cc-safety-net 2.4.1 → 2.4.3

package/dist/amp/cc-safety-net/index.ts

@@ -1,52 +1,49 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.1
+// version: 2.4.3
 // @bun
-var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",In="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ci={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},bp={errorCode:"structural-shell-syntax-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},xt={errorCode:"tool-input-limit",reason:"CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user."},Tn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},Pr={errorCode:"structural-shell-syntax-limit",reason:"Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry."},P=Object.freeze({realpathAttempts:{cap:16384,...Ci},processedCandidateBytes:{cap:4194304,...Ci},pathEnvironmentExpansion:{cap:64,...Ci},structuralShellSyntax:bp,recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Tn},trackedHeredocFiles:{cap:64,...Tn},controlFlowStates:{cap:64,...Tn},wrapperPeelIterations:{cap:20,...Tn},derivedCommandShape:Tn,parallelChildAnalyses:{cap:1024,...Pr},parallelDerivedTokens:{cap:16384,...Pr},parallelDerivedBytes:{cap:1048576,...Pr},parallelPlaceholderReplacements:{cap:16384,...Pr},hookInputBytes:{cap:8388608,errorCode:"tool-input-limit",reason:"Failed to parse hook input JSON."},toolInputDepth:{cap:64,...xt},toolInputNodes:{cap:1e4,...xt},toolInputKeys:{cap:1e4,...xt},toolInputStringBytes:{cap:1048576,...xt},toolInputAggregateStringBytes:{cap:4194304,...xt},toolInputGitDiffCandidates:{cap:64,...xt},toolInputShape:xt});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(P[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>P[t].cap)throw new F(t)}}}var vp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ct(e){return Ep(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ep(e){return vp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Rp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function xp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,Rp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var mi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Rn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var di={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},En={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...di},processedCandidateBytes:{cap:4194304,...di},pathEnvironmentExpansion:{cap:64,...di},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...En},trackedHeredocFiles:{cap:64,...En},controlFlowStates:{cap:64,...En},wrapperPeelIterations:{cap:20,...En},derivedCommandShape:En});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var sp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function at(e){return ap(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ap(e){return sp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var lp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function cp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,lp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function dl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function Tr(e={}){return{reason:In,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function ml(e){return xp({...e,redact:ct})}function fl(e){return ct(e instanceof Error?e.message:String(e))}import{lstatSync as cg,realpathSync as ug,statSync as dg}from"fs";import{homedir as mg,tmpdir as fg}from"os";import{statSync as sg}from"fs";import{join as ag}from"path";import{basename as hl,dirname as _p,isAbsolute as wp,join as Ap,normalize as Pp,resolve as pl}from"path";var Tp=256,Ir=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ze(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function xi(e,t){return vi(e,0,t)}function vi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ei(e,o+2),a=Ip(e,o,t);if(a===null){if(Ir.has(s))throw new F("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=kp(l,t,n),o=a+1;continue}let i=Ei(e,o+1);if(!i){r+="$",o++;continue}r+=Ri(i,n)??`$${i}`,o+=i.length+1}return r}function Ip(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>P.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function kp(e,t,n){let r=e.slice(2,-1),o=Ei(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ri(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ir.has(o))throw new F("pathEnvironmentExpansion");return e}if(!Ir.has(o))return e;if(s.endsWith("="))throw new F("pathEnvironmentExpansion");let a=Ri(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new F("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":vi(i.slice(s.length),t+1,n);return l?vi(i.slice(s.length),t+1,n):""}function Ei(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ri(e,t){if(!Ir.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function B(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){yl(n,i);let s=t.realpath(i);if(s!==null)return gl(n,e,s,o);let a=_p(i);if(a===i||o.length>=Tp)return gl(n,e,i,o);o.push(hl(i)),i=a}}function gl(e,t,n,r){let o=r.length===0?n:Ap(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Op(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;yl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function yl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=Cl(e,t,n);if(!o)return"";return B(o,n.paths,r).replace(/\\/g,"/")}function Sl(e,t,n,r,o){let i=Cl(e,t,n);if(!i)return null;if(o(hl(i)))return B(i,n.paths,r).replace(/\\/g,"/");let s=Op(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Cl(e,t,n){let r=n.home,o=xi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?pl(r,o.slice(2)):o,s=be(i);return Pp(wp(s)?s:pl(t,s))}import{spawnSync as Mp}from"child_process";import{existsSync as nn,lstatSync as Dp,readFileSync as wt,realpathSync as tn,statSync as kn}from"fs";import{dirname as kr,isAbsolute as On,join as _t,resolve as rn}from"path";var Np=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Lp=5000;function vl(e,t=Qp(),n=Lp){let r=Wp(e);if(r===null||!Fp(r))return null;let o=Xp(r,t,n);return o===null?null:{recursiveSubmodules:o}}function Wp(e){try{let t=tn(rn(e));return kn(t).isDirectory()?t:null}catch{return null}}function Fp(e){let t=Zp(e);if(!t)return!1;try{let n=Dp(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=_i(t);if(!r?.commonDir)return!1;if(!Bp(r.gitDir,t))return!1;return $p(r.gitDir,kr(t))}catch{return!1}}function _i(e){try{let t=Gp(e);if(!t)return null;let n=tn(On(t)?t:rn(kr(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:zp(n)}}catch{return null}}function Gp(e){let t=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function zp(e){try{let t=wt(_t(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=tn(On(t)?t:rn(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Bp(e,t){let n=Up(e);return n===null?!1:El(e,n,t)}function $p(e,t){let n=Hp(e);return n===null?!0:El(e,n,t)}function Up(e){let t=_t(e,"gitdir");if(!nn(t))return null;let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Hp(e){let t=_t(e,"config.worktree");return nn(t)?Vp(t):null}function El(e,t,n){try{return jp(On(t)?t:rn(e,t),n)}catch{return!1}}function jp(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return bl(tn.native(e))===bl(tn.native(t))}function bl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Vp(e){let t=wt(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Kp(s[1]??"")}return r}function Kp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Yp(t.slice(1,-1))}var qp={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Yp(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:qp[n]??t)}function Zp(e){try{return Or(tn(e))}catch{return null}}function Or(e){let t=e;while(!0){let n=_t(t,".git");if(nn(n))return n;let r=kr(t);if(r===t)return null;t=r}}function Xp(e,t,n){let r=Jp(e);if(r===null||r)return!0;if(t===null)return!0;let o=Mp(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:eg(process.env),stdio:["ignore","pipe","ignore"],timeout:n});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Rl(o.stdout.trim())}function Jp(e){let t=tg(e);if(t===null)return null;return t.filter((n)=>nn(n)).some((n)=>og(n))}function Qp(){return Np.find((e)=>nn(e))??null}function Mn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function eg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Mn(t)))}function tg(e){let t=Or(e);if(t===null)return null;let n=ng(t);if(n===null)return null;let r=rg(n);if(r===null)return null;return[_t(r,"config"),_t(n,"config.worktree")]}function ng(e){try{let n=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return On(r)?r:rn(kr(e),r)}catch{return null}}function rg(e){let t=_t(e,"commondir");if(!nn(t))return e;try{let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return On(n)?n:rn(e,n)}catch{return null}}function og(e){let t;try{t=wt(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(ig(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Rl(c)}return r}function ig(e){return e==="include"||e.startsWith("includeif ")}function Rl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function xl(e,t){if(e==="")return null;let n=Ce(),r=Or(ie(e,e,t,n)),o=r?lg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function lg(e,t,n,r){try{let o=ie(e,t,n,r),i=sg(e),s=i.isFile()?o:null,a=i.isFile()?_i(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[on(ie(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[on(e.replace(/\\/g,"/")),...l]:l)];return{entry:on(o),markerFile:s?on(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=on(ag(d,"hooks").replace(/\\/g,"/"));return[m,on(ie(m,t,n,r))]}))]}}catch{return null}}function on(e){return process.platform==="win32"?e.toLowerCase():e}var pg={realpath:(e)=>{try{return ug(e)}catch{return null}},entryKind:(e)=>{let t=cg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return dg(e).isDirectory()}catch{return!1}}};function wl(){return gg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||mg()),tmpdir:fg(),paths:pg})}function gg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>_l(n,i,()=>xl(i,o)),worktreeFacts:(i)=>_l(r,i,()=>vl(i)),...t};return o}function _l(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var sn=["fail_closed","paranoid_rm","paranoid_interpreters"],Mr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Dr=["standard","strict","paranoid"];function hg(e,t){if(!t)return e;return Dr.indexOf(t)>Dr.indexOf(e)?t:e}function yg(e){let t=Ti(ee.level,e);if(t===void 0||t==="")return;if(Dr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Dr.join(", ")}.`);return}function Sg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Al(e){return Sg(Ti(ee.auditScope,e))==="all"}function Ai(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Pi(e={},t){let n=e.safety?.level??"standard",r=yg(t),o=hg(n,r),i=Mr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(At(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(At(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(At(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(At(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||At(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ai(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function At(e,t){let n=typeof e==="string"?wi(e,t):Ti(e,t);return n==="1"||n?.toLowerCase()==="true"}function wi(e,t){return t.get(e)}function Ti(e,t){let n=wi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return wi(e.legacyName,t);return}import{types as Cg}from"util";var bg=new Set(["applypatch","patch"]),vg=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Eg=new Set(["grep","grepsearch","rg"]),Rg=new Set(["find","findbyname","glob"]),xg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),_g=new Set(["command","diff","input","patch","patchtext"]),Pl=new TextEncoder,wg=new TextDecoder,Ag=/\s/,Pg=64;class Xe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Dn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ml(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Lr(e){return xg.has(Ml(e))}function Mi(e){let t=Ml(e);if(bg.has(t))return"patch";if(Eg.has(t))return"grep";if(Rg.has(t))return"glob";if(vg.has(t))return"path";return"unknown"}function Ln(e){if(!e||typeof e!=="object")return;zl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ve();return}if(t.get||t.set)Ve();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Dl(e,t){return Nl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Nl(e,t,n,r){let o=Gl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Nl(a,t,n,r+1);return typeof a==="string"&&t.has(Ll(s))?[a]:l});return n.ancestors.delete(o.object),i}function Ll(e){return e.replace(/-/g,"_").toLowerCase()}function Wl(e){return Fl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Ig)}function Fl(e,t,n,r){let o=Gl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Fl(a,o.array?t:_g.has(Ll(s)),n,r+1));return n.ancestors.delete(o.object),i}function Tg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Dn.maxDepth||t.nodes>Dn.maxNodes)Ve();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Dn.maxStringBytes||t.stringBytes>Dn.maxAggregateStringBytes)Ve()}function Gl(e,t,n){if(Tg(e,t,n),!e||typeof e!=="object")return null;let r=zl(e);if(t.ancestors.has(e))Ve();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Dn.maxKeys)Ve();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ve();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function zl(e){if(Cg.isProxy(e))Ve();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ve();return t}function Ve(){throw new Xe}function Ig(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=kg(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ii(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ii(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...Oi(Nr(c.slice(4),!0),Nr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ii(c))}return t}function kg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ii(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Ol(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Ol(n[1]);if(e.startsWith("diff --git "))return Og(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return kl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return kl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Gg(i[1]);return[]}function Og(e){let t=Mg(e);if(t.length===2&&t[0]&&t[1])return Oi(t[0],t[1]);let n=Dg(e);return n?Oi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Mg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Pt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Pt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Bl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Pt(e[n]))n++;return n===e.length?t:[]}function Dg(e){let t=0;while(t<e.length&&Pt(e[t]))t++;let n=e.length;while(n>t&&Pt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Pt(e[o])){o++;continue}let i=o;while(o<n&&Pt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Pg)Ve();if(Ng(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Ng(e,t,n,r,o){if(ki(e,t,n,r,o))return!0;let i=Tl(e,"/",t,n),s=Tl(e,"/",r,o);if(i<=t||s<=r)return!1;if(ki(e,t,i,r,s))return!1;return ki(e,i+1,n,s+1,o)}function ki(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Tl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Pt(e){return e!==void 0&&Ag.test(e)}function Bl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:wg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Pl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Pl.encode(Lg(s[0]??""))),o+=2}return null}function Lg(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Wg(e){return Nn(zg(e))}function Oi(e,t){if(e==="/dev/null")return Il(t);if(t==="/dev/null")return Il(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Nn);let n=Fg(e,t)??(e===t?$l(e):null);return[e,t,...n?[n]:[]].flatMap(Nn)}function Il(e){let t=$l(e);return[e,...t?[t]:[]].flatMap(Nn)}function $l(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Fg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function kl(e){return Wg(Nr(e,!0))}function Gg(e){return Nn(Nr(e,!1))}function Nr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Bl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function zg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Nn(e){return e===""||e==="/dev/null"?[]:[e]}function Ol(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ni,relative as $g,resolve as Ul,sep as Ug}from"path";function Hl(e,t,n){if(Ze(e))return;let r=t.flatMap((i)=>Di(i,n));if(!r[0])return;let o=Di(Ni(e)?e:Ul(r[0],e),n)[0];if(!o)return;return r.some((i)=>Hg(o,i))?o:void 0}function jl(e,t,n){if(Ze(e))return;return Di(Ni(e)?e:Ul(t,e),n)[0]}function Di(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Hg(e,t){let n=$g(t,e);return n===""||n!==".."&&!n.startsWith(`..${Ug}`)&&!Ni(n)}function an(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{dirname as Vr}from"path";import{closeSync as Vg,constants as Vl,fstatSync as Kg,fsyncSync as pP,lstatSync as Wi,mkdirSync as gP,openSync as qg,readdirSync as hP,readFileSync as Yg,realpathSync as Wr,renameSync as yP,rmdirSync as SP,statSync as Zg,unlinkSync as CP,writeFileSync as bP}from"fs";import{isAbsolute as Kl,join as ql,normalize as Xg,parse as Jg,relative as Fi,resolve as Gi,sep as zi}from"path";function Li(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Qg=Symbol("PolicyFilesystemScope"),eh=Symbol("PolicyFilesystemTarget"),th=Vl.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Tt(e,t){return{[Qg]:!0,root:Gi(e),label:t}}function Yl(e,t){let n=Xg(t);if(t===""||Kl(t)||n===".."||n.startsWith(`..${zi}`))throw new se(e.label);return{[eh]:!0,scope:e,relativePath:n,path:ql(e.root,n)}}function Wn(e,t){return Yl(e,Fi(e.root,Gi(t)))}function Zl(e,t="rules policy"){let n=Gi(e),r=Jg(n).dir;return Yl(Tt(r,t),Fi(r,n))}function Gr(e){return Jl(e.scope.label,()=>{if(!Fr(e))return null;let t=qg(e.path,Vl.O_RDONLY|th);return nh(t,()=>{let n=Kg(t);if(!n.isFile())throw new se(e.scope.label);let r=Yg(t,"utf-8"),o=Wi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Fr(e),r})})}function Xl(e,t){if(e.path===t.path)return!0;return Jl(e.scope.label,()=>{if(!Fr(e)||!Fr(t))return!1;return Wr(e.path)===Wr(t.path)})}function Jl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function nh(e,t){try{return t()}finally{Vg(e)}}function Fr(e,t="file"){let n=rh(e.scope);if(!n)return!1;let r=e.relativePath.split(zi);for(let o of r.keys()){let i=ql(e.scope.root,...r.slice(0,o+1)),s=Wi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);oh(n,Wr(i),e.scope.label)}return!0}function rh(e){if(!Wi(e.root,{throwIfNoEntry:!1}))return null;if(!Zg(e.root).isDirectory())throw new se(e.label);return Wr(e.root)}function oh(e,t,n){let r=Fi(e,t);if(r===".."||r.startsWith(`..${zi}`)||Kl(r))throw new se(n)}import{dirname as kt,isAbsolute as ch,join as Mt,relative as uh,resolve as Ot,sep as dh}from"path";var It=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Ql="rulebook.json",ec=".cc-safety-net/rules";var tc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var ih=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,sh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ah="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),xP=new RegExp(`^${sh}/(${It.source.slice(1,-1)})/${ah}$`);function lh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function nc(e){if(zr(e))try{return Bi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return It.test(e)?null:`Local rulebook sources must be bare names matching ${It}: ${e}`}function Bi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(tc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!ih.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!It.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:lh(o),name:o}}function zr(e){return tc.test(e)}var rc="rule.json",Br="policy.json",oc=".cc-safety-net",mh="rules",fh="CC_SAFETY_NET_HOME",ic="`cc-safety-net rule update`";function ph(e){return Ot(e,ec)}function gh(e){return Mt(ph(e),rc)}function Fn(e){return Mt(Ot(e),oc,Br)}function $i(e,t={}){return t.userConfigDir??(t.userConfigPath?kt(t.userConfigPath):Mt(hh(e),mh))}function hh(e){let t=e.env.get(fh);return t?Ot(be(t)):Mt(e.home,oc)}function yh(e,t={}){return Mt($i(e,t),rc)}function ln(e,t={}){return Mt(kt($i(e,t)),Br)}function sc(e,t){let n=t.userConfigPath??yh(e,t),r=t.projectConfigPath??gh(t.cwd),o=Sh(e,t),i=Ch(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Wn(o,n),projectConfigTarget:Wn(i,r)}}function Sh(e,t){let n=t.userConfigPath?kt(kt(Ot(t.userConfigPath))):kt(Ot(t.userConfigDir??$i(e,t)));return Tt(n,"user policy")}function Ch(e,t){let n=Ot(t),r=Ot(e),o=uh(n,r);if(o!==".."&&!o.startsWith(`..${dh}`)&&!ch(o))return Tt(n,"project policy");return Tt(kt(kt(r)),"project policy")}function ac(e,t){return Mt(e,t,Ql)}var le=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ut=/^[a-zA-Z][a-zA-Z0-9_-]*$/,dt=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),lc=new Set(["python","python3","python2","node","ruby","perl"]),$r=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Ur=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var cc="Rulebook exceeds CC Safety Net's safe validation limits.",uc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function dc(e){if(Ui(e.allowed_commands,Oe.maxAllowedCommands)||Ui(e.rules,Oe.maxRules)||Ui(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ui(e,t){return Array.isArray(e)&&e.length>t}var Hi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var ji=64,Vi="Rule config exceeds CC Safety Net's safe source limit.";function L(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function fe(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var bh=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),vh=new Map([["zsh",new Set(["o"])]]),Eh=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function mc(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=Eh.get(e);if(xh(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=Rh(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function Rh(e,t){let n=bh.get(e),r=vh.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let l=t.slice(s+1);if(!o&&t[0]==="-"&&l==="c")continue;if(!o&&t[0]==="-"&&l[0]==="-"&&l.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function xh(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}function Gn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Hr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of _h(e))Gn(n,t);return t.inSingle||t.inDouble}function _h(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Gn(s,n)}return t}var Ki=new Set(["rm","find","xargs","parallel"]),wh=new Set(["git","busybox",...Ki,...J,...lc,...we]),Ah=new Set(["python","node","ruby","perl"]);function fc(e){let t=L(e);return wh.has(t)||Me(t)}function Me(e){return Ah.has(Ph(e))}function Ph(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function qi(e){try{let t=Gr(Th(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Oh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Th(e){return typeof e==="string"?Zl(e):e}var O=(e,t)=>({path:e,message:t,kind:"typed"}),ce=(e,t)=>({path:e,message:t,kind:"custom"});function pc(e){let t=new Set;return e.flatMap((n,r)=>{let o=cn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ce(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Yi=`must be one of ${Hi.join(", ")}`,Ih=/^[^/]+\/[^/]+$/,kh=["version","rules","overrides","transparent_wrappers"];function Oh(e){let t=Mh(e);return{errors:Zi($h(t,kh,(n)=>n.kind==="custom"),": "," "),sources:Bh(e,t)}}function Mh(e){if(!cn(e))return[O([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>ji;return[...e.version===1?[]:[O(["version"],"must be 1")],...Dh(e.rules,t),...Wh(e.overrides),...Gh(e.transparent_wrappers),...t?[]:Lh(e.rules),...cn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Ih.test(n)).map((n)=>ce(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...zh(e.transparent_wrappers)]}function Dh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[O(["rules"],"must be an array of rulebook source strings"),...gc(e,ji)?[O(["rules"],Vi)]:[]];if(t)return[{path:["rules"],message:Vi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[O(["rules",r],"must be a rulebook source string"),...Nh(n,1)?[O(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[O(["rules",r],"must be a non-empty rulebook source string")]:[]})}function gc(e,t){let n=hc(e);return n!==void 0&&!(n<=t)}function Nh(e,t){let n=hc(e);return n!==void 0&&!(n>=t)}function hc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Lh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ce(["rules",r],"must be a non-empty rulebook source string")];let o=nc(n);if(o)return[ce(["rules",r],o)];if(t.has(n))return[ce(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Wh(e){if(e===void 0)return[];if(!cn(e))return[O(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!cn(n))return[O(["overrides",t],'must be "off" or an object')];return[...Fh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Xi(n.intent)?[]:[O(["overrides",t,"intent"],Yi)]]})}function Fh(e,t){if(typeof e!=="string")return[O(t,"required non-empty string"),...gc(e,dt)?[O(t,`must be at most ${dt} characters`)]:[]];if(e==="")return[O(t,"required non-empty string")];return e.length>dt?[O(t,`must be at most ${dt} characters`)]:[]}function Gh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[O(["transparent_wrappers",n],"must be a command string")];return ut.test(t)?[]:[O(["transparent_wrappers",n],"must match command pattern")]})}function zh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["transparent_wrappers",r],`duplicate command "${n}"`)];if(fc(n))return[ce(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Bh(e,t){let n=cn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function $h(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Zi(e,t,n){return[...new Set(e.map((r)=>{let o=Uh(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Uh(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Xi(e){return Hi.includes(e)}function cn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Sc(e){let t=Vh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Hh=`required non-empty string up to ${dt} characters`,yc="must be a non-empty array of unique non-empty strings",jh="required non-empty array of non-empty strings";function Vh(e){if(!mt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!dc(e))return{errors:[cc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Zi(Kh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),uc]:t,ruleNames:new Set(Cc(e).map((n)=>n.toLowerCase()))}}function Cc(e){let t=mt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=mt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Kh(e,t){return[...typeof e.name==="string"&&It.test(e.name)?[]:[O(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[O(["version"],"required non-empty string")],...qh(e.allowed_commands),...Yh(e.rules,t),...Qh(e.tests),...ey(e),...ty(e)]}function qh(e){if(!Array.isArray(e))return[O(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ut.test(n)?[]:[O(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Yh(e,t){if(!Array.isArray(e))return[O(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!mt(n))return[O(["rules",r],"must be an object")];return t?Xh(n,["rules",r]):Zh(n,["rules",r])}),...pc(e)]}function Zh(e,t){return[...bc(e.name,t),...vc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ut.test(e.subcommand)?[]:[O([...t,"subcommand"],"must match command pattern")],...jr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Ec(e.reason,t),...Rc(e.intent,t)]}function Xh(e,t){return[...bc(e.name,t),...vc(e.command,t),...Ec(e.reason,t),...Rc(e.intent,t),...Jh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[O([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[O([...t,"block_args"],"not supported in rulebook_version 2")]]}function bc(e,t){if(typeof e!=="string")return[O([...t,"name"],"required string")];return It.test(e)?[]:[O([...t,"name"],"must match rule name pattern")]}function vc(e,t){return typeof e==="string"&&ut.test(e)?[]:[O([...t,"command"],"required string matching command pattern")]}function Ec(e,t){return typeof e==="string"&&e!==""&&e.length<=dt?[]:[O([...t,"reason"],Hh)]}function Rc(e,t){return e===void 0||Xi(e)?[]:[O([...t,"intent"],Yi)]}function Jh(e,t){if(!mt(e))return[O(t,"required object")];return[...jr(e.command_path,[...t,"command_path"],jh,!1),...e.any_args===void 0?[]:jr(e.any_args,[...t,"any_args"],yc,!0),...e.exclude_args===void 0?[]:jr(e.exclude_args,[...t,"exclude_args"],yc,!0)]}function jr(e,t,n,r){if(!Array.isArray(e))return[O(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[O([...t,s],"must be a non-empty string")];return i===""?[ce([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ce(t,n)]:[],...r&&new Set(e).size!==e.length?[ce(t,"must not contain duplicate values")]:[]]}function Qh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!mt(t))return[O(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[O(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[O(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[O(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ce(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function ey(e){if(!Array.isArray(e.tests))return[];let t=new Set(Cc(e));return[...new Set(e.tests.flatMap((n)=>mt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ce(["tests"],`blocked fixture references unknown rule "${n}"`))}function ty(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=mt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ce(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function mt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Tc(e,t){let n=sc(e,t),r=!1;try{r=Xl(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof se)return uy(n,f.message);throw f}let o=qi(n.userConfigTarget),i=r?{config:null,errors:[]}:qi(n.projectConfigTarget),s=Ac(n.userConfigPath,o.errors),a=Ac(n.projectConfigPath,i.errors),l=new Set,c=o.config?xc(o.config,Vr(n.userConfigPath),"user",n.userScope,l):Pc(),d=i.config?xc(i.config,Vr(n.projectConfigPath),"project",n.projectScope,l):Pc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[..._c(c.rules,m),..._c(d.rules,u)],transparent_wrappers:ly(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?wc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?cy(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?wc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function xc(e,t,n,r=Tt(Vr(Vr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=ry(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:ny(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),entries:a.map((c)=>({spec:c.rulebook.spec,name:c.rulebook.name,version:c.rulebook.version,ruleCount:c.rulebook.rules.length})),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function ny(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function ry(e,t,n){let r=oy(e),o=ac(t,r),i=sy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${iy(e)}`]};let s=ay(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function oy(e){return zr(e)?Bi(e).name:e}function iy(e){return zr(e)?`run ${ic} to vendor ${e}`:"create that file or remove that source from the rules config"}function sy(e,t){try{return{content:Gr(Wn(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function ay(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Sc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function ly(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function _c(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function wc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function cy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Ac(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function uy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Pc(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as xy,readFileSync as _y}from"fs";var Ic=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Ji=new Set(Ic.map((e)=>e.id)),Kr=Ic,dy=new Map(Kr.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:dy.get(e)??"manual_only"}}var Qi=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],qr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},my=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],fy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],es=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...fy.flatMap((e)=>my.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Yr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],kc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],py=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ts=kc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ns=kc.flatMap((e)=>py.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),zn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},rs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),os=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],gy=[...Qi,qr,...es,...ts,...ns,zn,...rs,...os,...Yr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Zr=new Set(Yr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),hy=gy.map((e)=>e.id),is=new Set(hy);import{isAbsolute as ss,join as yy,normalize as Sy,sep as Xr}from"path";var Oc=process.platform==="win32",Cy=/[*?]/;function Bn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function as(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Bn(e.trim(),t);if(!ss(n))return"must be an absolute path or start with ~/";return $n(n,t)}function ls(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(!ss(n))return null;if($n(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var by="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",vy="cannot cover the guard's own configuration";function Mc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Bn(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function cs(e,t){let n=Mc(e,t);if(n===null)return"must be a non-empty path string";if(Cy.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!ss(n))return null;if($n(n,t)!==null)return by;return Ey(n,t)?vy:null}function Ey(e,t){let n=Jr(e),r=Jr(yy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Xr}`)}function $n(e,t){let n=Jr(e),r=Jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Xr)?n:`${n}${Xr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Jr(e){let t=Sy(e);if(Oc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Oc?3:1)&&t.endsWith(Xr))t=t.slice(0,-1);return t}var Dc=30,us=1,ds=365;function Nc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Lc=new Set(Kr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(Lc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function Q(e,t,n){if(Lc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Wc(e,t){return Object.freeze(Object.fromEntries(Kr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Fc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Wc(e,t)})}var Gc={standard:0,strict:1,paranoid:2};function $c(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ms(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ms(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ms(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ry(e,t)}}function ms(e,t){return[...new Set([...e,...t??[]])]}function Ry(e,t){let n=t.safety?.level,r=Mr[e.safety.level];return[...n&&Gc[n]<Gc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...sn.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...zc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...zc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Zr.has(o))),...e.destructive_command_protection.enabled?Bc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Bc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function zc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Bc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var gs=new Set(["standard","strict","paranoid"]),Vc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Dc}};function Kc(e,t){let n=Ny(ln(e,t),e.home),r=to(Fn(t.cwd),e.home),o=Ay(r.parsed,e.home),i=Object.keys(o.policy).length>0?$c(n.gui??Vc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ps(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var wy="project policy audit settings are ignored; audit is user scope only";function Ay(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...gs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Uc({overrides:qc(n.overrides,sn,"safety.overrides",Dt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:eo(o.overrides,Ji,"destructive_command_protection.overrides",Dt)}:{},...o.allow_paths!==void 0?{allow_paths:dn(o.allow_paths,as,t,"destructive_command_protection.allow_paths",Dt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:eo(i.overrides,is,"secret_protection.overrides",Dt)}:{},...i.deny_paths!==void 0?{deny_paths:dn(i.deny_paths,ls,t,"secret_protection.deny_paths",Dt)}:{},...i.allow_paths!==void 0?{allow_paths:dn(i.allow_paths,cs,t,"secret_protection.allow_paths",Dt)}:{}};return{policy:Uc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[wy]}}function qc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(`${n}.${o}`,Yc);return[]}))}function Uc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Dt=()=>{return},Yc="not a boolean",Zc="not an object",Py=`not an integer between ${us} and ${ds}`,Ty=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Iy(e,t){let n=[];return{policy:Xc(e,t,(o,i)=>{n.push({path:o,reason:i})}),drops:n}}function ky(e,t){return Xc(e,t,Dt)}function Xc(e,t,n){if(!ve(e))return n("","not a JSON object"),Qr();if(e.version!==1)n("version","not 1");let r=un(e.safety,"safety",["level","overrides"],n),o=un(r.overrides,"safety.overrides",sn,n),i=un(e.workflow,"workflow",["worktree_mode"],n),s=un(e.destructive_command_protection,"destructive_command_protection",["enabled","overrides","allow_paths"],n),a=un(e.secret_protection,"secret_protection",["enabled","overrides","deny_paths","allow_paths"],n),l=un(e.audit,"audit",["retention_days"],n);return Jc(e,Ty,"",n),{version:1,safety:{level:Oy(r.level,n),overrides:qc(o,sn,"safety.overrides",n)},workflow:{worktree_mode:fs(i.worktree_mode,"workflow.worktree_mode",!1,n)},destructive_command_protection:{enabled:fs(s.enabled,"destructive_command_protection.enabled",!0,n),overrides:eo(s.overrides,Ji,"destructive_command_protection.overrides",n),allow_paths:dn(s.allow_paths,as,t,"destructive_command_protection.allow_paths",n)},secret_protection:{enabled:fs(a.enabled,"secret_protection.enabled",!0,n),overrides:eo(a.overrides,is,"secret_protection.overrides",n),deny_paths:dn(a.deny_paths,ls,t,"secret_protection.deny_paths",n),allow_paths:dn(a.allow_paths,cs,t,"secret_protection.allow_paths",n)},audit:{retention_days:My(l.retention_days,n)}}}function un(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(t,Zc),{};return Jc(e,n,t,r),e}function Jc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r(n===""?o:`${n}.${o}`,"unknown field")}function Oy(e,t){if(e===void 0)return"standard";if(gs.has(e))return e;return t("safety.level","not one of standard, strict, paranoid"),"standard"}function fs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(t,Yc);return n}function My(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=us&&e<=ds))t("audit.retention_days",Py);return Nc(e)}function eo(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(n,Zc),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r(`${n}.${o}`,"unknown rule id"),[];if(i==="on"||i==="off")return[[o,i]];return r(`${n}.${o}`,'not "on" or "off"'),[]}))}function dn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(r,"not an array"),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(`${r}[${s}]`,a),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Qr(){return structuredClone(Vc)}function to(e,t){if(!xy(e))return{exists:!1,policy:Qr(),errors:[]};try{let n=_y(e,"utf-8");if(!n.trim())return{exists:!0,policy:Qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Iy(r,t);if(o.drops.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.drops.map((i)=>`${e}: ${Dy(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}function Dy(e){return e.path===""?e.reason:`${e.path}: ${e.reason}`}function Ny(e,t){let n=to(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:jc(),errors:[]};let o=ky(r,t);return{policy:ps(o),gui:o,errors:[],levelPresent:Hc(r)}}if(n.parsed===void 0)return{policy:jc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ps(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Hc(n.parsed)}}function Hc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return gs.has(t.level)}function Qc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function jc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Qc({}),denyPaths:[],allowPaths:[]}}}function ps(e){return{safety:Ly(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Qc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Ly(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function eu(e,t){let n=Tc(e,t),r=Kc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...zy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return By(o,Wy(n,r),s,r.policyScopes)}function Wy(e,t){let n=Gy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:$y(e.errors.length>0?Fy(e.errors):void 0,e.warnings.length>0?ys(e.warnings.join("; ")):void 0,n)}}function Fy(e){return`${ys(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Gy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function zy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function By(e,t,n=Object.freeze({}),r){let o=hs(structuredClone(e)),i=r?{policyScopes:hs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function hs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))hs(t);return Object.freeze(e)}function $y(...e){return ys(e.filter((t)=>!!t).join("; "))}function ys(e){return/[.!?]$/.test(e)?e:`${e}.`}function tu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Ss(t.fail_closed,e.strict,"strict"),paranoid_rm:Ss(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Ss(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Fc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ai({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Ss(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Un(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Uy=/^[A-Za-z_][A-Za-z0-9_]*=/;function no(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Hn(e){let t=no(e.words[0],"time")?1:0,n=t===1&&no(e.words[t],"-p")?t+1:t,r=t===1&&no(e.words[n],"--")?n+1:n,o=no(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Uy.test(s.text));return i?.provenance==="literal"?i.text:void 0}function ro(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Hy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>pe(t)))})}function oo(e,t,n){e.push(n),t.reset()}function io(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Cs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function mn(e,t,n,r,o,i,s){return Cs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function pe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Hy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:pe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function bs(e,t,n){if(t>=n||ru(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!ru(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=nu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=nu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function vs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=jy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Vy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function nu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function ru(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function jy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`&&e[r]!=="\r")r++;let o=r>=n?n:e[r]==="\r"&&e[r+1]===`
