end:u.end},g=u.words.map((y)=>y.text);Co(l,u,{kind:"command",dialect:r,source:e.slice(p.start,p.end),span:p,words:u.words,redirections:u.redirections,nested:u.nested,displayText:c.length>0&&l.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let p=e[d];if(!p)break;if(a&&p===a)return f(),dc(l,c),{nodes:l,issues:c,next:d+1,closed:!0,limited:!1,pendingHeredocs:m};if(Eo(p)){if(p===`
+`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function oh(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var fc=new Set(["&&","||","|","|&"]);function pc(e,t,n){let r={start:0,end:e.length};if(e.length>n.maxInputLength)return ue({kind:"program",dialect:t,source:e,span:r,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${n.maxInputLength} UTF-16 code units`,span:r}],nodes:[]});let o=xo(e,0,e.length,t,n,{used:0,max:n.maxWords},0);return ue({kind:"program",dialect:t,source:e,span:r,status:Po(o.issues,o.limited),issues:o.issues,nodes:o.nodes})}function xo(e,t,n,r,o,i,s,a){let l=ho(),c=yo(),u=Co(),m=[],f=()=>{if(u.words.length===0&&u.redirections.length===0)return;let p={start:u.start,end:u.end},g=u.words.map((y)=>y.text);bo(l,u,{kind:"command",dialect:r,source:e.slice(p.start,p.end),span:p,words:u.words,redirections:u.redirections,nested:u.nested,displayText:c.length>0&&l.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let p=e[d];if(!p)break;if(a&&p===a)return f(),mc(l,c),{nodes:l,issues:c,next:d+1,closed:!0,limited:!1,pendingHeredocs:m};if(wo(p)){if(p===`
 `||p==="\r"){f();let P=p==="\r"&&e[d+1]===`
-`?d+2:d+1,S=l.at(-1);if(S?.kind!=="connector"||!mc.has(S.operator))l.push(Object.freeze({kind:"connector",operator:e.slice(d,P),span:Object.freeze({start:d,end:P})}));if(m.length>0){let C=rs(e,P,n,m.splice(0));c.push(...C.issues),d=C.next;continue}d=P;continue}d++;continue}if(p==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let g=u.start===-1?Rh(e,d,n):void 0;if(g){if(is(l,c,d),s>=o.maxDepth)return gn(l,c,d,"depth-limit",o.maxDepth);if(!os(i))return gn(l,c,d,"word-limit",o.maxWords);let P=Ro(e,g.braceIndex+1,n,r,o,i,s+1,"}"),S=P.next,C={start:g.braceIndex+1,end:P.closed?S-1:S},_=lc(e,r,C,P);if(l.push({kind:"function",name:g.name,span:{start:d,end:S},body:_}),c.push(...P.issues),P.pendingHeredocs.length>0||Kn(P.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:d,end:S}});if(m.push(...P.pendingHeredocs),P.limited)return vo(l,c,P.next);if(!P.closed)c.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:g.braceIndex,end:S}});d=S;continue}let y=xo(e,d);if(y){if(f(),!vc(l.at(-1)))c.push({code:"unexpected-connector",message:`connector ${y} has no preceding command`,span:{start:d,end:d+y.length}});l.push(Object.freeze({kind:"connector",operator:y,span:Object.freeze({start:d,end:d+y.length})})),d+=y.length;continue}if(p===")"){f(),c.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:d,end:d+1}}),l.push({kind:"unknown",source:p,span:{start:d,end:d+1}}),d++;continue}if((p==="("||p==="{"&&uh(e,d,n))&&u.start===-1){if(is(l,c,d),s>=o.maxDepth)return gn(l,c,d,"depth-limit",o.maxDepth);let P=p==="("?")":"}",S=Ro(e,d+1,n,r,o,i,s+1,P),C=S.next,_={start:d+1,end:S.closed?C-1:C},E=lc(e,r,_,S);if(l.push({kind:"group",style:p==="("?"subshell":"brace",span:{start:d,end:C},body:E}),c.push(...S.issues),S.pendingHeredocs.length>0||Kn(S.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:d,end:C}});if(m.push(...S.pendingHeredocs),S.limited)return vo(l,c,S.next);if(!S.closed)c.push({code:p==="("?"unclosed-subshell":"unclosed-brace-group",message:`${p} group is not closed`,span:{start:d,end:C}});d=C;continue}let h=(p==="<"||p===">")&&e[d+1]!=="("?sh(e,d):null;if(h){let P=u.words.at(-1),S=P&&P.span.end===d&&/^[0-9]+$/.test(P.raw)?Number(P.raw):void 0;if(S!==void 0)u.words.pop();let C=S===void 0?d:P?.span.start??d;u.start=u.start===-1?d:u.start;let _=d+h.length;while(_<n&&/[ \t]/.test(e[_]??""))_++;let E=e[_],T=_>d+h.length&&E==="#",O=!E||Eo(E)||!!xo(e,_)||E===a||E===")"||T||(E==="<"||E===">")&&e[_+1]!=="(",M=h==="<<"||h==="<<-"?ns(e,_,n):void 0,F=M?{word:pn(e,_,M.next,M.delimiter,"literal",M.quoted),nested:[],issues:[],next:M.next,limited:!1}:!O?ss(e,_,n,r,o,i,s):void 0;if(F){if(c.push(...F.issues),F.limited)return vo(l,c,F.next);if(!os(i))return gn(l,c,F.next,"word-limit",o.maxWords)}let oe=F?.next??d+h.length,Ee={kind:"redirection",operator:h,span:{start:C,end:oe},...S===void 0?{}:{fd:S},...F?{target:F.word}:{}};if(u.redirections.push(Ee),h==="<<"||h==="<<-")if(!M)c.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:d,end:d+h.length}});else{if(M.ambiguous||M.delimiter.length===0)c.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:M.span});m.push({delimiter:M.delimiter,quotedDelimiter:M.quoted,stripTabs:h==="<<-",declarationSpan:{start:C,end:oe},attach:(w)=>{Ee.heredoc=w}})}else if(!F)c.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`,span:{start:d,end:d+h.length}});if(F)u.nested.push(...F.nested);u.end=oe,d=oe;continue}if(u.start===-1)is(l,c,d);let R=ss(e,d,n,r,o,i,s);if(c.push(...R.issues),R.limited)return vo(l,c,R.next);let x=fh(u.words)?Ch(e,R.word,i.max-i.used,o.maxDepth,o.maxInputLength):void 0;if(x?.limitCode)return gn(l,c,R.next,x.limitCode,x.limitCode==="word-limit"?o.maxWords:x.limitCode==="depth-limit"?o.maxDepth:o.maxInputLength);let A=x?.words??[R.word];for(let P of A){if(!os(i))return gn(l,c,R.next,"word-limit",o.maxWords);u.words.push(P)}u.start=u.start===-1?d:u.start,u.end=R.next,u.nested.push(...R.nested),d=R.next>d?R.next:d+1}return f(),dc(l,c),c.push(...xh(m)),{nodes:l,issues:c,next:d,closed:a===void 0,limited:!1,pendingHeredocs:[]}}function lc(e,t,n,r){return{kind:"program",dialect:t,source:e.slice(n.start,n.end),span:n,status:wo(r.issues,r.limited),issues:r.issues,nodes:r.nodes}}function ss(e,t,n,r,o,i,s){let a="",l=t,c=!1,u="literal",m=[],f=[],d=!1;while(l<n){let p=e[l],g=(p==="<"||p===">")&&e[l+1]==="(";if(!p||Eo(p)||(p===";"||p==="|"||p==="&")&&xo(e,l)||(p==="<"||p===">")&&!g)break;if(p===")")break;if(p==="'"){c=!0;let h=e.indexOf("'",l+1);if(h===-1||h>=n){a+=e.slice(l+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:l,end:n}}),l=n;break}a+=e.slice(l+1,h),l=h+1;continue}if(p==='"'){c=!0;let h=oh(e,l,n,r,o,i,s);if(a+=h.text,m.push(...h.nested),f.push(...h.issues),d||=h.limited,u=qn(u,h.provenance),l=h.next,d)break;continue}if(e.startsWith("$'",l)){c=!0;let h=ah(e,l+2,n);if(a+=h.text,f.push(...h.issues),!h.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:l,end:n}});l=h.next;continue}if(p==="\\"){let h=e[l+1];if(!h){f.push({code:"trailing-escape",message:"escape has no following character",span:{start:l,end:l+1}}),l++;break}if(h===`
-`){l+=2;continue}a+=h,l+=2;continue}let y=p==="$"||p==="<"||p===">"||p==="`"?as(e,l,n,r,o,i,s):null;if(y){let h=pc(y,m,f);if(d||=h.limited,u=qn(u,h.provenance),l=h.next,d)break;continue}if(p==="$"){let h=yc(e,l,n,a,u);a=h.text,u=h.provenance,l=h.next;continue}if(p==="*"||p==="?"||p==="[")u=qn(u,"glob");a+=p,l++}return{word:pn(e,t,l,a,u,c,u==="literal"?void 0:ch(e,t,l)),nested:m,issues:f,next:l,limited:d}}function oh(e,t,n,r,o,i,s){let a="",l="literal",c=[],u=[],m=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:a,provenance:l,nested:c,issues:u,next:f+1,limited:m};if(d==="\\"&&e[f+1]){let g=e[f+1]??"";if(g===`
+`?d+2:d+1,S=l.at(-1);if(S?.kind!=="connector"||!fc.has(S.operator))l.push(Object.freeze({kind:"connector",operator:e.slice(d,P),span:Object.freeze({start:d,end:P})}));if(m.length>0){let C=os(e,P,n,m.splice(0));c.push(...C.issues),d=C.next;continue}d=P;continue}d++;continue}if(p==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let g=u.start===-1?xh(e,d,n):void 0;if(g){if(ss(l,c,d),s>=o.maxDepth)return gn(l,c,d,"depth-limit",o.maxDepth);if(!is(i))return gn(l,c,d,"word-limit",o.maxWords);let P=xo(e,g.braceIndex+1,n,r,o,i,s+1,"}"),S=P.next,C={start:g.braceIndex+1,end:P.closed?S-1:S},_=cc(e,r,C,P);if(l.push({kind:"function",name:g.name,span:{start:d,end:S},body:_}),c.push(...P.issues),P.pendingHeredocs.length>0||Kn(P.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:d,end:S}});if(m.push(...P.pendingHeredocs),P.limited)return Ro(l,c,P.next);if(!P.closed)c.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:g.braceIndex,end:S}});d=S;continue}let y=Eo(e,d);if(y){if(f(),!Rc(l.at(-1)))c.push({code:"unexpected-connector",message:`connector ${y} has no preceding command`,span:{start:d,end:d+y.length}});l.push(Object.freeze({kind:"connector",operator:y,span:Object.freeze({start:d,end:d+y.length})})),d+=y.length;continue}if(p===")"){f(),c.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:d,end:d+1}}),l.push({kind:"unknown",source:p,span:{start:d,end:d+1}}),d++;continue}if((p==="("||p==="{"&&dh(e,d,n))&&u.start===-1){if(ss(l,c,d),s>=o.maxDepth)return gn(l,c,d,"depth-limit",o.maxDepth);let P=p==="("?")":"}",S=xo(e,d+1,n,r,o,i,s+1,P),C=S.next,_={start:d+1,end:S.closed?C-1:C},E=cc(e,r,_,S);if(l.push({kind:"group",style:p==="("?"subshell":"brace",span:{start:d,end:C},body:E}),c.push(...S.issues),S.pendingHeredocs.length>0||Kn(S.nodes))c.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:d,end:C}});if(m.push(...S.pendingHeredocs),S.limited)return Ro(l,c,S.next);if(!S.closed)c.push({code:p==="("?"unclosed-subshell":"unclosed-brace-group",message:`${p} group is not closed`,span:{start:d,end:C}});d=C;continue}let h=(p==="<"||p===">")&&e[d+1]!=="("?ah(e,d):null;if(h){let P=u.words.at(-1),S=P&&P.span.end===d&&/^[0-9]+$/.test(P.raw)?Number(P.raw):void 0;if(S!==void 0)u.words.pop();let C=S===void 0?d:P?.span.start??d;u.start=u.start===-1?d:u.start;let _=d+h.length;while(_<n&&/[ \t]/.test(e[_]??""))_++;let E=e[_],T=_>d+h.length&&E==="#",O=!E||wo(E)||!!Eo(e,_)||E===a||E===")"||T||(E==="<"||E===">")&&e[_+1]!=="(",M=h==="<<"||h==="<<-"?rs(e,_,n):void 0,F=M?{word:pn(e,_,M.next,M.delimiter,"literal",M.quoted),nested:[],issues:[],next:M.next,limited:!1}:!O?as(e,_,n,r,o,i,s):void 0;if(F){if(c.push(...F.issues),F.limited)return Ro(l,c,F.next);if(!is(i))return gn(l,c,F.next,"word-limit",o.maxWords)}let oe=F?.next??d+h.length,Ee={kind:"redirection",operator:h,span:{start:C,end:oe},...S===void 0?{}:{fd:S},...F?{target:F.word}:{}};if(u.redirections.push(Ee),h==="<<"||h==="<<-")if(!M)c.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:d,end:d+h.length}});else{if(M.ambiguous||M.delimiter.length===0)c.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:M.span});m.push({delimiter:M.delimiter,quotedDelimiter:M.quoted,stripTabs:h==="<<-",declarationSpan:{start:C,end:oe},attach:(w)=>{Ee.heredoc=w}})}else if(!F)c.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`,span:{start:d,end:d+h.length}});if(F)u.nested.push(...F.nested);u.end=oe,d=oe;continue}if(u.start===-1)ss(l,c,d);let R=as(e,d,n,r,o,i,s);if(c.push(...R.issues),R.limited)return Ro(l,c,R.next);let x=ph(u.words)?bh(e,R.word,i.max-i.used,o.maxDepth,o.maxInputLength):void 0;if(x?.limitCode)return gn(l,c,R.next,x.limitCode,x.limitCode==="word-limit"?o.maxWords:x.limitCode==="depth-limit"?o.maxDepth:o.maxInputLength);let A=x?.words??[R.word];for(let P of A){if(!is(i))return gn(l,c,R.next,"word-limit",o.maxWords);u.words.push(P)}u.start=u.start===-1?d:u.start,u.end=R.next,u.nested.push(...R.nested),d=R.next>d?R.next:d+1}return f(),mc(l,c),c.push(...Eh(m)),{nodes:l,issues:c,next:d,closed:a===void 0,limited:!1,pendingHeredocs:[]}}function cc(e,t,n,r){return{kind:"program",dialect:t,source:e.slice(n.start,n.end),span:n,status:Po(r.issues,r.limited),issues:r.issues,nodes:r.nodes}}function as(e,t,n,r,o,i,s){let a="",l=t,c=!1,u="literal",m=[],f=[],d=!1;while(l<n){let p=e[l],g=(p==="<"||p===">")&&e[l+1]==="(";if(!p||wo(p)||(p===";"||p==="|"||p==="&")&&Eo(e,l)||(p==="<"||p===">")&&!g)break;if(p===")")break;if(p==="'"){c=!0;let h=e.indexOf("'",l+1);if(h===-1||h>=n){a+=e.slice(l+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:l,end:n}}),l=n;break}a+=e.slice(l+1,h),l=h+1;continue}if(p==='"'){c=!0;let h=ih(e,l,n,r,o,i,s);if(a+=h.text,m.push(...h.nested),f.push(...h.issues),d||=h.limited,u=qn(u,h.provenance),l=h.next,d)break;continue}if(e.startsWith("$'",l)){c=!0;let h=lh(e,l+2,n);if(a+=h.text,f.push(...h.issues),!h.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:l,end:n}});l=h.next;continue}if(p==="\\"){let h=e[l+1];if(!h){f.push({code:"trailing-escape",message:"escape has no following character",span:{start:l,end:l+1}}),l++;break}if(h===`
+`){l+=2;continue}a+=h,l+=2;continue}let y=p==="$"||p==="<"||p===">"||p==="`"?ls(e,l,n,r,o,i,s):null;if(y){let h=gc(y,m,f);if(d||=h.limited,u=qn(u,h.provenance),l=h.next,d)break;continue}if(p==="$"){let h=Cc(e,l,n,a,u);a=h.text,u=h.provenance,l=h.next;continue}if(p==="*"||p==="?"||p==="[")u=qn(u,"glob");a+=p,l++}return{word:pn(e,t,l,a,u,c,u==="literal"?void 0:uh(e,t,l)),nested:m,issues:f,next:l,limited:d}}function ih(e,t,n,r,o,i,s){let a="",l="literal",c=[],u=[],m=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:a,provenance:l,nested:c,issues:u,next:f+1,limited:m};if(d==="\\"&&e[f+1]){let g=e[f+1]??"";if(g===`
 `){f+=2;continue}if(g==="\r"&&e[f+2]===`
-`){f+=3;continue}a+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,f+=2;continue}if(e.startsWith("$((",f)){let g=ls(e,f+3,n,"))"),y=g===-1?n:g+2;if(a+=e.slice(f,y),g===-1)u.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:f,end:y}});f=y;continue}let p=as(e,f,n,r,o,i,s);if(p){let g=pc(p,c,u);if(f=g.next,m||=g.limited,l=qn(l,g.provenance),m)return{text:a,provenance:l,nested:c,issues:u,next:f,limited:m};continue}if(d==="$"){let g=yc(e,f,n,a,l);a=g.text,l=g.provenance,f=g.next;continue}a+=d??"",f++}return u.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:a,provenance:l,nested:c,issues:u,next:n,limited:m}}function as(e,t,n,r,o,i,s){let a=e.startsWith("$((",t),l=e.startsWith("$(",t)&&!a,c=(e.startsWith("<(",t)||e.startsWith(">(",t))&&!0,u=e[t]==="`";if(!a&&!l&&!c&&!u)return null;let m=a?3:u?1:2,f=a?"))":u?"`":")",d=ls(e,t+m,n,f),p=d===-1?n:d,g=d===-1?n:d+f.length;if(s>=o.maxDepth)return{program:vh(e,t+m,p,r,"depth-limit"),next:g,provenance:a?"arithmetic":"command-substitution"};if(a){let x=[],A=[],P=!1,S=t+m;while(S<p){let C=as(e,S,p,r,o,i,s+1);if(!C){S++;continue}if(x.push(...C.program.nodes),A.push(...C.program.issues),P||=C.program.status==="limited",S=C.next,P)break}if(d===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:g}});return{program:ue({kind:"program",dialect:r,source:e.slice(t+m,p),span:{start:t+m,end:p},status:wo(A,P),issues:A,nodes:x}),next:g,provenance:"arithmetic"}}let y=Ro(e,t+m,p,r,o,i,s+1),h=d===-1?[{code:a?"unclosed-arithmetic":"unclosed-command-substitution",message:`${e.slice(t,t+m)} substitution is not closed`,span:{start:t,end:g}}]:[],R=(u||c)&&Kn(y.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:g}}]:[];return{program:ue({kind:"program",dialect:r,source:e.slice(t+m,p),span:{start:t+m,end:p},status:wo([...y.issues,...h,...R],y.limited),issues:[...y.issues,...h,...R],nodes:y.nodes}),next:g,provenance:a?"arithmetic":"command-substitution"}}function pc(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function ls(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++)if(e[a]==="\\")a++;else if(e[a]==="`")return a;return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`){f+=3;continue}a+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,f+=2;continue}if(e.startsWith("$((",f)){let g=cs(e,f+3,n,"))"),y=g===-1?n:g+2;if(a+=e.slice(f,y),g===-1)u.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:f,end:y}});f=y;continue}let p=ls(e,f,n,r,o,i,s);if(p){let g=gc(p,c,u);if(f=g.next,m||=g.limited,l=qn(l,g.provenance),m)return{text:a,provenance:l,nested:c,issues:u,next:f,limited:m};continue}if(d==="$"){let g=Cc(e,f,n,a,l);a=g.text,l=g.provenance,f=g.next;continue}a+=d??"",f++}return u.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:a,provenance:l,nested:c,issues:u,next:n,limited:m}}function ls(e,t,n,r,o,i,s){let a=e.startsWith("$((",t),l=e.startsWith("$(",t)&&!a,c=(e.startsWith("<(",t)||e.startsWith(">(",t))&&!0,u=e[t]==="`";if(!a&&!l&&!c&&!u)return null;let m=a?3:u?1:2,f=a?"))":u?"`":")",d=cs(e,t+m,n,f),p=d===-1?n:d,g=d===-1?n:d+f.length;if(s>=o.maxDepth)return{program:Rh(e,t+m,p,r,"depth-limit"),next:g,provenance:a?"arithmetic":"command-substitution"};if(a){let x=[],A=[],P=!1,S=t+m;while(S<p){let C=ls(e,S,p,r,o,i,s+1);if(!C){S++;continue}if(x.push(...C.program.nodes),A.push(...C.program.issues),P||=C.program.status==="limited",S=C.next,P)break}if(d===-1)A.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:g}});return{program:ue({kind:"program",dialect:r,source:e.slice(t+m,p),span:{start:t+m,end:p},status:Po(A,P),issues:A,nodes:x}),next:g,provenance:"arithmetic"}}let y=xo(e,t+m,p,r,o,i,s+1),h=d===-1?[{code:a?"unclosed-arithmetic":"unclosed-command-substitution",message:`${e.slice(t,t+m)} substitution is not closed`,span:{start:t,end:g}}]:[],R=(u||c)&&Kn(y.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:g}}]:[];return{program:ue({kind:"program",dialect:r,source:e.slice(t+m,p),span:{start:t+m,end:p},status:Po([...y.issues,...h,...R],y.limited),issues:[...y.issues,...h,...R],nodes:y.nodes}),next:g,provenance:a?"arithmetic":"command-substitution"}}function gc(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function cs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++)if(e[a]==="\\")a++;else if(e[a]==="`")return a;return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=rs(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=gc(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=ih(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let f=ns(e,m,n);if(f){s.push({delimiter:f.delimiter,quotedDelimiter:f.quoted,stripTabs:u,declarationSpan:{start:a,end:f.next},attach:()=>{return}}),a=f.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function ih(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=gc(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function gc(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!Eh(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function xo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function sh(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function Eo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function hc(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function ah(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=lh(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function lh(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return So(e,t+1,n,16,2,t+1);if(r==="u")return So(e,t+1,n,16,4,t+1);if(r==="U")return So(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return So(e,t,n,8,3,t+1);return{text:r,next:t+1}}function So(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function wo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function yc(e,t,n,r,o){let i=hc(e,t,n);return{text:r+e.slice(t,i),provenance:qn(o,"variable"),next:i}}function ch(e,t,n){let r=bo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),f=l==="`";if(c||u||m||f){let d=c?3:f?1:2,p=c?"))":f?"`":")",g=ls(e,a+d,n,p),y=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,y,c?"arithmetic":"command-substitution"),a=y,o=y;continue}if(l==="$"){let d=hc(e,a,n);if(d>a+1){r.push(o,a,"literal"),r.push(a,d,"variable"),a=d,o=d;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function qn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function uh(e,t,n){return t+1>=n||Eo(e[t+1]??"")||xo(e,t+1)!==null}var dh=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),mh=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function fh(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=ph(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function ph(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return gh(e,t);if(n==="env")return hh(e,t);if(n==="sudo")return yh(e,t);return}function gh(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function hh(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(dh.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function yh(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(mh.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Cc(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let l=o.findIndex((p)=>uc(p));if(l===-1)break;if(++s>n)return{limited:!0};let c=o[l]??"",u=uc(c);if(!u||u.kind==="range")return{limited:!0};let m=u.start+c.length-u.end,f=u.alternatives.reduce((p,g)=>p+m+g.length,0);if(i-c.length+f>r||o.length-1+u.alternatives.length>t)return{limited:!0};let d=bc(c,u);o.splice(l,1,...d),i+=f-c.length}if(s===0)return;let a=o.map((l)=>Sh(l,n));if(a.some((l)=>l===null))return{limited:!0};return{words:[...new Set(a.filter((l)=>l!==null&&l!==""))]}}function Ch(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let c=i.findIndex((y)=>cc(y));if(c===-1)break;if(++a>r)return{limitCode:"depth-limit"};let u=i[c]??"",m=cc(u);if(!m)break;let f=m.start+u.length-m.end,d=m.alternatives.filter((y)=>f+y.length>0),p=d.reduce((y,h)=>y+f+h.length,0);if(s-u.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+d.length>n)return{limitCode:"word-limit"};let g=bc(u,{...m,alternatives:d});i.splice(c,1,...g),s+=p-u.length}let l=i.filter((c)=>c.length>0);if(a===0)return;return{words:l.map((c)=>pn(e,t.span.start,t.span.end,c,"literal",!1))}}function cc(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:Sc(e,n)}}function uc(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let l=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:bh(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(l&&(!n||l.start<n.start))n=l}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:Sc(e,n)}}function bc(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Sc(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function bh(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Sh(e,t){let n=`x${e}`,r=ss(n,0,n.length,"posix",{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function vh(e,t,n,r,o){return ue({kind:"program",dialect:r,source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:o,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function gn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function vo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function os(e){return e.used++,e.used<=e.max}function Rh(e,t,n){let r=/^([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(e.slice(t,n)),o=r?.[1];if(!r||!o)return;return{name:o,braceIndex:t+r[0].lastIndexOf("{")}}function Kn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Kn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Kn(t.body.nodes)})}function xh(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function vc(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function dc(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!mc.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function is(e,t,n){if(!vc(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function Eh(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Rc=new Set(["remove-item","ri","del","erase","rd","rmdir"]),xc=["-rec","-for","-path","-literalpath","-whatif"],Po={maxInputLength:131072,maxWords:16384,maxDepth:64};function Ec(e){let t=e.toLowerCase().replaceAll("`","");if(![...Rc].some((r)=>t.includes(r))&&!(t.includes("rm")&&xc.some((r)=>t.includes(r)))&&!t.includes("<#"))return!1;let n=Ah(e);return n.invalidComment||n.commands.some(wh)}function wh(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Rc.has(n))return!0;if(n!=="rm")return!1;return e.slice(t+1).some((r)=>{let o=r.toLowerCase().split(":",1)[0]??"";return xc.some((i)=>o.startsWith(i))})}function wc(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return ue({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=fs(e,0,e.length,t,0);return ue({kind:"program",dialect:"powershell",source:e,span:n,status:kh(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function fs(e,t,n,r,o,i=!1){let s=go(),a=ho(),l=yo(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let d={start:l.start,end:l.end};Co(s,l,{kind:"command",dialect:"powershell",source:e.slice(d.start,d.end),span:d,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},f=t;while(f<n){let d=e[f];if(!d)break;if(i&&d==="}")return m(),{nodes:s,issues:a,next:f+1,closed:!0,words:c,limited:u};let p=Ac(e,f,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};f=p.next;continue}if(/\s/.test(d)){if(d==="\r"||d===`
+`?a+2:a+1,m=os(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=hc(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=sh(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let f=rs(e,m,n);if(f){s.push({delimiter:f.delimiter,quotedDelimiter:f.quoted,stripTabs:u,declarationSpan:{start:a,end:f.next},attach:()=>{return}}),a=f.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function sh(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=hc(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function hc(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!wh(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function Eo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function ah(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function wo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function yc(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function lh(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ch(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ch(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return vo(e,t+1,n,16,2,t+1);if(r==="u")return vo(e,t+1,n,16,4,t+1);if(r==="U")return vo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return vo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function vo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function Po(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Cc(e,t,n,r,o){let i=yc(e,t,n);return{text:r+e.slice(t,i),provenance:qn(o,"variable"),next:i}}function uh(e,t,n){let r=So(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),f=l==="`";if(c||u||m||f){let d=c?3:f?1:2,p=c?"))":f?"`":")",g=cs(e,a+d,n,p),y=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,y,c?"arithmetic":"command-substitution"),a=y,o=y;continue}if(l==="$"){let d=yc(e,a,n);if(d>a+1){r.push(o,a,"literal"),r.push(a,d,"variable"),a=d,o=d;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function qn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function dh(e,t,n){return t+1>=n||wo(e[t+1]??"")||Eo(e,t+1)!==null}var mh=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),fh=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function ph(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=gh(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function gh(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return hh(e,t);if(n==="env")return yh(e,t);if(n==="sudo")return Ch(e,t);return}function hh(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function yh(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(mh.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Ch(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(fh.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function bc(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let l=o.findIndex((p)=>dc(p));if(l===-1)break;if(++s>n)return{limited:!0};let c=o[l]??"",u=dc(c);if(!u||u.kind==="range")return{limited:!0};let m=u.start+c.length-u.end,f=u.alternatives.reduce((p,g)=>p+m+g.length,0);if(i-c.length+f>r||o.length-1+u.alternatives.length>t)return{limited:!0};let d=Sc(c,u);o.splice(l,1,...d),i+=f-c.length}if(s===0)return;let a=o.map((l)=>vh(l,n));if(a.some((l)=>l===null))return{limited:!0};return{words:[...new Set(a.filter((l)=>l!==null&&l!==""))]}}function bh(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let c=i.findIndex((y)=>uc(y));if(c===-1)break;if(++a>r)return{limitCode:"depth-limit"};let u=i[c]??"",m=uc(u);if(!m)break;let f=m.start+u.length-m.end,d=m.alternatives.filter((y)=>f+y.length>0),p=d.reduce((y,h)=>y+f+h.length,0);if(s-u.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+d.length>n)return{limitCode:"word-limit"};let g=Sc(u,{...m,alternatives:d});i.splice(c,1,...g),s+=p-u.length}let l=i.filter((c)=>c.length>0);if(a===0)return;return{words:l.map((c)=>pn(e,t.span.start,t.span.end,c,"literal",!1))}}function uc(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:vc(e,n)}}function dc(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let l=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:Sh(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(l&&(!n||l.start<n.start))n=l}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:vc(e,n)}}function Sc(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function vc(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Sh(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function vh(e,t){let n=`x${e}`,r=as(n,0,n.length,"posix",{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function Rh(e,t,n,r,o){return ue({kind:"program",dialect:r,source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:o,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function gn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ro(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function is(e){return e.used++,e.used<=e.max}function xh(e,t,n){let r=/^([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(e.slice(t,n)),o=r?.[1];if(!r||!o)return;return{name:o,braceIndex:t+r[0].lastIndexOf("{")}}function Kn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Kn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Kn(t.body.nodes)})}function Eh(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function Rc(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function mc(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!fc.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function ss(e,t,n){if(!Rc(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function wh(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var xc=new Set(["remove-item","ri","del","erase","rd","rmdir"]),Ec=["-rec","-for","-path","-literalpath","-whatif"],_o={maxInputLength:131072,maxWords:16384,maxDepth:64};function wc(e){let t=e.toLowerCase().replaceAll("`","");if(![...xc].some((r)=>t.includes(r))&&!(t.includes("rm")&&Ec.some((r)=>t.includes(r)))&&!t.includes("<#"))return!1;let n=kh(e);return n.invalidComment||n.commands.some(Ph)}function Ph(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&xc.has(n))return!0;if(n!=="rm")return!1;return e.slice(t+1).some((r)=>{let o=r.toLowerCase().split(":",1)[0]??"";return Ec.some((i)=>o.startsWith(i))})}function Pc(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return ue({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=ps(e,0,e.length,t,0);return ue({kind:"program",dialect:"powershell",source:e,span:n,status:Th(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ps(e,t,n,r,o,i=!1){let s=ho(),a=yo(),l=Co(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let d={start:l.start,end:l.end};bo(s,l,{kind:"command",dialect:"powershell",source:e.slice(d.start,d.end),span:d,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},f=t;while(f<n){let d=e[f];if(!d)break;if(i&&d==="}")return m(),{nodes:s,issues:a,next:f+1,closed:!0,words:c,limited:u};let p=kc(e,f,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};f=p.next;continue}if(/\s/.test(d)){if(d==="\r"||d===`
 `){m();let h=d==="\r"&&e[f+1]===`
-`?f+2:f+1;s.push(cs(e,f,h)),f=h;continue}f++;continue}let g=ps(e,f);if(g){m(),s.push(cs(e,f,f+g.length)),f+=g.length;continue}if(d==="{"){if(m(),o>=r.maxDepth)return a.push(_c(f,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let h=fs(e,f+1,n,r,o+1,!0),R=h.closed?h.next-1:h.next,x=ue({kind:"program",dialect:"powershell",source:e.slice(f+1,R),span:{start:f+1,end:R},status:h.limited?"limited":h.issues.length>0?"partial":"complete",issues:h.issues,nodes:h.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:f,end:h.next}),body:x})),a.push(...h.issues),!h.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:f,end:h.next}});c+=h.words,u||=h.limited,f=h.next;continue}if(d==="}"){m(),s.push(cs(e,f,f+1)),f++;continue}if(d===">"||d==="<"){l.start=l.start===-1?f:l.start;let h=e[f+1]===d?f+2:f+1,R=h;while(/[ \t]/.test(e[R]??""))R++;let x=R<n?us(e,R,n,r,o):void 0,A=x?.next??h;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(f,h),span:Object.freeze({start:f,end:A}),...x?{target:x.word}:{}})),x)a.push(...x.issues),l.nested.push(...x.nested),c+=x.words,u||=x.limited;l.end=A,f=A;continue}if(d===","){l.start=l.start===-1?f:l.start,l.words.push(ts({text:",",raw:",",span:{start:f,end:f+1},provenance:"literal",quoted:!1})),l.end=++f;continue}let y=us(e,f,n,r,o);if(l.start=l.start===-1?f:l.start,l.end=y.next,l.words.push(y.word),a.push(...y.issues),l.nested.push(...y.nested),c+=1+y.words,u||=y.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:f,end:y.next}}),m(),{nodes:s,issues:a,next:y.next,closed:!1,words:c,limited:!0};f=y.next>f?y.next:f+1}return m(),{nodes:s,issues:a,next:f,closed:!i,words:c,limited:u}}function us(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,f=(p)=>{let g=Ph(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=ds(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},d=t;while(d<n){let p=e[d];if(!p||/\s/.test(p)||ps(e,d)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[d+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:d,end:d+1}}),d++;break}i+=g,d+=2;continue}if(e.startsWith("$(",d)){d=f(d);continue}if(p==="'"){a=!0,d++;let g=!1;while(d<e.length){if(e[d]==="'"&&e[d+1]==="'"){i+="'",d+=2;continue}if(e[d]==="'"){g=!0,d++;break}i+=e[d]??"",d++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let g=d++,y=!1;while(d<n){let h=e[d];if(h==="`"&&e[d+1]){i+=e[d+1],d+=2;continue}if(h==='"'){y=!0,d++;break}if(e.startsWith("$(",d)){d=f(d);continue}if(h==="$")s=e[d+1]==="("?"command-substitution":"variable";i+=h??"",d++}if(!y)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:g,end:e.length}});continue}if(p==="$")s=e[d+1]==="("?"command-substitution":"variable";if(p==="@"&&d===t)s="variable";i+=p,d++}return{word:pn(e,t,d,i,s,a,s==="literal"?void 0:_h(e,t,d)),next:d,issues:l,nested:c,words:u,limited:m}}function Ph(e,t,n,r,o){let i=Pc(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:ue({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[_c(t,r.maxDepth)],nodes:[]}),next:a};let l=fs(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:ue({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Pc(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function ds(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=ds(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=ds(r)}}return t}function _h(e,t,n){let r=bo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Pc(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=s+1;if(e[l]==="{"){let c=e.indexOf("}",l+1);l=c===-1||c>=n?n:c+1}else while(l<n&&/[A-Za-z0-9_:?]/.test(e[l]??""))l++;r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function _c(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function Ah(e){let t=[],n=[],r=0,o=0,i=!1,s=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let a=e[r];if(a==="\r"||a===`
+`?f+2:f+1;s.push(us(e,f,h)),f=h;continue}f++;continue}let g=gs(e,f);if(g){m(),s.push(us(e,f,f+g.length)),f+=g.length;continue}if(d==="{"){if(m(),o>=r.maxDepth)return a.push(Ac(f,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let h=ps(e,f+1,n,r,o+1,!0),R=h.closed?h.next-1:h.next,x=ue({kind:"program",dialect:"powershell",source:e.slice(f+1,R),span:{start:f+1,end:R},status:h.limited?"limited":h.issues.length>0?"partial":"complete",issues:h.issues,nodes:h.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:f,end:h.next}),body:x})),a.push(...h.issues),!h.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:f,end:h.next}});c+=h.words,u||=h.limited,f=h.next;continue}if(d==="}"){m(),s.push(us(e,f,f+1)),f++;continue}if(d===">"||d==="<"){l.start=l.start===-1?f:l.start;let h=e[f+1]===d?f+2:f+1,R=h;while(/[ \t]/.test(e[R]??""))R++;let x=R<n?ds(e,R,n,r,o):void 0,A=x?.next??h;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(f,h),span:Object.freeze({start:f,end:A}),...x?{target:x.word}:{}})),x)a.push(...x.issues),l.nested.push(...x.nested),c+=x.words,u||=x.limited;l.end=A,f=A;continue}if(d===","){l.start=l.start===-1?f:l.start,l.words.push(ns({text:",",raw:",",span:{start:f,end:f+1},provenance:"literal",quoted:!1})),l.end=++f;continue}let y=ds(e,f,n,r,o);if(l.start=l.start===-1?f:l.start,l.end=y.next,l.words.push(y.word),a.push(...y.issues),l.nested.push(...y.nested),c+=1+y.words,u||=y.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:f,end:y.next}}),m(),{nodes:s,issues:a,next:y.next,closed:!1,words:c,limited:!0};f=y.next>f?y.next:f+1}return m(),{nodes:s,issues:a,next:f,closed:!i,words:c,limited:u}}function ds(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,f=(p)=>{let g=_h(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=ms(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},d=t;while(d<n){let p=e[d];if(!p||/\s/.test(p)||gs(e,d)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[d+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:d,end:d+1}}),d++;break}i+=g,d+=2;continue}if(e.startsWith("$(",d)){d=f(d);continue}if(p==="'"){a=!0,d++;let g=!1;while(d<e.length){if(e[d]==="'"&&e[d+1]==="'"){i+="'",d+=2;continue}if(e[d]==="'"){g=!0,d++;break}i+=e[d]??"",d++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let g=d++,y=!1;while(d<n){let h=e[d];if(h==="`"&&e[d+1]){i+=e[d+1],d+=2;continue}if(h==='"'){y=!0,d++;break}if(e.startsWith("$(",d)){d=f(d);continue}if(h==="$")s=e[d+1]==="("?"command-substitution":"variable";i+=h??"",d++}if(!y)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:g,end:e.length}});continue}if(p==="$")s=e[d+1]==="("?"command-substitution":"variable";if(p==="@"&&d===t)s="variable";i+=p,d++}return{word:pn(e,t,d,i,s,a,s==="literal"?void 0:Ah(e,t,d)),next:d,issues:l,nested:c,words:u,limited:m}}function _h(e,t,n,r,o){let i=_c(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:ue({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Ac(t,r.maxDepth)],nodes:[]}),next:a};let l=ps(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:ue({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function _c(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function ms(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=ms(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=ms(r)}}return t}function Ah(e,t,n){let r=So(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=_c(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=s+1;if(e[l]==="{"){let c=e.indexOf("}",l+1);l=c===-1||c>=n?n:c+1}else while(l<n&&/[A-Za-z0-9_:?]/.test(e[l]??""))l++;r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Ac(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function kh(e){let t=[],n=[],r=0,o=0,i=!1,s=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let a=e[r];if(a==="\r"||a===`
 `){s(),r+=a==="\r"&&e[r+1]===`
-`?2:1;continue}if(/\s/.test(a??"")){r++;continue}let l=Ac(e,r,Math.min(e.length,Po.maxInputLength),Po.maxDepth);if(l){i||=!!l.issue||l.limited,r=l.next;continue}let c=ps(e,r);if(c){s(),r+=c.length;continue}if(a==="{"||a==="}"){s(),r++;continue}let u=us(e,r,Math.min(e.length,Po.maxInputLength),Po,0);if(u.word.text)n.push(u.word.text);for(let m of u.nested)t.push(...ms(m));o++,r=u.next>r?u.next:r+1}return s(),{commands:t,invalidComment:i}}function ms(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return ms(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(ms)]})}function ps(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Ac(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function kh(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function cs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var Wt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Fe(e,t="auto",n=Wt){if(t==="powershell"||t==="auto"&&Ec(e.slice(0,n.maxInputLength)))return wc(e,n);return fc(e,"posix",n)}function Yn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Th=/^[A-Za-z_][A-Za-z0-9_]*=/;function _o(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Ao(e){let t=_o(e.words[0],"time")?1:0,n=t===1&&_o(e.words[t],"-p")?t+1:t,r=t===1&&_o(e.words[n],"--")?n+1:n,o=_o(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Th.test(s.text));return i?.provenance==="literal"?i.text:void 0}function Zn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function hn(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Ih(e))Zn(n,t);return t.inSingle||t.inDouble}function Ih(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Zn(s,n)}return t}var Oh=new Set(["&&","||","|&","|","&",";"]),Mh=new Set(["<<","<<<",">|"]),Dh=/[*@#?$!_-]/,gs=Object.freeze([]),Lh=Object.freeze([]),Nh=256;function Mc(e,t){let n=t.status==="complete"?new Set(ys(t)):new Set,r=[...n].reduce((s,a)=>s.slice(0,a.start)+" ".repeat(a.end-a.start)+s.slice(a.end),e);if(hn(r))return ko("unclosed-quote",r,gs);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Xn(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map});if(o.limited)return ko("structural-limit",r,gs);if(o.invalid)return ko("invalid",r,gs);return ko("complete",r,i,o.assignmentFallbacks)}function ko(e,t,n,r=Lh){return Object.freeze({status:e,source:t,entries:Object.freeze(n),assignmentFallbacks:Object.freeze(r)})}function Xn(e,t){return e.nodes.flatMap((n,r)=>Wh(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.entries])}function Wh(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,entries:[Ge(Bh(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,entries:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,entries:[i?To("{"):Ge("("),...Xn(e.body,a),...s?[i?To("}"):Ge(")")]:[]]}]}let o=Hh(e,r.functions);if(o){if(r.depth>=Wt.maxDepth||++r.flags.expansions>Nh)return r.flags.limited=!0,[];return[{start:e.span.start,entries:[...kc(e,r),To(";"),...Xn(o,{...r,depth:r.depth+1}),To(";")]},...Tc(e,t,n,r)]}return[{start:e.span.start,entries:kc(e,r)},...Tc(e,t,n,r)]}function kc(e,t){return[...e.words.map((n)=>({start:n.span.start,entries:Lc(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,entries:Fh(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.entries)}function Fh(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Lc(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Cs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,role:Uh(r),targetOrder:Mh.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s}}),...s===void 0?o:o.slice(1)]}function Tc(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Cs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,entries:a}];return[{start:s.bodySpan.start,entries:[...Dc(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Gh(t,n,r):[]]}function Gh(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,entries:Dc(n.source.slice(r.span.end,e.span.end),n)}]}function Dc(e,t){if(t.depth>=Wt.maxDepth)return t.flags.limited=!0,[];let n=Fe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Xn(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Lc(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{if(a&&!r)o.push(Ge("glob"));else if(s!==""||e.quoted&&o.length===0)o.push(Cs(s));s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let d of hs(c.raw,i,n.flags)){if(typeof d==="string"){l(),o.push(Ge(d));continue}s+=d.text,a||=d.glob}continue}if(i.double){let d=n.source.slice(c.span.start,c.span.end);s+=hs(d,{single:!1,double:!0},n.flags).map((p)=>typeof p==="string"?p:p.text).join("");continue}let u=t.nested.find((d)=>d.span.start>=c.span.start&&d.span.end<=c.span.end),m=u?Xn(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(...m);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),...m,...c.raw.endsWith(")")?[Ge(")")]:[]);continue}let f=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:f},()=>Ge("(")),...m,...c.raw.endsWith(")".repeat(f))?Array.from({length:f},()=>Ge(")")):[])}return l(),o}function hs(e,t,n){let r=[],o="",i=!1,s=0;while(s<e.length){let a=e[s]??"";if(!t.single&&!t.double&&(a==="("||a===")")){r.push({text:o,glob:i},a),o="",i=!1,s++;continue}if(t.single){if(a==="'")t.single=!1;else o+=a;s++;continue}if(t.double){if(a==='"'){t.double=!1,s++;continue}if(a==="\\"){let l=e[s+1]??"";o+=['"',"\\","$"].includes(l)?l:`\\${l}`,s+=2;continue}if(a==="$"){let l=Ic(e,s,t,n);o+=l.text,s=l.next;continue}o+=a,s++;continue}if(a==="'"||a==='"'){t.single=a==="'",t.double=a==='"',s++;continue}if(a==="\\"){let l=e[s+1]??"";i||=l==="*"||l==="?",o+=l,s+=2;continue}if(a==="$"){let l=Ic(e,s,t,n);o+=l.text,s=l.next;continue}i||=a==="*"||a==="?",o+=a,s++}return[...r,{text:o,glob:i}]}function Ic(e,t,n,r){let o=e[t+1];if(o==="{"){let s=$h(e,t+2);if(s===-1)return r.invalid=!0,{text:"",next:e.length};let a=e.slice(t,s+1);return zh(a,n,r),{text:a,next:s+1}}if(o!==void 0&&Dh.test(o))return{text:`\${${o}}`,next:t+2};let i=/^\w*/.exec(e.slice(t+1))?.[0]??"";return{text:`\${${i}}`,next:t+1+i.length}}function zh(e,t,n){let r=e.slice(2,-1),o=/^[A-Za-z_][A-Za-z0-9_]*/.exec(r)?.[0];if(!o)return;let i=r.slice(o.length),s=[":=","="].find((l)=>i.startsWith(l));if(!s)return;let a=hs(i.slice(s.length),{...t},n);n.assignmentFallbacks.push(...a.flatMap((l)=>typeof l==="string"||!l.text?[]:[l.text]))}function $h(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;else if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Bh(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:Oh.has(e)})}function To(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Cs(e){return Object.freeze({kind:"word",text:e})}function Uh(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function ys(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ys(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((s)=>ys(s)),o=e.nodes[n+1];if(o?.kind==="connector"&&(o.operator==="|"||o.operator==="|&")||!Vh(t))return r;return[...r,...t.redirections.flatMap((s)=>s.heredoc?.quotedDelimiter?[s.heredoc.bodySpan]:[])]})}function Hh(e,t){let n=Ao(e);return n===void 0?void 0:t.get(n)}function Rt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function jh(e){if(Rt(e.words[0],"git"))return Rt(e.words[1],"commit");if(!Rt(e.words[0],"gh")||!Rt(e.words[2],"create"))return!1;return Rt(e.words[1],"pr")||Rt(e.words[1],"issue")}function Vh(e){return(Rt(e.words[0],"cat")||Rt(e.words[0],"tee")||jh(e))&&!e.words.some(Oc)&&!e.redirections.some((n)=>Oc(n.target))}function Oc(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}import{types as qh}from"node:util";var Kh=new Set(["applypatch","patch"]),Yh=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Zh=new Set(["grep","grepsearch","rg"]),Xh=new Set(["find","findbyname","glob"]),Jh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Qh=new Set(["command","diff","input","patch","patchtext"]),Nc=new TextEncoder,ey=new TextDecoder,ty=/\s/,ny=64;class er extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Jn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function $c(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Oo(e){return Jh.has($c(e))}function y_(e){let t=$c(e);if(Kh.has(t))return"patch";if(Zh.has(t))return"grep";if(Xh.has(t))return"glob";if(Yh.has(t))return"path";return"unknown"}function Mo(e){if(!e||typeof e!=="object")return;Kc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Xe();return}if(t.get||t.set)Xe();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Bc(e,t){return Uc(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Uc(e,t,n,r){let o=qc(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Uc(a,t,n,r+1);return typeof a==="string"&&t.has(Hc(s))?[a]:l});return n.ancestors.delete(o.object),i}function Hc(e){return e.replace(/-/g,"_").toLowerCase()}function jc(e){return Vc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(oy)}function Vc(e,t,n,r){let o=qc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Vc(a,o.array?t:Qh.has(Hc(s)),n,r+1));return n.ancestors.delete(o.object),i}function ry(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Jn.maxDepth||t.nodes>Jn.maxNodes)Xe();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Jn.maxStringBytes||t.stringBytes>Jn.maxAggregateStringBytes)Xe()}function qc(e,t,n){if(ry(e,t,n),!e||typeof e!