cc-safety-net 2.4.1 → 2.4.3

package/dist/openclaw/cc-safety-net/index.js

@@ -1,51 +1,48 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.1
-var cl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var vi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Tn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var bi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Cp={errorCode:"structural-shell-syntax-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},xt={errorCode:"tool-input-limit",reason:"CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user."},An={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},Tr={errorCode:"structural-shell-syntax-limit",reason:"Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry."},A=Object.freeze({realpathAttempts:{cap:16384,...bi},processedCandidateBytes:{cap:4194304,...bi},pathEnvironmentExpansion:{cap:64,...bi},structuralShellSyntax:Cp,recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...An},trackedHeredocFiles:{cap:64,...An},controlFlowStates:{cap:64,...An},wrapperPeelIterations:{cap:20,...An},derivedCommandShape:An,parallelChildAnalyses:{cap:1024,...Tr},parallelDerivedTokens:{cap:16384,...Tr},parallelDerivedBytes:{cap:1048576,...Tr},parallelPlaceholderReplacements:{cap:16384,...Tr},hookInputBytes:{cap:8388608,errorCode:"tool-input-limit",reason:"Failed to parse hook input JSON."},toolInputDepth:{cap:64,...xt},toolInputNodes:{cap:1e4,...xt},toolInputKeys:{cap:1e4,...xt},toolInputStringBytes:{cap:1048576,...xt},toolInputAggregateStringBytes:{cap:4194304,...xt},toolInputGitDiffCandidates:{cap:64,...xt},toolInputShape:xt});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(A[e].reason);this.kind=e}}function Se(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>A[t].cap)throw new F(t)}}}var Sp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function lt(e){return bp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function bp(e){return Sp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var vp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Ep(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,vp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.4.3
+var tl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var fi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",$e="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",En="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var di={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},vn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...di},processedCandidateBytes:{cap:4194304,...di},pathEnvironmentExpansion:{cap:64,...di},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...vn},trackedHeredocFiles:{cap:64,...vn},controlFlowStates:{cap:64,...vn},wrapperPeelIterations:{cap:20,...vn},derivedCommandShape:vn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function ye(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var op=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function st(e){return ip(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function ip(e){return op.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var sp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function ap(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,sp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function ul(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function In(e={}){return{reason:Tn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function dl(e){return Ep({...e,redact:lt})}function fl(e){return lt(e instanceof Error?e.message:String(e))}import{lstatSync as ag,realpathSync as lg,statSync as cg}from"node:fs";import{homedir as ug,tmpdir as dg}from"node:os";import{statSync as og}from"node:fs";import{join as ig}from"node:path";import{basename as gl,dirname as Rp,isAbsolute as xp,join as _p,normalize as wp,resolve as ml}from"node:path";var Pp=256,Ir=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function ct(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function _i(e,t){return Ei(e,0,t)}function Ei(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ri(e,o+2),a=Ap(e,o,t);if(a===null){if(Ir.has(s))throw new F("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Tp(l,t,n),o=a+1;continue}let i=Ri(e,o+1);if(!i){r+="$",o++;continue}r+=xi(i,n)??`$${i}`,o+=i.length+1}return r}function Ap(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>A.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Tp(e,t,n){let r=e.slice(2,-1),o=Ri(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return xi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ir.has(o))throw new F("pathEnvironmentExpansion");return e}if(!Ir.has(o))return e;if(s.endsWith("="))throw new F("pathEnvironmentExpansion");let a=xi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new F("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ei(i.slice(s.length),t+1,n);return l?Ei(i.slice(s.length),t+1,n):""}function Ri(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function xi(e,t){if(!Ir.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function B(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){hl(n,i);let s=t.realpath(i);if(s!==null)return pl(n,e,s,o);let a=Rp(i);if(a===i||o.length>=Pp)return pl(n,e,i,o);o.push(gl(i)),i=a}}function pl(e,t,n,r){let o=r.length===0?n:_p(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Ip(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;hl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function hl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=Cl(e,t,n);if(!o)return"";return B(o,n.paths,r).replace(/\\/g,"/")}function yl(e,t,n,r,o){let i=Cl(e,t,n);if(!i)return null;if(o(gl(i)))return B(i,n.paths,r).replace(/\\/g,"/");let s=Ip(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Cl(e,t,n){let r=n.home,o=_i(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?ml(r,o.slice(2)):o,s=be(i);return wp(xp(s)?s:ml(t,s))}import{spawnSync as kp}from"node:child_process";import{existsSync as rn,lstatSync as Op,readFileSync as wt,realpathSync as nn,statSync as kn}from"node:fs";import{dirname as kr,isAbsolute as On,join as _t,resolve as on}from"node:path";var Mp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Np=5000;function bl(e,t=Xp(),n=Np){let r=Dp(e);if(r===null||!Lp(r))return null;let o=Yp(r,t,n);return o===null?null:{recursiveSubmodules:o}}function Dp(e){try{let t=nn(on(e));return kn(t).isDirectory()?t:null}catch{return null}}function Lp(e){let t=qp(e);if(!t)return!1;try{let n=Op(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=wi(t);if(!r?.commonDir)return!1;if(!Gp(r.gitDir,t))return!1;return zp(r.gitDir,kr(t))}catch{return!1}}function wi(e){try{let t=Wp(e);if(!t)return null;let n=nn(On(t)?t:on(kr(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:Fp(n)}}catch{return null}}function Wp(e){let t=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Fp(e){try{let t=wt(_t(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=nn(On(t)?t:on(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Gp(e,t){let n=Bp(e);return n===null?!1:vl(e,n,t)}function zp(e,t){let n=$p(e);return n===null?!0:vl(e,n,t)}function Bp(e){let t=_t(e,"gitdir");if(!rn(t))return null;let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function $p(e){let t=_t(e,"config.worktree");return rn(t)?Hp(t):null}function vl(e,t,n){try{return Up(On(t)?t:on(e,t),n)}catch{return!1}}function Up(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Sl(nn.native(e))===Sl(nn.native(t))}function Sl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Hp(e){let t=wt(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=jp(s[1]??"")}return r}function jp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Kp(t.slice(1,-1))}var Vp={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Kp(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Vp[n]??t)}function qp(e){try{return Or(nn(e))}catch{return null}}function Or(e){let t=e;while(!0){let n=_t(t,".git");if(rn(n))return n;let r=kr(t);if(r===t)return null;t=r}}function Yp(e,t,n){let r=Zp(e);if(r===null||r)return!0;if(t===null)return!0;let o=kp(t,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Jp(process.env),stdio:["ignore","pipe","ignore"],timeout:n});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&El(o.stdout.trim())}function Zp(e){let t=Qp(e);if(t===null)return null;return t.filter((n)=>rn(n)).some((n)=>ng(n))}function Xp(){return Mp.find((e)=>rn(e))??null}function Mn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Jp(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Mn(t)))}function Qp(e){let t=Or(e);if(t===null)return null;let n=eg(t);if(n===null)return null;let r=tg(n);if(r===null)return null;return[_t(r,"config"),_t(n,"config.worktree")]}function eg(e){try{let n=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!n.startsWith("gitdir:"))return e;let r=n.slice(7).trim();if(r==="")return null;return On(r)?r:on(kr(e),r)}catch{return null}}function tg(e){let t=_t(e,"commondir");if(!rn(t))return e;try{let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(n==="")return null;return On(n)?n:on(e,n)}catch{return null}}function ng(e){let t;try{t=wt(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(rg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=El(c)}return r}function rg(e){return e==="include"||e.startsWith("includeif ")}function El(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Rl(e,t){if(e==="")return null;let n=Se(),r=Or(ie(e,e,t,n)),o=r?sg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function sg(e,t,n,r){try{let o=ie(e,t,n,r),i=og(e),s=i.isFile()?o:null,a=i.isFile()?wi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[sn(ie(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[sn(e.replace(/\\/g,"/")),...l]:l)];return{entry:sn(o),markerFile:s?sn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let f=sn(ig(d,"hooks").replace(/\\/g,"/"));return[f,sn(ie(f,t,n,r))]}))]}}catch{return null}}function sn(e){return process.platform==="win32"?e.toLowerCase():e}var fg={realpath:(e)=>{try{return lg(e)}catch{return null}},entryKind:(e)=>{let t=ag(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return cg(e).isDirectory()}catch{return!1}}};function _l(){return mg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||ug()),tmpdir:dg(),paths:fg})}function mg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>xl(n,i,()=>Rl(i,o)),worktreeFacts:(i)=>xl(r,i,()=>bl(i)),...t};return o}function xl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var an=["fail_closed","paranoid_rm","paranoid_interpreters"],Mr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Nr=["standard","strict","paranoid"];function pg(e,t){if(!t)return e;return Nr.indexOf(t)>Nr.indexOf(e)?t:e}function gg(e){let t=Ii(ee.level,e);if(t===void 0||t==="")return;if(Nr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Nr.join(", ")}.`);return}function hg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function wl(e){return hg(Ii(ee.auditScope,e))==="all"}function Ai(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Ti(e={},t){let n=e.safety?.level??"standard",r=gg(t),o=pg(n,r),i=Mr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Pt(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(Pt(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(Pt(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(Pt(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Pt(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ai(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Pt(e,t){let n=typeof e==="string"?Pi(e,t):Ii(e,t);return n==="1"||n?.toLowerCase()==="true"}function Pi(e,t){return t.get(e)}function Ii(e,t){let n=Pi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Pi(e.legacyName,t);return}import{isAbsolute as $l,relative as Lg,resolve as Wg,sep as Fg}from"node:path";import{types as yg}from"node:util";var Cg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Sg=new Set(["command","diff","input","patch","patchtext"]),Pl=new TextEncoder,bg=new TextDecoder,vg=/\s/,Eg=64;class Ze extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Nn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Rg(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Lr(e){return Cg.has(Rg(e))}function Ln(e){if(!e||typeof e!=="object")return;Fl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ve();return}if(t.get||t.set)Ve();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ol(e,t){return Ml(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Ml(e,t,n,r){let o=Wl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Ml(a,t,n,r+1);return typeof a==="string"&&t.has(Nl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Nl(e){return e.replace(/-/g,"_").toLowerCase()}function Dl(e){return Ll(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(_g)}function Ll(e,t,n,r){let o=Wl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ll(a,o.array?t:Sg.has(Nl(s)),n,r+1));return n.ancestors.delete(o.object),i}function xg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Nn.maxDepth||t.nodes>Nn.maxNodes)Ve();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Nn.maxStringBytes||t.stringBytes>Nn.maxAggregateStringBytes)Ve()}function Wl(e,t,n){if(xg(e,t,n),!e||typeof e!=="object")return null;let r=Fl(e);if(t.ancestors.has(e))Ve();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Nn.maxKeys)Ve();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ve();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Fl(e){if(yg.isProxy(e))Ve();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ve();return t}function Ve(){throw new Ze}function _g(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=wg(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...ki(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...ki(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...Mi(Dr(c.slice(4),!0),Dr(d.slice(4),!0))),l++;continue}if(!r)t.push(...ki(c))}return t}function wg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function ki(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return kl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return kl(n[1]);if(e.startsWith("diff --git "))return Pg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Il(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Il(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Ng(i[1]);return[]}function Pg(e){let t=Ag(e);if(t.length===2&&t[0]&&t[1])return Mi(t[0],t[1]);let n=Tg(e);return n?Mi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Ag(e){let t=[],n=0;while(n<e.length&&t.length<2){while(At(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!At(e[n]))n++;t.push(e.slice(i,n));continue}let o=Gl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(At(e[n]))n++;return n===e.length?t:[]}function Tg(e){let t=0;while(t<e.length&&At(e[t]))t++;let n=e.length;while(n>t&&At(e[n-1]))n--;let r=0,o=t;while(o<n){if(!At(e[o])){o++;continue}let i=o;while(o<n&&At(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Eg)Ve();if(Ig(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Ig(e,t,n,r,o){if(Oi(e,t,n,r,o))return!0;let i=Al(e,"/",t,n),s=Al(e,"/",r,o);if(i<=t||s<=r)return!1;if(Oi(e,t,i,r,s))return!1;return Oi(e,i+1,n,s+1,o)}function Oi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Al(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function At(e){return e!==void 0&&vg.test(e)}function Gl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:bg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Pl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Pl.encode(kg(s[0]??""))),o+=2}return null}function kg(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Og(e){return Dn(Dg(e))}function Mi(e,t){if(e==="/dev/null")return Tl(t);if(t==="/dev/null")return Tl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Dn);let n=Mg(e,t)??(e===t?zl(e):null);return[e,t,...n?[n]:[]].flatMap(Dn)}function Tl(e){let t=zl(e);return[e,...t?[t]:[]].flatMap(Dn)}function zl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Mg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Il(e){return Og(Dr(e,!0))}function Ng(e){return Dn(Dr(e,!1))}function Dr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Gl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Dg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Dn(e){return e===""||e==="/dev/null"?[]:[e]}function kl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Ni(e,t,n){if(ct(e))return;let r=t.flatMap((i)=>Bl(i,n));if(!r[0])return;let o=Bl($l(e)?e:Wg(r[0],e),n)[0];if(!o)return;return r.some((i)=>Gg(o,i))?o:void 0}function Bl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Gg(e,t){let n=Lg(t,e);return n===""||n!==".."&&!n.startsWith(`..${Fg}`)&&!$l(n)}function Wn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{dirname as Vr}from"node:path";import{closeSync as zg,constants as Ul,fstatSync as Bg,fsyncSync as uA,lstatSync as Li,mkdirSync as dA,openSync as $g,readdirSync as fA,readFileSync as Ug,realpathSync as Wr,renameSync as mA,rmdirSync as pA,statSync as Hg,unlinkSync as gA,writeFileSync as hA}from"node:fs";import{isAbsolute as Hl,join as jl,normalize as jg,parse as Vg,relative as Wi,resolve as Fi,sep as Gi}from"node:path";function Di(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Kg=Symbol("PolicyFilesystemScope"),qg=Symbol("PolicyFilesystemTarget"),Yg=Ul.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Tt(e,t){return{[Kg]:!0,root:Fi(e),label:t}}function Vl(e,t){let n=jg(t);if(t===""||Hl(t)||n===".."||n.startsWith(`..${Gi}`))throw new se(e.label);return{[qg]:!0,scope:e,relativePath:n,path:jl(e.root,n)}}function Fn(e,t){return Vl(e,Wi(e.root,Fi(t)))}function Kl(e,t="rules policy"){let n=Fi(e),r=Vg(n).dir;return Vl(Tt(r,t),Wi(r,n))}function Gr(e){return Yl(e.scope.label,()=>{if(!Fr(e))return null;let t=$g(e.path,Ul.O_RDONLY|Yg);return Zg(t,()=>{let n=Bg(t);if(!n.isFile())throw new se(e.scope.label);let r=Ug(t,"utf-8"),o=Li(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Fr(e),r})})}function ql(e,t){if(e.path===t.path)return!0;return Yl(e.scope.label,()=>{if(!Fr(e)||!Fr(t))return!1;return Wr(e.path)===Wr(t.path)})}function Yl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function Zg(e,t){try{return t()}finally{zg(e)}}function Fr(e,t="file"){let n=Xg(e.scope);if(!n)return!1;let r=e.relativePath.split(Gi);for(let o of r.keys()){let i=jl(e.scope.root,...r.slice(0,o+1)),s=Li(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);Jg(n,Wr(i),e.scope.label)}return!0}function Xg(e){if(!Li(e.root,{throwIfNoEntry:!1}))return null;if(!Hg(e.root).isDirectory())throw new se(e.label);return Wr(e.root)}function Jg(e,t,n){let r=Wi(e,t);if(r===".."||r.startsWith(`..${Gi}`)||Hl(r))throw new se(n)}import{dirname as kt,isAbsolute as rh,join as Mt,relative as oh,resolve as Ot,sep as ih}from"node:path";var It=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Zl="rulebook.json",Xl=".cc-safety-net/rules";var Jl=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Qg=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,eh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),th="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),bA=new RegExp(`^${eh}/(${It.source.slice(1,-1)})/${th}$`);function nh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Ql(e){if(zr(e))try{return zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return It.test(e)?null:`Local rulebook sources must be bare names matching ${It}: ${e}`}function zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Jl);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Qg.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!It.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:nh(o),name:o}}function zr(e){return Jl.test(e)}var ec="rule.json",Br="policy.json",tc=".cc-safety-net",sh="rules",ah="CC_SAFETY_NET_HOME",nc="`cc-safety-net rule update`";function lh(e){return Ot(e,Xl)}function ch(e){return Mt(lh(e),ec)}function Gn(e){return Mt(Ot(e),tc,Br)}function Bi(e,t={}){return t.userConfigDir??(t.userConfigPath?kt(t.userConfigPath):Mt(uh(e),sh))}function uh(e){let t=e.env.get(ah);return t?Ot(be(t)):Mt(e.home,tc)}function dh(e,t={}){return Mt(Bi(e,t),ec)}function ln(e,t={}){return Mt(kt(Bi(e,t)),Br)}function rc(e,t){let n=t.userConfigPath??dh(e,t),r=t.projectConfigPath??ch(t.cwd),o=fh(e,t),i=mh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Fn(o,n),projectConfigTarget:Fn(i,r)}}function fh(e,t){let n=t.userConfigPath?kt(kt(Ot(t.userConfigPath))):kt(Ot(t.userConfigDir??Bi(e,t)));return Tt(n,"user policy")}function mh(e,t){let n=Ot(t),r=Ot(e),o=oh(n,r);if(o!==".."&&!o.startsWith(`..${ih}`)&&!rh(o))return Tt(n,"project policy");return Tt(kt(kt(r)),"project policy")}function oc(e,t){return Mt(e,t,Zl)}var le=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ut=/^[a-zA-Z][a-zA-Z0-9_-]*$/,dt=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),ic=new Set(["python","python3","python2","node","ruby","perl"]),$r=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Ur=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var sc="Rulebook exceeds CC Safety Net's safe validation limits.",ac="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function lc(e){if($i(e.allowed_commands,Oe.maxAllowedCommands)||$i(e.rules,Oe.maxRules)||$i(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function $i(e,t){return Array.isArray(e)&&e.length>t}var Ui=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Hi=64,ji="Rule config exceeds CC Safety Net's safe source limit.";function L(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var ph=new Map([["bash",new Set(["O","o"])],["dash",new Set(["o"])],["ksh",new Set(["o"])],["sh",new Set(["o"])],["zsh",new Set(["o"])]]),gh=new Map([["zsh",new Set(["o"])]]),hh=new Map([["bash",new Set(["--init-file","--rcfile"])]]);function cc(e,t){for(let n=0;n<t.length;n++){let r=t[n];if(r===void 0||r==="--"||r==="-"||r[0]!=="-"&&r[0]!=="+")return null;if(r.startsWith("--")){let s=hh.get(e);if(Ch(r,s))continue;if(!s?.has(r))continue;if(t[n+1]===void 0)return null;n++;continue}let o=yh(e,r);if(o.commandSelected)return t[n+o.followingValues+1]??null;let i=t[n+1];if(e==="ksh"&&(r==="-o"||r==="+o")&&i!==void 0&&i[0]!=="-"&&i[0]!=="+")n++;n+=o.followingValues}return null}function yh(e,t){let n=ph.get(e),r=gh.get(e),o=!1,i=0;for(let s=1;s<t.length;s++){let a=t[s];if(a===void 0)break;if(t[0]==="-"&&a==="c")o=!0;if(e==="ksh"&&a==="o"){if(s+1<t.length){let l=t.slice(s+1);if(!o&&t[0]==="-"&&l==="c")continue;if(!o&&t[0]==="-"&&l[0]==="-"&&l.endsWith("c"))o=!0;break}if(o)i++;continue}if(!n?.has(a))continue;if(r?.has(a)&&s+1<t.length)break;i++}return{commandSelected:o,followingValues:i}}function Ch(e,t){return t!==void 0&&[...t].some((n)=>e.startsWith(`${n}=`))}function zn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Hr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Sh(e))zn(n,t);return t.inSingle||t.inDouble}function Sh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);zn(s,n)}return t}var Vi=new Set(["rm","find","xargs","parallel"]),bh=new Set(["git","busybox",...Vi,...J,...ic,...we]),vh=new Set(["python","node","ruby","perl"]);function uc(e){let t=L(e);return bh.has(t)||Me(t)}function Me(e){return vh.has(Eh(e))}function Eh(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function Ki(e){try{let t=Gr(Rh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=wh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Rh(e){return typeof e==="string"?Kl(e):e}var O=(e,t)=>({path:e,message:t,kind:"typed"}),ce=(e,t)=>({path:e,message:t,kind:"custom"});function dc(e){let t=new Set;return e.flatMap((n,r)=>{let o=cn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ce(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var qi=`must be one of ${Ui.join(", ")}`,xh=/^[^/]+\/[^/]+$/,_h=["version","rules","overrides","transparent_wrappers"];function wh(e){let t=Ph(e);return{errors:Yi(Lh(t,_h,(n)=>n.kind==="custom"),": "," "),sources:Dh(e,t)}}function Ph(e){if(!cn(e))return[O([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Hi;return[...e.version===1?[]:[O(["version"],"must be 1")],...Ah(e.rules,t),...kh(e.overrides),...Mh(e.transparent_wrappers),...t?[]:Ih(e.rules),...cn(e.overrides)?Object.keys(e.overrides).filter((n)=>!xh.test(n)).map((n)=>ce(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Nh(e.transparent_wrappers)]}function Ah(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[O(["rules"],"must be an array of rulebook source strings"),...fc(e,Hi)?[O(["rules"],ji)]:[]];if(t)return[{path:["rules"],message:ji,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[O(["rules",r],"must be a rulebook source string"),...Th(n,1)?[O(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[O(["rules",r],"must be a non-empty rulebook source string")]:[]})}function fc(e,t){let n=mc(e);return n!==void 0&&!(n<=t)}function Th(e,t){let n=mc(e);return n!==void 0&&!(n>=t)}function mc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Ih(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ce(["rules",r],"must be a non-empty rulebook source string")];let o=Ql(n);if(o)return[ce(["rules",r],o)];if(t.has(n))return[ce(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function kh(e){if(e===void 0)return[];if(!cn(e))return[O(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!cn(n))return[O(["overrides",t],'must be "off" or an object')];return[...Oh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Zi(n.intent)?[]:[O(["overrides",t,"intent"],qi)]]})}function Oh(e,t){if(typeof e!=="string")return[O(t,"required non-empty string"),...fc(e,dt)?[O(t,`must be at most ${dt} characters`)]:[]];if(e==="")return[O(t,"required non-empty string")];return e.length>dt?[O(t,`must be at most ${dt} characters`)]:[]}function Mh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[O(["transparent_wrappers",n],"must be a command string")];return ut.test(t)?[]:[O(["transparent_wrappers",n],"must match command pattern")]})}function Nh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["transparent_wrappers",r],`duplicate command "${n}"`)];if(uc(n))return[ce(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Dh(e,t){let n=cn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Lh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function Yi(e,t,n){return[...new Set(e.map((r)=>{let o=Wh(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Wh(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Zi(e){return Ui.includes(e)}function cn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function gc(e){let t=zh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Fh=`required non-empty string up to ${dt} characters`,pc="must be a non-empty array of unique non-empty strings",Gh="required non-empty array of non-empty strings";function zh(e){if(!ft(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!lc(e))return{errors:[sc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...Yi(Bh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),ac]:t,ruleNames:new Set(hc(e).map((n)=>n.toLowerCase()))}}function hc(e){let t=ft(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ft(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Bh(e,t){return[...typeof e.name==="string"&&It.test(e.name)?[]:[O(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[O(["version"],"required non-empty string")],...$h(e.allowed_commands),...Uh(e.rules,t),...Kh(e.tests),...qh(e),...Yh(e)]}function $h(e){if(!Array.isArray(e))return[O(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ut.test(n)?[]:[O(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ce(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Uh(e,t){if(!Array.isArray(e))return[O(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ft(n))return[O(["rules",r],"must be an object")];return t?jh(n,["rules",r]):Hh(n,["rules",r])}),...dc(e)]}function Hh(e,t){return[...yc(e.name,t),...Cc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ut.test(e.subcommand)?[]:[O([...t,"subcommand"],"must match command pattern")],...jr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Sc(e.reason,t),...bc(e.intent,t)]}function jh(e,t){return[...yc(e.name,t),...Cc(e.command,t),...Sc(e.reason,t),...bc(e.intent,t),...Vh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[O([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[O([...t,"block_args"],"not supported in rulebook_version 2")]]}function yc(e,t){if(typeof e!=="string")return[O([...t,"name"],"required string")];return It.test(e)?[]:[O([...t,"name"],"must match rule name pattern")]}function Cc(e,t){return typeof e==="string"&&ut.test(e)?[]:[O([...t,"command"],"required string matching command pattern")]}function Sc(e,t){return typeof e==="string"&&e!==""&&e.length<=dt?[]:[O([...t,"reason"],Fh)]}function bc(e,t){return e===void 0||Zi(e)?[]:[O([...t,"intent"],qi)]}function Vh(e,t){if(!ft(e))return[O(t,"required object")];return[...jr(e.command_path,[...t,"command_path"],Gh,!1),...e.any_args===void 0?[]:jr(e.any_args,[...t,"any_args"],pc,!0),...e.exclude_args===void 0?[]:jr(e.exclude_args,[...t,"exclude_args"],pc,!0)]}function jr(e,t,n,r){if(!Array.isArray(e))return[O(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[O([...t,s],"must be a non-empty string")];return i===""?[ce([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ce(t,n)]:[],...r&&new Set(e).size!==e.length?[ce(t,"must not contain duplicate values")]:[]]}function Kh(e){if(e===void 0)return[];if(!Array.isArray(e))return[O(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ft(t))return[O(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[O(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[O(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[O(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ce(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function qh(e){if(!Array.isArray(e.tests))return[];let t=new Set(hc(e));return[...new Set(e.tests.flatMap((n)=>ft(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ce(["tests"],`blocked fixture references unknown rule "${n}"`))}function Yh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ft(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ce(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ft(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function wc(e,t){let n=rc(e,t),r=!1;try{r=ql(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof se)return oy(n,m.message);throw m}let o=Ki(n.userConfigTarget),i=r?{config:null,errors:[]}:Ki(n.projectConfigTarget),s=xc(n.userConfigPath,o.errors),a=xc(n.projectConfigPath,i.errors),l=new Set,c=o.config?vc(o.config,Vr(n.userConfigPath),"user",n.userScope,l):_c(),d=i.config?vc(i.config,Vr(n.projectConfigPath),"project",n.projectScope,l):_c(),f=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Ec(c.rules,f),...Ec(d.rules,u)],transparent_wrappers:ny(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?Rc(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?ry(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?Rc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function vc(e,t,n,r=Tt(Vr(Vr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=Xh(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let f=d.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:Zh(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((u)=>`${f.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),entries:a.map((c)=>({spec:c.rulebook.spec,name:c.rulebook.name,version:c.rulebook.version,ruleCount:c.rulebook.rules.length})),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Zh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Xh(e,t,n){let r=Jh(e),o=oc(t,r),i=ey(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Qh(e)}`]};let s=ty(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Jh(e){return zr(e)?zi(e).name:e}function Qh(e){return zr(e)?`run ${nc} to vendor ${e}`:"create that file or remove that source from the rules config"}function ey(e,t){try{return{content:Gr(Fn(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function ty(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:gc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function ny(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Ec(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Rc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function ry(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function xc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function oy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function _c(){return{rules:[],rulebooks:[],entries:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Cy,readFileSync as Sy}from"node:fs";var Pc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Xi=new Set(Pc.map((e)=>e.id)),Kr=Pc,iy=new Map(Kr.map((e)=>[e.id,e.intent]));function C(e,t){return{id:e,reason:t,intent:iy.get(e)??"manual_only"}}var Ji=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],qr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},sy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],ay=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Qi=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...ay.flatMap((e)=>sy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Yr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Ac=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],ly=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],es=Ac.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ts=Ac.flatMap((e)=>ly.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Bn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ns=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),rs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],cy=[...Ji,qr,...Qi,...es,...ts,Bn,...ns,...rs,...Yr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Zr=new Set(Yr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),uy=cy.map((e)=>e.id),os=new Set(uy);import{isAbsolute as is,join as dy,normalize as fy,sep as Xr}from"node:path";var Tc=process.platform==="win32",my=/[*?]/;function $n(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=$n(e.trim(),t);if(!is(n))return"must be an absolute path or start with ~/";return Un(n,t)}function as(e,t){let n=Ic(e,t);if(n===null)return"must be a non-empty path string";if(!is(n))return null;if(Un(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var py="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",gy="cannot cover the guard's own configuration";function Ic(e,t){if(typeof e!=="string"||e.trim()==="")return null;return $n(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ls(e,t){let n=Ic(e,t);if(n===null)return"must be a non-empty path string";if(my.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!is(n))return null;if(Un(n,t)!==null)return py;return hy(n,t)?gy:null}function hy(e,t){let n=Jr(e),r=Jr(dy(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Xr}`)}function Un(e,t){let n=Jr(e),r=Jr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Xr)?n:`${n}${Xr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Jr(e){let t=fy(e);if(Tc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Tc?3:1)&&t.endsWith(Xr))t=t.slice(0,-1);return t}var kc=30,cs=1,us=365;function Oc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Mc=new Set(Kr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(Mc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function Q(e,t,n){if(Mc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Nc(e,t){return Object.freeze(Object.fromEntries(Kr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Dc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Nc(e,t)})}var Lc={standard:0,strict:1,paranoid:2};function Gc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:ds(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:ds(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:ds(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:yy(e,t)}}function ds(e,t){return[...new Set([...e,...t??[]])]}function yy(e,t){let n=t.safety?.level,r=Mr[e.safety.level];return[...n&&Lc[n]<Lc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...an.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Wc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Wc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Zr.has(o))),...e.destructive_command_protection.enabled?Fc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Fc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Wc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Fc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var ps=new Set(["standard","strict","paranoid"]),Uc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:kc}};function Hc(e,t){let n=Ty(ln(e,t),e.home),r=to(Gn(t.cwd),e.home),o=vy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Gc(n.gui??Uc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ms(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var by="project policy audit settings are ignored; audit is user scope only";function vy(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...ps.has(n.level)?{level:n.level}:{},...ve(n.overrides)?zc({overrides:jc(n.overrides,an,"safety.overrides",Nt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:eo(o.overrides,Xi,"destructive_command_protection.overrides",Nt)}:{},...o.allow_paths!==void 0?{allow_paths:dn(o.allow_paths,ss,t,"destructive_command_protection.allow_paths",Nt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:eo(i.overrides,os,"secret_protection.overrides",Nt)}:{},...i.deny_paths!==void 0?{deny_paths:dn(i.deny_paths,as,t,"secret_protection.deny_paths",Nt)}:{},...i.allow_paths!==void 0?{allow_paths:dn(i.allow_paths,ls,t,"secret_protection.allow_paths",Nt)}:{}};return{policy:zc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[by]}}function jc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(`${n}.${o}`,Vc);return[]}))}function zc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Nt=()=>{return},Vc="not a boolean",Kc="not an object",Ey=`not an integer between ${cs} and ${us}`,Ry=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function xy(e,t){let n=[];return{policy:qc(e,t,(o,i)=>{n.push({path:o,reason:i})}),drops:n}}function _y(e,t){return qc(e,t,Nt)}function qc(e,t,n){if(!ve(e))return n("","not a JSON object"),Qr();if(e.version!==1)n("version","not 1");let r=un(e.safety,"safety",["level","overrides"],n),o=un(r.overrides,"safety.overrides",an,n),i=un(e.workflow,"workflow",["worktree_mode"],n),s=un(e.destructive_command_protection,"destructive_command_protection",["enabled","overrides","allow_paths"],n),a=un(e.secret_protection,"secret_protection",["enabled","overrides","deny_paths","allow_paths"],n),l=un(e.audit,"audit",["retention_days"],n);return Yc(e,Ry,"",n),{version:1,safety:{level:wy(r.level,n),overrides:jc(o,an,"safety.overrides",n)},workflow:{worktree_mode:fs(i.worktree_mode,"workflow.worktree_mode",!1,n)},destructive_command_protection:{enabled:fs(s.enabled,"destructive_command_protection.enabled",!0,n),overrides:eo(s.overrides,Xi,"destructive_command_protection.overrides",n),allow_paths:dn(s.allow_paths,ss,t,"destructive_command_protection.allow_paths",n)},secret_protection:{enabled:fs(a.enabled,"secret_protection.enabled",!0,n),overrides:eo(a.overrides,os,"secret_protection.overrides",n),deny_paths:dn(a.deny_paths,as,t,"secret_protection.deny_paths",n),allow_paths:dn(a.allow_paths,ls,t,"secret_protection.allow_paths",n)},audit:{retention_days:Py(l.retention_days,n)}}}function un(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(t,Kc),{};return Yc(e,n,t,r),e}function Yc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r(n===""?o:`${n}.${o}`,"unknown field")}function wy(e,t){if(e===void 0)return"standard";if(ps.has(e))return e;return t("safety.level","not one of standard, strict, paranoid"),"standard"}function fs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(t,Vc);return n}function Py(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=cs&&e<=us))t("audit.retention_days",Ey);return Oc(e)}function eo(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(n,Kc),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r(`${n}.${o}`,"unknown rule id"),[];if(i==="on"||i==="off")return[[o,i]];return r(`${n}.${o}`,'not "on" or "off"'),[]}))}function dn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(r,"not an array"),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(`${r}[${s}]`,a),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Qr(){return structuredClone(Uc)}function to(e,t){if(!Cy(e))return{exists:!1,policy:Qr(),errors:[]};try{let n=Sy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Qr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=xy(r,t);if(o.drops.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.drops.map((i)=>`${e}: ${Ay(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Qr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}function Ay(e){return e.path===""?e.reason:`${e.path}: ${e.reason}`}function Ty(e,t){let n=to(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:$c(),errors:[]};let o=_y(r,t);return{policy:ms(o),gui:o,errors:[],levelPresent:Bc(r)}}if(n.parsed===void 0)return{policy:$c(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ms(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Bc(n.parsed)}}function Bc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return ps.has(t.level)}function Zc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function $c(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Zc({}),denyPaths:[],allowPaths:[]}}}function ms(e){return{safety:Iy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Zc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Iy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function Xc(e,t){let n=wc(e,t),r=Hc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Ny(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Dy(o,ky(n,r),s,r.policyScopes)}function ky(e,t){let n=My(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Ly(e.errors.length>0?Oy(e.errors):void 0,e.warnings.length>0?hs(e.warnings.join("; ")):void 0,n)}}function Oy(e){return`${hs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function My(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Ny(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Dy(e,t,n=Object.freeze({}),r){let o=gs(structuredClone(e)),i=r?{policyScopes:gs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function gs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))gs(t);return Object.freeze(e)}function Ly(...e){return hs(e.filter((t)=>!!t).join("; "))}function hs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Jc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ys(t.fail_closed,e.strict,"strict"),paranoid_rm:ys(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ys(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Dc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ai({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ys(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Hn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Wy=/^[A-Za-z_][A-Za-z0-9_]*=/;function no(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function jn(e){let t=no(e.words[0],"time")?1:0,n=t===1&&no(e.words[t],"-p")?t+1:t,r=t===1&&no(e.words[n],"--")?n+1:n,o=no(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Wy.test(s.text));return i?.provenance==="literal"?i.text:void 0}function ro(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Fy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>pe(t)))})}function oo(e,t,n){e.push(n),t.reset()}function io(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Cs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function fn(e,t,n,r,o,i,s){return Cs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function pe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t,span:Object.freeze(t.span)}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Fy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:pe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ss(e,t,n){if(t>=n||eu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!eu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Qc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Qc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,span:{start:t,end:s},ambiguous:i}}function bs(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Gy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?zy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`,span:s.declarationSpan}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Qc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function eu(e){return/[\s;&|<>)]/u.test(e)||e==="`"}function Gy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`&&e[r]!=="\r")r++;let o=r>=n?n:e[r]==="\r"&&e[r+1]===`
-`?r+2:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function zy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var iu=new Set(["&&","||","|","|&"]);function su(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=lo(e,0,e.length,t,{used:0,max:t.maxWords},0);return pe({kind:"program",dialect:"posix",source:e,span:n,status:fo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function lo(e,t,n,r,o,i,s){let a=[],l=[],c=ro(),d=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((h)=>h.text);oo(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return f(),ou(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(uo(m)){if(m===`
-`||m==="\r"){f();let b=m==="\r"&&e[u+1]===`
