cc-safety-net 2.4.1 → 2.4.3

package/dist/chunks/index-chc1n91k.js

@@ -1,48 +0,0 @@
-var Js="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Un="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",re="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Xs={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Zp={errorCode:"structural-shell-syntax-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},br={errorCode:"tool-input-limit",reason:"CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user."},bo={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},hi={errorCode:"structural-shell-syntax-limit",reason:"Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry."},n=Object.freeze({realpathAttempts:{cap:16384,...Xs},processedCandidateBytes:{cap:4194304,...Xs},pathEnvironmentExpansion:{cap:64,...Xs},structuralShellSyntax:Zp,recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...bo},trackedHeredocFiles:{cap:64,...bo},controlFlowStates:{cap:64,...bo},wrapperPeelIterations:{cap:20,...bo},derivedCommandShape:bo,parallelChildAnalyses:{cap:1024,...hi},parallelDerivedTokens:{cap:16384,...hi},parallelDerivedBytes:{cap:1048576,...hi},parallelPlaceholderReplacements:{cap:16384,...hi},hookInputBytes:{cap:8388608,errorCode:"tool-input-limit",reason:"Failed to parse hook input JSON."},toolInputDepth:{cap:64,...br},toolInputNodes:{cap:1e4,...br},toolInputKeys:{cap:1e4,...br},toolInputStringBytes:{cap:1048576,...br},toolInputAggregateStringBytes:{cap:4194304,...br},toolInputGitDiffCandidates:{cap:64,...br},toolInputShape:br});class a extends Error{kind;name="AnalysisLimit";constructor(M){super(n[M].reason);this.kind=M}}function Cn(){let M=new Map;return{counters:M,resolvedPaths:new Map,charge(F,q=1){let te=(M.get(F)??0)+q;if(M.set(F,te),te>n[F].cap)throw new a(F)}}}import{lstatSync as Ng,realpathSync as Lg,statSync as Wg}from"node:fs";import{homedir as Fg,tmpdir as Gg}from"node:os";import{statSync as Og}from"node:fs";import{join as Mg}from"node:path";import{basename as Rc,dirname as Xp,isAbsolute as Jp,join as Qp,normalize as eg,resolve as vc}from"node:path";var tg=256,yi=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function vn(M,F=process.platform){if(F!=="win32")return M;return M.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function sr(M,F=process.platform){if(F!=="win32")return!1;return(M[0]==="/"||M[0]==="\\")&&(M[1]==="/"||M[1]==="\\")}function na(M,F){return Qs(M,0,F)}function Qs(M,F,q){let te="",ne=0;while(ne<M.length){if(M[ne]!=="$"){te+=M[ne],ne++;continue}if(M[ne+1]==="{"){let Ke=ea(M,ne+2),mt=ng(M,ne,F);if(mt===null){if(yi.has(Ke))throw new a("pathEnvironmentExpansion");te+=M.slice(ne);break}let gt=M.slice(ne,mt+1);te+=rg(gt,F,q),ne=mt+1;continue}let we=ea(M,ne+1);if(!we){te+="$",ne++;continue}te+=ta(we,q)??`$${we}`,ne+=we.length+1}return te}function ng(M,F,q){let te=1;for(let ne=F+2;ne<M.length;ne++){if(M[ne]==="\\"){ne++;continue}if(M[ne]==="$"&&M[ne+1]==="{"){if(te++,q+te>n.pathEnvironmentExpansion.cap)throw new a("pathEnvironmentExpansion");ne++;continue}if(M[ne]!=="}")continue;if(te--,te===0)return ne}return null}function rg(M,F,q){let te=M.slice(2,-1),ne=ea(te,0);if(!ne)return M;let we=te.slice(ne.length);if(!we)return ta(ne,q)??M;let Ke=[":-",":+",":=",":?","-","+","=","?"].find((ht)=>we.startsWith(ht));if(!Ke){if(yi.has(ne))throw new a("pathEnvironmentExpansion");return M}if(!yi.has(ne))return M;if(Ke.endsWith("="))throw new a("pathEnvironmentExpansion");let mt=ta(ne,q),gt=Ke.startsWith(":")?mt!==null&&mt!=="":mt!==null;if(Ke.endsWith("?")&&!gt)throw new a("pathEnvironmentExpansion");if(Ke.endsWith("-")||Ke.endsWith("?"))return gt?mt??"":Qs(we.slice(Ke.length),F+1,q);return gt?Qs(we.slice(Ke.length),F+1,q):""}function ea(M,F){if(!/[A-Za-z_]/.test(M[F]??""))return"";let q=F+1;while(/[A-Za-z0-9_]/.test(M[q]??""))q++;return M.slice(F,q)}function ta(M,F){if(!yi.has(M))return null;if(M==="HOME")return F.env.get("HOME")??F.home;return F.env.get(M)??null}function Ht(M,F,q){if(!M)return M;let te=q.resolvedPaths.get(M);if(te!==void 0)return te;let ne=[],we=M;while(!0){xc(q,we);let Ke=F.realpath(we);if(Ke!==null)return Ec(q,M,Ke,ne);let mt=Xp(we);if(mt===we||ne.length>=tg)return Ec(q,M,we,ne);ne.push(Rc(we)),we=mt}}function Ec(M,F,q,te){let ne=te.length===0?q:Qp(q,...te.reverse());return M.resolvedPaths.set(F,ne),ne}function og(M,F,q){let te=q.resolvedPaths.get(M);if(te!==void 0)return te;xc(q,M);let ne=F.realpath(M);if(ne!==null)q.resolvedPaths.set(M,ne);return ne}function xc(M,F){M.charge("realpathAttempts"),M.charge("processedCandidateBytes",Buffer.byteLength(F))}function ln(M,F,q,te){let ne=wc(M,F,q);if(!ne)return"";return Ht(ne,q.paths,te).replace(/\\/g,"/")}function _c(M,F,q,te,ne){let we=wc(M,F,q);if(!we)return null;if(ne(Rc(we)))return Ht(we,q.paths,te).replace(/\\/g,"/");let Ke=og(we,q.paths,te);return Ke===null?null:Ke.replace(/\\/g,"/")}function wc(M,F,q){let te=q.home,ne=na(M.trim(),q).replace(/\\/g,"/");if(!ne)return"";let we=ne==="~"?te:ne.startsWith("~/")?vc(te,ne.slice(2)):ne,Ke=vn(we);return eg(Jp(Ke)?Ke:vc(F,Ke))}import{spawnSync as ig}from"node:child_process";import{existsSync as Yr,lstatSync as sg,readFileSync as vr,realpathSync as qr,statSync as Co}from"node:fs";import{dirname as Si,isAbsolute as vo,join as Cr,resolve as Zr}from"node:path";var ag=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],lg=5000;function Ac(M,F=_g(),q=lg){let te=cg(M);if(te===null||!ug(te))return null;let ne=Rg(te,F,q);return ne===null?null:{recursiveSubmodules:ne}}function cg(M){try{let F=qr(Zr(M));return Co(F).isDirectory()?F:null}catch{return null}}function ug(M){let F=Eg(M);if(!F)return!1;try{let q=sg(F);if(q.isSymbolicLink()||!q.isFile())return!1;let te=ra(F);if(!te?.commonDir)return!1;if(!mg(te.gitDir,F))return!1;return pg(te.gitDir,Si(F))}catch{return!1}}function ra(M){try{let F=dg(M);if(!F)return null;let q=qr(vo(F)?F:Zr(Si(M),F));if(!Co(q).isDirectory())return null;return{gitDir:q,commonDir:fg(q)}}catch{return null}}function dg(M){let F=vr(M,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!F.startsWith("gitdir:"))return null;return F.slice(7).trim()||null}function fg(M){try{let F=vr(Cr(M,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!F)return null;let q=qr(vo(F)?F:Zr(M,F));return Co(q).isDirectory()?q:null}catch{return null}}function mg(M,F){let q=gg(M);return q===null?!1:Tc(M,q,F)}function pg(M,F){let q=hg(M);return q===null?!0:Tc(M,q,F)}function gg(M){let F=Cr(M,"gitdir");if(!Yr(F))return null;let q=vr(F,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return q===""?null:q}function hg(M){let F=Cr(M,"config.worktree");return Yr(F)?Sg(F):null}function Tc(M,F,q){try{return yg(vo(F)?F:Zr(M,F),q)}catch{return!1}}function yg(M,F){try{let q=Co(M),te=Co(F);if(q.ino!==0&&te.ino!==0&&q.dev===te.dev&&q.ino===te.ino)return!0}catch{}return Pc(qr.native(M))===Pc(qr.native(F))}function Pc(M){let F=M.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),q=F.length>1&&F.endsWith("/")?F.slice(0,-1):F;return process.platform==="win32"?q.toLowerCase():q}function Sg(M){let F=vr(M,"utf-8"),q=!1,te=null;for(let ne of F.split(/\r?\n/)){let we=ne.trim();if(we===""||we.startsWith("#")||we.startsWith(";"))continue;if(we.startsWith("[")){q=/^\[core\]$/i.test(we);continue}if(!q)continue;let Ke=we.match(/^worktree\s*=\s*(.*)$/i);if(Ke)te=bg(Ke[1]??"")}return te}function bg(M){let F=M.trim();if(!F.startsWith('"')||!F.endsWith('"'))return F;return vg(F.slice(1,-1))}var Cg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function vg(M){return M.replace(/\\(.?)/gs,(F,q)=>q===""?F:Cg[q]??F)}function Eg(M){try{return bi(qr(M))}catch{return null}}function bi(M){let F=M;while(!0){let q=Cr(F,".git");if(Yr(q))return q;let te=Si(F);if(te===F)return null;F=te}}function Rg(M,F,q){let te=xg(M);if(te===null||te)return!0;if(F===null)return!0;let ne=ig(F,["config","--get","submodule.recurse"],{cwd:M,encoding:"utf8",env:wg(process.env),stdio:["ignore","pipe","ignore"],timeout:q});if(ne.error!==void 0||ne.status!==0&&ne.status!==1)return null;return ne.status===0&&Ic(ne.stdout.trim())}function xg(M){let F=Pg(M);if(F===null)return null;return F.filter((q)=>Yr(q)).some((q)=>Ig(q))}function _g(){return ag.find((M)=>Yr(M))??null}function Eo(M){return M==="GIT_CONFIG_COUNT"||M==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(M)}function wg(M){return Object.fromEntries(Object.entries(M).filter(([F])=>!Eo(F)))}function Pg(M){let F=bi(M);if(F===null)return null;let q=Ag(F);if(q===null)return null;let te=Tg(q);if(te===null)return null;return[Cr(te,"config"),Cr(q,"config.worktree")]}function Ag(M){try{let q=vr(M,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!q.startsWith("gitdir:"))return M;let te=q.slice(7).trim();if(te==="")return null;return vo(te)?te:Zr(Si(M),te)}catch{return null}}function Tg(M){let F=Cr(M,"commondir");if(!Yr(F))return M;try{let q=vr(F,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(q==="")return null;return vo(q)?q:Zr(M,q)}catch{return null}}function Ig(M){let F;try{F=vr(M,"utf-8")}catch{return!0}let q="",te=!1;for(let ne of F.split(/\r?\n/)){let we=ne.trim();if(we===""||we.startsWith("#")||we.startsWith(";"))continue;let Ke=we.match(/^\[([^\]]+)\]$/);if(Ke){q=Ke[1]?.trim().toLowerCase()??"";continue}let mt=we.indexOf("="),gt=(mt===-1?we:we.slice(0,mt)).trim().toLowerCase(),ht=mt===-1?"true":we.slice(mt+1).trim();if(kg(q)&&gt==="path")return!0;if(q==="submodule"&&gt==="recurse")te=Ic(ht)}return te}function kg(M){return M==="include"||M.startsWith("includeif ")}function Ic(M){let F=M.toLowerCase();return F!=="false"&&F!=="no"&&F!=="off"&&F!=="0"}function kc(M,F){if(M==="")return null;let q=Cn(),te=bi(ln(M,M,F,q)),ne=te?Dg(te,M,F,q):null;if(!ne)return null;return Object.freeze({entries:Object.freeze([ne.entry]),markerFiles:Object.freeze(ne.markerFile?[ne.markerFile]:[]),directories:Object.freeze(ne.directories),hooksDirectories:Object.freeze(ne.hooksDirectories)})}function Dg(M,F,q,te){try{let ne=ln(M,F,q,te),we=Og(M),Ke=we.isFile()?ne:null,mt=we.isFile()?ra(M):null,gt=(we.isDirectory()?[ne]:[mt?.gitDir,mt?.commonDir]).flatMap((St)=>St?[Xr(ln(St,F,q,te))]:[]),ht=[...new Set(we.isDirectory()?[Xr(M.replace(/\\/g,"/")),...gt]:gt)];return{entry:Xr(ne),markerFile:Ke?Xr(Ke):null,directories:ht,hooksDirectories:[...new Set(ht.flatMap((St)=>{let bt=Xr(Mg(St,"hooks").replace(/\\/g,"/"));return[bt,Xr(ln(bt,F,q,te))]}))]}}catch{return null}}function Xr(M){return process.platform==="win32"?M.toLowerCase():M}var zg={realpath:(M)=>{try{return Lg(M)}catch{return null}},entryKind:(M)=>{let F=Ng(M,{throwIfNoEntry:!1});if(!F)return"missing";return F.isSymbolicLink()?"symlink":"present"},isDirectory:(M)=>{try{return Wg(M).isDirectory()}catch{return!1}}};function l(){return Bg({env:new Map(Object.entries(process.env).flatMap(([M,F])=>F===void 0?[]:[[M,F]])),home:vn(process.env.HOME||Fg()),tmpdir:Gg(),paths:zg})}function Bg(M,F={}){let q=new Map,te=new Map,ne={...M,gitMetadata:(we)=>Oc(q,we,()=>kc(we,ne)),worktreeFacts:(we)=>Oc(te,we,()=>Ac(we)),...F};return ne}function Oc(M,F,q){let te=M.get(F);if(te!==void 0)return te;let ne=q();return M.set(F,ne),ne}import{accessSync as gh,constants as Yc,statSync as hh}from"node:fs";import{isAbsolute as Xc,relative as yh,resolve as Sh,sep as bh}from"node:path";var $g=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function K(M){return Oe(M.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Oe(M){return $g.reduce((F,q)=>F.replace(q,"<redacted>"),M.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function Ye(M){return Mc(M).reduceRight((F,q)=>`${F.slice(0,q.valueStart)}<redacted>${F.slice(q.valueEnd)}`,M)}function R(M){return Oe(Ye(M))}function ot(M){return Mc(M).map((F)=>M.slice(F.valueStart,F.valueEnd))}function Je(M){return/[A-Za-z_][A-Za-z0-9_]*=/.test(M)}function Mc(M){return[...M.matchAll(/[A-Za-z_][A-Za-z0-9_]*=/g)].flatMap((F)=>{let q=M[F.index-1];if(F.index>0&&q&&!/[\s"'([{]/.test(q))return[];let te=F.index+F[0].length;if(te>=M.length)return[];return[{valueStart:te,valueEnd:Ug(M,te)}]})}function Ug(M,F){if(M.startsWith("$(",F))return Hg(M,F);let q=M[F];if(q==='"'||q==="'"){for(let ne=F+1;ne<M.length;ne++){if(q==='"'&&M[ne]==="\\"){ne++;continue}if(M[ne]===q)return ne+1}return M.length}let te=F;while(te<M.length&&!/\s/.test(M[te]??""))te++;return te}function Hg(M,F){let q=0,te;for(let ne=F;ne<M.length;ne++){let we=M[ne];if(te){if(te==='"'&&we==="\\"){ne++;continue}if(we===te)te=void 0;continue}if(we==='"'||we==="'"){te=we;continue}if(we==="$"&&M[ne+1]==="("){q++,ne++;continue}if(we!==")")continue;if(q--,q===0)return ne+1}return M.length}var jg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Vg(M){let F=M.maxLen??200,q=M.redact??((ne)=>ne),te=(ne)=>ne.length>F?`${ne.slice(0,F)}...`:ne;return["BLOCKED by CC Safety Net",`Reason: ${q(M.reason)}`,M.ruleId?`Rule: ${M.ruleId}`:void 0,M.toolName?`Tool: ${M.toolName}`:void 0,M.command?`Command: ${te(q(M.command))}`:void 0,M.segment&&M.segment!==M.command?`Segment: ${te(q(M.segment))}`:void 0,M.configWarning?`Config warning: ${q(M.configWarning)}`:void 0,jg[M.intent??"manual_only"]].filter((ne)=>ne!==void 0).join(`
-
-`)}function Ce(M,F){if(M.decision.kind!=="deny")return;let q=F.includeEvidence?M.decision.evidence.find((te)=>te.kind==="command"):void 0;return{reason:M.decision.reason,ruleId:M.decision.ruleId,intent:M.decision.intent,command:q?.command,segment:q?.segment,toolName:F.toolName,...M.configFallback?{configWarning:M.configFallback.reason}:{}}}function j(M={}){return{reason:re,intent:"stop_and_explain",command:M.command,segment:M.segment??M.command,toolName:M.toolName}}function Se(M){return Vg({...M,redact:K})}function it(M){return K(M instanceof Error?M.message:String(M))}import{types as Kg}from"node:util";var qg=new Set(["applypatch","patch"]),Yg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Zg=new Set(["grep","grepsearch","rg"]),Xg=new Set(["find","findbyname","glob"]),Jg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Qg=new Set(["command","diff","input","patch","patchtext"]),Dc=new TextEncoder,eh=new TextDecoder,th=/\s/,nh=64;class f extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Ro=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Gc(M){return M.replace(/[-_\s]/g,"").toLowerCase()}function vi(M){return Jg.has(Gc(M))}function ce(M){let F=Gc(M);if(qg.has(F))return"patch";if(Zg.has(F))return"grep";if(Xg.has(F))return"glob";if(Yg.has(F))return"path";return"unknown"}function oe(M){if(!M||typeof M!=="object")return;Vc(M);let F=Object.getOwnPropertyDescriptor(M,"command");if(!F){if("command"in M)Hn();return}if(F.get||F.set)Hn();let q=F.value;return typeof q==="string"&&q!==""?q:void 0}function zc(M,F){return Bc(M,F,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Bc(M,F,q,te){let ne=jc(M,q,te);if(!ne)return[];let we=ne.entries.flatMap(([Ke,mt])=>{let gt=Bc(mt,F,q,te+1);return typeof mt==="string"&&F.has($c(Ke))?[mt]:gt});return q.ancestors.delete(ne.object),we}function $c(M){return M.replace(/-/g,"_").toLowerCase()}function Uc(M){return Hc(M,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(oh)}function Hc(M,F,q,te){let ne=jc(M,q,te);if(typeof M==="string")return F?[M]:[];if(!ne)return[];let we=ne.entries.flatMap(([Ke,mt])=>Hc(mt,ne.array?F:Qg.has($c(Ke)),q,te+1));return q.ancestors.delete(ne.object),we}function rh(M,F,q){if(F.nodes++,M!==null&&typeof M==="object"&&q>Ro.maxDepth||F.nodes>Ro.maxNodes)Hn();if(typeof M!=="string")return;let te=Buffer.byteLength(M);if(F.stringBytes+=te,te>Ro.maxStringBytes||F.stringBytes>Ro.maxAggregateStringBytes)Hn()}function jc(M,F,q){if(rh(M,F,q),!M||typeof M!=="object")return null;let te=Vc(M);if(F.ancestors.has(M))Hn();let ne=Reflect.ownKeys(M);if(F.keys+=ne.length,F.keys>Ro.maxKeys)Hn();let we=ne.flatMap((Ke)=>{let mt=Object.getOwnPropertyDescriptor(M,Ke);if(!mt||mt.get||mt.set)Hn();return typeof Ke==="string"&&mt.enumerable?[[Ke,mt.value]]:[]});return F.ancestors.add(M),{object:M,array:te,entries:we}}function Vc(M){if(Kg.isProxy(M))Hn();let F=Array.isArray(M),q=Object.getPrototypeOf(M);if(F&&q!==Array.prototype||!F&&q!==Object.prototype&&q!==null)Hn();return F}function Hn(){throw new f}function oh(M){let F=[],q=M.split(/\r?\n/),te=!1,ne=!1,we=null,Ke=null,mt=()=>{ne=!1,we=null,Ke=null};for(let gt=0;gt<q.length;gt++){let ht=q[gt]??"";if(ht==="*** Begin Patch"){te=!0,mt();continue}if(ht==="*** End Patch"){te=!1,mt();continue}if(ht.startsWith("@@")){let St=ih(ht);if(ne=!0,we=St?.oldLines??null,Ke=St?.newLines??null,we===0&&Ke===0)mt();continue}if(ne&&we!==null&&Ke!==null){let St=ht.startsWith(" ")||ht.startsWith("-")?1:0,bt=ht.startsWith(" ")||ht.startsWith("+")?1:0;if(we=Math.max(0,we-St),Ke=Math.max(0,Ke-bt),we===0&&Ke===0)mt();continue}if(ht.startsWith("*** ")){mt(),F.push(...oa(ht));continue}if(ne)continue;if(ht.startsWith("diff --git ")){F.push(...oa(ht));continue}if(ht.startsWith("--- ")){let St=q[gt+1]??"";if(!St.startsWith("+++ "))continue;F.push(...sa(Ci(ht.slice(4),!0),Ci(St.slice(4),!0))),gt++;continue}if(!te)F.push(...oa(ht))}return F}function ih(M){let F=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(M);if(!F)return null;return{oldLines:Number(F[1]??1),newLines:Number(F[2]??1)}}function oa(M){let F=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(M);if(F?.[1])return Fc(F[1]);let q=/^\*\*\* Move to: (.+)$/.exec(M);if(q?.[1])return Fc(q[1]);if(M.startsWith("diff --git "))return sh(M.slice(11));let te=/^--- (.+)$/.exec(M);if(te?.[1])return Wc(te[1]);let ne=/^\+\+\+ (.+)$/.exec(M);if(ne?.[1])return Wc(ne[1]);let we=/^(?:rename|copy) (?:from|to) (.+)$/.exec(M);if(we?.[1])return mh(we[1]);return[]}function sh(M){let F=ah(M);if(F.length===2&&F[0]&&F[1])return sa(F[0],F[1]);let q=lh(M);return q?sa(M.slice(q.oldStart,q.oldEnd),M.slice(q.newStart,q.newEnd)):[]}function ah(M){let F=[],q=0;while(q<M.length&&F.length<2){while(Er(M[q]))q++;if(q>=M.length)break;let te=M[q]==='"'||M[q]==="'"?M[q]:void 0;if(!te){let we=q;while(q<M.length&&!Er(M[q]))q++;F.push(M.slice(we,q));continue}let ne=Kc(M,q,te);if(!ne)return[];F.push(ne.value),q=ne.end}while(Er(M[q]))q++;return q===M.length?F:[]}function lh(M){let F=0;while(F<M.length&&Er(M[F]))F++;let q=M.length;while(q>F&&Er(M[q-1]))q--;let te=0,ne=F;while(ne<q){if(!Er(M[ne])){ne++;continue}let we=ne;while(ne<q&&Er(M[ne]))ne++;if(we===F||ne===q)continue;if(te++,te>nh)Hn();if(ch(M,F,we,ne,q))return{oldStart:F,oldEnd:we,newStart:ne,newEnd:q}}return null}function ch(M,F,q,te,ne){if(ia(M,F,q,te,ne))return!0;let we=Nc(M,"/",F,q),Ke=Nc(M,"/",te,ne);if(we<=F||Ke<=te)return!1;if(ia(M,F,we,te,Ke))return!1;return ia(M,we+1,q,Ke+1,ne)}function ia(M,F,q,te,ne){if(q-F!==ne-te)return!1;for(let we=0;we<q-F;we++)if(M[F+we]!==M[te+we])return!1;return!0}function Nc(M,F,q,te){for(let ne=q;ne<te;ne++)if(M[ne]===F)return ne;return-1}function Er(M){return M!==void 0&&th.test(M)}function Kc(M,F,q){let te=[],ne=F+1;while(ne<M.length){let we=String.fromCodePoint(M.codePointAt(ne)??0);if(we===q)return{value:eh.decode(Uint8Array.from(te)),end:ne+1};if(we!=="\\"||q==="'"){te.push(...Dc.encode(we)),ne+=we.length;continue}let Ke=M.slice(ne+1),mt=/^[0-7]{1,3}/.exec(Ke)?.[0];if(mt){te.push(Number.parseInt(mt,8)),ne+=mt.length+1;continue}te.push(...Dc.encode(uh(Ke[0]??""))),ne+=2}return null}function uh(M){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[M]??M}function dh(M){return xo(ph(M))}function sa(M,F){if(M==="/dev/null")return Lc(F);if(F==="/dev/null")return Lc(M);if(M.startsWith("a/")&&F.startsWith("b/"))return[M.slice(2),F.slice(2)].flatMap(xo);let q=fh(M,F)??(M===F?qc(M):null);return[M,F,...q?[q]:[]].flatMap(xo)}function Lc(M){let F=qc(M);return[M,...F?[F]:[]].flatMap(xo)}function qc(M){let F=M.indexOf("/");return F>0&&F<M.length-1?M.slice(F+1):null}function fh(M,F){let q=M.indexOf("/"),te=F.indexOf("/");if(q<1||te<1)return null;if(M.slice(0,q)===F.slice(0,te))return null;let ne=M.slice(q+1);return ne===F.slice(te+1)?ne:null}function Wc(M){return dh(Ci(M,!0))}function mh(M){return xo(Ci(M,!1))}function Ci(M,F){let q=M.trim(),te=q[0]==='"'||q[0]==="'"?q[0]:void 0;if(te){let ne=Kc(q,0,te);if(ne&&(F||q.slice(ne.end).trim()===""))return ne.value}return F?q.split("\t",1)[0]?.trim()??"":q}function ph(M){return M.startsWith("a/")||M.startsWith("b/")?M.slice(2):M}function xo(M){return M===""||M==="/dev/null"?[]:[M]}function Fc(M){let F=M.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return F===""||F==="/dev/null"?[]:[F]}function de(M){try{if(!hh(M).isDirectory())return!1;return gh(M,Yc.R_OK|Yc.X_OK),!0}catch{return!1}}function at(M,F,q){if(sr(M))return;let te=F.flatMap((we)=>Zc(we,q));if(!te[0])return;let ne=Zc(Xc(M)?M:Sh(te[0],M),q)[0];if(!ne)return;return te.some((we)=>Ch(ne,we))?ne:void 0}function Zc(M,F){let q=F.realpath(M);if(q===null)return[];return F.isDirectory(q)?[q]:[]}function Ch(M,F){let q=yh(F,M);return q===""||q!==".."&&!q.startsWith(`..${bh}`)&&!Xc(q)}var vh=8388608;async function Xe(M){let F=[],q=0;for await(let te of M){let ne=typeof te==="string"?Buffer.from(te,"utf-8"):Buffer.from(te.buffer,te.byteOffset,te.byteLength);if(q+=ne.byteLength,q>vh)throw Eh(M),Error("hook input byte limit exceeded");F.push(ne)}return Buffer.concat(F,q).toString("utf-8")}function Eh(M){let F=M.destroy??M.cancel;if(!F)return;try{Promise.resolve(F.call(M)).catch(()=>{})}catch{}}function u(M,F,q,te,ne){if(q.kind!=="command")return{toolName:M,input:F,route:q,context:te};return{toolName:M,input:F,route:q,context:te,command:ne}}var Jr=["fail_closed","paranoid_rm","paranoid_interpreters"],Ei={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var i={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Ri=["standard","strict","paranoid"];function Rh(M,F){if(!F)return M;return Ri.indexOf(F)>Ri.indexOf(M)?F:M}function xh(M){let F=Le(i.level,M);if(F===void 0||F==="")return;if(Ri.includes(F))return F;console.error(`CC Safety Net: ignored invalid ${i.level.name}=${JSON.stringify(F.slice(0,40))}. Use ${Ri.join(", ")}.`);return}function Ze(M){if(M===void 0||M==="all")return"all";if(M==="blocked")return"blocked";return"invalid"}function xe(M){return Ze(Le(i.auditScope,M))==="all"}function aa(M){if(M.failClosed&&M.paranoidRm&&M.paranoidInterpreters)return"paranoid";if(M.failClosed&&!M.paranoidRm&&!M.paranoidInterpreters)return"strict";if(!M.failClosed&&!M.paranoidRm&&!M.paranoidInterpreters)return"standard";return"custom"}function P(M={},F){let q=M.safety?.level??"standard",te=xh(F),ne=Rh(q,te),we=Ei[ne],Ke={failClosed:we.fail_closed,paranoidRm:we.paranoid_rm,paranoidInterpreters:we.paranoid_interpreters},mt={failClosed:ne===q?"preset":"environment",paranoidRm:ne===q?"preset":"environment",paranoidInterpreters:ne===q?"preset":"environment"},gt={failClosed:[`policy safety.level=${q}`],paranoidRm:[`policy safety.level=${q}`],paranoidInterpreters:[`policy safety.level=${q}`]};if(ne!==q)gt.failClosed.push(`env ${i.level.name}=${te}`),gt.paranoidRm.push(`env ${i.level.name}=${te}`),gt.paranoidInterpreters.push(`env ${i.level.name}=${te}`);if(M.safety?.overrides?.failClosed!==void 0)Ke.failClosed=M.safety.overrides.failClosed,mt.failClosed="capability_override",gt.failClosed.push("policy safety.overrides.fail_closed");if(M.safety?.overrides?.paranoidRm!==void 0)Ke.paranoidRm=M.safety.overrides.paranoidRm,mt.paranoidRm="capability_override",gt.paranoidRm.push("policy safety.overrides.paranoid_rm");if(M.safety?.overrides?.paranoidInterpreters!==void 0)Ke.paranoidInterpreters=M.safety.overrides.paranoidInterpreters,mt.paranoidInterpreters="capability_override",gt.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(_(i.strict,F))Ke.failClosed=!0,mt.failClosed="environment",gt.failClosed.push(`env ${i.strict.name}`);if(_(i.paranoid,F))Ke.paranoidRm=!0,Ke.paranoidInterpreters=!0,mt.paranoidRm="environment",mt.paranoidInterpreters="environment",gt.paranoidRm.push(`env ${i.paranoid.name}`),gt.paranoidInterpreters.push(`env ${i.paranoid.name}`);if(_(i.paranoidRm,F))Ke.paranoidRm=!0,mt.paranoidRm="environment",gt.paranoidRm.push(`env ${i.paranoidRm.name}`);if(_(i.paranoidInterpreters,F))Ke.paranoidInterpreters=!0,mt.paranoidInterpreters="environment",gt.paranoidInterpreters.push(`env ${i.paranoidInterpreters.name}`);let ht=!!M.worktreeMode||_(i.worktree,F);return{strict:Ke.failClosed,paranoidRm:Ke.paranoidRm,paranoidInterpreters:Ke.paranoidInterpreters,worktreeMode:ht,effectiveLevel:aa(Ke),capabilities:{fail_closed:{enabled:Ke.failClosed,source:mt.failClosed,sources:gt.failClosed},paranoid_rm:{enabled:Ke.paranoidRm,source:mt.paranoidRm,sources:gt.paranoidRm},paranoid_interpreters:{enabled:Ke.paranoidInterpreters,source:mt.paranoidInterpreters,sources:gt.paranoidInterpreters}}}}function _(M,F){let q=typeof M==="string"?_o(M,F):Le(M,F);return q==="1"||q?.toLowerCase()==="true"}function _o(M,F){return F.get(M)}function Le(M,F){let q=_o(M.name,F);if(q!==void 0)return q;if(M.legacyName)return _o(M.legacyName,F);return}function st(M,F){return _o(M.name,F)!==void 0||!!M.legacyName&&_o(M.legacyName,F)!==void 0}import{dirname as Pr}from"node:path";import{closeSync as _h,constants as wo,fstatSync as la,fsyncSync as wh,lstatSync as Pn,mkdirSync as Jc,openSync as Qc,readdirSync as ua,readFileSync as Ph,realpathSync as Rr,renameSync as Ah,rmdirSync as eu,statSync as ca,unlinkSync as da,writeFileSync as Th}from"node:fs";import{isAbsolute as tu,join as Qr,normalize as Ih,parse as nu,relative as fa,resolve as ma,sep as xi}from"node:path";function Ne(){let M=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${M()}${M()}`}var kh=Symbol("PolicyFilesystemScope"),Oh=Symbol("PolicyFilesystemTarget"),ru=wo.O_NOFOLLOW??0;class o extends Error{name="PolicyFilesystemError";constructor(M){super(`Unable to access ${M} filesystem safely.`)}}function S(M,F){return{[kh]:!0,root:ma(M),label:F}}function Po(M,F){let q=Ih(F);if(F===""||tu(F)||q===".."||q.startsWith(`..${xi}`))throw new o(M.label);return{[Oh]:!0,scope:M,relativePath:q,path:Qr(M.root,q)}}function s(M,F){return Po(M,fa(M.root,ma(F)))}function D(M,F="rules policy"){let q=ma(M),te=nu(q).dir;return Po(S(te,F),fa(te,q))}function r(M){return qn(M.scope.label,()=>{if(!on(M))return null;let F=Qc(M.path,wo.O_RDONLY|ru);return iu(F,()=>{let q=la(F);if(!q.isFile())throw new o(M.scope.label);let te=Ph(F,"utf-8"),ne=Pn(M.path);if(!ne.isFile()||ne.isSymbolicLink()||q.dev!==ne.dev||q.ino!==ne.ino)throw new o(M.scope.label);return on(M),te})})}function y(M,F,q=384,te){let ne=`${M.path}.${Ne()}.tmp`;qn(M.scope.label,()=>{Dh(M),on(M);let we=Qc(ne,wo.O_CREAT|wo.O_EXCL|wo.O_WRONLY|ru,q),Ke=iu(we,()=>{let mt=la(we);if(!mt.isFile())throw new o(M.scope.label);Th(we,F,"utf-8"),wh(we);let gt=la(we);if(!gt.isFile()||gt.dev!==mt.dev||gt.ino!==mt.ino)throw new o(M.scope.label);return gt});on(M),Lh(M,ne,Ke.dev,Ke.ino),Ah(ne,M.path),te?.(M.path),on(M)},()=>Wh(ne))}function ou(M,F){if(M.path===F.path)return!0;return qn(M.scope.label,()=>{if(!on(M)||!on(F))return!1;return Rr(M.path)===Rr(F.path)})}function ue(M){let F=qn(M.scope.label,()=>{if(!on(M,"directory"))return null;let q=ua(M.path);return on(M,"directory"),q});if(!F)return null;return qn(M.scope.label,()=>{let q=F.map((te)=>{let ne=Po(M.scope,Qr(M.relativePath,te)),we=Pn(ne.path);if(we.isSymbolicLink()||!we.isFile()&&!we.isDirectory())throw new o(M.scope.label);return _i(pa(M.scope),Rr(ne.path),M.scope.label),{name:te,kind:we.isDirectory()?"directory":"file"}});return on(M,"directory"),q})}function G(M){qn(M.scope.label,()=>{if(!on(M))return;da(M.path),on(M)})}function lt(M){qn(M.scope.label,()=>{if(!Mh(M))return;au(M),on(M,"directory")})}function ct(M){qn(M.scope.label,()=>{if(!on(M,"directory"))return;eu(M.path),on(M,"directory")})}function Mh(M){return qn(M.scope.label,()=>{if(!on(M,"directory"))return!1;return su(M),!0})}function qn(M,F,q){try{return F()}catch(te){if(q?.(),te instanceof o)throw te;throw new o(M)}}function iu(M,F){try{return F()}finally{_h(M)}}function on(M,F="file"){let q=lu(M.scope);if(!q)return!1;let te=M.relativePath.split(xi);for(let ne of te.keys()){let we=Qr(M.scope.root,...te.slice(0,ne+1)),Ke=Pn(we,{throwIfNoEntry:!1});if(!Ke)return!1;if(Ke.isSymbolicLink())throw new o(M.scope.label);if(ne<te.length-1&&!Ke.isDirectory())throw new o(M.scope.label);if(ne===te.length-1&&(F==="file"?!Ke.isFile():!Ke.isDirectory()))throw new o(M.scope.label);_i(q,Rr(we),M.scope.label)}return!0}function su(M){for(let F of ua(M.path)){let q=Po(M.scope,Qr(M.relativePath,F)),te=Pn(q.path);if(te.isSymbolicLink()||!te.isDirectory()&&!te.isFile())throw new o(M.scope.label);if(te.isDirectory())su(q)}on(M,"directory")}function au(M){for(let F of ua(M.path)){let q=Po(M.scope,Qr(M.relativePath,F)),te=Pn(q.path);if(te.isSymbolicLink())throw new o(M.scope.label);if(te.isDirectory()){au(q);continue}if(!te.isFile())throw new o(M.scope.label);da(q.path)}eu(M.path)}function Dh(M){Nh(M.scope);let F=pa(M.scope),q=M.relativePath.split(xi).slice(0,-1);for(let te of q.keys()){let ne=Qr(M.scope.root,...q.slice(0,te+1));if(!Pn(ne,{throwIfNoEntry:!1}))Jc(ne,{mode:448});let we=Pn(ne);if(!we.isDirectory()||we.isSymbolicLink())throw new o(M.scope.label);_i(F,Rr(ne),M.scope.label)}}function Nh(M){if(Pn(M.root,{throwIfNoEntry:!1})){if(!ca(M.root).isDirectory())throw new o(M.label);return}let F=[],q=M.root;while(!Pn(q,{throwIfNoEntry:!1})){F.unshift(q);let te=nu(q).dir;if(te===q)throw new o(M.label);q=te}if(!ca(q).isDirectory())throw new o(M.label);for(let te of F){Jc(te,{mode:448});let ne=Pn(te);if(!ne.isDirectory()||ne.isSymbolicLink())throw new o(M.label)}}function lu(M){if(!Pn(M.root,{throwIfNoEntry:!1}))return null;if(!ca(M.root).isDirectory())throw new o(M.label);return Rr(M.root)}function pa(M){let F=lu(M);if(!F)throw new o(M.label);return F}function Lh(M,F,q,te){let ne=Pn(F);if(!ne.isFile()||ne.isSymbolicLink()||ne.dev!==q||ne.ino!==te)throw new o(M.scope.label);_i(pa(M.scope),Rr(F),M.scope.label)}function _i(M,F,q){let te=fa(M,F);if(te===".."||te.startsWith(`..${xi}`)||tu(te))throw new o(q)}function Wh(M){try{da(M)}catch{}}import{dirname as xr,isAbsolute as $h,join as wr,relative as Uh,resolve as _r,sep as Hh}from"node:path";var c=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,pe="rulebook.json",fe=".cc-safety-net/rules";var cu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/,Fh=/^[A-Za-z0-9][A-Za-z0-9_.-]*\/[A-Za-z0-9_.-]+$/,uu=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Gh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),zh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),dt=new RegExp(`^${Gh}/(${c.source.slice(1,-1)})/${zh}$`);function Bh(M){return`.cc-safety-net/rules/${M}/rulebook.json`}function du(M){if(x(M))try{return O(M),null}catch(F){return F instanceof Error?F.message:String(F)}return c.test(M)?null:`Local rulebook sources must be bare names matching ${c}: ${M}`}function O(M){if(M.startsWith("github:"))throw Error(`Invalid rulebook source: ${M}`);let F=M.match(cu);if(!F?.[1]||!F[2]||!F[3])throw Error(`Invalid GitHub rulebook source: ${M}`);let q=F[3].lastIndexOf("/");if(q<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${M}`);let te=F[3].slice(0,q),ne=F[3].slice(q+1);if(!te||!uu.test(te))throw Error(`GitHub rulebook refs must use valid path segments: ${M}`);if(!ne||!c.test(ne))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${M}`);return{owner:F[1],repo:F[2],ref:te,path:Bh(ne),name:ne}}function Y(M){return Fh.test(M)}function ie(M){return uu.test(M)}function x(M){return cu.test(M)}function ut(M){if(!c.test(M))throw Error(`Local rulebook sources must be bare names matching ${c}: ${M}`)}var fu="rule.json",wi="policy.json",mu=".cc-safety-net",jh="rules",Vh="CC_SAFETY_NET_HOME",pu="`cc-safety-net rule update`";function Kh(M){return _r(M,fe)}function A(M){return wr(Kh(M),fu)}function w(M){return wr(_r(M),mu,wi)}function me(M,F={}){return F.userConfigDir??(F.userConfigPath?xr(F.userConfigPath):wr(qh(M),jh))}function qh(M){let F=M.env.get(Vh);return F?_r(vn(F)):wr(M.home,mu)}function T(M,F={}){return wr(me(M,F),fu)}function d(M,F={}){return wr(xr(me(M,F)),wi)}function H(M,F){let q=F.userConfigPath??T(M,F),te=F.projectConfigPath??A(F.cwd),ne=Qe(M,F),we=et(te,F.cwd);return{userConfigPath:q,projectConfigPath:te,userScope:ne,projectScope:we,userConfigTarget:s(ne,q),projectConfigTarget:s(we,te)}}function Qe(M,F){let q=F.userConfigPath?xr(xr(_r(F.userConfigPath))):xr(_r(F.userConfigDir??me(M,F)));return S(q,"user policy")}function et(M,F){let q=_r(F),te=_r(M),ne=Uh(q,te);if(ne!==".."&&!ne.startsWith(`..${Hh}`)&&!$h(ne))return S(q,"project policy");return S(xr(xr(te)),"project policy")}function N(M,F){return wr(M,F,pe)}var un=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),L=/^[a-zA-Z][a-zA-Z0-9_-]*$/,I=256,en=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),gu=new Set(["python","python3","python2","node","ruby","perl"]),Pi=/^python(?:[23](?:\.\d+)*)?$/,An=new Set(["awk","gawk","nawk","mawk"]),Ai=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var hu="Rulebook exceeds CC Safety Net's safe validation limits.",yu="Additional rulebook validation errors were omitted.",Mn=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Su(M){if(ga(M.allowed_commands,Mn.maxAllowedCommands)||ga(M.rules,Mn.maxRules)||ga(M.tests,Mn.maxTests))return!1;let{maxAggregateStringCodeUnits:F,maxTotalBlockArgs:q}=Mn,te=(ne,we=!1)=>{if(typeof ne!=="string")return!0;if(ne.length>Mn.maxStringCodeUnits||we&&ne.length>Mn.maxFixtureCommandCodeUnits||ne.length>F)return!1;return F-=ne.length,!0};if(!te(M.name)||!te(M.version)||!te(M.description)||!te(M.author)||!te(M.migrated_from))return!1;if(Array.isArray(M.allowed_commands)){for(let ne of M.allowed_commands)if(!te(ne))return!1}if(Array.isArray(M.rules))for(let ne of M.rules){if(!ne||typeof ne!=="object")continue;let we=ne;if(!te(we.name)||!te(we.command)||!te(we.subcommand)||!te(we.reason)||!te(we.intent))return!1;let Ke=we.match&&typeof we.match==="object"?we.match:{};for(let mt of[we.block_args,Ke.command_path,Ke.any_args,Ke.exclude_args]){if(!Array.isArray(mt))continue;if(mt.length>Mn.maxBlockArgsPerRule||mt.length>q)return!1;q-=mt.length;for(let gt of mt)if(!te(gt))return!1}}if(Array.isArray(M.tests))for(let ne of M.tests){if(!ne||typeof ne!=="object")continue;let we=ne;if(!te(we.command,!0)||!te(we.expect)||!te(we.rule))return!1}return!0}function ga(M,F){return Array.isArray(M)&&M.length>F}var ha=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var J=64,ge="Rule config exceeds CC Safety Net's safe source limit.";function zt(M){return Nt(M).toLowerCase()}function Nt(M){return M.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??M}function pn(M,F){let q=new Set,te=!1;for(let ne of M){if(ne==="--"){te=!0;continue}if(te)continue;if(ne.startsWith("-")&&!ne.startsWith("--")&&ne.length>1)for(let we=1;we<ne.length;we++){let Ke=ne[we];if(!Ke||!/[a-zA-Z]/.test(Ke))break;let mt=`-${Ke}`;if(q.add(mt),F?.shortOptsWithValue?.has(mt))break}}return q}var Yh=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),Zh=new Map([["zsh",new Set(["o"])]]),Xh=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function bu(M,F){for(let q=0;q<F.length;q++){let te=F[q];if(te===void 0||te==="--"||te==="-"||te[0]!=="-"&&te[0]!=="+")return null;if(te.startsWith("--")){let Ke=Xh.get(M);if(Qh(te,Ke))continue;if(!Ke?.has(te))continue;if(F[q+1]===void 0)return null;q++;continue}let ne=Jh(M,te);if(ne.commandSelected)return F[q+ne.followingValues+1]??null;let we=F[q+1];if(M==="ksh"&&(te==="-o"||te==="+o")&&we!==void 0&&we[0]!=="-"&&we[0]!=="+")q++;q+=ne.followingValues}return null}function Jh(M,F){let q=Yh.get(M),te=Zh.get(M),ne=!1,we=0;for(let Ke=1;Ke<F.length;Ke++){let mt=F[Ke];if(mt===void 0)break;if(F[0]==="-"&&mt==="c")ne=!0;if(M==="ksh"&&mt==="o"){if(Ke+1<F.length){let gt=F.slice(Ke+1);if(!ne&&F[0]==="-"&&gt==="c")continue;if(!ne&&F[0]==="-"&&gt[0]==="-"&&gt.endsWith("c"))ne=!0;break}if(ne)we++;continue}if(!q?.has(mt))continue;if(te?.has(mt)&&Ke+1<F.length)break;we++}return{commandSelected:ne,followingValues:we}}function Qh(M,F){return F!==void 0&&[...F].some((q)=>M.startsWith(`${q}=`))}function Ao(M,F){if(F.escaped)return F.escaped=!1,!0;if(M==="\\"&&!F.inSingle)return F.escaped=!0,!0;if(M==="'"&&!F.inDouble)return F.inSingle=!F.inSingle,!0;if(M==='"'&&!F.inSingle)return F.inDouble=!F.inDouble,!0;return!1}function Ti(M){let F={inSingle:!1,inDouble:!1,escaped:!1};for(let q of ey(M))Ao(q,F);return F.inSingle||F.inDouble}function ey(M){let F="",q={inSingle:!1,inDouble:!1,escaped:!1},te=!1,ne=!0;for(let we=0;we<M.length;we++){let Ke=M[we];if(!Ke)break;if(te){if(Ke===`