-`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Vy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var lu=new Set(["&&","||","|","|&"]);function cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=lo(e,0,e.length,t,{used:0,max:t.maxWords},0);return pe({kind:"program",dialect:"posix",source:e,span:n,status:mo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function lo(e,t,n,r,o,i,s){let a=[],l=[],c=ro(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);oo(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),au(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(uo(f)){if(f===`
-`||f==="\r"){m();let b=f==="\r"&&e[u+1]===`
-`?u+2:u+1,w=a.at(-1);if(w?.kind!=="connector"||!lu.has(w.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let R=vs(e,b,n,d.splice(0));l.push(...R.issues),u=R.next;continue}u=b;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?mS(e,u,n):void 0;if(p){if(Rs(a,l,u),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);if(!Es(o))return fn(a,l,u,"word-limit",r.maxWords);let b=lo(e,p.braceIndex+1,n,r,o,i+1,"}"),w=b.next,R={start:p.braceIndex+1,end:b.closed?w-1:w},A=ou(e,R,b);if(a.push({kind:"function",name:p.name,span:{start:u,end:w},body:A}),l.push(...b.issues),b.pendingHeredocs.length>0||Vn(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:u,end:w}});if(d.push(...b.pendingHeredocs),b.limited)return ao(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:p.braceIndex,end:w}});u=w;continue}let h=co(e,u);if(h){if(m(),!yu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`,span:{start:u,end:u+h.length}});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:u,end:u+1}}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&eS(e,u,n))&&c.start===-1){if(Rs(a,l,u),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);let b=f==="("?")":"}",w=lo(e,u+1,n,r,o,i+1,b),R=w.next,A={start:u+1,end:w.closed?R-1:R},K=ou(e,A,w);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:R},body:K}),l.push(...w.issues),w.pendingHeredocs.length>0||Vn(w.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:u,end:R}});if(d.push(...w.pendingHeredocs),w.limited)return ao(a,l,w.next);if(!w.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`,span:{start:u,end:R}});u=R;continue}let g=(f==="<"||f===">")&&e[u+1]!=="("?Zy(e,u):null;if(g){let b=c.words.at(-1),w=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(w!==void 0)c.words.pop();let R=w===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let A=u+g.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let K=e[A],Y=A>u+g.length&&K==="#",te=!K||uo(K)||!!co(e,A)||K===s||K===")"||Y||(K==="<"||K===">")&&e[A+1]!=="(",X=g==="<<"||g==="<<-",z=X?bs(e,A,n):void 0,D=z?{word:mn(e,A,z.next,z.delimiter,"literal",z.quoted),nested:[],issues:[],next:z.next,limited:!1}:!te?xs(e,A,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return ao(a,l,D.next);if(!Es(o))return fn(a,l,D.next,"word-limit",r.maxWords)}let oe=D?.next??u+g.length,_e={kind:"redirection",operator:g,span:{start:R,end:oe},...w===void 0?{}:{fd:w},...D?{target:D.word}:{}};if(c.redirections.push(_e),X&&!z)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:u,end:u+g.length}});if(z){if(z.ambiguous||z.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:z.span});let Ye=c.nested;d.push({delimiter:z.delimiter,quotedDelimiter:z.quoted,stripTabs:g==="<<-",declarationSpan:{start:R,end:oe},attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;Ye.push(...qy(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`,span:{start:u,end:u+g.length}});if(D)c.nested.push(...D.nested);c.end=oe,u=oe;continue}if(c.start===-1)Rs(a,l,u);let y=xs(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return ao(a,l,y.next);let v=rS(c.words)?lS(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return fn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!Es(o))return fn(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return m(),au(a,l),l.push(...fS(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function ou(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:mo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function xs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||uo(f)||(f===";"||f==="|"||f==="&")&&co(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:a,end:n}}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=Ky(e,a,n,r,o,i);if(s+=g.text,d.push(...g.nested),m.push(...g.issues),u||=g.limited,c=jn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Xy(e,a+2,n);if(s+=g.text,m.push(...g.issues),!g.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:a,end:n}});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){m.push({code:"trailing-escape",message:"escape has no following character",span:{start:a,end:a+1}}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?fo(e,a,n,r,o,i):null;if(h){let g=uu(h,d,m);if(u||=g.limited,c=jn(c,g.provenance),a=g.next,u)break;continue}if(f==="$"){let g=fu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=jn(c,"glob");s+=f,a++}return{word:mn(e,t,a,s,c,l,c==="literal"?void 0:Qy(e,t,a)),nested:d,issues:m,next:a,limited:u}}function Ky(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
-`){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=_s(e,m+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(m,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:m,end:h}});m=h;continue}let f=fo(e,m,n,r,o,i);if(f){let p=uu(f,l,c);if(m=p.next,d||=p.limited,a=jn(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let p=fu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function fo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=_s(e,t+d,n,m),f=u===-1?n:u,p=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:dS(e,t+d,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,w=t+d;while(w<f){let R=fo(e,w,f,r,o,i+1);if(!R){w++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),b||=R.program.status==="limited",w=R.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:p}});return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:mo(E,b),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=lo(e,t+d,f,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`,span:{start:t,end:p}}]:[],y=(c||l)&&Vn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:p}}]:[];return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:mo([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function qy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?fo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function uu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function _s(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=vs(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=du(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=Yy(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=bs(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,declarationSpan:{start:a,end:u.next},attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Yy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=du(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function du(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!pS(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function co(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Zy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function uo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function mu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Xy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Jy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Jy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return so(e,t+1,n,16,2,t+1);if(r==="u")return so(e,t+1,n,16,4,t+1);if(r==="U")return so(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return so(e,t,n,8,3,t+1);return{text:r,next:t+1}}function so(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function mo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function fu(e,t,n,r,o){let i=mu(e,t,n);return{text:r+e.slice(t,i),provenance:jn(o,"variable"),next:i}}function Qy(e,t,n){let r=io(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,p=c?"))":u?"`":")",h=_s(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=mu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function jn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function eS(e,t,n){return t+1>=n||uo(e[t+1]??"")||co(e,t+1)!==null}var tS=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),nS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function rS(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=oS(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function oS(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return iS(e,t);if(n==="env")return sS(e,t);if(n==="sudo")return aS(e,t);return}function iS(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function sS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(tS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function aS(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(nS.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function pu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let l=o.findIndex((p)=>su(p));if(l===-1)break;if(++s>n)return{limited:!0};let c=o[l]??"",d=su(c);if(!d||d.kind==="range")return{limited:!0};let m=d.start+c.length-d.end,u=d.alternatives.reduce((p,h)=>p+m+h.length,0);if(i-c.length+u>r||o.length-1+d.alternatives.length>t)return{limited:!0};let f=gu(c,d);o.splice(l,1,...f),i+=u-c.length}if(s===0)return;let a=o.map((l)=>uS(l,n));if(a.some((l)=>l===null))return{limited:!0};return{words:[...new Set(a.filter((l)=>l!==null&&l!==""))]}}function lS(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let c=i.findIndex((g)=>iu(g));if(c===-1)break;if(++a>r)return{limitCode:"depth-limit"};let d=i[c]??"",m=iu(d);if(!m)break;let u=m.start+d.length-m.end,f=m.alternatives.filter((g)=>u+g.length>0),p=f.reduce((g,y)=>g+u+y.length,0);if(s-d.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+f.length>n)return{limitCode:"word-limit"};let h=gu(d,{...m,alternatives:f});i.splice(c,1,...h),s+=p-d.length}let l=i.filter((c)=>c.length>0);if(a===0)return;return{words:l.map((c)=>mn(e,t.span.start,t.span.end,c,"literal",!1))}}function iu(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:hu(e,n)}}function su(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let l=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:cS(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(l&&(!n||l.start<n.start))n=l}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:hu(e,n)}}function gu(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function hu(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function cS(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function uS(e,t){let n=`x${e}`,r=xs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function dS(e,t,n,r){return pe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function fn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ao(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Es(e){return e.used++,e.used<=e.max}function mS(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Vn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Vn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Vn(t.body.nodes)})}function fS(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function yu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function au(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!lu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function Rs(e,t,n){if(!yu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function pS(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Su=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),gS=new Set(["gc","cat","type","cp","mv","rm"]),Cu=["-rec","-for","-path","-literalpath","-whatif"],hS=/^\$env:\w/i,yS=/^(?:\$\{?\w+\}?|~)\\./,po={maxInputLength:131072,maxWords:16384,maxDepth:64};function bu(e){let t=e.toLowerCase().replaceAll("`","");if(![...Su].some((r)=>t.includes(r))&&!(t.includes("rm")&&Cu.some((r)=>t.includes(r)))&&!t.includes("<#")&&!SS(t))return!1;let n=xS(e);if(n.posixHeredoc)return!1;return n.invalidComment||n.commands.some(CS)}function SS(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function CS(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Su.has(n))return!0;let r=e.slice(t+1);if(n&&gS.has(n)&&r.some(bS))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Cu.some((s)=>i.startsWith(s))})}function bS(e){return hS.test(e)||yS.test(e)}function vu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=Is(e,0,e.length,t,0);return pe({kind:"program",dialect:"powershell",source:e,span:n,status:_S(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Is(e,t,n,r,o,i=!1){let s=[],a=[],l=ro(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};oo(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=xu(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let y=f==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(ws(e,u,y)),u=y;continue}u++;continue}let h=ks(e,u);if(h){m(),s.push(ws(e,u,u+h.length)),u+=h.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Ru(u,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Is(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=pe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:u,end:y.next}});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(ws(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?As(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Cs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=As(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,d||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:u,end:g.next}}),m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function As(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(p)=>{let h=vS(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),d+=Ps(h.program),m||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||ks(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:f,end:f+1}}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let h=f++,g=!1;while(f<n){let y=e[f];if(y==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(y==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(y==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=y??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:h,end:e.length}});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:mn(e,t,f,i,s,a,s==="literal"?void 0:ES(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function vS(e,t,n,r,o){let i=Eu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Ru(t,r.maxDepth)],nodes:[]}),next:a};let l=Is(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Eu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ps(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ps(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ps(r)}}return t}function ES(e,t,n){let r=io(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Eu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=RS(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function RS(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Ru(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function xS(e){let t=[],n=[],r=0,o=0,i=!1,s=!1,a=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let l=e[r];if(l==="\r"||l===`
-`){a(),r+=l==="\r"&&e[r+1]===`
-`?2:1;continue}if(/\s/.test(l??"")){r++;continue}let c=xu(e,r,Math.min(e.length,po.maxInputLength),po.maxDepth);if(c){i||=!!c.issue||c.limited,r=c.next;continue}let d=ks(e,r);if(d){a(),r+=d.length;continue}if(l==="{"||l==="}"){a(),r++;continue}s||=e.startsWith("<<",r);let m=As(e,r,Math.min(e.length,po.maxInputLength),po,0);if(m.word.text)n.push(m.word.text);for(let u of m.nested)t.push(...Ts(u));o++,r=m.next>r?m.next:r+1}return a(),{commands:t,invalidComment:i,posixHeredoc:s}}function Ts(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ts(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(Ts)]})}function ks(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function xu(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function _S(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function ws(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var Nt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function De(e,t="auto",n=Nt){if(t==="powershell"||t==="auto"&&bu(e.slice(0,n.maxInputLength)))return vu(e,n);return cu(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function pn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function go(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Os(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Kn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){Kn(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function j(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ms(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function V(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Je(e,t,n){return!Lt(C(e,t-1))&&V(e,t,n)&&!Lt(C(e,t+n.length))}function Qe(e,t){return Lt(C(e,t-1))!==Lt(C(e,t))}function re(e){return e===`
-`||e===";"||e==="&"||e==="|"}function gn(e){return e==="|"||e===";"}function ho(e,t,n){let r=Os(e,n);if(t==="rm")return wS(r);if(t==="dd")return PS(r);return Iu(r,!0)}function yo(e,t,n){let r=Os(e,n);if(t==="rm")return TS(r);if(t==="reset-hard")return Pu(r,"--ha","rd");if(t==="reset-merge")return Pu(r,"--me","rge");if(t==="clean")return MS(r);if(t==="checkout")return NS(r);if(t==="push-force")return LS(r);if(t==="push-refspec")return WS(r);if(t==="push-delete")return FS(r);if(t==="branch")return GS(r);if(t==="tag")return $S(r);if(t==="restore")return US(r);return Iu(r,!1)}function wS(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Je(e,i,"rm")&&j(l)&&l!==`
-`)t=!0,i++;continue}let a=AS(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=_u(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(j(s)){if(o<0)continue;if(V(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=_u(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function AS(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(V(e,t,String.raw`\n`))return t+2;if(V(e,t,String.raw`\x0a`)||V(e,t,String.raw`\x0A`))return t+5;if(V(e,t,String.raw`\u000a`)||V(e,t,String.raw`\u000A`))return t+7;return V(e,t,String.raw`\012`)?t+4:-1}function _u(e,t,n){if(wu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(wu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function wu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!V(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function PS(e){let t=!1;for(let n=0;n<Z(e);n++){if(re(C(e,n))){t=!1;continue}if(Je(e,n,"dd")){t=!0,n++;continue}if(!t||!Je(e,n,"of")||!V(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!j(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function TS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=C(e,o);if(o===Z(e)||re(i)){t=!1,n=!1,r=!1,o++;continue}let s=kS(e,o);if(s>=0){if(IS(e,s))return!0;let a=s,l=!1;while(j(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(V(e,o,"--")&&(o===0||j(C(e,o-1)))&&(!C(e,o+2)||j(C(e,o+2))||re(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=V(e,o,"--recursive")&&Qe(e,o+11)||Ds(e,o,"recursive"),r||=V(e,o,"--force")&&Qe(e,o+7)||Ds(e,o,"force"),n&&r)return!0;o++}return!1}function Ds(e,t,n){if(!V(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||j(o)||re(o))break;if(o!==n[r])return!1;r++}return r>0&&Qe(e,t+r+2)}function IS(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(j(C(e,n)))n++;let i=n;while(n<Z(e)&&!j(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&V(e,i,"--"))return!1;let s=Au(e,i,"recursive"),a=Au(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=OS(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Au(e,t,n){return V(e,t,`--${n}`)&&Qe(e,t+n.length+2)||Ds(e,t,n)}function kS(e,t){if(t>0&&Lt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!j(C(e,n+1)))return-1;return n+1}function OS(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=C(e,c)??"",m=(d==="r"||d==="f")&&Qe(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Pu(e,t,n){return Yn(e,"reset",gn,!0,(r)=>C(e,r)==="-"&&hn(e,r,t,n)?!0:r)}function MS(e){return Yn(e,"clean",gn,!0,(t)=>{if(C(e,t)!=="-")return t;if(hn(e,t,"--fo","rce"))return!0;let n=qn(e,t,gn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function So(e,t,n){if(!Je(e,t,"git"))return null;let r=t+3;if(!j(C(e,r)))return{commandEnd:-1,next:r};while(j(C(e,r)))r++;while(r<Z(e)){if(re(C(e,r)))return{commandEnd:-1,next:r};let o=qn(e,r,re);if(Je(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&V(e,r,"--"),s=DS(e,r,o);r=o;while(j(C(e,r)))r++;if(i)return{commandEnd:Je(e,r,n)?r+n.length:-1,next:qn(e,r,re)};if(!s)continue;if(r>=Z(e)||re(C(e,r)))return{commandEnd:-1,next:r};r=qn(e,r,re);while(j(C(e,r)))r++}return{commandEnd:-1,next:r}}function DS(e,t,n){for(let r of le)if(n-t===r.length&&V(e,t,r))return!0;return!1}function NS(e){return Tu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function LS(e){return Yn(e,"push",gn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Lt(C(e,t+2))&&!V(e,t+2,"-with-lease"))return!0;let n=ku(e,t,"--fo","rce");if(n>=0&&!V(e,n,"-with-lease"))return!0;return t})}function WS(e){return Yn(e,"push",re,!1,(t)=>{if(j(C(e,t))&&C(e,t+1)==="+"&&t+2<Z(e)&&!re(C(e,t+2))&&!j(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function FS(e){return Yn(e,"push",re,!1,(t)=>{if(C(e,t)==="-"&&hn(e,t,"--de","lete"))return!0;if(j(C(e,t))&&C(e,t+1)===":"&&t+2<Z(e)&&!j(C(e,t+2))&&!re(C(e,t+2)))return!0;return t})}function GS(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||re(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=So(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=qn(e,o,re),s=zS(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function zS(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(hn(e,i,"--de","lete"))r=!0;if(hn(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&BS(C(e,s))){let d=C(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!Qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function BS(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function $S(e){return Tu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Tu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(j(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=So(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&j(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(hn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Qe(e,r+1))return!0;if(gn(o))i.outerActive=!1}return!1}function Yn(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=So(e,s,t);if(c){i=c.commandEnd>=0&&(!r||j(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(C(e,d)))i=!1;s=c}if(l)i=!1}return!1}function US(e){let t=!1;for(let n=0;n<Z(e);n++){if(Ms(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=So(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(V(e,n+2,"staged")||V(e,n+2,"help")))t=!1}return t}function Iu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=C(e,r),i=t?Ms(o):re(o);if(n&&j(o)&&C(e,r+1)==="-"&&Je(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Je(e,r,"find"))n=!0,r+=3}return!1}function qn(e,t,n){let r=t;while(r<Z(e)&&!j(C(e,r))&&!n(C(e,r)))r++;return r}function ku(e,t,n,r){if(!V(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return Qe(e,o)?o:-1}function hn(e,t,n,r){return ku(e,t,n,r)>=0}function et(e,t){Kn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&yo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var HS=/^[A-Za-z_][A-Za-z0-9_]*=/;function Mu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Kn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Du(t.nodes,r,i)}function Du(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Du(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return jS(r,t,n)})}function jS(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!HS.test(o.text));return e.words.every((o,i)=>o===t||Ou(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Ou(o.target.raw,n.anchored,!0)))}function Ou(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as VS,resolve as Nu}from"path";function Zn(e,t,n,r){let o=VS(e)?Nu(e):t?Nu(t,e):void 0;if(!o)return;try{return B(o,n,r)}catch{return o}}function Lu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Xn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ns=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),KS=new Set(["-p","--print"]),qS=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),YS=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),ZS=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),XS=new Map([["python",new Set(["m"])]]),JS=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),QS=new Set(["always","default","never"]),eC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),tC=/\\\r?\n/g,nC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Fu(e){return bo(e).code}function Co(e){return bo(e).sources}function Gu(e){return nC.get(Ws(e))??[]}function bo(e){let t=Ws(e[0]??"");if(!Ns.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&KS.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(oC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(iC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=rC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(JS.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&eC.has(s))||t==="python"&&!QS.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(XS.get(t)?.has(u)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(qS.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(YS.get(t)?.has(u)){if(m+1===s.length)i++;break}if(ZS.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function rC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ls(e,t){return Ws(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ws(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function oC(e,t){return Ns.get(e)?.has(t)??!1}function iC(e){return Ns.get(e)?.has("--eval")??!1}function Jn(e,t){let n=lC(e,t);if(!Wu(n,t))return!1;Ee(t,n);let r=aC(n);if(Wu(r,t))return!0;return Ee(t,r),sC.test(r)}var sC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function aC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Wu(e,t){if(ho(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>yo(o,r))))}function lC(e,t){return Ee(t,e),e.replace(tC,"")}import{isAbsolute as ud,relative as dd}from"path";import{isAbsolute as Hu,parse as SC}from"path";import{dirname as cC,isAbsolute as uC,parse as dC,sep as mC}from"path";function ft(e,t,n){if(Ze(t))throw Error("Unsupported Windows namespace path");let r=uC(t)?dC(t).root:"",o=r||e;for(let i of pC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=cC(o);continue}let s=fC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function fC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${mC}${t}`}function pC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Fs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],gC=new Set(Fs),hC=1024,zu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),vo=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),yC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Eo(e){return gC.has(e)}function Gs(e){return Eo(e)||zu.has(e)||vo.has(e)||Mn(e)}function Ae(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ro(e,t){let n=Ae("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=hC?{state:"valid",count:r}:{state:"invalid"}}function xo(e,t,n){let o=e.match(yC)?.[1];if(!o||!Gs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ae(o,t,n)??""}${e.slice(i+1)}`}}function Bu(e){return Uu(e,vo)}function $u(e){return Uu(e,zu)}function Uu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Vu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Vu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function _o(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Ku(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!Ku(Sn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<P.wrapperPeelIterations.cap;m++){let u=ju(i),f=_o(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&Sn(i).includes("=")&&!bC(i)){let h=vC(Sn(i),a,t.env)??xo(Sn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=Sn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=RC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=wC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=AC(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(ju(i)===u)break}let d=_o(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:CC(d.words,o)}}function CC(e,t){return e.some((n)=>!t.has(n))}function ju(e){return e.map(_).join(" ")}function Sn(e){let t=e[0];return t?_(t):""}function Le(e,t){let n=e[t];return n?_(n):void 0}function bC(e){return Vu.test(Sn(e))}function vC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var EC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function RC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(EC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var xC=new Set(["-i","-0","--null"]),_C=new Set(["-u","--unset","-C","--chdir","-P"]);function wC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(xC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(_C.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Qn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Qn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Qn(e,t,n){if(t==="")return null;if(!e&&!Hu(t))return null;let r=Hu(t)?SC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function AC(e){if(Le(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var PC=/['"\\$`{}#]/;function wo(e,t){if(e.some((r)=>PC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return Ao(e,t,n).tokens}function TC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function gt(e,t,n,r=0){let o=Ao(e,t,n),i=(o.envSplitValues??[]).flatMap(TC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return gt(s,t,n,r+1)}function Ao(e,t,n,r){if(!Ku(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Us=Symbol("adopt-as-operand"),IC=new Set(["env","sudo","command","builtin"]),kC=new Set(["&&","||","|&","|","&",";"]),OC=new Set(["<<","<<<",">|"]),MC=new Set(["|","|&"]),DC=/[*@#?$!_-]/,NC=/^\w+(?::\w+)*/,LC=Object.freeze([]),er=Object.freeze({kind:"scope",edge:"enter"}),tr=Object.freeze({kind:"scope",edge:"exit"}),WC=Object.freeze([]),FC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),nr=new Set(["bash","sh","zsh","dash","ksh"]),GC=256,Ju=new WeakMap;function Qu(e,t){let n=t.status==="complete"?new Set($s(t)):new Set,r=$C(e,n);if(Hr(r))return Po("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Po("structural-limit",r,t);if(o.invalid)return Po("invalid",r,t);let s=Po("complete",r,t,o.assignmentFallbacks);return Ju.set(s,Object.freeze(i)),s}function Io(e,t,n,r,o){let i={cwd:t,variables:new Map,previous:null},s=[],a=new Set,l=null,c=[];for(let d of ed(e)){if(d.kind==="scope"){if(d.edge==="enter"){c.push({state:i,segment:[...s],shellWords:new Set(a),pipeProducer:l});continue}let m=o.segment(s,i,l,null,a);if(m)return m;let u=c.pop();if(u===void 0)throw Error("scope exit without a matching enter");i=u.state,s=u.segment,a=u.shellWords,l=u.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let m=o.segment(s,i,l,d.operator,a);if(m)return m;i=zC(s,i,n,r),l=s.length>0&&MC.has(d.operator)?s:null,s=[],a=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)a.add(s.length-1);if(d.target===void 0)continue;let m=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},i);if(m===Us){a.add(s.length),s.push(o.word(d.target));continue}if(m)return m;continue}s.push(o.word(d.text))}return o.segment(s,i,l,null,a)}function ko(e){return ed(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function ge(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:ge(i,t);return a?ge(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function rr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function zC(e,t,n,r){let o=rr(e)?new Map([...t.variables,...BC(e,t.variables)]):t.variables,i=pt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(ge(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function BC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],ge(o,t)]]:[]})}function ed(e){return Ju.get(e)??LC}function $C(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Po(e,t,n,r=WC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>UC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function UC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(qC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[To("{"),...Ft(e.body,a),...s?[To("}")]:[]]:[er,We("("),...Ft(e.body,a),...s?[We(")")]:[],tr]}]}let o=JC(e,r.functions);if(o){if(r.depth>=Nt.maxDepth||++r.flags.expansions>GC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...qu(e,r),To(";"),...Ft(o,{...r,depth:r.depth+1}),To(";")]},...Yu(e,t,n,r)]}return[{start:e.span.start,events:qu(e,r)},...Yu(e,t,n,r)]}function qu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:nd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:HC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function HC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?nd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Hs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:YC(r),targetOrder:OC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:od(t)}:{}}),...s===void 0?o:o.slice(1)]}function Yu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Hs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...td(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?jC(t,n,r):[]]}function jC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:td(n.source.slice(r.span.end,e.span.end),n)}]}function td(e,t){if(t.depth>=Nt.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function nd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?Hs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of zs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=zs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=d?Ft(d,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(er,...p,tr);continue}let m=d?Ft(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(er,...m,tr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),er,...m,...c.raw.endsWith(")")?[We(")")]:[],tr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>We("(")),...u===1?[er]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>We(")")):[],...u===1?[tr]:[])}return l(),o}function zs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Zu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Zu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Zu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=KC(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return VC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&DC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?NC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function VC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=zs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function KC(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function qC(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:kC.has(e)})}function To(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Hs(e){return Object.freeze({kind:"word",text:e})}function YC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function or(e){return FC.has(e)||/^python\d/.test(e)}var ZC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function rd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=ZC.get(e)?.has(n)??!1;return rd(e,t.slice(r?2:1))}function Bs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Bs(e.slice(1));if(!IC.has(t))return[...e];return Bs(rd(t,e.slice(1)))}function od(e){let t=Hn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Bs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function XC(e){let t=od(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return or(n)&&!nr.has(n)}function $s(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return $s(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>$s(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(XC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!eb(t))return r;return[...r,...o]})}function JC(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function ht(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function QC(e){if(ht(e.words[0],"git"))return ht(e.words[1],"commit");if(!ht(e.words[0],"gh")||!ht(e.words[2],"create"))return!1;return ht(e.words[1],"pr")||ht(e.words[1],"issue")}function eb(e){return(ht(e.words[0],"cat")||ht(e.words[0],"tee")||QC(e))&&!e.words.some(Xu)&&!e.redirections.some((n)=>Xu(n.target))}function Xu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var id=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),sd=new Set([...id,"glob"]),tb=new Set([...sd,"pattern"]),ad={parseCommand:De,readGuardSyntax:Qu};class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function ir(e,t={}){let n=nb({...ad,...t}),r=Ln(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let l=s.findIndex((m)=>m.source===a.source);if(l!==-1){let m=s[l];if(!m)return s;return s[l]={...m,usages:[...m.usages,a.usage]},s}let c=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",d=n.getCommandProgram(a.source,c);return s.push({usages:[a.usage],source:a.source,program:d,shell:n.getShellSyntax(a.source,d)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:rb(e),store:n}}function ue(e,t){return e.commands.find((n)=>n.usages.includes(t))}function tt(e,t){if(!e.includes("$"))return e;return xi(e,t)}function nb(e={}){let t={...ad,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,l)=>{let c=`${l}\x00${a}`,d=r.get(c);if(d)return d;let m=t.parseCommand(a,l);return r.set(c,m),m};return{getShellSyntax:(a,l)=>{if(l&&l.source!==a)throw TypeError("Shell syntax source does not match command program source.");let c=l??i(a,"posix");if(c.status==="limited"){let u=o.get(c);if(u)return u;let f={status:"structural-limit",source:a,program:c,assignmentFallbacks:[]};return o.set(c,f),f}let d=n.get(a);if(d)return d;let m=t.readGuardSyntax(a,c);return n.set(a,m),m},getCommandProgram:i}}function rb(e){let t=e.route.kind==="grep"?sd:e.route.kind==="glob"?tb:id;return[...Dl(e.input,t),...e.route.kind==="patch"?Wl(e.input):[]]}var ob=new Set(["-S","--suffix"]);function Cn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Io(e,t,n,r,{word:(i)=>i,segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(ge(i.target,s.variables),s)?i.target:null})}function Oo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&ob.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function md(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Lr(e.invocation.toolName))return null;let a=e.paths.find((l)=>ld(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ue(e,"input-candidate");if(!i)return null;let s=Cn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>lb(a,l,t,n,r),isRedirectionTarget:(a,l)=>ld(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Gt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Do(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(js(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?Mo(m,l):ib(m,l);if(n.markerFiles.some(d))return!0;return r&&cd(n).some(d)}if(js(a,n))return!0;return r&&cd(n).some((c)=>Mo(c,a))}function ib(e,t){let n=dd(t,e);if(n===""||n.startsWith("..")||ud(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function sb(e,t,n,r,o){return Gt(e,t,n,!0,r,o)}function ab(e,t,n,r,o){if(!n)return!1;return js(Do(ie(e,t,r,o)),n)}function ld(e,t,n,r,o,i){let s=Do(ie(e,t,r,o));return i.includes(s)||pd(s,n)}function fd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Mo(i,Do(ie(s,t,r,o)))))}function js(e,t){return t.entries.includes(e)||t.directories.includes(e)||pd(e,t)}function pd(e,t){return t.hooksDirectories.some((n)=>Mo(e,n))}function cd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Mo(e,t){let n=dd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!ud(n)}function Do(e){return process.platform==="win32"?e.toLowerCase():e}function lb(e,t,n,r,o){if(rr(e))return null;let i=gt([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Oo(i.slice(1)),a=s.sources.find((l)=>sb(ge(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&ab(ge(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Xs,normalize as yb,parse as Sb,posix as Rd,resolve as bn,sep as Zs}from"path";import{isAbsolute as cb,join as gd,normalize as Sd,parse as ub,sep as hd}from"path";var db=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],mb=` 	