-`?u+2:u+1,w=a.at(-1);if(w?.kind!=="connector"||!iu.has(w.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let R=bs(e,b,n,d.splice(0));l.push(...R.issues),u=R.next;continue}u=b;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let p=c.start===-1?sC(e,u,n):void 0;if(p){if(Es(a,l,u),i>=r.maxDepth)return mn(a,l,u,"depth-limit",r.maxDepth);if(!vs(o))return mn(a,l,u,"word-limit",r.maxWords);let b=lo(e,p.braceIndex+1,n,r,o,i+1,"}"),w=b.next,R={start:p.braceIndex+1,end:b.closed?w-1:w},P=tu(e,R,b);if(a.push({kind:"function",name:p.name,span:{start:u,end:w},body:P}),l.push(...b.issues),b.pendingHeredocs.length>0||Kn(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely",span:{start:u,end:w}});if(d.push(...b.pendingHeredocs),b.limited)return ao(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed",span:{start:p.braceIndex,end:w}});u=w;continue}let h=co(e,u);if(h){if(f(),!pu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`,span:{start:u,end:u+h.length}});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis",span:{start:u,end:u+1}}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&qy(e,u,n))&&c.start===-1){if(Es(a,l,u),i>=r.maxDepth)return mn(a,l,u,"depth-limit",r.maxDepth);let b=m==="("?")":"}",w=lo(e,u+1,n,r,o,i+1,b),R=w.next,P={start:u+1,end:w.closed?R-1:R},K=tu(e,P,w);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:R},body:K}),l.push(...w.issues),w.pendingHeredocs.length>0||Kn(w.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely",span:{start:u,end:R}});if(d.push(...w.pendingHeredocs),w.limited)return ao(a,l,w.next);if(!w.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`,span:{start:u,end:R}});u=R;continue}let g=(m==="<"||m===">")&&e[u+1]!=="("?Hy(e,u):null;if(g){let b=c.words.at(-1),w=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(w!==void 0)c.words.pop();let R=w===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let P=u+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let K=e[P],Y=P>u+g.length&&K==="#",te=!K||uo(K)||!!co(e,P)||K===s||K===")"||Y||(K==="<"||K===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",z=X?Ss(e,P,n):void 0,N=z?{word:fn(e,P,z.next,z.delimiter,"literal",z.quoted),nested:[],issues:[],next:z.next,limited:!1}:!te?Rs(e,P,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return ao(a,l,N.next);if(!vs(o))return mn(a,l,N.next,"word-limit",r.maxWords)}let oe=N?.next??u+g.length,_e={kind:"redirection",operator:g,span:{start:R,end:oe},...w===void 0?{}:{fd:w},...N?{target:N.word}:{}};if(c.redirections.push(_e),X&&!z)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word",span:{start:u,end:u+g.length}});if(z){if(z.ambiguous||z.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely",span:z.span});let Ye=c.nested;d.push({delimiter:z.delimiter,quotedDelimiter:z.quoted,stripTabs:g==="<<-",declarationSpan:{start:R,end:oe},attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;Ye.push(...$y(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!N)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`,span:{start:u,end:u+g.length}});if(N)c.nested.push(...N.nested);c.end=oe,u=oe;continue}if(c.start===-1)Es(a,l,u);let y=Rs(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return ao(a,l,y.next);let v=Xy(c.words)?nC(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return mn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!vs(o))return mn(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return f(),ou(a,l),l.push(...aC(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function tu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:fo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Rs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],f=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||uo(m)||(m===";"||m==="|"||m==="&")&&co(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:a,end:n}}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(m==='"'){l=!0;let g=By(e,a,n,r,o,i);if(s+=g.text,d.push(...g.nested),f.push(...g.issues),u||=g.limited,c=Vn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=jy(e,a+2,n);if(s+=g.text,f.push(...g.issues),!g.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed",span:{start:a,end:n}});a=g.next;continue}if(m==="\\"){let g=e[a+1];if(!g){f.push({code:"trailing-escape",message:"escape has no following character",span:{start:a,end:a+1}}),a++;break}if(g===`
-`){a+=2;continue}s+=g,a+=2;continue}let h=m==="$"||m==="<"||m===">"||m==="`"?mo(e,a,n,r,o,i):null;if(h){let g=au(h,d,f);if(u||=g.limited,c=Vn(c,g.provenance),a=g.next,u)break;continue}if(m==="$"){let g=uu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(m==="*"||m==="?"||m==="[")c=Vn(c,"glob");s+=m,a++}return{word:fn(e,t,a,s,c,l,c==="literal"?void 0:Ky(e,t,a)),nested:d,issues:f,next:a,limited:u}}function By(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,f=t+1;while(f<n){let u=e[f];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:d};if(u==="\\"&&e[f+1]){let p=e[f+1]??"";if(p===`
-`){f+=2;continue}if(p==="\r"&&e[f+2]===`
-`){f+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,f+=2;continue}if(e.startsWith("$((",f)){let p=xs(e,f+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(f,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:f,end:h}});f=h;continue}let m=mo(e,f,n,r,o,i);if(m){let p=au(m,l,c);if(f=p.next,d||=p.limited,a=Vn(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:d};continue}if(u==="$"){let p=uu(e,f,n,s,a);s=p.text,a=p.provenance,f=p.next;continue}s+=u??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:t,end:n}}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function mo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,f=s?"))":c?"`":")",u=xs(e,t+d,n,f),m=u===-1?n:u,p=u===-1?n:u+f.length;if(i>=r.maxDepth)return{program:iC(e,t+d,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,w=t+d;while(w<m){let R=mo(e,w,m,r,o,i+1);if(!R){w++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),b||=R.program.status==="limited",w=R.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed",span:{start:t,end:p}});return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,m),span:{start:t+d,end:m},status:fo(E,b),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=lo(e,t+d,m,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`,span:{start:t,end:p}}]:[],y=(c||l)&&Kn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions",span:{start:t,end:p}}]:[];return{program:pe({kind:"program",dialect:"posix",source:e.slice(t+d,m),span:{start:t+d,end:m},status:fo([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function $y(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?mo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function au(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function xs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
-`?a+2:a+1,f=bs(e,d,n,s.splice(0));if(!f.terminated)return-1;a=f.next-1;continue}let c=lu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=Uy(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",f=a+(d?3:2);while(f<n&&/[ \t]/.test(e[f]??""))f++;let u=Ss(e,f,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,declarationSpan:{start:a,end:u.next},attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Uy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=lu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function lu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!lC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function co(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Hy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function uo(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function cu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function jy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Vy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`,span:{start:i,end:a.next}});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Vy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return so(e,t+1,n,16,2,t+1);if(r==="u")return so(e,t+1,n,16,4,t+1);if(r==="U")return so(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return so(e,t,n,8,3,t+1);return{text:r,next:t+1}}function so(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function fo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function uu(e,t,n,r,o){let i=cu(e,t,n);return{text:r+e.slice(t,i),provenance:Vn(o,"variable"),next:i}}function Ky(e,t,n){let r=io(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||f||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",h=xs(e,a+m,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let m=cu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Vn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function qy(e,t,n){return t+1>=n||uo(e[t+1]??"")||co(e,t+1)!==null}var Yy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Zy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Xy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Jy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Jy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Qy(e,t);if(n==="env")return eC(e,t);if(n==="sudo")return tC(e,t);return}function Qy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function eC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Yy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function tC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Zy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function du(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=[e.raw],i=e.raw.length,s=0;while(!0){let l=o.findIndex((p)=>ru(p));if(l===-1)break;if(++s>n)return{limited:!0};let c=o[l]??"",d=ru(c);if(!d||d.kind==="range")return{limited:!0};let f=d.start+c.length-d.end,u=d.alternatives.reduce((p,h)=>p+f+h.length,0);if(i-c.length+u>r||o.length-1+d.alternatives.length>t)return{limited:!0};let m=fu(c,d);o.splice(l,1,...m),i+=u-c.length}if(s===0)return;let a=o.map((l)=>oC(l,n));if(a.some((l)=>l===null))return{limited:!0};return{words:[...new Set(a.filter((l)=>l!==null&&l!==""))]}}function nC(e,t,n,r,o){if(t.provenance!=="literal"||t.quoted||t.raw!==t.text||!t.raw.includes("{"))return;let i=[t.text],s=t.text.length,a=0;while(!0){let c=i.findIndex((g)=>nu(g));if(c===-1)break;if(++a>r)return{limitCode:"depth-limit"};let d=i[c]??"",f=nu(d);if(!f)break;let u=f.start+d.length-f.end,m=f.alternatives.filter((g)=>u+g.length>0),p=m.reduce((g,y)=>g+u+y.length,0);if(s-d.length+p>o)return{limitCode:"brace-expansion-limit"};if(i.length-1+m.length>n)return{limitCode:"word-limit"};let h=fu(d,{...f,alternatives:m});i.splice(c,1,...h),s+=p-d.length}let l=i.filter((c)=>c.length>0);if(a===0)return;return{words:l.map((c)=>fn(e,t.span.start,t.span.end,c,"literal",!1))}}function nu(e){let t=[],n;for(let r=0;r<e.length;r++){let o=e[r];if(o==="{"){t.push({start:r,commas:[]});continue}if(o===","&&t.length>0){t.at(-1)?.commas.push(r);continue}if(o!=="}"||t.length===0)continue;let i=t.pop();if(!i||i.commas.length===0)continue;if(!n||i.start<n.start)n={start:i.start,end:r+1,commas:i.commas}}if(!n)return;return{start:n.start,end:n.end,alternatives:mu(e,n)}}function ru(e){let t=[],n,r=null,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(o){o=!1;continue}if(s==="\\"&&r!=="'"){o=!0;continue}if(s===r){r=null;continue}if(r===null&&(s==="'"||s==='"')){r=s;continue}if(r!==null)continue;if(s==="{"){t.push({start:i,commas:[]});continue}if(s===","&&t.length>0){t.at(-1)?.commas.push(i);continue}if(s!=="}"||t.length===0)continue;let a=t.pop();if(!a)continue;let l=a.commas.length>0?{kind:"alternatives",start:a.start,end:i+1,commas:a.commas}:rC(e.slice(a.start+1,i))?{kind:"range",start:a.start,end:i+1}:void 0;if(l&&(!n||l.start<n.start))n=l}if(!n||n.kind==="range")return n;return{kind:n.kind,start:n.start,end:n.end,alternatives:mu(e,n)}}function fu(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function mu(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function rC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function oC(e,t){let n=`x${e}`,r=Rs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function iC(e,t,n,r){return pe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit",span:{start:t,end:n}}],nodes:[]})}function mn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`,span:{start:n,end:n}}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ao(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function vs(e){return e.used++,e.used<=e.max}function sC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Kn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Kn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Kn(t.body.nodes)})}function aC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`,span:t.declarationSpan}))}function pu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function ou(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!iu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`,span:n.span})}function Es(e,t,n){if(!pu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector",span:{start:n,end:n+1}})}function lC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var gu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),cC=new Set(["gc","cat","type","cp","mv","rm"]),hu=["-rec","-for","-path","-literalpath","-whatif"],uC=/^\$env:\w/i,dC=/^(?:\$\{?\w+\}?|~)\\./,po={maxInputLength:131072,maxWords:16384,maxDepth:64};function yu(e){let t=e.toLowerCase().replaceAll("`","");if(![...gu].some((r)=>t.includes(r))&&!(t.includes("rm")&&hu.some((r)=>t.includes(r)))&&!t.includes("<#")&&!fC(t))return!1;let n=CC(e);if(n.posixHeredoc)return!1;return n.invalidComment||n.commands.some(mC)}function fC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function mC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&gu.has(n))return!0;let r=e.slice(t+1);if(n&&cC.has(n)&&r.some(pC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return hu.some((s)=>i.startsWith(s))})}function pC(e){return uC.test(e)||dC.test(e)}function Cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return pe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`,span:n}],nodes:[]});let r=Ts(e,0,e.length,t,0);return pe({kind:"program",dialect:"powershell",source:e,span:n,status:SC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ts(e,t,n,r,o,i=!1){let s=[],a=[],l=ro(),c=0,d=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};oo(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=vu(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
-`){f();let y=m==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(_s(e,u,y)),u=y;continue}u++;continue}let h=Is(e,u);if(h){f(),s.push(_s(e,u,u+h.length)),u+=h.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(bu(u,r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ts(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=pe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed",span:{start:u,end:y.next}});c+=y.words,d||=y.limited,u=y.next;continue}if(m==="}"){f(),s.push(_s(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?ws(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(Cs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=ws(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,d||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`,span:{start:u,end:g.next}}),f(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return f(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function ws(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,f=!1,u=(p)=>{let h=gC(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),d+=Ps(h.program),f||=h.program.status==="limited",s="command-substitution",h.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||Is(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[m+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character",span:{start:m,end:m+1}}),m++;break}i+=h,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let h=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){h=!0,m++;break}i+=e[m]??"",m++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed",span:{start:t,end:e.length}});continue}if(p==='"'){a=!0;let h=m++,g=!1;while(m<n){let y=e[m];if(y==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(y==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(y==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=y??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed",span:{start:h,end:e.length}});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:fn(e,t,m,i,s,a,s==="literal"?void 0:hC(e,t,m)),next:m,issues:l,nested:c,words:d,limited:f}}function gC(e,t,n,r,o){let i=Su(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[bu(t,r.maxDepth)],nodes:[]}),next:a};let l=Ts(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed",span:{start:t,end:a}}]:[];return{program:pe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Su(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ps(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ps(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ps(r)}}return t}function hC(e,t,n){let r=io(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Su(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=yC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function yC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function bu(e,t){return{code:"depth-limit",message:`command structure exceeds parser limit ${t}`,span:{start:e,end:e}}}function CC(e){let t=[],n=[],r=0,o=0,i=!1,s=!1,a=()=>{if(n.length>0)t.push(n);n=[]};while(r<e.length&&r<131072&&o<16384){let l=e[r];if(l==="\r"||l===`
-`){a(),r+=l==="\r"&&e[r+1]===`
-`?2:1;continue}if(/\s/.test(l??"")){r++;continue}let c=vu(e,r,Math.min(e.length,po.maxInputLength),po.maxDepth);if(c){i||=!!c.issue||c.limited,r=c.next;continue}let d=Is(e,r);if(d){a(),r+=d.length;continue}if(l==="{"||l==="}"){a(),r++;continue}s||=e.startsWith("<<",r);let f=ws(e,r,Math.min(e.length,po.maxInputLength),po,0);if(f.word.text)n.push(f.word.text);for(let u of f.nested)t.push(...As(u));o++,r=f.next>r?f.next:r+1}return a(),{commands:t,invalidComment:i,posixHeredoc:s}}function As(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return As(t.body);if(t.kind!=="command")return[];return[t.words.map((n)=>n.text),...t.nested.flatMap(As)]})}function Is(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function vu(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`,span:{start:t,end:i+2}},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed",span:{start:t,end:n}},limited:!1}}function SC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function _s(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}var Dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Ne(e,t="auto",n=Dt){if(t==="powershell"||t==="auto"&&yu(e.slice(0,n.maxInputLength)))return Cu(e,n);return su(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function pn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function go(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function ks(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function qn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){qn(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function j(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Os(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function V(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function Xe(e,t,n){return!Lt(S(e,t-1))&&V(e,t,n)&&!Lt(S(e,t+n.length))}function Je(e,t){return Lt(S(e,t-1))!==Lt(S(e,t))}function re(e){return e===`
-`||e===";"||e==="&"||e==="|"}function gn(e){return e==="|"||e===";"}function ho(e,t,n){let r=ks(e,n);if(t==="rm")return bC(r);if(t==="dd")return EC(r);return Pu(r,!0)}function yo(e,t,n){let r=ks(e,n);if(t==="rm")return RC(r);if(t==="reset-hard")return _u(r,"--ha","rd");if(t==="reset-merge")return _u(r,"--me","rge");if(t==="clean")return PC(r);if(t==="checkout")return TC(r);if(t==="push-force")return IC(r);if(t==="push-refspec")return kC(r);if(t==="push-delete")return OC(r);if(t==="branch")return MC(r);if(t==="tag")return LC(r);if(t==="restore")return WC(r);return Pu(r,!1)}function bC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(Xe(e,i,"rm")&&j(l)&&l!==`
-`)t=!0,i++;continue}let a=vC(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Eu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(j(s)){if(o<0)continue;if(V(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Eu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function vC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(V(e,t,String.raw`\n`))return t+2;if(V(e,t,String.raw`\x0a`)||V(e,t,String.raw`\x0A`))return t+5;if(V(e,t,String.raw`\u000a`)||V(e,t,String.raw`\u000A`))return t+7;return V(e,t,String.raw`\012`)?t+4:-1}function Eu(e,t,n){if(Ru(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Ru(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Ru(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!V(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function EC(e){let t=!1;for(let n=0;n<Z(e);n++){if(re(S(e,n))){t=!1;continue}if(Xe(e,n,"dd")){t=!0,n++;continue}if(!t||!Xe(e,n,"of")||!V(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!j(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function RC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=S(e,o);if(o===Z(e)||re(i)){t=!1,n=!1,r=!1,o++;continue}let s=_C(e,o);if(s>=0){if(xC(e,s))return!0;let a=s,l=!1;while(j(S(e,a)))l||=S(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(V(e,o,"--")&&(o===0||j(S(e,o-1)))&&(!S(e,o+2)||j(S(e,o+2))||re(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=V(e,o,"--recursive")&&Je(e,o+11)||Ms(e,o,"recursive"),r||=V(e,o,"--force")&&Je(e,o+7)||Ms(e,o,"force"),n&&r)return!0;o++}return!1}function Ms(e,t,n){if(!V(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||j(o)||re(o))break;if(o!==n[r])return!1;r++}return r>0&&Je(e,t+r+2)}function xC(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(j(S(e,n)))n++;let i=n;while(n<Z(e)&&!j(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&V(e,i,"--"))return!1;let s=xu(e,i,"recursive"),a=xu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=wC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function xu(e,t,n){return V(e,t,`--${n}`)&&Je(e,t+n.length+2)||Ms(e,t,n)}function _C(e,t){if(t>0&&Lt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!j(S(e,n+1)))return-1;return n+1}function wC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=S(e,c)??"",f=(d==="r"||d==="f")&&Je(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&f,s||=d==="f"&&f,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&f,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function _u(e,t,n){return Zn(e,"reset",gn,!0,(r)=>S(e,r)==="-"&&hn(e,r,t,n)?!0:r)}function PC(e){return Zn(e,"clean",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(hn(e,t,"--fo","rce"))return!0;let n=Yn(e,t,gn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Co(e,t,n){if(!Xe(e,t,"git"))return null;let r=t+3;if(!j(S(e,r)))return{commandEnd:-1,next:r};while(j(S(e,r)))r++;while(r<Z(e)){if(re(S(e,r)))return{commandEnd:-1,next:r};let o=Yn(e,r,re);if(Xe(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&V(e,r,"--"),s=AC(e,r,o);r=o;while(j(S(e,r)))r++;if(i)return{commandEnd:Xe(e,r,n)?r+n.length:-1,next:Yn(e,r,re)};if(!s)continue;if(r>=Z(e)||re(S(e,r)))return{commandEnd:-1,next:r};r=Yn(e,r,re);while(j(S(e,r)))r++}return{commandEnd:-1,next:r}}function AC(e,t,n){for(let r of le)if(n-t===r.length&&V(e,t,r))return!0;return!1}function TC(e){return wu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function IC(e){return Zn(e,"push",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!Lt(S(e,t+2))&&!V(e,t+2,"-with-lease"))return!0;let n=Au(e,t,"--fo","rce");if(n>=0&&!V(e,n,"-with-lease"))return!0;return t})}function kC(e){return Zn(e,"push",re,!1,(t)=>{if(j(S(e,t))&&S(e,t+1)==="+"&&t+2<Z(e)&&!re(S(e,t+2))&&!j(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function OC(e){return Zn(e,"push",re,!1,(t)=>{if(S(e,t)==="-"&&hn(e,t,"--de","lete"))return!0;if(j(S(e,t))&&S(e,t+1)===":"&&t+2<Z(e)&&!j(S(e,t+2))&&!re(S(e,t+2)))return!0;return t})}function MC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||re(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Co(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=Yn(e,o,re),s=NC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function NC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(hn(e,i,"--de","lete"))r=!0;if(hn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&DC(S(e,s))){let d=S(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!Je(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function DC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function LC(e){return wu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function wu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(j(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Co(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&j(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(hn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Je(e,r+1))return!0;if(gn(o))i.outerActive=!1}return!1}function Zn(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Co(e,s,t);if(c){i=c.commandEnd>=0&&(!r||j(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(S(e,d)))i=!1;s=c}if(l)i=!1}return!1}function WC(e){let t=!1;for(let n=0;n<Z(e);n++){if(Os(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Co(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(V(e,n+2,"staged")||V(e,n+2,"help")))t=!1}return t}function Pu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=S(e,r),i=t?Os(o):re(o);if(n&&j(o)&&S(e,r+1)==="-"&&Xe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Xe(e,r,"find"))n=!0,r+=3}return!1}function Yn(e,t,n){let r=t;while(r<Z(e)&&!j(S(e,r))&&!n(S(e,r)))r++;return r}function Au(e,t,n,r){if(!V(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return Je(e,o)?o:-1}function hn(e,t,n,r){return Au(e,t,n,r)>=0}function Qe(e,t){qn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&yo(a,s.scan,t))return C("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var FC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Iu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;qn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return ku(t.nodes,r,i)}function ku(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return ku(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return GC(r,t,n)})}function GC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!FC.test(o.text));return e.words.every((o,i)=>o===t||Tu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Tu(o.target.raw,n.anchored,!0)))}function Tu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as zC,resolve as Ou}from"node:path";function Xn(e,t,n,r){let o=zC(e)?Ou(e):t?Ou(t,e):void 0;if(!o)return;try{return B(o,n,r)}catch{return o}}function Mu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Jn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ns=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),BC=new Set(["-p","--print"]),$C=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),UC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),HC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),jC=new Map([["python",new Set(["m"])]]),VC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),KC=new Set(["always","default","never"]),qC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),YC=/\\\r?\n/g,ZC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Du(e){return bo(e).code}function So(e){return bo(e).sources}function Lu(e){return ZC.get(Ls(e))??[]}function bo(e){let t=Ls(e[0]??"");if(!Ns.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return De(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return De(t,n,r,o,i,s);if(t==="node"&&BC.has(s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(JC(t,s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return De(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(QC(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=XC(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,De(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return De(t,n,r,o);if(VC.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&qC.has(s))||t==="python"&&!KC.has(f))return De(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let u=s[f];if(u===void 0)break;if(jC.get(t)?.has(u)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return De(t,n,r,o)}if($C.get(t)?.has(u)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(UC.get(t)?.has(u)){if(f+1===s.length)i++;break}if(HC.get(t)?.has(u)&&f+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return De(t,n,r,o);if(c)i++}return De(t,n,r,o,void 0,void 0,!0)}function De(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function XC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ds(e,t){return Ls(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ls(e){let t=I(e).toLowerCase();return $r.test(t)?"python":t}function JC(e,t){return Ns.get(e)?.has(t)??!1}function QC(e){return Ns.get(e)?.has("--eval")??!1}function Qn(e,t){let n=nS(e,t);if(!Nu(n,t))return!1;Ee(t,n);let r=tS(n);if(Nu(r,t))return!0;return Ee(t,r),eS.test(r)}var eS=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function tS(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Nu(e,t){if(ho(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(ho(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>yo(o,r))))}function nS(e,t){return Ee(t,e),e.replace(YC,"")}import{isAbsolute as ad,relative as ld}from"node:path";import{isAbsolute as Bu,parse as fS}from"node:path";import{dirname as rS,isAbsolute as oS,parse as iS,sep as sS}from"node:path";function mt(e,t,n){if(ct(t))throw Error("Unsupported Windows namespace path");let r=oS(t)?iS(t).root:"",o=r||e;for(let i of lS(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=rS(o);continue}let s=aS(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function aS(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${sS}${t}`}function lS(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ws=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],cS=new Set(Ws),uS=1024,Wu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),vo=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),dS=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function Eo(e){return cS.has(e)}function Fs(e){return Eo(e)||Wu.has(e)||vo.has(e)||Mn(e)}function Pe(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ro(e,t){let n=Pe("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=uS?{state:"valid",count:r}:{state:"invalid"}}function xo(e,t,n){let o=e.match(dS)?.[1];if(!o||!Fs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Pe(o,t,n)??""}${e.slice(i+1)}`}}function Fu(e){return zu(e,vo)}function Gu(e){return zu(e,Wu)}function zu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Uu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ae(e){if(!Uu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function _o(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ae(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Hu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!Hu(Cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<A.wrapperPeelIterations.cap;f++){let u=$u(i),m=_o(i);for(let[h,g]of m.envAssignments)s.set(h,g),a.set(h,g);if(i=m.words,i.length===0)break;while(i.length>0&&Cn(i).includes("=")&&!pS(i)){let h=gS(Cn(i),a,t.env)??xo(Cn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=Cn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=yS(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=bS(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=vS(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if($u(i)===u)break}let d=_o(i);for(let[f,u]of d.envAssignments)s.set(f,u),a.set(f,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:mS(d.words,o)}}function mS(e,t){return e.some((n)=>!t.has(n))}function $u(e){return e.map(_).join(" ")}function Cn(e){let t=e[0];return t?_(t):""}function Le(e,t){let n=e[t];return n?_(n):void 0}function pS(e){return Uu.test(Cn(e))}function gS(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var hS=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function yS(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?er(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=er(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=er(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(hS.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var CS=new Set(["-i","-0","--null"]),SS=new Set(["-u","--unset","-C","--chdir","-P"]);function bS(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(CS.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=Le(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(SS.has(c)){if(c==="-C"||c==="--chdir"){let f=Le(e,a+1);s=f?er(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=er(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ae(c))break;while(a<e.length){let f=Ae(Le(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function er(e,t,n){if(t==="")return null;if(!e&&!Bu(t))return null;let r=Bu(t)?fS(t).root:n.realpath(e??"/");if(r===null)return null;try{return mt(r,t,n)}catch{return null}}function vS(e){if(Le(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var ES=/['"\\$`{}#]/;function wo(e,t){if(e.some((r)=>ES.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return Po(e,t,n).tokens}function RS(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function gt(e,t,n,r=0){let o=Po(e,t,n),i=(o.envSplitValues??[]).flatMap(RS);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return gt(s,t,n,r+1)}function Po(e,t,n,r){if(!Hu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var $s=Symbol("adopt-as-operand"),xS=new Set(["env","sudo","command","builtin"]),_S=new Set(["&&","||","|&","|","&",";"]),wS=new Set(["<<","<<<",">|"]),PS=new Set(["|","|&"]),AS=/[*@#?$!_-]/,TS=/^\w+(?::\w+)*/,IS=Object.freeze([]),tr=Object.freeze({kind:"scope",edge:"enter"}),nr=Object.freeze({kind:"scope",edge:"exit"}),kS=Object.freeze([]),OS=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),rr=new Set(["bash","sh","zsh","dash","ksh"]),MS=256,Yu=new WeakMap;function Zu(e,t){let n=t.status==="complete"?new Set(Bs(t)):new Set,r=LS(e,n);if(Hr(r))return Ao("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Ao("structural-limit",r,t);if(o.invalid)return Ao("invalid",r,t);let s=Ao("complete",r,t,o.assignmentFallbacks);return Yu.set(s,Object.freeze(i)),s}function Io(e,t,n,r,o){let i={cwd:t,variables:new Map,previous:null},s=[],a=new Set,l=null,c=[];for(let d of Xu(e)){if(d.kind==="scope"){if(d.edge==="enter"){c.push({state:i,segment:[...s],shellWords:new Set(a),pipeProducer:l});continue}let f=o.segment(s,i,l,null,a);if(f)return f;let u=c.pop();if(u===void 0)throw Error("scope exit without a matching enter");i=u.state,s=u.segment,a=u.shellWords,l=u.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let f=o.segment(s,i,l,d.operator,a);if(f)return f;i=NS(s,i,n,r),l=s.length>0&&PS.has(d.operator)?s:null,s=[],a=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)a.add(s.length-1);if(d.target===void 0)continue;let f=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},i);if(f===$s){a.add(s.length),s.push(o.word(d.target));continue}if(f)return f;continue}s.push(o.word(d.text))}return o.segment(s,i,l,null,a)}function ko(e){return Xu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function ge(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:ge(i,t);return a?ge(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function or(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function NS(e,t,n,r){let o=or(e)?new Map([...t.variables,...DS(e,t.variables)]):t.variables,i=pt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(ge(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function DS(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],ge(o,t)]]:[]})}function Xu(e){return Yu.get(e)??IS}function LS(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Ao(e,t,n,r=kS){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>WS(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function WS(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We($S(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[To("{"),...Ft(e.body,a),...s?[To("}")]:[]]:[tr,We("("),...Ft(e.body,a),...s?[We(")")]:[],nr]}]}let o=VS(e,r.functions);if(o){if(r.depth>=Dt.maxDepth||++r.flags.expansions>MS)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ju(e,r),To(";"),...Ft(o,{...r,depth:r.depth+1}),To(";")]},...Vu(e,t,n,r)]}return[{start:e.span.start,events:ju(e,r)},...Vu(e,t,n,r)]}function ju(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Qu(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:FS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function FS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Qu(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[Us(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:US(r),targetOrder:wS.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:td(t)}:{}}),...s===void 0?o:o.slice(1)]}function Vu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[Us(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...Ju(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?GS(t,n,r):[]]}function GS(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:Ju(n.source.slice(r.span.end,e.span.end),n)}]}function Ju(e,t){if(t.depth>=Dt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Qu(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?Us(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Gs(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(We(m));continue}s+=m.text,a||=m.glob}continue}let d=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Gs(m,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=d?Ft(d,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(tr,...p,nr);continue}let f=d?Ft(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(tr,...f,nr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),tr,...f,...c.raw.endsWith(")")?[We(")")]:[],nr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>We("(")),...u===1?[tr]:[],...f,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>We(")")):[],...u===1?[nr]:[])}return l(),o}function Gs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=Ku(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=Ku(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function Ku(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=BS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return zS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&AS.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?TS:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function zS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Gs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function BS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function $S(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:_S.has(e)})}function To(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function Us(e){return Object.freeze({kind:"word",text:e})}function US(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function ir(e){return OS.has(e)||/^python\d/.test(e)}var HS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function ed(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=HS.get(e)?.has(n)??!1;return ed(e,t.slice(r?2:1))}function zs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return zs(e.slice(1));if(!xS.has(t))return[...e];return zs(ed(t,e.slice(1)))}function td(e){let t=jn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return zs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function jS(e){let t=td(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return ir(n)&&!rr.has(n)}function Bs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Bs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Bs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(jS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!qS(t))return r;return[...r,...o]})}function VS(e,t){let n=jn(e);return n===void 0?void 0:t.get(n)}function ht(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function KS(e){if(ht(e.words[0],"git"))return ht(e.words[1],"commit");if(!ht(e.words[0],"gh")||!ht(e.words[2],"create"))return!1;return ht(e.words[1],"pr")||ht(e.words[1],"issue")}function qS(e){return(ht(e.words[0],"cat")||ht(e.words[0],"tee")||KS(e))&&!e.words.some(qu)&&!e.redirections.some((n)=>qu(n.target))}function qu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var nd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),rd=new Set([...nd,"glob"]),YS=new Set([...rd,"pattern"]),od={parseCommand:Ne,readGuardSyntax:Zu};class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function sr(e,t={}){let n=ZS({...od,...t}),r=Ln(e.input),o=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&r)o.push({usage:"input-candidate",source:r});if(e.route.kind==="command"&&"command"in e&&e.command)o.push({usage:"declared-command",source:e.command});let i=o.reduce((s,a)=>{let l=s.findIndex((f)=>f.source===a.source);if(l!==-1){let f=s[l];if(!f)return s;return s[l]={...f,usages:[...f.usages,a.usage]},s}let c=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",d=n.getCommandProgram(a.source,c);return s.push({usages:[a.usage],source:a.source,program:d,shell:n.getShellSyntax(a.source,d)}),s},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:i,paths:XS(e),store:n}}function ue(e,t){return e.commands.find((n)=>n.usages.includes(t))}function et(e,t){if(!e.includes("$"))return e;return _i(e,t)}function ZS(e={}){let t={...od,...e},n=new Map,r=new Map,o=new WeakMap,i=(a,l)=>{let c=`${l}\x00${a}`,d=r.get(c);if(d)return d;let f=t.parseCommand(a,l);return r.set(c,f),f};return{getShellSyntax:(a,l)=>{if(l&&l.source!==a)throw TypeError("Shell syntax source does not match command program source.");let c=l??i(a,"posix");if(c.status==="limited"){let u=o.get(c);if(u)return u;let m={status:"structural-limit",source:a,program:c,assignmentFallbacks:[]};return o.set(c,m),m}let d=n.get(a);if(d)return d;let f=t.readGuardSyntax(a,c);return n.set(a,f),f},getCommandProgram:i}}function XS(e){let t=e.route.kind==="grep"?rd:e.route.kind==="glob"?YS:nd;return[...Ol(e.input,t),...e.route.kind==="patch"?Dl(e.input):[]]}var JS=new Set(["-S","--suffix"]);function Sn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Io(e,t,n,r,{word:(i)=>i,segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(ge(i.target,s.variables),s)?i.target:null})}function Oo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&JS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function cd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Lr(e.invocation.toolName))return null;let a=e.paths.find((l)=>id(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ue(e,"input-candidate");if(!i)return null;let s=Sn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>nb(a,l,t,n,r),isRedirectionTarget:(a,l)=>id(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Gt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=No(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Hs(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(f)=>c?Mo(f,l):QS(f,l);if(n.markerFiles.some(d))return!0;return r&&sd(n).some(d)}if(Hs(a,n))return!0;return r&&sd(n).some((c)=>Mo(c,a))}function QS(e,t){let n=ld(t,e);if(n===""||n.startsWith("..")||ad(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function eb(e,t,n,r,o){return Gt(e,t,n,!0,r,o)}function tb(e,t,n,r,o){if(!n)return!1;return Hs(No(ie(e,t,r,o)),n)}function id(e,t,n,r,o,i){let s=No(ie(e,t,r,o));return i.includes(s)||dd(s,n)}function ud(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Mo(i,No(ie(s,t,r,o)))))}function Hs(e,t){return t.entries.includes(e)||t.directories.includes(e)||dd(e,t)}function dd(e,t){return t.hooksDirectories.some((n)=>Mo(e,n))}function sd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Mo(e,t){let n=ld(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!ad(n)}function No(e){return process.platform==="win32"?e.toLowerCase():e}function nb(e,t,n,r,o){if(or(e))return null;let i=gt([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Oo(i.slice(1)),a=s.sources.find((l)=>eb(ge(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&tb(ge(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Zs,normalize as db,parse as fb,posix as bd,resolve as bn,sep as Ys}from"node:path";import{isAbsolute as rb,join as fd,normalize as gd,parse as ob,sep as md}from"node:path";var ib=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],sb=` 	