-`||Ke==="\r")F+=Ke,te=!1,q.escaped=!1;continue}if(Ke==="#"&&!q.inSingle&&!q.inDouble&&ne){te=!0;continue}if(F+=Ke,!q.inSingle&&!q.inDouble&&!q.escaped)ne=/[\s;&|()<>]/.test(Ke);Ao(Ke,q)}return F}var ya=new Set(["rm","find","xargs","parallel"]),ty=new Set(["git","busybox",...ya,...en,...gu,...An]),ny=new Set(["python","node","ruby","perl"]);function Me(M){let F=zt(M);return ty.has(F)||Dn(F)}function Dn(M){return ny.has(ry(M))}function ry(M){let F=Nt(M).toLowerCase();return Pi.test(F)?"python":F}var pt={version:1,rules:[],overrides:{},transparent_wrappers:[]};function m(M){try{let F=r(oy(M));if(F===null)return{config:null,errors:[]};if(!F.trim())return{config:null,errors:["Config file is empty"]};let q=JSON.parse(F),te=tt(q);if(te.errors.length>0)return{config:null,errors:te.errors};return{config:{version:1,rules:q.rules??[],overrides:q.overrides??{},transparent_wrappers:q.transparent_wrappers??[]},errors:[]}}catch(F){if(F instanceof o)return{config:null,errors:[F.message]};let q=F instanceof Error?F.message:String(F);return{config:null,errors:[F instanceof SyntaxError?"Invalid JSON":q]}}}function oy(M){return typeof M==="string"?D(M):M}var e=(M,F)=>({path:M,message:F,kind:"typed"}),g=(M,F)=>({path:M,message:F,kind:"custom"});function $e(M){let F=new Set;return M.flatMap((q,te)=>{let ne=eo(q)?q.name:void 0;if(typeof ne!=="string")return[];if(F.has(ne.toLowerCase()))return[g(["rules",te,"name"],`duplicate rule name "${ne}"`)];return F.add(ne.toLowerCase()),[]})}var ke=`must be one of ${ha.join(", ")}`,iy=/^[^/]+\/[^/]+$/,sy=["version","rules","overrides","transparent_wrappers"];function tt(M){let F=ay(M);return{errors:se(nt(F,sy,(q)=>q.kind==="custom"),": "," "),sources:gy(M,F)}}function ay(M){if(!eo(M))return[e([],"Config must be an object")];let F=Array.isArray(M.rules)&&M.rules.length>J;return[...M.version===1?[]:[e(["version"],"must be 1")],...ly(M.rules,F),...dy(M.overrides),...my(M.transparent_wrappers),...F?[]:uy(M.rules),...eo(M.overrides)?Object.keys(M.overrides).filter((q)=>!iy.test(q)).map((q)=>g(["overrides",q],"must use <rulebook-name>/<rule-name>")):[],...py(M.transparent_wrappers)]}function ly(M,F){if(M===void 0)return[];if(!Array.isArray(M))return[e(["rules"],"must be an array of rulebook source strings"),...Cu(M,J)?[e(["rules"],ge)]:[]];if(F)return[{path:["rules"],message:ge,kind:"limit"}];return M.flatMap((q,te)=>{if(typeof q!=="string")return[e(["rules",te],"must be a rulebook source string"),...cy(q,1)?[e(["rules",te],"must be a non-empty rulebook source string")]:[]];return q===""?[e(["rules",te],"must be a non-empty rulebook source string")]:[]})}function Cu(M,F){let q=vu(M);return q!==void 0&&!(q<=F)}function cy(M,F){let q=vu(M);return q!==void 0&&!(q>=F)}function vu(M){if(M===null||M===void 0)return;let F=M.length;return F===void 0?void 0:Number(F)}function uy(M){if(!Array.isArray(M))return[];let F=new Set;return M.flatMap((q,te)=>{if(typeof q!=="string"||q==="")return[];if(q.trim()==="")return[g(["rules",te],"must be a non-empty rulebook source string")];let ne=du(q);if(ne)return[g(["rules",te],ne)];if(F.has(q))return[g(["rules",te],`duplicate rulebook source "${q}"`)];return F.add(q),[]})}function dy(M){if(M===void 0)return[];if(!eo(M))return[e(["overrides"],"must be an object if provided")];return Object.keys(M).flatMap((F)=>{let q=M[F];if(q==="off")return[];if(!eo(q))return[e(["overrides",F],'must be "off" or an object')];return[...fy(q.reason,["overrides",F,"reason"]),...q.intent===void 0||Ee(q.intent)?[]:[e(["overrides",F,"intent"],ke)]]})}function fy(M,F){if(typeof M!=="string")return[e(F,"required non-empty string"),...Cu(M,I)?[e(F,`must be at most ${I} characters`)]:[]];if(M==="")return[e(F,"required non-empty string")];return M.length>I?[e(F,`must be at most ${I} characters`)]:[]}function my(M){if(M===void 0)return[];if(!Array.isArray(M))return[e(["transparent_wrappers"],"must be an array of command strings")];return M.flatMap((F,q)=>{if(typeof F!=="string")return[e(["transparent_wrappers",q],"must be a command string")];return L.test(F)?[]:[e(["transparent_wrappers",q],"must match command pattern")]})}function py(M){if(!Array.isArray(M))return[];let F=new Set;return M.flatMap((q,te)=>{if(typeof q!=="string"||!L.test(q))return[];if(F.has(q))return[g(["transparent_wrappers",te],`duplicate command "${q}"`)];if(Me(q))return[g(["transparent_wrappers",te],`reserved command "${q}" cannot be a wrapper`)];return F.add(q),[]})}function gy(M,F){let q=eo(M)?M.rules:void 0;if(!Array.isArray(q))return new Set;if(F.some((ne)=>ne.path.length===1&&ne.path[0]==="rules"))return new Set;let te=new Set(F.filter((ne)=>ne.path[0]==="rules"&&typeof ne.path[1]==="number").map((ne)=>ne.path[1]));return new Set(q.filter((ne,we)=>typeof ne==="string"&&!te.has(we)))}function nt(M,F,q){let te=M.map((Ke)=>Ke.path[1]),ne=[...new Set(te.filter((Ke)=>typeof Ke==="string"))],we=(Ke,mt)=>[Ke.path.length===0?-1:F.indexOf(String(Ke.path[0])),typeof mt==="number"?mt:ne.indexOf(String(mt)),q(Ke)?0:1];return M.map((Ke,mt)=>({issue:Ke,rank:we(Ke,te[mt])})).sort((Ke,mt)=>Ke.rank[0]-mt.rank[0]||Ke.rank[1]-mt.rank[1]||Ke.rank[2]-mt.rank[2]).map((Ke)=>Ke.issue)}function se(M,F,q){return[...new Set(M.map((te)=>{let ne=hy(te.path);if(te.kind==="unknownKeys")return`${ne?`${ne}.`:""}unknown field "${te.message}"`;if(te.kind==="key"||te.kind==="limit"||te.path.length===0)return te.message;return`${ne}${te.path.length===1?q:F}${te.message}`}))]}function hy(M){return M.map((F,q)=>{if(typeof F==="number")return`[${F}]`;return q===0?String(F):`.${String(F)}`}).join("")}function Ee(M){return ha.includes(M)}function eo(M){return!!M&&typeof M==="object"&&!Array.isArray(M)}function ae(M){let F=by(M);if(F.errors.length>0)throw Error(F.errors.join("; "));return M}var yy=`required non-empty string up to ${I} characters`,Eu="must be a non-empty array of unique non-empty strings",Sy="required non-empty array of non-empty strings";function by(M){if(!ar(M))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Su(M))return{errors:[hu],ruleNames:new Set};let F=[...M.rulebook_version===1||M.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...se(Cy(M,M.rulebook_version===2),": ",": ")];return{errors:F.length>Mn.maxValidationErrors?[...F.slice(0,Mn.maxValidationErrors),yu]:F,ruleNames:new Set(Fe(M).map((q)=>q.toLowerCase()))}}function Fe(M){let F=ar(M)?M.rules:void 0;return(Array.isArray(F)?F:[]).flatMap((q)=>{let te=ar(q)?q.name:void 0;return typeof te==="string"?[te]:[]})}function Cy(M,F){return[...typeof M.name==="string"&&c.test(M.name)?[]:[e(["name"],"required string matching rule name pattern")],...typeof M.version==="string"&&M.version!==""?[]:[e(["version"],"required non-empty string")],...vy(M.allowed_commands),...Ey(M.rules,F),...wy(M.tests),...Py(M),...Ay(M)]}function vy(M){if(!Array.isArray(M))return[e(["allowed_commands"],"required array")];let F=new Set;return[...M.flatMap((q,te)=>typeof q==="string"&&L.test(q)?[]:[e(["allowed_commands",te],"must match command pattern")]),...M.flatMap((q,te)=>{if(typeof q!=="string"||!L.test(q))return[];if(F.has(q))return[g(["allowed_commands",te],`duplicate command "${q}"`)];return F.add(q),[]})]}function Ey(M,F){if(!Array.isArray(M))return[e(["rules"],"required array")];return[...M.flatMap((q,te)=>{if(!ar(q))return[e(["rules",te],"must be an object")];return F?xy(q,["rules",te]):Ry(q,["rules",te])}),...$e(M)]}function Ry(M,F){return[...Ru(M.name,F),...xu(M.command,F),...M.subcommand===void 0||typeof M.subcommand==="string"&&L.test(M.subcommand)?[]:[e([...F,"subcommand"],"must match command pattern")],...Ii(M.block_args,[...F,"block_args"],"required non-empty array",!1),..._u(M.reason,F),...wu(M.intent,F)]}function xy(M,F){return[...Ru(M.name,F),...xu(M.command,F),..._u(M.reason,F),...wu(M.intent,F),..._y(M.match,[...F,"match"]),...M.subcommand===void 0?[]:[e([...F,"subcommand"],"not supported in rulebook_version 2")],...M.block_args===void 0?[]:[e([...F,"block_args"],"not supported in rulebook_version 2")]]}function Ru(M,F){if(typeof M!=="string")return[e([...F,"name"],"required string")];return c.test(M)?[]:[e([...F,"name"],"must match rule name pattern")]}function xu(M,F){return typeof M==="string"&&L.test(M)?[]:[e([...F,"command"],"required string matching command pattern")]}function _u(M,F){return typeof M==="string"&&M!==""&&M.length<=I?[]:[e([...F,"reason"],yy)]}function wu(M,F){return M===void 0||Ee(M)?[]:[e([...F,"intent"],ke)]}function _y(M,F){if(!ar(M))return[e(F,"required object")];return[...Ii(M.command_path,[...F,"command_path"],Sy,!1),...M.any_args===void 0?[]:Ii(M.any_args,[...F,"any_args"],Eu,!0),...M.exclude_args===void 0?[]:Ii(M.exclude_args,[...F,"exclude_args"],Eu,!0)]}function Ii(M,F,q,te){if(!Array.isArray(M))return[e(F,q)];let ne=M.flatMap((we,Ke)=>{if(typeof we!=="string")return[e([...F,Ke],"must be a non-empty string")];return we===""?[g([...F,Ke],"must be a non-empty string")]:[]});if(M.some((we)=>typeof we!=="string"))return ne;return[...ne,...M.length===0?[g(F,q)]:[],...te&&new Set(M).size!==M.length?[g(F,"must not contain duplicate values")]:[]]}function wy(M){if(M===void 0)return[];if(!Array.isArray(M))return[e(["tests"],"must be an array if provided")];return M.flatMap((F,q)=>{if(!ar(F))return[e(["tests",q],"must be an object")];return[...typeof F.command==="string"&&F.command.trim()!==""?[]:[e(["tests",q,"command"],"required non-empty string")],...F.expect==="blocked"||F.expect==="allowed"?[]:[e(["tests",q,"expect"],'must be "blocked" or "allowed"')],...F.rule===void 0||typeof F.rule==="string"?[]:[e(["tests",q,"rule"],"must be a string if provided")],...F.expect==="blocked"&&typeof F.rule!=="string"?[g(["tests",q,"rule"],"required string for blocked fixtures")]:[]]})}function Py(M){if(!Array.isArray(M.tests))return[];let F=new Set(Fe(M));return[...new Set(M.tests.flatMap((q)=>ar(q)&&q.expect==="blocked"&&typeof q.rule==="string"?[q.rule]:[]))].filter((q)=>!F.has(q)).map((q)=>g(["tests"],`blocked fixture references unknown rule "${q}"`))}function Ay(M){if(!Array.isArray(M.allowed_commands)||!Array.isArray(M.rules))return[];let F=new Set(M.allowed_commands.filter((q)=>typeof q==="string"));return M.rules.flatMap((q,te)=>{let ne=ar(q)?q.command:void 0;if(typeof ne!=="string"||F.has(ne))return[];return[g(["rules",te,"command"],`"${ne}" must be listed in allowed_commands`)]})}function ar(M){return!!M&&typeof M==="object"&&!Array.isArray(M)}function Z(M,F){let q=H(M,F),te=!1;try{te=ou(q.userConfigTarget,q.projectConfigTarget)}catch(Ct){if(Ct instanceof o)return Wy(q,Ct.message);throw Ct}let ne=m(q.userConfigTarget),we=te?{config:null,errors:[]}:m(q.projectConfigTarget),Ke=Au(q.userConfigPath,ne.errors),mt=Au(q.projectConfigPath,we.errors),gt=new Set,ht=ne.config?Re(ne.config,Pr(q.userConfigPath),"user",q.userScope,gt):Tu(),St=we.config?Re(we.config,Pr(q.projectConfigPath),"project",q.projectScope,gt):Tu(),bt=ne.config?.overrides??{},yt=we.config?.overrides??{};return{rules:[...Pu(ht.rules,bt),...Pu(St.rules,yt)],transparent_wrappers:Ny(ne.config,we.config),rulebooks:[...ht.rulebooks,...St.rulebooks],errors:[...Ke,...mt,...ht.errors,...St.errors],warnings:[...ht.warnings,...St.warnings,...ht.canValidateOverrides?Sa(bt,ht.knownRuleIds,q.userConfigPath):[],...ht.canValidateOverrides?Ly(yt,ht.knownRuleIds,q.projectConfigPath):[],...St.canValidateOverrides?Sa(yt,St.knownRuleIds,q.projectConfigPath):[]],userConfig:ne.config??void 0,projectConfig:we.config??void 0,...q}}function W(M,F){let q=Ty(M,F);if(!q)return[];return[...q.scope.errors,...q.scope.warnings,...Iy(q.config,q.scope,M)]}function Ty(M,F){let q=F??S(Pr(Pr(M)),"rules policy"),te=m(s(q,M)).config;if(!te)return null;return{config:te,scope:Re(te,Pr(M),"project",q)}}function Iy(M,F,q){return F.canValidateOverrides?Sa(M.overrides??{},F.knownRuleIds,q):[]}function Re(M,F,q,te=S(Pr(Pr(F)),q==="user"?"user policy":"project policy"),ne=new Set){let we=[],Ke=[],mt=M.rules.flatMap((ht)=>{let St=Oy(ht,F,te);if(St.errors.length>0||!St.rulebook)return we.push(...St.errors),[];let bt=St.rulebook;if(ne.has(bt.name))return Ke.push(`duplicate active rulebook name "${bt.name}" for ${ht}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return ne.add(bt.name),[{rules:ky(bt),rulebook:{source:q,spec:ht,name:bt.name,version:bt.version,rules:bt.rules.map((yt)=>`${bt.name}/${yt.name}`)}}]}),gt=mt.flatMap((ht)=>ht.rules);return{rules:gt,rulebooks:mt.map((ht)=>ht.rulebook),entries:mt.map((ht)=>({spec:ht.rulebook.spec,name:ht.rulebook.name,version:ht.rulebook.version,ruleCount:ht.rulebook.rules.length})),knownRuleIds:new Set(gt.map((ht)=>ht.name)),errors:we,warnings:Ke,canValidateOverrides:we.length===0}}function ky(M){if(M.rulebook_version===2)return M.rules.map((F)=>({name:`${M.name}/${F.name}`,command:F.command,block_args:[],match:F.match,reason:F.reason,intent:F.intent}));return M.rules.map((F)=>({...F,name:`${M.name}/${F.name}`,match:void 0}))}function Oy(M,F,q){let te=je(M),ne=N(F,te),we=Dy(ne,q);if("error"in we)return{rulebook:null,errors:[we.error]};if(we.content===null)return{rulebook:null,errors:[`missing rulebook file ${ne} for ${M}; ${My(M)}`]};let Ke=he(we.content);if("problem"in Ke)return{rulebook:null,errors:[`invalid rulebook ${ne}: ${Ke.problem}; fix that file`]};if(Ke.rulebook.name!==te)return{rulebook:null,errors:[`rulebook name "${Ke.rulebook.name}" in ${ne} must match source "${M}"; fix that file`]};return{rulebook:Ke.rulebook,errors:[]}}function je(M){return x(M)?O(M).name:M}function My(M){return x(M)?`run ${pu} to vendor ${M}`:"create that file or remove that source from the rules config"}function Dy(M,F){try{return{content:r(s(F,M))}}catch(q){if(q instanceof o)return{error:q.message};throw q}}function he(M){let F;try{F=JSON.parse(M)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ae(F)}}catch(q){return{problem:q instanceof Error?q.message:"invalid rulebook"}}}function Ny(M,F){return[...new Set([...M?.transparent_wrappers??[],...F?.transparent_wrappers??[]])]}function Pu(M,F){return M.flatMap((q)=>{let te=F[q.name];if(te==="off")return[];if(te&&typeof te==="object")return[{...q,intent:te.intent??q.intent,reason:te.reason}];return[q]})}function Sa(M,F,q){return Object.keys(M).filter((te)=>!F.has(te)).map((te)=>`unknown override key "${te}" in ${q}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Ly(M,F,q){return Object.keys(M).filter((te)=>F.has(te)).map((te)=>`project override cannot target user-scoped rule "${te}" in ${q}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Au(M,F){return F.map((q)=>q.startsWith("Unable to access ")?q:`${M}: ${q}`)}function Wy(M,F){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[F],warnings:[],userConfigPath:M.userConfigPath,projectConfigPath:M.projectConfigPath}}function Tu(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Zy,readFileSync as Xy}from"node:fs";var Iu=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Pe=new Set(Iu.map((M)=>M.id)),U=Iu,Fy=new Map(U.map((M)=>[M.id,M.intent]));function _t(M,F){return{id:M,reason:F,intent:Fy.get(M)??"manual_only"}}var ba=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],ki={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Gy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],zy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Ca=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...zy.flatMap((M)=>Gy.map((F)=>({id:["secret.home",M.idSlug,F.slice(1)].join("."),category:"Home path",label:[M.label,F].join(""),description:["Blocks home ",M.label,F," credential backup files."].join(""),suffixParts:[...M.directoryParts,[M.basename,F].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Oi=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],ku=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],By=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],va=ku.map((M)=>({id:`secret.variant.${M.slug}.separator`,category:"Variant",label:`${M.label}-* / ${M.label}_*`,description:`Blocks ${M.label} variants with dash or underscore suffixes.`,prefix:M.prefix})),Ea=ku.flatMap((M)=>By.map((F)=>({id:`secret.variant.${M.slug}.${F.slice(1)}`,category:"Variant",label:`${M.label}${F}`,description:`Blocks ${M.label}${F} private credential variants.`,prefix:M.prefix,suffix:F}))),To={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},Ra=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((M)=>({id:`secret.ext.${M}`,category:"Extension",label:`.${M}`,description:`Blocks files with the .${M} extension.`,extension:M})),xa=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],rt=[...ba,ki,...Ca,...va,...Ea,To,...Ra,...xa,...Oi].map((M)=>({id:M.id,category:M.category,label:M.label,...M.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in M?{paths:M.paths}:{description:M.description}})),Mi=new Set(Oi.flatMap((M)=>M.category==="Coding CLI config"?[M.id]:[])),$y=rt.map((M)=>M.id),_e=new Set($y);import{isAbsolute as _a,join as Uy,normalize as Hy,sep as Di}from"node:path";var Ou=process.platform==="win32",jy=/[*?]/;function Io(M,F){if(M==="~")return F;if(M.startsWith("~/"))return`${F}${M.slice(1)}`;return M}function Ae(M,F){if(typeof M!=="string"||M.trim()==="")return"must be a non-empty path string";let q=Io(M.trim(),F);if(!_a(q))return"must be an absolute path or start with ~/";return ko(q,F)}function Te(M,F){let q=Mu(M,F);if(q===null)return"must be a non-empty path string";if(!_a(q))return null;if(ko(q,F)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Vy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ky="cannot cover the guard's own configuration";function Mu(M,F){if(typeof M!=="string"||M.trim()==="")return null;return Io(M.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),F)}function Ie(M,F){let q=Mu(M,F);if(q===null)return"must be a non-empty path string";if(jy.test(q))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!_a(q))return null;if(ko(q,F)!==null)return Vy;return qy(q,F)?Ky:null}function qy(M,F){let q=Ni(M),te=Ni(Uy(F,".cc-safety-net"));return q===te||q.startsWith(`${te}${Di}`)}function ko(M,F){let q=Ni(M),te=Ni(F);if(q===te)return"cannot be the home directory";let ne=q.endsWith(Di)?q:`${q}${Di}`;if(te.startsWith(ne))return"cannot contain the home directory";return null}function Ni(M){let F=Hy(M);if(Ou)F=F.replace(/\//g,"\\").toLowerCase();if(F.length>(Ou?3:1)&&F.endsWith(Di))F=F.slice(0,-1);return F}var Du=30,ye=1,ve=365;function Nu(M){if(typeof M!=="number"||!Number.isInteger(M))return 30;if(M<1)return 1;return M>365?365:M}var Lu=new Set(U.filter((M)=>M.catastrophic).map((M)=>M.id));function Dt(M,F){if(!M)return null;if(Lu.has(M.id))return M;if(F?.destructiveCommandProtectionEnabled===!1)return null;let q=F?.effectiveDestructiveCommandRules[M.id];return q&&!q.enabled?null:M}function tn(M,F,q){if(Lu.has(F))return!0;if(M?.destructiveCommandProtectionEnabled===!1)return!1;return M?.effectiveDestructiveCommandRules[F]?.enabled??q}function B(M,F){return Object.freeze(Object.fromEntries(U.map((q)=>{let te=q.activationCapability?F[q.activationCapability]:void 0,ne=te?.enabled??!0,we=M.destructiveCommandRuleOverrides[q.id],Ke=q.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...we?{override:we}:{}}:M.destructiveCommandProtectionEnabled?we?{enabled:we==="on",inheritedEnabled:ne,changesInherited:we==="on"!==ne,source:"rule_override",...q.activationCapability?{activationCapability:q.activationCapability}:{},override:we}:{enabled:ne,inheritedEnabled:ne,changesInherited:!1,source:te?.source??"built_in_default",...q.activationCapability?{activationCapability:q.activationCapability}:{}}:{enabled:!1,inheritedEnabled:ne,changesInherited:!1,source:"master_disabled",...q.activationCapability?{activationCapability:q.activationCapability}:{},...we?{override:we}:{}};return[q.id,Object.freeze(Ke)]})))}function Wu(M,F){return Object.freeze({...M,effectiveDestructiveCommandRules:B(M,F)})}var Fu={standard:0,strict:1,paranoid:2};function X(M,F){return{policy:{version:1,safety:{level:F.safety?.level??M.safety.level,overrides:{...M.safety.overrides,...F.safety?.overrides}},workflow:{worktree_mode:F.workflow?.worktree_mode??M.workflow.worktree_mode},destructive_command_protection:{enabled:F.destructive_command_protection?.enabled??M.destructive_command_protection.enabled,overrides:{...M.destructive_command_protection.overrides,...F.destructive_command_protection?.overrides},allow_paths:wa(M.destructive_command_protection.allow_paths,F.destructive_command_protection?.allow_paths)},secret_protection:{enabled:F.secret_protection?.enabled??M.secret_protection.enabled,overrides:{...M.secret_protection.overrides,...F.secret_protection?.overrides},deny_paths:wa(M.secret_protection.deny_paths,F.secret_protection?.deny_paths),allow_paths:wa(M.secret_protection.allow_paths,F.secret_protection?.allow_paths)},audit:M.audit},weakenings:Yy(M,F)}}function wa(M,F){return[...new Set([...M,...F??[]])]}function Yy(M,F){let q=F.safety?.level,te=Ei[M.safety.level];return[...q&&Fu[q]<Fu[M.safety.level]?[`project policy lowers level: ${M.safety.level} -> ${q}`]:[],...Jr.flatMap((ne)=>F.safety?.overrides?.[ne]===!1&&(M.safety.overrides[ne]??te[ne])?[`project policy disables ${ne}`]:[]),...F.workflow?.worktree_mode===!0&&!M.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...F.destructive_command_protection?.enabled===!1&&M.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...F.secret_protection?.enabled===!1&&M.secret_protection.enabled?["project policy disables secret protection"]:[],...Gu(F.destructive_command_protection?.overrides,(ne)=>M.destructive_command_protection.enabled&&M.destructive_command_protection.overrides[ne]!=="off"),...Gu(F.secret_protection?.overrides,(ne)=>M.secret_protection.enabled&&(M.secret_protection.overrides[ne]==="on"?!0:M.secret_protection.overrides[ne]!=="off"&&!Mi.has(ne))),...M.destructive_command_protection.enabled?zu(M.destructive_command_protection.allow_paths,F.destructive_command_protection?.allow_paths).map((ne)=>`project policy adds destructive allow path: ${ne}`):[],...M.secret_protection.enabled?zu(M.secret_protection.allow_paths,F.secret_protection?.allow_paths).map((ne)=>`project policy adds secret allow path: ${ne}`):[]]}function Gu(M,F){return Object.entries(M??{}).flatMap(([q,te])=>te==="off"&&F(q)?[`project policy disables rule ${q}`]:[])}function zu(M,F){return(F??[]).filter((q)=>!M.includes(q))}var Ta=new Set(["standard","strict","paranoid"]),Q={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Du}};function Hu(M,F){let q=iS(d(M,F),M.home),te=He(w(F.cwd),M.home),ne=le(te.parsed,M.home),we=Object.keys(ne.policy).length>0?X(q.gui??Q,ne.policy):void 0,Ke=[...q.errors,...te.errors,...ne.diagnostics],mt=(q.fallback==="defaults"&&we?"salvaged":q.fallback)??(q.gui?void 0:te.fallback)??(Ke.length>0?"salvaged":void 0),gt=ne.policy.safety?.level?"project":q.levelPresent?"user":"default";return{...we?Aa(we.policy):q.policy,errors:Ke,...mt?{fallback:mt}:{},...te.exists?{policyScopes:{levelScope:gt,weakenings:we?.weakenings??[]}}:{}}}var Jy="project policy audit settings are ignored; audit is user scope only";function le(M,F){if(!En(M))return{policy:{},diagnostics:[]};let q=En(M.safety)?M.safety:{},te=En(M.workflow)?M.workflow:{},ne=En(M.destructive_command_protection)?M.destructive_command_protection:{},we=En(M.secret_protection)?M.secret_protection:{},Ke={...Ta.has(q.level)?{level:q.level}:{},...En(q.overrides)?Bu({overrides:ju(q.overrides,Jr,"safety.overrides",Ar)}):{}},mt={...typeof ne.enabled==="boolean"?{enabled:ne.enabled}:{},...ne.overrides!==void 0?{overrides:Li(ne.overrides,Pe,"destructive_command_protection.overrides",Ar)}:{},...ne.allow_paths!==void 0?{allow_paths:no(ne.allow_paths,Ae,F,"destructive_command_protection.allow_paths",Ar)}:{}},gt={...typeof we.enabled==="boolean"?{enabled:we.enabled}:{},...we.overrides!==void 0?{overrides:Li(we.overrides,_e,"secret_protection.overrides",Ar)}:{},...we.deny_paths!==void 0?{deny_paths:no(we.deny_paths,Te,F,"secret_protection.deny_paths",Ar)}:{},...we.allow_paths!==void 0?{allow_paths:no(we.allow_paths,Ie,F,"secret_protection.allow_paths",Ar)}:{}};return{policy:Bu({safety:Ke,workflow:typeof te.worktree_mode==="boolean"?{worktree_mode:te.worktree_mode}:{},destructive_command_protection:mt,secret_protection:gt}),diagnostics:M.audit===void 0?[]:[Jy]}}function ju(M,F,q,te){return Object.fromEntries(F.flatMap((ne)=>{let we=M[ne];if(typeof we==="boolean")return[[ne,we]];if(we!==void 0)te(`${q}.${ne}`,Vu);return[]}))}function Bu(M){return Object.fromEntries(Object.entries(M).flatMap((F)=>Object.keys(F[1]).length>0?[F]:[]))}var Ar=()=>{return},Vu="not a boolean",Ku="not an object",Qy=`not an integer between ${ye} and ${ve}`,eS=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function tS(M,F){let q=[];return{policy:qu(M,F,(ne,we)=>{q.push({path:ne,reason:we})}),drops:q}}function h(M,F){return qu(M,F,Ar)}function qu(M,F,q){if(!En(M))return q("","not a JSON object"),z();if(M.version!==1)q("version","not 1");let te=to(M.safety,"safety",["level","overrides"],q),ne=to(te.overrides,"safety.overrides",Jr,q),we=to(M.workflow,"workflow",["worktree_mode"],q),Ke=to(M.destructive_command_protection,"destructive_command_protection",["enabled","overrides","allow_paths"],q),mt=to(M.secret_protection,"secret_protection",["enabled","overrides","deny_paths","allow_paths"],q),gt=to(M.audit,"audit",["retention_days"],q);return Yu(M,eS,"",q),{version:1,safety:{level:nS(te.level,q),overrides:ju(ne,Jr,"safety.overrides",q)},workflow:{worktree_mode:Pa(we.worktree_mode,"workflow.worktree_mode",!1,q)},destructive_command_protection:{enabled:Pa(Ke.enabled,"destructive_command_protection.enabled",!0,q),overrides:Li(Ke.overrides,Pe,"destructive_command_protection.overrides",q),allow_paths:no(Ke.allow_paths,Ae,F,"destructive_command_protection.allow_paths",q)},secret_protection:{enabled:Pa(mt.enabled,"secret_protection.enabled",!0,q),overrides:Li(mt.overrides,_e,"secret_protection.overrides",q),deny_paths:no(mt.deny_paths,Te,F,"secret_protection.deny_paths",q),allow_paths:no(mt.allow_paths,Ie,F,"secret_protection.allow_paths",q)},audit:{retention_days:rS(gt.retention_days,q)}}}function to(M,F,q,te){if(M===void 0)return{};if(!En(M))return te(F,Ku),{};return Yu(M,q,F,te),M}function Yu(M,F,q,te){for(let ne of Object.keys(M).filter((we)=>!F.includes(we)))te(q===""?ne:`${q}.${ne}`,"unknown field")}function nS(M,F){if(M===void 0)return"standard";if(Ta.has(M))return M;return F("safety.level","not one of standard, strict, paranoid"),"standard"}function Pa(M,F,q,te){if(typeof M==="boolean")return M;if(M!==void 0)te(F,Vu);return q}function rS(M,F){if(!(M===void 0||typeof M==="number"&&Number.isInteger(M)&&M>=ye&&M<=ve))F("audit.retention_days",Qy);return Nu(M)}function Li(M,F,q,te){if(M===void 0)return{};if(!En(M))return te(q,Ku),{};return Object.fromEntries(Object.entries(M).flatMap(([ne,we])=>{if(!F.has(ne))return te(`${q}.${ne}`,"unknown rule id"),[];if(we==="on"||we==="off")return[[ne,we]];return te(`${q}.${ne}`,'not "on" or "off"'),[]}))}function no(M,F,q,te,ne){if(M===void 0)return[];if(!Array.isArray(M))return ne(te,"not an array"),[];return M.flatMap((we,Ke)=>{let mt=F(we,q);if(mt===null)return[we];return ne(`${te}[${Ke}]`,mt),[]})}function En(M){return!!M&&typeof M==="object"&&!Array.isArray(M)}function z(){return structuredClone(Q)}function Ge(M,F){let q=P({safety:Ue(M.safety)},F),te=B({destructiveCommandProtectionEnabled:M.destructive_command_protection.enabled,destructiveCommandRuleOverrides:M.destructive_command_protection.overrides},q.capabilities),ne=Object.values(te),we=ne.filter((Ke)=>Ke.source!=="catastrophic");return{selectedPreset:M.safety.level,effectiveLevel:q.effectiveLevel,capabilities:q.capabilities,rules:te,counts:{enabled:we.filter((Ke)=>Ke.enabled).length,disabled:we.filter((Ke)=>!Ke.enabled).length,effectiveCustomizations:ne.filter((Ke)=>Ke.changesInherited).length}}}function He(M,F){if(!Zy(M))return{exists:!1,policy:z(),errors:[]};try{let q=Xy(M,"utf-8");if(!q.trim())return{exists:!0,policy:z(),errors:[`${M}: Config file is empty`],fallback:"defaults"};let te=JSON.parse(q),ne=tS(te,F);if(ne.drops.length===0)return{exists:!0,parsed:te,policy:ne.policy,errors:[]};return{exists:!0,parsed:te,policy:ne.policy,errors:ne.drops.map((we)=>`${M}: ${oS(we)}`),fallback:En(te)?"salvaged":"defaults"}}catch(q){let te=q instanceof Error?q.message:String(q);return{exists:!0,policy:z(),errors:[`${M}: ${q instanceof SyntaxError?"Invalid JSON":te}`],fallback:"defaults"}}}function oS(M){return M.path===""?M.reason:`${M.path}: ${M.reason}`}function iS(M,F){let q=He(M,F);if(!q.exists){let te=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!En(te))return{policy:Uu(),errors:[]};let ne=h(te,F);return{policy:Aa(ne),gui:ne,errors:[],levelPresent:$u(te)}}if(q.parsed===void 0)return{policy:Uu(),errors:q.errors,...q.fallback?{fallback:q.fallback}:{}};return{policy:Aa(q.policy),gui:q.policy,errors:q.errors,...q.fallback?{fallback:q.fallback}:{},levelPresent:$u(q.parsed)}}function $u(M){let F=En(M)&&En(M.safety)?M.safety:{};return Ta.has(F.level)}function We(M){let F=Object.entries(M),q=new Set(F.flatMap(([te,ne])=>ne==="on"?[te]:[]));return[...new Set([...[...Mi].filter((te)=>!q.has(te)),...F.flatMap(([te,ne])=>ne==="off"?[te]:[])])]}function Uu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:We({}),denyPaths:[],allowPaths:[]}}}function Aa(M){return{safety:Ue(M.safety),worktreeMode:M.workflow.worktree_mode,destructiveCommandProtectionEnabled:M.destructive_command_protection.enabled,destructiveCommandRuleOverrides:M.destructive_command_protection.overrides,destructiveCommandAllowPaths:M.destructive_command_protection.allow_paths,secretProtection:{enabled:M.secret_protection.enabled,disabledRules:We(M.secret_protection.overrides),denyPaths:M.secret_protection.deny_paths,allowPaths:M.secret_protection.allow_paths}}}function Ue(M){let F={...M.overrides.fail_closed!==void 0?{failClosed:M.overrides.fail_closed}:{},...M.overrides.paranoid_rm!==void 0?{paranoidRm:M.overrides.paranoid_rm}:{},...M.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:M.overrides.paranoid_interpreters}:{}};return{level:M.level,...Object.keys(F).length>0?{overrides:F}:{}}}function k(M,F){let q=Z(M,F),te=Hu(M,F),ne={rules:q.rules,transparentWrappers:q.transparent_wrappers,safety:te.safety,worktreeMode:te.worktreeMode,destructiveCommandProtectionEnabled:te.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:te.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:te.destructiveCommandAllowPaths,secretProtection:{enabled:te.secretProtection.enabled??!0,disabledRules:te.secretProtection.disabledRules??[],denyPaths:te.secretProtection.denyPaths,allowPaths:te.secretProtection.allowPaths??[]}},we={...q.userConfig?.overrides??{},...q.projectConfig?.overrides??{}},Ke=Object.freeze(Object.fromEntries(ne.rules.map((mt)=>{let gt=q.rulebooks.find((St)=>St.rules.includes(mt.name)),ht=we[mt.name];return[mt.name,Object.freeze({id:mt.name,...gt?{rulebook:Object.freeze({name:gt.name,version:gt.version}),...cS(gt.spec)?{source:gt.spec}:{}}:{},...ht&&typeof ht==="object"?{override:Object.freeze({type:"reason",reason:ht.reason})}:{}})]})));return De(ne,sS(q,te),Ke,te.policyScopes)}function Be(M){if(M.state==="ready")return{state:M.state};return{state:M.state,reason:M.reason}}function sS(M,F){let q=lS(F);if(M.errors.length===0&&M.warnings.length===0&&!q)return;return{diagnostics:[...M.errors,...M.warnings,...F.errors],reason:uS(M.errors.length>0?aS(M.errors):void 0,M.warnings.length>0?ka(M.warnings.join("; ")):void 0,q)}}function aS(M){return`${ka(M.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function lS(M){if(M.errors.length===0)return;let F=M.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${M.errors.join("; ")}. Enforcing ${F}; the invalid values are not active. Fix the policy file manually`}function cS(M){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(M)}function De(M,F,q=Object.freeze({}),te){let ne=Ia(structuredClone(M)),we=te?{policyScopes:Ia(structuredClone(te))}:{};if(!F)return Object.freeze({state:"ready",policy:ne,diagnostics:Object.freeze([]),ruleMetadata:q,...we});return Object.freeze({state:"degraded",policy:ne,diagnostics:Object.freeze([...F.diagnostics]),reason:F.reason,ruleMetadata:q,...we})}function Ia(M){if(typeof M!=="object"||M===null)return M;for(let F of Object.values(M))Ia(F);return Object.freeze(M)}function uS(...M){return ka(M.filter((F)=>!!F).join("; "))}function ka(M){return/[.!?]$/.test(M)?M:`${M}.`}function ze(M){let F=M.effectiveCapabilities,q=M.strict??F.fail_closed.enabled,te=M.paranoidRm??F.paranoid_rm.enabled,ne=M.paranoidInterpreters??F.paranoid_interpreters.enabled,we={fail_closed:Oa(F.fail_closed,M.strict,"strict"),paranoid_rm:Oa(F.paranoid_rm,M.paranoidRm,"paranoidRm"),paranoid_interpreters:Oa(F.paranoid_interpreters,M.paranoidInterpreters,"paranoidInterpreters")};return{policy:Wu(M.policySnapshot.policy,we),effectiveCapabilities:we,effectiveLevel:aa({failClosed:q,paranoidRm:te,paranoidInterpreters:ne}),strict:q,paranoidRm:te,paranoidInterpreters:ne,worktreeMode:M.worktreeMode??!1}}function Oa(M,F,q){if(F===void 0||F===M.enabled)return M;return{enabled:F,source:"capability_override",sources:[...M.sources,`analysis options.${q}`]}}function Oo(M,F){if(M!=="powershell")return F[0]?.provenance==="command-substitution";let q=F[0]?.text==="&"||F[0]?.text==="."?1:0,te=F[q]?.provenance;return te!==void 0&&te!=="literal"}var dS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Wi(M,F){return M?.provenance==="literal"&&!M.quoted&&M.raw===F&&M.text===F}function Mo(M){let F=Wi(M.words[0],"time")?1:0,q=F===1&&Wi(M.words[F],"-p")?F+1:F,te=F===1&&Wi(M.words[q],"--")?q+1:q,ne=Wi(M.words[te],"!")?te+1:te,we=M.words.slice(ne).find((Ke)=>!dS.test(Ke.text));return we?.provenance==="literal"?we.text:void 0}function Fi(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function fS(M){return Object.freeze({...M,span:Object.freeze(M.span),words:Object.freeze(M.words),redirections:Object.freeze(M.redirections.map((F)=>Object.freeze({...F,span:Object.freeze(F.span),...F.heredoc?{heredoc:Object.freeze({...F.heredoc,bodySpan:Object.freeze(F.heredoc.bodySpan),terminatorSpan:Object.freeze(F.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(M.nested.map((F)=>gn(F)))})}function Gi(M,F,q){M.push(q),F.reset()}function zi(M){let F=[];return{parts:F,push:(q,te,ne)=>{if(te<=q)return;F.push({raw:M.slice(q,te),span:{start:q,end:te},provenance:ne})}}}function Ma(M){let F=M.parts??[{raw:M.raw,span:M.span,provenance:M.provenance}];return Object.freeze({kind:"word",...M,span:Object.freeze(M.span),parts:Object.freeze(F.map((q)=>Object.freeze({...q,span:Object.freeze(q.span)})))})}function ro(M,F,q,te,ne,we,Ke){return Ma({text:te,raw:M.slice(F,q),span:{start:F,end:q},provenance:ne,quoted:we,...Ke?{parts:Ke}:{}})}function gn(M){return Object.freeze({...M,span:Object.freeze(M.span),issues:Object.freeze(M.issues.map((F)=>Object.freeze({...F,span:Object.freeze(F.span)}))),nodes:Object.freeze(M.nodes.map((F)=>{if(F.kind==="command")return fS(F);if(F.kind==="group"||F.kind==="function")return Object.freeze({...F,span:Object.freeze(F.span),body:gn(F.body)});return Object.freeze({...F,span:Object.freeze(F.span)})}))})}function Da(M,F,q){if(F>=q||Xu(M[F]??""))return null;let te="",ne=!1,we=!1,Ke=F;while(Ke<q&&!Xu(M[Ke]??"")){let mt=M[Ke]??"";if(mt==="'"){ne=!0;let gt=Zu(M,Ke+1,q,"'");te+=gt.text,we||=!gt.closed,Ke=gt.next;continue}if(mt==='"'){ne=!0;let gt=Zu(M,Ke+1,q,'"');te+=gt.text,we||=!gt.closed,Ke=gt.next;continue}if(mt==="\\"){ne=!0;let gt=M[Ke+1];if(!gt||gt===`
-`||gt==="\r"){we=!0;break}te+=gt,Ke+=2;continue}if(mt==="`"||M.startsWith("$(",Ke)||M.startsWith("${",Ke)||M.startsWith("<(",Ke)||M.startsWith(">(",Ke))we=!0;te+=mt,Ke++}return{delimiter:te,quoted:ne,next:Ke,span:{start:F,end:Ke},ambiguous:we}}function Na(M,F,q,te){let ne=[],we=F;for(let Ke of te){let mt=we,gt=!1;while(we<q){let ht=mS(M,we,q);if((Ke.stripTabs?ht.text.replace(/^\t+/,""):ht.text)===Ke.delimiter){Ke.attach({body:Ke.stripTabs?pS(M.slice(mt,we)):M.slice(mt,we),delimiter:Ke.delimiter,quotedDelimiter:Ke.quotedDelimiter,bodySpan:{start:mt,end:we},terminatorSpan:{start:we,end:ht.contentEnd}}),we=ht.next,gt=!0;break}if(ht.next<=we)break;we=ht.next}if(gt)continue;return ne.push({code:"unterminated-heredoc",message:`heredoc delimiter ${Ke.delimiter} was not found`,span:Ke.declarationSpan}),{next:q,issues:ne,terminated:!1}}return{next:we,issues:ne,terminated:!0}}function Zu(M,F,q,te){let ne="",we=F;while(we<q&&M[we]!==`
-`&&M[we]!=="\r"){let Ke=M[we]??"";if(Ke===te)return{text:ne,next:we+1,closed:!0};if(te==='"'&&Ke==="\\"&&M[we+1]){let mt=M[we+1]??"";ne+=["$","`",'"',"\\"].includes(mt)?mt:`\\${mt}`,we+=2;continue}ne+=Ke,we++}return{text:ne,next:we,closed:!1}}function Xu(M){return/[\s;&|<>)]/u.test(M)||M==="`"}function mS(M,F,q){let te=F;while(te<q&&M[te]!==`
-`&&M[te]!=="\r")te++;let ne=te>=q?q:M[te]==="\r"&&M[te+1]===`
-`?te+2:te+1;return{text:M.slice(F,te),contentEnd:te,next:ne}}function pS(M){return M.replace(/(^|\r\n?|\n)\t+/g,"$1")}var nd=new Set(["&&","||","|","|&"]);function rd(M,F){let q={start:0,end:M.length};if(M.length>F.maxInputLength)return gn({kind:"program",dialect:"posix",source:M,span:q,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${F.maxInputLength} UTF-16 code units`,span:q}],nodes:[]});let te=Ui(M,0,M.length,F,{used:0,max:F.maxWords},0);return gn({kind:"program",dialect:"posix",source:M,span:q,status:Vi(te.issues,te.limited),issues:te.issues,nodes:te.nodes})}function Ui(M,F,q,te,ne,we,Ke){let mt=[],gt=[],ht=Fi(),St=[],bt=()=>{if(ht.words.length===0&&ht.redirections.length===0)return;let Ct={start:ht.start,end:ht.end},vt=ht.words.map((Rt)=>Rt.text);Gi(mt,ht,{kind:"command",dialect:"posix",source:M.slice(Ct.start,Ct.end),span:Ct,words:ht.words,redirections:ht.redirections,nested:ht.nested,displayText:gt.length>0&&mt.length===0?M.slice(F,q):vt.join(" ")})},yt=F;while(yt<q){let Ct=M[yt];if(!Ct)break;if(Ke&&Ct===Ke)return bt(),td(mt,gt),{nodes:mt,issues:gt,next:yt+1,closed:!0,limited:!1,pendingHeredocs:St};if(ji(Ct)){if(Ct===`
