cc-safety-net 2.4.10 → 2.4.12

package/dist/amp/cc-safety-net/index.ts

@@ -1,49 +1,49 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.10
+// version: 2.4.12
 // @bun
-var Ci="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",wn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var bi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},_n={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...bi},processedCandidateBytes:{cap:4194304,...bi},pathEnvironmentExpansion:{cap:64,...bi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,..._n},trackedHeredocFiles:{cap:64,..._n},controlFlowStates:{cap:64,..._n},wrapperPeelIterations:{cap:20,..._n},derivedCommandShape:_n});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function be(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Pp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function lt(e){return Tp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Tp(e){return Pp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Ip={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function kp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Ip[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Dn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Mn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Mn},trackedHeredocFiles:{cap:64,...Mn},controlFlowStates:{cap:64,...Mn},wrapperPeelIterations:{cap:20,...Mn},derivedCommandShape:Mn});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Fp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function mt(e){return zp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function zp(e){return Fp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Bp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function $p(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Bp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function yl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function An(e={}){return{reason:wn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function bl(e){return kp({...e,redact:lt})}function Cl(e){return lt(e instanceof Error?e.message:String(e))}import{types as Op}from"util";var Mp=new Set(["applypatch","patch"]),Dp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Np=new Set(["grep","grepsearch","rg"]),Lp=new Set(["find","findbyname","glob"]),Wp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Fp=new Set(["command","diff","input","patch","patchtext"]),Sl=new TextEncoder,Gp=new TextDecoder,zp=/\s/,Bp=64;class Ye extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Pn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function _l(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Ar(e){return Wp.has(_l(e))}function xi(e){let t=_l(e);if(Mp.has(t))return"patch";if(Np.has(t))return"grep";if(Lp.has(t))return"glob";if(Dp.has(t))return"path";return"unknown"}function In(e){if(!e||typeof e!=="object")return;Ol(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)je();return}if(t.get||t.set)je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function wl(e,t){return Al(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Al(e,t,n,r){let o=kl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Al(a,t,n,r+1);return typeof a==="string"&&t.has(Pl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Pl(e){return e.replace(/-/g,"_").toLowerCase()}function Tl(e){return Il(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Up)}function Il(e,t,n,r){let o=kl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Il(a,o.array?t:Fp.has(Pl(s)),n,r+1));return n.ancestors.delete(o.object),i}function $p(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Pn.maxDepth||t.nodes>Pn.maxNodes)je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Pn.maxStringBytes||t.stringBytes>Pn.maxAggregateStringBytes)je()}function kl(e,t,n){if($p(e,t,n),!e||typeof e!=="object")return null;let r=Ol(e);if(t.ancestors.has(e))je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Pn.maxKeys)je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Ol(e){if(Op.isProxy(e))je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)je();return t}function je(){throw new Ye}function Up(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Hp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Si(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Si(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ei(wr(c.slice(4),!0),wr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Si(c))}return t}function Hp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Si(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Rl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Rl(n[1]);if(e.startsWith("diff --git "))return jp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return xl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return xl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Jp(i[1]);return[]}function jp(e){let t=Vp(e);if(t.length===2&&t[0]&&t[1])return Ei(t[0],t[1]);let n=Kp(e);return n?Ei(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Vp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Et(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Et(e[n]))n++;t.push(e.slice(i,n));continue}let o=Ml(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Et(e[n]))n++;return n===e.length?t:[]}function Kp(e){let t=0;while(t<e.length&&Et(e[t]))t++;let n=e.length;while(n>t&&Et(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Et(e[o])){o++;continue}let i=o;while(o<n&&Et(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Bp)je();if(qp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function qp(e,t,n,r,o){if(vi(e,t,n,r,o))return!0;let i=vl(e,"/",t,n),s=vl(e,"/",r,o);if(i<=t||s<=r)return!1;if(vi(e,t,i,r,s))return!1;return vi(e,i+1,n,s+1,o)}function vi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function vl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Et(e){return e!==void 0&&zp.test(e)}function Ml(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Gp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Sl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Sl.encode(Yp(s[0]??""))),o+=2}return null}function Yp(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function Zp(e){return Tn(Qp(e))}function Ei(e,t){if(e==="/dev/null")return El(t);if(t==="/dev/null")return El(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Tn);let n=Xp(e,t)??(e===t?Dl(e):null);return[e,t,...n?[n]:[]].flatMap(Tn)}function El(e){let t=Dl(e);return[e,...t?[t]:[]].flatMap(Tn)}function Dl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function Xp(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function xl(e){return Zp(wr(e,!0))}function Jp(e){return Tn(wr(e,!1))}function wr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Ml(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function Qp(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Tn(e){return e===""||e==="/dev/null"?[]:[e]}function Rl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Ti,relative as lg,resolve as Bl,sep as cg}from"path";import{basename as Wl,dirname as eg,isAbsolute as tg,join as ng,normalize as rg,resolve as Nl}from"path";var og=256,Pr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Ze(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ai(e,t){return Ri(e,0,t)}function Ri(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=_i(e,o+2),a=ig(e,o,t);if(a===null){if(Pr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=sg(l,t,n),o=a+1;continue}let i=_i(e,o+1);if(!i){r+="$",o++;continue}r+=wi(i,n)??`$${i}`,o+=i.length+1}return r}function ig(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function sg(e,t,n){let r=e.slice(2,-1),o=_i(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return wi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Pr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Pr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=wi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ri(i.slice(s.length),t+1,n);return l?Ri(i.slice(s.length),t+1,n):""}function _i(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function wi(e,t){if(!Pr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Fl(n,i);let s=t.realpath(i);if(s!==null)return Ll(n,e,s,o);let a=eg(i);if(a===i||o.length>=og)return Ll(n,e,i,o);o.push(Wl(i)),i=a}}function Ll(e,t,n,r){let o=r.length===0?n:ng(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function ag(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Fl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Fl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=zl(e,t,n);if(!o)return"";return z(o,n.paths,r).replace(/\\/g,"/")}function Gl(e,t,n,r,o){let i=zl(e,t,n);if(!i)return null;if(o(Wl(i)))return z(i,n.paths,r).replace(/\\/g,"/");let s=ag(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function zl(e,t,n){let r=n.home,o=Ai(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Nl(r,o.slice(2)):o,s=Ce(i);return rg(tg(s)?s:Nl(t,s))}function $l(e,t,n){if(Ze(e))return;let r=t.flatMap((i)=>Pi(i,n));if(!r[0])return;let o=Pi(Ti(e)?e:Bl(r[0],e),n)[0];if(!o)return;return r.some((i)=>ug(o,i))?o:void 0}function Ul(e,t,n){if(Ze(e))return;return Pi(Ti(e)?e:Bl(t,e),n)[0]}function Pi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function ug(e,t){let n=lg(t,e);return n===""||n!==".."&&!n.startsWith(`..${cg}`)&&!Ti(n)}function Yt(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Fg,realpathSync as Gg,statSync as zg}from"fs";import{homedir as Bg,tmpdir as $g}from"os";import{statSync as Ng}from"fs";import{join as Lg}from"path";import{spawnSync as dg}from"child_process";import{existsSync as On,lstatSync as mg,readFileSync as Mn,realpathSync as Zt,statSync as kn}from"fs";import{dirname as Ii,isAbsolute as ki,join as Xt,resolve as Tr}from"path";var fg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],pg=5000;function jl(e,t=kg(),n=pg){let r=gg(e),o=r===null?null:hg(r);if(r===null||o===null)return null;let i=Tg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function gg(e){try{let t=Zt(Tr(e));return kn(t).isDirectory()?t:null}catch{return null}}function hg(e){let t=Pg(e);if(!t)return null;try{let n=mg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Oi(t);if(!r?.commonDir)return null;if(!Cg(r.gitDir,t))return null;return Sg(r.gitDir,Ii(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Oi(e){try{let t=yg(e);if(!t)return null;let n=Zt(ki(t)?t:Tr(Ii(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:bg(n)}}catch{return null}}function yg(e){let t=Mn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function bg(e){try{let t=Mn(Xt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Zt(ki(t)?t:Tr(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Cg(e,t){let n=vg(e);return n===null?!1:Vl(e,n,t)}function Sg(e,t){let n=Eg(e);return n===null?!0:Vl(e,n,t)}function vg(e){let t=Xt(e,"gitdir");if(!On(t))return null;let n=Mn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Eg(e){let t=Xt(e,"config.worktree");return On(t)?Rg(t):null}function Vl(e,t,n){try{return xg(ki(t)?t:Tr(e,t),n)}catch{return!1}}function xg(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Hl(Zt.native(e))===Hl(Zt.native(t))}function Hl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Rg(e){let t=Mn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=_g(s[1]??"")}return r}function _g(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Ag(t.slice(1,-1))}var wg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Ag(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:wg[n]??t)}function Pg(e){try{return Mi(Zt(e))}catch{return null}}function Mi(e){let t=e;while(!0){let n=Xt(t,".git");if(On(n))return n;let r=Ii(t);if(r===t)return null;t=r}}function Tg(e,t,n,r){if(Ig(t))return!0;if(n===null)return!0;let o=dg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Og(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Kl(o.stdout.trim())}function Ig(e){return[Xt(e.commonDir,"config"),Xt(e.gitDir,"config.worktree")].filter((t)=>On(t)).some((t)=>Mg(t))}function kg(){return fg.find((e)=>On(e))??null}function Dn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Og(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Dn(t)))}function Mg(e){let t;try{t=Mn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Dg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Kl(c)}return r}function Dg(e){return e==="include"||e.startsWith("includeif ")}function Kl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function ql(e,t){if(e==="")return null;let n=be(),r=Mi(se(e,e,t,n)),o=r?Wg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Wg(e,t,n,r){try{let o=se(e,t,n,r),i=Ng(e),s=i.isFile()?o:null,a=i.isFile()?Oi(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Jt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Jt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Jt(o),markerFile:s?Jt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=Jt(Lg(u,"hooks").replace(/\\/g,"/"));return[m,Jt(se(m,t,n,r))]}))]}}catch{return null}}function Jt(e){return process.platform==="win32"?e.toLowerCase():e}var Ug={realpath:(e)=>{try{return Gg(e)}catch{return null}},entryKind:(e)=>{let t=Fg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return zg(e).isDirectory()}catch{return!1}}};function Zl(){return Hg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Ce(process.env.HOME||Bg()),tmpdir:$g(),paths:Ug})}function Hg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>Yl(n,i,()=>ql(i,o)),worktreeFacts:(i)=>Yl(r,i,()=>jl(i)),...t};return o}function Yl(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Qt=["fail_closed","paranoid_rm","paranoid_interpreters"],Ir={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},kr=["standard","strict","paranoid"];function jg(e,t){if(!t)return e;return kr.indexOf(t)>kr.indexOf(e)?t:e}function Vg(e){let t=Wi(Q.level,e);if(t===void 0||t==="")return;if(kr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${kr.join(", ")}.`);return}function Kg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Xl(e){return Kg(Wi(Q.auditScope,e))==="all"}function Ni(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Li(e={},t){let n=e.safety?.level??"standard",r=Vg(t),o=jg(n,r),i=Ir[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(xt(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(xt(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(xt(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(xt(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||xt(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ni(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function xt(e,t){let n=typeof e==="string"?Di(e,t):Wi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Di(e,t){return t.get(e)}function Wi(e,t){let n=Di(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Di(e.legacyName,t);return}import{dirname as zr}from"path";import{closeSync as qg,constants as Jl,fstatSync as Yg,fsyncSync as yP,lstatSync as zi,mkdirSync as bP,openSync as Zg,readdirSync as CP,readFileSync as Xg,realpathSync as Bi,renameSync as SP,rmdirSync as vP,statSync as Jg,unlinkSync as EP,writeFileSync as xP}from"fs";import{isAbsolute as Ql,join as $i,normalize as Qg,parse as Gi,relative as Ui,resolve as Hi,sep as ji}from"path";function Fi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var eh=Symbol("PolicyFilesystemScope"),th=Symbol("PolicyFilesystemTarget"),nh=Jl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function Rt(e,t){return{[eh]:!0,root:Hi(e),label:t}}function ec(e,t){let n=Qg(t);if(t===""||Ql(t)||n===".."||n.startsWith(`..${ji}`))throw new ae(e.label);return{[th]:!0,scope:e,relativePath:n,path:$i(e.root,n)}}function Nn(e,t){return ec(e,Ui(e.root,Hi(t)))}function tc(e,t="rules policy"){let n=Hi(e),r=Gi(n).dir;return ec(Rt(r,t),Ui(r,n))}function Mr(e){return rc(e.scope.label,()=>{if(!Or(e))return null;let t=Zg(e.path,Jl.O_RDONLY|nh);return rh(t,()=>{let n=Yg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Xg(t,"utf-8"),o=zi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Or(e),r})})}function nc(e,t){if(e.path===t.path)return!0;return rc(e.scope.label,()=>{if(!Or(e)||!Or(t))return!1;let n=(r)=>$i(Bi(Gi(r).dir),Gi(r).base);return n(e.path)===n(t.path)})}function rc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function rh(e,t){try{return t()}finally{qg(e)}}function Or(e,t="file"){let n=oh(e.scope);if(!n)return!1;let r=e.relativePath.split(ji);for(let o of r.keys()){let i=$i(e.scope.root,...r.slice(0,o+1)),s=zi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);ih(n,Bi(i),e.scope.label)}return!0}function oh(e){if(!zi(e.root,{throwIfNoEntry:!1}))return null;if(!Jg(e.root).isDirectory())throw new ae(e.label);return Bi(e.root)}function ih(e,t,n){let r=Ui(e,t);if(r===".."||r.startsWith(`..${ji}`)||Ql(r))throw new ae(n)}import{dirname as wt,isAbsolute as uh,join as Pt,relative as dh,resolve as At,sep as mh}from"path";var _t=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,oc="rulebook.json",ic=".cc-safety-net/rules";var sc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var sh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,ah=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),lh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),AP=new RegExp(`^${ah}/(${_t.source.slice(1,-1)})/${lh}$`);function ch(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function ac(e){if(Dr(e))try{return Vi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return _t.test(e)?null:`Local rulebook sources must be bare names matching ${_t}: ${e}`}function Vi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(sc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!sh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!_t.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:ch(o),name:o}}function Dr(e){return sc.test(e)}var lc="rule.json",Nr="policy.json",cc=".cc-safety-net",fh="rules",ph="CC_SAFETY_NET_HOME",uc="`cc-safety-net rule update`";function gh(e){return At(e,ic)}function hh(e){return Pt(gh(e),lc)}function Ln(e){return Pt(At(e),cc,Nr)}function Ki(e,t={}){return t.userConfigDir??(t.userConfigPath?wt(t.userConfigPath):Pt(yh(e),fh))}function yh(e){let t=e.env.get(ph);return t?At(Ce(t)):Pt(e.home,cc)}function bh(e,t={}){return Pt(Ki(e,t),lc)}function en(e,t={}){return Pt(wt(Ki(e,t)),Nr)}function dc(e,t){let n=t.userConfigPath??bh(e,t),r=t.projectConfigPath??hh(t.cwd),o=Ch(e,t),i=Sh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Nn(o,n),projectConfigTarget:Nn(i,r)}}function Ch(e,t){let n=t.userConfigPath?wt(wt(At(t.userConfigPath))):wt(At(t.userConfigDir??Ki(e,t)));return Rt(n,"user policy")}function Sh(e,t){let n=At(t),r=At(e),o=dh(n,r);if(o!==".."&&!o.startsWith(`..${mh}`)&&!uh(o))return Rt(n,"project policy");return Rt(wt(wt(r)),"project policy")}function mc(e,t){return Pt(e,t,oc)}var Se=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ct=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ut=256,J=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),fc=new Set(["python","python3","python2","node","ruby","perl"]),Lr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Wr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var pc="Rulebook exceeds CC Safety Net's safe validation limits.",gc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function hc(e){if(qi(e.allowed_commands,Oe.maxAllowedCommands)||qi(e.rules,Oe.maxRules)||qi(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function qi(e,t){return Array.isArray(e)&&e.length>t}var Yi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Zi=64,Xi="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return k(e).toLowerCase()}function k(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var vh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Ji=new Set(["--init-file","--rcfile"]);function Qi(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!vh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=k(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Ji.has(l)&&!s.includes("="))i++;continue}let a=Qi(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Wn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Fr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Eh(e))Wn(n,t);return t.inSingle||t.inDouble}function Eh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Wn(s,n)}return t}var es=new Set(["rm","find","xargs","parallel"]),xh=new Set(["git","busybox",...es,...J,...fc,...we]),Rh=new Set(["python","node","ruby","perl"]);function yc(e){let t=O(e);return xh.has(t)||Me(t)}function Me(e){return Rh.has(_h(e))}function _h(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function ts(e){try{let t=Mr(wh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Th(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function wh(e){return typeof e==="string"?tc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function bc(e){let t=new Set;return e.flatMap((n,r)=>{let o=tn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ns=`must be one of ${Yi.join(", ")}`,Ah=/^[^/]+\/[^/]+$/,Ph=["version","rules","overrides","transparent_wrappers"];function Th(e){let t=Ih(e);return{errors:rs(Gh(t,Ph,(n)=>n.kind==="custom"),": "," "),sources:Fh(e,t)}}function Ih(e){if(!tn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Zi;return[...e.version===1?