-`;function ar(e,t){if(yt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!js(e.get("TMPDIR")??"",t)}function zt(e,t){if(e.has("TMPDIR"))return js(e.get("TMPDIR")??"",t);let n=Vs(e,t);if(n===void 0)return!0;return js(n,t)}function Vs(e,t){return Cd(e,t,"TMPDIR")}function js(e,t){if(!e)return!1;if(lb(e))return!1;return Ks(e,t)}function yt(e,t){let n=Cd(e,t,"IFS");return n!==void 0&&n!==""&&n!==sb}function Ks(e,t){let n=Do(e,t.paths);if(n===null)return!1;return yd(t).some((r)=>ub(n,r))}function hd(e,t){let n=Do(e,t.paths);if(n===null)return!1;return yd(t).some((r)=>Lo(r)===Lo(n))}var pd=new WeakMap;function yd(e){let t=pd.get(e);if(t)return t;let n=ab(e);return pd.set(e,n),n}function ab(e){let t=ib.map((r)=>Do(r,e.paths)??gd(r)),n=Do(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&cb(n))return[...t,n];return t}function lb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Cd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function cb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Do(e,t){try{let n=gd(e);if(!rb(n))return n;let r=ob(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=fd(i,o[s]??"");if(t.entryKind(a)==="missing")return fd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function ub(e,t){let n=Lo(e),r=Lo(t);if(n===r)return!0;let o=r.endsWith(md)?r:`${r}${md}`;return n.startsWith(o)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}var mb=process.platform==="win32",Sd=64,pb=16384;function lr(e){let t=du(e,Sd,Sd,pb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:gb(e)}}function gb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>hb(e.raw,n.span.start-e.span.start))}function hb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Bt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Se();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:vb(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Rb(e))return{kind:"outside_anchored_cwd"};let o=!r&&Rd(e,t.posixShell);if(ct(e))return{kind:"outside_anchored_cwd"};if(Xs(e,r))return{kind:"root_or_home_target"};if(yb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Gt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(Cb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Eb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&Pb(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&Ab(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(Tb(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function vd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(bb(i))return!1;if(hd(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Ib(r??i,s,t.environment.paths,t.budget))}function Xs(e,t=!1){let n=e.trim(),r=bd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function yb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Zs(o)?o:t.resolvedCwd?bn(t.resolvedCwd,o):null;if(!i)return!1;let s=he(B(i,t.environment.paths,t.budget));if(s===fb(s).root)return!0;return s===he(B(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=db(e);if(mb){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function Cb(e,t,n,r,o,i,s,a){let l=e.trim();if(Ed(l))return!1;if(!r&&Ks(l,a))return!0;return(t||i&&s)&&n&&!o&&Sb(l,n)}function Sb(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Rd(e.slice(n.length+1),t)})}function bb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return bd.normalize(`/${t[1]??""}`)==="/"}function Ed(e){return e.split(/[\\/]+/).includes("..")}function vb(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=$n(o.trim(),t);if(!Zs(i))return[];try{let s=B(i,n,r);if(Un(s,B(t,n,r)))return[];return[he(s)]}catch{return[]}})}function Eb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(Ed(r))return!1;let o=n?r:$n(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Zs(o)?o:i?bn(i,o):null;if(!s)return!1;try{let a=he(B(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(Ys)?l:`${l}${Ys}`))}catch{return!1}}function Rb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Rd(e,t=!1){return e.includes("$")||e.includes("`")||xb(e)||t&&_b(e)}function xb(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function _b(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&wb(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function wb(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function Pb(e,t,n,r){try{return he(B(e,n,r))===he(B(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function Ab(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return he(B(bn(t,e),n,r))===he(B(t,n,r))}catch{try{return he(bn(t,e))===he(t)}catch{return!1}}}function Tb(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return qs(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return qs(bn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return qs(bn(a,e),t,i,s)}catch{return!1}}function qs(e,t,n,r){try{return xd(B(e,n,r),B(t,n,r))}catch{return!1}}function Ib(e,t,n,r){if(!t)return!1;try{return xd(B(t,n,r),B(e,n,r))}catch{return!0}}function xd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${Ys}`)||n===r}var kb=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),_d="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ob="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",wd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Pd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",Mb="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",Nb="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.";function Ad(e,t,n,r=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return Db(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function Db(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=Wb(o),s=o[i];if(!s||!kb.has(Vb(s.text)))return null;let a=Lb(o.slice(i+1));if(a.whatIfProtected)return null;if(Q(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return C("powershell.remove-item-pipeline-dynamic-target",Nb);for(let l of a.targets)if(!ct(l.text)&&Xs(Qs(l.text)))return C(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Pd);for(let l of a.targets)if(n.resolvedCwd&&Gt(Qs(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return C("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(Q(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return C("powershell.remove-item-recursive-force-dynamic-target",wd);for(let l of a.targets){let c=Kb(Ge(Qs(l.text),n),n,r);if(c)return c}return null}function Lb(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(Fb(l))continue;if(s){t.push(Js(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=zb(l.text);if(!c){t.push(Js(l)),i=i||l.dynamic;continue}if(Bb(c.name)){let d=c.value?Gb(c.value,l):e[++a];if(d?.kind==="word"){t.push(Js(d)),i=i||d.dynamic;continue}i=!0;continue}if($b(c.name)){n=!0;continue}if(Ub(c.name)){r=!0;continue}if(Hb(c.name))o=jb(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function Wb(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Js(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function Fb(e){return e.kind==="word"&&e.text===","}function Qs(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function Gb(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function zb(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function Bb(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function $b(e){return"recurse".startsWith(e)}function Ub(e){return e.length>=2&&"force".startsWith(e)}function Hb(e){return e==="wi"||"whatif".startsWith(e)}function jb(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function Vb(e){return e.toLowerCase()}function Kb(e,t,n){switch(e.kind){case"root_or_home_target":return C("powershell.remove-item-recursive-force-root-or-home",Pd);case"git_metadata_target":return C("powershell.remove-item-git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"powershell.remove-item-recursive-force-dynamic-target",t.strict))return null;return C("powershell.remove-item-recursive-force-dynamic-target",wd);case"home_cwd_target":return C("powershell.remove-item-recursive-force-home-cwd",Mb);case"cwd_self_target":return C("powershell.remove-item-recursive-force-cwd-self",_d);case"within_anchored_cwd":if(!Q(n,"powershell.remove-item-recursive-force-paranoid",t.paranoid))return null;return C("powershell.remove-item-recursive-force-paranoid",Ob);case"outside_anchored_cwd":return C("powershell.remove-item-recursive-force-outside-cwd",_d)}}var vn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Wo="Unsupported heredoc syntax",Td="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as ei}from"node:path";var qb=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),Yb=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),Zb=new Set(["-o","--output","--query","--subscription"]),Xb=new Set;function Id(e){if(e==="aws")return qb;if(e==="gcloud")return Yb;if(e==="az")return Zb;return Xb}var Jb=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Qb=new Set;function kd(e){if(e==="git")return le;if(e==="docker")return Jb;return Qb}function ze(e,t){if(e.length===0||t.length===0)return null;let n=L(e[0]??""),r=me(e);for(let o of t){if(!nv(n,o.command))continue;if(o.match){if(ev(n,e,o.match))return Od(o);continue}if(!rv(n,e,o.subcommand))continue;if(iv(e,new Set(o.block_args),r))return Od(o)}return null}function Od(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function ev(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return tv(r,n.command_path,Id(e))}function tv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function nv(e,t){return e===L(t)}function rv(e,t,n){if(!n)return!0;return Md(t,1,n,kd(e))}function Md(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&ov(e,i,n,r))return!0;continue}return s===n}return!1}function ov(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Md(e,t+2,n,r)}function iv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var sv=new Set(["-e","--source"]),av=new Set(["-F","-v","--assign","--field-separator"]),Nd=new Set(["-f","--file"]),lv=new Set(["print","printf","return"]),Dd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],cv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ld(e,t,n){let r=!1;for(let o of uv(e)){let i=dv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?C("awk.system-dynamic",cv):null}function ta(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&sv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(av.has(a)||Nd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Nd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ur(e){return ta(e).sources}function uv(e){return ur(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function dv(e,t){Ee(t,e);let n=e.includes("system")?na(e,t):null,r=fv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function na(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Go(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Wd(e,i+1);continue}if(s==="/"&&Fd(e,i)){i=Gd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,cr(e[a-1])||cr(e[i]))continue;let l=Fo(e,i);if(e[l]!=="(")continue;l=Fo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Go(e,l,c);if(!d){r=!0,o=!0;continue}if(l=Fo(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function fv(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let m=Go(e,i,d);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(d==="#"){i=Wd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Fd(e,i)){let m=Gd(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
-{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ea(e,i,"print")||ea(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,u=Fo(e,f);if(ea(e,u,"getline")){o=!0;let m=gv(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(yv(s,a)){o=!0;let m=pv(e,u);if(!m){r=!0,c=f,i=f;continue}if(!mv(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function cr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Fo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function mv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Go(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=hv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function pv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Go(e,t,n)}function gv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function hv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ea(e,t,n){return e.startsWith(n,t)&&!cr(e[t-1])&&!cr(e[t+n.length])}function yv(e,t){return t!==null&&t>=e}function Wd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Fd(e,t){let n=Cv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(cr(e[r-1]))r--;return lv.has(e.slice(r,n+1))}function Cv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Gd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Sv=new Set(["sudo","env","command","builtin"]);function zo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=bv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function bv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&vv(a,r);if(l)i.push(s);if(!l&&Ur.has(L(a)))break;if(o)break}return i}function vv(e,t){let n=I(e),r=L(e);return r==="git"||n==="busybox"||$t(e)||Vi.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return Sv.has(e.toLowerCase())}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Bo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Bo(e,t,n,r,o,i,s,a,l){let c=Po(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:d,cwd:f}=c;if(c.envSplitValues){let m=wo(c.envSplitValues,d);if(!m)throw new F("derivedCommandShape");ra(a),yield*Bo(m,t,f,r,o,i,s,a,l);return}if($t(d[0]??""))throw new F("wrapperPeelIterations");let u=zo(d,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])ra(a),yield*Bo(m===u.childIndex?u.tokens:[...d.slice(m)],t,f,r,new Map(o),new Map(i),s,a,!0);return}if(Rv(d)){ra(a),yield*Bo([...d.slice(1)],t,f,r,o,i,s,a,l);return}yield Ev(d,f,r,o,i,l)}function Ev(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ra(e){if(e.iterations>=A.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function Rv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function oa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function $e(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ia(r,"recursive")){t=!0;continue}if(r==="-f"||ia(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function zd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ia(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ia(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var xv="find -delete permanently removes files. Use -print first to preview.",_v="find -exec rm -rf is dangerous. Use explicit file list instead.",wv=new Set(["-exec","-execdir","-ok","-okdir"]),Pv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Bd(e,t){let n=e.map(_),r=Av(e,n,t);if(r)return r;if(Uo(n,1)&&!Iv(e,n,t)){let s=T(C("find.delete",xv),t.policy);if(s)return s}let o=t.budget??Se(),i=0;while(i<n.length){let s=n[i],a=Ct(s??"");if(a>0){i+=a+1;continue}if(!tt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=dr(n,i);i=l.nextIndex;let c=Ov(l.tokens,t.environment);if(c){let m=T(c,t.policy);if(m)return m}let d=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=f?.id.startsWith("custom.")?f:T(f,t.policy);if(u)return u}return null}function Av(e,t,n){if(!Uo(t,1)&&!sa(t,n.environment))return null;let o=$o(e)??q(["."]),i=Bt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=lr(s);for(let l of a.expandedTargets??[_(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return C("find.delete-git-metadata",Te)}}if(Tv(t)&&i.resolvedCwd&&ud(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return C("find.delete-git-metadata",Te);return null}function sa(e,t){let n=0;while(n<e.length){if(!tt(e[n])){n++;continue}let r=dr(e,n),o=gt([...r.tokens],t),i=I(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Tv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Iv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=$o(e);if(!r)return!1;let o=n.envAssignments??new Map,i=Vs(o,n.environment),s=n.trustedTmpdirValue??zt(o,n.environment),a=n.allowTmpdirVar??!ar(o,n.environment),l=Bt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??yt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let d=lr(c);if(d.unsafeBraceExpansion)return!1;return(d.expandedTargets??[_(c)]).every((f)=>vd(f,l,{containmentTarget:kv(f,i),targetIsLiteral:d.expandedTargets!==void 0||d.targetIsLiteral,tmpdirWordSplittingProtected:d.tmpdirWordSplittingProtected}))})}function kv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function $o(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Ov(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&$e(n))return C("find.exec-rm-recursive-force",_v);return null}function dr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Uo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(tt(r)){n=dr(e,n).nextIndex;continue}let o=Ct(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function Ct(e){return Pv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function tt(e){return e!==void 0&&wv.has(e)}function fr(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Mv=5,aa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function de(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Ud(e,t,n){let r=jd(e,t,n),o=Nv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Mv;a++){let{subcommand:l,rest:c}=Ue(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(d),u=Gv(f);if(u===null||u.length===0)return{blockedReason:aa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:aa,expanded:!0,tokens:i}}function Hd(e,t,n){return jd(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Ue(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=le.has(o)?2:1}return{subcommand:null,rest:[]}}function Nv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function jd(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=Lv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Dv(e,t,n)]}}function Dv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=la(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=la(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=$d(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=$d(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(le.has(i)){o+=2;continue}o++}return r}function Lv(e,t){let n=Wv(e,t),r=Fv(e,t);return{blockedReason:n===null||r===null?aa:null,entries:[...n??[],...r??[]]}}function Wv(e,t){let n=Pe("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=fr(n);if(!o)return null;for(let i of o){let s=la(i);if(!s)return null;r.push(s)}return r}function Fv(e,t){let n=Ro(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Pe(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Pe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function la(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function $d(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Pe(e.slice(r+1),t,n)}}function Gv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return fr(t)}var zv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Bv="git checkout --force discards uncommitted changes. Use 'git stash' first.",$v="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Uv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Hv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",jv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Vv="git switch --force discards uncommitted changes. Use 'git stash' first.",Kv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",qv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Yv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Zv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Xv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Jv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Qv="git push --force destroys remote history. Use --force-with-lease for safer force push.",eE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",tE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",nE="git branch -D force-deletes without merge check. Use -d for safe delete.",rE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",oE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",iE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",sE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",aE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",lE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",cE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",uE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),dE=new Set(["--recurse-submodules","--track","-t"]),ca=new Set(["-b","-B","-U"]),ua=new Set(["-c","-C"]),fE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Kd(e){let{subcommand:t,rest:n}=Ue(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return St(mE(n));case"switch":return St(pE(n));case"restore":return St(hE(n));case"reset":return CE(n);case"clean":return St(bE(n));case"rm":return St(vE(n));case"push":return Ut(EE(n));case"branch":return Ut(_E(n));case"stash":return Ut(IE(n));case"worktree":return Ut(kE(n));case"rebase":return St(wE(n));case"merge":return St(PE(n));case"tag":return Ut(AE(n));case"reflog":return Ut(TE(n));default:return null}}function St(e){return e?{...e,localDiscard:!0}:null}function Ut(e){return e?{...e,localDiscard:!1}:null}function mE(e){let{index:t,before:n}=de(e),r=me(n,{shortOptsWithValue:ca});if(n.some((i)=>M(i,"--force"))||r.has("-f"))return C("git.checkout-force",Bv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(M(i,"--pathspec-from-file"))return C("git.checkout-pathspec-from-file",Uv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return C("git.checkout-ref-path",$v);return C("git.checkout-double-dash",zv)}if(gE(e).length>=2)return C("git.checkout-ambiguous",Hv);return null}function pE(e){let{before:t}=de(e);if(t.some((r)=>M(r,"--discard-changes")))return C("git.switch-discard-changes",jv);let n=me(t,{shortOptsWithValue:ua});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return C("git.switch-force",Vv);return null}function gE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(uE.has(r)){n+=2;continue}if(dE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function hE(e){let t=yE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?C("git.restore-worktree",qv):C("git.restore-unstaged",Kv)}function yE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(fE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function CE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=C("git.reset-hard",Yv);break}if(M(n,"--merge")){t=C("git.reset-merge",Zv);break}}if(!t)return null;return SE(e)?Ut(t):St(t)}function SE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function bE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return C("git.clean-force",Xv);return null}function vE(e){let t=!1,n=!1,r=!1;for(let o of de(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?C("git.rm-force",Jv):null}function EE(e){let{before:t,after:n}=de(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return C("git.push-mirror",tE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Vd(t,n).some(RE))return C("git.push-force",Qv);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Vd(t,n).some(xE))return C("git.push-delete",eE);return null}function Vd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function RE(e){return e.startsWith("+")||e.includes(":+")}function xE(e){return e.length>1&&e.startsWith(":")}function _E(e){let{before:t}=de(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return C("git.branch-force-delete",nE);return null}function wE(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?C("git.rebase-abort",rE):null}function PE(e){let{before:t}=de(e);return t.some((n)=>M(n,"--abort"))?C("git.merge-abort",oE):null}function AE(e){let{before:t}=de(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?C("git.tag-delete",iE):null}function TE(e){return e[0]==="delete"?C("git.reflog-delete",sE):null}function IE(e){for(let t of e){if(t==="drop")return C("git.stash-drop",aE);if(t==="clear")return C("git.stash-clear",lE)}return null}function kE(e){let{before:t}=de(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return C("git.worktree-remove-force",cE);return null}import{resolve as OE}from"node:path";function Yd(e,t){return Ws.some((n)=>t?.has(n)||e.has(n))}function Zd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(OE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=qd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=qd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=le.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function qd(e,t,n){try{let r=mt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Qd(e,t,n){if(!t.localDiscard||!n.worktreeMode||Yd(n.environment.env,n.envAssignments))return null;let r=Zd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(ME(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function ME(e,t,n){let{subcommand:r,rest:o}=Ue(e),i=r?.toLowerCase();if(t.dynamicArguments||NE(o)||GE(e,t.environment.env,t.envAssignments,n)||WE(o)||DE(i,o))return!0;return i==="clean"&&FE(o)>1}function NE(e){return e.some((t)=>/[$*?[]/.test(t))}function DE(e,t){if(e==="checkout"){let{before:n}=de(t),r=me(n,{shortOptsWithValue:ca}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=de(t),r=me(n,{shortOptsWithValue:ua}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||LE(s))||r.has("-C");return o&&i}return!1}function LE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function WE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function FE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function GE(e,t,n,r){let o=zE(e,t,n);if(o!==null)return o;let i=BE(t,n);if(i!==null)return i;if(Gu(n))return!0;return r.recursiveSubmodules}function zE(e,t,n){let r=null,o=1;while(o<e.length){let i=e[o];if(!i||i==="--")return r;if(!i.startsWith("-"))return r;if(i==="-c"){let s=Xd(e[o+1]);if(s!==null)r=s;o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Xd(i.slice(2));if(s!==null)r=s;o++;continue}if(i==="--config-env"){let s=Jd(e[o+1],t,n);if(s!==null)r=s;o+=2;continue}if(i.startsWith("--config-env=")){let s=Jd(i.slice(13),t,n);if(s!==null)r=s;o++;continue}o+=le.has(i)?2:1}return r}function BE(e,t){if(Pe("GIT_CONFIG_PARAMETERS",e,t)!==void 0)return!0;let n=Ro(e,t);if(n.state==="absent")return null;if(n.state==="invalid")return!0;let r=null;for(let o=0;o<n.count;o++){let i=Pe(`GIT_CONFIG_KEY_${o}`,e,t),s=Pe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i?.trim()||s===void 0)return!0;let a=i.trim().toLowerCase();if(fa(a))return!0;if(a!=="submodule.recurse")continue;r=da(s)}return r}function Xd(e){if(!e)return null;let t=e.indexOf("="),n=(t===-1?e:e.slice(0,t)).toLowerCase();if(fa(n))return!0;if(n!=="submodule.recurse")return null;let r=t===-1?"true":e.slice(t+1).toLowerCase();return da(r)}function Jd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;let o=e.slice(0,r).toLowerCase();if(fa(o))return!0;if(o!=="submodule.recurse")return null;let i=Pe(e.slice(r+1),t,n);return i===void 0||da(i)}function da(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function fa(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var $E="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",UE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Ho(e,t){return ef(e.map(_),t)}function ef(e,t,n){let r=Ud(e,t.environment.env,t.envAssignments),o=r.blockedReason?T(C("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((Fu(t.envAssignments)||Hd(e,t.environment.env,t.envAssignments))&&HE(i))return C("git.ssh-env",$E);let s=Kd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=Qd(e,s,t);if(!a)return s;return n?.(a),null}function tf(e,t){let n=null;return{match:ef(e.map(_),t,(o)=>{n=o}),relaxation:n}}function HE(e){let{subcommand:t,rest:n}=Ue(e),r=t?.toLowerCase();if(!r)return!1;if(UE.has(r))return!0;if(r==="archive")return de(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&jE(n)}function jE(e){return e.find((t)=>!VE(t))?.toLowerCase()==="update"}function VE(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as AR}from"node:path";function Re(e,t){e.charge("parallelChildAnalyses",t.childAnalyses??0),e.charge("parallelDerivedTokens",t.derivedTokens??0),e.charge("parallelDerivedBytes",t.derivedBytes??0),e.charge("parallelPlaceholderReplacements",t.placeholderReplacements??0)}var nf="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",KE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",qE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",of="rm -rf targeting root or home directory is extremely dangerous and always blocked.",YE="rm -rf in home directory is dangerous. Change to a project directory first.";function jo(e,t){let n=Bt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=$e(r),i=zd(r),s=XE(e);for(let a of s){let l=lr(a.word);if(o&&l.unsafeBraceExpansion){let c=T(rf({kind:"outside_anchored_cwd"},n,t.policy),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=be(c),f={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Gt(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return C("rm.git-metadata",Te);if(i&&!o){let u=Ge(d,n,f);if(u.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home",of);if(u.kind==="git_metadata_target")return C("rm.git-metadata",Te);continue}if(!o)continue;for(let u of ZE(d,n,f)){let m=rf(u,n,t.policy),p=T(m,t.policy);if(p)return p}}}return null}function ZE(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function XE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}function rf(e,t,n){switch(e.kind){case"root_or_home_target":return C("rm.recursive-force-root-or-home",of);case"git_metadata_target":return C("rm.git-metadata",Te);case"temp_target":return null;case"dynamic_target":if(!Q(n,"rm.recursive-force-dynamic-target",t.strict))return null;return C("rm.recursive-force-dynamic-target",qE);case"home_cwd_target":return C("rm.recursive-force-home-cwd",YE);case"cwd_self_target":return C("rm.recursive-force-cwd-self",nf);case"within_anchored_cwd":if(Q(n,"rm.recursive-force-paranoid",t.paranoid))return C("rm.recursive-force-paranoid",KE);return null;case"outside_anchored_cwd":return C("rm.recursive-force-outside-cwd",nf)}}var JE={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},af=new Set(["--init-file","--rcfile"]),QE=["--init-file","--rcfile"],eR=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function nt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return sf(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=sf(e,t,!1);if(r!==null)return r}}return null}function rt(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ke(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function sf(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function lf(e){let t=I(e[0]??"").toLowerCase(),n=tR(e,t),r=eR.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function tR(e,t){let n=Ke(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?QE.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&af.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=cf(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}function cf(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let f=t.slice(c+1);if(t[0]==="-"&&(f==="c"||f[0]==="-"&&f.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!JE[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ke(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&af.has(l)&&!s.includes("="))i++;continue}let a=cf(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}var bt={kind:"none"},Ht={kind:"dynamic"},nR=new Set(["<","<<","<<-","<<<","<&","<>"]),df=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,rR=/^(?:[0-9]+|[@*])$/,oR=Dt.maxWords,iR=Dt.maxInputLength;function ff(e){if(!e||I(L(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`)}function nl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function Rn(e={}){return{reason:En,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function rl(e){return ap({...e,redact:st})}function ol(e){return st(e instanceof Error?e.message:String(e))}import{isAbsolute as wl,relative as Dp,resolve as Lp,sep as Wp}from"node:path";import{basename as al,dirname as lp,isAbsolute as cp,join as up,normalize as dp,resolve as il}from"node:path";var fp=256,Er=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function at(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function hi(e,t){return mi(e,0,t)}function mi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=pi(e,o+2),a=mp(e,o,t);if(a===null){if(Er.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=pp(l,t,n),o=a+1;continue}let i=pi(e,o+1);if(!i){r+="$",o++;continue}r+=gi(i,n)??`$${i}`,o+=i.length+1}return r}function mp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function pp(e,t,n){let r=e.slice(2,-1),o=pi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return gi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Er.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Er.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=gi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":mi(i.slice(s.length),t+1,n);return l?mi(i.slice(s.length),t+1,n):""}function pi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function gi(e,t){if(!Er.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function G(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){ll(n,i);let s=t.realpath(i);if(s!==null)return sl(n,e,s,o);let a=lp(i);if(a===i||o.length>=fp)return sl(n,e,i,o);o.push(al(i)),i=a}}function sl(e,t,n,r){let o=r.length===0?n:up(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function gp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;ll(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function ll(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=ul(e,t,n);if(!o)return"";return G(o,n.paths,r).replace(/\\/g,"/")}function cl(e,t,n,r,o){let i=ul(e,t,n);if(!i)return null;if(o(al(i)))return G(i,n.paths,r).replace(/\\/g,"/");let s=gp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function ul(e,t,n){let r=n.home,o=hi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?il(r,o.slice(2)):o,s=Ce(i);return dp(cp(s)?s:il(t,s))}import{types as hp}from"node:util";var yp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Cp=new Set(["command","diff","input","patch","patchtext"]),dl=new TextEncoder,bp=new TextDecoder,Sp=/\s/,vp=64;class Ve extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var xn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ep(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function xr(e){return yp.has(Ep(e))}function wn(e){if(!e||typeof e!=="object")return;El(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ue();return}if(t.get||t.set)Ue();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function hl(e,t){return yl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function yl(e,t,n,r){let o=vl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=yl(a,t,n,r+1);return typeof a==="string"&&t.has(Cl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Cl(e){return e.replace(/-/g,"_").toLowerCase()}function bl(e){return Sl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(xp)}function Sl(e,t,n,r){let o=vl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Sl(a,o.array?t:Cp.has(Cl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Rp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>xn.maxDepth||t.nodes>xn.maxNodes)Ue();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>xn.maxStringBytes||t.stringBytes>xn.maxAggregateStringBytes)Ue()}function vl(e,t,n){if(Rp(e,t,n),!e||typeof e!=="object")return null;let r=El(e);if(t.ancestors.has(e))Ue();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>xn.maxKeys)Ue();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ue();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function El(e){if(hp.isProxy(e))Ue();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ue();return t}function Ue(){throw new Ve}function xp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let f=_p(c);if(o=!0,i=f?.oldLines??null,s=f?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let f=c.startsWith(" ")||c.startsWith("-")?1:0,d=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-f),s=Math.max(0,s-d),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...yi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...yi(c));continue}if(c.startsWith("--- ")){let f=n[l+1]??"";if(!f.startsWith("+++ "))continue;t.push(...bi(Rr(c.slice(4),!0),Rr(f.slice(4),!0))),l++;continue}if(!r)t.push(...yi(c))}return t}function _p(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function yi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return gl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return gl(n[1]);if(e.startsWith("diff --git "))return wp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return pl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return pl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Mp(i[1]);return[]}function wp(e){let t=Pp(e);if(t.length===2&&t[0]&&t[1])return bi(t[0],t[1]);let n=Ap(e);return n?bi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Pp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Rt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Rt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Rl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Rt(e[n]))n++;return n===e.length?t:[]}function Ap(e){let t=0;while(t<e.length&&Rt(e[t]))t++;let n=e.length;while(n>t&&Rt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Rt(e[o])){o++;continue}let i=o;while(o<n&&Rt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>vp)Ue();if(Tp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Tp(e,t,n,r,o){if(Ci(e,t,n,r,o))return!0;let i=fl(e,"/",t,n),s=fl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ci(e,t,i,r,s))return!1;return Ci(e,i+1,n,s+1,o)}function Ci(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function fl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Rt(e){return e!==void 0&&Sp.test(e)}function Rl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:bp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...dl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...dl.encode(Ip(s[0]??""))),o+=2}return null}function Ip(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function kp(e){return _n(Np(e))}function bi(e,t){if(e==="/dev/null")return ml(t);if(t==="/dev/null")return ml(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(_n);let n=Op(e,t)??(e===t?xl(e):null);return[e,t,...n?[n]:[]].flatMap(_n)}function ml(e){let t=xl(e);return[e,...t?[t]:[]].flatMap(_n)}function xl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Op(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function pl(e){return kp(Rr(e,!0))}function Mp(e){return _n(Rr(e,!1))}function Rr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Rl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Np(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function _n(e){return e===""||e==="/dev/null"?[]:[e]}function gl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Si(e,t,n){if(at(e))return;let r=t.flatMap((i)=>_l(i,n));if(!r[0])return;let o=_l(wl(e)?e:Lp(r[0],e),n)[0];if(!o)return;return r.some((i)=>Fp(o,i))?o:void 0}function _l(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Fp(e,t){let n=Dp(t,e);return n===""||n!==".."&&!n.startsWith(`..${Wp}`)&&!wl(n)}function Pn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as fg,realpathSync as mg,statSync as pg}from"node:fs";import{homedir as gg,tmpdir as hg}from"node:os";import{statSync as cg}from"node:fs";import{join as ug}from"node:path";import{spawnSync as Gp}from"node:child_process";import{existsSync as Tn,lstatSync as zp,readFileSync as In,realpathSync as qt,statSync as An}from"node:fs";import{dirname as vi,isAbsolute as Ei,join as Yt,resolve as _r}from"node:path";var Bp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],$p=5000;function Al(e,t=ig(),n=$p){let r=Up(e),o=r===null?null:Hp(r);if(r===null||o===null)return null;let i=rg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Up(e){try{let t=qt(_r(e));return An(t).isDirectory()?t:null}catch{return null}}function Hp(e){let t=ng(e);if(!t)return null;try{let n=zp(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Ri(t);if(!r?.commonDir)return null;if(!Kp(r.gitDir,t))return null;return qp(r.gitDir,vi(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Ri(e){try{let t=jp(e);if(!t)return null;let n=qt(Ei(t)?t:_r(vi(e),t));if(!An(n).isDirectory())return null;return{gitDir:n,commonDir:Vp(n)}}catch{return null}}function jp(e){let t=In(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Vp(e){try{let t=In(Yt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=qt(Ei(t)?t:_r(e,t));return An(n).isDirectory()?n:null}catch{return null}}function Kp(e,t){let n=Yp(e);return n===null?!1:Tl(e,n,t)}function qp(e,t){let n=Zp(e);return n===null?!0:Tl(e,n,t)}function Yp(e){let t=Yt(e,"gitdir");if(!Tn(t))return null;let n=In(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Zp(e){let t=Yt(e,"config.worktree");return Tn(t)?Jp(t):null}function Tl(e,t,n){try{return Xp(Ei(t)?t:_r(e,t),n)}catch{return!1}}function Xp(e,t){try{let n=An(e),r=An(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Pl(qt.native(e))===Pl(qt.native(t))}function Pl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Jp(e){let t=In(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Qp(s[1]??"")}return r}function Qp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return tg(t.slice(1,-1))}var eg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function tg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:eg[n]??t)}function ng(e){try{return xi(qt(e))}catch{return null}}function xi(e){let t=e;while(!0){let n=Yt(t,".git");if(Tn(n))return n;let r=vi(t);if(r===t)return null;t=r}}function rg(e,t,n,r){if(og(t))return!0;if(n===null)return!0;let o=Gp(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:sg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Il(o.stdout.trim())}function og(e){return[Yt(e.commonDir,"config"),Yt(e.gitDir,"config.worktree")].filter((t)=>Tn(t)).some((t)=>ag(t))}function ig(){return Bp.find((e)=>Tn(e))??null}function kn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function sg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!kn(t)))}function ag(e){let t;try{t=In(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(lg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Il(c)}return r}function lg(e){return e==="include"||e.startsWith("includeif ")}function Il(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function kl(e,t){if(e==="")return null;let n=ye(),r=xi(ie(e,e,t,n)),o=r?dg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function dg(e,t,n,r){try{let o=ie(e,t,n,r),i=cg(e),s=i.isFile()?o:null,a=i.isFile()?Ri(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((f)=>f?[Zt(ie(f,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Zt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Zt(o),markerFile:s?Zt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((f)=>{let d=Zt(ug(f,"hooks").replace(/\\/g,"/"));return[d,Zt(ie(d,t,n,r))]}))]}}catch{return null}}function Zt(e){return process.platform==="win32"?e.toLowerCase():e}var yg={realpath:(e)=>{try{return mg(e)}catch{return null}},entryKind:(e)=>{let t=fg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return pg(e).isDirectory()}catch{return!1}}};function Ml(){return Cg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||gg()),tmpdir:hg(),paths:yg})}function Cg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Ol(n,i,()=>kl(i,o)),worktreeFacts:(i)=>Ol(r,i,()=>Al(i)),...t};return o}function Ol(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Xt=["fail_closed","paranoid_rm","paranoid_interpreters"],wr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Pr=["standard","strict","paranoid"];function bg(e,t){if(!t)return e;return Pr.indexOf(t)>Pr.indexOf(e)?t:e}function Sg(e){let t=Ai(Q.level,e);if(t===void 0||t==="")return;if(Pr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Pr.join(", ")}.`);return}function vg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Nl(e){return vg(Ai(Q.auditScope,e))==="all"}function wi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Pi(e={},t){let n=e.safety?.level??"standard",r=Sg(t),o=bg(n,r),i=wr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:wi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?_i(e,t):Ai(e,t);return n==="1"||n?.toLowerCase()==="true"}function _i(e,t){return t.get(e)}function Ai(e,t){let n=_i(e.name,t);if(n!==void 0)return n;if(e.legacyName)return _i(e.legacyName,t);return}import{dirname as Lr}from"node:path";import{closeSync as Eg,constants as Dl,fstatSync as Rg,fsyncSync as NP,lstatSync as ki,mkdirSync as DP,openSync as xg,readdirSync as LP,readFileSync as _g,realpathSync as Oi,renameSync as WP,rmdirSync as FP,statSync as wg,unlinkSync as GP,writeFileSync as zP}from"node:fs";import{isAbsolute as Ll,join as Mi,normalize as Pg,parse as Ii,relative as Ni,resolve as Di,sep as Li}from"node:path";function Ti(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var Ag=Symbol("PolicyFilesystemScope"),Tg=Symbol("PolicyFilesystemTarget"),Ig=Dl.O_NOFOLLOW??0;class se extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function _t(e,t){return{[Ag]:!0,root:Di(e),label:t}}function Wl(e,t){let n=Pg(t);if(t===""||Ll(t)||n===".."||n.startsWith(`..${Li}`))throw new se(e.label);return{[Tg]:!0,scope:e,relativePath:n,path:Mi(e.root,n)}}function On(e,t){return Wl(e,Ni(e.root,Di(t)))}function Fl(e,t="rules policy"){let n=Di(e),r=Ii(n).dir;return Wl(_t(r,t),Ni(r,n))}function Tr(e){return zl(e.scope.label,()=>{if(!Ar(e))return null;let t=xg(e.path,Dl.O_RDONLY|Ig);return kg(t,()=>{let n=Rg(t);if(!n.isFile())throw new se(e.scope.label);let r=_g(t,"utf-8"),o=ki(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new se(e.scope.label);return Ar(e),r})})}function Gl(e,t){if(e.path===t.path)return!0;return zl(e.scope.label,()=>{if(!Ar(e)||!Ar(t))return!1;let n=(r)=>Mi(Oi(Ii(r).dir),Ii(r).base);return n(e.path)===n(t.path)})}function zl(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof se)throw r;throw new se(e)}}function kg(e,t){try{return t()}finally{Eg(e)}}function Ar(e,t="file"){let n=Og(e.scope);if(!n)return!1;let r=e.relativePath.split(Li);for(let o of r.keys()){let i=Mi(e.scope.root,...r.slice(0,o+1)),s=ki(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new se(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new se(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new se(e.scope.label);Mg(n,Oi(i),e.scope.label)}return!0}function Og(e){if(!ki(e.root,{throwIfNoEntry:!1}))return null;if(!wg(e.root).isDirectory())throw new se(e.label);return Oi(e.root)}function Mg(e,t,n){let r=Ni(e,t);if(r===".."||r.startsWith(`..${Li}`)||Ll(r))throw new se(n)}import{dirname as Pt,isAbsolute as Fg,join as Tt,relative as Gg,resolve as At,sep as zg}from"node:path";var wt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,Bl="rulebook.json",$l=".cc-safety-net/rules";var Ul=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Ng=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Dg=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Lg="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),HP=new RegExp(`^${Dg}/(${wt.source.slice(1,-1)})/${Lg}$`);function Wg(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Hl(e){if(Ir(e))try{return Wi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return wt.test(e)?null:`Local rulebook sources must be bare names matching ${wt}: ${e}`}function Wi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Ul);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Ng.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!wt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Wg(o),name:o}}function Ir(e){return Ul.test(e)}var jl="rule.json",kr="policy.json",Vl=".cc-safety-net",Bg="rules",$g="CC_SAFETY_NET_HOME",Kl="`cc-safety-net rule update`";function Ug(e){return At(e,$l)}function Hg(e){return Tt(Ug(e),jl)}function Mn(e){return Tt(At(e),Vl,kr)}function Fi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):Tt(jg(e),Bg))}function jg(e){let t=e.env.get($g);return t?At(Ce(t)):Tt(e.home,Vl)}function Vg(e,t={}){return Tt(Fi(e,t),jl)}function Jt(e,t={}){return Tt(Pt(Fi(e,t)),kr)}function ql(e,t){let n=t.userConfigPath??Vg(e,t),r=t.projectConfigPath??Hg(t.cwd),o=Kg(e,t),i=qg(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:On(o,n),projectConfigTarget:On(i,r)}}function Kg(e,t){let n=t.userConfigPath?Pt(Pt(At(t.userConfigPath))):Pt(At(t.userConfigDir??Fi(e,t)));return _t(n,"user policy")}function qg(e,t){let n=At(t),r=At(e),o=Gg(n,r);if(o!==".."&&!o.startsWith(`..${zg}`)&&!Fg(o))return _t(n,"project policy");return _t(Pt(Pt(r)),"project policy")}function Yl(e,t){return Tt(e,t,Bl)}var be=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),lt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ct=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Zl=new Set(["python","python3","python2","node","ruby","perl"]),Or=/^python(?:[23](?:\.\d+)*)?$/,_e=new Set(["awk","gawk","nawk","mawk"]),Mr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Xl="Rulebook exceeds CC Safety Net's safe validation limits.",Jl="Additional rulebook validation errors were omitted.",Ie=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ql(e){if(Gi(e.allowed_commands,Ie.maxAllowedCommands)||Gi(e.rules,Ie.maxRules)||Gi(e.tests,Ie.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Ie,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Ie.maxStringCodeUnits||i&&o.length>Ie.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Ie.