=="object")return null;let r=Kc(e);if(t.ancestors.has(e))Xe();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Jn.maxKeys)Xe();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Xe();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Kc(e){if(qh.isProxy(e))Xe();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Xe();return t}function Xe(){throw new er}function oy(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=iy(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...bs(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...bs(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...vs(Io(c.slice(4),!0),Io(u.slice(4),!0))),l++;continue}if(!r)t.push(...bs(c))}return t}function iy(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function bs(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return zc(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return zc(n[1]);if(e.startsWith("diff --git "))return sy(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Gc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Gc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return fy(i[1]);return[]}function sy(e){let t=ay(e);if(t.length===2&&t[0]&&t[1])return vs(t[0],t[1]);let n=ly(e);return n?vs(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function ay(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Ft(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Ft(e[n]))n++;t.push(e.slice(i,n));continue}let o=Yc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Ft(e[n]))n++;return n===e.length?t:[]}function ly(e){let t=0;while(t<e.length&&Ft(e[t]))t++;let n=e.length;while(n>t&&Ft(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Ft(e[o])){o++;continue}let i=o;while(o<n&&Ft(e[o]))o++;if(i===t||o===n)continue;if(r++,r>ny)Xe();if(cy(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function cy(e,t,n,r,o){if(Ss(e,t,n,r,o))return!0;let i=Wc(e,"/",t,n),s=Wc(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ss(e,t,i,r,s))return!1;return Ss(e,i+1,n,s+1,o)}function Ss(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Wc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Ft(e){return e!==void 0&&ty.test(e)}function Yc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=e[o]??"";if(i===n)return{value:ey.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Nc.encode(i)),o++;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Nc.encode(uy(s[0]??""))),o+=2}return null}function uy(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function dy(e){return Qn(py(e))}function vs(e,t){if(e==="/dev/null")return Fc(t);if(t==="/dev/null")return Fc(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Qn);let n=my(e,t)??(e===t?Zc(e):null);return[e,t,...n?[n]:[]].flatMap(Qn)}function Fc(e){let t=Zc(e);return[e,...t?[t]:[]].flatMap(Qn)}function Zc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function my(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Gc(e){return dy(Io(e,!0))}function fy(e){return Qn(Io(e,!1))}function Io(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Yc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function py(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Qn(e){return e===""||e==="/dev/null"?[]:[e]}function zc(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var Xc=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Jc=new Set([...Xc,"glob"]),gy=new Set([...Jc,"pattern"]),hy=[],Qc={parseCommand:Fe,projectShellSyntax:Mc};class xt extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Do(e,t={}){let n=yy({...Qc,...t}),r=Mo(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let l=s.findIndex((m)=>m.source===a.source);if(l!==-1){let m=s[l];if(!m)return s;return s[l]={...m,usages:[...m.usages,a.usage]},s}let c=e.route.kind==="command"?e.route.shell:"posix",u=n.getCommandProgram(a.source,c);return s.push({usages:[a.usage],source:a.source,program:u,shell:n.getShellSyntax(a.source,u)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:Cy(e),store:n}}function be(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Je(e){if(!e.includes("$"))return e;return Qr(e,ct())}function yy(e={}){let t={...Qc,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,l)=>{let c=`${l}\x00${a}`,u=r.get(c);if(u)return u;let m=t.parseCommand(a,l);return r.set(c,m),m};return{getShellSyntax:(a,l)=>{if(l&&l.source!==a)throw TypeError("Shell syntax source does not match command program source.");let c=l??i(a,"posix");if(c.status==="limited"){let f=o.get(c);if(f)return f;let d={status:"structural-limit",source:a,entries:hy,assignmentFallbacks:[]};return o.set(c,d),d}let u=n.get(a);if(u)return u;let m=t.projectShellSyntax(a,c);return n.set(a,m),m},getCommandProgram:i}}function Cy(e){let t=e.route.kind==="grep"?Jc:e.route.kind==="glob"?gy:Xc;return[...Bc(e.input,t),...e.route.kind==="patch"?jc(e.input):[]]}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var by=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),Sy=new Map([["zsh",new Set(["o"])]]),vy=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function eu(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=vy.get(e);if(xy(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=Ry(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function Ry(e,t){let n=by.get(e),r=Sy.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let l=t.slice(s+1);if(!o&&t[0]==="-"&&l==="c")continue;if(!o&&t[0]==="-"&&l[0]==="-"&&l.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function xy(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}var _y=new Set(["-S","--suffix"]);function Lo(e,t,n,r){if(e.status==="structural-limit")throw new xt;if(e.status!=="complete")return r.findMalformedTarget(e.source);let o={cwd:t,variables:new Map},i=[];for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;let a=r.findSegmentTarget(i,o);if(a)return a;o=Ay(i,o,n,r.normalizeCwd),i=[];continue}if(s.kind==="redirection"){if(s.role==="file-write"&&s.target&&r.isRedirectionTarget(Se(s.target,o.variables),o))return s.target;continue}i.push(s.text)}return r.findSegmentTarget(i,o)}function Se(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Se(i,t);return a?Se(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function nu(e,t,n){let r=n.environment.home,o=Qr(e.trim(),n.environment).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?tu(r,o.slice(2)):o,s=pe(i);return Py(wy(s)?s:tu(t,s))}function le(e,t,n){let r=nu(e,t,n);if(!r)return"";return H(r,n.environment.paths,n).replace(/\\/g,"/")}function ru(e,t,n,r){let o=nu(e,t,n);if(!o)return null;if(r(Ey(o)))return H(o,n.environment.paths,n).replace(/\\/g,"/");let i=Gl(o,n.environment.paths,n);return i===null?null:i.replace(/\\/g,"/")}function No(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&_y.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}function Ay(e,t,n,r){let o=tr(e)?new Map([...t.variables,...ky(e,t.variables)]):t.variables,i=fn([...e],n.environment),s=D(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;return{cwd:!s||s==="-"?t.cwd:r(Se(s,o),t.cwd,n),variables:o}}function ky(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Se(o,t)]]:[]})}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function au(e,t=xs([e.invocation.context.executionCwd,e.invocation.context.configCwd])){let n=Mt(ct()),r=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Oo(e.invocation.toolName))return null;let s=e.paths.find((a)=>Ny(a,r,t,n));return s?{target:s}:null}if(e.invocation.route.kind!=="command")return null;let o=be(e,"input-candidate");if(!o)return null;let i=Lo(o.shell,r,n,{findSegmentTarget:(s,a)=>Fy(s,a,t,n),isRedirectionTarget:(s,a)=>Wy(s,a.cwd,t,n),findMalformedTarget:()=>null,normalizeCwd:le});return i?{target:i}:null}function xs(e,t=Mt(ct())){let n=[...new Map(e.filter((r)=>typeof r==="string"&&r!=="").flatMap((r)=>{let o=zn(le(r,r,t));return o?[[ze(o),{dotGitPath:o,cwd:r}]]:[]})).values()].flatMap((r)=>Oy(r.dotGitPath,r.cwd,t));if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.map((r)=>r.entry))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFile?[r.markerFile]:[]))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Oy(e,t,n){try{let r=le(e,t,n),o=Ty(e),i=o.isFile()?r:null,s=o.isFile()?Ui(e):null,a=(o.isDirectory()?[r]:[s?.gitDir,s?.commonDir]).flatMap((c)=>c?[ze(le(c,t,n))]:[]),l=[...new Set(o.isDirectory()?[ze(e.replace(/\\/g,"/")),...a]:a)];return[{entry:ze(r),markerFile:i?ze(i):null,directories:l,hooksDirectories:[...new Set(l.flatMap((c)=>{let u=ze(Iy(c,"hooks"));return[u,ze(le(u,t,n))]}))]}]}catch{return[]}}function Gt(e,t,n,r,o,i=!1){if(!n)return!1;let s=ze(le(e,t,o)),a=s.replace(/(\/\.?\*+)+$/,"");if(a!==s&&a!==""){if(Rs(a,n))return!0;let l=i||s.slice(a.length).includes("/."),c=(u)=>l?Wo(u,a):My(u,a);if(n.markerFiles.some(c))return!0;return r&&ou(n).some(c)}if(Rs(s,n))return!0;return r&&ou(n).some((l)=>Wo(l,s))}function My(e,t){let n=su(t,e);if(n===""||n.startsWith("..")||iu(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Dy(e,t,n,r){return Gt(e,t,n,!0,r)}function Ly(e,t,n,r){if(!n)return!1;return Rs(ze(le(e,t,r)),n)}function Ny(e,t,n,r){if(!n)return!1;return lu(e,t,n,r,n.entries)}function Wy(e,t,n,r){if(!n)return!1;return lu(e,t,n,r,n.markerFiles)}function lu(e,t,n,r,o){let i=ze(le(e,t,r));return o.includes(i)||uu(i,n)}function cu(e,t,n,r){if(!n)return!1;return n.hooksDirectories.some((o)=>e.some((i)=>Wo(o,ze(le(i,t,r)))))}function Rs(e,t){return t.entries.includes(e)||t.directories.includes(e)||uu(e,t)}function uu(e,t){return t.hooksDirectories.some((n)=>Wo(e,n))}function ou(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Wo(e,t){let n=su(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!iu(n)}function ze(e){return process.platform==="win32"?e.toLowerCase():e}function Fy(e,t,n,r){if(tr(e))return null;let o=vt([...e],r.environment);if(D(o[0]??"").toLowerCase()!=="mv")return null;let i=No(o.slice(1)),s=i.sources.find((a)=>Dy(Se(a,t.variables),t.cwd,n,r));if(s)return s;return i.destination&&Ly(Se(i.destination,t.variables),t.cwd,n,r)?i.destination:null}import{isAbsolute as Es,join as Gy,normalize as zy,sep as Fo}from"node:path";var du=process.platform==="win32",$y=/[*?]/;function nr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function zo(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=nr(e.trim(),t);if(!Es(n))return"must be an absolute path or start with ~/";return rr(n,t)}function $o(e,t){let n=mu(e,t);if(n===null)return"must be a non-empty path string";if(!Es(n))return null;if(rr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var By="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Uy="cannot cover the guard's own configuration";function mu(e,t){if(typeof e!=="string"||e.trim()==="")return null;return nr(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Bo(e,t){let n=mu(e,t);if(n===null)return"must be a non-empty path string";if($y.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!Es(n))return null;if(rr(n,t)!==null)return By;return Hy(n,t)?Uy:null}function Hy(e,t){let n=Go(e),r=Go(Gy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Fo}`)}function rr(e,t){let n=Go(e),r=Go(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Fo)?n:`${n}${Fo}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Go(e){let t=zy(e);if(du)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(du?3:1)&&t.endsWith(Fo))t=t.slice(0,-1);return t}var qy=process.platform==="win32",fu=64,Ky=16384;function or(e){let t=Cc(e,fu,fu,Ky);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:Yy(e)}}function Yy(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Zy(e.raw,n.span.start-e.span.start))}function Zy(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function zt(e){let t=e.environment.home,n=e.environment.paths,r=Mt(e.environment);return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:tC(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,pathCanonicalizationContext:r}}function $e(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&rC(e))return{kind:"outside_anchored_cwd"};let o=!r&&yu(e,t.posixShell);if(Tt(e))return{kind:"outside_anchored_cwd"};if(As(e,r))return{kind:"root_or_home_target"};if(Xy(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Gt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.pathCanonicalizationContext,!t.posixShell))return{kind:"git_metadata_target"};if(Jy(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(nC(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&aC(i,t.environment.home,t.environment.paths,t.pathCanonicalizationContext))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&lC(e,t.resolvedCwd??i,t.environment.paths,t.pathCanonicalizationContext))return{kind:"cwd_self_target"};if(cC(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.pathCanonicalizationContext))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function gu(e,t,n={}){let{containmentTarget:r,...o}=n;if($e(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(eC(i))return!1;if(Ql(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>uC(r??i,s,t.environment.paths,t.pathCanonicalizationContext))}function As(e,t=!1){let n=e.trim(),r=pu.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Xy(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=_s(o)?o:t.resolvedCwd?yn(t.resolvedCwd,o):null;if(!i)return!1;let s=me(H(i,t.environment.paths,t.pathCanonicalizationContext));if(s===Vy(s).root)return!0;return s===me(H(t.environment.home,t.environment.paths,t.pathCanonicalizationContext))}catch{return!1}}function me(e){let t=jy(e);if(qy){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function Jy(e,t,n,r,o,i,s,a){let l=e.trim();if(hu(l))return!1;if(!r&&es(l,a))return!0;return(t||i&&s)&&n&&!o&&Qy(l,n)}function Qy(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!yu(e.slice(n.length+1),t)})}function eC(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return pu.normalize(`/${t[1]??""}`)==="/"}function hu(e){return e.split(/[\\/]+/).includes("..")}function tC(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=nr(o.trim(),t);if(!_s(i))return[];try{let s=H(i,n,r);if(rr(s,H(t,n,r)))return[];return[me(s)]}catch{return[]}})}function nC(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(hu(r))return!1;let o=n?r:nr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=_s(o)?o:i?yn(i,o):null;if(!s)return!1;try{let a=me(H(s,t.environment.paths,t.pathCanonicalizationContext));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Ps)?l:`${l}${Ps}`))}catch{return!1}}function rC(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function yu(e,t=!1){return e.includes("$")||e.includes("`")||oC(e)||t&&iC(e)}function oC(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function iC(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&sC(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function sC(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function aC(e,t,n,r){try{return me(H(e,n,r))===me(H(t,n,r))}catch{try{return me(e)===me(t)}catch{return!1}}}function lC(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return me(H(yn(t,e),n,r))===me(H(t,n,r))}catch{try{return me(yn(t,e))===me(t)}catch{return!1}}}function cC(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ws(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ws(yn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ws(yn(a,e),t,i,s)}catch{return!1}}function ws(e,t,n,r){try{return Cu(H(e,n,r),H(t,n,r))}catch{return!1}}function uC(e,t,n,r){if(!t)return!1;try{return Cu(H(t,n,r),H(e,n,r))}catch{return!0}}function Cu(e,t){let n=me(e),r=me(t);return n.startsWith(`${r}${Ps}`)||n===r}var dC=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),bu="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",mC="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Su="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",vu="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",fC="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",pC="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function Ru(e,t,n,r=zt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return gC(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function gC(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=yC(o),s=o[i];if(!s||!dC.has(PC(s.text)))return null;let a=hC(o.slice(i+1));if(a.whatIfProtected)return null;if(Q(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",pC);for(let l of a.targets)if(!Tt(l.text)&&As(Ts(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",vu);for(let l of a.targets)if(n.resolvedCwd&&Gt(Ts(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.pathCanonicalizationContext,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(Q(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Su);for(let l of a.targets){let c=_C($e(Ts(l.text),n),n,r);if(c)return c}return null}function hC(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(CC(l))continue;if(s){t.push(ks(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=SC(l.text);if(!c){t.push(ks(l)),i=i||l.dynamic;continue}if(vC(c.name)){let u=c.value?bC(c.value,l):e[++a];if(u?.kind==="word")t.push(ks(u)),i=i||u.dynamic;else i=!0;continue}if(RC(c.name)){n=!0;continue}if(xC(c.name)){r=!0;continue}if(EC(c.name))o=wC(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function yC(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ks(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function CC(e){return e.kind==="word"&&e.text===","}function Ts(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function bC(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function SC(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function vC(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function RC(e){return"recurse".startsWith(e)}function xC(e){return e.length>=2&&"force".startsWith(e)}function EC(e){return e==="wi"||"whatif".startsWith(e)}function wC(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function PC(e){return e.toLowerCase()}function _C(e,t,n){switch(e.kind){case"root_or_home_target":return b("powershell.remove-item-recursive-force-root-or-home",vu);case"git_metadata_target":return b("powershell.remove-item-git-metadata",Ae);case"temp_target":return null;case"dynamic_target":if(!Q(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return b("powershell.remove-item-recursive-force-dynamic-target",Su);case"home_cwd_target":return b("powershell.remove-item-recursive-force-home-cwd",fC);case"cwd_self_target":return b("powershell.remove-item-recursive-force-cwd-self",bu);case"within_anchored_cwd":if(!Q(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return b("powershell.remove-item-recursive-force-paranoid",mC);case"outside_anchored_cwd":return b("powershell.remove-item-recursive-force-outside-cwd",bu)}}import{normalize as oi}from"node:path";var ve=new Set(["awk","gawk","nawk","mawk"]),AC=new Set(["-e","--source"]),kC=new Set(["-F","-v","--assign","--field-separator"]),xu=new Set(["-f","--file"]),TC=new Set(["print","printf","return"]),Eu=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],IC="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function jo(e,t,n){let r=!1;for(let o of OC(e)){let i=MC(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",IC):null}function Os(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&AC.has(a)){n=!0;let l=e[s+1];if(l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});else i=!1;s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(kC.has(a)||xu.has(a))){if(xu.has(a)){r=!0;let l=e[s+1];if(l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l});else i=!1}else if(e[s+1]===void 0)i=!1;s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function sr(e){return Os(e).sources}function OC(e){return sr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function MC(e,t){ge(t,e);let n=e.includes("system")?Ms(e,t):null,r=DC(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ms(e,t){ge(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Ho(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=wu(e,i+1);continue}if(s==="/"&&Pu(e,i)){i=_u(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ir(e[a-1])||ir(e[i]))continue;let l=Uo(e,i);if(e[l]!=="(")continue;l=Uo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Ho(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Uo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function DC(e,t){ge(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let d=Ho(e,i,u);if(d&&c===s)l={...d,startIndex:i};c=d?.endIndex??i+1,i=d?.endIndex??i+1;continue}if(u==="#"){i=wu(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Pu(e,i)){let d=_u(e,i+1);c=d??i+1,i=d??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Is(e,i,"print")||Is(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,f=Uo(e,m);if(Is(e,f,"getline")){o=!0;let d=WC(s,l,c);if(d===null)r=!0;else n.push(d);c=m,i=m;continue}if(GC(s,a)){o=!0;let d=NC(e,f);if(!d){r=!0,c=m,i=m;continue}if(!LC(e,d.endIndex)){r=!0,c=d.endIndex,i=d.endIndex;continue}n.push(d.value),c=d.endIndex,i=d.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ir(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Uo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function LC(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Ho(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=FC(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function NC(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Ho(e,t,n)}function WC(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function FC(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Is(e,t,n){return e.startsWith(n,t)&&!ir(e[t-1])&&!ir(e[t+n.length])}function GC(e,t){return t!==null&&t>=e}function wu(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Pu(e,t){let n=zC(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ir(e[r-1]))r--;return TC.has(e.slice(r,n+1))}function zC(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function _u(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Au=new Set(["rm","find","xargs","parallel"]),$C=new Set(["sudo","env","command","builtin"]),BC=new Set(["git","busybox",...Au,...ee,...Ul,...ve]);function Vo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(D(n)))return null;let r=D(n),o=e[1]==="--"?2:1,i=UC(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function UC(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;if(D(a)!==n&&HC(a,r))i.push(s);else if(to.has(z(a)))break;if(o)break}return i}function HC(e,t){let n=D(e),r=z(e);return r==="git"||n==="busybox"||$t(e)||Au.has(n)||t.transparentWrappers.includes(n)||ee.has(r)||e==="$SHELL"||ye(r)||ve.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return $C.has(e.toLowerCase())}function ku(e){let t=z(e);return BC.has(t)||ye(t)}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return qo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*qo(e,t,n,r,o,i,s,a,l){let c=po(e,t,n,i);for(let[d,p]of c.envAssignments)i.set(d,p),o.set(d,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let d=fo(c.envSplitValues,u);if(!d)throw new he;Ds(a),yield*qo(d,t,m,r,o,i,s,a,l);return}if($t(u[0]??""))throw new he;let f=Vo(u,s);if(f){for(let d of[f.childIndex,...f.alternativeChildIndices])Ds(a),yield*qo(d===f.childIndex?f.tokens:[...u.slice(d)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(VC(u)){Ds(a),yield*qo([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield jC(u,m,r,o,i,l)}function jC(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:D(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ds(e){if(e.iterations>=ln)throw new he;e.iterations++}function VC(e){return D(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Ls(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Ue(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Ns(r,"recursive"))t=!0;else if(r==="-f"||Ns(r,"force"))n=!0;else if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Tu(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Ns(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Ns(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var qC="find -delete permanently removes files. Use -print first to preview.",KC="find -exec rm -rf is dangerous. Use explicit file list instead.",YC=new Set(["-exec","-execdir","-ok","-okdir"]),ZC=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Ko(e,t){let n=e.map(I),r=XC(e,n,t);if(r)return r;if(Zo(n,1)&&!QC(e,n,t)){let s=k(b("find.delete",qC),t.policy);if(s)return s}let o=t.derivedCommandWorkBudget??Zr(),i=0;while(i<n.length){let s=n[i],a=Et(s??"");if(a>0){i+=a+1;continue}if(!pt(s)){i++;continue}Le(o,n.length-i-1);let l=ar(n,i);i=l.nextIndex;let c=tb(l.tokens,t.environment);if(c){let d=k(c,t.policy);if(d)return d}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,f=m?.id.startsWith("custom.")?m:k(m,t.policy);if(f)return f}return null}function XC(e,t,n){if(!Zo(t,1)&&!Ws(t,n.environment))return null;let o=Yo(e)??G(["."]),i=zt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=or(s);for(let l of a.expandedTargets??[I(s)]){let c=$e(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(JC(t)&&i.resolvedCwd&&cu(o.map(I),i.resolvedCwd,i.protectedGitMetadata,i.pathCanonicalizationContext))return b("find.delete-git-metadata",Ae);return null}function Ws(e,t){let n=0;while(n<e.length){if(!pt(e[n])){n++;continue}let r=ar(e,n),o=vt([...r.tokens],t),i=D(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function JC(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function QC(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Yo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Qi(o,n.environment),s=n.trustedTmpdirValue??ft(o,n.environment),a=n.allowTmpdirVar??!jn(o,n.environment),l=zt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Ze(o,n.environment),trustedTmpdirValue:s});return r.every((c)=>{let u=or(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[I(c)]).every((m)=>gu(m,l,{containmentTarget:eb(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function eb(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Yo(e){let t=(o)=>{let i=e[o];return i?I(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function tb(e,t){let n=fn([...e],t);if(n.length===0)return null;let r=D(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=D(n[0]??"");if(r==="rm"&&Ue(n))return b("find.exec-rm-recursive-force",KC);return null}function ar(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Zo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(pt(r)){n=ar(e,n).nextIndex;continue}let o=Et(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function Et(e){return ZC.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function pt(e){return e!==void 0&&YC.has(e)}function*Fs(e){for(let t of e.nodes)yield*rb(t)}function nb(e){return Object.freeze([...Fs(e)])}function NA(e){return Object.freeze(nb(e).map((t)=>Object.freeze(t.words.map((n)=>n.text))))}function lr(e){let t=Fe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}function*rb(e){if(e.kind==="command"){yield e;for(let t of e.nested)yield*Fs(t);return}if(e.kind==="group")yield*Fs(e.body)}var ob=5,Gs="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Ou(e,t,n){let r=Du(e,t,n),o=ib(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<ob;a++){let{subcommand:l,rest:c}=He(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),f=ub(m);if(f===null||f.length===0)return{blockedReason:Gs,expanded:!0,tokens:i};i=["git",...f,...c],s=!0}return{blockedReason:Gs,expanded:!0,tokens:i}}function Mu(e,t,n){return Du(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function He(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?D(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(o.startsWith("-"))if(Ye.has(o))r+=2;else if(o.startsWith("-c")&&o.length>2)r++;else if(o.startsWith("-C")&&o.length>2)r++;else r++;else return{subcommand:o,rest:e.slice(r+1)}}return{subcommand:null,rest:[]}}function ib(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Du(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?D(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=ab(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...sb(e,t,n)]}}function sb(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=zs(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=zs(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Iu(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Iu(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ye.has(i)){o+=2;continue}o++}return r}function ab(e,t){let n=lb(e,t),r=cb(e,t);return{blockedReason:n===null||r===null?Gs:null,entries:[...n??[],...r??[]]}}function lb(e,t){let n=we("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=lr(n);if(!o)return null;for(let i of o){let s=zs(i);if(!s)return null;r.push(s)}return r}function cb(e,t){let n=zr(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=we(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=we(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function zs(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Iu(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:we(e.slice(r+1),t,n)}}function ub(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return lr(t)}var db="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mb="git checkout --force discards uncommitted changes. Use 'git stash' first.",fb="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",pb="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",gb="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",hb="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",yb="git switch --force discards uncommitted changes. Use 'git stash' first.",Cb="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",bb="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Sb="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",vb="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Rb="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",xb="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Eb="git push --force destroys remote history. Use --force-with-lease for safer force push.",wb="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Pb="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",_b="git branch -D force-deletes without merge check. Use -d for safe delete.",Ab="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",kb="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Tb="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Ib="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Ob="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Mb="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Db="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Lu=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Nu=new Set(["--recurse-submodules","--track","-t"]),$s=new Set(["-b","-B","-U"]),Bs=new Set(["-c","-C"]),Lb=new Set(["--source","--conflict","--unified","--inter-hunk-context"]),Nb=new Set(["-q","--quiet","--no-quiet","-f","--force","--no-force","-d","--detach","--no-detach","-m","--merge","--no-merge","-p","--patch","--no-patch","--guess","--no-guess","--overlay","--no-overlay","--ours","--theirs","--ignore-skip-worktree-bits","--no-ignore-skip-worktree-bits","--no-track","--overwrite-ignore","--no-overwrite-ignore","--ignore-other-worktrees","--no-ignore-other-worktrees","--progress","--no-progress","--pathspec-file-nul","--no-pathspec-file-nul","--no-recurse-submodules"]);function W(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Cn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Fu(e){let{subcommand:t,rest:n}=He(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return wt(Wb(n));case"switch":return wt(Fb(n));case"restore":return wt(zb(n));case"reset":return Bb(n);case"clean":return wt(Hb(n));case"rm":return wt(jb(n));case"push":return Bt(Vb(n));case"branch":return Bt(Yb(n));case"stash":return Bt(eS(n));case"worktree":return Bt(tS(n));case"rebase":return wt(Zb(n));case"merge":return wt(Xb(n));case"tag":return Bt(Jb(n));case"reflog":return Bt(Qb(n));default:return null}}function wt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Wb(e){let{index:t,before:n}=ce(e),r=de(n,{shortOptsWithValue:$s});if(n.some((i)=>W(i,"--force"))||r.has("-f"))return b("git.checkout-force",mb);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(W(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",pb)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",fb);return b("git.checkout-double-dash",db)}if(Gb(e).length>=2)return b("git.checkout-ambiguous",gb);return null}function Fb(e){let{before:t}=ce(e);if(t.some((r)=>W(r,"--discard-changes")))return b("git.switch-discard-changes",hb);let n=de(t,{shortOptsWithValue:Bs});if(t.some((r)=>W(r,"--force"))||n.has("-f"))return b("git.switch-force",yb);return null}function Gb(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(r.startsWith("-"))if(Lu.has(r))n+=2;else if(r.startsWith("--")&&r.includes("="))n++;else if(Nu.has(r)){let o=e[n+1];if(o&&!o.startsWith("-")&&(r==="--recurse-submodules"||r==="--track"||r==="-t"))if((r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"]).includes(o))n+=2;else n++;else n++}else if(r.startsWith("--")&&!Nb.has(r)&&!Lu.has(r)&&!Nu.has(r))n++;else n++;else t.push(r),n++}return t}function zb(e){let t=$b(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",bb):b("git.restore-unstaged",Cb)}function $b(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Lb.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function Bb(e){let t=null;for(let n of e){if(W(n,"--hard")){t=b("git.reset-hard",Sb);break}if(W(n,"--merge")){t=b("git.reset-merge",vb);break}}if(!t)return null;return Ub(e)?Bt(t):wt(t)}function Ub(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function Hb(e){for(let n of e)if(n==="-n"||W(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>W(n,"--force"))||t.has("-f"))return b("git.clean-force",Rb);return null}function jb(e){let t=!1,n=!1,r=!1;for(let o of ce(e).before){if(W(o,"--no-force")){t=!1;continue}if(W(o,"--force")){t=!0;continue}if(W(o,"--no-cached")){n=!1;continue}if(W(o,"--cached")){n=!0;continue}if(W(o,"--no-dry-run")){r=!1;continue}if(W(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",xb):null}function Vb(e){let{before:t,after:n}=ce(e),r=de(t);if(t.some((s)=>W(s,"--mirror")))return b("git.push-mirror",Pb);if(t.some((s)=>W(s,"--force"))||r.has("-f")||Wu(t,n).some(qb))return b("git.push-force",Eb);if(t.some((s)=>W(s,"--delete"))||r.has("-d")||Wu(t,n).some(Kb))return b("git.push-delete",wb);return null}function Wu(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function qb(e){return e.startsWith("+")||e.includes(":+")}function Kb(e){return e.length>1&&e.startsWith(":")}function Yb(e){let{before:t}=ce(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>W(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>W(i,"--force"));if(r&&o)return b("git.branch-force-delete",_b);return null}function Zb(e){let{before:t}=ce(e);return t.some((n)=>W(n,"--abort"))?b("git.rebase-abort",Ab):null}function Xb(e){let{before:t}=ce(e);return t.some((n)=>W(n,"--abort"))?b("git.merge-abort",kb):null}function Jb(e){let{before:t}=ce(e);return de(t).has("-d")||t.some((r)=>W(r,"--delete"))?b("git.tag-delete",Tb):null}function Qb(e){return e[0]==="delete"?b("git.reflog-delete",Ib):null}function eS(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Ob);if(t==="clear")return b("git.stash-clear",Mb)}return null}function tS(e){let{before:t}=ce(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>W(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Db);return null}import{execFileSync as nS}from"node:child_process";import{existsSync as Hs,readFileSync as js}from"node:fs";import{dirname as rS,isAbsolute as $u,join as Us,resolve as Bu}from"node:path";var oS=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"];function Uu(e,t,n,r){let o=iS(e,t,n);if(o!==null)return o;let i=sS(t,n);if(i!==null)return i;if(hl(n))return!0;return aS(r)}function iS(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=Gu(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Gu(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=zu(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=zu(i.slice(13),t,n);if(s!==null)r=s;o++;continue}if(Ye.has(i))o+=2;else o++}return r}function sS(e,t){if(we("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=zr(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=we(`GIT_CONFIG_KEY_${o}`,e,t),s=we(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(Vs(a))return!0;if(a!=="submodule.recurse")continue;r=cr(s)}return r}function aS(e,t=cS()){let n=lS(e);if(n===null||n)return!0;if(t===null)return!0;try{let r=nS(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:uS(process.env),stdio:["ignore","pipe","ignore"]}).trim();return cr(r)}catch(r){return!dS(r)}}function lS(e){let t=mS(e);if(t===null)return null;for(let n of t){if(!Hs(n))continue;if(gS(n))return!0}return!1}function cS(){for(let e of oS)if(Hs(e))return e;return null}function uS(e){let t={...e};for(let n of Object.keys(t))if(Wn(n))delete t[n];return t}function dS(e){return typeof e==="object"&&e!==null&&"status"in e&&e.status===1}function mS(e){let t=zn(e);if(t===null)return null;let n=fS(t);if(n===null)return null;let r=pS(n);if(r===null)return null;return[Us(r,"config"),Us(n,"config.worktree")]}function fS(e){try{let n=js(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return $u(r)?r:Bu(rS(e),r)}catch{return null}}function pS(e){let t=Us(e,"commondir");if(!Hs(t))return e;try{let n=js(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return $u(n)?n:Bu(e,n)}catch{return null}}function gS(e){let t;try{t=js(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(hS(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=cr(c)}return r}function hS(e){return e==="include"||e.startsWith("includeif ")}function Gu(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(Vs(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return cr(r)}function cr(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function zu(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(Vs(o))return!0;if(o!=="submodule.recurse")return null;let i=we(e.slice(r+1),t,n);return i===void 0||cr(i)}function Vs(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Hu(e,t,n){if(!t.localDiscard||!n.worktreeMode||Sl(n.env,n.envAssignments))return null;let r=vl(e,n.cwd);if(!r.gitCwd||r.hasExplicitGitContext)return null;if(!Rl(r.gitCwd))return null;if(yS(e,n,r.gitCwd))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function yS(e,t,n){let{subcommand:r,rest:o}=He(e),i=r?.toLowerCase();if(t.dynamicArguments||CS(o)||Uu(e,t.env,t.envAssignments,n)||vS(o)||bS(i,o))return!0;return i==="clean"&&RS(o)>1}function CS(e){return e.some((t)=>/[$*?[]/.test(t))}function bS(e,t){if(e==="checkout"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:$s}),o=n.some((s)=>W(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:Bs}),o=n.some((s)=>W(s,"--force"))||n.some((s)=>W(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||SS(s))||r.has("-C");return o&&i}return!1}function SS(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function vS(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function RS(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}var xS="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",ES=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function bn(e,t){return ju(e.map(I),t)}function ju(e,t,n){let r=Ou(e,t.env,t.envAssignments),o=r.blockedReason?k(b("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((gl(t.envAssignments)||Mu(e,t.env,t.envAssignments))&&wS(i))return b("git.ssh-env",xS);let s=Fu(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=Hu(e,s,t);if(!a)return s;return n?.(a),null}function Vu(e,t){let n=null;return{match:ju(e.map(I),t,(o)=>{n=o}),relaxation:n}}function wS(e){let{subcommand:t,rest:n}=He(e),r=t?.toLowerCase();if(!r)return!1;if(ES.has(r))return!0;if(r==="archive")return ce(n).before.some((o)=>W(o,"--remote"));return r==="remote"&&PS(n)}function PS(e){return e.find((t)=>!_S(t))?.toLowerCase()==="update"}function _S(e){return e==="-v"||W(e,"--verbose")||W(e,"--no-verbose")}import{isAbsolute as yv}from"node:path";var qu="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",AS="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",kS="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Yu="rm -rf targeting root or home directory is extremely dangerous and always blocked.",TS="rm -rf in home directory is dangerous. Change to a project directory first.";function Sn(e,t){let n=zt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(I),o=Ue(r),i=Tu(r),s=OS(e);for(let a of s){let l=or(a.word);if(o&&l.unsafeBraceExpansion){let c=k(Ku({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=pe(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Gt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.pathCanonicalizationContext))return b("rm.git-metadata",Ae);if(i&&!o){let f=$e(u,n,m);if(f.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",Yu);if(f.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let f of IS(u,n,m)){let d=Ku(f,n,t.policy),p=k(d,t.policy);if(p)return p}}}return null}function IS(e,t,n){let r=$e(e,t,n);if(r.kind==="cwd_self_target")return[r,$e(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=$e(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,$e(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function OS(e){let t=[],n=!1;for(let r of e.slice(1)){let o=I(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function Ku(e,t,n){switch(e.kind){case"root_or_home_target":return b("rm.recursive-force-root-or-home",Yu);case"git_metadata_target":return b("rm.git-metadata",Ae);case"temp_target":return null;case"dynamic_target":if(!Q(n,"rm.recursive-force-dynamic-target",t.strict))return null;return b("rm.recursive-force-dynamic-target",kS);case"home_cwd_target":return b("rm.recursive-force-home-cwd",TS);case"cwd_self_target":return b("rm.recursive-force-cwd-self",qu);case"within_anchored_cwd":if(Q(n,"rm.recursive-force-paranoid",t.paranoid))return b("rm.recursive-force-paranoid",AS);return null;case"outside_anchored_cwd":return b("rm.recursive-force-outside-cwd",qu)}}var MS={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Xu=new Set(["--init-file","--rcfile"]),DS=["--init-file","--rcfile"],LS=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Qe(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Zu(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Zu(e,t,!1);if(r!==null)return r}}return null}function ke(e){let t=D(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return et(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Zu(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Ju(e){let t=D(e[0]??"").toLowerCase(),n=NS(e,t),r=LS.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function NS(e,t){let n=et(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?DS.find((f)=>l===f):void 0){let f=e[a+1];o.push(f===void 0?{kind:"absent"}:{kind:"literal",value:f}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Xu.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Qu(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function Qu(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!MS[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function et(e){let t=D(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Xu.has(l)&&!s.includes("="))i++;continue}let a=Qu(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var Pt={kind:"none"},Ut={kind:"dynamic"},WS=new Set(["<","<<","<<-","<<<","<&","<>"]),td=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,FS=/^(?:[0-9]+|[@*])$/,GS=Wt.maxWords,zS=Wt.maxInputLength;function nd(e){if(!e||D(z(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?2:1;continue}if(/\s/.test(a??"")){r++;continue}let l=kc(e,r,Math.min(e.length,_o.maxInputLength),_o.maxDepth);if(l){i||=!!l.issue||l.limited,r=l.next;continue}let c=gs(e,r);if(c){s(),r+=c.length;continue}if(a==="{"||a==="}"){s(),r++;continue}let u=ds(e,r,Math.min(e.length,_o.maxInputLength),_o,0);if(u.word.text)n.push(u.word.text);for(let m of u.nested)t.push(...fs(m));o++,r=u.next>r?u.next:r+1}return s(),{commands:t,invalidComment:i}}function fs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return fs(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(fs)]})}function gs(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function kc(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function Th(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function us(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var Wt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Fe(e,t="auto",n=Wt){if(t==="powershell"||t==="auto"&&wc(e.slice(0,n.maxInputLength)))return Pc(e,n);return pc(e,"posix",n)}function Yn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ih=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ao(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function ko(e){let t=Ao(e.words[0],"time")?1:0,n=t===1&&Ao(e.words[t],"-p")?t+1:t,r=t===1&&Ao(e.words[n],"--")?n+1:n,o=Ao(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ih.test(s.text));return i?.provenance==="literal"?i.text:void 0}function Zn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function hn(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Oh(e))Zn(n,t);return t.inSingle||t.inDouble}function Oh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Zn(s,n)}return t}var Mh=new Set(["&&","||","|&","|","&",";"]),Dh=new Set(["<<","<<<",">|"]),Lh=/[*@#?$!_-]/,hs=Object.freeze([]),Nh=Object.freeze([]),Wh=256;function Dc(e,t){let n=t.status==="complete"?new Set(Cs(t)):new Set,r=[...n].reduce((s,a)=>s.slice(0,a.start)+" ".repeat(a.end-a.start)+s.slice(a.end),e);if(hn(r))return To("unclosed-quote",r,hs);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Xn(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map});if(o.limited)return To("structural-limit",r,hs);if(o.invalid)return To("invalid",r,hs);return To("complete",r,i,o.assignmentFallbacks)}function To(e,t,n,r=Nh){return Object.freeze({status:e,source:t,entries:Object.freeze(n),assignmentFallbacks:Object.freeze(r)})}function Xn(e,t){return e.nodes.flatMap((n,r)=>Fh(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.entries])}function Fh(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,entries:[Ge(Uh(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,entries:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,entries:[i?Io("{"):Ge("("),...Xn(e.body,a),...s?[i?Io("}"):Ge(")")]:[]]}]}let o=jh(e,r.functions);if(o){if(r.depth>=Wt.maxDepth||++r.flags.expansions>Wh)return r.flags.limited=!0,[];return[{start:e.span.start,entries:[...Tc(e,r),Io(";"),...Xn(o,{...r,depth:r.depth+1}),Io(";")]},...Ic(e,t,n,r)]}return[{start:e.span.start,entries:Tc(e,r)},...Ic(e,t,n,r)]}function Tc(e,t){return[...e.words.map((n)=>({start:n.span.start,entries:Nc(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,entries:Gh(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.entries)}function Gh(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Nc(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[bs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,role:Hh(r),targetOrder:Dh.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s}}),...s===void 0?o:o.slice(1)]}function Ic(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[bs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,entries:a}];return[{start:s.bodySpan.start,entries:[...Lc(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?zh(t,n,r):[]]}function zh(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,entries:Lc(n.source.slice(r.span.end,e.span.end),n)}]}function Lc(e,t){if(t.depth>=Wt.maxDepth)return t.flags.limited=!0,[];let n=Fe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Xn(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Nc(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{if(a&&!r)o.push(Ge("glob"));else if(s!