[]:[_(["version"],"must be 1")],...kh(e.rules,t),...Dh(e.overrides),...Lh(e.transparent_wrappers),...t?[]:Mh(e.rules),...tn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Ah.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Wh(e.transparent_wrappers)]}function kh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...Cc(e,Zi)?[_(["rules"],Xi)]:[]];if(t)return[{path:["rules"],message:Xi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Oh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Cc(e,t){let n=Sc(e);return n!==void 0&&!(n<=t)}function Oh(e,t){let n=Sc(e);return n!==void 0&&!(n>=t)}function Sc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Mh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=ac(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Dh(e){if(e===void 0)return[];if(!tn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!tn(n))return[_(["overrides",t],'must be "off" or an object')];return[...Nh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||is(n.intent)?[]:[_(["overrides",t,"intent"],ns)]]})}function Nh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...Cc(e,ut)?[_(t,`must be at most ${ut} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>ut?[_(t,`must be at most ${ut} characters`)]:[]}function Lh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ct.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Wh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(yc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Fh(e,t){let n=tn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Gh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function rs(e,t,n){return[...new Set(e.map((r)=>{let o=os(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function os(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function is(e){return Yi.includes(e)}function tn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ec(e){let t=$h(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var zh=`required non-empty string up to ${ut} characters`,vc="must be a non-empty array of unique non-empty strings",Bh="required non-empty array of non-empty strings";function $h(e){if(!dt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!hc(e))return{errors:[pc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...rs(Uh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),gc]:t,ruleNames:new Set(xc(e).map((n)=>n.toLowerCase()))}}function xc(e){let t=dt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=dt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Uh(e,t){return[...typeof e.name==="string"&&_t.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...Hh(e.allowed_commands),...jh(e.rules,t),...Yh(e.tests),...Zh(e),...Xh(e)]}function Hh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ct.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ct.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function jh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!dt(n))return[_(["rules",r],"must be an object")];return t?Kh(n,["rules",r]):Vh(n,["rules",r])}),...bc(e)]}function Vh(e,t){return[...Rc(e.name,t),..._c(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ct.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Gr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...wc(e.reason,t),...Ac(e.intent,t)]}function Kh(e,t){return[...Rc(e.name,t),..._c(e.command,t),...wc(e.reason,t),...Ac(e.intent,t),...qh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Rc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return _t.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function _c(e,t){return typeof e==="string"&&ct.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function wc(e,t){return typeof e==="string"&&e!==""&&e.length<=ut?[]:[_([...t,"reason"],zh)]}function Ac(e,t){return e===void 0||is(e)?[]:[_([...t,"intent"],ns)]}function qh(e,t){if(!dt(e))return[_(t,"required object")];return[...Gr(e.command_path,[...t,"command_path"],Bh,!1),...e.any_args===void 0?[]:Gr(e.any_args,[...t,"any_args"],vc,!0),...e.exclude_args===void 0?[]:Gr(e.exclude_args,[...t,"exclude_args"],vc,!0)]}function Gr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Yh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!dt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Zh(e){if(!Array.isArray(e.tests))return[];let t=new Set(xc(e));return[...new Set(e.tests.flatMap((n)=>dt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Xh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=dt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function dt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Mc(e,t){let n=dc(e,t),r;try{r=nc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ae)return sy(n,f.message);throw f}let o=ts(n.userConfigTarget),i=r?{config:null,errors:[]}:ts(n.projectConfigTarget),s=kc(n.userConfigPath,o.errors),a=kc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Pc(o.config,zr(n.userConfigPath),"user",n.userScope,l):Oc(),u=i.config?Pc(i.config,zr(n.projectConfigPath),"project",n.projectScope,l):Oc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Tc(c.rules,m),...Tc(u.rules,d)],transparent_wrappers:oy(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Ic(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?iy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Ic(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Pc(e,t,n,r=Rt(zr(zr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=Qh(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:Jh(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Jh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function Qh(e,t,n){let r=ey(e),o=mc(t,r),i=ny(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${ty(e)}`]};let s=ry(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function ey(e){return Dr(e)?Vi(e).name:e}function ty(e){return Dr(e)?`run ${uc} to vendor ${e}`:"create that file or remove that source from the rules config"}function ny(e,t){try{return{content:Mr(Nn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function ry(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Ec(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function oy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Tc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Ic(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function iy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function kc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function sy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Oc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as by,readFileSync as Cy}from"fs";var Dc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],ss=new Set(Dc.map((e)=>e.id)),Br=Dc,ay=new Map(Br.map((e)=>[e.id,e.intent]));function C(e,t){return{id:e,reason:t,intent:ay.get(e)??"manual_only"}}var as=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],$r={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},ly=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],cy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ls=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...cy.flatMap((e)=>ly.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Ur=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Nc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],uy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],cs=Nc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),us=Nc.flatMap((e)=>uy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Fn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},ds=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),ms=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],dy=[...as,$r,...ls,...cs,...us,Fn,...ds,...ms,...Ur].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Hr=new Set(Ur.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),fs=new Set(dy.map((e)=>e.id));import{isAbsolute as ps,join as my,normalize as fy,sep as jr}from"path";var Vr=process.platform==="win32",Lc=/[*?]/;function gs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(Vr?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Lc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Gn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function hs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Gn(e.trim(),t);if(!ps(n))return"must be an absolute path or start with ~/";return zn(n,t)}function ys(e,t){let n=Wc(e,t);if(n===null)return"must be a non-empty path string";if(!ps(n))return null;if(zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var py="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",gy="cannot cover the guard's own configuration";function Wc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=Vr?n.replaceAll("\\","/"):n;return Gn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function bs(e,t){let n=Wc(e,t);if(n===null)return"must be a non-empty path string";let r=gs(n)?.root??n;if(Lc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!ps(r))return null;if(zn(r,t)!==null)return py;return hy(r,t)?gy:null}function hy(e,t){let n=Kr(e),r=Kr(my(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${jr}`)}function zn(e,t){let n=Kr(e),r=Kr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(jr)?n:`${n}${jr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Kr(e){let t=fy(e);if(Vr)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(Vr?3:1)&&t.endsWith(jr))t=t.slice(0,-1);return t}var Fc=30,qr=1,Yr=365;function Gc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var zc=new Set(Br.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(zc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(zc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Bc(e,t){return Object.freeze(Object.fromEntries(Br.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function $c(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Bc(e,t)})}var Uc={standard:0,strict:1,paranoid:2};function Vc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:yy(e,t)}}function Cs(e,t){return[...new Set([...e,...t??[]])]}function yy(e,t){let n=t.safety?.level,r=Ir[e.safety.level];return[...n&&Uc[n]<Uc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Qt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Hc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Hc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Hr.has(o))),...e.destructive_command_protection.enabled?jc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?jc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Hc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function jc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var Es=new Set(["standard","strict","paranoid"]),Zc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Fc}};function Xc(e,t){let n=Ty(en(e,t),e.home),r=Jr(Ln(t.cwd),e.home),o=vy(r.parsed,e.home),i=Object.keys(o.policy).length>0?Vc(n.gui??Zc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?vs(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Sy="project policy audit settings are ignored; audit is user scope only";function vy(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...Es.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?Kc({overrides:Jc(n.overrides,Qt,["safety","overrides"],Tt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Xr(o.overrides,ss,eu,Tt)}:{},...o.allow_paths!==void 0?{allow_paths:rn(o.allow_paths,hs,t,["destructive_command_protection","allow_paths"],Tt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Xr(i.overrides,fs,tu,Tt)}:{},...i.deny_paths!==void 0?{deny_paths:rn(i.deny_paths,ys,t,["secret_protection","deny_paths"],Tt)}:{},...i.allow_paths!==void 0?{allow_paths:rn(i.allow_paths,bs,t,["secret_protection","allow_paths"],Tt)}:{}};return{policy:Kc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Sy]}}function Jc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],xs));return[]}))}function Kc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Tt=()=>{return},xs="must be a boolean",Rs="must be an object if provided",Qc=`must be an integer between ${qr} and ${Yr}`,eu={path:["destructive_command_protection","overrides"],label:"destructive command"},tu={path:["secret_protection","overrides"],label:"secret protection"},Ey=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function xy(e,t){let n=[];return{policy:nu(e,t,(o)=>{n.push(o)}),issues:n}}function Ry(e,t){return nu(e,t,Tt)}function nu(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Zr();if(e.version!==1)n(_(["version"],"must be 1"));let r=nn(e.safety,["safety"],["level","overrides"],n),o=nn(r.overrides,["safety","overrides"],Qt,n),i=nn(e.workflow,["workflow"],["worktree_mode"],n),s=nn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=nn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=nn(e.audit,["audit"],["retention_days"],n);return ru(e,Ey,[],n),{version:1,safety:{level:_y(r.level,n),overrides:Jc(o,Qt,["safety","overrides"],n)},workflow:{worktree_mode:Ss(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Ss(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Xr(s.overrides,ss,eu,n),allow_paths:rn(s.allow_paths,hs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Ss(a.enabled,["secret_protection","enabled"],!0,n),overrides:Xr(a.overrides,fs,tu,n),deny_paths:rn(a.deny_paths,ys,t,["secret_protection","deny_paths"],n),allow_paths:rn(a.allow_paths,bs,t,["secret_protection","allow_paths"],n)},audit:{retention_days:wy(l.retention_days,n)}}}function nn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,Rs)),{};return ru(e,n,t,r),e}function ru(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function _y(e,t){if(e===void 0)return"standard";if(Es.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Ss(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,xs));return n}function wy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=qr&&e<=Yr))t(_(["audit","retention_days"],Qc));return Gc(e)}function Xr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,Rs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function rn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Zr(){return structuredClone(Zc)}function Jr(e,t){if(!by(e))return{exists:!1,policy:Zr(),errors:[]};try{let n=Cy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Zr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=xy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Py(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Zr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Ay=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Rs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[xs,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Qc,`not an integer between ${qr} and ${Yr}`]]);function Py(e){let t=os(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Ay.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Ty(e,t){let n=Jr(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:Yc(),errors:[]};let o=Ry(r,t);return{policy:vs(o),gui:o,errors:[],levelPresent:qc(r)}}if(n.parsed===void 0)return{policy:Yc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:vs(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:qc(n.parsed)}}function qc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return Es.has(t.level)}function ou(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Hr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function Yc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:ou({}),denyPaths:[],allowPaths:[]}}}function vs(e){return{safety:Iy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:ou(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Iy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function iu(e,t){let n=Mc(e,t),r=Xc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Dy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Ny(o,ky(n,r),s,r.policyScopes)}function ky(e,t){let n=My(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Ly(e.errors.length>0?Oy(e.errors):void 0,e.warnings.length>0?ws(e.warnings.join("; ")):void 0,n)}}function Oy(e){return`${ws(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function My(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Dy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Ny(e,t,n=Object.freeze({}),r){let o=_s(structuredClone(e)),i=r?{policyScopes:_s(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function _s(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))_s(t);return Object.freeze(e)}function Ly(...e){return ws(e.filter((t)=>!!t).join("; "))}function ws(e){return/[.!?]$/.test(e)?e:`${e}.`}function su(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:As(t.fail_closed,e.strict,"strict"),paranoid_rm:As(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:As(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:$c(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ni({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function As(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Bn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Wy=/^[A-Za-z_][A-Za-z0-9_]*=/;function Qr(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function $n(e){let t=Qr(e.words[0],"time")?1:0,n=t===1&&Qr(e.words[t],"-p")?t+1:t,r=t===1&&Qr(e.words[n],"--")?n+1:n,o=Qr(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Wy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var mt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function eo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Fy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function to(e,t,n){e.push(n),t.reset()}function no(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Ps(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function on(e,t,n,r,o,i,s){return Ps({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Fy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ts(e,t,n){if(t>=n||lu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!lu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=au(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=au(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Is(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Gy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?zy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function au(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function lu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Gy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function zy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var mu=new Set(["&&","||","|","|&"]);function fu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=io(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:lo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function io(e,t,n,r,o,i,s){let a=[],l=[],c=eo(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);to(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),du(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(ao(f)){if(f===`