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Gi(e,t){return Array.isArray(e)&&e.length>t}var zi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Bi=64,$i="Rule config exceeds CC Safety Net's safe source limit.";function M(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function de(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Yg={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ui=new Set(["--init-file","--rcfile"]);function Hi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let f=t[c];if(f===void 0)break;if(e==="ksh"&&f==="o"&&c+1<t.length){if(r==="argv"){let d=t.slice(c+1);if(t[0]==="-"&&(d==="c"||d[0]==="-"&&d.endsWith("c")))s=!0}break}if(e==="ksh"&&f==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&f==="o"&&c+1<t.length)break;if(r==="startup"&&f==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&f==="c")s=!0;if(r==="argv"&&f==="n")l=t[0]==="-";if(r==="argv"&&f==="s")a=t[0]==="-";if(!Yg[e]?.includes(f))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Se(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Ui.has(l)&&!s.includes("="))i++;continue}let a=Hi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Nn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Nr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Zg(e))Nn(n,t);return t.inSingle||t.inDouble}function Zg(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Nn(s,n)}return t}var ji=new Set(["rm","find","xargs","parallel"]),Xg=new Set(["git","busybox",...ji,...J,...Zl,..._e]),Jg=new Set(["python","node","ruby","perl"]);function ec(e){let t=M(e);return Xg.has(t)||ke(t)}function ke(e){return Jg.has(Qg(e))}function Qg(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function Vi(e){try{let t=Tr(eh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=rh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof se)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function eh(e){return typeof e==="string"?Fl(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function tc(e){let t=new Set;return e.flatMap((n,r)=>{let o=Qt(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var Ki=`must be one of ${zi.join(", ")}`,th=/^[^/]+\/[^/]+$/,nh=["version","rules","overrides","transparent_wrappers"];function rh(e){let t=oh(e);return{errors:qi(mh(t,nh,(n)=>n.kind==="custom"),": "," "),sources:fh(e,t)}}function oh(e){if(!Qt(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Bi;return[...e.version===1?[]:[_(["version"],"must be 1")],...ih(e.rules,t),...lh(e.overrides),...uh(e.transparent_wrappers),...t?[]:ah(e.rules),...Qt(e.overrides)?Object.keys(e.overrides).filter((n)=>!th.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...dh(e.transparent_wrappers)]}function ih(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...nc(e,Bi)?[_(["rules"],$i)]:[]];if(t)return[{path:["rules"],message:$i,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...sh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function nc(e,t){let n=rc(e);return n!==void 0&&!(n<=t)}function sh(e,t){let n=rc(e);return n!==void 0&&!(n>=t)}function rc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function ah(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=Hl(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function lh(e){if(e===void 0)return[];if(!Qt(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!Qt(n))return[_(["overrides",t],'must be "off" or an object')];return[...ch(n.reason,["overrides",t,"reason"]),...n.intent===void 0||Zi(n.intent)?[]:[_(["overrides",t,"intent"],Ki)]]})}function ch(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...nc(e,ct)?[_(t,`must be at most ${ct} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ct?[_(t,`must be at most ${ct} characters`)]:[]}function uh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return lt.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function dh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(ec(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function fh(e,t){let n=Qt(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function mh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function qi(e,t,n){return[...new Set(e.map((r)=>{let o=Yi(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function Yi(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function Zi(e){return zi.includes(e)}function Qt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function ic(e){let t=hh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var ph=`required non-empty string up to ${ct} characters`,oc="must be a non-empty array of unique non-empty strings",gh="required non-empty array of non-empty strings";function hh(e){if(!ut(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ql(e))return{errors:[Xl],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...qi(yh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Ie.maxValidationErrors?[...t.slice(0,Ie.maxValidationErrors),Jl]:t,ruleNames:new Set(sc(e).map((n)=>n.toLowerCase()))}}function sc(e){let t=ut(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ut(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function yh(e,t){return[...typeof e.name==="string"&&wt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Ch(e.allowed_commands),...bh(e.rules,t),...Rh(e.tests),...xh(e),..._h(e)]}function Ch(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&lt.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!lt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function bh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ut(n))return[_(["rules",r],"must be an object")];return t?vh(n,["rules",r]):Sh(n,["rules",r])}),...tc(e)]}function Sh(e,t){return[...ac(e.name,t),...lc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&lt.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Dr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...cc(e.reason,t),...uc(e.intent,t)]}function vh(e,t){return[...ac(e.name,t),...lc(e.command,t),...cc(e.reason,t),...uc(e.intent,t),...Eh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function ac(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return wt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function lc(e,t){return typeof e==="string"&&lt.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function cc(e,t){return typeof e==="string"&&e!==""&&e.length<=ct?[]:[_([...t,"reason"],ph)]}function uc(e,t){return e===void 0||Zi(e)?[]:[_([...t,"intent"],Ki)]}function Eh(e,t){if(!ut(e))return[_(t,"required object")];return[...Dr(e.command_path,[...t,"command_path"],gh,!1),...e.any_args===void 0?[]:Dr(e.any_args,[...t,"any_args"],oc,!0),...e.exclude_args===void 0?[]:Dr(e.exclude_args,[...t,"exclude_args"],oc,!0)]}function Dr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Rh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ut(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function xh(e){if(!Array.isArray(e.tests))return[];let t=new Set(sc(e));return[...new Set(e.tests.flatMap((n)=>ut(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function _h(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ut(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ut(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function hc(e,t){let n=ql(e,t),r=!1;try{r=Gl(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof se)return Nh(n,m.message);throw m}let o=Vi(n.userConfigTarget),i=r?{config:null,errors:[]}:Vi(n.projectConfigTarget),s=pc(n.userConfigPath,o.errors),a=pc(n.projectConfigPath,i.errors),l=new Set,c=o.config?dc(o.config,Lr(n.userConfigPath),"user",n.userScope,l):gc(),f=i.config?dc(i.config,Lr(n.projectConfigPath),"project",n.projectScope,l):gc(),d=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...fc(c.rules,d),...fc(f.rules,u)],transparent_wrappers:Oh(o.config,i.config),rulebooks:[...c.rulebooks,...f.rulebooks],errors:[...s,...a,...c.errors,...f.errors],warnings:[...c.warnings,...f.warnings,...c.canValidateOverrides?mc(d,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?Mh(u,c.knownRuleIds,n.projectConfigPath):[],...f.canValidateOverrides?mc(u,f.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function dc(e,t,n,r=_t(Lr(Lr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let f=Ph(c,t,r);if(f.errors.length>0||!f.rulebook)return i.push(...f.errors),[];let d=f.rulebook;if(o.has(d.name))return s.push(`duplicate active rulebook name "${d.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(d.name),[{rules:wh(d),rulebook:{source:n,spec:c,name:d.name,version:d.version,rules:d.rules.map((u)=>`${d.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function wh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Ph(e,t,n){let r=Ah(e),o=Yl(t,r),i=Ih(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${Th(e)}`]};let s=kh(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function Ah(e){return Ir(e)?Wi(e).name:e}function Th(e){return Ir(e)?`run ${Kl} to vendor ${e}`:"create that file or remove that source from the rules config"}function Ih(e,t){try{return{content:Tr(On(t,e))}}catch(n){if(n instanceof se)return{error:n.message};throw n}}function kh(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:ic(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Oh(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function fc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function mc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function Mh(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function pc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Nh(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function gc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Kh,readFileSync as qh}from"node:fs";var yc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores after --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],Xi=new Set(yc.map((e)=>e.id)),Wr=yc,Dh=new Map(Wr.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:Dh.get(e)??"manual_only"}}var Ji=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Fr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Lh=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],Wh=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],Qi=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...Wh.flatMap((e)=>Lh.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Gr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Cc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Fh=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],es=Cc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ts=Cc.flatMap((e)=>Fh.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Dn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ns=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),rs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],Gh=[...Ji,Fr,...Qi,...es,...ts,Dn,...ns,...rs,...Gr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),zr=new Set(Gr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),os=new Set(Gh.map((e)=>e.id));import{isAbsolute as is,join as zh,normalize as Bh,sep as Br}from"node:path";var bc=process.platform==="win32",$h=/[*?]/;function Ln(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Ln(e.trim(),t);if(!is(n))return"must be an absolute path or start with ~/";return Wn(n,t)}function as(e,t){let n=Sc(e,t);if(n===null)return"must be a non-empty path string";if(!is(n))return null;if(Wn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Uh="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Hh="cannot cover the guard's own configuration";function Sc(e,t){if(typeof e!=="string"||e.trim()==="")return null;return Ln(e.trim().replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ls(e,t){let n=Sc(e,t);if(n===null)return"must be a non-empty path string";if($h.test(n))return"cannot contain glob characters (* or ?); list the exact file or directory";if(!is(n))return null;if(Wn(n,t)!==null)return Uh;return jh(n,t)?Hh:null}function jh(e,t){let n=$r(e),r=$r(zh(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Br}`)}function Wn(e,t){let n=$r(e),r=$r(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Br)?n:`${n}${Br}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function $r(e){let t=Bh(e);if(bc)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(bc?3:1)&&t.endsWith(Br))t=t.slice(0,-1);return t}var vc=30,Ur=1,Hr=365;function Ec(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Rc=new Set(Wr.filter((e)=>e.catastrophic).map((e)=>e.id));function A(e,t){if(!e)return null;if(Rc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Rc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function xc(e,t){return Object.freeze(Object.fromEntries(Wr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function _c(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:xc(e,t)})}var wc={standard:0,strict:1,paranoid:2};function Tc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Vh(e,t)}}function cs(e,t){return[...new Set([...e,...t??[]])]}function Vh(e,t){let n=t.safety?.level,r=wr[e.safety.level];return[...n&&wc[n]<wc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Xt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Pc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Pc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!zr.has(o))),...e.destructive_command_protection.enabled?Ac(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Ac(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Pc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Ac(e,t){return(t??[]).filter((n)=>!e.includes(n))}var fs=new Set(["standard","strict","paranoid"]),Mc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:vc}};function Nc(e,t){let n=oy(Jt(e,t),e.home),r=Kr(Mn(t.cwd),e.home),o=Zh(r.parsed,e.home),i=Object.keys(o.policy).length>0?Tc(n.gui??Mc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ds(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Yh="project policy audit settings are ignored; audit is user scope only";function Zh(e,t){if(!ve(e))return{policy:{},diagnostics:[]};let n=ve(e.safety)?e.safety:{},r=ve(e.workflow)?e.workflow:{},o=ve(e.destructive_command_protection)?e.destructive_command_protection:{},i=ve(e.secret_protection)?e.secret_protection:{},s={...fs.has(n.level)?{level:n.level}:{},...ve(n.overrides)?Ic({overrides:Dc(n.overrides,Xt,["safety","overrides"],It)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Vr(o.overrides,Xi,Wc,It)}:{},...o.allow_paths!==void 0?{allow_paths:tn(o.allow_paths,ss,t,["destructive_command_protection","allow_paths"],It)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Vr(i.overrides,os,Fc,It)}:{},...i.deny_paths!==void 0?{deny_paths:tn(i.deny_paths,as,t,["secret_protection","deny_paths"],It)}:{},...i.allow_paths!==void 0?{allow_paths:tn(i.allow_paths,ls,t,["secret_protection","allow_paths"],It)}:{}};return{policy:Ic({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Yh]}}function Dc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],ms));return[]}))}function Ic(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var It=()=>{return},ms="must be a boolean",ps="must be an object if provided",Lc=`must be an integer between ${Ur} and ${Hr}`,Wc={path:["destructive_command_protection","overrides"],label:"destructive command"},Fc={path:["secret_protection","overrides"],label:"secret protection"},Xh=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Jh(e,t){let n=[];return{policy:Gc(e,t,(o)=>{n.push(o)}),issues:n}}function Qh(e,t){return Gc(e,t,It)}function Gc(e,t,n){if(!ve(e))return n(_([],"Config must be an object")),jr();if(e.version!==1)n(_(["version"],"must be 1"));let r=en(e.safety,["safety"],["level","overrides"],n),o=en(r.overrides,["safety","overrides"],Xt,n),i=en(e.workflow,["workflow"],["worktree_mode"],n),s=en(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=en(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=en(e.audit,["audit"],["retention_days"],n);return zc(e,Xh,[],n),{version:1,safety:{level:ey(r.level,n),overrides:Dc(o,Xt,["safety","overrides"],n)},workflow:{worktree_mode:us(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:us(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Vr(s.overrides,Xi,Wc,n),allow_paths:tn(s.allow_paths,ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:us(a.enabled,["secret_protection","enabled"],!0,n),overrides:Vr(a.overrides,os,Fc,n),deny_paths:tn(a.deny_paths,as,t,["secret_protection","deny_paths"],n),allow_paths:tn(a.allow_paths,ls,t,["secret_protection","allow_paths"],n)},audit:{retention_days:ty(l.retention_days,n)}}}function en(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(t,ps)),{};return zc(e,n,t,r),e}function zc(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function ey(e,t){if(e===void 0)return"standard";if(fs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function us(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,ms));return n}function ty(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Ur&&e<=Hr))t(_(["audit","retention_days"],Lc));return Ec(e)}function Vr(e,t,n,r){if(e===void 0)return{};if(!ve(e))return r(_(n.path,ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function tn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function ve(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function jr(){return structuredClone(Mc)}function Kr(e,t){if(!Kh(e))return{exists:!1,policy:jr(),errors:[]};try{let n=qh(e,"utf-8");if(!n.trim())return{exists:!0,policy:jr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Jh(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${ry(i)}`),fallback:ve(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:jr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var ny=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[ms,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Lc,`not an integer between ${Ur} and ${Hr}`]]);function ry(e){let t=Yi(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=ny.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function oy(e,t){let n=Kr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!ve(r))return{policy:Oc(),errors:[]};let o=Qh(r,t);return{policy:ds(o),gui:o,errors:[],levelPresent:kc(r)}}if(n.parsed===void 0)return{policy:Oc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ds(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:kc(n.parsed)}}function kc(e){let t=ve(e)&&ve(e.safety)?e.safety:{};return fs.has(t.level)}function Bc(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...zr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Oc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:Bc({}),denyPaths:[],allowPaths:[]}}}function ds(e){return{safety:iy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:Bc(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function iy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function $c(e,t){let n=hc(e,t),r=Nc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((f)=>f.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...cy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return uy(o,sy(n,r),s,r.policyScopes)}function sy(e,t){let n=ly(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:dy(e.errors.length>0?ay(e.errors):void 0,e.warnings.length>0?hs(e.warnings.join("; ")):void 0,n)}}function ay(e){return`${hs(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function ly(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function cy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function uy(e,t,n=Object.freeze({}),r){let o=gs(structuredClone(e)),i=r?{policyScopes:gs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function gs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))gs(t);return Object.freeze(e)}function dy(...e){return hs(e.filter((t)=>!!t).join("; "))}function hs(e){return/[.!?]$/.test(e)?e:`${e}.`}function Uc(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ys(t.fail_closed,e.strict,"strict"),paranoid_rm:ys(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ys(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:_c(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:wi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ys(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Fn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var fy=/^[A-Za-z_][A-Za-z0-9_]*=/;function qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Gn(e){let t=qr(e.words[0],"time")?1:0,n=t===1&&qr(e.words[t],"-p")?t+1:t,r=t===1&&qr(e.words[n],"--")?n+1:n,o=qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!fy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var dt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function Yr(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function my(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function Zr(e,t,n){e.push(n),t.reset()}function Xr(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Cs(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function nn(e,t,n,r,o,i,s){return Cs({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return my(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function bs(e,t,n){if(t>=n||jc(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!jc(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=Hc(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=Hc(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ss(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=py(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?gy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function Hc(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function jc(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function py(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function gy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var Yc=new Set(["&&","||","|","|&"]);function Zc(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=eo(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:ro(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function eo(e,t,n,r,o,i,s){let a=[],l=[],c=Yr(),f=[],d=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((h)=>h.text);Zr(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(s&&m===s)return d(),qc(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:f};if(no(m)){if(m===`
+`||m==="\r"){d();let S=m==="\r"&&e[u+1]===`
+`?u+2:u+1,T=a.at(-1);if(T?.kind!=="connector"||!Yc.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,S),span:Object.freeze({start:u,end:S})}));if(f.length>0){let R=Ss(e,S,n,f.splice(0));l.push(...R.issues),u=R.next;continue}u=S;continue}u++;continue}if(m==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let p=c.start===-1?Ly(e,u,n):void 0;if(p){if(Es(a,l),i>=r.maxDepth)return rn(a,l,u,"depth-limit",r.maxDepth);if(!vs(o))return rn(a,l,u,"word-limit",r.maxWords);let S=eo(e,p.braceIndex+1,n,r,o,i+1,"}"),T=S.next,R={start:p.braceIndex+1,end:S.closed?T-1:T},P=Vc(e,R,S);if(a.push({kind:"function",name:p.name,span:{start:u,end:T},body:P}),l.push(...S.issues),S.pendingHeredocs.length>0||Bn(S.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(f.push(...S.pendingHeredocs),S.limited)return Qr(a,l,S.next);if(!S.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=T;continue}let h=to(e,u);if(h){if(d(),!ou(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${h} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:h,span:Object.freeze({start:u,end:u+h.length})})),u+=h.length;continue}if(m===")"){d(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:u,end:u+1}}),u++;continue}if((m==="("||m==="{"&&Ry(e,u,n))&&c.start===-1){if(Es(a,l),i>=r.maxDepth)return rn(a,l,u,"depth-limit",r.maxDepth);let S=m==="("?")":"}",T=eo(e,u+1,n,r,o,i+1,S),R=T.next,P={start:u+1,end:T.closed?R-1:R},q=Vc(e,P,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:u,end:R},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Bn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(f.push(...T.pendingHeredocs),T.limited)return Qr(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});u=R;continue}let g=(m==="<"||m===">")&&e[u+1]!=="("?by(e,u):null;if(g){let S=c.words.at(-1),T=S&&S.span.end===u&&/^[0-9]+$/.test(S.raw)?Number(S.raw):void 0;if(T!==void 0)c.words.pop();let R=T===void 0?u:S?.span.start??u;c.start=c.start===-1?u:c.start;let P=u+g.length;while(P<n&&/[ \t]/.test(e[P]??""))P++;let q=e[P],Z=P>u+g.length&&q==="#",ee=!q||no(q)||!!to(e,P)||q===s||q===")"||Z||(q==="<"||q===">")&&e[P+1]!=="(",X=g==="<<"||g==="<<-",U=X?bs(e,P,n):void 0,D=U?{word:nn(e,P,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Rs(e,P,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return Qr(a,l,D.next);if(!vs(o))return rn(a,l,D.next,"word-limit",r.maxWords)}let le=D?.next??u+g.length,xe={kind:"redirection",operator:g,span:{start:R,end:le},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(xe),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let je=c.nested;f.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:g==="<<-",attach:(Te)=>{if(xe.heredoc=Te,Te.quotedDelimiter)return;je.push(...yy(e,Te.bodySpan.start,Te.bodySpan.end,r,o,i+1))}})}if(!X&&!D)l.push({code:"missing-redirection-target",message:`redirection ${g} requires a target word`});if(D)c.nested.push(...D.nested);c.end=le,u=le;continue}if(c.start===-1)Es(a,l);let y=Rs(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return Qr(a,l,y.next);let v=wy(c.words)?ky(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return rn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let S of E){if(!vs(o))return rn(a,l,y.next,"word-limit",r.maxWords);c.words.push(S)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return d(),qc(a,l),l.push(...Wy(f)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function Vc(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:ro(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Rs(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",f=[],d=[],u=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||no(m)||(m===";"||m==="|"||m==="&")&&to(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let g=e.indexOf("'",a+1);if(g===-1||g>=n){s+=e.slice(a+1,n),d.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,g),a=g+1;continue}if(m==='"'){l=!0;let g=hy(e,a,n,r,o,i);if(s+=g.text,f.push(...g.nested),d.push(...g.issues),u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let g=Sy(e,a+2,n);if(s+=g.text,d.push(...g.issues),!g.closed)d.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=g.next;continue}if(m==="\\"){let g=e[a+1];if(!g){d.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(g===`
+`){a+=2;continue}s+=g,a+=2;continue}let h=m==="$"||m==="<"||m===">"||m==="`"?oo(e,a,n,r,o,i):null;if(h){let g=Xc(h,f,d);if(u||=g.limited,c=zn(c,g.provenance),a=g.next,u)break;continue}if(m==="$"){let g=eu(e,a,n,s,c);s=g.text,c=g.provenance,a=g.next;continue}if(m==="*"||m==="?"||m==="[")c=zn(c,"glob");s+=m,a++}return{word:nn(e,t,a,s,c,l,c==="literal"?void 0:Ey(e,t,a)),nested:f,issues:d,next:a,limited:u}}function hy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],f=!1,d=t+1;while(d<n){let u=e[d];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:d+1,limited:f};if(u==="\\"&&e[d+1]){let p=e[d+1]??"";if(p===`
+`){d+=2;continue}if(p==="\r"&&e[d+2]===`
+`){d+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,d+=2;continue}if(e.startsWith("$((",d)){let p=xs(e,d+3,n,"))"),h=p===-1?n:p+2;if(s+=e.slice(d,h),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});d=h;continue}let m=oo(e,d,n,r,o,i);if(m){let p=Xc(m,l,c);if(d=p.next,f||=p.limited,a=zn(a,p.provenance),f)return{text:s,provenance:a,nested:l,issues:c,next:d,limited:f};continue}if(u==="$"){let p=eu(e,d,n,s,a);s=p.text,a=p.provenance,d=p.next;continue}s+=u??"",d++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:f}}function oo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let f=s?3:c?1:2,d=s?"))":c?"`":")",u=xs(e,t+f,n,d),m=u===-1?n:u,p=u===-1?n:u+d.length;if(i>=r.maxDepth)return{program:Dy(e,t+f,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],S=!1,T=t+f;while(T<m){let R=oo(e,T,m,r,o,i+1);if(!R){T++;continue}if(v.push(...R.program.nodes),E.push(...R.program.issues),S||=R.program.status==="limited",T=R.next,S)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+f,m),span:{start:t+f,end:m},status:ro(E,S),issues:E,nodes:v}),next:p,provenance:"arithmetic"}}let h=eo(e,t+f,m,r,o,i+1),g=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+f)} substitution is not closed`}]:[],y=(c||l)&&Bn(h.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+f,m),span:{start:t+f,end:m},status:ro([...h.issues,...g,...y],h.limited),issues:[...h.issues,...g,...y],nodes:h.nodes}),next:p,provenance:"command-substitution"}}function yy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?oo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Xc(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function xs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let f=l==="\r"&&e[a+1]===`
+`?a+2:a+1,d=Ss(e,f,n,s.splice(0));if(!d.terminated)return-1;a=d.next-1;continue}let c=Jc(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let f=Cy(e,a+3,n);if(f===-1)return-1;a=f+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let f=e[a+2]==="-",d=a+(f?3:2);while(d<n&&/[ \t]/.test(e[d]??""))d++;let u=bs(e,d,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:f,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Cy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Jc(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Jc(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!Fy(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function to(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function by(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function no(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Qc(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Sy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=vy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function vy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return Jr(e,t+1,n,16,2,t+1);if(r==="u")return Jr(e,t+1,n,16,4,t+1);if(r==="U")return Jr(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return Jr(e,t,n,8,3,t+1);return{text:r,next:t+1}}function Jr(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function ro(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function eu(e,t,n,r,o){let i=Qc(e,t,n);return{text:r+e.slice(t,i),provenance:zn(o,"variable"),next:i}}function Ey(e,t,n){let r=Xr(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),f=e.startsWith("$(",a)&&!c,d=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||f||d||u){let m=c?3:u?1:2,p=c?"))":u?"`":")",h=xs(e,a+m,n,p),g=h===-1?n:h+p.length;r.push(o,a,"literal"),r.push(a,g,c?"arithmetic":"command-substitution"),a=g,o=g;continue}if(l==="$"){let m=Qc(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function zn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Ry(e,t,n){return t+1>=n||no(e[t+1]??"")||to(e,t+1)!==null}var xy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),_y=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function wy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Py(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Py(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Ay(e,t);if(n==="env")return Ty(e,t);if(n==="sudo")return Iy(e,t);return}function Ay(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function Ty(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(xy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function Iy(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(_y.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function tu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=nu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>ru(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function ky(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=nu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>ru(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>nn(e,t.span.start,t.span.end,a,"literal",!1))}}function nu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>Kc(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",f=Kc(c,o);if(!f||f.kind==="range")return{limited:"expansions"};let d=f.start+c.length-f.end,u=f.alternatives.reduce((m,p)=>m+d+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+f.alternatives.length>t)return{limited:"words"};i.splice(l,1,...Oy(c,f)),s+=u-c.length}return a===0?void 0:{values:i}}function Kc(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&Ny(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:My(e,r)}}function Oy(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function My(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function Ny(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function ru(e,t){let n=`x${e}`,r=Rs(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function Dy(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function rn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Qr(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function vs(e){return e.used++,e.used<=e.max}function Ly(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Bn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Bn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Bn(t.body.nodes)})}function Wy(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function ou(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function qc(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!Yc.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Es(e,t){if(!ou(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function Fy(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var su=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Gy=new Set(["gc","cat","type","cp","mv","rm"]),au=["-rec","-for","-path","-literalpath","-whatif"],zy=/^\$env:\w/i,By=/^(?:\$\{?\w+\}?|~)\\./;function lu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...su].some((o)=>n.includes(o))&&!(n.includes("rm")&&au.some((o)=>n.includes(o)))&&!n.includes("<#")&&!$y(n))return!1;let r=As(e,t);if(cu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ps(r).some(Uy)}function cu(e){return e.nodes.some((t)=>{if(t.kind==="group")return cu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function $y(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function Uy(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&su.has(n))return!0;let r=e.slice(t+1);if(n&&Gy.has(n)&&r.some(Hy))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return au.some((s)=>i.startsWith(s))})}function Hy(e){return zy.test(e)||By.test(e)}function As(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Ts(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Yy(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Ts(e,t,n,r,o,i=!1){let s=[],a=[],l=Yr(),c=0,f=!1,d=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};Zr(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let m=e[u];if(!m)break;if(i&&m==="}")return d(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:f};let p=qy(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return d(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
+`){d();let y=m==="\r"&&e[u+1]===`
+`?u+2:u+1;s.push(_s(e,u,y)),u=y;continue}u++;continue}let h=fu(e,u);if(h){d(),s.push(_s(e,u,u+h.length)),u+=h.length;continue}if(m==="{"){if(d(),o>=r.maxDepth)return a.push(du(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Ts(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,f||=y.limited,u=y.next;continue}if(m==="}"){d(),s.push(_s(e,u,u+1)),u++;continue}if(m===">"||m==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===m?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?iu(e,v,n,r,o):void 0,S=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:S}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,f||=E.limited;l.end=S,u=S;continue}if(m===","){l.start=l.start===-1?u:l.start,l.words.push(Cs({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let g=iu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=g.next,l.words.push(g.word),a.push(...g.issues),l.nested.push(...g.nested),c+=1+g.words,f||=g.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),d(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next>u?g.next:u+1}return d(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:f}}function iu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],f=0,d=!1,u=(p)=>{let h=jy(e,p,n,r,o);return i+=e.slice(p,h.next),c.push(h.program),l.push(...h.program.issues),f+=ws(h.program),d||=h.program.status==="limited",s="command-substitution",h.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||fu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let h=e[m+1];if(!h){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=h,m+=2;continue}if(e.startsWith("$(",m)){m=u(m);continue}if(p==="'"){a=!0,m++;let h=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){h=!0,m++;break}i+=e[m]??"",m++}if(!h)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let h=!1;while(m<n){let g=e[m];if(g==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(g==='"'){h=!0,m++;break}if(e.startsWith("$(",m)){m=u(m);continue}if(g==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=g??"",m++}if(!h)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:nn(e,t,m,i,s,a,s==="literal"?void 0:Vy(e,t,m)),next:m,issues:l,nested:c,words:f,limited:d}}function jy(e,t,n,r,o){let i=uu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[du(r.maxDepth)],nodes:[]}),next:a};let l=Ts(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function uu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function ws(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=ws(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=ws(r)}}return t}function Vy(e,t,n){let r=Xr(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=uu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Ky(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Ky(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function du(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ps(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ps(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ps)]})}function fu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function qy(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Yy(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function _s(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Oe(e,t="auto",n=dt){if(t==="powershell"||t==="auto"&&lu(e.slice(0,n.maxInputLength),n))return As(e,n);return Zc(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function on(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function io(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Is(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function $n(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Ee(e,t){$n(e,t)}function kt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function ks(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Ke(e,t,n){return!kt(C(e,t-1))&&j(e,t,n)&&!kt(C(e,t+n.length))}function qe(e,t){return kt(C(e,t-1))!==kt(C(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function sn(e){return e==="|"||e===";"}function so(e,t,n){let r=Is(e,n);if(t==="rm")return Zy(r);if(t==="dd")return Jy(r);return Cu(r,!0)}function ao(e,t,n){let r=Is(e,n);if(t==="rm")return Qy(r);if(t==="reset-hard")return hu(r,"--ha","rd");if(t==="reset-merge")return hu(r,"--me","rge");if(t==="clean")return rC(r);if(t==="checkout")return iC(r);if(t==="push-force")return sC(r);if(t==="push-refspec")return aC(r);if(t==="push-delete")return lC(r);if(t==="branch")return cC(r);if(t==="tag")return fC(r);if(t==="restore")return mC(r);return Cu(r,!1)}function Zy(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Ke(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=Xy(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=mu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=mu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Xy(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function mu(e,t,n){if(pu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(pu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function pu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function Jy(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(C(e,n))){t=!1;continue}if(Ke(e,n,"dd")){t=!0,n++;continue}if(!t||!Ke(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function Qy(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=C(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=tC(e,o);if(s>=0){if(eC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&qe(e,o+11)||Os(e,o,"recursive"),r||=j(e,o,"--force")&&qe(e,o+7)||Os(e,o,"force"),n&&r)return!0;o++}return!1}function Os(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&qe(e,t+r+2)}function eC(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(C(e,n)))n++;let i=n;while(n<Y(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=gu(e,i,"recursive"),a=gu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=nC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function gu(e,t,n){return j(e,t,`--${n}`)&&qe(e,t+n.length+2)||Os(e,t,n)}function tC(e,t){if(t>0&&kt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function nC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let f=C(e,c)??"",d=(f==="r"||f==="f")&&qe(e,c+1);r||=f==="r",o||=f==="f",i||=f==="r"&&d,s||=f==="f"&&d,a||=(l==="r"&&f==="f"||l==="f"&&f==="r")&&d,l=f}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function hu(e,t,n){return Hn(e,"reset",sn,!0,(r)=>C(e,r)==="-"&&an(e,r,t,n)?!0:r)}function rC(e){return Hn(e,"clean",sn,!0,(t)=>{if(C(e,t)!=="-")return t;if(an(e,t,"--fo","rce"))return!0;let n=Un(e,t,sn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function lo(e,t,n){if(!Ke(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Y(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=Un(e,r,oe);if(Ke(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=oC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Ke(e,r,n)?r+n.length:-1,next:Un(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=Un(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function oC(e,t,n){for(let r of be)if(n-t===r.length&&j(e,t,r))return!0;return!1}function iC(e){return yu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function sC(e){return Hn(e,"push",sn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!kt(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=bu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function aC(e){return Hn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Y(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function lC(e){return Hn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&an(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Y(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function cC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=lo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=Un(e,o,oe),s=uC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function uC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(an(e,i,"--de","lete"))r=!0;if(an(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&dC(C(e,s))){let f=C(e,s);a||=f==="d"||f==="D",l||=f==="f",c||=f==="D",s++}if(!qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function dC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function fC(e){return yu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function yu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=lo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(an(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&qe(e,r+1))return!0;if(sn(o))i.outerActive=!1}return!1}function Hn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=lo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let f=s;f<=c;f++)if(n(C(e,f)))i=!1;s=c}if(l)i=!1}return!1}function mC(e){let t=!1;for(let n=0;n<Y(e);n++){if(ks(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=lo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Cu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=C(e,r),i=t?ks(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Ke(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Ke(e,r,"find"))n=!0,r+=3}return!1}function Un(e,t,n){let r=t;while(r<Y(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function bu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return qe(e,o)?o:-1}function an(e,t,n,r){return bu(e,t,n,r)>=0}function Ye(e,t){$n(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Ee(t,a);if((s.regex?.test(a)??!1)||s.scan&&ao(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var pC=/^[A-Za-z_][A-Za-z0-9_]*=/;function vu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;$n(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Eu(t.nodes,r,i)}function Eu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Eu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return gC(r,t,n)})}function gC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!pC.test(o.text));return e.words.every((o,i)=>o===t||Su(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Su(o.target.raw,n.anchored,!0)))}function Su(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as hC,resolve as Ru}from"node:path";function jn(e,t,n,r){let o=hC(e)?Ru(e):t?Ru(t,e):void 0;if(!o)return;try{return G(o,n,r)}catch{return o}}function xu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var ln="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Vn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Ms=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),yC=new Set(["-p","--print"]),CC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),bC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),SC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),vC=new Map([["python",new Set(["m"])]]),EC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),RC=new Set(["always","default","never"]),xC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),_C=/\\\r?\n/g,wC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function wu(e){return uo(e).code}function co(e){return uo(e).sources}function Pu(e){return wC.get(Ds(e))??[]}function uo(e){let t=Ds(e[0]??"");if(!Ms.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Me(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Me(t,n,r,o,i,s);if(t==="node"&&yC.has(s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(d.startsWith("-"))continue;n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),i++;continue}if(AC(t,s)){let d=e[i+1];if(d===void 0)return Me(t,n,r,o);if(n.push({tokenIndex:i+1,value:d}),r.push({tokenIndex:i+1,kind:"inline-code",value:d}),t==="python")return Me(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(TC(t)&&a){let d=a[1]??"";n.push({tokenIndex:i,value:d}),r.push({tokenIndex:i,kind:"inline-code",value:d});continue}if(t==="node"){let d=PC(s);if(d){if(d.attached){if(o&&=d.value!=="",d.value!=="")r.push({tokenIndex:i,kind:"module-file",value:d.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Me(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Me(t,n,r,o);if(EC.get(t)?.has(s)){let d=e[i+1];if(d===void 0||d.startsWith("-")&&!(t==="ruby"&&xC.has(s))||t==="python"&&!RC.has(d))return Me(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let d=1;d<s.length;d++){let u=s[d];if(u===void 0)break;if(vC.get(t)?.has(u)){let m=s.slice(d+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return Me(t,n,r,o)}if(CC.get(t)?.has(u)){l=s.slice(d+1)||e[i+1],c=d+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&u==="r"){let m=s.slice(d+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let m=s.slice(d+1);if(!m){if(o=!1,d+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(bC.get(t)?.has(u)){if(d+1===s.length)i++;break}if(SC.get(t)?.has(u)&&d+1<s.length)break}if(l===void 0)continue;let f=c?i+1:i;if(n.push({tokenIndex:f,value:l}),r.push({tokenIndex:f,kind:"inline-code",value:l}),t==="python")return Me(t,n,r,o);if(c)i++}return Me(t,n,r,o,void 0,void 0,!0)}function Me(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((f)=>f.tokenIndex)),c=n.filter((f)=>f.kind!