==""||e.quoted&&o.length===0)o.push(bs(s));s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let d of ys(c.raw,i,n.flags)){if(typeof d==="string"){l(),o.push(Ge(d));continue}s+=d.text,a||=d.glob}continue}if(i.double){let d=n.source.slice(c.span.start,c.span.end);s+=ys(d,{single:!1,double:!0},n.flags).map((p)=>typeof p==="string"?p:p.text).join("");continue}let u=t.nested.find((d)=>d.span.start>=c.span.start&&d.span.end<=c.span.end),m=u?Xn(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(...m);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),...m,...c.raw.endsWith(")")?[Ge(")")]:[]);continue}let f=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:f},()=>Ge("(")),...m,...c.raw.endsWith(")".repeat(f))?Array.from({length:f},()=>Ge(")")):[])}return l(),o}function ys(e,t,n){let r=[],o="",i=!1,s=0;while(s<e.length){let a=e[s]??"";if(!t.single&&!t.double&&(a==="("||a===")")){r.push({text:o,glob:i},a),o="",i=!1,s++;continue}if(t.single){if(a==="'")t.single=!1;else o+=a;s++;continue}if(t.double){if(a==='"'){t.double=!1,s++;continue}if(a==="\\"){let l=e[s+1]??"";o+=['"',"\\","$"].includes(l)?l:`\\${l}`,s+=2;continue}if(a==="$"){let l=Oc(e,s,t,n);o+=l.text,s=l.next;continue}o+=a,s++;continue}if(a==="'"||a==='"'){t.single=a==="'",t.double=a==='"',s++;continue}if(a==="\\"){let l=e[s+1]??"";i||=l==="*"||l==="?",o+=l,s+=2;continue}if(a==="$"){let l=Oc(e,s,t,n);o+=l.text,s=l.next;continue}i||=a==="*"||a==="?",o+=a,s++}return[...r,{text:o,glob:i}]}function Oc(e,t,n,r){let o=e[t+1];if(o==="{"){let s=Bh(e,t+2);if(s===-1)return r.invalid=!0,{text:"",next:e.length};let a=e.slice(t,s+1);return $h(a,n,r),{text:a,next:s+1}}if(o!==void 0&&Lh.test(o))return{text:`\${${o}}`,next:t+2};let i=/^\w*/.exec(e.slice(t+1))?.[0]??"";return{text:`\${${i}}`,next:t+1+i.length}}function $h(e,t,n){let r=e.slice(2,-1),o=/^[A-Za-z_][A-Za-z0-9_]*/.exec(r)?.[0];if(!o)return;let i=r.slice(o.length),s=[":=","="].find((l)=>i.startsWith(l));if(!s)return;let a=ys(i.slice(s.length),{...t},n);n.assignmentFallbacks.push(...a.flatMap((l)=>typeof l==="string"||!l.text?[]:[l.text]))}function Bh(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;else if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Uh(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:Mh.has(e)})}function Io(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function bs(e){return Object.freeze({kind:"word",text:e})}function Hh(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Cs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Cs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((s)=>Cs(s)),o=e.nodes[n+1];if(o?.kind==="connector"&&(o.operator==="|"||o.operator==="|&")||!qh(t))return r;return[...r,...t.redirections.flatMap((s)=>s.heredoc?.quotedDelimiter?[s.heredoc.bodySpan]:[])]})}function jh(e,t){let n=ko(e);return n===void 0?void 0:t.get(n)}function Rt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Vh(e){if(Rt(e.words[0],"git"))return Rt(e.words[1],"commit");if(!Rt(e.words[0],"gh")||!Rt(e.words[2],"create"))return!1;return Rt(e.words[1],"pr")||Rt(e.words[1],"issue")}function qh(e){return(Rt(e.words[0],"cat")||Rt(e.words[0],"tee")||Vh(e))&&!e.words.some(Mc)&&!e.redirections.some((n)=>Mc(n.target))}function Mc(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}import{types as Kh}from"node:util";var Yh=new Set(["applypatch","patch"]),Zh=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Xh=new Set(["grep","grepsearch","rg"]),Jh=new Set(["find","findbyname","glob"]),Qh=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),ey=new Set(["command","diff","input","patch","patchtext"]),Wc=new TextEncoder,ty=new TextDecoder,ny=/\s/,ry=64;class er extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Jn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Bc(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Mo(e){return Qh.has(Bc(e))}function C_(e){let t=Bc(e);if(Yh.has(t))return"patch";if(Xh.has(t))return"grep";if(Jh.has(t))return"glob";if(Zh.has(t))return"path";return"unknown"}function Do(e){if(!e||typeof e!=="object")return;Yc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Xe();return}if(t.get||t.set)Xe();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Uc(e,t){return Hc(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Hc(e,t,n,r){let o=Kc(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Hc(a,t,n,r+1);return typeof a==="string"&&t.has(jc(s))?[a]:l});return n.ancestors.delete(o.object),i}function jc(e){return e.replace(/-/g,"_").toLowerCase()}function Vc(e){return qc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(iy)}function qc(e,t,n,r){let o=Kc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>qc(a,o.array?t:ey.has(jc(s)),n,r+1));return n.ancestors.delete(o.object),i}function oy(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Jn.maxDepth||t.nodes>Jn.maxNodes)Xe();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Jn.maxStringBytes||t.stringBytes>Jn.maxAggregateStringBytes)Xe()}function Kc(e,t,n){if(oy(e,t,n),!e||typeof e!=="object")return null;let r=Yc(e);if(t.ancestors.has(e))Xe();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Jn.maxKeys)Xe();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Xe();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Yc(e){if(Kh.isProxy(e))Xe();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Xe();return t}function Xe(){throw new er}function iy(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=sy(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ss(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ss(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Rs(Oo(c.slice(4),!0),Oo(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ss(c))}return t}function sy(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ss(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return $c(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return $c(n[1]);if(e.startsWith("diff --git "))return ay(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return zc(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return zc(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return py(i[1]);return[]}function ay(e){let t=ly(e);if(t.length===2&&t[0]&&t[1])return Rs(t[0],t[1]);let n=cy(e);return n?Rs(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function ly(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Ft(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Ft(e[n]))n++;t.push(e.slice(i,n));continue}let o=Zc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Ft(e[n]))n++;return n===e.length?t:[]}function cy(e){let t=0;while(t<e.length&&Ft(e[t]))t++;let n=e.length;while(n>t&&Ft(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Ft(e[o])){o++;continue}let i=o;while(o<n&&Ft(e[o]))o++;if(i===t||o===n)continue;if(r++,r>ry)Xe();if(uy(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function uy(e,t,n,r,o){if(vs(e,t,n,r,o))return!0;let i=Fc(e,"/",t,n),s=Fc(e,"/",r,o);if(i<=t||s<=r)return!1;if(vs(e,t,i,r,s))return!1;return vs(e,i+1,n,s+1,o)}function vs(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Fc(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Ft(e){return e!==void 0&&ny.test(e)}function Zc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=e[o]??"";if(i===n)return{value:ty.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Wc.encode(i)),o++;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Wc.encode(dy(s[0]??""))),o+=2}return null}function dy(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function my(e){return Qn(gy(e))}function Rs(e,t){if(e==="/dev/null")return Gc(t);if(t==="/dev/null")return Gc(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Qn);let n=fy(e,t)??(e===t?Xc(e):null);return[e,t,...n?[n]:[]].flatMap(Qn)}function Gc(e){let t=Xc(e);return[e,...t?[t]:[]].flatMap(Qn)}function Xc(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function fy(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function zc(e){return my(Oo(e,!0))}function py(e){return Qn(Oo(e,!1))}function Oo(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Zc(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function gy(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Qn(e){return e===""||e==="/dev/null"?[]:[e]}function $c(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}var Jc=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Qc=new Set([...Jc,"glob"]),hy=new Set([...Qc,"pattern"]),yy=[],eu={parseCommand:Fe,projectShellSyntax:Dc};class xt extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function Lo(e,t={}){let n=Cy({...eu,...t}),r=Do(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let l=s.findIndex((m)=>m.source===a.source);if(l!==-1){let m=s[l];if(!m)return s;return s[l]={...m,usages:[...m.usages,a.usage]},s}let c=e.route.kind==="command"?e.route.shell:"posix",u=n.getCommandProgram(a.source,c);return s.push({usages:[a.usage],source:a.source,program:u,shell:n.getShellSyntax(a.source,u)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:by(e),store:n}}function be(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Je(e){if(!e.includes("$"))return e;return Qr(e,ct())}function Cy(e={}){let t={...eu,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,l)=>{let c=`${l}\x00${a}`,u=r.get(c);if(u)return u;let m=t.parseCommand(a,l);return r.set(c,m),m};return{getShellSyntax:(a,l)=>{if(l&&l.source!==a)throw TypeError("Shell syntax source does not match command program source.");let c=l??i(a,"posix");if(c.status==="limited"){let f=o.get(c);if(f)return f;let d={status:"structural-limit",source:a,entries:yy,assignmentFallbacks:[]};return o.set(c,d),d}let u=n.get(a);if(u)return u;let m=t.projectShellSyntax(a,c);return n.set(a,m),m},getCommandProgram:i}}function by(e){let t=e.route.kind==="grep"?Qc:e.route.kind==="glob"?hy:Jc;return[...Uc(e.input,t),...e.route.kind==="patch"?Vc(e.input):[]]}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Sy=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),vy=new Map([["zsh",new Set(["o"])]]),Ry=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function tu(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=Ry.get(e);if(Ey(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=xy(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function xy(e,t){let n=Sy.get(e),r=vy.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let l=t.slice(s+1);if(!o&&t[0]==="-"&&l==="c")continue;if(!o&&t[0]==="-"&&l[0]==="-"&&l.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function Ey(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}var Ay=new Set(["-S","--suffix"]);function No(e,t,n,r){if(e.status==="structural-limit")throw new xt;if(e.status!=="complete")return r.findMalformedTarget(e.source);let o={cwd:t,variables:new Map},i=[];for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;let a=r.findSegmentTarget(i,o);if(a)return a;o=ky(i,o,n,r.normalizeCwd),i=[];continue}if(s.kind==="redirection"){if(s.role==="file-write"&&s.target&&r.isRedirectionTarget(Se(s.target,o.variables),o))return s.target;continue}i.push(s.text)}return r.findSegmentTarget(i,o)}function Se(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:Se(i,t);return a?Se(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function ru(e,t,n){let r=n.environment.home,o=Qr(e.trim(),n.environment).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?nu(r,o.slice(2)):o,s=pe(i);return _y(Py(s)?s:nu(t,s))}function le(e,t,n){let r=ru(e,t,n);if(!r)return"";return H(r,n.environment.paths,n).replace(/\\/g,"/")}function ou(e,t,n,r){let o=ru(e,t,n);if(!o)return null;if(r(wy(o)))return H(o,n.environment.paths,n).replace(/\\/g,"/");let i=zl(o,n.environment.paths,n);return i===null?null:i.replace(/\\/g,"/")}function Wo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Ay.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}function ky(e,t,n,r){let o=tr(e)?new Map([...t.variables,...Ty(e,t.variables)]):t.variables,i=fn([...e],n.environment),s=D(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;return{cwd:!s||s==="-"?t.cwd:r(Se(s,o),t.cwd,n),variables:o}}function Ty(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],Se(o,t)]]:[]})}var Ae="Git metadata and hooks are protected. Ask the user before modifying them.";function lu(e,t=Es([e.invocation.context.executionCwd,e.invocation.context.configCwd])){let n=Mt(ct()),r=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Mo(e.invocation.toolName))return null;let s=e.paths.find((a)=>Wy(a,r,t,n));return s?{target:s}:null}if(e.invocation.route.kind!=="command")return null;let o=be(e,"input-candidate");if(!o)return null;let i=No(o.shell,r,n,{findSegmentTarget:(s,a)=>Gy(s,a,t,n),isRedirectionTarget:(s,a)=>Fy(s,a.cwd,t,n),findMalformedTarget:()=>null,normalizeCwd:le});return i?{target:i}:null}function Es(e,t=Mt(ct())){let n=[...new Map(e.filter((r)=>typeof r==="string"&&r!=="").flatMap((r)=>{let o=zn(le(r,r,t));return o?[[ze(o),{dotGitPath:o,cwd:r}]]:[]})).values()].flatMap((r)=>My(r.dotGitPath,r.cwd,t));if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.map((r)=>r.entry))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFile?[r.markerFile]:[]))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function My(e,t,n){try{let r=le(e,t,n),o=Iy(e),i=o.isFile()?r:null,s=o.isFile()?Hi(e):null,a=(o.isDirectory()?[r]:[s?.gitDir,s?.commonDir]).flatMap((c)=>c?[ze(le(c,t,n))]:[]),l=[...new Set(o.isDirectory()?[ze(e.replace(/\\/g,"/")),...a]:a)];return[{entry:ze(r),markerFile:i?ze(i):null,directories:l,hooksDirectories:[...new Set(l.flatMap((c)=>{let u=ze(Oy(c,"hooks"));return[u,ze(le(u,t,n))]}))]}]}catch{return[]}}function Gt(e,t,n,r,o,i=!1){if(!n)return!1;let s=ze(le(e,t,o)),a=s.replace(/(\/\.?\*+)+$/,"");if(a!==s&&a!==""){if(xs(a,n))return!0;let l=i||s.slice(a.length).includes("/."),c=(u)=>l?Fo(u,a):Dy(u,a);if(n.markerFiles.some(c))return!0;return r&&iu(n).some(c)}if(xs(s,n))return!0;return r&&iu(n).some((l)=>Fo(l,s))}function Dy(e,t){let n=au(t,e);if(n===""||n.startsWith("..")||su(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Ly(e,t,n,r){return Gt(e,t,n,!0,r)}function Ny(e,t,n,r){if(!n)return!1;return xs(ze(le(e,t,r)),n)}function Wy(e,t,n,r){if(!n)return!1;return cu(e,t,n,r,n.entries)}function Fy(e,t,n,r){if(!n)return!1;return cu(e,t,n,r,n.markerFiles)}function cu(e,t,n,r,o){let i=ze(le(e,t,r));return o.includes(i)||du(i,n)}function uu(e,t,n,r){if(!n)return!1;return n.hooksDirectories.some((o)=>e.some((i)=>Fo(o,ze(le(i,t,r)))))}function xs(e,t){return t.entries.includes(e)||t.directories.includes(e)||du(e,t)}function du(e,t){return t.hooksDirectories.some((n)=>Fo(e,n))}function iu(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Fo(e,t){let n=au(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!su(n)}function ze(e){return process.platform==="win32"?e.toLowerCase():e}function Gy(e,t,n,r){if(tr(e))return null;let o=vt([...e],r.environment);if(D(o[0]??"").toLowerCase()!=="mv")return null;let i=Wo(o.slice(1)),s=i.sources.find((a)=>Ly(Se(a,t.variables),t.cwd,n,r));if(s)return s;return i.destination&&Ny(Se(i.destination,t.variables),t.cwd,n,r)?i.destination:null}import{isAbsolute as ws,join as zy,normalize as $y,sep as Go}from"node:path";var mu=process.platform==="win32",By=/[*?]/;function nr(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function $o(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=nr(e.trim(),t);if(!ws(n))return"must be an absolute path or start with ~/";return rr(n,t)}function Bo(e,t){let n=fu(e,t);if(n===null)return"must be a non-empty path string";if(!ws(n))return null;if(rr(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Uy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Hy="cannot cover the guard's own configuration";function fu(e,t){if(typeof e!=="string"||e.trim()==="")return null;return nr(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Uo(e,t){let n=fu(e,t);if(n===null)return"must be a non-empty path string";if(By.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ws(n))return null;if(rr(n,t)!==null)return Uy;return jy(n,t)?Hy:null}function jy(e,t){let n=zo(e),r=zo(zy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Go}`)}function rr(e,t){let n=zo(e),r=zo(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Go)?n:`${n}${Go}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function zo(e){let t=$y(e);if(mu)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(mu?3:1)&&t.endsWith(Go))t=t.slice(0,-1);return t}var Ky=process.platform==="win32",pu=64,Yy=16384;function or(e){let t=bc(e,pu,pu,Yy);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:Zy(e)}}function Zy(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Xy(e.raw,n.span.start-e.span.start))}function Xy(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function zt(e){let t=e.environment.home,n=e.environment.paths,r=Mt(e.environment);return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:nC(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,pathCanonicalizationContext:r}}function $e(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&oC(e))return{kind:"outside_anchored_cwd"};let o=!r&&Cu(e,t.posixShell);if(Tt(e))return{kind:"outside_anchored_cwd"};if(ks(e,r))return{kind:"root_or_home_target"};if(Jy(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Gt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.pathCanonicalizationContext,!t.posixShell))return{kind:"git_metadata_target"};if(Qy(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(rC(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&lC(i,t.environment.home,t.environment.paths,t.pathCanonicalizationContext))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&cC(e,t.resolvedCwd??i,t.environment.paths,t.pathCanonicalizationContext))return{kind:"cwd_self_target"};if(uC(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.pathCanonicalizationContext))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function hu(e,t,n={}){let{containmentTarget:r,...o}=n;if($e(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(tC(i))return!1;if(ec(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>dC(r??i,s,t.environment.paths,t.pathCanonicalizationContext))}function ks(e,t=!1){let n=e.trim(),r=gu.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Jy(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=As(o)?o:t.resolvedCwd?yn(t.resolvedCwd,o):null;if(!i)return!1;let s=me(H(i,t.environment.paths,t.pathCanonicalizationContext));if(s===qy(s).root)return!0;return s===me(H(t.environment.home,t.environment.paths,t.pathCanonicalizationContext))}catch{return!1}}function me(e){let t=Vy(e);if(Ky){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function Qy(e,t,n,r,o,i,s,a){let l=e.trim();if(yu(l))return!1;if(!r&&ts(l,a))return!0;return(t||i&&s)&&n&&!o&&eC(l,n)}function eC(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Cu(e.slice(n.length+1),t)})}function tC(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return gu.normalize(`/${t[1]??""}`)==="/"}function yu(e){return e.split(/[\\/]+/).includes("..")}function nC(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=nr(o.trim(),t);if(!As(i))return[];try{let s=H(i,n,r);if(rr(s,H(t,n,r)))return[];return[me(s)]}catch{return[]}})}function rC(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(yu(r))return!1;let o=n?r:nr(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=As(o)?o:i?yn(i,o):null;if(!s)return!1;try{let a=me(H(s,t.environment.paths,t.pathCanonicalizationContext));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(_s)?l:`${l}${_s}`))}catch{return!1}}function oC(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Cu(e,t=!1){return e.includes("$")||e.includes("`")||iC(e)||t&&sC(e)}function iC(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function sC(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&aC(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function aC(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function lC(e,t,n,r){try{return me(H(e,n,r))===me(H(t,n,r))}catch{try{return me(e)===me(t)}catch{return!1}}}function cC(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return me(H(yn(t,e),n,r))===me(H(t,n,r))}catch{try{return me(yn(t,e))===me(t)}catch{return!1}}}function uC(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ps(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ps(yn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ps(yn(a,e),t,i,s)}catch{return!1}}function Ps(e,t,n,r){try{return bu(H(e,n,r),H(t,n,r))}catch{return!1}}function dC(e,t,n,r){if(!t)return!1;try{return bu(H(t,n,r),H(e,n,r))}catch{return!0}}function bu(e,t){let n=me(e),r=me(t);return n.startsWith(`${r}${_s}`)||n===r}var mC=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Su="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",fC="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",vu="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ru="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",pC="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",gC="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function xu(e,t,n,r=zt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return hC(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function hC(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=CC(o),s=o[i];if(!s||!mC.has(_C(s.text)))return null;let a=yC(o.slice(i+1));if(a.whatIfProtected)return null;if(Q(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",gC);for(let l of a.targets)if(!Tt(l.text)&&ks(Is(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ru);for(let l of a.targets)if(n.resolvedCwd&&Gt(Is(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.pathCanonicalizationContext,!0))return b("powershell.remove-item-git-metadata",Ae);if(!a.recursive||!a.force)return null;if(Q(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",vu);for(let l of a.targets){let c=AC($e(Is(l.text),n),n,r);if(c)return c}return null}function yC(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(bC(l))continue;if(s){t.push(Ts(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=vC(l.text);if(!c){t.push(Ts(l)),i=i||l.dynamic;continue}if(RC(c.name)){let u=c.value?SC(c.value,l):e[++a];if(u?.kind==="word")t.push(Ts(u)),i=i||u.dynamic;else i=!0;continue}if(xC(c.name)){n=!0;continue}if(EC(c.name)){r=!0;continue}if(wC(c.name))o=PC(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function CC(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Ts(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function bC(e){return e.kind==="word"&&e.text===","}function Is(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function SC(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function vC(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function RC(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function xC(e){return"recurse".startsWith(e)}function EC(e){return e.length>=2&&"force".startsWith(e)}function wC(e){return e==="wi"||"whatif".startsWith(e)}function PC(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function _C(e){return e.toLowerCase()}function AC(e,t,n){switch(e.kind){case"root_or_home_target":return b("powershell.remove-item-recursive-force-root-or-home",Ru);case"git_metadata_target":return b("powershell.remove-item-git-metadata",Ae);case"temp_target":return null;case"dynamic_target":if(!Q(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return b("powershell.remove-item-recursive-force-dynamic-target",vu);case"home_cwd_target":return b("powershell.remove-item-recursive-force-home-cwd",pC);case"cwd_self_target":return b("powershell.remove-item-recursive-force-cwd-self",Su);case"within_anchored_cwd":if(!Q(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return b("powershell.remove-item-recursive-force-paranoid",fC);case"outside_anchored_cwd":return b("powershell.remove-item-recursive-force-outside-cwd",Su)}}import{normalize as ii}from"node:path";var ve=new Set(["awk","gawk","nawk","mawk"]),kC=new Set(["-e","--source"]),TC=new Set(["-F","-v","--assign","--field-separator"]),Eu=new Set(["-f","--file"]),IC=new Set(["print","printf","return"]),wu=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],OC="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Vo(e,t,n){let r=!1;for(let o of MC(e)){let i=DC(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",OC):null}function Ms(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&kC.has(a)){n=!0;let l=e[s+1];if(l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});else i=!1;s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(TC.has(a)||Eu.has(a))){if(Eu.has(a)){r=!0;let l=e[s+1];if(l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l});else i=!1}else if(e[s+1]===void 0)i=!1;s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function sr(e){return Ms(e).sources}function MC(e){return sr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function DC(e,t){ge(t,e);let n=e.includes("system")?Ds(e,t):null,r=LC(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ds(e,t){ge(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=jo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Pu(e,i+1);continue}if(s==="/"&&_u(e,i)){i=Au(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ir(e[a-1])||ir(e[i]))continue;let l=Ho(e,i);if(e[l]!=="(")continue;l=Ho(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=jo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Ho(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function LC(e,t){ge(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let d=jo(e,i,u);if(d&&c===s)l={...d,startIndex:i};c=d?.endIndex??i+1,i=d?.endIndex??i+1;continue}if(u==="#"){i=Pu(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&_u(e,i)){let d=Au(e,i+1);c=d??i+1,i=d??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Os(e,i,"print")||Os(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,f=Ho(e,m);if(Os(e,f,"getline")){o=!0;let d=FC(s,l,c);if(d===null)r=!0;else n.push(d);c=m,i=m;continue}if(zC(s,a)){o=!0;let d=WC(e,f);if(!d){r=!0,c=m,i=m;continue}if(!NC(e,d.endIndex)){r=!0,c=d.endIndex,i=d.endIndex;continue}n.push(d.value),c=d.endIndex,i=d.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function ir(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Ho(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function NC(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function jo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=GC(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function WC(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return jo(e,t,n)}function FC(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function GC(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Os(e,t,n){return e.startsWith(n,t)&&!ir(e[t-1])&&!ir(e[t+n.length])}function zC(e,t){return t!==null&&t>=e}function Pu(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function _u(e,t){let n=$C(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ir(e[r-1]))r--;return IC.has(e.slice(r,n+1))}function $C(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Au(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var ku=new Set(["rm","find","xargs","parallel"]),BC=new Set(["sudo","env","command","builtin"]),UC=new Set(["git","busybox",...ku,...ee,...Hl,...ve]);function qo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(D(n)))return null;let r=D(n),o=e[1]==="--"?2:1,i=HC(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function HC(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;if(D(a)!==n&&jC(a,r))i.push(s);else if(to.has(z(a)))break;if(o)break}return i}function jC(e,t){let n=D(e),r=z(e);return r==="git"||n==="busybox"||$t(e)||ku.has(n)||t.transparentWrappers.includes(n)||ee.has(r)||e==="$SHELL"||ye(r)||ve.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return BC.has(e.toLowerCase())}function Tu(e){let t=z(e);return UC.has(t)||ye(t)}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Ko([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Ko(e,t,n,r,o,i,s,a,l){let c=go(e,t,n,i);for(let[d,p]of c.envAssignments)i.set(d,p),o.set(d,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let d=po(c.envSplitValues,u);if(!d)throw new he;Ls(a),yield*Ko(d,t,m,r,o,i,s,a,l);return}if($t(u[0]??""))throw new he;let f=qo(u,s);if(f){for(let d of[f.childIndex,...f.alternativeChildIndices])Ls(a),yield*Ko(d===f.childIndex?f.tokens:[...u.slice(d)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(qC(u)){Ls(a),yield*Ko([...u.slice(1)],t,m,r,o,i,s,a,l);return}yield VC(u,m,r,o,i,l)}function VC(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:D(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ls(e){if(e.iterations>=ln)throw new he;e.iterations++}function qC(e){return D(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Ns(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Ue(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||Ws(r,"recursive"))t=!0;else if(r==="-f"||Ws(r,"force"))n=!0;else if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Iu(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>Ws(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function Ws(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var KC="find -delete permanently removes files. Use -print first to preview.",YC="find -exec rm -rf is dangerous. Use explicit file list instead.",ZC=new Set(["-exec","-execdir","-ok","-okdir"]),XC=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Yo(e,t){let n=e.map(I),r=JC(e,n,t);if(r)return r;if(Xo(n,1)&&!eb(e,n,t)){let s=k(b("find.delete",KC),t.policy);if(s)return s}let o=t.derivedCommandWorkBudget??Zr(),i=0;while(i<n.length){let s=n[i],a=Et(s??"");if(a>0){i+=a+1;continue}if(!pt(s)){i++;continue}Le(o,n.length-i-1);let l=ar(n,i);i=l.nextIndex;let c=nb(l.tokens,t.environment);if(c){let d=k(c,t.policy);if(d)return d}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,f=m?.id.startsWith("custom.")?m:k(m,t.policy);if(f)return f}return null}function JC(e,t,n){if(!Xo(t,1)&&!Fs(t,n.environment))return null;let o=Zo(e)??G(["."]),i=zt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=or(s);for(let l of a.expandedTargets??[I(s)]){let c=$e(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Ae)}}if(QC(t)&&i.resolvedCwd&&uu(o.map(I),i.resolvedCwd,i.protectedGitMetadata,i.pathCanonicalizationContext))return b("find.delete-git-metadata",Ae);return null}function Fs(e,t){let n=0;while(n<e.length){if(!pt(e[n])){n++;continue}let r=ar(e,n),o=vt([...r.tokens],t),i=D(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function QC(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function eb(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Zo(e);if(!r)return!1;let o=n.envAssignments??new Map,i=es(o,n.environment),s=n.trustedTmpdirValue??ft(o,n.environment),a=n.allowTmpdirVar??!jn(o,n.environment),l=zt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Ze(o,n.environment),trustedTmpdirValue:s});return r.every((c)=>{let u=or(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[I(c)]).every((m)=>hu(m,l,{containmentTarget:tb(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function tb(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Zo(e){let t=(o)=>{let i=e[o];return i?I(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function nb(e,t){let n=fn([...e],t);if(n.length===0)return null;let r=D(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=D(n[0]??"");if(r==="rm"&&Ue(n))return b("find.exec-rm-recursive-force",YC);return null}function ar(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Xo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(pt(r)){n=ar(e,n).nextIndex;continue}let o=Et(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function Et(e){return XC.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function pt(e){return e!==void 0&&ZC.has(e)}function*Gs(e){for(let t of e.nodes)yield*ob(t)}function rb(e){return Object.freeze([...Gs(e)])}function WA(e){return Object.freeze(rb(e).map((t)=>Object.freeze(t.words.map((n)=>n.text))))}function lr(e){let t=Fe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}function*ob(e){if(e.kind==="command"){yield e;for(let t of e.nested)yield*Gs(t);return}if(e.kind==="group")yield*Gs(e.body)}var ib=5,zs="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Mu(e,t,n){let r=Lu(e,t,n),o=sb(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<ib;a++){let{subcommand:l,rest:c}=He(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),f=db(m);if(f===null||f.length===0)return{blockedReason:zs,expanded:!0,tokens:i};i=["git",...f,...c],s=!0}return{blockedReason:zs,expanded:!0,tokens:i}}function Du(e,t,n){return Lu(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function He(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?D(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(o.startsWith("-"))if(Ye.has(o))r+=2;else if(o.startsWith("-c")&&o.length>2)r++;else if(o.startsWith("-C")&&o.length>2)r++;else r++;else return{subcommand:o,rest:e.slice(r+1)}}return{subcommand:null,rest:[]}}function sb(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Lu(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?D(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=lb(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...ab(e,t,n)]}}function ab(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=$s(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=$s(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Ou(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Ou(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ye.has(i)){o+=2;continue}o++}return r}function lb(e,t){let n=cb(e,t),r=ub(e,t);return{blockedReason:n===null||r===null?zs:null,entries:[...n??[],...r??[]]}}function cb(e,t){let n=we("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=lr(n);if(!o)return null;for(let i of o){let s=$s(i);if(!s)return null;r.push(s)}return r}function ub(e,t){let n=zr(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=we(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=we(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function $s(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Ou(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:we(e.slice(r+1),t,n)}}function db(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return lr(t)}var mb="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",fb="git checkout --force discards uncommitted changes. Use 'git stash' first.",pb="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",gb="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",hb="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",yb="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Cb="git switch --force discards uncommitted changes. Use 'git stash' first.",bb="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Sb="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",vb="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Rb="git reset --merge can lose uncommitted changes. Use 'git stash' first.",xb="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Eb="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",wb="git push --force destroys remote history. Use --force-with-lease for safer force push.",Pb="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",_b="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Ab="git branch -D force-deletes without merge check. Use -d for safe delete.",kb="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Tb="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Ib="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Ob="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Mb="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Db="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Lb="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Nu=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Wu=new Set(["--recurse-submodules","--track","-t"]),Bs=new Set(["-b","-B","-U"]),Us=new Set(["-c","-C"]),Nb=new Set(["--source","--conflict","--unified","--inter-hunk-context"]),Wb=new Set(["-q","--quiet","--no-quiet","-f","--force","--no-force","-d","--detach","--no-detach","-m","--merge","--no-merge","-p","--patch","--no-patch","--guess","--no-guess","--overlay","--no-overlay","--ours","--theirs","--ignore-skip-worktree-bits","--no-ignore-skip-worktree-bits","--no-track","--overwrite-ignore","--no-overwrite-ignore","--ignore-other-worktrees","--no-ignore-other-worktrees","--progress","--no-progress","--pathspec-file-nul","--no-pathspec-file-nul","--no-recurse-submodules"]);function W(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Cn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Gu(e){let{subcommand:t,rest:n}=He(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return wt(Fb(n));case"switch":return wt(Gb(n));case"restore":return wt($b(n));case"reset":return Ub(n);case"clean":return wt(jb(n));case"rm":return wt(Vb(n));case"push":return Bt(qb(n));case"branch":return Bt(Zb(n));case"stash":return Bt(tS(n));case"worktree":return Bt(nS(n));case"rebase":return wt(Xb(n));case"merge":return wt(Jb(n));case"tag":return Bt(Qb(n));case"reflog":return Bt(eS(n));default:return null}}function wt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function Fb(e){let{index:t,before:n}=ce(e),r=de(n,{shortOptsWithValue:Bs});if(n.some((i)=>W(i,"--force"))||r.has("-f"))return b("git.checkout-force",fb);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(W(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",gb)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",pb);return b("git.checkout-double-dash",mb)}if(zb(e).length>=2)return b("git.checkout-ambiguous",hb);return null}function Gb(e){let{before:t}=ce(e);if(t.some((r)=>W(r,"--discard-changes")))return b("git.switch-discard-changes",yb);let n=de(t,{shortOptsWithValue:Us});if(t.some((r)=>W(r,"--force"))||n.has("-f"))return b("git.switch-force",Cb);return null}function zb(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(r.startsWith("-"))if(Nu.has(r))n+=2;else if(r.startsWith("--")&&r.includes("="))n++;else if(Wu.has(r)){let o=e[n+1];if(o&&!o.startsWith("-")&&(r==="--recurse-submodules"||r==="--track"||r==="-t"))if((r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"]).includes(o))n+=2;else n++;else n++}else if(r.startsWith("--")&&!Wb.has(r)&&!Nu.has(r)&&!Wu.has(r))n++;else n++;else t.push(r),n++}return t}function $b(e){let t=Bb(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",Sb):b("git.restore-unstaged",bb)}function Bb(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Nb.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function Ub(e){let t=null;for(let n of e){if(W(n,"--hard")){t=b("git.reset-hard",vb);break}if(W(n,"--merge")){t=b("git.reset-merge",Rb);break}}if(!t)return null;return Hb(e)?Bt(t):wt(t)}function Hb(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function jb(e){for(let n of e)if(n==="-n"||W(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>W(n,"--force"))||t.has("-f"))return b("git.clean-force",xb);return null}function Vb(e){let t=!1,n=!1,r=!1;for(let o of ce(e).before){if(W(o,"--no-force")){t=!1;continue}if(W(o,"--force")){t=!0;continue}if(W(o,"--no-cached")){n=!1;continue}if(W(o,"--cached")){n=!0;continue}if(W(o,"--no-dry-run")){r=!1;continue}if(W(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Eb):null}function qb(e){let{before:t,after:n}=ce(e),r=de(t);if(t.some((s)=>W(s,"--mirror")))return b("git.push-mirror",_b);if(t.some((s)=>W(s,"--force"))||r.has("-f")||Fu(t,n).some(Kb))return b("git.push-force",wb);if(t.some((s)=>W(s,"--delete"))||r.has("-d")||Fu(t,n).some(Yb))return b("git.push-delete",Pb);return null}function Fu(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Kb(e){return e.startsWith("+")||e.includes(":+")}function Yb(e){return e.length>1&&e.startsWith(":")}function Zb(e){let{before:t}=ce(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>W(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>W(i,"--force"));if(r&&o)return b("git.branch-force-delete",Ab);return null}function Xb(e){let{before:t}=ce(e);return t.some((n)=>W(n,"--abort"))?b("git.rebase-abort",kb):null}function Jb(e){let{before:t}=ce(e);return t.some((n)=>W(n,"--abort"))?b("git.merge-abort",Tb):null}function Qb(e){let{before:t}=ce(e);return de(t).has("-d")||t.some((r)=>W(r,"--delete"))?b("git.tag-delete",Ib):null}function eS(e){return e[0]==="delete"?b("git.reflog-delete",Ob):null}function tS(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Mb);if(t==="clear")return b("git.stash-clear",Db)}return null}function nS(e){let{before:t}=ce(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>W(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Lb);return null}import{execFileSync as rS}from"node:child_process";import{existsSync as js,readFileSync as Vs}from"node:fs";import{dirname as oS,isAbsolute as Bu,join as Hs,resolve as Uu}from"node:path";var iS=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"];function Hu(e,t,n,r){let o=sS(e,t,n);if(o!==null)return o;let i=aS(t,n);if(i!==null)return i;if(yl(n))return!0;return lS(r)}function sS(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=zu(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=zu(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=$u(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=$u(i.slice(13),t,n);if(s!==null)r=s;o++;continue}if(Ye.has(i))o+=2;else o++}return r}function aS(e,t){if(we("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=zr(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=we(`GIT_CONFIG_KEY_${o}`,e,t),s=we(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(qs(a))return!0;if(a!=="submodule.recurse")continue;r=cr(s)}return r}function lS(e,t=uS()){let n=cS(e);if(n===null||n)return!0;if(t===null)return!0;try{let r=rS(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:dS(process.env),stdio:["ignore","pipe","ignore"]}).trim();return cr(r)}catch(r){return!mS(r)}}function cS(e){let t=fS(e);if(t===null)return null;for(let n of t){if(!js(n))continue;if(hS(n))return!0}return!1}function uS(){for(let e of iS)if(js(e))return e;return null}function dS(e){let t={...e};for(let n of Object.keys(t))if(Wn(n))delete t[n];return t}function mS(e){return typeof e==="object"&&e!==null&&"status"in e&&e.status===1}function fS(e){let t=zn(e);if(t===null)return null;let n=pS(t);if(n===null)return null;let r=gS(n);if(r===null)return null;return[Hs(r,"config"),Hs(n,"config.worktree")]}function pS(e){try{let n=Vs(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return Bu(r)?r:Uu(oS(e),r)}catch{return null}}function gS(e){let t=Hs(e,"commondir");if(!js(t))return e;try{let n=Vs(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return Bu(n)?n:Uu(e,n)}catch{return null}}function hS(e){let t;try{t=Vs(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(yS(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=cr(c)}return r}function yS(e){return e==="include"||e.startsWith("includeif ")}function zu(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(qs(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return cr(r)}function cr(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function $u(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(qs(o))return!0;if(o!=="submodule.recurse")return null;let i=we(e.slice(r+1),t,n);return i===void 0||cr(i)}function qs(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function ju(e,t,n){if(!t.localDiscard||!n.worktreeMode||vl(n.env,n.envAssignments))return null;let r=Rl(e,n.cwd);if(!r.gitCwd||r.hasExplicitGitContext)return null;if(!xl(r.gitCwd))return null;if(CS(e,n,r.gitCwd))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function CS(e,t,n){let{subcommand:r,rest:o}=He(e),i=r?.toLowerCase();if(t.dynamicArguments||bS(o)||Hu(e,t.env,t.envAssignments,n)||RS(o)||SS(i,o))return!0;return i==="clean"&&xS(o)>1}function bS(e){return e.some((t)=>/[$*?[]/.test(t))}function SS(e,t){if(e==="checkout"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:Bs}),o=n.some((s)=>W(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:Us}),o=n.some((s)=>W(s,"--force"))||n.some((s)=>W(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||vS(s))||r.has("-C");return o&&i}return!1}function vS(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function RS(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function xS(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}var ES="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",wS=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function bn(e,t){return Vu(e.map(I),t)}function Vu(e,t,n){let r=Mu(e,t.env,t.envAssignments),o=r.blockedReason?k(b("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((hl(t.envAssignments)||Du(e,t.env,t.envAssignments))&&PS(i))return b("git.ssh-env",ES);let s=Gu(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=ju(e,s,t);if(!a)return s;return n?.(a),null}function qu(e,t){let n=null;return{match:Vu(e.map(I),t,(o)=>{n=o}),relaxation:n}}function PS(e){let{subcommand:t,rest:n}=He(e),r=t?.toLowerCase();if(!r)return!1;if(wS.has(r))return!0;if(r==="archive")return ce(n).before.some((o)=>W(o,"--remote"));return r==="remote"&&_S(n)}function _S(e){return e.find((t)=>!AS(t))?.toLowerCase()==="update"}function AS(e){return e==="-v"||W(e,"--verbose")||W(e,"--no-verbose")}import{isAbsolute as Cv}from"node:path";var Ku="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",kS="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",TS="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Zu="rm -rf targeting root or home directory is extremely dangerous and always blocked.",IS="rm -rf in home directory is dangerous. Change to a project directory first.";function Sn(e,t){let n=zt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(I),o=Ue(r),i=Iu(r),s=MS(e);for(let a of s){let l=or(a.word);if(o&&l.unsafeBraceExpansion){let c=k(Yu({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=pe(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Gt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.pathCanonicalizationContext))return b("rm.git-metadata",Ae);if(i&&!o){let f=$e(u,n,m);if(f.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",Zu);if(f.kind==="git_metadata_target")return b("rm.git-metadata",Ae);continue}if(!o)continue;for(let f of OS(u,n,m)){let d=Yu(f,n,t.policy),p=k(d,t.policy);if(p)return p}}}return null}function OS(e,t,n){let r=$e(e,t,n);if(r.kind==="cwd_self_target")return[r,$e(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=$e(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,$e(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function MS(e){let t=[],n=!1;for(let r of e.slice(1)){let o=I(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function Yu(e,t,n){switch(e.kind){case"root_or_home_target":return b("rm.recursive-force-root-or-home",Zu);case"git_metadata_target":return b("rm.git-metadata",Ae);case"temp_target":return null;case"dynamic_target":if(!Q(n,"rm.recursive-force-dynamic-target",t.strict))return null;return b("rm.recursive-force-dynamic-target",TS);case"home_cwd_target":return b("rm.recursive-force-home-cwd",IS);case"cwd_self_target":return b("rm.recursive-force-cwd-self",Ku);case"within_anchored_cwd":if(Q(n,"rm.recursive-force-paranoid",t.paranoid))return b("rm.recursive-force-paranoid",kS);return null;case"outside_anchored_cwd":return b("rm.recursive-force-outside-cwd",Ku)}}var DS={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ju=new Set(["--init-file","--rcfile"]),LS=["--init-file","--rcfile"],NS=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Qe(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Xu(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Xu(e,t,!1);if(r!==null)return r}}return null}function ke(e){let t=D(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return et(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Xu(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function Qu(e){let t=D(e[0]??"").toLowerCase(),n=WS(e,t),r=NS.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function WS(e,t){let n=et(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?LS.find((f)=>l===f):void 0){let f=e[a+1];o.push(f===void 0?{kind:"absent"}:{kind:"literal",value:f}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Ju.