-`;function sr(e,t){if(yt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Vs(e.get("TMPDIR")??"",t)}function zt(e,t){if(e.has("TMPDIR"))return Vs(e.get("TMPDIR")??"",t);let n=Ks(e,t);if(n===void 0)return!0;return Vs(n,t)}function Ks(e,t){return vd(e,t,"TMPDIR")}function Vs(e,t){if(!e)return!1;if(pb(e))return!1;return qs(e,t)}function yt(e,t){let n=vd(e,t,"IFS");return n!==void 0&&n!==""&&n!==mb}function qs(e,t){let n=No(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>hb(n,r))}function Cd(e,t){let n=No(e,t.paths);if(n===null)return!1;return bd(t).some((r)=>Lo(r)===Lo(n))}var yd=new WeakMap;function bd(e){let t=yd.get(e);if(t)return t;let n=fb(e);return yd.set(e,n),n}function fb(e){let t=db.map((r)=>No(r,e.paths)??Sd(r)),n=No(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&gb(n))return[...t,n];return t}function pb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function vd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function gb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function No(e,t){try{let n=Sd(e);if(!cb(n))return n;let r=ub(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=gd(i,o[s]??"");if(t.entryKind(a)==="missing")return gd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function hb(e,t){let n=Lo(e),r=Lo(t);if(n===r)return!0;let o=r.endsWith(hd)?r:`${r}${hd}`;return n.startsWith(o)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}var Cb=process.platform==="win32",Ed=64,bb=16384;function ar(e){let t=pu(e,Ed,Ed,bb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:vb(e)}}function vb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Eb(e.raw,n.span.start-e.span.start))}function Eb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Bt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:Ab(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Tb(e))return{kind:"outside_anchored_cwd"};let o=!r&&wd(e,t.posixShell);if(Ze(e))return{kind:"outside_anchored_cwd"};if(Js(e,r))return{kind:"root_or_home_target"};if(Rb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Gt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(xb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Pb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&Mb(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&Db(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(Nb(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function xd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(wb(i))return!1;if(Cd(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Lb(r??i,s,t.environment.paths,t.budget))}function Js(e,t=!1){let n=e.trim(),r=Rd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Rb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Xs(o)?o:t.resolvedCwd?bn(t.resolvedCwd,o):null;if(!i)return!1;let s=he(B(i,t.environment.paths,t.budget));if(s===Sb(s).root)return!0;return s===he(B(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=yb(e);if(Cb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function xb(e,t,n,r,o,i,s,a){let l=e.trim();if(_d(l))return!1;if(!r&&qs(l,a))return!0;return(t||i&&s)&&n&&!o&&_b(l,n)}function _b(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!wd(e.slice(n.length+1),t)})}function wb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Rd.normalize(`/${t[1]??""}`)==="/"}function _d(e){return e.split(/[\\/]+/).includes("..")}function Ab(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Bn(o.trim(),t);if(!Xs(i))return[];try{let s=B(i,n,r);if($n(s,B(t,n,r)))return[];return[he(s)]}catch{return[]}})}function Pb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(_d(r))return!1;let o=n?r:Bn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Xs(o)?o:i?bn(i,o):null;if(!s)return!1;try{let a=he(B(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Zs)?l:`${l}${Zs}`))}catch{return!1}}function Tb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function wd(e,t=!1){return e.includes("$")||e.includes("`")||Ib(e)||t&&kb(e)}function Ib(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function kb(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&Ob(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function Ob(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function Mb(e,t,n,r){try{return he(B(e,n,r))===he(B(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function Db(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return he(B(bn(t,e),n,r))===he(B(t,n,r))}catch{try{return he(bn(t,e))===he(t)}catch{return!1}}}function Nb(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ys(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ys(bn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ys(bn(a,e),t,i,s)}catch{return!1}}function Ys(e,t,n,r){try{return Ad(B(e,n,r),B(t,n,r))}catch{return!1}}function Lb(e,t,n,r){if(!t)return!1;try{return Ad(B(t,n,r),B(e,n,r))}catch{return!0}}function Ad(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${Zs}`)||n===r}var Wb=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Pd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Fb="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Td="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Id="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Gb="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",zb="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function kd(e,t,n,r=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return Bb(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function Bb(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=Ub(o),s=o[i];if(!s||!Wb.has(Jb(s.text)))return null;let a=$b(o.slice(i+1));if(a.whatIfProtected)return null;if(Q(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",zb);for(let l of a.targets)if(!Ze(l.text)&&Js(ea(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Id);for(let l of a.targets)if(n.resolvedCwd&&Gt(ea(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(Q(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",Td);for(let l of a.targets){let c=Qb(Ge(ea(l.text),n),n,r);if(c)return c}return null}function $b(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Hb(l))continue;if(s){t.push(Qs(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=Vb(l.text);if(!c){t.push(Qs(l)),i=i||l.dynamic;continue}if(Kb(c.name)){let d=c.value?jb(c.value,l):e[++a];if(d?.kind==="word"){t.push(Qs(d)),i=i||d.dynamic;continue}i=!0;continue}if(qb(c.name)){n=!0;continue}if(Yb(c.name)){r=!0;continue}if(Zb(c.name))o=Xb(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function Ub(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Qs(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Hb(e){return e.kind==="word"&&e.text===","}function ea(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function jb(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function Vb(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Kb(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function qb(e){return"recurse".startsWith(e)}function Yb(e){return e.length>=2&&"force".startsWith(e)}function Zb(e){return e==="wi"||"whatif".startsWith(e)}function Xb(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Jb(e){return e.toLowerCase()}function Qb(e,t,n){switch(e.kind){case"root_or_home_target":return S("powershell.remove-item-recursive-force-root-or-home",Id);case"git_metadata_target":return S("powershell.remove-item-git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return S("powershell.remove-item-recursive-force-dynamic-target",Td);case"home_cwd_target":return S("powershell.remove-item-recursive-force-home-cwd",Gb);case"cwd_self_target":return S("powershell.remove-item-recursive-force-cwd-self",Pd);case"within_anchored_cwd":if(!Q(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return S("powershell.remove-item-recursive-force-paranoid",Fb);case"outside_anchored_cwd":return S("powershell.remove-item-recursive-force-outside-cwd",Pd)}}var vn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Wo="Unsupported heredoc syntax",Od="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as ei}from"path";var ev=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),tv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),nv=new Set(["-o","--output","--query","--subscription"]),rv=new Set;function Md(e){if(e==="aws")return ev;if(e==="gcloud")return tv;if(e==="az")return nv;return rv}var ov=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),iv=new Set;function Dd(e){if(e==="git")return le;if(e==="docker")return ov;return iv}function ze(e,t){if(e.length===0||t.length===0)return null;let n=L(e[0]??""),r=fe(e);for(let o of t){if(!lv(n,o.command))continue;if(o.match){if(sv(n,e,o.match))return Nd(o);continue}if(!cv(n,e,o.subcommand))continue;if(dv(e,new Set(o.block_args),r))return Nd(o)}return null}function Nd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function sv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return av(r,n.command_path,Md(e))}function av(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function lv(e,t){return e===L(t)}function cv(e,t,n){if(!n)return!0;return Ld(t,1,n,Dd(e))}function Ld(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&uv(e,i,n,r))return!0;continue}return s===n}return!1}function uv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Ld(e,t+2,n,r)}function dv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var mv=new Set(["-e","--source"]),fv=new Set(["-F","-v","--assign","--field-separator"]),Wd=new Set(["-f","--file"]),pv=new Set(["print","printf","return"]),Fd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],gv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Gd(e,t,n){let r=!1;for(let o of hv(e)){let i=yv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",gv):null}function na(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&mv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(fv.has(a)||Wd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Wd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return na(e).sources}function hv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function yv(e,t){Ee(t,e);let n=e.includes("system")?ra(e,t):null,r=Sv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ra(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Go(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=zd(e,i+1);continue}if(s==="/"&&Bd(e,i)){i=$d(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=Fo(e,i);if(e[l]!=="(")continue;l=Fo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Go(e,l,c);if(!d){r=!0,o=!0;continue}if(l=Fo(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Sv(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Go(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=zd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Bd(e,i)){let f=$d(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ta(e,i,"print")||ta(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=Fo(e,m);if(ta(e,u,"getline")){o=!0;let f=vv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Rv(s,a)){o=!0;let f=bv(e,u);if(!f){r=!0,c=m,i=m;continue}if(!Cv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Fo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Cv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Go(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Ev(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function bv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Go(e,t,n)}function vv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Ev(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ta(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function Rv(e,t){return t!==null&&t>=e}function zd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Bd(e,t){let n=xv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return pv.has(e.slice(r,n+1))}function xv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function $d(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var _v=new Set(["sudo","env","command","builtin"]);function zo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=wv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function wv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Av(a,r);if(l)i.push(s);if(!l&&Ur.has(L(a)))break;if(o)break}return i}function Av(e,t){let n=I(e),r=L(e);return r==="git"||n==="busybox"||$t(e)||Ki.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return _v.has(e.toLowerCase())}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Bo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Bo(e,t,n,r,o,i,s,a,l){let c=Ao(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=wo(c.envSplitValues,d);if(!f)throw new F("derivedCommandShape");oa(a),yield*Bo(f,t,m,r,o,i,s,a,l);return}if($t(d[0]??""))throw new F("wrapperPeelIterations");let u=zo(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])oa(a),yield*Bo(f===u.childIndex?u.tokens:[...d.slice(f)],t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Tv(d)){oa(a),yield*Bo([...d.slice(1)],t,m,r,o,i,s,a,l);return}yield Pv(d,m,r,o,i,l)}function Pv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function oa(e){if(e.iterations>=P.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function Tv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ia(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function $e(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||sa(r,"recursive")){t=!0;continue}if(r==="-f"||sa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Ud(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>sa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function sa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Iv="find -delete permanently removes files. Use -print first to preview.",kv="find -exec rm -rf is dangerous. Use explicit file list instead.",Ov=new Set(["-exec","-execdir","-ok","-okdir"]),Mv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Hd(e,t){let n=e.map(_),r=Dv(e,n,t);if(r)return r;if(Uo(n,1)&&!Lv(e,n,t)){let s=T(S("find.delete",Iv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=St(s??"");if(a>0){i+=a+1;continue}if(!nt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Fv(l.tokens,t.environment);if(c){let f=T(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:T(m,t.policy);if(u)return u}return null}function Dv(e,t,n){if(!Uo(t,1)&&!aa(t,n.environment))return null;let o=$o(e)??q(["."]),i=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=ar(s);for(let l of a.expandedTargets??[_(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return S("find.delete-git-metadata",Te)}}if(Nv(t)&&i.resolvedCwd&&fd(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function aa(e,t){let n=0;while(n<e.length){if(!nt(e[n])){n++;continue}let r=ur(e,n),o=gt([...r.tokens],t),i=I(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Nv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Lv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=$o(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ks(o,n.environment),s=n.trustedTmpdirValue??zt(o,n.environment),a=n.allowTmpdirVar??!sr(o,n.environment),l=Bt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??yt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let d=ar(c);if(d.unsafeBraceExpansion)return!1;return(d.expandedTargets??[_(c)]).every((m)=>xd(m,l,{containmentTarget:Wv(m,i),targetIsLiteral:d.expandedTargets!==void 0||d.targetIsLiteral,tmpdirWordSplittingProtected:d.tmpdirWordSplittingProtected}))})}function Wv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function $o(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Fv(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&$e(n))return S("find.exec-rm-recursive-force",kv);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Uo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(nt(r)){n=ur(e,n).nextIndex;continue}let o=St(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function St(e){return Mv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function nt(e){return e!==void 0&&Ov.has(e)}function dr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Gv=5,la="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function de(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Vd(e,t,n){let r=qd(e,t,n),o=zv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Gv;a++){let{subcommand:l,rest:c}=Ue(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=jv(m);if(u===null||u.length===0)return{blockedReason:la,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:la,expanded:!0,tokens:i}}function Kd(e,t,n){return qd(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ue(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=le.has(o)?2:1}return{subcommand:null,rest:[]}}function zv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qd(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=$v(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Bv(e,t,n)]}}function Bv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ca(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ca(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=jd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=jd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(le.has(i)){o+=2;continue}o++}return r}function $v(e,t){let n=Uv(e,t),r=Hv(e,t);return{blockedReason:n===null||r===null?la:null,entries:[...n??[],...r??[]]}}function Uv(e,t){let n=Ae("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=ca(i);if(!s)return null;r.push(s)}return r}function Hv(e,t){let n=Ro(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ae(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ae(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ca(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function jd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ae(e.slice(r+1),t,n)}}function jv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var Vv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Kv="git checkout --force discards uncommitted changes. Use 'git stash' first.",qv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Yv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Zv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Xv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Jv="git switch --force discards uncommitted changes. Use 'git stash' first.",Qv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",eE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",tE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",nE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",rE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",oE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",iE="git push --force destroys remote history. Use --force-with-lease for safer force push.",sE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",aE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",lE="git branch -D force-deletes without merge check. Use -d for safe delete.",cE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",uE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",dE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",mE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",fE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",pE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",gE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",hE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),yE=new Set(["--recurse-submodules","--track","-t"]),ua=new Set(["-b","-B","-U"]),da=new Set(["-c","-C"]),SE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Zd(e){let{subcommand:t,rest:n}=Ue(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return Ct(CE(n));case"switch":return Ct(bE(n));case"restore":return Ct(EE(n));case"reset":return xE(n);case"clean":return Ct(wE(n));case"rm":return Ct(AE(n));case"push":return Ut(PE(n));case"branch":return Ut(kE(n));case"stash":return Ut(LE(n));case"worktree":return Ut(WE(n));case"rebase":return Ct(OE(n));case"merge":return Ct(ME(n));case"tag":return Ut(DE(n));case"reflog":return Ut(NE(n));default:return null}}function Ct(e){return e?{...e,localDiscard:!0}:null}function Ut(e){return e?{...e,localDiscard:!1}:null}function CE(e){let{index:t,before:n}=de(e),r=fe(n,{shortOptsWithValue:ua});if(n.some((i)=>M(i,"--force"))||r.has("-f"))return S("git.checkout-force",Kv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(M(i,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",Yv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return S("git.checkout-ref-path",qv);return S("git.checkout-double-dash",Vv)}if(vE(e).length>=2)return S("git.checkout-ambiguous",Zv);return null}function bE(e){let{before:t}=de(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",Xv);let n=fe(t,{shortOptsWithValue:da});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",Jv);return null}function vE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(hE.has(r)){n+=2;continue}if(yE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function EE(e){let t=RE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",eE):S("git.restore-unstaged",Qv)}function RE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(SE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function xE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",tE);break}if(M(n,"--merge")){t=S("git.reset-merge",nE);break}}if(!t)return null;return _E(e)?Ut(t):Ct(t)}function _E(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function wE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=fe(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",rE);return null}function AE(e){let t=!1,n=!1,r=!1;for(let o of de(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=fe([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",oE):null}function PE(e){let{before:t,after:n}=de(e),r=fe(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",aE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Yd(t,n).some(TE))return S("git.push-force",iE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Yd(t,n).some(IE))return S("git.push-delete",sE);return null}function Yd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function TE(e){return e.startsWith("+")||e.includes(":+")}function IE(e){return e.length>1&&e.startsWith(":")}function kE(e){let{before:t}=de(e),n=fe(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",lE);return null}function OE(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",cE):null}function ME(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",uE):null}function DE(e){let{before:t}=de(e);return fe(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",dE):null}function NE(e){return e[0]==="delete"?S("git.reflog-delete",mE):null}function LE(e){for(let t of e){if(t==="drop")return S("git.stash-drop",fE);if(t==="clear")return S("git.stash-clear",pE)}return null}function WE(e){let{before:t}=de(e);if(!t.includes("remove"))return null;let r=fe(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",gE);return null}import{resolve as FE}from"path";function Jd(e,t){return Fs.some((n)=>t?.has(n)||e.has(n))}function Qd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(FE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Xd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Xd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=le.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Xd(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function nm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Jd(n.environment.env,n.envAssignments))return null;let r=Qd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(GE(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function GE(e,t,n){let{subcommand:r,rest:o}=Ue(e),i=r?.toLowerCase();if(t.dynamicArguments||zE(o)||jE(e,t.environment.env,t.envAssignments,n)||UE(o)||BE(i,o))return!0;return i==="clean"&&HE(o)>1}function zE(e){return e.some((t)=>/[$*?[]/.test(t))}function BE(e,t){if(e==="checkout"){let{before:n}=de(t),r=fe(n,{shortOptsWithValue:ua}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=de(t),r=fe(n,{shortOptsWithValue:da}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||$E(s))||r.has("-C");return o&&i}return!1}function $E(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function UE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function HE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function jE(e,t,n,r){let o=VE(e,t,n);if(o!==null)return o;let i=KE(t,n);if(i!==null)return i;if($u(n))return!0;return r.recursiveSubmodules}function VE(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=em(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=em(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=tm(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=tm(i.slice(13),t,n);if(s!==null)r=s;o++;continue}o+=le.has(i)?2:1}return r}function KE(e,t){if(Ae("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=Ro(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=Ae(`GIT_CONFIG_KEY_${o}`,e,t),s=Ae(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(fa(a))return!0;if(a!=="submodule.recurse")continue;r=ma(s)}return r}function em(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(fa(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return ma(r)}function tm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(fa(o))return!0;if(o!=="submodule.recurse")return null;let i=Ae(e.slice(r+1),t,n);return i===void 0||ma(i)}function ma(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function fa(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var qE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",YE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Ho(e,t){return rm(e.map(_),t)}function rm(e,t,n){let r=Vd(e,t.environment.env,t.envAssignments),o=r.blockedReason?T(S("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((Bu(t.envAssignments)||Kd(e,t.environment.env,t.envAssignments))&&ZE(i))return S("git.ssh-env",qE);let s=Zd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=nm(e,s,t);if(!a)return s;return n?.(a),null}function om(e,t){let n=null;return{match:rm(e.map(_),t,(o)=>{n=o}),relaxation:n}}function ZE(e){let{subcommand:t,rest:n}=Ue(e),r=t?.toLowerCase();if(!r)return!1;if(YE.has(r))return!0;if(r==="archive")return de(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&XE(n)}function XE(e){return e.find((t)=>!JE(t))?.toLowerCase()==="update"}function JE(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as DR}from"path";function Re(e,t){e.charge("parallelChildAnalyses",t.childAnalyses??0),e.charge("parallelDerivedTokens",t.derivedTokens??0),e.charge("parallelDerivedBytes",t.derivedBytes??0),e.charge("parallelPlaceholderReplacements",t.placeholderReplacements??0)}var im="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",eR="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",am="rm -rf targeting root or home directory is extremely dangerous and always blocked.",tR="rm -rf in home directory is dangerous. Change to a project directory first.";function jo(e,t){let n=Bt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=$e(r),i=Ud(r),s=rR(e);for(let a of s){let l=ar(a.word);if(o&&l.unsafeBraceExpansion){let c=T(sm({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=be(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Gt(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let u=Ge(d,n,m);if(u.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",am);if(u.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let u of nR(d,n,m)){let f=sm(u,n,t.policy),p=T(f,t.policy);if(p)return p}}}return null}function nR(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function rR(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function sm(e,t,n){switch(e.kind){case"root_or_home_target":return S("rm.recursive-force-root-or-home",am);case"git_metadata_target":return S("rm.git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"rm.recursive-force-dynamic-target",t.strict))return null;return S("rm.recursive-force-dynamic-target",eR);case"home_cwd_target":return S("rm.recursive-force-home-cwd",tR);case"cwd_self_target":return S("rm.recursive-force-cwd-self",im);case"within_anchored_cwd":if(Q(n,"rm.recursive-force-paranoid",t.paranoid))return S("rm.recursive-force-paranoid",QE);return null;case"outside_anchored_cwd":return S("rm.recursive-force-outside-cwd",im)}}var oR={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},cm=new Set(["--init-file","--rcfile"]),iR=["--init-file","--rcfile"],sR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function rt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return lm(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=lm(e,t,!1);if(r!==null)return r}}return null}function ot(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ke(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function lm(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function um(e){let t=I(e[0]??"").toLowerCase(),n=aR(e,t),r=sR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function aR(e,t){let n=Ke(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?iR.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&cm.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=dm(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function dm(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!oR[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ke(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&cm.has(l)&&!s.includes("="))i++;continue}let a=dm(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var bt={kind:"none"},Ht={kind:"dynamic"},lR=new Set(["<","<<","<<-","<<<","<&","<>"]),fm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,cR=/^(?:[0-9]+|[@*])$/,uR=Nt.maxWords,dR=Nt.maxInputLength;function pm(e){if(!e||I(L(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`)}function rl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function xn(e={}){return{reason:Rn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function ol(e){return cp({...e,redact:at})}function il(e){return at(e instanceof Error?e.message:String(e))}import{types as up}from"util";var dp=new Set(["applypatch","patch"]),mp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),fp=new Set(["grep","grepsearch","rg"]),pp=new Set(["find","findbyname","glob"]),gp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),hp=new Set(["command","diff","input","patch","patchtext"]),sl=new TextEncoder,yp=new TextDecoder,bp=/\s/,Cp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var _n=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function dl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Rr(e){return gp.has(dl(e))}function hi(e){let t=dl(e);if(dp.has(t))return"patch";if(fp.has(t))return"grep";if(pp.has(t))return"glob";if(mp.has(t))return"path";return"unknown"}function Pn(e){if(!e||typeof e!=="object")return;bl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function ml(e,t){return fl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function fl(e,t,n,r){let o=yl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=fl(a,t,n,r+1);return typeof a==="string"&&t.has(pl(s))?[a]:l});return n.ancestors.delete(o.object),i}function pl(e){return e.replace(/-/g,"_").toLowerCase()}function gl(e){return hl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(vp)}function hl(e,t,n,r){let o=yl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>hl(a,o.array?t:hp.has(pl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Sp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>_n.maxDepth||t.nodes>_n.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>_n.maxStringBytes||t.stringBytes>_n.maxAggregateStringBytes)Ue()}function yl(e,t,n){if(Sp(e,t,n),!e||typeof e!=="object")return null;let r=bl(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>_n.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function bl(e){if(up.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function vp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let m=Ep(c);if(o=!0,i=m?.oldLines??null,s=m?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let m=c.startsWith(" ")||c.startsWith("-")?1:0,d=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-m),s=Math.max(0,s-d),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...fi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...fi(c));continue}if(c.startsWith("--- ")){let m=n[l+1]??"";if(!m.startsWith("+++ "))continue;t.push(...gi(Er(c.slice(4),!0),Er(m.slice(4),!0))),l++;continue}if(!r)t.push(...fi(c))}return t}function Ep(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function fi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return ul(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return ul(n[1]);if(e.startsWith("diff --git "))return Rp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return cl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return cl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Ip(i[1]);return[]}function Rp(e){let t=xp(e);if(t.length===2&&t[0]&&t[1])return gi(t[0],t[1]);let n=_p(e);return n?gi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function xp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Et(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Et(e[n]))n++;t.push(e.slice(i,n));continue}let o=Cl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Et(e[n]))n++;return n===e.length?t:[]}function _p(e){let t=0;while(t<e.length&&Et(e[t]))t++;let n=e.length;while(n>t&&Et(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Et(e[o])){o++;continue}let i=o;while(o<n&&Et(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Cp)Ue();if(wp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function wp(e,t,n,r,o){if(pi(e,t,n,r,o))return!0;let i=al(e,"/",t,n),s=al(e,"/",r,o);if(i<=t||s<=r)return!1;if(pi(e,t,i,r,s))return!1;return pi(e,i+1,n,s+1,o)}function pi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function al(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Et(e){return e!==void 0&&bp.test(e)}function Cl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:yp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...sl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...sl.encode(Pp(s[0]??""))),o+=2}return null}function Pp(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function Ap(e){return wn(kp(e))}function gi(e,t){if(e==="/dev/null")return ll(t);if(t==="/dev/null")return ll(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(wn);let n=Tp(e,t)??(e===t?Sl(e):null);return[e,t,...n?[n]:[]].flatMap(wn)}function ll(e){let t=Sl(e);return[e,...t?[t]:[]].flatMap(wn)}function Sl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Tp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function cl(e){return Ap(Er(e,!0))}function Ip(e){return wn(Er(e,!1))}function Er(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Cl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function kp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function wn(e){return e===""||e==="/dev/null"?[]:[e]}function ul(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ei,relative as zp,resolve as Pl,sep as Bp}from"path";import{basename as Rl,dirname as Op,isAbsolute as Mp,join as Dp,normalize as Np,resolve as vl}from"path";var Lp=256,xr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ke(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Si(e,t){return yi(e,0,t)}function yi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=bi(e,o+2),a=Wp(e,o,t);if(a===null){if(xr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Fp(l,t,n),o=a+1;continue}let i=bi(e,o+1);if(!i){r+="$",o++;continue}r+=Ci(i,n)??`$${i}`,o+=i.length+1}return r}function Wp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Fp(e,t,n){let r=e.slice(2,-1),o=bi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ci(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(xr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!xr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=Ci(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":yi(i.slice(s.length),t+1,n);return l?yi(i.slice(s.length),t+1,n):""}function bi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ci(e,t){if(!xr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function G(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){xl(n,i);let s=t.realpath(i);if(s!==null)return El(n,e,s,o);let a=Op(i);if(a===i||o.length>=Lp)return El(n,e,i,o);o.push(Rl(i)),i=a}}function El(e,t,n,r){let o=r.length===0?n:Dp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Gp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;xl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function xl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=wl(e,t,n);if(!o)return"";return G(o,n.paths,r).replace(/\\/g,"/")}function _l(e,t,n,r,o){let i=wl(e,t,n);if(!i)return null;if(o(Rl(i)))return G(i,n.paths,r).replace(/\\/g,"/");let s=Gp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function wl(e,t,n){let r=n.home,o=Si(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?vl(r,o.slice(2)):o,s=be(i);return Np(Mp(s)?s:vl(t,s))}function Al(e,t,n){if(Ke(e))return;let r=t.flatMap((i)=>vi(i,n));if(!r[0])return;let o=vi(Ei(e)?e:Pl(r[0],e),n)[0];if(!o)return;return r.some((i)=>$p(o,i))?o:void 0}function Tl(e,t,n){if(Ke(e))return;return vi(Ei(e)?e:Pl(t,e),n)[0]}function vi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function $p(e,t){let n=zp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Bp}`)&&!Ei(n)}function qt(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as hg,realpathSync as yg,statSync as bg}from"fs";import{homedir as Cg,tmpdir as Sg}from"os";import{statSync as fg}from"fs";import{join as pg}from"path";import{spawnSync as Up}from"child_process";import{existsSync as Tn,lstatSync as Hp,readFileSync as In,realpathSync as Yt,statSync as An}from"fs";import{dirname as Ri,isAbsolute as xi,join as Zt,resolve as _r}from"path";var jp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Vp=5000;function kl(e,t=cg(),n=Vp){let r=Kp(e),o=r===null?null:qp(r);if(r===null||o===null)return null;let i=ag(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Kp(e){try{let t=Yt(_r(e));return An(t).isDirectory()?t:null}catch{return null}}function qp(e){let t=sg(e);if(!t)return null;try{let n=Hp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=_i(t);if(!r?.commonDir)return null;if(!Xp(r.gitDir,t))return null;return Jp(r.gitDir,Ri(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function _i(e){try{let t=Yp(e);if(!t)return null;let n=Yt(xi(t)?t:_r(Ri(e),t));if(!An(n).isDirectory())return null;return{gitDir:n,commonDir:Zp(n)}}catch{return null}}function Yp(e){let t=In(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Zp(e){try{let t=In(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(xi(t)?t:_r(e,t));return An(n).isDirectory()?n:null}catch{return null}}function Xp(e,t){let n=Qp(e);return n===null?!1:Ol(e,n,t)}function Jp(e,t){let n=eg(e);return n===null?!0:Ol(e,n,t)}function Qp(e){let t=Zt(e,"gitdir");if(!Tn(t))return null;let n=In(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function eg(e){let t=Zt(e,"config.worktree");return Tn(t)?ng(t):null}function Ol(e,t,n){try{return tg(xi(t)?t:_r(e,t),n)}catch{return!1}}function tg(e,t){try{let n=An(e),r=An(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Il(Yt.native(e))===Il(Yt.native(t))}function Il(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function ng(e){let t=In(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=rg(s[1]??"")}return r}function rg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return ig(t.slice(1,-1))}var og={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function ig(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:og[n]??t)}function sg(e){try{return wi(Yt(e))}catch{return null}}function wi(e){let t=e;while(!0){let n=Zt(t,".git");if(Tn(n))return n;let r=Ri(t);if(r===t)return null;t=r}}function ag(e,t,n,r){if(lg(t))return!0;if(n===null)return!0;let o=Up(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:ug(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ml(o.stdout.trim())}function lg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>Tn(t)).some((t)=>dg(t))}function cg(){return jp.find((e)=>Tn(e))??null}function kn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function ug(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!kn(t)))}function dg(e){let t;try{t=In(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(mg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ml(c)}return r}function mg(e){return e==="include"||e.startsWith("includeif ")}function Ml(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Dl(e,t){if(e==="")return null;let n=ye(),r=wi(ie(e,e,t,n)),o=r?gg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function gg(e,t,n,r){try{let o=ie(e,t,n,r),i=fg(e),s=i.isFile()?o:null,a=i.isFile()?_i(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((m)=>m?[Xt(ie(m,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((m)=>{let d=Xt(pg(m,"hooks").replace(/\\/g,"/"));return[d,Xt(ie(d,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var vg={realpath:(e)=>{try{return yg(e)}catch{return null}},entryKind:(e)=>{let t=hg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return bg(e).isDirectory()}catch{return!1}}};function Ll(){return Eg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||Cg()),tmpdir:Sg(),paths:vg})}function Eg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Nl(n,i,()=>Dl(i,o)),worktreeFacts:(i)=>Nl(r,i,()=>kl(i)),...t};return o}function Nl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],wr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Pr=["standard","strict","paranoid"];function Rg(e,t){if(!t)return e;return Pr.indexOf(t)>Pr.indexOf(e)?t:e}function xg(e){let t=Ii(Q.level,e);if(t===void 0||t==="")return;if(Pr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Pr.join(", ")}.`);return}function _g(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Wl(e){return _g(Ii(Q.auditScope,e))==="all"}function Ai(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Ti(e={},t){let n=e.safety?.level??"standard",r=xg(t),o=Rg(n,r),i=wr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Rt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(Rt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(Rt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(Rt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Rt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ai(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Rt(e,t){let n=typeof e==="string"?Pi(e,t):Ii(e,t);return n==="1"||n?.toLowerCase()==="true"}function Pi(e,t){return t.get(e)}function Ii(e,t){let n=Pi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Pi(e.legacyName,t);return}import{dirname as Lr}from"path";import{closeSync as wg,constants as Fl,fstatSync as Pg,fsyncSync as FP,lstatSync as Mi,mkdirSync as GP,openSync as Ag,readdirSync as zP,readFileSync as Tg,realpathSync as Di,renameSync as BP,rmdirSync as $P,statSync as Ig,unlinkSync as UP,writeFileSync as HP}from"fs";import{isAbsolute as Gl,join as Ni,normalize as kg,parse as Oi,relative as Li,resolve as Wi,sep as Fi}from"path";function ki(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Og=Symbol("PolicyFilesystemScope"),Mg=Symbol("PolicyFilesystemTarget"),Dg=Fl.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function xt(e,t){return{[Og]:!0,root:Wi(e),label:t}}function zl(e,t){let n=kg(t);if(t===""||Gl(t)||n===".."||n.startsWith(`..${Fi}`))throw new se(e.label);return{[Mg]:!0,scope:e,relativePath:n,path:Ni(e.root,n)}}function On(e,t){return zl(e,Li(e.root,Wi(t)))}function Bl(e,t="rules policy"){let n=Wi(e),r=Oi(n).dir;return zl(xt(r,t),Li(r,n))}function Tr(e){return Ul(e.scope.label,()=>{if(!Ar(e))return null;let t=Ag(e.path,Fl.O_RDONLY|Dg);return Ng(t,()=>{let n=Pg(t);if(!n.isFile())throw new se(e.scope.label);let r=Tg(t,"utf-8"),o=Mi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Ar(e),r})})}function $l(e,t){if(e.path===t.path)return!0;return Ul(e.scope.label,()=>{if(!Ar(e)||!Ar(t))return!1;let n=(r)=>Ni(Di(Oi(r).dir),Oi(r).base);return n(e.path)===n(t.path)})}function Ul(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function Ng(e,t){try{return t()}finally{wg(e)}}function Ar(e,t="file"){let n=Lg(e.scope);if(!n)return!1;let r=e.relativePath.split(Fi);for(let o of r.keys()){let i=Ni(e.scope.root,...r.slice(0,o+1)),s=Mi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);Wg(n,Di(i),e.scope.label)}return!0}function Lg(e){if(!Mi(e.root,{throwIfNoEntry:!1}))return null;if(!Ig(e.root).isDirectory())throw new se(e.label);return Di(e.root)}function Wg(e,t,n){let r=Li(e,t);if(r===".."||r.startsWith(`..${Fi}`)||Gl(r))throw new se(n)}import{dirname as wt,isAbsolute as $g,join as At,relative as Ug,resolve as Pt,sep as Hg}from"path";var _t=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Hl="rulebook.json",jl=".cc-safety-net/rules";var Vl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Fg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Gg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),zg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),qP=new RegExp(`^${Gg}/(${_t.source.slice(1,-1)})/${zg}$`);function Bg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Kl(e){if(Ir(e))try{return Gi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return _t.test(e)?null:`Local rulebook sources must be bare names matching ${_t}: ${e}`}function Gi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Vl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Fg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!_t.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Bg(o),name:o}}function Ir(e){return Vl.test(e)}var ql="rule.json",kr="policy.json",Yl=".cc-safety-net",jg="rules",Vg="CC_SAFETY_NET_HOME",Zl="`cc-safety-net rule update`";function Kg(e){return Pt(e,jl)}function qg(e){return At(Kg(e),ql)}function Mn(e){return At(Pt(e),Yl,kr)}function zi(e,t={}){return t.userConfigDir??(t.userConfigPath?wt(t.userConfigPath):At(Yg(e),jg))}function Yg(e){let t=e.env.get(Vg);return t?Pt(be(t)):At(e.home,Yl)}function Zg(e,t={}){return At(zi(e,t),ql)}function Qt(e,t={}){return At(wt(zi(e,t)),kr)}function Xl(e,t){let n=t.userConfigPath??Zg(e,t),r=t.projectConfigPath??qg(t.cwd),o=Xg(e,t),i=Jg(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:On(o,n),projectConfigTarget:On(i,r)}}function Xg(e,t){let n=t.userConfigPath?wt(wt(Pt(t.userConfigPath))):wt(Pt(t.userConfigDir??zi(e,t)));return xt(n,"user policy")}function Jg(e,t){let n=Pt(t),r=Pt(e),o=Ug(n,r);if(o!==".."&&!o.startsWith(`..${Hg}`)&&!$g(o))return xt(n,"project policy");return xt(wt(wt(r)),"project policy")}function Jl(e,t){return At(e,t,Hl)}var Ce=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Ql=new Set(["python","python3","python2","node","ruby","perl"]),Or=/^python(?:[23](?:\.\d+)*)?