=="inline-code"||l.has(f.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((f)=>f.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function PC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ns(e,t){return Ds(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Ds(e){let t=k(e).toLowerCase();return Or.test(t)?"python":t}function AC(e,t){return Ms.get(e)?.has(t)??!1}function TC(e){return Ms.get(e)?.has("--eval")??!1}function Kn(e,t){let n=OC(e,t);if(!_u(n,t))return!1;Ee(t,n);let r=kC(n);if(_u(r,t))return!0;return Ee(t,r),IC.test(r)}var IC=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function kC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function _u(e,t){if(so(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Ee(t,e),r.test(e))return!0;if(so(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Ee(t,e),r.test(e))return!0;if(so(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Ee(t,e),n.some((o)=>ao(o,r))))}function OC(e,t){return Ee(t,e),e.replace(_C,"")}import{isAbsolute as Qu,relative as ed}from"node:path";import{isAbsolute as Nu,parse as $C}from"node:path";import{dirname as MC,isAbsolute as NC,parse as DC,sep as LC}from"node:path";function ft(e,t,n){if(at(t))throw Error("Unsupported Windows namespace path");let r=NC(t)?DC(t).root:"",o=r||e;for(let i of FC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=MC(o);continue}let s=WC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function WC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${LC}${t}`}function FC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ls=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],GC=new Set(Ls),zC=1024,Au=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Tu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),BC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function fo(e){return GC.has(e)}function Ws(e){return fo(e)||Au.has(e)||Tu.has(e)||kn(e)}function Ze(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Iu(e,t){let n=Ze("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=zC?{state:"valid",count:r}:{state:"invalid"}}function mo(e,t,n){let o=e.match(BC)?.[1];if(!o||!Ws(o))return null;let i=e.indexOf("=");return{name:o,value:`${Ze(o,t,n)??""}${e.slice(i+1)}`}}function ku(e){return Mu(e,Tu)}function Ou(e){return Mu(e,Au)}function Mu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Lu=/^[A-Za-z_][A-Za-z0-9_]*=/;function we(e){if(!Lu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function po(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=we(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Wu(e){let t=e.toLowerCase();return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Ot(e,t,n,r){if(!Wu(cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let d=0;d<V.wrapperPeelIterations.cap;d++){let u=Du(i),m=po(i);for(let[h,g]of m.envAssignments)s.set(h,g),a.set(h,g);if(i=m.words,i.length===0)break;while(i.length>0&&cn(i).includes("=")&&!HC(i)){let h=jC(cn(i),a,t.env)??mo(cn(i),t.env,a);if(h)s.set(h.name,h.value),a.set(h.name,h.value);i=i.slice(1)}if(i.length===0)break;let p=cn(i).toLowerCase();if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let h=KC(i,t.paths,c);if(i=h.words,h.cwd!==void 0)c=h.cwd}if(p==="env"){let h=ZC(i,c,a,t);if(l.push(...h.envSplitValues??[]),i=h.words,h.cwd!==void 0)c=h.cwd;for(let[g,y]of h.envAssignments)s.set(g,y),a.set(g,y)}if(p==="command")i=XC(i);if(p==="builtin")i=i.slice(Ne(i,1)==="--"?2:1);if(Du(i)===u)break}let f=po(i);for(let[d,u]of f.envAssignments)s.set(d,u),a.set(d,u);return{words:f.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:UC(f.words,o)}}function UC(e,t){return e.some((n)=>!t.has(n))}function Du(e){return e.map(w).join(" ")}function cn(e){let t=e[0];return t?w(t):""}function Ne(e,t){let n=e[t];return n?w(n):void 0}function HC(e){return Lu.test(cn(e))}function jC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var VC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function KC(e,t,n){let r=1,o=n;while(r<e.length){let i=Ne(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Ne(e,r+1);o=s?qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(VC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var qC=new Set(["-i","-0","--null"]),YC=new Set(["-u","--unset","-C","--chdir","-P"]);function ZC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Ne(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let d of n.keys())o.set(d,"");o.set("TMPDIR",""),a++;continue}if(qC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let d=Ne(e,a+1);if(d!==void 0)o.set(d,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let f=c==="-S"||c==="--split-string"?{value:Ne(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(f){if(f.value!==void 0)i.push(f.value);return s=null,l(a+f.consumed)}if(YC.has(c)){if(c==="-C"||c==="--chdir"){let d=Ne(e,a+1);s=d?qn(s,d,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let d=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=qn(s,d,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!we(c))break;while(a<e.length){let d=we(Ne(e,a)??"");if(!d)break;o.set(d.name,d.value),a++}if(Ne(e,a)==="--")a++;return l(a)}return l(a)}function qn(e,t,n){if(t==="")return null;if(!e&&!Nu(t))return null;let r=Nu(t)?$C(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function XC(e){if(Ne(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Ne(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var JC=/['"\\$`{}#]/;function go(e,t){if(e.some((r)=>JC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function mt(e,t,n){return ho(e,t,n).tokens}function QC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Mt(e,t,n,r=0){let o=ho(e,t,n),i=(o.envSplitValues??[]).flatMap(QC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Mt(s,t,n,r+1)}function ho(e,t,n,r){if(!Wu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Ot(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Bs=Symbol("adopt-as-operand"),eb=new Set(["env","sudo","command","builtin"]),tb=new Set(["&&","||","|&","|","&",";"]),nb=new Set(["<<","<<<",">|"]),rb=new Set(["|","|&"]),ob=/[*@#?$!_-]/,ib=/^\w+(?::\w+)*/,sb=Object.freeze([]),Yn=Object.freeze({kind:"scope",edge:"enter"}),Zn=Object.freeze({kind:"scope",edge:"exit"}),ab=Object.freeze([]),lb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),Xn=new Set(["bash","sh","zsh","dash","ksh"]),cb=256,$u=new WeakMap;function Uu(e,t){let n=t.status==="complete"?new Set(zs(t)):new Set,r=fb(e,n);if(Nr(r))return yo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return yo("structural-limit",r,t);if(o.invalid)return yo("invalid",r,t);let s=yo("complete",r,t,o.assignmentFallbacks);return $u.set(s,Object.freeze(i)),s}function bo(e,t,n,r,o){let i=o.word??((d)=>d),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,f=[];for(let d of Hu(e)){if(d.kind==="scope"){if(d.edge==="enter"){f.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let m=f.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(d.kind==="operator"){if(!d.boundary)continue;let u=o.segment(a,s,c,d.operator,l);if(u)return u;s=ub(a,s,n,r),c=a.length>0&&rb.has(d.operator)?a:null,a=[],l=new Set;continue}if(d.kind==="redirection"){if(d.fd!==void 0)l.add(a.length-1);if(d.target===void 0)continue;let u=o.redirection({operator:d.operator,role:d.role,targetOrder:d.targetOrder,target:d.target,...d.body===void 0?{}:{body:d.body,consumer:d.consumer}},s);if(u===Bs){l.add(a.length),a.push(i(d.target));continue}if(u)return u;continue}a.push(i(d.text))}return o.segment(a,s,c,null,l)}function So(e){return Hu(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function me(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:me(i,t);return a?me(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function Jn(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function ub(e,t,n,r){let o=Jn(e)?new Map([...t.variables,...db(e,t.variables)]):t.variables,i=mt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ie(me(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function db(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],me(o,t)]]:[]})}function Hu(e){return $u.get(e)??sb}function fb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function yo(e,t,n,r=ab){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>mb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function mb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[De(Cb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[De(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[Co("{"),...Nt(e.body,a),...s?[Co("}")]:[]]:[Yn,De("("),...Nt(e.body,a),...s?[De(")")]:[],Zn]}]}let o=Eb(e,r.functions);if(o){if(r.depth>=dt.maxDepth||++r.flags.expansions>cb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...Fu(e,r),Co(";"),...Nt(o,{...r,depth:r.depth+1}),Co(";")]},...Gu(e,t,n,r)]}return[{start:e.span.start,events:Fu(e,r)},...Gu(e,t,n,r)]}function Fu(e,t){return[...e.words.map((n)=>({start:n.span.start,events:Vu(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:pb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function pb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?Vu(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[$s(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:bb(r),targetOrder:nb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:qu(t)}:{}}),...s===void 0?o:o.slice(1)]}function Gu(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[$s(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[De(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ju(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?gb(t,n,r):[]]}function gb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ju(n.source.slice(r.span.end,e.span.end),n)}]}function ju(e,t){if(t.depth>=dt.maxDepth)return t.flags.limited=!0,[];let n=Oe(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function Vu(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?De("glob"):s!==""||e.quoted&&o.length===0?$s(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Fs(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(De(m));continue}s+=m.text,a||=m.glob}continue}let f=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Fs(m,{single:!1,double:!0},n.flags,n.powershell).map((h)=>typeof h==="string"?h:h.text).join("");let p=f?Nt(f,n).filter((h)=>h.kind==="redirection"&&h.body!==void 0):[];if(p.length>0)o.push(Yn,...p,Zn);continue}let d=f?Nt(f,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Yn,...d,Zn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?De("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Yn,...d,...c.raw.endsWith(")")?[De(")")]:[],Zn);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>De("(")),...u===1?[Yn]:[],...d,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>De(")")):[],...u===1?[Zn]:[])}return l(),o}function Fs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=zu(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=zu(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function zu(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=yb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return hb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&ob.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?ib:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function hb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Fs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function yb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Cb(e){return/^[\r\n]+$/.test(e)?";":e}function De(e){return Object.freeze({kind:"operator",operator:e,boundary:tb.has(e)})}function Co(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function $s(e){return Object.freeze({kind:"word",text:e})}function bb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function Qn(e){return lb.has(e)||/^python\d/.test(e)}var Sb=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Ku(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Sb.get(e)?.has(n)??!1;return Ku(e,t.slice(r?2:1))}function Gs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Gs(e.slice(1));if(!eb.has(t))return[...e];return Gs(Ku(t,e.slice(1)))}function qu(e){let t=Gn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Gs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function vb(e){let t=qu(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return Qn(n)&&!Xn.has(n)}function zs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return zs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>zs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(vb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!xb(t))return r;return[...r,...o]})}function Eb(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function pt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Rb(e){if(pt(e.words[0],"git"))return pt(e.words[1],"commit");if(!pt(e.words[0],"gh")||!pt(e.words[2],"create"))return!1;return pt(e.words[1],"pr")||pt(e.words[1],"issue")}function xb(e){return(pt(e.words[0],"cat")||pt(e.words[0],"tee")||Rb(e))&&!e.words.some(Bu)&&!e.redirections.some((n)=>Bu(n.target))}function Bu(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Yu=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Zu=new Set([...Yu,"glob"]),_b=new Set([...Zu,"pattern"]);class Le extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function er(e){let t=wb(),n=wn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((f)=>f.source===s.source);if(a!==-1){let f=i[a];if(!f)return i;return i[a]={...f,usages:[...f.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Pb(e),store:t}}function pe(e,t){return e.commands.find((n)=>n.usages.includes(t))}function Xe(e,t){if(!e.includes("$"))return e;return hi(e,t)}function wb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Oe(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let f=n.get(a);if(f)return f;let d={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,d),d}let l=e.get(i);if(l)return l;let c=Uu(i,a);return e.set(i,c),c},getCommandProgram:r}}function Pb(e){let t=e.route.kind==="grep"?Zu:e.route.kind==="glob"?_b:Yu;return[...hl(e.input,t),...e.route.kind==="patch"?bl(e.input):[]]}var Ab=new Set(["-S","--suffix"]);function un(e,t,n,r,o){if(e.status==="structural-limit")throw new Le;if(e.status!=="complete")return o.findMalformedTarget(e.source);return bo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(me(i.target,s.variables),s)?i.target:null})}function vo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&Ab.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Pe="Git metadata and hooks are protected. Ask the user before modifying them.";function td(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(xr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Xu(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=pe(e,"input-candidate");if(!i)return null;let s=un(i.shell,o,n,r,{findSegmentTarget:(a,l)=>Ob(a,l,t,n,r),isRedirectionTarget:(a,l)=>Xu(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Ro(ie(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(Us(l,n))return!0;let c=s||a.slice(l.length).includes("/."),f=(d)=>c?Eo(d,l):Tb(d,l);if(n.markerFiles.some(f))return!0;return r&&Ju(n).some(f)}if(Us(a,n))return!0;return r&&Ju(n).some((c)=>Eo(c,a))}function Tb(e,t){let n=ed(t,e);if(n===""||n.startsWith("..")||Qu(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function Ib(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function kb(e,t,n,r,o){if(!n)return!1;return Us(Ro(ie(e,t,r,o)),n)}function Xu(e,t,n,r,o,i){let s=Ro(ie(e,t,r,o));return i.includes(s)||rd(s,n)}function nd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Eo(i,Ro(ie(s,t,r,o)))))}function Us(e,t){return t.entries.includes(e)||t.directories.includes(e)||rd(e,t)}function rd(e,t){return t.hooksDirectories.some((n)=>Eo(e,n))}function Ju(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Eo(e,t){let n=ed(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Qu(n)}function Ro(e){return process.platform==="win32"?e.toLowerCase():e}function Ob(e,t,n,r,o){if(Jn(e))return null;let i=Mt([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=vo(i.slice(1)),a=s.sources.find((l)=>Ib(me(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&kb(me(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Ys,normalize as Bb,parse as $b,posix as fd,resolve as dn,sep as qs}from"node:path";import{isAbsolute as Mb,join as od,normalize as ad,parse as Nb,sep as id}from"node:path";var Db=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],Lb=` 	
+`;function tr(e,t){if(gt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!Hs(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return Hs(e.get("TMPDIR")??"",t);let n=js(e,t);if(n===void 0)return!0;return Hs(n,t)}function js(e,t){return ud(e,t,"TMPDIR")}function Hs(e,t){if(!e)return!1;if(Fb(e))return!1;return Vs(e,t)}function gt(e,t){let n=ud(e,t,"IFS");return n!==void 0&&n!==""&&n!==Lb}function Vs(e,t){let n=xo(e,t.paths);if(n===null)return!1;return cd(t).some((r)=>zb(n,r))}function ld(e,t){let n=xo(e,t.paths);if(n===null)return!1;return cd(t).some((r)=>_o(r)===_o(n))}var sd=new WeakMap;function cd(e){let t=sd.get(e);if(t)return t;let n=Wb(e);return sd.set(e,n),n}function Wb(e){let t=Db.map((r)=>xo(r,e.paths)??ad(r)),n=xo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&Gb(n))return[...t,n];return t}function Fb(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function ud(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function Gb(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function xo(e,t){try{let n=ad(e);if(!Mb(n))return n;let r=Nb(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=od(i,o[s]??"");if(t.entryKind(a)==="missing")return od(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function zb(e,t){let n=_o(e),r=_o(t);if(n===r)return!0;let o=r.endsWith(id)?r:`${r}${id}`;return n.startsWith(o)}function _o(e){return process.platform==="win32"?e.toLowerCase():e}var Ub=process.platform==="win32",dd=64,Hb=16384;function nr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function rr(e){let t=tu(e,dd,dd,Hb);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:jb(e)}}function jb(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>Vb(e.raw,n.span.start-e.span.start))}function Vb(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??ye();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:Xb(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function We(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&Qb(e))return{kind:"outside_anchored_cwd"};let o=!r&&gd(e,t.posixShell);if(at(e))return{kind:"outside_anchored_cwd"};if(Zs(e,r))return{kind:"root_or_home_target"};if(Kb(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(qb(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(Jb(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&rS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&oS(e,t.resolvedCwd??i,t.environment.paths,t.budget))return{kind:"cwd_self_target"};if(iS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}return{kind:"outside_anchored_cwd"}}function md(e,t,n={}){let{containmentTarget:r,...o}=n;if(We(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(Zb(i))return!1;if(ld(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>sS(r??i,s,t.environment.paths,t.budget))}function Zs(e,t=!1){let n=e.trim(),r=fd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function Kb(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Ys(o)?o:t.resolvedCwd?dn(t.resolvedCwd,o):null;if(!i)return!1;let s=ge(G(i,t.environment.paths,t.budget));if(s===$b(s).root)return!0;return s===ge(G(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function ge(e){let t=Bb(e);if(Ub){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function qb(e,t,n,r,o,i,s,a){let l=e.trim();if(pd(l))return!1;if(!r&&Vs(l,a))return!0;return(t||i&&s)&&n&&!o&&Yb(l,n)}function Yb(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!gd(e.slice(n.length+1),t)})}function Zb(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return fd.normalize(`/${t[1]??""}`)==="/"}function pd(e){return e.split(/[\\/]+/).includes("..")}function Xb(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Ln(o.trim(),t);if(!Ys(i))return[];try{let s=G(i,n,r);if(Wn(s,G(t,n,r)))return[];return[ge(s)]}catch{return[]}})}function Jb(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(pd(r))return!1;let o=n?r:Ln(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Ys(o)?o:i?dn(i,o):null;if(!s)return!1;try{let a=ge(G(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(qs)?l:`${l}${qs}`))}catch{return!1}}function Qb(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function gd(e,t=!1){return e.includes("$")||e.includes("`")||eS(e)||t&&tS(e)}function eS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function tS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&nS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function nS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function rS(e,t,n,r){try{return ge(G(e,n,r))===ge(G(t,n,r))}catch{try{return ge(e)===ge(t)}catch{return!1}}}function oS(e,t,n,r){if(e==="."||e==="./"||e===".\\")return!0;try{return ge(G(dn(t,e),n,r))===ge(G(t,n,r))}catch{try{return ge(dn(t,e))===ge(t)}catch{return!1}}}function iS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return Ks(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return Ks(dn(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return Ks(dn(a,e),t,i,s)}catch{return!1}}function Ks(e,t,n,r){try{return hd(G(e,n,r),G(t,n,r))}catch{return!1}}function sS(e,t,n,r){if(!t)return!1;try{return hd(G(t,n,r),G(e,n,r))}catch{return!0}}function hd(e,t){let n=ge(e),r=ge(t);return n.startsWith(`${r}${qs}`)||n===r}var aS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),yd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",lS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Cd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",bd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",cS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",uS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",dS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:bd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Pe},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Cd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:cS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:yd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:lS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:yd}};function Sd(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return fS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function fS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=pS(o),s=o[i];if(!s||!aS.has(RS(s.text)))return null;let a=mS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",uS);for(let l of a.targets)if(!at(l.text)&&Zs(Js(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",bd);for(let l of a.targets)if(n.resolvedCwd&&Dt(Js(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Pe);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Cd);for(let l of a.targets){let c=nr(We(Js(l.text),n),n,r,dS);if(c)return c}return null}function mS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(gS(l))continue;if(s){t.push(Xs(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=yS(l.text);if(!c){t.push(Xs(l)),i=i||l.dynamic;continue}if(CS(c.name)){let f=c.value?hS(c.value,l):e[++a];if(f?.kind==="word"){t.push(Xs(f)),i=i||f.dynamic;continue}i=!0;continue}if(bS(c.name)){n=!0;continue}if(SS(c.name)){r=!0;continue}if(vS(c.name))o=ES(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function pS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function Xs(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function gS(e){return e.kind==="word"&&e.text===","}function Js(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function hS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function yS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function CS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function bS(e){return"recurse".startsWith(e)}function SS(e){return e.length>=2&&"force".startsWith(e)}function vS(e){return e==="wi"||"whatif".startsWith(e)}function ES(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function RS(e){return e.toLowerCase()}var fn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",wo="Unsupported heredoc syntax",vd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";import{normalize as Vo}from"node:path";var xS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),_S=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),wS=new Set(["-o","--output","--query","--subscription"]),PS=new Set;function Ed(e){if(e==="aws")return xS;if(e==="gcloud")return _S;if(e==="az")return wS;return PS}var AS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),TS=new Set;function Rd(e){if(e==="git")return be;if(e==="docker")return AS;return TS}function Je(e,t){if(e.length===0||t.length===0)return null;let n=M(e[0]??""),r=de(e);for(let o of t){if(!OS(n,o.command))continue;if(o.match){if(IS(n,e,o.match))return xd(o);continue}if(!MS(n,e,o.subcommand))continue;if(DS(e,new Set(o.block_args),r))return xd(o)}return null}function xd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function IS(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return kS(r,n.command_path,Ed(e))}function kS(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function OS(e,t){return e===M(t)}function MS(e,t,n){if(!n)return!0;return _d(t,1,n,Rd(e))}function _d(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&NS(e,i,n,r))return!0;continue}return s===n}return!1}function NS(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return _d(e,t+2,n,r)}function DS(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var LS=new Set(["-e","--source"]),WS=new Set(["-F","-v","--assign","--field-separator"]),wd=new Set(["-f","--file"]),FS=new Set(["print","printf","return"]),Pd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],GS="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ad(e,t,n){let r=!1;for(let o of zS(e)){let i=BS(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",GS):null}function ea(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&LS.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(WS.has(a)||wd.has(a))){let l=e[s+1];if(i&&=l!==void 0,wd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(o=!1,!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function ir(e){return ea(e).sources}function zS(e){return ir(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function BS(e,t){Ee(t,e);let n=e.includes("system")?ta(e,t):null,r=$S(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ta(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Ao(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Td(e,i+1);continue}if(s==="/"&&Id(e,i)){i=kd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,or(e[a-1])||or(e[i]))continue;let l=Po(e,i);if(e[l]!=="(")continue;l=Po(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let f=Ao(e,l,c);if(!f){r=!0,o=!0;continue}if(l=Po(e,f.endIndex),r=!0,e[l]!==")"){o=!0,i=f.endIndex;continue}n.push(f.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function $S(e,t){Ee(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let f=e[i];if(!f)break;if(f==='"'||f==="'"){let m=Ao(e,i,f);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(f==="#"){i=Td(e,i+1),s=i,a=null,l=null,c=i;continue}if(f==="/"&&Id(e,i)){let m=kd(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
+{}`.includes(f)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(Qs(e,i,"print")||Qs(e,i,"printf")))a=i;if(f!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(f))c=i+1;i++;continue}let d=e[i+1]==="&"?i+2:i+1,u=Po(e,d);if(Qs(e,u,"getline")){o=!0;let m=jS(s,l,c);if(r||=m===null,m!==null)n.push(m);c=d,i=d;continue}if(KS(s,a)){o=!0;let m=HS(e,u);if(!m){r=!0,c=d,i=d;continue}if(!US(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=d,i++}if(!o)return null;return{dynamic:r,commands:n}}function or(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Po(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function US(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Ao(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=VS(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function HS(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Ao(e,t,n)}function jS(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function VS(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function Qs(e,t,n){return e.startsWith(n,t)&&!or(e[t-1])&&!or(e[t+n.length])}function KS(e,t){return t!==null&&t>=e}function Td(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Id(e,t){let n=qS(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(or(e[r-1]))r--;return FS.has(e.slice(r,n+1))}function qS(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function kd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var YS=new Set(["sudo","env","command","builtin"]);function To(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=ZS(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:[...e.slice(s)],childIndex:s,alternativeChildIndices:i.slice(1)}}function ZS(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&XS(a,r);if(l)i.push(s);if(!l&&Mr.has(M(a)))break;if(o)break}return i}function XS(e,t){let n=k(e),r=M(e);return r==="git"||n==="busybox"||Ft(e)||ji.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||ke(r)||_e.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return YS.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Fe(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Io([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Io(e,t,n,r,o,i,s,a,l){let c=ho(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:f,cwd:d}=c;if(c.envSplitValues){let m=go(c.envSplitValues,f);if(!m)throw new N("derivedCommandShape");na(a),yield*Io(m,t,d,r,o,i,s,a,l);return}if(Ft(f[0]??""))throw new N("wrapperPeelIterations");let u=To(f,s);if(u){for(let m of[u.childIndex,...u.alternativeChildIndices])na(a),yield*Io(m===u.childIndex?u.tokens:[...f.slice(m)],t,d,r,new Map(o),new Map(i),s,a,!0);return}if(QS(f)){na(a),yield*Io([...f.slice(1)],t,d,r,o,i,s,a,l);return}yield JS(f,d,r,o,i,l)}function JS(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function na(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function QS(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ra(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Ge(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||oa(r,"recursive")){t=!0;continue}if(r==="-f"||oa(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Od(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>oa(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function oa(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var ev="find -delete permanently removes files. Use -print first to preview.",tv="find -exec rm -rf is dangerous. Use explicit file list instead.",nv=new Set(["-exec","-execdir","-ok","-okdir"]),rv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Md(e,t){let n=e.map(w),r=ov(e,n,t);if(r)return r;if(Oo(n,1)&&!sv(e,n,t)){let s=A(b("find.delete",ev),t.policy);if(s)return s}let o=t.budget??ye(),i=0;while(i<n.length){let s=n[i],a=ht(s??"");if(a>0){i+=a+1;continue}if(!Qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=sr(n,i);i=l.nextIndex;let c=lv(l.tokens,t.environment);if(c){let m=A(c,t.policy);if(m)return m}let f=s==="-execdir"||s==="-okdir",d=t.analyzeTokens?t.analyzeTokens(l.tokens,f?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:f?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=d?.id.startsWith("custom.")?d:A(d,t.policy);if(u)return u}return null}function ov(e,t,n){if(!Oo(t,1)&&!ia(t,n.environment))return null;let o=ko(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=rr(s);for(let l of a.expandedTargets??[w(s)]){let c=We(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return b("find.delete-git-metadata",Pe)}}if(iv(t)&&i.resolvedCwd&&nd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Pe);return null}function ia(e,t){let n=0;while(n<e.length){if(!Qe(e[n])){n++;continue}let r=sr(e,n),o=Mt([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function iv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function sv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=ko(e);if(!r)return!1;let o=n.envAssignments??new Map,i=js(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!tr(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??gt(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let f=rr(c);if(f.unsafeBraceExpansion)return!1;return(f.expandedTargets??[w(c)]).every((d)=>md(d,l,{containmentTarget:av(d,i),targetIsLiteral:f.expandedTargets!==void 0||f.targetIsLiteral,tmpdirWordSplittingProtected:f.tmpdirWordSplittingProtected}))})}function av(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function ko(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function lv(e,t){let n=mt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Ge(n))return b("find.exec-rm-recursive-force",tv);return null}function sr(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Oo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Qe(r)){n=sr(e,n).nextIndex;continue}let o=ht(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ht(e){return rv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Qe(e){return e!==void 0&&nv.has(e)}function ar(e){let t=Oe(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var cv=5,sa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ce(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Dd(e,t,n){let r=Mo(e,t,n),o=uv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<cv;a++){let{subcommand:l,rest:c}=ze(i),f=l?.toLowerCase();if(!f||!o.has(f))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let d=o.get(f),u=gv(d);if(u===null||u.length===0)return{blockedReason:sa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:sa,expanded:!0,tokens:i}}function Ld(e,t,n){return Mo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function ze(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=be.has(o)?2:1}return{subcommand:null,rest:[]}}function uv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Mo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=fv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...dv(e,t,n)]}}function dv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=aa(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=aa(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Nd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Nd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(be.has(i)){o+=2;continue}o++}return r}function fv(e,t){let n=mv(e,t),r=pv(e,t);return{blockedReason:n===null||r===null?sa:null,entries:[...n??[],...r??[]]}}function mv(e,t){let n=Ze("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=ar(n);if(!o)return null;for(let i of o){let s=aa(i);if(!s)return null;r.push(s)}return r}function pv(e,t){let n=Iu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Ze(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Ze(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function aa(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Nd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Ze(e.slice(r+1),t,n)}}function gv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return ar(t)}var hv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",yv="git checkout --force discards uncommitted changes. Use 'git stash' first.",Cv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",bv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",Sv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",vv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Ev="git switch --force discards uncommitted changes. Use 'git stash' first.",Rv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",xv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",_v="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",wv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Pv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Av="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",Tv="git push --force destroys remote history. Use --force-with-lease for safer force push.",Iv="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",kv="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",Ov="git branch -D force-deletes without merge check. Use -d for safe delete.",Mv="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",Nv="git merge --abort discards merge conflict resolutions. Use 'git status' first.",Dv="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",Lv="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",Wv="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",Fv="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",Gv="git worktree remove --force can delete uncommitted changes. Remove --force flag.",zv=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),Bv=new Set(["--recurse-submodules","--track","-t"]),la=new Set(["-b","-B","-U"]),ca=new Set(["-c","-C"]),$v=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function O(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var mn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function Fd(e){let{subcommand:t,rest:n}=ze(e);if(!t)return null;switch(t.toLowerCase()){case"checkout":return yt(Uv(n));case"switch":return yt(Hv(n));case"restore":return yt(Vv(n));case"reset":return qv(n);case"clean":return yt(Zv(n));case"rm":return yt(Xv(n));case"push":return zt(Jv(n));case"branch":return zt(tE(n));case"stash":return zt(sE(n));case"worktree":return zt(aE(n));case"rebase":return yt(nE(n));case"merge":return yt(rE(n));case"tag":return zt(oE(n));case"reflog":return zt(iE(n));default:return null}}function yt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function Uv(e){let{index:t,before:n}=ce(e),r=de(n,{shortOptsWithValue:la});if(n.some((i)=>O(i,"--force"))||r.has("-f"))return b("git.checkout-force",yv);for(let i of e){if(i==="-b"||i==="-B"||i==="--orphan")return null;if(O(i,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",bv)}if(t!==-1){if(n.some((s)=>!s.startsWith("-")))return b("git.checkout-ref-path",Cv);return b("git.checkout-double-dash",hv)}if(jv(e).length>=2)return b("git.checkout-ambiguous",Sv);return null}function Hv(e){let{before:t}=ce(e);if(t.some((r)=>O(r,"--discard-changes")))return b("git.switch-discard-changes",vv);let n=de(t,{shortOptsWithValue:ca});if(t.some((r)=>O(r,"--force"))||n.has("-f"))return b("git.switch-force",Ev);return null}function jv(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(zv.has(r)){n+=2;continue}if(Bv.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function Vv(e){let t=Kv(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",xv):b("git.restore-unstaged",Rv)}function Kv(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if($v.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function qv(e){let t=null;for(let n of e){if(O(n,"--hard")){t=b("git.reset-hard",_v);break}if(O(n,"--merge")){t=b("git.reset-merge",wv);break}}if(!t)return null;return Yv(e)?zt(t):yt(t)}function Yv(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function Zv(e){for(let n of e)if(n==="-n"||O(n,"--dry-run"))return null;let t=de(e.filter((n)=>n!=="--"));if(e.some((n)=>O(n,"--force"))||t.has("-f"))return b("git.clean-force",Pv);return null}function Xv(e){let t=!1,n=!1,r=!1;for(let o of ce(e).before){if(O(o,"--no-force")){t=!1;continue}if(O(o,"--force")){t=!0;continue}if(O(o,"--no-cached")){n=!1;continue}if(O(o,"--cached")){n=!0;continue}if(O(o,"--no-dry-run")){r=!1;continue}if(O(o,"--dry-run")){r=!0;continue}let i=de([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",Av):null}function Jv(e){let{before:t,after:n}=ce(e),r=de(t);if(t.some((s)=>O(s,"--mirror")))return b("git.push-mirror",kv);if(t.some((s)=>O(s,"--force"))||r.has("-f")||Wd(t,n).some(Qv))return b("git.push-force",Tv);if(t.some((s)=>O(s,"--delete"))||r.has("-d")||Wd(t,n).some(eE))return b("git.push-delete",Iv);return null}function Wd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function Qv(e){return e.startsWith("+")||e.includes(":+")}function eE(e){return e.length>1&&e.startsWith(":")}function tE(e){let{before:t}=ce(e),n=de(t),r=n.has("-D")||n.has("-d")||t.some((i)=>O(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>O(i,"--force"));if(r&&o)return b("git.branch-force-delete",Ov);return null}function nE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?b("git.rebase-abort",Mv):null}function rE(e){let{before:t}=ce(e);return t.some((n)=>O(n,"--abort"))?b("git.merge-abort",Nv):null}function oE(e){let{before:t}=ce(e);return de(t).has("-d")||t.some((r)=>O(r,"--delete"))?b("git.tag-delete",Dv):null}function iE(e){return e[0]==="delete"?b("git.reflog-delete",Lv):null}function sE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",Wv);if(t==="clear")return b("git.stash-clear",Fv)}return null}function aE(e){let{before:t}=ce(e);if(!t.includes("remove"))return null;let r=de(t);if(t.some((o)=>O(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",Gv);return null}import{resolve as lE}from"node:path";function zd(e,t){return Ls.some((n)=>t?.has(n)||e.has(n))}function Bd(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(lE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Gd(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Gd(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=be.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Gd(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function $d(e,t,n){if(!t.localDiscard||!n.worktreeMode||zd(n.environment.env,n.envAssignments))return null;let r=Bd(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(cE(e,n,o))return null;return{originalReason:t.reason,gitCwd:r.gitCwd}}function cE(e,t,n){let{subcommand:r,rest:o}=ze(e),i=r?.toLowerCase();if(t.dynamicArguments||uE(o)||gE(e,t.environment.env,t.envAssignments,n)||mE(o)||dE(i,o))return!0;return i==="clean"&&pE(o)>1}function uE(e){return e.some((t)=>/[$*?[]/.test(t))}function dE(e,t){if(e==="checkout"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:la}),o=n.some((s)=>O(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ce(t),r=de(n,{shortOptsWithValue:ca}),o=n.some((s)=>O(s,"--force"))||n.some((s)=>O(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||fE(s))||r.has("-C");return o&&i}return!1}function fE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function mE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function pE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function gE(e,t,n,r){if(Ze("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Mo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>yE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||hE(s.value);if(Ou(n))return!0;return r.recursiveSubmodules}function hE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function yE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}var CE="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",bE=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function No(e,t){return Ud(e.map(w),t)}function Ud(e,t,n){let r=Dd(e,t.environment.env,t.envAssignments),o=r.blockedReason?A(b("git.alias-config",r.blockedReason),t.policy):null;if(o)return o;let i=r.tokens;if((ku(t.envAssignments)||Ld(e,t.environment.env,t.envAssignments))&&SE(i))return b("git.ssh-env",CE);let s=Fd(i);if(!s)return null;if(r.expanded||r.blockedReason)return s;let a=$d(e,s,t);if(!a)return s;return n?.(a),null}function Hd(e,t){let n=null;return{match:Ud(e.map(w),t,(o)=>{n=o}),relaxation:n}}function SE(e){let{subcommand:t,rest:n}=ze(e),r=t?.toLowerCase();if(!r)return!1;if(bE.has(r))return!0;if(r==="archive")return ce(n).before.some((o)=>O(o,"--remote"));return r==="remote"&&vE(n)}function vE(e){return e.find((t)=>!EE(t))?.toLowerCase()==="update"}function EE(e){return e==="-v"||O(e,"--verbose")||O(e,"--no-verbose")}import{isAbsolute as rR}from"node:path";function jd(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Do(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Vd="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",RE="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",xE="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",qd="rm -rf targeting root or home directory is extremely dangerous and always blocked.",_E="rm -rf in home directory is dangerous. Change to a project directory first.",Kd={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:qd},git_metadata_target:{id:"rm.git-metadata",reason:Pe},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:xE},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:_E},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Vd},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:RE},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Vd}};function Lo(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Ge(r),i=Od(r),s=PE(e);for(let a of s){let l=rr(a.word);if(o&&l.unsafeBraceExpansion){let c=A(nr({kind:"outside_anchored_cwd"},n,t.policy,Kd),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let f=Ce(c),d={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(f,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Pe);if(i&&!o){let u=We(f,n,d);if(u.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",qd);if(u.kind==="git_metadata_target")return b("rm.git-metadata",Pe);continue}if(!o)continue;for(let u of wE(f,n,d)){let m=nr(u,n,t.policy,Kd),p=A(m,t.policy);if(p)return p}}}return null}function wE(e,t,n){let r=We(e,t,n);if(r.kind==="cwd_self_target")return[r,We(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=We(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,We(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function PE(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},Bt={kind:"dynamic"},AE=new Set(["<","<<","<<-","<<<","<&","<>"]),Zd=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,TE=/^(?:[0-9]+|[@*])$/,IE=dt.maxWords,kE=dt.maxInputLength;function Xd(e){if(!e||k(M(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=mr(e[1])==="--"?2:1;if(e.length<=t)return bt;let n=e.slice(t);if(!n.every(qo))return Ht;return{kind:"literal",source:n.map(_).join(" ")}}function mf(e){let t=mr(e[1])==="--"?2:1,n=e[t],r=mr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return bt;if(!qo(n))return Ht;return{kind:"literal",source:r}}function Ko(e,t){let n=aR(e);if(n===-1)return bt;let r=lR(t);if(!r)return bt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=uR(s,e,n,r.ifs);if(!a)return Ht;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>oR||i>iR)return Ht;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(fR)].filter((s)=>s!==null).join(" ")}}function pf(e,t,n,r){if(!Ke(e.map(_)).readsStdinAsCommands)return bt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&nR.