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=ed(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function ed(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!DS[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function et(e){let t=D(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Ju.has(l)&&!s.includes("="))i++;continue}let a=ed(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var Pt={kind:"none"},Ut={kind:"dynamic"},FS=new Set(["<","<<","<<-","<<<","<&","<>"]),nd=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,GS=/^(?:[0-9]+|[@*])$/,zS=Wt.maxWords,$S=Wt.maxInputLength;function rd(e){if(!e||D(z(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function vn(e){let t=ur(e[1])==="--"?2:1;if(e.length<=t)return Pt;let n=e.slice(t);if(!n.every(Jo))return Ut;return{kind:"literal",source:n.map(I).join(" ")}}function rd(e){let t=ur(e[1])==="--"?2:1,n=e[t],r=ur(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Pt;if(!Jo(n))return Ut;return{kind:"literal",source:r}}function Xo(e,t){let n=BS(e);if(n===-1)return Pt;let r=US(t);if(!r)return Pt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=jS(s,e,n,r.ifs);if(!a)return Ut;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>GS||i>zS)return Ut;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(qS)].filter((s)=>s!==null).join(" ")}}function od(e,t,n,r){if(!et(e.map(I)).readsStdinAsCommands)return Pt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&WS.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Pt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Ut;return{kind:"literal",source:o.target.text}}if(!n)return Pt;return r===void 0?Ut:{kind:"literal",source:r}}function tt(e){let t=et(e.map(I)).scriptIndex;if(t===null)return Pt;let n=e[t],r=ur(n);return Fr(n,r)?{kind:"literal",source:r}:Ut}var $S=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Zs(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||_e(s)!==null)return!1;let a=D(z(s));return!$S.has(a)&&!ee.has(a)&&!$t(a)}function BS(e){return et(e.map(I)).commandIndex??-1}function US(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(HS);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function HS(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function jS(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?qs(o):VS(o,r);if(e.parameter==="*"){let a=qs(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ks(l,r)}let i=t[n+1+e.parameter];if(i&&!Jo(i))return;let s=ur(i);return e.quoted?[s]:Ks(s,r)}function qs(e){return e.every(Jo)?e.map(I):void 0}function VS(e,t){let n=qs(e);if(!n)return;let r=n.map((o)=>Ks(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ks(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function vn(e){let t=ur(e[1])==="--"?2:1;if(e.length<=t)return Pt;let n=e.slice(t);if(!n.every(Qo))return Ut;return{kind:"literal",source:n.map(I).join(" ")}}function od(e){let t=ur(e[1])==="--"?2:1,n=e[t],r=ur(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Pt;if(!Qo(n))return Ut;return{kind:"literal",source:r}}function Jo(e,t){let n=US(e);if(n===-1)return Pt;let r=HS(t);if(!r)return Pt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=VS(s,e,n,r.ifs);if(!a)return Ut;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>zS||i>$S)return Ut;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(KS)].filter((s)=>s!==null).join(" ")}}function id(e,t,n,r){if(!et(e.map(I)).readsStdinAsCommands)return Pt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&FS.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Pt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Ut;return{kind:"literal",source:o.target.text}}if(!n)return Pt;return r===void 0?Ut:{kind:"literal",source:r}}function tt(e){let t=et(e.map(I)).scriptIndex;if(t===null)return Pt;let n=e[t],r=ur(n);return Fr(n,r)?{kind:"literal",source:r}:Ut}var BS=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Xs(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||_e(s)!==null)return!1;let a=D(z(s));return!BS.has(a)&&!ee.has(a)&&!$t(a)}function US(e){return et(e.map(I)).commandIndex??-1}function HS(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(jS);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function jS(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function VS(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ks(o):qS(o,r);if(e.parameter==="*"){let a=Ks(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ys(l,r)}let i=t[n+1+e.parameter];if(i&&!Qo(i))return;let s=ur(i);return e.quoted?[s]:Ys(s,r)}function Ks(e){return e.every(Qo)?e.map(I):void 0}function qS(e,t){let n=Ks(e);if(!n)return;let r=n.map((o)=>Ys(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ys(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Jo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(I(e)):e.provenance==="literal"}function ur(e){return e?I(e):""}function qS(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Xs(e,t){return Ys(Fe(e,"posix"),t)}function Rn(e){return Xs(e,new Set(Array.from(e.matchAll(td)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ys(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ys(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ys(o,n))||id(r.words,n))return!0;JS(r,n)}return!1}function id(e,t){let n=e.findIndex((s)=>_e(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(dr(r,t))return!0;let o=z(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return ed(e[s],t)}if(ee.has(o)){let s=e.slice(n),a=et(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&ed(s[l],t)}let i=KS(e,n,t);if(i===null)return!1;if(i===-1)return!0;return id(e.slice(i),t)}function KS(e,t,n){let r=z(e[t]?.text??"");if(r==="command")return YS(e,t+1);if(r==="exec")return ZS(e,t+1);if(r==="env")return XS(e,t+1,n);return null}function YS(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function ZS(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function XS(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return dr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return dr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(_e(i))continue;return r}return null}function JS(e,t){if(!e.words.every((n)=>_e(n.text)!==null))return;for(let n of e.words){let r=_e(n.text);if(!r)continue;if(dr(n,t))t.add(r.name)}}function dr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(td)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(FS.test(o)||t.has(o))}))}function ed(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||dr(e,t))}var QS=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--config-env"]),ev=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),tv=new Set;function sd(e){if(e==="git")return QS;if(e==="docker")return ev;return tv}function ne(e,t){if(e.length===0||t.length===0)return null;let n=z(e[0]??""),r=de(e);for(let o of t){if(!nv(n,o.command))continue;if(!rv(n,e,o.subcommand))continue;if(iv(e,new Set(o.block_args),r))return{id:`custom.${o.name}`,reason:`[${o.name}] ${o.reason}`,intent:o.intent??"manual_only"}}return null}function nv(e,t){return e===z(t)}function rv(e,t,n){if(!n)return!0;return ad(t,1,n,sd(e))}function ad(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&ov(e,i,n,r))return!0;continue}return s===n}return!1}function ov(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return ad(e,t+2,n,r)}function iv(e,t,n){for(let r of e)if(t.has(r))return!0;for(let r of n)if(t.has(r))return!0;return!1}function _t(e,t,n={}){if(e.length===0)return null;let r=e[0];if(!r)return null;let o=z(r);if(o==="eval"){let i=vn(G(e));if(i.kind==="dynamic")return xn(n,t);if(i.kind==="literal"&&t.analyzeNested){let s=t.analyzeNested(i.source,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s)return s}return nt(n,t)}if(ee.has(o)){if(ke(e))return null;let i=Qe(e);if(i){if(n.dynamicSourceInput??n.dynamicInput){let l=xn(n,t);if(l)return l}if(Rn(i)){let l=xn(n,t);if(l)return l}if(!t.analyzeNested)return null;let a=t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(a)return a;return null}let s=tt(G(e));if(s.kind==="dynamic")return xn(n,t);if(s.kind==="literal"){if(n.dynamicSourceInput)return xn(n,t);return null}if(n.dynamicSourceInput??n.dynamicInput)return xn(n,t);return null}if(ve.has(o))return k(jo(e,(i)=>t.analyzeNested?t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments}):null),t.policy)??ne(e,t.policy?.rules??[])??nt(n,t);if(ye(o)){let i=ro(e);if(!i)return nt(n,t);if(Q(t.policy,"interpreter.one-liner-paranoid",!!t.paranoidInterpreters)){let a=k(b("interpreter.one-liner-paranoid",un),t.policy);if(a)return a}if(so(o,i))return nt(n,t);let s=t.analyzeNested?.(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s&&s.id!=="raw-text.dangerous-command"&&(s.reason!==St||hn(i)))return s;if(dn(i,t.scanWork))return k(b("interpreter.dangerous-command",Lt),t.policy)??nt(n,t);return nt(n,t)}if(o==="rm"||o==="rmdir"){let i=o==="rm"&&(Ue(e)||n.dynamicRmInput);return k(Sn(G(e),{environment:t.environment,cwd:t.cwd,originalCwd:t.originalCwd,strict:t.strict,paranoid:t.paranoidRm,allowTmpdirVar:t.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(t.envAssignments,t.environment),trustedTmpdirValue:ft(t.envAssignments,t.environment),protectedGitMetadata:t.protectedGitMetadata,policy:t.policy}),t.policy)??(i&&n.dynamicRmInput?nt(n,t):null)??(i?sv(n,t):null)}if(o==="find")return Ko(G(e),{...t,derivedCommandWorkBudget:t.derivedCommandWorkBudget,analyzeTokens:(i,s)=>_t(i,{...t,cwd:s??void 0,derivedCommandWorkBudget:t.derivedCommandWorkBudget},n)})??ne(e,t.policy?.rules??[])??nt(n,t);if(o==="git")return k(bn(G(e),{env:t.environment.env,cwd:t.cwd,envAssignments:t.envAssignments,policy:t.policy,worktreeMode:n.dynamicInput?!1:t.worktreeMode}),t.policy)??ne(e,t.policy?.rules??[])??nt(n,t);return ne(e,t.policy?.rules??[])??nt(n,t)}function xn(e,t){return e.shellDynamicMatch?k(e.shellDynamicMatch,t.policy):null}function nt(e,t){return e.dynamicSourceInput&&e.dynamicSourceMatch?k(e.dynamicSourceMatch,t.policy):null}function sv(e,t){return e.dynamicInput&&e.rmDynamicMatch?k(e.rmDynamicMatch,t.policy):null}var Js="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Qs="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",av="__CC_SAFETY_NET_XARGS_INPUT__",Qo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ei="rm",lv=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,cv=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,uv=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,dv=/^(?:[0-9]+|[@*])$/;function ud(e,t){let n=e.map(I),{childStart:r,replacementToken:o}=Ht(n),i=n.slice(r),s=b("xargs.shell-dynamic",Qs);if(fv(i,o,t)&&k(s,t.policy))return k(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?k(s,t.policy):null;if(c)return c;let u=pd(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&md(l,o),f=_t(l,{...t,cwd:a.cwd,envAssignments:a.envAssignments},{dynamicInput:u,dynamicSourceInput:m||dd(l,a.head,o,a.wrapperEnvAssignments,u,t.scanWork,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",Js)});if(f)return f;let d=mv(l,o,t.policy?.rules??[]);if(d)return d;if(a.head==="git"){let g=o===null?[...l,av]:l,y=o!==null&&(l.some((R)=>R.includes(o))||Array.from(a.envAssignments.values()).some((R)=>R.includes(o))),h=_t(g,{...t,cwd:a.cwd,envAssignments:a.envAssignments,worktreeMode:o===null||y?!1:t.worktreeMode});if(h)return h}let p=ne(l,t.policy?.rules??[]);if(p)return p}return null}function mv(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ne([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>ea(s,t,i)):[])));for(let o of r){let i=ne(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function ea(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function dd(e,t,n,r,o,i,s){if(ee.has(t)){if(ke(e))return!1;if(n!==null&&pv(e,n))return!0;let a=Qe(e);if(!a){let l=tt(G(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(mt(a,i))return!0;return gv(a,n,r)}if(ye(t))return ld(e,n,io,Vl(t));if(ve.has(t))return ld(e,n,Os,Eu);if(t==="eval"){let a=vn(G(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return hv(e,n,i,s);if(t==="git"){let a=He(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Cn.has(a.subcommand.toLowerCase())&&fd(a.rest,n).some((l)=>l.includes(n))}return!1}function ld(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Qo]).sources.some((l)=>l.value===Qo);if(o.sources.some((l)=>l.value.includes(t)))return!0;let i=new Set(o.sources.map((l)=>`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)),s=r.flatMap((l)=>[l.selector,...l.valueForm==="attached-only"||l.valueForm==="attached-or-separate"?[`${l.selector}${Qo}`]:[],...l.valueForm==="equals-or-separate"?[`${l.selector}=${Qo}`]:[]]),a=new Set(s.flatMap((l)=>e.flatMap((c)=>ea(c,t,l))));return Array.from(a).some((l)=>n(e.map((c)=>c.replaceAll(t,l))).sources.some((c)=>!i.has(`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)))}function fv(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,ei]:e.map((i,s)=>s===0?i:i.replaceAll(t,ei));return Array.from(Be(o,n)).some((i)=>i.head===ei&&!r.has(ei))}function md(e,t){return fd(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function fd(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function pd(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function pv(e,t){let n=et(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return ea(i,t,o).some((l)=>{let c=e.map((m,f)=>f===s?m.replaceAll(t,l):m),u=et(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function gv(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(lv))if(cd(o,r))return!0;for(let o of e.matchAll(cv))for(let i of(o[1]??"").matchAll(uv))if(cd(i,r))return!0;return Xs(e,r)}function cd(e,t){let n=e[1]??e[2];return n!==void 0&&(dv.test(n)||t.has(n))}function hv(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(pt(a)){let c=ar(e,s);s=c.nextIndex-1;for(let u of Be(c.tokens,{environment:r,cwd:void 0})){let m=pd(u.tokens,t,u.wrapperEnvAssignments);if(u.head==="rm"&&md(u.tokens,t)||dd(u.tokens,u.head,t,u.wrapperEnvAssignments,m,n,r))return!0}continue}let l=Et(a);if(l>0){if(i=l,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function Ht(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(o.startsWith("-")){if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}if(t.has(o))r+=2;else r++}else return{childStart:r,replacementToken:n}}return{childStart:e.length,replacementToken:n}}var fr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",pr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Cv="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",bv="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Sv=/\{[^{}\s]*\}/,Rd=/\{\}|\{-?\d+\}/g,vv=["e","f","source","file","-e","-f","--source","--file"],Rv=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],xv=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Ev=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),gd=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),wv=new Set(["--workdir","--wd"]),hd="__CC_SAFETY_NET_PARALLEL_SOURCE__",Pv=new TextEncoder,na=B.maxDerivedBytes+4*B.maxPlaceholderReplacements;function fe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function xd(e,t){return fe([...e],(n)=>mt(n,t.scanWork))}function Ed(e,t){let n=e.map(I);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Vt(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Md(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=Vt(t);if(p)return p;let g=xd(t.envAssignments?.values()??[],t);if(g)return g}if(l){let p=Dv(t);if(p)return p}if(u!==void 0&&a){let p=Vt(t);if(p)return p}let f=Fv(u,t.cwd,t.environment.paths);if(f===null){let p=Vt(t);if(p)return p}let d=a?{...t,cwd:void 0,originalCwd:void 0}:f===null||f===void 0||f===t.cwd?t:{...t,cwd:f};if(m){if([...Be(i,d)].flatMap((g)=>[...g.envAssignments.values()]).some(sa)){let g=Vt(t);if(g)return g}return null}if(i.length===0){if(s.some((y)=>y.length!==1)){let y=Vt(t);if(y)return y}let p=s.map((y)=>y[0]??"");Ce(t.budget,ra(p));let g=kd(d.envAssignments,d.cwd,a);return fe(p,(y)=>t.analyzeNested(y,g))}return fe(Be(i,d),(p)=>_v(p,o,t,d))}function _v(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c={...r,cwd:e.cwd,envAssignments:e.envAssignments},u=[...e.envAssignments.values()];if(u.some(Id)){let h=Vt(n);if(h)return h}let m=xd(u,n);if(m)return m;let f=u.some(j),d=i||f,p=a&&d,g=kd(e.envAssignments,e.wrapperCwd,s||p);if(ee.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ce(n.budget,ti(l,o,"generic")),fe(o,(A)=>_t(l.map((P)=>At(P,A)),c))};if(ke(l))return h();let R=Qe(l);if(R){if(Od(R)){let C=jt(n);if(C)return C;if(o.length===0)return null;return Ce(n.budget,vd(R,o)),fe(o,(_)=>n.analyzeNested(At(R,_),g))}if(j(R)){if(o.length>0)return Ce(n.budget,vd(R,o)),fe(o,(E)=>n.analyzeNested(At(R,E),g));Ce(n.budget,bd(R));let C=lr(R);if(C?.[0]&&z(C[0])==="rm"&&Ue(C)){let E=Cd(n);if(E)return E}let _=C?_t(C,c,{dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",pr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",fr)}):null;if(_)return _;return n.analyzeNested(R,g)}let A=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((C)=>Xo(G(C===void 0?l:i?l.map((_)=>At(_,C)):[...l,...C]),R)):[];if(A.some((C)=>C.kind==="dynamic")){let C=jt(n);if(C)return C}let P=A.flatMap((C)=>C.kind==="literal"?[C.source]:[]);if(P.length>0)return Ce(n.budget,ra(P)),fe(P,(C)=>n.analyzeNested(C,g));if(Ce(n.budget,bd(R)),Rn(R)){let C=jt(n);if(C)return C}let S=n.analyzeNested(R,g);if(S)return S;if(d)return jt(n);return null}let x=tt(G(l));if(x.kind==="dynamic"||x.kind==="literal"&&j(x.source))return jt(n)??h();if(x.kind==="literal")return h();if(o.length>0){let A=jt(n);if(A)return A;let P=h();if(P)return P;if(i)return null;let S=o.flatMap((C)=>C[0]===void 0?[]:[C[0]]);return Ce(n.budget,ra(S)),fe(S,(C)=>n.analyzeNested(C,g))}if(d||a)return jt(n)??h();return null}if(e.head==="rm"&&Ue(l)){if(i&&o.length>0)return Ce(n.budget,ti(l,o,"rm")),fe(o,(R)=>ta(l.map((x)=>oa(x,R)),e.cwd,r));if(o.length>0)return Ce(n.budget,Sd(l,o)),fe(o,(R)=>ta([...l,...R],e.cwd,r));let h=ta(l.flatMap((R,x)=>{if(x===0||!j(R))return[R];return R.startsWith("-")?[oa(R,[""])]:[]}),e.cwd,r);if(h)return h;return Cd(n)}Ce(n.budget,i&&o.length>0?ti(l,o,"generic"):o.length>0?Sd(l,o):Ad(l));let y=o.length>0?o:[void 0];return fe(y,(h)=>{let R=h===void 0?l:i?l.map((T)=>At(T,h)):[...l,...h],x=b("parallel.shell-dynamic",pr),A=a&&e.head==="find"?Mv(R,r):null,P=Pd(R,a,n.policy?.rules??[],n.budget)??A?.customResult??null,S=z(e.head),C=a&&(S==="rm"&&ia(R)||S==="xargs"&&_d(R)||A?.rmOptions===!0),_=a&&(C||A?.executedSource===!0||A===null&&wd(R,S)),E=_t(R,{...c,worktreeMode:s||a||d?!1:n.worktreeMode},{dynamicInput:a||d,dynamicRmInput:C,dynamicSourceInput:P!==null||_,shellDynamicMatch:x,dynamicSourceMatch:x,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",fr)});if(_){let T=k(x,n.policy);if(T)return T}return E??P??ne(R,n.policy?.rules??[])})}function wd(e,t){if(j(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(ee.has(t))return Tv(e);if(t==="git")return Av(e);if(t==="find")return!0;if(ve.has(t))return yd(e,vv,sr);if(ye(t))return yd(e,Rv,oo);return!1}function ia(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(j))return t===-1;return n.some((o)=>j(o)&&(o.startsWith("-")||Od(o)))}function Av(e){if(kv(e))return!0;let t=He(e);if(t.subcommand===null||j(t.subcommand))return!0;if(!Cn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(j))return n===-1;return r.some(j)}function kv(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(j(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(j(n))return!0;continue}if(j(n))return!0}return!1}function Tv(e){if(ke(e))return!1;let t=Qe(e);if(t!==null)return j(t);let n=tt(G(e));if(n.kind==="literal")return j(n.source);if(n.kind==="dynamic")return!0;return!e.some(j)}function yd(e,t,n){let r=n(e);if(r.some((i)=>j(i.value)))return!0;if(!e.some(j))return n([...e,hd]).some((i)=>i.value===hd);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>At(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function Pd(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>z(s.command)===z(e[0]??""));if(o.length===0)return null;let i=e.some(j);if(Ce(r,Iv(e,o,i)),!i)return fe(o,(s)=>ne([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return fe(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((l)=>l?Ov(e,l):[]));return fe(a,(l)=>ne(e.map((c)=>At(c,[l])),[s]))})}function Iv(e,t,n){let r=n?qt(Te(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),B.maxChildAnalyses),2*Math.max(e.length,1),B.maxChildAnalyses):t.length;return{childAnalyses:r,derivedTokens:qt(r,e.length,B.maxDerivedTokens)}}function Ov(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function Mv(e,t){let n={customResult:null,executedSource:!e.some(j),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(j))return;for(let a of Be(i,t))n.executedSource||=wd(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&ia(a.tokens)||a.head==="xargs"&&_d(a.tokens),n.customResult??=Pd(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=j(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(pt(a)){i=[],n.executedSource||=j(a);continue}let l=Et(a);if(l>0){o=l,n.executedSource||=j(a);continue}n.executedSource||=j(a)}return s(),n}function _d(e){let t=e.slice(Ht(e).childStart);return z(t[0]??"")==="rm"&&ia(t)}function ni(e,t){return(n)=>k(b(e,t),n.policy)}var jt=ni("parallel.shell-dynamic",pr),Dv=ni("parallel.command-stream-dynamic",Cv),Vt=ni("parallel.command-stream-dynamic",bv),Cd=ni("parallel.rm-recursive-force-dynamic",fr);function ta(e,t,n){return k(Sn(G(e),{environment:n.environment,cwd:t,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(n.envAssignments??new Map,n.environment),trustedTmpdirValue:ft(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function ra(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:gr(e)}}function bd(e){return Ad([e])}function Ad(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:gr(e)}}function Sd(e,t){if(t.length>B.maxChildAnalyses)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Te(t.map((n)=>e.length+n.length),B.maxDerivedTokens),derivedBytes:Te([qt(gr(e),t.length,B.maxDerivedBytes),Te(t.map((n)=>gr(n)),B.maxDerivedBytes)],B.maxDerivedBytes)}}function vd(e,t){return ti([e],t,"generic")}function ti(e,t,n){if(t.length>B.maxChildAnalyses)return{childAnalyses:t.length};let r=qt(e.length,t.length,B.maxDerivedTokens);if(r>B.maxDerivedTokens)return{childAnalyses:t.length,derivedTokens:r};let o=Wv(e.map((l)=>Nv(l,n))),i=qt(o.occurrences,t.length,B.maxPlaceholderReplacements);if(i>B.maxPlaceholderReplacements)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(Lv(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:B.maxDerivedBytes+1,placeholderReplacements:i};let s=n==="generic"?At:oa,a=Te(t.map((l)=>gr(e.map((c)=>s(c,l)))),B.maxDerivedBytes);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function Lv(e,t,n){let r=B.maxDerivedBytes+4*n;return Te([qt(e.fixedBytes,t.length,r),qt(e.occurrences,Te(t.map((o)=>o.reduce((i,s)=>Math.max(i,mr(s)),0)),r),r)],r)>r}function Nv(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(Rd),r=0,o=0,i=0;for(let s of n){if(r>=B.maxPlaceholderReplacements)return{occurrences:B.maxPlaceholderReplacements+1,fixedBytes:0};o=Te([o,mr(e.slice(i,s.index))],na),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?mr(e):Te([o,mr(e.slice(i))],na)}}function Wv(e){return{occurrences:Te(e.map((t)=>t.occurrences),B.maxPlaceholderReplacements),fixedBytes:Te(e.map((t)=>t.fixedBytes),na)}}function gr(e,t=B.maxDerivedBytes){return Te(e.map(mr),t)}function mr(e){return Pv.encode(e).byteLength}function Te(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function qt(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function kd(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function At(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>Td(n,t))}function oa(e,t){return e.replace(Rd,(n)=>Td(n,t))}function Td(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function j(e){return Sv.test(e)}function Id(e){if(sa(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function sa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Od(e){return/^\{[^{}\s]*\}$/.test(e)}function Md(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let x=Ls(e,t+1);n.push(...x.templateTokens),r=t+1,o=x.markerIndex;break}if(!p.startsWith("-")){let x=Ls(e,t);n.push(...x.templateTokens),r=t,o=x.markerIndex;break}let g=e[t+1],y=p.indexOf("="),h=y===-1?p:p.slice(0,y),R=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(h==="--replace"||p.startsWith("-i")&&p.length>2){let x=h==="--replace"?R:p.slice(2);c||=x!==""&&x!=="{}",t++;continue}if(p==="-a"||Ev.has(h)){c=!0,t+=R===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(h==="--env"){c=!0,t+=R===void 0?2:1;continue}if(gd.has(h)||p.startsWith("-S")&&p.length>2){i=!0,t+=gd.has(p)?2:1;continue}if(wv.has(h)){let x=R??g;if(x===void 0||x===":::"||x==="--"){c=!0,t++;continue}l=x,c||=R!==void 0&&x==="",t+=R===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&R!==void 0){t++;continue}if(xv.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(a?sa:Id);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let y=e[g];if(y===":::"){u.push(p),p=[];continue}if(y!==void 0)p.push(y)}u.push(p)}let m=Gv(u),f=n.some(j),d=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:f,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:d,unsupported:c,workdir:l,dryRun:a}}function Fv(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!yv(e))return null;try{return bt(t??e,e,n)}catch{return null}}function Gv(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>B.maxChildAnalyses)return r;t=r}return t}function Dd(e){return Md(e).childStart}var zv="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ri="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function la(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function aa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Nd(e,t,n,r,o=!1,i){let a=(Yn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&Q(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",zv):null;return k(a,i)??Wd(e,t,n,o,i)}function Wd(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>la(a)?[l]:[]);if(i.length===0)return null;let s=z(t[0]?.text??"");if(s==="git"){let a=rn(e,t),l=Bv(a);if(Q(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return k(b("shell.dynamic-structure",ri),o);if(k(bn(a,{env:n.env}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,f)=>f>l&&I(m)==="--");if(Q(o,"shell.dynamic-structure",r)&&c&&Cn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return k(b("shell.dynamic-structure",ri),o);return null}if(s==="find")return Q(o,"shell.dynamic-structure",r)&&Uv(t)?k(b("shell.dynamic-structure",ri),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&I(c)==="--"),l=Ue(t.map(I));return Q(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?k(b("shell.dynamic-structure",ri),o):null}if(s==="xargs")return Ld(e,t.slice(Ht(t.map(I)).childStart),"xargs",n,r,o);if(s==="parallel")return Ld(e,t.slice(Dd(t.map(I))),"parallel",n,r,o);return null}function Ld(e,t,n,r,o,i){if(t.length===0)return null;let s=$v(t,r);if(Yn(e,s)){let l=k(b(`${n}.shell-dynamic`,n==="xargs"?Qs:pr),i);if(l)return l}let a=Wd(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>la(l)&&aa(l)))return k(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Js:fr),i);return null}function $v(e,t){let n=Nt(e,t),r=n.rewritten?G(n.words.map(I)):n.words,o=r[0];return o&&I(o)==="busybox"?r.slice(1):r}function Bv(e){let t=1;while(t<e.length){let n=e[t],r=n?I(n):"";if(Ye.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function Uv(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=la(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||aa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||aa(s)))return!0;continue}if(t=!0,a)return!0;let l=Et(s.text);if(l>0){n=l;continue}if(pt(s.text))o=!0,r=!0}return!1}function ca(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Fr(t[n.tokenIndex],n.value)})}var Hv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",jv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Vv="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Fd(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",Hv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",jv);if(e==="shred"&&n.length>0)return b("shred.target",Vv);return null}var zd=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Sn(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(e.envAssignments,e.options.environment),trustedTmpdirValue:ft(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy})},{heads:new Set(["git"]),analyze:(e)=>bn(e.words,ua(e))},{heads:new Set(["find"]),analyze:(e)=>Ko(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(e.envAssignments,e.options.environment),trustedTmpdirValue:ft(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>ud(e.words,{...Gd(e),analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Ed(e.words,{...Gd(e),budget:e.options.parallelBudget,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})}];function Gd(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function Kt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function ua(e){return{env:e.options.environment.env,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var Hd="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function jd(e){return zd.find((t)=>t.heads.has(e))?.analyze}function hr(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(w)=>w.map((N)=>o==="posix"?I(N):N.text),s=n.effectiveCwd===null,a=s?void 0:n.effectiveCwd??n.cwd,l=s?void 0:n.cwd,c=mo(e);if(c.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...c.envAssignments.keys()],output:i(c.words)});let u=Nt(c.words,n.environment,a,new Map([...n.envAssignments??[],...c.envAssignments])),m=u.envSplitValues??[];if(m.length>0){let w=[...m,...i(u.words)].join(" "),N=mt(w,n.scanWork);if(N)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:N.reason}),rt(N);if(n.strict)return Re(r);let Z=fo(m,i(u.words));if(Z){Le(n.derivedCommandWorkBudget,Z.length);let J=n.analyzeNested(Z.join(" "),{effectiveCwd:u.cwd===void 0?n.effectiveCwd:u.cwd,envAssignments:new Map([...n.envAssignments??[],...c.envAssignments,...u.envAssignments])});if(J)return J}}let f=u.rewritten?G(i(u.words)):rn(o,u.words),d=i(f),p={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&c.words.length>f.length){let w=i(c.words);r.recordSegment({type:"leading-tokens-stripped",input:w,removed:w.slice(0,w.length-f.length),output:d})}let g=new Map([...n.envAssignments??[],...c.envAssignments,...u.envAssignments]),y=d[0];if(!y)return null;if($t(y))throw new he;let h=z(y),R=u.cwd===null?void 0:u.cwd??a,x=u.cwd===null?void 0:l,A=u.cwd===void 0?n.effectiveCwd:u.cwd,P=!jn(g,n.environment),S=Nd(o,u.words,n.environment,t===0,n.strict,n.policy);if(S)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:S.reason}),rt(S);let C=Vo(d,n.policy);if(C){for(let w of[C.childIndex,...C.alternativeChildIndices]){$d(p.wrapperNormalizationBudget);let N=f.slice(w);r?.recordSegment({type:"transparent-wrapper",wrapper:C.wrapper,output:i(N)});let Z=hr(N,t,{...p,effectiveCwd:A,envAssignments:g});if(Z)return Z}return null}let _=h==="eval"?vn(f):h==="trap"?rd(f):void 0;if(_?.kind==="dynamic"&&(n.strict||!n.commandView||!Zs(n.commandView)))return Re(r);if(_?.kind==="literal"){r?.recordSegment({type:"recurse",reason:h==="eval"?"shell-eval":"shell-trap",innerCommand:_.source,depth:t+1});let w=n.analyzeNested(_.source,{effectiveCwd:A,envAssignments:g,functionDefinitions:n.functionDefinitions});if(w)return w}if(qd(y,h)){if(ke(d))return null;let w=qv(d,g,A,n,r,t);if(w)return w;let N=Qe(d);if(N){let nn=Xo(f,N);if(nn.kind==="dynamic")return Re(r);let Li=nn.kind==="literal"?nn.source:N,il=Kv(Li);r?.recordSegment({type:"shell-wrapper",wrapper:h,innerCommand:il}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:il,depth:t+1});let sl=n.analyzeNested(Li,{effectiveCwd:A,envAssignments:g});if(sl)return sl;return Rn(Li)?Re(r):null}let Z=tt(f);if(Z.kind==="dynamic")return Re(r);if(Z.kind==="literal")return si(Z.source,A,g,n,r,t);let J=od(f,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(J.kind==="dynamic")return Re(r);if(J.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:J.source,depth:t+1}),n.analyzeNested(J.source,{effectiveCwd:A,envAssignments:g})}if(h==="source"||h==="."){let w=d[1]==="-p"?2:null;if(w!==null){let nn=n.commandView?f[w]:void 0;if(!nn)return null;if(nn.provenance!=="literal")return Re(r)}let N=w===null?1:3,Z=d[N]==="--"?N+1:N,J=n.commandView?f[Z]:void 0;if(!J)return null;if(J.provenance==="literal")return si(J.text,A,g,n,r,t);if(n.strict||!n.commandView||!Zs(n.commandView))return Re(r)}if(ve.has(h)){if(n.strict&&ca(sr(d),f))return Re(r);let w=jo(d,(Z)=>Kt(n.analyzeNested(Z,{effectiveCwd:A,envAssignments:g}))),N=k(w,n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:N.reason}),rt(N)}if(ye(h)){if(n.strict&&ca(oo(d),f))return Re(r);let w=ro(d);if(w){let N=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:h,codeArg:w,paranoidBlocked:N}),N){let J=k(b("interpreter.one-liner-paranoid",un),n.policy);if(J)return rt(J)}if(so(h,w))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:w,depth:t+1});let Z=n.analyzeNested(w,{effectiveCwd:A,envAssignments:g});if(Z&&Z.ruleId!=="raw-text.dangerous-command"&&(Z.reason!==St||hn(w)))return Z;if(dn(w,n.scanWork)){let J=k(b("interpreter.dangerous-command",Lt),n.policy);if(J)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:Lt}),rt(J)}r=void 0}}if(h==="busybox"&&d.length>1)return $d(p.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:d[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:d.slice(1).join(" "),depth:t+1}),hr(f.slice(1),t,{...p,effectiveCwd:A,envAssignments:g});let E=k(Fd(h,d),n.policy);if(E)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:E.reason}),rt(E);let T=r===p.trace?p:{...p,trace:r},O={words:f,head:h,cwd:R,originalCwd:x,envAssignments:g,allowTmpdirVar:P,dynamicArguments:u.words.some((w)=>w.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:T,analyzeChildTokens:(w,N)=>Kt(hr(G(w),t+1,{...T,commandView:void 0,effectiveCwd:N,envAssignments:g}))??ne(w,T.policy.rules)},M=jd(h);if(h==="rm"||h==="xargs"||h==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:g.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!P,allowTmpdirVar:P});let F=r&&h==="git"?Vu(O.words,ua(O)):void 0,oe=Bd(F?F.match:M?.(O)??null,n.policy);if(r)Yv(O,oe,F?.relaxation??null);if(oe)return rt(oe);let Ee=M!==void 0;if(!Ee)if(!to.has(h)){let w=r?[]:void 0;for(let N=1;N<d.length;N++){let Z=d[N];if(!Z)continue;w?.push(Z);let J=Bd(Zv(O,d,N),n.policy);if(J)return r?.recordSegment({type:"fallback-scan",tokensScanned:w??[],embeddedCommandFound:z(Z)}),rt(J)}r?.recordSegment({type:"fallback-scan",tokensScanned:w??[]})}else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});if(t===0||!Ee){let w=ne(d,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!w,reason:w?.reason}),w)return rt(w)}else r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1});return null}function qv(e,t,n,r,o,i){let s=Ju(e);if(s.argvSource?.kind==="absent")return Re(o);if(s.argvSourceApplies&&s.argvSource){let l=si(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return si(a,n,t,r,o,i,!0)}function si(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Re(o);let a=Hn(e,t,r.environment.paths),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Re(o):null;return Le(r.derivedCommandWorkBudget,1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function Kv(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Yv(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function $d(e){if(e.iterations>=ln)throw new he;e.iterations++}function rt(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Re(e){return e?.recordSegment({type:"error",message:Hd}),rt(Vd())}function Vd(){return{id:"",reason:Hd,intent:"stop_and_explain"}}function qd(e,t){return ee.has(t)||e==="$SHELL"||e==="${SHELL}"||ee.has(D(t))}function Zv(e,t,n){let r=Be(t.slice(n),{environment:e.options.environment,cwd:e.cwd,envAssignments:e.envAssignments,policy:e.options.policy});for(let o of r){let i=Xv(e,n,o);if(i)return i}return null}function Xv(e,t,n){let r=n.tokens[0];if(!r)return null;let o=z(r);if(qd(r,o)){Le(e.options.derivedCommandWorkBudget,e.words.length-t);let l=n.tokens;if(ke(l))return null;let c=Qe(l);if(!c){if(tt(G(l)).kind==="dynamic")return Vd();return ii(e,n)}let u=e.options.analyzeNested(c,{effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,envAssignments:n.envAssignments});return u?Kt(u):ii(e,n)}let i=jd(o);if(!i||o==="xargs"||o==="parallel"){if(n.wrappedByTransparent&&e.options.policy.rules.length>0)Le(e.options.derivedCommandWorkBudget,e.words.length-t);return ii(e,n)}Le(e.options.derivedCommandWorkBudget,e.words.length-t);let s=[o,...n.tokens.slice(1)],a={...e,words:G(s),head:o,cwd:n.cwd,originalCwd:n.wrapperCwd===null?void 0:e.originalCwd,envAssignments:n.envAssignments,allowTmpdirVar:!jn(n.envAssignments,e.options.environment),effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,options:o==="git"?{...e.options,worktreeMode:!1}:e.options};return i(a)??ii(e,n)}function ii(e,t){return t.wrappedByTransparent?ne(t.tokens,e.options.policy.rules):null}function Bd(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:k(e,t)}var Jv=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Qv=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function eR(e,t){let n=Zd(e,t);if(n.length===0)return!1;let r=n[Yd(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return Jv.test(e.join(" "))}function Kd(e,t,n,r){if(e.dialect==="powershell"){let a=tR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Ud(iR(a.target),t,n.paths)}let o=e.words.map(I);if(!eR(o,n))return;if(!t)return null;let i=Zd(o,n,t),s=Yd(i);if(s===-1||i[s]!=="cd")return null;return Ud(i[s+1],t,n.paths)}function Ud(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return sR(bt(t,e,n),t,n)?t:null}catch{return null}}function tR(e,t){let n=nR(e[0])?1:0,r=e[n];if(!rR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Qv.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return oR(e.slice(n+1),t)}function nR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function rR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function oR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function iR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Yd(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Zd(e,t,n){let r=aR(e);return fn([...r],t,n)}function sR(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return oi(e)===oi(t);return oi(r)===oi(o)}function aR(e){let t=0;while(t<e.length){let n=e[t];if(n==="{"||n==="("||n==="$(")t++;else break}return e.slice(t)}var ma="TMPDIR",fa="IFS",Xd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Jd=/^[A-Za-z_][A-Za-z0-9_]*$/,Qd=new Set(["export","typeset","declare","readonly"]),lR=new Set(["builtin","command","time"]);function em(e,t){return{env:e,effectiveEnvAssignments:fR(e,t),shellAssignments:new Map}}function tm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function pa(e,t){let n=rm(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),ga(t,s)});let r=n.commandIndex;if(r!==-1&&Qd.has(e[r]??""))e.filter((s)=>Jd.test(s)&&da(s)).forEach((s)=>{pR(t,s)});let o=r===-1?-1:om(e,r);if(o===-1||e[o]!=="unset")return;let i=hR(e,o);if(i===null)return;e.slice(i).forEach((s)=>{gR(t,s)})}function nm(e,t){let n=rm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function rm(e,t){let n=e.findIndex((s)=>!cR(s)),r=n!==-1&&Qd.has(e[om(e,n)]??""),o=mR(t);return{assignments:e.flatMap((s,a)=>{let l=uR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Fi(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function om(e,t){let n=t;while(lR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function cR(e){return _e(e)!==null||Xd.test(e)}function uR(e,t,n){return _e(e)??dR(e,t,n)}function dR(e,t,n){let r=$r(e,n,t);if(r)return r;let o=e.match(Xd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function da(e){return e===ma||e===fa||Gi(e)}function mR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function fR(e,t){let n=[...Gr,ma,fa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ga(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function pR(e,t){ga(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function gR(e,t){if(!da(t)&&!Jd.test(t))return;if(e.shellAssignments.set(t,""),!da(t)||t===ma||t===fa||Wn(t)){ga(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function hR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var yR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Yt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.",CR=64;function Sa(e,t,n,r){let o=n.derivedCommandWorkBudget===void 0,i=n.parallelBudget===void 0;try{return bR(e,t,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget??Zr(),parallelBudget:n.parallelBudget??Kl()},r)}catch(s){let a=s instanceof he&&o?Fl:s instanceof co&&i?ql:void 0;if(!a)throw s;if(n.trace?.currentSegmentIndex!==void 0)n.trace.recordSegment({type:"error",message:a});else n.trace?.recordGlobal({type:"error",message:a});return{reason:a,segment:e,intent:"stop_and_explain"}}}function bR(e,t,n,r){if(t>=eo)return n.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Fe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return ba(e,n);let u=`Unsupported heredoc syntax: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return um(e,n),{reason:St,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return um(e,n),{reason:St,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote"))&&!n.analyzePartialProgram)return ba(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=em(n.environment.env,n.envAssignments);return ci(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ci(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,f=SR(e,l,c,a,m),d=a==="&&"||a==="||",p=d?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],h=a==="&&"?p?.failure??[]:[],R=d||En(m);if(c.kind==="function"){let E=g.flatMap((O)=>{let M=yr(O);return M.functionDefinitions.set(c.name,c.body),ha(O,[M],f,m==="&",En(m))}),T=ya(E,[],y,h,a,m);i=T.states,s=T.conditionalStates,a=void 0;continue}if(c.kind==="group"){let E=[],T=[];for(let M of g){let F=ci(c.body,t,n,r,[yr(M)]);if(F.result)return F;if(E.push(...ha(M,F.states,f,m==="&",En(m))),R)T.push(M,...f?F.states.map((oe)=>ai(M,oe)):F.states)}let O=ya(E,T,y,h,a,m);i=O.states,s=O.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let x=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),A=e.nodes[l-2],P=ui(a)&&A?.kind==="command"?nd(A)??RR(A):void 0,S=[],C=[];for(let E of g){let T=xR(c,t,n,r,[yr(E)]);if(T.result)return{result:T.result,states:i};let O=e.dialect==="powershell"?T.states:T.states.map((M)=>ai(E,M));for(let M of O){let F=yr(M),oe=PR(c,t,n.trace?{...n,trace:dm(n.trace,x)}:n,r,F,ui(a),P);if(oe)return{result:oe,states:i};let Ee=GR(c,F.functionDefinitions);if(Ee)Le(n.derivedCommandWorkBudget,di(Ee));let w=Ee?t+1>=eo?Ca(c.displayText,n,[F]):ci(Ee,t+1,n,r,[F]):{result:null,states:[F]};if(w.result)return w;if(S.push(...ha(E,w.states,f,m==="&",En(m))),R)C.push(E),C.push(...w.states.map((N)=>f?ai(E,N):N))}}let _=ya(S,C,y,h,a,m);i=_.states,s=_.conditionalStates,a=void 0}return{result:null,states:i}}function SR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ui(r)||ui(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&vR(e,t)}function ha(e,t,n,r,o){let i=n?t.map((a)=>ai(e,a)):[...t],s=o?i.flatMap((a)=>Cr(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ai(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function vR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(ER(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ui(e){return e==="|"||e==="|&"}function RR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function ya(e,t,n,r,o,i){let s={success:li([...n,...e]),failure:li([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?li([...s.success,...s.failure]):s.success,conditionalStates:a}}function dm(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function xR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=wR(e);if(s){if(t+1>=eo)return Ca(s,n,o);let a=Fe(s,"powershell");if(a.status==="limited")return Ca(s,n,o);if(a.status!=="complete")return im(i,n,r,o);Le(n.derivedCommandWorkBudget,di(a)),i.push({program:a,depth:t+1})}}return im(i,n,r,o)}function ER(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function im(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ci(i.program,i.depth,t,n,[yr(a)]);if(l.result)return l;s.push(...l.states)}o=li(s)}return{result:null,states:o}}function wR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Ca(e,t,n){return t.trace?.recordSegment({type:"error",message:lt}),{result:{reason:lt,segment:e,intent:"stop_and_explain"},states:[...n]}}function PR(e,t,n,r,o,i,s){let a=MR(e);if(a&&n.strict)return n.trace?.recordSegment({type:"error",message:a}),{reason:a,segment:e.source,intent:"stop_and_explain"};mm(e,o,"before-consumer",n.environment.paths);let l=rn(e.dialect,e.words).map(I),c=e.displayText,u=nm(l,o.shellGitContextState);if(e.dialect==="powershell"){let d=k(Ru(e,i,$R(n,o.effectiveCwd)),n.policy);if(n.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!d,reason:d?.reason}),d)return zR(c,d)}if(l.length===1&&l[0]?.includes(" ")&&!Yn(e.dialect,e.words)){let d=k(mt(l[0],n.scanWork),n.policy),p=d!==null&&!n.strict&&Ll(e,n.rootProgram,n.scanWork);if(d&&!p)return n.trace?.recordSegment({type:"dangerous-text",token:l[0],matched:!0,reason:d.reason}),{reason:d.reason,segment:c,ruleId:d.id,intent:d.intent};n.trace?.recordSegment({type:"dangerous-text",token:l[0],matched:!1});let g=sm(e,a,o,u,s,n);if(g)return g;return pa(l,o.shellGitContextState),null}let m=hr(e.words,t,{...n,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(d,p)=>{let g=p&&Object.hasOwn(p,"effectiveCwd")?p.effectiveCwd:o.effectiveCwd,y=Sa(d,t+1,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget,effectiveCwd:g,envAssignments:p?.envAssignments??u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:p?.functionDefinitions,worktreeMode:p?.worktreeMode??n.worktreeMode,trace:n.trace?dm(n.trace,n.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(m)return{...m,segment:c};let f=sm(e,a,o,u,s,n);if(f)return f;return pa(l,o.shellGitContextState),null}function sm(e,t,n,r,o,i){let s=DR(e,t,n,r??new Map,i);if(s)return s;return mm(e,n,"after-consumer",i.environment.paths),n.literalHeredocFiles.clear(),kR(e,t,n,i.environment.paths),WR(e,n,o,i.environment,i.trace),null}var _R=new Set([">>","<>"]);function mm(e,t,n,r){for(let i of e.redirections){if(!(n==="before-consumer"?AR(i):_R.has(i.operator)))continue;am(i.target,t,r)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let o=fm(e.words.slice(1));if(!o)return;for(let i of o.operands)am(i,t,r)}function AR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function am(e,t,n){let r=e?.provenance==="literal"?Hn(e.text,t.effectiveCwd,n):void 0;if(!r)return;t.literalHeredocFiles.delete(r)}function kR(e,t,n,r){if(t)return;let o=e.redirections.find((i)=>i.operator==="<<"||i.operator==="<<-")?.heredoc;if(!o||!mi(o))return;for(let i of TR(e)){let s=Hn(i.text,n.effectiveCwd,r);if(!s||!Bl(s))continue;if(!n.literalHeredocFiles.has(s)&&n.literalHeredocFiles.size>=$l)throw new he;n.literalHeredocFiles.set(s,o.body)}}function TR(e){let t=OR(e.redirections)?.target,n=lm(t)?[t]:[];if(xe(e.words[0],"cat"))return IR(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=fm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(lm))return[];return[...r.operands,...n]}function IR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function OR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function fm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function lm(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function mi(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function MR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Yt;let n=t[0];if(!n?.heredoc)return Yt;if(!mi(n.heredoc))return yR;if(n.fd!