-`||Ct==="\r"){bt();let Pt=Ct==="\r"&&M[yt+1]===`
-`?yt+2:yt+1,Ot=mt.at(-1);if(Ot?.kind!=="connector"||!nd.has(Ot.operator))mt.push(Object.freeze({kind:"connector",operator:M.slice(yt,Pt),span:Object.freeze({start:yt,end:Pt})}));if(St.length>0){let It=Na(M,Pt,q,St.splice(0));gt.push(...It.issues),yt=It.next;continue}yt=Pt;continue}yt++;continue}if(Ct==="#"){while(yt<q&&M[yt]!==`
-`&&M[yt]!=="\r")yt++;continue}let vt=ht.start===-1?DS(M,yt,q):void 0;if(vt){if(Wa(mt,gt,yt),we>=te.maxDepth)return oo(mt,gt,yt,"depth-limit",te.maxDepth);if(!La(ne))return oo(mt,gt,yt,"word-limit",te.maxWords);let Pt=Ui(M,vt.braceIndex+1,q,te,ne,we+1,"}"),Ot=Pt.next,It={start:vt.braceIndex+1,end:Pt.closed?Ot-1:Ot},Mt=Ju(M,It,Pt);if(mt.push({kind:"function",name:vt.name,span:{start:yt,end:Ot},body:Mt}),gt.push(...Pt.issues),Pt.pendingHeredocs.length>0||No(Pt.nodes))gt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:yt,end:Ot}});if(St.push(...Pt.pendingHeredocs),Pt.limited)return $i(mt,gt,Pt.next);if(!Pt.closed)gt.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:vt.braceIndex,end:Ot}});yt=Ot;continue}let Rt=Hi(M,yt);if(Rt){if(bt(),!dd(mt.at(-1)))gt.push({code:"unexpected-connector",message:`connector ${Rt} has no preceding command`,span:{start:yt,end:yt+Rt.length}});mt.push(Object.freeze({kind:"connector",operator:Rt,span:Object.freeze({start:yt,end:yt+Rt.length})})),yt+=Rt.length;continue}if(Ct===")"){bt(),gt.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:yt,end:yt+1}}),mt.push({kind:"unknown",source:Ct,span:{start:yt,end:yt+1}}),yt++;continue}if((Ct==="("||Ct==="{"&&ES(M,yt,q))&&ht.start===-1){if(Wa(mt,gt,yt),we>=te.maxDepth)return oo(mt,gt,yt,"depth-limit",te.maxDepth);let Pt=Ct==="("?")":"}",Ot=Ui(M,yt+1,q,te,ne,we+1,Pt),It=Ot.next,Mt={start:yt+1,end:Ot.closed?It-1:It},Yt=Ju(M,Mt,Ot);if(mt.push({kind:"group",style:Ct==="("?"subshell":"brace",span:{start:yt,end:It},body:Yt}),gt.push(...Ot.issues),Ot.pendingHeredocs.length>0||No(Ot.nodes))gt.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:yt,end:It}});if(St.push(...Ot.pendingHeredocs),Ot.limited)return $i(mt,gt,Ot.next);if(!Ot.closed)gt.push({code:Ct==="("?"unclosed-subshell":"unclosed-brace-group",message:`${Ct} group is not closed`,span:{start:yt,end:It}});yt=It;continue}let Et=(Ct==="<"||Ct===">")&&M[yt+1]!=="("?SS(M,yt):null;if(Et){let Pt=ht.words.at(-1),Ot=Pt&&Pt.span.end===yt&&/^[0-9]+$/.test(Pt.raw)?Number(Pt.raw):void 0;if(Ot!==void 0)ht.words.pop();let It=Ot===void 0?yt:Pt?.span.start??yt;ht.start=ht.start===-1?yt:ht.start;let Mt=yt+Et.length;while(Mt<q&&/[ \t]/.test(M[Mt]??""))Mt++;let Yt=M[Mt],Xt=Mt>yt+Et.length&&Yt==="#",nn=!Yt||ji(Yt)||!!Hi(M,Mt)||Yt===Ke||Yt===")"||Xt||(Yt==="<"||Yt===">")&&M[Mt+1]!=="(",Qt=Et==="<<"||Et==="<<-",Ut=Qt?Da(M,Mt,q):void 0,Ft=Ut?{word:ro(M,Mt,Ut.next,Ut.delimiter,"literal",Ut.quoted),nested:[],issues:[],next:Ut.next,limited:!1}:!nn?Fa(M,Mt,q,te,ne,we):void 0;if(Ft){if(gt.push(...Ft.issues),Ft.limited)return $i(mt,gt,Ft.next);if(!La(ne))return oo(mt,gt,Ft.next,"word-limit",te.maxWords)}let an=Ft?.next??yt+Et.length,wn={kind:"redirection",operator:Et,span:{start:It,end:an},...Ot===void 0?{}:{fd:Ot},...Ft?{target:Ft.word}:{}};if(ht.redirections.push(wn),Qt&&!Ut)gt.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:yt,end:yt+Et.length}});if(Ut){if(Ut.ambiguous||Ut.delimiter.length===0)gt.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:Ut.span});let Kn=ht.nested;St.push({delimiter:Ut.delimiter,quotedDelimiter:Ut.quoted,stripTabs:Et==="<<-",declarationSpan:{start:It,end:an},attach:(On)=>{if(wn.heredoc=On,On.quotedDelimiter)return;Kn.push(...hS(M,On.bodySpan.start,On.bodySpan.end,te,ne,we+1))}})}if(!Qt&&!Ft)gt.push({code:"missing-redirection-target",message:`redirection ${Et} requires a target word`,span:{start:yt,end:yt+Et.length}});if(Ft)ht.nested.push(...Ft.nested);ht.end=an,yt=an;continue}if(ht.start===-1)Wa(mt,gt,yt);let xt=Fa(M,yt,q,te,ne,we);if(gt.push(...xt.issues),xt.limited)return $i(mt,gt,xt.next);let At=_S(ht.words)?IS(M,xt.word,ne.max-ne.used,te.maxDepth,te.maxInputLength):void 0;if(At?.limitCode)return oo(mt,gt,xt.next,At.limitCode,At.limitCode==="word-limit"?te.maxWords:At.limitCode==="depth-limit"?te.maxDepth:te.maxInputLength);let Tt=At?.words??[xt.word];for(let Pt of Tt){if(!La(ne))return oo(mt,gt,xt.next,"word-limit",te.maxWords);ht.words.push(Pt)}ht.start=ht.start===-1?yt:ht.start,ht.end=xt.next,ht.nested.push(...xt.nested),yt=xt.next>yt?xt.next:yt+1}return bt(),td(mt,gt),gt.push(...NS(St)),{nodes:mt,issues:gt,next:yt,closed:Ke===void 0,limited:!1,pendingHeredocs:[]}}function Ju(M,F,q){return{kind:"program",dialect:"posix",source:M.slice(F.start,F.end),span:F,status:Vi(q.issues,q.limited),issues:q.issues,nodes:q.nodes}}function Fa(M,F,q,te,ne,we){let Ke="",mt=F,gt=!1,ht="literal",St=[],bt=[],yt=!1;while(mt<q){let Ct=M[mt],vt=(Ct==="<"||Ct===">")&&M[mt+1]==="(";if(!Ct||ji(Ct)||(Ct===";"||Ct==="|"||Ct==="&")&&Hi(M,mt)||(Ct==="<"||Ct===">")&&!vt)break;if(Ct===")")break;if(Ct==="'"){gt=!0;let Et=M.indexOf("'",mt+1);if(Et===-1||Et>=q){Ke+=M.slice(mt+1,q),bt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:mt,end:q}}),mt=q;break}Ke+=M.slice(mt+1,Et),mt=Et+1;continue}if(Ct==='"'){gt=!0;let Et=gS(M,mt,q,te,ne,we);if(Ke+=Et.text,St.push(...Et.nested),bt.push(...Et.issues),yt||=Et.limited,ht=Do(ht,Et.provenance),mt=Et.next,yt)break;continue}if(M.startsWith("$'",mt)){gt=!0;let Et=bS(M,mt+2,q);if(Ke+=Et.text,bt.push(...Et.issues),!Et.closed)bt.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:mt,end:q}});mt=Et.next;continue}if(Ct==="\\"){let Et=M[mt+1];if(!Et){bt.push({code:"trailing-escape",message:"escape has no following character",span:{start:mt,end:mt+1}}),mt++;break}if(Et===`
-`){mt+=2;continue}Ke+=Et,mt+=2;continue}let Rt=Ct==="$"||Ct==="<"||Ct===">"||Ct==="`"?Ki(M,mt,q,te,ne,we):null;if(Rt){let Et=od(Rt,St,bt);if(yt||=Et.limited,ht=Do(ht,Et.provenance),mt=Et.next,yt)break;continue}if(Ct==="$"){let Et=ad(M,mt,q,Ke,ht);Ke=Et.text,ht=Et.provenance,mt=Et.next;continue}if(Ct==="*"||Ct==="?"||Ct==="[")ht=Do(ht,"glob");Ke+=Ct,mt++}return{word:ro(M,F,mt,Ke,ht,gt,ht==="literal"?void 0:vS(M,F,mt)),nested:St,issues:bt,next:mt,limited:yt}}function gS(M,F,q,te,ne,we){let Ke="",mt="literal",gt=[],ht=[],St=!1,bt=F+1;while(bt<q){let yt=M[bt];if(yt==='"')return{text:Ke,provenance:mt,nested:gt,issues:ht,next:bt+1,limited:St};if(yt==="\\"&&M[bt+1]){let vt=M[bt+1]??"";if(vt===`
-`){bt+=2;continue}if(vt==="\r"&&M[bt+2]===`
-`){bt+=3;continue}Ke+=["$","`",'"',"\\"].includes(vt)?vt:`\\${vt}`,bt+=2;continue}if(M.startsWith("$((",bt)){let vt=Ga(M,bt+3,q,"))"),Rt=vt===-1?q:vt+2;if(Ke+=M.slice(bt,Rt),vt===-1)ht.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:bt,end:Rt}});bt=Rt;continue}let Ct=Ki(M,bt,q,te,ne,we);if(Ct){let vt=od(Ct,gt,ht);if(bt=vt.next,St||=vt.limited,mt=Do(mt,vt.provenance),St)return{text:Ke,provenance:mt,nested:gt,issues:ht,next:bt,limited:St};continue}if(yt==="$"){let vt=ad(M,bt,q,Ke,mt);Ke=vt.text,mt=vt.provenance,bt=vt.next;continue}Ke+=yt??"",bt++}return ht.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:F,end:q}}),{text:Ke,provenance:mt,nested:gt,issues:ht,next:q,limited:St}}function Ki(M,F,q,te,ne,we){let Ke=M.startsWith("$((",F),mt=M.startsWith("$(",F)&&!Ke,gt=M.startsWith("<(",F)||M.startsWith(">(",F),ht=M[F]==="`";if(!Ke&&!mt&&!gt&&!ht)return null;let St=Ke?3:ht?1:2,bt=Ke?"))":ht?"`":")",yt=Ga(M,F+St,q,bt),Ct=yt===-1?q:yt,vt=yt===-1?q:yt+bt.length;if(we>=te.maxDepth)return{program:MS(M,F+St,Ct,"depth-limit"),next:vt,provenance:Ke?"arithmetic":"command-substitution"};if(Ke){let At=[],Tt=[],Pt=!1,Ot=F+St;while(Ot<Ct){let It=Ki(M,Ot,Ct,te,ne,we+1);if(!It){Ot++;continue}if(At.push(...It.program.nodes),Tt.push(...It.program.issues),Pt||=It.program.status==="limited",Ot=It.next,Pt)break}if(yt===-1)Tt.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:F,end:vt}});return{program:gn({kind:"program",dialect:"posix",source:M.slice(F+St,Ct),span:{start:F+St,end:Ct},status:Vi(Tt,Pt),issues:Tt,nodes:At}),next:vt,provenance:"arithmetic"}}let Rt=Ui(M,F+St,Ct,te,ne,we+1),Et=yt===-1?[{code:"unclosed-command-substitution",message:`${M.slice(F,F+St)} substitution is not closed`,span:{start:F,end:vt}}]:[],xt=(ht||gt)&&No(Rt.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:F,end:vt}}]:[];return{program:gn({kind:"program",dialect:"posix",source:M.slice(F+St,Ct),span:{start:F+St,end:Ct},status:Vi([...Rt.issues,...Et,...xt],Rt.limited),issues:[...Rt.issues,...Et,...xt],nodes:Rt.nodes}),next:vt,provenance:"command-substitution"}}function hS(M,F,q,te,ne,we){let Ke=[],mt=F;while(mt<q){let gt=M[mt];if(gt==="\\"){mt+=2;continue}let ht=gt==="$"||gt==="`"?Ki(M,mt,q,te,ne,we):null;if(!ht){mt++;continue}if(Ke.push(ht.program),mt=ht.next,ht.program.status==="limited")break}return Ke}function od(M,F,q){return F.push(M.program),q.push(...M.program.issues),{provenance:M.provenance,next:M.next,limited:M.program.status==="limited"}}function Ga(M,F,q,te){if(te==="`"){for(let mt=F;mt<q;mt++){if(M[mt]==="\\"){mt++;continue}if(M[mt]==="`")return mt}return-1}let ne=1,we={single:!1,double:!1},Ke=[];for(let mt=F;mt<q;mt++){let gt=M[mt];if((gt===`
-`||gt==="\r")&&Ke.length>0){let St=gt==="\r"&&M[mt+1]===`
-`?mt+2:mt+1,bt=Na(M,St,q,Ke.splice(0));if(!bt.terminated)return-1;mt=bt.next-1;continue}let ht=id(M,mt,F,q,we);if(ht!==null){mt=ht;continue}if(!we.double&&M.startsWith("$((",mt)){let St=yS(M,mt+3,q);if(St===-1)return-1;mt=St+1;continue}if(te===")"&&!we.double&&gt==="<"&&M[mt+1]==="<"&&M[mt+2]!=="<"){let St=M[mt+2]==="-",bt=mt+(St?3:2);while(bt<q&&/[ \t]/.test(M[bt]??""))bt++;let yt=Da(M,bt,q);if(yt){Ke.push({delimiter:yt.delimiter,quotedDelimiter:yt.quoted,stripTabs:St,declarationSpan:{start:mt,end:yt.next},attach:()=>{return}}),mt=yt.next-1;continue}}if(M.startsWith("$(",mt)&&!M.startsWith("$((",mt)){ne++,mt++;continue}if(gt==="("&&!we.double)ne++;if(gt===")"&&!we.double){if(ne--,ne===0)return te==="))"&&M[mt+1]!==")"?-1:mt}}return-1}function yS(M,F,q){let te=1,ne={single:!1,double:!1};for(let we=F;we<q;we++){let Ke=M[we],mt=id(M,we,F,q,ne);if(mt!==null){we=mt;continue}if(M.startsWith("$(",we)&&!M.startsWith("$((",we)){te++,we++;continue}if(Ke==="("&&!ne.double)te++;if(Ke!==")"||ne.double)continue;if(te--,te===0)return M[we+1]===")"?we:-1}return-1}function id(M,F,q,te,ne){let we=M[F];if(we==="\\"&&!ne.single)return F+1;if(!ne.double&&we==="'")ne.single=!ne.single;if(!ne.single&&we==='"')ne.double=!ne.double;if(ne.single)return F;if(ne.double||we!=="#"||!LS(M,F,q))return null;let Ke=F;while(Ke+1<te&&M[Ke+1]!==`
-`&&M[Ke+1]!=="\r")Ke++;return Ke}function Hi(M,F){let q=M[F];if(q===";")return";";if(q==="&")return M[F+1]==="&"?"&&":"&";if(q==="|")return M[F+1]==="|"?"||":M[F+1]==="&"?"|&":"|";return null}function SS(M,F){let q=M[F];if(q===">"){if(M[F+1]===">")return">>";if(M[F+1]==="&")return">&";return M[F+1]==="|"?">|":">"}if(q!=="<")return null;if(M.startsWith("<<<",F))return"<<<";if(M.startsWith("<<-",F))return"<<-";if(M[F+1]==="<")return"<<";if(M[F+1]==="&")return"<&";if(M[F+1]===">")return"<>";return"<"}function ji(M){let F=M.charCodeAt(0);if(F===32||F>=9&&F<=13)return!0;if(F<128)return!1;return/\s/u.test(M)}function sd(M,F,q){if(M[F+1]==="{"){let ne=M.indexOf("}",F+2);return ne===-1||ne>=q?q:ne+1}let te=F+1;while(te<q&&/[A-Za-z0-9_?@#$!*-]/.test(M[te]??""))te++;return te===F+1?F+1:te}function bS(M,F,q){let te="",ne=[],we=F;while(we<q){let Ke=M[we];if(Ke==="'")return{text:te,next:we+1,closed:!0,issues:ne};if(Ke!=="\\"){te+=Ke??"",we++;continue}let mt=CS(M,we+1,q);if(te+=mt.text,mt.invalidCodePoint!==void 0)ne.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${mt.invalidCodePoint}`,span:{start:we,end:mt.next}});we=mt.next}return{text:te,next:q,closed:!1,issues:ne}}function CS(M,F,q){let te=M[F];if(!te||F>=q)return{text:"\\",next:F};let ne=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(ne.has(te))return{text:ne.get(te)??te,next:F+1};if(te==="x")return Bi(M,F+1,q,16,2,F+1);if(te==="u")return Bi(M,F+1,q,16,4,F+1);if(te==="U")return Bi(M,F+1,q,16,8,F+1);if(/[0-7]/.test(te))return Bi(M,F,q,8,3,F+1);return{text:te,next:F+1}}function Bi(M,F,q,te,ne,we){let Ke=te===16?/[0-9a-fA-F]/:/[0-7]/,mt="",gt=F;while(gt<q&&mt.length<ne&&Ke.test(M[gt]??""))mt+=M[gt],gt++;if(!mt)return{text:M[we-1]??"",next:we};let ht=Number.parseInt(mt,te);return ht>1114111||ht>=55296&&ht<=57343?{text:"�",next:gt,invalidCodePoint:ht}:{text:String.fromCodePoint(ht),next:gt}}function Vi(M,F=!1){if(F)return"limited";if(M.some((q)=>q.code==="invalid-ansi-c-code-point"||q.code==="missing-heredoc-delimiter"||q.code==="ambiguous-heredoc-delimiter"||q.code==="unterminated-heredoc"||q.code==="unsupported-heredoc-context"))return"invalid";return M.length>0?"partial":"complete"}function ad(M,F,q,te,ne){let we=sd(M,F,q);return{text:te+M.slice(F,we),provenance:Do(ne,"variable"),next:we}}function vS(M,F,q){let te=zi(M),ne=F,we=!1,Ke=!1,mt=F;while(mt<q){let gt=M[mt];if(gt==="\\"&&!we){mt+=2;continue}if(!Ke&&gt==="'"){we=!we,mt++;continue}if(!we&&gt==='"'){Ke=!Ke,mt++;continue}if(we){mt++;continue}let ht=M.startsWith("$((",mt),St=M.startsWith("$(",mt)&&!ht,bt=!Ke&&(M.startsWith("<(",mt)||M.startsWith(">(",mt)),yt=gt==="`";if(ht||St||bt||yt){let Ct=ht?3:yt?1:2,vt=ht?"))":yt?"`":")",Rt=Ga(M,mt+Ct,q,vt),Et=Rt===-1?q:Rt+vt.length;te.push(ne,mt,"literal"),te.push(mt,Et,ht?"arithmetic":"command-substitution"),mt=Et,ne=Et;continue}if(gt==="$"){let Ct=sd(M,mt,q);if(Ct>mt+1){te.push(ne,mt,"literal"),te.push(mt,Ct,"variable"),mt=Ct,ne=Ct;continue}}if(!Ke&&(gt==="*"||gt==="?"||gt==="[")){te.push(ne,mt,"literal"),te.push(mt,mt+1,"glob"),mt++,ne=mt;continue}mt++}return te.push(ne,q,"literal"),te.parts}function Do(M,F){if(F==="command-substitution"||M==="command-substitution")return"command-substitution";if(F==="arithmetic"||M==="arithmetic")return"arithmetic";if(F==="variable"||M==="variable")return"variable";if(F==="glob"||M==="glob")return"glob";return M}function ES(M,F,q){return F+1>=q||ji(M[F+1]??"")||Hi(M,F+1)!==null}var RS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),xS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function _S(M){let F=0;while(F<=M.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(M[F]?.text??""))F++;if(F===M.length)return!0;let q=wS(M,F);if(q===void 0||q===null)return!1;F=q}return!1}function wS(M,F){let q=M[F]?.text.toLowerCase();if(q==="command")return PS(M,F);if(q==="env")return AS(M,F);if(q==="sudo")return TS(M,F);return}function PS(M,F){if(M[F+1]?.text==="-v")return null;for(let q=F+1;q<M.length;q++){let te=M[q]?.text??"";if(te==="--")return q+1;if(te==="-p"||te==="-v"||te==="-V"||/^-[pvV]+$/.test(te))continue;return q}return M.length}function AS(M,F){for(let q=F+1;q<M.length;q++){let te=M[q]?.text??"";if(te==="--")return q+1;if(RS.has(te)){if(M[q+1]===void 0)return null;q++;continue}if(te.startsWith("-u=")||te.startsWith("--unset=")||te.startsWith("-C")&&te.length>2||te.startsWith("--chdir=")||te.startsWith("-S")&&te.length>2||te.startsWith("--split-string=")||te.startsWith("-P"))continue;if(te.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(te))continue;return q}return M.length}function TS(M,F){for(let q=F+1;q<M.length;q++){let te=M[q]?.text??"";if(te==="--")return q+1;if(xS.has(te)){if(M[q+1]===void 0)return null;q++;continue}if(te.startsWith("-"))continue;return q}return M.length}function ld(M,F,q,te){if(M.provenance!=="literal"||!M.raw.includes("{"))return;let ne=[M.raw],we=M.raw.length,Ke=0;while(!0){let gt=ne.findIndex((vt)=>ed(vt));if(gt===-1)break;if(++Ke>q)return{limited:!0};let ht=ne[gt]??"",St=ed(ht);if(!St||St.kind==="range")return{limited:!0};let bt=St.start+ht.length-St.end,yt=St.alternatives.reduce((vt,Rt)=>vt+bt+Rt.length,0);if(we-ht.length+yt>te||ne.length-1+St.alternatives.length>F)return{limited:!0};let Ct=cd(ht,St);ne.splice(gt,1,...Ct),we+=yt-ht.length}if(Ke===0)return;let mt=ne.map((gt)=>OS(gt,q));if(mt.some((gt)=>gt===null))return{limited:!0};return{words:[...new Set(mt.filter((gt)=>gt!==null&&gt!==""))]}}function IS(M,F,q,te,ne){if(F.provenance!=="literal"||F.quoted||F.raw!==F.text||!F.raw.includes("{"))return;let we=[F.text],Ke=F.text.length,mt=0;while(!0){let ht=we.findIndex((Et)=>Qu(Et));if(ht===-1)break;if(++mt>te)return{limitCode:"depth-limit"};let St=we[ht]??"",bt=Qu(St);if(!bt)break;let yt=bt.start+St.length-bt.end,Ct=bt.alternatives.filter((Et)=>yt+Et.length>0),vt=Ct.reduce((Et,xt)=>Et+yt+xt.length,0);if(Ke-St.length+vt>ne)return{limitCode:"brace-expansion-limit"};if(we.length-1+Ct.length>q)return{limitCode:"word-limit"};let Rt=cd(St,{...bt,alternatives:Ct});we.splice(ht,1,...Rt),Ke+=vt-St.length}let gt=we.filter((ht)=>ht.length>0);if(mt===0)return;return{words:gt.map((ht)=>ro(M,F.span.start,F.span.end,ht,"literal",!1))}}function Qu(M){let F=[],q;for(let te=0;te<M.length;te++){let ne=M[te];if(ne==="{"){F.push({start:te,commas:[]});continue}if(ne===","&&F.length>0){F.at(-1)?.commas.push(te);continue}if(ne!=="}"||F.length===0)continue;let we=F.pop();if(!we||we.commas.length===0)continue;if(!q||we.start<q.start)q={start:we.start,end:te+1,commas:we.commas}}if(!q)return;return{start:q.start,end:q.end,alternatives:ud(M,q)}}function ed(M){let F=[],q,te=null,ne=!1;for(let we=0;we<M.length;we++){let Ke=M[we];if(ne){ne=!1;continue}if(Ke==="\\"&&te!=="'"){ne=!0;continue}if(Ke===te){te=null;continue}if(te===null&&(Ke==="'"||Ke==='"')){te=Ke;continue}if(te!==null)continue;if(Ke==="{"){F.push({start:we,commas:[]});continue}if(Ke===","&&F.length>0){F.at(-1)?.commas.push(we);continue}if(Ke!=="}"||F.length===0)continue;let mt=F.pop();if(!mt)continue;let gt=mt.commas.length>0?{kind:"alternatives",start:mt.start,end:we+1,commas:mt.commas}:kS(M.slice(mt.start+1,we))?{kind:"range",start:mt.start,end:we+1}:void 0;if(gt&&(!q||gt.start<q.start))q=gt}if(!q||q.kind==="range")return q;return{kind:q.kind,start:q.start,end:q.end,alternatives:ud(M,q)}}function cd(M,F){return F.alternatives.map((q)=>`${M.slice(0,F.start)}${q}${M.slice(F.end)}`)}function ud(M,F){let q=[F.start,...F.commas,F.end-1];return q.slice(0,-1).map((te,ne)=>M.slice(te+1,q[ne+1]))}function kS(M){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(M)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(M)}function OS(M,F){let q=`x${M}`,te=Fa(q,0,q.length,{maxInputLength:q.length,maxWords:1,maxDepth:F},{used:0,max:1},0);if(te.limited||te.issues.length>0||te.next!==q.length||te.word.provenance!=="literal")return null;return te.word.text.slice(1)}function MS(M,F,q,te){return gn({kind:"program",dialect:"posix",source:M.slice(F,q),span:{start:F,end:q},status:"limited",issues:[{code:te,message:"command structure exceeds parser limit",span:{start:F,end:q}}],nodes:[]})}function oo(M,F,q,te,ne){return{nodes:M,issues:[...F,{code:te,message:`command structure exceeds parser limit ${ne}`,span:{start:q,end:q}}],next:q,closed:!1,limited:!0,pendingHeredocs:[]}}function $i(M,F,q){return{nodes:M,issues:F,next:q,closed:!1,limited:!0,pendingHeredocs:[]}}function La(M){return M.used++,M.used<=M.max}function DS(M,F,q){let te=M.slice(F,q),ne=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(te)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(te),we=ne?.[1];if(!ne||!we)return;return{name:we,braceIndex:F+ne[0].lastIndexOf("{")}}function No(M){return M.some((F)=>{if(F.kind==="command")return F.redirections.some((q)=>q.heredoc)||F.nested.some((q)=>No(q.nodes));return(F.kind==="group"||F.kind==="function")&&No(F.body.nodes)})}function NS(M){return M.map((F)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${F.delimiter} was not found`,span:F.declarationSpan}))}function dd(M){return M?.kind==="command"||M?.kind==="group"||M?.kind==="function"}function td(M,F){let q=M.at(-1);if(q?.kind!=="connector"||!nd.has(q.operator))return;F.push({code:"missing-command-after-connector",message:`connector ${q.operator} requires a following command`,span:q.span})}function Wa(M,F,q){if(!dd(M.at(-1)))return;F.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:q,end:q+1}})}function LS(M,F,q){return F===q||/[\s;&|()]/u.test(M[F-1]??"")}var fd=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),WS=new Set(["gc","cat","type","cp","mv","rm"]),md=["-rec","-for","-path","-literalpath","-whatif"],FS=/^\$env:\w/i,GS=/^(?:\$\{?\w+\}?|~)\\./,qi={maxInputLength:131072,maxWords:16384,maxDepth:64};function pd(M){let F=M.toLowerCase().replaceAll("`","");if(![...fd].some((te)=>F.includes(te))&&!(F.includes("rm")&&md.some((te)=>F.includes(te)))&&!F.includes("<#")&&!zS(F))return!1;let q=VS(M);if(q.posixHeredoc)return!1;return q.invalidComment||q.commands.some(BS)}function zS(M){if(M.includes("$env:"))return!0;return M.includes("\\")&&(M.includes("$")||M.includes("~"))}function BS(M){let F=M[0]==="&"||M[0]==="."?1:0,q=M[F]?.toLowerCase();if(q&&fd.has(q))return!0;let te=M.slice(F+1);if(q&&WS.has(q)&&te.some($S))return!0;if(q!=="rm")return!1;return te.some((ne)=>{let we=ne.toLowerCase().split(":",1)[0]??"";return md.some((Ke)=>we.startsWith(Ke))})}function $S(M){return FS.test(M)||GS.test(M)}function gd(M,F){let q={start:0,end:M.length};if(M.length>F.maxInputLength)return gn({kind:"program",dialect:"powershell",source:M,span:q,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${F.maxInputLength} UTF-16 code units`,span:q}],nodes:[]});let te=Ha(M,0,M.length,F,0);return gn({kind:"program",dialect:"powershell",source:M,span:q,status:KS(te.issues,te.limited),issues:te.issues,nodes:te.nodes})}function Ha(M,F,q,te,ne,we=!1){let Ke=[],mt=[],gt=Fi(),ht=0,St=!1,bt=()=>{if(gt.words.length===0&&gt.redirections.length===0)return;let Ct={start:gt.start,end:gt.end};Gi(Ke,gt,{kind:"command",dialect:"powershell",source:M.slice(Ct.start,Ct.end),span:Ct,words:gt.words,redirections:gt.redirections,nested:gt.nested,displayText:gt.words.map((vt)=>vt.text).join(" ")})},yt=F;while(yt<q){let Ct=M[yt];if(!Ct)break;if(we&&Ct==="}")return bt(),{nodes:Ke,issues:mt,next:yt+1,closed:!0,words:ht,limited:St};let vt=Sd(M,yt,q,te.maxDepth);if(vt){if(vt.issue)mt.push(vt.issue);if(vt.limited)return bt(),{nodes:Ke,issues:mt,next:vt.next,closed:!1,words:ht,limited:!0};yt=vt.next;continue}if(/\s/.test(Ct)){if(Ct==="\r"||Ct===`
-`){bt();let xt=Ct==="\r"&&M[yt+1]===`
-`?yt+2:yt+1;Ke.push(za(M,yt,xt)),yt=xt;continue}yt++;continue}let Rt=ja(M,yt);if(Rt){bt(),Ke.push(za(M,yt,yt+Rt.length)),yt+=Rt.length;continue}if(Ct==="{"){if(bt(),ne>=te.maxDepth)return mt.push(yd(yt,te.maxDepth)),{nodes:Ke,issues:mt,next:q,closed:!1,words:ht,limited:!0};let xt=Ha(M,yt+1,q,te,ne+1,!0),At=xt.closed?xt.next-1:xt.next,Tt=gn({kind:"program",dialect:"powershell",source:M.slice(yt+1,At),span:{start:yt+1,end:At},status:xt.limited?"limited":xt.issues.length>0?"partial":"complete",issues:xt.issues,nodes:xt.nodes});if(Ke.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:yt,end:xt.next}),body:Tt})),mt.push(...xt.issues),!xt.closed)mt.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:yt,end:xt.next}});ht+=xt.words,St||=xt.limited,yt=xt.next;continue}if(Ct==="}"){bt(),Ke.push(za(M,yt,yt+1)),yt++;continue}if(Ct===">"||Ct==="<"){gt.start=gt.start===-1?yt:gt.start;let xt=M[yt+1]===Ct?yt+2:yt+1,At=xt;while(/[ \t]/.test(M[At]??""))At++;let Tt=At<q?Ba(M,At,q,te,ne):void 0,Pt=Tt?.next??xt;if(gt.redirections.push(Object.freeze({kind:"redirection",operator:M.slice(yt,xt),span:Object.freeze({start:yt,end:Pt}),...Tt?{target:Tt.word}:{}})),Tt)mt.push(...Tt.issues),gt.nested.push(...Tt.nested),ht+=Tt.words,St||=Tt.limited;gt.end=Pt,yt=Pt;continue}if(Ct===","){gt.start=gt.start===-1?yt:gt.start,gt.words.push(Ma({text:",",raw:",",span:{start:yt,end:yt+1},provenance:"literal",quoted:!1})),gt.end=++yt;continue}let Et=Ba(M,yt,q,te,ne);if(gt.start=gt.start===-1?yt:gt.start,gt.end=Et.next,gt.words.push(Et.word),mt.push(...Et.issues),gt.nested.push(...Et.nested),ht+=1+Et.words,St||=Et.limited,ht>te.maxWords)return mt.push({code:"word-limit",message:`command exceeds ${te.maxWords} words`,span:{start:yt,end:Et.next}}),bt(),{nodes:Ke,issues:mt,next:Et.next,closed:!1,words:ht,limited:!0};yt=Et.next>yt?Et.next:yt+1}return bt(),{nodes:Ke,issues:mt,next:yt,closed:!we,words:ht,limited:St}}function Ba(M,F,q,te,ne){let we="",Ke="literal",mt=!1,gt=[],ht=[],St=0,bt=!1,yt=(vt)=>{let Rt=US(M,vt,q,te,ne);return we+=M.slice(vt,Rt.next),ht.push(Rt.program),gt.push(...Rt.program.issues),St+=$a(Rt.program),bt||=Rt.program.status==="limited",Ke="command-substitution",Rt.next},Ct=F;while(Ct<q){let vt=M[Ct];if(!vt||/\s/.test(vt)||ja(M,Ct)||vt===">"||vt==="<"||vt==="#")break;if(vt===",")break;if(vt==="`"){let Rt=M[Ct+1];if(!Rt){gt.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:Ct,end:Ct+1}}),Ct++;break}we+=Rt,Ct+=2;continue}if(M.startsWith("$(",Ct)){Ct=yt(Ct);continue}if(vt==="'"){mt=!0,Ct++;let Rt=!1;while(Ct<M.length){if(M[Ct]==="'"&&M[Ct+1]==="'"){we+="'",Ct+=2;continue}if(M[Ct]==="'"){Rt=!0,Ct++;break}we+=M[Ct]??"",Ct++}if(!Rt)gt.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:F,end:M.length}});continue}if(vt==='"'){mt=!0;let Rt=Ct++,Et=!1;while(Ct<q){let xt=M[Ct];if(xt==="`"&&M[Ct+1]){we+=M[Ct+1],Ct+=2;continue}if(xt==='"'){Et=!0,Ct++;break}if(M.startsWith("$(",Ct)){Ct=yt(Ct);continue}if(xt==="$")Ke=M[Ct+1]==="("?"command-substitution":"variable";we+=xt??"",Ct++}if(!Et)gt.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:Rt,end:M.length}});continue}if(vt==="$")Ke=M[Ct+1]==="("?"command-substitution":"variable";if(vt==="@"&&Ct===F)Ke="variable";we+=vt,Ct++}return{word:ro(M,F,Ct,we,Ke,mt,Ke==="literal"?void 0:HS(M,F,Ct)),next:Ct,issues:gt,nested:ht,words:St,limited:bt}}function US(M,F,q,te,ne){let we=hd(M,F+2,q),Ke=we===-1?q:we,mt=we===-1?q:we+1;if(ne>=te.maxDepth)return{program:gn({kind:"program",dialect:"powershell",source:M.slice(F+2,Ke),span:{start:F+2,end:Ke},status:"limited",issues:[yd(F,te.maxDepth)],nodes:[]}),next:mt};let gt=Ha(M,F+2,Ke,te,ne+1),ht=we===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:F,end:mt}}]:[];return{program:gn({kind:"program",dialect:"powershell",source:M.slice(F+2,Ke),span:{start:F+2,end:Ke},status:gt.limited?"limited":gt.issues.length+ht.length>0?"partial":"complete",issues:[...gt.issues,...ht],nodes:gt.nodes}),next:mt}}function hd(M,F,q){let te=1,ne=!1,we=!1;for(let Ke=F;Ke<q;Ke++){let mt=M[Ke];if(mt==="`"){Ke++;continue}if(!we&&mt==="'"){if(ne&&M[Ke+1]==="'"){Ke++;continue}ne=!ne;continue}if(!ne&&mt==='"'){we=!we;continue}if(ne)continue;if(M.startsWith("$(",Ke)){te++,Ke++;continue}if(!we&&mt==="(")te++;if(mt!==")")continue;if(te--,te===0)return Ke}return-1}function $a(M){let F=0;for(let q of M.nodes){if(q.kind==="group")F+=$a(q.body);if(q.kind==="command"){F+=q.words.length;for(let te of q.nested)F+=$a(te)}}return F}function HS(M,F,q){let te=zi(M),ne=F,we=!1,Ke=F;while(Ke<q){let mt=M[Ke];if(mt==="`"){Ke+=2;continue}if(mt==="'"){if(we&&M[Ke+1]==="'"){Ke+=2;continue}we=!we,Ke++;continue}if(we){Ke++;continue}if(M.startsWith("$(",Ke)){let gt=hd(M,Ke+2,q),ht=gt===-1?q:gt+1;te.push(ne,Ke,"literal"),te.push(Ke,ht,"command-substitution"),Ke=ht,ne=ht;continue}if(mt==="$"||mt==="@"&&Ke===F){let gt=jS(M,Ke+1,q);te.push(ne,Ke,"literal"),te.push(Ke,gt,"variable"),Ke=gt,ne=gt;continue}Ke++}return te.push(ne,q,"literal"),te.parts}function jS(M,F,q){if(M[F]==="{"){let ne=M.indexOf("}",F+1);return ne===-1||ne>=q?q:ne+1}let te=F;while(te<q&&/[A-Za-z0-9_:?]/.test(M[te]??""))te++;return te}function yd(M,F){return{code:"depth-limit",message:`command structure exceeds parser limit ${F}`,span:{start:M,end:M}}}function VS(M){let F=[],q=[],te=0,ne=0,we=!1,Ke=!1,mt=()=>{if(q.length>0)F.push(q);q=[]};while(te<M.length&&te<131072&&ne<16384){let gt=M[te];if(gt==="\r"||gt===`
-`){mt(),te+=gt==="\r"&&M[te+1]===`
-`?2:1;continue}if(/\s/.test(gt??"")){te++;continue}let ht=Sd(M,te,Math.min(M.length,qi.maxInputLength),qi.maxDepth);if(ht){we||=!!ht.issue||ht.limited,te=ht.next;continue}let St=ja(M,te);if(St){mt(),te+=St.length;continue}if(gt==="{"||gt==="}"){mt(),te++;continue}Ke||=M.startsWith("<<",te);let bt=Ba(M,te,Math.min(M.length,qi.maxInputLength),qi,0);if(bt.word.text)q.push(bt.word.text);for(let yt of bt.nested)F.push(...Ua(yt));ne++,te=bt.next>te?bt.next:te+1}return mt(),{commands:F,invalidComment:we,posixHeredoc:Ke}}function Ua(M){return M.nodes.flatMap((F)=>{if(F.kind==="group")return Ua(F.body);if(F.kind!=="command")return[];return[F.words.map((q)=>q.text),...F.nested.flatMap(Ua)]})}function ja(M,F){for(let q of["&&","||",";","|"])if(M.startsWith(q,F))return q;return null}function Sd(M,F,q,te){if(M[F]==="#"&&M[F+1]!==">"){let Ke=F+1;while(Ke<q&&M[Ke]!=="\r"&&M[Ke]!==`
-`)Ke++;return{next:Ke,limited:!1}}if(!M.startsWith("<#",F))return null;let ne=1,we=F+2;while(we<q){if(M.startsWith("<#",we)){if(ne++,ne>te)return{next:q,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${te}`,span:{start:F,end:we+2}},limited:!0};we+=2;continue}if(M.startsWith("#>",we)){if(ne--,we+=2,ne===0)return{next:we,limited:!1};continue}we++}return{next:q,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:F,end:q}},limited:!1}}function KS(M,F){if(F)return"limited";if(M.some((q)=>q.code==="unclosed-block-comment"))return"invalid";return M.length>0?"partial":"complete"}function za(M,F,q){return Object.freeze({kind:"connector",operator:M.slice(F,q),span:Object.freeze({start:F,end:q})})}var Tr=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function v(M,F="auto",q=Tr){if(F==="powershell"||F==="auto"&&pd(M.slice(0,q.maxInputLength)))return gd(M,q);return rd(M,q)}function t(M){return M.provenance==="command-substitution"?M.raw:M.text}function ee(M,F){return M==="posix"?F:Zt(F.map((q)=>q.text))}function Yi(M,F){return M&&M.provenance!=="unknown"?M.provenance==="literal":!/[$`*?[\]]/.test(F)}function Zt(M){return M.map((F)=>({kind:"word",text:F,raw:F,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Va(M,F){return{value:M,work:F}}function wt(M,F){if(M.work)M.work.units=Math.min(Number.MAX_SAFE_INTEGER,M.work.units+1);return M.value[F]}function Jt(M){return M.value.length}function Lo(M,F,q=1){if(M)M.units=Math.min(Number.MAX_SAFE_INTEGER,M.units+F.length*q)}function Rn(M,F){Lo(M,F)}function Ir(M){if(!M)return!1;let F=M.charCodeAt(0);return F>=48&&F<=57||F>=65&&F<=90||F===95||F>=97&&F<=122}function Kt(M){if(!M)return!1;let F=M.charCodeAt(0);return F===9||F===10||F===11||F===12||F===13||F===32||F===160||F===65279||F===5760||F>=8192&&F<=8202||F===8232||F===8233||F===8239||F===8287||F===12288}function Ka(M){return M===`
-`||M==="\r"||M==="\u2028"||M==="\u2029"}function qt(M,F,q){if(F+q.length>Jt(M))return!1;for(let te=0;te<q.length;te++)if(wt(M,F+te)!==q[te])return!1;return!0}function Yn(M,F,q){return!Ir(wt(M,F-1))&&qt(M,F,q)&&!Ir(wt(M,F+q.length))}function Zn(M,F){return Ir(wt(M,F-1))!==Ir(wt(M,F))}function sn(M){return M===`
-`||M===";"||M==="&"||M==="|"}function io(M){return M==="|"||M===";"}function Zi(M,F,q){let te=Va(M,q);if(F==="rm")return qS(te);if(F==="dd")return ZS(te);return xd(te,!0)}function Xi(M,F,q){let te=Va(M,q);if(F==="rm")return XS(te);if(F==="reset-hard")return Ed(te,"--ha","rd");if(F==="reset-merge")return Ed(te,"--me","rge");if(F==="clean")return tb(te);if(F==="checkout")return rb(te);if(F==="push-force")return ob(te);if(F==="push-refspec")return ib(te);if(F==="push-delete")return sb(te);if(F==="branch")return ab(te);if(F==="tag")return ub(te);if(F==="restore")return db(te);return xd(te,!1)}function qS(M){let F=!1,q=!1,te=!1,ne=-1;for(let we=0;we<=Jt(M);we++){let Ke=wt(M,we);if(!F){let gt=wt(M,we+2);if(Yn(M,we,"rm")&&Kt(gt)&&gt!==`
-`)F=!0,we++;continue}let mt=YS(M,we);if(Ke===`
-`||mt!==-1){if(F=!1,q=!1,te=!1,ne=-1,mt!==-1)we=mt-1;continue}if(Ke===";"||Ke==="&"||Ke==="|"||we===Jt(M)){if(ne>=0){let gt=bd(M,ne,we);q||=gt.recursive,te||=gt.force}if(q&&te)return!0;F=!1,q=!1,te=!1,ne=-1;continue}if(Kt(Ke)){if(ne<0)continue;if(qt(M,ne,"--")&&we-ne===2){F=!1,q=!1,te=!1,ne=-1;continue}let gt=bd(M,ne,we);if(q||=gt.recursive,te||=gt.force,q&&te)return!0;ne=-1;continue}if(ne<0)ne=we}return!1}function YS(M,F){if(wt(M,F)!=="\\"||wt(M,F-1)==="\\")return-1;if(qt(M,F,String.raw`\n`))return F+2;if(qt(M,F,String.raw`\x0a`)||qt(M,F,String.raw`\x0A`))return F+5;if(qt(M,F,String.raw`\u000a`)||qt(M,F,String.raw`\u000A`))return F+7;return qt(M,F,String.raw`\012`)?F+4:-1}function bd(M,F,q){if(Cd(M,F,q,"recursive"))return{recursive:!0,force:!1};if(Cd(M,F,q,"force"))return{recursive:!1,force:!0};if(wt(M,F)!=="-"||wt(M,F+1)==="-")return{recursive:!1,force:!1};let te=!1,ne=!1;for(let we=F+1;we<q;we++){let Ke=wt(M,we);te||=Ke==="r"||Ke==="R",ne||=Ke==="f"||Ke==="F"}return{recursive:te,force:ne}}function Cd(M,F,q,te){let ne=q-F-2;if(ne<1||ne>te.length||!qt(M,F,"--"))return!1;for(let we=0;we<ne;we++)if(wt(M,F+we+2)!==te[we])return!1;return!0}function ZS(M){let F=!1;for(let q=0;q<Jt(M);q++){if(sn(wt(M,q))){F=!1;continue}if(Yn(M,q,"dd")){F=!0,q++;continue}if(!F||!Yn(M,q,"of")||!qt(M,q,"of=/dev/"))continue;let te=q+8;if(te<Jt(M)&&!Kt(wt(M,te))&&wt(M,te)!=="'"&&wt(M,te)!=='"')return!0}return!1}function XS(M){let F=!1,q=!1,te=!1;for(let ne=0;ne<=Jt(M);){let we=wt(M,ne);if(ne===Jt(M)||sn(we)){F=!1,q=!1,te=!1,ne++;continue}let Ke=QS(M,ne);if(Ke>=0){if(JS(M,Ke))return!0;let mt=Ke,gt=!1;while(Kt(wt(M,mt)))gt||=wt(M,mt)===`