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return bt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Ht;return{kind:"literal",source:o.target.text}}if(!n)return bt;return r===void 0?Ht:{kind:"literal",source:r}}function ot(e){let t=Ke(e.map(_)).scriptIndex;if(t===null)return bt;let n=e[t],r=mr(n);return go(n,r)?{kind:"literal",source:r}:Ht}var sR=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ha(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Ae(s)!==null)return!1;let a=I(L(s));return!sR.has(a)&&!J.has(a)&&!$t(a)}function aR(e){return Ke(e.map(_)).commandIndex??-1}function lR(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(cR);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function cR(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function uR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?ma(o):dR(o,r);if(e.parameter==="*"){let a=ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:pa(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=mr(i);return e.quoted?[s]:pa(s,r)}function ma(e){return e.every(qo)?e.map(_):void 0}function dR(e,t){let n=ma(e);if(!n)return;let r=n.map((o)=>pa(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function pa(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Wo(e){let t=lr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(Go))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function Jd(e){let t=lr(e[1])==="--"?2:1,n=e[t],r=lr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!Go(n))return Bt;return{kind:"literal",source:r}}function Fo(e,t){let n=ME(e);if(n===-1)return Ct;let r=NE(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=LE(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>IE||i>kE)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(FE)].filter((s)=>s!==null).join(" ")}}function Qd(e,t,n,r){if(!Se(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&AE.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?Bt:{kind:"literal",source:r}}function et(e){let t=Se(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=lr(n);return io(n,r)?{kind:"literal",source:r}:Bt}var OE=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ma(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||we(s)!==null)return!1;let a=k(M(s));return!OE.has(a)&&!J.has(a)&&!Ft(a)}function ME(e){return Se(e.map(w)).commandIndex??-1}function NE(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(DE);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function DE(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function LE(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?ua(o):WE(o,r);if(e.parameter==="*"){let a=ua(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:da(l,r)}let i=t[n+1+e.parameter];if(i&&!Go(i))return;let s=lr(i);return e.quoted?[s]:da(s,r)}function ua(e){return e.every(Go)?e.map(w):void 0}function WE(e,t){let n=ua(e);if(!n)return;let r=n.map((o)=>da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function mr(e){return e?_(e):""}function fR(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function ya(e,t){return ga(Ne(e,"posix"),t)}function gr(e){return ya(e,new Set(Array.from(e.matchAll(df)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function ga(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(ga(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>ga(o,n))||gf(r.words,n))return!0;yR(r,n)}return!1}function gf(e,t){let n=e.findIndex((s)=>Ae(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(pr(r,t))return!0;let o=L(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return uf(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Ke(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&uf(s[l],t)}let i=mR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return gf(e.slice(i),t)}function mR(e,t,n){let r=L(e[t]?.text??"");if(r==="command")return pR(e,t+1);if(r==="exec")return gR(e,t+1);if(r==="env")return hR(e,t+1,n);return null}function pR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function gR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function hR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return pr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return pr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Ae(i))continue;return r}return null}function yR(e,t){if(!e.words.every((n)=>Ae(n.text)!==null))return;for(let n of e.words){let r=Ae(n.text);if(!r)continue;if(pr(n,t))t.add(r.name)}}function pr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(df)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(rR.test(o)||t.has(o))}))}function uf(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||pr(e,t))}var Ca="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Sa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",CR="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",SR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,bR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,vR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,ER=/^(?:[0-9]+|[@*])$/;function Sf(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=jt(n),i=n.slice(r),s=C("xargs.shell-dynamic",Sa);if(xR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=Rf(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&vf(l,o),u=t.analyzeChild(l,{...hf(a,t),dynamicInput:d,dynamicSourceInput:f||bf(l,a.head,o,a.wrapperEnvAssignments,d,t.scanWork,t.environment),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:C("xargs.rm-recursive-force-dynamic",Ca)});if(u)return u;let m=RR(l,o,t.policy?.rules??[]);if(m)return m;if(a.head==="git"){let h=o===null?[...l,CR]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...hf(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=ze(l,t.policy?.rules??[]);if(p)return p}return null}function hf(e,t){return{producer:"xargs",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function RR(e,t,n){if(n.length===0)return null;if(t===null){for(let o of n){let i=ze([...e,...o.subcommand?[o.subcommand]:[],...o.block_args],n);if(i)return i}return null}let r=new Set(n.flatMap((o)=>[o.subcommand,...o.block_args].flatMap((i)=>i?e.flatMap((s)=>ba(s,t,i)):[])));for(let o of r){let i=ze(e.map((s)=>s.replaceAll(t,o)),n);if(i)return i}return null}function ba(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=e.slice(0,r),i=e.slice(r+t.length);return n.startsWith(o)&&n.endsWith(i)?[n.slice(o.length,n.length-i.length)]:[]}function bf(e,t,n,r,o,i,s){if(J.has(t)){if(rt(e))return!1;if(n!==null&&_R(e,n))return!0;let a=nt(e);if(!a){let l=ot(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n))return!0;if(Qe(a,i))return!0;return wR(a,n,r)}if(Me(t))return yf(e,n,bo,Lu(t));if(we.has(t))return yf(e,n,ta,Dd);if(t==="eval"){let a=Vo(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return PR(e,n,i,s);if(t==="git"){let a=Ue(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&Ef(a.rest,n).some((l)=>l.includes(n))}return!1}function yf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((l)=>l.value===Yo);if(o.sources.some((l)=>l.value.includes(t)))return!0;let i=new Set(o.sources.map((l)=>`${l.tokenIndex}\x00${l.kind}\x00${l.value}`)),s=r.flatMap((l)=>[l.selector,...l.valueForm==="attached-only"||l.valueForm==="attached-or-separate"?[`${l.selector}${Yo}`]:[],...l.valueForm==="equals-or-separate"?[`${l.selector}=${Yo}`]:[]]),a=new Set(s.flatMap((l)=>e.flatMap((c)=>ba(c,t,l))));return Array.from(a).some((l)=>n(e.map((c)=>c.replaceAll(t,l))).sources.some((c)=>!i.has(`${c.tokenIndex}\x00${c.kind}\x00${c.value}`)))}function xR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(Be(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function vf(e,t){return Ef(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Ef(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Rf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function _R(e,t){let n=Ke(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return ba(i,t,o).some((l)=>{let c=e.map((f,u)=>u===s?f.replaceAll(t,l):f),d=Ke(c);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(n.commandIndex===null&&d.commandIndex!==null)return!0;if(n.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(c[d.commandIndex]??"").includes(l))return!0;return d.scriptIndex!==null&&(c[d.scriptIndex]??"").includes(l)})}))}function wR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(SR))if(Cf(o,r))return!0;for(let o of e.matchAll(bR))for(let i of(o[1]??"").matchAll(vR))if(Cf(i,r))return!0;return ya(e,r)}function Cf(e,t){let n=e[1]??e[2];return n!==void 0&&(ER.test(n)||t.has(n))}function PR(e,t,n,r){if(t===null)return!0;let o=!1,i=0;for(let s=1;s<e.length;s++){let a=e[s]??"";if(!o&&!a.startsWith("-")&&a!=="!"&&a!=="("){if(a.indexOf(t)===0)return!0;continue}if(o=!0,i>0){i--;continue}if(tt(a)){let c=dr(e,s);s=c.nextIndex-1;for(let d of Be(c.tokens,{environment:r,cwd:void 0})){let f=Rf(d.tokens,t,d.wrapperEnvAssignments);if(d.head==="rm"&&vf(d.tokens,t)||bf(d.tokens,d.head,t,d.wrapperEnvAssignments,f,n,r))return!0}continue}let l=Ct(a);if(l>0){if(i=l,a.includes(t))return!0;continue}if(a.includes(t))return!0}return!1}function jt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var yr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Cr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",TR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",IR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",kR=/\{[^{}\s]*\}/,kf=/\{\}|\{-?\d+\}/g,OR=["e","f","source","file","-e","-f","--source","--file"],MR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],NR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),DR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),xf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),LR=new Set(["--workdir","--wd"]),_f="__CC_SAFETY_NET_PARALLEL_SOURCE__",WR=new TextEncoder,Ra=A.parallelDerivedBytes.cap+4*A.parallelPlaceholderReplacements.cap;function ye(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Of(e,t){return ye([...e],(n)=>Qe(n,t.scanWork))}function Mf(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Kt(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=$f(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:f}=o;if(c){let p=Kt(t);if(p)return p;let h=Of(t.envAssignments?.values()??[],t);if(h)return h}if(l){let p=jR(t);if(p)return p}if(d!==void 0&&a){let p=Kt(t);if(p)return p}let u=YR(d,t.cwd,t.environment.paths);if(u===null){let p=Kt(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(f){if([...Be(i,m)].flatMap((h)=>[...h.envAssignments.values()]).some(Pa)){let h=Kt(t);if(h)return h}return null}if(i.length===0){if(s.some((g)=>g.length!==1)){let g=Kt(t);if(g)return g}let p=s.map((g)=>g[0]??"");Re(t.budget,xa(p));let h=Ff(m.envAssignments,m.cwd,a);return ye(p,(g)=>t.analyzeNested(g,h))}return ye(Be(i,m),(p)=>FR(p,o,t,m))}function FR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(zf)){let g=Kt(n);if(g)return g}let d=Of(c,n);if(d)return d;let f=c.some(G),u=i||f,m=a&&u,p=Ff(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Re(n.budget,Xo(l,o,"generic")),ye(o,(E)=>n.analyzeChild(l.map((b)=>vt(b,E)),va(e,r)))};if(rt(l))return g();let y=nt(l);if(y){if(Bf(y)){let R=Vt(n);if(R)return R;if(o.length===0)return null;return Re(n.budget,If(y,o)),ye(o,(P)=>n.analyzeNested(vt(y,P),p))}if(G(y)){if(o.length>0)return Re(n.budget,If(y,o)),ye(o,(K)=>n.analyzeNested(vt(y,K),p));Re(n.budget,Af(y));let R=fr(y);if(R?.[0]&&L(R[0])==="rm"&&$e(R)){let K=Pf(n);if(K)return K}let P=R?n.analyzeChild(R,{...va(e,r),dynamicInput:a,shellDynamicMatch:C("parallel.shell-dynamic",Cr),rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",yr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Ko(q(R===void 0?l:i?l.map((P)=>vt(P,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=Vt(n);if(R)return R}let b=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(b.length>0)return Re(n.budget,xa(b)),ye(b,(R)=>n.analyzeNested(R,p));if(Re(n.budget,Af(y)),gr(y)){let R=Vt(n);if(R)return R}let w=n.analyzeNested(y,p);if(w)return w;if(u)return Vt(n);return null}let v=ot(q(l));if(v.kind==="dynamic"||v.kind==="literal"&&G(v.source))return Vt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=Vt(n);if(E)return E;let b=g();if(b)return b;if(i)return null;let w=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return Re(n.budget,xa(w)),ye(w,(R)=>n.analyzeNested(R,p))}if(u||a)return Vt(n)??g();return null}if(e.head==="rm"&&$e(l)){if(i&&o.length>0)return Re(n.budget,Xo(l,o,"rm")),ye(o,(y)=>Ea(l.map((v)=>_a(v,y)),e.cwd,r));if(o.length>0)return Re(n.budget,Tf(l,o)),ye(o,(y)=>Ea([...l,...y],e.cwd,r));let g=Ea(l.flatMap((y,v)=>{if(v===0||!G(y))return[y];return y.startsWith("-")?[_a(y,[""])]:[]}),e.cwd,r);if(g)return g;return Pf(n)}Re(n.budget,i&&o.length>0?Xo(l,o,"generic"):o.length>0?Tf(l,o):Wf(l));let h=o.length>0?o:[void 0];return ye(h,(g)=>{let y=g===void 0?l:i?l.map((Y)=>vt(Y,g)):[...l,...g],v=C("parallel.shell-dynamic",Cr),E=a&&e.head==="find"?HR(y,r):null,b=Df(y,a,n.policy?.rules??[],n.budget)??E?.customResult??null,w=L(e.head),R=a&&(w==="rm"&&wa(y)||w==="xargs"&&Lf(y)||E?.rmOptions===!0),P=a&&(R||E?.executedSource===!0||E===null&&Nf(y,w)),K=n.analyzeChild(y,{...va(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:b!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",yr)});if(P){let Y=T(v,n.policy);if(Y)return Y}return K??b??ze(y,n.policy?.rules??[])})}function va(e,t){return{producer:"parallel",cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Nf(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return BR(e);if(t==="git")return GR(e);if(t==="find")return!0;if(we.has(t))return wf(e,OR,ur);if(Me(t))return wf(e,MR,So);return!1}function wa(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||Bf(o)))}function GR(e){if(zR(e))return!0;let t=Ue(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function zR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function BR(e){if(rt(e))return!1;let t=nt(e);if(t!==null)return G(t);let n=ot(q(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function wf(e,t,n){let r=n(e);if(r.some((i)=>G(i.value)))return!0;if(!e.some(G))return n([...e,_f]).some((i)=>i.value===_f);let o=new Set(r.map((i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`));return t.some((i)=>n(e.map((s)=>vt(s,[i]))).some((s)=>!o.has(`${s.tokenIndex}\x00${s.kind}\x00${s.value}`)))}function Df(e,t,n,r){if(!t||n.length===0)return null;let o=n.filter((s)=>L(s.command)===L(e[0]??""));if(o.length===0)return null;let i=e.some(G);if(Re(r,$R(e,o,i)),!i)return ye(o,(s)=>ze([...e,...s.subcommand?[s.subcommand]:[],...s.block_args],[s]));return ye(o,(s)=>{let a=new Set([s.subcommand,...s.block_args].flatMap((l)=>l?UR(e,l):[]));return ye(a,(l)=>ze(e.map((c)=>vt(c,[l])),[s]))})}function $R(e,t,n){let r=n?qt(Ie(t.map((o)=>o.block_args.length+(o.subcommand?1:0)),A.parallelChildAnalyses.cap),2*Math.max(e.length,1),A.parallelChildAnalyses.cap):t.length;return{childAnalyses:r,derivedTokens:qt(r,e.length,A.parallelDerivedTokens.cap)}}function UR(e,t){return e.flatMap((n)=>{let r=[...n.matchAll(/\{[^{}\s]*\}/g)];if(r.length!==1)return[];let o=r[0];if(!o||o.index===void 0)return[];let i=n.slice(0,o.index),s=n.slice(o.index+o[0].length);if(!t.startsWith(i)||!t.endsWith(s))return[t];let a=t.slice(i.length,t.length-s.length);return a!==t?[t,a]:[t]})}function HR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of Be(i,t))n.executedSource||=Nf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&wa(a.tokens)||a.head==="xargs"&&Lf(a.tokens),n.customResult??=Df(a.tokens,!0,t.policy?.rules??[],t.budget)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(tt(a)){i=[],n.executedSource||=G(a);continue}let l=Ct(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function Lf(e){let t=e.slice(jt(e).childStart);return L(t[0]??"")==="rm"&&wa(t)}function Jo(e,t){return(n)=>T(C(e,t),n.policy)}var Vt=Jo("parallel.shell-dynamic",Cr),jR=Jo("parallel.command-stream-dynamic",TR),Kt=Jo("parallel.command-stream-dynamic",IR),Pf=Jo("parallel.rm-recursive-force-dynamic",yr);function Ea(e,t,n){return T(jo(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:zt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function xa(e){return{childAnalyses:e.length,derivedTokens:e.length,derivedBytes:Sr(e)}}function Af(e){return Wf([e])}function Wf(e){return{childAnalyses:1,derivedTokens:e.length,derivedBytes:Sr(e)}}function Tf(e,t){if(t.length>A.parallelChildAnalyses.cap)return{childAnalyses:t.length};return{childAnalyses:t.length,derivedTokens:Ie(t.map((n)=>e.length+n.length),A.parallelDerivedTokens.cap),derivedBytes:Ie([qt(Sr(e),t.length,A.parallelDerivedBytes.cap),Ie(t.map((n)=>Sr(n)),A.parallelDerivedBytes.cap)],A.parallelDerivedBytes.cap)}}function If(e,t){return Xo([e],t,"generic")}function Xo(e,t,n){if(t.length>A.parallelChildAnalyses.cap)return{childAnalyses:t.length};let r=qt(e.length,t.length,A.parallelDerivedTokens.cap);if(r>A.parallelDerivedTokens.cap)return{childAnalyses:t.length,derivedTokens:r};let o=qR(e.map((l)=>KR(l,n))),i=qt(o.occurrences,t.length,A.parallelPlaceholderReplacements.cap);if(i>A.parallelPlaceholderReplacements.cap)return{childAnalyses:t.length,derivedTokens:r,placeholderReplacements:i};if(VR(o,t,i))return{childAnalyses:t.length,derivedTokens:r,derivedBytes:A.parallelDerivedBytes.cap+1,placeholderReplacements:i};let s=n==="generic"?vt:_a,a=Ie(t.map((l)=>Sr(e.map((c)=>s(c,l)))),A.parallelDerivedBytes.cap);return{childAnalyses:t.length,derivedTokens:r,derivedBytes:a,placeholderReplacements:i}}function VR(e,t,n){let r=A.parallelDerivedBytes.cap+4*n;return Ie([qt(e.fixedBytes,t.length,r),qt(e.occurrences,Ie(t.map((o)=>o.reduce((i,s)=>Math.max(i,hr(s)),0)),r),r)],r)>r}function KR(e,t){let n=t==="generic"?e.matchAll(/\{[^{}\s]*\}/g):e.matchAll(kf),r=0,o=0,i=0;for(let s of n){if(r>=A.parallelPlaceholderReplacements.cap)return{occurrences:A.parallelPlaceholderReplacements.cap+1,fixedBytes:0};o=Ie([o,hr(e.slice(i,s.index))],Ra),r++,i=s.index+s[0].length}return{occurrences:r,fixedBytes:r===0?hr(e):Ie([o,hr(e.slice(i))],Ra)}}function qR(e){return{occurrences:Ie(e.map((t)=>t.occurrences),A.parallelPlaceholderReplacements.cap),fixedBytes:Ie(e.map((t)=>t.fixedBytes),Ra)}}function Sr(e,t=A.parallelDerivedBytes.cap){return Ie(e.map(hr),t)}function hr(e){return WR.encode(e).byteLength}function Ie(e,t){let n=0;for(let r of e){if(!Number.isSafeInteger(r)||r<0||r>t-n)return t+1;n+=r}return n}function qt(e,t,n){if(!Number.isSafeInteger(e)||!Number.isSafeInteger(t)||e<0||t<0||e!==0&&t>Math.floor(n/e))return n+1;return e*t}function Ff(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function vt(e,t){return e.replace(/\{[^{}\s]*\}/g,(n)=>Gf(n,t))}function _a(e,t){return e.replace(kf,(n)=>Gf(n,t))}function Gf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n),o=r>0?r-1:t.length+r;return t[o]??""}function G(e){return kR.test(e)}function zf(e){if(Pa(e))return!0;for(let t of e.matchAll(/\{[^{}\s]*\}/g))if(!/^(?:\{\}|\{-?\d+\})$/.test(t[0]))return!0;return!1}function Pa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Bf(e){return/^\{[^{}\s]*\}$/.test(e)}function $f(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a=!1,l,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=oa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=oa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){a=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||DR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(xf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=xf.has(p)?2:1;continue}if(LR.has(y)){let E=v??h;if(E===void 0||E===":::"||E==="--"){c=!0,t++;continue}l=E,c||=v!==void 0&&E==="",t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(NR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(a?Pa:zf);let d=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){d.push(p),p=[];continue}if(g!==void 0)p.push(g)}d.push(p)}let f=ZR(d),u=n.some(G),m=n.length===0&&o===-1;return{template:n,jobs:f,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:l,dryRun:a}}function YR(e,t,n){if(e===void 0)return;if(e==="..."||/[{}$`*?~[]/.test(e))return null;if(!t&&!AR(e))return null;try{return mt(t??e,e,n)}catch{return null}}function ZR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let n of e){if(n.length===1){let o=n[0];if(o===void 0)return[];for(let i of t)i.push(o);continue}let r=[];for(let o of t)for(let i of n)if(r.push([...o,i]),r.length>A.parallelChildAnalyses.cap)return r;t=r}return t}function Uf(e){return $f(e).childStart}var XR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",Qo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ta(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Aa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function jf(e,t,n,r,o=!1,i){let a=(Hn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&Q(i,"shell.dynamic-executable",o)?C("shell.dynamic-executable",XR):null;return T(a,i)??Vf(e,t,n,o,i)}function Vf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ta(a)?[l]:[]);if(i.length===0)return null;let s=L(t[0]?.text??"");if(s==="git"){let a=pn(e,t),l=QR(a);if(Q(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return T(C("shell.dynamic-structure",Qo),o);if(T(Ho(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((f,u)=>u>l&&_(f)==="--");if(Q(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((f)=>f>l&&(d===-1||f<d)))return T(C("shell.dynamic-structure",Qo),o);return null}if(s==="find")return Q(o,"shell.dynamic-structure",r)&&ex(t)?T(C("shell.dynamic-structure",Qo),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&_(c)==="--"),l=$e(t.map(_));return Q(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(C("shell.dynamic-structure",Qo),o):null}if(s==="xargs")return Hf(e,t.slice(jt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return Hf(e,t.slice(Uf(t.map(_))),"parallel",n,r,o);return null}function Hf(e,t,n,r,o,i){if(t.length===0)return null;let s=JR(t,r);if(Hn(e,s)){let l=T(C(`${n}.shell-dynamic`,n==="xargs"?Sa:Cr),i);if(l)return l}let a=Vf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ta(l)&&Aa(l)))return T(C(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ca:yr),i);return null}function JR(e,t){let n=Wt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function QR(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(le.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function ex(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ta(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Aa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Aa(s)))return!0;continue}if(t=!0,a)return!0;let l=Ct(s.text);if(l>0){n=l;continue}if(tt(s.text))o=!0,r=!0}return!1}function Ia(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!go(t[n.tokenIndex],n.value)})}var tx="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",nx="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",rx="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Kf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return C("dd.device-write",tx);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return C("mkfs.device",nx);if(e==="shred"&&n.length>0)return C("shred.target",rx);return null}var Yf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Ho(e.words,ka(e))},{heads:new Set(["find"]),analyze:(e)=>Bd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:yt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Sf(e.words,{...qf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Mf(e.words,{...qf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Yt(e.options.analyzeNested(t,n))})}];function qf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy,scanWork:e.options.scanWork}}function Yt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function ka(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var Qf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function em(e){return Yf.find((t)=>t.heads.has(e))?.analyze}function xn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((k)=>o==="posix"?_(k):k.text),s=n.child,a=s!==void 0&&s.producer!=="unknown-head",l=s?.producer==="unknown-head",c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,u=_o(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=Wt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let x=[...p,...i(m.words)].join(" "),k=Qe(x,n.scanWork);if(k)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:k.reason}),fe(k);if(n.strict)return Ce(r);let D=wo(p,i(m.words));if(D){n.budget.charge("derivedTokens",D.length);let ne=n.analyzeNested(D.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(ne)return ne}}let h=m.rewritten?q(i(m.words)):pn(o,m.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),E=g[0];if(!E)return null;if($t(E))throw new F("wrapperPeelIterations");let b=L(E),w=m.cwd===null?void 0:m.cwd??d,R=m.cwd===null?void 0:f,P=m.cwd===void 0?n.effectiveCwd:m.cwd,K=s?s.allowTmpdirVar:!ar(v,n.environment),Y=jf(o,m.words,n.environment,t===0,n.strict,n.policy);if(Y)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Y.reason}),fe(Y);let te=zo(g,n.policy);if(te){for(let x of[te.childIndex,...te.alternativeChildIndices]){Zf(y.wrapperNormalizationBudget);let k=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:te.wrapper,output:i(k)});let D=xn(k,t,{...y,effectiveCwd:P,envAssignments:v});if(D)return D}return null}let X=l?void 0:b==="eval"?Vo(h):b==="trap"&&!a?mf(h):void 0;if(a&&s&&b==="eval"){if(X?.kind==="dynamic")return Rn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(x)return x}return _n(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ha(n.commandView)))return Ce(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(b):nm(E,b)){if(rt(g))return null;if(a&&s){let x=nt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let D=Rn(s,n.policy);if(D)return D}if(gr(x)){let D=Rn(s,n.policy);if(D)return D}return n.analyzeNested(x,{effectiveCwd:P,envAssignments:v})}let k=ot(h);if(k.kind==="dynamic")return Rn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?Rn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Rn(s,n.policy):null}if(l){let x=nt(g),k=x?n.analyzeNested(x,{effectiveCwd:P,envAssignments:v}):ot(h).kind==="dynamic"?Ce(r):null;if(k)return k}if(s===void 0){let x=ax(g,v,P,n,r,t);if(x)return x;let k=nt(g);if(k){let tn=Ko(h,k);if(tn.kind==="dynamic")return Ce(r);let Si=tn.kind==="literal"?tn.source:k,al=lx(Si);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:al}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:al,depth:t+1});let ll=n.analyzeNested(Si,{effectiveCwd:P,envAssignments:v});if(ll)return ll;return gr(Si)?Ce(r):null}let D=ot(h);if(D.kind==="dynamic")return Ce(r);if(D.kind==="literal")return ti(D.source,P,v,n,r,t);let ne=pf(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(ne.kind==="dynamic")return Ce(r);if(ne.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:ne.source,depth:t+1}),n.analyzeNested(ne.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let x=g[1]==="-p"?2:null;if(x!==null){let tn=n.commandView?h[x]:void 0;if(!tn)return null;if(tn.provenance!=="literal")return Ce(r)}let k=x===null?1:3,D=g[k]==="--"?k+1:k,ne=n.commandView?h[D]:void 0;if(!ne)return null;if(ne.provenance==="literal")return ti(ne.text,P,v,n,r,t);if(n.strict||!n.commandView||!ha(n.commandView))return Ce(r)}if(we.has(b)&&!l){if(!s&&n.strict&&Ia(ur(g),h))return Ce(r);let x=Ld(g,(D)=>Yt(n.analyzeNested(D,{effectiveCwd:P,envAssignments:v}))),k=T(x,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),fe(k)}if(Me(b)&&!l){if(!s&&n.strict&&Ia(So(g),h))return Ce(r);let x=Du(g);if(a&&s)return ix(b,x,P,v,n,s);if(x){let k=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:x,paranoidBlocked:k}),k){let ne=T(C("interpreter.one-liner-paranoid",Jn),n.policy);if(ne)return fe(ne)}if(Ds(b,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let D=n.analyzeNested(x,{effectiveCwd:P,envAssignments:v});if(D&&!tm(D,x))return D;if(Qn(x,n.scanWork)){let ne=T(C("interpreter.dangerous-command",yn),n.policy);if(ne)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:yn}),fe(ne)}r=void 0}}if(b==="busybox"&&g.length>1)return Zf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),xn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let N=s?null:T(Kf(b,g),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),fe(N);let oe=r===y.trace?y:{...y,trace:r},_e={words:h,head:b,cwd:w,originalCwd:R,envAssignments:v,allowTmpdirVar:K,dynamicArguments:m.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:oe,analyzeChildTokens:(x,k)=>a&&s?Oa(x,t,oe,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Yt(xn(q(x),t+1,{...oe,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??ze(x,oe.policy.rules),analyzeChild:(x,k)=>Oa(x,t,oe,k)},Ye=s&&(b==="xargs"||b==="parallel")?void 0:em(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,isOverriddenToNonTemp:!K,allowTmpdirVar:K});let ke=r&&b==="git"?tf(_e.words,ka(_e)):void 0,yi=Xf(ke?ke.match:Ye?.(_e)??null,n.policy);if(r)cx(_e,yi,ke?.relaxation??null);if(yi)return fe(yi);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&($e(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?_n(s,n.policy):null)??sx(s,n.policy)}let il=Ye!==void 0,sl=!s&&!il&&!Ur.has(b),Ci=r&&sl?[]:void 0;if(sl)for(let x=1;x<g.length;x++){let k=g[x];if(!k)continue;Ci?.push(k);let D=Xf(ox(g,x,t,oe,w,R,P,v),n.policy);if(D)return r?.recordSegment({type:"fallback-scan",tokensScanned:Ci??[],embeddedCommandFound:L(k)}),fe(D)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Ci??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&il)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let Ar=ze(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ar,reason:Ar?.reason}),Ar)return fe(Ar);return a&&s?_n(s,n.policy):null}function Oa(e,t,n,r){return Yt(xn(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function ox(e,t,n,r,o,i,s,a){for(let l of Be(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=L(c);if(nm(c,d)||em(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=Oa(l.tokens,n,r,{producer:"unknown-head",cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!ar(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function ix(e,t,n,r,o,i){if(!t)return _n(i,o.policy);if(Q(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(C("interpreter.one-liner-paranoid",Jn),o.policy);if(a)return fe(a)}if(Ds(e,t))return _n(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!tm(s,t))return s;if(Qn(t,o.scanWork)){let a=T(C("interpreter.dangerous-command",yn),o.policy);if(a)return fe(a)}return _n(i,o.policy)}function tm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Wo)||e.reason===vn)&&!Hr(t)}function Rn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?fe(n):null}function _n(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?fe(n):null}function sx(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?fe(n):null}function ax(e,t,n,r,o,i){let s=lf(e);if(s.argvSource?.kind==="absent")return Ce(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return Ce(o);let a=Xn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?Ce(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function lx(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function cx(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Zf(e){if(e.iterations>=A.wrapperPeelIterations.cap)throw new F("wrapperPeelIterations");e.iterations++}function fe(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function Ce(e){return e?.recordSegment({type:"error",message:Qf}),fe(ux())}function ux(){return{id:"",reason:Qf,intent:"stop_and_explain"}}function nm(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(I(t))}function Xf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var dx=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,fx=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function mx(e,t){let n=im(e,t);if(n.length===0)return!1;let r=n[om(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return dx.test(e.join(" "))}function rm(e,t,n,r){if(e.dialect==="powershell"){let a=px(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Jf(Cx(a.target),t,n.paths)}let o=e.words.map(_);if(!mx(o,n))return;if(!t)return null;let i=im(o,n,t),s=om(i);if(s===-1||i[s]!=="cd")return null;return Jf(i[s+1],t,n.paths)}function Jf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return Sx(mt(t,e,n),t,n)?t:null}catch{return null}}function px(e,t){let n=gx(e[0])?1:0,r=e[n];if(!hx(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!fx.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return yx(e.slice(n+1),t)}function gx(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function hx(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function yx(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function Cx(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function om(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function im(e,t,n){let r=bx(e);return pt([...r],t,n)}function Sx(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return ei(e)===ei(t);return ei(r)===ei(o)}function bx(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var Na="TMPDIR",Da="IFS",sm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,am=/^[A-Za-z_][A-Za-z0-9_]*$/,lm=new Set(["export","typeset","declare","readonly"]),vx=new Set(["builtin","command","time"]);function cm(e,t){return{env:e,effectiveEnvAssignments:wx(e,t),shellAssignments:new Map}}function um(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function La(e,t){let n=fm(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Wa(t,s)});let r=n.commandIndex;if(r!==-1&&lm.has(e[r]??""))e.filter((s)=>am.test(s)&&Ma(s)).forEach((s)=>{Px(t,s)});let o=r===-1?-1:mm(e,r);if(o===-1||e[o]!=="unset")return;let i=Tx(e,o);if(i===null)return;e.slice(i).forEach((s)=>{Ax(t,s)})}function dm(e,t){let n=fm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function fm(e,t){let n=e.findIndex((s)=>!Ex(s)),r=n!==-1&&lm.has(e[mm(e,n)]??""),o=_x(t);return{assignments:e.flatMap((s,a)=>{let l=Rx(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!Eo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function mm(e,t){let n=t;while(vx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Ex(e){return Ae(e)!==null||sm.test(e)}function Rx(e,t,n){return Ae(e)??xx(e,t,n)}function xx(e,t,n){let r=xo(e,n,t);if(r)return r;let o=e.match(sm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ma(e){return e===Na||e===Da||Fs(e)}function _x(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function wx(e,t){let n=[...vo,Na,Da].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Wa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Px(e,t){Wa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function Ax(e,t){if(!Ma(t)&&!am.test(t))return;if(e.shellAssignments.set(t,""),Eo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ma(t)||t===Na||t===Da||Mn(t)){Wa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Tx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var Ix="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Zt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function $a(e,t,n,r){if(t>=A.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return Ba(e,n);let d=`${Wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Sm(e,n),{reason:vn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Sm(e,n),{reason:vn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote"))&&!n.analyzePartialProgram)return Ba(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=cm(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let d=e.nodes[l+1],f=d?.kind==="connector"?d.operator:void 0,u=kx(e,l,c,a,f),m=a==="&&"||a==="||",p=m?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=m||Pn(f);if(c.kind==="function"){let Y=h.flatMap((X)=>{let z=br(X);return z.functionDefinitions.set(c.name,c.body),Fa(X,[z],u,f==="&",Pn(f))}),te=Ga(Y,[],g,y,a,f);i=te.states,s=te.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Y=[],te=[];for(let z of h){let N=oi(c.body,t,n,r,[br(z)]);if(N.result)return N;if(Y.push(...Fa(z,N.states,u,f==="&",Pn(f))),v)te.push(z,...u?N.states.map((oe)=>ni(z,oe)):N.states)}let X=Ga(Y,te,g,y,a,f);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),b=e.nodes[l-2],w=ii(a)&&b?.kind==="command"?ff(b)??Mx(b):void 0,R=[],P=[];for(let Y of h){let te=Nx(c,t,n,r,[br(Y)]);if(te.result)return{result:te.result,states:i};let X=e.dialect==="powershell"?te.states:te.states.map((z)=>ni(Y,z));for(let z of X){let N=br(z),oe=Wx(c,t,n.trace?{...n,trace:bm(n.trace,E)}:n,r,N,ii(a),w);if(oe)return{result:oe,states:i};let _e=Zx(c,N.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let Ye=_e?t+1>=A.recursionDepth.cap?za(c.displayText,n,[N]):oi(_e,t+1,n,r,[N]):{result:null,states:[N]};if(Ye.result)return Ye;if(R.push(...Fa(Y,Ye.states,u,f==="&",Pn(f))),v)P.push(Y),P.push(...Ye.states.map((ke)=>u?ni(Y,ke):ke))}}let K=Ga(R,P,g,y,a,f);i=K.states,s=K.conditionalStates,a=void 0}return{result:null,states:i}}function kx(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&Ox(e,t)}function Fa(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>wn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function Ox(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(Dx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function Mx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Pn(e){return e==="&&"||e==="||"}function Ga(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=Pn(i)?s:void 0;return{states:Pn(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function bm(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function Nx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=Lx(e);if(s){if(t+1>=A.recursionDepth.cap)return za(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return za(s,n,o);if(a.status!=="complete")return pm(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return pm(i,n,r,o)}function Dx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function pm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[br(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function Lx(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function za(e,t,n){return t.trace?.recordSegment({type:"error",message:je}),{result:{reason:je,segment:e,intent:"stop_and_explain"},states:[...n]}}function Wx(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=Hx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};vm(e,o,"before-consumer",a.environment.paths,a.budget);let c=pn(e.dialect,e.words).map(_),d=e.displayText,f=dm(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=T(Ad(e,i,Jx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return Xx(d,p)}if(c.length===1&&c[0]?.includes(" ")&&!Hn(e.dialect,e.words)){let p=T(Qe(c[0],a.scanWork),a.policy),h=p!==null&&!a.strict&&Iu(e,a.rootProgram,a.scanWork);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:d,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=gm(e,l,o,f,s,a);if(g)return g;return La(c,o.shellGitContextState),null}let u=xn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=$a(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?bm(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:d};let m=gm(e,l,o,f,s,a);if(m)return m;return La(c,o.shellGitContextState),null}function gm(e,t,n,r,o,i){let s=jx(e,t,n,r??new Map,i);if(s)return s;return vm(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),zx(e,t,n,i.environment.paths,i.budget),qx(e,n,o,i.environment,i.trace),null}var Fx=new Set([">>","<>"]);function vm(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?Gx(s):Fx.has(s.operator)))continue;hm(s.target,t,r,o)}if(n!=="before-consumer"||!xe(e.words[0],"tee"))return;let i=Em(e.words.slice(1));if(!i)return;for(let s of i.operands)hm(s,t,r,o)}function Gx(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function hm(e,t,n,r){let o=e?.provenance==="literal"?Xn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function zx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!ai(i))return;for(let s of Bx(e)){let a=Xn(s.text,n.effectiveCwd,r,o);if(!a||!Mu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=A.trackedHeredocFiles.cap)throw new F("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function Bx(e){let t=Ux(e.redirections)?.target,n=ym(t)?[t]:[];if(xe(e.words[0],"cat"))return $x(e.words)?n:[];if(!xe(e.words[0],"tee"))return[];let r=Em(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(ym))return[];return[...r.operands,...n]}function $x(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function Ux(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Em(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&xe(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function ym(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function xe(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function ai(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function Hx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Zt;let n=t[0];if(!n?.heredoc)return Zt;if(!ai(n.heredoc))return Ix;if(n.fd!==void 0&&n.fd!==0)return Zt;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Zt;let r=e.redirections.some((s)=>s!==n&&Cm(s.target));if(xe(e.words[0],"cat"))return r?Zt:void 0;if(xe(e.words[0],"tee"))return r||e.words.slice(1).some(Cm)?Zt:void 0;let o=e.words[0],i=e.words[1];if(xe(o,"git")&&(xe(i,"apply")||xe(i,"commit")))return;if(xe(o,"gh")&&(xe(i,"pr")||xe(i,"issue"))&&xe(e.words[2],"create"))return;return Zt}function Cm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function jx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(Kx(e,i,n,r,o))return null;let a=Vx(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ba(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function Vx(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!ai(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!Me(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=Q(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=T(C("interpreter.one-liner-paranoid",Jn),n.policy);if(c)return c}if(!Qn(s,n.scanWork))return null;let l=T(C("interpreter.dangerous-command",yn),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function Kx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!ai(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=L(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(I(l)))return!1;return rt(a)}function qx(e,t,n,r,o){let i=rm(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function br(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:um(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>Yx(r,n)))t.push(n);if(t.length>A.controlFlowStates.cap)throw new F("controlFlowStates")}return t}function Yx(e,t){return e.effectiveCwd===t.effectiveCwd&&wn(e.shellGitContextState.env,t.shellGitContextState.env)&&wn(e.literalHeredocFiles,t.literalHeredocFiles)&&wn(e.functionDefinitions,t.functionDefinitions)&&wn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&wn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function wn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Zx(e,t){let n=jn(e);return n===void 0?void 0:t.get(n)}function Xx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Jx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ba(e,t){let n=T(Qe(e,t.scanWork),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Sm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:vn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var Qx=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape","parallelChildAnalyses","parallelDerivedTokens","parallelDerivedBytes","parallelPlaceholderReplacements"]);function Rm(e,t,n,r){let o=$a(e,0,{...t,...Jc(t),budget:t.budget??Se(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:[{kind:"command",command:e,segment:o.segment}]}}function xm(e,t,n){try{return{decision:e()}}catch(r){let o=e_(r,t,n);if(!o)throw r;return o}}function e_(e,t,n){if(!(e instanceof F)||!Qx.has(e.kind))return null;let r=A[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:[{kind:"command",command:t,segment:t}]},errorCode:r.errorCode}}var t_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Ha=new Set(["cc-safety-net","ccsn"]),n_=new Set(["bunx","npx","pnpx"]),r_=new Set(["pnpm","yarn"]),o_=new Set(["npm","pnpm","yarn"]),i_=new Set(["bun","node"]);function ci(e,t,n={}){if(Ha.has(e))return 0;if(n_.has(e)){if(n.broad)return Ua(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return li(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&o_.has(e)&&n.broad&&t[r]==="exec"){let o=Ua(t.slice(r+1));return o===null?null:r+1+o}if(r_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&li(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ua(t.slice(r+1));return o===null?null:r+1+o}if(i_.has(e)){let o=n.broad&&r!==-1?r:0;if(_m(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&_m(t[o+1]))return o+2}return null}function Ua(e){let t=e.findIndex((r)=>li(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!li(r))break;n++}return n}function li(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Ha.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Ha.has(e.slice(0,t))}function _m(e){let t=e?.replaceAll("\\","/");return[...t_].some((n)=>t===n||t?.endsWith(`/${n}`))}var wm="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Pm(e,t,n){let r=ue(e,"input-candidate");if(!r)return null;let o=Sn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>s_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function s_(e,t){let n=pt([...e],t),r=n.slice(1),o=ci(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ui}from"node:path";var km="This path contains the protected policy config and you must not modify or delete it.",a_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Om(e,t,n){let r=m_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Am(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ue(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Tm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Tm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Am(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Lr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Am(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>vr(a,n,r,o,i));return s?{target:s}:null}function Tm(e,t,n,r,o){let i=Sn(e,t,r,o,{findSegmentTarget:(s,a)=>l_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>vr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>f_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function l_(e,t,n,r,o){if(or(e))return null;let i=gt([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&c_(a)){let l=u_(a).find((c)=>Im(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Uo(i,1)||sa(i,r)){let c=($o(q(i))??q(["."])).find((d)=>{let f=ge(d.text,t.variables);return vr(f,t.cwd,n,r,o)||Im(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Oo(a).sources.find((c)=>p_(ge(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(d_(e,r))return null;for(let l of[...e,...i])for(let c of Mm(l))if(vr(ge(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function c_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function u_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function d_(e,t){let n=gt([...e],t);if(n.length===0)return!1;let r=I(n[0]??"").toLowerCase();if(!a_.has(r))return!1;if(r!