==void 0&&n.fd!==0)return Yt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Yt;let r=e.redirections.some((s)=>s!==n&&cm(s.target));if(xe(e.words[0],"cat"))return r?Yt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(cm)?Yt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return Yt}function cm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function DR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(NR(e,i,n,r,o))return null;let a=LR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=ba(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function LR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!mi(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!ye(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=k(b("interpreter.one-liner-paranoid",un),n.policy);if(c)return c}if(!dn(s,n.scanWork))return null;let l=k(b("interpreter.dangerous-command",Lt),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function NR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!mi(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Nt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(I),l=z(a[0]??"");if((s.envSplitValues?.length??0)>0||!ee.has(l)&&!ee.has(D(l)))return!1;return ke(a)}function WR(e,t,n,r,o){let i=Kd(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(I).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function yr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:tm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function li(e){let t=[];for(let n of e){if(!t.some((r)=>FR(r,n)))t.push(n);if(t.length>CR)throw new he}return t}function FR(e,t){return e.effectiveCwd===t.effectiveCwd&&Cr(e.literalHeredocFiles,t.literalHeredocFiles)&&Cr(e.functionDefinitions,t.functionDefinitions)&&Cr(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Cr(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Cr(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function GR(e,t){let n=Ao(e);return n===void 0?void 0:t.get(n)}function zR(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function $R(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy}}function ba(e,t){let n=k(mt(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function um(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:St};if(t.trace?.currentSegmentIndex===void 0)t.trace?.recordGlobal(n);else t.trace.recordSegment(n)}var ie={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},fi=["standard","strict","paranoid"];function BR(e){return{failClosed:e==="strict"||e==="paranoid",paranoidRm:e==="paranoid",paranoidInterpreters:e==="paranoid"}}function UR(e,t){if(!t)return e;return fi.indexOf(t)>fi.indexOf(e)?t:e}function HR(){let e=Ra(ie.level);if(e===void 0||e==="")return;if(fi.includes(e))return e;console.error(`CC Safety Net: ignored invalid ${ie.level.name}=${JSON.stringify(e.slice(0,40))}. Use ${fi.join(", ")}.`);return}function jR(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function XI(){return jR(Ra(ie.auditScope))==="all"}function va(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function pi(e={}){let t=e.safety?.level??"standard",n=HR(),r=UR(t,n),o=BR(r),i={failClosed:r===t?"preset":"environment",paranoidRm:r===t?"preset":"environment",paranoidInterpreters:r===t?"preset":"environment"},s={failClosed:[`policy safety.level=${t}`],paranoidRm:[`policy safety.level=${t}`],paranoidInterpreters:[`policy safety.level=${t}`]};if(r!==t)s.failClosed.push(`env ${ie.level.name}=${n}`),s.paranoidRm.push(`env ${ie.level.name}=${n}`),s.paranoidInterpreters.push(`env ${ie.level.name}=${n}`);if(e.safety?.overrides?.failClosed!==void 0)o.failClosed=e.safety.overrides.failClosed,i.failClosed="capability_override",s.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)o.paranoidRm=e.safety.overrides.paranoidRm,i.paranoidRm="capability_override",s.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)o.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,i.paranoidInterpreters="capability_override",s.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(br(ie.strict))o.failClosed=!0,i.failClosed="environment",s.failClosed.push(`env ${ie.strict.name}`);if(br(ie.paranoid))o.paranoidRm=!0,o.paranoidInterpreters=!0,i.paranoidRm="environment",i.paranoidInterpreters="environment",s.paranoidRm.push(`env ${ie.paranoid.name}`),s.paranoidInterpreters.push(`env ${ie.paranoid.name}`);if(br(ie.paranoidRm))o.paranoidRm=!0,i.paranoidRm="environment",s.paranoidRm.push(`env ${ie.paranoidRm.name}`);if(br(ie.paranoidInterpreters))o.paranoidInterpreters=!0,i.paranoidInterpreters="environment",s.paranoidInterpreters.push(`env ${ie.paranoidInterpreters.name}`);let a=!!e.worktreeMode||br(ie.worktree);return{strict:o.failClosed,paranoidRm:o.paranoidRm,paranoidInterpreters:o.paranoidInterpreters,worktreeMode:a,effectiveLevel:va(o),capabilities:{fail_closed:{enabled:o.failClosed,source:i.failClosed,sources:s.failClosed},paranoid_rm:{enabled:o.paranoidRm,source:i.paranoidRm,sources:s.paranoidRm},paranoid_interpreters:{enabled:o.paranoidInterpreters,source:i.paranoidInterpreters,sources:s.paranoidInterpreters}}}}function br(e){let t=typeof e==="string"?Sr(e):Ra(e);return t==="1"||t?.toLowerCase()==="true"}function Sr(e){return Object.hasOwn(process.env,e)?process.env[e]:void 0}function Ra(e){let t=Sr(e.name);if(t!==void 0)return t;if(e.legacyName)return Sr(e.legacyName);return}function JI(e){return Sr(e.name)!==void 0||!!e.legacyName&&Sr(e.legacyName)!==void 0}function pm(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:xa(t.fail_closed,e.strict,"strict"),paranoid_rm:xa(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:xa(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Ml(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:va({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function xa(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function iO(e,t){return Ea(e,t)}function Ea(e,t,n,r){let o=Sa(e,0,{...t,...pm(t),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}import{basename as Yx,dirname as Va}from"node:path";import{chmodSync as Gx,existsSync as Ha,mkdirSync as zx,readFileSync as ja}from"node:fs";import{dirname as mf,join as $x}from"node:path";import{createRequire as ex}from"node:module";var gm=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var hm=30,wa=1,Pa=365;function ym(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var vr=64,bm="Rule config exceeds CC Safety Net's safe source limit.";var Cm=Object.freeze({maxSources:64,concurrency:4,maxRequests:131,maxResponseBytes:67108864});function gi(e={}){return{requests:0,responseBytes:0,maxRequests:e.maxRequests??Cm.maxRequests,maxResponseBytes:e.maxResponseBytes??Cm.maxResponseBytes}}function hi(e){return{controller:new AbortController,budget:gi(),resolveUrl:e}}function Sm(e){if(e.requests>=e.maxRequests)throw Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");e.requests++}function vm(e,t){if(t>e.maxResponseBytes-e.responseBytes)throw e.responseBytes+=t,Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");e.responseBytes+=t}var Ie=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,yi="rulebook.json",Ci=".cc-safety-net/rules";var Rm=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,VR=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,qR=/^[A-Za-z0-9._-]+$/,KR=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),YR="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),_a=new RegExp(`^${KR}/(${Ie.source.slice(1,-1)})/${YR}$`);function xm(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Rr(e){if(Pn(e))try{return wn(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Ie.test(e)?null:`Local rulebook sources must be bare names matching ${Ie}: ${e}`}function wn(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Rm);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let[n,r,...o]=t[3].split("/");if(!n||!qR.test(n))throw Error(`GitHub rulebook refs must be a single path segment: ${e}`);if(!r||o.length>0||!Ie.test(r))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:n,path:xm(r),name:r}}function Em(e){return VR.test(e)}function Pn(e){return Rm.test(e)}function Aa(e){if(!Ie.test(e))throw Error(`Local rulebook sources must be bare names matching ${Ie}: ${e}`)}var ka=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],bi={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},ZR=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],XR=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ta=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...XR.flatMap((e)=>ZR.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Si=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],wm=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],JR=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Ia=wm.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Oa=wm.flatMap((e)=>JR.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),xr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Ma=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),Da=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Pm=[...ka,bi,...Ta,...Ia,...Oa,xr,...Ma,...Da,...Si].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),_m=new Set(Si.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),QR=Pm.map((e)=>e.id),vi=new Set(QR);var tx=ex(import.meta.url),Am,nx=Array(vr+1).fill("over-limit"),km=/^[^/]+\/[^/]+$/,rx=/^sha256:[a-f0-9]{64}$/,Ri=`must be an integer between ${wa} and ${Pa}`,ox=["version","rules","overrides","transparent_wrappers"],ix=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Tm(e){if(!Oe(e)||!Array.isArray(e.rules)||e.rules.length<=vr)return e;return{$schema:e.$schema,version:e.version,rules:nx,overrides:e.overrides,transparent_wrappers:e.transparent_wrappers}}function sx(){let e=tx("../vendor/zod.cjs"),t=(S)=>{let C=e.superRefine(S);return C._zod.def.when=()=>!0,C},n=e.enum(gm),r=e.union([e.literal("off"),e.looseObject({reason:e.string({error:"required non-empty string"}).min(1,"required non-empty string").max(cn,`must be at most ${cn} characters`).describe("Replacement block reason"),intent:n.optional()})],{error:'must be "off" or an object'}).describe("Disable a rule or replace its block reason and intent."),o=e.string({error:"must be a rulebook source string"}).min(1,"must be a non-empty rulebook source string"),i=e.string({error:"must be a command string"}).regex(Dt,"must match command pattern").describe("Command name such as 'git', 'docker', or 'rtk'."),s=e.looseObject({$schema:e.unknown().optional().describe("JSON Schema reference for IDE support"),version:e.literal(1).describe("Schema version (must be 1)"),rules:e.array(o,{error:"must be an array of rulebook source strings"}).max(vr,bm).default([]).describe("Rulebook source strings such as project-rules or owner/repo#main/team-rules"),overrides:e.record(e.string().meta({pattern:km.source}),r).default({}).describe("Rule overrides by id"),transparent_wrappers:e.array(i,{error:"must be an array of command strings"}).default([]).describe("Commands that transparently execute a visible protected child command")}),a=(S,C)=>{if(!Oe(S))return;if(Array.isArray(S.rules)&&S.rules.length<=vr){let E=new Set;S.rules.forEach((T,O)=>{if(typeof T!=="string"||T==="")return;if(T.trim()===""){C.addIssue({code:"custom",message:"must be a non-empty rulebook source string",path:["rules",O]});return}let M=Rr(T);if(M){C.addIssue({code:"custom",message:M,path:["rules",O]});return}if(E.has(T)){C.addIssue({code:"custom",message:`duplicate rulebook source "${T}"`,path:["rules",O]});return}E.add(T)})}if(Oe(S.overrides))for(let E of Object.keys(S.overrides)){if(km.test(E))continue;C.addIssue({code:"custom",message:"must use <rulebook-name>/<rule-name>",path:["overrides",E]})}if(!Array.isArray(S.transparent_wrappers))return;let _=new Set;S.transparent_wrappers.forEach((E,T)=>{if(typeof E!=="string"||!Dt.test(E))return;if(_.has(E)){C.addIssue({code:"custom",message:`duplicate command "${E}"`,path:["transparent_wrappers",T]});return}if(ku(E)){C.addIssue({code:"custom",message:`reserved command "${E}" cannot be a wrapper`,path:["transparent_wrappers",T]});return}_.add(E)})},l=e.preprocess(Tm,s.check(e.superRefine(a))),c=e.preprocess(Tm,s.check(t(a))),u=e.strictObject({fail_closed:e.boolean().optional(),paranoid_rm:e.boolean().optional(),paranoid_interpreters:e.boolean().optional()}),m=(S,C)=>e.intersection(e.record(e.string().refine((_)=>S.has(_),{error:(_)=>`unknown ${C} rule id "${String(_.input)}"`}),e.unknown()),e.record(e.string(),e.enum(["on","off"]))),f=(S)=>e.array(e.string({error:"must be a non-empty path string"}),{error:"must be an array of paths"}).check(t((C,_)=>{if(!Array.isArray(C))return;let E=It();C.forEach((T,O)=>{if(typeof T!=="string")return;let M=S(T,E);if(M)_.addIssue({code:"custom",message:M,path:[O]})})})),d=e.strictObject({version:e.literal(1),safety:e.strictObject({level:e.enum(["standard","strict","paranoid"]).optional(),overrides:u.optional()}).optional(),workflow:e.strictObject({worktree_mode:e.boolean().optional()}).optional(),destructive_command_protection:e.strictObject({enabled:e.boolean().optional(),overrides:m(Kr,"destructive command").optional(),allow_paths:f(zo).optional()}).optional(),secret_protection:e.strictObject({enabled:e.boolean().optional(),overrides:m(vi,"secret protection").optional(),deny_paths:f($o).optional(),allow_paths:f(Bo).optional()}).optional(),audit:e.strictObject({retention_days:e.number({error:Ri}).int(Ri).min(wa,Ri).max(Pa,Ri).optional().describe("Days of audit log history to keep before the sweep deletes it")}).optional()}),p=(S)=>{let C=(O,M)=>S==="legacy"?O:M,_=C("must match pattern (letters, numbers, hyphens, underscores)","must match command pattern"),E=`required non-empty string up to ${cn} characters`,T=e.looseObject({name:e.string({error:"required string"}).regex(Ie,C("must match pattern (letters, numbers, hyphens, underscores; max 64 chars)","must match rule name pattern")),command:e.string({error:C("required string","required string matching command pattern")}).regex(Dt,C(_,"required string matching command pattern")),subcommand:e.string({error:C("must be a string if provided","must match command pattern")}).regex(Dt,_).optional(),block_args:e.array(e.string({error:C("must be a string","must be a non-empty string")}).refine((O)=>O!=="",{error:C("must not be empty","must be a non-empty string")}),{error:C("required array","required non-empty array")}).refine((O)=>O.length>0,{error:C("must have at least one element","required non-empty array")}),reason:e.string({error:C("required string",E)}).refine((O)=>O!=="",{error:C("must not be empty",E)}).refine((O)=>O.length<=cn,{error:C(`must be at most ${cn} characters`,E)}),intent:n.optional()},{error:"must be an object"});return e.array(T,{error:C("must be an array","required array")}).check(t((O,M)=>{if(!Array.isArray(O))return;let F=new Set;O.forEach((oe,Ee)=>{let w=Oe(oe)?oe.name:void 0;if(typeof w!=="string")return;if(F.has(w.toLowerCase())){M.addIssue({code:"custom",message:`duplicate rule name "${w}"`,path:[Ee,"name"]});return}F.add(w.toLowerCase())})}))},g=e.looseObject({version:e.literal(1),rules:p("legacy").optional()}),y="required string matching rule name pattern",h=e.looseObject({command:e.string({error:"required non-empty string"}).refine((S)=>S.trim()!=="",{error:"required non-empty string"}),expect:e.enum(["blocked","allowed"]),rule:e.string({error:"must be a string if provided"}).optional()},{error:"must be an object"}).check(t((S,C)=>{if(!Oe(S))return;if(S.expect!=="blocked"||typeof S.rule==="string")return;C.addIssue({code:"custom",message:"required string for blocked fixtures",path:["rule"]})})),R=e.looseObject({name:e.string({error:"required string matching rule name pattern"}).regex(Ie,"required string matching rule name pattern"),version:e.string({error:"required non-empty string"}).refine((S)=>S!=="",{error:"required non-empty string"}),allowed_commands:e.array(e.string({error:"must match command pattern"}).regex(Dt,"must match command pattern"),{error:"required array"}).check(t((S,C)=>{if(!Array.isArray(S))return;let _=new Set;S.forEach((E,T)=>{if(typeof E!=="string"||!Dt.test(E))return;if(_.has(E)){C.addIssue({code:"custom",message:`duplicate command "${E}"`,path:[T]});return}_.add(E)})})),rules:p("rulebook"),tests:e.array(h,{error:"must be an array if provided"}).optional()}).check(t((S,C)=>{if(!Oe(S))return;let _=new Set(La(S));if(Array.isArray(S.tests)){let T=new Set(S.tests.flatMap((O)=>Oe(O)&&O.expect==="blocked"&&typeof O.rule==="string"?[O.rule]:[]));for(let O of T){if(_.has(O))continue;C.addIssue({code:"custom",message:`blocked fixture references unknown rule "${O}"`,path:["tests"]})}}if(!Array.isArray(S.allowed_commands)||!Array.isArray(S.rules))return;let E=new Set(S.allowed_commands.filter((T)=>typeof T==="string"));S.rules.forEach((T,O)=>{let M=Oe(T)?T.command:void 0;if(typeof M!=="string"||E.has(M))return;C.addIssue({code:"custom",message:`"${M}" must be listed in allowed_commands`,path:["rules",O,"command"]})})})),x=e.string({error:"required string"}).refine((S)=>S.trim()!=="",{error:"required string"}),A=e.looseObject({spec:x,name:x,version:x,digest:e.string({error:"required sha256 digest"}).regex(rx,"required sha256 digest")},{error:"must be an object"}),P=e.looseObject({rulebooks:e.array(e.intersection(A,e.discriminatedUnion("kind",[e.object({kind:e.literal("local-directory"),path:x}),e.object({kind:e.literal("github"),owner:x,repo:x,ref:x,commit:x,path:x,display_ref:e.unknown().optional()})],{error:(S)=>{if(!Oe(S.input))return"must be an object";let C=S.input.kind;return typeof C==="string"?`unknown kind "${C}"`:"required string"}})))});return{RulesConfigSchema:l,RulesConfigDiagnosticSchema:c,RuleOverrideSchema:r,UserPolicySchema:d,LegacyConfigSchema:g,RulebookSchema:R,RulesLockfileSchema:P}}function _n(){return Am??=sx(),Am}function Im(){return _n().RulesConfigSchema}function ax(){return _n().UserPolicySchema}function xO(){return _n().LegacyConfigSchema}function Om(){return _n().RulebookSchema}function Mm(){return _n().RulesLockfileSchema}function La(e){let t=Oe(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Oe(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Dm(e){let t=_n().RulesConfigDiagnosticSchema.safeParse(e);if(t.success)return{errors:[],sources:new Set(t.data.rules)};return{errors:An(Nm(t.error.issues,ox)),sources:dx(e,t.error.issues)}}function Er(e){let t=ax().safeParse(e);if(t.success)return[];return An(Nm(t.error.issues,ix)," ")}function An(e,t=": ",n=" "){return[...new Set(e.flatMap((r)=>Lm(r,t,n,[])))]}function Lm(e,t,n,r){let o=[...r,...e.path],i=ux(o);if(e.code==="unrecognized_keys")return e.keys.map((s)=>`${i?`${i}.`:""}unknown field "${s}"`);if(e.code==="invalid_key")return e.issues.map((s)=>s.message);if(e.code==="invalid_union"){let s=e.errors.flat().filter((a)=>a.path.length>0);if(s.length>0)return s.flatMap((a)=>Lm(a,t,n,o))}if(o.length===0)return[e.code==="invalid_type"?"Config must be an object":e.message];if(o.length===1&&(e.code==="too_big"||e.code==="too_small")&&e.origin==="array")return[e.message];return[`${i}${o.length===1?n:t}${lx(e)}`]}function lx(e){if(e.code==="invalid_value")return`must be ${cx(e.values)}`;if(e.code!=="invalid_type"||!e.message.startsWith("Invalid input:"))return e.message;if(e.expected==="object"||e.expected==="record")return"must be an object if provided";return e.expected==="boolean"?"must be a boolean":e.message}function cx(e){if(e.length>3)return`one of ${e.join(", ")}`;let t=e.map((n)=>typeof n==="string"?`"${n}"`:String(n));if(t.length<2)return`${t[0]}`;return`${t.slice(0,-1).join(", ")}${t.length>2?",":""} or ${t.at(-1)}`}function ux(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Nm(e,t){let n=e.map((i)=>i.path[1]),r=[...new Set(n.filter((i)=>typeof i==="string"))],o=(i,s)=>[i.path.length===0?-1:t.indexOf(String(i.path[0])),typeof s==="number"?s:r.indexOf(String(s)),i.code==="custom"?0:1];return e.map((i,s)=>({issue:i,rank:o(i,n[s])})).sort((i,s)=>i.rank[0]-s.rank[0]||i.rank[1]-s.rank[1]||i.rank[2]-s.rank[2]).map((i)=>i.issue)}function dx(e,t){let n=Oe(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Oe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}import{randomBytes as mx}from"node:crypto";import{closeSync as Fa,constants as wr,fstatSync as Na,fsyncSync as fx,lstatSync as kt,mkdirSync as Wm,openSync as Fm,readdirSync as Ga,readFileSync as px,realpathSync as Zt,renameSync as gx,rmdirSync as Gm,statSync as Wa,unlinkSync as za,writeFileSync as hx}from"node:fs";import{isAbsolute as zm,join as kn,normalize as yx,parse as $m,relative as $a,resolve as Ba,sep as _r}from"node:path";var Cx=Symbol("PolicyFilesystemScope"),bx=Symbol("PolicyFilesystemTarget"),Bm=wr.O_NOFOLLOW??0;class L extends Error{constructor(e){super(`Unable to access ${e} filesystem safely.`);this.name="PolicyFilesystemError"}}function Me(e,t){return{[Cx]:!0,root:Ba(e),label:t}}function Ar(e,t){let n=yx(t);if(t===""||zm(t)||n===".."||n.startsWith(`..${_r}`))throw new L(e.label);return{[bx]:!0,scope:e,relativePath:n,path:kn(e.root,n)}}function se(e,t){let n=$a(e.root,Ba(t));return Ar(e,n)}function xi(e,t="rules policy"){let n=Ba(e),r=$m(n).dir;return Ar(Me(r,t),$a(r,n))}function gt(e){try{if(!re(e,!1).exists)return null;let n=Fm(e.path,wr.O_RDONLY|Bm);try{let r=Na(n);if(!r.isFile())throw new L(e.scope.label);let o=px(n,"utf-8"),i=kt(e.path);if(!i.isFile()||i.isSymbolicLink()||r.dev!==i.dev||r.ino!==i.ino)throw new L(e.scope.label);return re(e,!1),o}finally{Fa(n)}}catch(t){ht(e.scope.label,t)}}function Um(e,t,n=384,r){let o=`${e.path}.${mx(8).toString("hex")}.tmp`,i=null;try{Rx(e),re(e,!0),i=Fm(o,wr.O_CREAT|wr.O_EXCL|wr.O_WRONLY|Bm,n);let s=Na(i);if(!s.isFile())throw new L(e.scope.label);hx(i,t,"utf-8"),fx(i);let a=Na(i);if(!a.isFile()||a.dev!==s.dev||a.ino!==s.ino)throw new L(e.scope.label);Fa(i),i=null,re(e,!0),Ex(e,o,a.dev,a.ino),gx(o,e.path),r?.(e.path),re(e,!1)}catch(s){if(i!==null)Px(i);_x(o),ht(e.scope.label,s)}}function Hm(e,t){if(e.path===t.path)return!0;try{if(!re(e,!1).exists||!re(t,!1).exists)return!1;return Zt(e.path)===Zt(t.path)}catch(n){if(n instanceof L)throw n;throw new L(e.scope.label)}}function Sx(e){try{if(!re(e,!1,"directory").exists)return null;let n=Ga(e.path);return re(e,!1,"directory"),n}catch(t){ht(e.scope.label,t)}}function AO(e){let t=Sx(e);if(!t)return null;try{let n=t.map((r)=>{let o=Ar(e.scope,kn(e.relativePath,r)),i=kt(o.path);if(i.isSymbolicLink()||!i.isFile()&&!i.isDirectory())throw new L(e.scope.label);return Ei(Km(e.scope),Zt(o.path),e.scope.label),{name:r,kind:i.isDirectory()?"directory":"file"}});return re(e,!1,"directory"),n}catch(n){ht(e.scope.label,n)}}function kO(e){try{if(!re(e,!0).exists)return;za(e.path),re(e,!0)}catch(t){ht(e.scope.label,t)}}function TO(e){try{qm(e,e.relativePath.split(_r))}catch(t){ht(e.scope.label,t)}}function IO(e){try{if(!vx(e))return;Vm(e),re(e,!0,"directory")}catch(t){ht(e.scope.label,t)}}function OO(e){try{if(!re(e,!0,"directory").exists)return;Gm(e.path),re(e,!0,"directory")}catch(t){ht(e.scope.label,t)}}function vx(e){try{if(!re(e,!0,"directory").exists)return!1;return jm(e),!0}catch(t){ht(e.scope.label,t)}}function re(e,t,n="file"){let r=Ua(e.scope);if(!r)return{exists:!1};let o=e.relativePath.split(_r);for(let i of o.keys()){let s=kn(e.scope.root,...o.slice(0,i+1)),a=Pr(s);if(!a){if(i===o.length-1&&t)return{exists:!1};return{exists:!1}}if(a.isSymbolicLink())throw new L(e.scope.label);if(i<o.length-1&&!a.isDirectory())throw new L(e.scope.label);if(i===o.length-1&&(n==="file"?!a.isFile():!a.isDirectory()))throw new L(e.scope.label);Ei(r,Zt(s),e.scope.label)}return{exists:!0}}function jm(e){for(let t of Ga(e.path)){let n=Ar(e.scope,kn(e.relativePath,t)),r=kt(n.path);if(r.isSymbolicLink()||!r.isDirectory()&&!r.isFile())throw new L(e.scope.label);if(r.isDirectory())jm(n)}re(e,!1,"directory")}function Vm(e){for(let t of Ga(e.path)){let n=Ar(e.scope,kn(e.relativePath,t)),r=kt(n.path);if(r.isSymbolicLink())throw new L(e.scope.label);if(r.isDirectory()){Vm(n);continue}if(!r.isFile())throw new L(e.scope.label);za(n.path)}Gm(e.path)}function Rx(e){qm(e,e.relativePath.split(_r).slice(0,-1))}function qm(e,t){xx(e.scope);let n=Km(e.scope);for(let r of t.keys()){let o=kn(e.scope.root,...t.slice(0,r+1));if(!Pr(o))Wm(o,{mode:448});let s=kt(o);if(!s.isDirectory()||s.isSymbolicLink())throw new L(e.scope.label);Ei(n,Zt(o),e.scope.label)}}function xx(e){if(Pr(e.root)){if(!Wa(e.root).isDirectory())throw new L(e.label);return}let t=[],n=e.root;while(!Pr(n)){t.unshift(n);let r=$m(n).dir;if(r===n)throw new L(e.label);n=r}if(!Wa(n).isDirectory())throw new L(e.label);for(let r of t){Wm(r,{mode:448});let o=kt(r);if(!o.isDirectory()||o.isSymbolicLink())throw new L(e.label)}}function Ua(e){if(!Pr(e.root))return null;if(!Wa(e.root).isDirectory())throw new L(e.label);return Zt(e.root)}function Km(e){let t=Ua(e);if(!t)throw new L(e.label);return t}function Ex(e,t,n,r){let o=kt(t);if(!o.isFile()||o.isSymbolicLink()||o.dev!==n||o.ino!==r)throw new L(e.scope.label);let i=Ua(e.scope);if(!i)throw new L(e.scope.label);Ei(i,Zt(t),e.scope.label)}function Ei(e,t,n){let r=$a(e,t);if(r===".."||r.startsWith(`..${_r}`)||zm(r))throw new L(n)}function Pr(e){try{return kt(e)}catch(t){if(wx(t)&&t.code==="ENOENT")return null;throw t}}function ht(e,t){if(t instanceof L)throw t;throw new L(e)}function wx(e){return e instanceof Error&&"code"in e}function Px(e){try{Fa(e)}catch{}}function _x(e){try{za(e)}catch{}}var Ym={version:1,rules:[],overrides:{},transparent_wrappers:[]};function Ax(e){return Dm(e)}function Tn(e){try{let t=gt(Zm(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Ax(n);if(r.errors.length>0)return{config:null,errors:r.errors};let o=Im().parse(n);return{config:{version:1,rules:o.rules??[],overrides:o.overrides??{},transparent_wrappers:o.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof L)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function FO(e){let t=Tn(e);if(t.errors.length>0)return{ok:!1,result:{ok:!1,errors:t.errors,warnings:[],entries:[]}};return{ok:!0,config:t.config??Ym}}function GO(e,t=[]){wi(e,{version:1,rules:t,overrides:{},transparent_wrappers:[]})}function zO(e,t="project-rules"){wi(e,{rulebook_version:1,name:t,version:"1.0.0",description:t==="project-rules"?"Project-specific CC Safety Net rules.":"User-specific CC Safety Net rules.",author:t==="project-rules"?"project":"user",allowed_commands:["docker"],rules:[{name:"block-docker-system-prune",command:"docker",subcommand:"system",block_args:["prune"],reason:"Use targeted cleanup instead."}],tests:[{command:"docker system prune",expect:"blocked",rule:"block-docker-system-prune"}]})}function wi(e,t,n,r){Um(Zm(e),`${JSON.stringify(t,null,2)}
-`,n,r)}function Zm(e){return typeof e==="string"?xi(e):e}import{homedir as kx}from"node:os";import{dirname as ot,isAbsolute as Tx,join as je,relative as Ix,resolve as it,sep as Ox}from"node:path";var Jm="rule.json",Qm="policy.json",ef="rule.lock",Mx="config.json",tf=".cc-safety-net",Dx="rules",Xm="cache",Lx="CC_SAFETY_NET_HOME",Ve="`cc-safety-net rule sync`";function Nx(e){return it(e??process.cwd(),Ci)}function nf(e){return je(Nx(e),Jm)}function Jt(e){return e?.userConfigDir??(e?.userConfigPath?ot(e.userConfigPath):je(Wx(),Dx))}function Wx(){let e=process.env[Lx];return e?it(pe(e)):je(kx(),tf)}function rf(e){return je(Jt(e),Jm)}function KO(e){return je(Jt(e),ef)}function Xt(e){return je(ot(e),ef)}function YO(e={}){return je(ot(Jt(e)),Mx)}function ZO(e={}){return it(e.cwd??process.cwd(),".safety-net.json")}function of(e){let t=e.userConfigPath??rf(e),n=e.projectConfigPath??nf(e.cwd),r=sf(t,e),o=af(n,e);return{userConfigPath:t,projectConfigPath:n,userLockPath:Xt(t),projectLockPath:Xt(n),userScope:r,projectScope:o,userConfigTarget:se(r,t),projectConfigTarget:se(o,n),userLockTarget:se(r,Xt(t)),projectLockTarget:se(o,Xt(n))}}function XO(e){let t=e.global?e.userConfigPath??rf(e):e.projectConfigPath??nf(e.cwd),n=e.global?sf(t,e):af(t,e),r=Xt(t);return{configDir:ot(t),configPath:t,lockPath:r,filesystemScope:n,configTarget:se(n,t),lockTarget:se(n,r)}}function sf(e,t){let n=t.userConfigPath?ot(ot(it(t.userConfigPath))):ot(it(t.userConfigDir??Jt(t)));return Me(n,"user policy")}function af(e,t){let n=it(t.cwd??process.cwd()),r=it(e),o=Ix(n,r);if(o!==".."&&!o.startsWith(`..${Ox}`)&&!Tx(o))return Me(n,"project policy");return Me(ot(ot(r)),"project policy")}function lf(e){if(e.kind==="github"&&e.display_ref)return`${e.owner}/${e.repo}#${e.display_ref}/${e.name}`;return e.spec}function Pi(e,t){let n=e.digest.startsWith("sha256:")?e.digest.slice(7):e.digest;return je(cf(t),"rulebooks",`${Fx(e)}--${n.slice(0,12)}`,yi)}function JO(e){return je(cf(e),"rulebooks")}function _i(e,t){let n=t;return{cacheConfigDir:e,cwd:t.cwd,global:n.global}}function Fx(e){return(e.kind==="github"&&e.display_ref?`${e.owner}/${e.repo}#${e.display_ref}/${e.name}`:e.spec).toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"rulebook"}function cf(e){let t=e?.cacheConfigDir??Jt(e),n=e;if(n&&!n.global&&n.cwd&&it(t)===it(n.cwd))return je(it(n.cwd),tf,Xm);return je(ot(t),Xm)}var Bx=new Set(["standard","strict","paranoid"]),ki={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:hm}};function On(e){return $x(mf(Jt(e)),Qm)}function mM(e={}){let t=On(e);if(!Ha(t))return{path:t,exists:!1,raw:"",policy:kr(),errors:[]};let n=ja(t,"utf-8");if(!n.trim())return{path:t,exists:!0,raw:n,policy:kr(),errors:["Config file is empty"]};try{let r=JSON.parse(n),o=Er(r);return{path:t,exists:!0,raw:n,policy:In(r),errors:o}}catch(r){return{path:t,exists:!0,raw:n,policy:kr(),errors:[`Invalid JSON: ${r instanceof Error?r.message:String(r)}`]}}}function Ai(e,t={}){let n=On(t),r=Er(e),o=r.length>0?kr():In(e);if(r.length>0)return{path:n,policy:o,errors:r};return zx(mf(n),{recursive:!0,mode:448}),wi(n,o,384),Gx(n,384),{path:n,policy:o,errors:[]}}function fM(e){let t=Er(e);if(t.length>0)return{errors:t};return{preview:Ux(In(e)),errors:[]}}function Ux(e){let t=pi({safety:gf(e.safety)}),n=qi({destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides},t.capabilities),r=Object.values(n),o=r.filter((i)=>i.source!=="catastrophic");return{selectedPreset:e.safety.level,effectiveLevel:t.effectiveLevel,capabilities:t.capabilities,rules:n,counts:{enabled:o.filter((i)=>i.enabled).length,disabled:o.filter((i)=>!i.enabled).length,effectiveCustomizations:r.filter((i)=>i.changesInherited).length}}}function pM(e={}){let t=On(e);if(!Ha(t))return Ai(ki,e);let n=ja(t,"utf-8");if(!n.trim())return Ai(ki,e);try{return Ai(In(JSON.parse(n)),e)}catch{return Ai(ki,e)}}function ff(e={}){let t=qx(On(e));return{...t.policy,errors:t.errors,...t.fallback?{fallback:t.fallback}:{}}}function In(e){if(!st(e))return kr();let t=st(e.safety)?e.safety:{},n=st(t.overrides)?t.overrides:{},r=st(e.workflow)?e.workflow:{},o=st(e.destructive_command_protection)?e.destructive_command_protection:{},i=st(e.secret_protection)?e.secret_protection:{};return{version:1,safety:{level:Bx.has(t.level)?t.level:"standard",overrides:{...typeof n.fail_closed==="boolean"?{fail_closed:n.fail_closed}:{},...typeof n.paranoid_rm==="boolean"?{paranoid_rm:n.paranoid_rm}:{},...typeof n.paranoid_interpreters==="boolean"?{paranoid_interpreters:n.paranoid_interpreters}:{}}},workflow:{worktree_mode:typeof r.worktree_mode==="boolean"?r.worktree_mode:!1},destructive_command_protection:{enabled:typeof o.enabled==="boolean"?o.enabled:!0,overrides:uf(o.overrides,Kr),allow_paths:jx(o.allow_paths)},secret_protection:{enabled:typeof i.enabled==="boolean"?i.enabled:!0,overrides:uf(i.overrides,vi),deny_paths:Hx(i.deny_paths),allow_paths:Vx(i.allow_paths)},audit:{retention_days:ym(st(e.audit)?e.audit.retention_days:void 0)}}}function uf(e,t){if(!st(e))return{};return Object.fromEntries(Object.entries(e).flatMap(([n,r])=>t.has(n)&&(r==="on"||r==="off")?[[n,r]]:[]))}function Hx(e){if(!Array.isArray(e))return[];let t=It();return e.filter((n)=>$o(n,t)===null)}function jx(e){if(!Array.isArray(e))return[];let t=It();return e.filter((n)=>zo(n,t)===null)}function Vx(e){if(!Array.isArray(e))return[];let t=It();return e.filter((n)=>Bo(n,t)===null)}function st(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function kr(){return structuredClone(ki)}function qx(e){let t=Kx();if(!Ha(e)){let n=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!st(n))return{policy:t,errors:[]};return{policy:df(In(n)),errors:[]}}try{let n=ja(e,"utf-8");if(!n.trim())return{policy:t,errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Er(r),i=df(In(r));if(o.length>0)return{policy:i,errors:o.map((s)=>`${e}: ${s}`),fallback:st(r)?"salvaged":"defaults"};return{policy:i,errors:[]}}catch(n){let r=n instanceof Error?n.message:String(n);return{policy:t,errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}function pf(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[..._m].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Kx(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:pf({}),denyPaths:[],allowPaths:[]}}}function df(e){return{safety:gf(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:pf(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function gf(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}var bf="This path contains the protected policy config and you must not modify or delete it.",Zx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Sf(e){let t=Mt(ct()),n=nE(e.invocation.context.executionCwd,t);if(e.invocation.route.kind==="patch")return hf(e.paths,!1,e.invocation.context.executionCwd,n,t);let r=be(e,"input-candidate");if(e.invocation.route.kind==="command")return r?yf(r.shell,e.invocation.context.executionCwd,n,t):null;if(e.invocation.route.kind==="unknown"&&r){let o=yf(r.shell,e.invocation.context.executionCwd,n,t);if(o)return o}return hf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Oo(e.invocation.toolName),e.invocation.context.executionCwd,n,t)}function hf(e,t,n,r,o){if(t)return null;let i=e.find((s)=>Tr(s,n,r,o));return i?{target:i}:null}function yf(e,t,n,r){let o=Lo(e,t,r,{findSegmentTarget:(i,s)=>Xx(i,s,n,r)?.target??null,isRedirectionTarget:(i,s)=>Tr(i,s.cwd,n,r),findMalformedTarget:(i)=>tE(i,t,n,r)?.target??null,normalizeCwd:le});return o?{target:o}:null}function Xx(e,t,n,r){if(tr(e))return null;let o=r.environment,i=vt([...e],o),s=D(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&Jx(a)){let l=Qx(a).find((c)=>Cf(Se(c,t.variables),t.cwd,n,r));if(l)return{target:l}}if(s==="find"){if(Zo(i,1)||Ws(i,o)){let c=(Yo(G(i))??G(["."])).find((u)=>{let m=Se(u.text,t.variables);return Tr(m,t.cwd,n,r)||Cf(m,t.cwd,n,r)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=No(a).sources.find((c)=>rE(Se(c,t.variables),t.cwd,n,r));if(l)return{target:l}}if(eE(e,o))return null;for(let l of[...e,...i])for(let c of vf(l))if(Tr(Se(c,t.variables),t.cwd,n,r))return{target:c};return null}function Jx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Qx(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function eE(e,t){let n=vt([...e],t);if(n.length===0)return!1;let r=D(n[0]??"").toLowerCase();if(!Zx.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function tE(e,t,n,r){for(let o of e.split(/\s+/))for(let i of vf(o))if(Tr(i,t,n,r))return{target:i};return null}function vf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function nE(e,t){let n=le(On(),e,t),r=Va(n),o=new Set;for(let i=r;;i=Va(i))if(o.add(Mn(i)),Va(i)===i)break;return{file:Mn(n),directoryAndAncestors:o}}function Tr(e,t,n,r){let o=ru(e,t,r,(i)=>Mn(i)===Yx(n.file));return o!==null&&Mn(o)===n.file}function Cf(e,t,n,r){return n.directoryAndAncestors.has(Mn(le(e,t,r)))}function rE(e,t,n,r){let o=Mn(le(e,t,r));return o===n.file||n.directoryAndAncestors.has(o)}function Mn(e){return process.platform==="win32"?e.toLowerCase():e}import{homedir as Ka}from"node:os";import{isAbsolute as Ti,posix as oE,resolve as Oi,win32 as iE}from"node:path";import{fileURLToPath as sE}from"node:url";var Of="Access to a sensitive path is not allowed.",Mf=new Set(["echo","printf"]),aE=new Set(["find"]),lE=new Set(["-exec","-execdir"]),cE=new Set([";","+"]),uE=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),dE=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),mE=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),fE=new Set(["node","bun"]),pE=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),gE=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","popen","read","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Df=new Set(["-c","-e","-r","-E","--eval","--exec"]),hE=new Set(["src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js"]),Rf=new Set(["cc-safety-net","ccsn"]),yE=new Set(["bunx","npx","pnpx"]),CE=new Set(["bun","node"]),bE=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),SE=new Set(["grep","rg"]),xf="f",Ef="file",vE="files",RE=new Set(["e","f"]),xE=new Set(["regexp","file"]),EE=new Set(["e","f","A","B","C","m"]),wE=new Set(["regexp","file","after-context","before-context","context","max-count"]),PE=new Set(["|","|&"]),qa="__CC_SAFETY_NET_PIPE_INPUT__",Lf=new Set(["bash","sh","zsh","dash","ksh"]),_E=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function wf(e,t,n,r,o){let i=Jr();for(let s of e){if(pw(s,t,n?.denyPaths??[],r,i))return{target:s,ruleId:"secret.deny-path"};if(o&&!o.has(s))continue;let a=mw(s,t,n,i);if(a){if(!a.startsWith("secret.cli.")&&gw(s,t,n?.allowPaths??[],r,i))continue;return{target:s,ruleId:a}}}return null}function Nf(e,t,n={}){let r=Pf(e),o=wf(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd),i=o?.ruleId!=="secret.deny-path"&&n.strict===!1?Pf(e,{refineJavaScriptInlineData:!0}):r,s=i.length===r.length?o:wf(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd,new Set(i));if(s?.ruleId!=="secret.deny-path"&&n.strict===!1&&AE(e))return null;return s}function AE(e){if(e.invocation.route.kind!=="command")return!1;let t=be(e,"input-candidate")??be(e,"declared-command");if(!t)return!1;if(t.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let n=[];for(let s of t.shell.entries){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind!=="operator")n.push(Je(s.text))}let r=Dn(n);if(r.length===0)return!1;let o=en(r[0]??"").toLowerCase(),i=r.slice(1);if(o==="ls"||o==="stat")return!0;if(o==="test")return i.length===2&&(i[0]==="-e"||i[0]==="-f");if(o!=="find")return!1;return!i.some((s)=>uE.has(s))}function Pf(e,t={}){if(e.invocation.route.kind==="command"){let r=be(e,"input-candidate");return r?Mr(r.shell,e.store,t):[]}if(e.invocation.route.kind!=="unknown")return[...e.paths];let n=be(e,"input-candidate");return[...n?Mr(n.shell,e.store,t):[],...e.paths]}function Mr(e,t,n){if(e.status==="structural-limit")throw new xt;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let r=[...e.assignmentFallbacks,...KE(Je(e.source),t,n)],o=[],i=null;for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;if(o.length>0){if(r.push(...Ii(o,t,n)),i!==null)r.push(...Af(i,o,t,n));i=PE.has(s.operator)?o:null,o=[]}else i=null;continue}if(s.kind==="redirection"){let a=s.target?Je(s.target):void 0;if(a&&s.targetOrder==="legacy-segment")o.push(a);else if(a)r.push(a);continue}o.push(Je(s.text))}if(o.length>0){if(r.push(...Ii(o,t,n)),i!==null)r.push(...Af(i,o,t,n))}return r}function Ii(e,t,n){let r=FE(e),o=Dn(e);if(o.length===0)return r;let i=o[0]??"",s=en(i).toLowerCase(),a=o.slice(1),l=TE(i,s,a);if(l)return[...r,...l];if(Mf.has(s))return r;if(SE.has(s))return[...r,...nw(a)];if(aE.has(s))return[...r,...GE(a,t,n)];if(ve.has(s))return[...r,...a.flatMap((c)=>kf("awk",c)),...a.flatMap((c)=>$E(c,t,n)),...a.flatMap(BE)];if(Gf(s)){if(Lf.has(s)){let c=eu(s,a);if(c!==null&&t.getShellSyntax(c).status==="structural-limit")throw new xt}return[...r,...zE(s,a,n)]}return[...r,...a.flatMap((c)=>kf(s,c))]}function kE(e,t){if(Rf.has(e))return t[0]==="explain"?0:null;if(yE.has(e)){let n=t[0]==="-y"||t[0]==="--yes"?1:0;return Rf.has(t[n]??"")&&t[n+1]==="explain"?n+1:null}if(CE.has(e)){if(_f(t[0])&&t[1]==="explain")return 1;if(e==="bun"&&t[0]==="run"&&_f(t[1])&&t[2]==="explain")return 2}return null}function TE(e,t,n){let r=kE(t,n);if(r===null)return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function _f(e){let t=e?.replaceAll("\\","/");return[...hE].some((n)=>t===n||t?.endsWith(`/${n}`))}function Af(e,t,n,r){if(LE(t,n,r))return IE(e);let o=NE(t);if(o===null)return[];return OE(e).flatMap((i)=>Lf.has(o)?Mr(n.getShellSyntax(i),n,r):$f(i))}function IE(e){let t=Dn(e);if(t.length===0)return[];let n=en(t[0]??"").toLowerCase();if(!Mf.has(n))return[];return t.slice(1)}function OE(e){let t=Dn(e);if(t.length===0)return[];let n=en(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return ME(r);return[]}function ME(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Wf(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>DE(t,r.slice(i*n,(i+1)*n)))}function DE(e,t){let n=0;return Wf(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Wf(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function LE(e,t,n){let r=Dn(e);if(r.length===0||en(r[0]??"").toLowerCase()!=="xargs")return!1;let o=Ht(r),i=r.slice(o.childStart);if(i.length===0)return!1;if(o.replacementToken==="")return!1;let s=o.replacementToken,a=s===null?[...i,qa]:i.map((l)=>l.split(s).join(qa));return Ii(a,t,n).some((l)=>l.includes(qa))}function NE(e){let t=Dn(e);if(t.length===0)return null;let n=en(t[0]??"").toLowerCase();if(!Gf(n))return null;return WE(n,t.slice(1))?n:null}function WE(e,t){let n=Ff(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Df.has(o)||zf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(_E.get(n)?.has(o))r++;continue}return!1}return!0}function Ff(e){return/^python\d/.test(e)?"python":e}function FE(e){let t=[];for(let n of e){if(Hf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}function kf(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function GE(e,t,n){let r=e.findIndex((i)=>i.startsWith("-")||i==="("||i==="!"||i===";"),o=[...e.slice(0,r===-1?e.length:r)];for(let i=0;i<e.length;i++){if(!lE.has(e[i]??""))continue;let s=e.slice(i+1),a=s.findIndex((u)=>cE.has(u)),l=a===-1?s:s.slice(0,a),c=Ii(l,t,n);if(o.push(...c.filter((u)=>u!=="{}")),!c.includes("{}"))continue;o.push(...e.slice(0,i).flatMap((u,m,f)=>{if(!dE.has(u))return[];let d=f[m+1];return d===void 0?[]:[d,d.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return o}function Gf(e){return mE.has(e)||/^python\d/.test(e)}function zE(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o];if(i===void 0)break;if(Df.has(i)||zf(e,i)){let a=t[o+1];if(a!==void 0)r.push(...Tf(e,a,n)),o++;continue}let s=/^--(?:eval|exec)=(.*)$/.exec(i);if(s!==null&&s[1]!==void 0){r.push(...Tf(e,s[1],n));continue}if(!i.startsWith("-"))r.push(i)}return r}function zf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return bE.get(t[t.length-1]??"")?.has(Ff(e))??!1}function $E(e,t,n){if(!e.includes("system"))return[];return Ms(e)?.commands.flatMap((r)=>Mr(t.getShellSyntax(r),t,n))??[]}function BE(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function $f(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(/[\w./~@+-]*[./~][\w./~@+-]*/g)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Bf),...n]}function Tf(e,t,n){let r=$f(t);if(!n.refineJavaScriptInlineData||!fE.has(e)||r.length===0)return r;let o=UE(t);return o!==null&&!jE(o)?[]:r}function UE(e){let t=e.split("");for(let n=0;n<e.length;n++){let r=e[n];if(r!=="'"&&r!=='"'&&r!=="`")continue;if(r==="`"&&HE(e,n))return null;t[n]=" ";let o=!1;for(let i=n+1;i<e.length;i++){let s=e[i];if(t[i]=" ",s==="\\"){if(i++,i<e.length)t[i]=" ";continue}if(r==="`"&&s==="$"&&e[i+1]==="{")return null;if(r!=="`"&&(s===`