-`,mt++;if(gt)q=!1,te=!1;F=!0,ne=mt;continue}if(!F){ne++;continue}if(qt(M,ne,"--")&&(ne===0||Kt(wt(M,ne-1)))&&(!wt(M,ne+2)||Kt(wt(M,ne+2))||sn(wt(M,ne+2)))){F=!1,q=!1,te=!1,ne+=2;continue}if(q||=qt(M,ne,"--recursive")&&Zn(M,ne+11)||qa(M,ne,"recursive"),te||=qt(M,ne,"--force")&&Zn(M,ne+7)||qa(M,ne,"force"),q&&te)return!0;ne++}return!1}function qa(M,F,q){if(!qt(M,F,"--"))return!1;let te=0;while(te<=q.length){let ne=wt(M,F+te+2);if(!ne||Kt(ne)||sn(ne))break;if(ne!==q[te])return!1;te++}return te>0&&Zn(M,F+te+2)}function JS(M,F){let q=F,te=!1,ne=!1;while(q<Jt(M)){while(Kt(wt(M,q)))q++;let we=q;while(q<Jt(M)&&!Kt(wt(M,q)))q++;if(wt(M,we)!=="-"||q-we===2&&qt(M,we,"--"))return!1;let Ke=vd(M,we,"recursive"),mt=vd(M,we,"force");if(te&&mt||ne&&Ke)return!0;if(te||=Ke,ne||=mt,wt(M,we+1)==="-")continue;let gt=eb(M,we,q);if(gt.combined||te&&gt.forceAtBoundary||ne&&gt.recursiveAtBoundary)return!0;te||=gt.recursive,ne||=gt.force}return!1}function vd(M,F,q){return qt(M,F,`--${q}`)&&Zn(M,F+q.length+2)||qa(M,F,q)}function QS(M,F){if(F>0&&Ir(wt(M,F-1)))return-1;let q=F;if(wt(M,q)==="\\")q++;if(wt(M,q)!=="r")return-1;if(q++,wt(M,q)==="\\")q++;if(wt(M,q)!=="m"||!Kt(wt(M,q+1)))return-1;return q+1}function eb(M,F,q){let te=!1,ne=!1,we=!1,Ke=!1,mt=!1;if(wt(M,F)!=="-")return{recursive:te,force:ne,recursiveAtBoundary:we,forceAtBoundary:Ke,combined:mt};let gt="";for(let ht=F+1;ht<q;ht++){let St=wt(M,ht)??"",bt=(St==="r"||St==="f")&&Zn(M,ht+1);te||=St==="r",ne||=St==="f",we||=St==="r"&&bt,Ke||=St==="f"&&bt,mt||=(gt==="r"&&St==="f"||gt==="f"&&St==="r")&&bt,gt=St}return{recursive:te,force:ne,recursiveAtBoundary:we,forceAtBoundary:Ke,combined:mt}}function Ed(M,F,q){return Fo(M,"reset",io,!0,(te)=>wt(M,te)==="-"&&so(M,te,F,q)?!0:te)}function tb(M){return Fo(M,"clean",io,!0,(F)=>{if(wt(M,F)!=="-")return F;if(so(M,F,"--fo","rce"))return!0;let q=Wo(M,F,io);for(let te=F+1;te<q;te++)if(wt(M,te)==="f")return!0;return q-1})}function Ji(M,F,q){if(!Yn(M,F,"git"))return null;let te=F+3;if(!Kt(wt(M,te)))return{commandEnd:-1,next:te};while(Kt(wt(M,te)))te++;while(te<Jt(M)){if(sn(wt(M,te)))return{commandEnd:-1,next:te};let ne=Wo(M,te,sn);if(Yn(M,te,q))return{commandEnd:te+q.length,next:ne};if(wt(M,te)!=="-")return{commandEnd:-1,next:ne};let we=ne-te===2&&qt(M,te,"--"),Ke=nb(M,te,ne);te=ne;while(Kt(wt(M,te)))te++;if(we)return{commandEnd:Yn(M,te,q)?te+q.length:-1,next:Wo(M,te,sn)};if(!Ke)continue;if(te>=Jt(M)||sn(wt(M,te)))return{commandEnd:-1,next:te};te=Wo(M,te,sn);while(Kt(wt(M,te)))te++}return{commandEnd:-1,next:te}}function nb(M,F,q){for(let te of un)if(q-F===te.length&&qt(M,F,te))return!0;return!1}function rb(M){return Rd(M,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function ob(M){return Fo(M,"push",io,!0,(F)=>{if(wt(M,F)!=="-")return F;if(wt(M,F+1)==="f"&&!Ir(wt(M,F+2))&&!qt(M,F+2,"-with-lease"))return!0;let q=_d(M,F,"--fo","rce");if(q>=0&&!qt(M,q,"-with-lease"))return!0;return F})}function ib(M){return Fo(M,"push",sn,!1,(F)=>{if(Kt(wt(M,F))&&wt(M,F+1)==="+"&&F+2<Jt(M)&&!sn(wt(M,F+2))&&!Kt(wt(M,F+2)))return!0;if(wt(M,F)===":"&&wt(M,F+1)==="+")return!0;return F})}function sb(M){return Fo(M,"push",sn,!1,(F)=>{if(wt(M,F)==="-"&&so(M,F,"--de","lete"))return!0;if(Kt(wt(M,F))&&wt(M,F+1)===":"&&F+2<Jt(M)&&!Kt(wt(M,F+2))&&!sn(wt(M,F+2)))return!0;return F})}function ab(M){let F=!1,q=!1,te=!1;for(let ne=0;ne<=Jt(M);ne++){if(ne===Jt(M)||sn(wt(M,ne))){if(q&&te)return!0;F=!1,q=!1,te=!1;continue}if(!F){let mt=Ji(M,ne,"branch");if(mt){F=mt.commandEnd>=0,ne=Math.max(ne,(F?mt.commandEnd:mt.next)-1);continue}}if(!F||wt(M,ne)!=="-")continue;let we=Wo(M,ne,sn),Ke=lb(M,ne,we);if(q||=Ke.deletion,te||=Ke.force,q&&te)return!0;ne=we-1}return!1}function lb(M,F,q){let te=!1,ne=!1;for(let we=F;we<q;we++){if(wt(M,we)!=="-")continue;if(so(M,we,"--de","lete"))te=!0;if(so(M,we,"--fo","rce"))ne=!0;if(wt(M,we+1)==="-")continue;let Ke=we+1,mt=!1,gt=!1,ht=!1;while(Ke<q&&cb(wt(M,Ke))){let St=wt(M,Ke);mt||=St==="d"||St==="D",gt||=St==="f",ht||=St==="D",Ke++}if(!Zn(M,Ke))continue;te||=mt,ne||=gt||ht}return{deletion:te,force:ne}}function cb(M){if(!M)return!1;let F=M.charCodeAt(0);return F>=65&&F<=90||F>=97&&F<=122}function ub(M){return Rd(M,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Rd(M,F){let q=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let te=0;te<Jt(M);te++){let ne=wt(M,te),we=q[q.length-1];if(!we)return!1;let Ke=we.escaped;if(we.escaped=!Ke&&we.quote!=="'"&&ne==="\\",!Ke&&ne==="'"&&we.quote!=='"')we.quote=we.quote==="'"?"":"'";if(!Ke&&ne==='"'&&we.quote!=="'")we.quote=we.quote==='"'?"":'"';if(ne==="$"&&wt(M,te+1)==="("&&(q.length===1||!Ke&&we.quote!=="'")){q.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),te++;continue}if(!Ke&&!we.quote&&q.length>1&&ne==="("){we.depth++;continue}if(!Ke&&!we.quote&&q.length>1&&ne===")"){if(we.depth--,we.depth===0)q.pop();continue}if(Kt(ne))we.shortActive=!1,we.hasShortFlag=!1;if(!we.outerActive){let mt=Ji(M,te,F.command);if(mt){we.outerActive=mt.commandEnd>=0&&Kt(wt(M,mt.commandEnd)),we.shortActive=!1,we.hasShortFlag=!1,te=Math.max(te,(we.outerActive?mt.commandEnd:mt.next)-1);continue}}if(we.outerActive&&ne==="-"){if(so(M,te,F.longPrefix,F.longOptional))return!0;we.shortActive||=!F.excludedShortStarts.includes(wt(M,te+1)??"")}if(we.hasShortFlag||=we.shortActive&&ne===F.shortFlag,we.hasShortFlag&&Zn(M,te+1))return!0;if(io(ne))we.outerActive=!1}return!1}function Fo(M,F,q,te,ne){let we=!1;for(let Ke=0;Ke<Jt(M);Ke++){let mt=wt(M,Ke),gt=q(mt);if(!we&&!gt){let ht=Ji(M,Ke,F);if(ht){we=ht.commandEnd>=0&&(!te||Kt(wt(M,ht.commandEnd))),Ke=Math.max(Ke,(we?ht.commandEnd:ht.next)-1);continue}}if(we){let ht=ne(Ke);if(ht===!0)return!0;for(let St=Ke;St<=ht;St++)if(q(wt(M,St)))we=!1;Ke=ht}if(gt)we=!1}return!1}function db(M){let F=!1;for(let q=0;q<Jt(M);q++){if(Ka(wt(M,q))){if(F)return!0;F=!1;continue}if(!F){let te=Ji(M,q,"restore");if(te){F=te.commandEnd>=0,q=Math.max(q,(F?te.commandEnd:te.next)-1);continue}}if(F&&wt(M,q)==="-"&&wt(M,q+1)==="-"&&(qt(M,q+2,"staged")||qt(M,q+2,"help")))F=!1}return F}function xd(M,F){let q=!1;for(let te=0;te<Jt(M);te++){let ne=wt(M,te),we=F?Ka(ne):sn(ne);if(q&&Kt(ne)&&wt(M,te+1)==="-"&&Yn(M,te+2,"delete"))return!0;if(we){q=!1;continue}if(Yn(M,te,"find"))q=!0,te+=3}return!1}function Wo(M,F,q){let te=F;while(te<Jt(M)&&!Kt(wt(M,te))&&!q(wt(M,te)))te++;return te}function _d(M,F,q,te){if(!qt(M,F,q))return-1;let ne=F+q.length;for(let we=0;we<te.length&&wt(M,ne)===te[we];we++)ne++;return Zn(M,ne)?ne:-1}function so(M,F,q,te){return _d(M,F,q,te)>=0}function Xn(M,F){Lo(F,M,2);let q=M.toLowerCase(),te=q.trimStart(),ne=te.startsWith("echo ")||te.startsWith("rg "),we=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let Ke of we){if(Ke.skipForEchoRg&&ne)continue;let mt=Ke.caseSensitive?M:q;if(Ke.regex)Rn(F,mt);if((Ke.regex?.test(mt)??!1)||Ke.scan&&Xi(mt,Ke.scan,F))return _t("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${Ke.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var fb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pd(M,F,q){let te=M.words[0];if(!F||!te||M.words.length!==1||M.dialect!=="posix")return!1;if(!te.quoted||te.provenance!=="literal")return!1;let ne=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(te.text)?.[1];if(!ne)return!1;Lo(q,F.source,2);let we={anchored:new RegExp(`^\\$\\{?${ne}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${ne}(?![A-Za-z0-9_])`)};return Ad(F.nodes,te,we)}function Ad(M,F,q){return M.every((te)=>{if(te.kind==="connector")return!0;if(te.kind==="group"||te.kind==="function")return Ad(te.body.nodes,F,q);if(te.kind==="unknown")return!q.loose.test(te.source);return mb(te,F,q)})}function mb(M,F,q){if(M.nested.some((ne)=>q.loose.test(ne.source)))return!1;let te=M.words.findIndex((ne)=>!fb.test(ne.text));return M.words.every((ne,we)=>ne===F||wd(ne.raw,q.anchored,we!==te))&&M.redirections.every((ne)=>(!ne.heredoc||ne.heredoc.quotedDelimiter||!q.loose.test(ne.heredoc.body))&&(!ne.target||wd(ne.target.raw,q.anchored,!0)))}function wd(M,F,q){let te=!1,ne=!1;for(let we=0;we<M.length;we++){let Ke=M[we];if(Ke==="\\"&&!te){we++;continue}if(!ne&&Ke==="'"){te=!te;continue}if(!te&&Ke==='"'){ne=!ne;continue}if(te||Ke!=="$")continue;if(!F.test(M.slice(we)))continue;if(!ne||!q)return!1}return!0}import{isAbsolute as pb,resolve as Td}from"node:path";function Go(M,F,q,te){let ne=pb(M)?Td(M):F?Td(F,M):void 0;if(!ne)return;try{return Ht(ne,q,te)}catch{return ne}}function Id(M){return!["/dev","/proc","/sys"].some((F)=>M===F||M.startsWith(`${F}/`))}var ao="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",zo="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ya=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),gb=new Set(["-p","--print"]),hb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),yb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),Sb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),bb=new Map([["python",new Set(["m"])]]),Cb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),vb=new Set(["always","default","never"]),Eb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Rb=/\\\r?\n/g,xb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Od(M){return es(M).code}function Qi(M){return es(M).sources}function Md(M){return xb.get(Xa(M))??[]}function es(M){let F=Xa(M[0]??"");if(!Ya.has(F))return{code:null,sources:[],optionsOpen:!1};let q=[],te=[],ne=!0;for(let we=1;we<M.length;we++){let Ke=M[we];if(Ke===void 0)break;if(Ke==="--")return Nn(F,q,te,ne,M[we+1]===void 0?void 0:we+1,M[we+1]);if(Ke===""||Ke==="-"||!Ke.startsWith("-"))return Nn(F,q,te,ne,we,Ke);if(F==="node"&&gb.has(Ke)){let bt=M[we+1];if(bt===void 0)return Nn(F,q,te,ne);if(bt.startsWith("-"))continue;q.push({tokenIndex:we+1,value:bt}),te.push({tokenIndex:we+1,kind:"inline-code",value:bt}),we++;continue}if(wb(F,Ke)){let bt=M[we+1];if(bt===void 0)return Nn(F,q,te,ne);if(q.push({tokenIndex:we+1,value:bt}),te.push({tokenIndex:we+1,kind:"inline-code",value:bt}),F==="python")return Nn(F,q,te,ne);we++;continue}let mt=/^--eval=(.*)$/s.exec(Ke);if(Pb(F)&&mt){let bt=mt[1]??"";q.push({tokenIndex:we,value:bt}),te.push({tokenIndex:we,kind:"inline-code",value:bt});continue}if(F==="node"){let bt=_b(Ke);if(bt){if(bt.attached){if(ne&&=bt.value!=="",bt.value!=="")te.push({tokenIndex:we,kind:"module-file",value:bt.value});continue}let yt=M[we+1];if(yt===void 0||yt.startsWith("-"))return ne=!1,Nn(F,q,te,ne);te.push({tokenIndex:we+1,kind:"module-file",value:yt}),we++;continue}}if(F==="python"&&Ke.startsWith("--check-hash-based-pycs=")||F==="node"&&(Ke==="--conditions="||Ke==="--diagnostic-dir="||Ke==="--title=")||F==="ruby"&&(Ke==="--disable="||Ke==="--enable="))return Nn(F,q,te,ne);if(Cb.get(F)?.has(Ke)){let bt=M[we+1];if(bt===void 0||bt.startsWith("-")&&!(F==="ruby"&&Eb.has(Ke))||F==="python"&&!vb.has(bt))return Nn(F,q,te,ne);we++;continue}if(Ke.startsWith("--"))continue;let gt,ht=!1;for(let bt=1;bt<Ke.length;bt++){let yt=Ke[bt];if(yt===void 0)break;if(bb.get(F)?.has(yt)){let Ct=Ke.slice(bt+1),vt=Ct||M[we+1];if(vt!==void 0)te.push({tokenIndex:Ct?we:we+1,kind:"module-file",value:vt});return Nn(F,q,te,ne)}if(hb.get(F)?.has(yt)){gt=Ke.slice(bt+1)||M[we+1],ht=bt+1===Ke.length;break}if(F==="node"&&yt==="r"){if(ne&&=Ke==="-r",Ke==="-r"){let Ct=M[we+1];if(ne&&=Ct!==void 0&&!Ct.startsWith("-"),ne&&Ct!==void 0)te.push({tokenIndex:we+1,kind:"module-file",value:Ct});we++}break}if(F==="ruby"&&yt==="r"){let Ct=Ke.slice(bt+1),vt=Ct||M[we+1];if(ne&&=vt!==void 0,vt!==void 0)te.push({tokenIndex:Ct?we:we+1,kind:"module-file",value:vt});if(!Ct)we++;break}if(F==="perl"&&(yt==="M"||yt==="m")){let Ct=Ke.slice(bt+1);if(!Ct){if(ne=!1,bt+1===Ke.length)we++;break}te.push({tokenIndex:we,kind:"module-file",value:Ct});break}if(yb.get(F)?.has(yt)){if(bt+1===Ke.length)we++;break}if(Sb.get(F)?.has(yt)&&bt+1<Ke.length)break}if(gt===void 0)continue;let St=ht?we+1:we;if(q.push({tokenIndex:St,value:gt}),te.push({tokenIndex:St,kind:"inline-code",value:gt}),F==="python")return Nn(F,q,te,ne);if(ht)we++}return Nn(F,q,te,ne,void 0,void 0,!0)}function Nn(M,F,q,te,ne,we,Ke=!1){let mt=M==="node"?F.slice(-1):F,gt=new Set(mt.map((St)=>St.tokenIndex)),ht=q.filter((St)=>St.kind!=="inline-code"||gt.has(St.tokenIndex));if(te&&F.length===0&&ne!==void 0&&we!==void 0)ht.push({tokenIndex:ne,kind:"main-script",value:we});return{code:(M==="node"?mt[0]?.value:mt.map((St)=>St.value).join(`
-`))||null,sources:te?ht:[],optionsOpen:te&&Ke}}function _b(M){for(let F of["--import","--loader","--experimental-loader","--require"]){if(M===F)return{attached:!1,value:""};if(M.startsWith(`${F}=`))return{attached:!0,value:M.slice(F.length+1)}}return}function Za(M,F){return Xa(M)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(F)}function Xa(M){let F=Nt(M).toLowerCase();return Pi.test(F)?"python":F}function wb(M,F){return Ya.get(M)?.has(F)??!1}function Pb(M){return Ya.get(M)?.has("--eval")??!1}function Bo(M,F){let q=Ib(M,F);if(!kd(q,F))return!1;Rn(F,q);let te=Tb(q);if(kd(te,F))return!0;return Rn(F,te),Ab.test(te)}var Ab=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Tb(M){let F=[],q=0,te=0;while(te<M.length){let ne=M[te];if(ne!=="'"&&ne!=='"'){te++;continue}let we=M.startsWith(ne.repeat(3),te)?ne.repeat(3):ne,Ke=te+we.length;while(Ke<M.length&&!M.startsWith(we,Ke))Ke+=M[Ke]==="\\"?2:1;if(Ke>=M.length)break;F.push(M.slice(q,te)," "),te=Ke+we.length,q=te}return F.push(M.slice(q)),F.join("")}function kd(M,F){if(Zi(M,"rm",F))return!0;for(let te of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Rn(F,M),te.test(M))return!0;if(Zi(M,"dd",F))return!0;for(let te of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Rn(F,M),te.test(M))return!0;if(Zi(M,"find",F))return!0;let q=M.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((te)=>(Rn(F,M),q.some((ne)=>Xi(ne,te))))}function Ib(M,F){return Rn(F,M),M.replace(Rb,"")}import{isAbsolute as of,relative as sf}from"node:path";import{isAbsolute as Fd,parse as zb}from"node:path";import{dirname as kb,isAbsolute as Ob,parse as Mb,sep as Db}from"node:path";function lr(M,F,q){if(sr(F))throw Error("Unsupported Windows namespace path");let te=Ob(F)?Mb(F).root:"",ne=te||M;for(let we of Lb(te?F.slice(te.length):F)){if(we===""||we===".")continue;if(we===".."){ne=kb(ne);continue}let Ke=Nb(ne,we),mt=q.entryKind(Ke),gt=mt==="symlink"?q.realpath(Ke):Ke;if(mt==="missing"||gt===null)throw Error(`Cannot resolve path component: ${Ke}`);ne=gt}return ne}function Nb(M,F){return M.endsWith("/")||M.endsWith("\\")?`${M}${F}`:`${M}${Db}${F}`}function Lb(M){let F=process.platform==="win32"?/[\\/]+/:/\/+/;return M.split(F)}var Ja=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Wb=new Set(Ja),Fb=1024,Dd=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ts=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Gb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function ns(M){return Wb.has(M)}function Qa(M){return ns(M)||Dd.has(M)||ts.has(M)||Eo(M)}function Tn(M,F,q){return q?.has(M)?q.get(M):F.get(M)}function rs(M,F){let q=Tn("GIT_CONFIG_COUNT",M,F);if(q===void 0)return{state:"absent"};if(q==="")return{state:"valid",count:0};if(!/^\d+$/.test(q))return{state:"invalid"};let te=Number(q);return Number.isSafeInteger(te)&&te<=Fb?{state:"valid",count:te}:{state:"invalid"}}function os(M,F,q){let ne=M.match(Gb)?.[1];if(!ne||!Qa(ne))return null;let we=M.indexOf("=");return{name:ne,value:`${Tn(ne,F,q)??""}${M.slice(we+1)}`}}function Nd(M){return Wd(M,ts)}function Ld(M){return Wd(M,Dd)}function Wd(M,F){if(!M)return!1;for(let q of M.keys())if(F.has(q))return!0;return!1}var zd=/^[A-Za-z_][A-Za-z0-9_]*=/;function In(M){if(!zd.test(M))return null;let F=M.indexOf("=");return{name:M.slice(0,F),value:M.slice(F+1)}}function be(M){let F=new Map,q=0;while(q<M.length){let te=M[q];if(!te)break;let ne=In(t(te));if(!ne)break;F.set(ne.name,ne.value),q++}return{words:M.slice(q),envAssignments:F}}function Bd(M){let F=M.toLowerCase();return M.includes("=")||F==="sudo"||F==="env"||F==="command"||F==="builtin"}function kr(M,F,q,te){if(!Bd(lo(M)))return{words:M,envAssignments:new Map,cwd:q,rewritten:!1};let ne=new Set(M),we=M,Ke=new Map,mt=new Map(te??[]),gt=[],ht=q;for(let bt=0;bt<n.wrapperPeelIterations.cap;bt++){let yt=Gd(we),Ct=be(we);for(let[Rt,Et]of Ct.envAssignments)Ke.set(Rt,Et),mt.set(Rt,Et);if(we=Ct.words,we.length===0)break;while(we.length>0&&lo(we).includes("=")&&!$b(we)){let Rt=Ub(lo(we),mt,F.env)??os(lo(we),F.env,mt);if(Rt)Ke.set(Rt.name,Rt.value),mt.set(Rt.name,Rt.value);we=we.slice(1)}if(we.length===0)break;let vt=lo(we).toLowerCase();if(vt!=="sudo"&&vt!=="env"&&vt!=="command"&&vt!=="builtin")break;if(vt==="sudo"){let Rt=jb(we,F.paths,ht);if(we=Rt.words,Rt.cwd!==void 0)ht=Rt.cwd}if(vt==="env"){let Rt=qb(we,ht,mt,F);if(gt.push(...Rt.envSplitValues??[]),we=Rt.words,Rt.cwd!==void 0)ht=Rt.cwd;for(let[Et,xt]of Rt.envAssignments)Ke.set(Et,xt),mt.set(Et,xt)}if(vt==="command")we=Yb(we);if(vt==="builtin")we=we.slice(Ln(we,1)==="--"?2:1);if(Gd(we)===yt)break}let St=be(we);for(let[bt,yt]of St.envAssignments)Ke.set(bt,yt),mt.set(bt,yt);return{words:St.words,envAssignments:Ke,cwd:ht,envSplitValues:gt.length>0?gt:void 0,rewritten:Bb(St.words,ne)}}function Bb(M,F){return M.some((q)=>!F.has(q))}function Gd(M){return M.map(t).join(" ")}function lo(M){let F=M[0];return F?t(F):""}function Ln(M,F){let q=M[F];return q?t(q):void 0}function $b(M){return zd.test(lo(M))}function Ub(M,F,q){if(!M.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${F.get("TMPDIR")??q.get("TMPDIR")??""}${M.slice(8)}`}}var Hb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function jb(M,F,q){let te=1,ne=q;while(te<M.length){let we=Ln(M,te);if(!we)break;if(we==="--")return{words:M.slice(te+1),cwd:ne};if(!we.startsWith("-"))break;if(we==="-D"||we==="--chdir"){let Ke=Ln(M,te+1);ne=Ke?$o(ne,Ke,F):null,te+=2;continue}if(we.startsWith("--chdir=")){ne=$o(ne,we.slice(8),F),te++;continue}if(we.startsWith("-D")&&we.length>2){ne=$o(ne,we.slice(2),F),te++;continue}if(we==="-i"||we==="--login"){ne=null,te++;continue}if(Hb.has(we)){te+=2;continue}te++}return{words:M.slice(te),cwd:ne}}var Vb=new Set(["-i","-0","--null"]),Kb=new Set(["-u","--unset","-C","--chdir","-P"]);function qb(M,F,q,te){let ne=new Map,we=[],Ke=F,mt=1,gt=(ht)=>({words:M.slice(ht),envAssignments:ne,cwd:Ke,envSplitValues:we.length>0?we:void 0});while(mt<M.length){let ht=Ln(M,mt);if(!ht)break;if(ht==="--")return gt(mt+1);if(ht==="-i"||ht==="--ignore-environment"||ht==="-"){ne.clear();for(let bt of q.keys())ne.set(bt,"");ne.set("TMPDIR",""),mt++;continue}if(Vb.has(ht)){mt++;continue}if(ht==="-u"||ht==="--unset"){let bt=Ln(M,mt+1);if(bt!==void 0)ne.set(bt,"");mt+=2;continue}if(ht.startsWith("-u")&&ht.length>2&&!ht.startsWith("-u=")){ne.set(ht.slice(2),""),mt++;continue}if(ht.startsWith("--unset=")){ne.set(ht.slice(8),""),mt++;continue}let St=ht==="-S"||ht==="--split-string"?{value:Ln(M,mt+1),consumed:2}:ht.startsWith("-S")&&ht.length>2?{value:ht.slice(2),consumed:1}:ht.startsWith("--split-string=")?{value:ht.slice(15),consumed:1}:null;if(St){if(St.value!==void 0)we.push(St.value);return Ke=null,gt(mt+St.consumed)}if(Kb.has(ht)){if(ht==="-C"||ht==="--chdir"){let bt=Ln(M,mt+1);Ke=bt?$o(Ke,bt,te.paths):null}mt+=2;continue}if(ht.startsWith("-u=")){mt++;continue}if(ht.startsWith("-C")&&ht.length>2||ht.startsWith("--chdir=")){let bt=ht.startsWith("--chdir=")?ht.slice(8):ht.startsWith("-C=")?ht.slice(3):ht.slice(2);Ke=$o(Ke,bt,te.paths),mt++;continue}if(ht.startsWith("-P")){mt++;continue}if(ht.startsWith("-")){mt++;continue}if(!In(ht))break;while(mt<M.length){let bt=In(Ln(M,mt)??"");if(!bt)break;ne.set(bt.name,bt.value),mt++}if(Ln(M,mt)==="--")mt++;return gt(mt)}return gt(mt)}function $o(M,F,q){if(F==="")return null;if(!M&&!Fd(F))return null;let te=Fd(F)?zb(F).root:q.realpath(M??"/");if(te===null)return null;try{return lr(te,F,q)}catch{return null}}function Yb(M){if(Ln(M,1)==="-v")return[...Zt(["type"]),...M.slice(2)];let F=1;while(F<M.length){let q=Ln(M,F);if(!q)break;if(q==="-p"||q==="-v"||q==="-V"){F++;continue}if(q==="--")return M.slice(F+1);if(q.startsWith("-")&&!q.startsWith("--")&&q.length>1){if(!/^[pvV]+$/.test(q.slice(1)))break;F++;continue}break}return M.slice(F)}var Zb=/['"\\$`{}#]/;function is(M,F){if(M.some((te)=>Zb.test(te)))return null;let q=[...M.flatMap((te)=>te.split(/\s+/).filter((ne)=>ne.length>0)),...F];return q.length<=64?q:null}function cr(M,F,q){return ss(M,F,q).tokens}function Xb(M){let F=[],q="",te=0;while(te<M.length){let ne=M.charAt(te);if(ne==='"'||ne==="'"){let we=M.indexOf(ne,te+1);if(we===-1)return M.split(/\s+/).map((Ke)=>Ke.replace(/["']/g,"")).filter((Ke)=>Ke.length>0);q+=M.slice(te+1,we),te=we+1;continue}if(/\s/.test(ne)){if(q.length>0)F.push(q);q="",te++;continue}q+=ne,te++}if(q.length>0)F.push(q);return F}function ur(M,F,q,te=0){let ne=ss(M,F,q),we=(ne.envSplitValues??[]).flatMap(Xb);if(we.length===0)return ne.tokens;let Ke=[...we,...ne.tokens];if(te>=8)return Ke;return ur(Ke,F,q,te+1)}function ss(M,F,q,te){if(!Bd(M[0]??""))return{tokens:[...M],envAssignments:new Map,cwd:q};let ne=kr(Zt(M),F,q,te);return{tokens:ne.words.map(t),envAssignments:ne.envAssignments,cwd:ne.cwd,envSplitValues:ne.envSplitValues}}var rl=Symbol("adopt-as-operand"),Jb=new Set(["env","sudo","command","builtin"]),Qb=new Set(["&&","||","|&","|","&",";"]),eC=new Set(["<<","<<<",">|"]),tC=new Set(["|","|&"]),nC=/[*@#?$!_-]/,rC=/^\w+(?::\w+)*/,oC=Object.freeze([]),Uo=Object.freeze({kind:"scope",edge:"enter"}),Ho=Object.freeze({kind:"scope",edge:"exit"}),iC=Object.freeze([]),sC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),jo=new Set(["bash","sh","zsh","dash","ksh"]),aC=256,Vd=new WeakMap;function Kd(M,F){let q=F.status==="complete"?new Set(nl(F)):new Set,te=uC(M,q);if(Ti(te))return as("unclosed-quote",te,F);let ne={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},we=Or(F,{source:te,suppressed:q,flags:ne,depth:0,functions:new Map,powershell:F.dialect==="powershell"});if(ne.limited)return as("structural-limit",te,F);if(ne.invalid)return as("invalid",te,F);let Ke=as("complete",te,F,ne.assignmentFallbacks);return Vd.set(Ke,Object.freeze(we)),Ke}function cs(M,F,q,te,ne){let we={cwd:F,variables:new Map,previous:null},Ke=[],mt=new Set,gt=null,ht=[];for(let St of qd(M)){if(St.kind==="scope"){if(St.edge==="enter"){ht.push({state:we,segment:[...Ke],shellWords:new Set(mt),pipeProducer:gt});continue}let bt=ne.segment(Ke,we,gt,null,mt);if(bt)return bt;let yt=ht.pop();if(yt===void 0)throw Error("scope exit without a matching enter");we=yt.state,Ke=yt.segment,mt=yt.shellWords,gt=yt.pipeProducer;continue}if(St.kind==="operator"){if(!St.boundary)continue;let bt=ne.segment(Ke,we,gt,St.operator,mt);if(bt)return bt;we=lC(Ke,we,q,te),gt=Ke.length>0&&tC.has(St.operator)?Ke:null,Ke=[],mt=new Set;continue}if(St.kind==="redirection"){if(St.fd!==void 0)mt.add(Ke.length-1);if(St.target===void 0)continue;let bt=ne.redirection({operator:St.operator,role:St.role,targetOrder:St.targetOrder,target:St.target,...St.body===void 0?{}:{body:St.body,consumer:St.consumer}},we);if(bt===rl){mt.add(Ke.length),Ke.push(ne.word(St.target));continue}if(bt)return bt;continue}Ke.push(ne.word(St.text))}return ne.segment(Ke,we,gt,null,mt)}function us(M){return qd(M).flatMap((F)=>{if(F.kind==="word")return[{kind:"word",text:F.text}];if(F.kind==="operator")return[{kind:"operator",boundary:F.boundary}];if(F.kind==="redirection")return[{kind:"redirection",target:F.target}];return[]})}function hn(M,F){return M.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(q,te,ne,we)=>{let Ke=F.get(te);if(Ke===void 0)return q;let mt=ne.startsWith(":")?Ke!=="":!0;if(ne.endsWith("-"))return mt?Ke:hn(we,F);return mt?hn(we,F):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(q,te)=>F.get(te)??q).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(q,te)=>F.get(te)??q)}function Vo(M){return M.length>0&&M.every((F)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(F))}function lC(M,F,q,te){let ne=Vo(M)?new Map([...F.variables,...cC(M,F.variables)]):F.variables,we=cr([...M],q),Ke=Nt(we[0]??"").toLowerCase()==="cd"?we[1]:void 0;if(!Ke)return{...F,variables:ne};if(Ke==="-"){if(F.previous===null)return{...F,variables:ne};return{cwd:F.previous,variables:ne,previous:F.cwd}}return{cwd:ln(hn(Ke,ne),F.cwd,q,te),variables:ne,previous:F.cwd}}function cC(M,F){return M.flatMap((q)=>{let te=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(q),ne=te?.[2]?.startsWith("=")?te[2].slice(1):void 0;return te?.[1]!==void 0&&ne!==void 0?[[te[1],hn(ne,F)]]:[]})}function qd(M){return Vd.get(M)??oC}function uC(M,F){return[...F].reduce((q,te)=>q.slice(0,te.start)+" ".repeat(te.end-te.start)+q.slice(te.end),M)}function as(M,F,q,te=iC){return Object.freeze({status:M,source:F,program:q,assignmentFallbacks:Object.freeze(te)})}function Or(M,F){return M.nodes.flatMap((q,te)=>dC(q,M,te,F)).sort((q,te)=>q.start-te.start).flatMap((q)=>[...q.events])}function dC(M,F,q,te){if(M.kind==="connector")return[{start:M.span.start,events:[Wn(hC(M.operator))]}];if(M.kind==="unknown")return[{start:M.span.start,events:[Wn(M.source)]}];if(M.kind==="function")return te.functions.set(M.name,M.body),[];if(M.kind==="group"){let we=M.style!=="subshell",Ke=te.source[M.span.end-1]===(we?"}":")"),mt=we?te:{...te,functions:new Map(te.functions)};return[{start:M.span.start,events:we?[ls("{"),...Or(M.body,mt),...Ke?[ls("}")]:[]]:[Uo,Wn("("),...Or(M.body,mt),...Ke?[Wn(")")]:[],Ho]}]}let ne=CC(M,te.functions);if(ne){if(te.depth>=Tr.maxDepth||++te.flags.expansions>aC)return te.flags.limited=!0,[];return[{start:M.span.start,events:[...$d(M,te),ls(";"),...Or(ne,{...te,depth:te.depth+1}),ls(";")]},...Ud(M,F,q,te)]}return[{start:M.span.start,events:$d(M,te)},...Ud(M,F,q,te)]}function $d(M,F){return[...M.words.map((q)=>({start:q.span.start,events:Zd(q,M,F,!1)})),...M.redirections.map((q)=>({start:q.span.start,events:fC(q,M,F)}))].sort((q,te)=>q.start-te.start).flatMap((q)=>q.events)}function fC(M,F,q){let te=M.operator==="<<-"?"<<":M.operator,ne=M.target?Zd(M.target,F,q,!0):[],we=ne[0],Ke=we?.kind==="word"?we.text:void 0;return[...M.fd===void 0?[]:[ol(String(M.fd))],Object.freeze({kind:"redirection",operator:te,...M.fd===void 0?{}:{fd:M.fd},role:yC(te),targetOrder:eC.has(te)?"legacy-segment":"immediate",...Ke===void 0?{}:{target:Ke},...M.heredoc&&q.suppressed.has(M.heredoc.bodySpan)?{body:M.heredoc.body,consumer:Jd(F)}:{}}),...Ke===void 0?ne:ne.slice(1)]}function Ud(M,F,q,te){let ne=M.redirections.filter((we)=>we.operator==="<<"||we.operator==="<<-");return[...ne.flatMap((we)=>{let Ke=we.heredoc;if(!Ke)return[];let mt=[ol(Ke.delimiter),.../[\r\n]/.test(te.source[Ke.terminatorSpan.end]??"")?[Wn(";")]:[]];if(te.suppressed.has(Ke.bodySpan))return[{start:Ke.bodySpan.start,events:mt}];return[{start:Ke.bodySpan.start,events:[...Yd(te.source.slice(Ke.bodySpan.start,Ke.bodySpan.end),te),...mt]}]}),...ne.some((we)=>!we.heredoc&&we.target)?mC(F,q,te):[]]}function mC(M,F,q){let te=M.nodes.slice(F+1).find((ne)=>ne.kind==="connector");if(!te||te.span.end>=M.span.end)return[];return[{start:te.span.end,events:Yd(q.source.slice(te.span.end,M.span.end),q)}]}function Yd(M,F){if(F.depth>=Tr.maxDepth)return F.flags.limited=!0,[];let q=v(M,"posix");if(q.status==="limited")return F.flags.limited=!0,[];let te={invalid:!1,limited:!1,expansions:F.flags.expansions,assignmentFallbacks:F.flags.assignmentFallbacks},ne=Or(q,{source:M,suppressed:new Set,flags:te,depth:F.depth+1,functions:new Map,powershell:!1});return F.flags.limited||=te.limited,F.flags.expansions=te.expansions,ne}function Zd(M,F,q,te){let ne=[],we={single:!1,double:!1},Ke="",mt=!1,gt=()=>{let ht=mt&&!te?Wn("glob"):Ke!==""||M.quoted&&ne.length===0?ol(Ke):void 0;if(ht)ne.push(ht);Ke="",mt=!1};for(let ht of M.parts){if(ht.provenance!=="command-substitution"&&ht.provenance!=="arithmetic"){for(let Ct of el(ht.raw,we,q.flags,q.powershell)){if(typeof Ct==="string"){gt(),ne.push(Wn(Ct));continue}Ke+=Ct.text,mt||=Ct.glob}continue}let St=F.nested.find((Ct)=>Ct.span.start>=ht.span.start&&Ct.span.end<=ht.span.end);if(we.double){let Ct=q.source.slice(ht.span.start,ht.span.end);Ke+=el(Ct,{single:!1,double:!0},q.flags,q.powershell).map((Rt)=>typeof Rt==="string"?Rt:Rt.text).join("");let vt=St?Or(St,q).filter((Rt)=>Rt.kind==="redirection"&&Rt.body!==void 0):[];if(vt.length>0)ne.push(Uo,...vt,Ho);continue}let bt=St?Or(St,q):[];if(ht.raw.startsWith("`")){Ke+="${}",gt(),ne.push(Uo,...bt,Ho);continue}if(ht.raw.startsWith("<(")||ht.raw.startsWith(">(")){gt(),ne.push(ht.raw.startsWith("<(")?Wn("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Uo,...bt,...ht.raw.endsWith(")")?[Wn(")")]:[],Ho);continue}let yt=ht.raw.startsWith("$((")?2:1;Ke+="${}",gt(),ne.push(...Array.from({length:yt},()=>Wn("(")),...yt===1?[Uo]:[],...bt,...ht.raw.endsWith(")".repeat(yt))?Array.from({length:yt},()=>Wn(")")):[],...yt===1?[Ho]:[])}return gt(),ne}function el(M,F,q,te){let ne=[],we="",Ke=!1,mt=0;while(mt<M.length){let gt=M[mt]??"";if(!F.single&&!F.double&&(gt==="("||gt===")")){ne.push({text:we,glob:Ke},gt),we="",Ke=!1,mt++;continue}if(te&&gt==="`"&&!F.single){we+=M[mt+1]??"",mt+=2;continue}if(F.single&&gt==="'"){F.single=!1,mt++;continue}if(F.single){we+=gt,mt++;continue}if(F.double){if(gt==='"'){F.double=!1,mt++;continue}if(!te&&gt==="\\"){let ht=M[mt+1]??"";we+=['"',"\\","$"].includes(ht)?ht:`\\${ht}`,mt+=2;continue}if(gt==="$"){let ht=Hd(M,mt,F,q,te);we+=ht.text,mt=ht.next;continue}we+=gt,mt++;continue}if(gt==="'"||gt==='"'){F.single=gt==="'",F.double=gt==='"',mt++;continue}if(!te&&gt==="\\"){let ht=M[mt+1]??"";Ke||=ht==="*"||ht==="?",we+=ht,mt+=2;continue}if(gt==="$"){let ht=Hd(M,mt,F,q,te);we+=ht.text,mt=ht.next;continue}Ke||=gt==="*"||gt==="?",we+=gt,mt++}return[...ne,{text:we,glob:Ke}]}function Hd(M,F,q,te,ne){let we=M[F+1];if(we==="{"){let mt=gC(M,F+2);if(mt===-1)return te.invalid=!0,{text:"",next:M.length};let gt=M.slice(F,mt+1);return pC(gt,q,te,ne),{text:gt,next:mt+1}}if(we!==void 0&&nC.test(we))return{text:`\${${we}}`,next:F+2};let Ke=(ne?rC:/^\w*/).exec(M.slice(F+1))?.[0]??"";return{text:`\${${Ke}}`,next:F+1+Ke.length}}function pC(M,F,q,te){let ne=M.slice(2,-1),we=/^[A-Za-z_][A-Za-z0-9_]*/.exec(ne)?.[0];if(!we)return;let Ke=ne.slice(we.length),mt=[":=","="].find((ht)=>Ke.startsWith(ht));if(!mt)return;let gt=el(Ke.slice(mt.length),{...F},q,te);q.assignmentFallbacks.push(...gt.flatMap((ht)=>typeof ht==="string"||!ht.text?[]:[ht.text]))}function gC(M,F){let q=1,te=F;while(q>0&&te<M.length){if(M[te]==="{"&&M[te-1]==="$")q++;if(M[te]==="}")q--;te++}return q===0?te-1:-1}function hC(M){return/^[\r\n]+$/.test(M)?";":M}function Wn(M){return Object.freeze({kind:"operator",operator:M,boundary:Qb.has(M)})}function ls(M){return Object.freeze({kind:"operator",operator:M,boundary:!0})}function ol(M){return Object.freeze({kind:"word",text:M})}function yC(M){if(M==="<<"||M==="<<<")return"here-data";if(M==="<"||M==="<&")return"file-read";return"file-write"}function Ko(M){return sC.has(M)||/^python\d/.test(M)}var SC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Xd(M,F){let q=F[0];if(q===void 0||!q.startsWith("-"))return F;let te=SC.get(M)?.has(q)??!1;return Xd(M,F.slice(te?2:1))}function tl(M){let F=M[0];if(F===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(F))return tl(M.slice(1));if(!Jb.has(F))return[...M];return tl(Xd(F,M.slice(1)))}function Jd(M){let F=Mo(M),q=M.words.findIndex((te)=>te.provenance==="literal"&&te.text===F);return tl(q<0?[]:M.words.slice(q).map((te)=>te.text))}function bC(M){let F=Jd(M)[0];if(F===void 0)return!1;let q=Nt(F).toLowerCase();return Ko(q)&&!jo.has(q)}function nl(M){return M.nodes.flatMap((F,q)=>{if(F.kind==="group"||F.kind==="function")return nl(F.body);if(F.kind!=="command")return[];let te=F.nested.flatMap((mt)=>nl(mt)),ne=F.redirections.flatMap((mt)=>mt.heredoc?.quotedDelimiter?[mt.heredoc.bodySpan]:[]);if(bC(F))return[...te,...ne];let we=M.nodes[q+1];if(we?.kind==="connector"&&(we.operator==="|"||we.operator==="|&")||!EC(F))return te;return[...te,...ne]})}function CC(M,F){let q=Mo(M);return q===void 0?void 0:F.get(q)}function dr(M,F){return M!==void 0&&M.provenance==="literal"&&!M.quoted&&M.raw===M.text&&M.text===F}function vC(M){if(dr(M.words[0],"git"))return dr(M.words[1],"commit");if(!dr(M.words[0],"gh")||!dr(M.words[2],"create"))return!1;return dr(M.words[1],"pr")||dr(M.words[1],"issue")}function EC(M){return(dr(M.words[0],"cat")||dr(M.words[0],"tee")||vC(M))&&!M.words.some(jd)&&!M.redirections.some((q)=>jd(q.target))}function jd(M){return M?.parts.some((F)=>F.provenance==="command-substitution"&&F.raw.startsWith(">("))??!1}var Qd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),ef=new Set([...Qd,"glob"]),RC=new Set([...ef,"pattern"]),tf={parseCommand:v,readGuardSyntax:Kd};class b extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function qo(M,F={}){let q=xC({...tf,...F}),te=oe(M.input),ne=[];if((M.route.kind==="command"||M.route.kind==="unknown")&&te)ne.push({usage:"input-candidate",source:te});if(M.route.kind==="command"&&"command"in M&&M.command)ne.push({usage:"declared-command",source:M.command});let we=ne.reduce((Ke,mt)=>{let gt=Ke.findIndex((bt)=>bt.source===mt.source);if(gt!==-1){let bt=Ke[gt];if(!bt)return Ke;return Ke[gt]={...bt,usages:[...bt.usages,mt.usage]},Ke}let ht=M.route.kind==="command"?M.route.shell:process.platform==="win32"?"powershell":"posix",St=q.getCommandProgram(mt.source,ht);return Ke.push({usages:[mt.usage],source:mt.source,program:St,shell:q.getShellSyntax(mt.source,St)}),Ke},[]);return{invocation:{toolName:M.toolName,route:M.route,context:M.context},commands:we,paths:_C(M),store:q}}function dn(M,F){return M.commands.find((q)=>q.usages.includes(F))}function Jn(M,F){if(!M.includes("$"))return M;return na(M,F)}function xC(M={}){let F={...tf,...M},q=new Map,te=new Map,ne=new WeakMap,we=(mt,gt)=>{let ht=`${gt}\x00${mt}`,St=te.get(ht);if(St)return St;let bt=F.parseCommand(mt,gt);return te.set(ht,bt),bt};return{getShellSyntax:(mt,gt)=>{if(gt&&gt.source!==mt)throw TypeError("Shell syntax source does not match command program source.");let ht=gt??we(mt,"posix");if(ht.status==="limited"){let yt=ne.get(ht);if(yt)return yt;let Ct={status:"structural-limit",source:mt,program:ht,assignmentFallbacks:[]};return ne.set(ht,Ct),Ct}let St=q.get(mt);if(St)return St;let bt=F.readGuardSyntax(mt,ht);return q.set(mt,bt),bt},getCommandProgram:we}}function _C(M){let F=M.route.kind==="grep"?ef:M.route.kind==="glob"?RC:Qd;return[...zc(M.input,F),...M.route.kind==="patch"?Uc(M.input):[]]}var wC=new Set(["-S","--suffix"]);function co(M,F,q,te,ne){if(M.status==="structural-limit")throw new b;if(M.status!=="complete")return ne.findMalformedTarget(M.source);return cs(M,F,q,te,{word:(we)=>we,segment:(we,Ke)=>ne.findSegmentTarget(we,Ke),redirection:(we,Ke)=>we.role==="file-write"&&ne.isRedirectionTarget(hn(we.target,Ke.variables),Ke)?we.target:null})}function ds(M){let F=[],q=null,te=!1;for(let ne=0;ne<M.length;ne++){let we=M[ne];if(we===void 0)break;if(!te&&we==="--"){te=!0;continue}if(!te&&(we==="-t"||we==="--target-directory")){q=M[++ne]??null;continue}if(!te&&we.startsWith("--target-directory=")){q=we.slice(19);continue}if(!te&&we.startsWith("-t")&&we.length>2){q=we.slice(2);continue}if(!te&&wC.has(we)){ne++;continue}if(!te&&(we.startsWith("--suffix=")||we.startsWith("--backup=")))continue;if(!te&&we.startsWith("-"))continue;F.push(we)}return q?{sources:F,destination:q}:{sources:F.slice(0,-1),destination:F.at(-1)??null}}var C="Git metadata and hooks are protected. Ask the user before modifying them.";function af(M,F,q,te){let ne=M.invocation.context.executionCwd;if(!F)return null;if(M.invocation.route.kind==="patch"||M.invocation.route.kind==="path"||M.invocation.route.kind==="unknown"){if(vi(M.invocation.toolName))return null;let mt=M.paths.find((gt)=>nf(gt,ne,F,q,te,F.entries));return mt?{target:mt}:null}if(M.invocation.route.kind!=="command")return null;let we=dn(M,"input-candidate");if(!we)return null;let Ke=co(we.shell,ne,q,te,{findSegmentTarget:(mt,gt)=>IC(mt,gt,F,q,te),isRedirectionTarget:(mt,gt)=>nf(mt,gt.cwd,F,q,te,F.markerFiles),findMalformedTarget:()=>null});return Ke?{target:Ke}:null}function Mr(M,F,q,te,ne,we,Ke=!1){if(!q)return!1;let mt=ms(ln(M,F,ne,we)),gt=mt.replace(/(\/\.?\*+)+$/,"");if(gt!==mt&&gt!==""){if(il(gt,q))return!0;let ht=Ke||mt.slice(gt.length).includes("/."),St=(bt)=>ht?fs(bt,gt):PC(bt,gt);if(q.markerFiles.some(St))return!0;return te&&rf(q).some(St)}if(il(mt,q))return!0;return te&&rf(q).some((ht)=>fs(ht,mt))}function PC(M,F){let q=sf(F,M);if(q===""||q.startsWith("..")||of(q))return!1;return!q.split(/[\\/]/)[0]?.startsWith(".")}function AC(M,F,q,te,ne){return Mr(M,F,q,!0,te,ne)}function TC(M,F,q,te,ne){if(!q)return!1;return il(ms(ln(M,F,te,ne)),q)}function nf(M,F,q,te,ne,we){let Ke=ms(ln(M,F,te,ne));return we.includes(Ke)||cf(Ke,q)}function lf(M,F,q,te,ne){if(!q)return!1;return q.hooksDirectories.some((we)=>M.some((Ke)=>fs(we,ms(ln(Ke,F,te,ne)))))}function il(M,F){return F.entries.includes(M)||F.directories.includes(M)||cf(M,F)}function cf(M,F){return F.hooksDirectories.some((q)=>fs(M,q))}function rf(M){return[...M.entries,...M.directories,...M.hooksDirectories]}function fs(M,F){let q=sf(F,M);return q===""||!/^\.\.(?:[\\/]|$)/.test(q)&&!of(q)}function ms(M){return process.platform==="win32"?M.toLowerCase():M}function IC(M,F,q,te,ne){if(Vo(M))return null;let we=ur([...M],te);if(Nt(we[0]??"").toLowerCase()!=="mv")return null;let Ke=ds(we.slice(1)),mt=Ke.sources.find((gt)=>AC(hn(gt,F.variables),F.cwd,q,te,ne));if(mt)return mt;return Ke.destination&&TC(hn(Ke.destination,F.variables),F.cwd,q,te,ne)?Ke.destination:null}import{isAbsolute as dl,normalize as GC,parse as zC,posix as Sf,resolve as uo,sep as ul}from"node:path";import{isAbsolute as kC,join as uf,normalize as mf,parse as OC,sep as df}from"node:path";var MC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],DC=` 	