=="sed")return!0;return!n.slice(1).some((o)=>o.startsWith("-i")||o==="--in-place"||o.startsWith("--in-place="))}function f_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Mm(i))if(vr(s,t,n,r,o))return{target:s};return null}function Mm(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function m_(e,t,n){let r=(a)=>Er(ie(a,e.executionCwd,t,n)),o=r(ln(t)),i=[r(Gn(e.executionCwd)),r(Gn(e.configCwd))],s=new Set(i.map((a)=>ui(a)));for(let a=ui(o);;a=ui(a))if(s.add(a),ui(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function vr(e,t,n,r,o){let i=yl(e,t,r,o,(s)=>Er(s)===Br);return i!==null&&n.files.has(Er(i))}function Im(e,t,n,r,o){return n.directoriesAndAncestors.has(Er(ie(e,t,r,o)))}function p_(e,t,n,r,o){let i=Er(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Er(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as di,posix as g_,resolve as mi,win32 as h_}from"node:path";import{fileURLToPath as y_}from"node:url";var Hm="Access to a sensitive path is not allowed.",jm=new Set(["echo","printf"]),C_=new Set(["find"]),S_=new Set(["-exec","-execdir"]),b_=new Set([";","+"]),v_=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),E_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Vm=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),R_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),x_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Km=new Set(["-c","-e","-r","-E","--eval","--exec"]),__=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),w_=new Set(["grep","rg"]),Nm=new Set(["jq","gojq","jaq"]),Dm="f",Lm="file",P_="files",A_=new Set(["e","f"]),T_=new Set(["regexp","file"]),I_=new Set(["e","f","A","B","C","m"]),k_=new Set(["regexp","file","after-context","before-context","context","max-count"]),ja="__CC_SAFETY_NET_PIPE_INPUT__",Ka=/[\w./~@+-]*[./~][\w./~@+-]*/g,O_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,M_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,N_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,D_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,L_=/\b(?:system|exec)\s*$/,W_=/\b(?:eval|exec)\s*\(/g,F_=/\b(?:eval|exec)\s*$/,G_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Wm(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Lw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Nw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&Ww(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function qm(e,t,n,r,o={}){let i=Fm(e,n,r),s=Wm(i,t,e.invocation.context.configCwd,n,r),a=s?.ruleId!=="secret.deny-path"&&o.strict===!1?Fm(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:Wm(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&z_(e,n))return null;return l}function z_(e,t){let n=ue(e,"input-candidate")??ue(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of ko(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(et(a.text,t))}let o=Et(r);if(o.length===0)return!1;let i=at(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>v_.has(a))}function Fm(e,t,n,r={}){let o=e.invocation.context.executionCwd;if(e.invocation.route.kind==="command"){let s=ue(e,"input-candidate");return s?Xt(s.shell,e.store,r,t,o,n,Gm(s)):[]}if(e.invocation.route.kind!=="unknown")return e.paths.map((s)=>({target:s,cwd:o}));let i=ue(e,"input-candidate");return[...i?Xt(i.shell,e.store,r,t,o,n,Gm(i)):[],...e.paths.map((s)=>({target:s,cwd:o}))]}function Gm(e){return e.program.dialect==="powershell"}function Xt(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...hw(et(e.source,r),t,n,r,o,i)],l=(c)=>et(X_(c,s),r);return Io(e,o,r,i,{word:l,segment:(c,d,f,u,m)=>{if(c.length===0)return null;if(a.push(...pi(c,t,n,r,d.cwd,i,m)),f!==null)a.push(...$_(f,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Ym(c.consumer,[c.body],t,n,r,d.cwd,i,(f)=>U_(c.consumer??[],f,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return $s;return a.push({target:l(c.target),cwd:d.cwd}),null}}),a}function qa(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Xt(s,t,n,r,o,i):null}function pi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(Nm.has(at(Et(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...pi(p,t,n,r,o,i)]}let l=Z_(e).map(a),c=Et(e);if(c.length===0)return l;let d=c[0]??"",f=at(d).toLowerCase(),u=c.slice(1),m=B_(d,f,u);if(m)return[...l,...m.map(a)];if(jm.has(f))return n.capturedOutput===!0?[...l,...Zm(e).map(a)]:l;if(f==="eval")return[...l,...qa(u.join(" "),t,n,r,o,i)??u.map(a)];if(f==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:st(f,p)).map(a)];if(f==="git")return[...l,...Q_(u).map(a)];if(Nm.has(f))return[...l,...J_(u).map(a)];if(w_.has(f))return[...l,...xw(u).map(a)];if(C_.has(f))return[...l,...rw(u,t,n,r,o,i).map(a)];if(we.has(f))return[...l,...u.flatMap((p)=>st("awk",p)).map(a),...u.flatMap((p)=>iw(p,t,n,r,o,i)),...u.flatMap(sw).map(a)];if(f==="curl")return[...l,...u.flatMap((p)=>st(f,p)).map(a),...ew(u).map(a)];if(ir(f)){let p=rr.has(f)?cc(f,u):null;if(p!==null){let h=t.getShellSyntax(p);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Xt(h,t,n,r,o,i),...u.slice(u.indexOf(p)+1).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...ow(f,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>st(f,p)).map(a)]}function B_(e,t,n){let r=ci(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function $_(e,t,n,r,o,i,s){if(K_(t,n,r,o,i,s))return Zm(e).map((a)=>({target:a,cwd:i}));return Ym(t,H_(e),n,r,o,i,s,()=>[])}function U_(e,t,n,r,o,i,s){let a=Et(e);if(!ir(at(a[0]??"").toLowerCase()))return[];return qa(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Ym(e,t,n,r,o,i,s,a){let l=q_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>rr.has(l)?Xt(n.getShellSyntax(c),n,r,o,i,s):fi(l,c,n,r,o,i,s))}function Zm(e){let t=Et(e);if(t.length===0)return[];let n=at(t[0]??"").toLowerCase();if(!jm.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ya(r.replaceAll("%%","%"))];return t.slice(1)}function H_(e){let t=Et(e);if(t.length===0)return[];let n=at(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return j_(r);return[]}function j_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ya(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>V_(t,r.slice(i*n,(i+1)*n)))}function V_(e,t){let n=0;return Ya(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ya(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function K_(e,t,n,r,o,i){let s=Et(e);if(s.length===0||at(s[0]??"").toLowerCase()!=="xargs")return!1;let a=jt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,ja]:l.map((f)=>f.split(c).join(ja));return pi(d,t,n,r,o,i).some((f)=>f.target.includes(ja))}function q_(e){let t=Et(e);if(t.length===0)return null;let n=at(t[0]??"").toLowerCase();if(!ir(n))return null;return Y_(n,t.slice(1))?n:null}function Y_(e,t){let n=Za(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Km.has(o)||Xm(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(G_.get(n)?.has(o))r++;continue}return!1}return!0}function Za(e){return/^python\d/.test(e)?"python":e}function Z_(e){let t=[];for(let n of e){if(Qm(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var zm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function X_(e,t){if(!t||!zm.test(e))return e;return`~${e.replace(zm,"").replace(/\\/g,"/")}`}function st(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function J_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>st("jq",i))}return e.flatMap((r,o)=>o===t?[]:st("jq",r))}function Q_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>st("git",i))];if(t.push(...st("git",r)),!le.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:st("git",o)),n++}return t}function ew(e){return e.flatMap((t,n)=>{let r=nw(t);if(r!==null)return Bm(r.flag,r.value);let o=tw(e[n-1]);return o===null?[]:Bm(o,t)})}function Bm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Va(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Va(t.slice(n+1))}return t.startsWith("@")?Va(t.slice(1)):[]}function tw(e){if(e===void 0)return null;if(Vm.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function nw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Vm.has(r)?{flag:r,value:e.slice(n+1)}:null}function Va(e){return e===""||e==="-"?[]:[e]}function rw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!S_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((m)=>b_.has(m)),f=d===-1?c:c.slice(0,d),u=pi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,h)=>{if(!E_.has(m))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function ow(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Km.has(c)||Xm(e,c)){let f=t[l+1];if(f!==void 0)a.push(...fi(e,f,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...fi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Xm(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return __.get(t[t.length-1]??"")?.has(Za(e))??!1}function iw(e,t,n,r,o,i){if(!e.includes("system"))return[];return na(e)?.commands.flatMap((s)=>Xt(t.getShellSyntax(s),t,n,r,o,i))??[]}function sw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function aw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(Ka)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Xa),...n]}function fi(e,t,n,r,o,i,s){let a=(m)=>({target:m,cwd:i}),l=cw(t,lw(e));if(l===null)return aw(t).map(a);let c=l.masked.match(D_)!==null||l.literals.some((m)=>L_.test(l.masked.slice(0,m.start))),d=l.masked.match(W_)!==null||l.literals.some((m)=>F_.test(l.masked.slice(0,m.start))),f=r.refineInlineData===!0&&!rr.has(e),u=f&&!(mw(l.masked)||c||d)?[]:l.literals;return[...u.map((m)=>m.text).filter((m)=>m!=="").map(a),...u.flatMap((m)=>Xa(m.text)).map(a),...f?[]:l.literals.flatMap((m)=>m.text.match(Ka)??[]).filter((m)=>m!=="process.versions.sqlite").map(a),...c?l.literals.flatMap((m)=>qa(m.text,n,r,o,i,s)??[a(m.text)]):[],...d?l.literals.flatMap((m)=>fi(e,m.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
-`:h),n,r,o,i,s)):[],...(l.masked.match(Ka)??[]).filter((m)=>m!=="process.versions.sqlite").map(a)]}function lw(e){let t=Za(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function cw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(M_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&fw(e,o))return null;let a=t==="python"?uw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=dw(e,c,l);if(d===null)return null;let f=e.slice(c,d);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&N_.test(f))return null;r.push({start:c,text:f});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{masked:n.join(""),literals:r}}function uw(e,t){return O_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function dw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function fw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function mw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(R_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>x_.has(i)))continue;if(o.length>1)return!0;if(pw(e,r)===".")return!0;if(gw(e,r+n.length)==="(")return!0}return!1}function pw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function gw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function hw(e,t,n,r,o,i){return vw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Xt(a,t,{...n,capturedOutput:!0},r,o,i),...yw(a,r)?Cw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function yw(e,t){let n=ko(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||at(et(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=et(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Cw(e,t){return ko(e).flatMap((n)=>n.kind==="word"?[et(n.text,t)]:n.kind==="redirection"&&n.target?[et(n.target,t)]:[]).flatMap(Xa)}function Xa(e){let t=bw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Sw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Sw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function bw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function vw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(zn(o,n))continue;if(Jm(e,r,n)){let i=Ew(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Rw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Ew(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(zn(i,n))continue;if(Jm(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Rw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Jm(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function xw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let f=d[1]??"",u=d[2];if(f===P_)o=!0;if(T_.has(f))r=!0;if(u!==void 0){if(f===Lm)t.push(u);continue}if(k_.has(f)){let m=e[l+1];if(f===Lm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),u="",m="";for(let h=0;h<f.length;h++){let g=f[h]??"";if(A_.has(g))r=!0;if(I_.has(g)){u=g,m=f.slice(h+1);break}}if(u==="")continue;if(m.length>0){if(u===Dm)t.push(m);continue}let p=e[l+1];if(u===Dm&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Et(e){let t=e.findIndex((n)=>!Qm(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Qm(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var _w=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),ww=".env.",Pw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Aw=[".env.example.",".env.sample."];function Tw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Iw(e){return e.length>0&&!/\s/.test(e)}function kw(e,t,n,r){try{let o=_r(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof F)throw o;return!1}}var Ow=new Set(["node_modules","__pycache__"]),Mw=[["vendor","bundle"],["vendor","cache"]];function Nw(e,t,n,r,o){if(Tw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>Iw(s)||kw(e,t,r,o);if(Pw.has(s)||Aw.some((u)=>s.startsWith(u)))return null;let c=H(zw(e,t,r,o));for(let u of Qi){let m=`~/${u.suffixParts.join("/")}`;if((Um(a,m)||Um(c,m))&&it(u.id,n))return u.id}let d=Dw(i,t,n,r,o);if(d)return d;if(_w.has(s))return null;for(let u of Ji)if(s===u.basename&&it(u.id,n))return u.id;if(s.startsWith(ww)&&it(qr.id,n)&&l())return qr.id;for(let u of es)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&it(u.id,n)&&l())return u.id}for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&it(u.id,n))return u.id}if(Fw(a))return null;if(!s.includes(".")&&Bn.pattern.test(s)&&it(Bn.id,n))return Bn.id;let f=Gw(s,n);if(f)return f;return null}function Dw(e,t,n,r,o){return Yr.find((i)=>{if(!it(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||xr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Rr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?xr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Rr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Rr(e,s,["credentials"])||Rr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>xr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?U(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?xr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,qe(d,t,r,o),l))}case"secret.cli.pi":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Rr(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(qe("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?xr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(U(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&Jt(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var $m=new WeakMap;function U(e,t,n,r,o){let i=$m.get(o)??new Map;$m.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>ep(e,ae(t,r)))}function Rr(e,t,n){return n.some((r)=>Jt(H(e),H(ae(t,r))))}function xr(e,t,n,r,o){return ep(e,qe(t,n,r,o))}function ep(e,t){return H(e)===H(t)}function ae(e,...t){return He([e,...t].filter(Boolean).join("/"))}function Lw(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(_r(e,t,o,i));return n.some((a)=>Jt(s,H(_r(a,r,o,i))))}function Ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(_r(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(B(be(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),f=H(d?He(B(mi(be(d)),o.paths,i)):l&&He(B(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Jt(s,f))return!1;return n.some((u)=>{let m=H(_r(u,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return Jt(s,m)})}function Fw(e){let t=e.split("/");return t.some((n)=>Ow.has(n))||Mw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Gw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ns)if(r===o.extension&&it(o.id,t))return o.id;for(let o of rs)if(o.pattern.test(r)&&it(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function it(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i)return"";if(!o)return i;let s=Qa(i,o),a=di(s)?s:He(mi(t,s)),l=He(B(a,n.paths,r));if(!Jt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Um(e,t){return e===t||e.startsWith(`${t}/`)}function zw(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i||!o)return"";let s=Qa(i,o),a=g_.normalize(di(s)?s:He(mi(t,s))),l=He(be(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let f=a.slice(d.length);return f?`~${f}`:"~"}function _r(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i)return"";let s=o?Qa(i,o):i;return He(B(di(s)?s:mi(t,s),n.paths,r))}function Ja(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(B(be(r),t.paths,n)):"",i=He(be(Bw(et(e,t))));return{home:o,normalized:i}}function Bw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return y_(e)}catch{return e}}function Qa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function $w(e){if(process.platform==="win32")return!0;return h_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&$w(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function at(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Uw={findPolicyMutation:Om,findGitMetadataMutation:cd,resolveGitMetadata:Hw,loadPolicySnapshot:Xc,findSensitiveTarget:qm,analyzeCommand:Rm,getModes:Ti};function tp(e,t){let n={...Uw,...t.dependencies},r=Kw(e),o=wr(e)?e.command:r,i=Rt("policy-protection",o,()=>sr(e,t.factParserDependencies)),s=ue(i,"input-candidate"),a=ue(i,"declared-command");if(wr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Td,intent:"stop_and_explain",evidence:[]}};let l=Se(),c=Rt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=Rt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:km,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let f=Rt("policy-protection",o,()=>Pm(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:wm,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:f.target}]}}}let u=Rt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let m=Rt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...jw(m)},y=p.secretProtection.enabled===!1?null:Rt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:wr(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Hm,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!wr(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...el("command-validation",o),...g};let v=Rt("command-analysis",o,()=>xm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Vw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Hw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function jw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Vw(e){return ue(e,"declared-command")?.program}function Kw(e){try{return Ln(e.input)}catch(t){let n=wr(e)?e.command:void 0;throw new Qt("policy-protection",el("policy-protection",t instanceof Ze?void 0:n,t),t)}}function Rt(e,t,n){try{return n()}catch(r){throw new Qt(e,el(e,r instanceof Ze?void 0:t,r),r)}}function el(e,t,n){let r=n instanceof F||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?vi:Tn,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function wr(e){return e.route.kind==="command"}import{appendFileSync as sP,mkdirSync as aP}from"node:fs";import{isAbsolute as lP,join as rl}from"node:path";import{lstatSync as rp,readdirSync as qw,readFileSync as Yw,rmdirSync as Zw,statSync as op,unlinkSync as Xw,utimesSync as Jw,writeFileSync as Qw}from"node:fs";import{join as Pr}from"node:path";function np(e,t={}){return to(ln(e,t),e.home).policy.audit.retention_days}var nl=86400000,eP=".last-prune",tP=/^\d{4}-\d{2}$/,nP=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,ip=(e)=>Math.floor(e/nl);function ap(e,t,n=()=>new Date){try{let r=n().getTime();if(!op(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Pr(t,eP),i=op(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&ip(i)===ip(r))return;let s=r-np(e)*nl,a=new Date(r).toISOString().slice(0,7);for(let l of tl(t)){if(l.isDirectory()){rP(Pr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))oP(Pr(t,l.name),s)}Qw(o,"",{mode:384}),Jw(o,r/1000,r/1000)}catch{}}function rP(e,t,n){for(let r of tl(e)){if(!r.isDirectory()||!tP.test(r.name))continue;let o=Pr(e,r.name);for(let i of tl(o)){if(!i.isFile())continue;let s=nP.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+nl;if(!Number.isFinite(a)||a>=t)continue;lp(Pr(o,i.name))}if(r.name!==n)sp(o)}sp(e)}function oP(e,t){try{let n=rp(e);if(n.mtimeMs>=t)return;let r=Yw(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(iP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(rp(e).mtimeMs!==n.mtimeMs)return;lp(e)}catch{}}function iP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function tl(e){try{return qw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function lp(e){try{Xw(e)}catch{}}function sp(e){try{Zw(e)}catch{}}var cP="2.4.1",uP=1e4,dP=2000,fP=256,mP=32768;function pP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function gP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function ol(e,t,n,r,o,i,s={}){let a=pP(t);if(!a)return;let l=yP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:uP),f=gi(lt(r),dP),u=s.toolName?gi(lt(s.toolName),fP):void 0,m=i===null?void 0:gi(lt(i),mP),p=rl(l,gP(m?.value??null),c.slice(0,7));aP(p,{recursive:!0,mode:448});let h=rl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:cP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:f.value,...d.truncated||f.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};sP(h,`${JSON.stringify(g)}
-`,{encoding:"utf-8",mode:384}),ap(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function hP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&lP(n)?n:null}function yP(e){let t=hP(e);return t?rl(t,".cc-safety-net","logs"):null}function up(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=cp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?cp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function cp(e){return"command"in e?e.command??"":""}function dp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ol(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function fp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ol(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function pp(e,t,n){try{let r=tp(t,{environment:e,...n.guard});return mp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw mp(e,t,r.evaluation,n,!(r.cause instanceof Ze),{stage:r.stage,errorCode:CP(r.cause)}),r}}function mp(e,t,n,r,o=!0,i){dp(e,up(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function CP(e){if(e instanceof F)return A[e.kind].errorCode;if(e instanceof Ze)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}var hp="exec",SP=new Set(["auto","gateway"]);function yp(e){e.on("before_tool_call",bP(e),{matcher:[hp],priority:50})}function bP(e,t={}){return(n,r)=>{try{return vP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),hi(In())}}}function vP(e,t,n,r){let o=_l();if(t.abortSignal?.aborted)return hi(In());let i=EP(e,t,n,o.paths);if(!i)return;let s=()=>t.sessionId??t.sessionKey;if("malformed"in i)return fp(o,i.denial,s,{agent:"openclaw",toolName:i.denial.toolName,cwd:i.cwd}),hi(i.denial);try{let a=pp(o,i,{guard:{auditAllowed:wl(o.env),dependencies:r.guardDependencies},audit:{agent:"openclaw",getSessionId:s}});return gp(a,!0)}catch(a){if(!(a instanceof Qt))throw a;if(Pt(ee.debug,o.env))console.error(`CC Safety Net debug: openclaw before_tool_call analysis failed: ${fl(a.cause)}`);return gp(a.evaluation,!0)}}function EP(e,t,n,r){if(!e||typeof e!=="object")return en(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return en(null);if(o!==hp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return en(null,o);let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return en(null,o);if(s.host!==void 0&&!SP.has(s.host))return en(null,o,a);let l=RP(n,t.agentId,r);if(!l)return en(null,o,a);let c=xP(l,s,r);if(!c)return en(l,o,a,typeof s.workdir==="string"?s.workdir:void 0);return Wn(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function RP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Ni(".",[r],n)}catch{return}}function xP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Ni(r,[e],n)}function en(e,t,n,r){return{malformed:!0,denial:In({command:n,segment:r,toolName:t}),cwd:e}}function gp(e,t){let n=ul(e,{includeEvidence:t});return n?hi(n):void 0}function hi(e){return{block:!0,blockReason:dl(e)}}var mL={...cl,register:yp};export{mL as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function Go(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function lr(e){return e?w(e):""}function FE(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function pa(e,t){return fa(Oe(e,"posix"),t)}function ur(e){return pa(e,new Set(Array.from(e.matchAll(Zd)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function fa(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(fa(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>fa(o,n))||ef(r.words,n))return!0;UE(r,n)}return!1}function ef(e,t){let n=e.findIndex((s)=>we(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(cr(r,t))return!0;let o=M(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Yd(e[s],t)}if(J.has(o)){let s=e.slice(n),a=Se(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Yd(s[l],t)}let i=GE(e,n,t);if(i===null)return!1;if(i===-1)return!0;return ef(e.slice(i),t)}function GE(e,t,n){let r=M(e[t]?.text??"");if(r==="command")return zE(e,t+1);if(r==="exec")return BE(e,t+1);if(r==="env")return $E(e,t+1,n);return null}function zE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function BE(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function $E(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return cr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return cr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(we(i))continue;return r}return null}function UE(e,t){if(!e.words.every((n)=>we(n.text)!==null))return;for(let n of e.words){let r=we(n.text);if(!r)continue;if(cr(n,t))t.add(r.name)}}function cr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Zd)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(TE.test(o)||t.has(o))}))}function Yd(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||cr(e,t))}var HE=["--init-file","--rcfile"],jE=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function tt(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return tf(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=tf(e,t,!1);if(r!==null)return r}}return null}function nt(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Se(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function tf(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function nf(e){let t=k(e[0]??"").toLowerCase(),n=VE(e,t),r=jE.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function VE(e,t){let n=Se(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?HE.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let d=l.split("=",1)[0]??l;if(t==="bash"&&Ui.has(d)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Hi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",ha="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",KE="__CC_SAFETY_NET_XARGS_INPUT__",zo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Bo="rm",qE=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,YE=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,ZE=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,XE=/^(?:[0-9]+|[@*])$/;function sf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=b("xargs.shell-dynamic",ha);if(QE(i,o,t)&&A(s,t.policy))return A(s,t.policy);for(let a of Fe(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?A(s,t.policy):null;if(c)return c;let f=df(l,o,a.wrapperEnvAssignments),d=a.head==="rm"&&o!==null&&cf(l,o),u=t.analyzeChild(l,{...Gt(a,t),dynamicInput:f,dynamicSourceInput:d||lf(l,a.head,o,a.wrapperEnvAssignments,f,t.environment),dynamicRmInput:d,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",ga)});if(u)return u;let m=JE(l,o,t.policy?.rules??[],A(s,t.policy));if(m)return m;if(a.head==="git"){let h=o===null?[...l,KE]:l,g=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(h,{...Gt(a,t),worktreeMode:o===null||g?!1:t.worktreeMode});if(y)return y}let p=Je(l,t.policy?.rules??[]);if(p)return p}return null}function JE(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=M(e[0]??"");if(!n.some((i)=>M(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function af(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=jd(e,r,t.length,n);return o===null?[]:[o]}function lf(e,t,n,r,o,i){if(J.has(t)){if(nt(e))return!1;if(n!==null&&eR(e,n))return!0;let s=tt(e);if(!s){let a=et(K(e));if(a.kind==="literal")return n!==null&&a.source.includes(n);return a.kind==="none"&&o}if(n!==null&&s.includes(n))return!0;if(Ye(s))return!0;return tR(s,n,r)}if(ke(t))return rf(e,n,uo,Pu(t));if(_e.has(t))return rf(e,n,ea,Pd);if(t==="eval"){let s=Wo(K(e));if(s.kind==="dynamic")return!0;if(n!==null)return s.kind==="literal"&&s.source.includes(n);return o}if(t==="find")return nR(e,n,i);if(t==="git"){let s=ze(e);return n===null?s.subcommand===null:(s.subcommand?.includes(n)??!1)||s.subcommand!==null&&mn.has(s.subcommand.toLowerCase())&&uf(s.rest,n).some((a)=>a.includes(n))}return!1}function rf(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,zo]).sources.some((a)=>a.value===zo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${zo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${zo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>af(l,t,a))));return Do(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function QE(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Fe(e,n),(i)=>i.head)),o=t===null?[...e,Bo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Bo));return Array.from(Fe(o,n)).some((i)=>i.head===Bo&&!r.has(Bo))}function cf(e,t){return uf(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function uf(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function df(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function eR(e,t){let n=Se(e);if(n.commandIndex!==null&&(e[n.commandIndex]??"").includes(t)||n.scriptIndex!==null&&(e[n.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((o)=>e.some((i,s)=>{if(s===0||!i.includes(t))return!1;return af(i,t,o).some((l)=>{let c=e.map((d,u)=>u===s?d.replaceAll(t,l):d),f=Se(c);if(f.commandIndex===null&&f.scriptIndex===null)return!1;if(n.commandIndex===null&&f.commandIndex!==null)return!0;if(n.scriptIndex===null&&f.scriptIndex!==null)return!0;if(f.commandIndex!==null&&(c[f.commandIndex]??"").includes(l))return!0;return f.scriptIndex!==null&&(c[f.scriptIndex]??"").includes(l)})}))}function tR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(qE))if(of(o,r))return!0;for(let o of e.matchAll(YE))for(let i of(o[1]??"").matchAll(ZE))if(of(i,r))return!0;return pa(e,r)}function of(e,t){let n=e[1]??e[2];return n!==void 0&&(XE.test(n)||t.has(n))}function nR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Qe(s)){let l=sr(e,i);i=l.nextIndex-1;for(let c of Fe(l.tokens,{environment:n,cwd:void 0})){let f=df(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&cf(c.tokens,t)||lf(c.tokens,c.head,t,c.wrapperEnvAssignments,f,n))return!0}continue}let a=ht(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var dr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",fr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",oR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",iR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Uo=/\{[^{}\s]*\}/g,ff=/\{\}|\{-?\d+\}/g,sR=["e","f","source","file","-e","-f","--source","--file"],aR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],lR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),cR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),mf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),uR=new Set(["--workdir","--wd"]),pf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ae(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function bf(e){return Ae([...e],(t)=>Ye(t))}function Sf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=pn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=Tf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:f,dryRun:d}=o;if(c){let p=pn(t);if(p)return p;let h=bf(t.envAssignments?.values()??[]);if(h)return h}if(l){let p=hR(t);if(p)return p}if(f!==void 0&&a){let p=pn(t);if(p)return p}let u=yR(f,t.cwd,t.environment.paths);if(u===null){let p=pn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(d){if([...Fe(i,m)].flatMap((h)=>[...h.envAssignments.values()]).some(ba)){let h=pn(t);if(h)return h}return null}if(i.length===0){let p=s.map((g)=>g[0]??"");t.budget.charge("derivedTokens",p.length);let h=xf(m.envAssignments,m.cwd,a);return Ae(p,(g)=>t.analyzeNested(g,h))}return Ae(Fe(i,m),(p)=>dR(p,o,t,m))}function dR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(Pf)){let g=pn(n);if(g)return g}let f=bf(c);if(f)return f;let d=c.some(F),u=i||d,m=a&&u,p=xf(e.envAssignments,e.wrapperCwd,s||m);if(J.has(e.head)){let g=()=>{if(!i||o.length===0)return null;return Ae(o,(E)=>n.analyzeChild($o(l,E,n.budget),Gt(e,r)))};if(nt(l))return g();let y=tt(l);if(y){if(Af(y)){let R=bt(n);if(R)return R;if(o.length===0)return null;return Ae(o,(P)=>n.analyzeNested(yf(y,P,n.budget),p))}if(F(y)){if(o.length>0)return Ae(o,(q)=>n.analyzeNested(yf(y,q,n.budget),p));let R=ar(y);if(R?.[0]&&M(R[0])==="rm"&&Ge(R)){let q=hf(n);if(q)return q}let P=R?n.analyzeChild(R,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",fr),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",dr)}):null;if(P)return P;return n.analyzeNested(y,p)}let E=!d&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((R)=>Fo(K(R===void 0?l:i?l.map((P)=>_f(P,R)):[...l,...R]),y)):[];if(E.some((R)=>R.kind==="dynamic")){let R=bt(n);if(R)return R}let S=E.flatMap((R)=>R.kind==="literal"?[R.source]:[]);if(S.length>0)return n.budget.charge("derivedTokens",S.length),Ae(S,(R)=>n.analyzeNested(R,p));if(ur(y)){let R=bt(n);if(R)return R}let T=n.analyzeNested(y,p);if(T)return T;if(u)return bt(n);return null}let v=et(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return bt(n)??g();if(v.kind==="literal")return g();if(o.length>0){let E=bt(n);if(E)return E;let S=g();if(S)return S;if(i)return null;let T=o.flatMap((R)=>R[0]===void 0?[]:[R[0]]);return n.budget.charge("derivedTokens",T.length),Ae(T,(R)=>n.analyzeNested(R,p))}if(u||a)return bt(n)??g();return null}if(e.head==="rm"&&Ge(l)){if(i&&o.length>0)return Ae(o,(y)=>ya($o(l,y,n.budget,ff),e.cwd,r));if(o.length>0)return Ae(o,(y)=>ya(Cf(l,y,n.budget),e.cwd,r));let g=ya(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(ff,"")]:[]}),e.cwd,r);if(g)return g;return hf(n)}let h=o.length>0?o:[void 0];return Ae(h,(g)=>{let y=g===void 0?l:i?$o(l,g,n.budget):Cf(l,g,n.budget),v=b("parallel.shell-dynamic",fr),E=a&&e.head==="find"?gR(y,r):null,S=Ef(y,a,n)??E?.customResult??null,T=M(e.head),R=a&&(T==="rm"&&Ca(y)||T==="xargs"&&Rf(y)||E?.rmOptions===!0),P=a&&(R||E?.executedSource===!0||E===null&&vf(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:R,dynamicSourceInput:S!==null||P,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",dr)});if(P){let Z=A(v,n.policy);if(Z)return Z}return q??S??Je(y,n.policy?.rules??[])})}function vf(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return pR(e);if(t==="git")return fR(e);if(t==="find")return!0;if(_e.has(t))return gf(e,sR,ir);if(ke(t))return gf(e,aR,co);return!1}function Ca(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||Af(o)))}function fR(e){if(mR(e))return!0;let t=ze(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!mn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function mR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function pR(e){if(nt(e))return!1;let t=tt(e);if(t!==null)return F(t);let n=et(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function gf(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,pf]).some((o)=>o.value===pf);return Do(r,t,(o)=>n(e.map((i)=>_f(i,[o]))))}function Ef(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>M(i.command)===M(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return bt(n);return Ae(o,(i)=>Je([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function gR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of Fe(i,t))n.executedSource||=vf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ca(a.tokens)||a.head==="xargs"&&Rf(a.tokens),n.customResult??=Ef(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Qe(a)){i=[],n.executedSource||=F(a);continue}let l=ht(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Rf(e){let t=e.slice($t(e).childStart);return M(t[0]??"")==="rm"&&Ca(t)}function Ho(e,t){return(n)=>A(b(e,t),n.policy)}var bt=Ho("parallel.shell-dynamic",fr),hR=Ho("parallel.command-stream-dynamic",oR),pn=Ho("parallel.command-stream-dynamic",iR),hf=Ho("parallel.rm-recursive-force-dynamic",dr);function ya(e,t,n){return A(Lo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function xf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function _f(e,t){return e.replace(Uo,(n)=>wf(n,t))}function $o(e,t,n,r=Uo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=wf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function yf(e,t,n){return $o([e],t,n)[0]??""}function Cf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function wf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Uo)!==-1}function Pf(e){if(ba(e))return!0;for(let t of e.matchAll(Uo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function ba(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Af(e){return/^\{[^{}\s]*\}$/.test(e)}function yR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!rR(e))return null;try{return ft(t??e,e,n)}catch{return null}}function Tf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ra(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ra(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let h=e[t+1],g=p.indexOf("="),y=g===-1?p:p.slice(0,g),v=g===-1?void 0:p.slice(g+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?h:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?v:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||cR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(mf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=mf.has(p)?2:1;continue}if(uR.has(y)){c=!0;let E=v??h;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&v!==void 0){t++;continue}if(lR.has(p)){if(h===void 0||h===":::"||h==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?ba:Pf);let f=[];if(o!==-1){let p=[];for(let h=o+1;h<e.length;h++){let g=e[h];if(g===":::"){f.push(p),p=[];continue}if(g!==void 0)p.push(g)}f.push(p)}c||=f.length>1;let d=CR(f),u=n.some(F),m=n.length===0&&o===-1;return{template:n,jobs:d,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function CR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function If(e){return Tf(e).childStart}var bR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",jo="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function va(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Sa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Of(e,t,n,r,o=!1,i){let a=(Fn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",bR):null;return A(a,i)??Mf(e,t,n,o,i)}function Mf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>va(a)?[l]:[]);if(i.length===0)return null;let s=M(t[0]?.text??"");if(s==="git"){let a=on(e,t),l=vR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((d)=>d<=l))return A(b("shell.dynamic-structure",jo),o);if(A(No(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),f=a.findIndex((d,u)=>u>l&&w(d)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&mn.has(c)&&i.some((d)=>d>l&&(f===-1||d<f)))return A(b("shell.dynamic-structure",jo),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&ER(t)?A(b("shell.dynamic-structure",jo),o):null;if(s==="rm"){let a=t.findIndex((c,f)=>f>0&&w(c)==="--"),l=Ge(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?A(b("shell.dynamic-structure",jo),o):null}if(s==="xargs")return kf(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return kf(e,t.slice(If(t.map(w))),"parallel",n,r,o);return null}function kf(e,t,n,r,o,i){if(t.length===0)return null;let s=SR(t,r);if(Fn(e,s)){let l=A(b(`${n}.shell-dynamic`,n==="xargs"?ha:fr),i);if(l)return l}let a=Mf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>va(l)&&Sa(l)))return A(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?ga:dr),i);return null}function SR(e,t){let n=Ot(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function vR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(be.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function ER(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=va(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Sa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Sa(s)))return!0;continue}if(t=!0,a)return!0;let l=ht(s.text);if(l>0){n=l;continue}if(Qe(s.text))o=!0,r=!0}return!1}function Ea(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!io(t[n.tokenIndex],n.value)})}var RR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",xR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",_R="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Nf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",RR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",xR);if(e==="shred"&&n.length>0)return b("shred.target",_R);return null}var Lf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Lo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>No(e.words,Ra(e))},{heads:new Set(["find"]),analyze:(e)=>Md(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:gt(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>sf(e.words,{...Df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Sf(e.words,{...Df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function Df(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ra(e){return{environment:e.options.environment,cwd:e.cwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}var zf="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.";function Bf(e){return Lf.find((t)=>t.heads.has(e))?.analyze}function hn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(x)=>x.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,f=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,d=s?s.originalCwd:c?void 0:n.cwd,u=po(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let m=Ot(u.words,n.environment,f,new Map([...n.envAssignments??[],...u.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let x=[...p,...i(m.words)].join(" "),I=Ye(x);if(I)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:I.reason}),ue(I);if(n.strict)return he(r);let L=go(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments])});if(te)return te}}let h=m.rewritten?K(i(m.words)):on(o,m.words),g=i(h),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>h.length){let x=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:x,removed:x.slice(0,x.length-h.length),output:g})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...m.envAssignments]),E=g[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let S=M(E),T=m.cwd===null?void 0:m.cwd??f,R=m.cwd===null?void 0:d,P=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!tr(v,n.environment),Z=Of(o,m.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),ue(Z);let ee=To(g,n.policy);if(ee){for(let x of[ee.childIndex,...ee.alternativeChildIndices]){Wf(y.wrapperNormalizationBudget);let I=h.slice(x);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=hn(I,t,{...y,effectiveCwd:P,envAssignments:v});if(L)return L}return null}let X=l?void 0:S==="eval"?Wo(h):S==="trap"&&!a?Jd(h):void 0;if(a&&s&&S==="eval"){if(X?.kind==="dynamic")return gn(s,n.policy);if(X?.kind==="literal"){let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v});if(x)return x}return yn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ma(n.commandView)))return he(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:S==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let x=n.analyzeNested(X.source,{effectiveCwd:P,envAssignments:v,functionDefinitions:n.functionDefinitions});if(x)return x}if(a?J.has(S):Uf(E,S)){if(nt(g))return null;if(a&&s){let x=tt(g);if(x){if(s.dynamicSourceInput??s.dynamicInput){let L=gn(s,n.policy);if(L)return L}if(ur(x)){let L=gn(s,n.policy);if(L)return L}return n.analyzeNested(x,{effectiveCwd:P,envAssignments:v})}let I=et(h);if(I.kind==="dynamic")return gn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?gn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?gn(s,n.policy):null}if(l){let x=tt(g),I=x?n.analyzeNested(x,{effectiveCwd:P,envAssignments:v}):et(h).kind==="dynamic"?he(r):null;if(I)return I}if(s===void 0){let x=TR(g,v,P,n,r,t);if(x)return x;let I=tt(g);if(I){let Kt=Fo(h,I);if(Kt.kind==="dynamic")return he(r);let ui=Kt.kind==="literal"?Kt.source:I,Qa=IR(ui);r?.recordSegment({type:"shell-wrapper",wrapper:S,innerCommand:Qa}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:Qa,depth:t+1});let el=n.analyzeNested(ui,{effectiveCwd:P,envAssignments:v});if(el)return el;return ur(ui)?he(r):null}let L=et(h);if(L.kind==="dynamic")return he(r);if(L.kind==="literal")return Ko(L.source,P,v,n,r,t);let te=Qd(h,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return he(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:P,envAssignments:v})}}if(!s&&(S==="source"||S===".")){let x=g[1]==="-p"?2:null;if(x!==null){let Kt=n.commandView?h[x]:void 0;if(!Kt)return null;if(Kt.provenance!=="literal")return he(r)}let I=x===null?1:3,L=g[I]==="--"?I+1:I,te=n.commandView?h[L]:void 0;if(!te)return null;if(te.provenance==="literal")return Ko(te.text,P,v,n,r,t);if(n.strict||!n.commandView||!ma(n.commandView))return he(r)}if(_e.has(S)&&!l){if(!s&&n.strict&&Ea(ir(g),h))return he(r);let x=Ad(g,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:P,envAssignments:v}))),I=A(x,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),ue(I)}if(ke(S)&&!l){if(!s&&n.strict&&Ea(co(g),h))return he(r);let x=wu(g);if(a&&s)return PR(S,x,P,v,n,s);if(x){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:S,codeArg:x,paranoidBlocked:I}),I){let te=A(b("interpreter.one-liner-paranoid",Vn),n.policy);if(te)return ue(te)}if(Ns(S,x))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:x,depth:t+1});let L=n.analyzeNested(x,{effectiveCwd:P,envAssignments:v});if(L&&!