-`||s==="\r"))return null;if(s!==r)continue;n=i,o=!0;break}if(!o)return null}return t.join("")}function HE(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function jE(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(pE.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>gE.has(i)))continue;if(o.length>1)return!0;if(VE(e,r)===".")return!0;if(qE(e,r+n.length)==="(")return!0}return!1}function VE(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function qE(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function KE(e,t,n){return QE(e).flatMap((r)=>{let o=t.getShellSyntax(r);if(o.status==="invalid")return[];return[...Mr(o,t,n),...YE(o)?ZE(o):[]]})}function YE(e){let t=e.entries;for(let n=0;n<t.length;n++){let r=t[n];if(r?.kind!=="word"||en(Je(r.text)).toLowerCase()!=="base64")continue;for(let o=n+1;o<t.length;o++){let i=t[o];if(i?.kind==="operator")break;if(i?.kind!=="word")continue;let s=Je(i.text);if(s==="--decode"||!s.startsWith("--")&&s.startsWith("-")&&/[dD]/.test(s))return!0}}return!1}function ZE(e){return e.entries.flatMap((t)=>t.kind==="word"?[Je(t.text)]:t.kind==="redirection"&&t.target?[Je(t.target)]:[]).flatMap(Bf)}function Bf(e){let t=JE(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||XE(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function XE(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function JE(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function QE(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Zn(o,n))continue;if(Uf(e,r,n)){let i=ew(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function ew(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Zn(i,n))continue;if(Uf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Uf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function nw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",f=u[2];if(m===vE)o=!0;if(xE.has(m))r=!0;if(f!==void 0){if(m===Ef)t.push(f);continue}if(wE.has(m)){let d=e[l+1];if(m===Ef&&d!==void 0)t.push(d);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),f="",d="";for(let p=0;p<m.length;p++){let g=m[p]??"";if(RE.has(g))r=!0;if(EE.has(g)){f=g,d=m.slice(p+1);break}}if(f!=="")if(d.length>0){if(f===xf)t.push(d)}else{let p=e[l+1];if(f===xf&&p!==void 0)t.push(p);l++}continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Dn(e){let t=e.findIndex((n)=>!Hf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Hf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var rw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),ow=".env.",iw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),sw=[".env.example.",".env.sample."];function aw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function lw(e){return e.length>0&&!/\s/.test(e)}function cw(e,t,n){try{let r=Dr(e,t,n);return r!==""&&De.entryKind(r)!=="missing"}catch(r){if(r instanceof Pe)throw r;return!1}}var uw=new Set(["node_modules","__pycache__"]),dw=[["vendor","bundle"],["vendor","cache"]];function mw(e,t,n,r){if(aw(e))return null;let o=at(e,t,r);if(!o)return null;let i=q(o.split("/").pop()??""),s=q(o),a=()=>lw(i)||cw(e,t,r);if(iw.has(i)||sw.some((m)=>i.startsWith(m)))return null;let l=q(Cw(e,t,r));for(let m of Ta){let f=`~/${m.suffixParts.join("/")}`;if((If(s,f)||If(l,f))&&yt(m.id,n))return m.id}let c=fw(o,t,n,r);if(c)return c;if(rw.has(i))return null;for(let m of ka)if(i===m.basename&&yt(m.id,n))return m.id;if(i.startsWith(ow)&&yt(bi.id,n)&&a())return bi.id;for(let m of Ia)if(i.length>m.prefix.length&&i.startsWith(m.prefix)){let f=i.slice(m.prefix.length)[0];if((f==="-"||f==="_")&&yt(m.id,n)&&a())return m.id}for(let m of Oa)if(i.length>m.prefix.length&&i.startsWith(m.prefix)){if(i.slice(m.prefix.length)===m.suffix&&yt(m.id,n))return m.id}if(hw(s))return null;if(!i.includes(".")&&xr.pattern.test(i)&&yt(xr.id,n))return xr.id;let u=yw(i,n);if(u)return u;return null}function fw(e,t,n,r){return Si.find((o)=>{if(!yt(o.id,n))return!1;switch(o.id){case"secret.cli.claude-code":return U(e,V(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),[".credentials.json"]);case"secret.cli.claude-code.config":{let i=q(e).split("/");return U(e,V(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),["settings.json","settings.local.json"])||Or(e,"~/.claude.json",t,r)||i.at(-1)==="settings.local.json"&&i.at(-2)===".claude"||i.at(-1)===".mcp.json"}case"secret.cli.antigravity":return U(e,at("~/.gemini/config",t,r),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let i=V(process.env.CODEX_HOME,"~/.codex",t,r);return U(e,i,["auth.json",".credentials.json"])||Ir(e,i,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let i=V(process.env.CODEX_HOME,"~/.codex",t,r),s=q(e).split("/").at(-1)??"";return U(e,i,["config.toml"])||s.endsWith(".config.toml")&&U(e,i,[s])}case"secret.cli.gemini":return U(e,ae(V(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let i=q(e).split("/"),s=process.env.ProgramData?[ae(V(process.env.ProgramData,"",t,r),"gemini-cli")]:[];return U(e,ae(V(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["settings.json","google_accounts.json"])||i.at(-1)==="settings.json"&&i.at(-2)===".gemini"||(process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH?.trim()?Or(e,process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH,t,r):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...s].some((a)=>U(e,at(a,t,r),["settings.json"]))}case"secret.cli.copilot-cli":{let i=V(process.env.COPILOT_HOME,"~/.copilot",t,r);return U(e,i,["config.json"])||Ir(e,i,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return U(e,V(process.env.COPILOT_HOME,"~/.copilot",t,r),["mcp-config.json"]);case"secret.cli.kimi-code":{let i=V(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),s=V(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r);return U(e,i,["server.token"])||Ir(e,i,["credentials"])||Ir(e,s,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let i=["config.toml","mcp.json"],s=q(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".kimi-code"||U(e,V(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),i)||U(e,V(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r),[...i,"config.json","config.json.bak"])}case"secret.cli.opencode":{let i=ae(V(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"opencode"),s=q(e).split("/").at(-1)??"",a=process.env.OPENCODE_DB?.trim(),l=a&&a!==":memory:"?[a,`${a}-wal`,`${a}-shm`]:[];return U(e,i,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(s)&&U(e,i,[s])||l.some((c)=>Or(e,c,t,r))}case"secret.cli.opencode.config":{let i=process.env.OPENCODE_CONFIG_DIR?V(process.env.OPENCODE_CONFIG_DIR,"~/.config/opencode",t,r):ae(V(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"opencode"),s=process.env.ProgramData?[ae(V(process.env.ProgramData,"",t,r),"opencode")]:[],a=["opencode.json","opencode.jsonc"];return a.includes(q(e).split("/").at(-1)??"")||U(e,i,a)||(process.env.OPENCODE_CONFIG?.trim()?Or(e,process.env.OPENCODE_CONFIG,t,r):!1)||["/Library/Application Support/opencode","/etc/opencode",...s].some((l)=>U(e,at(l,t,r),a))}case"secret.cli.pi":return U(e,V(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["auth.json"]);case"secret.cli.pi.config":return U(e,V(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["models.json"]);case"secret.cli.amp":{let i=at("~",t,r);return[ae(V(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"amp"),ae(i,".local","share","amp")].some((a)=>U(e,a,["secrets.json"]))||Ir(e,ae(i,".amp"),["oauth"])}case"secret.cli.amp.config":{let i=["settings.json","settings.jsonc"],s=[ae(V(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"amp"),ae(at("~",t,r),".config","amp")],a=q(e).split("/");return s.some((l)=>U(e,l,i))||a.at(-2)===".amp"&&i.includes(a.at(-1)??"")||(process.env.AMP_SETTINGS_FILE?.trim()?Or(e,process.env.AMP_SETTINGS_FILE,t,r):!1)}case"secret.cli.cursor":{let i=ae(V(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"cursor"),s=ae(V(process.env.CURSOR_DATA_DIR,"~/.cursor",t,r),"projects");return U(e,at("~/.cursor",t,r),["auth.json"])||U(e,i,["auth.json"])||q(e).split("/").at(-1)==="mcp-auth.json"&&Qt(q(e),q(s))}case"secret.cli.cursor.config":{let i=q(e).split("/");return i.at(-1)==="mcp.json"&&i.at(-2)===".cursor"}case"secret.cli.grok-build":return U(e,V(process.env.GROK_HOME,"~/.grok",t,r),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let i=q(e).split("/");return i.at(-1)==="config.toml"&&i.at(-2)===".grok"||U(e,V(process.env.GROK_HOME,"~/.grok",t,r),["config.toml","managed_config.toml","requirements.toml"])||U(e,at("/etc/grok",t,r),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}function V(e,t,n,r){return at(e?.trim()?e:t,n,r)}function U(e,t,n){return n.some((r)=>jf(e,ae(t,r)))}function Ir(e,t,n){return n.some((r)=>Qt(q(e),q(ae(t,r))))}function Or(e,t,n,r){return jf(e,at(t,n,r))}function jf(e,t){return q(e)===q(t)}function ae(e,...t){return qe([e,...t].filter(Boolean).join("/"))}function pw(e,t,n,r,o){if(n.length===0)return!1;let i=q(Dr(e,t,o));return n.some((s)=>Qt(i,q(Dr(s,r,o))))}function gw(e,t,n,r,o){if(n.length===0)return!1;let i=q(Dr(e,t,o));if(!i)return!1;let s=process.env.HOME??Ka(),a=s?qe(H(pe(s),De,o)):"",l=q(a),c=process.env.CC_SAFETY_NET_HOME,u=q(c?qe(H(Oi(pe(c)),De,o)):a&&qe(H(`${a}/.cc-safety-net`,De,o)));if(u&&Qt(i,u))return!1;return n.some((m)=>{let f=q(Dr(m,r,o));if(!f)return!1;if(l&&(l===f||l.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Qt(i,f)})}function hw(e){let t=e.split("/");return t.some((n)=>uw.has(n))||dw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function yw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Ma)if(r===o.extension&&yt(o.id,t))return o.id;for(let o of Da)if(o.pattern.test(r)&&yt(o.id,t))return o.id;return null}function q(e){return e.toLowerCase()}function yt(e,t){return!t?.disabledRules?.includes(e)}function at(e,t,n){let{home:r,normalized:o}=Ya(e,n);if(!o)return"";if(!r)return o;let i=Za(o,r),s=Ti(i)?i:qe(Oi(t,i)),a=qe(H(s,De,n));if(!Qt(a,r)){if(Ti(i))return a;return a===s?o:a}let l=a.slice(r.length);return l?`~${l}`:"~"}function If(e,t){return e===t||e.startsWith(`${t}/`)}function Cw(e,t,n){let{home:r,normalized:o}=Ya(e,n);if(!o||!r)return"";let i=Za(o,r),s=oE.normalize(Ti(i)?i:qe(Oi(t,i))),a=qe(pe(process.env.HOME??Ka())),l=(m)=>process.platform==="win32"?m.toLowerCase():m,c=[r,a].find((m)=>m!==""&&Qt(l(s),l(m)));if(c===void 0)return"";let u=s.slice(c.length);return u?`~${u}`:"~"}function Dr(e,t,n){let{home:r,normalized:o}=Ya(e,n);if(!o)return"";let i=r?Za(o,r):o;return qe(H(Ti(i)?i:Oi(t,i),De,n))}function Ya(e,t){let n=process.env.HOME??Ka(),r=n?qe(H(pe(n),De,t)):"",o=qe(pe(bw(Je(e))));return{home:r,normalized:o}}function bw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return sE(e)}catch{return e}}function Za(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function Sw(e){if(process.platform==="win32")return!0;return iE.parse(e).root.length>1}function qe(e){let t=e.trim(),n=(Sw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Qt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function en(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}import{dirname as Ct}from"node:path";var Vf="Rulebook exceeds CC Safety Net's safe validation limits.",qf="Additional rulebook validation errors were omitted.",Ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Kf(e){if(Xa(e.allowed_commands,Ke.maxAllowedCommands)||Xa(e.rules,Ke.maxRules)||Xa(e.tests,Ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ke.maxStringCodeUnits||i&&o.length>Ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;if(!Array.isArray(i.block_args))continue;if(i.block_args.length>Ke.maxBlockArgsPerRule||i.block_args.length>n)return!1;n-=i.block_args.length;for(let s of i.block_args)if(!r(s))return!1}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Xa(e,t){return Array.isArray(e)&&e.length>t}function vw(e){if(!Rw(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Kf(e))return{errors:[Vf],ruleNames:new Set};let t=Om().safeParse(e),n=[...e.rulebook_version===1?[]:["rulebook_version must be 1"],...t.success?[]:An(t.error.issues,": ",": ")];return{errors:n.length>Ke.maxValidationErrors?[...n.slice(0,Ke.maxValidationErrors),qf]:n,ruleNames:new Set(La(e).map((r)=>r.toLowerCase()))}}function Ln(e){let t=vw(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}function Rw(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}var xw=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#([A-Za-z0-9._-]+)$/;function Mi(e){if(Pn(e.spec))return ww(e);return Ew(e)}function Ew(e){if(!Ie.test(e.spec))return`Local rulebook sources must be bare names matching ${Ie}: ${e.spec}`;if(e.kind!=="local-directory")return`lock entry for ${e.spec} must use local-directory kind`;if(e.path===e.spec&&e.name===e.spec)return null;return`lock entry for ${e.spec} does not match local source identity`}function ww(e){let t=Rr(e.spec);if(t)return t;let n=wn(e.spec);if(e.kind!=="github")return`lock entry for ${e.spec} must use github kind`;if(e.owner===n.owner&&e.repo===n.repo&&e.ref===n.ref&&e.path===n.path&&e.name===n.name)return null;return`lock entry for ${e.spec} does not match GitHub source identity`}function ZM(e,t,n){let r=Zf(e.rules,n);if(r.length>0)return{ok:!0,specs:r};if(!t)return{ok:!1,result:{ok:!1,errors:[`No lockfile available to match rulebook name ${n}; use the exact source or run ${Ve}`],warnings:[],entries:[]}};let o=new Set(e.rules),i=t.rulebooks.filter((s)=>s.name===n&&o.has(s.spec)).map((s)=>s.spec);if(i.length===1)return{ok:!0,specs:i};return Yf(n,i)}function XM(e,t,n){let r=Zf(e,n);if(r.length>0)return{ok:!0,specs:r};let o=Pw(e,n);if(o.length>0)return{ok:!0,specs:o};let i=_w(e,n);if(!i.ok)return i;if(i.specs.length>0)return{ok:!0,specs:i.specs};let s=t?e.filter((a)=>t.rulebooks.find((l)=>l.spec===a)?.name===n):[];if(s.length===1)return{ok:!0,specs:s};return Yf(n,s)}function Yf(e,t){return{ok:!1,result:{ok:!1,errors:t.length===0?[`No configured rulebook matches ${e}`]:[`Ambiguous rulebook match ${e}: ${t.join(", ")}`],warnings:[],entries:[]}}}function Zf(e,t){return e.filter((n)=>n===t)}function Pw(e,t){let n=t.match(xw),r=n?.[1],o=n?.[2],i=n?.[3];if(!r||!o||!i)return[];return Jf(e,(s)=>s.owner===r&&s.repo===o&&s.ref===i)}function _w(e,t){if(!Em(t))return{ok:!0,specs:[]};let[n,r]=t.split("/"),o=Jf(e,(s)=>s.owner===n&&s.repo===r);if(new Set(o.map((s)=>Xf(s)?.ref).filter((s)=>!!s)).size<2)return{ok:!0,specs:o};return{ok:!1,result:{ok:!1,errors:[`Multiple refs are configured for ${t}. Use an explicit ref:`,`  cc-safety-net rule remove ${t}#<ref>`],warnings:[],entries:[]}}}function Xf(e){try{return wn(e)}catch{return null}}function Jf(e,t){return e.filter((n)=>{let r=Xf(n);return r?t(r):!1})}function Ja(e){let t=typeof e==="string"?e:e.path;try{let n=gt(typeof e==="string"?xi(e):e);if(n===null)return{lock:null,errors:[]};let r=JSON.parse(n);if(!r||typeof r!=="object")return{lock:null,errors:[`malformed lockfile ${t}: must be an object`]};let o=r;if(o.version!==1||!Array.isArray(o.rulebooks))return{lock:null,errors:[`malformed lockfile ${t}`]};let i=Mm().safeParse(o),s=o.rulebooks.flatMap((l,c)=>{let u=i.success?[]:i.error.issues.filter((f)=>f.path[1]===c);if(u.length>0)return An(u).map((f)=>`${t}: ${f}`);let m=Mi(l);return m?[`${t}: rulebooks[${c}]: ${m}`]:[]});if(!i.success||s.length>0)return{lock:null,errors:[`malformed lockfile ${t}`,...s]};return{lock:{version:1,rulebooks:i.data.rulebooks.map((l)=>{if(l.kind==="local-directory")return{spec:l.spec,kind:l.kind,path:l.path,name:l.name,version:l.version,digest:l.digest};let c={spec:l.spec,kind:l.kind,owner:l.owner,repo:l.repo,ref:l.ref,commit:l.commit,path:l.path,name:l.name,version:l.version,digest:l.digest};return typeof l.display_ref==="string"&&l.display_ref!==""?{...c,display_ref:l.display_ref}:c})},errors:[]}}catch(n){if(n instanceof L)return{lock:null,errors:[n.message]};return{lock:null,errors:["malformed lockfile"]}}}import{createHash as Aw}from"node:crypto";import{dirname as Di,join as kw}from"node:path";var tp=Object.freeze({timeoutMs:15000,metadataBytes:524288,commitBytes:262144,treeBytes:16777216,rawBytes:4194304});async function Qf(e,t,n,r=Me(Di(Di(t)),"rules policy"),o=hi()){if(Pn(e))return Iw(e,o);return Tw(e,t,n,r)}async function dD(e,t,n,r,o,i=hi()){if(!Pn(e)||n.refresh)return Qf(e,t,n,o,i);let s=r?.rulebooks.find((a)=>a.spec===e);if(!s||s.kind!=="github")return Qf(e,t,n,o,i);return Ow(s,t,n,o,i)}async function mD(e,t=hi()){let[n,r]=e.split("/");if(!n||!r)throw Error(`Invalid GitHub repository source: ${e}`);let o=await Lr(`https://api.github.com/repos/${n}/${r}`,"metadata",t),i=o.response;if(!i.ok)throw Error(`Failed to inspect ${e}: GitHub returned ${i.status}`);let a=JSON.parse(o.content)?.default_branch;if(typeof a!=="string"||a==="")throw Error(`Failed to inspect ${e}: missing default branch`);let l=await rp(n,r,a,e,t),c=await Lr(`https://api.github.com/repos/${n}/${r}/git/trees/${l}?recursive=1`,"tree",t),u=c.response;if(!u.ok)throw Error(`Failed to inspect ${e}: GitHub tree returned ${u.status}`);let m=JSON.parse(c.content);if(!Array.isArray(m?.tree))throw Error(`Failed to inspect ${e}: unexpected GitHub tree response`);let d=m.tree.flatMap((p)=>{if(!p||typeof p!=="object")return[];let g=p;if(g.type!=="blob"||typeof g.path!=="string")return[];let y=g.path.match(_a);return y?.[1]?[y[1]]:[]}).sort();if(d.length===0)throw Error(`No rulebooks found in ${e} under ${Ci}/`);return d.map((p)=>({spec:`${n}/${r}#${l}/${p}`,display_ref:a}))}function Tw(e,t,n,r){Aa(e);let o=Nw(t,e),i=gt(se(r,o));if(i===null)throw Error(`Rulebook source not found: ${e}`);let s=Ln(Qa(i,"Invalid local rulebook source."));if(s.name!==e)throw Error(`rulebook name "${s.name}" must match local source "${e}"`);return{rulebook:s,content:i,entry:{spec:e,kind:"local-directory",path:e,name:s.name,version:s.version,digest:Nn(i)}}}async function Iw(e,t){let n=wn(e),r=await rp(n.owner,n.repo,n.ref,e,t),o=await Lr(`https://raw.githubusercontent.com/${n.owner}/${n.repo}/${r}/${n.path}`,"raw",t),i=o.response;if(!i.ok)throw Error(`Failed to fetch ${e}: GitHub raw returned ${i.status}`);let s=o.content,a=Ln(Qa(s,"Invalid GitHub rulebook response."));if(a.name!==n.name)throw Error(`rulebook name "${a.name}" must match GitHub source "${n.name}"`);return{rulebook:a,content:s,entry:{spec:e,kind:"github",owner:n.owner,repo:n.repo,ref:n.ref,commit:r,path:n.path,name:a.name,version:a.version,digest:Nn(s)}}}async function Ow(e,t,n,r=Me(Di(Di(t)),"rules policy"),o){let i=Mi(e);if(i)throw Error(`${i}; run ${Ve}`);let s=Pi(e,_i(t,n)),a=gt(se(r,s));if(a!==null){if(Nn(a)===e.digest)return{entry:e,rulebook:np(a,e),content:a}}return Mw(e,o)}async function Mw(e,t){let n=await Lr(`https://raw.githubusercontent.com/${e.owner}/${e.repo}/${e.commit}/${e.path}`,"raw",t),r=n.response;if(!r.ok)throw Error(`Failed to restore ${e.spec}: GitHub raw returned ${r.status}`);let o=n.content;if(Nn(o)!==e.digest)throw Error(`locked GitHub digest mismatch for ${e.spec}; run ${Ve}`);return{entry:e,rulebook:np(o,e),content:o}}function np(e,t){let n=Ln(Qa(e,"Invalid cached rulebook."));if(n.name!==t.name)throw Error(`rulebook name "${n.name}" must match lock entry "${t.name}"`);return n}function Qa(e,t){try{return JSON.parse(e)}catch{throw Error(t)}}async function rp(e,t,n,r,o){let i=await Lr(`https://api.github.com/repos/${e}/${t}/commits/${encodeURIComponent(n)}`,"commit",o),s=i.response;if(!s.ok)throw Error(`Failed to resolve ${r}: GitHub returned ${s.status}`);let a=JSON.parse(i.content);if(typeof a?.sha!=="string"||a.sha==="")throw Error(`Failed to resolve commit for ${r}`);return a.sha}async function Dw(e,t,n={}){if(n.signal?.aborted)throw n.signal.reason;let r=n.budget??gi(),o=new AbortController,i=()=>o.abort(n.signal?.reason);n.signal?.addEventListener("abort",i,{once:!0});let s=!1,a=setTimeout(()=>{if(o.signal.aborted)return;s=!0,o.abort()},n.timeoutMs??tp.timeoutMs);try{if(n.signal?.aborted)throw n.signal.reason;Sm(r);let l=await(n.fetch??fetch)(e,{signal:o.signal,redirect:"error"});if(!l.ok)return op(l),{response:l,content:""};return{response:l,content:await Lw(l,t,r,()=>o.abort())}}catch(l){if(s)throw Error("GitHub request timed out",{cause:l});if(n.signal?.aborted)throw n.signal.reason;throw l}finally{clearTimeout(a),n.signal?.removeEventListener("abort",i)}}function Lr(e,t,n){return Dw(n.resolveUrl?.(e)??e,t,{budget:n.budget,signal:n.controller.signal})}async function Lw(e,t,n=gi(),r){let o=tp[`${t}Bytes`],i=Number(e.headers.get("content-length"));if(Number.isFinite(i)&&i>o)throw op(e),Error(`GitHub ${t} response exceeds ${o} bytes`);if(!e.body)return"";let s=e.body.getReader(),a=[],l=0;while(!0){let c=await s.read();if(c.done)break;try{vm(n,c.value.byteLength)}catch(u){throw r?.(),ep(s),u}if(l+=c.value.byteLength,l>o)throw r?.(),ep(s),Error(`GitHub ${t} response exceeds ${o} bytes`);a.push(Buffer.from(c.value))}return Buffer.concat(a,l).toString("utf-8")}function op(e){if(!e.body)return;ip(()=>e.body?.cancel())}function ep(e){ip(()=>e.cancel())}function ip(e){try{Promise.resolve(e()).catch(()=>{})}catch{}}function Nw(e,t){return kw(e,t,yi)}function Nn(e){return`sha256:${Aw("sha256").update(e).digest("hex")}`}function lp(e={}){let t=of(e),n=!1;try{n=Hm(t.userConfigTarget,t.projectConfigTarget)}catch(f){if(f instanceof L)return Bw(t,f.message);throw f}let r=Tn(t.userConfigTarget),o=n?{config:null,errors:[]}:Tn(t.projectConfigTarget),i=ap(t.userConfigPath,r.errors),s=ap(t.projectConfigPath,o.errors),a=new Set,l=r.config?el(r.config,t.userLockPath,Ct(t.userConfigPath),e,"user",t.userScope,a):Nr(),c=o.config?el(o.config,t.projectLockPath,Ct(t.projectConfigPath),e,"project",t.projectScope,a):Nr(),u=r.config?.overrides??{},m=o.config?.overrides??{};return{rules:[...sp(l.rules,u),...sp(c.rules,m)],transparent_wrappers:zw(r.config,o.config),rulebooks:[...l.rulebooks,...c.rulebooks],errors:[...i,...s,...l.errors,...c.errors],warnings:[...l.warnings,...c.warnings,...l.canValidateOverrides?tl(u,l.knownRuleIds,t.userConfigPath):[],...l.canValidateOverrides?$w(m,l.knownRuleIds,t.projectConfigPath):[],...c.canValidateOverrides?tl(m,c.knownRuleIds,t.projectConfigPath):[]],userConfig:r.config??void 0,projectConfig:o.config??void 0,...t}}function vD(e,t){let n=t??Me(Ct(Ct(e)),"rules policy"),r=Tn(se(n,e)).config,o=Ja(se(n,Xt(e))).lock;if(!r||!o)return new Map;let i=new Set(r.rules);return new Map(o.rulebooks.filter((s)=>i.has(s.spec)).map((s)=>[s.spec,lf(s)]))}function RD(e,t,n,r){let o=Ww(e,t,n,r);if(!o)return[];return[...o.scope.errors,...o.scope.warnings,...Fw(o.config,o.scope,e)]}function Ww(e,t,n,r){let o=r??Me(Ct(Ct(e)),"rules policy"),i=Tn(se(o,e)).config;if(!i)return null;return{config:i,scope:el(i,t,Ct(e),n,"project",o)}}function Fw(e,t,n){return t.canValidateOverrides?tl(e.overrides??{},t.knownRuleIds,n):[]}function el(e,t,n,r,o,i=Me(Ct(Ct(n)),o==="user"?"user policy":"project policy"),s=new Set){let a;try{a=se(i,t)}catch(y){if(y instanceof L)return{...Nr(),errors:[y.message],canValidateOverrides:!1};throw y}let l=Ja(a);if(l.errors.length>0)return{...Nr(),errors:l.errors,canValidateOverrides:!1};let c=l.lock;if(!c&&e.rules.length>0)return{...Nr(),errors:[`missing lockfile ${t}; run ${Ve}`],canValidateOverrides:!1};let u=c?.rulebooks??[],m=new Map(u.map((y)=>[y.spec,y])),f=[],d=[],p=e.rules.flatMap((y)=>{let h=m.get(y);if(!h)return f.push(`missing lock entry for ${y}; run ${Ve}`),[];let R=Gw(h,n,r,i);if(R.errors.length>0||!R.rulebook)return f.push(...R.errors),[];let x=R.rulebook;if(s.has(x.name))return d.push(`duplicate active rulebook name "${x.name}" for ${y}; keeping the first and ignoring this one, so its rules are not active; rename one of them, then run ${Ve}`),[];return s.add(x.name),[{rules:x.rules.map((A)=>({...A,name:`${x.name}/${A.name}`})),rulebook:{source:o,spec:h.spec,name:x.name,version:x.version,rules:x.rules.map((A)=>`${x.name}/${A.name}`)}}]}),g=p.flatMap((y)=>y.rules);return{rules:g,rulebooks:p.map((y)=>y.rulebook),entries:u,knownRuleIds:new Set(g.map((y)=>y.name)),errors:f,warnings:d,canValidateOverrides:f.length===0}}function Gw(e,t,n,r){let o=Pi(e,_i(t,n)),i;try{i=gt(se(r,o))}catch(a){if(a instanceof L)return{rulebook:null,errors:[a.message]};throw a}if(i===null)return{rulebook:null,errors:[`missing cache entry for ${e.spec}; run ${Ve}`]};if(Nn(i)!==e.digest)return{rulebook:null,errors:[`cache digest mismatch for ${e.spec}; run ${Ve}`]};let s;try{s=JSON.parse(i)}catch{return{rulebook:null,errors:[`invalid cached rulebook for ${e.spec}`]}}try{Ln(s)}catch(a){return{rulebook:null,errors:[`invalid cached rulebook for ${e.spec}: ${a instanceof Error?a.message:"invalid rulebook"}`]}}return{rulebook:s,errors:[]}}function zw(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function sp(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function tl(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function $w(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function ap(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Bw(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,userLockPath:e.userLockPath,projectLockPath:e.projectLockPath}}function Nr(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}function cp(e={}){let t=lp(e),n=ff(e),r={rules:t.rules,transparentWrappers:t.transparent_wrappers,safety:n.safety,worktreeMode:n.worktreeMode,destructiveCommandProtectionEnabled:n.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:n.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:n.destructiveCommandAllowPaths,secretProtection:{enabled:n.secretProtection.enabled??!0,disabledRules:n.secretProtection.disabledRules??[],denyPaths:n.secretProtection.denyPaths,allowPaths:n.secretProtection.allowPaths??[]}},o={...t.userConfig?.overrides??{},...t.projectConfig?.overrides??{}},i=Object.freeze(Object.fromEntries(r.rules.map((s)=>{let a=t.rulebooks.find((c)=>c.rules.includes(s.name)),l=o[s.name];return[s.name,Object.freeze({id:s.name,...a?{rulebook:Object.freeze({name:a.name,version:a.version}),...Vw(a.spec)?{source:a.spec}:{}}:{},...l&&typeof l==="object"?{override:Object.freeze({type:"reason",reason:l.reason})}:{}})]})));return qw(r,Uw(t,n),i)}function PD(e){if(e.state==="ready")return{state:e.state};return{state:e.state,reason:e.reason}}function Uw(e,t){let n=jw(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Kw(e.errors.length>0?Hw(e.errors):void 0,e.warnings.length>0?nl(e.warnings.join("; ")):void 0,n)}}function Hw(e){return`${nl(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function jw(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Vw(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function qw(e,t,n=Object.freeze({})){let r=up(structuredClone(e));if(!t)return Object.freeze({state:"ready",policy:r,diagnostics:Object.freeze([]),ruleMetadata:n});return Object.freeze({state:"degraded",policy:r,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n})}function up(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))up(t);return Object.freeze(e)}function Kw(...e){return nl(e.filter((t)=>!!t).join("; "))}function nl(e){return/[.!?]$/.test(e)?e:`${e}.`}class rl extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Yw={findPolicyMutation:Sf,findGitMetadataMutation:au,resolveGitMetadata:xs,loadPolicySnapshot:cp,findSensitiveTarget:Nf,analyzeCommand:Ea,getModes:pi};function GD(e,t={}){let n={...Yw,...t.dependencies},r=Jw(e),o=Wr(e)?e.command:r,i=tn("policy-protection",o,()=>Do(e,t.factParserDependencies)),s=be(i,"declared-command");if(Wr(e)&&e.command?.trim()&&s?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:lt,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(be(i,"input-candidate")?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:ul,intent:"stop_and_explain",evidence:[]}};let a=tn("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd])),l=tn("policy-protection",o,()=>n.findPolicyMutation(i));if(l){let y=o??l.target;return{stage:"policy-protection",decision:{kind:"deny",reason:bf,intent:"hard_stop",evidence:[{kind:"command",command:y,segment:l.target}]}}}let c=tn("policy-protection",o,()=>n.findGitMetadataMutation(i,a));if(c){let y=o??c.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:[{kind:"command",command:y,segment:c.target}]}}}let u=tn("config-load",o,()=>n.loadPolicySnapshot({...t.policyOptions,cwd:e.context.configCwd})),m=u.policy,f=n.getModes(m),d={level:f.effectiveLevel,...Zw(u)},p=m.secretProtection.enabled===!1?null:tn("secret-protection",o,()=>n.findSensitiveTarget(i,m.secretProtection,{strict:Wr(e)?f.strict:void 0}));if(p){let y=o??p.target;return{stage:"secret-protection",...d,decision:{kind:"deny",reason:Of,intent:"hard_stop",ruleId:p.ruleId,evidence:[{kind:"command",command:y,segment:p.target}]}}}if(!Wr(e))return{stage:"non-command",...d,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...ol("command-validation",o),...d};let g=tn("command-analysis",o,()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:u,environment:ct(),protectedGitMetadata:a,effectiveCapabilities:f.capabilities,strict:f.strict,paranoidRm:f.paranoidRm,paranoidInterpreters:f.paranoidInterpreters,worktreeMode:f.worktreeMode},Xw(i),i.store));if(g)return{stage:"command-analysis",...d,decision:g};return{stage:"command-analysis",...d,decision:{kind:"allow"}}}function Zw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Xw(e){return be(e,"declared-command")?.program}function Jw(e){try{return Mo(e.input)}catch(t){let n=Wr(e)?e.command:void 0;throw new rl("policy-protection",ol("policy-protection",t instanceof er?void 0:n,t),t)}}function tn(e,t,n){try{return n()}catch(r){throw new rl(e,ol(e,r instanceof er?void 0:t,r),r)}}function ol(e,t,n){let r=n instanceof Pe||n instanceof xt;return{stage:e,decision:{kind:"deny",reason:r?dl:ml,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function Wr(e){return e.route.kind==="command"}
-export{hm as q,ym as r,De as s,ct as t,L as u,se as v,xi as w,gt as x,Um as y,Hm as z,AO as A,kO as B,TO as C,IO as D,OO as E,vx as F,Ie as G,yi as H,Ci as I,Em as J,Qm as K,Ve as L,nf as M,Jt as N,rf as O,KO as P,Xt as Q,YO as R,ZO as S,of as T,XO as U,lf as V,Pi as W,JO as X,_i as Y,oP as Z,iP as _,sP as $,xp as aa,ml as ba,Pe as ca,Jr as da,H as ea,Yr as fa,qi as ga,Dt as ha,er as ia,y_ as ja,Mo as ka,Bc as la,jc as ma,xt as na,Do as oa,yy as pa,Ae as qa,au as ra,xs as sa,ku as ta,NA as ua,ie as va,jR as wa,XI as xa,pi as ya,br as za,Ra as Aa,JI as Ba,pm as Ca,iO as Da,Ea,fl as Fa,vr as Ga,bm as Ha,Cm as Ia,hi as Ja,Pm as Ka,xO as La,La as Ma,Er as Na,An as Oa,Ax as Pa,Tn as Qa,FO as Ra,GO as Sa,zO as Ta,wi as Ua,ki as Va,On as Wa,mM as Xa,Ai as Ya,fM as Za,Ux as _a,pM as $a,In as ab,pf as bb,gf as cb,bf as db,Sf as eb,Of as fb,Nf as gb,Ln as hb,ZM as ib,XM as jb,Ja as kb,dD as lb,mD as mb,lp as nb,vD as ob,RD as pb,el as qb,cp as rb,PD as sb,qw as tb,rl as ub,GD as vb};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(I(e)):e.provenance==="literal"}function ur(e){return e?I(e):""}function KS(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Js(e,t){return Zs(Fe(e,"posix"),t)}function Rn(e){return Js(e,new Set(Array.from(e.matchAll(nd)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Zs(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Zs(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Zs(o,n))||sd(r.words,n))return!0;QS(r,n)}return!1}function sd(e,t){let n=e.findIndex((s)=>_e(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(dr(r,t))return!0;let o=z(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return td(e[s],t)}if(ee.has(o)){let s=e.slice(n),a=et(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&td(s[l],t)}let i=YS(e,n,t);if(i===null)return!1;if(i===-1)return!0;return sd(e.slice(i),t)}function YS(e,t,n){let r=z(e[t]?.text??"");if(r==="command")return ZS(e,t+1);if(r==="exec")return XS(e,t+1);if(r==="env")return JS(e,t+1,n);return null}function ZS(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function XS(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function JS(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return dr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return dr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(_e(i))continue;return r}return null}function QS(e,t){if(!e.words.every((n)=>_e(n.text)!==null))return;for(let n of e.words){let r=_e(n.text);if(!r)continue;if(dr(n,t))t.add(r.name)}}function dr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(nd)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(GS.test(o)||t.has(o))}))}function td(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||dr(e,t))}var ev=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--config-env"]),tv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),nv=new Set;function ad(e){if(e==="git")return ev;if(e==="docker")return tv;return nv}function ne(e,t){if(e.length===0||t.length===0)return null;let n=z(e[0]??""),r=de(e);for(let o of t){if(!rv(n,o.command))continue;if(!ov(n,e,o.subcommand))continue;if(sv(e,new Set(o.block_args),r))return{id:`custom.${o.name}`,reason:`[${o.name}] ${o.reason}`,intent:o.intent??"manual_only"}}return null}function rv(e,t){return e===z(t)}function ov(e,t,n){if(!n)return!0;return ld(t,1,n,ad(e))}function ld(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&iv(e,i,n,r))return!0;continue}return s===n}return!1}function iv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return ld(e,t+2,n,r)}function sv(e,t,n){for(let r of e)if(t.has(r))return!0;for(let r of n)if(t.has(r))return!0;return!1}function _t(e,t,n={}){if(e.length===0)return null;let r=e[0];if(!r)return null;let o=z(r);if(o==="eval"){let i=vn(G(e));if(i.kind==="dynamic")return xn(n,t);if(i.kind==="literal"&&t.analyzeNested){let s=t.analyzeNested(i.source,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s)return s}return nt(n,t)}if(ee.has(o)){if(ke(e))return null;let i=Qe(e);if(i){if(n.dynamicSourceInput??n.dynamicInput){let l=xn(n,t);if(l)return l}if(Rn(i)){let l=xn(n,t);if(l)return l}if(!t.analyzeNested)return null;let a=t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(a)return a;return null}let s=tt(G(e));if(s.kind==="dynamic")return xn(n,t);if(s.kind==="literal"){if(n.dynamicSourceInput)return xn(n,t);return null}if(n.dynamicSourceInput??n.dynamicInput)return xn(n,t);return null}if(ve.has(o))return k(Vo(e,(i)=>t.analyzeNested?t.analyzeNested(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments}):null),t.policy)??ne(e,t.policy?.rules??[])??nt(n,t);if(ye(o)){let i=ro(e);if(!i)return nt(n,t);if(Q(t.policy,"interpreter.one-liner-paranoid",!!t.paranoidInterpreters)){let a=k(b("interpreter.one-liner-paranoid",un),t.policy);if(a)return a}if(so(o,i))return nt(n,t);let s=t.analyzeNested?.(i,{effectiveCwd:t.cwd,envAssignments:t.envAssignments});if(s&&s.id!=="raw-text.dangerous-command"&&(s.reason!==St||hn(i)))return s;if(dn(i,t.scanWork))return k(b("interpreter.dangerous-command",Lt),t.policy)??nt(n,t);return nt(n,t)}if(o==="rm"||o==="rmdir"){let i=o==="rm"&&(Ue(e)||n.dynamicRmInput);return k(Sn(G(e),{environment:t.environment,cwd:t.cwd,originalCwd:t.originalCwd,strict:t.strict,paranoid:t.paranoidRm,allowTmpdirVar:t.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(t.envAssignments,t.environment),trustedTmpdirValue:ft(t.envAssignments,t.environment),protectedGitMetadata:t.protectedGitMetadata,policy:t.policy}),t.policy)??(i&&n.dynamicRmInput?nt(n,t):null)??(i?av(n,t):null)}if(o==="find")return Yo(G(e),{...t,derivedCommandWorkBudget:t.derivedCommandWorkBudget,analyzeTokens:(i,s)=>_t(i,{...t,cwd:s??void 0,derivedCommandWorkBudget:t.derivedCommandWorkBudget},n)})??ne(e,t.policy?.rules??[])??nt(n,t);if(o==="git")return k(bn(G(e),{env:t.environment.env,cwd:t.cwd,envAssignments:t.envAssignments,policy:t.policy,worktreeMode:n.dynamicInput?!1:t.worktreeMode}),t.policy)??ne(e,t.policy?.rules??[])??nt(n,t);return ne(e,t.policy?.rules??[])??nt(n,t)}function xn(e,t){return e.shellDynamicMatch?k(e.shellDynamicMatch,t.policy):null}function nt(e,t){return e.dynamicSourceInput&&e.dynamicSourceMatch?k(e.dynamicSourceMatch,t.policy):null}function av(e,t){return e.dynamicInput&&e.rmDynamicMatch?k(e.rmDynamicMatch,t.policy):null}var Qs="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ea="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",lv="__CC_SAFETY_NET_XARGS_INPUT__",ei="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ti="rm",cv=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,uv=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,dv=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,mv=/^(?:[0-9]+|[@*])$/;function dd(e,t){let n=e.map(I),{childStart:r,replacementToken:o}=Ht(n),i=n.slice(r),s=b("xargs.shell-dynamic",ea);if(pv(i,o,t)&&k(s,t.policy))return k(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?k(s,t.policy):null;if(c)return c;let u=gd(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&fd(l,o),f=_t(l,{...t,cwd:a.cwd,envAssignments:a.envAssignments},{dynamicInput:u,dynamicSourceInput:m||md(l,a.head,o,a.wrapperEnvAssignments,u,t.scanWork,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",Qs)});if(f)return f;let d=fv(l,o,t.policy?.rules??[]);if(d)return d;if(a.head==="git"){let g=o===null?[...l,lv]:l,y=o!==null&&(l.some((R)=>R.includes(o))||Array.from(a.envAssignments.values()).some((R)=>R.includes(o))),h=_t(g,{...t,cwd:a.cwd,envAssignments:a.envAssignments,worktreeMode:o===null||y?!1:t.worktreeMode});if(h)return h}let p=ne(l,t.policy?.rules??[]);if(p)return p}return null}function fv(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ne([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>ta(s,t,i)):[])));for(let o of r){let i=ne(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function ta(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function md(e,t,n,r,o,i,s){if(ee.has(t)){if(ke(e))return!1;if(n!==null&&gv(e,n))return!0;let a=Qe(e);if(!a){let l=tt(G(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(mt(a,i))return!0;return hv(a,n,r)}if(ye(t))return cd(e,n,io,ql(t));if(ve.has(t))return cd(e,n,Ms,wu);if(t==="eval"){let a=vn(G(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return yv(e,n,i,s);if(t==="git"){let a=He(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Cn.has(a.subcommand.toLowerCase())&&pd(a.rest,n).some((l)=>l.includes(n))}return!1}function cd(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ei]).sources.some((l)=>l.value===ei);if(o.sources.some((l)=>l.value.includes(t)))return!0;let i=new Set(o.sources.map((l)=>`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)),s=r.flatMap((l)=>[l.selector,...l.valueForm==="attached-only"||l.valueForm==="attached-or-separate"?[`${l.selector}${ei}`]:[],...l.valueForm==="equals-or-separate"?[`${l.selector}=${ei}`]:[]]),a=new Set(s.flatMap((l)=>e.flatMap((c)=>ta(c,t,l))));return Array.from(a).some((l)=>n(e.map((c)=>c.replaceAll(t,l))).sources.some((c)=>!i.has(`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)))}function pv(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,ti]:e.map((i,s)=>s===0?i:i.replaceAll(t,ti));return Array.from(Be(o,n)).some((i)=>i.head===ti&&!r.has(ti))}function fd(e,t){return pd(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function pd(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function gd(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function gv(e,t){let n=et(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return ta(i,t,o).some((l)=>{let c=e.map((m,f)=>f===s?m.replaceAll(t,l):m),u=et(c);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(n.commandIndex===null&&u.commandIndex!==null)return!0;if(n.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(c[u.commandIndex]??"").includes(l))return!0;return u.scriptIndex!==null&&(c[u.scriptIndex]??"").includes(l)})}))}function hv(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(cv))if(ud(o,r))return!0;for(let o of e.matchAll(uv))for(let i of(o[1]??"").matchAll(dv))if(ud(i,r))return!0;return Js(e,r)}function ud(e,t){let n=e[1]??e[2];return n!==void 0&&(mv.test(n)||t.has(n))}function yv(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(pt(a)){let c=ar(e,s);s=c.nextIndex-1;for(let u of Be(c.tokens,{environment:r,cwd:void 0})){let m=gd(u.tokens,t,u.wrapperEnvAssignments);if(u.head==="rm"&&fd(u.tokens,t)||md(u.tokens,u.head,t,u.wrapperEnvAssignments,m,n,r))return!0}continue}let l=Et(a);if(l>0){if(i=l,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function Ht(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(o.startsWith("-")){if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}if(t.has(o))r+=2;else r++}else return{childStart:r,replacementToken:n}}return{childStart:e.length,replacementToken:n}}var fr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",pr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",bv="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Sv="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",vv=/\{[^{}\s]*\}/,xd=/\{\}|\{-?\d+\}/g,Rv=["e","f","source","file","-e","-f","--source","--file"],xv=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Ev=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),wv=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),hd=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Pv=new Set(["--workdir","--wd"]),yd="__CC_SAFETY_NET_PARALLEL_SOURCE__",_v=new TextEncoder,ra=B.maxDerivedBytes+4*B.maxPlaceholderReplacements;function fe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Ed(e,t){return fe([...e],(n)=>mt(n,t.scanWork))}function wd(e,t){let n=e.map(I);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Vt(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Dd(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=Vt(t);if(p)return p;let g=Ed(t.envAssignments?.values()??[],t);if(g)return g}if(l){let p=Lv(t);if(p)return p}if(u!==void 0&&a){let p=Vt(t);if(p)return p}let f=Gv(u,t.cwd,t.environment.paths);if(f===null){let p=Vt(t);if(p)return p}let d=a?{...t,cwd:void 0,originalCwd:void 0}:f===null||f===void 0||f===t.cwd?t:{...t,cwd:f};if(m){if([...Be(i,d)].flatMap((g)=>[...g.envAssignments.values()]).some(aa)){let g=Vt(t);if(g)return g}return null}if(i.length===0){if(s.some((y)=>y.length!==1)){let y=Vt(t);if(y)return y}let p=s.map((y)=>y[0]??"");Ce(t.budget,oa(p));let g=Td(d.envAssignments,d.cwd,a);return fe(p,(y)=>t.analyzeNested(y,g))}return fe(Be(i,d),(p)=>Av(p,o,t,d))}function Av(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c={...r,cwd:e.cwd,envAssignments:e.envAssignments},u=[...e.envAssignments.values()];if(u.some(Od)){let h=Vt(n);if(h)return h}let m=Ed(u,n);if(m)return m;let f=u.some(j),d=i||f,p=a&&d,g=Td(e.envAssignments,e.wrapperCwd,s||p);if(ee.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ce(n.budget,ni(l,o,"generic")),fe(o,(A)=>_t(l.map((P)=>At(P,A)),c))};if(ke(l))return h();let R=Qe(l);if(R){if(Md(R)){let C=jt(n);if(C)return C;if(o.length===0)return null;return Ce(n.budget,Rd(R,o)),fe(o,(_)=>n.analyzeNested(At(R,_),g))}if(j(R)){if(o.length>0)return Ce(n.budget,Rd(R,o)),fe(o,(E)=>n.analyzeNested(At(R,E),g));Ce(n.budget,Sd(R));let C=lr(R);if(C?.[0]&&z(C[0])==="rm"&&Ue(C)){let E=bd(n);if(E)return E}let _=C?_t(C,c,{dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",pr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",fr)}):null;if(_)return _;return n.analyzeNested(R,g)}let A=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((C)=>Jo(G(C===void 0?l:i?l.map((_)=>At(_,C)):[...l,...C]),R)):[];if(A.some((C)=>C.kind==="dynamic")){let C=jt(n);if(C)return C}let P=A.flatMap((C)=>C.kind==="literal"?[C.source]:[]);if(P.length>0)return Ce(n.budget,oa(P)),fe(P,(C)=>n.analyzeNested(C,g));if(Ce(n.budget,Sd(R)),Rn(R)){let C=jt(n);if(C)return C}let S=n.analyzeNested(R,g);if(S)return S;if(d)return jt(n);return null}let x=tt(G(l));if(x.kind==="dynamic"||x.kind==="literal"&&j(x.source))return jt(n)??h();if(x.kind==="literal")return h();if(o.length>0){let A=jt(n);if(A)return A;let P=h();if(P)return P;if(i)return null;let S=o.flatMap((C)=>C[0]===void 0?[]:[C[0]]);return Ce(n.budget,oa(S)),fe(S,(C)=>n.analyzeNested(C,g))}if(d||a)return jt(n)??h();return null}if(e.head==="rm"&&Ue(l)){if(i&&o.length>0)return Ce(n.budget,ni(l,o,"rm")),fe(o,(R)=>na(l.map((x)=>ia(x,R)),e.cwd,r));if(o.length>0)return Ce(n.budget,vd(l,o)),fe(o,(R)=>na([...l,...R],e.cwd,r));let h=na(l.flatMap((R,x)=>{if(x===0||!j(R))return[R];return R.startsWith("-")?[ia(R,[""])]:[]}),e.cwd,r);if(h)return h;return bd(n)}Ce(n.budget,i&&o.length>0?ni(l,o,"generic"):o.length>0?vd(l,o):kd(l));let y=o.length>0?o:[void 0];return fe(y,(h)=>{let R=h===void 0?l:i?l.map((T)=>At(T,h)):[...l,...h],x=b("parallel.shell-dynamic",pr),A=a&&e.head==="find"?Dv(R,r):null,P=_d(R,a,n.policy?.rules??[],n.budget)??A?.customResult??null,S=z(e.head),C=a&&(S==="rm"&&sa(R)||S==="xargs"&&Ad(R)||A?.rmOptions===!0),_=a&&(C||A?.executedSource===!0||A===null&&Pd(R,S)),E=_t(R,{...c,worktreeMode:s||a||d?!1:n.worktreeMode},{dynamicInput:a||d,dynamicRmInput:C,dynamicSourceInput:P!==null||_,shellDynamicMatch:x,dynamicSourceMatch:x,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",fr)});if(_){let T=k(x,n.policy);if(T)return T}return E??P??ne(R,n.policy?.rules??[])})}function Pd(e,t){if(j(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(ee.has(t))return Iv(e);if(t==="git")return kv(e);if(t==="find")return!0;if(ve.has(t))return Cd(e,Rv,sr);if(ye(t))return Cd(e,xv,oo);return!1}function sa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(j))return t===-1;return n.some((o)=>j(o)&&(o.startsWith("-")||Md(o)))}function kv(e){if(Tv(e))return!0;let t=He(e);if(t.subcommand===null||j(t.subcommand))return!0;if(!Cn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(j))return n===-1;return r.some(j)}function Tv(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(j(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(j(n))return!0;continue}if(j(n))return!0}return!1}function Iv(e){if(ke(e))return!1;let t=Qe(e);if(t!==null)return j(t);let n=tt(G(e));if(n.kind==="literal")return j(n.source);if(n.kind==="dynamic")return!0;return!e.some(j)}function Cd(e,t,n){let r=n(e);if(r.some((i)=>j(i.value)))return!0;if(!e.some(j))return n([...e,yd]).some((i)=>i.value===yd);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>At(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function _d(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>z(s.command)===z(e[0]??""));if(o.length===0)return null;let i=e.some(j);if(Ce(r,Ov(e,o,i)),!i)return fe(o,(s)=>ne([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return fe(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((l)=>l?Mv(e,l):[]));return fe(a,(l)=>ne(e.map((c)=>At(c,[l])),[s]))})}function Ov(e,t,n){let r=n?qt(Te(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),B.maxChildAnalyses),2*Math.max(e.length,1),B.maxChildAnalyses):t.length;return{childAnalyses:r,derivedTokens:qt(r,e.length,B.maxDerivedTokens)}}function Mv(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function Dv(e,t){let n={customResult:null,executedSource:!e.some(j),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(j))return;for(let a of Be(i,t))n.executedSource||=Pd(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&sa(a.tokens)||a.head==="xargs"&&Ad(a.tokens),n.customResult??=_d(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=j(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(pt(a)){i=[],n.executedSource||=j(a);continue}let l=Et(a);if(l>0){o=l,n.executedSource||=j(a);continue}n.executedSource||=j(a)}return s(),n}function Ad(e){let t=e.slice(Ht(e).childStart);return z(t[0]??"")==="rm"&&sa(t)}function ri(e,t){return(n)=>k(b(e,t),n.policy)}var jt=ri("parallel.shell-dynamic",pr),Lv=ri("parallel.command-stream-dynamic",bv),Vt=ri("parallel.command-stream-dynamic",Sv),bd=ri("parallel.rm-recursive-force-dynamic",fr);function na(e,t,n){return k(Sn(G(e),{environment:n.environment,cwd:t,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(n.envAssignments??new Map,n.environment),trustedTmpdirValue:ft(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function oa(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:gr(e)}}function Sd(e){return kd([e])}function kd(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:gr(e)}}function vd(e,t){if(t.length>B.maxChildAnalyses)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Te(t.map((n)=>e.length+n.length),B.maxDerivedTokens),derivedBytes:Te([qt(gr(e),t.length,B.maxDerivedBytes),Te(t.map((n)=>gr(n)),B.maxDerivedBytes)],B.maxDerivedBytes)}}function Rd(e,t){return ni([e],t,"generic")}function ni(e,t,n){if(t.length>B.maxChildAnalyses)return{childAnalyses:t.length};let r=qt(e.length,t.length,B.maxDerivedTokens);if(r>B.maxDerivedTokens)return{childAnalyses:t.length,derivedTokens:r};let o=Fv(e.map((l)=>Wv(l,n))),i=qt(o.occurrences,t.length,B.maxPlaceholderReplacements);if(i>B.maxPlaceholderReplacements)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(Nv(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:B.maxDerivedBytes+1,placeholderReplacements:i};let s=n==="generic"?At:ia,a=Te(t.map((l)=>gr(e.map((c)=>s(c,l)))),B.maxDerivedBytes);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function Nv(e,t,n){let r=B.maxDerivedBytes+4*n;return Te([qt(e.fixedBytes,t.length,r),qt(e.occurrences,Te(t.map((o)=>o.reduce((i,s)=>Math.max(i,mr(s)),0)),r),r)],r)>r}function Wv(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(xd),r=0,o=0,i=0;for(let s of n){if(r>=B.maxPlaceholderReplacements)return{occurrences:B.maxPlaceholderReplacements+1,fixedBytes:0};o=Te([o,mr(e.slice(i,s.index))],ra),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?mr(e):Te([o,mr(e.slice(i))],ra)}}function Fv(e){return{occurrences:Te(e.map((t)=>t.occurrences),B.maxPlaceholderReplacements),fixedBytes:Te(e.map((t)=>t.fixedBytes),ra)}}function gr(e,t=B.maxDerivedBytes){return Te(e.map(mr),t)}function mr(e){return _v.encode(e).byteLength}function Te(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function qt(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function Td(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function At(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>Id(n,t))}function ia(e,t){return e.replace(xd,(n)=>Id(n,t))}function Id(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function j(e){return vv.test(e)}function Od(e){if(aa(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function aa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Md(e){return/^\{[^{}\s]*\}$/.test(e)}function Dd(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let x=Ns(e,t+1);n.push(...x.templateTokens),r=t+1,o=x.markerIndex;break}if(!p.startsWith("-")){let x=Ns(e,t);n.push(...x.templateTokens),r=t,o=x.markerIndex;break}let g=e[t+1],y=p.indexOf("="),h=y===-1?p:p.slice(0,y),R=y===-1?void 0:p.slice(y+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(h==="--replace"||p.startsWith("-i")&&p.length>2){let x=h==="--replace"?R:p.slice(2);c||=x!==""&&x!=="{}",t++;continue}if(p==="-a"||wv.has(h)){c=!0,t+=R===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(h==="--env"){c=!0,t+=R===void 0?2:1;continue}if(hd.has(h)||p.startsWith("-S")&&p.length>2){i=!0,t+=hd.has(p)?2:1;continue}if(Pv.has(h)){let x=R??g;if(x===void 0||x===":::"||x==="--"){c=!0,t++;continue}l=x,c||=R!==void 0&&x==="",t+=R===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&R!==void 0){t++;continue}if(Ev.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(a?aa:Od);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let y=e[g];if(y===":::"){u.push(p),p=[];continue}if(y!==void 0)p.push(y)}u.push(p)}let m=zv(u),f=n.some(j),d=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:f,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:d,unsupported:c,workdir:l,dryRun:a}}function Gv(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!Cv(e))return null;try{return bt(t??e,e,n)}catch{return null}}function zv(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>B.maxChildAnalyses)return r;t=r}return t}function Ld(e){return Dd(e).childStart}var $v="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",oi="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function ca(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function la(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Wd(e,t,n,r,o=!1,i){let a=(Yn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&Q(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",$v):null;return k(a,i)??Fd(e,t,n,o,i)}function Fd(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>ca(a)?