$/,_e=new Set(["awk","gawk","nawk","mawk"]),Mr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var ec="Rulebook exceeds CC Safety Net's safe validation limits.",tc="Additional rulebook validation errors were omitted.",Ie=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function nc(e){if(Bi(e.allowed_commands,Ie.maxAllowedCommands)||Bi(e.rules,Ie.maxRules)||Bi(e.tests,Ie.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ie,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ie.maxStringCodeUnits||i&&o.length>Ie.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ie.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Bi(e,t){return Array.isArray(e)&&e.length>t}var $i=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Ui=64,Hi="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Qg={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ji=new Set(["--init-file","--rcfile"]);function Vi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let m=t[c];if(m===void 0)break;if(e==="ksh"&&m==="o"&&c+1<t.length){if(r==="argv"){let d=t.slice(c+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&m==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&m==="o"&&c+1<t.length)break;if(r==="startup"&&m==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&m==="c")s=!0;if(r==="argv"&&m==="n")l=t[0]==="-";if(r==="argv"&&m==="s")a=t[0]==="-";if(!Qg[e]?.includes(m))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ji.has(l)&&!s.includes("="))i++;continue}let a=Vi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Dn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Dr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of eh(e))Dn(n,t);return t.inSingle||t.inDouble}function eh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Dn(s,n)}return t}var Ki=new Set(["rm","find","xargs","parallel"]),th=new Set(["git","busybox",...Ki,...J,...Ql,..._e]),nh=new Set(["python","node","ruby","perl"]);function rc(e){let t=M(e);return th.has(t)||ke(t)}function ke(e){return nh.has(rh(e))}function rh(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function qi(e){try{let t=Tr(oh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=ah(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function oh(e){return typeof e==="string"?Bl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function oc(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Yi=`must be one of ${$i.join(", ")}`,ih=/^[^/]+\/[^/]+$/,sh=["version","rules","overrides","transparent_wrappers"];function ah(e){let t=lh(e);return{errors:Zi(yh(t,sh,(n)=>n.kind==="custom"),": "," "),sources:hh(e,t)}}function lh(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Ui;return[...e.version===1?[]:[_(["version"],"must be 1")],...ch(e.rules,t),...mh(e.overrides),...ph(e.transparent_wrappers),...t?[]:dh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!ih.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...gh(e.transparent_wrappers)]}function ch(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...ic(e,Ui)?[_(["rules"],Hi)]:[]];if(t)return[{path:["rules"],message:Hi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...uh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function ic(e,t){let n=sc(e);return n!==void 0&&!(n<=t)}function uh(e,t){let n=sc(e);return n!==void 0&&!(n>=t)}function sc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function dh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Kl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function mh(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...fh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Ji(n.intent)?[]:[_(["overrides",t,"intent"],Yi)]]})}function fh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...ic(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function ph(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function gh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(rc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function hh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function yh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Zi(e,t,n){return[...new Set(e.map((r)=>{let o=Xi(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Xi(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Ji(e){return $i.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function lc(e){let t=Sh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var bh=`required non-empty string up to ${ct} characters`,ac="must be a non-empty array of unique non-empty strings",Ch="required non-empty array of non-empty strings";function Sh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!nc(e))return{errors:[ec],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Zi(vh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ie.maxValidationErrors?[...t.slice(0,Ie.maxValidationErrors),tc]:t,ruleNames:new Set(cc(e).map((n)=>n.toLowerCase()))}}function cc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function vh(e,t){return[...typeof e.name==="string"&&_t.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Eh(e.allowed_commands),...Rh(e.rules,t),...Ph(e.tests),...Ah(e),...Th(e)]}function Eh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Rh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?_h(n,["rules",r]):xh(n,["rules",r])}),...oc(e)]}function xh(e,t){return[...uc(e.name,t),...dc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Nr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...mc(e.reason,t),...fc(e.intent,t)]}function _h(e,t){return[...uc(e.name,t),...dc(e.command,t),...mc(e.reason,t),...fc(e.intent,t),...wh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function uc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return _t.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function dc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function mc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],bh)]}function fc(e,t){return e===void 0||Ji(e)?[]:[_([...t,"intent"],Yi)]}function wh(e,t){if(!ut(e))return[_(t,"required object")];return[...Nr(e.command_path,[...t,"command_path"],Ch,!1),...e.any_args===void 0?[]:Nr(e.any_args,[...t,"any_args"],ac,!0),...e.exclude_args===void 0?[]:Nr(e.exclude_args,[...t,"exclude_args"],ac,!0)]}function Nr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Ph(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Ah(e){if(!Array.isArray(e.tests))return[];let t=new Set(cc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Th(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Cc(e,t){let n=Xl(e,t),r=!1;try{r=$l(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof se)return Fh(n,f.message);throw f}let o=qi(n.userConfigTarget),i=r?{config:null,errors:[]}:qi(n.projectConfigTarget),s=yc(n.userConfigPath,o.errors),a=yc(n.projectConfigPath,i.errors),l=new Set,c=o.config?pc(o.config,Lr(n.userConfigPath),"user",n.userScope,l):bc(),m=i.config?pc(i.config,Lr(n.projectConfigPath),"project",n.projectScope,l):bc(),d=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...gc(c.rules,d),...gc(m.rules,u)],transparent_wrappers:Lh(o.config,i.config),rulebooks:[...c.rulebooks,...m.rulebooks],errors:[...s,...a,...c.errors,...m.errors],warnings:[...c.warnings,...m.warnings,...c.canValidateOverrides?hc(d,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Wh(u,c.knownRuleIds,n.projectConfigPath):[],...m.canValidateOverrides?hc(u,m.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function pc(e,t,n,r=xt(Lr(Lr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let m=kh(c,t,r);if(m.errors.length>0||!m.rulebook)return i.push(...m.errors),[];let d=m.rulebook;if(o.has(d.name))return s.push(`duplicate active rulebook name "${d.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(d.name),[{rules:Ih(d),rulebook:{source:n,spec:c,name:d.name,version:d.version,rules:d.rules.map((u)=>`${d.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Ih(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function kh(e,t,n){let r=Oh(e),o=Jl(t,r),i=Dh(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Mh(e)}`]};let s=Nh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Oh(e){return Ir(e)?Gi(e).name:e}function Mh(e){return Ir(e)?`run ${Zl} to vendor ${e}`:"create that file or remove that source from the rules config"}function Dh(e,t){try{return{content:Tr(On(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function Nh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:lc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Lh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function gc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function hc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Wh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function yc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Fh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function bc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Xh,readFileSync as Jh}from"fs";var Sc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Qi=new Set(Sc.map((e)=>e.id)),Wr=Sc,Gh=new Map(Wr.map((e)=>[e.id,e.intent]));function C(e,t){return{id:e,reason:t,intent:Gh.get(e)??"manual_only"}}var es=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Fr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},zh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Bh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ts=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Bh.flatMap((e)=>zh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Gr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],vc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],$h=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ns=vc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),rs=vc.flatMap((e)=>$h.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Nn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},os=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),is=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Uh=[...es,Fr,...ts,...ns,...rs,Nn,...os,...is,...Gr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),zr=new Set(Gr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ss=new Set(Uh.map((e)=>e.id));import{isAbsolute as as,join as Hh,normalize as jh,sep as Br}from"path";var Ec=process.platform==="win32",Vh=/[*?]/;function Ln(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ls(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Ln(e.trim(),t);if(!as(n))return"must be an absolute path or start with ~/";return Wn(n,t)}function cs(e,t){let n=Rc(e,t);if(n===null)return"must be a non-empty path string";if(!as(n))return null;if(Wn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Kh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",qh="cannot cover the guard's own configuration";function Rc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Ln(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function us(e,t){let n=Rc(e,t);if(n===null)return"must be a non-empty path string";if(Vh.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!as(n))return null;if(Wn(n,t)!==null)return Kh;return Yh(n,t)?qh:null}function Yh(e,t){let n=$r(e),r=$r(Hh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Br}`)}function Wn(e,t){let n=$r(e),r=$r(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Br)?n:`${n}${Br}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function $r(e){let t=jh(e);if(Ec)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Ec?3:1)&&t.endsWith(Br))t=t.slice(0,-1);return t}var xc=30,Ur=1,Hr=365;function _c(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var wc=new Set(Wr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(wc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(wc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Pc(e,t){return Object.freeze(Object.fromEntries(Wr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Ac(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Pc(e,t)})}var Tc={standard:0,strict:1,paranoid:2};function Oc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ds(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ds(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ds(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Zh(e,t)}}function ds(e,t){return[...new Set([...e,...t??[]])]}function Zh(e,t){let n=t.safety?.level,r=wr[e.safety.level];return[...n&&Tc[n]<Tc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Ic(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Ic(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!zr.has(o))),...e.destructive_command_protection.enabled?kc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?kc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Ic(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function kc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var ps=new Set(["standard","strict","paranoid"]),Lc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:xc}};function Wc(e,t){let n=ly(Qt(e,t),e.home),r=Kr(Mn(t.cwd),e.home),o=ey(r.parsed,e.home),i=Object.keys(o.policy).length>0?Oc(n.gui??Lc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?fs(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Qh="project policy audit settings are ignored; audit is user scope only";function ey(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...ps.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Mc({overrides:Fc(n.overrides,Jt,["safety","overrides"],Tt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Vr(o.overrides,Qi,zc,Tt)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,ls,t,["destructive_command_protection","allow_paths"],Tt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Vr(i.overrides,ss,Bc,Tt)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,cs,t,["secret_protection","deny_paths"],Tt)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,us,t,["secret_protection","allow_paths"],Tt)}:{}};return{policy:Mc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Qh]}}function Fc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],gs));return[]}))}function Mc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Tt=()=>{return},gs="must be a boolean",hs="must be an object if provided",Gc=`must be an integer between ${Ur} and ${Hr}`,zc={path:["destructive_command_protection","overrides"],label:"destructive command"},Bc={path:["secret_protection","overrides"],label:"secret protection"},ty=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function ny(e,t){let n=[];return{policy:$c(e,t,(o)=>{n.push(o)}),issues:n}}function ry(e,t){return $c(e,t,Tt)}function $c(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),jr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return Uc(e,ty,[],n),{version:1,safety:{level:oy(r.level,n),overrides:Fc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:ms(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:ms(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Vr(s.overrides,Qi,zc,n),allow_paths:nn(s.allow_paths,ls,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:ms(a.enabled,["secret_protection","enabled"],!0,n),overrides:Vr(a.overrides,ss,Bc,n),deny_paths:nn(a.deny_paths,cs,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,us,t,["secret_protection","allow_paths"],n)},audit:{retention_days:iy(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,hs)),{};return Uc(e,n,t,r),e}function Uc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function oy(e,t){if(e===void 0)return"standard";if(ps.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function ms(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,gs));return n}function iy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Ur&&e<=Hr))t(_(["audit","retention_days"],Gc));return _c(e)}function Vr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,hs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function jr(){return structuredClone(Lc)}function Kr(e,t){if(!Xh(e))return{exists:!1,policy:jr(),errors:[]};try{let n=Jh(e,"utf-8");if(!n.trim())return{exists:!0,policy:jr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=ny(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${ay(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:jr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var sy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[hs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[gs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Gc,`not an integer between ${Ur} and ${Hr}`]]);function ay(e){let t=Xi(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=sy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function ly(e,t){let n=Kr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Nc(),errors:[]};let o=ry(r,t);return{policy:fs(o),gui:o,errors:[],levelPresent:Dc(r)}}if(n.parsed===void 0)return{policy:Nc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:fs(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Dc(n.parsed)}}function Dc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return ps.has(t.level)}function Hc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Nc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Hc({}),denyPaths:[],allowPaths:[]}}}function fs(e){return{safety:cy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Hc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function cy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function jc(e,t){let n=Cc(e,t),r=Wc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((m)=>m.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...fy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return py(o,uy(n,r),s,r.policyScopes)}function uy(e,t){let n=my(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:gy(e.errors.length>0?dy(e.errors):void 0,e.warnings.length>0?bs(e.warnings.join("; ")):void 0,n)}}function dy(e){return`${bs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function my(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function fy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function py(e,t,n=Object.freeze({}),r){let o=ys(structuredClone(e)),i=r?{policyScopes:ys(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function ys(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))ys(t);return Object.freeze(e)}function gy(...e){return bs(e.filter((t)=>!!t).join("; "))}function bs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Vc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:Cs(t.fail_closed,e.strict,"strict"),paranoid_rm:Cs(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:Cs(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Ac(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ai({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function Cs(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Fn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var hy=/^[A-Za-z_][A-Za-z0-9_]*=/;function qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Gn(e){let t=qr(e.words[0],"time")?1:0,n=t===1&&qr(e.words[t],"-p")?t+1:t,r=t===1&&qr(e.words[n],"--")?n+1:n,o=qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!hy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Yr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function yy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function Zr(e,t,n){e.push(n),t.reset()}function Xr(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Ss(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return Ss({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return yy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function vs(e,t,n){if(t>=n||qc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!qc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Kc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Kc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Es(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=by(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Cy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Kc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function qc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function by(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Cy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Jc=new Set(["&&","||","|","|&"]);function Qc(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=eo(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:ro(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function eo(e,t,n,r,o,i,s){let a=[],l=[],c=Yr(),m=[],d=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Zr(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return d(),Xc(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:m};if(no(f)){if(f===`
+`||f==="\r"){d();let S=f==="\r"&&e[u+1]===`
+`?u+2:u+1,T=a.at(-1);if(T?.kind!=="connector"||!Jc.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,S),span:Object.freeze({start:u,end:S})}));if(m.length>0){let R=Es(e,S,n,m.splice(0));l.push(...R.issues),u=R.next;continue}u=S;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let p=c.start===-1?zy(e,u,n):void 0;if(p){if(xs(a,l),i>=r.maxDepth)return on(a,l,u,"depth-limit",r.maxDepth);if(!Rs(o))return on(a,l,u,"word-limit",r.maxWords);let S=eo(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},P=Yc(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:u,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Bn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(m.push(...S.pendingHeredocs),S.limited)return Qr(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=T;continue}let h=to(e,u);if(h){if(d(),!au(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(f===")"){d(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&Py(e,u,n))&&c.start===-1){if(xs(a,l),i>=r.maxDepth)return on(a,l,u,"depth-limit",r.maxDepth);let S=f==="("?")":"}",T=eo(e,u+1,n,r,o,i+1,S),R=T.next,P={start:u+1,end:T.closed?R-1:R},q=Yc(e,P,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:R},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Bn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(m.push(...T.pendingHeredocs),T.limited)return Qr(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});u=R;continue}let g=(f==="<"||f===">")&&e[u+1]!=="("?Ry(e,u):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===u&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?u:S?.span.start??u;c.start=c.start===-1?u:c.start;let P=u+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>u+g.length&&q==="#",ee=!q||no(q)||!!to(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?vs(e,P,n):void 0,N=U?{word:rn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?_s(e,P,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return Qr(a,l,N.next);if(!Rs(o))return on(a,l,N.next,"word-limit",r.maxWords)}let le=N?.next??u+g.length,xe={kind:"redirection",operator:g,span:{start:R,end:le},...T===void 0?{}:{fd:T},...N?{target:N.word}:{}};if(c.redirections.push(xe),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;m.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Te)=>{if(xe.heredoc=Te,Te.quotedDelimiter)return;je.push(...vy(e,Te.bodySpan.start,Te.bodySpan.end,r,o,i+1))}})}if(!X&&!N)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(N)c.nested.push(...N.nested);c.end=le,u=le;continue}if(c.start===-1)xs(a,l);let y=_s(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return Qr(a,l,y.next);let v=Iy(c.words)?Ny(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return on(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!Rs(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return d(),Xc(a,l),l.push(...By(m)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Yc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ro(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function _s(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",m=[],d=[],u=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||no(f)||(f===";"||f==="|"||f==="&")&&to(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),d.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(f==='"'){l=!0;let g=Sy(e,a,n,r,o,i);if(s+=g.text,m.push(...g.nested),d.push(...g.issues),u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=xy(e,a+2,n);if(s+=g.text,d.push(...g.issues),!g.closed)d.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(f==="\\"){let g=e[a+1];if(!g){d.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=f==="$"||f==="<"||f===">"||f==="`"?oo(e,a,n,r,o,i):null;if(h){let g=eu(h,m,d);if(u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(f==="$"){let g=ru(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(f==="*"||f==="?"||f==="[")c=zn(c,"glob");s+=f,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:wy(e,t,a)),nested:m,issues:d,next:a,limited:u}}function Sy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],m=!1,d=t+1;while(d<n){let u=e[d];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:d+1,limited:m};if(u==="\\"&&e[d+1]){let p=e[d+1]??"";if(p===`
+`){d+=2;continue}if(p==="\r"&&e[d+2]===`
+`){d+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,d+=2;continue}if(e.startsWith("$((",d)){let p=ws(e,d+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(d,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});d=h;continue}let f=oo(e,d,n,r,o,i);if(f){let p=eu(f,l,c);if(d=p.next,m||=p.limited,a=zn(a,p.provenance),m)return{text:s,provenance:a,nested:l,issues:c,next:d,limited:m};continue}if(u==="$"){let p=ru(e,d,n,s,a);s=p.text,a=p.provenance,d=p.next;continue}s+=u??"",d++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:m}}function oo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let m=s?3:c?1:2,d=s?"))":c?"`":")",u=ws(e,t+m,n,d),f=u===-1?n:u,p=u===-1?n:u+d.length;if(i>=r.maxDepth)return{program:Gy(e,t+m,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+m;while(T<f){let R=oo(e,T,f,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+m,f),span:{start:t+m,end:f},status:ro(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=eo(e,t+m,f,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+m)} substitution is not closed`}]:[],y=(c||l)&&Bn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+m,f),span:{start:t+m,end:f},status:ro([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function vy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?oo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function eu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function ws(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let m=l==="\r"&&e[a+1]===`
+`?a+2:a+1,d=Es(e,m,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let c=tu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let m=Ey(e,a+3,n);if(m===-1)return-1;a=m+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let m=e[a+2]==="-",d=a+(m?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let u=vs(e,d,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:m,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Ey(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=tu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function tu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!$y(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function to(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Ry(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function no(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function nu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function xy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=_y(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function _y(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Jr(e,t+1,n,16,2,t+1);if(r==="u")return Jr(e,t+1,n,16,4,t+1);if(r==="U")return Jr(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Jr(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Jr(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ro(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function ru(e,t,n,r,o){let i=nu(e,t,n);return{text:r+e.slice(t,i),provenance:zn(o,"variable"),next:i}}function wy(e,t,n){let r=Xr(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),m=e.startsWith("$(",a)&&!c,d=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||m||d||u){let f=c?3:u?1:2,p=c?"))":u?"`":")",h=ws(e,a+f,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let f=nu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function zn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Py(e,t,n){return t+1>=n||no(e[t+1]??"")||to(e,t+1)!==null}var Ay=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Ty=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Iy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=ky(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function ky(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Oy(e,t);if(n==="env")return My(e,t);if(n==="sudo")return Dy(e,t);return}function Oy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function My(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ay.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Dy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Ty.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function ou(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=iu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>su(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function Ny(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=iu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>su(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function iu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>Zc(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",m=Zc(c,o);if(!m||m.kind==="range")return{limited:"expansions"};let d=m.start+c.length-m.end,u=m.alternatives.reduce((f,p)=>f+d+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+m.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Ly(c,m)),s+=u-c.length}return a===0?void 0:{values:i}}function Zc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Fy(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:Wy(e,r)}}function Ly(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function Wy(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Fy(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function su(e,t){let n=`x${e}`,r=_s(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function Gy(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Qr(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Rs(e){return e.used++,e.used<=e.max}function zy(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Bn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Bn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Bn(t.body.nodes)})}function By(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function au(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Xc(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Jc.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function xs(e,t){if(!au(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function $y(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var cu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Uy=new Set(["gc","cat","type","cp","mv","rm"]),uu=["-rec","-for","-path","-literalpath","-whatif"],Hy=/^\$env:\w/i,jy=/^(?:\$\{?\w+\}?|~)\\./;function du(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...cu].some((o)=>n.includes(o))&&!(n.includes("rm")&&uu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!Vy(n))return!1;let r=Is(e,t);if(mu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ts(r).some(Ky)}function mu(e){return e.nodes.some((t)=>{if(t.kind==="group")return mu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function Vy(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Ky(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&cu.has(n))return!0;let r=e.slice(t+1);if(n&&Uy.has(n)&&r.some(qy))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return uu.some((s)=>i.startsWith(s))})}function qy(e){return Hy.test(e)||jy.test(e)}function Is(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ks(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:Qy(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ks(e,t,n,r,o,i=!1){let s=[],a=[],l=Yr(),c=0,m=!1,d=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};Zr(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return d(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:m};let p=Jy(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return d(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){d();let y=f==="\r"&&e[u+1]===`
+`?u+2:u+1;s.push(Ps(e,u,y)),u=y;continue}u++;continue}let h=gu(e,u);if(h){d(),s.push(Ps(e,u,u+h.length)),u+=h.length;continue}if(f==="{"){if(d(),o>=r.maxDepth)return a.push(pu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=ks(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,m||=y.limited,u=y.next;continue}if(f==="}"){d(),s.push(Ps(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?lu(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,m||=E.limited;l.end=S,u=S;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Ss({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=lu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,m||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),d(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return d(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:m}}function lu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],m=0,d=!1,u=(p)=>{let h=Yy(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),m+=As(h.program),d||=h.program.status==="limited",s="command-substitution",h.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||gu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[f+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=h,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(p==="'"){a=!0,f++;let h=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){h=!0,f++;break}i+=e[f]??"",f++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let h=!1;while(f<n){let g=e[f];if(g==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(g==='"'){h=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=g??"",f++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:rn(e,t,f,i,s,a,s==="literal"?void 0:Zy(e,t,f)),next:f,issues:l,nested:c,words:m,limited:d}}function Yy(e,t,n,r,o){let i=fu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[pu(r.maxDepth)],nodes:[]}),next:a};let l=ks(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function fu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function As(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=As(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=As(r)}}return t}function Zy(e,t,n){let r=Xr(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=fu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Xy(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Xy(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function pu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ts(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ts(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ts)]})}function gu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Jy(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Qy(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ps(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Oe(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&du(e.slice(0,n.maxInputLength),n))return Is(e,n);return Qc(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function io(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Os(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function $n(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){$n(e,t)}function It(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Ms(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(b(e,t+r)!==n[r])return!1;return!0}function qe(e,t,n){return!It(b(e,t-1))&&j(e,t,n)&&!It(b(e,t+n.length))}function Ye(e,t){return It(b(e,t-1))!==It(b(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function so(e,t,n){let r=Os(e,n);if(t==="rm")return eb(r);if(t==="dd")return nb(r);return vu(r,!0)}function ao(e,t,n){let r=Os(e,n);if(t==="rm")return rb(r);if(t==="reset-hard")return Cu(r,"--ha","rd");if(t==="reset-merge")return Cu(r,"--me","rge");if(t==="clean")return ab(r);if(t==="checkout")return cb(r);if(t==="push-force")return ub(r);if(t==="push-refspec")return db(r);if(t==="push-delete")return mb(r);if(t==="branch")return fb(r);if(t==="tag")return hb(r);if(t==="restore")return yb(r);return vu(r,!1)}function eb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(qe(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=tb(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=hu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=hu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function tb(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function hu(e,t,n){if(yu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(yu(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function yu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function nb(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(b(e,n))){t=!1;continue}if(qe(e,n,"dd")){t=!0,n++;continue}if(!t||!qe(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function rb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=b(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=ib(e,o);if(s>=0){if(ob(e,s))return!0;let a=s,l=!1;while(H(b(e,a)))l||=b(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(b(e,o-1)))&&(!b(e,o+2)||H(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Ye(e,o+11)||Ds(e,o,"recursive"),r||=j(e,o,"--force")&&Ye(e,o+7)||Ds(e,o,"force"),n&&r)return!0;o++}return!1}function Ds(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Ye(e,t+r+2)}function ob(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(b(e,n)))n++;let i=n;while(n<Y(e)&&!H(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=bu(e,i,"recursive"),a=bu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=sb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function bu(e,t,n){return j(e,t,`--${n}`)&&Ye(e,t+n.length+2)||Ds(e,t,n)}function ib(e,t){if(t>0&&It(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!H(b(e,n+1)))return-1;return n+1}function sb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let m=b(e,c)??"",d=(m==="r"||m==="f")&&Ye(e,c+1);r||=m==="r",o||=m==="f",i||=m==="r"&&d,s||=m==="f"&&d,a||=(l==="r"&&m==="f"||l==="f"&&m==="r")&&d,l=m}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Cu(e,t,n){return Hn(e,"reset",an,!0,(r)=>b(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function ab(e){return Hn(e,"clean",an,!0,(t)=>{if(b(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=Un(e,t,an);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function lo(e,t,n){if(!qe(e,t,"git"))return null;let r=t+3;if(!H(b(e,r)))return{commandEnd:-1,next:r};while(H(b(e,r)))r++;while(r<Y(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=Un(e,r,oe);if(qe(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=lb(e,r,o);r=o;while(H(b(e,r)))r++;if(i)return{commandEnd:qe(e,r,n)?r+n.length:-1,next:Un(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=Un(e,r,oe);while(H(b(e,r)))r++}return{commandEnd:-1,next:r}}function lb(e,t,n){for(let r of Ce)if(n-t===r.length&&j(e,t,r))return!0;return!1}function cb(e){return Su(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function ub(e){return Hn(e,"push",an,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!It(b(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Eu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function db(e){return Hn(e,"push",oe,!1,(t)=>{if(H(b(e,t))&&b(e,t+1)==="+"&&t+2<Y(e)&&!oe(b(e,t+2))&&!H(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function mb(e){return Hn(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(b(e,t))&&b(e,t+1)===":"&&t+2<Y(e)&&!H(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function fb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=lo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=Un(e,o,oe),s=pb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function pb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&gb(b(e,s))){let m=b(e,s);a||=m==="d"||m==="D",l||=m==="f",c||=m==="D",s++}if(!Ye(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function gb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function hb(e){return Su(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Su(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=lo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Ye(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Hn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=lo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let m=s;m<=c;m++)if(n(b(e,m)))i=!1;s=c}if(l)i=!1}return!1}function yb(e){let t=!1;for(let n=0;n<Y(e);n++){if(Ms(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=lo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function vu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=b(e,r),i=t?Ms(o):oe(o);if(n&&H(o)&&b(e,r+1)==="-"&&qe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(qe(e,r,"find"))n=!0,r+=3}return!1}function Un(e,t,n){let r=t;while(r<Y(e)&&!H(b(e,r))&&!n(b(e,r)))r++;return r}function Eu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return Ye(e,o)?o:-1}function ln(e,t,n,r){return Eu(e,t,n,r)>=0}function Ze(e,t){$n(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&ao(a,s.scan,t))return C("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var bb=/^[A-Za-z_][A-Za-z0-9_]*=/;function xu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;$n(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return _u(t.nodes,r,i)}function _u(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return _u(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return Cb(r,t,n)})}function Cb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!bb.test(o.text));return e.words.every((o,i)=>o===t||Ru(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Ru(o.target.raw,n.anchored,!0)))}function Ru(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Sb,resolve as wu}from"path";function jn(e,t,n,r){let o=Sb(e)?wu(e):t?wu(t,e):void 0;if(!o)return;try{return G(o,n,r)}catch{return o}}function Pu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Vn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ns=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),vb=new Set(["-p","--print"]),Eb=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Rb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),xb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),_b=new Map([["python",new Set(["m"])]]),wb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),Pb=new Set(["always","default","never"]),Ab=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Tb=/\\\r?\n/g,Ib=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Tu(e){return uo(e).code}function co(e){return uo(e).sources}function Iu(e){return Ib.get(Ws(e))??[]}function uo(e){let t=Ws(e[0]??"");if(!Ns.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Me(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Me(t,n,r,o,i,s);if(t==="node"&&vb.has(s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(d.startsWith("-"))continue;n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),i++;continue}if(Ob(t,s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),t==="python")return Me(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(Mb(t)&&a){let d=a[1]??"";n.push({tokenIndex:i,value:d}),r.push({tokenIndex:i,kind:"inline-code",value:d});continue}if(t==="node"){let d=kb(s);if(d){if(d.attached){if(o&&=d.value!=="",d.value!=="")r.push({tokenIndex:i,kind:"module-file",value:d.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Me(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Me(t,n,r,o);if(wb.get(t)?.has(s)){let d=e[i+1];if(d===void 0||d.startsWith("-")&&!