$f(L,x))return L;if(Kn(x)){let te=A(b("interpreter.dangerous-command",ln),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:x,matched:!0,reason:ln}),ue(te)}r=void 0}}if(S==="busybox"&&g.length>1)return Wf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:g[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:g.slice(1).join(" "),depth:t+1}),hn(h.slice(1),t,{...y,effectiveCwd:P,envAssignments:v});let D=s?null:A(Nf(S,g),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),ue(D);let le=r===y.trace?y:{...y,trace:r},xe={words:h,head:S,cwd:T,originalCwd:R,envAssignments:v,allowTmpdirVar:q,dynamicArguments:m.words.some((x)=>x.provenance==="command-substitution"),depth:t,effectiveCwd:P,options:le,analyzeChildTokens:(x,I)=>a&&s?xa(x,t,le,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(hn(K(x),t+1,{...le,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:v}))??Je(x,le.policy.rules),analyzeChild:(x,I)=>xa(x,t,le,I)},je=s&&(S==="xargs"||S==="parallel")?void 0:Bf(S);if(S==="rm"||S==="xargs"||S==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let Te=r&&S==="git"?Hd(xe.words,Ra(xe)):void 0,li=Ff(Te?Te.match:je?.(xe)??null,n.policy);if(r)kR(xe,li,Te?.relaxation??null);if(li)return ue(li);if(a&&s&&(S==="rm"||S==="rmdir")){if(!(S==="rm"&&(Ge(g)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?yn(s,n.policy):null)??AR(s,n.policy)}let Xa=je!==void 0,Ja=!s&&!Xa&&!Mr.has(S),ci=r&&Ja?[]:void 0;if(Ja)for(let x=1;x<g.length;x++){let I=g[x];if(!I)continue;ci?.push(I);let L=Ff(wR(g,x,t,le,T,R,P,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[],embeddedCommandFound:M(I)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:ci??[]}),l&&s&&!s.wrappedByTransparent)return null;if(!s&&t!==0&&Xa)return r?.recordSegment({type:"custom-rules-check",rulesChecked:!1,matched:!1}),null;let vr=Je(g,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!vr,reason:vr?.reason}),vr)return ue(vr);return a&&s?yn(s,n.policy):null}function xa(e,t,n,r){return Ut(hn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function wR(e,t,n,r,o,i,s,a){for(let l of Fe(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let f=M(c);if(Uf(c,f)||Bf(f)!==void 0&&f!=="xargs"&&f!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=xa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!tr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function PR(e,t,n,r,o,i){if(!t)return yn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=A(b("interpreter.one-liner-paranoid",Vn),o.policy);if(a)return ue(a)}if(Ns(e,t))return yn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!$f(s,t))return s;if(Kn(t)){let a=A(b("interpreter.dangerous-command",ln),o.policy);if(a)return ue(a)}return yn(i,o.policy)}function $f(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(wo)||e.reason===fn)&&!Nr(t)}function gn(e,t){let n=e.shellDynamicMatch?A(e.shellDynamicMatch,t):null;return n?ue(n):null}function yn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?A(e.dynamicSourceMatch,t):null;return n?ue(n):null}function AR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?A(e.rmDynamicMatch,t):null;return n?ue(n):null}function TR(e,t,n,r,o,i){let s=nf(e);if(s.argvSource?.kind==="absent")return he(o);if(s.argvSourceApplies&&s.argvSource){let l=Ko(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return Ko(a,n,t,r,o,i,!0)}function Ko(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return he(o);let a=jn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?he(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function IR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function kR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:"worktree-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Wf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function he(e){return e?.recordSegment({type:"error",message:zf}),ue(OR())}function OR(){return{id:"",reason:zf,intent:"stop_and_explain"}}function Uf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function Ff(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:A(e,t)}var MR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,NR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function DR(e,t){let n=Vf(e,t);if(n.length===0)return!1;let r=n[jf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return MR.test(e.join(" "))}function Hf(e,t,n,r){if(e.dialect==="powershell"){let a=LR(e.words,r);if(a.kind==="none")return;if(!t||a.kind==="unknown")return null;return Gf(zR(a.target),t,n.paths)}let o=e.words.map(w);if(!DR(o,n))return;if(!t)return null;let i=Vf(o,n,t),s=jf(i);if(s===-1||i[s]!=="cd")return null;return Gf(i[s+1],t,n.paths)}function Gf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return BR(ft(t,e,n),t,n)?t:null}catch{return null}}function LR(e,t){let n=WR(e[0])?1:0,r=e[n];if(!FR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!NR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return GR(e.slice(n+1),t)}function WR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function FR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function GR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function zR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function jf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Vf(e,t,n){let r=$R(e);return mt([...r],t,n)}function BR(e,t,n){let r=n.realpath(e),o=n.realpath(t);if(r===null||o===null)return Vo(e)===Vo(t);return Vo(r)===Vo(o)}function $R(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var wa="TMPDIR",Pa="IFS",Kf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,qf=/^[A-Za-z_][A-Za-z0-9_]*$/,Yf=new Set(["export","typeset","declare","readonly"]),UR=new Set(["builtin","command","time"]);function Zf(e,t){return{env:e,effectiveEnvAssignments:qR(e,t),shellAssignments:new Map}}function Xf(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments)}}function Aa(e,t){let n=Qf(e,t);n.assignments.filter((s)=>s.persists).forEach((s)=>{t.shellAssignments.set(s.name,s.value),Ta(t,s)});let r=n.commandIndex;if(r!==-1&&Yf.has(e[r]??""))e.filter((s)=>qf.test(s)&&_a(s)).forEach((s)=>{YR(t,s)});let o=r===-1?-1:em(e,r);if(o===-1||e[o]!=="unset")return;let i=XR(e,o);if(i===null)return;e.slice(i).forEach((s)=>{ZR(t,s)})}function Jf(e,t){let n=Qf(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Qf(e,t){let n=e.findIndex((s)=>!HR(s)),r=n!==-1&&Yf.has(e[em(e,n)]??""),o=KR(t);return{assignments:e.flatMap((s,a)=>{let l=jR(s,o,t.env);if(!l)return[];if(n!==-1&&a>n&&!r&&!fo(l.name))return[];return o.set(l.name,l.value),[{...l,persists:n===-1||r}]}),commandIndex:n}}function em(e,t){let n=t;while(UR.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function HR(e){return we(e)!==null||Kf.test(e)}function jR(e,t,n){return we(e)??VR(e,t,n)}function VR(e,t,n){let r=mo(e,n,t);if(r)return r;let o=e.match(Kf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function _a(e){return e===wa||e===Pa||Ws(e)}function KR(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function qR(e,t){let n=[wa,Pa].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function Ta(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function YR(e,t){Ta(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function ZR(e,t){if(!_a(t)&&!qf.test(t))return;if(e.shellAssignments.set(t,""),fo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!_a(t)||t===wa||t===Pa||kn(t)){Ta(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function XR(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}var JR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Na(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Oe(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:$e}),{reason:$e,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((f)=>f.code.includes("heredoc"));if(c){if(!n.strict)return Ma(e,n);let f=`${wo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:f}),{reason:f,segment:e,intent:"stop_and_explain"}}return sm(e,n),{reason:fn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return sm(e,n),{reason:fn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ma(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=Zf(n.environment.env,n.envAssignments);return Zo(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function Zo(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let f=e.nodes[l+1],d=f?.kind==="connector"?f.operator:void 0,u=QR(e,l,c,a,d),m=a==="&&"||a==="||",p=m?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,g=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],v=m||bn(d);if(c.kind==="function"){let Z=h.flatMap((X)=>{let U=mr(X);return U.functionDefinitions.set(c.name,c.body),Ia(X,[U],u,d==="&",bn(d))}),ee=ka(Z,[],g,y,a,d);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of h){let D=Zo(c.body,t,n,r,[mr(U)]);if(D.result)return D;if(Z.push(...Ia(U,D.states,u,d==="&",bn(d))),v)ee.push(U,...u?D.states.map((le)=>qo(U,le)):D.states)}let X=ka(Z,ee,g,y,a,d);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),S=e.nodes[l-2],T=Xo(a)&&S?.kind==="command"?Xd(S)??tx(S):void 0,R=[],P=[];for(let Z of h){let ee=nx(c,t,n,r,[mr(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>qo(Z,U));for(let U of X){let D=mr(U),le=ix(c,t,n.trace?{...n,trace:am(n.trace,E)}:n,r,D,Xo(a),T);if(le)return{result:le,states:i};let xe=Cx(c,D.functionDefinitions);if(xe)n.budget.charge("derivedTokens",Jo(xe));let je=xe?t+1>=V.recursionDepth.cap?Oa(c.displayText,n,[D]):Zo(xe,t+1,n,r,[D]):{result:null,states:[D]};if(je.result)return je;if(R.push(...Ia(Z,je.states,u,d==="&",bn(d))),v)P.push(Z),P.push(...je.states.map((Te)=>u?qo(Z,Te):Te))}}let q=ka(R,P,g,y,a,d);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function QR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(Xo(r)||Xo(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&ex(e,t)}function Ia(e,t,n,r,o){let i=n?t.map((a)=>qo(e,a)):[...t],s=o?i.flatMap((a)=>Cn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function qo(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function ex(e,t){let n=[...e.nodes.slice(0,t)].reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(rx(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function Xo(e){return e==="|"||e==="|&"}function tx(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function bn(e){return e==="&&"||e==="||"}function ka(e,t,n,r,o,i){let s={success:Yo([...n,...e]),failure:Yo([...r,...t])},a=bn(i)?s:void 0;return{states:bn(o)||a?Yo([...s.success,...s.failure]):s.success,conditionalStates:a}}function am(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function nx(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=ox(e);if(s){if(t+1>=V.recursionDepth.cap)return Oa(s,n,o);let a=Oe(s,"powershell");if(a.status==="limited")return Oa(s,n,o);if(a.status!=="complete")return tm(i,n,r,o);n.budget.charge("derivedTokens",Jo(a)),i.push({program:a,depth:t+1})}}return tm(i,n,r,o)}function rx(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function tm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=Zo(i.program,i.depth,t,n,[mr(a)]);if(l.result)return l;s.push(...l.states)}o=Yo(s)}return{result:null,states:o}}function ox(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function Jo(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+Jo(o),0):n.kind==="group"||n.kind==="function"?Jo(n.body):0),0)}function Oa(e,t,n){return t.trace?.recordSegment({type:"error",message:$e}),{result:{reason:$e,segment:e,intent:"stop_and_explain"},states:[...n]}}function ix(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=fx(e);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};lm(e,o,"before-consumer",a.environment.paths,a.budget);let c=on(e.dialect,e.words).map(w),f=e.displayText,d=Jf(c,o.shellGitContextState);if(e.dialect==="powershell"){let p=A(Sd(e,i,Sx(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!p,reason:p?.reason}),p)return bx(f,p)}if(c.length===1&&c[0]?.includes(" ")&&!Fn(e.dialect,e.words)){let p=A(Ye(c[0]),a.policy),h=p!==null&&!a.strict&&vu(e,a.rootProgram);if(p&&!h)return a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!0,reason:p.reason}),{reason:p.reason,segment:f,ruleId:p.id,intent:p.intent};a.trace?.recordSegment({type:"dangerous-text",token:c[0],matched:!1});let g=nm(e,l,o,d,s,a);if(g)return g;return Aa(c,o.shellGitContextState),null}let u=hn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(p,h)=>{let g=h&&Object.hasOwn(h,"effectiveCwd")?h.effectiveCwd:o.effectiveCwd,y=Na(p,t+1,{...a,effectiveCwd:g,envAssignments:h?.envAssignments??d,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:h?.functionDefinitions,worktreeMode:h?.worktreeMode??a.worktreeMode,trace:a.trace?am(a.trace,a.trace.currentSegmentIndex,!0):void 0});return y?{reason:y.reason,ruleId:y.ruleId,intent:y.intent}:null}});if(u)return{...u,segment:f};let m=nm(e,l,o,d,s,a);if(m)return m;return Aa(c,o.shellGitContextState),null}function nm(e,t,n,r,o,i){let s=mx(e,t,n,r??new Map,i);if(s)return s;return lm(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),lx(e,t,n,i.environment.paths,i.budget),hx(e,n,o,i.environment,i.trace),null}var sx=new Set([">>","<>"]);function lm(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?ax(s):sx.has(s.operator)))continue;rm(s.target,t,r,o)}if(n!=="before-consumer"||!Re(e.words[0],"tee"))return;let i=cm(e.words.slice(1));if(!i)return;for(let s of i.operands)rm(s,t,r,o)}function ax(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function rm(e,t,n,r){let o=e?.provenance==="literal"?jn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function lx(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i||!Qo(i))return;for(let s of cx(e)){let a=jn(s.text,n.effectiveCwd,r,o);if(!a||!xu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function cx(e){let t=dx(e.redirections)?.target,n=om(t)?[t]:[];if(Re(e.words[0],"cat"))return ux(e.words)?n:[];if(!Re(e.words[0],"tee"))return[];let r=cm(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(om))return[];return[...r.operands,...n]}function ux(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function dx(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function cm(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&Re(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=[...i.text.slice(1)].some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function om(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function Re(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function Qo(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function fx(e){let t=e.redirections.filter((s)=>s.operator==="<<"||s.operator==="<<-");if(t.length===0)return;if(t.length!==1)return Ht;let n=t[0];if(!n?.heredoc)return Ht;if(!Qo(n.heredoc))return JR;if(n.fd!==void 0&&n.fd!==0)return Ht;if(e.redirections.some((s)=>s!==n&&["<","<<","<<-","<<<","<&","<>"].includes(s.operator)))return Ht;let r=e.redirections.some((s)=>s!==n&&im(s.target));if(Re(e.words[0],"cat"))return r?Ht:void 0;if(Re(e.words[0],"tee"))return r||e.words.slice(1).some(im)?Ht:void 0;let o=e.words[0],i=e.words[1];if(Re(o,"git")&&(Re(i,"apply")||Re(i,"commit")))return;if(Re(o,"gh")&&(Re(i,"pr")||Re(i,"issue"))&&Re(e.words[2],"create"))return;return Ht}function im(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function mx(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(gx(e,i,n,r,o))return null;let a=px(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ma(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function px(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!Qo(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=e.words[0];if(o?.provenance!=="literal"||!ke(o.text))return;if(!e.words.slice(1).every((c)=>c.provenance==="literal"&&c.text.startsWith("-")))return;let s=r.heredoc.body,a=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:o.text,codeArg:s,paranoidBlocked:a}),a){let c=A(b("interpreter.one-liner-paranoid",Vn),n.policy);if(c)return c}if(!Kn(s))return null;let l=A(b("interpreter.dangerous-command",ln),n.policy);if(!l)return null;return n.trace?.recordSegment({type:"dangerous-text",token:s,matched:!0,reason:l.reason}),l}function gx(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!Qo(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Ot(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=M(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return nt(a)}function hx(e,t,n,r,o){let i=Hf(e,t.effectiveCwd,r,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}function mr(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Xf(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function Yo(e){let t=[];for(let n of e){if(!t.some((r)=>yx(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function yx(e,t){return e.effectiveCwd===t.effectiveCwd&&Cn(e.shellGitContextState.env,t.shellGitContextState.env)&&Cn(e.literalHeredocFiles,t.literalHeredocFiles)&&Cn(e.functionDefinitions,t.functionDefinitions)&&Cn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Cn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)}function Cn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Cx(e,t){let n=Gn(e);return n===void 0?void 0:t.get(n)}function bx(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Sx(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ma(e,t){let n=A(Ye(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function sm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:fn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var vx=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function um(e,t,n,r){let o=Na(e,0,{...t,...Uc(t),budget:t.budget??ye(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function dm(e,t,n){try{return{decision:e()}}catch(r){let o=Ex(r,t,n);if(!o)throw r;return o}}function Ex(e,t,n){if(!(e instanceof N)||!vx.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Rx=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),La=new Set(["cc-safety-net","ccsn"]),xx=new Set(["bunx","npx","pnpx"]),_x=new Set(["pnpm","yarn"]),wx=new Set(["npm","pnpm","yarn"]),Px=new Set(["bun","node"]);function ti(e,t,n={}){if(La.has(e))return 0;if(xx.has(e)){if(n.broad)return Da(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ei(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&wx.has(e)&&n.broad&&t[r]==="exec"){let o=Da(t.slice(r+1));return o===null?null:r+1+o}if(_x.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ei(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Da(t.slice(r+1));return o===null?null:r+1+o}if(Px.has(e)){let o=n.broad&&r!==-1?r:0;if(fm(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&fm(t[o+1]))return o+2}return null}function Da(e){let t=e.findIndex((r)=>ei(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ei(r))break;n++}return n}function ei(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return La.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return La.has(e.slice(0,t))}function fm(e){let t=e?.replaceAll("\\","/");return[...Rx].some((n)=>t===n||t?.endsWith(`/${n}`))}var mm="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function pm(e,t,n){let r=pe(e,"input-candidate");if(!r)return null;let o=un(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Ax(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Ax(e,t){let n=mt([...e],t),r=n.slice(1),o=ti(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ni}from"node:path";var Cm="This path contains the protected policy config and you must not modify or delete it.",Tx=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function bm(e,t,n){let r=Dx(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return gm(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=pe(e,"input-candidate");if(e.invocation.route.kind==="command")return o?hm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=hm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return gm(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||xr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function gm(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>pr(a,n,r,o,i));return s?{target:s}:null}function hm(e,t,n,r,o){let i=un(e,t,r,o,{findSegmentTarget:(s,a)=>Ix(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>pr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Nx(s,t,n,r,o)?.target??null});return i?{target:i}:null}function Ix(e,t,n,r,o){if(Jn(e))return null;let i=Mt([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&kx(a)){let l=Ox(a).find((c)=>ym(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Oo(i,1)||ia(i,r)){let c=(ko(K(i))??K(["."])).find((f)=>{let d=me(f.text,t.variables);return pr(d,t.cwd,n,r,o)||ym(d,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=vo(a).sources.find((c)=>Lx(me(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Mx(i,s))return null;for(let l of[...e,...i])for(let c of Sm(l))if(pr(me(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function kx(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Ox(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Mx(e,t){if(!Tx.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Nx(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Sm(i))if(pr(s,t,n,r,o))return{target:s};return null}function Sm(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Dx(e,t,n){let r=(a)=>gr(ie(a,e.executionCwd,t,n)),o=r(Jt(t)),i=[r(Mn(e.executionCwd)),r(Mn(e.configCwd))],s=new Set(i.map((a)=>ni(a)));for(let a=ni(o);;a=ni(a))if(s.add(a),ni(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function pr(e,t,n,r,o){let i=cl(e,t,r,o,(s)=>gr(s)===kr);return i!==null&&n.files.has(gr(i))}function ym(e,t,n,r,o){return n.directoriesAndAncestors.has(gr(ie(e,t,r,o)))}function Lx(e,t,n,r,o){let i=gr(ie(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function gr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ri,posix as Wx,resolve as ii,win32 as Fx}from"node:path";import{fileURLToPath as Gx}from"node:url";var Im="Access to a sensitive path is not allowed.",km=new Set(["echo","printf"]),zx=new Set(["find"]),Bx=new Set(["-exec","-execdir"]),$x=new Set([";","+"]),Ux=new Set(["-delete","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Hx=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),Om=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),jx=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Vx=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),Mm=new Set(["-c","-e","-r","-E","--eval","--exec"]),Kx=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),qx=new Set(["grep","rg"]),vm=new Set(["jq","gojq","jaq"]),Em="f",Rm="file",Yx="files",Zx=new Set(["e","f"]),Xx=new Set(["regexp","file"]),Jx=new Set(["e","f","A","B","C","m"]),Qx=new Set(["regexp","file","after-context","before-context","context","max-count"]),Wa="__CC_SAFETY_NET_PIPE_INPUT__",Ga=/[\w./~@+-]*[./~][\w./~@+-]*/g,e_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,t_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,n_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,r_=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,o_=/\b(?:system|exec)\s*$/,i_=/\b(?:eval|exec)\s*\(/g,s_=/\b(?:eval|exec)\s*$/,a_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function xm(e,t,n,r,o,i){for(let s of e){let a=s.target;if(iw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=rw(a,s.cwd,t,r,o);if(l){if(!l.startsWith("secret.cli.")&&sw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function Nm(e,t,n,r,o={}){let i=_m(e,n,r),s=xm(i,t,e.invocation.context.configCwd,n,r);if(s===null)return null;let a=s.ruleId!=="secret.deny-path"&&o.strict===!1?_m(e,n,r,{refineInlineData:!0}):i,l=a.length===i.length?s:xm(i,t,e.invocation.context.configCwd,n,r,new Set(a.map((c)=>c.target)));if(l?.ruleId!=="secret.deny-path"&&o.strict===!1&&l_(e,n))return null;return l}function l_(e,t){let n=pe(e,"input-candidate")??pe(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((a)=>a.kind==="command"&&a.nested.length>0))return!1;let r=[];for(let a of So(n.shell)){if(a.kind==="operator"&&a.boundary)return!1;if(a.kind==="redirection")return!1;if(a.kind==="operator")continue;r.push(Xe(a.text,t))}let o=St(r);if(o.length===0)return!1;let i=it(o[0]??"").toLowerCase(),s=o.slice(1);if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");if(i==="ls"||i==="stat")return!0;if(i==="test")return s.length===2&&(s[0]==="-e"||s[0]==="-f");if(i!=="find")return!1;return!s.some((a)=>Ux.has(a))}function _m(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=pe(e,"input-candidate");return[...s?Sn(s.shell,e.store,r,t,o,n,c_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function c_(e){return e.program.dialect==="powershell"}function Sn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Le;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...G_(Xe(e.source,r),t,n,r,o,i)],l=(c)=>Xe(S_(c,s),r);return bo(e,o,r,i,{word:l,segment:(c,f,d,u,m)=>{if(c.length===0)return null;if(a.push(...si(c,t,n,r,f.cwd,i,m)),d!==null)a.push(...d_(d,c,t,n,r,f.cwd,i));return null},redirection:(c,f)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Dm(c.consumer,[c.body],t,n,r,f.cwd,i,(d)=>f_(c.consumer??[],d,t,n,r,f.cwd,i)));if(c.targetOrder==="legacy-segment")return Bs;return a.push({target:l(c.target),cwd:f.cwd}),null}}),a}function za(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Le;return s.status==="complete"?Sn(s,t,n,r,o,i):null}function si(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,g)=>!s.has(g));if(vm.has(it(St(p)[0]??"").toLowerCase()))return[...e.filter((h,g)=>s.has(g)).map(a),...si(p,t,n,r,o,i)]}let l=b_(e).map(a),c=St(e);if(c.length===0)return l;let f=c[0]??"",d=it(f).toLowerCase(),u=c.slice(1),m=u_(f,d,u);if(m)return[...l,...m.map(a)];if(km.has(d))return n.capturedOutput===!0?[...l,...Lm(e).map(a)]:l;if(d==="eval")return[...l,...za(u.join(" "),t,n,r,o,i)??u.map(a)];if(d==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:ot(d,p)).map(a)];if(d==="git")return[...l,...E_(u).map(a)];if(vm.has(d))return[...l,...v_(u).map(a)];if(qx.has(d))return[...l,...K_(u).map(a)];if(zx.has(d))return[...l,...w_(u,t,n,r,o,i).map(a)];if(_e.has(d))return[...l,...u.flatMap((p)=>ot("awk",p)).map(a),...u.flatMap((p)=>A_(p,t,n,r,o,i)),...u.flatMap(T_).map(a)];if(d==="curl")return[...l,...u.flatMap((p)=>ot(d,p)).map(a),...R_(u).map(a)];if(Qn(d)){let p=Xn.has(d)?Se([d,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Le;if(h.status==="complete")return[...l,...Sn(h,t,n,r,o,i),...u.slice(p.commandIndex).filter((g)=>!g.startsWith("-")).map(a)]}return[...l,...P_(d,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>ot(d,p)).map(a)]}function u_(e,t,n){let r=ti(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function d_(e,t,n,r,o,i,s){if(h_(t,n,r,o,i,s))return Lm(e).map((a)=>({target:a,cwd:i}));return Dm(t,m_(e),n,r,o,i,s,()=>[])}function f_(e,t,n,r,o,i,s){let a=St(e);if(!Qn(it(a[0]??"").toLowerCase()))return[];return za(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Dm(e,t,n,r,o,i,s,a){let l=y_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>Xn.has(l)?Sn(n.getShellSyntax(c),n,r,o,i,s):oi(l,c,n,r,o,i,s))}function Lm(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase();if(!km.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[Ba(r.replaceAll("%%","%"))];return t.slice(1)}function m_(e){let t=St(e);if(t.length===0)return[];let n=it(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return p_(r);return[]}function p_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[Ba(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>g_(t,r.slice(i*n,(i+1)*n)))}function g_(e,t){let n=0;return Ba(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function Ba(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function h_(e,t,n,r,o,i){let s=St(e);if(s.length===0||it(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,f=c===null?[...l,Wa]:l.map((d)=>d.split(c).join(Wa));return si(f,t,n,r,o,i).some((d)=>d.target.includes(Wa))}function y_(e){let t=St(e);if(t.length===0)return null;let n=it(t[0]??"").toLowerCase();if(!Qn(n))return null;return C_(n,t.slice(1))?n:null}function C_(e,t){let n=$a(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Mm.has(o)||Wm(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(a_.get(n)?.has(o))r++;continue}return!1}return!0}function $a(e){return/^python\d/.test(e)?"python":e}function b_(e){let t=[];for(let n of e){if(Gm(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var wm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function S_(e,t){if(!t||!wm.test(e))return e;return`~${e.replace(wm,"").replace(/\\/g,"/")}`}function ot(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function v_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>ot("jq",i))}return e.flatMap((r,o)=>o===t?[]:ot("jq",r))}function E_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>ot("git",i))];if(t.push(...ot("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:ot("git",o)),n++}return t}function R_(e){return e.flatMap((t,n)=>{let r=__(t);if(r!==null)return Pm(r.flag,r.value);let o=x_(e[n-1]);return o===null?[]:Pm(o,t)})}function Pm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Fa(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Fa(t.slice(n+1))}return t.startsWith("@")?Fa(t.slice(1)):[]}function x_(e){if(e===void 0)return null;if(Om.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function __(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Om.has(r)?{flag:r,value:e.slice(n+1)}:null}function Fa(e){return e===""||e==="-"?[]:[e]}function w_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!Bx.has(e[l]??""))continue;let c=e.slice(l+1),f=c.findIndex((m)=>$x.has(m)),d=f===-1?c:c.slice(0,f),u=si(d,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,h)=>{if(!Hx.has(m))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function P_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Mm.has(c)||Wm(e,c)){let d=t[l+1];if(d!==void 0)a.push(...oi(e,d,n,r,o,i,s)),l++;continue}let f=/^--(?:eval|exec)=(.*)$/.exec(c);if(f!==null&&f[1]!==void 0){a.push(...oi(e,f[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Wm(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return Kx.get(t[t.length-1]??"")?.has($a(e))??!1}function A_(e,t,n,r,o,i){if(!e.includes("system"))return[];return ta(e)?.commands.flatMap((s)=>Sn(t.getShellSyntax(s),t,n,r,o,i))??[]}function T_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function I_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(Ua),...e.match(Ga)??[]]}function oi(e,t,n,r,o,i,s){let a=(m)=>({target:m,cwd:i}),l=O_(t,k_(e));if(l===null)return I_(t).map(a);let c=l.masked.match(r_)!==null||l.literals.some((m)=>o_.test(l.masked.slice(0,m.start))),f=l.masked.match(i_)!==null||l.literals.some((m)=>s_.test(l.masked.slice(0,m.start))),d=r.refineInlineData===!0&&!Xn.has(e),u=d&&!(L_(l.masked)||c||f)?[]:l.literals;return[...u.map((m)=>m.text).filter((m)=>m!=="").map(a),...u.flatMap((m)=>Ua(m.text)).map(a),...d?[]:l.literals.flatMap((m)=>m.text.match(Ga)??[]).map(a),...c?l.literals.flatMap((m)=>za(m.text,n,r,o,i,s)??[a(m.text)]):[],...f?l.literals.flatMap((m)=>oi(e,m.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
+`:h),n,r,o,i,s)):[],...(l.masked.match(Ga)??[]).map(a)]}function k_(e){let t=$a(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function O_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(t_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&D_(e,o))return null;let a=t==="python"?M_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,f=N_(e,c,l);if(f===null)return null;let d=e.slice(c,f);if(/[fF]/.test(a)&&d.includes("{"))return null;if(t==="simple"&&s==='"'&&n_.test(d))return null;r.push({start:c,text:d});for(let u=o;u<f+l.length;u++)n[u]=" ";o=f+l.length-1}return{masked:n.join(""),literals:r}}function M_(e,t){return e_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function N_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function D_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function L_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(jx.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Vx.has(i)))continue;if(o.length>1)return!0;if(W_(e,r)===".")return!0;if(F_(e,r+n.length)==="(")return!0}return!1}function W_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function F_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function G_(e,t,n,r,o,i){return H_(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Sn(a,t,{...n,capturedOutput:!0},r,o,i),...z_(a,r)?B_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function z_(e,t){let n=So(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||it(Xe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Xe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function B_(e,t){return So(e).flatMap((n)=>n.kind==="word"?[Xe(n.text,t)]:n.kind==="redirection"&&n.target?[Xe(n.target,t)]:[]).flatMap(Ua)}function Ua(e){let t=U_(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||$_(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function $_(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function U_(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function H_(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Nn(o,n))continue;if(Fm(e,r,n)){let i=j_(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=V_(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function j_(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Nn(i,n))continue;if(Fm(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function V_(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Fm(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function K_(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let f=/^--([^=]+)(?:=(.*))?$/.exec(c);if(f!==null){let d=f[1]??"",u=f[2];if(d===Yx)o=!0;if(Xx.has(d))r=!0;if(u!==void 0){if(d===Rm)t.push(u);continue}if(Qx.has(d)){let m=e[l+1];if(d===Rm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let d=c.slice(1),u="",m="";for(let h=0;h<d.length;h++){let g=d[h]??"";if(Zx.has(g))r=!0;if(Jx.has(g)){u=g,m=d.slice(h+1);break}}if(u==="")continue;if(m.length>0){if(u===Em)t.push(m);continue}let p=e[l+1];if(u===Em&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function St(e){let t=e.findIndex((n)=>!Gm(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Gm(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var q_=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Y_=".env.",Z_=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),X_=[".env.example.",".env.sample."];function J_(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Q_(e){return e.length>0&&!/\s/.test(e)}function ew(e,t,n,r){try{let o=Cr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof N)throw o;return!1}}var tw=new Set(["node_modules","__pycache__"]),nw=[["vendor","bundle"],["vendor","cache"]];function rw(e,t,n,r,o){if(J_(e))return null;let i=He(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>Q_(s)||ew(e,t,r,o);if(Z_.has(s)||X_.some((u)=>s.startsWith(u)))return null;let c=B(cw(e,t,r,o));for(let u of Qi){let m=`~/${u.suffixParts.join("/")}`;if((Tm(a,m)||Tm(c,m))&&rt(u.id,n))return u.id}let f=ow(i,t,n,r,o);if(f)return f;if(q_.has(s))return null;for(let u of Ji)if(s===u.basename&&rt(u.id,n))return u.id;if(s.startsWith(Y_)&&rt(Fr.id,n)&&l())return Fr.id;for(let u of es)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&rt(u.id,n)&&l())return u.id}for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&rt(u.id,n))return u.id}if(aw(a))return null;if(!s.includes(".")&&Dn.pattern.test(s)&&rt(Dn.id,n))return Dn.id;let d=lw(s,n);if(d)return d;return null}function ow(e,t,n,r,o){return Gr.find((i)=>{if(!rt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return W(e,z(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||yr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,He("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||hr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=z(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(z(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?yr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,He(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||hr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,z(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||hr(e,s,["credentials"])||hr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,z(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,z(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((f)=>yr(e,f,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?z(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(z(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?yr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((f)=>W(e,He(f,t,r,o),l))}case"secret.cli.pi":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,z(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=He("~",t,r,o);return[ae(z(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||hr(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(He("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((f)=>W(e,f,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?yr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(z(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(z(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,He("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&jt(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,z(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,He("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Am=new WeakMap;function z(e,t,n,r,o){let i=Am.get(o)??new Map;Am.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=He(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>zm(e,ae(t,r)))}function hr(e,t,n){return n.some((r)=>jt(B(e),B(ae(t,r))))}function yr(e,t,n,r,o){return zm(e,He(t,n,r,o))}function zm(e,t){return B(e)===B(t)}function ae(e,...t){return Be([e,...t].filter(Boolean).join("/"))}function iw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Cr(e,t,o,i));return n.some((a)=>jt(s,B(Cr(a,r,o,i))))}function sw(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(Cr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Be(G(Ce(a),o.paths,i)):"",c=B(l),f=o.env.get("CC_SAFETY_NET_HOME"),d=B(f?Be(G(ii(Ce(f)),o.paths,i)):l&&Be(G(`${l}/.cc-safety-net`,o.paths,i)));if(d&&jt(s,d))return!1;return n.some((u)=>{let m=B(Cr(u,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return jt(s,m)})}function aw(e){let t=e.split("/");return t.some((n)=>tw.has(n))||nw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function lw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ns)if(r===o.extension&&rt(o.id,t))return o.id;for(let o of rs)if(o.pattern.test(r)&&rt(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function rt(e,t){return!t?.disabledRules?.includes(e)}function He(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i)return"";if(!o)return i;let s=ja(i,o),a=ri(s)?s:Be(ii(t,s)),l=Be(G(a,n.paths,r));if(!jt(l,o)){if(ri(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Tm(e,t){return e===t||e.startsWith(`${t}/`)}function cw(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i||!o)return"";let s=ja(i,o),a=Wx.normalize(ri(s)?s:Be(ii(t,s))),l=Be(Ce(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,f=[o,l].find((u)=>u!==""&&jt(c(a),c(u)));if(f===void 0)return"";let d=a.slice(f.length);return d?`~${d}`:"~"}function Cr(e,t,n,r){let{home:o,normalized:i}=Ha(e,n,r);if(!i)return"";let s=o?ja(i,o):i;return Be(G(ri(s)?s:ii(t,s),n.paths,r))}function Ha(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Be(G(Ce(r),t.paths,n)):"",i=Be(Ce(uw(Xe(e,t))));return{home:o,normalized:i}}function uw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Gx(e)}catch{return e}}function ja(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function dw(e){if(process.platform==="win32")return!0;return Fx.parse(e).root.length>1}function Be(e){let t=e.trim(),n=(t.includes("\\")&&dw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function it(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var fw={findPolicyMutation:bm,findGitMetadataMutation:td,resolveGitMetadata:mw,loadPolicySnapshot:$c,findSensitiveTarget:Nm,analyzeCommand:um,getModes:Pi};function Bm(e,t){let n={...fw,...t.dependencies},r=hw(e),o=br(e)?e.command:r,i=vt("policy-protection",o,()=>er(e)),s=pe(i,"input-candidate"),a=pe(i,"declared-command");if(br(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:$e,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:vd,intent:"stop_and_explain"}};let l=ye(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),f=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Cm,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>pm(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:mm,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let u=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Pe,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...pw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:br(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Im,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!br(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Va("command-validation",o),...g};let v=vt("command-analysis",o,()=>dm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},gw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function mw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function pw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function gw(e){return pe(e,"declared-command")?.program}function hw(e){try{return wn(e.input)}catch(t){let n=br(e)?e.command:void 0;throw new Vt("policy-protection",Va("policy-protection",t instanceof Ve?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,Va(e,r instanceof Ve?void 0:t,r),r)}}function Va(e,t,n){let r=n instanceof N||n instanceof Le;return{stage:e,decision:{kind:"deny",reason:r?fi:En,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function br(e){return e.route.kind==="command"}import{appendFileSync as Tw,mkdirSync as Iw}from"node:fs";import{isAbsolute as kw,join as Ya}from"node:path";import{lstatSync as Um,readdirSync as yw,readFileSync as Cw,rmdirSync as bw,statSync as Hm,unlinkSync as Sw,utimesSync as vw,writeFileSync as Ew}from"node:fs";import{join as Sr}from"node:path";function $m(e,t={}){return Kr(Jt(e,t),e.home).policy.audit.retention_days}var qa=86400000,Rw=".last-prune",xw=/^\d{4}-\d{2}$/,_w=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,jm=(e)=>Math.floor(e/qa);function Km(e,t,n=()=>new Date){try{let r=n().getTime();if(!Hm(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Sr(t,Rw),i=Hm(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&jm(i)===jm(r))return;let s=r-$m(e)*qa,a=new Date(r).toISOString().slice(0,7);for(let l of Ka(t)){if(l.isDirectory()){ww(Sr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Pw(Sr(t,l.name),s)}Ew(o,"",{mode:384}),vw(o,r/1000,r/1000)}catch{}}function ww(e,t,n){for(let r of Ka(e)){if(!r.isDirectory()||!xw.test(r.name))continue;let o=Sr(e,r.name);for(let i of Ka(o)){if(!i.isFile())continue;let s=_w.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+qa;if(!Number.isFinite(a)||a>=t)continue;qm(Sr(o,i.name))}if(r.name!==n)Vm(o)}Vm(e)}function Pw(e,t){try{let n=Um(e);if(n.mtimeMs>=t)return;let r=Cw(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(Aw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Um(e).mtimeMs!==n.mtimeMs)return;qm(e)}catch{}}function Aw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Ka(e){try{return yw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function qm(e){try{Sw(e)}catch{}}function Vm(e){try{bw(e)}catch{}}var Ow="2.4.3",Mw=1e4,Nw=2000,Dw=256,Lw=32768;function Ww(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function Fw(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Za(e,t,n,r,o,i,s={}){let a=Ww(t);if(!a)return;let l=zw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),f=ai(st(n),s.failureStage?Number.POSITIVE_INFINITY:Mw),d=ai(st(r),Nw),u=s.toolName?ai(st(s.toolName),Dw):void 0,m=i===null?void 0:ai(st(i),Lw),p=Ya(l,Fw(m?.value??null),c.slice(0,7));Iw(p,{recursive:!0,mode:448});let h=Ya(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Ti)(),v:Ow,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:f.value,segment:d.value,...f.truncated||d.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};Tw(h,`${JSON.stringify(g)}
+`,{encoding:"utf-8",mode:384}),Km(e,l,s.now)}catch{}}function ai(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function Gw(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&kw(n)?n:null}function zw(e){let t=Gw(e);return t?Ya(t,".cc-safety-net","logs"):null}function Zm(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Ym(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Ym(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Ym(e){return"command"in e?e.command??"":""}function Xm(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Za(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Jm(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Za(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function ep(e,t,n){try{let r=Bm(t,{environment:e,...n.guard});return Qm(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw Qm(e,t,r.evaluation,n,!(r.cause instanceof Ve),{stage:r.stage,errorCode:Bw(r.cause)}),r}}function Qm(e,t,n,r,o=!0,i){Xm(e,Zm(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function Bw(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ve)return"tool-input-limit";if(e instanceof Le)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:Rn(t),cwd:e}}function tp(e,t={}){return(n,r)=>{try{return $w(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Rn())}}}function $w(e,t,n,r){let o=Ml();if(n.cancelled?.(t))return n.block(Rn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Jm(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let f=nl(l,{includeEvidence:c});return f?n.block(f):n.allow};try{let l=ep(o,i,{guard:{auditAllowed:Nl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${ol(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var np="exec",Uw=new Set(["auto","gateway"]);function rp(e){e.on("before_tool_call",Hw(e),{matcher:[np],priority:50})}function Hw(e,t={}){return tp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>jw(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>qw(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function jw(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==np)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!Uw.has(s.host))return Et(null,{command:a,toolName:o});let l=Vw(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=Kw(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return Pn(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function Vw(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Si(".",[r],n)}catch{return}}function Kw(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Si(r,[e],n)}function qw(e){return{block:!0,blockReason:rl(e)}}var HD={...tl,register:rp};export{HD as default};