-`||f==="\r"){m();let v=f==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!mu.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=Is(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?ab(e,d,n):void 0;if(p){if(Os(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);if(!ks(o))return sn(a,l,d,"word-limit",r.maxWords);let v=io(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=cu(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Hn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return oo(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=so(e,d);if(g){if(m(),!vu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&qy(e,d,n))&&c.start===-1){if(Os(a,l),i>=r.maxDepth)return sn(a,l,d,"depth-limit",r.maxDepth);let v=f==="("?")":"}",T=io(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=cu(e,A,T);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Hn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return oo(a,l,T.next);if(!T.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?Hy(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],Z=A>d+h.length&&q==="#",ee=!q||ao(q)||!!so(e,A)||q===s||q===")"||Z||(q==="<"||q===">")&&e[A+1]!=="(",X=h==="<<"||h==="<<-",U=X?Ts(e,A,n):void 0,N=U?{word:on(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Ms(e,A,n,r,o,i):void 0;if(N){if(l.push(...N.issues),N.limited)return oo(a,l,N.next);if(!ks(o))return sn(a,l,N.next,"word-limit",r.maxWords)}let ue=N?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...N?{target:N.word}:{}};if(c.redirections.push(_e),X&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let qe=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;qe.push(...$y(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!X&&!N)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(N)c.nested.push(...N.nested);c.end=ue,d=ue;continue}if(c.start===-1)Os(a,l);let y=Ms(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return oo(a,l,y.next);let S=Xy(c.words)?nb(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return sn(a,l,y.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[y.word];for(let v of E){if(!ks(o))return sn(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),du(a,l),l.push(...lb(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function cu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:lo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ms(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ao(f)||(f===";"||f==="|"||f==="&")&&so(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=By(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=jy(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?co(e,a,n,r,o,i):null;if(g){let h=pu(g,u,m);if(d||=h.limited,c=Un(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=yu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Un(c,"glob");s+=f,a++}return{word:on(e,t,a,s,c,l,c==="literal"?void 0:Ky(e,t,a)),nested:u,issues:m,next:a,limited:d}}function By(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
-`){m+=2;continue}if(p==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Ds(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=co(e,m,n,r,o,i);if(f){let p=pu(f,l,c);if(m=p.next,u||=p.limited,a=Un(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let p=yu(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function co(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Ds(e,t+u,n,m),f=d===-1?n:d,p=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:sb(e,t+u,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let S=[],E=[],v=!1,T=t+u;while(T<f){let x=co(e,T,f,r,o,i+1);if(!x){T++;continue}if(S.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:lo(E,v),issues:E,nodes:S}),next:p,provenance:"arithmetic"}}let g=io(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Hn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:lo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function $y(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?co(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function pu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Ds(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
-`||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Is(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=gu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Uy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Ts(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Uy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=gu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function gu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!cb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function so(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function Hy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ao(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function hu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function jy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Vy(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Vy(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return ro(e,t+1,n,16,2,t+1);if(r==="u")return ro(e,t+1,n,16,4,t+1);if(r==="U")return ro(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return ro(e,t,n,8,3,t+1);return{text:r,next:t+1}}function ro(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function lo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function yu(e,t,n,r,o){let i=hu(e,t,n);return{text:r+e.slice(t,i),provenance:Un(o,"variable"),next:i}}function Ky(e,t,n){let r=no(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,p=c?"))":d?"`":")",g=Ds(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=hu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Un(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function qy(e,t,n){return t+1>=n||ao(e[t+1]??"")||so(e,t+1)!==null}var Yy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Zy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Xy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Jy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Jy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return Qy(e,t);if(n==="env")return eb(e,t);if(n==="sudo")return tb(e,t);return}function Qy(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function eb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Yy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function tb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Zy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function bu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Cu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Su(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function nb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Cu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Su(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>on(e,t.span.start,t.span.end,a,"literal",!1))}}function Cu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>uu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=uu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...rb(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function uu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&ib(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:ob(e,r)}}function rb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function ob(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function ib(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Su(e,t){let n=`x${e}`,r=Ms(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function sb(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function sn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function oo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function ks(e){return e.used++,e.used<=e.max}function ab(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Hn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Hn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Hn(t.body.nodes)})}function lb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function vu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function du(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!mu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Os(e,t){if(!vu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function cb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var xu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),ub=new Set(["gc","cat","type","cp","mv","rm"]),Ru=["-rec","-for","-path","-literalpath","-whatif"],db=/^\$env:\w/i,mb=/^(?:\$\{?\w+\}?|~)\\./;function _u(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...xu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Ru.some((o)=>n.includes(o)))&&!n.includes("<#")&&!fb(n))return!1;let r=Fs(e,t);if(wu(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ws(r).some(pb)}function wu(e){return e.nodes.some((t)=>{if(t.kind==="group")return wu(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function fb(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function pb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&xu.has(n))return!0;let r=e.slice(t+1);if(n&&ub.has(n)&&r.some(gb))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Ru.some((s)=>i.startsWith(s))})}function gb(e){return db.test(e)||mb.test(e)}function Fs(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Gs(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Sb(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Gs(e,t,n,r,o,i=!1){let s=[],a=[],l=eo(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};to(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=Cb(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
-`){m();let y=f==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(Ns(e,d,y)),d=y;continue}d++;continue}let g=Tu(e,d);if(g){m(),s.push(Ns(e,d,d+g.length)),d+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Pu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Gs(e,d+1,n,r,o+1,!0),S=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,S),span:{start:d+1,end:S},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(Ns(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,S=y;while(/[ \t]/.test(e[S]??""))S++;let E=S<n?Eu(e,S,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Ps({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Eu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Eu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(p)=>{let g=hb(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Ls(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Tu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:on(e,t,f,i,s,a,s==="literal"?void 0:yb(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function hb(e,t,n,r,o){let i=Au(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Pu(r.maxDepth)],nodes:[]}),next:a};let l=Gs(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Au(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ls(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ls(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ls(r)}}return t}function yb(e,t,n){let r=no(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Au(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=bb(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function bb(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Pu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ws(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ws(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ws)]})}function Tu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function Cb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Sb(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ns(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=mt){if(t==="powershell"||t==="auto"&&_u(e.slice(0,n.maxInputLength),n))return Fs(e,n);return fu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function an(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function uo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function zs(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Y(e){return e.value.length}function jn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){jn(e,t)}function It(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function Bs(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Y(e))return!1;for(let r=0;r<n.length;r++)if(b(e,t+r)!==n[r])return!1;return!0}function Xe(e,t,n){return!It(b(e,t-1))&&j(e,t,n)&&!It(b(e,t+n.length))}function Je(e,t){return It(b(e,t-1))!==It(b(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function ln(e){return e==="|"||e===";"}function mo(e,t,n){let r=zs(e,n);if(t==="rm")return vb(r);if(t==="dd")return xb(r);return Nu(r,!0)}function fo(e,t,n){let r=zs(e,n);if(t==="rm")return Rb(r);if(t==="reset-hard")return Mu(r,"--ha","rd");if(t==="reset-merge")return Mu(r,"--me","rge");if(t==="clean")return Pb(r);if(t==="checkout")return Ib(r);if(t==="push-force")return kb(r);if(t==="push-refspec")return Ob(r);if(t==="push-delete")return Mb(r);if(t==="branch")return Db(r);if(t==="tag")return Wb(r);if(t==="restore")return Fb(r);return Nu(r,!1)}function vb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Y(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(Xe(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=Eb(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Y(e)){if(o>=0){let l=Iu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Iu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Eb(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Iu(e,t,n){if(ku(e,t,n,"recursive"))return{recursive:!0,force:!1};if(ku(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function ku(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function xb(e){let t=!1;for(let n=0;n<Y(e);n++){if(oe(b(e,n))){t=!1;continue}if(Xe(e,n,"dd")){t=!0,n++;continue}if(!t||!Xe(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Y(e)&&!H(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function Rb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);){let i=b(e,o);if(o===Y(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=wb(e,o);if(s>=0){if(_b(e,s))return!0;let a=s,l=!1;while(H(b(e,a)))l||=b(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(b(e,o-1)))&&(!b(e,o+2)||H(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Je(e,o+11)||$s(e,o,"recursive"),r||=j(e,o,"--force")&&Je(e,o+7)||$s(e,o,"force"),n&&r)return!0;o++}return!1}function $s(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Je(e,t+r+2)}function _b(e,t){let n=t,r=!1,o=!1;while(n<Y(e)){while(H(b(e,n)))n++;let i=n;while(n<Y(e)&&!H(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=Ou(e,i,"recursive"),a=Ou(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=Ab(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Ou(e,t,n){return j(e,t,`--${n}`)&&Je(e,t+n.length+2)||$s(e,t,n)}function wb(e,t){if(t>0&&It(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!H(b(e,n+1)))return-1;return n+1}function Ab(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=b(e,c)??"",m=(u==="r"||u==="f")&&Je(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Mu(e,t,n){return Kn(e,"reset",ln,!0,(r)=>b(e,r)==="-"&&cn(e,r,t,n)?!0:r)}function Pb(e){return Kn(e,"clean",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(cn(e,t,"--fo","rce"))return!0;let n=Vn(e,t,ln);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function po(e,t,n){if(!Xe(e,t,"git"))return null;let r=t+3;if(!H(b(e,r)))return{commandEnd:-1,next:r};while(H(b(e,r)))r++;while(r<Y(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=Vn(e,r,oe);if(Xe(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=Tb(e,r,o);r=o;while(H(b(e,r)))r++;if(i)return{commandEnd:Xe(e,r,n)?r+n.length:-1,next:Vn(e,r,oe)};if(!s)continue;if(r>=Y(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=Vn(e,r,oe);while(H(b(e,r)))r++}return{commandEnd:-1,next:r}}function Tb(e,t,n){for(let r of Se)if(n-t===r.length&&j(e,t,r))return!0;return!1}function Ib(e){return Du(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function kb(e){return Kn(e,"push",ln,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!It(b(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Lu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function Ob(e){return Kn(e,"push",oe,!1,(t)=>{if(H(b(e,t))&&b(e,t+1)==="+"&&t+2<Y(e)&&!oe(b(e,t+2))&&!H(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function Mb(e){return Kn(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&cn(e,t,"--de","lete"))return!0;if(H(b(e,t))&&b(e,t+1)===":"&&t+2<Y(e)&&!H(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function Db(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Y(e);o++){if(o===Y(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=po(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=Vn(e,o,oe),s=Nb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function Nb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(cn(e,i,"--de","lete"))r=!0;if(cn(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&Lb(b(e,s))){let u=b(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Je(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function Lb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Wb(e){return Du(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Du(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Y(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=po(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(cn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Je(e,r+1))return!0;if(ln(o))i.outerActive=!1}return!1}function Kn(e,t,n,r,o){let i=!1;for(let s=0;s<Y(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=po(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(b(e,u)))i=!1;s=c}if(l)i=!1}return!1}function Fb(e){let t=!1;for(let n=0;n<Y(e);n++){if(Bs(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=po(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Nu(e,t){let n=!1;for(let r=0;r<Y(e);r++){let o=b(e,r),i=t?Bs(o):oe(o);if(n&&H(o)&&b(e,r+1)==="-"&&Xe(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Xe(e,r,"find"))n=!0,r+=3}return!1}function Vn(e,t,n){let r=t;while(r<Y(e)&&!H(b(e,r))&&!n(b(e,r)))r++;return r}function Lu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return Je(e,o)?o:-1}function cn(e,t,n,r){return Lu(e,t,n,r)>=0}function Ae(e,t){jn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&fo(a,s.scan,t))return C("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Gb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Fu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;jn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Gu(t.nodes,r,i)}function Gu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Gu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return zb(r,t,n)})}function zb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Gb.test(o.text));return e.words.every((o,i)=>o===t||Wu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Wu(o.target.raw,n.anchored,!0)))}function Wu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Bb,resolve as zu}from"path";function qn(e,t,n,r){let o=Bb(e)?zu(e):t?zu(t,e):void 0;if(!o)return;try{return z(o,n,r)}catch{return o}}function Bu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var un="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Yn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Hs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),$b=new Set(["-p","--print"]),Ub=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),Hb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),jb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),Vb=new Map([["python",new Set(["m"])]]),Kb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),qb=new Set(["always","default","never"]),Yb=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),Zb=/\\\r?