-`;function Yo(M,F){if(fr(M,F))return!0;if(!M.has("TMPDIR"))return!1;return!sl(M.get("TMPDIR")??"",F)}function Dr(M,F){if(M.has("TMPDIR"))return sl(M.get("TMPDIR")??"",F);let q=al(M,F);if(q===void 0)return!0;return sl(q,F)}function al(M,F){return hf(M,F,"TMPDIR")}function sl(M,F){if(!M)return!1;if(LC(M))return!1;return ll(M,F)}function fr(M,F){let q=hf(M,F,"IFS");return q!==void 0&&q!==""&&q!==DC}function ll(M,F){let q=ps(M,F.paths);if(q===null)return!1;return gf(F).some((te)=>FC(q,te))}function pf(M,F){let q=ps(M,F.paths);if(q===null)return!1;return gf(F).some((te)=>gs(te)===gs(q))}var ff=new WeakMap;function gf(M){let F=ff.get(M);if(F)return F;let q=NC(M);return ff.set(M,q),q}function NC(M){let F=MC.map((te)=>ps(te,M.paths)??mf(te)),q=ps(M.tmpdir,M.paths);if(!q)return F;if(process.platform==="win32")return[...F,q];if(process.platform==="darwin"&&WC(q))return[...F,q];return F}function LC(M){return/[\s$`*?[]/.test(M)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(M)||/[+@!]\([^)]*\)/.test(M)}function hf(M,F,q){return M.has(q)?M.get(q):F.env.get(q)}function WC(M){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(M)}function ps(M,F){try{let q=mf(M);if(!kC(q))return q;let te=OC(q).root,ne=q.slice(te.length).split(/[\\/]+/).filter(Boolean),we=te;for(let Ke=0;Ke<ne.length;Ke++){let mt=uf(we,ne[Ke]??"");if(F.entryKind(mt)==="missing")return uf(mt,...ne.slice(Ke+1));let gt=F.realpath(mt);if(gt===null)return null;we=gt}return we}catch{return null}}function FC(M,F){let q=gs(M),te=gs(F);if(q===te)return!0;let ne=te.endsWith(df)?te:`${te}${df}`;return q.startsWith(ne)}function gs(M){return process.platform==="win32"?M.toLowerCase():M}var BC=process.platform==="win32",yf=64,$C=16384;function Zo(M){let F=ld(M,yf,yf,$C);return{expandedTargets:F&&"words"in F?F.words:void 0,unsafeBraceExpansion:F!==void 0&&"limited"in F,targetIsLiteral:F===void 0&&M.provenance==="literal"&&(M.quoted||M.raw!==M.text),tmpdirWordSplittingProtected:UC(M)}}function UC(M){let F=M.parts.filter((q)=>q.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(q.raw));return F.length>0&&F.every((q)=>HC(M.raw,q.span.start-M.span.start))}function HC(M,F){let q=null,te=!1;for(let ne=0;ne<F;ne++){let we=M[ne];if(te){te=!1;continue}if(we==="\\"&&q!=="'"){te=!0;continue}if(q===we){q=null;continue}if(q===null&&(we==="'"||we==='"'))q=we}return q==='"'}function Nr(M){let F=M.environment.home,q=M.environment.paths,te=M.budget??Cn();return{anchoredCwd:M.originalCwd??M.cwd??null,resolvedCwd:M.cwd??null,strict:M.strict??!1,paranoid:M.paranoid??!1,trustTmpdirVar:M.allowTmpdirVar??!0,posixShell:M.posixShell??!1,tmpdirWordSplittingUnsafe:M.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:M.trustedTmpdirValue??M.allowTmpdirVar??!0,environment:M.environment,allowRoots:YC(M.allowPaths,F,q,te),protectedGitMetadata:M.protectedGitMetadata,budget:te}}function Fn(M,F,q={}){let te=q.targetIsLiteral??!1;if(!te&&F.tmpdirWordSplittingUnsafe&&!q.tmpdirWordSplittingProtected&&XC(M))return{kind:"outside_anchored_cwd"};let ne=!te&&vf(M,F.posixShell);if(sr(M))return{kind:"outside_anchored_cwd"};if(fl(M,te))return{kind:"root_or_home_target"};if(jC(M,F,te))return{kind:"root_or_home_target"};if(F.resolvedCwd&&Mr(M,F.resolvedCwd,F.protectedGitMetadata,!0,F.environment,F.budget,!F.posixShell))return{kind:"git_metadata_target"};if(VC(M,F.trustTmpdirVar,F.posixShell,ne,te,q.tmpdirWordSplittingProtected??!1,F.trustedTmpdirValue,F.environment))return{kind:"temp_target"};if(ne)return{kind:"dynamic_target"};if(ZC(M,F,te))return{kind:"temp_target"};let we=F.anchoredCwd;if(we){if(!q.skipHomeCwd&&tv(we,F.environment.home,F.environment.paths,F.budget))return{kind:"home_cwd_target"};if(!q.skipCwdSelf&&nv(M,F.resolvedCwd??we,F.environment.paths,F.budget))return{kind:"cwd_self_target"};if(rv(M,we,F.resolvedCwd??we,ne,te,F.environment.paths,F.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function bf(M,F,q={}){let{containmentTarget:te,...ne}=q;if(Fn(M,F,ne).kind!=="temp_target")return!1;let we=M.trim();if(qC(we))return!1;if(pf(we,F.environment))return!1;return![F.anchoredCwd,F.resolvedCwd].some((Ke)=>ov(te??we,Ke,F.environment.paths,F.budget))}function fl(M,F=!1){let q=M.trim(),te=Sf.normalize(q),ne=q.replace(/\\/g,"/"),we=te==="/"?te:te.replace(/\/+$/,"");if(we==="/"||we.startsWith("/")&&we.slice(1).split("/").every((Ke)=>/^\*+$/.test(Ke)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(ne)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(ne))return!0;if(!F&&(te==="~"||te==="~/"||te==="~/*"))return!0;if(!F&&(te==="$HOME"||te==="$HOME/"||te==="$HOME/*"))return!0;if(!F&&(te==="${HOME}"||te==="${HOME}/"||te==="${HOME}/*"))return!0;return!1}function jC(M,F,q){let te=M.trim(),ne=q?te:te==="*"?".":te.endsWith("/*")?te.slice(0,-2):te;if(!ne)return!1;try{let we=dl(ne)?ne:F.resolvedCwd?uo(F.resolvedCwd,ne):null;if(!we)return!1;let Ke=yn(Ht(we,F.environment.paths,F.budget));if(Ke===zC(Ke).root)return!0;return Ke===yn(Ht(F.environment.home,F.environment.paths,F.budget))}catch{return!1}}function yn(M){let F=GC(M);if(BC){if(F=F.replace(/\//g,"\\").toLowerCase(),F.length>3&&F.endsWith("\\"))F=F.slice(0,-1);return F}if(F.length>1&&F.endsWith("/"))F=F.slice(0,-1);return F}function VC(M,F,q,te,ne,we,Ke,mt){let gt=M.trim();if(Cf(gt))return!1;if(!te&&ll(gt,mt))return!0;return(F||we&&Ke)&&q&&!ne&&KC(gt,q)}function KC(M,F){return["$TMPDIR","${TMPDIR}"].some((q)=>{if(M===q)return!0;if(!M.startsWith(`${q}/`))return!1;return!vf(M.slice(q.length+1),F)})}function qC(M){let F=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(M);if(!F)return!1;return Sf.normalize(`/${F[1]??""}`)==="/"}function Cf(M){return M.split(/[\\/]+/).includes("..")}function YC(M,F,q,te){if(!M?.length)return[];return M.flatMap((ne)=>{let we=Io(ne.trim(),F);if(!dl(we))return[];try{let Ke=Ht(we,q,te);if(ko(Ke,Ht(F,q,te)))return[];return[yn(Ke)]}catch{return[]}})}function ZC(M,F,q){if(F.allowRoots.length===0)return!1;let te=M.trim();if(Cf(te))return!1;let ne=q?te:Io(te,F.environment.home),we=F.resolvedCwd??F.anchoredCwd,Ke=dl(ne)?ne:we?uo(we,ne):null;if(!Ke)return!1;try{let mt=yn(Ht(Ke,F.environment.paths,F.budget));return F.allowRoots.some((gt)=>mt===gt||mt.startsWith(gt.endsWith(ul)?gt:`${gt}${ul}`))}catch{return!1}}function XC(M){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(M)}function vf(M,F=!1){return M.includes("$")||M.includes("`")||JC(M)||F&&QC(M)}function JC(M){let F=!1;for(let q of M){if(F){F=!1;continue}if(q==="\\"){F=!0;continue}if(q==="*"||q==="?"||q==="[")return!0}return!1}function QC(M){let F=!1;for(let q=0;q<M.length;q++){let te=M[q];if(F){F=!1;continue}if(te==="\\"){F=!0;continue}if(te==="{"&&ev(M,q)||(te==="+"||te==="@"||te==="!")&&M[q+1]==="(")return!0}return!1}function ev(M,F){let q=M.indexOf("}",F+1);if(q===-1)return!1;let te=M.slice(F+1,q);return te.includes(",")||te.includes("..")}function tv(M,F,q,te){try{return yn(Ht(M,q,te))===yn(Ht(F,q,te))}catch{try{return yn(M)===yn(F)}catch{return!1}}}function nv(M,F,q,te){if(M==="."||M==="./"||M===".\\")return!0;try{return yn(Ht(uo(F,M),q,te))===yn(Ht(F,q,te))}catch{try{return yn(uo(F,M))===yn(F)}catch{return!1}}}function rv(M,F,q,te,ne,we,Ke){let mt=q??F;if(!ne&&(M.startsWith("~")||M.startsWith("$HOME")||M.startsWith("${HOME}")))return!1;if(te)return!1;if(M.startsWith("/")||/^[A-Za-z]:[\\/]/.test(M))try{return cl(M,F,we,Ke)}catch{return!1}if(M.startsWith("./")||M.startsWith(".\\")||!M.includes("/")&&!M.includes("\\"))try{return cl(uo(mt,M),F,we,Ke)}catch{return!1}if(M.startsWith("../"))return!1;try{return cl(uo(mt,M),F,we,Ke)}catch{return!1}}function cl(M,F,q,te){try{return Ef(Ht(M,q,te),Ht(F,q,te))}catch{return!1}}function ov(M,F,q,te){if(!F)return!1;try{return Ef(Ht(F,q,te),Ht(M,q,te))}catch{return!0}}function Ef(M,F){let q=yn(M),te=yn(F);return q.startsWith(`${te}${ul}`)||q===te}var iv=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Rf="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",sv="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xf="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",_f="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",av="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",lv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function wf(M,F,q,te=Nr({...q,allowPaths:q.policy?.destructiveCommandAllowPaths})){return cv(M.words.map((ne)=>({kind:"word",text:ne.text,dynamic:ne.provenance!=="literal"})),F,te,q.policy)}function cv(M,F,q,te){let ne=M.filter((gt)=>gt.kind==="word"),we=dv(ne),Ke=ne[we];if(!Ke||!iv.has(Cv(Ke.text)))return null;let mt=uv(ne.slice(we+1));if(mt.whatIfProtected)return null;if(tn(te,"powershell.remove-item-pipeline-dynamic-target",q.strict)&&F&&(mt.targets.length===0||mt.recursive))return _t("powershell.remove-item-pipeline-dynamic-target",lv);for(let gt of mt.targets)if(!sr(gt.text)&&fl(pl(gt.text)))return _t(mt.recursive&&mt.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",_f);for(let gt of mt.targets)if(q.resolvedCwd&&Mr(pl(gt.text),q.resolvedCwd,q.protectedGitMetadata,mt.recursive,q.environment,q.budget,!0))return _t("powershell.remove-item-git-metadata",C);if(!mt.recursive||!mt.force)return null;if(tn(te,"powershell.remove-item-recursive-force-dynamic-target",q.strict)&&(mt.hasDynamicTarget||mt.targets.length===0))return _t("powershell.remove-item-recursive-force-dynamic-target",xf);for(let gt of mt.targets){let ht=vv(Fn(pl(gt.text),q),q,te);if(ht)return ht}return null}function uv(M){let F=[],q=!1,te=!1,ne=!1,we=!1,Ke=!1;for(let mt=0;mt<M.length;mt++){let gt=M[mt];if(!gt||gt.kind!=="word")continue;if(fv(gt))continue;if(Ke){F.push(ml(gt)),we=we||gt.dynamic;continue}if(gt.text==="--"){Ke=!0;continue}let ht=pv(gt.text);if(!ht){F.push(ml(gt)),we=we||gt.dynamic;continue}if(gv(ht.name)){let St=ht.value?mv(ht.value,gt):M[++mt];if(St?.kind==="word"){F.push(ml(St)),we=we||St.dynamic;continue}we=!0;continue}if(hv(ht.name)){q=!0;continue}if(yv(ht.name)){te=!0;continue}if(Sv(ht.name))ne=bv(ht.value)}return{targets:F,recursive:q,force:te,whatIfProtected:ne,hasDynamicTarget:we}}function dv(M){let F=M[0];if(F?.kind==="word"&&F.text==="&"||F?.text===".")return M.length>1?1:0;return 0}function ml(M){return{text:M.kind==="word"?M.text:"",dynamic:M.kind==="word"&&M.dynamic}}function fv(M){return M.kind==="word"&&M.text===","}function pl(M){let F=M.replace(/\\/g,"/"),q=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(F);return q?`$HOME${F.slice(q[0].length)}`:F}function mv(M,F){return{kind:"word",text:M,dynamic:F.kind==="word"&&(F.dynamic||M.includes("$"))}}function pv(M){if(!M.startsWith("-")||M==="-")return null;let F=M.slice(1),q=F.indexOf(":");if(q===-1)return{name:F.toLowerCase()};return{name:F.slice(0,q).toLowerCase(),value:F.slice(q+1)}}function gv(M){return"path".startsWith(M)||"literalpath".startsWith(M)}function hv(M){return"recurse".startsWith(M)}function yv(M){return M.length>=2&&"force".startsWith(M)}function Sv(M){return M==="wi"||"whatif".startsWith(M)}function bv(M){if(M===void 0||M==="")return!0;let F=M.toLowerCase();return F==="$true"||F==="true"}function Cv(M){return M.toLowerCase()}function vv(M,F,q){switch(M.kind){case"root_or_home_target":return _t("powershell.remove-item-recursive-force-root-or-home",_f);case"git_metadata_target":return _t("powershell.remove-item-git-metadata",C);case"temp_target":return null;case"dynamic_target":if(!tn(q,"powershell.remove-item-recursive-force-dynamic-target",F.strict))return null;return _t("powershell.remove-item-recursive-force-dynamic-target",xf);case"home_cwd_target":return _t("powershell.remove-item-recursive-force-home-cwd",av);case"cwd_self_target":return _t("powershell.remove-item-recursive-force-cwd-self",Rf);case"within_anchored_cwd":if(!tn(q,"powershell.remove-item-recursive-force-paranoid",F.paranoid))return null;return _t("powershell.remove-item-recursive-force-paranoid",sv);case"outside_anchored_cwd":return _t("powershell.remove-item-recursive-force-outside-cwd",Rf)}}var fo="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",hs="Unsupported heredoc syntax",Pf="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as Ms}from"node:path";var Ev=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Rv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),xv=new Set(["-o","--output","--query","--subscription"]),_v=new Set;function Af(M){if(M==="aws")return Ev;if(M==="gcloud")return Rv;if(M==="az")return xv;return _v}var wv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Pv=new Set;function Tf(M){if(M==="git")return un;if(M==="docker")return wv;return Pv}function E(M,F){if(M.length===0||F.length===0)return null;let q=zt(M[0]??""),te=pn(M);for(let ne of F){if(!Iv(q,ne.command))continue;if(ne.match){if(Av(q,M,ne.match))return If(ne);continue}if(!kv(q,M,ne.subcommand))continue;if(Mv(M,new Set(ne.block_args),te))return If(ne)}return null}function If(M){return{id:`custom.${M.name}`,reason:`[${M.name}] ${M.reason}`,intent:M.intent??"manual_only"}}function Av(M,F,q){let te=F.slice(1);if(q.exclude_args?.some((ne)=>te.includes(ne)))return!1;if(q.any_args&&!q.any_args.some((ne)=>te.includes(ne)))return!1;return Tv(te,q.command_path,Af(M))}function Tv(M,F,q){let te=0,ne=!1;for(let we of M){if(te>=F.length)return!0;if(ne){ne=!1;continue}if(we.startsWith("-")){ne=!we.includes("=")&&q.has(we);continue}if(we!==F[te])return!1;te++}return te>=F.length}function Iv(M,F){return M===zt(F)}function kv(M,F,q){if(!q)return!0;return kf(F,1,q,Tf(M))}function kf(M,F,q,te){let ne=!1;for(let we=F;we<M.length;we++){let Ke=M[we];if(!Ke)continue;if(ne){ne=!1;continue}if(Ke==="--"){let mt=M[we+1];if(mt&&!mt.startsWith("-"))return mt===q;return!1}if(te.has(Ke)){ne=!0;continue}if(Ke.startsWith("-")){if(!Ke.includes("=")&&Ov(M,we,q,te))return!0;continue}return Ke===q}return!1}function Ov(M,F,q,te){let ne=M[F+1];if(!ne||ne.startsWith("-"))return!1;return kf(M,F+2,q,te)}function Mv(M,F,q){return M.some((te)=>F.has(te))||[...q].some((te)=>F.has(te))}var Dv=new Set(["-e","--source"]),Nv=new Set(["-F","-v","--assign","--field-separator"]),Of=new Set(["-f","--file"]),Lv=new Set(["print","printf","return"]),Mf=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Wv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Df(M,F,q){let te=!1;for(let ne of Fv(M)){let we=Gv(ne,q);if(!we)continue;for(let Ke of we.commands){let mt=F(Ke);if(mt)return mt;if(Ke.includes("{}")||/[$`]/.test(Ke))te=!0}te||=we.dynamic}return te?_t("awk.system-dynamic",Wv):null}function hl(M){let F=[],q=!1,te=!1,ne=!0,we=!0;for(let Ke=1;Ke<M.length;Ke++){let mt=M[Ke];if(mt===void 0)break;if(ne&&mt==="--"){ne=!1;continue}if(ne&&Dv.has(mt)){q=!0;let gt=M[Ke+1];if(we&&=gt!==void 0,gt!==void 0)F.push({tokenIndex:Ke+1,kind:"inline-code",value:gt});Ke++;continue}if(ne&&mt.startsWith("--source=")){q=!0,F.push({tokenIndex:Ke,kind:"inline-code",value:mt.slice(9)});continue}if(ne&&mt.startsWith("-e")&&mt.length>2){q=!0,F.push({tokenIndex:Ke,kind:"inline-code",value:mt.slice(2)});continue}if(ne&&(Nv.has(mt)||Of.has(mt))){let gt=M[Ke+1];if(we&&=gt!==void 0,Of.has(mt)){if(te=!0,gt!==void 0)F.push({tokenIndex:Ke+1,kind:"program-file",value:gt})}Ke++;continue}if(ne&&(mt.startsWith("-F")||mt.startsWith("-v")&&mt.slice(2).includes("=")))continue;if(ne&&mt.startsWith("-f")&&mt.length>2){te=!0,F.push({tokenIndex:Ke,kind:"program-file",value:mt.slice(2)});continue}if(ne&&(mt.startsWith("--assign=")||mt.startsWith("--field-separator=")))continue;if(ne&&mt.startsWith("--file=")){te=!0,F.push({tokenIndex:Ke,kind:"program-file",value:mt.slice(7)});continue}if(ne&&mt.startsWith("-")&&mt!=="-")continue;if(ne=!1,!q&&!te)F.push({tokenIndex:Ke,kind:"main-program",value:mt});return{sources:F,optionsOpen:!1}}return{sources:we?F:[],optionsOpen:ne&&we}}function Jo(M){return hl(M).sources}function Fv(M){return Jo(M).filter((F)=>F.kind!=="program-file").map((F)=>F.value)}function Gv(M,F){Rn(F,M);let q=M.includes("system")?yl(M,F):null,te=zv(M,F);if(!q&&!te)return null;return{dynamic:!!q?.dynamic||!!te?.dynamic,commands:[...q?.commands??[],...te?.commands??[]]}}function yl(M,F){Rn(F,M);let q=[],te=!1,ne=!1,we=0;while(we<M.length){let Ke=M[we];if(Ke==='"'||Ke==="'"){we=Ss(M,we,Ke)?.endIndex??we+1;continue}if(Ke==="#"){we=Nf(M,we+1);continue}if(Ke==="/"&&Lf(M,we)){we=Wf(M,we+1)??we+1;continue}if(!M.startsWith("system",we)){we++;continue}let mt=we;if(we+=6,Xo(M[mt-1])||Xo(M[we]))continue;let gt=ys(M,we);if(M[gt]!=="(")continue;gt=ys(M,gt+1);let ht=M[gt];if(ht!=='"'&&ht!=="'"){te=!0,ne=!0;continue}let St=Ss(M,gt,ht);if(!St){te=!0,ne=!0;continue}if(gt=ys(M,St.endIndex),te=!0,M[gt]!==")"){ne=!0,we=St.endIndex;continue}q.push(St.value),we=gt+1}if(!te)return null;return{dynamic:ne,commands:q}}function zv(M,F){Rn(F,M);let q=[],te=!1,ne=!1,we=0,Ke=0,mt=null,gt=null,ht=0;while(we<M.length){let St=M[we];if(!St)break;if(St==='"'||St==="'"){let Ct=Ss(M,we,St);if(Ct&&ht===Ke)gt={...Ct,startIndex:we};ht=Ct?.endIndex??we+1,we=Ct?.endIndex??we+1;continue}if(St==="#"){we=Nf(M,we+1),Ke=we,mt=null,gt=null,ht=we;continue}if(St==="/"&&Lf(M,we)){let Ct=Wf(M,we+1);ht=Ct??we+1,we=Ct??we+1;continue}if(`;
-{}`.includes(St)){we++,Ke=we,mt=null,gt=null,ht=we;continue}if(mt===null&&(gl(M,we,"print")||gl(M,we,"printf")))mt=we;if(St!=="|"||M[we-1]==="|"||M[we+1]==="|"){if(!/\s/.test(St))ht=we+1;we++;continue}let bt=M[we+1]==="&"?we+2:we+1,yt=ys(M,bt);if(gl(M,yt,"getline")){ne=!0;let Ct=Uv(Ke,gt,ht);if(te||=Ct===null,Ct!==null)q.push(Ct);ht=bt,we=bt;continue}if(jv(Ke,mt)){ne=!0;let Ct=$v(M,yt);if(!Ct){te=!0,ht=bt,we=bt;continue}if(!Bv(M,Ct.endIndex)){te=!0,ht=Ct.endIndex,we=Ct.endIndex;continue}q.push(Ct.value),ht=Ct.endIndex,we=Ct.endIndex;continue}ht=bt,we++}if(!ne)return null;return{dynamic:te,commands:q}}function Xo(M){return!!M&&/[A-Za-z0-9_]/.test(M)}function ys(M,F){let q=F;while(/\s/.test(M[q]??""))q++;return q}function Bv(M,F){let q=F;while(/[\t\f\v\r ]/.test(M[q]??""))q++;let te=M[q];return!te||`;
-}#`.includes(te)}function Ss(M,F,q){let te="",ne=!1;for(let we=F+1;we<M.length;we++){let Ke=M[we];if(!Ke)break;if(ne){let mt=Hv(M,we);if(!mt)return null;te+=mt.value,we=mt.endIndex,ne=!1;continue}if(Ke==="\\"){ne=!0;continue}if(Ke===q)return{value:te,endIndex:we+1};te+=Ke}return null}function $v(M,F){let q=M[F];if(q!=='"'&&q!=="'")return null;return Ss(M,F,q)}function Uv(M,F,q){if(!F)return null;return F.startIndex>=M&&F.endIndex===q?F.value:null}function Hv(M,F){let q=M[F];if(!q)return null;if(q==="x"){let ne=M.slice(F+1,F+3);if(!/^[0-9A-Fa-f]{2}$/.test(ne))return null;return{value:String.fromCharCode(Number.parseInt(ne,16)),endIndex:F+2}}if(/[0-7]/.test(q)){let ne=/^[0-7]{1,3}/.exec(M.slice(F));if(!ne)return null;return{value:String.fromCharCode(Number.parseInt(ne[0],8)),endIndex:F+ne[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[q]??q,endIndex:F}}function gl(M,F,q){return M.startsWith(q,F)&&!Xo(M[F-1])&&!Xo(M[F+q.length])}function jv(M,F){return F!==null&&F>=M}function Nf(M,F){let q=M.indexOf(`
-`,F);return q===-1?M.length:q+1}function Lf(M,F){let q=Vv(M,F);if(q===-1)return!0;if("{([,;!~=".includes(M[q]??""))return!0;let te=q;while(Xo(M[te-1]))te--;return Lv.has(M.slice(te,q+1))}function Vv(M,F){for(let q=F-1;q>=0;q--)if(!/\s/.test(M[q]??""))return q;return-1}function Wf(M,F){let q=!1;for(let te=F;te<M.length;te++){let ne=M[te];if(!ne)break;if(q){q=!1;continue}if(ne==="\\"){q=!0;continue}if(ne==="/")return te+1}return null}var Kv=new Set(["sudo","env","command","builtin"]);function bs(M,F){let q=M[0];if(!q||!F.transparentWrappers.includes(Nt(q)))return null;let te=Nt(q),ne=M[1]==="--"?2:1,we=qv(M,ne,te,F),Ke=we[0];if(Ke===void 0)return null;return{wrapper:te,tokens:[...M.slice(Ke)],childIndex:Ke,alternativeChildIndices:we.slice(1)}}function qv(M,F,q,te){let ne=M[1]==="--",we=[];for(let Ke=F;Ke<M.length;Ke++){let mt=M[Ke];if(!mt)continue;let gt=Nt(mt)!==q&&Yv(mt,te);if(gt)we.push(Ke);if(!gt&&Ai.has(zt(mt)))break;if(ne)break}return we}function Yv(M,F){let q=Nt(M),te=zt(M);return te==="git"||q==="busybox"||Lr(M)||ya.has(q)||F.transparentWrappers.includes(q)||en.has(te)||M==="$SHELL"||Dn(te)||An.has(te)||F.rules.some((ne)=>ne.command===q)}function Lr(M){return Kv.has(M.toLowerCase())}function Gn(M,F){let q=F.policy??{rules:[],transparentWrappers:[]};return Cs([...M],F.environment,F.cwd,F.cwd,new Map,new Map(F.envAssignments??[]),q,{iterations:0},!1)}function*Cs(M,F,q,te,ne,we,Ke,mt,gt){let ht=ss(M,F,q,we);for(let[Ct,vt]of ht.envAssignments)we.set(Ct,vt),ne.set(Ct,vt);let{tokens:St,cwd:bt}=ht;if(ht.envSplitValues){let Ct=is(ht.envSplitValues,St);if(!Ct)throw new a("derivedCommandShape");Sl(mt),yield*Cs(Ct,F,bt,te,ne,we,Ke,mt,gt);return}if(Lr(St[0]??""))throw new a("wrapperPeelIterations");let yt=bs(St,Ke);if(yt){for(let Ct of[yt.childIndex,...yt.alternativeChildIndices])Sl(mt),yield*Cs(Ct===yt.childIndex?yt.tokens:[...St.slice(Ct)],F,bt,te,new Map(ne),new Map(we),Ke,mt,!0);return}if(Xv(St)){Sl(mt),yield*Cs([...St.slice(1)],F,bt,te,ne,we,Ke,mt,gt);return}yield Zv(St,bt,te,ne,we,gt)}function Zv(M,F,q,te,ne,we){return{tokens:M,cwd:F===null?void 0:F??q,wrapperCwd:F,wrapperEnvAssignments:te,envAssignments:ne,head:Nt(M[0]??"").toLowerCase(),wrappedByTransparent:we}}function Sl(M){if(M.iterations>=n.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");M.iterations++}function Xv(M){return Nt(M[0]??"").toLowerCase()==="busybox"&&M.length>1}function bl(M,F){let q=[],te=F;while(te<M.length){let ne=M[te];if(ne===void 0||ne===":::")break;q.push(ne),te++}return{markerIndex:te<M.length&&M[te]===":::"?te:-1,templateTokens:q}}function zn(M){let F=!1,q=!1;for(let te of M){if(te==="--")break;if(te==="-r"||te==="-R"||Cl(te,"recursive")){F=!0;continue}if(te==="-f"||Cl(te,"force")){q=!0;continue}if(te.startsWith("-")&&!te.startsWith("--")){if(te.includes("r")||te.includes("R"))F=!0;if(te.includes("f"))q=!0}}return F&&q}function Ff(M){let F=M.indexOf("--");return M.slice(1,F===-1?void 0:F).some((q)=>Cl(q,"recursive")||/^-[A-Za-z]+$/.test(q)&&/[rR]/.test(q.slice(1)))}function Cl(M,F){return M.length>2&&M.startsWith("--")&&F.startsWith(M.slice(2))}var Jv="find -delete permanently removes files. Use -print first to preview.",Qv="find -exec rm -rf is dangerous. Use explicit file list instead.",eE=new Set(["-exec","-execdir","-ok","-okdir"]),tE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((M)=>[M,1]),["-fprintf",2]]);function Gf(M,F){let q=M.map(t),te=nE(M,q,F);if(te)return te;if(Es(q,1)&&!oE(M,q,F)){let Ke=Dt(_t("find.delete",Jv),F.policy);if(Ke)return Ke}let ne=F.budget??Cn(),we=0;while(we<q.length){let Ke=q[we],mt=mr(Ke??"");if(mt>0){we+=mt+1;continue}if(!Qn(Ke)){we++;continue}ne.charge("derivedTokens",q.length-we-1);let gt=Qo(q,we);we=gt.nextIndex;let ht=sE(gt.tokens,F.environment);if(ht){let Ct=Dt(ht,F.policy);if(Ct)return Ct}let St=Ke==="-execdir"||Ke==="-okdir",bt=F.analyzeTokens?F.analyzeTokens(gt.tokens,St?null:F.cwd):F.analyzeNested?F.analyzeNested(gt.tokens.join(" "),{effectiveCwd:St?void 0:F.cwd,envAssignments:F.envAssignments}):null,yt=bt?.id.startsWith("custom.")?bt:Dt(bt,F.policy);if(yt)return yt}return null}function nE(M,F,q){if(!Es(F,1)&&!vl(F,q.environment))return null;let ne=vs(M)??Zt(["."]),we=Nr({...q,allowPaths:q.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let Ke of ne){let mt=Zo(Ke);for(let gt of mt.expandedTargets??[t(Ke)]){let ht=Fn(gt,we,{targetIsLiteral:mt.expandedTargets!==void 0||mt.targetIsLiteral,tmpdirWordSplittingProtected:mt.tmpdirWordSplittingProtected});if(ht.kind==="root_or_home_target")return _t("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(ht.kind==="git_metadata_target")return _t("find.delete-git-metadata",C)}}if(rE(F)&&we.resolvedCwd&&lf(ne.map(t),we.resolvedCwd,we.protectedGitMetadata,we.environment,we.budget))return _t("find.delete-git-metadata",C);return null}function vl(M,F){let q=0;while(q<M.length){if(!Qn(M[q])){q++;continue}let te=Qo(M,q),ne=ur([...te.tokens],F),we=Nt(ne[0]??"").toLowerCase();if((we==="rm"||we==="rmdir")&&ne.some((Ke)=>Ke.includes("{}")))return!0;q=te.nextIndex}return!1}function rE(M){return M.some((F,q)=>{if(!["-name","-iname"].includes(F))return!1;return M[q+1]?.toLowerCase()==="hooks"})}function oE(M,F,q){if(F.includes("-L")||F.includes("-f")||F.includes("-follow"))return!1;let te=vs(M);if(!te)return!1;let ne=q.envAssignments??new Map,we=al(ne,q.environment),Ke=q.trustedTmpdirValue??Dr(ne,q.environment),mt=q.allowTmpdirVar??!Yo(ne,q.environment),gt=Nr({environment:q.environment,protectedGitMetadata:q.protectedGitMetadata,cwd:q.cwd,originalCwd:q.originalCwd,strict:q.strict,allowTmpdirVar:mt&&Ke&&Boolean(we),allowPaths:q.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:q.tmpdirWordSplittingUnsafe??fr(ne,q.environment),trustedTmpdirValue:Ke,budget:q.budget});return te.every((ht)=>{let St=Zo(ht);if(St.unsafeBraceExpansion)return!1;return(St.expandedTargets??[t(ht)]).every((bt)=>bf(bt,gt,{containmentTarget:iE(bt,we),targetIsLiteral:St.expandedTargets!==void 0||St.targetIsLiteral,tmpdirWordSplittingProtected:St.tmpdirWordSplittingProtected}))})}function iE(M,F){if(!F)return M;return M.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>F)}function vs(M){let F=(ne)=>{let we=M[ne];return we?t(we):void 0},q=1;while(F(q)==="-H"||F(q)==="-P")q++;if(F(q)==="--")q++;let te=[];while(q<M.length){let ne=F(q),we=M[q];if(!ne||!we||ne.startsWith("-")||["!","(",")"].includes(ne))break;te.push(we),q++}return te.length>0?te:null}function sE(M,F){let q=cr([...M],F);if(q.length===0)return null;let te=Nt(q[0]??"");if(te==="busybox"&&q.length>1)q=q.slice(1),te=Nt(q[0]??"");if(te==="rm"&&zn(q))return _t("find.exec-rm-recursive-force",Qv);return null}function Qo(M,F){let q=F+1;while(q<M.length&&M[q]!==";"&&!(M[q]==="+"&&M[q-1]==="{}"))q++;return{tokens:M.slice(F+1,q),nextIndex:Math.min(q+1,M.length)}}function Es(M,F){let q=F;while(q<M.length){let te=M[q];if(!te){q++;continue}if(Qn(te)){q=Qo(M,q).nextIndex;continue}let ne=mr(te);if(ne>0){q+=ne+1;continue}if(te==="-delete")return!0;q++}return!1}function mr(M){return tE.get(M)??(/^-newer[A-Za-z]{2}$/.test(M)?1:0)}function Qn(M){return M!==void 0&&eE.has(M)}function*El(M){for(let F of M.nodes)yield*lE(F)}function aE(M){return Object.freeze([...El(M)])}function ft(M){return Object.freeze(aE(M).map((F)=>Object.freeze(F.words.map((q)=>q.text))))}function ei(M){let F=v(M,"posix");if(F.status!=="complete"||F.nodes.length!==1)return null;let q=F.nodes[0];if(q?.kind!=="command")return null;if(q.redirections.length>0||q.nested.length>0)return null;if(q.words.some((te)=>te.provenance==="command-substitution"))return null;return q.words.map((te)=>te.text)}function*lE(M){if(M.kind==="command"){yield M;for(let F of M.nested)yield*El(F);return}if(M.kind==="group")yield*El(M.body)}var cE=5,Rl="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function fn(M){let F=M.indexOf("--");if(F===-1)return{index:-1,before:M,after:[]};return{index:F,before:M.slice(0,F),after:M.slice(F+1)}}function Bf(M,F,q){let te=Uf(M,F,q),ne=uE(te.entries);if(ne.size===0)return{blockedReason:te.blockedReason,expanded:!1,tokens:M};let we=M,Ke=!1;for(let mt=0;mt<cE;mt++){let{subcommand:gt,rest:ht}=Bn(we),St=gt?.toLowerCase();if(!St||!ne.has(St))return{blockedReason:te.blockedReason,expanded:Ke,tokens:we};let bt=ne.get(St),yt=gE(bt);if(yt===null||yt.length===0)return{blockedReason:Rl,expanded:!0,tokens:we};we=["git",...yt,...ht],Ke=!0}return{blockedReason:Rl,expanded:!0,tokens:we}}function $f(M,F,q){return Uf(M,F,q).entries.some((te)=>te.key.toLowerCase()==="core.sshcommand")}function Bn(M){if(M.length===0)return{subcommand:null,rest:[]};let F=M[0];if((F?Nt(F).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let te=1;while(te<M.length){let ne=M[te];if(!ne)break;if(ne==="--"){let we=M[te+1];if(we&&!we.startsWith("-"))return{subcommand:we,rest:M.slice(te+2)};return{subcommand:null,rest:M.slice(te+1)}}if(!ne.startsWith("-"))return{subcommand:ne,rest:M.slice(te+1)};te+=un.has(ne)?2:1}return{subcommand:null,rest:[]}}function uE(M){let F=new Map;for(let q of M){let te=q.key.toLowerCase();if(!te.startsWith("alias."))continue;let ne=te.slice(6);if(ne!=="")F.set(ne,q.value)}return F}function Uf(M,F,q){if(M.length===0)return{blockedReason:null,entries:[]};let te=M[0];if((te?Nt(te).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let we=fE(F,q);return{blockedReason:we.blockedReason,entries:[...we.entries,...dE(M,F,q)]}}function dE(M,F,q){let te=[],ne=1;while(ne<M.length){let we=M[ne];if(!we||we==="--"||!we.startsWith("-"))return te;if(we==="-c"){let Ke=xl(M[ne+1]);if(Ke)te.push(Ke);ne+=2;continue}if(we.startsWith("-c")&&we.length>2){let Ke=xl(we.slice(2));if(Ke)te.push(Ke);ne++;continue}if(we==="--config-env"){let Ke=zf(M[ne+1],F,q);if(Ke)te.push(Ke);ne+=2;continue}if(we.startsWith("--config-env=")){let Ke=zf(we.slice(13),F,q);if(Ke)te.push(Ke);ne++;continue}if(un.has(we)){ne+=2;continue}ne++}return te}function fE(M,F){let q=mE(M,F),te=pE(M,F);return{blockedReason:q===null||te===null?Rl:null,entries:[...q??[],...te??[]]}}function mE(M,F){let q=Tn("GIT_CONFIG_PARAMETERS",M,F);if(q===void 0)return[];let te=[],ne=ei(q);if(!ne)return null;for(let we of ne){let Ke=xl(we);if(!Ke)return null;te.push(Ke)}return te}function pE(M,F){let q=rs(M,F);if(q.state==="absent")return[];if(q.state==="invalid")return null;let te=[];for(let ne=0;ne<q.count;ne++){let we=Tn(`GIT_CONFIG_KEY_${ne}`,M,F)?.trim(),Ke=Tn(`GIT_CONFIG_VALUE_${ne}`,M,F);if(!we||Ke===void 0)return null;te.push({key:we,value:Ke})}return te}function xl(M){if(!M)return null;let F=M.indexOf("=");return{key:(F===-1?M:M.slice(0,F)).trim(),value:F===-1?void 0:M.slice(F+1)}}function zf(M,F,q){let te=M?.indexOf("=")??-1;if(!M||te===-1)return null;return{key:M.slice(0,te).trim(),value:Tn(M.slice(te+1),F,q)}}function gE(M){let F=M?.trimStart();if(!F||F.startsWith("!"))return null;return ei(F)}var hE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",yE="git checkout --force discards uncommitted changes. Use 'git stash' first.",SE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",bE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",CE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",vE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",EE="git switch --force discards uncommitted changes. Use 'git stash' first.",RE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",xE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",_E="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",wE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",PE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",AE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",TE="git push --force destroys remote history. Use --force-with-lease for safer force push.",IE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",kE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",OE="git branch -D force-deletes without merge check. Use -d for safe delete.",ME="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",DE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",NE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",LE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",WE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",FE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",GE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",zE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),BE=new Set(["--recurse-submodules","--track","-t"]),_l=new Set(["-b","-B","-U"]),wl=new Set(["-c","-C"]),$E=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function Wt(M,F){let q=M.split("=",1)[0]??M;return q.length>=4&&F.startsWith(q)&&q.startsWith("--")&&q.slice(2).length>=2}var mo=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function jf(M){let{subcommand:F,rest:q}=Bn(M);if(!F)return null;switch(F.toLowerCase()){case"checkout":return pr(UE(q));case"switch":return pr(HE(q));case"restore":return pr(VE(q));case"reset":return qE(q);case"clean":return pr(ZE(q));case"rm":return pr(XE(q));case"push":return Wr(JE(q));case"branch":return Wr(tR(q));case"stash":return Wr(sR(q));case"worktree":return Wr(aR(q));case"rebase":return pr(nR(q));case"merge":return pr(rR(q));case"tag":return Wr(oR(q));case"reflog":return Wr(iR(q));default:return null}}function pr(M){return M?{...M,localDiscard:!0}:null}function Wr(M){return M?{...M,localDiscard:!1}:null}function UE(M){let{index:F,before:q}=fn(M),te=pn(q,{shortOptsWithValue:_l});if(q.some((we)=>Wt(we,"--force"))||te.has("-f"))return _t("git.checkout-force",yE);for(let we of M){if(we==="-b"||we==="-B"||we==="--orphan")return null;if(Wt(we,"--pathspec-from-file"))return _t("git.checkout-pathspec-from-file",bE)}if(F!==-1){if(q.some((Ke)=>!Ke.startsWith("-")))return _t("git.checkout-ref-path",SE);return _t("git.checkout-double-dash",hE)}if(jE(M).length>=2)return _t("git.checkout-ambiguous",CE);return null}function HE(M){let{before:F}=fn(M);if(F.some((te)=>Wt(te,"--discard-changes")))return _t("git.switch-discard-changes",vE);let q=pn(F,{shortOptsWithValue:wl});if(F.some((te)=>Wt(te,"--force"))||q.has("-f"))return _t("git.switch-force",EE);return null}function jE(M){let F=[],q=0;while(q<M.length){let te=M[q];if(!te)break;if(te==="--")break;if(!te.startsWith("-")){F.push(te),q++;continue}if(zE.has(te)){q+=2;continue}if(BE.has(te)){let ne=M[q+1],we=te==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];q+=ne&&!ne.startsWith("-")&&we.includes(ne)?2:1;continue}q++}return F}function VE(M){let F=KE(M);if(F.isTerminal||!F.hasPathspec&&!F.hasPatch||!F.hasWorktree)return null;return F.hasExplicitLocation?_t("git.restore-worktree",xE):_t("git.restore-unstaged",RE)}function KE(M){let F=!1,q=!1,te=!0,ne=!1,we=(Ke)=>{if(!ne)te=!1,ne=!0;if(Ke!==void 0)te=Ke};for(let Ke=0;Ke<M.length;Ke++){let mt=M[Ke];if(mt===void 0)break;if(mt==="--"){F||=Ke+1<M.length;break}if(mt==="--pathspec-from-file"){F=!0,Ke++;continue}if(mt.startsWith("--pathspec-from-file=")){F=!0;continue}if(mt==="-h"||mt==="--help"||mt==="--version")return{hasPathspec:F,hasPatch:q,hasWorktree:te,hasExplicitLocation:ne,isTerminal:!0};if(mt==="--staged"){we();continue}if(mt==="--no-staged"){we();continue}if(mt==="--worktree"){we(!0);continue}if(mt==="--no-worktree"){we(!1);continue}if(mt==="--patch"){q=!0;continue}if(mt==="--no-patch"){q=!1;continue}if($E.has(mt)){Ke++;continue}if(mt.startsWith("--"))continue;if(mt==="-"){F=!0;continue}if(!mt.startsWith("-")){F=!0;continue}for(let gt=1;gt<mt.length;gt++){let ht=mt.charAt(gt);if(ht==="h")return{hasPathspec:F,hasPatch:q,hasWorktree:te,hasExplicitLocation:ne,isTerminal:!0};if(ht==="S"){we();continue}if(ht==="W"){we(!0);continue}if(ht==="p"){q=!0;continue}if(ht==="s"||ht==="U"){if(gt===mt.length-1)Ke++;break}}}return{hasPathspec:F,hasPatch:q,hasWorktree:te,hasExplicitLocation:ne,isTerminal:!1}}function qE(M){let F=null;for(let q of M){if(Wt(q,"--hard")){F=_t("git.reset-hard",_E);break}if(Wt(q,"--merge")){F=_t("git.reset-merge",wE);break}}if(!F)return null;return YE(M)?Wr(F):pr(F)}function YE(M){for(let F of M){if(F==="--")return!1;if(!F.startsWith("-"))return!0}return!1}function ZE(M){for(let q of M)if(q==="-n"||Wt(q,"--dry-run"))return null;let F=pn(M.filter((q)=>q!=="--"));if(M.some((q)=>Wt(q,"--force"))||F.has("-f"))return _t("git.clean-force",PE);return null}function XE(M){let F=!1,q=!1,te=!1;for(let ne of fn(M).before){if(Wt(ne,"--no-force")){F=!1;continue}if(Wt(ne,"--force")){F=!0;continue}if(Wt(ne,"--no-cached")){q=!1;continue}if(Wt(ne,"--cached")){q=!0;continue}if(Wt(ne,"--no-dry-run")){te=!1;continue}if(Wt(ne,"--dry-run")){te=!0;continue}let we=pn([ne]);F||=we.has("-f"),te||=we.has("-n")}return F&&!q&&!te?_t("git.rm-force",AE):null}function JE(M){let{before:F,after:q}=fn(M),te=pn(F);if(F.some((Ke)=>Wt(Ke,"--mirror")))return _t("git.push-mirror",kE);if(F.some((Ke)=>Wt(Ke,"--force"))||te.has("-f")||Hf(F,q).some(QE))return _t("git.push-force",TE);if(F.some((Ke)=>Wt(Ke,"--delete"))||te.has("-d")||Hf(F,q).some(eR))return _t("git.push-delete",IE);return null}function Hf(M,F){return[...M.filter((q)=>q!==""&&!q.startsWith("-")),...F]}function QE(M){return M.startsWith("+")||M.includes(":+")}function eR(M){return M.length>1&&M.startsWith(":")}function tR(M){let{before:F}=fn(M),q=pn(F),te=q.has("-D")||q.has("-d")||F.some((we)=>Wt(we,"--delete")),ne=q.has("-D")||q.has("-f")||F.some((we)=>Wt(we,"--force"));if(te&&ne)return _t("git.branch-force-delete",OE);return null}function nR(M){let{before:F}=fn(M);return F.some((q)=>Wt(q,"--abort"))?_t("git.rebase-abort",ME):null}function rR(M){let{before:F}=fn(M);return F.some((q)=>Wt(q,"--abort"))?_t("git.merge-abort",DE):null}function oR(M){let{before:F}=fn(M);return pn(F).has("-d")||F.some((te)=>Wt(te,"--delete"))?_t("git.tag-delete",NE):null}function iR(M){return M[0]==="delete"?_t("git.reflog-delete",LE):null}function sR(M){for(let F of M){if(F==="drop")return _t("git.stash-drop",WE);if(F==="clear")return _t("git.stash-clear",FE)}return null}function aR(M){let{before:F}=fn(M);if(!F.includes("remove"))return null;let te=pn(F);if(F.some((ne)=>Wt(ne,"--force"))||te.has("-f"))return _t("git.worktree-remove-force",GE);return null}import{resolve as lR}from"node:path";function Kf(M,F){return Ja.some((q)=>F?.has(q)||M.has(q))}function qf(M,F,q){if(!F)return{gitCwd:null,hasExplicitGitContext:!1};let te=q.realpath(lR(F));if(te===null||!q.isDirectory(te))return{gitCwd:null,hasExplicitGitContext:!1};let ne=te,we=!1,Ke=1;while(Ke<M.length){let mt=M[Ke];if(!mt)break;if(mt==="--")break;if(!mt.startsWith("-"))break;if(mt==="-C"){let gt=M[Ke+1];if(!gt)return{gitCwd:null,hasExplicitGitContext:we};let ht=Vf(ne,gt,q);if(!ht)return{gitCwd:null,hasExplicitGitContext:we};ne=ht,Ke+=2;continue}if(mt.startsWith("-C")&&mt.length>2){let gt=Vf(ne,mt.slice(2),q);if(!gt)return{gitCwd:null,hasExplicitGitContext:we};ne=gt,Ke++;continue}if(mt==="--git-dir"||mt==="--work-tree"){we=!0,Ke+=2;continue}if(mt.startsWith("--git-dir=")||mt.startsWith("--work-tree=")){we=!0,Ke++;continue}Ke+=un.has(mt)?2:1}return{gitCwd:ne,hasExplicitGitContext:we}}function Vf(M,F,q){try{let te=lr(M,F,q);return q.isDirectory(te)?te:null}catch{return null}}function Xf(M,F,q){if(!F.localDiscard||!q.worktreeMode||Kf(q.environment.env,q.envAssignments))return null;let te=qf(M,q.cwd,q.environment.paths);if(!te.gitCwd||te.hasExplicitGitContext)return null;let ne=q.environment.worktreeFacts(te.gitCwd);if(!ne)return null;if(cR(M,q,ne))return null;return{originalReason:F.reason,gitCwd:te.gitCwd}}function cR(M,F,q){let{subcommand:te,rest:ne}=Bn(M),we=te?.toLowerCase();if(F.dynamicArguments||uR(ne)||gR(M,F.environment.env,F.envAssignments,q)||mR(ne)||dR(we,ne))return!0;return we==="clean"&&pR(ne)>1}function uR(M){return M.some((F)=>/[$*?[]/.test(F))}function dR(M,F){if(M==="checkout"){let{before:q}=fn(F),te=pn(q,{shortOptsWithValue:_l}),ne=q.some((Ke)=>Wt(Ke,"--force"))||te.has("-f"),we=te.has("-B")||q.some((Ke)=>Ke==="-B"||Ke.startsWith("-B"));return ne&&we}if(M==="switch"){let{before:q}=fn(F),te=pn(q,{shortOptsWithValue:wl}),ne=q.some((Ke)=>Wt(Ke,"--force"))||q.some((Ke)=>Wt(Ke,"--discard-changes"))||te.has("-f"),we=q.some((Ke)=>Ke==="-C"||Ke.startsWith("-C")||fR(Ke))||te.has("-C");return ne&&we}return!1}function fR(M){let F=M.split("=",1)[0]??M;return F==="--force-create"||F.length>=9&&"--force-create".startsWith(F)}function mR(M){return M.some((F)=>F.startsWith("--recurse-sub"))}function pR(M){let F=0;for(let q of M){if(q==="--force"){F++;continue}if(q.startsWith("-")&&!q.startsWith("--")){for(let te of q.slice(1))if(te==="f")F++}}return F}function gR(M,F,q,te){let ne=hR(M,F,q);if(ne!==null)return ne;let we=yR(F,q);if(we!==null)return we;if(Ld(q))return!0;return te.recursiveSubmodules}function hR(M,F,q){let te=null,ne=1;while(ne<M.length){let we=M[ne];if(!we||we==="--")return te;if(!we.startsWith("-"))return te;if(we==="-c"){let Ke=Yf(M[ne+1]);if(Ke!==null)te=Ke;ne+=2;continue}if(we.startsWith("-c")&&we.length>2){let Ke=Yf(we.slice(2));if(Ke!==null)te=Ke;ne++;continue}if(we==="--config-env"){let Ke=Zf(M[ne+1],F,q);if(Ke!==null)te=Ke;ne+=2;continue}if(we.startsWith("--config-env=")){let Ke=Zf(we.slice(13),F,q);if(Ke!==null)te=Ke;ne++;continue}ne+=un.has(we)?2:1}return te}function yR(M,F){if(Tn("GIT_CONFIG_PARAMETERS",M,F)!