[l]:[]);if(i.length===0)return null;let s=z(t[0]?.text??"");if(s==="git"){let a=rn(e,t),l=Uv(a);if(Q(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return k(b("shell.dynamic-structure",oi),o);if(k(bn(a,{env:n.env}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,f)=>f>l&&I(m)==="--");if(Q(o,"shell.dynamic-structure",r)&&c&&Cn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return k(b("shell.dynamic-structure",oi),o);return null}if(s==="find")return Q(o,"shell.dynamic-structure",r)&&Hv(t)?k(b("shell.dynamic-structure",oi),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&I(c)==="--"),l=Ue(t.map(I));return Q(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?k(b("shell.dynamic-structure",oi),o):null}if(s==="xargs")return Nd(e,t.slice(Ht(t.map(I)).childStart),"xargs",n,r,o);if(s==="parallel")return Nd(e,t.slice(Ld(t.map(I))),"parallel",n,r,o);return null}function Nd(e,t,n,r,o,i){if(t.length===0)return null;let s=Bv(t,r);if(Yn(e,s)){let l=k(b(`${n}.shell-dynamic`,n==="xargs"?ea:pr),i);if(l)return l}let a=Fd(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>ca(l)&&la(l)))return k(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Qs:fr),i);return null}function Bv(e,t){let n=Nt(e,t),r=n.rewritten?G(n.words.map(I)):n.words,o=r[0];return o&&I(o)==="busybox"?r.slice(1):r}function Uv(e){let t=1;while(t<e.length){let n=e[t],r=n?I(n):"";if(Ye.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function Hv(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=ca(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||la(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||la(s)))return!0;continue}if(t=!0,a)return!0;let l=Et(s.text);if(l>0){n=l;continue}if(pt(s.text))o=!0,r=!0}return!1}function ua(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Fr(t[n.tokenIndex],n.value)})}var jv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Vv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",qv="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Gd(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",jv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",Vv);if(e==="shred"&&n.length>0)return b("shred.target",qv);return null}var $d=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Sn(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(e.envAssignments,e.options.environment),trustedTmpdirValue:ft(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy})},{heads:new Set(["git"]),analyze:(e)=>bn(e.words,da(e))},{heads:new Set(["find"]),analyze:(e)=>Yo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ze(e.envAssignments,e.options.environment),trustedTmpdirValue:ft(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>dd(e.words,{...zd(e),analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>wd(e.words,{...zd(e),budget:e.options.parallelBudget,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})}];function zd(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,derivedCommandWorkBudget:e.options.derivedCommandWorkBudget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function Kt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function da(e){return{env:e.options.environment.env,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var jd="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function Vd(e){return $d.find((t)=>t.heads.has(e))?.analyze}function hr(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(w)=>w.map((N)=>o==="posix"?I(N):N.text),s=n.effectiveCwd===null,a=s?void 0:n.effectiveCwd??n.cwd,l=s?void 0:n.cwd,c=fo(e);if(c.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...c.envAssignments.keys()],output:i(c.words)});let u=Nt(c.words,n.environment,a,new Map([...n.envAssignments??[],...c.envAssignments])),m=u.envSplitValues??[];if(m.length>0){let w=[...m,...i(u.words)].join(" "),N=mt(w,n.scanWork);if(N)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:N.reason}),rt(N);if(n.strict)return Re(r);let Z=po(m,i(u.words));if(Z){Le(n.derivedCommandWorkBudget,Z.length);let J=n.analyzeNested(Z.join(" "),{effectiveCwd:u.cwd===void 0?n.effectiveCwd:u.cwd,envAssignments:new Map([...n.envAssignments??[],...c.envAssignments,...u.envAssignments])});if(J)return J}}let f=u.rewritten?G(i(u.words)):rn(o,u.words),d=i(f),p={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&c.words.length>f.length){let w=i(c.words);r.recordSegment({type:"leading-tokens-stripped",input:w,removed:w.slice(0,w.length-f.length),output:d})}let g=new Map([...n.envAssignments??[],...c.envAssignments,...u.envAssignments]),y=d[0];if(!y)return null;if($t(y))throw new he;let h=z(y),R=u.cwd===null?void 0:u.cwd??a,x=u.cwd===null?void 0:l,A=u.cwd===void 0?n.effectiveCwd:u.cwd,P=!jn(g,n.environment),S=Wd(o,u.words,n.environment,t===0,n.strict,n.policy);if(S)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:S.reason}),rt(S);let C=qo(d,n.policy);if(C){for(let w of[C.childIndex,...C.alternativeChildIndices]){Bd(p.wrapperNormalizationBudget);let N=f.slice(w);r?.recordSegment({type:"transparent-wrapper",wrapper:C.wrapper,output:i(N)});let Z=hr(N,t,{...p,effectiveCwd:A,envAssignments:g});if(Z)return Z}return null}let _=h==="eval"?vn(f):h==="trap"?od(f):void 0;if(_?.kind==="dynamic"&&(n.strict||!n.commandView||!Xs(n.commandView)))return Re(r);if(_?.kind==="literal"){r?.recordSegment({type:"recurse",reason:h==="eval"?"shell-eval":"shell-trap",innerCommand:_.source,depth:t+1});let w=n.analyzeNested(_.source,{effectiveCwd:A,envAssignments:g,functionDefinitions:n.functionDefinitions});if(w)return w}if(Kd(y,h)){if(ke(d))return null;let w=Kv(d,g,A,n,r,t);if(w)return w;let N=Qe(d);if(N){let nn=Jo(f,N);if(nn.kind==="dynamic")return Re(r);let Ni=nn.kind==="literal"?nn.source:N,sl=Yv(Ni);r?.recordSegment({type:"shell-wrapper",wrapper:h,innerCommand:sl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:sl,depth:t+1});let al=n.analyzeNested(Ni,{effectiveCwd:A,envAssignments:g});if(al)return al;return Rn(Ni)?Re(r):null}let Z=tt(f);if(Z.kind==="dynamic")return Re(r);if(Z.kind==="literal")return ai(Z.source,A,g,n,r,t);let J=id(f,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(J.kind==="dynamic")return Re(r);if(J.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:J.source,depth:t+1}),n.analyzeNested(J.source,{effectiveCwd:A,envAssignments:g})}if(h==="source"||h==="."){let w=d[1]==="-p"?2:null;if(w!==null){let nn=n.commandView?f[w]:void 0;if(!nn)return null;if(nn.provenance!=="literal")return Re(r)}let N=w===null?1:3,Z=d[N]==="--"?N+1:N,J=n.commandView?f[Z]:void 0;if(!J)return null;if(J.provenance==="literal")return ai(J.text,A,g,n,r,t);if(n.strict||!n.commandView||!Xs(n.commandView))return Re(r)}if(ve.has(h)){if(n.strict&&ua(sr(d),f))return Re(r);let w=Vo(d,(Z)=>Kt(n.analyzeNested(Z,{effectiveCwd:A,envAssignments:g}))),N=k(w,n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:N.reason}),rt(N)}if(ye(h)){if(n.strict&&ua(oo(d),f))return Re(r);let w=ro(d);if(w){let N=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:h,codeArg:w,paranoidBlocked:N}),N){let J=k(b("interpreter.one-liner-paranoid",un),n.policy);if(J)return rt(J)}if(so(h,w))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:w,depth:t+1});let Z=n.analyzeNested(w,{effectiveCwd:A,envAssignments:g});if(Z&&Z.ruleId!=="raw-text.dangerous-command"&&(Z.reason!==St||hn(w)))return Z;if(dn(w,n.scanWork)){let J=k(b("interpreter.dangerous-command",Lt),n.policy);if(J)return r?.recordSegment({type:"dangerous-text",token:w,matched:!0,reason:Lt}),rt(J)}r=void 0}}if(h==="busybox"&&d.length>1)return Bd(p.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:d[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:d.slice(1).join(" "),depth:t+1}),hr(f.slice(1),t,{...p,effectiveCwd:A,envAssignments:g});let E=k(Gd(h,d),n.policy);if(E)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:E.reason}),rt(E);let T=r===p.trace?p:{...p,trace:r},O={words:f,head:h,cwd:R,originalCwd:x,envAssignments:g,allowTmpdirVar:P,dynamicArguments:u.words.some((w)=>w.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:T,analyzeChildTokens:(w,N)=>Kt(hr(G(w),t+1,{...T,commandView:void 0,effectiveCwd:N,envAssignments:g}))??ne(w,T.policy.rules)},M=Vd(h);if(h==="rm"||h==="xargs"||h==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:g.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!P,allowTmpdirVar:P});let F=r&&h==="git"?qu(O.words,da(O)):void 0,oe=Ud(F?F.match:M?.(O)??null,n.policy);if(r)Zv(O,oe,F?.relaxation??null);if(oe)return rt(oe);let Ee=M!==void 0;if(!Ee)if(!to.has(h)){let w=r?[]:void 0;for(let N=1;N<d.length;N++){let Z=d[N];if(!Z)continue;w?.push(Z);let J=Ud(Xv(O,d,N),n.policy);if(J)return r?.recordSegment({type:"fallback-scan",tokensScanned:w??[],embeddedCommandFound:z(Z)}),rt(J)}r?.recordSegment({type:"fallback-scan",tokensScanned:w??[]})}else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});else r?.recordSegment({type:"fallback-scan",tokensScanned:[]});if(t===0||!Ee){let w=ne(d,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!w,reason:w?.reason}),w)return rt(w)}else r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1});return null}function Kv(e,t,n,r,o,i){let s=Qu(e);if(s.argvSource?.kind==="absent")return Re(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Re(o);let a=Hn(e,t,r.environment.paths),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Re(o):null;return Le(r.derivedCommandWorkBudget,1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function Yv(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function Zv(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Bd(e){if(e.iterations>=ln)throw new he;e.iterations++}function rt(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Re(e){return e?.recordSegment({type:"error",message:jd}),rt(qd())}function qd(){return{id:"",reason:jd,intent:"stop_and_explain"}}function Kd(e,t){return ee.has(t)||e==="$SHELL"||e==="${SHELL}"||ee.has(D(t))}function Xv(e,t,n){let r=Be(t.slice(n),{environment:e.options.environment,cwd:e.cwd,envAssignments:e.envAssignments,policy:e.options.policy});for(let o of r){let i=Jv(e,n,o);if(i)return i}return null}function Jv(e,t,n){let r=n.tokens[0];if(!r)return null;let o=z(r);if(Kd(r,o)){Le(e.options.derivedCommandWorkBudget,e.words.length-t);let l=n.tokens;if(ke(l))return null;let c=Qe(l);if(!c){if(tt(G(l)).kind==="dynamic")return qd();return si(e,n)}let u=e.options.analyzeNested(c,{effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,envAssignments:n.envAssignments});return u?Kt(u):si(e,n)}let i=Vd(o);if(!i||o==="xargs"||o==="parallel"){if(n.wrappedByTransparent&&e.options.policy.rules.length>0)Le(e.options.derivedCommandWorkBudget,e.words.length-t);return si(e,n)}Le(e.options.derivedCommandWorkBudget,e.words.length-t);let s=[o,...n.tokens.slice(1)],a={...e,words:G(s),head:o,cwd:n.cwd,originalCwd:n.wrapperCwd===null?void 0:e.originalCwd,envAssignments:n.envAssignments,allowTmpdirVar:!jn(n.envAssignments,e.options.environment),effectiveCwd:n.wrapperCwd===void 0?e.effectiveCwd:n.wrapperCwd,options:o==="git"?{...e.options,worktreeMode:!1}:e.options};return i(a)??si(e,n)}function si(e,t){return t.wrappedByTransparent?ne(t.tokens,e.options.policy.rules):null}function Ud(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:k(e,t)}var Qv=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,eR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function tR(e,t){let n=Xd(e,t);if(n.length===0)return!1;let r=n[Zd(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return Qv.test(e.join(" "))}function Yd(e,t,n,r){if(e.dialect==="powershell"){let a=nR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Hd(sR(a.target),t,n.paths)}let o=e.words.map(I);if(!tR(o,n))return;if(!t)return null;let i=Xd(o,n,t),s=Zd(i);if(s===-1||i[s]!=="cd")return null;return Hd(i[s+1],t,n.paths)}function Hd(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return aR(bt(t,e,n),t,n)?t:null}catch{return null}}function nR(e,t){let n=rR(e[0])?1:0,r=e[n];if(!oR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!eR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return iR(e.slice(n+1),t)}function rR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function oR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function iR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function sR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Zd(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Xd(e,t,n){let r=lR(e);return fn([...r],t,n)}function aR(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ii(e)===ii(t);return ii(r)===ii(o)}function lR(e){let t=0;while(t<e.length){let n=e[t];if(n==="{"||n==="("||n==="$(")t++;else break}return e.slice(t)}var fa="TMPDIR",pa="IFS",Jd=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Qd=/^[A-Za-z_][A-Za-z0-9_]*$/,em=new Set(["export","typeset","declare","readonly"]),cR=new Set(["builtin","command","time"]);function tm(e,t){return{env:e,effectiveEnvAssignments:pR(e,t),shellAssignments:new Map}}function nm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function ga(e,t){let n=om(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),ha(t,s)});let r=n.commandIndex;if(r!==-1&&em.has(e[r]??""))e.filter((s)=>Qd.test(s)&&ma(s)).forEach((s)=>{gR(t,s)});let o=r===-1?-1:im(e,r);if(o===-1||e[o]!=="unset")return;let i=yR(e,o);if(i===null)return;e.slice(i).forEach((s)=>{hR(t,s)})}function rm(e,t){let n=om(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function om(e,t){let n=e.findIndex((s)=>!uR(s)),r=n!==-1&&em.has(e[im(e,n)]??""),o=fR(t);return{assignments:e.flatMap((s,a)=>{let l=dR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Gi(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function im(e,t){let n=t;while(cR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function uR(e){return _e(e)!==null||Jd.test(e)}function dR(e,t,n){return _e(e)??mR(e,t,n)}function mR(e,t,n){let r=$r(e,n,t);if(r)return r;let o=e.match(Jd)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function ma(e){return e===fa||e===pa||zi(e)}function fR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function pR(e,t){let n=[...Gr,fa,pa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ha(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function gR(e,t){ha(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function hR(e,t){if(!ma(t)&&!Qd.test(t))return;if(e.shellAssignments.set(t,""),!ma(t)||t===fa||t===pa||Wn(t)){ha(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function yR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var CR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Yt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.",bR=64;function va(e,t,n,r){let o=n.derivedCommandWorkBudget===void 0,i=n.parallelBudget===void 0;try{return SR(e,t,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget??Zr(),parallelBudget:n.parallelBudget??Yl()},r)}catch(s){let a=s instanceof he&&o?Gl:s instanceof co&&i?Kl:void 0;if(!a)throw s;if(n.trace?.currentSegmentIndex!==void 0)n.trace.recordSegment({type:"error",message:a});else n.trace?.recordGlobal({type:"error",message:a});return{reason:a,segment:e,intent:"stop_and_explain"}}}function SR(e,t,n,r){if(t>=eo)return n.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Fe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:lt}),{reason:lt,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Sa(e,n);let u=`Unsupported heredoc syntax: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return dm(e,n),{reason:St,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return dm(e,n),{reason:St,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote"))&&!n.analyzePartialProgram)return Sa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=tm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ui(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,f=vR(e,l,c,a,m),d=a==="&&"||a==="||",p=d?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],h=a==="&&"?p?.failure??[]:[],R=d||En(m);if(c.kind==="function"){let E=g.flatMap((O)=>{let M=yr(O);return M.functionDefinitions.set(c.name,c.body),ya(O,[M],f,m==="&",En(m))}),T=Ca(E,[],y,h,a,m);i=T.states,s=T.conditionalStates,a=void 0;continue}if(c.kind==="group"){let E=[],T=[];for(let M of g){let F=ui(c.body,t,n,r,[yr(M)]);if(F.result)return F;if(E.push(...ya(M,F.states,f,m==="&",En(m))),R)T.push(M,...f?F.states.map((oe)=>li(M,oe)):F.states)}let O=Ca(E,T,y,h,a,m);i=O.states,s=O.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let x=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),A=e.nodes[l-2],P=di(a)&&A?.kind==="command"?rd(A)??xR(A):void 0,S=[],C=[];for(let E of g){let T=ER(c,t,n,r,[yr(E)]);if(T.result)return{result:T.result,states:i};let O=e.dialect==="powershell"?T.states:T.states.map((M)=>li(E,M));for(let M of O){let F=yr(M),oe=_R(c,t,n.trace?{...n,trace:mm(n.trace,x)}:n,r,F,di(a),P);if(oe)return{result:oe,states:i};let Ee=zR(c,F.functionDefinitions);if(Ee)Le(n.derivedCommandWorkBudget,mi(Ee));let w=Ee?t+1>=eo?ba(c.displayText,n,[F]):ui(Ee,t+1,n,r,[F]):{result:null,states:[F]};if(w.result)return w;if(S.push(...ya(E,w.states,f,m==="&",En(m))),R)C.push(E),C.push(...w.states.map((N)=>f?li(E,N):N))}}let _=Ca(S,C,y,h,a,m);i=_.states,s=_.conditionalStates,a=void 0}return{result:null,states:i}}function vR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(di(r)||di(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&RR(e,t)}function ya(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>Cr(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function RR(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(wR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function di(e){return e==="|"||e==="|&"}function xR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function Ca(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function mm(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function ER(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=PR(e);if(s){if(t+1>=eo)return ba(s,n,o);let a=Fe(s,"powershell");if(a.status==="limited")return ba(s,n,o);if(a.status!=="complete")return sm(i,n,r,o);Le(n.derivedCommandWorkBudget,mi(a)),i.push({program:a,depth:t+1})}}return sm(i,n,r,o)}function wR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function sm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[yr(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function PR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function mi(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+mi(o),0):n.kind==="group"||n.kind==="function"?mi(n.body):0),0)}function ba(e,t,n){return t.trace?.recordSegment({type:"error",message:lt}),{result:{reason:lt,segment:e,intent:"stop_and_explain"},states:[...n]}}function _R(e,t,n,r,o,i,s){let a=DR(e);if(a&&n.strict)return n.trace?.recordSegment({type:"error",message:a}),{reason:a,segment:e.source,intent:"stop_and_explain"};fm(e,o,"before-consumer",n.environment.paths);let l=rn(e.dialect,e.words).map(I),c=e.displayText,u=rm(l,o.shellGitContextState);if(e.dialect==="powershell"){let d=k(xu(e,i,BR(n,o.effectiveCwd)),n.policy);if(n.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!d,reason:d?.reason}),d)return $R(c,d)}if(l.length===1&&l[0]?.includes(" ")&&!Yn(e.dialect,e.words)){let d=k(mt(l[0],n.scanWork),n.policy),p=d!==null&&!n.strict&&Nl(e,n.rootProgram,n.scanWork);if(d&&!p)return n.trace?.recordSegment({type:"dangerous-text",token:l[0],matched:!0,reason:d.reason}),{reason:d.reason,segment:c,ruleId:d.id,intent:d.intent};n.trace?.recordSegment({type:"dangerous-text",token:l[0],matched:!1});let g=am(e,a,o,u,s,n);if(g)return g;return ga(l,o.shellGitContextState),null}let m=hr(e.words,t,{...n,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(d,p)=>{let g=p&&Object.hasOwn(p,"effectiveCwd")?p.effectiveCwd:o.effectiveCwd,y=va(d,t+1,{...n,derivedCommandWorkBudget:n.derivedCommandWorkBudget,effectiveCwd:g,envAssignments:p?.envAssignments??u,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:p?.functionDefinitions,worktreeMode:p?.worktreeMode??n.worktreeMode,trace:n.trace?mm(n.trace,n.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(m)return{...m,segment:c};let f=am(e,a,o,u,s,n);if(f)return f;return ga(l,o.shellGitContextState),null}function am(e,t,n,r,o,i){let s=LR(e,t,n,r??new Map,i);if(s)return s;return fm(e,n,"after-consumer",i.environment.paths),n.literalHeredocFiles.clear(),TR(e,t,n,i.environment.paths),FR(e,n,o,i.environment,i.trace),null}var AR=new Set([">>","<>"]);function fm(e,t,n,r){for(let i of e.redirections){if(!(n==="before-consumer"?kR(i):AR.has(i.operator)))continue;lm(i.target,t,r)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let o=pm(e.words.slice(1));if(!o)return;for(let i of o.operands)lm(i,t,r)}function kR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function lm(e,t,n){let r=e?.provenance==="literal"?Hn(e.text,t.effectiveCwd,n):void 0;if(!r)return;t.literalHeredocFiles.delete(r)}function TR(e,t,n,r){if(t)return;let o=e.redirections.find((i)=>i.operator==="<<"||i.operator==="<<-")?.heredoc;if(!o||!fi(o))return;for(let i of IR(e)){let s=Hn(i.text,n.effectiveCwd,r);if(!s||!Ul(s))continue;if(!n.literalHeredocFiles.has(s)&&n.literalHeredocFiles.size>=Bl)throw new he;n.literalHeredocFiles.set(s,o.body)}}function IR(e){let t=MR(e.redirections)?.target,n=cm(t)?[t]:[];if(xe(e.words[0],"cat"))return OR(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=pm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(cm))return[];return[...r.operands,...n]}function OR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function MR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function pm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function cm(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function fi(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function DR(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Yt;let n=t[0];if(!n?.heredoc)return Yt;if(!fi(n.heredoc))return CR;if(n.fd!==void 0&&n.fd!==0)return Yt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Yt;let r=e.redirections.some((s)=>s!==n&&um(s.target));if(xe(e.words[0],"cat"))return r?Yt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(um)?Yt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return Yt}function um(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function LR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(WR(e,i,n,r,o))return null;let a=NR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Sa(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function NR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!fi(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!ye(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=k(b("interpreter.one-liner-paranoid",un),n.policy);if(c)return c}if(!dn(s,n.scanWork))return null;let l=k(b("interpreter.dangerous-command",Lt),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function WR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!fi(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Nt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(I),l=z(a[0]??"");if((s.envSplitValues?.length??0)>0||!ee.has(l)&&!ee.has(D(l)))return!1;return ke(a)}function FR(e,t,n,r,o){let i=Yd(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(I).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function yr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:nm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>GR(r,n)))t.push(n);if(t.length>bR)throw new he}return t}function GR(e,t){return e.effectiveCwd===t.effectiveCwd&&Cr(e.literalHeredocFiles,t.literalHeredocFiles)&&Cr(e.functionDefinitions,t.functionDefinitions)&&Cr(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Cr(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Cr(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function zR(e,t){let n=ko(e);return n===void 0?void 0:t.get(n)}function $R(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function BR(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy}}function Sa(e,t){let n=k(mt(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function dm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:St};if(t.trace?.currentSegmentIndex===void 0)t.trace?.recordGlobal(n);else t.trace.recordSegment(n)}var ie={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},pi=["standard","strict","paranoid"];function UR(e){return{failClosed:e==="strict"||e==="paranoid",paranoidRm:e==="paranoid",paranoidInterpreters:e==="paranoid"}}function HR(e,t){if(!t)return e;return pi.indexOf(t)>pi.indexOf(e)?t:e}function jR(){let e=xa(ie.level);if(e===void 0||e==="")return;if(pi.includes(e))return e;console.error(`CC Safety Net: ignored invalid ${ie.level.name}=${JSON.stringify(e.slice(0,40))}. Use ${pi.join(", ")}.`);return}function VR(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function JI(){return VR(xa(ie.auditScope))==="all"}function Ra(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function gi(e={}){let t=e.safety?.level??"standard",n=jR(),r=HR(t,n),o=UR(r),i={failClosed:r===t?"preset":"environment",paranoidRm:r===t?"preset":"environment",paranoidInterpreters:r===t?"preset":"environment"},s={failClosed:[`policy safety.level=${t}`],paranoidRm:[`policy safety.level=${t}`],paranoidInterpreters:[`policy safety.level=${t}`]};if(r!==t)s.failClosed.push(`env ${ie.level.name}=${n}`),s.paranoidRm.push(`env ${ie.level.name}=${n}`),s.paranoidInterpreters.push(`env ${ie.level.name}=${n}`);if(e.safety?.overrides?.failClosed!==void 0)o.failClosed=e.safety.overrides.failClosed,i.failClosed="capability_override",s.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)o.paranoidRm=e.safety.overrides.paranoidRm,i.paranoidRm="capability_override",s.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)o.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,i.paranoidInterpreters="capability_override",s.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(br(ie.strict))o.failClosed=!0,i.failClosed="environment",s.failClosed.push(`env ${ie.strict.name}`);if(br(ie.paranoid))o.paranoidRm=!0,o.paranoidInterpreters=!0,i.paranoidRm="environment",i.paranoidInterpreters="environment",s.paranoidRm.push(`env ${ie.paranoid.name}`),s.paranoidInterpreters.push(`env ${ie.paranoid.name}`);if(br(ie.paranoidRm))o.paranoidRm=!0,i.paranoidRm="environment",s.paranoidRm.push(`env ${ie.paranoidRm.name}`);if(br(ie.paranoidInterpreters))o.paranoidInterpreters=!0,i.paranoidInterpreters="environment",s.paranoidInterpreters.push(`env ${ie.paranoidInterpreters.name}`);let a=!!e.worktreeMode||br(ie.worktree);return{strict:o.failClosed,paranoidRm:o.paranoidRm,paranoidInterpreters:o.paranoidInterpreters,worktreeMode:a,effectiveLevel:Ra(o),capabilities:{fail_closed:{enabled:o.failClosed,source:i.failClosed,sources:s.failClosed},paranoid_rm:{enabled:o.paranoidRm,source:i.paranoidRm,sources:s.paranoidRm},paranoid_interpreters:{enabled:o.paranoidInterpreters,source:i.paranoidInterpreters,sources:s.paranoidInterpreters}}}}function br(e){let t=typeof e==="string"?Sr(e):xa(e);return t==="1"||t?.toLowerCase()==="true"}function Sr(e){return Object.hasOwn(process.env,e)?process.env[e]:void 0}function xa(e){let t=Sr(e.name);if(t!==void 0)return t;if(e.legacyName)return Sr(e.legacyName);return}function QI(e){return Sr(e.name)!==void 0||!!e.legacyName&&Sr(e.legacyName)!==void 0}function gm(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ea(t.fail_closed,e.strict,"strict"),paranoid_rm:Ea(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ea(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Dl(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ra({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ea(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function sO(e,t){return wa(e,t)}function wa(e,t,n,r){let o=va(e,0,{...t,...gm(t),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}import{basename as Zx,dirname as qa}from"node:path";import{chmodSync as zx,existsSync as ja,mkdirSync as $x,readFileSync as Va}from"node:fs";import{dirname as ff,join as Bx}from"node:path";import{createRequire as tx}from"node:module";var hm=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ym=30,Pa=1,_a=365;function Cm(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var vr=64,Sm="Rule config exceeds CC Safety Net's safe source limit.";var bm=Object.freeze({maxSources:64,concurrency:4,maxRequests:131,maxResponseBytes:67108864});function hi(e={}){return{requests:0,responseBytes:0,maxRequests:e.maxRequests??bm.maxRequests,maxResponseBytes:e.maxResponseBytes??bm.maxResponseBytes}}function yi(e){return{controller:new AbortController,budget:hi(),resolveUrl:e}}function vm(e){if(e.requests>=e.maxRequests)throw Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");e.requests++}function Rm(e,t){if(t>e.maxResponseBytes-e.responseBytes)throw e.responseBytes+=t,Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");e.responseBytes+=t}var Ie=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ci="rulebook.json",bi=".cc-safety-net/rules";var xm=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,qR=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,KR=/^[A-Za-z0-9._-]+$/,YR=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ZR="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Aa=new RegExp(`^${YR}/(${Ie.source.slice(1,-1)})/${ZR}$`);function Em(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Rr(e){if(Pn(e))try{return wn(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Ie.test(e)?null:`Local rulebook sources must be bare names matching ${Ie}: ${e}`}function wn(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(xm);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let[n,r,...o]=t[3].split("/");if(!n||!KR.test(n))throw Error(`GitHub rulebook refs must be a single path segment: ${e}`);if(!r||o.length>0||!Ie.test(r))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:n,path:Em(r),name:r}}function wm(e){return qR.test(e)}function Pn(e){return xm.test(e)}function ka(e){if(!Ie.test(e))throw Error(`Local rulebook sources must be bare names matching ${Ie}: ${e}`)}var Ta=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Si={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},XR=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],JR=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ia=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...JR.flatMap((e)=>XR.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var vi=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Pm=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],QR=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],Oa=Pm.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),Ma=Pm.flatMap((e)=>QR.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),xr={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Da=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),La=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],_m=[...Ta,Si,...Ia,...Oa,...Ma,xr,...Da,...La,...vi].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Am=new Set(vi.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ex=_m.map((e)=>e.id),Ri=new Set(ex);var nx=tx(import.meta.url),km,rx=Array(vr+1).fill("over-limit"),Tm=/^[^/]+\/[^/]+$/,ox=/^sha256:[a-f0-9]{64}$/,xi=`must be an integer between ${Pa} and ${_a}`,ix=["version","rules","overrides","transparent_wrappers"],sx=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Im(e){if(!Oe(e)||!Array.isArray(e.rules)||e.rules.length<=vr)return e;return{$schema:e.$schema,version:e.version,rules:rx,overrides:e.overrides,transparent_wrappers:e.transparent_wrappers}}function ax(){let e=nx("../vendor/zod.cjs"),t=(S)=>{let C=e.superRefine(S);return C._zod.def.when=()=>!0,C},n=e.enum(hm),r=e.union([e.literal("off"),e.looseObject({reason:e.string({error:"required non-empty string"}).min(1,"required non-empty string").max(cn,`must be at most ${cn} characters`).describe("Replacement block reason"),intent:n.optional()})],{error:'must be "off" or an object'}).describe("Disable a rule or replace its block reason and intent."),o=e.string({error:"must be a rulebook source string"}).min(1,"must be a non-empty rulebook source string"),i=e.string({error:"must be a command string"}).regex(Dt,"must match command pattern").describe("Command name such as 'git', 'docker', or 'rtk'."),s=e.looseObject({$schema:e.unknown().optional().describe("JSON Schema reference for IDE support"),version:e.literal(1).describe("Schema version (must be 1)"),rules:e.array(o,{error:"must be an array of rulebook source strings"}).max(vr,Sm).default([]).describe("Rulebook source strings such as project-rules or owner/repo#main/team-rules"),overrides:e.record(e.string().meta({pattern:Tm.source}),r).default({}).describe("Rule overrides by id"),transparent_wrappers:e.array(i,{error:"must be an array of command strings"}).default([]).describe("Commands that transparently execute a visible protected child command")}),a=(S,C)=>{if(!Oe(S))return;if(Array.isArray(S.rules)&&S.rules.length<=vr){let E=new Set;S.rules.forEach((T,O)=>{if(typeof T!=="string"||T==="")return;if(T.trim()===""){C.addIssue({code:"custom",message:"must be a non-empty rulebook source string",path:["rules",O]});return}let M=Rr(T);if(M){C.addIssue({code:"custom",message:M,path:["rules",O]});return}if(E.has(T)){C.addIssue({code:"custom",message:`duplicate rulebook source "${T}"`,path:["rules",O]});return}E.add(T)})}if(Oe(S.overrides))for(let E of Object.keys(S.overrides)){if(Tm.test(E))continue;C.addIssue({code:"custom",message:"must use <rulebook-name>/<rule-name>",path:["overrides",E]})}if(!Array.isArray(S.transparent_wrappers))return;let _=new Set;S.transparent_wrappers.forEach((E,T)=>{if(typeof E!=="string"||!Dt.test(E))return;if(_.has(E)){C.addIssue({code:"custom",message:`duplicate command "${E}"`,path:["transparent_wrappers",T]});return}if(Tu(E)){C.addIssue({code:"custom",message:`reserved command "${E}" cannot be a wrapper`,path:["transparent_wrappers",T]});return}_.add(E)})},l=e.preprocess(Im,s.check(e.superRefine(a))),c=e.preprocess(Im,s.check(t(a))),u=e.strictObject({fail_closed:e.boolean().optional(),paranoid_rm:e.boolean().optional(),paranoid_interpreters:e.boolean().optional()}),m=(S,C)=>e.intersection(e.record(e.string().refine((_)=>S.has(_),{error:(_)=>`unknown ${C} rule id "${String(_.input)}"`}),e.unknown()),e.record(e.string(),e.enum(["on","off"]))),f=(S)=>e.array(e.string({error:"must be a non-empty path string"}),{error:"must be an array of paths"}).check(t((C,_)=>{if(!Array.isArray(C))return;let E=It();C.forEach((T,O)=>{if(typeof T!=="string")return;let M=S(T,E);if(M)_.addIssue({code:"custom",message:M,path:[O]})})})),d=e.strictObject({version:e.literal(1),safety:e.strictObject({level:e.enum(["standard","strict","paranoid"]).optional(),overrides:u.optional()}).optional(),workflow:e.strictObject({worktree_mode:e.boolean().optional()}).optional(),destructive_command_protection:e.strictObject({enabled:e.boolean().optional(),overrides:m(Kr,"destructive command").optional(),allow_paths:f($o).optional()}).optional(),secret_protection:e.strictObject({enabled:e.boolean().optional(),overrides:m(Ri,"secret protection").optional(),deny_paths:f(Bo).optional(),allow_paths:f(Uo).optional()}).optional(),audit:e.strictObject({retention_days:e.number({error:xi}).int(xi).min(Pa,xi).max(_a,xi).optional().describe("Days of audit log history to keep before the sweep deletes it")}).optional()}),p=(S)=>{let C=(O,M)=>S==="legacy"?O:M,_=C("must match pattern (letters, numbers, hyphens, underscores)","must match command pattern"),E=`required non-empty string up to ${cn} characters`,T=e.looseObject({name:e.string({error:"required string"}).regex(Ie,C("must match pattern (letters, numbers, hyphens, underscores; max 64 chars)","must match rule name pattern")),command:e.string({error:C("required string","required string matching command pattern")}).regex(Dt,C(_,"required string matching command pattern")),subcommand:e.string({error:C("must be a string if provided","must match command pattern")}).regex(Dt,_).optional(),block_args:e.array(e.string({error:C("must be a string","must be a non-empty string")}).refine((O)=>O!=="",{error:C("must not be empty","must be a non-empty string")}),{error:C("required array","required non-empty array")}).refine((O)=>O.length>0,{error:C("must have at least one element","required non-empty array")}),reason:e.string({error:C("required string",E)}).refine((O)=>O!=="",{error:C("must not be empty",E)}).refine((O)=>O.length<=cn,{error:C(`must be at most ${cn} characters`,E)}),intent:n.optional()},{error:"must be an object"});return e.array(T,{error:C("must be an array","required array")}).check(t((O,M)=>{if(!Array.isArray(O))return;let F=new Set;O.forEach((oe,Ee)=>{let w=Oe(oe)?oe.name:void 0;if(typeof w!=="string")return;if(F.has(w.toLowerCase())){M.addIssue({code:"custom",message:`duplicate rule name "${w}"`,path:[Ee,"name"]});return}F.add(w.toLowerCase())})}))},g=e.looseObject({version:e.literal(1),rules:p("legacy").optional()}),y="required string matching rule name pattern",h=e.looseObject({command:e.string({error:"required non-empty string"}).refine((S)=>S.trim()!=="",{error:"required non-empty string"}),expect:e.enum(["blocked","allowed"]),rule:e.string({error:"must be a string if provided"}).optional()},{error:"must be an object"}).check(t((S,C)=>{if(!Oe(S))return;if(S.expect!=="blocked"||typeof S.rule==="string")return;C.addIssue({code:"custom",message:"required string for blocked fixtures",path:["rule"]})})),R=e.looseObject({name:e.string({error:"required string matching rule name pattern"}).regex(Ie,"required string matching rule name pattern"),version:e.string({error:"required non-empty string"}).refine((S)=>S!=="",{error:"required non-empty string"}),allowed_commands:e.array(e.string({error:"must match command pattern"}).regex(Dt,"must match command pattern"),{error:"required array"}).check(t((S,C)=>{if(!Array.isArray(S))return;let _=new Set;S.forEach((E,T)=>{if(typeof E!=="string"||!Dt.test(E))return;if(_.has(E)){C.addIssue({code:"custom",message:`duplicate command "${E}"`,path:[T]});return}_.add(E)})})),rules:p("rulebook"),tests:e.array(h,{error:"must be an array if provided"}).optional()}).check(t((S,C)=>{if(!Oe(S))return;let _=new Set(Na(S));if(Array.isArray(S.tests)){let T=new Set(S.tests.flatMap((O)=>Oe(O)&&O.expect==="blocked"&&typeof O.rule==="string"?[O.rule]:[]));for(let O of T){if(_.has(O))continue;C.addIssue({code:"custom",message:`blocked fixture references unknown rule "${O}"`,path:["tests"]})}}if(!Array.isArray(S.allowed_commands)||!Array.isArray(S.rules))return;let E=new Set(S.allowed_commands.filter((T)=>typeof T==="string"));S.rules.forEach((T,O)=>{let M=Oe(T)?T.command:void 0;if(typeof M!=="string"||E.has(M))return;C.addIssue({code:"custom",message:`"${M}" must be listed in allowed_commands`,path:["rules",O,"command"]})})})),x=e.string({error:"required string"}).refine((S)=>S.trim()!=="",{error:"required string"}),A=e.looseObject({spec:x,name:x,version:x,digest:e.string({error:"required sha256 digest"}).regex(ox,"required sha256 digest")},{error:"must be an object"}),P=e.looseObject({rulebooks:e.array(e.intersection(A,e.discriminatedUnion("kind",[e.object({kind:e.literal("local-directory"),path:x}),e.object({kind:e.literal("github"),owner:x,repo:x,ref:x,commit:x,path:x,display_ref:e.unknown().optional()})],{error:(S)=>{if(!Oe(S.input))return"must be an object";let C=S.input.kind;return typeof C==="string"?`unknown kind "${C}"`:"required string"}})))});return{RulesConfigSchema:l,RulesConfigDiagnosticSchema:c,RuleOverrideSchema:r,UserPolicySchema:d,LegacyConfigSchema:g,RulebookSchema:R,RulesLockfileSchema:P}}function _n(){return km??=ax(),km}function Om(){return _n().RulesConfigSchema}function lx(){return _n().UserPolicySchema}function EO(){return _n().LegacyConfigSchema}function Mm(){return _n().RulebookSchema}function Dm(){return _n().RulesLockfileSchema}function Na(e){let t=Oe(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=Oe(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Lm(e){let t=_n().RulesConfigDiagnosticSchema.safeParse(e);if(t.success)return{errors:[],sources:new Set(t.data.rules)};return{errors:An(Wm(t.error.issues,ix)),sources:mx(e,t.error.issues)}}function Er(e){let t=lx().safeParse(e);if(t.success)return[];return An(Wm(t.error.issues,sx)," ")}function An(e,t=": ",n=" "){return[...new Set(e.flatMap((r)=>Nm(r,t,n,[])))]}function Nm(e,t,n,r){let o=[...r,...e.path],i=dx(o);if(e.code==="unrecognized_keys")return e.keys.map((s)=>`${i?`${i}.`:""}unknown field "${s}"`);if(e.code==="invalid_key")return e.issues.map((s)=>s.message);if(e.code==="invalid_union"){let s=e.errors.flat().filter((a)=>a.path.length>0);if(s.length>0)return s.flatMap((a)=>Nm(a,t,n,o))}if(o.length===0)return[e.code==="invalid_type"?"Config must be an object":e.message];if(o.length===1&&(e.code==="too_big"||e.code==="too_small")&&e.origin==="array")return[e.message];return[`${i}${o.length===1?n:t}${cx(e)}`]}function cx(e){if(e.code==="invalid_value")return`must be ${ux(e.values)}`;if(e.code!=="invalid_type"||!e.message.startsWith("Invalid input:"))return e.message;if(e.expected==="object"||e.expected==="record")return"must be an object if provided";return e.expected==="boolean"?"must be a boolean":e.message}function ux(e){if(e.length>3)return`one of ${e.join(", ")}`;let t=e.map((n)=>typeof n==="string"?`"${n}"`:String(n));if(t.length<2)return`${t[0]}`;return`${t.slice(0,-1).join(", ")}${t.length>2?",":""} or ${t.at(-1)}`}function dx(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Wm(e,t){let n=e.map((i)=>i.path[1]),r=[...new Set(n.filter((i)=>typeof i==="string"))],o=(i,s)=>[i.path.length===0?-1:t.indexOf(String(i.path[0])),typeof s==="number"?s:r.indexOf(String(s)),i.code==="custom"?0:1];return e.map((i,s)=>({issue:i,rank:o(i,n[s])})).sort((i,s)=>i.rank[0]-s.rank[0]||i.rank[1]-s.rank[1]||i.rank[2]-s.rank[2]).map((i)=>i.issue)}function mx(e,t){let n=Oe(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Oe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}import{randomBytes as fx}from"node:crypto";import{closeSync as Ga,constants as wr,fstatSync as Wa,fsyncSync as px,lstatSync as kt,mkdirSync as Fm,openSync as Gm,readdirSync as za,readFileSync as gx,realpathSync as Zt,renameSync as hx,rmdirSync as zm,statSync as Fa,unlinkSync as $a,writeFileSync as yx}from"node:fs";import{isAbsolute as $m,join as kn,normalize as Cx,parse as Bm,relative as Ba,resolve as Ua,sep as _r}from"node:path";var bx=Symbol("PolicyFilesystemScope"),Sx=Symbol("PolicyFilesystemTarget"),Um=wr.O_NOFOLLOW??0;class L extends Error{constructor(e){super(`Unable to access ${e} filesystem safely.`);this.name="PolicyFilesystemError"}}function Me(e,t){return{[bx]:!0,root:Ua(e),label:t}}function Ar(e,t){let n=Cx(t);if(t===""||$m(t)||n===".."||n.startsWith(`..${_r}`))throw new L(e.label);return{[Sx]:!0,scope:e,relativePath:n,path:kn(e.root,n)}}function se(e,t){let n=Ba(e.root,Ua(t));return Ar(e,n)}function Ei(e,t="rules policy"){let n=Ua(e),r=Bm(n).dir;return Ar(Me(r,t),Ba(r,n))}function gt(e){try{if(!re(e,!1).exists)return null;let n=Gm(e.path,wr.O_RDONLY|Um);try{let r=Wa(n);if(!r.isFile())throw new L(e.scope.label);let o=gx(n,"utf-8"),i=kt(e.path);if(!i.isFile()||i.isSymbolicLink()||r.dev!==i.dev||r.ino!==i.ino)throw new L(e.scope.label);return re(e,!1),o}finally{Ga(n)}}catch(t){ht(e.scope.label,t)}}function Hm(e,t,n=384,r){let o=`${e.path}.${fx(8).toString("hex")}.tmp`,i=null;try{xx(e),re(e,!0),i=Gm(o,wr.O_CREAT|wr.O_EXCL|wr.O_WRONLY|Um,n);let s=Wa(i);if(!s.isFile())throw new L(e.scope.label);yx(i,t,"utf-8"),px(i);let a=Wa(i);if(!a.isFile()||a.dev!==s.dev||a.ino!==s.ino)throw new L(e.scope.label);Ga(i),i=null,re(e,!0),wx(e,o,a.dev,a.ino),hx(o,e.path),r?.(e.path),re(e,!1)}catch(s){if(i!==null)_x(i);Ax(o),ht(e.scope.label,s)}}function jm(e,t){if(e.path===t.path)return!0;try{if(!re(e,!1).exists||!re(t,!1).exists)return!1;return Zt(e.path)===Zt(t.path)}catch(n){if(n instanceof L)throw n;throw new L(e.scope.label)}}function vx(e){try{if(!re(e,!1,"directory").exists)return null;let n=za(e.path);return re(e,!1,"directory"),n}catch(t){ht(e.scope.label,t)}}function kO(e){let t=vx(e);if(!t)return null;try{let n=t.map((r)=>{let o=Ar(e.scope,kn(e.relativePath,r)),i=kt(o.path);if(i.isSymbolicLink()||!i.isFile()&&!i.isDirectory())throw new L(e.scope.label);return wi(Ym(e.scope),Zt(o.path),e.scope.label),{name:r,kind:i.isDirectory()?"directory":"file"}});return re(e,!1,"directory"),n}catch(n){ht(e.scope.label,n)}}function TO(e){try{if(!re(e,!0).exists)return;$a(e.path),re(e,!0)}catch(t){ht(e.scope.label,t)}}function IO(e){try{Km(e,e.relativePath.split(_r))}catch(t){ht(e.scope.label,t)}}function OO(e){try{if(!Rx(e))return;qm(e),re(e,!0,"directory")}catch(t){ht(e.scope.label,t)}}function MO(e){try{if(!re(e,!0,"directory").exists)return;zm(e.path),re(e,!0,"directory")}catch(t){ht(e.scope.label,t)}}function Rx(e){try{if(!re(e,!0,"directory").exists)return!1;return Vm(e),!0}catch(t){ht(e.scope.label,t)}}function re(e,t,n="file"){let r=Ha(e.scope);if(!r)return{exists:!1};let o=e.relativePath.split(_r);for(let i of o.keys()){let s=kn(e.scope.root,...o.slice(0,i+1)),a=Pr(s);if(!a){if(i===o.length-1&&t)return{exists:!1};return{exists:!1}}if(a.isSymbolicLink())throw new L(e.scope.label);if(i<o.length-1&&!a.isDirectory())throw new L(e.scope.label);if(i===o.length-1&&(n==="file"?!a.isFile():!a.isDirectory()))throw new L(e.scope.label);wi(r,Zt(s),e.scope.label)}return{exists:!0}}function Vm(e){for(let t of za(e.path)){let n=Ar(e.scope,kn(e.relativePath,t)),r=kt(n.path);if(r.isSymbolicLink()||!r.isDirectory()&&!r.isFile())throw new L(e.scope.label);if(r.isDirectory())Vm(n)}re(e,!1,"directory")}function qm(e){for(let t of za(e.path)){let n=Ar(e.scope,kn(e.relativePath,t)),r=kt(n.path);if(r.isSymbolicLink())throw new L(e.scope.label);if(r.isDirectory()){qm(n);continue}if(!r.isFile())throw new L(e.scope.label);$a(n.path)}zm(e.path)}function xx(e){Km(e,e.relativePath.split(_r).slice(0,-1))}function Km(e,t){Ex(e.scope);let n=Ym(e.scope);for(let r of t.keys()){let o=kn(e.scope.root,...t.slice(0,r+1));if(!Pr(o))Fm(o,{mode:448});let s=kt(o);if(!s.isDirectory()||s.isSymbolicLink())throw new L(e.scope.label);wi(n,Zt(o),e.scope.label)}}function Ex(e){if(Pr(e.root)){if(!Fa(e.root).isDirectory())throw new L(e.label);return}let t=[],n=e.root;while(!Pr(n)){t.unshift(n);let r=Bm(n).dir;if(r===n)throw new L(e.label);n=r}if(!Fa(n).isDirectory())throw new L(e.label);for(let r of t){Fm(r,{mode:448});let o=kt(r);if(!o.isDirectory()||o.isSymbolicLink())throw new L(e.label)}}function Ha(e){if(!Pr(e.root))return null;if(!Fa(e.root).isDirectory())throw new L(e.label);return Zt(e.root)}function Ym(e){let t=Ha(e);if(!t)throw new L(e.label);return t}function wx(e,t,n,r){let o=kt(t);if(!o.isFile()||o.isSymbolicLink()||o.dev!==n||o.ino!==r)throw new L(e.scope.label);let i=Ha(e.scope);if(!i)throw new L(e.scope.label);wi(i,Zt(t),e.scope.label)}function wi(e,t,n){let r=Ba(e,t);if(r===".."||r.startsWith(`..${_r}`)||$m(r))throw new L(n)}function Pr(e){try{return kt(e)}catch(t){if(Px(t)&&t.code==="ENOENT")return null;throw t}}function ht(e,t){if(t instanceof L)throw t;throw new L(e)}function Px(e){return e instanceof Error&&"code"in e}function _x(e){try{Ga(e)}catch{}}function Ax(e){try{$a(e)}catch{}}var Zm={version:1,rules:[],overrides:{},transparent_wrappers:[]};function kx(e){return Lm(e)}function Tn(e){try{let t=gt(Xm(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=kx(n);if(r.errors.length>0)return{config:null,errors:r.errors};let o=Om().parse(n);return{config:{version:1,rules:o.rules??[],overrides:o.overrides??{},transparent_wrappers:o.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof L)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function GO(e){let t=Tn(e);if(t.errors.length>0)return{ok:!1,result:{ok:!1,errors:t.errors,warnings:[],entries:[]}};return{ok:!0,config:t.config??Zm}}function zO(e,t=[]){Pi(e,{version:1,rules:t,overrides:{},transparent_wrappers:[]})}function $O(e,t="project-rules"){Pi(e,{rulebook_version:1,name:t,version:"1.0.0",description:t==="project-rules"?"Project-specific CC Safety Net rules.":"User-specific CC Safety Net rules.",author:t==="project-rules"?"project":"user",allowed_commands:["docker"],rules:[{name:"block-docker-system-prune",command:"docker",subcommand:"system",block_args:["prune"],reason:"Use targeted cleanup instead."}],tests:[{command:"docker system prune",expect:"blocked",rule:"block-docker-system-prune"}]})}function Pi(e,t,n,r){Hm(Xm(e),`${JSON.stringify(t,null,2)}