\n/g,Xb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function $u(e){return ho(e).code}function go(e){return ho(e).sources}function Uu(e){return Xb.get(Vs(e))??[]}function ho(e){let t=Vs(e[0]??"");if(!Hs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&$b.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(Qb(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(eC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=Jb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(Kb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&Yb.has(s))||t==="python"&&!qb.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(Vb.get(t)?.has(d)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Ne(t,n,r,o)}if(Ub.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(Hb.get(t)?.has(d)){if(m+1===s.length)i++;break}if(jb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function Jb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function js(e,t){return Vs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Vs(e){let t=k(e).toLowerCase();return Lr.test(t)?"python":t}function Qb(e,t){return Hs.get(e)?.has(t)??!1}function eC(e){return Hs.get(e)?.has("--eval")??!1}function Zn(e,t,n=!1){let r=rC(e,t);if(!Us(r,t))return!1;xe(t,r);let o=nC(r);if(Us(o,t))return!0;if(xe(t,o),!Hu.test(o))return!1;return!n||tC(r,t)}function tC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>Hu.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:Ks(o,a)}});if(i.some((s)=>qs(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&Us(s.text,t))}function Ks(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function qs(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Hu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function nC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Us(e,t){if(mo(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(mo(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(mo(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>fo(o,r))))}function rC(e,t){return xe(t,e),e.replace(Zb,"")}import{isAbsolute as hd,relative as yd}from"path";import{isAbsolute as Xu,parse as fC}from"path";import{dirname as oC,isAbsolute as iC,parse as sC,sep as aC}from"path";function ft(e,t,n){if(Ze(t))throw Error("Unsupported Windows namespace path");let r=iC(t)?sC(t).root:"",o=r||e;for(let i of cC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=oC(o);continue}let s=lC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function lC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${aC}${t}`}function cC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Ys=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],uC=new Set(Ys),dC=1024,ju=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Vu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),mC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function yo(e){return uC.has(e)}function Zs(e){return yo(e)||ju.has(e)||Vu.has(e)||Dn(e)}function Qe(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ku(e,t){let n=Qe("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=dC?{state:"valid",count:r}:{state:"invalid"}}function bo(e,t,n){let o=e.match(mC)?.[1];if(!o||!Zs(o))return null;let i=e.indexOf("=");return{name:o,value:`${Qe(o,t,n)??""}${e.slice(i+1)}`}}function qu(e){return Zu(e,Vu)}function Yu(e){return Zu(e,ju)}function Zu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Qu=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Qu.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Co(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function ed(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function kt(e,t,n,r){if(!ed(dn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=Ju(i),f=Co(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&dn(i).includes("=")&&!gC(i)){let g=hC(dn(i),a,t.env)??bo(dn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(dn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=bC(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=vC(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=EC(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(Ju(i)===d)break}let u=Co(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:pC(u.words,o)}}function pC(e,t){return e.some((n)=>!t.has(n))}function Ju(e){return e.map(w).join(" ")}function dn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function gC(e){return Qu.test(dn(e))}function hC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var yC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function bC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Xn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Xn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Xn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(yC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var CC=new Set(["-i","-0","--null"]),SC=new Set(["-u","--unset","-C","--chdir","-P"]);function vC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(CC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(SC.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?Xn(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Xn(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Xn(e,t,n){if(t==="")return null;if(!e&&!Xu(t))return null;let r=Xu(t)?fC(t).root:n.realpath(e??"/");if(r===null)return null;try{return ft(r,t,n)}catch{return null}}function EC(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var xC=/['"\\$`{}#]/;function So(e,t){if(e.some((r)=>xC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function pt(e,t,n){return vo(e,t,n).tokens}function RC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ot(e,t,n,r=0){let o=vo(e,t,n),i=(o.envSplitValues??[]).flatMap(RC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ot(s,t,n,r+1)}function vo(e,t,n,r){if(!ed(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=kt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var ea=Symbol("adopt-as-operand"),_C=new Set(["env","sudo","command","builtin"]),wC=new Set(["&&","||","|&","|","&",";"]),AC=new Set(["<<","<<<",">|"]),PC=new Set(["|","|&"]),TC=/[*@#?$!_-]/,IC=/^\w+(?::\w+)*/,kC=Object.freeze([]),Jn=Object.freeze({kind:"scope",edge:"enter"}),Qn=Object.freeze({kind:"scope",edge:"exit"}),OC=Object.freeze([]),MC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),er=new Set(["bash","sh","zsh","dash","ksh"]),DC=256,id=new WeakMap;function sd(e,t){let n=t.status==="complete"?new Set(Qs(t)):new Set,r=WC(e,n);if(Fr(r))return Eo("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Mt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Eo("structural-limit",r,t);if(o.invalid)return Eo("invalid",r,t);let s=Eo("complete",r,t,o.assignmentFallbacks);return id.set(s,Object.freeze(i)),s}function Ro(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of ad(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=NC(a,s,n,r),c=a.length>0&&PC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===ea){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function _o(e){return ad(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function tr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function NC(e,t,n,r){let o=tr(e)?new Map([...t.variables,...LC(e,t.variables)]):t.variables,i=pt([...e],n),s=k(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function LC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function ad(e){return id.get(e)??kC}function WC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Eo(e,t,n,r=OC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Mt(e,t){return e.nodes.flatMap((n,r)=>FC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function FC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(UC(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[xo("{"),...Mt(e.body,a),...s?[xo("}")]:[]]:[Jn,We("("),...Mt(e.body,a),...s?[We(")")]:[],Qn]}]}let o=KC(e,r.functions);if(o){if(r.depth>=mt.maxDepth||++r.flags.expansions>DC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...td(e,r),xo(";"),...Mt(o,{...r,depth:r.depth+1}),xo(";")]},...nd(e,t,n,r)]}return[{start:e.span.start,events:td(e,r)},...nd(e,t,n,r)]}function td(e,t){return[...e.words.map((n)=>({start:n.span.start,events:cd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:GC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function GC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?cd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ta(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:HC(r),targetOrder:AC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:dd(t)}:{}}),...s===void 0?o:o.slice(1)]}function nd(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ta(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ld(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?zC(t,n,r):[]]}function zC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ld(n.source.slice(r.span.end,e.span.end),n)}]}function ld(e,t){if(t.depth>=mt.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Mt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function cd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ta(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of Xs(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=Xs(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Mt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(Jn,...p,Qn);continue}let m=u?Mt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(Jn,...m,Qn);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),Jn,...m,...c.raw.endsWith(")")?[We(")")]:[],Qn);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[Jn]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[Qn]:[])}return l(),o}function Xs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=rd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=rd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function rd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=$C(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return BC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&TC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?IC:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function BC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Xs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function $C(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function UC(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:wC.has(e)})}function xo(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ta(e){return Object.freeze({kind:"word",text:e})}function HC(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function nr(e){return MC.has(e)||/^python\d/.test(e)}var jC=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function ud(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=jC.get(e)?.has(n)??!1;return ud(e,t.slice(r?2:1))}function Js(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Js(e.slice(1));if(!_C.has(t))return[...e];return Js(ud(t,e.slice(1)))}function dd(e){let t=$n(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Js(n<0?[]:e.words.slice(n).map((r)=>r.text))}function VC(e){let t=dd(e)[0];if(t===void 0)return!1;let n=k(t).toLowerCase();return nr(n)&&!er.has(n)}function Qs(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Qs(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Qs(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(VC(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!YC(t))return r;return[...r,...o]})}function KC(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function gt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function qC(e){if(gt(e.words[0],"git"))return gt(e.words[1],"commit");if(!gt(e.words[0],"gh")||!gt(e.words[2],"create"))return!1;return gt(e.words[1],"pr")||gt(e.words[1],"issue")}function YC(e){return(gt(e.words[0],"cat")||gt(e.words[0],"tee")||qC(e))&&!e.words.some(od)&&!e.redirections.some((n)=>od(n.target))}function od(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var md=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),fd=new Set([...md,"glob"]),ZC=new Set([...fd,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function rr(e){let t=XC(),n=In(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:JC(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function et(e,t){if(!e.includes("$"))return e;return Ai(e,t)}function XC(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=sd(i,a);return e.set(i,c),c},getCommandProgram:r}}function JC(e){let t=e.route.kind==="grep"?fd:e.route.kind==="glob"?ZC:md;return[...wl(e.input,t),...e.route.kind==="patch"?Tl(e.input):[]]}var QC=new Set(["-S","--suffix"]);function mn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Ro(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function wo(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&QC.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function bd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Ar(e.invocation.toolName))return null;let a=e.paths.find((l)=>pd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=mn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>rS(a,l,t,n,r),isRedirectionTarget:(a,l)=>pd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Po(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(na(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?Ao(m,l):eS(m,l);if(n.markerFiles.some(u))return!0;return r&&gd(n).some(u)}if(na(a,n))return!0;return r&&gd(n).some((c)=>Ao(c,a))}function eS(e,t){let n=yd(t,e);if(n===""||n.startsWith("..")||hd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function tS(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function nS(e,t,n,r,o){if(!n)return!1;return na(Po(se(e,t,r,o)),n)}function pd(e,t,n,r,o,i){let s=Po(se(e,t,r,o));return i.includes(s)||Sd(s,n)}function Cd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>Ao(i,Po(se(s,t,r,o)))))}function na(e,t){return t.entries.includes(e)||t.directories.includes(e)||Sd(e,t)}function Sd(e,t){return t.hooksDirectories.some((n)=>Ao(e,n))}function gd(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function Ao(e,t){let n=yd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!hd(n)}function Po(e){return process.platform==="win32"?e.toLowerCase():e}function rS(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r);if(k(i[0]??"").toLowerCase()!=="mv")return null;let s=wo(i.slice(1)),a=s.sources.find((l)=>tS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&nS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Mo,normalize as dS,parse as mS,posix as Pd,resolve as Lt,sep as sa}from"path";import{isAbsolute as oS,join as vd,normalize as Rd,parse as iS,sep as Ed}from"path";var sS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],aS=` 	
-`;function or(e,t){if(ht(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ra(e.get("TMPDIR")??"",t)}function Nt(e,t){if(e.has("TMPDIR"))return ra(e.get("TMPDIR")??"",t);let n=oa(e,t);if(n===void 0)return!0;return ra(n,t)}function oa(e,t){return wd(e,t,"TMPDIR")}function ra(e,t){if(!e)return!1;if(cS(e))return!1;return fn(e,t)}function ht(e,t){let n=wd(e,t,"IFS");return n!==void 0&&n!==""&&n!==aS}function fn(e,t){let n=To(e,t.paths);if(n===null)return!1;return _d(t).some((r)=>Oo(n,r))}function ko(e,t){let n=To(e,t.paths);if(n===null)return!1;return _d(t).some((r)=>Io(r)===Io(n))}var xd=new WeakMap;function _d(e){let t=xd.get(e);if(t)return t;let n=lS(e);return xd.set(e,n),n}function lS(e){let t=sS.map((r)=>To(r,e.paths)??Rd(r)),n=To(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&uS(n))return[...t,n];return t}function cS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function wd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function uS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function To(e,t){try{let n=Rd(e);if(!oS(n))return n;let r=iS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=vd(i,o[s]??"");if(t.entryKind(a)==="missing")return vd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Oo(e,t){let n=Io(e),r=Io(t);if(n===r)return!0;let o=r.endsWith(Ed)?r:`${r}${Ed}`;return n.startsWith(o)}function Io(e){return process.platform==="win32"?e.toLowerCase():e}var fS=process.platform==="win32",Ad=64,pS=16384;function ir(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return C(o.id,o.reason)}function sr(e){let t=bu(e,Ad,Ad,pS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:gS(e)}}function gS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>hS(e.raw,n.span.start-e.span.start))}function hS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Wt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??be();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:ES(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Ge(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&RS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Id(e,t.posixShell);if(Ze(e))return{kind:"outside_anchored_cwd"};if(aa(e,r))return{kind:"root_or_home_target"};if(bS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(CS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(xS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&PS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>TS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(IS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(yS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function yS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Mo(r)||r.startsWith("~"))return!1;if(la(r))return!1;if(kd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Lt(t.resolvedCwd,r),t.environment)}function Td(e,t,n={}){let{containmentTarget:r,...o}=n;if(Ge(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(vS(i))return!1;if(ko(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>kd(r??i,s,t.environment.paths,t.budget))}function aa(e,t=!1){let n=e.trim(),r=Pd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function bS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Mo(o)?o:t.resolvedCwd?Lt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(z(i,t.environment.paths,t.budget));if(s===mS(s).root)return!0;return s===he(z(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=dS(e);if(fS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function CS(e,t,n,r,o,i,s,a){let l=e.trim();if(la(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&SS(l,n)}function SS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Id(e.slice(n.length+1),t)})}function vS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Pd.normalize(`/${t[1]??""}`)==="/"}function la(e){return e.split(/[\\/]+/).includes("..")