==void 0)return!0;let q=rs(M,F);if(q.state==="absent")return null;if(q.state==="invalid")return!0;let te=null;for(let ne=0;ne<q.count;ne++){let we=Tn(`GIT_CONFIG_KEY_${ne}`,M,F),Ke=Tn(`GIT_CONFIG_VALUE_${ne}`,M,F);if(!we?.trim()||Ke===void 0)return!0;let mt=we.trim().toLowerCase();if(Al(mt))return!0;if(mt!=="submodule.recurse")continue;te=Pl(Ke)}return te}function Yf(M){if(!M)return null;let F=M.indexOf("="),q=(F===-1?M:M.slice(0,F)).toLowerCase();if(Al(q))return!0;if(q!=="submodule.recurse")return null;let te=F===-1?"true":M.slice(F+1).toLowerCase();return Pl(te)}function Zf(M,F,q){let te=M?.indexOf("=")??-1;if(!M||te===-1)return null;let ne=M.slice(0,te).toLowerCase();if(Al(ne))return!0;if(ne!=="submodule.recurse")return null;let we=Tn(M.slice(te+1),F,q);return we===void 0||Pl(we)}function Pl(M){let F=M.toLowerCase();return F!=="false"&&F!=="no"&&F!=="off"&&F!=="0"}function Al(M){return M==="include.path"||M.startsWith("includeif.")&&M.endsWith(".path")}var SR="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",bR=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Rs(M,F){return Jf(M.map(t),F)}function Jf(M,F,q){let te=Bf(M,F.environment.env,F.envAssignments),ne=te.blockedReason?Dt(_t("git.alias-config",te.blockedReason),F.policy):null;if(ne)return ne;let we=te.tokens;if((Nd(F.envAssignments)||$f(M,F.environment.env,F.envAssignments))&&CR(we))return _t("git.ssh-env",SR);let Ke=jf(we);if(!Ke)return null;if(te.expanded||te.blockedReason)return Ke;let mt=Xf(M,Ke,F);if(!mt)return Ke;return q?.(mt),null}function Qf(M,F){let q=null;return{match:Jf(M.map(t),F,(ne)=>{q=ne}),relaxation:q}}function CR(M){let{subcommand:F,rest:q}=Bn(M),te=F?.toLowerCase();if(!te)return!1;if(bR.has(te))return!0;if(te==="archive")return fn(q).before.some((ne)=>Wt(ne,"--remote"));return te==="remote"&&vR(q)}function vR(M){return M.find((F)=>!ER(F))?.toLowerCase()==="update"}function ER(M){return M==="-v"||Wt(M,"--verbose")||Wt(M,"--no-verbose")}import{isAbsolute as ox}from"node:path";function xn(M,F){M.charge("parallelChildAnalyses",F.childAnalyses??0),M.charge("parallelDerivedTokens",F.derivedTokens??0),M.charge("parallelDerivedBytes",F.derivedBytes??0),M.charge("parallelPlaceholderReplacements",F.placeholderReplacements??0)}var em="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",RR="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",nm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",_R="rm -rf in home directory is dangerous. Change to a project directory first.";function xs(M,F){let q=Nr({...F,allowPaths:F.policy?.destructiveCommandAllowPaths,posixShell:!0}),te=M.map(t),ne=zn(te),we=Ff(te),Ke=PR(M);for(let mt of Ke){let gt=Zo(mt.word);if(ne&&gt.unsafeBraceExpansion){let ht=Dt(tm({kind:"outside_anchored_cwd"},q,F.policy),F.policy);if(ht)return ht;continue}for(let ht of gt.expandedTargets??[mt.text]){let St=vn(ht),bt={targetIsLiteral:gt.expandedTargets!==void 0||gt.targetIsLiteral,tmpdirWordSplittingProtected:gt.tmpdirWordSplittingProtected};if(!we&&q.resolvedCwd&&Mr(St,q.resolvedCwd,q.protectedGitMetadata,we,q.environment,q.budget))return _t("rm.git-metadata",C);if(we&&!ne){let yt=Fn(St,q,bt);if(yt.kind==="root_or_home_target")return _t("rm.recursive-force-root-or-home",nm);if(yt.kind==="git_metadata_target")return _t("rm.git-metadata",C);continue}if(!ne)continue;for(let yt of wR(St,q,bt)){let Ct=tm(yt,q,F.policy),vt=Dt(Ct,F.policy);if(vt)return vt}}}return null}function wR(M,F,q){let te=Fn(M,F,q);if(te.kind==="cwd_self_target")return[te,Fn(M,F,{...q,skipCwdSelf:!0})];if(te.kind!=="home_cwd_target")return[te];let ne=Fn(M,F,{...q,skipHomeCwd:!0});if(ne.kind!=="cwd_self_target")return[te,ne];return[te,ne,Fn(M,F,{...q,skipHomeCwd:!0,skipCwdSelf:!0})]}function PR(M){let F=[],q=!1;for(let te of M.slice(1)){let ne=t(te);if(!ne)continue;if(ne==="--"){q=!0;continue}if(q){F.push({text:ne,word:te});continue}if(!ne.startsWith("-"))F.push({text:ne,word:te})}return F}function tm(M,F,q){switch(M.kind){case"root_or_home_target":return _t("rm.recursive-force-root-or-home",nm);case"git_metadata_target":return _t("rm.git-metadata",C);case"temp_target":return null;case"dynamic_target":if(!tn(q,"rm.recursive-force-dynamic-target",F.strict))return null;return _t("rm.recursive-force-dynamic-target",xR);case"home_cwd_target":return _t("rm.recursive-force-home-cwd",_R);case"cwd_self_target":return _t("rm.recursive-force-cwd-self",em);case"within_anchored_cwd":if(tn(q,"rm.recursive-force-paranoid",F.paranoid))return _t("rm.recursive-force-paranoid",RR);return null;case"outside_anchored_cwd":return _t("rm.recursive-force-outside-cwd",em)}}var AR={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},om=new Set(["--init-file","--rcfile"]),TR=["--init-file","--rcfile"],IR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function er(M){for(let F=1;F<M.length;F++){let q=M[F];if(!q)continue;if(q==="-c")return rm(M,F,!0);if(q.startsWith("-")&&q.includes("c")&&!q.startsWith("--")){let te=rm(M,F,!1);if(te!==null)return te}}return null}function tr(M){let F=Nt(M[0]??"").toLowerCase();if(F==="zsh"||F==="ksh")return jn(M).syntaxCheck;let q=!1;for(let te of M.slice(1)){if(te==="--")return q;if(te.startsWith("+")&&!te.startsWith("++")){if(te.slice(1).includes("n"))q=!1;continue}if(!te.startsWith("-")||te.startsWith("--"))return q;let ne=te.slice(1);if(ne.includes("n"))q=!0;if(ne.includes("c"))return q}return q}function rm(M,F,q){if(M[F+1]==="--")return M[F+2]||null;let te=M[F+1];if(!te||!q&&te.startsWith("-"))return null;return te}function im(M){let F=Nt(M[0]??"").toLowerCase(),q=kR(M,F),te=IR.get(F)??null,ne=q.argvSource?.kind!=="absent";return{argvSource:F==="bash"?q.argvSource:null,argvSourceApplies:F==="bash"&&q.interactive&&q.argvSource?.kind==="literal",envName:te,envSourceApplies:ne&&(te==="BASH_ENV"?!q.interactive:te==="ENV"&&q.interactive)}}function kR(M,F){let q=jn(M),te=q.commandIndex??q.scriptIndex??M.length,ne=[],we=!1,Ke=!0;for(let mt=1;mt<te;mt++){let gt=M[mt];if(gt===void 0||gt==="--"||gt==="-"||gt[0]!=="-"&&gt[0]!=="+")break;if(gt.startsWith("--")){if(F==="bash"&&Ke?TR.find((yt)=>gt===yt):void 0){let yt=M[mt+1];ne.push(yt===void 0?{kind:"absent"}:{kind:"literal",value:yt}),mt++;continue}let bt=gt.split("=",1)[0]??gt;if(F==="bash"&&om.has(bt)&&!gt.includes("="))mt++;continue}if(F==="bash")Ke=!1;let ht=sm(F,gt,M[mt+1],"startup");if(ht.interactive)we=gt[0]==="-";mt+=ht.followingValues}return{argvSource:ne.at(-1)??null,interactive:we}}function sm(M,F,q,te){let ne=!1,we=0,Ke=!1,mt=!1,gt=!1;for(let ht=1;ht<F.length;ht++){let St=F[ht];if(St===void 0)break;if(M==="ksh"&&St==="o"&&ht+1<F.length){if(te==="argv"){let bt=F.slice(ht+1);if(F[0]==="-"&&(bt==="c"||bt[0]==="-"&&bt.endsWith("c")))Ke=!0}break}if(M==="ksh"&&St==="o"&&ht+1===F.length&&(q?.startsWith("-")||q?.startsWith("+")))break;if(M==="zsh"&&St==="o"&&ht+1<F.length)break;if(te==="startup"&&St==="i")ne=F[0]==="-";if(te==="argv"&&F[0]==="-"&&St==="c")Ke=!0;if(te==="argv"&&St==="n")gt=F[0]==="-";if(te==="argv"&&St==="s")mt=F[0]==="-";if(!AR[M]?.includes(St))continue;if(ht+1===F.length)we++;break}return{interactive:ne,followingValues:we,commandSelected:Ke,stdinMode:mt,syntaxCheck:gt}}function jn(M){let F=Nt(M[0]??"").toLowerCase(),q=!1,te=!1,ne=!1;for(let we=1;we<M.length;we++){let Ke=M[we];if(Ke===void 0)break;if(Ke==="--"){let gt=q&&M[we+1]!==void 0?we+1:null;return{command:gt===null?null:M[gt]??null,commandIndex:gt,scriptIndex:!q&&!te&&M[we+1]!==void 0?we+1:null,readsStdinAsCommands:!q&&(te||M[we+1]===void 0),syntaxCheck:ne}}if(Ke==="-"||Ke[0]!=="-"&&Ke[0]!=="+")return{command:q?Ke:null,commandIndex:q?we:null,scriptIndex:!q&&!te&&Ke!=="-"?we:null,readsStdinAsCommands:!q&&(te||Ke==="-"),syntaxCheck:ne};if(Ke.startsWith("--")){let gt=Ke.split("=",1)[0]??Ke;if(F==="bash"&&om.has(gt)&&!Ke.includes("="))we++;continue}let mt=sm(F,Ke,M[we+1],"argv");if(mt.commandSelected)q=!0;if(mt.syntaxCheck)ne=!0;if(mt.stdinMode)te=!0;we+=mt.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!q,syntaxCheck:ne}}var gr={kind:"none"},Fr={kind:"dynamic"},OR=new Set(["<","<<","<<-","<<<","<&","<>"]),lm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,MR=/^(?:[0-9]+|[@*])$/,DR=Tr.maxWords,NR=Tr.maxInputLength;function cm(M){if(!M||Nt(zt(M.words[0]?.text??""))!=="printf")return;if(M.words.some((ne)=>ne.provenance!=="literal"))return;let F=M.words.slice(M.words[1]?.text==="--"?2:1),q=F[0]?.text;if(q===void 0)return"";let te=F.slice(1).map((ne)=>ne.text);if(q==="%s")return te.join("");if(q==="%s\\n"||q===`%s
-`)return`${te.join(`
-`)}
-`;if(q.includes("%")||/\\(?![\\nrt])/.test(q))return;return q.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function _s(M){let F=ti(M[1])==="--"?2:1;if(M.length<=F)return gr;let q=M.slice(F);if(!q.every(Ps))return Fr;return{kind:"literal",source:q.map(t).join(" ")}}function um(M){let F=ti(M[1])==="--"?2:1,q=M[F],te=ti(q);if(q===void 0||M.length<=F+1||te==="-"||te===""||te==="-l"||te==="-p")return gr;if(!Ps(q))return Fr;return{kind:"literal",source:te}}function ws(M,F){let q=WR(M);if(q===-1)return gr;let te=FR(F);if(!te)return gr;let ne=[],we=te.command?.length??0;for(let Ke of te.references){let mt=zR(Ke,M,q,te.ifs);if(!mt)return Fr;if(we+=mt.reduce((gt,ht)=>gt+ht.length+3,0),ne.length+mt.length>DR||we>NR)return Fr;ne.push(...mt)}if(te.command==="eval")return{kind:"literal",source:ne.join(" ")};if(ne.length===0||/\s/.test(ne[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[te.command,te.command&&te.optionTerminator?"--":null,...ne.map($R)].filter((Ke)=>Ke!==null).join(" ")}}function dm(M,F,q,te){if(!jn(M.map(t)).readsStdinAsCommands)return gr;let ne=F.filter((we)=>(we.fd===void 0||we.fd===0)&&OR.has(we.operator)).at(-1);if(ne){if(ne.operator==="<<"||ne.operator==="<<-")return gr;if(ne.operator!=="<<<"||ne.target?.provenance!=="literal")return Fr;return{kind:"literal",source:ne.target.text}}if(!q)return gr;return te===void 0?Fr:{kind:"literal",source:te}}function nr(M){let F=jn(M.map(t)).scriptIndex;if(F===null)return gr;let q=M[F],te=ti(q);return Yi(q,te)?{kind:"literal",source:te}:Fr}var LR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function Ol(M){if(M.words.length!==2||M.redirections.length!==0||M.nested.length!==1)return!1;let F=M.words[0],q=M.words[1];if(!F||F.provenance!=="literal"||F.quoted||F.raw!==F.text||!q)return!1;if(!(F.text==="eval"&&q.quoted&&q.parts.length===3&&q.parts[0]?.raw==='"'&&q.parts[1]?.provenance==="command-substitution"&&q.parts[1].raw.startsWith("$(")&&q.parts[2]?.raw==='"'||(F.text==="source"||F.text===".")&&!q.quoted&&q.parts.length===1&&q.parts[0]?.provenance==="command-substitution"&&q.parts[0].raw.startsWith("<(")))return!1;let ne=M.nested[0];if(ne?.status!=="complete"||ne.nodes.length!==1)return!1;let we=ne.nodes[0];if(we?.kind!=="command"||we.redirections.length!==0||we.nested.length!==0||we.words.some((gt)=>gt.provenance!=="literal"||gt.parts.some((ht)=>ht.provenance!=="literal")))return!1;let Ke=we.words[0]?.text;if(Ke===void 0||In(Ke)!==null)return!1;let mt=Nt(zt(Ke));return!LR.has(mt)&&!en.has(mt)&&!Lr(mt)}function WR(M){return jn(M.map(t)).commandIndex??-1}function FR(M){let F=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(M.trim()),q=F?.[4]??M.trim(),te=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(q),ne=(te?.[3]??q).split(/\s+/).map(GR);if(ne.length===0||ne.some((we)=>we===null))return null;return{command:te?.[1]??null,optionTerminator:te?.[2]!==void 0,references:ne.filter((we)=>!!we),ifs:F?F[1]??F[2]??F[3]??"":` 	
-`}}function GR(M){let F=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(M),q=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(M),te=F??q;if(!te)return null;let ne=te[1]??te[2];return{parameter:ne==="@"||ne==="*"?ne:Number(ne),quoted:F!==null}}function zR(M,F,q,te){let ne=F.slice(q+2);if(M.parameter==="@")return M.quoted?Tl(ne):BR(ne,te);if(M.parameter==="*"){let mt=Tl(ne);if(!mt)return;let gt=mt.join(te[0]??"");return M.quoted?[gt]:Il(gt,te)}let we=F[q+1+M.parameter];if(we&&!Ps(we))return;let Ke=ti(we);return M.quoted?[Ke]:Il(Ke,te)}function Tl(M){return M.every(Ps)?M.map(t):void 0}function BR(M,F){let q=Tl(M);if(!q)return;let te=q.map((ne)=>Il(ne,F));return te.some((ne)=>ne===void 0)?void 0:te.flatMap((ne)=>ne??[])}function Il(M,F){if(["*","?","[","]"].some((q)=>M.includes(q)))return;if(F==="")return M===""?[]:[M];if(F===` 	
-`)return M.trim().split(/\s+/).filter(Boolean);if(F.length!==1)return;return F===" "||F==="\t"||F===`
-`?M.trim().split(/\s+/).filter(Boolean):M.split(F).filter(Boolean)}function Ps(M){if(!M)return!0;return M.provenance==="unknown"?!/[$`]/.test(t(M)):M.provenance==="literal"}function ti(M){return M?t(M):""}function $R(M){return`'${M.replaceAll("'",`'"'"'`)}'`}function Ml(M,F){return kl(v(M,"posix"),F)}function ri(M){return Ml(M,new Set(Array.from(M.matchAll(lm)).flatMap((F)=>{let q=F[1]??F[2];return q===void 0?[]:[q]})))}function kl(M,F){if(M.status==="invalid"||M.status==="limited")return!1;let q=new Set(F);for(let te of M.nodes){if(te.kind==="group"){if(kl(te.body,q))return!0;continue}if(te.kind!=="command")continue;if(te.nested.some((ne)=>kl(ne,q))||fm(te.words,q))return!0;KR(te,q)}return!1}function fm(M,F){let q=M.findIndex((Ke)=>In(Ke.text)===null);if(q===-1)return!1;let te=M[q];if(!te)return!1;if(ni(te,F))return!0;let ne=zt(te.text);if(ne==="source"||ne==="."){let Ke=M[q+1]?.text==="--"?q+2:q+1;return am(M[Ke],F)}if(en.has(ne)){let Ke=M.slice(q),mt=jn(Ke.map((ht)=>ht.text)),gt=mt.commandIndex??mt.scriptIndex;return!mt.syntaxCheck&&gt!==null&&am(Ke[gt],F)}let we=UR(M,q,F);if(we===null)return!1;if(we===-1)return!0;return fm(M.slice(we),F)}function UR(M,F,q){let te=zt(M[F]?.text??"");if(te==="command")return HR(M,F+1);if(te==="exec")return jR(M,F+1);if(te==="env")return VR(M,F+1,q);return null}function HR(M,F){for(let q=F;q<M.length;q++){let te=M[q]?.text??"";if(te==="--")return M[q+1]?q+1:null;if(/^-[p]*[vV][pvV]*$/.test(te))return null;if(/^-p+$/.test(te))continue;return q}return null}function jR(M,F){for(let q=F;q<M.length;q++){let te=M[q]?.text??"";if(te==="--")return M[q+1]?q+1:null;if(te==="-a"){q++;continue}if(/^-a.+/.test(te)||/^-[cl]+$/.test(te))continue;return q}return null}function VR(M,F,q){for(let te=F;te<M.length;te++){let ne=M[te],we=ne?.text??"";if(we==="--")return M[te+1]?te+1:null;if(we==="-S"||we==="--split-string")return ni(M[te+1],q)?-1:te+2;if(we.startsWith("-S")||we.startsWith("--split-string="))return ni(ne,q)?-1:te+1;if(we==="-u"||we==="--unset"||we==="-C"||we==="--chdir"||we==="-P"){te++;continue}if(we==="-i"||we==="-0"||we==="--null"||we.startsWith("-u=")||we.startsWith("--unset=")||we.startsWith("-C")||we.startsWith("--chdir=")||we.startsWith("-P"))continue;if(we.startsWith("-"))continue;if(In(we))continue;return te}return null}function KR(M,F){if(!M.words.every((q)=>In(q.text)!==null))return;for(let q of M.words){let te=In(q.text);if(!te)continue;if(ni(q,F))F.add(te.name)}}function ni(M,F){if(!M)return!1;return M.parts.filter((q)=>q.provenance==="variable").some((q)=>Array.from(q.raw.matchAll(lm)).some((te)=>{let ne=te[1]??te[2];return ne!==void 0&&(MR.test(ne)||F.has(ne))}))}function am(M,F){return!!M&&(M.parts.some((q)=>q.provenance!=="literal"&&q.provenance!=="variable")||ni(M,F))}var Dl="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Nl="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",qR="__CC_SAFETY_NET_XARGS_INPUT__",As="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Ts="rm",YR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,ZR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,XR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,JR=/^(?:[0-9]+|[@*])$/;function hm(M,F){let q=M.map(t),{childStart:te,replacementToken:ne}=Gr(q),we=q.slice(te),Ke=_t("xargs.shell-dynamic",Nl);if(ex(we,ne,F)&&Dt(Ke,F.policy))return Dt(Ke,F.policy);for(let mt of Gn(we,F)){let gt=mt.tokens,ht=ne!==null&&gt[0]!==we[0]&&(gt[0]?.includes(ne)??!1)?Dt(Ke,F.policy):null;if(ht)return ht;let St=Cm(gt,ne,mt.wrapperEnvAssignments),bt=mt.head==="rm"&&ne!==null&&Sm(gt,ne),yt=F.analyzeChild(gt,{...mm(mt,F),dynamicInput:St,dynamicSourceInput:bt||ym(gt,mt.head,ne,mt.wrapperEnvAssignments,St,F.scanWork,F.environment),dynamicRmInput:bt,shellDynamicMatch:Ke,dynamicSourceMatch:Ke,rmDynamicMatch:_t("xargs.rm-recursive-force-dynamic",Dl)});if(yt)return yt;let Ct=QR(gt,ne,F.policy?.rules??[]);if(Ct)return Ct;if(mt.head==="git"){let Rt=ne===null?[...gt,qR]:gt,Et=ne!==null&&(gt.some((At)=>At.includes(ne))||Array.from(mt.envAssignments.values()).some((At)=>At.includes(ne))),xt=F.analyzeChild(Rt,{...mm(mt,F),worktreeMode:ne===null||Et?!1:F.worktreeMode});if(xt)return xt}let vt=E(gt,F.policy?.rules??[]);if(vt)return vt}return null}function mm(M,F){return{producer:"xargs",cwd:M.cwd,originalCwd:F.originalCwd,effectiveCwd:M.cwd,envAssignments:M.envAssignments,allowTmpdirVar:F.allowTmpdirVar,worktreeMode:F.worktreeMode,wrappedByTransparent:!1}}function QR(M,F,q){if(q.length===0)return null;if(F===null){for(let ne of q){let we=E([...M,...ne.subcommand?[ne.subcommand]:[],...ne.block_args],q);if(we)return we}return null}let te=new Set(q.flatMap((ne)=>[ne.subcommand,...ne.block_args].flatMap((we)=>we?M.flatMap((Ke)=>Ll(Ke,F,we)):[])));for(let ne of te){let we=E(M.map((Ke)=>Ke.replaceAll(F,ne)),q);if(we)return we}return null}function Ll(M,F,q){let te=M.indexOf(F);if(te===-1||M.indexOf(F,te+F.length)!==-1)return[];let ne=M.slice(0,te),we=M.slice(te+F.length);return q.startsWith(ne)&&q.endsWith(we)?[q.slice(ne.length,q.length-we.length)]:[]}function ym(M,F,q,te,ne,we,Ke){if(en.has(F)){if(tr(M))return!1;if(q!==null&&tx(M,q))return!0;let mt=er(M);if(!mt){let gt=nr(Zt(M));if(gt.kind==="literal")return q!==null&&gt.source.includes(q);return gt.kind==="none"&&ne}if(q!==null&&mt.includes(q))return!0;if(Xn(mt,we))return!0;return nx(mt,q,te)}if(Dn(F))return pm(M,q,es,Md(F));if(An.has(F))return pm(M,q,hl,Mf);if(F==="eval"){let mt=_s(Zt(M));if(mt.kind==="dynamic")return!0;if(q!==null)return mt.kind==="literal"&&mt.source.includes(q);return ne}if(F==="find")return rx(M,q,we,Ke);if(F==="git"){let mt=Bn(M);return q===null?mt.subcommand===null:(mt.subcommand?.includes(q)??!1)||mt.subcommand!==null&&mo.has(mt.subcommand.toLowerCase())&&bm(mt.rest,q).some((gt)=>gt.includes(q))}return!1}function pm(M,F,q,te){let ne=q(M);if(F===null)return ne.optionsOpen||q([...M,As]).sources.some((gt)=>gt.value===As);if(ne.sources.some((gt)=>gt.value.includes(F)))return!0;let we=new Set(ne.sources.map((gt)=>`${gt.tokenIndex}\x00${gt.kind}\x00${gt.value}`)),Ke=te.flatMap((gt)=>[gt.selector,...gt.valueForm==="attached-only"||gt.valueForm==="attached-or-separate"?[`${gt.selector}${As}`]:[],...gt.valueForm==="equals-or-separate"?[`${gt.selector}=${As}`]:[]]),mt=new Set(Ke.flatMap((gt)=>M.flatMap((ht)=>Ll(ht,F,gt))));return Array.from(mt).some((gt)=>q(M.map((ht)=>ht.replaceAll(F,gt))).sources.some((ht)=>!we.has(`${ht.tokenIndex}\x00${ht.kind}\x00${ht.value}`)))}function ex(M,F,q){if(M.length===0||(M[0]??"").toLowerCase()==="command")return!1;let te=new Set(Array.from(Gn(M,q),(we)=>we.head)),ne=F===null?[...M,Ts]:M.map((we,Ke)=>Ke===0?we:we.replaceAll(F,Ts));return Array.from(Gn(ne,q)).some((we)=>we.head===Ts&&!te.has(Ts))}function Sm(M,F){return bm(M.slice(1),F).some((q)=>q.includes(F)&&(q.startsWith("-")||q.startsWith(F)))}function bm(M,F){let q=M.findIndex((te)=>te==="--"&&!te.includes(F));return q===-1?M:M.slice(0,q)}function Cm(M,F,q){if(F===null)return!0;return M.some((te)=>te.includes(F))||Array.from(q.values()).some((te)=>te.includes(F))}function tx(M,F){let q=jn(M);if(q.commandIndex!==null&&(M[q.commandIndex]??"").includes(F)||q.scriptIndex!==null&&(M[q.scriptIndex]??"").includes(F))return!0;return["-c","-nc","-cn",`--${F}`,F].some((ne)=>M.some((we,Ke)=>{if(Ke===0||!we.includes(F))return!1;return Ll(we,F,ne).some((gt)=>{let ht=M.map((bt,yt)=>yt===Ke?bt.replaceAll(F,gt):bt),St=jn(ht);if(St.commandIndex===null&&St.scriptIndex===null)return!1;if(q.commandIndex===null&&St.commandIndex!==null)return!0;if(q.scriptIndex===null&&St.scriptIndex!==null)return!0;if(St.commandIndex!==null&&(ht[St.commandIndex]??"").includes(gt))return!0;return St.scriptIndex!==null&&(ht[St.scriptIndex]??"").includes(gt)})}))}function nx(M,F,q){let te=new Set(F===null?[]:Array.from(q).filter(([,ne])=>ne.includes(F)).map(([ne])=>ne));for(let ne of M.matchAll(YR))if(gm(ne,te))return!0;for(let ne of M.matchAll(ZR))for(let we of(ne[1]??"").matchAll(XR))if(gm(we,te))return!0;return Ml(M,te)}function gm(M,F){let q=M[1]??M[2];return q!==void 0&&(JR.test(q)||F.has(q))}function rx(M,F,q,te){if(F===null)return!0;let ne=!1,we=0;for(let Ke=1;Ke<M.length;Ke++){let mt=M[Ke]??"";if(!ne&&!mt.startsWith("-")&&mt!=="!"&&mt!=="("){if(mt.indexOf(F)===0)return!0;continue}if(ne=!0,we>0){we--;continue}if(Qn(mt)){let ht=Qo(M,Ke);Ke=ht.nextIndex-1;for(let St of Gn(ht.tokens,{environment:te,cwd:void 0})){let bt=Cm(St.tokens,F,St.wrapperEnvAssignments);if(St.head==="rm"&&Sm(St.tokens,F)||ym(St.tokens,St.head,F,St.wrapperEnvAssignments,bt,q,te))return!0}continue}let gt=mr(mt);if(gt>0){if(we=gt,mt.includes(F))return!0;continue}if(mt.includes(F))return!0}return!1}function Gr(M){let F=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),q=null,te=1;while(te<M.length){let ne=M[te];if(!ne)break;if(ne==="--")return{childStart:te+1,replacementToken:q};if(!ne.startsWith("-"))return{childStart:te,replacementToken:q};if(ne==="-I"){q=M[te+1]??"{}",te+=2;continue}if(ne.startsWith("-I")&&ne.length>2){q=ne.slice(2),te++;continue}if(ne==="--replace"){q="{}",te++;continue}if(ne.startsWith("--replace=")){let we=ne.slice(10);q=we===""?"{}":we,te++;continue}if(ne==="-J"){q=M[te+1]??"{}",te+=2;continue}te+=F.has(ne)?2:1}return{childStart:M.length,replacementToken:q}}var ii="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",si="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",ix="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",sx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",ax=/\{[^{}\s]*\}/,Am=/\{\}|\{-?\d+\}/g,lx=["e","f","source","file","-e","-f","--source","--file"],cx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],ux=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),dx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),vm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),fx=new Set(["--workdir","--wd"]),Em="__CC_SAFETY_NET_PARALLEL_SOURCE__",mx=new TextEncoder,Gl=n.parallelDerivedBytes.cap+4*n.parallelPlaceholderReplacements.cap;function Sn(M,F){for(let q of M){let te=F(q);if(te)return te}return null}function Tm(M,F){return Sn([...M],(q)=>Xn(q,F.scanWork))}function Im(M,F){let q=M.map(t);if((F.envAssignments?.has("PARALLEL")?F.envAssignments.get("PARALLEL"):F.environment.env.get("PARALLEL"))?.trim()){let vt=Br(F);if(vt)return vt}if(q.length===2&&(q[1]==="--version"||q[1]==="--help"))return null;let ne=Gm(q),{template:we,jobs:Ke,runsRemotely:mt,readsCommandsFromInput:gt,unsupported:ht,workdir:St,dryRun:bt}=ne;if(ht){let vt=Br(F);if(vt)return vt;let Rt=Tm(F.envAssignments?.values()??[],F);if(Rt)return Rt}if(gt){let vt=vx(F);if(vt)return vt}if(St!==void 0&&mt){let vt=Br(F);if(vt)return vt}let yt=_x(St,F.cwd,F.environment.paths);if(yt===null){let vt=Br(F);if(vt)return vt}let Ct=mt?{...F,cwd:void 0,originalCwd:void 0}:yt===null||yt===void 0||yt===F.cwd?F:{...F,cwd:yt};if(bt){if([...Gn(we,Ct)].flatMap((Rt)=>[...Rt.envAssignments.values()]).some(Ul)){let Rt=Br(F);if(Rt)return Rt}return null}if(we.length===0){if(Ke.some((Et)=>Et.length!==1)){let Et=Br(F);if(Et)return Et}let vt=Ke.map((Et)=>Et[0]??"");xn(F.budget,zl(vt));let Rt=Nm(Ct.envAssignments,Ct.cwd,mt);return Sn(vt,(Et)=>F.analyzeNested(Et,Rt))}return Sn(Gn(we,Ct),(vt)=>px(vt,ne,F,Ct))}function px(M,F,q,te){let{jobs:ne,templateHasPlaceholder:we,runsRemotely:Ke,usesStdin:mt}=F,gt=M.tokens,ht=[...M.envAssignments.values()];if(ht.some(Wm)){let Et=Br(q);if(Et)return Et}let St=Tm(ht,q);if(St)return St;let bt=ht.some($t),yt=we||bt,Ct=mt&&yt,vt=Nm(M.envAssignments,M.wrapperCwd,Ke||Ct);if(en.has(M.head)){let Et=()=>{if(!we||ne.length===0)return null;return xn(q.budget,Is(gt,ne,"generic")),Sn(ne,(Tt)=>q.analyzeChild(gt.map((Pt)=>hr(Pt,Tt)),Wl(M,te)))};if(tr(gt))return Et();let xt=er(gt);if(xt){if(Fm(xt)){let It=zr(q);if(It)return It;if(ne.length===0)return null;return xn(q.budget,Pm(xt,ne)),Sn(ne,(Mt)=>q.analyzeNested(hr(xt,Mt),vt))}if($t(xt)){if(ne.length>0)return xn(q.budget,Pm(xt,ne)),Sn(ne,(Yt)=>q.analyzeNested(hr(xt,Yt),vt));xn(q.budget,_m(xt));let It=ei(xt);if(It?.[0]&&zt(It[0])==="rm"&&zn(It)){let Yt=xm(q);if(Yt)return Yt}let Mt=It?q.analyzeChild(It,{...Wl(M,te),dynamicInput:mt,shellDynamicMatch:_t("parallel.shell-dynamic",si),rmDynamicMatch:_t("parallel.rm-recursive-force-dynamic",ii)}):null;if(Mt)return Mt;return q.analyzeNested(xt,vt)}let Tt=!bt&&(!we||ne.length>0)?(ne.length>0?ne:[void 0]).map((It)=>ws(Zt(It===void 0?gt:we?gt.map((Mt)=>hr(Mt,It)):[...gt,...It]),xt)):[];if(Tt.some((It)=>It.kind==="dynamic")){let It=zr(q);if(It)return It}let Pt=Tt.flatMap((It)=>It.kind==="literal"?[It.source]:[]);if(Pt.length>0)return xn(q.budget,zl(Pt)),Sn(Pt,(It)=>q.analyzeNested(It,vt));if(xn(q.budget,_m(xt)),ri(xt)){let It=zr(q);if(It)return It}let Ot=q.analyzeNested(xt,vt);if(Ot)return Ot;if(yt)return zr(q);return null}let At=nr(Zt(gt));if(At.kind==="dynamic"||At.kind==="literal"&&$t(At.source))return zr(q)??Et();if(At.kind==="literal")return Et();if(ne.length>0){let Tt=zr(q);if(Tt)return Tt;let Pt=Et();if(Pt)return Pt;if(we)return null;let Ot=ne.flatMap((It)=>It[0]===void 0?[]:[It[0]]);return xn(q.budget,zl(Ot)),Sn(Ot,(It)=>q.analyzeNested(It,vt))}if(yt||mt)return zr(q)??Et();return null}if(M.head==="rm"&&zn(gt)){if(we&&ne.length>0)return xn(q.budget,Is(gt,ne,"rm")),Sn(ne,(xt)=>Fl(gt.map((At)=>Bl(At,xt)),M.cwd,te));if(ne.length>0)return xn(q.budget,wm(gt,ne)),Sn(ne,(xt)=>Fl([...gt,...xt],M.cwd,te));let Et=Fl(gt.flatMap((xt,At)=>{if(At===0||!$t(xt))return[xt];return xt.startsWith("-")?[Bl(xt,[""])]:[]}),M.cwd,te);if(Et)return Et;return xm(q)}xn(q.budget,we&&ne.length>0?Is(gt,ne,"generic"):ne.length>0?wm(gt,ne):Dm(gt));let Rt=ne.length>0?ne:[void 0];return Sn(Rt,(Et)=>{let xt=Et===void 0?gt:we?gt.map((Xt)=>hr(Xt,Et)):[...gt,...Et],At=_t("parallel.shell-dynamic",si),Tt=mt&&M.head==="find"?Cx(xt,te):null,Pt=Om(xt,mt,q.policy?.rules??[],q.budget)??Tt?.customResult??null,Ot=zt(M.head),It=mt&&(Ot==="rm"&&$l(xt)||Ot==="xargs"&&Mm(xt)||Tt?.rmOptions===!0),Mt=mt&&(It||Tt?.executedSource===!0||Tt===null&&km(xt,Ot)),Yt=q.analyzeChild(xt,{...Wl(M,te),worktreeMode:Ke||mt||yt?!1:q.worktreeMode,dynamicInput:mt||yt,dynamicRmInput:It,dynamicSourceInput:Pt!==null||Mt,shellDynamicMatch:At,dynamicSourceMatch:At,rmDynamicMatch:_t("parallel.rm-recursive-force-dynamic",ii)});if(Mt){let Xt=Dt(At,q.policy);if(Xt)return Xt}return Yt??Pt??E(xt,q.policy?.rules??[])})}function Wl(M,F){return{producer:"parallel",cwd:M.cwd,originalCwd:F.originalCwd,effectiveCwd:M.cwd,envAssignments:M.envAssignments,allowTmpdirVar:F.allowTmpdirVar,worktreeMode:F.worktreeMode,wrappedByTransparent:!1}}function km(M,F){if($t(M[0]??""))return!0;if(F==="eval"||F==="source"||F===".")return!0;if(F==="parallel"||F==="xargs")return!0;if(en.has(F))return yx(M);if(F==="git")return gx(M);if(F==="find")return!0;if(An.has(F))return Rm(M,lx,Jo);if(Dn(F))return Rm(M,cx,Qi);return!1}function $l(M){let F=M.indexOf("--"),q=M.slice(1,F===-1?void 0:F);if(!M.some($t))return F===-1;return q.some((ne)=>$t(ne)&&(ne.startsWith("-")||Fm(ne)))}function gx(M){if(hx(M))return!0;let F=Bn(M);if(F.subcommand===null||$t(F.subcommand))return!0;if(!mo.has(F.subcommand.toLowerCase()))return!1;let q=F.rest.indexOf("--"),te=F.rest.slice(0,q===-1?void 0:q);if(!M.some($t))return q===-1;return te.some($t)}function hx(M){for(let F=1;F<M.length;F++){let q=M[F];if(!q||q==="--"||!q.startsWith("-"))return!1;if(q==="-c"||q==="--config-env"){if($t(M[F+1]??""))return!0;F++;continue}if(q.startsWith("-c")&&q.length>2||q.startsWith("--config-env=")){if($t(q))return!0;continue}if($t(q))return!0}return!1}function yx(M){if(tr(M))return!1;let F=er(M);if(F!==null)return $t(F);let q=nr(Zt(M));if(q.kind==="literal")return $t(q.source);if(q.kind==="dynamic")return!0;return!M.some($t)}function Rm(M,F,q){let te=q(M);if(te.some((we)=>$t(we.value)))return!0;if(!M.some($t))return q([...M,Em]).some((we)=>we.value===Em);let ne=new Set(te.map((we)=>`${we.tokenIndex}\x00${we.kind}\x00${we.value}`));return F.some((we)=>q(M.map((Ke)=>hr(Ke,[we]))).some((Ke)=>!ne.has(`${Ke.tokenIndex}\x00${Ke.kind}\x00${Ke.value}`)))}function Om(M,F,q,te){if(!F||q.length===0)return null;let ne=q.filter((Ke)=>zt(Ke.command)===zt(M[0]??""));if(ne.length===0)return null;let we=M.some($t);if(xn(te,Sx(M,ne,we)),!we)return Sn(ne,(Ke)=>E([...M,...Ke.subcommand?[Ke.subcommand]:[],...Ke.block_args],[Ke]));return Sn(ne,(Ke)=>{let mt=new Set([Ke.subcommand,...Ke.block_args].flatMap((gt)=>gt?bx(M,gt):[]));return Sn(mt,(gt)=>E(M.map((ht)=>hr(ht,[gt])),[Ke]))})}function Sx(M,F,q){let te=q?$r(kn(F.map((ne)=>ne.block_args.length+(ne.subcommand?1:0)),n.parallelChildAnalyses.cap),2*Math.max(M.length,1),n.parallelChildAnalyses.cap):F.length;return{childAnalyses:te,derivedTokens:$r(te,M.length,n.parallelDerivedTokens.cap)}}function bx(M,F){return M.flatMap((q)=>{let te=[...q.matchAll(/\{[^{}\s]*\}/g)];if(te.length!==1)return[];let ne=te[0];if(!ne||ne.index===void 0)return[];let we=q.slice(0,ne.index),Ke=q.slice(ne.index+ne[0].length);if(!F.startsWith(we)||!F.endsWith(Ke))return[F];let mt=F.slice(we.length,F.length-Ke.length);return mt!==F?[F,mt]:[F]})}function Cx(M,F){let q={customResult:null,executedSource:!M.some($t),rmOptions:!1},te=!1,ne=0,we=null,Ke=()=>{if(!we?.some($t))return;for(let mt of Gn(we,F))q.executedSource||=km(mt.tokens,mt.head),q.rmOptions||=mt.head==="rm"&&$l(mt.tokens)||mt.head==="xargs"&&Mm(mt.tokens),q.customResult??=Om(mt.tokens,!0,F.policy?.rules??[],F.budget)};for(let mt of M.slice(1)){if(!te&&!mt.startsWith("-")&&mt!=="!"&&mt!=="("){q.executedSource||=$t(mt);continue}if(te=!0,we){if(mt===";"||mt==="+"){Ke(),we=null;continue}we.push(mt);continue}if(ne>0){ne--;continue}if(Qn(mt)){we=[],q.executedSource||=$t(mt);continue}let gt=mr(mt);if(gt>0){ne=gt,q.executedSource||=$t(mt);continue}q.executedSource||=$t(mt)}return Ke(),q}function Mm(M){let F=M.slice(Gr(M).childStart);return zt(F[0]??"")==="rm"&&$l(F)}function ks(M,F){return(q)=>Dt(_t(M,F),q.policy)}var zr=ks("parallel.shell-dynamic",si),vx=ks("parallel.command-stream-dynamic",ix),Br=ks("parallel.command-stream-dynamic",sx),xm=ks("parallel.rm-recursive-force-dynamic",ii);function Fl(M,F,q){return Dt(xs(Zt(M),{environment:q.environment,cwd:F,budget:q.budget,originalCwd:q.originalCwd,strict:q.strict,paranoid:q.paranoidRm,allowTmpdirVar:q.allowTmpdirVar,tmpdirWordSplittingUnsafe:fr(q.envAssignments??new Map,q.environment),trustedTmpdirValue:Dr(q.envAssignments??new Map,q.environment),protectedGitMetadata:q.protectedGitMetadata,policy:q.policy}),q.policy)}function zl(M){return{childAnalyses:M.length,derivedTokens:M.length,derivedBytes:ai(M)}}function _m(M){return Dm([M])}function Dm(M){return{childAnalyses:1,derivedTokens:M.length,derivedBytes:ai(M)}}function wm(M,F){if(F.length>n.parallelChildAnalyses.cap)return{childAnalyses:F.length};return{childAnalyses:F.length,derivedTokens:kn(F.map((q)=>M.length+q.length),n.parallelDerivedTokens.cap),derivedBytes:kn([$r(ai(M),F.length,n.parallelDerivedBytes.cap),kn(F.map((q)=>ai(q)),n.parallelDerivedBytes.cap)],n.parallelDerivedBytes.cap)}}function Pm(M,F){return Is([M],F,"generic")}function Is(M,F,q){if(F.length>n.parallelChildAnalyses.cap)return{childAnalyses:F.length};let te=$r(M.length,F.length,n.parallelDerivedTokens.cap);if(te>n.parallelDerivedTokens.cap)return{childAnalyses:F.length,derivedTokens:te};let ne=xx(M.map((gt)=>Rx(gt,q))),we=$r(ne.occurrences,F.length,n.parallelPlaceholderReplacements.cap);if(we>n.parallelPlaceholderReplacements.cap)return{childAnalyses:F.length,derivedTokens:te,placeholderReplacements:we};if(Ex(ne,F,we))return{childAnalyses:F.length,derivedTokens:te,derivedBytes:n.parallelDerivedBytes.cap+1,placeholderReplacements:we};let Ke=q==="generic"?hr:Bl,mt=kn(F.map((gt)=>ai(M.map((ht)=>Ke(ht,gt)))),n.parallelDerivedBytes.cap);return{childAnalyses:F.length,derivedTokens:te,derivedBytes:mt,placeholderReplacements:we}}function Ex(M,F,q){let te=n.parallelDerivedBytes.cap+4*q;return kn([$r(M.fixedBytes,F.length,te),$r(M.occurrences,kn(F.map((ne)=>ne.reduce((we,Ke)=>Math.max(we,oi(Ke)),0)),te),te)],te)>te}function Rx(M,F){let q=F==="generic"?M.matchAll(/\{[^{}\s]*\}/g):M.matchAll(Am),te=0,ne=0,we=0;for(let Ke of q){if(te>=n.parallelPlaceholderReplacements.cap)return{occurrences:n.parallelPlaceholderReplacements.cap+1,fixedBytes:0};ne=kn([ne,oi(M.slice(we,Ke.index))],Gl),te++,we=Ke.index+Ke[0].length}return{occurrences:te,fixedBytes:te===0?oi(M):kn([ne,oi(M.slice(we))],Gl)}}function xx(M){return{occurrences:kn(M.map((F)=>F.occurrences),n.parallelPlaceholderReplacements.cap),fixedBytes:kn(M.map((F)=>F.fixedBytes),Gl)}}function ai(M,F=n.parallelDerivedBytes.cap){return kn(M.map(oi),F)}function oi(M){return mx.encode(M).byteLength}function kn(M,F){let q=0;for(let te of M){if(!Number.isSafeInteger(te)||te<0||te>F-q)return F+1;q+=te}return q}function $r(M,F,q){if(!Number.isSafeInteger(M)||!Number.isSafeInteger(F)||M<0||F<0||M!==0&&F>Math.floor(q/M))return q+1;return M*F}function Nm(M,F,q){let te={};if(M)te.envAssignments=M;if(q)return te.effectiveCwd=null,te.worktreeMode=!1,te;if(F!==void 0)te.effectiveCwd=F;return Object.keys(te).length>0?te:void 0}function hr(M,F){return M.replace(/\{[^{}\s]*\}/g,(q)=>Lm(q,F))}function Bl(M,F){return M.replace(Am,(q)=>Lm(q,F))}function Lm(M,F){let q=/^\{(-?\d+)[^{}\s]*\}$/.exec(M)?.[1];if(q===void 0)return F[0]??"";let te=Number(q),ne=te>0?te-1:F.length+te;return F[ne]??""}function $t(M){return ax.test(M)}function Wm(M){if(Ul(M))return!0;for(let F of M.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(F[0]))return!0;return!1}function Ul(M){let F=M.indexOf("{=");return F!==-1&&M.indexOf("=}",F+2)!==-1}function Fm(M){return/^\{[^{}\s]*\}$/.test(M)}function Gm(M){let F=1,q=[],te=M.length,ne=-1,we=!1,Ke=!1,mt=!1,gt,ht=M.some((vt)=>vt==="::::"||vt==="::::+"||vt===":::+");while(F<M.length){let vt=M[F];if(vt===void 0)break;if(vt===":::"){ne=F;break}if(vt==="--"){let Tt=bl(M,F+1);q.push(...Tt.templateTokens),te=F+1,ne=Tt.markerIndex;break}if(!vt.startsWith("-")){let Tt=bl(M,F);q.push(...Tt.templateTokens),te=F,ne=Tt.markerIndex;break}let Rt=M[F+1],Et=vt.indexOf("="),xt=Et===-1?vt:vt.slice(0,Et),At=Et===-1?void 0:vt.slice(Et+1);if(vt==="--dry-run"){mt=!0,F++;continue}if(vt==="-I"||vt.startsWith("-I")&&vt.length>2){ht||=(vt==="-I"?Rt:vt.slice(2))!=="{}",F+=vt==="-I"?2:1;continue}if(vt==="--replace"||vt==="-i"){ht=!0,F+=2;continue}if(xt==="--replace"||vt.startsWith("-i")&&vt.length>2){let Tt=xt==="--replace"?At:vt.slice(2);ht||=Tt!==""&&Tt!=="{}",F++;continue}if(vt==="-a"||dx.has(xt)){ht=!0,F+=At===void 0?2:1;continue}if(vt==="--pipe"||vt==="--pipepart"){Ke=!0,F++;continue}if(xt==="--env"){ht=!0,F+=At===void 0?2:1;continue}if(vm.has(xt)||vt.startsWith("-S")&&vt.length>2){we=!0,F+=vm.has(vt)?2:1;continue}if(fx.has(xt)){let Tt=At??Rt;if(Tt===void 0||Tt===":::"||Tt==="--"){ht=!0,F++;continue}gt=Tt,ht||=At!==void 0&&Tt==="",F+=At===void 0?2:1;continue}if(vt.startsWith("-j")&&vt.length>2&&/^\d+$/.test(vt.slice(2))){F++;continue}if(vt.startsWith("--")&&At!==void 0){F++;continue}if(ux.has(vt)){if(Rt===void 0||Rt===":::"||Rt==="--"){ht=!0,F++;continue}F+=2;continue}F+=vt==="-j"||vt==="--jobs"?2:1}ht||=q.some(mt?Ul:Wm);let St=[];if(ne!==-1){let vt=[];for(let Rt=ne+1;Rt<M.length;Rt++){let Et=M[Rt];if(Et===":::"){St.push(vt),vt=[];continue}if(Et!==void 0)vt.push(Et)}St.push(vt)}let bt=wx(St),yt=q.some($t),Ct=q.length===0&&ne===-1;return{template:q,jobs:bt,childStart:te,templateHasPlaceholder:yt,runsRemotely:we,usesStdin:Ke||ne===-1,readsCommandsFromInput:Ct,unsupported:ht,workdir:gt,dryRun:mt}}function _x(M,F,q){if(M===void 0)return;if(M==="..."||/[{}$`*?~[]/.test(M))return null;if(!F&&!ox(M))return null;try{return lr(F??M,M,q)}catch{return null}}function wx(M){if(M.length===0||M.some((q)=>q.length===0))return[];let F=[[]];for(let q of M){if(q.length===1){let ne=q[0];if(ne===void 0)return[];for(let we of F)we.push(ne);continue}let te=[];for(let ne of F)for(let we of q)if(te.push([...ne,we]),te.length>n.parallelChildAnalyses.cap)return te;F=te}return F}function zm(M){return Gm(M).childStart}var Px="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Os="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function jl(M){return M?.parts.some((F)=>F.provenance==="command-substitution")??!1}function Hl(M){return M?.parts.some((F)=>F.provenance==="literal"&&F.raw.replace(/^["']/,"").startsWith("-"))??!1}function $m(M,F,q,te,ne=!1,we){let mt=(Oo(M,F)||te&&M!=="powershell"&&F[0]?.provenance==="variable")&&tn(we,"shell.dynamic-executable",ne)?_t("shell.dynamic-executable",Px):null;return Dt(mt,we)??Um(M,F,q,ne,we)}function Um(M,F,q,te,ne){if(F.length<2)return null;let we=F.flatMap((mt,gt)=>jl(mt)?