+`,n,r)}function Xm(e){return typeof e==="string"?Ei(e):e}import{homedir as Tx}from"node:os";import{dirname as ot,isAbsolute as Ix,join as je,relative as Ox,resolve as it,sep as Mx}from"node:path";var Qm="rule.json",ef="policy.json",tf="rule.lock",Dx="config.json",nf=".cc-safety-net",Lx="rules",Jm="cache",Nx="CC_SAFETY_NET_HOME",Ve="`cc-safety-net rule sync`";function Wx(e){return it(e??process.cwd(),bi)}function rf(e){return je(Wx(e),Qm)}function Jt(e){return e?.userConfigDir??(e?.userConfigPath?ot(e.userConfigPath):je(Fx(),Lx))}function Fx(){let e=process.env[Nx];return e?it(pe(e)):je(Tx(),nf)}function of(e){return je(Jt(e),Qm)}function YO(e){return je(Jt(e),tf)}function Xt(e){return je(ot(e),tf)}function ZO(e={}){return je(ot(Jt(e)),Dx)}function XO(e={}){return it(e.cwd??process.cwd(),".safety-net.json")}function sf(e){let t=e.userConfigPath??of(e),n=e.projectConfigPath??rf(e.cwd),r=af(t,e),o=lf(n,e);return{userConfigPath:t,projectConfigPath:n,userLockPath:Xt(t),projectLockPath:Xt(n),userScope:r,projectScope:o,userConfigTarget:se(r,t),projectConfigTarget:se(o,n),userLockTarget:se(r,Xt(t)),projectLockTarget:se(o,Xt(n))}}function JO(e){let t=e.global?e.userConfigPath??of(e):e.projectConfigPath??rf(e.cwd),n=e.global?af(t,e):lf(t,e),r=Xt(t);return{configDir:ot(t),configPath:t,lockPath:r,filesystemScope:n,configTarget:se(n,t),lockTarget:se(n,r)}}function af(e,t){let n=t.userConfigPath?ot(ot(it(t.userConfigPath))):ot(it(t.userConfigDir??Jt(t)));return Me(n,"user policy")}function lf(e,t){let n=it(t.cwd??process.cwd()),r=it(e),o=Ox(n,r);if(o!==".."&&!o.startsWith(`..${Mx}`)&&!Ix(o))return Me(n,"project policy");return Me(ot(ot(r)),"project policy")}function cf(e){if(e.kind==="github"&&e.display_ref)return`${e.owner}/${e.repo}#${e.display_ref}/${e.name}`;return e.spec}function _i(e,t){let n=e.digest.startsWith("sha256:")?e.digest.slice(7):e.digest;return je(uf(t),"rulebooks",`${Gx(e)}--${n.slice(0,12)}`,Ci)}function QO(e){return je(uf(e),"rulebooks")}function Ai(e,t){let n=t;return{cacheConfigDir:e,cwd:t.cwd,global:n.global}}function Gx(e){return(e.kind==="github"&&e.display_ref?`${e.owner}/${e.repo}#${e.display_ref}/${e.name}`:e.spec).toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"rulebook"}function uf(e){let t=e?.cacheConfigDir??Jt(e),n=e;if(n&&!n.global&&n.cwd&&it(t)===it(n.cwd))return je(it(n.cwd),nf,Jm);return je(ot(t),Jm)}var Ux=new Set(["standard","strict","paranoid"]),Ti={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:ym}};function On(e){return Bx(ff(Jt(e)),ef)}function fM(e={}){let t=On(e);if(!ja(t))return{path:t,exists:!1,raw:"",policy:kr(),errors:[]};let n=Va(t,"utf-8");if(!n.trim())return{path:t,exists:!0,raw:n,policy:kr(),errors:["Config file is empty"]};try{let r=JSON.parse(n),o=Er(r);return{path:t,exists:!0,raw:n,policy:In(r),errors:o}}catch(r){return{path:t,exists:!0,raw:n,policy:kr(),errors:[`Invalid JSON: ${r instanceof Error?r.message:String(r)}`]}}}function ki(e,t={}){let n=On(t),r=Er(e),o=r.length>0?kr():In(e);if(r.length>0)return{path:n,policy:o,errors:r};return $x(ff(n),{recursive:!0,mode:448}),Pi(n,o,384),zx(n,384),{path:n,policy:o,errors:[]}}function pM(e){let t=Er(e);if(t.length>0)return{errors:t};return{preview:Hx(In(e)),errors:[]}}function Hx(e){let t=gi({safety:hf(e.safety)}),n=Ki({destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides},t.capabilities),r=Object.values(n),o=r.filter((i)=>i.source!=="catastrophic");return{selectedPreset:e.safety.level,effectiveLevel:t.effectiveLevel,capabilities:t.capabilities,rules:n,counts:{enabled:o.filter((i)=>i.enabled).length,disabled:o.filter((i)=>!i.enabled).length,effectiveCustomizations:r.filter((i)=>i.changesInherited).length}}}function gM(e={}){let t=On(e);if(!ja(t))return ki(Ti,e);let n=Va(t,"utf-8");if(!n.trim())return ki(Ti,e);try{return ki(In(JSON.parse(n)),e)}catch{return ki(Ti,e)}}function pf(e={}){let t=Kx(On(e));return{...t.policy,errors:t.errors,...t.fallback?{fallback:t.fallback}:{}}}function In(e){if(!st(e))return kr();let t=st(e.safety)?e.safety:{},n=st(t.overrides)?t.overrides:{},r=st(e.workflow)?e.workflow:{},o=st(e.destructive_command_protection)?e.destructive_command_protection:{},i=st(e.secret_protection)?e.secret_protection:{};return{version:1,safety:{level:Ux.has(t.level)?t.level:"standard",overrides:{...typeof n.fail_closed==="boolean"?{fail_closed:n.fail_closed}:{},...typeof n.paranoid_rm==="boolean"?{paranoid_rm:n.paranoid_rm}:{},...typeof n.paranoid_interpreters==="boolean"?{paranoid_interpreters:n.paranoid_interpreters}:{}}},workflow:{worktree_mode:typeof r.worktree_mode==="boolean"?r.worktree_mode:!1},destructive_command_protection:{enabled:typeof o.enabled==="boolean"?o.enabled:!0,overrides:df(o.overrides,Kr),allow_paths:Vx(o.allow_paths)},secret_protection:{enabled:typeof i.enabled==="boolean"?i.enabled:!0,overrides:df(i.overrides,Ri),deny_paths:jx(i.deny_paths),allow_paths:qx(i.allow_paths)},audit:{retention_days:Cm(st(e.audit)?e.audit.retention_days:void 0)}}}function df(e,t){if(!st(e))return{};return Object.fromEntries(Object.entries(e).flatMap(([n,r])=>t.has(n)&&(r==="on"||r==="off")?[[n,r]]:[]))}function jx(e){if(!Array.isArray(e))return[];let t=It();return e.filter((n)=>Bo(n,t)===null)}function Vx(e){if(!Array.isArray(e))return[];let t=It();return e.filter((n)=>$o(n,t)===null)}function qx(e){if(!Array.isArray(e))return[];let t=It();return e.filter((n)=>Uo(n,t)===null)}function st(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function kr(){return structuredClone(Ti)}function Kx(e){let t=Yx();if(!ja(e)){let n=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!st(n))return{policy:t,errors:[]};return{policy:mf(In(n)),errors:[]}}try{let n=Va(e,"utf-8");if(!n.trim())return{policy:t,errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Er(r),i=mf(In(r));if(o.length>0)return{policy:i,errors:o.map((s)=>`${e}: ${s}`),fallback:st(r)?"salvaged":"defaults"};return{policy:i,errors:[]}}catch(n){let r=n instanceof Error?n.message:String(n);return{policy:t,errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}function gf(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Am].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Yx(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:gf({}),denyPaths:[],allowPaths:[]}}}function mf(e){return{safety:hf(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:gf(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function hf(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}var Sf="This path contains the protected policy config and you must not modify or delete it.",Xx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function vf(e){let t=Mt(ct()),n=rE(e.invocation.context.executionCwd,t);if(e.invocation.route.kind==="patch")return yf(e.paths,!1,e.invocation.context.executionCwd,n,t);let r=be(e,"input-candidate");if(e.invocation.route.kind==="command")return r?Cf(r.shell,e.invocation.context.executionCwd,n,t):null;if(e.invocation.route.kind==="unknown"&&r){let o=Cf(r.shell,e.invocation.context.executionCwd,n,t);if(o)return o}return yf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Mo(e.invocation.toolName),e.invocation.context.executionCwd,n,t)}function yf(e,t,n,r,o){if(t)return null;let i=e.find((s)=>Tr(s,n,r,o));return i?{target:i}:null}function Cf(e,t,n,r){let o=No(e,t,r,{findSegmentTarget:(i,s)=>Jx(i,s,n,r)?.target??null,isRedirectionTarget:(i,s)=>Tr(i,s.cwd,n,r),findMalformedTarget:(i)=>nE(i,t,n,r)?.target??null,normalizeCwd:le});return o?{target:o}:null}function Jx(e,t,n,r){if(tr(e))return null;let o=r.environment,i=vt([...e],o),s=D(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&Qx(a)){let l=eE(a).find((c)=>bf(Se(c,t.variables),t.cwd,n,r));if(l)return{target:l}}if(s==="find"){if(Xo(i,1)||Fs(i,o)){let c=(Zo(G(i))??G(["."])).find((u)=>{let m=Se(u.text,t.variables);return Tr(m,t.cwd,n,r)||bf(m,t.cwd,n,r)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Wo(a).sources.find((c)=>oE(Se(c,t.variables),t.cwd,n,r));if(l)return{target:l}}if(tE(e,o))return null;for(let l of[...e,...i])for(let c of Rf(l))if(Tr(Se(c,t.variables),t.cwd,n,r))return{target:c};return null}function Qx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function eE(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function tE(e,t){let n=vt([...e],t);if(n.length===0)return!1;let r=D(n[0]??"").toLowerCase();if(!Xx.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function nE(e,t,n,r){for(let o of e.split(/\s+/))for(let i of Rf(o))if(Tr(i,t,n,r))return{target:i};return null}function Rf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function rE(e,t){let n=le(On(),e,t),r=qa(n),o=new Set;for(let i=r;;i=qa(i))if(o.add(Mn(i)),qa(i)===i)break;return{file:Mn(n),directoryAndAncestors:o}}function Tr(e,t,n,r){let o=ou(e,t,r,(i)=>Mn(i)===Zx(n.file));return o!==null&&Mn(o)===n.file}function bf(e,t,n,r){return n.directoryAndAncestors.has(Mn(le(e,t,r)))}function oE(e,t,n,r){let o=Mn(le(e,t,r));return o===n.file||n.directoryAndAncestors.has(o)}function Mn(e){return process.platform==="win32"?e.toLowerCase():e}import{homedir as Ya}from"node:os";import{isAbsolute as Ii,posix as iE,resolve as Mi,win32 as sE}from"node:path";import{fileURLToPath as aE}from"node:url";var Mf="Access to a sensitive path is not allowed.",Df=new Set(["echo","printf"]),lE=new Set(["find"]),cE=new Set(["-exec","-execdir"]),uE=new Set([";","+"]),dE=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),mE=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),fE=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),pE=new Set(["node","bun"]),gE=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),hE=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","popen","read","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Lf=new Set(["-c","-e","-r","-E","--eval","--exec"]),yE=new Set(["src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js"]),xf=new Set(["cc-safety-net","ccsn"]),CE=new Set(["bunx","npx","pnpx"]),bE=new Set(["bun","node"]),SE=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),vE=new Set(["grep","rg"]),Ef="f",wf="file",RE="files",xE=new Set(["e","f"]),EE=new Set(["regexp","file"]),wE=new Set(["e","f","A","B","C","m"]),PE=new Set(["regexp","file","after-context","before-context","context","max-count"]),_E=new Set(["|","|&"]),Ka="__CC_SAFETY_NET_PIPE_INPUT__",Nf=new Set(["bash","sh","zsh","dash","ksh"]),AE=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Pf(e,t,n,r,o){let i=Jr();for(let s of e){if(gw(s,t,n?.denyPaths??[],r,i))return{target:s,ruleId:"secret.deny-path"};if(o&&!o.has(s))continue;let a=fw(s,t,n,i);if(a){if(!a.startsWith("secret.cli.")&&hw(s,t,n?.allowPaths??[],r,i))continue;return{target:s,ruleId:a}}}return null}function Wf(e,t,n={}){let r=_f(e),o=Pf(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd),i=o?.ruleId!=="secret.deny-path"&&n.strict===!1?_f(e,{refineJavaScriptInlineData:!0}):r,s=i.length===r.length?o:Pf(r,e.invocation.context.executionCwd,t,e.invocation.context.configCwd,new Set(i));if(s?.ruleId!=="secret.deny-path"&&n.strict===!1&&kE(e))return null;return s}function kE(e){if(e.invocation.route.kind!=="command")return!1;let t=be(e,"input-candidate")??be(e,"declared-command");if(!t)return!1;if(t.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let n=[];for(let s of t.shell.entries){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind!=="operator")n.push(Je(s.text))}let r=Dn(n);if(r.length===0)return!1;let o=en(r[0]??"").toLowerCase(),i=r.slice(1);if(o==="ls"||o==="stat")return!0;if(o==="test")return i.length===2&&(i[0]==="-e"||i[0]==="-f");if(o!=="find")return!1;return!i.some((s)=>dE.has(s))}function _f(e,t={}){if(e.invocation.route.kind==="command"){let r=be(e,"input-candidate");return r?Mr(r.shell,e.store,t):[]}if(e.invocation.route.kind!=="unknown")return[...e.paths];let n=be(e,"input-candidate");return[...n?Mr(n.shell,e.store,t):[],...e.paths]}function Mr(e,t,n){if(e.status==="structural-limit")throw new xt;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let r=[...e.assignmentFallbacks,...YE(Je(e.source),t,n)],o=[],i=null;for(let s of e.entries){if(s.kind==="operator"){if(!s.boundary)continue;if(o.length>0){if(r.push(...Oi(o,t,n)),i!==null)r.push(...kf(i,o,t,n));i=_E.has(s.operator)?o:null,o=[]}else i=null;continue}if(s.kind==="redirection"){let a=s.target?Je(s.target):void 0;if(a&&s.targetOrder==="legacy-segment")o.push(a);else if(a)r.push(a);continue}o.push(Je(s.text))}if(o.length>0){if(r.push(...Oi(o,t,n)),i!==null)r.push(...kf(i,o,t,n))}return r}function Oi(e,t,n){let r=GE(e),o=Dn(e);if(o.length===0)return r;let i=o[0]??"",s=en(i).toLowerCase(),a=o.slice(1),l=IE(i,s,a);if(l)return[...r,...l];if(Df.has(s))return r;if(vE.has(s))return[...r,...rw(a)];if(lE.has(s))return[...r,...zE(a,t,n)];if(ve.has(s))return[...r,...a.flatMap((c)=>Tf("awk",c)),...a.flatMap((c)=>BE(c,t,n)),...a.flatMap(UE)];if(zf(s)){if(Nf.has(s)){let c=tu(s,a);if(c!==null&&t.getShellSyntax(c).status==="structural-limit")throw new xt}return[...r,...$E(s,a,n)]}return[...r,...a.flatMap((c)=>Tf(s,c))]}function TE(e,t){if(xf.has(e))return t[0]==="explain"?0:null;if(CE.has(e)){let n=t[0]==="-y"||t[0]==="--yes"?1:0;return xf.has(t[n]??"")&&t[n+1]==="explain"?n+1:null}if(bE.has(e)){if(Af(t[0])&&t[1]==="explain")return 1;if(e==="bun"&&t[0]==="run"&&Af(t[1])&&t[2]==="explain")return 2}return null}function IE(e,t,n){let r=TE(t,n);if(r===null)return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Af(e){let t=e?.replaceAll("\\","/");return[...yE].some((n)=>t===n||t?.endsWith(`/${n}`))}function kf(e,t,n,r){if(NE(t,n,r))return OE(e);let o=WE(t);if(o===null)return[];return ME(e).flatMap((i)=>Nf.has(o)?Mr(n.getShellSyntax(i),n,r):Bf(i))}function OE(e){let t=Dn(e);if(t.length===0)return[];let n=en(t[0]??"").toLowerCase();if(!Df.has(n))return[];return t.slice(1)}function ME(e){let t=Dn(e);if(t.length===0)return[];let n=en(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return DE(r);return[]}function DE(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ff(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>LE(t,r.slice(i*n,(i+1)*n)))}function LE(e,t){let n=0;return Ff(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ff(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function NE(e,t,n){let r=Dn(e);if(r.length===0||en(r[0]??"").toLowerCase()!=="xargs")return!1;let o=Ht(r),i=r.slice(o.childStart);if(i.length===0)return!1;if(o.replacementToken==="")return!1;let s=o.replacementToken,a=s===null?[...i,Ka]:i.map((l)=>l.split(s).join(Ka));return Oi(a,t,n).some((l)=>l.includes(Ka))}function WE(e){let t=Dn(e);if(t.length===0)return null;let n=en(t[0]??"").toLowerCase();if(!zf(n))return null;return FE(n,t.slice(1))?n:null}function FE(e,t){let n=Gf(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Lf.has(o)||$f(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(AE.get(n)?.has(o))r++;continue}return!1}return!0}function Gf(e){return/^python\d/.test(e)?"python":e}function GE(e){let t=[];for(let n of e){if(jf(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}function Tf(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function zE(e,t,n){let r=e.findIndex((i)=>i.startsWith("-")||i==="("||i==="!"||i===";"),o=[...e.slice(0,r===-1?e.length:r)];for(let i=0;i<e.length;i++){if(!cE.has(e[i]??""))continue;let s=e.slice(i+1),a=s.findIndex((u)=>uE.has(u)),l=a===-1?s:s.slice(0,a),c=Oi(l,t,n);if(o.push(...c.filter((u)=>u!=="{}")),!c.includes("{}"))continue;o.push(...e.slice(0,i).flatMap((u,m,f)=>{if(!mE.has(u))return[];let d=f[m+1];return d===void 0?[]:[d,d.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return o}function zf(e){return fE.has(e)||/^python\d/.test(e)}function $E(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o];if(i===void 0)break;if(Lf.has(i)||$f(e,i)){let a=t[o+1];if(a!==void 0)r.push(...If(e,a,n)),o++;continue}let s=/^--(?:eval|exec)=(.*)$/.exec(i);if(s!==null&&s[1]!==void 0){r.push(...If(e,s[1],n));continue}if(!i.startsWith("-"))r.push(i)}return r}function $f(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return SE.get(t[t.length-1]??"")?.has(Gf(e))??!1}function BE(e,t,n){if(!e.includes("system"))return[];return Ds(e)?.commands.flatMap((r)=>Mr(t.getShellSyntax(r),t,n))??[]}function UE(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Bf(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(/[\w./~@+-]*[./~][\w./~@+-]*/g)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Uf),...n]}function If(e,t,n){let r=Bf(t);if(!n.refineJavaScriptInlineData||!pE.has(e)||r.length===0)return r;let o=HE(t);return o!==null&&!VE(o)?[]:r}function HE(e){let t=e.split("");for(let n=0;n<e.length;n++){let r=e[n];if(r!=="'"&&r!=='"'&&r!=="`")continue;if(r==="`"&&jE(e,n))return null;t[n]=" ";let o=!1;for(let i=n+1;i<e.length;i++){let s=e[i];if(t[i]=" ",s==="\\"){if(i++,i<e.length)t[i]=" ";continue}if(r==="`"&&s==="$"&&e[i+1]==="{")return null;if(r!=="`"&&(s===`
+`||s==="\r"))return null;if(s!==r)continue;n=i,o=!0;break}if(!o)return null}return t.join("")}function jE(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function VE(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(gE.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>hE.has(i)))continue;if(o.length>1)return!0;if(qE(e,r)===".")return!0;if(KE(e,r+n.length)==="(")return!0}return!1}function qE(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function KE(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function YE(e,t,n){return ew(e).flatMap((r)=>{let o=t.getShellSyntax(r);if(o.status==="invalid")return[];return[...Mr(o,t,n),...ZE(o)?XE(o):[]]})}function ZE(e){let t=e.entries;for(let n=0;n<t.length;n++){let r=t[n];if(r?.kind!=="word"||en(Je(r.text)).toLowerCase()!=="base64")continue;for(let o=n+1;o<t.length;o++){let i=t[o];if(i?.kind==="operator")break;if(i?.kind!=="word")continue;let s=Je(i.text);if(s==="--decode"||!s.startsWith("--")&&s.startsWith("-")&&/[dD]/.test(s))return!0}}return!1}function XE(e){return e.entries.flatMap((t)=>t.kind==="word"?[Je(t.text)]:t.kind==="redirection"&&t.target?[Je(t.target)]:[]).flatMap(Uf)}function Uf(e){let t=QE(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||JE(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function JE(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function QE(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function ew(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Zn(o,n))continue;if(Hf(e,r,n)){let i=tw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=nw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function tw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Zn(i,n))continue;if(Hf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function nw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Hf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function rw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",f=u[2];if(m===RE)o=!0;if(EE.has(m))r=!0;if(f!==void 0){if(m===wf)t.push(f);continue}if(PE.has(m)){let d=e[l+1];if(m===wf&&d!==void 0)t.push(d);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),f="",d="";for(let p=0;p<m.length;p++){let g=m[p]??"";if(xE.has(g))r=!0;if(wE.has(g)){f=g,d=m.slice(p+1);break}}if(f!=="")if(d.length>0){if(f===Ef)t.push(d)}else{let p=e[l+1];if(f===Ef&&p!==void 0)t.push(p);l++}continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Dn(e){let t=e.findIndex((n)=>!jf(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function jf(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var ow=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),iw=".env.",sw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),aw=[".env.example.",".env.sample."];function lw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function cw(e){return e.length>0&&!/\s/.test(e)}function uw(e,t,n){try{let r=Dr(e,t,n);return r!==""&&De.entryKind(r)!=="missing"}catch(r){if(r instanceof Pe)throw r;return!1}}var dw=new Set(["node_modules","__pycache__"]),mw=[["vendor","bundle"],["vendor","cache"]];function fw(e,t,n,r){if(lw(e))return null;let o=at(e,t,r);if(!o)return null;let i=q(o.split("/").pop()??""),s=q(o),a=()=>cw(i)||uw(e,t,r);if(sw.has(i)||aw.some((m)=>i.startsWith(m)))return null;let l=q(bw(e,t,r));for(let m of Ia){let f=`~/${m.suffixParts.join("/")}`;if((Of(s,f)||Of(l,f))&&yt(m.id,n))return m.id}let c=pw(o,t,n,r);if(c)return c;if(ow.has(i))return null;for(let m of Ta)if(i===m.basename&&yt(m.id,n))return m.id;if(i.startsWith(iw)&&yt(Si.id,n)&&a())return Si.id;for(let m of Oa)if(i.length>m.prefix.length&&i.startsWith(m.prefix)){let f=i.slice(m.prefix.length)[0];if((f==="-"||f==="_")&&yt(m.id,n)&&a())return m.id}for(let m of Ma)if(i.length>m.prefix.length&&i.startsWith(m.prefix)){if(i.slice(m.prefix.length)===m.suffix&&yt(m.id,n))return m.id}if(yw(s))return null;if(!i.includes(".")&&xr.pattern.test(i)&&yt(xr.id,n))return xr.id;let u=Cw(i,n);if(u)return u;return null}function pw(e,t,n,r){return vi.find((o)=>{if(!yt(o.id,n))return!1;switch(o.id){case"secret.cli.claude-code":return U(e,V(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),[".credentials.json"]);case"secret.cli.claude-code.config":{let i=q(e).split("/");return U(e,V(process.env.CLAUDE_CONFIG_DIR,"~/.claude",t,r),["settings.json","settings.local.json"])||Or(e,"~/.claude.json",t,r)||i.at(-1)==="settings.local.json"&&i.at(-2)===".claude"||i.at(-1)===".mcp.json"}case"secret.cli.antigravity":return U(e,at("~/.gemini/config",t,r),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let i=V(process.env.CODEX_HOME,"~/.codex",t,r);return U(e,i,["auth.json",".credentials.json"])||Ir(e,i,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let i=V(process.env.CODEX_HOME,"~/.codex",t,r),s=q(e).split("/").at(-1)??"";return U(e,i,["config.toml"])||s.endsWith(".config.toml")&&U(e,i,[s])}case"secret.cli.gemini":return U(e,ae(V(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let i=q(e).split("/"),s=process.env.ProgramData?[ae(V(process.env.ProgramData,"",t,r),"gemini-cli")]:[];return U(e,ae(V(process.env.GEMINI_CLI_HOME,"~",t,r),".gemini"),["settings.json","google_accounts.json"])||i.at(-1)==="settings.json"&&i.at(-2)===".gemini"||(process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH?.trim()?Or(e,process.env.GEMINI_CLI_SYSTEM_SETTINGS_PATH,t,r):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...s].some((a)=>U(e,at(a,t,r),["settings.json"]))}case"secret.cli.copilot-cli":{let i=V(process.env.COPILOT_HOME,"~/.copilot",t,r);return U(e,i,["config.json"])||Ir(e,i,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return U(e,V(process.env.COPILOT_HOME,"~/.copilot",t,r),["mcp-config.json"]);case"secret.cli.kimi-code":{let i=V(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),s=V(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r);return U(e,i,["server.token"])||Ir(e,i,["credentials"])||Ir(e,s,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let i=["config.toml","mcp.json"],s=q(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".kimi-code"||U(e,V(process.env.KIMI_CODE_HOME,"~/.kimi-code",t,r),i)||U(e,V(process.env.KIMI_SHARE_DIR,"~/.kimi",t,r),[...i,"config.json","config.json.bak"])}case"secret.cli.opencode":{let i=ae(V(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"opencode"),s=q(e).split("/").at(-1)??"",a=process.env.OPENCODE_DB?.trim(),l=a&&a!==":memory:"?[a,`${a}-wal`,`${a}-shm`]:[];return U(e,i,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(s)&&U(e,i,[s])||l.some((c)=>Or(e,c,t,r))}case"secret.cli.opencode.config":{let i=process.env.OPENCODE_CONFIG_DIR?V(process.env.OPENCODE_CONFIG_DIR,"~/.config/opencode",t,r):ae(V(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"opencode"),s=process.env.ProgramData?[ae(V(process.env.ProgramData,"",t,r),"opencode")]:[],a=["opencode.json","opencode.jsonc"];return a.includes(q(e).split("/").at(-1)??"")||U(e,i,a)||(process.env.OPENCODE_CONFIG?.trim()?Or(e,process.env.OPENCODE_CONFIG,t,r):!1)||["/Library/Application Support/opencode","/etc/opencode",...s].some((l)=>U(e,at(l,t,r),a))}case"secret.cli.pi":return U(e,V(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["auth.json"]);case"secret.cli.pi.config":return U(e,V(process.env.PI_CODING_AGENT_DIR,"~/.pi/agent",t,r),["models.json"]);case"secret.cli.amp":{let i=at("~",t,r);return[ae(V(process.env.XDG_DATA_HOME,"~/.local/share",t,r),"amp"),ae(i,".local","share","amp")].some((a)=>U(e,a,["secrets.json"]))||Ir(e,ae(i,".amp"),["oauth"])}case"secret.cli.amp.config":{let i=["settings.json","settings.jsonc"],s=[ae(V(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"amp"),ae(at("~",t,r),".config","amp")],a=q(e).split("/");return s.some((l)=>U(e,l,i))||a.at(-2)===".amp"&&i.includes(a.at(-1)??"")||(process.env.AMP_SETTINGS_FILE?.trim()?Or(e,process.env.AMP_SETTINGS_FILE,t,r):!1)}case"secret.cli.cursor":{let i=ae(V(process.env.XDG_CONFIG_HOME,"~/.config",t,r),"cursor"),s=ae(V(process.env.CURSOR_DATA_DIR,"~/.cursor",t,r),"projects");return U(e,at("~/.cursor",t,r),["auth.json"])||U(e,i,["auth.json"])||q(e).split("/").at(-1)==="mcp-auth.json"&&Qt(q(e),q(s))}case"secret.cli.cursor.config":{let i=q(e).split("/");return i.at(-1)==="mcp.json"&&i.at(-2)===".cursor"}case"secret.cli.grok-build":return U(e,V(process.env.GROK_HOME,"~/.grok",t,r),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let i=q(e).split("/");return i.at(-1)==="config.toml"&&i.at(-2)===".grok"||U(e,V(process.env.GROK_HOME,"~/.grok",t,r),["config.toml","managed_config.toml","requirements.toml"])||U(e,at("/etc/grok",t,r),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}function V(e,t,n,r){return at(e?.trim()?e:t,n,r)}function U(e,t,n){return n.some((r)=>Vf(e,ae(t,r)))}function Ir(e,t,n){return n.some((r)=>Qt(q(e),q(ae(t,r))))}function Or(e,t,n,r){return Vf(e,at(t,n,r))}function Vf(e,t){return q(e)===q(t)}function ae(e,...t){return qe([e,...t].filter(Boolean).join("/"))}function gw(e,t,n,r,o){if(n.length===0)return!1;let i=q(Dr(e,t,o));return n.some((s)=>Qt(i,q(Dr(s,r,o))))}function hw(e,t,n,r,o){if(n.length===0)return!1;let i=q(Dr(e,t,o));if(!i)return!1;let s=process.env.HOME??Ya(),a=s?qe(H(pe(s),De,o)):"",l=q(a),c=process.env.CC_SAFETY_NET_HOME,u=q(c?qe(H(Mi(pe(c)),De,o)):a&&qe(H(`${a}/.cc-safety-net`,De,o)));if(u&&Qt(i,u))return!1;return n.some((m)=>{let f=q(Dr(m,r,o));if(!f)return!1;if(l&&(l===f||l.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Qt(i,f)})}function yw(e){let t=e.split("/");return t.some((n)=>dw.has(n))||mw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Cw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Da)if(r===o.extension&&yt(o.id,t))return o.id;for(let o of La)if(o.pattern.test(r)&&yt(o.id,t))return o.id;return null}function q(e){return e.toLowerCase()}function yt(e,t){return!t?.disabledRules?.includes(e)}function at(e,t,n){let{home:r,normalized:o}=Za(e,n);if(!o)return"";if(!r)return o;let i=Xa(o,r),s=Ii(i)?i:qe(Mi(t,i)),a=qe(H(s,De,n));if(!Qt(a,r)){if(Ii(i))return a;return a===s?o:a}let l=a.slice(r.length);return l?`~${l}`:"~"}function Of(e,t){return e===t||e.startsWith(`${t}/`)}function bw(e,t,n){let{home:r,normalized:o}=Za(e,n);if(!o||!r)return"";let i=Xa(o,r),s=iE.normalize(Ii(i)?i:qe(Mi(t,i))),a=qe(pe(process.env.HOME??Ya())),l=(m)=>process.platform==="win32"?m.toLowerCase():m,c=[r,a].find((m)=>m!==""&&Qt(l(s),l(m)));if(c===void 0)return"";let u=s.slice(c.length);return u?`~${u}`:"~"}function Dr(e,t,n){let{home:r,normalized:o}=Za(e,n);if(!o)return"";let i=r?Xa(o,r):o;return qe(H(Ii(i)?i:Mi(t,i),De,n))}function Za(e,t){let n=process.env.HOME??Ya(),r=n?qe(H(pe(n),De,t)):"",o=qe(pe(Sw(Je(e))));return{home:r,normalized:o}}function Sw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return aE(e)}catch{return e}}function Xa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function vw(e){if(process.platform==="win32")return!0;return sE.parse(e).root.length>1}function qe(e){let t=e.trim(),n=(vw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Qt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function en(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}import{dirname as Ct}from"node:path";var qf="Rulebook exceeds CC Safety Net's safe validation limits.",Kf="Additional rulebook validation errors were omitted.",Ke=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Yf(e){if(Ja(e.allowed_commands,Ke.maxAllowedCommands)||Ja(e.rules,Ke.maxRules)||Ja(e.tests,Ke.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ke,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ke.maxStringCodeUnits||i&&o.length>Ke.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;if(!Array.isArray(i.block_args))continue;if(i.block_args.length>Ke.maxBlockArgsPerRule||i.block_args.length>n)return!1;n-=i.block_args.length;for(let s of i.block_args)if(!r(s))return!1}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ja(e,t){return Array.isArray(e)&&e.length>t}function Rw(e){if(!xw(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Yf(e))return{errors:[qf],ruleNames:new Set};let t=Mm().safeParse(e),n=[...e.rulebook_version===1?[]:["rulebook_version must be 1"],...t.success?[]:An(t.error.issues,": ",": ")];return{errors:n.length>Ke.maxValidationErrors?[...n.slice(0,Ke.maxValidationErrors),Kf]:n,ruleNames:new Set(Na(e).map((r)=>r.toLowerCase()))}}function Ln(e){let t=Rw(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}function xw(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}var Ew=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#([A-Za-z0-9._-]+)$/;function Di(e){if(Pn(e.spec))return Pw(e);return ww(e)}function ww(e){if(!Ie.test(e.spec))return`Local rulebook sources must be bare names matching ${Ie}: ${e.spec}`;if(e.kind!=="local-directory")return`lock entry for ${e.spec} must use local-directory kind`;if(e.path===e.spec&&e.name===e.spec)return null;return`lock entry for ${e.spec} does not match local source identity`}function Pw(e){let t=Rr(e.spec);if(t)return t;let n=wn(e.spec);if(e.kind!=="github")return`lock entry for ${e.spec} must use github kind`;if(e.owner===n.owner&&e.repo===n.repo&&e.ref===n.ref&&e.path===n.path&&e.name===n.name)return null;return`lock entry for ${e.spec} does not match GitHub source identity`}function XM(e,t,n){let r=Xf(e.rules,n);if(r.length>0)return{ok:!0,specs:r};if(!t)return{ok:!1,result:{ok:!1,errors:[`No lockfile available to match rulebook name ${n}; use the exact source or run ${Ve}`],warnings:[],entries:[]}};let o=new Set(e.rules),i=t.rulebooks.filter((s)=>s.name===n&&o.has(s.spec)).map((s)=>s.spec);if(i.length===1)return{ok:!0,specs:i};return Zf(n,i)}function JM(e,t,n){let r=Xf(e,n);if(r.length>0)return{ok:!0,specs:r};let o=_w(e,n);if(o.length>0)return{ok:!0,specs:o};let i=Aw(e,n);if(!i.ok)return i;if(i.specs.length>0)return{ok:!0,specs:i.specs};let s=t?e.filter((a)=>t.rulebooks.find((l)=>l.spec===a)?.name===n):[];if(s.length===1)return{ok:!0,specs:s};return Zf(n,s)}function Zf(e,t){return{ok:!1,result:{ok:!1,errors:t.length===0?[`No configured rulebook matches ${e}`]:[`Ambiguous rulebook match ${e}: ${t.join(", ")}`],warnings:[],entries:[]}}}function Xf(e,t){return e.filter((n)=>n===t)}function _w(e,t){let n=t.match(Ew),r=n?.[1],o=n?.[2],i=n?.[3];if(!r||!o||!i)return[];return Qf(e,(s)=>s.owner===r&&s.repo===o&&s.ref===i)}function Aw(e,t){if(!wm(t))return{ok:!0,specs:[]};let[n,r]=t.split("/"),o=Qf(e,(s)=>s.owner===n&&s.repo===r);if(new Set(o.map((s)=>Jf(s)?.ref).filter((s)=>!!s)).size<2)return{ok:!0,specs:o};return{ok:!1,result:{ok:!1,errors:[`Multiple refs are configured for ${t}. Use an explicit ref:`,`  cc-safety-net rule remove ${t}#<ref>`],warnings:[],entries:[]}}}function Jf(e){try{return wn(e)}catch{return null}}function Qf(e,t){return e.filter((n)=>{let r=Jf(n);return r?t(r):!1})}function Qa(e){let t=typeof e==="string"?e:e.path;try{let n=gt(typeof e==="string"?Ei(e):e);if(n===null)return{lock:null,errors:[]};let r=JSON.parse(n);if(!r||typeof r!=="object")return{lock:null,errors:[`malformed lockfile ${t}: must be an object`]};let o=r;if(o.version!==1||!Array.isArray(o.rulebooks))return{lock:null,errors:[`malformed lockfile ${t}`]};let i=Dm().safeParse(o),s=o.rulebooks.flatMap((l,c)=>{let u=i.success?[]:i.error.issues.filter((f)=>f.path[1]===c);if(u.length>0)return An(u).map((f)=>`${t}: ${f}`);let m=Di(l);return m?[`${t}: rulebooks[${c}]: ${m}`]:[]});if(!i.success||s.length>0)return{lock:null,errors:[`malformed lockfile ${t}`,...s]};return{lock:{version:1,rulebooks:i.data.rulebooks.map((l)=>{if(l.kind==="local-directory")return{spec:l.spec,kind:l.kind,path:l.path,name:l.name,version:l.version,digest:l.digest};let c={spec:l.spec,kind:l.kind,owner:l.owner,repo:l.repo,ref:l.ref,commit:l.commit,path:l.path,name:l.name,version:l.version,digest:l.digest};return typeof l.display_ref==="string"&&l.display_ref!==""?{...c,display_ref:l.display_ref}:c})},errors:[]}}catch(n){if(n instanceof L)return{lock:null,errors:[n.message]};return{lock:null,errors:["malformed lockfile"]}}}import{createHash as kw}from"node:crypto";import{dirname as Li,join as Tw}from"node:path";var np=Object.freeze({timeoutMs:15000,metadataBytes:524288,commitBytes:262144,treeBytes:16777216,rawBytes:4194304});async function ep(e,t,n,r=Me(Li(Li(t)),"rules policy"),o=yi()){if(Pn(e))return Ow(e,o);return Iw(e,t,n,r)}async function mD(e,t,n,r,o,i=yi()){if(!Pn(e)||n.refresh)return ep(e,t,n,o,i);let s=r?.rulebooks.find((a)=>a.spec===e);if(!s||s.kind!=="github")return ep(e,t,n,o,i);return Mw(s,t,n,o,i)}async function fD(e,t=yi()){let[n,r]=e.split("/");if(!n||!r)throw Error(`Invalid GitHub repository source: ${e}`);let o=await Lr(`https://api.github.com/repos/${n}/${r}`,"metadata",t),i=o.response;if(!i.ok)throw Error(`Failed to inspect ${e}: GitHub returned ${i.status}`);let a=JSON.parse(o.content)?.default_branch;if(typeof a!=="string"||a==="")throw Error(`Failed to inspect ${e}: missing default branch`);let l=await op(n,r,a,e,t),c=await Lr(`https://api.github.com/repos/${n}/${r}/git/trees/${l}?recursive=1`,"tree",t),u=c.response;if(!u.ok)throw Error(`Failed to inspect ${e}: GitHub tree returned ${u.status}`);let m=JSON.parse(c.content);if(!Array.isArray(m?.tree))throw Error(`Failed to inspect ${e}: unexpected GitHub tree response`);let d=m.tree.flatMap((p)=>{if(!p||typeof p!=="object")return[];let g=p;if(g.type!=="blob"||typeof g.path!=="string")return[];let y=g.path.match(Aa);return y?.[1]?[y[1]]:[]}).sort();if(d.length===0)throw Error(`No rulebooks found in ${e} under ${bi}/`);return d.map((p)=>({spec:`${n}/${r}#${l}/${p}`,display_ref:a}))}function Iw(e,t,n,r){ka(e);let o=Ww(t,e),i=gt(se(r,o));if(i===null)throw Error(`Rulebook source not found: ${e}`);let s=Ln(el(i,"Invalid local rulebook source."));if(s.name!==e)throw Error(`rulebook name "${s.name}" must match local source "${e}"`);return{rulebook:s,content:i,entry:{spec:e,kind:"local-directory",path:e,name:s.name,version:s.version,digest:Nn(i)}}}async function Ow(e,t){let n=wn(e),r=await op(n.owner,n.repo,n.ref,e,t),o=await Lr(`https://raw.githubusercontent.com/${n.owner}/${n.repo}/${r}/${n.path}`,"raw",t),i=o.response;if(!i.ok)throw Error(`Failed to fetch ${e}: GitHub raw returned ${i.status}`);let s=o.content,a=Ln(el(s,"Invalid GitHub rulebook response."));if(a.name!==n.name)throw Error(`rulebook name "${a.name}" must match GitHub source "${n.name}"`);return{rulebook:a,content:s,entry:{spec:e,kind:"github",owner:n.owner,repo:n.repo,ref:n.ref,commit:r,path:n.path,name:a.name,version:a.version,digest:Nn(s)}}}async function Mw(e,t,n,r=Me(Li(Li(t)),"rules policy"),o){let i=Di(e);if(i)throw Error(`${i}; run ${Ve}`);let s=_i(e,Ai(t,n)),a=gt(se(r,s));if(a!==null){if(Nn(a)===e.digest)return{entry:e,rulebook:rp(a,e),content:a}}return Dw(e,o)}async function Dw(e,t){let n=await Lr(`https://raw.githubusercontent.com/${e.owner}/${e.repo}/${e.commit}/${e.path}`,"raw",t),r=n.response;if(!r.ok)throw Error(`Failed to restore ${e.spec}: GitHub raw returned ${r.status}`);let o=n.content;if(Nn(o)!==e.digest)throw Error(`locked GitHub digest mismatch for ${e.spec}; run ${Ve}`);return{entry:e,rulebook:rp(o,e),content:o}}function rp(e,t){let n=Ln(el(e,"Invalid cached rulebook."));if(n.name!==t.name)throw Error(`rulebook name "${n.name}" must match lock entry "${t.name}"`);return n}function el(e,t){try{return JSON.parse(e)}catch{throw Error(t)}}async function op(e,t,n,r,o){let i=await Lr(`https://api.github.com/repos/${e}/${t}/commits/${encodeURIComponent(n)}`,"commit",o),s=i.response;if(!s.ok)throw Error(`Failed to resolve ${r}: GitHub returned ${s.status}`);let a=JSON.parse(i.content);if(typeof a?.sha!=="string"||a.sha==="")throw Error(`Failed to resolve commit for ${r}`);return a.sha}async function Lw(e,t,n={}){if(n.signal?.aborted)throw n.signal.reason;let r=n.budget??hi(),o=new AbortController,i=()=>o.abort(n.signal?.reason);n.signal?.addEventListener("abort",i,{once:!0});let s=!1,a=setTimeout(()=>{if(o.signal.aborted)return;s=!0,o.abort()},n.timeoutMs??np.timeoutMs);try{if(n.signal?.aborted)throw n.signal.reason;vm(r);let l=await(n.fetch??fetch)(e,{signal:o.signal,redirect:"error"});if(!l.ok)return ip(l),{response:l,content:""};return{response:l,content:await Nw(l,t,r,()=>o.abort())}}catch(l){if(s)throw Error("GitHub request timed out",{cause:l});if(n.signal?.aborted)throw n.signal.reason;throw l}finally{clearTimeout(a),n.signal?.removeEventListener("abort",i)}}function Lr(e,t,n){return Lw(n.resolveUrl?.(e)??e,t,{budget:n.budget,signal:n.controller.signal})}async function Nw(e,t,n=hi(),r){let o=np[`${t}Bytes`],i=Number(e.headers.get("content-length"));if(Number.isFinite(i)&&i>o)throw ip(e),Error(`GitHub ${t} response exceeds ${o} bytes`);if(!e.body)return"";let s=e.body.getReader(),a=[],l=0;while(!0){let c=await s.read();if(c.done)break;try{Rm(n,c.value.byteLength)}catch(u){throw r?.(),tp(s),u}if(l+=c.value.byteLength,l>o)throw r?.(),tp(s),Error(`GitHub ${t} response exceeds ${o} bytes`);a.push(Buffer.from(c.value))}return Buffer.concat(a,l).toString("utf-8")}function ip(e){if(!e.body)return;sp(()=>e.body?.cancel())}function tp(e){sp(()=>e.cancel())}function sp(e){try{Promise.resolve(e()).catch(()=>{})}catch{}}function Ww(e,t){return Tw(e,t,Ci)}function Nn(e){return`sha256:${kw("sha256").update(e).digest("hex")}`}function cp(e={}){let t=sf(e),n=!1;try{n=jm(t.userConfigTarget,t.projectConfigTarget)}catch(f){if(f instanceof L)return Uw(t,f.message);throw f}let r=Tn(t.userConfigTarget),o=n?{config:null,errors:[]}:Tn(t.projectConfigTarget),i=lp(t.userConfigPath,r.errors),s=lp(t.projectConfigPath,o.errors),a=new Set,l=r.config?tl(r.config,t.userLockPath,Ct(t.userConfigPath),e,"user",t.userScope,a):Nr(),c=o.config?tl(o.config,t.projectLockPath,Ct(t.projectConfigPath),e,"project",t.projectScope,a):Nr(),u=r.config?.overrides??{},m=o.config?.overrides??{};return{rules:[...ap(l.rules,u),...ap(c.rules,m)],transparent_wrappers:$w(r.config,o.config),rulebooks:[...l.rulebooks,...c.rulebooks],errors:[...i,...s,...l.errors,...c.errors],warnings:[...l.warnings,...c.warnings,...l.canValidateOverrides?nl(u,l.knownRuleIds,t.userConfigPath):[],...l.canValidateOverrides?Bw(m,l.knownRuleIds,t.projectConfigPath):[],...c.canValidateOverrides?nl(m,c.knownRuleIds,t.projectConfigPath):[]],userConfig:r.config??void 0,projectConfig:o.config??void 0,...t}}function RD(e,t){let n=t??Me(Ct(Ct(e)),"rules policy"),r=Tn(se(n,e)).config,o=Qa(se(n,Xt(e))).lock;if(!r||!o)return new Map;let i=new Set(r.rules);return new Map(o.rulebooks.filter((s)=>i.has(s.spec)).map((s)=>[s.spec,cf(s)]))}function xD(e,t,n,r){let o=Fw(e,t,n,r);if(!o)return[];return[...o.scope.errors,...o.scope.warnings,...Gw(o.config,o.scope,e)]}function Fw(e,t,n,r){let o=r??Me(Ct(Ct(e)),"rules policy"),i=Tn(se(o,e)).config;if(!i)return null;return{config:i,scope:tl(i,t,Ct(e),n,"project",o)}}function Gw(e,t,n){return t.canValidateOverrides?nl(e.overrides??{},t.knownRuleIds,n):[]}function tl(e,t,n,r,o,i=Me(Ct(Ct(n)),o==="user"?"user policy":"project policy"),s=new Set){let a;try{a=se(i,t)}catch(y){if(y instanceof L)return{...Nr(),errors:[y.message],canValidateOverrides:!1};throw y}let l=Qa(a);if(l.errors.length>0)return{...Nr(),errors:l.errors,canValidateOverrides:!1};let c=l.lock;if(!c&&e.rules.length>0)return{...Nr(),errors:[`missing lockfile ${t}; run ${Ve}`],canValidateOverrides:!1};let u=c?.rulebooks??[],m=new Map(u.map((y)=>[y.spec,y])),f=[],d=[],p=e.rules.flatMap((y)=>{let h=m.get(y);if(!h)return f.push(`missing lock entry for ${y}; run ${Ve}`),[];let R=zw(h,n,r,i);if(R.errors.length>0||!R.rulebook)return f.push(...R.errors),[];let x=R.rulebook;if(s.has(x.name))return d.push(`duplicate active rulebook name "${x.name}" for ${y}; keeping the first and ignoring this one, so its rules are not active; rename one of them, then run ${Ve}`),[];return s.add(x.name),[{rules:x.rules.map((A)=>({...A,name:`${x.name}/${A.name}`})),rulebook:{source:o,spec:h.spec,name:x.name,version:x.version,rules:x.rules.map((A)=>`${x.name}/${A.name}`)}}]}),g=p.flatMap((y)=>y.rules);return{rules:g,rulebooks:p.map((y)=>y.rulebook),entries:u,knownRuleIds:new Set(g.map((y)=>y.name)),errors:f,warnings:d,canValidateOverrides:f.length===0}}function zw(e,t,n,r){let o=_i(e,Ai(t,n)),i;try{i=gt(se(r,o))}catch(a){if(a instanceof L)return{rulebook:null,errors:[a.message]};throw a}if(i===null)return{rulebook:null,errors:[`missing cache entry for ${e.spec}; run ${Ve}`]};if(Nn(i)!==e.digest)return{rulebook:null,errors:[`cache digest mismatch for ${e.spec}; run ${Ve}`]};let s;try{s=JSON.parse(i)}catch{return{rulebook:null,errors:[`invalid cached rulebook for ${e.spec}`]}}try{Ln(s)}catch(a){return{rulebook:null,errors:[`invalid cached rulebook for ${e.spec}: ${a instanceof Error?a.message:"invalid rulebook"}`]}}return{rulebook:s,errors:[]}}function $w(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function ap(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function nl(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Bw(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function lp(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Uw(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,userLockPath:e.userLockPath,projectLockPath:e.projectLockPath}}function Nr(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}function up(e={}){let t=cp(e),n=pf(e),r={rules:t.rules,transparentWrappers:t.transparent_wrappers,safety:n.safety,worktreeMode:n.worktreeMode,destructiveCommandProtectionEnabled:n.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:n.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:n.destructiveCommandAllowPaths,secretProtection:{enabled:n.secretProtection.enabled??!0,disabledRules:n.secretProtection.disabledRules??[],denyPaths:n.secretProtection.denyPaths,allowPaths:n.secretProtection.allowPaths??[]}},o={...t.userConfig?.overrides??{},...t.projectConfig?.overrides??{}},i=Object.freeze(Object.fromEntries(r.rules.map((s)=>{let a=t.rulebooks.find((c)=>c.rules.includes(s.name)),l=o[s.name];return[s.name,Object.freeze({id:s.name,...a?{rulebook:Object.freeze({name:a.name,version:a.version}),...qw(a.spec)?{source:a.spec}:{}}:{},...l&&typeof l==="object"?{override:Object.freeze({type:"reason",reason:l.reason})}:{}})]})));return Kw(r,Hw(t,n),i)}function _D(e){if(e.state==="ready")return{state:e.state};return{state:e.state,reason:e.reason}}function Hw(e,t){let n=Vw(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Yw(e.errors.length>0?jw(e.errors):void 0,e.warnings.length>0?rl(e.warnings.join("; ")):void 0,n)}}function jw(e){return`${rl(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Vw(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function qw(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Kw(e,t,n=Object.freeze({})){let r=dp(structuredClone(e));if(!t)return Object.freeze({state:"ready",policy:r,diagnostics:Object.freeze([]),ruleMetadata:n});return Object.freeze({state:"degraded",policy:r,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n})}function dp(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))dp(t);return Object.freeze(e)}function Yw(...e){return rl(e.filter((t)=>!!t).join("; "))}function rl(e){return/[.!?]$/.test(e)?e:`${e}.`}class ol extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Zw={findPolicyMutation:vf,findGitMetadataMutation:lu,resolveGitMetadata:Es,loadPolicySnapshot:up,findSensitiveTarget:Wf,analyzeCommand:wa,getModes:gi};function zD(e,t={}){let n={...Zw,...t.dependencies},r=Qw(e),o=Wr(e)?e.command:r,i=tn("policy-protection",o,()=>Lo(e,t.factParserDependencies)),s=be(i,"declared-command");if(Wr(e)&&e.command?.trim()&&s?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:lt,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(be(i,"input-candidate")?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:dl,intent:"stop_and_explain",evidence:[]}};let a=tn("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd])),l=tn("policy-protection",o,()=>n.findPolicyMutation(i));if(l){let y=o??l.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Sf,intent:"hard_stop",evidence:[{kind:"command",command:y,segment:l.target}]}}}let c=tn("policy-protection",o,()=>n.findGitMetadataMutation(i,a));if(c){let y=o??c.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,intent:"hard_stop",evidence:[{kind:"command",command:y,segment:c.target}]}}}let u=tn("config-load",o,()=>n.loadPolicySnapshot({...t.policyOptions,cwd:e.context.configCwd})),m=u.policy,f=n.getModes(m),d={level:f.effectiveLevel,...Xw(u)},p=m.secretProtection.enabled===!1?null:tn("secret-protection",o,()=>n.findSensitiveTarget(i,m.secretProtection,{strict:Wr(e)?f.strict:void 0}));if(p){let y=o??p.target;return{stage:"secret-protection",...d,decision:{kind:"deny",reason:Mf,intent:"hard_stop",ruleId:p.ruleId,evidence:[{kind:"command",command:y,segment:p.target}]}}}if(!Wr(e))return{stage:"non-command",...d,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...il("command-validation",o),...d};let g=tn("command-analysis",o,()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:u,environment:ct(),protectedGitMetadata:a,effectiveCapabilities:f.capabilities,strict:f.strict,paranoidRm:f.paranoidRm,paranoidInterpreters:f.paranoidInterpreters,worktreeMode:f.worktreeMode},Jw(i),i.store));if(g)return{stage:"command-analysis",...d,decision:g};return{stage:"command-analysis",...d,decision:{kind:"allow"}}}function Xw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Jw(e){return be(e,"declared-command")?.program}function Qw(e){try{return Do(e.input)}catch(t){let n=Wr(e)?e.command:void 0;throw new ol("policy-protection",il("policy-protection",t instanceof er?void 0:n,t),t)}}function tn(e,t,n){try{return n()}catch(r){throw new ol(e,il(e,r instanceof er?void 0:t,r),r)}}function il(e,t,n){let r=n instanceof Pe||n instanceof xt;return{stage:e,decision:{kind:"deny",reason:r?ml:fl,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function Wr(e){return e.route.kind==="command"}
+export{ym as q,Cm as r,De as s,ct as t,L as u,se as v,Ei as w,gt as x,Hm as y,jm as z,kO as A,TO as B,IO as C,OO as D,MO as E,Rx as F,Ie as G,Ci as H,bi as I,wm as J,ef as K,Ve as L,rf as M,Jt as N,of as O,YO as P,Xt as Q,ZO as R,XO as S,sf as T,JO as U,cf as V,_i as W,QO as X,Ai as Y,iP as Z,sP as _,aP as $,Ep as aa,fl as ba,Pe as ca,Jr as da,H as ea,Yr as fa,Ki as ga,Dt as ha,er as ia,C_ as ja,Do as ka,Uc as la,Vc as ma,xt as na,Lo as oa,Cy as pa,Ae as qa,lu as ra,Es as sa,Tu as ta,WA as ua,ie as va,VR as wa,JI as xa,gi as ya,br as za,xa as Aa,QI as Ba,gm as Ca,sO as Da,wa as Ea,pl as Fa,vr as Ga,Sm as Ha,bm as Ia,yi as Ja,_m as Ka,EO as La,Na as Ma,Er as Na,An as Oa,kx as Pa,Tn as Qa,GO as Ra,zO as Sa,$O as Ta,Pi as Ua,Ti as Va,On as Wa,fM as Xa,ki as Ya,pM as Za,Hx as _a,gM as $a,In as ab,gf as bb,hf as cb,Sf as db,vf as eb,Mf as fb,Wf as gb,Ln as hb,XM as ib,JM as jb,Qa as kb,mD as lb,fD as mb,cp as nb,RD as ob,xD as pb,tl as qb,up as rb,_D as sb,Kw as tb,ol as ub,zD as vb};