}function ES(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Gn(o.trim(),t);if(!Mo(i))return[];try{let s=z(i,n,r);if(zn(s,z(t,n,r)))return[];return[he(s)]}catch{return[]}})}function xS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(la(r))return!1;let o=n?r:Gn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Mo(o)?o:i?Lt(i,o):null;if(!s)return!1;try{let a=he(z(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(sa)?l:`${l}${sa}`))}catch{return!1}}function RS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Id(e,t=!1){return e.includes("$")||e.includes("`")||_S(e)||t&&wS(e)}function _S(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function wS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&AS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function AS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function PS(e,t,n,r){try{return he(z(e,n,r))===he(z(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function TS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(z(Lt(t,e),n,r))===he(z(o,n,r))}catch{try{return he(Lt(t,e))===he(o)}catch{return!1}}}function IS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ia(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ia(Lt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ia(Lt(a,e),t,i,s)}catch{return!1}}function ia(e,t,n,r){try{return Od(z(e,n,r),z(t,n,r))}catch{return!1}}function kd(e,t,n,r){if(!t)return!1;try{return Od(z(t,n,r),z(e,n,r))}catch{return!0}}function Od(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${sa}`)||n===r}var kS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Md="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",OS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Dd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Nd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",MS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",DS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",NS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Nd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Dd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:MS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Md},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:OS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Md}};function Ld(e,t,n,r=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return LS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function LS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=FS(o),s=o[i];if(!s||!kS.has(KS(s.text)))return null;let a=WS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return C("powershell.remove-item-pipeline-dynamic-target",DS);for(let l of a.targets)if(!Ze(l.text)&&aa(ua(l.text)))return C(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Nd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ua(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return C("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return C("powershell.remove-item-recursive-force-dynamic-target",Dd);for(let l of a.targets){let c=ir(Ge(ua(l.text),n),n,r,NS);if(c)return c}return null}function WS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(GS(l))continue;if(s){t.push(ca(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=BS(l.text);if(!c){t.push(ca(l)),i=i||l.dynamic;continue}if($S(c.name)){let u=c.value?zS(c.value,l):e[++a];if(u?.kind==="word"){t.push(ca(u)),i=i||u.dynamic;continue}i=!0;continue}if(US(c.name)){n=!0;continue}if(HS(c.name)){r=!0;continue}if(jS(c.name))o=VS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function FS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ca(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function GS(e){return e.kind==="word"&&e.text===","}function ua(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function zS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function BS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function $S(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function US(e){return"recurse".startsWith(e)}function HS(e){return e.length>=2&&"force".startsWith(e)}function jS(e){return e==="wi"||"whatif".startsWith(e)}function VS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function KS(e){return e.toLowerCase()}var pn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Do="Unsupported heredoc syntax",ar="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Wd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var qS=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),YS=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),ZS=new Set(["-o","--output","--query","--subscription"]),XS=new Set;function Fd(e){if(e==="aws")return qS;if(e==="gcloud")return YS;if(e==="az")return ZS;return XS}var JS=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),QS=new Set;function Gd(e){if(e==="git")return Se;if(e==="docker")return JS;return QS}function tt(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!nv(n,o.command))continue;if(o.match){if(ev(n,e,o.match))return zd(o);continue}if(!rv(n,e,o.subcommand))continue;if(iv(e,new Set(o.block_args),r))return zd(o)}return null}function zd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function ev(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return tv(r,n.command_path,Fd(e))}function tv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function nv(e,t){return e===O(t)}function rv(e,t,n){if(!n)return!0;return Bd(t,1,n,Gd(e))}function Bd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&ov(e,i,n,r))return!0;continue}return s===n}return!1}function ov(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Bd(e,t+2,n,r)}function iv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var sv=new Set(["-e","--source"]),av=new Set(["-F","-v","--assign","--field-separator"]),$d=new Set(["-f","--file"]),lv=new Set(["print","printf","return"]),Ud=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],cv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Hd(e,t,n){let r=!1;for(let o of uv(e)){let i=dv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?C("awk.system-dynamic",cv):null}function ma(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&sv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(av.has(a)||$d.has(a))){let l=e[s+1];if(i&&=l!==void 0,$d.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function cr(e){return ma(e).sources}function uv(e){return cr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function dv(e,t){xe(t,e);let n=e.includes("system")?fa(e,t):null,r=mv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function fa(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Lo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=jd(e,i+1);continue}if(s==="/"&&Vd(e,i)){i=Kd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,lr(e[a-1])||lr(e[i]))continue;let l=No(e,i);if(e[l]!=="(")continue;l=No(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Lo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=No(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function mv(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Lo(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=jd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Vd(e,i)){let f=Kd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(da(e,i,"print")||da(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=No(e,m);if(da(e,d,"getline")){o=!0;let f=gv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(yv(s,a)){o=!0;let f=pv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!fv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function lr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function No(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function fv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Lo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=hv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function pv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Lo(e,t,n)}function gv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function hv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function da(e,t,n){return e.startsWith(n,t)&&!lr(e[t-1])&&!lr(e[t+n.length])}function yv(e,t){return t!==null&&t>=e}function jd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Vd(e,t){let n=bv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(lr(e[r-1]))r--;return lv.has(e.slice(r,n+1))}function bv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Kd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Cv=new Set(["sudo","env","command","builtin"]);function Wo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(k(n)))return null;let r=k(n),o=e[1]==="--"?2:1,i=Sv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Sv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=k(a)!==n&&vv(a,r);if(l)i.push(s);if(!l&&Wr.has(O(a)))break;if(o)break}return i}function vv(e,t){let n=k(e),r=O(e);return r==="git"||n==="busybox"||Ft(e)||es.has(n)||t.transparentWrappers.includes(n)||J.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return Cv.has(e.toLowerCase())}function Gt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return Fo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*Fo(e,t,n,r,o,i,s,a,l){let c=vo(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=So(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");pa(a),yield*Fo(f,t,m,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new D("wrapperPeelIterations");let d=Wo(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])pa(a),yield*Fo(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(xv(u)){pa(a),yield*Fo(u.slice(1),t,m,r,o,i,s,a,l);return}yield Ev(u,m,r,o,i,l)}function Ev(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:k(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function pa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function xv(e){return k(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ga(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ha(r,"recursive")){t=!0;continue}if(r==="-f"||ha(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function qd(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ha(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ha(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Rv="find -delete permanently removes files. Use -print first to preview.",_v="find -exec rm -rf is dangerous. Use explicit file list instead.",wv=new Set(["-exec","-execdir","-ok","-okdir"]),Av=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Yd(e,t){let n=e.map(w),r=Pv(e,n,t);if(r)return r;if(zo(n,1)&&!Iv(e,n,t)){let s=P(C("find.delete",Rv),t.policy);if(s)return s}let o=t.budget??be(),i=0;while(i<n.length){let s=n[i],a=yt(s??"");if(a>0){i+=a+1;continue}if(!nt(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=ur(n,i);i=l.nextIndex;let c=Ov(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:P(m,t.policy);if(d)return d}return null}function Pv(e,t,n){if(!zo(t,1)&&!ya(t,n.environment))return null;let o=Go(e)??K(["."]),i=Wt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=sr(s);for(let l of a.expandedTargets??[w(s)]){let c=Ge(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target")return C("find.delete-git-metadata",Te)}}if(Tv(t)&&i.resolvedCwd&&Cd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return C("find.delete-git-metadata",Te);return null}function ya(e,t){let n=0;while(n<e.length){if(!nt(e[n])){n++;continue}let r=ur(e,n),o=Ot([...r.tokens],t),i=k(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir")&&o.some((s)=>s.includes("{}")))return!0;n=r.nextIndex}return!1}function Tv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Iv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Go(e);if(!r)return!1;let o=n.envAssignments??new Map,i=oa(o,n.environment),s=n.trustedTmpdirValue??Nt(o,n.environment),a=n.allowTmpdirVar??!or(o,n.environment),l=Wt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??ht(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=sr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((m)=>Td(m,l,{containmentTarget:kv(m,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function kv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Go(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Ov(e,t){let n=pt([...e],t);if(n.length===0)return null;let r=k(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=k(n[0]??"");if(r==="rm"&&Be(n))return C("find.exec-rm-recursive-force",_v);return null}function ur(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function zo(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(nt(r)){n=ur(e,n).nextIndex;continue}let o=yt(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function yt(e){return Av.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function nt(e){return e!==void 0&&wv.has(e)}import{resolve as ox}from"path";function dr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Mv=5,ba="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Xd(e,t,n){let r=Bo(e,t,n),o=Dv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Mv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=Gv(m);if(d===null||d.length===0)return{blockedReason:ba,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:ba,expanded:!0,tokens:i}}function Jd(e,t,n){return Bo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?k(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Se.has(o)?2:1}return{subcommand:null,rest:[]}}function Dv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Bo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?k(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=Lv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Nv(e,t,n)]}}function Nv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ca(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ca(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Zd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Zd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Se.has(i)){o+=2;continue}o++}return r}function Lv(e,t){let n=Wv(e,t),r=Fv(e,t);return{blockedReason:n===null||r===null?ba:null,entries:[...n??[],...r??[]]}}function Wv(e,t){let n=Qe("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=dr(n);if(!o)return null;for(let i of o){let s=Ca(i);if(!s)return null;r.push(s)}return r}function Fv(e,t){let n=Ku(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=Qe(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=Qe(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ca(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Zd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:Qe(e.slice(r+1),t,n)}}function Gv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return dr(t)}var zv="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",Bv="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",$v="git checkout --force discards uncommitted changes. Use 'git stash' first.",Uv="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",Hv="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",jv="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",Vv="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",Kv="git switch --force discards uncommitted changes. Use 'git stash' first.",qv="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",Yv="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",Zv="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",Xv="git reset --merge can lose uncommitted changes. Use 'git stash' first.",Jv="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",Qv="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",eE="git push --force destroys remote history. Use --force-with-lease for safer force push.",tE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",nE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",rE="git branch -D force-deletes without merge check. Use -d for safe delete.",oE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",iE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",sE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",aE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",lE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",cE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",uE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",dE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),mE=new Set(["--recurse-submodules","--track","-t"]),Sa=new Set(["-b","-B","-U"]),va=new Set(["-c","-C"]),fE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var gn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function em(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return bt(pE(r,t));case"switch":return bt(hE(r));case"restore":return bt(bE(r));case"reset":return SE(r);case"clean":return bt(EE(r));case"rm":return bt(xE(r));case"push":return zt(RE(r));case"branch":return zt(AE(r));case"stash":return zt(OE(r));case"worktree":return zt(ME(r));case"rebase":return bt(PE(r));case"merge":return bt(TE(r));case"tag":return zt(IE(r));case"reflog":return zt(kE(r));default:return null}}function bt(e){return e?{...e,localDiscard:!0}:null}function zt(e){return e?{...e,localDiscard:!1}:null}function pE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:Sa});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return C("git.checkout-force",$v);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return C("git.checkout-pathspec-from-file",Hv)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return C("git.checkout-ref-path",Uv);return C("git.checkout-double-dash",zv)}let i=yE(e);if(i.length>=2)return C("git.checkout-ambiguous",jv);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(gE(s)||t(s))return C("git.checkout-double-dash",Bv);return null}function gE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function hE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return C("git.switch-discard-changes",Vv);let n=me(t,{shortOptsWithValue:va});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return C("git.switch-force",Kv);return null}function yE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(dE.has(r)){n+=2;continue}if(mE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function bE(e){let t=CE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?C("git.restore-worktree",Yv):C("git.restore-unstaged",qv)}function CE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(fE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function SE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=C("git.reset-hard",Zv);break}if(M(n,"--merge")){t=C("git.reset-merge",Xv);break}}if(!t)return null;return vE(e)?zt(t):bt(t)}function vE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function EE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return C("git.clean-force",Jv);return null}function xE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?C("git.rm-force",Qv):null}function RE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return C("git.push-mirror",nE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Qd(t,n).some(_E))return C("git.push-force",eE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Qd(t,n).some(wE))return C("git.push-delete",tE);return null}function Qd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function _E(e){return e.startsWith("+")||e.includes(":+")}function wE(e){return e.length>1&&e.startsWith(":")}function AE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return C("git.branch-force-delete",rE);return null}function PE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?C("git.rebase-abort",oE):null}function TE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?C("git.merge-abort",iE):null}function IE(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?C("git.tag-delete",sE):null}function kE(e){return e[0]==="delete"?C("git.reflog-delete",aE):null}function OE(e){for(let t of e){if(t==="drop")return C("git.stash-drop",lE);if(t==="clear")return C("git.stash-clear",cE)}return null}function ME(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return C("git.worktree-remove-force",uE);return null}import{dirname as QE,isAbsolute as ex,join as gm,resolve as tx}from"path";var xa="TMPDIR",Ra="IFS",nm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,rm=/^[A-Za-z_][A-Za-z0-9_]*$/,om=new Set(["export","typeset","declare","readonly"]),DE=new Set(["builtin","command","time"]),im=new Set(["do","then","else"]),NE=new Set(["do","then","case"]),tm=new Set(["done","fi","esac"]),LE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function sm(e,t){return e.map((n)=>n.provenance==="variable"&&mm(n.text)?mr(n.text,t.shellAssignments):w(n))}function mr(e,t){return e.replace(LE,(n,r,o)=>t.get(r??o??"")??n)}function am(e,t){return{env:e,effectiveEnvAssignments:zE(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function lm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function _a(e,t){let n=um(e,t),r=e[0]??"";if(NE.has(r))t.bodyDepth+=1;if(r==="elif"||tm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(tm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);wa(t,a)});let o=n.commandIndex;if(o!==-1&&om.has(e[o]??""))e.filter((a)=>rm.test(a)&&Ea(a)).forEach((a)=>{BE(t,a)});let i=o===-1?-1:dm(e,o);if(i===-1||e[i]!=="unset")return;let s=UE(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(im.has(r)){t.shellAssignments.set(a,"");return}$E(t,a)})}function cm(e,t){let n=um(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function um(e,t){let n=im.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!mm(a)),o=r!