(t==="ruby"&&Ab.has(s))||t==="python"&&!Pb.has(d))return Me(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let d=1;d<s.length;d++){let u=s[d];if(u===void 0)break;if(_b.get(t)?.has(u)){let f=s.slice(d+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Me(t,n,r,o)}if(Eb.get(t)?.has(u)){l=s.slice(d+1)||e[i+1],c=d+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(d+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(d+1);if(!f){if(o=!1,d+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(Rb.get(t)?.has(u)){if(d+1===s.length)i++;break}if(xb.get(t)?.has(u)&&d+1<s.length)break}if(l===void 0)continue;let m=c?i+1:i;if(n.push({tokenIndex:m,value:l}),r.push({tokenIndex:m,kind:"inline-code",value:l}),t==="python")return Me(t,n,r,o);if(c)i++}return Me(t,n,r,o,void 0,void 0,!0)}function Me(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((m)=>m.tokenIndex)),c=n.filter((m)=>m.kind!=="inline-code"||l.has(m.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((m)=>m.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function kb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ls(e,t){return Ws(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ws(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function Ob(e,t){return Ns.get(e)?.has(t)??!1}function Mb(e){return Ns.get(e)?.has("--eval")??!1}function Kn(e,t){let n=Lb(e,t);if(!Au(n,t))return!1;Ee(t,n);let r=Nb(n);if(Au(r,t))return!0;return Ee(t,r),Db.test(r)}var Db=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function Nb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Au(e,t){if(so(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(so(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(so(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>ao(o,r))))}function Lb(e,t){return Ee(t,e),e.replace(Tb,"")}import{isAbsolute as nd,relative as rd}from"path";import{isAbsolute as Wu,parse as Vb}from"path";import{dirname as Wb,isAbsolute as Fb,parse as Gb,sep as zb}from"path";function mt(e,t,n){if(Ke(t))throw Error("Unsupported Windows namespace path");let r=Fb(t)?Gb(t).root:"",o=r||e;for(let i of $b(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=Wb(o);continue}let s=Bb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Bb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${zb}${t}`}function $b(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Fs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Ub=new Set(Fs),Hb=1024,ku=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Ou=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),jb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function mo(e){return Ub.has(e)}function Gs(e){return mo(e)||ku.has(e)||Ou.has(e)||kn(e)}function Xe(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Mu(e,t){let n=Xe("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=Hb?{state:"valid",count:r}:{state:"invalid"}}function fo(e,t,n){let o=e.match(jb)?.[1];if(!o||!Gs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Xe(o,t,n)??""}${e.slice(i+1)}`}}function Du(e){return Lu(e,Ou)}function Nu(e){return Lu(e,ku)}function Lu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Gu=/^[A-Za-z_][A-Za-z0-9_]*=/;function we(e){if(!Gu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function po(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=we(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function zu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function kt(e,t,n,r){if(!zu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let d=0;d<V.wrapperPeelIterations.cap;d++){let u=Fu(i),f=po(i);for(let[h,g]of f.envAssignments)s.set(h,g),a.set(h,g);if(i=f.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!qb(i)){let h=Yb(un(i),a,t.env)??fo(un(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=un(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=Xb(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=eC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=tC(i);if(p==="builtin")i=i.slice(De(i,1)==="--"?2:1);if(Fu(i)===u)break}let m=po(i);for(let[d,u]of m.envAssignments)s.set(d,u),a.set(d,u);return{words:m.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Kb(m.words,o)}}function Kb(e,t){return e.some((n)=>!t.has(n))}function Fu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function De(e,t){let n=e[t];return n?w(n):void 0}function qb(e){return Gu.test(un(e))}function Yb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Zb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Xb(e,t,n){let r=1,o=n;while(r<e.length){let i=De(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=De(e,r+1);o=s?qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Zb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Jb=new Set(["-i","-0","--null"]),Qb=new Set(["-u","--unset","-C","--chdir","-P"]);function eC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=De(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let d of n.keys())o.set(d,"");o.set("TMPDIR",""),a++;continue}if(Jb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let d=De(e,a+1);if(d!==void 0)o.set(d,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let m=c==="-S"||c==="--split-string"?{value:De(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(m){if(m.value!==void 0)i.push(m.value);return s=null,l(a+m.consumed)}if(Qb.has(c)){if(c==="-C"||c==="--chdir"){let d=De(e,a+1);s=d?qn(s,d,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let d=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=qn(s,d,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!we(c))break;while(a<e.length){let d=we(De(e,a)??"");if(!d)break;o.set(d.name,d.value),a++}if(De(e,a)==="--")a++;return l(a)}return l(a)}function qn(e,t,n){if(t==="")return null;if(!e&&!Wu(t))return null;let r=Wu(t)?Vb(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function tC(e){if(De(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=De(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var nC=/['"\\$`{}#]/;function go(e,t){if(e.some((r)=>nC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function ft(e,t,n){return ho(e,t,n).tokens}function rC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ot(e,t,n,r=0){let o=ho(e,t,n),i=(o.envSplitValues??[]).flatMap(rC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ot(s,t,n,r+1)}function ho(e,t,n,r){if(!zu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=kt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Us=Symbol("adopt-as-operand"),oC=new Set(["env","sudo","command","builtin"]),iC=new Set(["&&","||","|&","|","&",";"]),sC=new Set(["<<","<<<",">|"]),aC=new Set(["|","|&"]),lC=/[*@#?$!_-]/,cC=/^\w+(?::\w+)*/,uC=Object.freeze([]),Yn=Object.freeze({kind:"scope",edge:"enter"}),Zn=Object.freeze({kind:"scope",edge:"exit"}),dC=Object.freeze([]),mC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Xn=new Set(["bash","sh","zsh","dash","ksh"]),fC=256,ju=new WeakMap;function Vu(e,t){let n=t.status==="complete"?new Set($s(t)):new Set,r=hC(e,n);if(Dr(r))return yo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Mt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return yo("structural-limit",r,t);if(o.invalid)return yo("invalid",r,t);let s=yo("complete",r,t,o.assignmentFallbacks);return ju.set(s,Object.freeze(i)),s}function Co(e,t,n,r,o){let i=o.word??((d)=>d),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,m=[];for(let d of Ku(e)){if(d.kind==="scope"){if(d.edge==="enter"){m.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=m.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let u=o.segment(a,s,c,d.operator,l);if(u)return u;s=pC(a,s,n,r),c=a.length>0&&aC.has(d.operator)?a:null,a=[],l=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)l.add(a.length-1);if(d.target===void 0)continue;let u=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},s);if(u===Us){l.add(a.length),a.push(i(d.target));continue}if(u)return u;continue}a.push(i(d.text))}return o.segment(a,s,c,null,l)}function So(e){return Ku(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function fe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:fe(i,t);return a?fe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Jn(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function pC(e,t,n,r){let o=Jn(e)?new Map([...t.variables,...gC(e,t.variables)]):t.variables,i=ft([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(fe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function gC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],fe(o,t)]]:[]})}function Ku(e){return ju.get(e)??uC}function hC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function yo(e,t,n,r=dC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Mt(e,t){return e.nodes.flatMap((n,r)=>yC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function yC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ne(EC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ne(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[bo("{"),...Mt(e.body,a),...s?[bo("}")]:[]]:[Yn,Ne("("),...Mt(e.body,a),...s?[Ne(")")]:[],Zn]}]}let o=wC(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>fC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Bu(e,r),bo(";"),...Mt(o,{...r,depth:r.depth+1}),bo(";")]},...$u(e,t,n,r)]}return[{start:e.span.start,events:Bu(e,r)},...$u(e,t,n,r)]}function Bu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Yu(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:bC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function bC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Yu(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Hs(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:RC(r),targetOrder:sC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:Xu(t)}:{}}),...s===void 0?o:o.slice(1)]}function $u(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Hs(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ne(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...qu(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?CC(t,n,r):[]]}function CC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:qu(n.source.slice(r.span.end,e.span.end),n)}]}function qu(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Oe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Mt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Yu(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ne("glob"):s!==""||e.quoted&&o.length===0?Hs(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of zs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Ne(f));continue}s+=f.text,a||=f.glob}continue}let m=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=zs(f,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=m?Mt(m,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Yn,...p,Zn);continue}let d=m?Mt(m,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Yn,...d,Zn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ne("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Yn,...d,...c.raw.endsWith(")")?[Ne(")")]:[],Zn);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>Ne("(")),...u===1?[Yn]:[],...d,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>Ne(")")):[],...u===1?[Zn]:[])}return l(),o}function zs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Uu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Uu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Uu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=vC(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return SC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&lC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?cC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function SC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=zs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function vC(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function EC(e){return/^[\r\n]+$/.test(e)?";":e}function Ne(e){return Object.freeze({kind:"operator",operator:e,boundary:iC.has(e)})}function bo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Hs(e){return Object.freeze({kind:"word",text:e})}function RC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Qn(e){return mC.has(e)||/^python\d/.test(e)}var xC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Zu(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=xC.get(e)?.has(n)??!1;return Zu(e,t.slice(r?2:1))}function Bs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Bs(e.slice(1));if(!oC.has(t))return[...e];return Bs(Zu(t,e.slice(1)))}function Xu(e){let t=Gn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Bs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function _C(e){let t=Xu(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return Qn(n)&&!Xn.has(n)}function $s(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return $s(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>$s(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(_C(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!AC(t))return r;return[...r,...o]})}function wC(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function PC(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function AC(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||PC(e))&&!e.words.some(Hu)&&!e.redirections.some((n)=>Hu(n.target))}function Hu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Ju=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Qu=new Set([...Ju,"glob"]),TC=new Set([...Qu,"pattern"]);class Le extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function er(e){let t=IC(),n=Pn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((m)=>m.source===s.source);if(a!==-1){let m=i[a];if(!m)return i;return i[a]={...m,usages:[...m.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:kC(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Je(e,t){if(!e.includes("$"))return e;return Si(e,t)}function IC(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Oe(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let m=n.get(a);if(m)return m;let d={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,d),d}let l=e.get(i);if(l)return l;let c=Vu(i,a);return e.set(i,c),c},getCommandProgram:r}}function kC(e){let t=e.route.kind==="grep"?Qu:e.route.kind==="glob"?TC:Ju;return[...ml(e.input,t),...e.route.kind==="patch"?gl(e.input):[]]}var OC=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new Le;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Co(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(fe(i.target,s.variables),s)?i.target:null})}function vo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&OC.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Pe="Git metadata and hooks are protected. Ask the user before modifying them.";function od(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Rr(e.invocation.toolName))return null;let a=e.paths.find((l)=>ed(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>LC(a,l,t,n,r),isRedirectionTarget:(a,l)=>ed(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Ro(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(js(l,n))return!0;let c=s||a.slice(l.length).includes("/."),m=(d)=>c?Eo(d,l):MC(d,l);if(n.markerFiles.some(m))return!0;return r&&td(n).some(m)}if(js(a,n))return!0;return r&&td(n).some((c)=>Eo(c,a))}function MC(e,t){let n=rd(t,e);if(n===""||n.startsWith("..")||nd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function DC(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function NC(e,t,n,r,o){if(!n)return!1;return js(Ro(ie(e,t,r,o)),n)}function ed(e,t,n,r,o,i){let s=Ro(ie(e,t,r,o));return i.includes(s)||sd(s,n)}function id(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Eo(i,Ro(ie(s,t,r,o)))))}function js(e,t){return t.entries.includes(e)||t.directories.includes(e)||sd(e,t)}function sd(e,t){return t.hooksDirectories.some((n)=>Eo(e,n))}function td(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Eo(e,t){let n=rd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!nd(n)}function Ro(e){return process.platform==="win32"?e.toLowerCase():e}function LC(e,t,n,r,o){if(Jn(e))return null;let i=Ot([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=vo(i.slice(1)),a=s.sources.find((l)=>DC(fe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&NC(fe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Xs,normalize as jC,parse as VC,posix as gd,resolve as mn,sep as Zs}from"path";import{isAbsolute as WC,join as ad,normalize as ud,parse as FC,sep as ld}from"path";var GC=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],zC=` 	
+`;function tr(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Vs(e.get("TMPDIR")??"",t)}function Nt(e,t){if(e.has("TMPDIR"))return Vs(e.get("TMPDIR")??"",t);let n=Ks(e,t);if(n===void 0)return!0;return Vs(n,t)}function Ks(e,t){return fd(e,t,"TMPDIR")}function Vs(e,t){if(!e)return!1;if($C(e))return!1;return qs(e,t)}function gt(e,t){let n=fd(e,t,"IFS");return n!==void 0&&n!==""&&n!==zC}function qs(e,t){let n=xo(e,t.paths);if(n===null)return!1;return md(t).some((r)=>HC(n,r))}function dd(e,t){let n=xo(e,t.paths);if(n===null)return!1;return md(t).some((r)=>_o(r)===_o(n))}var cd=new WeakMap;function md(e){let t=cd.get(e);if(t)return t;let n=BC(e);return cd.set(e,n),n}function BC(e){let t=GC.map((r)=>xo(r,e.paths)??ud(r)),n=xo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&UC(n))return[...t,n];return t}function $C(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function fd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function UC(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function xo(e,t){try{let n=ud(e);if(!WC(n))return n;let r=FC(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=ad(i,o[s]??"");if(t.entryKind(a)==="missing")return ad(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function HC(e,t){let n=_o(e),r=_o(t);if(n===r)return!0;let o=r.endsWith(ld)?r:`${r}${ld}`;return n.startsWith(o)}function _o(e){return process.platform==="win32"?e.toLowerCase():e}var KC=process.platform==="win32",pd=64,qC=16384;function nr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return C(o.id,o.reason)}function rr(e){let t=ou(e,pd,pd,qC);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:YC(e)}}function YC(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>ZC(e.raw,n.span.start-e.span.start))}function ZC(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Lt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:tS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function We(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&rS(e))return{kind:"outside_anchored_cwd"};let o=!r&&bd(e,t.posixShell);if(Ke(e))return{kind:"outside_anchored_cwd"};if(Js(e,r))return{kind:"root_or_home_target"};if(XC(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(JC(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(nS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&aS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&lS(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(cS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function hd(e,t,n={}){let{containmentTarget:r,...o}=n;if(We(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(eS(i))return!1;if(dd(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>uS(r??i,s,t.environment.paths,t.budget))}function Js(e,t=!1){let n=e.trim(),r=gd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function XC(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Xs(o)?o:t.resolvedCwd?mn(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(G(i,t.environment.paths,t.budget));if(s===VC(s).root)return!0;return s===ge(G(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=jC(e);if(KC){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function JC(e,t,n,r,o,i,s,a){let l=e.trim();if(yd(l))return!1;if(!r&&qs(l,a))return!0;return(t||i&&s)&&n&&!o&&QC(l,n)}function QC(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!bd(e.slice(n.length+1),t)})}function eS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return gd.normalize(`/${t[1]??""}`)==="/"}function yd(e){return e.split(/[\\/]+/).includes("..")}function tS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Ln(o.trim(),t);if(!Xs(i))return[];try{let s=G(i,n,r);if(Wn(s,G(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function nS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(yd(r))return!1;let o=n?r:Ln(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Xs(o)?o:i?mn(i,o):null;if(!s)return!1;try{let a=ge(G(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Zs)?l:`${l}${Zs}`))}catch{return!1}}function rS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function bd(e,t=!1){return e.includes("$")||e.includes("`")||oS(e)||t&&iS(e)}function oS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function iS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&sS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function sS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function aS(e,t,n,r){try{return ge(G(e,n,r))===ge(G(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function lS(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return ge(G(mn(t,e),n,r))===ge(G(t,n,r))}catch{try{return ge(mn(t,e))===ge(t)}catch{return!1}}}function cS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ys(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ys(mn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ys(mn(a,e),t,i,s)}catch{return!1}}function Ys(e,t,n,r){try{return Cd(G(e,n,r),G(t,n,r))}catch{return!1}}function uS(e,t,n,r){if(!t)return!1;try{return Cd(G(t,n,r),G(e,n,r))}catch{return!0}}function Cd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${Zs}`)||n===r}var dS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Sd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",mS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",vd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ed="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",fS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",pS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",gS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ed},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Pe},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:vd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:fS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Sd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:mS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Sd}};function Rd(e,t,n,r=Lt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return hS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function hS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=bS(o),s=o[i];if(!s||!dS.has(PS(s.text)))return null;let a=yS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return C("powershell.remove-item-pipeline-dynamic-target",pS);for(let l of a.targets)if(!Ke(l.text)&&Js(ea(l.text)))return C(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ed);for(let l of a.targets)if(n.resolvedCwd&&Dt(ea(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return C("powershell.remove-item-git-metadata",Pe);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return C("powershell.remove-item-recursive-force-dynamic-target",vd);for(let l of a.targets){let c=nr(We(ea(l.text),n),n,r,gS);if(c)return c}return null}function yS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(CS(l))continue;if(s){t.push(Qs(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=vS(l.text);if(!c){t.push(Qs(l)),i=i||l.dynamic;continue}if(ES(c.name)){let m=c.value?SS(c.value,l):e[++a];if(m?.kind==="word"){t.push(Qs(m)),i=i||m.dynamic;continue}i=!0;continue}if(RS(c.name)){n=!0;continue}if(xS(c.name)){r=!0;continue}if(_S(c.name))o=wS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function bS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Qs(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function CS(e){return e.kind==="word"&&e.text===","}function ea(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function SS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function vS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function ES(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function RS(e){return"recurse".startsWith(e)}function xS(e){return e.length>=2&&"force".startsWith(e)}function _S(e){return e==="wi"||"whatif".startsWith(e)}function wS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function PS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",wo="Unsupported heredoc syntax",xd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as Vo}from"path";var AS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),TS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),IS=new Set(["-o","--output","--query","--subscription"]),kS=new Set;function _d(e){if(e==="aws")return AS;if(e==="gcloud")return TS;if(e==="az")return IS;return kS}var OS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),MS=new Set;function wd(e){if(e==="git")return Ce;if(e==="docker")return OS;return MS}function Qe(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!LS(n,o.command))continue;if(o.match){if(DS(n,e,o.match))return Pd(o);continue}if(!WS(n,e,o.subcommand))continue;if(GS(e,new Set(o.block_args),r))return Pd(o)}return null}function Pd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function DS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return NS(r,n.command_path,_d(e))}function NS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function LS(e,t){return e===M(t)}function WS(e,t,n){if(!n)return!0;return Ad(t,1,n,wd(e))}function Ad(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&FS(e,i,n,r))return!0;continue}return s===n}return!1}function FS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Ad(e,t+2,n,r)}function GS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var zS=new Set(["-e","--source"]),BS=new Set(["-F","-v","--assign","--field-separator"]),Td=new Set(["-f","--file"]),$S=new Set(["print","printf","return"]),Id=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],US="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function kd(e,t,n){let r=!1;for(let o of HS(e)){let i=jS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?C("awk.system-dynamic",US):null}function na(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&zS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(BS.has(a)||Td.has(a))){let l=e[s+1];if(i&&=l!==void 0,Td.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ir(e){return na(e).sources}function HS(e){return ir(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function jS(e,t){Ee(t,e);let n=e.includes("system")?ra(e,t):null,r=VS(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ra(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Ao(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Od(e,i+1);continue}if(s==="/"&&Md(e,i)){i=Dd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,or(e[a-1])||or(e[i]))continue;let l=Po(e,i);if(e[l]!=="(")continue;l=Po(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let m=Ao(e,l,c);if(!m){r=!0,o=!0;continue}if(l=Po(e,m.endIndex),r=!0,e[l]!==")"){o=!0,i=m.endIndex;continue}n.push(m.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function VS(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let m=e[i];if(!m)break;if(m==='"'||m==="'"){let f=Ao(e,i,m);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(m==="#"){i=Od(e,i+1),s=i,a=null,l=null,c=i;continue}if(m==="/"&&Md(e,i)){let f=Dd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(m)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ta(e,i,"print")||ta(e,i,"printf")))a=i;if(m!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(m))c=i+1;i++;continue}let d=e[i+1]==="&"?i+2:i+1,u=Po(e,d);if(ta(e,u,"getline")){o=!0;let f=YS(s,l,c);if(r||=f===null,f!==null)n.push(f);c=d,i=d;continue}if(XS(s,a)){o=!0;let f=qS(e,u);if(!f){r=!0,c=d,i=d;continue}if(!KS(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=d,i++}if(!o)return null;return{dynamic:r,commands:n}}function or(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Po(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function KS(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Ao(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=ZS(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function qS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Ao(e,t,n)}function YS(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function ZS(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ta(e,t,n){return e.startsWith(n,t)&&!or(e[t-1])&&!or(e[t+n.length])}function XS(e,t){return t!==null&&t>=e}function Od(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Md(e,t){let n=JS(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(or(e[r-1]))r--;return $S.has(e.slice(r,n+1))}function JS(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Dd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var QS=new Set(["sudo","env","command","builtin"]);function To(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=ev(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function ev(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&tv(a,r);if(l)i.push(s);if(!l&&Mr.has(M(a)))break;if(o)break}return i}function tv(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Wt(e)||Ki.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||ke(r)||_e.has(r)||t.rules.some((o)=>o.command===n)}function Wt(e){return QS.has(e.toLowerCase())}function Ft(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Io([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Io(e,t,n,r,o,i,s,a,l){let c=ho(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:m,cwd:d}=c;if(c.envSplitValues){let f=go(c.envSplitValues,m);if(!f)throw new D("derivedCommandShape");oa(a),yield*Io(f,t,d,r,o,i,s,a,l);return}if(Wt(m[0]??""))throw new D("wrapperPeelIterations");let u=To(m,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])oa(a),yield*Io(f===u.childIndex?u.tokens:[...m.slice(f)],t,d,r,new Map(o),new Map(i),s,a,!0);return}if(rv(m)){oa(a),yield*Io([...m.slice(1)],t,d,r,o,i,s,a,l);return}yield nv(m,d,r,o,i,l)}function nv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function oa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function rv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ia(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Ge(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||sa(r,"recursive")){t=!0;continue}if(r==="-f"||sa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Nd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>sa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function sa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var ov="find -delete permanently removes files. Use -print first to preview.",iv="find -exec rm -rf is dangerous. Use explicit file list instead.",sv=new Set(["-exec","-execdir","-ok","-okdir"]),av=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Ld(e,t){let n=e.map(w),r=lv(e,n,t);if(r)return r;if(Oo(n,1)&&!uv(e,n,t)){let s=A(C("find.delete",ov),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!et(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=sr(n,i);i=l.nextIndex;let c=mv(l.tokens,t.environment);if(c){let f=A(c,t.policy);if(f)return f}let m=s==="-execdir"||s==="-okdir",d=t.analyzeTokens?t.analyzeTokens(l.tokens,m?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:m?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=d?.id.startsWith("custom.")?d:A(d,t.policy);if(u)return u}return null}function lv(e,t,n){if(!Oo(t,1)&&!aa(t,n.environment))return null;let o=ko(e)??K(["."]),i=Lt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=rr(s);for(let l of a.expandedTargets??[w(s)]){let c=We(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return C("find.delete-git-metadata",Pe)}}if(cv(t)&&i.resolvedCwd&&id(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return C("find.delete-git-metadata",Pe);return null}function aa(e,t){let n=0;while(n<e.length){if(!et(e[n])){n++;continue}let r=sr(e,n),o=Ot([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function cv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function uv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=ko(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Ks(o,n.environment),s=n.trustedTmpdirValue??Nt(o,n.environment),a=n.allowTmpdirVar??!tr(o,n.environment),l=Lt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let m=rr(c);if(m.unsafeBraceExpansion)return!1;return(m.expandedTargets??[w(c)]).every((d)=>hd(d,l,{containmentTarget:dv(d,i),targetIsLiteral:m.expandedTargets!==void 0||m.targetIsLiteral,tmpdirWordSplittingProtected:m.tmpdirWordSplittingProtected}))})}function dv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function ko(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function mv(e,t){let n=ft([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Ge(n))return C("find.exec-rm-recursive-force",iv);return null}function sr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Oo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(et(r)){n=sr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return av.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function et(e){return e!==void 0&&sv.has(e)}function ar(e){let t=Oe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var fv=5,la="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Fd(e,t,n){let r=Mo(e,t,n),o=pv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<fv;a++){let{subcommand:l,rest:c}=ze(i),m=l?.toLowerCase();if(!m||!o.has(m))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let d=o.get(m),u=Cv(d);if(u===null||u.length===0)return{blockedReason:la,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:la,expanded:!0,tokens:i}}function Gd(e,t,n){return Mo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function ze(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ce.has(o)?2:1}return{subcommand:null,rest:[]}}function pv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Mo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=hv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...gv(e,t,n)]}}function gv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ca(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ca(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Wd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Wd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ce.has(i)){o+=2;continue}o++}return r}function hv(e,t){let n=yv(e,t),r=bv(e,t);return{blockedReason:n===null||r===null?la:null,entries:[...n??[],...r??[]]}}function yv(e,t){let n=Xe("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ar(n);if(!o)return null;for(let i of o){let s=ca(i);if(!s)return null;r.push(s)}return r}function bv(e,t){let n=Mu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Xe(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Xe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ca(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Wd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Xe(e.slice(r+1),t,n)}}function Cv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ar(t)}var Sv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",vv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Ev="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Rv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",xv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",_v="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",wv="git switch --force discards uncommitted changes. Use 'git stash' first.",Pv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Av="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Tv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Iv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",kv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Ov="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Mv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Dv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",Nv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Lv="git branch -D force-deletes without merge check. Use -d for safe delete.",Wv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Fv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Gv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",zv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Bv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",$v="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Uv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",Hv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),jv=new Set(["--recurse-submodules","--track","-t"]),ua=new Set(["-b","-B","-U"]),da=new Set(["-c","-C"]),Vv=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var pn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Bd(e){let{subcommand:t,rest:n}=ze(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return yt(Kv(n));case"switch":return yt(qv(n));case"restore":return yt(Zv(n));case"reset":return Jv(n);case"clean":return yt(eE(n));case"rm":return yt(tE(n));case"push":return Gt(nE(n));case"branch":return Gt(iE(n));case"stash":return Gt(uE(n));case"worktree":return Gt(dE(n));case"rebase":return yt(sE(n));case"merge":return yt(aE(n));case"tag":return Gt(lE(n));case"reflog":return Gt(cE(n));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function Gt(e){return e?{...e,localDiscard:!1}:null}function Kv(e){let{index:t,before:n}=ce(e),r=de(n,{shortOptsWithValue:ua});if(n.some((i)=>O(i,"--force"))||r.has("-f"))return C("git.checkout-force",vv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(O(i,"--pathspec-from-file"))return C("git.checkout-pathspec-from-file",Rv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return C("git.checkout-ref-path",Ev);return C("git.checkout-double-dash",Sv)}if(Yv(e).length>=2)return C("git.checkout-ambiguous",xv);return null}function qv(e){let{before:t}=ce(e);if(t.some((r)=>O(r,"--discard-changes")))return C("git.switch-discard-changes",_v);let n=de(t,{shortOptsWithValue:da});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return C("git.switch-force",wv);return null}function Yv(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(Hv.has(r)){n+=2;continue}if(jv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function Zv(e){let t=Xv(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?C("git.restore-worktree",Av):C("git.restore-unstaged",Pv)}function Xv(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(Vv.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function Jv(e){let t=null;for(let n of e){if(O(n,"--hard")){t=C("git.reset-hard",Tv);break}if(O(n,"--merge")){t=C("git.reset-merge",Iv);break}}if(!t)return null;return Qv(e)?Gt(t):yt(t)}function Qv(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function eE(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return C("git.clean-force",kv);return null}function tE(e){let t=!1,n=!1,r=!1;for(let o of ce(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?C("git.rm-force",Ov):null}function nE(e){let{before:t,after:n}=ce(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return C("git.push-mirror",Nv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||zd(t,n).some(rE))return C("git.push-force",Mv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||zd(t,n).some(oE))return C("git.push-delete",Dv);return null}function zd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function rE(e){return e.startsWith("+")||e.includes(":+")}function oE(e){return e.length>1&&e.startsWith(":")}function iE(e){let{before:t}=ce(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return C("git.branch-force-delete",Lv);return null}function sE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?C("git.rebase-abort",Wv):null}function aE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?C("git.merge-abort",Fv):null}function lE(e){let{before:t}=ce(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?C("git.tag-delete",Gv):null}function cE(e){return e[0]==="delete"?C("git.reflog-delete",zv):null}function uE(e){for(let t of e){if(t==="drop")return C("git.stash-drop",Bv);if(t==="clear")return C("git.stash-clear",$v)}return null}function dE(e){let{before:t}=ce(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return C("git.worktree-remove-force",Uv);return null}import{resolve as mE}from"path";function Ud(e,t){return Fs.some((n)=>t?.has(n)||e.has(n))}function Hd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(mE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=$d(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=$d(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ce.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function $d(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function jd(e,t,n){if(!t.localDiscard||!n.worktreeMode||Ud(n.environment.env,n.envAssignments))return null;let r=Hd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(fE(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function fE(e,t,n){let{subcommand:r,rest:o}=ze(e),i=r?.toLowerCase();if(t.dynamicArguments||pE(o)||CE(e,t.environment.env,t.envAssignments,n)||yE(o)||gE(i,o))return!0;return i==="clean"&&bE(o)>1}function pE(e){return e.some((t)=>/[$*?[]/.test(t))}function gE(e,t){if(e==="checkout"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:ua}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:da}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||hE(s))||r.has("-C");return o&&i}return!1}function hE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function yE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function bE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function CE(e,t,n,r){if(Xe("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Mo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>vE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||SE(s.value);if(Nu(n))return!0;return r.recursiveSubmodules}function SE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function vE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var EE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",RE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Do(e,t){return Vd(e.map(w),t)}function Vd(e,t,n){let r=Fd(e,t.environment.env,t.envAssignments),o=r.blockedReason?A(C("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((Du(t.envAssignments)||Gd(e,t.environment.env,t.envAssignments))&&xE(i))return C("git.ssh-env",EE);let s=Bd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=jd(e,s,t);if(!a)return s;return n?.(a),null}function Kd(e,t){let n=null;return{match:Vd(e.map(w),t,(o)=>{n=o}),relaxation:n}}function xE(e){let{subcommand:t,rest:n}=ze(e),r=t?.toLowerCase();if(!r)return!1;if(RE.has(r))return!0;if(r==="archive")return ce(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&_E(n)}function _E(e){return e.find((t)=>!wE(t))?.toLowerCase()==="update"}function wE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as aR}from"path";function qd(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function No(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Yd="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",PE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",AE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Xd="rm -rf targeting root or home directory is extremely dangerous and always blocked.",TE="rm -rf in home directory is dangerous. Change to a project directory first.",Zd={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Xd},git_metadata_target:{id:"rm.git-metadata",reason:Pe},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:AE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:TE},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Yd},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:PE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Yd}};function Lo(e,t){let n=Lt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Ge(r),i=Nd(r),s=kE(e);for(let a of s){let l=rr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(nr({kind:"outside_anchored_cwd"},n,t.policy,Zd),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let m=be(c),d={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(m,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return C("rm.git-metadata",Pe);if(i&&!o){let u=We(m,n,d);if(u.