[gt]:[]);if(we.length===0)return null;let Ke=zt(F[0]?.text??"");if(Ke==="git"){let mt=ee(M,F),gt=Tx(mt);if(tn(ne,"shell.dynamic-structure",te)&&we.some((bt)=>bt<=gt))return Dt(_t("shell.dynamic-structure",Os),ne);if(Dt(Rs(mt,{environment:q}),ne))return null;let ht=F[gt]?.text.toLowerCase(),St=mt.findIndex((bt,yt)=>yt>gt&&t(bt)==="--");if(tn(ne,"shell.dynamic-structure",te)&&ht&&mo.has(ht)&&we.some((bt)=>bt>gt&&(St===-1||bt<St)))return Dt(_t("shell.dynamic-structure",Os),ne);return null}if(Ke==="find")return tn(ne,"shell.dynamic-structure",te)&&Ix(F)?Dt(_t("shell.dynamic-structure",Os),ne):null;if(Ke==="rm"){let mt=F.findIndex((ht,St)=>St>0&&t(ht)==="--"),gt=zn(F.map(t));return tn(ne,"shell.dynamic-structure",te)&&we.some((ht)=>(mt===-1||ht<mt)&&(ht<F.length-1||!gt))?Dt(_t("shell.dynamic-structure",Os),ne):null}if(Ke==="xargs")return Bm(M,F.slice(Gr(F.map(t)).childStart),"xargs",q,te,ne);if(Ke==="parallel")return Bm(M,F.slice(zm(F.map(t))),"parallel",q,te,ne);return null}function Bm(M,F,q,te,ne,we){if(F.length===0)return null;let Ke=Ax(F,te);if(Oo(M,Ke)){let gt=Dt(_t(`${q}.shell-dynamic`,q==="xargs"?Nl:si),we);if(gt)return gt}let mt=Um(M,Ke,te,ne,we);if(mt)return mt;if(Ke[0]?.text==="rm"&&Ke.slice(1).some((gt)=>jl(gt)&&Hl(gt)))return Dt(_t(`${q}.rm-recursive-force-dynamic`,q==="xargs"?Dl:ii),we);return null}function Ax(M,F){let q=kr(M,F),te=q.rewritten?Zt(q.words.map(t)):q.words,ne=te[0];return ne&&t(ne)==="busybox"?te.slice(1):te}function Tx(M){let F=1;while(F<M.length){let q=M[F],te=q?t(q):"";if(un.has(te)){F+=2;continue}if(te.startsWith("-")){F++;continue}return F}return F}function Ix(M){let F=!1,q=0,te=!1,ne=!1;for(let we=1;we<M.length;we++){let Ke=M[we];if(!Ke)continue;let mt=jl(Ke);if(q>0){q--;continue}if(ne){if(Ke.text===";"||Ke.text==="+"){ne=!1,F=!0,te=!1;continue}if(mt&&(te||Hl(Ke)))return!0;te=!1;continue}if(!F&&!Ke.text.startsWith("-")){if(mt&&(we>1||Hl(Ke)))return!0;continue}if(F=!0,mt)return!0;let gt=mr(Ke.text);if(gt>0){q=gt;continue}if(Qn(Ke.text))ne=!0,te=!0}return!1}function Vl(M,F){return M.some((q)=>{if(q.value==="-"&&(q.kind==="main-script"||q.kind==="program-file"))return!0;return!Yi(F[q.tokenIndex],q.value)})}var kx="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Ox="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",Mx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Hm(M,F){let q=F.slice(1);if(M==="dd"&&q.some((te)=>/^of=\/dev\/.+/.test(te)))return _t("dd.device-write",kx);if((M==="mkfs"||M.startsWith("mkfs."))&&q.some((te)=>te.startsWith("/dev/")))return _t("mkfs.device",Ox);if(M==="shred"&&q.length>0)return _t("shred.target",Mx);return null}var Vm=[{heads:new Set(["rm","rmdir"]),analyze:(M)=>xs(M.words,{environment:M.options.environment,cwd:M.cwd,originalCwd:M.originalCwd,strict:M.options.strict,paranoid:M.options.paranoidRm,allowTmpdirVar:M.allowTmpdirVar,tmpdirWordSplittingUnsafe:fr(M.envAssignments,M.options.environment),trustedTmpdirValue:Dr(M.envAssignments,M.options.environment),protectedGitMetadata:M.options.protectedGitMetadata,policy:M.options.policy,budget:M.options.budget})},{heads:new Set(["git"]),analyze:(M)=>Rs(M.words,Kl(M))},{heads:new Set(["find"]),analyze:(M)=>Gf(M.words,{environment:M.options.environment,cwd:M.cwd,originalCwd:M.originalCwd,strict:M.options.strict,allowTmpdirVar:M.allowTmpdirVar,tmpdirWordSplittingUnsafe:fr(M.envAssignments,M.options.environment),trustedTmpdirValue:Dr(M.envAssignments,M.options.environment),protectedGitMetadata:M.options.protectedGitMetadata,budget:M.options.budget,envAssignments:M.envAssignments,policy:M.options.policy,analyzeTokens:M.analyzeChildTokens,analyzeNested:(F,q)=>Ur(M.options.analyzeNested(F,q))})},{heads:new Set(["xargs"]),analyze:(M)=>hm(M.words,{...jm(M),analyzeChild:M.analyzeChild,analyzeNested:(F,q)=>Ur(M.options.analyzeNested(F,q))})},{heads:new Set(["parallel"]),analyze:(M)=>Im(M.words,{...jm(M),analyzeChild:M.analyzeChild,analyzeNested:(F,q)=>Ur(M.options.analyzeNested(F,q))})}];function jm(M){return{environment:M.options.environment,cwd:M.cwd,originalCwd:M.originalCwd,strict:M.options.strict,paranoidRm:M.options.paranoidRm,paranoidInterpreters:M.options.paranoidInterpreters,allowTmpdirVar:M.allowTmpdirVar,protectedGitMetadata:M.options.protectedGitMetadata,budget:M.options.budget,envAssignments:M.envAssignments,worktreeMode:M.options.worktreeMode,policy:M.options.policy,scanWork:M.options.scanWork}}function Ur(M){return M?{id:M.ruleId??"",reason:M.reason,intent:M.intent??"manual_only"}:null}function Kl(M){return{environment:M.options.environment,cwd:M.cwd,dynamicArguments:M.dynamicArguments,envAssignments:M.envAssignments,policy:M.options.policy,worktreeMode:M.options.worktreeMode}}var Zm="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function Xm(M){return Vm.find((F)=>F.heads.has(M))?.analyze}function go(M,F,q){let te=q.trace;if(M.length===0)return null;let ne=q.commandView?.dialect??"posix",we=(kt)=>kt.map((Lt)=>ne==="posix"?t(Lt):Lt.text),Ke=q.child,mt=Ke!==void 0&&Ke.producer!=="unknown-head",gt=Ke?.producer==="unknown-head",ht=q.effectiveCwd===null,St=Ke?Ke.cwd:ht?void 0:q.effectiveCwd??q.cwd,bt=Ke?Ke.originalCwd:ht?void 0:q.cwd,yt=be(M);if(yt.envAssignments.size>0)te?.recordSegment({type:"env-strip",input:we(M),envVars:[...yt.envAssignments.keys()],output:we(yt.words)});let Ct=kr(yt.words,q.environment,St,new Map([...q.envAssignments??[],...yt.envAssignments])),vt=Ct.envSplitValues??[];if(vt.length>0){let kt=[...vt,...we(Ct.words)].join(" "),Lt=Xn(kt,q.scanWork);if(Lt)return te?.recordSegment({type:"dangerous-text",token:kt,matched:!0,reason:Lt.reason}),mn(Lt);if(q.strict)return bn(te);let Gt=is(vt,we(Ct.words));if(Gt){q.budget.charge("derivedTokens",Gt.length);let rn=q.analyzeNested(Gt.join(" "),{effectiveCwd:Ct.cwd===void 0?q.effectiveCwd:Ct.cwd,envAssignments:new Map([...q.envAssignments??[],...yt.envAssignments,...Ct.envAssignments])});if(rn)return rn}}let Rt=Ct.rewritten?Zt(we(Ct.words)):ee(ne,Ct.words),Et=we(Rt),xt={...q,wrapperNormalizationBudget:q.wrapperNormalizationBudget??{iterations:0}};if(te&&yt.words.length>Rt.length){let kt=we(yt.words);te.recordSegment({type:"leading-tokens-stripped",input:kt,removed:kt.slice(0,kt.length-Rt.length),output:Et})}let At=new Map([...q.envAssignments??[],...yt.envAssignments,...Ct.envAssignments]),Tt=Et[0];if(!Tt)return null;if(Lr(Tt))throw new a("wrapperPeelIterations");let Pt=zt(Tt),Ot=Ct.cwd===null?void 0:Ct.cwd??St,It=Ct.cwd===null?void 0:bt,Mt=Ct.cwd===void 0?q.effectiveCwd:Ct.cwd,Yt=Ke?Ke.allowTmpdirVar:!Yo(At,q.environment),Xt=$m(ne,Ct.words,q.environment,F===0,q.strict,q.policy);if(Xt)return te?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Xt.reason}),mn(Xt);let nn=bs(Et,q.policy);if(nn){for(let kt of[nn.childIndex,...nn.alternativeChildIndices]){Km(xt.wrapperNormalizationBudget);let Lt=Rt.slice(kt);te?.recordSegment({type:"transparent-wrapper",wrapper:nn.wrapper,output:we(Lt)});let Gt=go(Lt,F,{...xt,effectiveCwd:Mt,envAssignments:At});if(Gt)return Gt}return null}let Qt=gt?void 0:Pt==="eval"?_s(Rt):Pt==="trap"&&!mt?um(Rt):void 0;if(mt&&Ke&&Pt==="eval"){if(Qt?.kind==="dynamic")return po(Ke,q.policy);if(Qt?.kind==="literal"){let kt=q.analyzeNested(Qt.source,{effectiveCwd:Mt,envAssignments:At});if(kt)return kt}return ho(Ke,q.policy)}if(Qt?.kind==="dynamic"&&(q.strict||!q.commandView||!Ol(q.commandView)))return bn(te);if(Qt?.kind==="literal"){te?.recordSegment({type:"recurse",reason:Pt==="eval"?"shell-eval":"shell-trap",innerCommand:Qt.source,depth:F+1});let kt=q.analyzeNested(Qt.source,{effectiveCwd:Mt,envAssignments:At,functionDefinitions:q.functionDefinitions});if(kt)return kt}if(mt?en.has(Pt):Qm(Tt,Pt)){if(tr(Et))return null;if(mt&&Ke){let kt=er(Et);if(kt){if(Ke.dynamicSourceInput??Ke.dynamicInput){let Gt=po(Ke,q.policy);if(Gt)return Gt}if(ri(kt)){let Gt=po(Ke,q.policy);if(Gt)return Gt}return q.analyzeNested(kt,{effectiveCwd:Mt,envAssignments:At})}let Lt=nr(Rt);if(Lt.kind==="dynamic")return po(Ke,q.policy);if(Lt.kind==="literal")return Ke.dynamicSourceInput?po(Ke,q.policy):null;return Ke.dynamicSourceInput??Ke.dynamicInput?po(Ke,q.policy):null}if(gt){let kt=er(Et),Lt=kt?q.analyzeNested(kt,{effectiveCwd:Mt,envAssignments:At}):nr(Rt).kind==="dynamic"?bn(te):null;if(Lt)return Lt}if(Ke===void 0){let kt=Wx(Et,At,Mt,q,te,F);if(kt)return kt;let Lt=er(Et);if(Lt){let Kr=ws(Rt,Lt);if(Kr.kind==="dynamic")return bn(te);let Zs=Kr.kind==="literal"?Kr.source:Lt,bc=Fx(Zs);te?.recordSegment({type:"shell-wrapper",wrapper:Pt,innerCommand:bc}),te?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:bc,depth:F+1});let Cc=q.analyzeNested(Zs,{effectiveCwd:Mt,envAssignments:At});if(Cc)return Cc;return ri(Zs)?bn(te):null}let Gt=nr(Rt);if(Gt.kind==="dynamic")return bn(te);if(Gt.kind==="literal")return Ds(Gt.source,Mt,At,q,te,F);let rn=dm(Rt,q.commandView?.redirections??[],q.hasPipelineInput??!1,q.literalShellInput);if(rn.kind==="dynamic")return bn(te);if(rn.kind==="literal")return te?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:rn.source,depth:F+1}),q.analyzeNested(rn.source,{effectiveCwd:Mt,envAssignments:At})}}if(!Ke&&(Pt==="source"||Pt===".")){let kt=Et[1]==="-p"?2:null;if(kt!==null){let Kr=q.commandView?Rt[kt]:void 0;if(!Kr)return null;if(Kr.provenance!=="literal")return bn(te)}let Lt=kt===null?1:3,Gt=Et[Lt]==="--"?Lt+1:Lt,rn=q.commandView?Rt[Gt]:void 0;if(!rn)return null;if(rn.provenance==="literal")return Ds(rn.text,Mt,At,q,te,F);if(q.strict||!q.commandView||!Ol(q.commandView))return bn(te)}if(An.has(Pt)&&!gt){if(!Ke&&q.strict&&Vl(Jo(Et),Rt))return bn(te);let kt=Df(Et,(Gt)=>Ur(q.analyzeNested(Gt,{effectiveCwd:Mt,envAssignments:At}))),Lt=Dt(kt,q.policy);if(Lt)return te?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:Lt.reason}),mn(Lt)}if(Dn(Pt)&&!gt){if(!Ke&&q.strict&&Vl(Qi(Et),Rt))return bn(te);let kt=Od(Et);if(mt&&Ke)return Nx(Pt,kt,Mt,At,q,Ke);if(kt){let Lt=tn(q.policy,"interpreter.one-liner-paranoid",!!q.paranoidInterpreters);if(te?.recordSegment({type:"interpreter",interpreter:Pt,codeArg:kt,paranoidBlocked:Lt}),Lt){let rn=Dt(_t("interpreter.one-liner-paranoid",zo),q.policy);if(rn)return mn(rn)}if(Za(Pt,kt))return null;te?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:kt,depth:F+1});let Gt=q.analyzeNested(kt,{effectiveCwd:Mt,envAssignments:At});if(Gt&&!Jm(Gt,kt))return Gt;if(Bo(kt,q.scanWork)){let rn=Dt(_t("interpreter.dangerous-command",ao),q.policy);if(rn)return te?.recordSegment({type:"dangerous-text",token:kt,matched:!0,reason:ao}),mn(rn)}te=void 0}}if(Pt==="busybox"&&Et.length>1)return Km(xt.wrapperNormalizationBudget),te?.recordSegment({type:"busybox",subcommand:Et[1]??"unknown"}),te?.recordSegment({type:"recurse",reason:"busybox",innerCommand:Et.slice(1).join(" "),depth:F+1}),go(Rt.slice(1),F,{...xt,effectiveCwd:Mt,envAssignments:At});let Ft=Ke?null:Dt(Hm(Pt,Et),q.policy);if(Ft)return te?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:Ft.reason}),mn(Ft);let an=te===xt.trace?xt:{...xt,trace:te},wn={words:Rt,head:Pt,cwd:Ot,originalCwd:It,envAssignments:At,allowTmpdirVar:Yt,dynamicArguments:Ct.words.some((kt)=>kt.provenance==="command-substitution"),depth:F,effectiveCwd:Mt,options:an,analyzeChildTokens:(kt,Lt)=>mt&&Ke?ql(kt,F,an,{...Ke,cwd:Lt??void 0,effectiveCwd:Lt??void 0}):Ur(go(Zt(kt),F+1,{...an,child:void 0,commandView:void 0,effectiveCwd:Lt,envAssignments:At}))??E(kt,an.policy.rules),analyzeChild:(kt,Lt)=>ql(kt,F,an,Lt)},Kn=Ke&&(Pt==="xargs"||Pt==="parallel")?void 0:Xm(Pt);if(Pt==="rm"||Pt==="xargs"||Pt==="parallel")te?.recordSegment({type:"tmpdir-check",tmpdirValue:At.has("TMPDIR")||q.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!Yt,allowTmpdirVar:Yt});let On=te&&Pt==="git"?Qf(wn.words,Kl(wn)):void 0,qs=qm(On?On.match:Kn?.(wn)??null,q.policy);if(te)Gx(wn,qs,On?.relaxation??null);if(qs)return mn(qs);if(mt&&Ke&&(Pt==="rm"||Pt==="rmdir")){if(!(Pt==="rm"&&(zn(Et)||Ke.dynamicRmInput)))return null;return(Ke.dynamicRmInput?ho(Ke,q.policy):null)??Lx(Ke,q.policy)}let yc=Kn!==void 0,Sc=!Ke&&!yc&&!Ai.has(Pt),Ys=te&&Sc?[]:void 0;if(Sc)for(let kt=1;kt<Et.length;kt++){let Lt=Et[kt];if(!Lt)continue;Ys?.push(Lt);let Gt=qm(Dx(Et,kt,F,an,Ot,It,Mt,At),q.policy);if(Gt)return te?.recordSegment({type:"fallback-scan",tokensScanned:Ys??[],embeddedCommandFound:zt(Lt)}),mn(Gt)}if(te?.recordSegment({type:"fallback-scan",tokensScanned:Ys??[]}),gt&&Ke&&!Ke.wrappedByTransparent)return null;if(!Ke&&F!==0&&yc)return te?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let gi=E(Et,q.policy.rules);if(te?.recordSegment({type:"custom-rules-check",rulesChecked:q.policy.rules.length>0,matched:!!gi,reason:gi?.reason}),gi)return mn(gi);return mt&&Ke?ho(Ke,q.policy):null}function ql(M,F,q,te){return Ur(go(Zt(M),F+1,{...q,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:te.originalCwd,effectiveCwd:te.effectiveCwd,envAssignments:te.envAssignments,worktreeMode:te.dynamicInput?!1:te.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:te}))}function Dx(M,F,q,te,ne,we,Ke,mt){for(let gt of Gn(M.slice(F),{environment:te.environment,cwd:ne,envAssignments:mt,policy:te.policy})){let ht=gt.tokens[0];if(!ht)continue;let St=zt(ht);if(Qm(ht,St)||Xm(St)!==void 0&&St!=="xargs"&&St!=="parallel"||gt.wrappedByTransparent&&te.policy.rules.length>0)te.budget.charge("derivedTokens",M.length-F);let yt=ql(gt.tokens,q,te,{producer:"unknown-head",cwd:gt.cwd,originalCwd:gt.wrapperCwd===null?void 0:we,effectiveCwd:gt.wrapperCwd===void 0?Ke:gt.wrapperCwd,envAssignments:gt.envAssignments,allowTmpdirVar:!Yo(gt.envAssignments,te.environment),worktreeMode:!1,wrappedByTransparent:gt.wrappedByTransparent});if(yt)return yt}return null}function Nx(M,F,q,te,ne,we){if(!F)return ho(we,ne.policy);if(tn(ne.policy,"interpreter.one-liner-paranoid",!!ne.paranoidInterpreters)){let mt=Dt(_t("interpreter.one-liner-paranoid",zo),ne.policy);if(mt)return mn(mt)}if(Za(M,F))return ho(we,ne.policy);let Ke=ne.analyzeNested(F,{effectiveCwd:q,envAssignments:te});if(Ke&&!Jm(Ke,F))return Ke;if(Bo(F,ne.scanWork)){let mt=Dt(_t("interpreter.dangerous-command",ao),ne.policy);if(mt)return mn(mt)}return ho(we,ne.policy)}function Jm(M,F){if(M.ruleId==="raw-text.dangerous-command")return!0;return(M.reason.startsWith(hs)||M.reason===fo)&&!Ti(F)}function po(M,F){let q=M.shellDynamicMatch?Dt(M.shellDynamicMatch,F):null;return q?mn(q):null}function ho(M,F){let q=M.dynamicSourceInput&&M.dynamicSourceMatch?Dt(M.dynamicSourceMatch,F):null;return q?mn(q):null}function Lx(M,F){let q=M.dynamicInput&&M.rmDynamicMatch?Dt(M.rmDynamicMatch,F):null;return q?mn(q):null}function Wx(M,F,q,te,ne,we){let Ke=im(M);if(Ke.argvSource?.kind==="absent")return bn(ne);if(Ke.argvSourceApplies&&Ke.argvSource){let gt=Ds(Ke.argvSource.value,q,F,te,ne,we,!0);if(gt)return gt}if(!Ke.envSourceApplies||!Ke.envName)return null;let mt=F.get(Ke.envName);if(!mt)return null;return Ds(mt,q,F,te,ne,we,!0)}function Ds(M,F,q,te,ne,we,Ke=!1){if(Ke&&/[$`*?[\]]/.test(M))return bn(ne);let mt=Go(M,F,te.environment.paths,te.budget),gt=mt?te.literalHeredocFiles?.get(mt):void 0;if(gt===void 0)return Ke?bn(ne):null;return te.budget.charge("derivedTokens",1),ne?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:gt,depth:we+1}),te.analyzeNested(gt,{effectiveCwd:F,envAssignments:q})}function Fx(M){let F=M[0];return M.length>=2&&(F==='"'||F==="'")&&M.at(-1)===F?M.slice(1,-1):M}function Gx(M,F,q){let te={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[M.head];if(!te)return;if(M.options.trace?.recordSegment({type:"rule-check",rule:te,matched:!!F||!!q,reason:F?.reason??q?.originalReason}),q)M.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:q.originalReason,gitCwd:q.gitCwd})}function Km(M){if(M.iterations>=n.wrapperPeelIterations.cap)throw new a("wrapperPeelIterations");M.iterations++}function mn(M){return{reason:M.reason,ruleId:M.id||void 0,intent:M.intent}}function bn(M){return M?.recordSegment({type:"error",message:Zm}),mn(zx())}function zx(){return{id:"",reason:Zm,intent:"stop_and_explain"}}function Qm(M,F){return en.has(F)||M==="$SHELL"||M==="${SHELL}"||en.has(Nt(F))}function qm(M,F){return M?.id.startsWith("custom.")||M?.id==="raw-text.dangerous-command"?M:Dt(M,F)}var Bx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,$x=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Ux(M,F){let q=np(M,F);if(q.length===0)return!1;let te=q[tp(q)];if(te==="cd"||te==="pushd"||te==="popd")return!0;return Bx.test(M.join(" "))}function ep(M,F,q,te){if(M.dialect==="powershell"){let mt=Hx(M.words,te);if(mt.kind==="none")return;if(!F||mt.kind==="unknown")return null;return Ym(qx(mt.target),F,q.paths)}let ne=M.words.map(t);if(!Ux(ne,q))return;if(!F)return null;let we=np(ne,q,F),Ke=tp(we);if(Ke===-1||we[Ke]!=="cd")return null;return Ym(we[Ke+1],F,q.paths)}function Ym(M,F,q){if(!M||M==="-"||M.includes("$")||M.includes("`"))return null;try{return Yx(lr(F,M,q),F,q)?F:null}catch{return null}}function Hx(M,F){let q=jx(M[0])?1:0,te=M[q];if(!Vx(te,q===1))return{kind:"none"};let ne=te.text.toLowerCase(),we=ne.split(/[\\/]/).pop()??ne;if(!$x.has(we))return{kind:"none"};if(ne!==we||we==="pop-location"||we==="popd")return{kind:"unknown"};return Kx(M.slice(q+1),F)}function jx(M){return M?.provenance==="literal"&&!M.quoted&&M.raw===M.text&&(M.text==="&"||M.text===".")}function Vx(M,F){return M?.provenance==="literal"&&(F||!M.quoted&&M.raw===M.text)}function Kx(M,F){let q;for(let te of M){if(te.provenance!=="literal"||q!==void 0)return{kind:"unknown"};q=te.text}if(q!==void 0)return{kind:"target",target:q};return F===void 0?{kind:"unknown"}:{kind:"target",target:F}}function qx(M){return M.includes("::")?void 0:M.replaceAll("\\","/")}function tp(M){let F=0;if(M[0]==="builtin"&&M.length>1)F=1;if(M[F]!=="time")return F;let q=F+1;while(M[q]?.startsWith("-"))q++;return q}function np(M,F,q){let te=Zx(M);return cr([...te],F,q)}function Yx(M,F,q){let te=q.realpath(M),ne=q.realpath(F);if(te===null||ne===null)return Ms(M)===Ms(F);return Ms(te)===Ms(ne)}function Zx(M){let F=0;while(F<M.length){let q=M[F];if(q!=="{"&&q!=="("&&q!=="$(")break;F++}return M.slice(F)}var Zl="TMPDIR",Xl="IFS",rp=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,op=/^[A-Za-z_][A-Za-z0-9_]*$/,ip=new Set(["export","typeset","declare","readonly"]),Xx=new Set(["builtin","command","time"]);function sp(M,F){return{env:M,effectiveEnvAssignments:n_(M,F),shellAssignments:new Map}}function ap(M){return{env:M.env,effectiveEnvAssignments:M.effectiveEnvAssignments?new Map(M.effectiveEnvAssignments):void 0,shellAssignments:new Map(M.shellAssignments)}}function Jl(M,F){let q=cp(M,F);q.assignments.filter((Ke)=>Ke.persists).forEach((Ke)=>{F.shellAssignments.set(Ke.name,Ke.value),Ql(F,Ke)});let te=q.commandIndex;if(te!==-1&&ip.has(M[te]??""))M.filter((Ke)=>op.test(Ke)&&Yl(Ke)).forEach((Ke)=>{r_(F,Ke)});let ne=te===-1?-1:up(M,te);if(ne===-1||M[ne]!=="unset")return;let we=i_(M,ne);if(we===null)return;M.slice(we).forEach((Ke)=>{o_(F,Ke)})}function lp(M,F){let q=cp(M,F).assignments;if(q.length===0)return F.effectiveEnvAssignments;let te=new Map(F.effectiveEnvAssignments??[]);return q.forEach((ne)=>{te.set(ne.name,ne.value)}),te}function cp(M,F){let q=M.findIndex((Ke)=>!Jx(Ke)),te=q!==-1&&ip.has(M[up(M,q)]??""),ne=t_(F);return{assignments:M.flatMap((Ke,mt)=>{let gt=Qx(Ke,ne,F.env);if(!gt)return[];if(q!==-1&&mt>q&&!te&&!ns(gt.name))return[];return ne.set(gt.name,gt.value),[{...gt,persists:q===-1||te}]}),commandIndex:q}}function up(M,F){let q=F;while(Xx.has(M[q]??"")){q+=1;while(M[q]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(M[q]??""))return F;q+=1}}return q}function Jx(M){return In(M)!==null||rp.test(M)}function Qx(M,F,q){return In(M)??e_(M,F,q)}function e_(M,F,q){let te=os(M,q,F);if(te)return te;let ne=M.match(rp)?.[1];if(!ne)return null;let we=M.indexOf("=");return{name:ne,value:`${F.has(ne)?F.get(ne):q.get(ne)??""}${M.slice(we+1)}`}}function Yl(M){return M===Zl||M===Xl||Qa(M)}function t_(M){return new Map([...M.effectiveEnvAssignments??[],...M.shellAssignments])}function n_(M,F){let q=[...ts,Zl,Xl].map((te)=>{let ne=M.get(te);return ne===void 0?null:[te,ne]}).filter((te)=>te!==null);if(q.length===0)return F;return new Map([...q,...F??[]])}function Ql(M,F){let q=new Map(M.effectiveEnvAssignments??[]);q.set(F.name,F.value),M.effectiveEnvAssignments=q}function r_(M,F){Ql(M,{name:F,value:M.shellAssignments.get(F)??M.effectiveEnvAssignments?.get(F)??M.env.get(F)??""})}function o_(M,F){if(!Yl(F)&&!op.test(F))return;if(M.shellAssignments.set(F,""),ns(F)&&M.env.has(F)){let te=new Map(M.env);te.delete(F),M.env=te}if(!Yl(F)||F===Zl||F===Xl||Eo(F)){Ql(M,{name:F,value:""});return}if(!M.effectiveEnvAssignments?.has(F))return;let q=new Map(M.effectiveEnvAssignments);q.delete(F),M.effectiveEnvAssignments=q.size===0?void 0:q}function i_(M,F){let q=F+1;while(q<M.length){let te=M[q];if(!te)return null;if(te==="--")return q+1;if(te==="-v"){q++;continue}if(te.startsWith("-"))return null;return q}return q}var s_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Hr="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function oc(M,F,q,te){if(F>=n.recursionDepth.cap)return q.trace?.recordSegment({type:"error",message:Un}),{reason:Un,segment:M,intent:"stop_and_explain"};let ne=te??q.factStore?.getCommandProgram(M,q.shell??"auto")??v(M,q.shell);if(ne.status==="limited")return q.trace?.recordSegment({type:"error",message:Un}),{reason:Un,segment:M,intent:"stop_and_explain"};if(ne.status==="invalid"){let ht=ne.issues.find((St)=>St.code.includes("heredoc"));if(ht){if(!q.strict)return rc(M,q);let St=`${hs}: ${ht.message}`;return q.trace?.recordGlobal({type:"error",message:St}),{reason:St,segment:M,intent:"stop_and_explain"}}return hp(M,q),{reason:fo,segment:M,intent:"stop_and_explain"}}if(q.strict&&ne.status==="partial")return hp(M,q),{reason:fo,segment:M,intent:"stop_and_explain"};if(ne.issues.some((ht)=>ht.code.includes("quote"))&&!q.analyzePartialProgram)return rc(M,q);let Ke=q.cwd,mt=q.effectiveCwd!==void 0?q.effectiveCwd:q.cwd,gt=sp(q.environment.env,q.envAssignments);return Ws(ne,F,{...q,rootProgram:ne},Ke,[{effectiveCwd:mt,shellGitContextState:gt,literalHeredocFiles:new Map(q.literalHeredocFiles),functionDefinitions:new Map(q.functionDefinitions)}]).result}function Ws(M,F,q,te,ne){let we=[...ne],Ke,mt;for(let[gt,ht]of M.nodes.entries()){if(ht.kind==="connector"){mt=ht.operator;continue}let St=M.nodes[gt+1],bt=St?.kind==="connector"?St.operator:void 0,yt=a_(M,gt,ht,mt,bt),Ct=mt==="&&"||mt==="||",vt=Ct?Ke:void 0,Rt=mt==="&&"?vt?.success??we:mt==="||"?vt?.failure??we:we,Et=mt==="||"?vt?.success??[]:[],xt=mt==="&&"?vt?.failure??[]:[],At=Ct||So(bt);if(ht.kind==="function"){let Xt=Rt.flatMap((Qt)=>{let Ut=li(Qt);return Ut.functionDefinitions.set(ht.name,ht.body),ec(Qt,[Ut],yt,bt==="&",So(bt))}),nn=tc(Xt,[],Et,xt,mt,bt);we=nn.states,Ke=nn.conditionalStates,mt=void 0;continue}if(ht.kind==="group"){let Xt=[],nn=[];for(let Ut of Rt){let Ft=Ws(ht.body,F,q,te,[li(Ut)]);if(Ft.result)return Ft;if(Xt.push(...ec(Ut,Ft.states,yt,bt==="&",So(bt))),At)nn.push(Ut,...yt?Ft.states.map((an)=>Ns(Ut,an)):Ft.states)}let Qt=tc(Xt,nn,Et,xt,mt,bt);we=Qt.states,Ke=Qt.conditionalStates,mt=void 0;continue}if(ht.kind!=="command")continue;let Tt=q.trace?.flattenNested?q.trace.currentSegmentIndex:q.trace?.allocateSegment(),Pt=M.nodes[gt-2],Ot=Fs(mt)&&Pt?.kind==="command"?cm(Pt)??c_(Pt):void 0,It=[],Mt=[];for(let Xt of Rt){let nn=u_(ht,F,q,te,[li(Xt)]);if(nn.result)return{result:nn.result,states:we};let Qt=M.dialect==="powershell"?nn.states:nn.states.map((Ut)=>Ns(Xt,Ut));for(let Ut of Qt){let Ft=li(Ut),an=m_(ht,F,q.trace?{...q,trace:yp(q.trace,Tt)}:q,te,Ft,Fs(mt),Ot);if(an)return{result:an,states:we};let wn=w_(ht,Ft.functionDefinitions);if(wn)q.budget.charge("derivedTokens",Gs(wn));let Kn=wn?F+1>=n.recursionDepth.cap?nc(ht.displayText,q,[Ft]):Ws(wn,F+1,q,te,[Ft]):{result:null,states:[Ft]};if(Kn.result)return Kn;if(It.push(...ec(Xt,Kn.states,yt,bt==="&",So(bt))),At)Mt.push(Xt),Mt.push(...Kn.states.map((On)=>yt?Ns(Xt,On):On))}}let Yt=tc(It,Mt,Et,xt,mt,bt);we=Yt.states,Ke=Yt.conditionalStates,mt=void 0}return{result:null,states:we}}function a_(M,F,q,te,ne){if(q.kind==="group"&&q.style==="subshell")return!0;if(M.dialect==="posix"&&(Fs(te)||Fs(ne)))return!0;if(ne==="&")return!0;return M.dialect==="powershell"&&q.kind==="group"&&q.style==="brace"&&l_(M,F)}function ec(M,F,q,te,ne){let we=q?F.map((mt)=>Ns(M,mt)):[...F],Ke=ne?we.flatMap((mt)=>yo(M.literalHeredocFiles,mt.literalHeredocFiles)?[mt]:[{...mt,literalHeredocFiles:new Map(M.literalHeredocFiles)},mt]):we;return te?[M,...Ke]:Ke}function Ns(M,F){return{...M,literalHeredocFiles:new Map(F.literalHeredocFiles)}}function l_(M,F){let q=[...M.nodes.slice(0,F)].reverse().find((ne)=>ne.kind==="command"||ne.kind==="connector");if(!q||q.kind!=="command")return!0;let te=q.words[0]?.text.toLowerCase();if(te==="&"||te===".")return!1;if(te==="write-output"||te==="function"||te==="start-job")return!0;if(d_(q))return!0;return q.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Fs(M){return M==="|"||M==="|&"}function c_(M){if(M?.dialect!=="powershell")return;if(M.words.length===1&&M.words[0]?.quoted&&M.words[0].provenance==="literal")return M.words[0].text;if(M.words[0]?.text.toLowerCase()==="write-output"&&M.words.length===2&&M.words[1]?.provenance==="literal")return M.words[1].text;return}function So(M){return M==="&&"||M==="||"}function tc(M,F,q,te,ne,we){let Ke={success:Ls([...q,...M]),failure:Ls([...te,...F])},mt=So(we)?Ke:void 0;return{states:So(ne)||mt?Ls([...Ke.success,...Ke.failure]):Ke.success,conditionalStates:mt}}function yp(M,F,q=M.flattenNested){return{currentSegmentIndex:F,flattenNested:q,allocateSegment:M.allocateSegment,getNextSegmentIndex:M.getNextSegmentIndex,recordGlobal:M.recordGlobal,recordSegment:(te,ne=F)=>M.recordSegment(te,ne)}}function u_(M,F,q,te,ne){let we=M.nested.map((Ke)=>({program:Ke,depth:F}));if(M.dialect==="powershell"){let Ke=f_(M);if(Ke){if(F+1>=n.recursionDepth.cap)return nc(Ke,q,ne);let mt=v(Ke,"powershell");if(mt.status==="limited")return nc(Ke,q,ne);if(mt.status!=="complete")return dp(we,q,te,ne);q.budget.charge("derivedTokens",Gs(mt)),we.push({program:mt,depth:F+1})}}return dp(we,q,te,ne)}function d_(M){let F=M.words[0];return F?.provenance==="variable"&&M.words.at(-1)?.text==="="?F.text.toLowerCase():void 0}function dp(M,F,q,te){let ne=[...te];for(let we of M){let Ke=[];for(let mt of ne){let gt=Ws(we.program,we.depth,F,q,[li(mt)]);if(gt.result)return gt;Ke.push(...gt.states)}ne=Ls(Ke)}return{result:null,states:ne}}function f_(M){let F=M.words[0]?.provenance==="literal"&&!M.words[0].quoted&&M.words[0].raw===M.words[0].text&&(M.words[0].text==="&"||M.words[0].text==="."),q=F?1:0,te=M.words[q];if(te?.provenance!=="literal"||!F&&(te.quoted||te.raw!==te.text)||!["iex","invoke-expression"].includes(te.text.toLowerCase()))return;let ne=M.words.slice(q+1),we=ne[0]&&!ne[0].quoted&&ne[0].raw===ne[0].text&&["-c","-command"].includes(ne[0].text.toLowerCase())?1:0,Ke=ne[we];return ne.length===we+1&&Ke?.quoted&&Ke.provenance==="literal"?Ke.text:void 0}function Gs(M){return M.nodes.reduce((F,q)=>F+(q.kind==="command"?q.words.length+q.nested.reduce((te,ne)=>te+Gs(ne),0):q.kind==="group"||q.kind==="function"?Gs(q.body):0),0)}function nc(M,F,q){return F.trace?.recordSegment({type:"error",message:Un}),{result:{reason:Un,segment:M,intent:"stop_and_explain"},states:[...q]}}function m_(M,F,q,te,ne,we,Ke){let mt={...q,environment:{...q.environment,env:ne.shellGitContextState.env}},gt=C_(M);if(gt&&mt.strict)return mt.trace?.recordSegment({type:"error",message:gt}),{reason:gt,segment:M.source,intent:"stop_and_explain"};Sp(M,ne,"before-consumer",mt.environment.paths,mt.budget);let ht=ee(M.dialect,M.words).map(t),St=M.displayText,bt=lp(ht,ne.shellGitContextState);if(M.dialect==="powershell"){let vt=Dt(wf(M,we,A_(mt,ne.effectiveCwd)),mt.policy);if(mt.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!vt,reason:vt?.reason}),vt)return P_(St,vt)}if(ht.length===1&&ht[0]?.includes(" ")&&!Oo(M.dialect,M.words)){let vt=Dt(Xn(ht[0],mt.scanWork),mt.policy),Rt=vt!==null&&!mt.strict&&Pd(M,mt.rootProgram,mt.scanWork);if(vt&&!Rt)return mt.trace?.recordSegment({type:"dangerous-text",token:ht[0],matched:!0,reason:vt.reason}),{reason:vt.reason,segment:St,ruleId:vt.id,intent:vt.intent};mt.trace?.recordSegment({type:"dangerous-text",token:ht[0],matched:!1});let Et=fp(M,gt,ne,bt,Ke,mt);if(Et)return Et;return Jl(ht,ne.shellGitContextState),null}let yt=go(M.words,F,{...mt,commandView:M,cwd:te,effectiveCwd:ne.effectiveCwd,envAssignments:bt,literalHeredocFiles:ne.literalHeredocFiles,functionDefinitions:ne.functionDefinitions,hasPipelineInput:we,literalShellInput:Ke,analyzeNested:(vt,Rt)=>{let Et=Rt&&Object.hasOwn(Rt,"effectiveCwd")?Rt.effectiveCwd:ne.effectiveCwd,xt=oc(vt,F+1,{...mt,effectiveCwd:Et,envAssignments:Rt?.envAssignments??bt,literalHeredocFiles:ne.literalHeredocFiles,functionDefinitions:Rt?.functionDefinitions,worktreeMode:Rt?.worktreeMode??mt.worktreeMode,trace:mt.trace?yp(mt.trace,mt.trace.currentSegmentIndex,!0):void 0});return xt?{reason:xt.reason,ruleId:xt.ruleId,intent:xt.intent}:null}});if(yt)return{...yt,segment:St};let Ct=fp(M,gt,ne,bt,Ke,mt);if(Ct)return Ct;return Jl(ht,ne.shellGitContextState),null}function fp(M,F,q,te,ne,we){let Ke=v_(M,F,q,te??new Map,we);if(Ke)return Ke;return Sp(M,q,"after-consumer",we.environment.paths,we.budget),q.literalHeredocFiles.clear(),h_(M,F,q,we.environment.paths,we.budget),x_(M,q,ne,we.environment,we.trace),null}var p_=new Set([">>","<>"]);function Sp(M,F,q,te,ne){for(let Ke of M.redirections){if(!(q==="before-consumer"?g_(Ke):p_.has(Ke.operator)))continue;mp(Ke.target,F,te,ne)}if(q!=="before-consumer"||!_n(M.words[0],"tee"))return;let we=bp(M.words.slice(1));if(!we)return;for(let Ke of we.operands)mp(Ke,F,te,ne)}function g_(M){if(M.operator===">"||M.operator===">|")return!0;return M.operator===">&"&&M.fd===void 0&&M.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(M.target.text)}function mp(M,F,q,te){let ne=M?.provenance==="literal"?Go(M.text,F.effectiveCwd,q,te):void 0;if(!ne)return;F.literalHeredocFiles.delete(ne)}function h_(M,F,q,te,ne){if(F)return;let we=M.redirections.find((Ke)=>Ke.operator==="<<"||Ke.operator==="<<-")?.heredoc;if(!we||!zs(we))return;for(let Ke of y_(M)){let mt=Go(Ke.text,q.effectiveCwd,te,ne);if(!mt||!Id(mt))continue;if(!q.literalHeredocFiles.has(mt)&&q.literalHeredocFiles.size>=n.trackedHeredocFiles.cap)throw new a("trackedHeredocFiles");q.literalHeredocFiles.set(mt,we.body)}}function y_(M){let F=b_(M.redirections)?.target,q=pp(F)?[F]:[];if(_n(M.words[0],"cat"))return S_(M.words)?q:[];if(!_n(M.words[0],"tee"))return[];let te=bp(M.words.slice(1));if(!te||te.append||te.hasUnsupportedOptions||!te.operands.every(pp))return[];return[...te.operands,...q]}function S_(M){let F=!1;for(let q of M.slice(1)){if(F||q.provenance!=="literal")return!1;if(q.text==="--"){F=!0;continue}if(!/^-u+$/.test(q.text))return!1}return!0}function b_(M){let F=M.findLast((q)=>(q.fd??([">",">|",">>",">&"].includes(q.operator)?1:0))===1);return F?.operator===">"||F?.operator===">|"?F:void 0}function bp(M){let F=[],q=!0,te=!1,ne=!1;for(let we of M){if(we.provenance!=="literal")return;if(q&&_n(we,"--")){q=!1;continue}if(q&&!we.quoted&&we.raw===we.text&&/^-[^-]/.test(we.text)){te||=we.text.slice(1).includes("a"),ne||=[...we.text.slice(1)].some((Ke)=>Ke!=="a"&&Ke!=="i");continue}if(q&&!we.quoted&&we.raw===we.text&&we.text.startsWith("--")){te||=we.text==="--append",ne||=we.text!=="--append"&&we.text!=="--ignore-interrupts";continue}F.push(we)}return{operands:F,append:te,hasUnsupportedOptions:ne}}function pp(M){if(!M||M.provenance!=="literal"||M.text.length===0)return!1;if(M.quoted||M.raw!==M.text)return!0;return!M.raw.startsWith("~")&&!/[{}]/.test(M.raw)}function _n(M,F){return M?.text===F&&M.raw===F&&M.provenance==="literal"&&!M.quoted}function zs(M){return M.quotedDelimiter||!/[$`\\]/.test(M.body)}function C_(M){let F=M.redirections.filter((Ke)=>Ke.operator==="<<"||Ke.operator==="<<-");if(F.length===0)return;if(F.length!==1)return Hr;let q=F[0];if(!q?.heredoc)return Hr;if(!zs(q.heredoc))return s_;if(q.fd!==void 0&&q.fd!==0)return Hr;if(M.redirections.some((Ke)=>Ke!==q&&["<","<<","<<-","<<<","<&","<>"].includes(Ke.operator)))return Hr;let te=M.redirections.some((Ke)=>Ke!==q&&gp(Ke.target));if(_n(M.words[0],"cat"))return te?Hr:void 0;if(_n(M.words[0],"tee"))return te||M.words.slice(1).some(gp)?Hr:void 0;let ne=M.words[0],we=M.words[1];if(_n(ne,"git")&&(_n(we,"apply")||_n(we,"commit")))return;if(_n(ne,"gh")&&(_n(we,"pr")||_n(we,"issue"))&&_n(M.words[2],"create"))return;return Hr}function gp(M){return M?.parts.some((F)=>F.provenance==="command-substitution"&&F.raw.startsWith(">("))??!1}function v_(M,F,q,te,ne){if(!F)return null;let we=M.redirections.filter((ht)=>ht.operator==="<<"||ht.operator==="<<-"),Ke=we.flatMap((ht)=>ht.heredoc?[ht.heredoc.body]:[]);if(R_(M,we,q,te,ne))return null;let mt=E_(M,we,ne);if(mt!==void 0)return mt?{reason:mt.reason,segment:M.displayText,ruleId:mt.id,intent:mt.intent}:null;let gt=rc(Ke.length===we.length?Ke.join(`