==-1&&om.has(e[dm(e,r)]??""),i=GE(t);return{assignments:e.flatMap((a,l)=>{let c=WE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!yo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function dm(e,t){let n=t;while(DE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function mm(e){return Pe(e)!==null||nm.test(e)}function WE(e,t,n){return Pe(e)??FE(e,t,n)}function FE(e,t,n){let r=bo(e,n,t);if(r)return r;let o=e.match(nm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ea(e){return e===xa||e===Ra||Zs(e)}function GE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function zE(e,t){let n=[xa,Ra].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function wa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function BE(e,t){wa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function $E(e,t){if(!Ea(t)&&!rm.test(t))return;if(e.shellAssignments.set(t,""),yo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ea(t)||t===xa||t===Ra||Dn(t)){wa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function UE(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as HE}from"path";function $o(e,t){return Ys.some((n)=>t?.has(n)||e.has(n))}function hn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(HE(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=fm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=fm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Se.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function fm(e,t,n){try{let r=ft(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function pm(e,t,n){if(!t.localDiscard||!n.worktreeMode||$o(n.environment.env,n.envAssignments))return null;let r=hn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Aa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Aa(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||jE(o)||ZE(e,t.environment.env,t.envAssignments,n)||qE(o)||VE(i,o))return!0;return i==="clean"&&YE(o)>1}function jE(e){return e.some((t)=>/[$*?[]/.test(t))}function VE(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:Sa}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:va}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||KE(s))||r.has("-C");return o&&i}return!1}function KE(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function qE(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function YE(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function ZE(e,t,n,r){if(Qe("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Bo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>JE(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||XE(s.value);if(Yu(n))return!0;return r.recursiveSubmodules}function XE(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function JE(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function hm(e,t,n){let r=e.map(w),o=n.environment.paths,i=hn(r,n.cwd,o),s=n.originalCwd?o.realpath(tx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||$o(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?rx(e,n.shellAssignments,o):ym(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!nx(a,r,t,n)||!fn(a,n.environment)||ko(a,n.environment)||Oo(s,a)||Oo(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function nx(e,t,n,r){let o=r.environment.paths,i=gm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Aa(t,r,s)}function rx(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?mr(a,t??new Map):a;if(!ex(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function ym(e,t){if(t.entryKind(gm(e,".git"))!=="missing")return e;let n=QE(e);return n===e?null:ym(n,t)}var ix="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",sx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Uo(e,t){return bm(e,t)}function bm(e,t,n){let r=e.map(w),o=Xd(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(C("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((qu(t.envAssignments)||Jd(r,t.environment.env,t.envAssignments))&&ax(s))return C("git.ssh-env",ix);let a=em(s,(c)=>{let u=hn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(ox(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=pm(r,a,t)??hm(e,a,t);if(!l)return a;return n?.(l),null}function Cm(e,t){let n=null;return{match:bm(e,t,(o)=>{n=o}),relaxation:n}}function ax(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(sx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&lx(n)}function lx(e){return e.find((t)=>!cx(t))?.toLowerCase()==="update"}function cx(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as Hx}from"path";function Sm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Ho(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var vm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ux="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",dx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",xm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",mx="rm -rf in home directory is dangerous. Change to a project directory first.",Em={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:xm},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:dx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:mx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:vm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:ux},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:vm}};function jo(e,t){let n=Wt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=qd(r),s=px(e);for(let a of s){let l=sr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ir({kind:"outside_anchored_cwd"},n,t.policy,Em),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Ce(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return C("rm.git-metadata",Te);if(i&&!o){let d=Ge(u,n,m);if(d.kind==="root_or_home_target")return C("rm.recursive-force-root-or-home",xm);if(d.kind==="git_metadata_target")return C("rm.git-metadata",Te);continue}if(!o)continue;for(let d of fx(u,n,m)){let f=ir(d,n,t.policy,Em),p=P(f,t.policy);if(p)return p}}}return null}function fx(e,t,n){let r=Ge(e,t,n);if(r.kind==="cwd_self_target")return[r,Ge(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Ge(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Ge(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function px(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Ct={kind:"none"},Bt={kind:"dynamic"},gx=new Set(["<","<<","<<-","<<<","<&","<>"]),_m=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,hx=/^(?:[0-9]+|[@*])$/,yx=mt.maxWords,bx=mt.maxInputLength;function wm(e){if(!e||k(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`)}function xl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Nn(e={}){return{reason:Dn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Up={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...Up[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Rl(e){return $p({...e,redact:mt})}function _l(e){return mt(e instanceof Error?e.message:String(e))}import{types as Hp}from"util";var jp=new Set(["applypatch","patch"]),Vp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Kp=new Set(["grep","grepsearch","rg"]),qp=new Set(["find","findbyname","glob"]),Yp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Zp=new Set(["command","diff","input","patch","patchtext"]),wl=new TextEncoder,Xp=new TextDecoder,Jp=/\s/,Qp=64;class Qe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Ln=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function kl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Nr(e){return Yp.has(kl(e))}function Ai(e){let t=kl(e);if(jp.has(t))return"patch";if(Kp.has(t))return"grep";if(qp.has(t))return"glob";if(Vp.has(t))return"path";return"unknown"}function Gn(e){if(!e||typeof e!=="object")return;Gl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ol(e,t){return Ml(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Ml(e,t,n,r){let o=Wl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Ml(a,t,n,r+1);return typeof a==="string"&&t.has(Dl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Dl(e){return e.replace(/-/g,"_").toLowerCase()}function Nl(e){return Ll(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(tg)}function Ll(e,t,n,r){let o=Wl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ll(a,o.array?t:Zp.has(Dl(s)),n,r+1));return n.ancestors.delete(o.object),i}function eg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Ln.maxDepth||t.nodes>Ln.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Ln.maxStringBytes||t.stringBytes>Ln.maxAggregateStringBytes)Ke()}function Wl(e,t,n){if(eg(e,t,n),!e||typeof e!=="object")return null;let r=Gl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Ln.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Gl(e){if(Hp.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new Qe}function tg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=ng(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...wi(Dr(c.slice(4),!0),Dr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function ng(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Il(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Il(n[1]);if(e.startsWith("diff --git "))return rg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Tl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Tl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return ug(i[1]);return[]}function rg(e){let t=og(e);if(t.length===2&&t[0]&&t[1])return wi(t[0],t[1]);let n=ig(e);return n?wi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function og(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Pt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Pt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Fl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Pt(e[n]))n++;return n===e.length?t:[]}function ig(e){let t=0;while(t<e.length&&Pt(e[t]))t++;let n=e.length;while(n>t&&Pt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Pt(e[o])){o++;continue}let i=o;while(o<n&&Pt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Qp)Ke();if(sg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function sg(e,t,n,r,o){if(_i(e,t,n,r,o))return!0;let i=Al(e,"/",t,n),s=Al(e,"/",r,o);if(i<=t||s<=r)return!1;if(_i(e,t,i,r,s))return!1;return _i(e,i+1,n,s+1,o)}function _i(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Al(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Pt(e){return e!==void 0&&Jp.test(e)}function Fl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Xp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...wl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...wl.encode(ag(s[0]??""))),o+=2}return null}function ag(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function lg(e){return Wn(dg(e))}function wi(e,t){if(e==="/dev/null")return Pl(t);if(t==="/dev/null")return Pl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Wn);let n=cg(e,t)??(e===t?zl(e):null);return[e,t,...n?[n]:[]].flatMap(Wn)}function Pl(e){let t=zl(e);return[e,...t?[t]:[]].flatMap(Wn)}function zl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function cg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Tl(e){return lg(Dr(e,!0))}function ug(e){return Wn(Dr(e,!1))}function Dr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Fl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function dg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Wn(e){return e===""||e==="/dev/null"?[]:[e]}function Il(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Mi,relative as Sg,resolve as Kl,sep as vg}from"path";import{basename as Ul,dirname as mg,isAbsolute as fg,join as pg,normalize as gg,resolve as Bl}from"path";var hg=256,Lr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Se(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function et(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ki(e,t){return Pi(e,0,t)}function Pi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ti(e,o+2),a=yg(e,o,t);if(a===null){if(Lr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=bg(l,t,n),o=a+1;continue}let i=Ti(e,o+1);if(!i){r+="$",o++;continue}r+=Ii(i,n)??`$${i}`,o+=i.length+1}return r}function yg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function bg(e,t,n){let r=e.slice(2,-1),o=Ti(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ii(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Lr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Lr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=Ii(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Pi(i.slice(s.length),t+1,n);return l?Pi(i.slice(s.length),t+1,n):""}function Ti(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ii(e,t){if(!Lr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function N(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Hl(n,i);let s=t.realpath(i);if(s!==null)return $l(n,e,s,o);let a=mg(i);if(a===i||o.length>=hg)return $l(n,e,i,o);o.push(Ul(i)),i=a}}function $l(e,t,n,r){let o=r.length===0?n:pg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Cg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Hl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Hl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ae(e,t,n,r){let o=Vl(e,t,n);if(!o)return"";return N(o,n.paths,r).replace(/\\/g,"/")}function jl(e,t,n,r,o){let i=Vl(e,t,n);if(!i)return null;if(o(Ul(i)))return N(i,n.paths,r).replace(/\\/g,"/");let s=Cg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Vl(e,t,n){let r=n.home,o=ki(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Bl(r,o.slice(2)):o,s=Se(i);return gg(fg(s)?s:Bl(t,s))}function ql(e,t,n){if(et(e))return;let r=t.flatMap((i)=>Oi(i,n));if(!r[0])return;let o=Oi(Mi(e)?e:Kl(r[0],e),n)[0];if(!o)return;return r.some((i)=>Eg(o,i))?o:void 0}function Yl(e,t,n){if(et(e))return;return Oi(Mi(e)?e:Kl(t,e),n)[0]}function Oi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Eg(e,t){let n=Sg(t,e);return n===""||n!==".."&&!n.startsWith(`..${vg}`)&&!Mi(n)}function en(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Zg,realpathSync as Xg,statSync as Jg}from"fs";import{homedir as Qg,tmpdir as eh}from"os";import{statSync as Kg}from"fs";import{join as qg}from"path";import{spawnSync as xg}from"child_process";import{existsSync as zn,lstatSync as Rg,readFileSync as Bn,realpathSync as tn,statSync as Fn}from"fs";import{dirname as Di,isAbsolute as Ni,join as nn,resolve as Wr}from"path";var _g=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],wg=5000;function Xl(e,t=Ug(),n=wg){let r=Ag(e),o=r===null?null:Pg(r);if(r===null||o===null)return null;let i=Bg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Ag(e){try{let t=tn(Wr(e));return Fn(t).isDirectory()?t:null}catch{return null}}function Pg(e){let t=zg(e);if(!t)return null;try{let n=Rg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Li(t);if(!r?.commonDir)return null;if(!kg(r.gitDir,t))return null;return Og(r.gitDir,Di(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Li(e){try{let t=Tg(e);if(!t)return null;let n=tn(Ni(t)?t:Wr(Di(e),t));if(!Fn(n).isDirectory())return null;return{gitDir:n,commonDir:Ig(n)}}catch{return null}}function Tg(e){let t=Bn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Ig(e){try{let t=Bn(nn(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=tn(Ni(t)?t:Wr(e,t));return Fn(n).isDirectory()?n:null}catch{return null}}function kg(e,t){let n=Mg(e);return n===null?!1:Jl(e,n,t)}function Og(e,t){let n=Dg(e);return n===null?!0:Jl(e,n,t)}function Mg(e){let t=nn(e,"gitdir");if(!zn(t))return null;let n=Bn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Dg(e){let t=nn(e,"config.worktree");return zn(t)?Lg(t):null}function Jl(e,t,n){try{return Ng(Ni(t)?t:Wr(e,t),n)}catch{return!1}}function Ng(e,t){try{let n=Fn(e),r=Fn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Zl(tn.native(e))===Zl(tn.native(t))}function Zl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Lg(e){let t=Bn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Wg(s[1]??"")}return r}function Wg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Fg(t.slice(1,-1))}var Gg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Fg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Gg[n]??t)}function zg(e){try{return Wi(tn(e))}catch{return null}}function Wi(e){let t=e;while(!0){let n=nn(t,".git");if(zn(n))return n;let r=Di(t);if(r===t)return null;t=r}}function Bg(e,t,n,r){if($g(t))return!0;if(n===null)return!0;let o=xg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ql(o.stdout.trim())}function $g(e){return[nn(e.commonDir,"config"),nn(e.gitDir,"config.worktree")].filter((t)=>zn(t)).some((t)=>jg(t))}function Ug(){return _g.find((e)=>zn(e))??null}function $n(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!$n(t)))}function jg(e){let t;try{t=Bn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Vg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ql(c)}return r}function Vg(e){return e==="include"||e.startsWith("includeif ")}function Ql(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function ec(e,t){if(e==="")return null;let n=Ce(),r=Wi(ae(e,e,t,n)),o=r?Yg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Yg(e,t,n,r){try{let o=ae(e,t,n,r),i=Kg(e),s=i.isFile()?o:null,a=i.isFile()?Li(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[rn(ae(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[rn(e.replace(/\\/g,"/")),...l]:l)];return{entry:rn(o),markerFile:s?rn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=rn(qg(d,"hooks").replace(/\\/g,"/"));return[m,rn(ae(m,t,n,r))]}))]}}catch{return null}}function rn(e){return process.platform==="win32"?e.toLowerCase():e}var th={realpath:(e)=>{try{return Xg(e)}catch{return null}},entryKind:(e)=>{let t=Zg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Jg(e).isDirectory()}catch{return!1}}};function nc(){return nh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Se(process.env.HOME||Qg()),tmpdir:eh(),paths:th})}function nh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>tc(n,i,()=>ec(i,o)),worktreeFacts:(i)=>tc(r,i,()=>Xl(i)),...t};return o}function tc(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var on=["fail_closed","paranoid_rm","paranoid_interpreters"],Gr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Fr=["standard","strict","paranoid"];function rh(e,t){if(!t)return e;return Fr.indexOf(t)>Fr.indexOf(e)?t:e}function oh(e){let t=Bi(ee.level,e);if(t===void 0||t==="")return;if(Fr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Fr.join(", ")}.`);return}function ih(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function rc(e){return ih(Bi(ee.auditScope,e))==="all"}function Fi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function zi(e={},t){let n=e.safety?.level??"standard",r=oh(t),o=rh(n,r),i=Gr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Tt(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(Tt(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(Tt(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(Tt(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Tt(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Fi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Tt(e,t){let n=typeof e==="string"?Gi(e,t):Bi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Gi(e,t){return t.get(e)}function Bi(e,t){let n=Gi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Gi(e.legacyName,t);return}import{dirname as qr}from"path";import{closeSync as sh,constants as oc,fstatSync as ah,fsyncSync as jP,lstatSync as Hi,mkdirSync as VP,openSync as lh,readdirSync as KP,readFileSync as ch,realpathSync as ji,renameSync as qP,rmdirSync as YP,statSync as uh,unlinkSync as ZP,writeFileSync as XP}from"fs";import{isAbsolute as ic,join as Vi,normalize as dh,parse as Ui,relative as Ki,resolve as qi,sep as Yi}from"path";function $i(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var mh=Symbol("PolicyFilesystemScope"),fh=Symbol("PolicyFilesystemTarget"),ph=oc.O_NOFOLLOW??0;class le extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function It(e,t){return{[mh]:!0,root:qi(e),label:t}}function sc(e,t){let n=dh(t);if(t===""||ic(t)||n===".."||n.startsWith(`..