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home",Xd);if(u.kind==="git_metadata_target")return C("rm.git-metadata",Pe);continue}if(!o)continue;for(let u of IE(m,n,d)){let f=nr(u,n,t.policy,Zd),p=A(f,t.policy);if(p)return p}}}return null}function IE(e,t,n){let r=We(e,t,n);if(r.kind==="cwd_self_target")return[r,We(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=We(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,We(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function kE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var bt={kind:"none"},zt={kind:"dynamic"},OE=new Set(["<","<<","<<-","<<<","<&","<>"]),Qd=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,ME=/^(?:[0-9]+|[@*])$/,DE=dt.maxWords,NE=dt.maxInputLength;function em(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(qo))return Ht;return{kind:"literal",source:n.map(_).join(" ")}}function gm(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!qo(n))return Ht;return{kind:"literal",source:r}}function Ko(e,t){let n=fR(e);if(n===-1)return bt;let r=pR(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=hR(s,e,n,r.ifs);if(!a)return Ht;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>uR||i>dR)return Ht;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(SR)].filter((s)=>s!==null).join(" ")}}function hm(e,t,n,r){if(!Ke(e.map(_)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&lR.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Ht;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?Ht:{kind:"literal",source:r}}function it(e){let t=Ke(e.map(_)).scriptIndex;if(t===null)return bt;let n=e[t],r=mr(n);return go(n,r)?{kind:"literal",source:r}:Ht}var mR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ya(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(L(s));return!mR.has(a)&&!J.has(a)&&!$t(a)}function fR(e){return Ke(e.map(_)).commandIndex??-1}function pR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(gR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function gR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function hR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?pa(o):yR(o,r);if(e.parameter==="*"){let a=pa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:ga(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=mr(i);return e.quoted?[s]:ga(s,r)}function pa(e){return e.every(qo)?e.map(_):void 0}function yR(e,t){let n=pa(e);if(!n)return;let r=n.map((o)=>ga(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function ga(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Wo(e){let t=lr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(Go))return zt;return{kind:"literal",source:n.map(w).join(" ")}}function tm(e){let t=lr(e[1])==="--"?2:1,n=e[t],r=lr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!Go(n))return zt;return{kind:"literal",source:r}}function Fo(e,t){let n=WE(e);if(n===-1)return bt;let r=FE(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=zE(s,e,n,r.ifs);if(!a)return zt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>DE||i>NE)return zt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map($E)].filter((s)=>s!==null).join(" ")}}function nm(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&OE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return zt;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?zt:{kind:"literal",source:r}}function tt(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return bt;let n=e[t],r=lr(n);return io(n,r)?{kind:"literal",source:r}:zt}var LE=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ga(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||we(s)!==null)return!1;let a=k(M(s));return!LE.has(a)&&!J.has(a)&&!Wt(a)}function WE(e){return Se(e.map(w)).commandIndex??-1}function FE(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(GE);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function GE(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function zE(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?ma(o):BE(o,r);if(e.parameter==="*"){let a=ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:fa(l,r)}let i=t[n+1+e.parameter];if(i&&!Go(i))return;let s=lr(i);return e.quoted?[s]:fa(s,r)}function ma(e){return e.every(Go)?e.map(w):void 0}function BE(e,t){let n=ma(e);if(!n)return;let r=n.map((o)=>fa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function fa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function mr(e){return e?_(e):""}function SR(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Sa(e,t){return ha(De(e,"posix"),t)}function pr(e){return Sa(e,new Set(Array.from(e.matchAll(fm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function ha(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(ha(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>ha(o,n))||ym(r.words,n))return!0;RR(r,n)}return!1}function ym(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(fr(r,t))return!0;let o=L(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return mm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Ke(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&mm(s[l],t)}let i=CR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return ym(e.slice(i),t)}function CR(e,t,n){let r=L(e[t]?.text??"");if(r==="command")return bR(e,t+1);if(r==="exec")return vR(e,t+1);if(r==="env")return ER(e,t+1,n);return null}function bR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function vR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function ER(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return fr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return fr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function RR(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(fr(n,t))t.add(r.name)}}function fr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(fm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(cR.test(o)||t.has(o))}))}function mm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||fr(e,t))}var Ca="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ba="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",xR="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",_R=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,wR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,AR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,PR=/^(?:[0-9]+|[@*])$/;function vm(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=jt(n),i=n.slice(r),s=S("xargs.shell-dynamic",ba);if(IR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=_m(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Rm(l,o),u=t.analyzeChild(l,{...Sm(a,t),dynamicInput:d,dynamicSourceInput:m||Em(l,a.head,o,a.wrapperEnvAssignments,d,t.scanWork,t.environment),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Ca)});if(u)return u;let f=TR(l,o,t.policy?.rules??[]);if(f)return f;if(a.head==="git"){let h=o===null?[...l,xR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Sm(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=ze(l,t.policy?.rules??[]);if(p)return p}return null}function Sm(e,t){return{producer:"xargs",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function TR(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ze([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>va(s,t,i)):[])));for(let o of r){let i=ze(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function va(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function Em(e,t,n,r,o,i,s){if(J.has(t)){if(ot(e))return!1;if(n!==null&&kR(e,n))return!0;let a=rt(e);if(!a){let l=it(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(et(a,i))return!0;return OR(a,n,r)}if(Me(t))return Cm(e,n,bo,Gu(t));if(we.has(t))return Cm(e,n,na,Fd);if(t==="eval"){let a=Vo(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return MR(e,n,i,s);if(t==="git"){let a=Ue(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&xm(a.rest,n).some((l)=>l.includes(n))}return!1}function Cm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((l)=>l.value===Yo);if(o.sources.some((l)=>l.value.includes(t)))return!0;let i=new Set(o.sources.map((l)=>`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)),s=r.flatMap((l)=>[l.selector,...l.valueForm==="attached-only"||l.valueForm==="attached-or-separate"?[`${l.selector}${Yo}`]:[],...l.valueForm==="equals-or-separate"?[`${l.selector}=${Yo}`]:[]]),a=new Set(s.flatMap((l)=>e.flatMap((c)=>va(c,t,l))));return Array.from(a).some((l)=>n(e.map((c)=>c.replaceAll(t,l))).sources.some((c)=>!i.has(`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)))}function IR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(Be(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function Rm(e,t){return xm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function xm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function _m(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function kR(e,t){let n=Ke(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return va(i,t,o).some((l)=>{let c=e.map((m,u)=>u===s?m.replaceAll(t,l):m),d=Ke(c);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(n.commandIndex===null&&d.commandIndex!==null)return!0;if(n.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(c[d.commandIndex]??"").includes(l))return!0;return d.scriptIndex!==null&&(c[d.scriptIndex]??"").includes(l)})}))}function OR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(_R))if(bm(o,r))return!0;for(let o of e.matchAll(wR))for(let i of(o[1]??"").matchAll(AR))if(bm(i,r))return!0;return Sa(e,r)}function bm(e,t){let n=e[1]??e[2];return n!==void 0&&(PR.test(n)||t.has(n))}function MR(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(nt(a)){let c=ur(e,s);s=c.nextIndex-1;for(let d of Be(c.tokens,{environment:r,cwd:void 0})){let m=_m(d.tokens,t,d.wrapperEnvAssignments);if(d.head==="rm"&&Rm(d.tokens,t)||Em(d.tokens,d.head,t,d.wrapperEnvAssignments,m,n,r))return!0}continue}let l=St(a);if(l>0){if(i=l,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function jt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",NR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",LR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",WR=/\{[^{}\s]*\}/,Mm=/\{\}|\{-?\d+\}/g,FR=["e","f","source","file","-e","-f","--source","--file"],GR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],zR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),BR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),wm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),$R=new Set(["--workdir","--wd"]),Am="__CC_SAFETY_NET_PARALLEL_SOURCE__",UR=new TextEncoder,xa=P.parallelDerivedBytes.cap+4*P.parallelPlaceholderReplacements.cap;function ye(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Dm(e,t){return ye([...e],(n)=>et(n,t.scanWork))}function Nm(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Kt(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Hm(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let p=Kt(t);if(p)return p;let h=Dm(t.envAssignments?.values()??[],t);if(h)return h}if(l){let p=XR(t);if(p)return p}if(d!==void 0&&a){let p=Kt(t);if(p)return p}let u=tx(d,t.cwd,t.environment.paths);if(u===null){let p=Kt(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...Be(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(Pa)){let h=Kt(t);if(h)return h}return null}if(i.length===0){if(s.some((g)=>g.length!==1)){let g=Kt(t);if(g)return g}let p=s.map((g)=>g[0]??"");Re(t.budget,_a(p));let h=zm(f.envAssignments,f.cwd,a);return ye(p,(g)=>t.analyzeNested(g,h))}return ye(Be(i,f),(p)=>HR(p,o,t,f))}function HR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some($m)){let g=Kt(n);if(g)return g}let d=Dm(c,n);if(d)return d;let m=c.some(G),u=i||m,f=a&&u,p=zm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Re(n.budget,Xo(l,o,"generic")),ye(o,(E)=>n.analyzeChild(l.map((b)=>vt(b,E)),Ea(e,r)))};if(ot(l))return g();let y=rt(l);if(y){if(Um(y)){let R=Vt(n);if(R)return R;if(o.length===0)return null;return Re(n.budget,Om(y,o)),ye(o,(A)=>n.analyzeNested(vt(y,A),p))}if(G(y)){if(o.length>0)return Re(n.budget,Om(y,o)),ye(o,(K)=>n.analyzeNested(vt(y,K),p));Re(n.budget,Im(y));let R=dr(y);if(R?.[0]&&L(R[0])==="rm"&&$e(R)){let K=Tm(n);if(K)return K}let A=R?n.analyzeChild(R,{...Ea(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",yr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Ko(q(R===void 0?l:i?l.map((A)=>vt(A,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=Vt(n);if(R)return R}let b=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(b.length>0)return Re(n.budget,_a(b)),ye(b,(R)=>n.analyzeNested(R,p));if(Re(n.budget,Im(y)),pr(y)){let R=Vt(n);if(R)return R}let w=n.analyzeNested(y,p);if(w)return w;if(u)return Vt(n);return null}let v=it(q(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return Vt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=Vt(n);if(E)return E;let b=g();if(b)return b;if(i)return null;let w=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return Re(n.budget,_a(w)),ye(w,(R)=>n.analyzeNested(R,p))}if(u||a)return Vt(n)??g();return null}if(e.head==="rm"&&$e(l)){if(i&&o.length>0)return Re(n.budget,Xo(l,o,"rm")),ye(o,(y)=>Ra(l.map((v)=>wa(v,y)),e.cwd,r));if(o.length>0)return Re(n.budget,km(l,o)),ye(o,(y)=>Ra([...l,...y],e.cwd,r));let g=Ra(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[wa(y,[""])]:[]}),e.cwd,r);if(g)return g;return Tm(n)}Re(n.budget,i&&o.length>0?Xo(l,o,"generic"):o.length>0?km(l,o):Gm(l));let h=o.length>0?o:[void 0];return ye(h,(g)=>{let y=g===void 0?l:i?l.map((Y)=>vt(Y,g)):[...l,...g],v=S("parallel.shell-dynamic",yr),E=a&&e.head==="find"?ZR(y,r):null,b=Wm(y,a,n.policy?.rules??[],n.budget)??E?.customResult??null,w=L(e.head),R=a&&(w==="rm"&&Aa(y)||w==="xargs"&&Fm(y)||E?.rmOptions===!0),A=a&&(R||E?.executedSource===!0||E===null&&Lm(y,w)),K=n.analyzeChild(y,{...Ea(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:b!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",hr)});if(A){let Y=T(v,n.policy);if(Y)return Y}return K??b??ze(y,n.policy?.rules??[])})}function Ea(e,t){return{producer:"parallel",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Lm(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return KR(e);if(t==="git")return jR(e);if(t==="find")return!0;if(we.has(t))return Pm(e,FR,cr);if(Me(t))return Pm(e,GR,Co);return!1}function Aa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||Um(o)))}function jR(e){if(VR(e))return!0;let t=Ue(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function VR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function KR(e){if(ot(e))return!1;let t=rt(e);if(t!==null)return G(t);let n=it(q(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Pm(e,t,n){let r=n(e);if(r.some((i)=>G(i.value)))return!0;if(!e.some(G))return n([...e,Am]).some((i)=>i.value===Am);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>vt(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function Wm(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>L(s.command)===L(e[0]??""));if(o.length===0)return null;let i=e.some(G);if(Re(r,qR(e,o,i)),!i)return ye(o,(s)=>ze([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return ye(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((l)=>l?YR(e,l):[]));return ye(a,(l)=>ze(e.map((c)=>vt(c,[l])),[s]))})}function qR(e,t,n){let r=n?qt(Ie(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),P.parallelChildAnalyses.cap),2*Math.max(e.length,1),P.parallelChildAnalyses.cap):t.length;return{childAnalyses:r,derivedTokens:qt(r,e.length,P.parallelDerivedTokens.cap)}}function YR(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function ZR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Be(i,t))n.executedSource||=Lm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Aa(a.tokens)||a.head==="xargs"&&Fm(a.tokens),n.customResult??=Wm(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(nt(a)){i=[],n.executedSource||=G(a);continue}let l=St(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Fm(e){let t=e.slice(jt(e).childStart);return L(t[0]??"")==="rm"&&Aa(t)}function Jo(e,t){return(n)=>T(S(e,t),n.policy)}var Vt=Jo("parallel.shell-dynamic",yr),XR=Jo("parallel.command-stream-dynamic",NR),Kt=Jo("parallel.command-stream-dynamic",LR),Tm=Jo("parallel.rm-recursive-force-dynamic",hr);function Ra(e,t,n){return T(jo(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:zt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function _a(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:Sr(e)}}function Im(e){return Gm([e])}function Gm(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:Sr(e)}}function km(e,t){if(t.length>P.parallelChildAnalyses.cap)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Ie(t.map((n)=>e.length+n.length),P.parallelDerivedTokens.cap),derivedBytes:Ie([qt(Sr(e),t.length,P.parallelDerivedBytes.cap),Ie(t.map((n)=>Sr(n)),P.parallelDerivedBytes.cap)],P.parallelDerivedBytes.cap)}}function Om(e,t){return Xo([e],t,"generic")}function Xo(e,t,n){if(t.length>P.parallelChildAnalyses.cap)return{childAnalyses:t.length};let r=qt(e.length,t.length,P.parallelDerivedTokens.cap);if(r>P.parallelDerivedTokens.cap)return{childAnalyses:t.length,derivedTokens:r};let o=ex(e.map((l)=>QR(l,n))),i=qt(o.occurrences,t.length,P.parallelPlaceholderReplacements.cap);if(i>P.parallelPlaceholderReplacements.cap)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(JR(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:P.parallelDerivedBytes.cap+1,placeholderReplacements:i};let s=n==="generic"?vt:wa,a=Ie(t.map((l)=>Sr(e.map((c)=>s(c,l)))),P.parallelDerivedBytes.cap);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function JR(e,t,n){let r=P.parallelDerivedBytes.cap+4*n;return Ie([qt(e.fixedBytes,t.length,r),qt(e.occurrences,Ie(t.map((o)=>o.reduce((i,s)=>Math.max(i,gr(s)),0)),r),r)],r)>r}function QR(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(Mm),r=0,o=0,i=0;for(let s of n){if(r>=P.parallelPlaceholderReplacements.cap)return{occurrences:P.parallelPlaceholderReplacements.cap+1,fixedBytes:0};o=Ie([o,gr(e.slice(i,s.index))],xa),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?gr(e):Ie([o,gr(e.slice(i))],xa)}}function ex(e){return{occurrences:Ie(e.map((t)=>t.occurrences),P.parallelPlaceholderReplacements.cap),fixedBytes:Ie(e.map((t)=>t.fixedBytes),xa)}}function Sr(e,t=P.parallelDerivedBytes.cap){return Ie(e.map(gr),t)}function gr(e){return UR.encode(e).byteLength}function Ie(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function qt(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function zm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function vt(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>Bm(n,t))}function wa(e,t){return e.replace(Mm,(n)=>Bm(n,t))}function Bm(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function G(e){return WR.test(e)}function $m(e){if(Pa(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function Pa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Um(e){return/^\{[^{}\s]*\}$/.test(e)}function Hm(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ia(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ia(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||BR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(wm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=wm.has(p)?2:1;continue}if($R.has(y)){let E=v??h;if(E===void 0||E===":::"||E==="--"){c=!0,t++;continue}l=E,c||=v!==void 0&&E==="",t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(zR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(a?Pa:$m);let d=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){d.push(p),p=[];continue}if(g!==void 0)p.push(g)}d.push(p)}let m=nx(d),u=n.some(G),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:l,dryRun:a}}function tx(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!DR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function nx(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>P.parallelChildAnalyses.cap)return r;t=r}return t}function jm(e){return Hm(e).childStart}var rx="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ia(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ta(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Km(e,t,n,r,o=!1,i){let a=(Un(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&Q(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",rx):null;return T(a,i)??qm(e,t,n,o,i)}function qm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ia(a)?[l]:[]);if(i.length===0)return null;let s=L(t[0]?.text??"");if(s==="git"){let a=pn(e,t),l=ix(a);if(Q(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return T(S("shell.dynamic-structure",Qo),o);if(T(Ho(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&_(m)==="--");if(Q(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return T(S("shell.dynamic-structure",Qo),o);return null}if(s==="find")return Q(o,"shell.dynamic-structure",r)&&sx(t)?T(S("shell.dynamic-structure",Qo),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&_(c)==="--"),l=$e(t.map(_));return Q(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(S("shell.dynamic-structure",Qo),o):null}if(s==="xargs")return Vm(e,t.slice(jt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return Vm(e,t.slice(jm(t.map(_))),"parallel",n,r,o);return null}function Vm(e,t,n,r,o,i){if(t.length===0)return null;let s=ox(t,r);if(Un(e,s)){let l=T(S(`${n}.shell-dynamic`,n==="xargs"?ba:yr),i);if(l)return l}let a=qm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ia(l)&&Ta(l)))return T(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ca:hr),i);return null}function ox(e,t){let n=Wt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function ix(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(le.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function sx(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ia(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ta(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ta(s)))return!0;continue}if(t=!0,a)return!0;let l=St(s.text);if(l>0){n=l;continue}if(nt(s.text))o=!0,r=!0}return!1}function ka(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!go(t[n.tokenIndex],n.value)})}var ax="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",lx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",cx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Ym(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",ax);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",lx);if(e==="shred"&&n.length>0)return S("shred.target",cx);return null}var Xm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Ho(e.words,Oa(e))},{heads:new Set(["find"]),analyze:(e)=>Hd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>vm(e.words,{...Zm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Nm(e.words,{...Zm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})}];function Zm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function Yt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Oa(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var tf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function nf(e){return Xm.find((t)=>t.heads.has(e))?.analyze}function xn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((k)=>o==="posix"?_(k):k.text),s=n.child,a=s!==void 0&&s.producer!=="unknown-head",l=s?.producer==="unknown-head",c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=_o(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Wt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let x=[...p,...i(f.words)].join(" "),k=et(x,n.scanWork);if(k)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:k.reason}),me(k);if(n.strict)return Se(r);let N=wo(p,i(f.words));if(N){n.budget.charge("derivedTokens",N.length);let ne=n.analyzeNested(N.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(ne)return ne}}let h=f.rewritten?q(i(f.words)):pn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if($t(E))throw new F("wrapperPeelIterations");let b=L(E),w=f.cwd===null?void 0:f.cwd??d,R=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,K=s?s.allowTmpdirVar:!sr(v,n.environment),Y=Km(o,f.words,n.environment,t===0,n.strict,n.policy);if(Y)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Y.reason}),me(Y);let te=zo(g,n.policy);if(te){for(let x of[te.childIndex,...te.alternativeChildIndices]){Jm(y.wrapperNormalizationBudget);let k=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:te.wrapper,output:i(k)});let N=xn(k,t,{...y,effectiveCwd:A,envAssignments:v});if(N)return N}return null}let X=l?void 0:b==="eval"?Vo(h):b==="trap"&&!a?gm(h):void 0;if(a&&s&&b==="eval"){if(X?.kind==="dynamic")return Rn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v});if(x)return x}return _n(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ya(n.commandView)))return Se(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(b):of(E,b)){if(ot(g))return null;if(a&&s){let x=rt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let N=Rn(s,n.policy);if(N)return N}if(pr(x)){let N=Rn(s,n.policy);if(N)return N}return n.analyzeNested(x,{effectiveCwd:A,envAssignments:v})}let k=it(h);if(k.kind==="dynamic")return Rn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?Rn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Rn(s,n.policy):null}if(l){let x=rt(g),k=x?n.analyzeNested(x,{effectiveCwd:A,envAssignments:v}):it(h).kind==="dynamic"?Se(r):null;if(k)return k}if(s===void 0){let x=fx(g,v,A,n,r,t);if(x)return x;let k=rt(g);if(k){let en=Ko(h,k);if(en.kind==="dynamic")return Se(r);let Si=en.kind==="literal"?en.source:k,cl=px(Si);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:cl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:cl,depth:t+1});let ul=n.analyzeNested(Si,{effectiveCwd:A,envAssignments:v});if(ul)return ul;return pr(Si)?Se(r):null}let N=it(h);if(N.kind==="dynamic")return Se(r);if(N.kind==="literal")return ti(N.source,A,v,n,r,t);let ne=hm(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ne.kind==="dynamic")return Se(r);if(ne.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ne.source,depth:t+1}),n.analyzeNested(ne.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let x=g[1]==="-p"?2:null;if(x!==null){let en=n.commandView?h[x]:void 0;if(!en)return null;if(en.provenance!=="literal")return Se(r)}let k=x===null?1:3,N=g[k]==="--"?k+1:k,ne=n.commandView?h[N]:void 0;if(!ne)return null;if(ne.provenance==="literal")return ti(ne.text,A,v,n,r,t);if(n.strict||!n.commandView||!ya(n.commandView))return Se(r)}if(we.has(b)&&!l){if(!s&&n.strict&&ka(cr(g),h))return Se(r);let x=Gd(g,(N)=>Yt(n.analyzeNested(N,{effectiveCwd:A,envAssignments:v}))),k=T(x,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),me(k)}if(Me(b)&&!l){if(!s&&n.strict&&ka(Co(g),h))return Se(r);let x=Fu(g);if(a&&s)return dx(b,x,A,v,n,s);if(x){let k=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:x,paranoidBlocked:k}),k){let ne=T(S("interpreter.one-liner-paranoid",Xn),n.policy);if(ne)return me(ne)}if(Ls(b,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let N=n.analyzeNested(x,{effectiveCwd:A,envAssignments:v});if(N&&!rf(N,x))return N;if(Jn(x,n.scanWork)){let ne=T(S("interpreter.dangerous-command",yn),n.policy);if(ne)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:yn}),me(ne)}r=void 0}}if(b==="busybox"&&g.length>1)return Jm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),xn(h.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let D=s?null:T(Ym(b,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),me(D);let oe=r===y.trace?y:{...y,trace:r},_e={words:h,head:b,cwd:w,originalCwd:R,envAssignments:v,allowTmpdirVar:K,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:oe,analyzeChildTokens:(x,k)=>a&&s?Ma(x,t,oe,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Yt(xn(q(x),t+1,{...oe,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??ze(x,oe.policy.rules),analyzeChild:(x,k)=>Ma(x,t,oe,k)},Ye=s&&(b==="xargs"||b==="parallel")?void 0:nf(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!K,allowTmpdirVar:K});let ke=r&&b==="git"?om(_e.words,Oa(_e)):void 0,hi=Qm(ke?ke.match:Ye?.(_e)??null,n.policy);if(r)gx(_e,hi,ke?.relaxation??null);if(hi)return me(hi);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&($e(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?_n(s,n.policy):null)??mx(s,n.policy)}let al=Ye!==void 0,ll=!s&&!al&&!Ur.has(b),yi=r&&ll?[]:void 0;if(ll)for(let x=1;x<g.length;x++){let k=g[x];if(!k)continue;yi?.push(k);let N=Qm(ux(g,x,t,oe,w,R,A,v),n.policy);if(N)return r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[],embeddedCommandFound:L(k)}),me(N)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&al)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Ar=ze(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ar,reason:Ar?.reason}),Ar)return me(Ar);return a&&s?_n(s,n.policy):null}function Ma(e,t,n,r){return Yt(xn(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function ux(e,t,n,r,o,i,s,a){for(let l of Be(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=L(c);if(of(c,d)||nf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=Ma(l.tokens,n,r,{producer:"unknown-head",cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!sr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function dx(e,t,n,r,o,i){if(!t)return _n(i,o.policy);if(Q(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(S("interpreter.one-liner-paranoid",Xn),o.policy);if(a)return me(a)}if(Ls(e,t))return _n(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!rf(s,t))return s;if(Jn(t,o.scanWork)){let a=T(S("interpreter.dangerous-command",yn),o.policy);if(a)return me(a)}return _n(i,o.policy)}function rf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Wo)||e.reason===vn)&&!Hr(t)}function Rn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?me(n):null}function _n(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?me(n):null}function mx(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?me(n):null}function fx(e,t,n,r,o,i){let s=um(e);if(s.argvSource?.kind==="absent")return Se(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Se(o);let a=Zn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Se(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function px(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function gx(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Jm(e){if(e.iterations>=P.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function me(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Se(e){return e?.recordSegment({type:"error",message:tf}),me(hx())}function hx(){return{id:"",reason:tf,intent:"stop_and_explain"}}function of(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(I(t))}function Qm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var yx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,Sx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function Cx(e,t){let n=lf(e,t);if(n.length===0)return!1;let r=n[af(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return yx.test(e.join(" "))}function sf(e,t,n,r){if(e.dialect==="powershell"){let a=bx(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return ef(xx(a.target),t,n.paths)}let o=e.words.map(_);if(!Cx(o,n))return;if(!t)return null;let i=lf(o,n,t),s=af(i);if(s===-1||i[s]!=="cd")return null;return ef(i[s+1],t,n.paths)}function ef(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return _x(ft(t,e,n),t,n)?t:null}catch{return null}}function bx(e,t){let n=vx(e[0])?1:0,r=e[n];if(!Ex(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!Sx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return Rx(e.slice(n+1),t)}function vx(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function Ex(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function Rx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function xx(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function af(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function lf(e,t,n){let r=wx(e);return pt([...r],t,n)}function _x(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ei(e)===ei(t);return ei(r)===ei(o)}function wx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Na="TMPDIR",La="IFS",cf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,uf=/^[A-Za-z_][A-Za-z0-9_]*$/,df=new Set(["export","typeset","declare","readonly"]),Ax=new Set(["builtin","command","time"]);function mf(e,t){return{env:e,effectiveEnvAssignments:Ox(e,t),shellAssignments:new Map}}function ff(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function Wa(e,t){let n=gf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Fa(t,s)});let r=n.commandIndex;if(r!==-1&&df.has(e[r]??""))e.filter((s)=>uf.test(s)&&Da(s)).forEach((s)=>{Mx(t,s)});let o=r===-1?-1:hf(e,r);if(o===-1||e[o]!=="unset")return;let i=Nx(e,o);if(i===null)return;e.slice(i).forEach((s)=>{Dx(t,s)})}function pf(e,t){let n=gf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function gf(e,t){let n=e.findIndex((s)=>!Px(s)),r=n!==-1&&df.has(e[hf(e,n)]??""),o=kx(t);return{assignments:e.flatMap((s,a)=>{let l=Tx(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Eo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function hf(e,t){let n=t;while(Ax.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Px(e){return Pe(e)!==null||cf.test(e)}function Tx(e,t,n){return Pe(e)??Ix(e,t,n)}function Ix(e,t,n){let r=xo(e,n,t);if(r)return r;let o=e.match(cf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Da(e){return e===Na||e===La||Gs(e)}function kx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function Ox(e,t){let n=[...vo,Na,La].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Fa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Mx(e,t){Fa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function Dx(e,t){if(!Da(t)&&!uf.test(t))return;if(e.shellAssignments.set(t,""),Eo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Da(t)||t===Na||t===La||Mn(t)){Fa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Nx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var Lx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Zt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ua(e,t,n,r){if(t>=P.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return $a(e,n);let d=`${Wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Ef(e,n),{reason:vn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Ef(e,n),{reason:vn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote"))&&!n.analyzePartialProgram)return $a(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=mf(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let d=e.nodes[l+1],m=d?.kind==="connector"?d.operator:void 0,u=Wx(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||An(m);if(c.kind==="function"){let Y=h.flatMap((X)=>{let z=Cr(X);return z.functionDefinitions.set(c.name,c.body),Ga(X,[z],u,m==="&",An(m))}),te=za(Y,[],g,y,a,m);i=te.states,s=te.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Y=[],te=[];for(let z of h){let D=oi(c.body,t,n,r,[Cr(z)]);if(D.result)return D;if(Y.push(...Ga(z,D.states,u,m==="&",An(m))),v)te.push(z,...u?D.states.map((oe)=>ni(z,oe)):D.states)}let X=za(Y,te,g,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),b=e.nodes[l-2],w=ii(a)&&b?.kind==="command"?pm(b)??Gx(b):void 0,R=[],A=[];for(let Y of h){let te=zx(c,t,n,r,[Cr(Y)]);if(te.result)return{result:te.result,states:i};let X=e.dialect==="powershell"?te.states:te.states.map((z)=>ni(Y,z));for(let z of X){let D=Cr(z),oe=Ux(c,t,n.trace?{...n,trace:Rf(n.trace,E)}:n,r,D,ii(a),w);if(oe)return{result:oe,states:i};let _e=n_(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let Ye=_e?t+1>=P.recursionDepth.cap?Ba(c.displayText,n,[D]):oi(_e,t+1,n,r,[D]):{result:null,states:[D]};if(Ye.result)return Ye;if(R.push(...Ga(Y,Ye.states,u,m==="&",An(m))),v)A.push(Y),A.push(...Ye.states.map((ke)=>u?ni(Y,ke):ke))}}let K=za(R,A,g,y,a,m);i=K.states,s=K.conditionalStates,a=void 0}return{result:null,states:i}}function Wx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&Fx(e,t)}function Ga(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>wn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function Fx(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(Bx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function Gx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function An(e){return e==="&&"||e==="||"}function za(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=An(i)?s:void 0;return{states:An(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function Rf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function zx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=$x(e);if(s){if(t+1>=P.recursionDepth.cap)return Ba(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Ba(s,n,o);if(a.status!=="complete")return yf(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return yf(i,n,r,o)}function Bx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function yf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[Cr(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function $x(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function Ba(e,t,n){return t.trace?.recordSegment({type:"error",message:je}),{result:{reason:je,segment:e,intent:"stop_and_explain"},states:[...n]}}function Ux(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=Zx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};xf(e,o,"before-consumer",a.environment.paths,a.budget);let c=pn(e.dialect,e.words).map(_),d=e.displayText,m=pf(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=T(kd(e,i,o_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return r_(d,p)}if(c.length===1&&c[0]?.includes(" ")&&!Un(e.dialect,e.words)){let p=T(et(c[0],a.scanWork),a.policy),h=p!==null&&!a.strict&&Mu(e,a.rootProgram,a.scanWork);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:d,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=Sf(e,l,o,m,s,a);if(g)return g;return Wa(c,o.shellGitContextState),null}let u=xn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=Ua(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?Rf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:d};let f=Sf(e,l,o,m,s,a);if(f)return f;return Wa(c,o.shellGitContextState),null}function Sf(e,t,n,r,o,i){let s=Xx(e,t,n,r??new Map,i);if(s)return s;return xf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),Vx(e,t,n,i.environment.paths,i.budget),e_(e,n,o,i.environment,i.trace),null}var Hx=new Set([">>","<>"]);function xf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?jx(s):Hx.has(s.operator)))continue;Cf(s.target,t,r,o)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let i=_f(e.words.slice(1));if(!i)return;for(let s of i.operands)Cf(s,t,r,o)}function jx(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Cf(e,t,n,r){let o=e?.provenance==="literal"?Zn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function Vx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ai(i))return;for(let s of Kx(e)){let a=Zn(s.text,n.effectiveCwd,r,o);if(!a||!Lu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=P.trackedHeredocFiles.cap)throw new F("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Kx(e){let t=Yx(e.redirections)?.target,n=bf(t)?[t]:[];if(xe(e.words[0],"cat"))return qx(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=_f(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(bf))return[];return[...r.operands,...n]}function qx(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function Yx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function _f(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function bf(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ai(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function Zx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Zt;let n=t[0];if(!n?.heredoc)return Zt;if(!ai(n.heredoc))return Lx;if(n.fd!==void 0&&n.fd!==0)return Zt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Zt;let r=e.redirections.some((s)=>s!==n&&vf(s.target));if(xe(e.words[0],"cat"))return r?Zt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(vf)?Zt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return Zt}function vf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Xx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Qx(e,i,n,r,o))return null;let a=Jx(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=$a(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function Jx(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ai(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Me(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=T(S("interpreter.one-liner-paranoid",Xn),n.policy);if(c)return c}if(!Jn(s,n.scanWork))return null;let l=T(S("interpreter.dangerous-command",yn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Qx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ai(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=L(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(I(l)))return!1;return ot(a)}function e_(e,t,n,r,o){let i=sf(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function Cr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:ff(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>t_(r,n)))t.push(n);if(t.length>P.controlFlowStates.cap)throw new F("controlFlowStates")}return t}function t_(e,t){return e.effectiveCwd===t.effectiveCwd&&wn(e.shellGitContextState.env,t.shellGitContextState.env)&&wn(e.literalHeredocFiles,t.literalHeredocFiles)&&wn(e.functionDefinitions,t.functionDefinitions)&&wn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&wn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function wn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function n_(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function r_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function o_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function $a(e,t){let n=T(et(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Ef(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:vn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var i_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape","parallelChildAnalyses","parallelDerivedTokens","parallelDerivedBytes","parallelPlaceholderReplacements"]);function wf(e,t,n,r){let o=Ua(e,0,{...t,...tu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}function Af(e,t,n){try{return{decision:e()}}catch(r){let o=s_(r,t,n);if(!o)throw r;return o}}function s_(e,t,n){if(!(e instanceof F)||!i_.has(e.kind))return null;let r=P[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:[{kind:"command",command:t,segment:t}]},errorCode:r.errorCode}}var a_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),ja=new Set(["cc-safety-net","ccsn"]),l_=new Set(["bunx","npx","pnpx"]),c_=new Set(["pnpm","yarn"]),u_=new Set(["npm","pnpm","yarn"]),d_=new Set(["bun","node"]);function ci(e,t,n={}){if(ja.has(e))return 0;if(l_.has(e)){if(n.broad)return Ha(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return li(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&u_.has(e)&&n.broad&&t[r]==="exec"){let o=Ha(t.slice(r+1));return o===null?null:r+1+o}if(c_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&li(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ha(t.slice(r+1));return o===null?null:r+1+o}if(d_.has(e)){let o=n.broad&&r!