-`):M.source,ne);return gt?{...gt,segment:M.displayText}:null}function E_(M,F,q){let te=F.length===1?F[0]:void 0;if(!te?.heredoc||!zs(te.heredoc)||te.fd!==void 0&&te.fd!==0)return;let ne=M.words[0];if(ne?.provenance!=="literal"||!Dn(ne.text))return;if(!M.words.slice(1).every((ht)=>ht.provenance==="literal"&&ht.text.startsWith("-")))return;let Ke=te.heredoc.body,mt=tn(q.policy,"interpreter.one-liner-paranoid",!!q.paranoidInterpreters);if(q.trace?.recordSegment({type:"interpreter",interpreter:ne.text,codeArg:Ke,paranoidBlocked:mt}),mt){let ht=Dt(_t("interpreter.one-liner-paranoid",zo),q.policy);if(ht)return ht}if(!Bo(Ke,q.scanWork))return null;let gt=Dt(_t("interpreter.dangerous-command",ao),q.policy);if(!gt)return null;return q.trace?.recordSegment({type:"dangerous-text",token:Ke,matched:!0,reason:gt.reason}),gt}function R_(M,F,q,te,ne){let we=F.length===1?F[0]:void 0;if(!we?.heredoc||!zs(we.heredoc)||we.fd!==void 0&&we.fd!==0)return!1;let Ke=kr(M.words,ne.environment,q.effectiveCwd,te),mt=Ke.words.map(t),gt=zt(mt[0]??"");if((Ke.envSplitValues?.length??0)>0||!en.has(gt)&&!en.has(Nt(gt)))return!1;return tr(mt)}function x_(M,F,q,te,ne){let we=ep(M,F.effectiveCwd,te,q);if(we===null)ne?.recordSegment({type:"cwd-change",segment:M.words.map(t).join(" "),effectiveCwdNowUnknown:!0});if(we!==void 0)F.effectiveCwd=we}function li(M){return{effectiveCwd:M.effectiveCwd,shellGitContextState:ap(M.shellGitContextState),literalHeredocFiles:new Map(M.literalHeredocFiles),functionDefinitions:new Map(M.functionDefinitions)}}function Ls(M){let F=[];for(let q of M){if(!F.some((te)=>__(te,q)))F.push(q);if(F.length>n.controlFlowStates.cap)throw new a("controlFlowStates")}return F}function __(M,F){return M.effectiveCwd===F.effectiveCwd&&yo(M.shellGitContextState.env,F.shellGitContextState.env)&&yo(M.literalHeredocFiles,F.literalHeredocFiles)&&yo(M.functionDefinitions,F.functionDefinitions)&&yo(M.shellGitContextState.effectiveEnvAssignments,F.shellGitContextState.effectiveEnvAssignments)&&yo(M.shellGitContextState.shellAssignments,F.shellGitContextState.shellAssignments)}function yo(M,F){if(M===F)return!0;if(!M||!F||M.size!==F.size)return!1;return[...M].every(([q,te])=>F.get(q)===te&&F.has(q))}function w_(M,F){let q=Mo(M);return q===void 0?void 0:F.get(q)}function P_(M,F){if(!F)return null;return{reason:F.reason,segment:M,ruleId:F.id,intent:F.intent}}function A_(M,F=M.effectiveCwd){let q=F===null;return{environment:M.environment,cwd:q?void 0:F??M.cwd,originalCwd:q?void 0:M.cwd,strict:M.strict,paranoid:M.paranoidRm,allowTmpdirVar:M.allowTmpdirVar,protectedGitMetadata:M.protectedGitMetadata,policy:M.policy,budget:M.budget}}function rc(M,F){let q=Dt(Xn(M,F.scanWork),F.policy),te=F.trace?.currentSegmentIndex??F.trace?.allocateSegment(),ne={type:"dangerous-text",token:M,matched:!!q,reason:q?.reason};if(F.trace?.recordSegment(ne,te),!q&&/^(?:cd|pushd)\s/.test(M))F.trace?.recordSegment({type:"cwd-change",segment:M,effectiveCwdNowUnknown:!0},te);return q?{reason:q.reason,segment:M,ruleId:q.id,intent:q.intent}:null}function hp(M,F){let q={type:"strict-unparseable",rawCommand:M,reason:fo},te=F.trace?.currentSegmentIndex;if(te===void 0)F.trace?.recordGlobal(q);if(te!==void 0)F.trace?.recordSegment(q)}var T_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape","parallelChildAnalyses","parallelDerivedTokens","parallelDerivedBytes","parallelPlaceholderReplacements"]);function Cp(M,F,q,te){let ne=oc(M,0,{...F,...ze(F),budget:F.budget??Cn(),factStore:te},q);if(!ne)return null;return{kind:"deny",reason:ne.reason,intent:ne.intent??"manual_only",...ne.ruleId?{ruleId:ne.ruleId}:{},evidence:[{kind:"command",command:M,segment:ne.segment}]}}function vp(M,F,q){try{return{decision:M()}}catch(te){let ne=I_(te,F,q);if(!ne)throw te;return ne}}function I_(M,F,q){if(!(M instanceof a)||!T_.has(M.kind))return null;let te=n[M.kind];if(q?.currentSegmentIndex!==void 0)q.recordSegment({type:"error",message:te.reason});if(q?.currentSegmentIndex===void 0)q?.recordGlobal({type:"error",message:te.reason});return{decision:{kind:"deny",reason:te.reason,intent:"stop_and_explain",evidence:[{kind:"command",command:F,segment:F}]},errorCode:te.errorCode}}var k_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),sc=new Set(["cc-safety-net","ccsn"]),O_=new Set(["bunx","npx","pnpx"]),M_=new Set(["pnpm","yarn"]),D_=new Set(["npm","pnpm","yarn"]),N_=new Set(["bun","node"]);function $s(M,F,q={}){if(sc.has(M))return 0;if(O_.has(M)){if(q.broad)return ic(F);let ne=F[0]==="-y"||F[0]==="--yes"?1:0;return Bs(F[ne])?ne+1:null}let te=q.broad?F.findIndex((ne)=>!ne.startsWith("-")):0;if(te!==-1&&D_.has(M)&&q.broad&&F[te]==="exec"){let ne=ic(F.slice(te+1));return ne===null?null:te+1+ne}if(M_.has(M)){if(M==="yarn"&&!q.broad)return null;if(!q.broad)return F[0]==="dlx"&&Bs(F[1])?2:null;if(te===-1||F[te]!=="dlx")return null;let ne=ic(F.slice(te+1));return ne===null?null:te+1+ne}if(N_.has(M)){let ne=q.broad&&te!==-1?te:0;if(Ep(F[ne]))return ne+1;if(M==="bun"&&F[ne]==="run"&&Ep(F[ne+1]))return ne+2}return null}function ic(M){let F=M.findIndex((te)=>Bs(te));if(F===-1)return null;let q=F;while(q<M.length){let te=M[q]??"";if(!te.startsWith("-")&&!Bs(te))break;q++}return q}function Bs(M){if(!M)return!1;let F=M.indexOf("@");if(F===-1)return sc.has(M);if(F===0)return!1;let q=M.slice(F+1);if(q===""||q.includes("/")||q.includes(":"))return!1;return sc.has(M.slice(0,F))}function Ep(M){let F=M?.replaceAll("\\","/");return[...k_].some((q)=>F===q||F?.endsWith(`/${q}`))}var Ve="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Rp(M,F,q){let te=dn(M,"input-candidate");if(!te)return null;let ne=co(te.shell,M.invocation.context.executionCwd,F,q,{findSegmentTarget:(we)=>L_(we,F),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return ne?{target:ne}:null}function L_(M,F){let q=cr([...M],F),te=q.slice(1),ne=$s(Nt(q[0]??"").toLowerCase(),te,{broad:!0});if(ne===null)return null;let we=te.slice(ne).filter((Ke)=>Ke!=="-g"&&Ke!=="--global");return we[0]==="policy"&&we[1]==="apply"?q.join(" "):null}import{dirname as Us}from"node:path";var qe="This path contains the protected policy config and you must not modify or delete it.",W_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Pp(M,F,q){let te=U_(M.invocation.context,F,q);if(M.invocation.route.kind==="patch")return xp(M.paths,!1,M.invocation.context.executionCwd,te,F,q);let ne=dn(M,"input-candidate");if(M.invocation.route.kind==="command")return ne?_p(ne.shell,M.invocation.context.executionCwd,te,F,q):null;if(M.invocation.route.kind==="unknown"&&ne){let we=_p(ne.shell,M.invocation.context.executionCwd,te,F,q);if(we)return we}return xp(M.paths,M.invocation.route.kind==="grep"||M.invocation.route.kind==="glob"||vi(M.invocation.toolName),M.invocation.context.executionCwd,te,F,q)}function xp(M,F,q,te,ne,we){if(F)return null;let Ke=M.find((mt)=>ci(mt,q,te,ne,we));return Ke?{target:Ke}:null}function _p(M,F,q,te,ne){let we=co(M,F,te,ne,{findSegmentTarget:(Ke,mt)=>F_(Ke,mt,q,te,ne)?.target??null,isRedirectionTarget:(Ke,mt)=>ci(Ke,mt.cwd,q,te,ne),findMalformedTarget:(Ke)=>$_(Ke,F,q,te,ne)?.target??null});return we?{target:we}:null}function F_(M,F,q,te,ne){if(Vo(M))return null;let we=ur([...M],te),Ke=Nt(we[0]??"").toLowerCase(),mt=we.slice(1);if(Ke==="rm"&&G_(mt)){let gt=z_(mt).find((ht)=>wp(hn(ht,F.variables),F.cwd,q,te,ne));if(gt)return{target:gt}}if(Ke==="find"){if(Es(we,1)||vl(we,te)){let ht=(vs(Zt(we))??Zt(["."])).find((St)=>{let bt=hn(St.text,F.variables);return ci(bt,F.cwd,q,te,ne)||wp(bt,F.cwd,q,te,ne)})?.text;if(ht)return{target:ht}}}if(Ke==="mv"){let gt=ds(mt).sources.find((ht)=>H_(hn(ht,F.variables),F.cwd,q,te,ne));if(gt)return{target:gt}}if(B_(M,te))return null;for(let gt of[...M,...we])for(let ht of Ap(gt))if(ci(hn(ht,F.variables),F.cwd,q,te,ne))return{target:ht};return null}function G_(M){return M.some((F)=>F==="--recursive"||F.startsWith("-")&&!F.startsWith("--")&&/[rR]/.test(F.slice(1)))}function z_(M){let F=M.indexOf("--");if(F!==-1)return[...M.slice(0,F).filter((q)=>!q.startsWith("-")),...M.slice(F+1)];return M.filter((q)=>!q.startsWith("-"))}function B_(M,F){let q=ur([...M],F);if(q.length===0)return!1;let te=Nt(q[0]??"").toLowerCase();if(!W_.has(te))return!1;if(te!=="sed")return!0;return!q.slice(1).some((ne)=>ne.startsWith("-i")||ne==="--in-place"||ne.startsWith("--in-place="))}function $_(M,F,q,te,ne){for(let we of M.split(/\s+/))for(let Ke of Ap(we))if(ci(Ke,F,q,te,ne))return{target:Ke};return null}function Ap(M){let F=M.trim().replace(/^['"]|['"]$/g,""),q=F.indexOf("=");return q===-1||q===F.length-1?[F]:[F,F.slice(q+1)]}function U_(M,F,q){let te=(mt)=>ui(ln(mt,M.executionCwd,F,q)),ne=te(d(F)),we=[te(w(M.executionCwd)),te(w(M.configCwd))],Ke=new Set(we.map((mt)=>Us(mt)));for(let mt=Us(ne);;mt=Us(mt))if(Ke.add(mt),Us(mt)===mt)break;return{files:new Set([ne,...we]),directoriesAndAncestors:Ke}}function ci(M,F,q,te,ne){let we=_c(M,F,te,ne,(Ke)=>ui(Ke)===wi);return we!==null&&q.files.has(ui(we))}function wp(M,F,q,te,ne){return q.directoriesAndAncestors.has(ui(ln(M,F,te,ne)))}function H_(M,F,q,te,ne){let we=ui(ln(M,F,te,ne));return q.files.has(we)||q.directoriesAndAncestors.has(we)}function ui(M){return process.platform==="win32"?M.toLowerCase():M}import{isAbsolute as Hs,posix as j_,resolve as Vs,win32 as V_}from"node:path";import{fileURLToPath as K_}from"node:url";var Gp="Access to a sensitive path is not allowed.",zp=new Set(["echo","printf"]),q_=new Set(["find"]),Y_=new Set(["-exec","-execdir"]),Z_=new Set([";","+"]),X_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),J_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Bp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Q_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),ew=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),$p=new Set(["-c","-e","-r","-E","--eval","--exec"]),tw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),nw=new Set(["grep","rg"]),Tp=new Set(["jq","gojq","jaq"]),Ip="f",kp="file",rw="files",ow=new Set(["e","f"]),iw=new Set(["regexp","file"]),sw=new Set(["e","f","A","B","C","m"]),aw=new Set(["regexp","file","after-context","before-context","context","max-count"]),ac="__CC_SAFETY_NET_PIPE_INPUT__",cc=/[\w./~@+-]*[./~][\w./~@+-]*/g,lw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,cw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,uw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,dw=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,fw=/\b(?:system|exec)\s*$/,mw=/\b(?:eval|exec)\s*\(/g,pw=/\b(?:eval|exec)\s*$/,gw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Op(M,F,q,te,ne,we){for(let Ke of M){let mt=Ke.target;if(fP(mt,Ke.cwd,F?.denyPaths??[],q,te,ne))return{target:mt,ruleId:"secret.deny-path"};if(we&&!we.has(mt))continue;let gt=uP(mt,Ke.cwd,F,te,ne);if(gt){if(!gt.startsWith("secret.cli.")&&mP(mt,Ke.cwd,F?.allowPaths??[],q,te,ne))continue;return{target:mt,ruleId:gt}}}return null}function Up(M,F,q,te,ne={}){let we=Mp(M,q,te),Ke=Op(we,F,M.invocation.context.configCwd,q,te),mt=Ke?.ruleId!=="secret.deny-path"&&ne.strict===!1?Mp(M,q,te,{refineInlineData:!0}):we,gt=mt.length===we.length?Ke:Op(we,F,M.invocation.context.configCwd,q,te,new Set(mt.map((ht)=>ht.target)));if(gt?.ruleId!=="secret.deny-path"&&ne.strict===!1&&hw(M,q))return null;return gt}function hw(M,F){let q=dn(M,"input-candidate")??dn(M,"declared-command");if(!q)return!1;if(q.program.nodes.some((mt)=>mt.kind==="command"&&mt.nested.length>0))return!1;let te=[];for(let mt of us(q.shell)){if(mt.kind==="operator"&&mt.boundary)return!1;if(mt.kind==="redirection")return!1;if(mt.kind==="operator")continue;te.push(Jn(mt.text,F))}let ne=yr(te);if(ne.length===0)return!1;let we=ir(ne[0]??"").toLowerCase(),Ke=ne.slice(1);if(M.invocation.route.kind==="unknown")return q.program.dialect==="powershell"&&(we==="ls"||we==="stat");if(we==="ls"||we==="stat")return!0;if(we==="test")return Ke.length===2&&(Ke[0]==="-e"||Ke[0]==="-f");if(we!=="find")return!1;return!Ke.some((mt)=>X_.has(mt))}function Mp(M,F,q,te={}){let ne=M.invocation.context.executionCwd;if(M.invocation.route.kind==="command"){let Ke=dn(M,"input-candidate");return Ke?jr(Ke.shell,M.store,te,F,ne,q,Dp(Ke)):[]}if(M.invocation.route.kind!=="unknown")return M.paths.map((Ke)=>({target:Ke,cwd:ne}));let we=dn(M,"input-candidate");return[...we?jr(we.shell,M.store,te,F,ne,q,Dp(we)):[],...M.paths.map((Ke)=>({target:Ke,cwd:ne}))]}function Dp(M){return M.program.dialect==="powershell"}function jr(M,F,q,te,ne,we,Ke=!1){if(M.status==="structural-limit")throw new b;if(M.status==="unclosed-quote")return[];if(M.status==="invalid")throw Error("Unable to parse command for secret protection");let mt=[...M.assignmentFallbacks.map((ht)=>({target:ht,cwd:ne})),...Vw(Jn(M.source,te),F,q,te,ne,we)],gt=(ht)=>Jn(Pw(ht,Ke),te);return cs(M,ne,te,we,{word:gt,segment:(ht,St,bt,yt,Ct)=>{if(ht.length===0)return null;if(mt.push(...Ks(ht,F,q,te,St.cwd,we,Ct)),bt!==null)mt.push(...Sw(bt,ht,F,q,te,St.cwd,we));return null},redirection:(ht,St)=>{if(ht.body!==void 0&&ht.consumer!==void 0)mt.push(...Hp(ht.consumer,[ht.body],F,q,te,St.cwd,we,(bt)=>bw(ht.consumer??[],bt,F,q,te,St.cwd,we)));if(ht.targetOrder==="legacy-segment")return rl;return mt.push({target:gt(ht.target),cwd:St.cwd}),null}}),mt}function uc(M,F,q,te,ne,we){let Ke=F.getShellSyntax(M);if(Ke.status==="structural-limit")throw new b;return Ke.status==="complete"?jr(Ke,F,q,te,ne,we):null}function Ks(M,F,q,te,ne,we,Ke){let mt=(vt)=>({target:vt,cwd:ne});if(Ke?.size){let vt=M.filter((Rt,Et)=>!Ke.has(Et));if(Tp.has(ir(yr(vt)[0]??"").toLowerCase()))return[...M.filter((Rt,Et)=>Ke.has(Et)).map(mt),...Ks(vt,F,q,te,ne,we)]}let gt=ww(M).map(mt),ht=yr(M);if(ht.length===0)return gt;let St=ht[0]??"",bt=ir(St).toLowerCase(),yt=ht.slice(1),Ct=yw(St,bt,yt);if(Ct)return[...gt,...Ct.map(mt)];if(zp.has(bt))return q.capturedOutput===!0?[...gt,...jp(M).map(mt)]:gt;if(bt==="eval")return[...gt,...uc(yt.join(" "),F,q,te,ne,we)??yt.map(mt)];if(bt==="export")return[...gt,...yt.flatMap((vt)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(vt)?[vt.slice(vt.indexOf("=")+1)]:or(bt,vt)).map(mt)];if(bt==="git")return[...gt,...Tw(yt).map(mt)];if(Tp.has(bt))return[...gt,...Aw(yt).map(mt)];if(nw.has(bt))return[...gt,...eP(yt).map(mt)];if(q_.has(bt))return[...gt,...Mw(yt,F,q,te,ne,we).map(mt)];if(An.has(bt))return[...gt,...yt.flatMap((vt)=>or("awk",vt)).map(mt),...yt.flatMap((vt)=>Nw(vt,F,q,te,ne,we)),...yt.flatMap(Lw).map(mt)];if(bt==="curl")return[...gt,...yt.flatMap((vt)=>or(bt,vt)).map(mt),...Iw(yt).map(mt)];if(Ko(bt)){let vt=jo.has(bt)?bu(bt,yt):null;if(vt!==null){let Rt=F.getShellSyntax(vt);if(Rt.status==="structural-limit")throw new b;if(Rt.status==="complete")return[...gt,...jr(Rt,F,q,te,ne,we),...yt.slice(yt.indexOf(vt)+1).filter((Et)=>!Et.startsWith("-")).map(mt)]}return[...gt,...Dw(bt,yt,F,q,te,ne,we)]}return[...gt,...yt.flatMap((vt)=>or(bt,vt)).map(mt)]}function yw(M,F,q){let te=$s(F,q);if(te===null||q[te]!=="explain")return null;let ne=[M,...q.slice(0,te)],we=q.slice(te+1);for(let Ke=0;Ke<we.length;Ke++){let mt=we[Ke];if(mt==="--json"||mt==="--help"||mt==="-h")continue;if(mt==="--cwd"){let gt=we[Ke+1];if(gt&&!gt.startsWith("--"))ne.push(gt);Ke++;continue}return ne}return ne}function Sw(M,F,q,te,ne,we,Ke){if(Rw(F,q,te,ne,we,Ke))return jp(M).map((mt)=>({target:mt,cwd:we}));return Hp(F,Cw(M),q,te,ne,we,Ke,()=>[])}function bw(M,F,q,te,ne,we,Ke){let mt=yr(M);if(!Ko(ir(mt[0]??"").toLowerCase()))return[];return uc(F,q,te,ne,we,Ke)??[{target:F,cwd:we}]}function Hp(M,F,q,te,ne,we,Ke,mt){let gt=xw(M);if(gt===null)return F.flatMap(mt);return F.flatMap((ht)=>jo.has(gt)?jr(q.getShellSyntax(ht),q,te,ne,we,Ke):js(gt,ht,q,te,ne,we,Ke))}function jp(M){let F=yr(M);if(F.length===0)return[];let q=ir(F[0]??"").toLowerCase();if(!zp.has(q))return[];let te=F[F[1]==="--"?2:1];if(q==="printf"&&te!==void 0&&!te.startsWith("-")&&!te.replaceAll("%%","").includes("%"))return[dc(te.replaceAll("%%","%"))];return F.slice(1)}function Cw(M){let F=yr(M);if(F.length===0)return[];let q=ir(F[0]??"").toLowerCase(),te=F.slice(1);if(q==="echo"){let ne=te.findIndex((we)=>!/^-[neE]+$/.test(we));return[(ne===-1?[]:te.slice(ne)).join(" ")]}if(q==="printf")return vw(te);return[]}function vw(M){let F=M[0];if(F===void 0)return[];let q=(F.match(/%%|%[bqs]/g)??[]).filter((ne)=>ne!=="%%").length;if(q===0||M.length===1)return[dc(F)];let te=M.slice(1);return Array.from({length:Math.ceil(te.length/q)},(ne,we)=>Ew(F,te.slice(we*q,(we+1)*q)))}function Ew(M,F){let q=0;return dc(M.replace(/%%|%[bqs]/g,(te)=>{if(te==="%%")return"%";let ne=F[q]??"";return q++,ne}))}function dc(M){return M.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Rw(M,F,q,te,ne,we){let Ke=yr(M);if(Ke.length===0||ir(Ke[0]??"").toLowerCase()!=="xargs")return!1;let mt=Gr(Ke),gt=Ke.slice(mt.childStart);if(gt.length===0)return!1;if(mt.replacementToken==="")return!1;let ht=mt.replacementToken,St=ht===null?[...gt,ac]:gt.map((bt)=>bt.split(ht).join(ac));return Ks(St,F,q,te,ne,we).some((bt)=>bt.target.includes(ac))}function xw(M){let F=yr(M);if(F.length===0)return null;let q=ir(F[0]??"").toLowerCase();if(!Ko(q))return null;return _w(q,F.slice(1))?q:null}function _w(M,F){let q=fc(M);for(let te=0;te<F.length;te++){let ne=F[te];if(ne===void 0)break;if($p.has(ne)||Vp(M,ne)||/^--(?:eval|exec)=/.test(ne))return!1;if(ne==="-")return!0;if(ne.startsWith("-")){if(q==="python"&&ne==="-m")return!1;if(gw.get(q)?.has(ne))te++;continue}return!1}return!0}function fc(M){return/^python\d/.test(M)?"python":M}function ww(M){let F=[];for(let q of M){if(qp(q))continue;let te=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(q);if(te===null)break;if(te[1]!==void 0&&te[1]!=="")F.push(te[1])}return F}var Np=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function Pw(M,F){if(!F||!Np.test(M))return M;return`~${M.replace(Np,"").replace(/\\/g,"/")}`}function or(M,F){if(F==="--")return[];let q=[],te=F.indexOf("=");if(te>0&&te<F.length-1)q.push(F.slice(te+1));if(F.startsWith("-"))return q;if(M==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(F))return q;if(M==="zip"&&/\.zip$/i.test(F))return q;return q.push(F),q}function Aw(M){let F=-1,q=!1;for(let te=0;te<M.length;te++){let ne=M[te]??"";if(!q&&ne==="--"){q=!0;continue}if(q||!/^-(?:[A-Za-z]|-)/.test(ne)){if(F===-1)F=te;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(ne)){te+=2;continue}if(ne==="--indent"||ne==="-L"){te++;continue}if(ne.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(ne)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(ne))continue;return M.flatMap((we)=>or("jq",we))}return M.flatMap((te,ne)=>ne===F?[]:or("jq",te))}function Tw(M){let F=[];for(let q=0;q<M.length;q++){let te=M[q]??"";if(te==="--"||!te.startsWith("-"))return[...F,...M.slice(q).flatMap((we)=>or("git",we))];if(F.push(...or("git",te)),!un.has(te))continue;let ne=M[q+1];if(ne===void 0)break;F.push(...te==="-c"&&ne.includes("=")?[ne.slice(ne.indexOf("=")+1)]:or("git",ne)),q++}return F}function Iw(M){return M.flatMap((F,q)=>{let te=Ow(F);if(te!==null)return Lp(te.flag,te.value);let ne=kw(M[q-1]);return ne===null?[]:Lp(ne,F)})}function Lp(M,F){if(M==="-F"||M==="--form"){let q=F.indexOf("="),te=q===-1?F:F.slice(q+1);if(!te.startsWith("@")&&!te.startsWith("<"))return[];return lc(te.slice(1).split(";")[0]??"")}if(M==="--data-urlencode"){let q=F.indexOf("@"),te=F.indexOf("=");if(q===-1||te!==-1&&te<q)return[];return lc(F.slice(q+1))}return F.startsWith("@")?lc(F.slice(1)):[]}function kw(M){if(M===void 0)return null;if(Bp.has(M))return M;return/^-[A-Za-z]+[dF]$/.test(M)?`-${M.slice(-1)}`:null}function Ow(M){let F=M.slice(0,2);if(M.length>2&&(F==="-d"||F==="-F"))return{flag:F,value:M.slice(2)};let q=M.indexOf("=");if(q===-1)return null;let te=M.slice(0,q);return Bp.has(te)?{flag:te,value:M.slice(q+1)}:null}function lc(M){return M===""||M==="-"?[]:[M]}function Mw(M,F,q,te,ne,we){let Ke=M.findIndex((gt)=>gt.startsWith("-")||gt==="("||gt==="!"||gt===";"),mt=[...M.slice(0,Ke===-1?M.length:Ke)];for(let gt=0;gt<M.length;gt++){if(!Y_.has(M[gt]??""))continue;let ht=M.slice(gt+1),St=ht.findIndex((Ct)=>Z_.has(Ct)),bt=St===-1?ht:ht.slice(0,St),yt=Ks(bt,F,q,te,ne,we).map((Ct)=>Ct.target);if(mt.push(...yt.filter((Ct)=>Ct!=="{}")),!yt.includes("{}"))continue;mt.push(...M.slice(0,gt).flatMap((Ct,vt,Rt)=>{if(!J_.has(Ct))return[];let Et=Rt[vt+1];return Et===void 0?[]:[Et,Et.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return mt}function Dw(M,F,q,te,ne,we,Ke){let mt=[];for(let gt=0;gt<F.length;gt++){let ht=F[gt];if(ht===void 0)break;if($p.has(ht)||Vp(M,ht)){let bt=F[gt+1];if(bt!==void 0)mt.push(...js(M,bt,q,te,ne,we,Ke)),gt++;continue}let St=/^--(?:eval|exec)=(.*)$/.exec(ht);if(St!==null&&St[1]!==void 0){mt.push(...js(M,St[1],q,te,ne,we,Ke));continue}if(!ht.startsWith("-"))mt.push({target:ht,cwd:we})}return mt}function Vp(M,F){if(!F.startsWith("-")||F.startsWith("--")||F.length<=2)return!1;return tw.get(F[F.length-1]??"")?.has(fc(M))??!1}function Nw(M,F,q,te,ne,we){if(!M.includes("system"))return[];return yl(M)?.commands.flatMap((Ke)=>jr(F.getShellSyntax(Ke),F,q,te,ne,we))??[]}function Lw(M){return Array.from(M.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((F)=>F[1]).filter((F)=>F!==void 0&&F!=="")}function Ww(M){let F=Array.from(M.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((te)=>te[2]).filter((te)=>te!==void 0&&te!==""),q=(M.match(cc)??[]).filter((te)=>te!=="process.versions.sqlite"||F.some((ne)=>ne.includes(te)));return[...F,...F.flatMap(mc),...q]}function js(M,F,q,te,ne,we,Ke){let mt=(Ct)=>({target:Ct,cwd:we}),gt=Gw(F,Fw(M));if(gt===null)return Ww(F).map(mt);let ht=gt.masked.match(dw)!==null||gt.literals.some((Ct)=>fw.test(gt.masked.slice(0,Ct.start))),St=gt.masked.match(mw)!==null||gt.literals.some((Ct)=>pw.test(gt.masked.slice(0,Ct.start))),bt=te.refineInlineData===!0&&!jo.has(M),yt=bt&&!(Uw(gt.masked)||ht||St)?[]:gt.literals;return[...yt.map((Ct)=>Ct.text).filter((Ct)=>Ct!=="").map(mt),...yt.flatMap((Ct)=>mc(Ct.text)).map(mt),...bt?[]:gt.literals.flatMap((Ct)=>Ct.text.match(cc)??[]).filter((Ct)=>Ct!=="process.versions.sqlite").map(mt),...ht?gt.literals.flatMap((Ct)=>uc(Ct.text,q,te,ne,we,Ke)??[mt(Ct.text)]):[],...St?gt.literals.flatMap((Ct)=>js(M,Ct.text.replace(/\\(.)/g,(vt,Rt)=>Rt==="n"?`
-`:Rt),q,te,ne,we,Ke)):[],...(gt.masked.match(cc)??[]).filter((Ct)=>Ct!=="process.versions.sqlite").map(mt)]}function Fw(M){let F=fc(M);if(F==="python")return"python";if(F==="osascript")return"opaque";return F==="node"||F==="bun"||F==="deno"?"javascript":"simple"}function Gw(M,F){if(F==="opaque")return null;let q=M.split(""),te=[];for(let ne=0;ne<M.length;ne++){let we=M[ne]??"";if(F==="simple"&&(we==="`"||we==="%"||we==="<")){if(cw.test(M.slice(ne)))return null}let Ke=we==="'"||we==='"'||F==="javascript"&&we==="`"?we:null;if(Ke===null)continue;if(Ke==="`"&&$w(M,ne))return null;let mt=F==="python"?zw(M,ne):"",gt=F==="python"&&M.startsWith(Ke.repeat(3),ne)?Ke.repeat(3):Ke,ht=ne+gt.length,St=Bw(M,ht,gt);if(St===null)return null;let bt=M.slice(ht,St);if(/[fF]/.test(mt)&&bt.includes("{"))return null;if(F==="simple"&&Ke==='"'&&uw.test(bt))return null;te.push({start:ht,text:bt});for(let yt=ne;yt<St+gt.length;yt++)q[yt]=" ";ne=St+gt.length-1}return{masked:q.join(""),literals:te}}function zw(M,F){return lw.exec(M.slice(Math.max(0,F-3),F))?.[1]??""}function Bw(M,F,q){let te=q==="`",ne=te||q.length===3;for(let we=F;we<M.length;we++){let Ke=M[we];if(Ke==="\\"){we++;continue}if(te&&Ke==="$"&&M[we+1]==="{")return null;if(!ne&&(Ke===`
-`||Ke==="\r"))return null;if(M.startsWith(q,we))return we}return null}function $w(M,F){for(let q=F-1;q>=0;q--){let te=M[q];if(!te||/\s/.test(te))continue;return/[\w$\])]/.test(te)}return!1}function Uw(M){for(let F of M.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let q=F[0],te=F.index;if(Q_.has(q.toLowerCase()))return!0;let ne=q.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((we)=>we.toLowerCase());if(!ne.some((we)=>ew.has(we)))continue;if(ne.length>1)return!0;if(Hw(M,te)===".")return!0;if(jw(M,te+q.length)==="(")return!0}return!1}function Hw(M,F){for(let q=F-1;q>=0;q--)if(!/\s/.test(M[q]??""))return M[q];return}function jw(M,F){for(let q=F;q<M.length;q++)if(!/\s/.test(M[q]??""))return M[q];return}function Vw(M,F,q,te,ne,we){return Xw(M).flatMap((Ke)=>{let mt=F.getShellSyntax(Ke);if(mt.status==="invalid")return[];return[...jr(mt,F,{...q,capturedOutput:!0},te,ne,we),...Kw(mt,te)?qw(mt,te).map((gt)=>({target:gt,cwd:ne})):[]]})}function Kw(M,F){let q=us(M);for(let te=0;te<q.length;te++){let ne=q[te];if(ne?.kind!=="word"||ir(Jn(ne.text,F)).toLowerCase()!=="base64")continue;for(let we=te+1;we<q.length;we++){let Ke=q[we];if(Ke?.kind==="operator")break;if(Ke?.kind!=="word")continue;let mt=Jn(Ke.text,F);if(mt==="--decode"||!mt.startsWith("--")&&mt.startsWith("-")&&/[dD]/.test(mt))return!0}}return!1}function qw(M,F){return us(M).flatMap((q)=>q.kind==="word"?[Jn(q.text,F)]:q.kind==="redirection"&&q.target?[Jn(q.target,F)]:[]).flatMap(mc)}function mc(M){let F=Zw(M);if(F===null)return[];let q=Buffer.from(F,"base64").toString("utf8");if(q===""||Yw(q))return[];return Buffer.from(q,"utf8").toString("base64").replace(/=+$/g,"")===F.replace(/=+$/g,"")?[q]:[]}function Yw(M){return Array.from(M).some((F)=>{let q=F.charCodeAt(0);return q<32||q===127})}function Zw(M){if(M.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(M))return null;if(/=/.test(M.replace(/=+$/g,"")))return null;let F=M.replace(/=+$/g,"");if(F.length%4===1)return null;return`${F.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-F.length%4)%4)}`}function Xw(M){let F=[],q={inSingle:!1,inDouble:!1,escaped:!1};for(let te=0;te<M.length;te++){let ne=M[te];if(!ne)break;if(Ao(ne,q))continue;if(Kp(M,te,q)){let we=Jw(M,te+1);if(we!==null)F.push(we.body),te=we.endIndex;continue}if(!q.inSingle&&ne==="`"){let we=Qw(M,te);if(we!==null)F.push(we.body),te=we.endIndex}}return F}function Jw(M,F){let q={inSingle:!1,inDouble:!1,escaped:!1},te=1;for(let ne=F+1;ne<M.length;ne++){let we=M[ne];if(!we)break;if(Ao(we,q))continue;if(Kp(M,ne,q)){te++,ne++;continue}if(!q.inSingle&&!q.inDouble&&we===")"){if(te--,te===0)return{body:M.slice(F+1,ne),endIndex:ne}}}return null}function Qw(M,F){let q=!1;for(let te=F+1;te<M.length;te++){let ne=M[te];if(!ne)break;if(q){q=!1;continue}if(ne==="\\"){q=!0;continue}if(ne==="`")return{body:M.slice(F+1,te),endIndex:te}}return null}function Kp(M,F,q){return!q.inSingle&&M[F]==="$"&&M[F+1]==="("&&M[F+2]!=="("}function eP(M){let F=[],q=[],te=!1,ne=!1,we=!1;for(let gt=0;gt<M.length;gt++){let ht=M[gt];if(ht===void 0)break;if(!we&&ht==="--"){we=!0;continue}if(we){q.push(ht);continue}let St=/^--([^=]+)(?:=(.*))?$/.exec(ht);if(St!==null){let bt=St[1]??"",yt=St[2];if(bt===rw)ne=!0;if(iw.has(bt))te=!0;if(yt!==void 0){if(bt===kp)F.push(yt);continue}if(aw.has(bt)){let Ct=M[gt+1];if(bt===kp&&Ct!==void 0)F.push(Ct);gt++}continue}if(ht.startsWith("-")&&ht.length>1){let bt=ht.slice(1),yt="",Ct="";for(let Rt=0;Rt<bt.length;Rt++){let Et=bt[Rt]??"";if(ow.has(Et))te=!0;if(sw.has(Et)){yt=Et,Ct=bt.slice(Rt+1);break}}if(yt==="")continue;if(Ct.length>0){if(yt===Ip)F.push(Ct);continue}let vt=M[gt+1];if(yt===Ip&&vt!==void 0)F.push(vt);gt++;continue}q.push(ht)}let mt=!te&&!ne?q.slice(1):q;return[...F,...mt]}function yr(M){let F=M.findIndex((q)=>!qp(q)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(q));return F===-1?[]:[...M.slice(F)]}function qp(M){return M==="env"||M==="command"||M==="builtin"||M==="sudo"}var tP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),nP=".env.",rP=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),oP=[".env.example.",".env.sample."];function iP(M){let F;try{F=new URL(M.trim())}catch{return!1}return F.protocol!=="file:"&&F.host!==""}function sP(M){return M.length>0&&!/\s/.test(M)}function aP(M,F,q,te){try{let ne=mi(M,F,q,te);return ne!==""&&q.paths.entryKind(ne)!=="missing"}catch(ne){if(ne instanceof a)throw ne;return!1}}var lP=new Set(["node_modules","__pycache__"]),cP=[["vendor","bundle"],["vendor","cache"]];function uP(M,F,q,te,ne){if(iP(M))return null;let we=Vn(M,F,te,ne);if(!we)return null;let Ke=Vt(we.split("/").pop()??""),mt=Vt(we),gt=()=>sP(Ke)||aP(M,F,te,ne);if(rP.has(Ke)||oP.some((yt)=>Ke.startsWith(yt)))return null;let ht=Vt(hP(M,F,te,ne));for(let yt of Ca){let Ct=`~/${yt.suffixParts.join("/")}`;if((Fp(mt,Ct)||Fp(ht,Ct))&&rr(yt.id,q))return yt.id}let St=dP(we,F,q,te,ne);if(St)return St;if(tP.has(Ke))return null;for(let yt of ba)if(Ke===yt.basename&&rr(yt.id,q))return yt.id;if(Ke.startsWith(nP)&&rr(ki.id,q)&&gt())return ki.id;for(let yt of va)if(Ke.length>yt.prefix.length&&Ke.startsWith(yt.prefix)){let Ct=Ke.slice(yt.prefix.length)[0];if((Ct==="-"||Ct==="_")&&rr(yt.id,q)&&gt())return yt.id}for(let yt of Ea)if(Ke.length>yt.prefix.length&&Ke.startsWith(yt.prefix)){if(Ke.slice(yt.prefix.length)===yt.suffix&&rr(yt.id,q))return yt.id}if(pP(mt))return null;if(!Ke.includes(".")&&To.pattern.test(Ke)&&rr(To.id,q))return To.id;let bt=gP(Ke,q);if(bt)return bt;return null}function dP(M,F,q,te,ne){return Oi.find((we)=>{if(!rr(we.id,q))return!1;switch(we.id){case"secret.cli.claude-code":return Bt(M,jt(te.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",F,te,ne),[".credentials.json"]);case"secret.cli.claude-code.config":{let Ke=Vt(M).split("/");return Bt(M,jt(te.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",F,te,ne),["settings.json","settings.local.json"])||fi(M,"~/.claude.json",F,te,ne)||Ke.at(-1)==="settings.local.json"&&Ke.at(-2)===".claude"||Ke.at(-1)===".mcp.json"}case"secret.cli.antigravity":return Bt(M,Vn("~/.gemini/config",F,te,ne),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let Ke=jt(te.env.get("CODEX_HOME"),"~/.codex",F,te,ne);return Bt(M,Ke,["auth.json",".credentials.json"])||di(M,Ke,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let Ke=jt(te.env.get("CODEX_HOME"),"~/.codex",F,te,ne),mt=Vt(M).split("/").at(-1)??"";return Bt(M,Ke,["config.toml"])||mt.endsWith(".config.toml")&&Bt(M,Ke,[mt])}case"secret.cli.gemini":return Bt(M,cn(jt(te.env.get("GEMINI_CLI_HOME"),"~",F,te,ne),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let Ke=Vt(M).split("/"),mt=te.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),gt=te.env.get("ProgramData")?[cn(jt(te.env.get("ProgramData"),"",F,te,ne),"gemini-cli")]:[];return Bt(M,cn(jt(te.env.get("GEMINI_CLI_HOME"),"~",F,te,ne),".gemini"),["settings.json","google_accounts.json"])||Ke.at(-1)==="settings.json"&&Ke.at(-2)===".gemini"||(mt?.trim()?fi(M,mt,F,te,ne):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...gt].some((ht)=>Bt(M,Vn(ht,F,te,ne),["settings.json"]))}case"secret.cli.copilot-cli":{let Ke=jt(te.env.get("COPILOT_HOME"),"~/.copilot",F,te,ne);return Bt(M,Ke,["config.json"])||di(M,Ke,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return Bt(M,jt(te.env.get("COPILOT_HOME"),"~/.copilot",F,te,ne),["mcp-config.json"]);case"secret.cli.kimi-code":{let Ke=jt(te.env.get("KIMI_CODE_HOME"),"~/.kimi-code",F,te,ne),mt=jt(te.env.get("KIMI_SHARE_DIR"),"~/.kimi",F,te,ne);return Bt(M,Ke,["server.token"])||di(M,Ke,["credentials"])||di(M,mt,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let Ke=["config.toml","mcp.json"],mt=Vt(M).split("/");return mt.at(-1)==="mcp.json"&&mt.at(-2)===".kimi-code"||Bt(M,jt(te.env.get("KIMI_CODE_HOME"),"~/.kimi-code",F,te,ne),Ke)||Bt(M,jt(te.env.get("KIMI_SHARE_DIR"),"~/.kimi",F,te,ne),[...Ke,"config.json","config.json.bak"])}case"secret.cli.opencode":{let Ke=cn(jt(te.env.get("XDG_DATA_HOME"),"~/.local/share",F,te,ne),"opencode"),mt=Vt(M).split("/").at(-1)??"",gt=te.env.get("OPENCODE_DB")?.trim(),ht=gt&&gt!==":memory:"?[gt,`${gt}-wal`,`${gt}-shm`]:[];return Bt(M,Ke,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(mt)&&Bt(M,Ke,[mt])||ht.some((St)=>fi(M,St,F,te,ne))}case"secret.cli.opencode.config":{let Ke=te.env.get("OPENCODE_CONFIG_DIR")?jt(te.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",F,te,ne):cn(jt(te.env.get("XDG_CONFIG_HOME"),"~/.config",F,te,ne),"opencode"),mt=te.env.get("ProgramData")?[cn(jt(te.env.get("ProgramData"),"",F,te,ne),"opencode")]:[],gt=["opencode.json","opencode.jsonc"],ht=te.env.get("OPENCODE_CONFIG");return gt.includes(Vt(M).split("/").at(-1)??"")||Bt(M,Ke,gt)||(ht?.trim()?fi(M,ht,F,te,ne):!1)||["/Library/Application Support/opencode","/etc/opencode",...mt].some((St)=>Bt(M,Vn(St,F,te,ne),gt))}case"secret.cli.pi":return Bt(M,jt(te.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",F,te,ne),["auth.json"]);case"secret.cli.pi.config":return Bt(M,jt(te.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",F,te,ne),["models.json"]);case"secret.cli.amp":{let Ke=Vn("~",F,te,ne);return[cn(jt(te.env.get("XDG_DATA_HOME"),"~/.local/share",F,te,ne),"amp"),cn(Ke,".local","share","amp")].some((gt)=>Bt(M,gt,["secrets.json"]))||di(M,cn(Ke,".amp"),["oauth"])}case"secret.cli.amp.config":{let Ke=["settings.json","settings.jsonc"],mt=[cn(jt(te.env.get("XDG_CONFIG_HOME"),"~/.config",F,te,ne),"amp"),cn(Vn("~",F,te,ne),".config","amp")],gt=Vt(M).split("/"),ht=te.env.get("AMP_SETTINGS_FILE");return mt.some((St)=>Bt(M,St,Ke))||gt.at(-2)===".amp"&&Ke.includes(gt.at(-1)??"")||(ht?.trim()?fi(M,ht,F,te,ne):!1)}case"secret.cli.cursor":{let Ke=cn(jt(te.env.get("XDG_CONFIG_HOME"),"~/.config",F,te,ne),"cursor"),mt=cn(jt(te.env.get("CURSOR_DATA_DIR"),"~/.cursor",F,te,ne),"projects");return Bt(M,Vn("~/.cursor",F,te,ne),["auth.json"])||Bt(M,Ke,["auth.json"])||Vt(M).split("/").at(-1)==="mcp-auth.json"&&Vr(Vt(M),Vt(mt))}case"secret.cli.cursor.config":{let Ke=Vt(M).split("/");return Ke.at(-1)==="mcp.json"&&Ke.at(-2)===".cursor"}case"secret.cli.grok-build":return Bt(M,jt(te.env.get("GROK_HOME"),"~/.grok",F,te,ne),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let Ke=Vt(M).split("/");return Ke.at(-1)==="config.toml"&&Ke.at(-2)===".grok"||Bt(M,jt(te.env.get("GROK_HOME"),"~/.grok",F,te,ne),["config.toml","managed_config.toml","requirements.toml"])||Bt(M,Vn("/etc/grok",F,te,ne),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Wp=new WeakMap;function jt(M,F,q,te,ne){let we=Wp.get(ne)??new Map;Wp.set(ne,we);let Ke=`${q}\x00${M??""}\x00${F}`,mt=we.get(Ke);if(mt!==void 0)return mt;let gt=Vn(M?.trim()?M:F,q,te,ne);return we.set(Ke,gt),gt}function Bt(M,F,q){return q.some((te)=>Yp(M,cn(F,te)))}function di(M,F,q){return q.some((te)=>Vr(Vt(M),Vt(cn(F,te))))}function fi(M,F,q,te,ne){return Yp(M,Vn(F,q,te,ne))}function Yp(M,F){return Vt(M)===Vt(F)}function cn(M,...F){return $n([M,...F].filter(Boolean).join("/"))}function fP(M,F,q,te,ne,we){if(q.length===0)return!1;let Ke=Vt(mi(M,F,ne,we));return q.some((mt)=>Vr(Ke,Vt(mi(mt,te,ne,we))))}function mP(M,F,q,te,ne,we){if(q.length===0)return!1;let Ke=Vt(mi(M,F,ne,we));if(!Ke)return!1;let mt=ne.env.get("HOME")??ne.home,gt=mt?$n(Ht(vn(mt),ne.paths,we)):"",ht=Vt(gt),St=ne.env.get("CC_SAFETY_NET_HOME"),bt=Vt(St?$n(Ht(Vs(vn(St)),ne.paths,we)):gt&&$n(Ht(`${gt}/.cc-safety-net`,ne.paths,we)));if(bt&&Vr(Ke,bt))return!1;return q.some((yt)=>{let Ct=Vt(mi(yt,te,ne,we));if(!Ct)return!1;if(ht&&(ht===Ct||ht.startsWith(Ct.endsWith("/")?Ct:`${Ct}/`)))return!1;return Vr(Ke,Ct)})}function pP(M){let F=M.split("/");return F.some((q)=>lP.has(q))||cP.some(([q,te])=>F.some((ne,we)=>ne===q&&F[we+1]===te))}function gP(M,F){let q=M.lastIndexOf("."),te=q>0&&q<M.length-1?M.slice(q+1):"";if(te==="")return null;for(let ne of Ra)if(te===ne.extension&&rr(ne.id,F))return ne.id;for(let ne of xa)if(ne.pattern.test(te)&&rr(ne.id,F))return ne.id;return null}function Vt(M){return M.toLowerCase()}function rr(M,F){return!F?.disabledRules?.includes(M)}function Vn(M,F,q,te){let{home:ne,normalized:we}=pc(M,q,te);if(!we)return"";if(!ne)return we;let Ke=gc(we,ne),mt=Hs(Ke)?Ke:$n(Vs(F,Ke)),gt=$n(Ht(mt,q.paths,te));if(!Vr(gt,ne)){if(Hs(Ke))return gt;return gt===mt?we:gt}let ht=gt.slice(ne.length);return ht?`~${ht}`:"~"}function Fp(M,F){return M===F||M.startsWith(`${F}/`)}function hP(M,F,q,te){let{home:ne,normalized:we}=pc(M,q,te);if(!we||!ne)return"";let Ke=gc(we,ne),mt=j_.normalize(Hs(Ke)?Ke:$n(Vs(F,Ke))),gt=$n(vn(q.env.get("HOME")??q.home)),ht=(yt)=>process.platform==="win32"?yt.toLowerCase():yt,St=[ne,gt].find((yt)=>yt!==""&&Vr(ht(mt),ht(yt)));if(St===void 0)return"";let bt=mt.slice(St.length);return bt?`~${bt}`:"~"}function mi(M,F,q,te){let{home:ne,normalized:we}=pc(M,q,te);if(!we)return"";let Ke=ne?gc(we,ne):we;return $n(Ht(Hs(Ke)?Ke:Vs(F,Ke),q.paths,te))}function pc(M,F,q){let te=F.env.get("HOME")??F.home,ne=te?$n(Ht(vn(te),F.paths,q)):"",we=$n(vn(yP(Jn(M,F))));return{home:ne,normalized:we}}function yP(M){if(!M.trim().toLowerCase().startsWith("file:"))return M;try{return K_(M)}catch{return M}}function gc(M,F){if(M==="~")return F;if(M.startsWith("~/"))return cn(F,M.slice(2));return M}function SP(M){if(process.platform==="win32")return!0;return V_.parse(M).root.length>1}function $n(M){let F=M.trim(),q=(F.includes("\\")&&SP(F)?F.replace(/\\/g,"/"):F).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(q==="/")return q;return q.replace(/\/+$/g,"")}function Vr(M,F){return M===F||M.startsWith(F.endsWith("/")?F:`${F}/`)}function ir(M){return M.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??M}class p extends Error{stage;evaluation;name="GuardEvaluationError";constructor(M,F,q){super(`CC Safety Net ${M} dependency failed`,{cause:q});this.stage=M;this.evaluation=F}}var bP={findPolicyMutation:Pp,findGitMetadataMutation:af,resolveGitMetadata:CP,loadPolicySnapshot:k,findSensitiveTarget:Up,analyzeCommand:Cp,getModes:P};function V(M,F){let q={...bP,...F.dependencies},te=RP(M),ne=pi(M)?M.command:te,we=Sr("policy-protection",ne,()=>qo(M,F.factParserDependencies)),Ke=dn(we,"input-candidate"),mt=dn(we,"declared-command");if(pi(M)&&M.command?.trim()&&mt?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Un,intent:"stop_and_explain",evidence:[{kind:"command",command:M.command,segment:M.command}]}};if(Ke?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Pf,intent:"stop_and_explain",evidence:[]}};let gt=Cn(),ht=Sr("policy-protection",ne,()=>q.resolveGitMetadata([M.context.executionCwd,M.context.configCwd],F.environment)),St=Sr("policy-protection",ne,()=>q.findPolicyMutation(we,F.environment,gt));if(St){let Tt=ne??St.target;return{stage:"policy-protection",decision:{kind:"deny",reason:qe,intent:"hard_stop",evidence:[{kind:"command",command:Tt,segment:St.target}]}}}let bt=Sr("policy-protection",ne,()=>Rp(we,F.environment,gt));if(bt){let Tt=ne??bt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ve,intent:"hard_stop",evidence:[{kind:"command",command:Tt,segment:bt.target}]}}}let yt=Sr("policy-protection",ne,()=>q.findGitMetadataMutation(we,ht,F.environment,gt));if(yt){let Tt=ne??yt.target;return{stage:"policy-protection",decision:{kind:"deny",reason:C,intent:"hard_stop",evidence:[{kind:"command",command:Tt,segment:yt.target}]}}}let Ct=Sr("config-load",ne,()=>q.loadPolicySnapshot(F.environment,{...F.policyOptions,cwd:M.context.configCwd})),vt=Ct.policy,Rt=q.getModes(vt,F.environment.env),Et={level:Rt.effectiveLevel,...vP(Ct)},xt=vt.secretProtection.enabled===!1?null:Sr("secret-protection",ne,()=>q.findSensitiveTarget(we,vt.secretProtection,F.environment,gt,{strict:pi(M)||Ke?.program.dialect==="powershell"?Rt.strict:void 0}));if(xt){let Tt=ne??xt.target;return{stage:"secret-protection",...Et,decision:{kind:"deny",reason:Gp,intent:"hard_stop",ruleId:xt.ruleId,evidence:[{kind:"command",command:Tt,segment:xt.target}]}}}if(!pi(M))return{stage:"non-command",...Et,decision:{kind:"allow"}};if(!M.command||M.command.trim()==="")return{...hc("command-validation",ne),...Et};let At=Sr("command-analysis",ne,()=>vp(()=>q.analyzeCommand(M.command,{cwd:M.context.executionCwd,shell:M.route.shell,policySnapshot:Ct,environment:F.environment,protectedGitMetadata:ht,effectiveCapabilities:Rt.capabilities,strict:Rt.strict,paranoidRm:Rt.paranoidRm,paranoidInterpreters:Rt.paranoidInterpreters,worktreeMode:Rt.worktreeMode,budget:gt,...F.trace?{trace:F.trace}:{}},EP(we),we.store),M.command,F.trace));if(At.decision)return{stage:"command-analysis",...Et,..."errorCode"in At?{errorCode:At.errorCode}:{},decision:At.decision};return{stage:"command-analysis",...Et,decision:{kind:"allow"}}}function CP(M,F){let q=[...new Set(M.filter((te)=>typeof te==="string"&&te!==""))].flatMap((te)=>F.gitMetadata(te)??[]);if(q.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(q.flatMap((te)=>te.entries))]),markerFiles:Object.freeze([...new Set(q.flatMap((te)=>te.markerFiles))]),directories:Object.freeze([...new Set(q.flatMap((te)=>te.directories))]),hooksDirectories:Object.freeze([...new Set(q.flatMap((te)=>te.hooksDirectories))])})}function vP(M){if(M.state==="ready")return{};return{configFallback:{reason:M.reason}}}function EP(M){return dn(M,"declared-command")?.program}function RP(M){try{return oe(M.input)}catch(F){let q=pi(M)?M.command:void 0;throw new p("policy-protection",hc("policy-protection",F instanceof f?void 0:q,F),F)}}function Sr(M,F,q){try{return q()}catch(te){throw new p(M,hc(M,te instanceof f?void 0:F,te),te)}}function hc(M,F,q){let te=q instanceof a||q instanceof b;return{stage:M,decision:{kind:"deny",reason:te?Js:re,intent:"stop_and_explain",evidence:F?[{kind:"command",command:F,segment:F}]:[]}}}function pi(M){return M.route.kind==="command"}
-export{re,n,a,K,Oe,Ye,R,ot,Je,Ce,j,Se,it,l,i,Ze,xe,P,_,Le,st,f,ce,oe,de,at,Xe,u,Ne,o,S,s,D,r,y,ue,G,lt,ct,c,pe,fe,dt,O,Y,ie,x,ut,A,w,me,T,d,H,Qe,et,N,L,I,J,ge,Me,pt,m,e,g,$e,ke,tt,nt,se,Ee,ae,Fe,Z,W,Re,je,he,Pe,U,rt,_e,Ae,Te,Ie,ye,ve,B,X,Q,le,h,z,Ge,He,We,Ue,k,Be,De,ze,v,t,ee,be,b,C,E,ft,Ve,qe,p,V};