${Yi}`))throw new le(e.label);return{[fh]:!0,scope:e,relativePath:n,path:Vi(e.root,n)}}function Un(e,t){return sc(e,Ki(e.root,qi(t)))}function ac(e,t="rules policy"){let n=qi(e),r=Ui(n).dir;return sc(It(r,t),Ki(r,n))}function Br(e){return cc(e.scope.label,()=>{if(!zr(e))return null;let t=lh(e.path,oc.O_RDONLY|ph);return gh(t,()=>{let n=ah(t);if(!n.isFile())throw new le(e.scope.label);let r=ch(t,"utf-8"),o=Hi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new le(e.scope.label);return zr(e),r})})}function lc(e,t){if(e.path===t.path)return!0;return cc(e.scope.label,()=>{if(!zr(e)||!zr(t))return!1;let n=(r)=>Vi(ji(Ui(r).dir),Ui(r).base);return n(e.path)===n(t.path)})}function cc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof le)throw r;throw new le(e)}}function gh(e,t){try{return t()}finally{sh(e)}}function zr(e,t="file"){let n=hh(e.scope);if(!n)return!1;let r=e.relativePath.split(Yi);for(let o of r.keys()){let i=Vi(e.scope.root,...r.slice(0,o+1)),s=Hi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new le(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new le(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new le(e.scope.label);yh(n,ji(i),e.scope.label)}return!0}function hh(e){if(!Hi(e.root,{throwIfNoEntry:!1}))return null;if(!uh(e.root).isDirectory())throw new le(e.label);return ji(e.root)}function yh(e,t,n){let r=Ki(e,t);if(r===".."||r.startsWith(`..${Yi}`)||ic(r))throw new le(n)}import{dirname as Ot,isAbsolute as Eh,join as Dt,relative as xh,resolve as Mt,sep as Rh}from"path";var kt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,uc="rulebook.json",dc=".cc-safety-net/rules";var mc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var bh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Ch=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Sh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),tT=new RegExp(`^${Ch}/(${kt.source.slice(1,-1)})/${Sh}$`);function vh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function fc(e){if($r(e))try{return Zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return kt.test(e)?null:`Local rulebook sources must be bare names matching ${kt}: ${e}`}function Zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(mc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!bh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!kt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:vh(o),name:o}}function $r(e){return mc.test(e)}var pc="rule.json",Ur="policy.json",gc=".cc-safety-net",_h="rules",wh="CC_SAFETY_NET_HOME",hc="`cc-safety-net rule update`";function Ah(e){return Mt(e,dc)}function Ph(e){return Dt(Ah(e),pc)}function Hn(e){return Dt(Mt(e),gc,Ur)}function Xi(e,t={}){return t.userConfigDir??(t.userConfigPath?Ot(t.userConfigPath):Dt(Th(e),_h))}function Th(e){let t=e.env.get(wh);return t?Mt(Se(t)):Dt(e.home,gc)}function Ih(e,t={}){return Dt(Xi(e,t),pc)}function sn(e,t={}){return Dt(Ot(Xi(e,t)),Ur)}function yc(e,t){let n=t.userConfigPath??Ih(e,t),r=t.projectConfigPath??Ph(t.cwd),o=kh(e,t),i=Oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Un(o,n),projectConfigTarget:Un(i,r)}}function kh(e,t){let n=t.userConfigPath?Ot(Ot(Mt(t.userConfigPath))):Ot(Mt(t.userConfigDir??Xi(e,t)));return It(n,"user policy")}function Oh(e,t){let n=Mt(t),r=Mt(e),o=xh(n,r);if(o!==".."&&!o.startsWith(`..${Rh}`)&&!Eh(o))return It(n,"project policy");return It(Ot(Ot(r)),"project policy")}function bc(e,t){return Dt(e,t,uc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ft=/^[a-zA-Z][a-zA-Z0-9_-]*$/,pt=256,q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Cc=new Set(["python","python3","python2","node","ruby","perl"]),Hr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),jr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Sc="Rulebook exceeds CC Safety Net's safe validation limits.",vc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ec(e){if(Ji(e.allowed_commands,Oe.maxAllowedCommands)||Ji(e.rules,Oe.maxRules)||Ji(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ji(e,t){return Array.isArray(e)&&e.length>t}var Qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var es=64,ts="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Mh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ns=new Set(["--init-file","--rcfile"]);function rs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!Mh[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ee(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ns.has(l)&&!s.includes("="))i++;continue}let a=rs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function jn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Vr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Dh(e))jn(n,t);return t.inSingle||t.inDouble}function Dh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);jn(s,n)}return t}var os=new Set(["rm","find","xargs","parallel"]),Nh=new Set(["git","busybox",...os,...q,...Cc,...we]),Lh=new Set(["python","node","ruby","perl"]);function xc(e){let t=O(e);return Nh.has(t)||Me(t)}function Me(e){return Lh.has(Wh(e))}function Wh(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function is(e){try{let t=Br(Gh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Bh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof le)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Gh(e){return typeof e==="string"?ac(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function Rc(e){let t=new Set;return e.flatMap((n,r)=>{let o=an(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ss=`must be one of ${Qi.join(", ")}`,Fh=/^[^/]+\/[^/]+$/,zh=["version","rules","overrides","transparent_wrappers"];function Bh(e){let t=$h(e);return{errors:as(Xh(t,zh,(n)=>n.kind==="custom"),": "," "),sources:Zh(e,t)}}function $h(e){if(!an(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>es;return[...e.version===1?[]:[_(["version"],"must be 1")],...Uh(e.rules,t),...Vh(e.overrides),...qh(e.transparent_wrappers),...t?[]:jh(e.rules),...an(e.overrides)?Object.keys(e.overrides).filter((n)=>!Fh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Yh(e.transparent_wrappers)]}function Uh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),..._c(e,es)?[_(["rules"],ts)]:[]];if(t)return[{path:["rules"],message:ts,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function _c(e,t){let n=wc(e);return n!==void 0&&!(n<=t)}function Hh(e,t){let n=wc(e);return n!==void 0&&!(n>=t)}function wc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function jh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=fc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Vh(e){if(e===void 0)return[];if(!an(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!an(n))return[_(["overrides",t],'must be "off" or an object')];return[...Kh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||cs(n.intent)?[]:[_(["overrides",t,"intent"],ss)]]})}function Kh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),..._c(e,pt)?[_(t,`must be at most ${pt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>pt?[_(t,`must be at most ${pt} characters`)]:[]}function qh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ft.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(xc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Zh(e,t){let n=an(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function as(e,t,n){return[...new Set(e.map((r)=>{let o=ls(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ls(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function cs(e){return Qi.includes(e)}function an(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Pc(e){let t=ey(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Jh=`required non-empty string up to ${pt} characters`,Ac="must be a non-empty array of unique non-empty strings",Qh="required non-empty array of non-empty strings";function ey(e){if(!gt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ec(e))return{errors:[Sc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...as(ty(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),vc]:t,ruleNames:new Set(Tc(e).map((n)=>n.toLowerCase()))}}function Tc(e){let t=gt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=gt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function ty(e,t){return[...typeof e.name==="string"&&kt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...ny(e.allowed_commands),...ry(e.rules,t),...ay(e.tests),...ly(e),...cy(e)]}function ny(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ft.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function ry(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!gt(n))return[_(["rules",r],"must be an object")];return t?iy(n,["rules",r]):oy(n,["rules",r])}),...Rc(e)]}function oy(e,t){return[...Ic(e.name,t),...kc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ft.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Kr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Oc(e.reason,t),...Mc(e.intent,t)]}function iy(e,t){return[...Ic(e.name,t),...kc(e.command,t),...Oc(e.reason,t),...Mc(e.intent,t),...sy(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Ic(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return kt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function kc(e,t){return typeof e==="string"&&ft.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Oc(e,t){return typeof e==="string"&&e!==""&&e.length<=pt?[]:[_([...t,"reason"],Jh)]}function Mc(e,t){return e===void 0||cs(e)?[]:[_([...t,"intent"],ss)]}function sy(e,t){if(!gt(e))return[_(t,"required object")];return[...Kr(e.command_path,[...t,"command_path"],Qh,!1),...e.any_args===void 0?[]:Kr(e.any_args,[...t,"any_args"],Ac,!0),...e.exclude_args===void 0?[]:Kr(e.exclude_args,[...t,"exclude_args"],Ac,!0)]}function Kr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function ay(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!gt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function ly(e){if(!Array.isArray(e.tests))return[];let t=new Set(Tc(e));return[...new Set(e.tests.flatMap((n)=>gt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function cy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=gt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function gt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Fc(e,t){let n=yc(e,t),r;try{r=lc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof le)return by(n,f.message);throw f}let o=is(n.userConfigTarget),i=r?{config:null,errors:[]}:is(n.projectConfigTarget),s=Wc(n.userConfigPath,o.errors),a=Wc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Dc(o.config,qr(n.userConfigPath),"user",n.userScope,l):Gc(),d=i.config?Dc(i.config,qr(n.projectConfigPath),"project",n.projectScope,l):Gc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Nc(c.rules,m),...Nc(d.rules,u)],transparent_wrappers:hy(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?Lc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?yy(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?Lc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Dc(e,t,n,r=It(qr(qr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=dy(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:uy(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function uy(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function dy(e,t,n){let r=my(e),o=bc(t,r),i=py(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${fy(e)}`]};let s=gy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function my(e){return $r(e)?Zi(e).name:e}function fy(e){return $r(e)?`run ${hc} to vendor ${e}`:"create that file or remove that source from the rules config"}function py(e,t){try{return{content:Br(Un(t,e))}}catch(n){if(n instanceof le)return{error:n.message};throw n}}function gy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Pc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function hy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Nc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Lc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function yy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Wc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function by(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Gc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Iy,readFileSync as ky}from"fs";var zc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],us=new Set(zc.map((e)=>e.id)),Yr=zc,Cy=new Map(Yr.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:Cy.get(e)??"manual_only"}}var ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Sy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],vy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ms=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...vy.flatMap((e)=>Sy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Xr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Bc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Ey=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],fs=Bc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ps=Bc.flatMap((e)=>Ey.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Vn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),hs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xy=[...ds,Zr,...ms,...fs,...ps,Vn,...gs,...hs,...Xr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Jr=new Set(Xr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ys=new Set(xy.map((e)=>e.id));import{isAbsolute as bs,join as Ry,normalize as _y,sep as Qr}from"path";var eo=process.platform==="win32",$c=/[*?]/;function Cs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(eo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if($c.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Kn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Kn(e.trim(),t);if(!bs(n))return"must be an absolute path or start with ~/";return qn(n,t)}function vs(e,t){let n=Uc(e,t);if(n===null)return"must be a non-empty path string";if(!bs(n))return null;if(qn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var wy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ay="cannot cover the guard's own configuration";function Uc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=eo?n.replaceAll("\\","/"):n;return Kn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=Uc(e,t);if(n===null)return"must be a non-empty path string";let r=Cs(n)?.root??n;if($c.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!bs(r))return null;if(qn(r,t)!==null)return wy;return Py(r,t)?Ay:null}function Py(e,t){let n=to(e),r=to(Ry(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Qr}`)}function qn(e,t){let n=to(e),r=to(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Qr)?n:`${n}${Qr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function to(e){let t=_y(e);if(eo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(eo?3:1)&&t.endsWith(Qr))t=t.slice(0,-1);return t}var Hc=30,no=1,ro=365;function jc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Vc=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(Vc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Vc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Kc(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function qc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Kc(e,t)})}var Yc={standard:0,strict:1,paranoid:2};function Jc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:xs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:xs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:xs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ty(e,t)}}function xs(e,t){return[...new Set([...e,...t??[]])]}function Ty(e,t){let n=t.safety?.level,r=Gr[e.safety.level];return[...n&&Yc[n]<Yc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...on.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Zc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Zc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Jr.has(o))),...e.destructive_command_protection.enabled?Xc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Xc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Zc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Xc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var ws=new Set(["standard","strict","paranoid"]),nu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Hc}};function ru(e,t){let n=By(sn(e,t),e.home),r=so(Hn(t.cwd),e.home),o=My(r.parsed,e.home),i=Object.keys(o.policy).length>0?Jc(n.gui??nu,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?_s(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Oy="project policy audit settings are ignored; audit is user scope only";function My(e,t){if(!xe(e))return{policy:{},diagnostics:[]};let n=xe(e.safety)?e.safety:{},r=xe(e.workflow)?e.workflow:{},o=xe(e.destructive_command_protection)?e.destructive_command_protection:{},i=xe(e.secret_protection)?e.secret_protection:{},s={...ws.has(n.level)?{level:n.level}:{},...xe(n.overrides)?Qc({overrides:ou(n.overrides,on,["safety","overrides"],Nt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:io(o.overrides,us,su,Nt)}:{},...o.allow_paths!==void 0?{allow_paths:cn(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Nt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:io(i.overrides,ys,au,Nt)}:{},...i.deny_paths!==void 0?{deny_paths:cn(i.deny_paths,vs,t,["secret_protection","deny_paths"],Nt)}:{},...i.allow_paths!==void 0?{allow_paths:cn(i.allow_paths,Es,t,["secret_protection","allow_paths"],Nt)}:{}};return{policy:Qc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Oy]}}function ou(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],As));return[]}))}function Qc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Nt=()=>{return},As="must be a boolean",Ps="must be an object if provided",iu=`must be an integer between ${no} and ${ro}`,su={path:["destructive_command_protection","overrides"],label:"destructive command"},au={path:["secret_protection","overrides"],label:"secret protection"},Dy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ny(e,t){let n=[];return{policy:lu(e,t,(o)=>{n.push(o)}),issues:n}}function Ly(e,t){return lu(e,t,Nt)}function lu(e,t,n){if(!xe(e))return n(_([],"Config must be an object")),oo();if(e.version!==1)n(_(["version"],"must be 1"));let r=ln(e.safety,["safety"],["level","overrides"],n),o=ln(r.overrides,["safety","overrides"],on,n),i=ln(e.workflow,["workflow"],["worktree_mode"],n),s=ln(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=ln(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=ln(e.audit,["audit"],["retention_days"],n);return cu(e,Dy,[],n),{version:1,safety:{level:Wy(r.level,n),overrides:ou(o,on,["safety","overrides"],n)},workflow:{worktree_mode:Rs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Rs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:io(s.overrides,us,su,n),allow_paths:cn(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Rs(a.enabled,["secret_protection","enabled"],!0,n),overrides:io(a.overrides,ys,au,n),deny_paths:cn(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:cn(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Gy(l.retention_days,n)}}}function ln(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(t,Ps)),{};return cu(e,n,t,r),e}function cu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Wy(e,t){if(e===void 0)return"standard";if(ws.