==-1?r:0;if(Pf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Pf(t[o+1]))return o+2}return null}function Ha(e){let t=e.findIndex((r)=>li(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!li(r))break;n++}return n}function li(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return ja.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return ja.has(e.slice(0,t))}function Pf(e){let t=e?.replaceAll("\\","/");return[...a_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Tf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function If(e,t,n){let r=ue(e,"input-candidate");if(!r)return null;let o=Cn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>m_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function m_(e,t){let n=pt([...e],t),r=n.slice(1),o=ci(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ui}from"path";var Df="This path contains the protected policy config and you must not modify or delete it.",f_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Nf(e,t,n){let r=C_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return kf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ue(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Of(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Of(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return kf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Lr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function kf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>br(a,n,r,o,i));return s?{target:s}:null}function Of(e,t,n,r,o){let i=Cn(e,t,r,o,{findSegmentTarget:(s,a)=>p_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>br(s,a.cwd,n,r,o),findMalformedTarget:(s)=>S_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function p_(e,t,n,r,o){if(rr(e))return null;let i=gt([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&g_(a)){let l=h_(a).find((c)=>Mf(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Uo(i,1)||aa(i,r)){let c=($o(q(i))??q(["."])).find((d)=>{let m=ge(d.text,t.variables);return br(m,t.cwd,n,r,o)||Mf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Oo(a).sources.find((c)=>b_(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(y_(e,r))return null;for(let l of[...e,...i])for(let c of Lf(l))if(br(ge(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function g_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function h_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function y_(e,t){let n=gt([...e],t);if(n.length===0)return!1;let r=I(n[0]??"").toLowerCase();if(!f_.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function S_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Lf(i))if(br(s,t,n,r,o))return{target:s};return null}function Lf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function C_(e,t,n){let r=(a)=>vr(ie(a,e.executionCwd,t,n)),o=r(ln(t)),i=[r(Fn(e.executionCwd)),r(Fn(e.configCwd))],s=new Set(i.map((a)=>ui(a)));for(let a=ui(o);;a=ui(a))if(s.add(a),ui(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function br(e,t,n,r,o){let i=Sl(e,t,r,o,(s)=>vr(s)===Br);return i!==null&&n.files.has(vr(i))}function Mf(e,t,n,r,o){return n.directoriesAndAncestors.has(vr(ie(e,t,r,o)))}function b_(e,t,n,r,o){let i=vr(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function vr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as di,posix as v_,resolve as fi,win32 as E_}from"path";import{fileURLToPath as R_}from"url";var Kf="Access to a sensitive path is not allowed.",qf=new Set(["echo","printf"]),x_=new Set(["find"]),__=new Set(["-exec","-execdir"]),w_=new Set([";","+"]),A_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),P_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Yf=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),T_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),I_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Zf=new Set(["-c","-e","-r","-E","--eval","--exec"]),k_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),O_=new Set(["grep","rg"]),Wf=new Set(["jq","gojq","jaq"]),Ff="f",Gf="file",M_="files",D_=new Set(["e","f"]),N_=new Set(["regexp","file"]),L_=new Set(["e","f","A","B","C","m"]),W_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Va="__CC_SAFETY_NET_PIPE_INPUT__",qa=/[\w./~@+-]*[./~][\w./~@+-]*/g,F_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,G_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,z_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,B_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,$_=/\b(?:system|exec)\s*$/,U_=/\b(?:eval|exec)\s*\(/g,H_=/\b(?:eval|exec)\s*$/,j_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function zf(e,t,n,r,o,i){for(let s of e){let a=s.target;if($w(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=zw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&Uw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Xf(e,t,n,r,o={}){let i=Bf(e,n,r),s=zf(i,t,e.invocation.context.configCwd,n,r),a=s?.ruleId!=="secret.deny-path"&&o.strict===!1?Bf(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:zf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&V_(e,n))return null;return l}function V_(e,t){let n=ue(e,"input-candidate")??ue(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of ko(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(tt(a.text,t))}let o=Et(r);if(o.length===0)return!1;let i=lt(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>A_.has(a))}function Bf(e,t,n,r={}){let o=e.invocation.context.executionCwd;if(e.invocation.route.kind==="command"){let s=ue(e,"input-candidate");return s?Xt(s.shell,e.store,r,t,o,n,$f(s)):[]}if(e.invocation.route.kind!=="unknown")return e.paths.map((s)=>({target:s,cwd:o}));let i=ue(e,"input-candidate");return[...i?Xt(i.shell,e.store,r,t,o,n,$f(i)):[],...e.paths.map((s)=>({target:s,cwd:o}))]}function $f(e){return e.program.dialect==="powershell"}function Xt(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Ew(tt(e.source,r),t,n,r,o,i)],l=(c)=>tt(rw(c,s),r);return Io(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...pi(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...q_(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Jf(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>Y_(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return Us;return a.push({target:l(c.target),cwd:d.cwd}),null}}),a}function Ya(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Xt(s,t,n,r,o,i):null}function pi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(Wf.has(lt(Et(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...pi(p,t,n,r,o,i)]}let l=nw(e).map(a),c=Et(e);if(c.length===0)return l;let d=c[0]??"",m=lt(d).toLowerCase(),u=c.slice(1),f=K_(d,m,u);if(f)return[...l,...f.map(a)];if(qf.has(m))return n.capturedOutput===!0?[...l,...Qf(e).map(a)]:l;if(m==="eval")return[...l,...Ya(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:at(m,p)).map(a)];if(m==="git")return[...l,...iw(u).map(a)];if(Wf.has(m))return[...l,...ow(u).map(a)];if(O_.has(m))return[...l,...Iw(u).map(a)];if(x_.has(m))return[...l,...cw(u,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...u.flatMap((p)=>at("awk",p)).map(a),...u.flatMap((p)=>dw(p,t,n,r,o,i)),...u.flatMap(mw).map(a)];if(m==="curl")return[...l,...u.flatMap((p)=>at(m,p)).map(a),...sw(u).map(a)];if(or(m)){let p=nr.has(m)?mc(m,u):null;if(p!==null){let h=t.getShellSyntax(p);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Xt(h,t,n,r,o,i),...u.slice(u.indexOf(p)+1).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...uw(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>at(m,p)).map(a)]}function K_(e,t,n){let r=ci(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function q_(e,t,n,r,o,i,s){if(Q_(t,n,r,o,i,s))return Qf(e).map((a)=>({target:a,cwd:i}));return Jf(t,Z_(e),n,r,o,i,s,()=>[])}function Y_(e,t,n,r,o,i,s){let a=Et(e);if(!or(lt(a[0]??"").toLowerCase()))return[];return Ya(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Jf(e,t,n,r,o,i,s,a){let l=ew(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>nr.has(l)?Xt(n.getShellSyntax(c),n,r,o,i,s):mi(l,c,n,r,o,i,s))}function Qf(e){let t=Et(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase();if(!qf.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Za(r.replaceAll("%%","%"))];return t.slice(1)}function Z_(e){let t=Et(e);if(t.length===0)return[];let n=lt(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return X_(r);return[]}function X_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Za(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>J_(t,r.slice(i*n,(i+1)*n)))}function J_(e,t){let n=0;return Za(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Za(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Q_(e,t,n,r,o,i){let s=Et(e);if(s.length===0||lt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=jt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,Va]:l.map((m)=>m.split(c).join(Va));return pi(d,t,n,r,o,i).some((m)=>m.target.includes(Va))}function ew(e){let t=Et(e);if(t.length===0)return null;let n=lt(t[0]??"").toLowerCase();if(!or(n))return null;return tw(n,t.slice(1))?n:null}function tw(e,t){let n=Xa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Zf.has(o)||ep(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(j_.get(n)?.has(o))r++;continue}return!1}return!0}function Xa(e){return/^python\d/.test(e)?"python":e}function nw(e){let t=[];for(let n of e){if(np(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Uf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function rw(e,t){if(!t||!Uf.test(e))return e;return`~${e.replace(Uf,"").replace(/\\/g,"/")}`}function at(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>at("jq",i))}return e.flatMap((r,o)=>o===t?[]:at("jq",r))}function iw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>at("git",i))];if(t.push(...at("git",r)),!le.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:at("git",o)),n++}return t}function sw(e){return e.flatMap((t,n)=>{let r=lw(t);if(r!==null)return Hf(r.flag,r.value);let o=aw(e[n-1]);return o===null?[]:Hf(o,t)})}function Hf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ka(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ka(t.slice(n+1))}return t.startsWith("@")?Ka(t.slice(1)):[]}function aw(e){if(e===void 0)return null;if(Yf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Yf.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ka(e){return e===""||e==="-"?[]:[e]}function cw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!__.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>w_.has(f)),m=d===-1?c:c.slice(0,d),u=pi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!P_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Zf.has(c)||ep(e,c)){let m=t[l+1];if(m!==void 0)a.push(...mi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...mi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ep(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return k_.get(t[t.length-1]??"")?.has(Xa(e))??!1}function dw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ra(e)?.commands.flatMap((s)=>Xt(t.getShellSyntax(s),t,n,r,o,i))??[]}function mw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(qa)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Ja),...n]}function mi(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=gw(t,pw(e));if(l===null)return fw(t).map(a);let c=l.masked.match(B_)!==null||l.literals.some((f)=>$_.test(l.masked.slice(0,f.start))),d=l.masked.match(U_)!==null||l.literals.some((f)=>H_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!nr.has(e),u=m&&!(Cw(l.masked)||c||d)?[]:l.literals;return[...u.map((f)=>f.text).filter((f)=>f!=="").map(a),...u.flatMap((f)=>Ja(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a),...c?l.literals.flatMap((f)=>Ya(f.text,n,r,o,i,s)??[a(f.text)]):[],...d?l.literals.flatMap((f)=>mi(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a)]}function pw(e){let t=Xa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function gw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(G_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Sw(e,o))return null;let a=t==="python"?hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=yw(e,c,l);if(d===null)return null;let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&z_.test(m))return null;r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{masked:n.join(""),literals:r}}function hw(e,t){return F_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function yw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Sw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Cw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(T_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>I_.has(i)))continue;if(o.length>1)return!0;if(bw(e,r)===".")return!0;if(vw(e,r+n.length)==="(")return!0}return!1}function bw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function vw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t,n,r,o,i){return Aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Xt(a,t,{...n,capturedOutput:!0},r,o,i),...Rw(a,r)?xw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Rw(e,t){let n=ko(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||lt(tt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=tt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function xw(e,t){return ko(e).flatMap((n)=>n.kind==="word"?[tt(n.text,t)]:n.kind==="redirection"&&n.target?[tt(n.target,t)]:[]).flatMap(Ja)}function Ja(e){let t=ww(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||_w(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function _w(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function ww(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Gn(o,n))continue;if(tp(e,r,n)){let i=Pw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Pw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Gn(i,n))continue;if(tp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function tp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===M_)o=!0;if(N_.has(m))r=!0;if(u!==void 0){if(m===Gf)t.push(u);continue}if(W_.has(m)){let f=e[l+1];if(m===Gf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(D_.has(g))r=!0;if(L_.has(g)){u=g,f=m.slice(h+1);break}}if(u==="")continue;if(f.length>0){if(u===Ff)t.push(f);continue}let p=e[l+1];if(u===Ff&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Et(e){let t=e.findIndex((n)=>!np(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function np(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var kw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Ow=".env.",Mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Dw=[".env.example.",".env.sample."];function Nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Lw(e){return e.length>0&&!/\s/.test(e)}function Ww(e,t,n,r){try{let o=xr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof F)throw o;return!1}}var Fw=new Set(["node_modules","__pycache__"]),Gw=[["vendor","bundle"],["vendor","cache"]];function zw(e,t,n,r,o){if(Nw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>Lw(s)||Ww(e,t,r,o);if(Mw.has(s)||Dw.some((u)=>s.startsWith(u)))return null;let c=H(Vw(e,t,r,o));for(let u of es){let f=`~/${u.suffixParts.join("/")}`;if((Vf(a,f)||Vf(c,f))&&st(u.id,n))return u.id}let d=Bw(i,t,n,r,o);if(d)return d;if(kw.has(s))return null;for(let u of Qi)if(s===u.basename&&st(u.id,n))return u.id;if(s.startsWith(Ow)&&st(qr.id,n)&&l())return qr.id;for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&st(u.id,n)&&l())return u.id}for(let u of ns)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&st(u.id,n))return u.id}if(Hw(a))return null;if(!s.includes(".")&&zn.pattern.test(s)&&st(zn.id,n))return zn.id;let m=jw(s,n);if(m)return m;return null}function Bw(e,t,n,r,o){return Yr.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Rr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Er(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Rr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Er(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Er(e,s,["credentials"])||Er(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>Rr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?U(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Rr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,qe(d,t,r,o),l))}case"secret.cli.pi":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Er(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(qe("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Rr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(U(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&Jt(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var jf=new WeakMap;function U(e,t,n,r,o){let i=jf.get(o)??new Map;jf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>rp(e,ae(t,r)))}function Er(e,t,n){return n.some((r)=>Jt(H(e),H(ae(t,r))))}function Rr(e,t,n,r,o){return rp(e,qe(t,n,r,o))}function rp(e,t){return H(e)===H(t)}function ae(e,...t){return He([e,...t].filter(Boolean).join("/"))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));return n.some((a)=>Jt(s,H(xr(a,r,o,i))))}function Uw(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(B(be(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=H(d?He(B(fi(be(d)),o.paths,i)):l&&He(B(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Jt(s,m))return!1;return n.some((u)=>{let f=H(xr(u,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Jt(s,f)})}function Hw(e){let t=e.split("/");return t.some((n)=>Fw.has(n))||Gw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function jw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of rs)if(r===o.extension&&st(o.id,t))return o.id;for(let o of os)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";if(!o)return i;let s=el(i,o),a=di(s)?s:He(fi(t,s)),l=He(B(a,n.paths,r));if(!Jt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Vf(e,t){return e===t||e.startsWith(`${t}/`)}function Vw(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i||!o)return"";let s=el(i,o),a=v_.normalize(di(s)?s:He(fi(t,s))),l=He(be(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function xr(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";let s=o?el(i,o):i;return He(B(di(s)?s:fi(t,s),n.paths,r))}function Qa(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(B(be(r),t.paths,n)):"",i=He(be(Kw(tt(e,t))));return{home:o,normalized:i}}function Kw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return R_(e)}catch{return e}}function el(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function qw(e){if(process.platform==="win32")return!0;return E_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&qw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function lt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Yw={findPolicyMutation:Nf,findGitMetadataMutation:md,resolveGitMetadata:Zw,loadPolicySnapshot:eu,findSensitiveTarget:Xf,analyzeCommand:wf,getModes:Pi};function op(e,t){let n={...Yw,...t.dependencies},r=Qw(e),o=_r(e)?e.command:r,i=Rt("policy-protection",o,()=>ir(e,t.factParserDependencies)),s=ue(i,"input-candidate"),a=ue(i,"declared-command");if(_r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Od,intent:"stop_and_explain",evidence:[]}};let l=Ce(),c=Rt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=Rt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Df,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let m=Rt("policy-protection",o,()=>If(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Tf,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:m.target}]}}}let u=Rt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let f=Rt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Xw(f)},y=p.secretProtection.enabled===!1?null:Rt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:_r(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Kf,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!_r(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...tl("command-validation",o),...g};let v=Rt("command-analysis",o,()=>Af(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Jw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Zw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Xw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Jw(e){return ue(e,"declared-command")?.program}function Qw(e){try{return Ln(e.input)}catch(t){let n=_r(e)?e.command:void 0;throw new Qt("policy-protection",tl("policy-protection",t instanceof Xe?void 0:n,t),t)}}function Rt(e,t,n){try{return n()}catch(r){throw new Qt(e,tl(e,r instanceof Xe?void 0:t,r),r)}}function tl(e,t,n){let r=n instanceof F||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?bi:In,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function _r(e){return e.route.kind==="command"}import{appendFileSync as mA,mkdirSync as fA}from"fs";import{isAbsolute as pA,join as ol}from"path";import{lstatSync as sp,readdirSync as eA,readFileSync as tA,rmdirSync as nA,statSync as ap,unlinkSync as rA,utimesSync as oA,writeFileSync as iA}from"fs";import{join as wr}from"path";function ip(e,t={}){return to(ln(e,t),e.home).policy.audit.retention_days}var rl=86400000,sA=".last-prune",aA=/^\d{4}-\d{2}$/,lA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,lp=(e)=>Math.floor(e/rl);function up(e,t,n=()=>new Date){try{let r=n().getTime();if(!ap(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=wr(t,sA),i=ap(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&lp(i)===lp(r))return;let s=r-ip(e)*rl,a=new Date(r).toISOString().slice(0,7);for(let l of nl(t)){if(l.isDirectory()){cA(wr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))uA(wr(t,l.name),s)}iA(o,"",{mode:384}),oA(o,r/1000,r/1000)}catch{}}function cA(e,t,n){for(let r of nl(e)){if(!r.isDirectory()||!aA.test(r.name))continue;let o=wr(e,r.name);for(let i of nl(o)){if(!i.isFile())continue;let s=lA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+rl;if(!Number.isFinite(a)||a>=t)continue;dp(wr(o,i.name))}if(r.name!==n)cp(o)}cp(e)}function uA(e,t){try{let n=sp(e);if(n.mtimeMs>=t)return;let r=tA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(dA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(sp(e).mtimeMs!==n.mtimeMs)return;dp(e)}catch{}}function dA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function nl(e){try{return eA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dp(e){try{rA(e)}catch{}}function cp(e){try{nA(e)}catch{}}var gA="2.4.1",hA=1e4,yA=2000,SA=256,CA=32768;function bA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function il(e,t,n,r,o,i,s={}){let a=bA(t);if(!a)return;let l=RA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(ct(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=gi(ct(r),yA),u=s.toolName?gi(ct(s.toolName),SA):void 0,f=i===null?void 0:gi(ct(i),CA),p=ol(l,vA(f?.value??null),c.slice(0,7));fA(p,{recursive:!0,mode:448});let h=ol(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Li)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};mA(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),up(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function EA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&pA(n)?n:null}function RA(e){let t=EA(e);return t?ol(t,".cc-safety-net","logs"):null}function fp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=mp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?mp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function mp(e){return"command"in e?e.command??"":""}function pp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function gp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function yp(e,t,n){try{let r=op(t,{environment:e,...n.guard});return hp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw hp(e,t,r.evaluation,n,!(r.cause instanceof Xe),{stage:r.stage,errorCode:xA(r.cause)}),r}}function hp(e,t,n,r,o=!0,i){pp(e,fp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function xA(e){if(e instanceof F)return P[e.kind].errorCode;if(e instanceof Xe)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}var Cp=wA();function wA(e={}){return(t,n)=>{try{return AA(t,n,e)}catch(r){return console.error("CC Safety Net error:",r),sl(Tr())}}}function AA(e,t,n){let r=wl(),o=PA(e,t,r.paths),i=()=>kA(e);if("malformed"in o)return gp(r,o.denial,i,{agent:"amp",toolName:o.denial.toolName,cwd:o.cwd}),sl(o.denial);try{let s=yp(r,o,{guard:{auditAllowed:Al(r.env),dependencies:n.guardDependencies},audit:{agent:"amp",getSessionId:i}});return Sp(s,!0)}catch(s){if(!(s instanceof Qt))throw s;if(At(ee.debug,r.env))console.error(`CC Safety Net debug: amp tool.call analysis failed: ${fl(s.cause)}`);return Sp(s.evaluation,o.route.kind==="command")}}function PA(e,t,n){if(!e||typeof e!=="object")return Pn(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Pn(null);if(!r.input||typeof r.input!=="object")return Pn(null,r.tool);let o=TA(t,n);if(!o)return Pn(null,r.tool);let i=IA(t,e);if(!i.ok)return Pn(o,r.tool);if(!i.command)return an(r.tool,r.input,{kind:Mi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Pn(o,r.tool);let s=typeof i.command.dir==="string"?jl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return an(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function TA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Hl(".",[r],t)}catch{return}}function IA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function kA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function Pn(e,t){return{malformed:!0,denial:Tr({toolName:t}),cwd:e}}function Sp(e,t){let n=dl(e,{includeEvidence:t});return n?sl(n):{action:"allow"}}function sl(e){return{action:"reject-and-continue",message:ml(e)}}function OA(e){e.on("tool.call",(t)=>Cp(t,e))}export{OA as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Go(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function lr(e){return e?w(e):""}function $E(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function ha(e,t){return pa(Oe(e,"posix"),t)}function ur(e){return ha(e,new Set(Array.from(e.matchAll(Qd)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function pa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(pa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>pa(o,n))||rm(r.words,n))return!0;KE(r,n)}return!1}function rm(e,t){let n=e.findIndex((s)=>we(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(cr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Jd(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Jd(s[l],t)}let i=UE(e,n,t);if(i===null)return!1;if(i===-1)return!0;return rm(e.slice(i),t)}function UE(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return HE(e,t+1);if(r==="exec")return jE(e,t+1);if(r==="env")return VE(e,t+1,n);return null}function HE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function jE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function VE(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return cr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return cr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(we(i))continue;return r}return null}function KE(e,t){if(!e.words.every((n)=>we(n.text)!==null))return;for(let n of e.words){let r=we(n.text);if(!r)continue;if(cr(n,t))t.add(r.name)}}function cr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Qd)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(ME.test(o)||t.has(o))}))}function Jd(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||cr(e,t))}var qE=["--init-file","--rcfile"],YE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function nt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return om(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=om(e,t,!1);if(r!==null)return r}}return null}function rt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function om(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function im(e){let t=k(e[0]??"").toLowerCase(),n=ZE(e,t),r=YE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function ZE(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?qE.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let d=l.split("=",1)[0]??l;if(t==="bash"&&ji.has(d)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Vi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var ya="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ba="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",XE="__CC_SAFETY_NET_XARGS_INPUT__",zo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Bo="rm",JE=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,QE=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,eR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,tR=/^(?:[0-9]+|[@*])$/;function lm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Bt(n),i=n.slice(r),s=C("xargs.shell-dynamic",ba);if(rR(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let m=fm(l,o,a.wrapperEnvAssignments),d=a.head==="rm"&&o!==null&&dm(l,o),u=t.analyzeChild(l,{...Ft(a,t),dynamicInput:m,dynamicSourceInput:d||um(l,a.head,o,a.wrapperEnvAssignments,m,t.environment),dynamicRmInput:d,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:C("xargs.rm-recursive-force-dynamic",ya)});if(u)return u;let f=nR(l,o,t.policy?.rules??[],A(s,t.policy));if(f)return f;if(a.head==="git"){let h=o===null?[...l,XE]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Ft(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Qe(l,t.policy?.rules??[]);if(p)return p}return null}function nR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Qe([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function cm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=qd(e,r,t.length,n);return o===null?[]:[o]}function um(e,t,n,r,o,i){if(J.has(t)){if(rt(e))return!1;if(n!==null&&oR(e,n))return!0;let s=nt(e);if(!s){let a=tt(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ze(s))return!0;return iR(s,n,r)}if(ke(t))return sm(e,n,uo,Iu(t));if(_e.has(t))return sm(e,n,na,Id);if(t==="eval"){let s=Wo(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return sR(e,n,i);if(t==="git"){let s=ze(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&pn.has(s.subcommand.toLowerCase())&&mm(s.rest,n).some((a)=>a.includes(n))}return!1}function sm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,zo]).sources.some((a)=>a.value===zo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${zo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${zo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>cm(l,t,a))));return No(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function rR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,Bo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Bo));return Array.from(Fe(o,n)).some((i)=>i.head===Bo&&!r.has(Bo))}function dm(e,t){return mm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function mm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function fm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function oR(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return cm(i,t,o).some((l)=>{let c=e.map((d,u)=>u===s?d.replaceAll(t,l):d),m=Se(c);if(m.commandIndex===null&&m.scriptIndex===null)return!1;if(n.commandIndex===null&&m.commandIndex!==null)return!0;if(n.scriptIndex===null&&m.scriptIndex!==null)return!0;if(m.commandIndex!==null&&(c[m.commandIndex]??"").includes(l))return!0;return m.scriptIndex!==null&&(c[m.scriptIndex]??"").includes(l)})}))}function iR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(JE))if(am(o,r))return!0;for(let o of e.matchAll(QE))for(let i of(o[1]??"").matchAll(eR))if(am(i,r))return!0;return ha(e,r)}function am(e,t){let n=e[1]??e[2];return n!==void 0&&(tR.test(n)||t.has(n))}function sR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(et(s)){let l=sr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let m=fm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&dm(c.tokens,t)||um(c.tokens,c.head,t,c.wrapperEnvAssignments,m,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Bt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var dr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",mr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",lR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",cR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Uo=/\{[^{}\s]*\}/g,pm=/\{\}|\{-?\d+\}/g,uR=["e","f","source","file","-e","-f","--source","--file"],dR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],mR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),fR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),gm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),pR=new Set(["--workdir","--wd"]),hm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ae(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function vm(e){return Ae([...e],(t)=>Ze(t))}function Em(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=gn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=km(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:m,dryRun:d}=o;if(c){let p=gn(t);if(p)return p;let h=vm(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=SR(t);if(p)return p}if(m!==void 0&&a){let p=gn(t);if(p)return p}let u=vR(m,t.cwd,t.environment.paths);if(u===null){let p=gn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(d){if([...Fe(i,f)].flatMap((h)=>[...h.envAssignments.values()]).some(va)){let h=gn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=wm(f.envAssignments,f.cwd,a);return Ae(p,(g)=>t.analyzeNested(g,h))}return Ae(Fe(i,f),(p)=>gR(p,o,t,f))}function gR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Tm)){let g=gn(n);if(g)return g}let m=vm(c);if(m)return m;let d=c.some(F),u=i||d,f=a&&u,p=wm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Ae(o,(E)=>n.analyzeChild($o(l,E,n.budget),Ft(e,r)))};if(rt(l))return g();let y=nt(l);if(y){if(Im(y)){let R=Ct(n);if(R)return R;if(o.length===0)return null;return Ae(o,(P)=>n.analyzeNested(Cm(y,P,n.budget),p))}if(F(y)){if(o.length>0)return Ae(o,(q)=>n.analyzeNested(Cm(y,q,n.budget),p));let R=ar(y);if(R?.[0]&&M(R[0])==="rm"&&Ge(R)){let q=bm(n);if(q)return q}let P=R?n.analyzeChild(R,{...Ft(e,r),dynamicInput:a,shellDynamicMatch:C("parallel.shell-dynamic",mr),rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",dr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!d&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Fo(K(R===void 0?l:i?l.map((P)=>Pm(P,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=Ct(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Ae(S,(R)=>n.analyzeNested(R,p));if(ur(y)){let R=Ct(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(u)return Ct(n);return null}let v=tt(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return Ct(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=Ct(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Ae(T,(R)=>n.analyzeNested(R,p))}if(u||a)return Ct(n)??g();return null}if(e.head==="rm"&&Ge(l)){if(i&&o.length>0)return Ae(o,(y)=>Ca($o(l,y,n.budget,pm),e.cwd,r));if(o.length>0)return Ae(o,(y)=>Ca(Sm(l,y,n.budget),e.cwd,r));let g=Ca(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(pm,"")]:[]}),e.cwd,r);if(g)return g;return bm(n)}let h=o.length>0?o:[void 0];return Ae(h,(g)=>{let y=g===void 0?l:i?$o(l,g,n.budget):Sm(l,g,n.budget),v=C("parallel.shell-dynamic",mr),E=a&&e.head==="find"?CR(y,r):null,S=xm(y,a,n)??E?.customResult??null,T=M(e.head),R=a&&(T==="rm"&&Sa(y)||T==="xargs"&&_m(y)||E?.rmOptions===!0),P=a&&(R||E?.executedSource===!0||E===null&&Rm(y,T)),q=n.analyzeChild(y,{...Ft(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",dr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Qe(y,n.policy?.rules??[])})}function Rm(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return bR(e);if(t==="git")return hR(e);if(t==="find")return!0;if(_e.has(t))return ym(e,uR,ir);if(ke(t))return ym(e,dR,co);return!1}function Sa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||Im(o)))}function hR(e){if(yR(e))return!0;let t=ze(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!pn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function yR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function bR(e){if(rt(e))return!1;let t=nt(e);if(t!==null)return F(t);let n=tt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function ym(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,hm]).some((o)=>o.value===hm);return No(r,t,(o)=>n(e.map((i)=>Pm(i,[o]))))}function xm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return Ct(n);return Ae(o,(i)=>Qe([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function CR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of Fe(i,t))n.executedSource||=Rm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Sa(a.tokens)||a.head==="xargs"&&_m(a.tokens),n.customResult??=xm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(et(a)){i=[],n.executedSource||=F(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function _m(e){let t=e.slice(Bt(e).childStart);return M(t[0]??"")==="rm"&&Sa(t)}function Ho(e,t){return(n)=>A(C(e,t),n.policy)}var Ct=Ho("parallel.shell-dynamic",mr),SR=Ho("parallel.command-stream-dynamic",lR),gn=Ho("parallel.command-stream-dynamic",cR),bm=Ho("parallel.rm-recursive-force-dynamic",dr);function Ca(e,t,n){return A(Lo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Nt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function wm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function Pm(e,t){return e.replace(Uo,(n)=>Am(n,t))}function $o(e,t,n,r=Uo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=Am(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Cm(e,t,n){return $o([e],t,n)[0]??""}function Sm(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function Am(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Uo)!==-1}function Tm(e){if(va(e))return!0;for(let t of e.matchAll(Uo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function va(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Im(e){return/^\{[^{}\s]*\}$/.test(e)}function vR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!aR(e))return null;try{return mt(t??e,e,n)}catch{return null}}function km(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ia(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ia(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||fR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(gm.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=gm.has(p)?2:1;continue}if(pR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(mR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?va:Tm);let m=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){m.push(p),p=[];continue}if(g!==void 0)p.push(g)}m.push(p)}c||=m.length>1;let d=ER(m),u=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function ER(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function Om(e){return km(e).childStart}var RR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ra(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ea(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Dm(e,t,n,r,o=!1,i){let a=(Fn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?C("shell.dynamic-executable",RR):null;return A(a,i)??Nm(e,t,n,o,i)}function Nm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ra(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=_R(a);if(re(o,"shell.dynamic-structure",r)&&i.some((d)=>d<=l))return A(C("shell.dynamic-structure",jo),o);if(A(Do(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),m=a.findIndex((d,u)=>u>l&&w(d)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&pn.has(c)&&i.some((d)=>d>l&&(m===-1||d<m)))return A(C("shell.dynamic-structure",jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&wR(t)?A(C("shell.dynamic-structure",jo),o):null;if(s==="rm"){let a=t.findIndex((c,m)=>m>0&&w(c)==="--"),l=Ge(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(C("shell.dynamic-structure",jo),o):null}if(s==="xargs")return Mm(e,t.slice(Bt(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return Mm(e,t.slice(Om(t.map(w))),"parallel",n,r,o);return null}function Mm(e,t,n,r,o,i){if(t.length===0)return null;let s=xR(t,r);if(Fn(e,s)){let l=A(C(`${n}.shell-dynamic`,n==="xargs"?ba:mr),i);if(l)return l}let a=Nm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ra(l)&&Ea(l)))return A(C(`${n}.rm-recursive-force-dynamic`,n==="xargs"?ya:dr),i);return null}function xR(e,t){let n=kt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function _R(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Ce.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function wR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ra(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ea(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ea(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(et(s.text))o=!0,r=!0}return!1}function xa(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!io(t[n.tokenIndex],n.value)})}var PR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",AR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",TR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Lm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return C("dd.device-write",PR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return C("mkfs.device",AR);if(e==="shred"&&n.length>0)return C("shred.target",TR);return null}var Fm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Lo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Do(e.words,_a(e))},{heads:new Set(["find"]),analyze:(e)=>Ld(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>$t(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>lm(e.words,{...Wm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>$t(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Em(e.words,{...Wm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>$t(e.options.analyzeNested(t,n))})}];function Wm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function $t(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function _a(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var $m="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function Um(e){return Fm.find((t)=>t.heads.has(e))?.analyze}function yn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,m=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,d=s?s.originalCwd:c?void 0:n.cwd,u=po(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=kt(u.words,n.environment,m,new Map([...n.envAssignments??[],...u.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let x=[...p,...i(f.words)].join(" "),I=Ze(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=go(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(te)return te}}let h=f.rewritten?K(i(f.words)):sn(o,f.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=g[0];if(!E)return null;if(Wt(E))throw new D("wrapperPeelIterations");let S=M(E),T=f.cwd===null?void 0:f.cwd??m,R=f.cwd===null?void 0:d,P=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!tr(v,n.environment),Z=Dm(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=To(g,n.policy);if(ee){for(let x of[ee.childIndex,...ee.alternativeChildIndices]){Gm(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=yn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Wo(h):S==="trap"&&!a?tm(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return hn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(x)return x}return bn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ga(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(S):jm(E,S)){if(rt(g))return null;if(a&&s){let x=nt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let L=hn(s,n.policy);if(L)return L}if(ur(x)){let L=hn(s,n.policy);if(L)return L}return n.analyzeNested(x,{effectiveCwd:P,envAssignments:v})}let I=tt(h);if(I.kind==="dynamic")return hn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?hn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?hn(s,n.policy):null}if(l){let x=nt(g),I=x?n.analyzeNested(x,{effectiveCwd:P,envAssignments:v}):tt(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let x=MR(g,v,P,n,r,t);if(x)return x;let I=nt(g);if(I){let Kt=Fo(h,I);if(Kt.kind==="dynamic")return he(r);let ui=Kt.kind==="literal"?Kt.source:I,tl=DR(ui);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:tl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:tl,depth:t+1});let nl=n.analyzeNested(ui,{effectiveCwd:P,envAssignments:v});if(nl)return nl;return ur(ui)?he(r):null}let L=tt(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Ko(L.source,P,v,n,r,t);let te=nm(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let Kt=n.commandView?h[x]:void 0;if(!Kt)return null;if(Kt.provenance!=="literal")return he(r)}let I=x===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Ko(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!ga(n.commandView))return he(r)}if(_e.has(S)&&!l){if(!s&&n.strict&&xa(ir(g),h))return he(r);let x=kd(g,(L)=>$t(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(ke(S)&&!l){if(!s&&n.strict&&xa(co(g),h))return he(r);let x=Tu(g);if(a&&s)return kR(S,x,P,v,n,s);if(x){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let te=A(C("interpreter.one-liner-paranoid",Vn),n.policy);if(te)return ue(te)}if(Ls(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let L=n.analyzeNested(x,{effectiveCwd:P,envAssignments:v});if(L&&!Hm(L,x))return L;if(Kn(x)){let te=A(C("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:cn}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return Gm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),yn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let N=s?null:A(Lm(S,g),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),ue(N);let le=r===y.trace?y:{...y,trace:r},xe={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:q,dynamicArguments:f.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:le,analyzeChildTokens:(x,I)=>a&&s?wa(x,t,le,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):$t(yn(K(x),t+1,{...le,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Qe(x,le.policy.rules),analyzeChild:(x,I)=>wa(x,t,le,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:Um(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Te=r&&S==="git"?Kd(xe.words,_a(xe)):void 0,li=zm(Te?Te.match:je?.(xe)??null,n.policy);if(r)NR(xe,li,Te?.relaxation??null);if(li)return ue(li);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(Ge(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?bn(s,n.policy):null)??OR(s,n.policy)}let Qa=je!==void 0,el=!s&&!Qa&&!Mr.has(S),ci=r&&el?[]:void 0;if(el)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;ci?.push(I);let L=zm(IR(g,x,t,le,T,R,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&Qa)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let vr=Qe(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!vr,reason:vr?.reason}),vr)return ue(vr);return a&&s?bn(s,n.policy):null}function wa(e,t,n,r){return $t(yn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function IR(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let m=M(c);if(jm(c,m)||Um(m)!==void 0&&m!=="xargs"&&m!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=wa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!tr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function kR(e,t,n,r,o,i){if(!t)return bn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(C("interpreter.one-liner-paranoid",Vn),o.policy);if(a)return ue(a)}if(Ls(e,t))return bn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Hm(s,t))return s;if(Kn(t)){let a=A(C("interpreter.dangerous-command",cn),o.policy);if(a)return ue(a)}return bn(i,o.policy)}function Hm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(wo)||e.reason===fn)&&!Dr(t)}function hn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function bn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function OR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function MR(e,t,n,r,o,i){let s=im(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Ko(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Ko(a,n,t,r,o,i,!0)}function Ko(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=jn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function DR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function NR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Gm(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:$m}),ue(LR())}function LR(){return{id:"",reason:$m,intent:"stop_and_explain"}}function jm(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function zm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var WR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,FR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function GR(e,t){let n=qm(e,t);if(n.length===0)return!1;let r=n[Km(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return WR.test(e.join(" "))}function Vm(e,t,n,r){if(e.dialect==="powershell"){let a=zR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Bm(HR(a.target),t,n.paths)}let o=e.words.map(w);if(!GR(o,n))return;if(!t)return null;let i=qm(o,n,t),s=Km(i);if(s===-1||i[s]!=="cd")return null;return Bm(i[s+1],t,n.paths)}function Bm(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return jR(mt(t,e,n),t,n)?t:null}catch{return null}}function zR(e,t){let n=BR(e[0])?1:0,r=e[n];if(!$R(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!FR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return UR(e.slice(n+1),t)}function BR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function $R(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function UR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function HR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Km(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function qm(e,t,n){let r=VR(e);return ft([...r],t,n)}function jR(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return Vo(e)===Vo(t);return Vo(r)===Vo(o)}function VR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Aa="TMPDIR",Ta="IFS",Ym=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,Zm=/^[A-Za-z_][A-Za-z0-9_]*$/,Xm=new Set(["export","typeset","declare","readonly"]),KR=new Set(["builtin","command","time"]);function Jm(e,t){return{env:e,effectiveEnvAssignments:JR(e,t),shellAssignments:new Map}}function Qm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function Ia(e,t){let n=tf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),ka(t,s)});let r=n.commandIndex;if(r!==-1&&Xm.has(e[r]??""))e.filter((s)=>Zm.test(s)&&Pa(s)).forEach((s)=>{QR(t,s)});let o=r===-1?-1:nf(e,r);if(o===-1||e[o]!=="unset")return;let i=tx(e,o);if(i===null)return;e.slice(i).forEach((s)=>{ex(t,s)})}function ef(e,t){let n=tf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function tf(e,t){let n=e.findIndex((s)=>!qR(s)),r=n!==-1&&Xm.has(e[nf(e,n)]??""),o=XR(t);return{assignments:e.flatMap((s,a)=>{let l=YR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!mo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function nf(e,t){let n=t;while(KR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function qR(e){return we(e)!==null||Ym.test(e)}function YR(e,t,n){return we(e)??ZR(e,t,n)}function ZR(e,t,n){let r=fo(e,n,t);if(r)return r;let o=e.match(Ym)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Pa(e){return e===Aa||e===Ta||Gs(e)}function XR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function JR(e,t){let n=[Aa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function QR(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function ex(e,t){if(!Pa(t)&&!Zm.test(t))return;if(e.shellAssignments.set(t,""),mo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Pa(t)||t===Aa||t===Ta||kn(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function tx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var nx="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ut="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function La(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Oe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((m)=>m.code.includes("heredoc"));if(c){if(!n.strict)return Na(e,n);let m=`${wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:m}),{reason:m,segment:e,intent:"stop_and_explain"}}return cf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return cf(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Na(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Jm(n.environment.env,n.envAssignments);return Zo(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function Zo(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let m=e.nodes[l+1],d=m?.kind==="connector"?m.operator:void 0,u=rx(e,l,c,a,d),f=a==="&&"||a==="||",p=f?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=f||Sn(d);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=fr(X);return U.functionDefinitions.set(c.name,c.body),Oa(X,[U],u,d==="&",Sn(d))}),ee=Ma(Z,[],g,y,a,d);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let N=Zo(c.body,t,n,r,[fr(U)]);if(N.result)return N;if(Z.push(...Oa(U,N.states,u,d==="&",Sn(d))),v)ee.push(U,...u?N.states.map((le)=>qo(U,le)):N.states)}let X=Ma(Z,ee,g,y,a,d);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=Xo(a)&&S?.kind==="command"?em(S)??ix(S):void 0,R=[],P=[];for(let Z of h){let ee=sx(c,t,n,r,[fr(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>qo(Z,U));for(let U of X){let N=fr(U),le=cx(c,t,n.trace?{...n,trace:uf(n.trace,E)}:n,r,N,Xo(a),T);if(le)return{result:le,states:i};let xe=Ex(c,N.functionDefinitions);if(xe)n.budget.charge("derivedTokens",Jo(xe));let je=xe?t+1>=V.recursionDepth.cap?Da(c.displayText,n,[N]):Zo(xe,t+1,n,r,[N]):{result:null,states:[N]};if(je.result)return je;if(R.push(...Oa(Z,je.states,u,d==="&",Sn(d))),v)P.push(Z),P.push(...je.states.map((Te)=>u?qo(Z,Te):Te))}}let q=Ma(R,P,g,y,a,d);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function rx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Xo(r)||Xo(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&ox(e,t)}function Oa(e,t,n,r,o){let i=n?t.map((a)=>qo(e,a)):[...t],s=o?i.flatMap((a)=>Cn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function qo(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function ox(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(ax(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Xo(e){return e==="|"||e==="|&"}function ix(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Sn(e){return e==="&&"||e==="||"}function Ma(e,t,n,r,o,i){let s={success:Yo([...n,...e]),failure:Yo([...r,...t])},a=Sn(i)?s:void 0;return{states:Sn(o)||a?Yo([...s.success,...s.failure]):s.success,conditionalStates:a}}function uf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function sx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=lx(e);if(s){if(t+1>=V.recursionDepth.cap)return Da(s,n,o);let a=Oe(s,"powershell");if(a.status==="limited")return Da(s,n,o);if(a.status!=="complete")return rf(i,n,r,o);n.budget.charge("derivedTokens",Jo(a)),i.push({program:a,depth:t+1})}}return rf(i,n,r,o)}function ax(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function rf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Zo(i.program,i.depth,t,n,[fr(a)]);if(l.result)return l;s.push(...l.states)}o=Yo(s)}return{result:null,states:o}}function lx(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Jo(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Jo(o),0):n.kind==="group"||n.kind==="function"?Jo(n.body):0),0)}function Da(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function cx(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=hx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};df(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words).map(w),m=e.displayText,d=ef(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=A(Rd(e,i,xx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return Rx(m,p)}if(c.length===1&&c[0]?.includes(" ")&&!Fn(e.dialect,e.words)){let p=A(Ze(c[0]),a.policy),h=p!==null&&!a.strict&&xu(e,a.rootProgram);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:m,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=of(e,l,o,d,s,a);if(g)return g;return Ia(c,o.shellGitContextState),null}let u=yn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=La(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?uf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:m};let f=of(e,l,o,d,s,a);if(f)return f;return Ia(c,o.shellGitContextState),null}function of(e,t,n,r,o,i){let s=yx(e,t,n,r??new Map,i);if(s)return s;return df(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),mx(e,t,n,i.environment.paths,i.budget),Sx(e,n,o,i.environment,i.trace),null}var ux=new Set([">>","<>"]);function df(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?dx(s):ux.has(s.operator)))continue;sf(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=mf(e.words.slice(1));if(!i)return;for(let s of i.operands)sf(s,t,r,o)}function dx(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function sf(e,t,n,r){let o=e?.provenance==="literal"?jn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function mx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!Qo(i))return;for(let s of fx(e)){let a=jn(s.text,n.effectiveCwd,r,o);if(!a||!Pu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function fx(e){let t=gx(e.redirections)?.target,n=af(t)?[t]:[];if(Re(e.words[0],"cat"))return px(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=mf(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(af))return[];return[...r.operands,...n]}function px(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function gx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function mf(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function af(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Qo(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function hx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Ut;let n=t[0];if(!n?.heredoc)return Ut;if(!Qo(n.heredoc))return nx;if(n.fd!==void 0&&n.fd!==0)return Ut;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Ut;let r=e.redirections.some((s)=>s!==n&&lf(s.target));if(Re(e.words[0],"cat"))return r?Ut:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(lf)?Ut:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return Ut}function lf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function yx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Cx(e,i,n,r,o))return null;let a=bx(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Na(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function bx(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Qo(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!ke(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(C("interpreter.one-liner-paranoid",Vn),n.policy);if(c)return c}if(!Kn(s))return null;let l=A(C("interpreter.dangerous-command",cn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Cx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Qo(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=kt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return rt(a)}function Sx(e,t,n,r,o){let i=Vm(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function fr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Qm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function Yo(e){let t=[];for(let n of e){if(!t.some((r)=>vx(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function vx(e,t){return e.effectiveCwd===t.effectiveCwd&&Cn(e.shellGitContextState.env,t.shellGitContextState.env)&&Cn(e.literalHeredocFiles,t.literalHeredocFiles)&&Cn(e.functionDefinitions,t.functionDefinitions)&&Cn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Cn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Cn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Ex(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function Rx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function xx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Na(e,t){let n=A(Ze(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function cf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var _x=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function ff(e,t,n,r){let o=La(e,0,{...t,...Vc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function pf(e,t,n){try{return{decision:e()}}catch(r){let o=wx(r,t,n);if(!o)throw r;return o}}function wx(e,t,n){if(!(e instanceof D)||!_x.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Px=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Fa=new Set(["cc-safety-net","ccsn"]),Ax=new Set(["bunx","npx","pnpx"]),Tx=new Set(["pnpm","yarn"]),Ix=new Set(["npm","pnpm","yarn"]),kx=new Set(["bun","node"]);function ti(e,t,n={}){if(Fa.has(e))return 0;if(Ax.has(e)){if(n.broad)return Wa(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ei(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Ix.has(e)&&n.broad&&t[r]==="exec"){let o=Wa(t.slice(r+1));return o===null?null:r+1+o}if(Tx.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ei(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Wa(t.slice(r+1));return o===null?null:r+1+o}if(kx.has(e)){let o=n.broad&&r!==-1?r:0;if(gf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&gf(t[o+1]))return o+2}return null}function Wa(e){let t=e.findIndex((r)=>ei(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ei(r))break;n++}return n}function ei(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Fa.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Fa.has(e.slice(0,t))}function gf(e){let t=e?.replaceAll("\\","/");return[...Px].some((n)=>t===n||t?.endsWith(`/${n}`))}var hf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function yf(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Ox(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Ox(e,t){let n=ft([...e],t),r=n.slice(1),o=ti(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ni}from"path";var vf="This path contains the protected policy config and you must not modify or delete it.",Mx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Ef(e,t,n){let r=Gx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return bf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Cf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Cf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return bf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Rr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function bf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>pr(a,n,r,o,i));return s?{target:s}:null}function Cf(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>Dx(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>pr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Fx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function Dx(e,t,n,r,o){if(Jn(e))return null;let i=Ot([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&Nx(a)){let l=Lx(a).find((c)=>Sf(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Oo(i,1)||aa(i,r)){let c=(ko(K(i))??K(["."])).find((m)=>{let d=fe(m.text,t.variables);return pr(d,t.cwd,n,r,o)||Sf(d,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=vo(a).sources.find((c)=>zx(fe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Wx(i,s))return null;for(let l of[...e,...i])for(let c of Rf(l))if(pr(fe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function Nx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Lx(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Wx(e,t){if(!Mx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Fx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Rf(i))if(pr(s,t,n,r,o))return{target:s};return null}function Rf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Gx(e,t,n){let r=(a)=>gr(ie(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Mn(e.executionCwd)),r(Mn(e.configCwd))],s=new Set(i.map((a)=>ni(a)));for(let a=ni(o);;a=ni(a))if(s.add(a),ni(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function pr(e,t,n,r,o){let i=_l(e,t,r,o,(s)=>gr(s)===kr);return i!==null&&n.files.has(gr(i))}function Sf(e,t,n,r,o){return n.directoriesAndAncestors.has(gr(ie(e,t,r,o)))}function zx(e,t,n,r,o){let i=gr(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function gr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ri,posix as Bx,resolve as ii,win32 as $x}from"path";import{fileURLToPath as Ux}from"url";var Mf="Access to a sensitive path is not allowed.",Df=new Set(["echo","printf"]),Hx=new Set(["find"]),jx=new Set(["-exec","-execdir"]),Vx=new Set([";","+"]),Kx=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),qx=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Nf=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),Yx=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Zx=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Lf=new Set(["-c","-e","-r","-E","--eval","--exec"]),Xx=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),Jx=new Set(["grep","rg"]),xf=new Set(["jq","gojq","jaq"]),_f="f",wf="file",Qx="files",e_=new Set(["e","f"]),t_=new Set(["regexp","file"]),n_=new Set(["e","f","A","B","C","m"]),r_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Ga="__CC_SAFETY_NET_PIPE_INPUT__",Ba=/[\w./~@+-]*[./~][\w./~@+-]*/g,o_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,i_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,s_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,a_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,l_=/\b(?:system|exec)\s*$/,c_=/\b(?:eval|exec)\s*\(/g,u_=/\b(?:eval|exec)\s*$/,d_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Pf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(cw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=aw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&uw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Wf(e,t,n,r,o={}){let i=Af(e,n,r),s=Pf(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?Af(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Pf(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&m_(e,n))return null;return l}function m_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of So(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Je(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=st(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>Kx.has(a))}function Af(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?vn(s.shell,e.store,r,t,o,n,f_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function f_(e){return e.program.dialect==="powershell"}function vn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Le;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...U_(Je(e.source,r),t,n,r,o,i)],l=(c)=>Je(x_(c,s),r);return Co(e,o,r,i,{word:l,segment:(c,m,d,u,f)=>{if(c.length===0)return null;if(a.push(...si(c,t,n,r,m.cwd,i,f)),d!==null)a.push(...g_(d,c,t,n,r,m.cwd,i));return null},redirection:(c,m)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Ff(c.consumer,[c.body],t,n,r,m.cwd,i,(d)=>h_(c.consumer??[],d,t,n,r,m.cwd,i)));if(c.targetOrder==="legacy-segment")return Us;return a.push({target:l(c.target),cwd:m.cwd}),null}}),a}function $a(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Le;return s.status==="complete"?vn(s,t,n,r,o,i):null}function si(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(xf.has(st(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...si(p,t,n,r,o,i)]}let l=R_(e).map(a),c=St(e);if(c.length===0)return l;let m=c[0]??"",d=st(m).toLowerCase(),u=c.slice(1),f=p_(m,d,u);if(f)return[...l,...f.map(a)];if(Df.has(d))return n.capturedOutput===!0?[...l,...Gf(e).map(a)]:l;if(d==="eval")return[...l,...$a(u.join(" "),t,n,r,o,i)??u.map(a)];if(d==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:it(d,p)).map(a)];if(d==="git")return[...l,...w_(u).map(a)];if(xf.has(d))return[...l,...__(u).map(a)];if(Jx.has(d))return[...l,...X_(u).map(a)];if(Hx.has(d))return[...l,...I_(u,t,n,r,o,i).map(a)];if(_e.has(d))return[...l,...u.flatMap((p)=>it("awk",p)).map(a),...u.flatMap((p)=>O_(p,t,n,r,o,i)),...u.flatMap(M_).map(a)];if(d==="curl")return[...l,...u.flatMap((p)=>it(d,p)).map(a),...P_(u).map(a)];if(Qn(d)){let p=Xn.has(d)?Se([d,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Le;if(h.status==="complete")return[...l,...vn(h,t,n,r,o,i),...u.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...k_(d,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>it(d,p)).map(a)]}function p_(e,t,n){let r=ti(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function g_(e,t,n,r,o,i,s){if(S_(t,n,r,o,i,s))return Gf(e).map((a)=>({target:a,cwd:i}));return Ff(t,y_(e),n,r,o,i,s,()=>[])}function h_(e,t,n,r,o,i,s){let a=St(e);if(!Qn(st(a[0]??"").toLowerCase()))return[];return $a(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Ff(e,t,n,r,o,i,s,a){let l=v_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Xn.has(l)?vn(n.getShellSyntax(c),n,r,o,i,s):oi(l,c,n,r,o,i,s))}function Gf(e){let t=St(e);if(t.length===0)return[];let n=st(t[0]??"").toLowerCase();if(!Df.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ua(r.replaceAll("%%","%"))];return t.slice(1)}function y_(e){let t=St(e);if(t.length===0)return[];let n=st(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return b_(r);return[]}function b_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ua(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>C_(t,r.slice(i*n,(i+1)*n)))}function C_(e,t){let n=0;return Ua(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ua(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function S_(e,t,n,r,o,i){let s=St(e);if(s.length===0||st(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Bt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,m=c===null?[...l,Ga]:l.map((d)=>d.split(c).join(Ga));return si(m,t,n,r,o,i).some((d)=>d.target.includes(Ga))}function v_(e){let t=St(e);if(t.length===0)return null;let n=st(t[0]??"").toLowerCase();if(!Qn(n))return null;return E_(n,t.slice(1))?n:null}function E_(e,t){let n=Ha(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Lf.has(o)||zf(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(d_.get(n)?.has(o))r++;continue}return!1}return!0}function Ha(e){return/^python\d/.test(e)?"python":e}function R_(e){let t=[];for(let n of e){if($f(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Tf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function x_(e,t){if(!t||!Tf.test(e))return e;return`~${e.replace(Tf,"").replace(/\\/g,"/")}`}function it(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function __(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>it("jq",i))}return e.flatMap((r,o)=>o===t?[]:it("jq",r))}function w_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>it("git",i))];if(t.push(...it("git",r)),!Ce.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:it("git",o)),n++}return t}function P_(e){return e.flatMap((t,n)=>{let r=T_(t);if(r!==null)return If(r.flag,r.value);let o=A_(e[n-1]);return o===null?[]:If(o,t)})}function If(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return za(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return za(t.slice(n+1))}return t.startsWith("@")?za(t.slice(1)):[]}function A_(e){if(e===void 0)return null;if(Nf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function T_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Nf.has(r)?{flag:r,value:e.slice(n+1)}:null}function za(e){return e===""||e==="-"?[]:[e]}function I_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!jx.has(e[l]??""))continue;let c=e.slice(l+1),m=c.findIndex((f)=>Vx.has(f)),d=m===-1?c:c.slice(0,m),u=si(d,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!qx.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function k_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Lf.has(c)||zf(e,c)){let d=t[l+1];if(d!==void 0)a.push(...oi(e,d,n,r,o,i,s)),l++;continue}let m=/^--(?:eval|exec)=(.*)$/.exec(c);if(m!==null&&m[1]!==void 0){a.push(...oi(e,m[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function zf(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Xx.get(t[t.length-1]??"")?.has(Ha(e))??!1}function O_(e,t,n,r,o,i){if(!e.includes("system"))return[];return ra(e)?.commands.flatMap((s)=>vn(t.getShellSyntax(s),t,n,r,o,i))??[]}function M_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function D_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ja),...e.match(Ba)??[]]}function oi(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=L_(t,N_(e));if(l===null)return D_(t).map(a);let c=l.masked.match(a_)!==null||l.literals.some((f)=>l_.test(l.masked.slice(0,f.start))),m=l.masked.match(c_)!==null||l.literals.some((f)=>u_.test(l.masked.slice(0,f.start))),d=r.refineInlineData===!0&&!Xn.has(e),u=d&&!(z_(l.masked)||c||m)?[]:l.literals;return[...u.map((f)=>f.text).filter((f)=>f!=="").map(a),...u.flatMap((f)=>ja(f.text)).map(a),...d?[]:l.literals.flatMap((f)=>f.text.match(Ba)??[]).map(a),...c?l.literals.flatMap((f)=>$a(f.text,n,r,o,i,s)??[a(f.text)]):[],...m?l.literals.flatMap((f)=>oi(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(Ba)??[]).map(a)]}function N_(e){let t=Ha(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function L_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(i_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&G_(e,o))return null;let a=t==="python"?W_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,m=F_(e,c,l);if(m===null)return null;let d=e.slice(c,m);if(/[fF]/.test(a)&&d.includes("{"))return null;if(t==="simple"&&s==='"'&&s_.test(d))return null;r.push({start:c,text:d});for(let u=o;u<m+l.length;u++)n[u]=" ";o=m+l.length-1}return{masked:n.join(""),literals:r}}function W_(e,t){return o_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function F_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function G_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function z_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(Yx.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Zx.has(i)))continue;if(o.length>1)return!0;if(B_(e,r)===".")return!0;if($_(e,r+n.length)==="(")return!0}return!1}function B_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function $_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function U_(e,t,n,r,o,i){return q_(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...vn(a,t,{...n,capturedOutput:!0},r,o,i),...H_(a,r)?j_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function H_(e,t){let n=So(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||st(Je(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Je(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function j_(e,t){return So(e).flatMap((n)=>n.kind==="word"?[Je(n.text,t)]:n.kind==="redirection"&&n.target?[Je(n.target,t)]:[]).flatMap(ja)}function ja(e){let t=K_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||V_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function V_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function K_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function q_(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Dn(o,n))continue;if(Bf(e,r,n)){let i=Y_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Z_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Y_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Dn(i,n))continue;if(Bf(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Z_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Bf(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function X_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let m=/^--([^=]+)(?:=(.*))?$/.exec(c);if(m!==null){let d=m[1]??"",u=m[2];if(d===Qx)o=!0;if(t_.has(d))r=!0;if(u!==void 0){if(d===wf)t.push(u);continue}if(r_.has(d)){let f=e[l+1];if(d===wf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let d=c.slice(1),u="",f="";for(let h=0;h<d.length;h++){let g=d[h]??"";if(e_.has(g))r=!0;if(n_.has(g)){u=g,f=d.slice(h+1);break}}if(u==="")continue;if(f.length>0){if(u===_f)t.push(f);continue}let p=e[l+1];if(u===_f&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!$f(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function $f(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var J_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Q_=".env.",ew=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),tw=[".env.example.",".env.sample."];function nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function rw(e){return e.length>0&&!/\s/.test(e)}function ow(e,t,n,r){try{let o=br(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof D)throw o;return!1}}var iw=new Set(["node_modules","__pycache__"]),sw=[["vendor","bundle"],["vendor","cache"]];function aw(e,t,n,r,o){if(nw(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>rw(s)||ow(e,t,r,o);if(ew.has(s)||tw.some((u)=>s.startsWith(u)))return null;let c=B(fw(e,t,r,o));for(let u of ts){let f=`~/${u.suffixParts.join("/")}`;if((Of(a,f)||Of(c,f))&&ot(u.id,n))return u.id}let m=lw(i,t,n,r,o);if(m)return m;if(J_.has(s))return null;for(let u of es)if(s===u.basename&&ot(u.id,n))return u.id;if(s.startsWith(Q_)&&ot(Fr.id,n)&&l())return Fr.id;for(let u of ns)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&ot(u.id,n)&&l())return u.id}for(let u of rs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&ot(u.id,n))return u.id}if(dw(a))return null;if(!s.includes(".")&&Nn.pattern.test(s)&&ot(Nn.id,n))return Nn.id;let d=mw(s,n);if(d)return d;return null}function lw(e,t,n,r,o){return Gr.find((i)=>{if(!ot(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||yr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||hr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?yr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||hr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||hr(e,s,["credentials"])||hr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((m)=>yr(e,m,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?yr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((m)=>W(e,He(m,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||hr(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((m)=>W(e,m,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?yr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&Ht(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var kf=new WeakMap;function z(e,t,n,r,o){let i=kf.get(o)??new Map;kf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Uf(e,ae(t,r)))}function hr(e,t,n){return n.some((r)=>Ht(B(e),B(ae(t,r))))}function yr(e,t,n,r,o){return Uf(e,He(t,n,r,o))}function Uf(e,t){return B(e)===B(t)}function ae(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function cw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(br(e,t,o,i));return n.some((a)=>Ht(s,B(br(a,r,o,i))))}function uw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(br(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(G(be(a),o.paths,i)):"",c=B(l),m=o.env.get("CC_SAFETY_NET_HOME"),d=B(m?Be(G(ii(be(m)),o.paths,i)):l&&Be(G(`${l}/.cc-safety-net`,o.paths,i)));if(d&&Ht(s,d))return!1;return n.some((u)=>{let f=B(br(u,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Ht(s,f)})}function dw(e){let t=e.split("/");return t.some((n)=>iw.has(n))||sw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function mw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of os)if(r===o.extension&&ot(o.id,t))return o.id;for(let o of is)if(o.pattern.test(r)&&ot(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function ot(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Va(e,n,r);if(!i)return"";if(!o)return i;let s=Ka(i,o),a=ri(s)?s:Be(ii(t,s)),l=Be(G(a,n.paths,r));if(!Ht(l,o)){if(ri(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Of(e,t){return e===t||e.startsWith(`${t}/`)}function fw(e,t,n,r){let{home:o,normalized:i}=Va(e,n,r);if(!i||!o)return"";let s=Ka(i,o),a=Bx.normalize(ri(s)?s:Be(ii(t,s))),l=Be(be(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,m=[o,l].find((u)=>u!==""&&Ht(c(a),c(u)));if(m===void 0)return"";let d=a.slice(m.length);return d?`~${d}`:"~"}function br(e,t,n,r){let{home:o,normalized:i}=Va(e,n,r);if(!i)return"";let s=o?Ka(i,o):i;return Be(G(ri(s)?s:ii(t,s),n.paths,r))}function Va(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(G(be(r),t.paths,n)):"",i=Be(be(pw(Je(e,t))));return{home:o,normalized:i}}function pw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Ux(e)}catch{return e}}function Ka(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function gw(e){if(process.platform==="win32")return!0;return $x.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&gw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Ht(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function st(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class jt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var hw={findPolicyMutation:Ef,findGitMetadataMutation:od,resolveGitMetadata:yw,loadPolicySnapshot:jc,findSensitiveTarget:Wf,analyzeCommand:ff,getModes:Ti};function Hf(e,t){let n={...hw,...t.dependencies},r=Sw(e),o=Cr(e)?e.command:r,i=vt("policy-protection",o,()=>er(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(Cr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:xd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),m=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:vf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>yf(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:hf,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let u=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Pe,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...bw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Cr(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Mf,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Cr(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...qa("command-validation",o),...g};let v=vt("command-analysis",o,()=>pf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Cw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function yw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function bw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Cw(e){return pe(e,"declared-command")?.program}function Sw(e){try{return Pn(e.input)}catch(t){let n=Cr(e)?e.command:void 0;throw new jt("policy-protection",qa("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new jt(e,qa(e,r instanceof Ve?void 0:t,r),r)}}function qa(e,t,n){let r=n instanceof D||n instanceof Le;return{stage:e,decision:{kind:"deny",reason:r?mi:Rn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Cr(e){return e.route.kind==="command"}import{appendFileSync as Mw,mkdirSync as Dw}from"fs";import{isAbsolute as Nw,join as Xa}from"path";import{lstatSync as Vf,readdirSync as vw,readFileSync as Ew,rmdirSync as Rw,statSync as Kf,unlinkSync as xw,utimesSync as _w,writeFileSync as ww}from"fs";import{join as Sr}from"path";function jf(e,t={}){return Kr(Qt(e,t),e.home).policy.audit.retention_days}var Za=86400000,Pw=".last-prune",Aw=/^\d{4}-\d{2}$/,Tw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,qf=(e)=>Math.floor(e/Za);function Zf(e,t,n=()=>new Date){try{let r=n().getTime();if(!Kf(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Sr(t,Pw),i=Kf(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&qf(i)===qf(r))return;let s=r-jf(e)*Za,a=new Date(r).toISOString().slice(0,7);for(let l of Ya(t)){if(l.isDirectory()){Iw(Sr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))kw(Sr(t,l.name),s)}ww(o,"",{mode:384}),_w(o,r/1000,r/1000)}catch{}}function Iw(e,t,n){for(let r of Ya(e)){if(!r.isDirectory()||!Aw.test(r.name))continue;let o=Sr(e,r.name);for(let i of Ya(o)){if(!i.isFile())continue;let s=Tw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Za;if(!Number.isFinite(a)||a>=t)continue;Xf(Sr(o,i.name))}if(r.name!==n)Yf(o)}Yf(e)}function kw(e,t){try{let n=Vf(e);if(n.mtimeMs>=t)return;let r=Ew(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(Ow);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Vf(e).mtimeMs!==n.mtimeMs)return;Xf(e)}catch{}}function Ow(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Ya(e){try{return vw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Xf(e){try{xw(e)}catch{}}function Yf(e){try{Rw(e)}catch{}}var Lw="2.4.3",Ww=1e4,Fw=2000,Gw=256,zw=32768;function Bw(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function $w(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ja(e,t,n,r,o,i,s={}){let a=Bw(t);if(!a)return;let l=Hw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),m=ai(at(n),s.failureStage?Number.POSITIVE_INFINITY:Ww),d=ai(at(r),Fw),u=s.toolName?ai(at(s.toolName),Gw):void 0,f=i===null?void 0:ai(at(i),zw),p=Xa(l,$w(f?.value??null),c.slice(0,7));Dw(p,{recursive:!0,mode:448});let h=Xa(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??ki)(),v:Lw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:m.value,segment:d.value,...m.truncated||d.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Mw(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),Zf(e,l,s.now)}catch{}}function ai(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function Uw(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&Nw(n)?n:null}function Hw(e){let t=Uw(e);return t?Xa(t,".cc-safety-net","logs"):null}function Qf(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Jf(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Jf(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Jf(e){return"command"in e?e.command??"":""}function ep(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ja(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function tp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ja(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function rp(e,t,n){try{let r=Hf(t,{environment:e,...n.guard});return np(e,t,r,n),r}catch(r){if(!(r instanceof jt))throw r;throw np(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:jw(r.cause)}),r}}function np(e,t,n,r,o=!0,i){ep(e,Qf(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function jw(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof Le)return"structural-shell-syntax-limit";return"unexpected-error"}function Vt(e,t={}){return{malformed:!0,denial:xn(t),cwd:e}}function op(e,t={}){return(n,r)=>{try{return Vw(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(xn())}}}function Vw(e,t,n,r){let o=Ll();if(n.cancelled?.(t))return n.block(xn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return tp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let m=rl(l,{includeEvidence:c});return m?n.block(m):n.allow};try{let l=rp(o,i,{guard:{auditAllowed:Wl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof jt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${il(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Kw={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>Yw(e,t,n),getSessionId:(e)=>Jw(e),allow:{action:"allow"},block:(e)=>Qw(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},ip=qw();function qw(e={}){return op(Kw,e)}function Yw(e,t,n){if(!e||typeof e!=="object")return Vt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Vt(null);if(!r.input||typeof r.input!=="object")return Vt(null,{toolName:r.tool});let o=Zw(t,n);if(!o)return Vt(null,{toolName:r.tool});let i=Xw(t,e);if(!i.ok)return Vt(o,{toolName:r.tool});if(!i.command)return qt(r.tool,r.input,{kind:hi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Vt(o,{toolName:r.tool});let s=typeof i.command.dir==="string"?Tl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return qt(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function Zw(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Al(".",[r],t)}catch{return}}function Xw(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function Jw(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function Qw(e){return{action:"reject-and-continue",message:ol(e)}}function eP(e){e.on("tool.call",(t)=>ip(t,e))}export{eP as default};