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Rs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,As));return n}function Gy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=no&&e<=ro))t(_(["audit","retention_days"],iu));return jc(e)}function io(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function cn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function xe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function oo(){return structuredClone(nu)}function so(e,t){if(!Iy(e))return{exists:!1,policy:oo(),errors:[]};try{let n=ky(e,"utf-8");if(!n.trim())return{exists:!0,policy:oo(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Ny(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${zy(i)}`),fallback:xe(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:oo(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Fy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[iu,`not an integer between ${no} and ${ro}`]]);function zy(e){let t=ls(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Fy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function By(e,t){let n=so(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!xe(r))return{policy:tu(),errors:[]};let o=Ly(r,t);return{policy:_s(o),gui:o,errors:[],levelPresent:eu(r)}}if(n.parsed===void 0)return{policy:tu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:_s(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:eu(n.parsed)}}function eu(e){let t=xe(e)&&xe(e.safety)?e.safety:{};return ws.has(t.level)}function uu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Jr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function tu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:uu({}),denyPaths:[],allowPaths:[]}}}function _s(e){return{safety:$y(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:uu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function $y(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function du(e,t){let n=Fc(e,t),r=ru(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Vy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Ky(o,Uy(n,r),s,r.policyScopes)}function Uy(e,t){let n=jy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:qy(e.errors.length>0?Hy(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function Hy(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function jy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Vy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Ky(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function qy(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function mu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:qc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Fi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as qR,isAbsolute as YR,join as ZR,parse as XR,resolve as JR,sep as QR}from"path";function Yn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Yy=/^[A-Za-z_][A-Za-z0-9_]*=/;function ao(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Zn(e){let t=ao(e.words[0],"time")?1:0,n=t===1&&ao(e.words[t],"-p")?t+1:t,r=t===1&&ao(e.words[n],"--")?n+1:n,o=ao(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Yy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ht=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function lo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Zy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function co(e,t,n){e.push(n),t.reset()}function uo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function un(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Zy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||pu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!pu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=fu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=fu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Xy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Jy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function fu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function pu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Xy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Jy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var bu=new Set(["&&","||","|","|&"]);function Cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=po(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:yo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function po(e,t,n,r,o,i,s){let a=[],l=[],c=lo(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);co(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),yu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(ho(f)){if(f===`
+`||f==="\r"){m();let b=f==="\r"&&e[u+1]===`
+`?u+2:u+1,P=a.at(-1);if(P?.kind!=="connector"||!bu.has(P.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let x=Ds(e,b,n,d.splice(0));l.push(...x.issues),u=x.next;continue}u=b;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let g=c.start===-1?Cb(e,u,n):void 0;if(g){if(Ls(a,l),i>=r.maxDepth)return dn(a,l,u,"depth-limit",r.maxDepth);if(!Ns(o))return dn(a,l,u,"word-limit",r.maxWords);let b=po(e,g.braceIndex+1,n,r,o,i+1,"}"),P=b.next,x={start:g.braceIndex+1,end:b.closed?P-1:P},A=gu(e,x,b);if(a.push({kind:"function",name:g.name,span:{start:u,end:P},body:A}),l.push(...b.issues),b.pendingHeredocs.length>0||Jn(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...b.pendingHeredocs),b.limited)return fo(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=P;continue}let p=go(e,u);if(p){if(m(),!Au(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:u,end:u+p.length})})),u+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&sb(e,u,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return dn(a,l,u,"depth-limit",r.maxDepth);let b=f==="("?")":"}",P=po(e,u+1,n,r,o,i+1,b),x=P.next,A={start:u+1,end:P.closed?x-1:x},Y=gu(e,A,P);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:x},body:Y}),l.push(...P.issues),P.pendingHeredocs.length>0||Jn(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...P.pendingHeredocs),P.limited)return fo(a,l,P.next);if(!P.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});u=x;continue}let h=(f==="<"||f===">")&&e[u+1]!=="("?nb(e,u):null;if(h){let b=c.words.at(-1),P=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(P!==void 0)c.words.pop();let x=P===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let A=u+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let Y=e[A],ke=A>u+h.length&&Y==="#",je=!Y||ho(Y)||!!go(e,A)||Y===s||Y===")"||ke||(Y==="<"||Y===">")&&e[A+1]!=="(",de=h==="<<"||h==="<<-",j=de?Ms(e,A,n):void 0,G=j?{word:un(e,A,j.next,j.delimiter,"literal",j.quoted),nested:[],issues:[],next:j.next,limited:!1}:!je?Ws(e,A,n,r,o,i):void 0;if(G){if(l.push(...G.issues),G.limited)return fo(a,l,G.next);if(!Ns(o))return dn(a,l,G.next,"word-limit",r.maxWords)}let J=G?.next??u+h.length,X={kind:"redirection",operator:h,span:{start:x,end:J},...P===void 0?{}:{fd:P},...G?{target:G.word}:{}};if(c.redirections.push(X),de&&!j)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(j){if(j.ambiguous||j.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Q=c.nested;d.push({delimiter:j.delimiter,quotedDelimiter:j.quoted,stripTabs:h==="<<-",attach:(be)=>{if(X.heredoc=be,be.quotedDelimiter)return;Q.push(...eb(e,be.bodySpan.start,be.bodySpan.end,r,o,i+1))}})}if(!de&&!G)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(G)c.nested.push(...G.nested);c.end=J,u=J;continue}if(c.start===-1)Ls(a,l);let y=Ws(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return fo(a,l,y.next);let v=cb(c.words)?pb(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return dn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!Ns(o))return dn(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return m(),yu(a,l),l.push(...Sb(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function gu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:yo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ho(f)||(f===";"||f==="|"||f==="&")&&go(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=Qy(e,a,n,r,o,i);if(s+=h.text,d.push(...h.nested),m.push(...h.issues),u||=h.limited,c=Xn(c,h.provenance),a=h.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let h=rb(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let p=f==="$"||f==="<"||f===">"||f==="`"?bo(e,a,n,r,o,i):null;if(p){let h=Su(p,d,m);if(u||=h.limited,c=Xn(c,h.provenance),a=h.next,u)break;continue}if(f==="$"){let h=xu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Xn(c,"glob");s+=f,a++}return{word:un(e,t,a,s,c,l,c==="literal"?void 0:ib(e,t,a)),nested:d,issues:m,next:a,limited:u}}function Qy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let g=e[m+1]??"";if(g===`
+`){m+=2;continue}if(g==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,m+=2;continue}if(e.startsWith("$((",m)){let g=Gs(e,m+3,n,"))"),p=g===-1?n:g+2;if(s+=e.slice(m,p),g===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=p;continue}let f=bo(e,m,n,r,o,i);if(f){let g=Su(f,l,c);if(m=g.next,d||=g.limited,a=Xn(a,g.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let g=xu(e,m,n,s,a);s=g.text,a=g.provenance,m=g.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function bo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=Gs(e,t+d,n,m),f=u===-1?n:u,g=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:bb(e,t+d,f,"depth-limit"),next:g,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,P=t+d;while(P<f){let x=bo(e,P,f,r,o,i+1);if(!x){P++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),b||=x.program.status==="limited",P=x.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo(E,b),issues:E,nodes:v}),next:g,provenance:"arithmetic"}}let p=po(e,t+d,f,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`}]:[],y=(c||l)&&Jn(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo([...p.issues,...h,...y],p.limited),issues:[...p.issues,...h,...y],nodes:p.nodes}),next:g,provenance:"command-substitution"}}function eb(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?bo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Su(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Gs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
+`?a+2:a+1,m=Ds(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=vu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=tb(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=Ms(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function tb(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=vu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function vu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!vb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function go(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function nb(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ho(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Eu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function rb(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ob(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ob(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return mo(e,t+1,n,16,2,t+1);if(r==="u")return mo(e,t+1,n,16,4,t+1);if(r==="U")return mo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return mo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function mo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function yo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function xu(e,t,n,r,o){let i=Eu(e,t,n);return{text:r+e.slice(t,i),provenance:Xn(o,"variable"),next:i}}function ib(e,t,n){let r=uo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,g=c?"))":u?"`":")",p=Gs(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=Eu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Xn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function sb(e,t,n){return t+1>=n||ho(e[t+1]??"")||go(e,t+1)!==null}var ab=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),lb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function cb(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=ub(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function ub(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return db(e,t);if(n==="env")return mb(e,t);if(n==="sudo")return fb(e,t);return}function db(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function mb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(ab.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function fb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(lb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Ru(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=_u(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>wu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function pb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=_u(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>wu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>un(e,t.span.start,t.span.end,a,"literal",!1))}}function _u(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>hu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=hu(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let m=d.start+c.length-d.end,u=d.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...gb(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function hu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&yb(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:hb(e,r)}}function gb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function hb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function yb(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function wu(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function bb(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function dn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function fo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function Cb(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Jn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Jn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Jn(t.body.nodes)})}function Sb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Au(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function yu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!bu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ls(e,t){if(!Au(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function vb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Tu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Eb=new Set(["gc","cat","type","cp","mv","rm"]),Iu=["-rec","-for","-path","-literalpath","-whatif"],xb=/^\$env:\w/i,Rb=/^(?:\$\{?\w+\}?|~)\\./;function ku(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Tu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Iu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!_b(n))return!1;let r=$s(e,t);if(Ou(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Bs(r).some(wb)}function Ou(e){return e.nodes.some((t)=>{if(t.kind==="group")return Ou(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function _b(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function wb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Tu.has(n))return!0;let r=e.slice(t+1);if(n&&Eb.has(n)&&r.some(Ab))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Iu.some((s)=>i.startsWith(s))})}function Ab(e){return xb.test(e)||Rb.test(e)}function $s(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Ob(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=lo(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};co(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let g=kb(e,u,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[u+1]===`
+`?u+2:u+1;s.push(Fs(e,u,y)),u=y;continue}u++;continue}let p=Nu(e,u);if(p){m(),s.push(Fs(e,u,u+p.length)),u+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Du(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Us(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(Fs(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?Pu(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Os({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=Pu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function Pu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(g)=>{let p=Pb(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),d+=zs(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||Nu(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:un(e,t,f,i,s,a,s==="literal"?void 0:Tb(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function Pb(e,t,n,r,o){let i=Mu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Du(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Mu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function Tb(e,t,n){let r=uo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Mu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Ib(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Ib(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Du(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Bs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Bs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Bs)]})}function Nu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function kb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Ob(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Fs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=ht){if(t==="powershell"||t==="auto"&&ku(e.slice(0,n.maxInputLength),n))return $s(e,n);return Cu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function mn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function Co(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Hs(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Qn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Re(e,t){Qn(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function U(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function H(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!Lt(C(e,t-1))&&H(e,t,n)&&!Lt(C(e,t+n.length))}function nt(e,t){return Lt(C(e,t-1))!==Lt(C(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function fn(e){return e==="|"||e===";"}function So(e,t,n){let r=Hs(e,n);if(t==="rm")return Mb(r);if(t==="dd")return Nb(r);return Bu(r,!0)}function vo(e,t,n){let r=Hs(e,n);if(t==="rm")return Lb(r);if(t==="reset-hard")return Fu(r,"--ha","rd");if(t==="reset-merge")return Fu(r,"--me","rge");if(t==="clean")return zb(r);if(t==="checkout")return $b(r);if(t==="push-force")return Ub(r);if(t==="push-refspec")return Hb(r);if(t==="push-delete")return jb(r);if(t==="branch")return Vb(r);if(t==="tag")return Yb(r);if(t==="restore")return Zb(r);return Bu(r,!1)}function Mb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(tt(e,i,"rm")&&U(l)&&l!==`
+`)t=!0,i++;continue}let a=Db(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Lu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(U(s)){if(o<0)continue;if(H(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Lu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Db(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(H(e,t,String.raw`\n`))return t+2;if(H(e,t,String.raw`\x0a`)||H(e,t,String.raw`\x0A`))return t+5;if(H(e,t,String.raw`\u000a`)||H(e,t,String.raw`\u000A`))return t+7;return H(e,t,String.raw`\012`)?t+4:-1}function Lu(e,t,n){if(Wu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Wu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Wu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!H(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function Nb(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(C(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!H(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!U(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function Lb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=C(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=Gb(e,o);if(s>=0){if(Wb(e,s))return!0;let a=s,l=!1;while(U(C(e,a)))l||=C(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(H(e,o,"--")&&(o===0||U(C(e,o-1)))&&(!C(e,o+2)||U(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=H(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=H(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!H(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||U(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function Wb(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(U(C(e,n)))n++;let i=n;while(n<Z(e)&&!U(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&H(e,i,"--"))return!1;let s=Gu(e,i,"recursive"),a=Gu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=Fb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Gu(e,t,n){return H(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function Gb(e,t){if(t>0&&Lt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!U(C(e,n+1)))return-1;return n+1}function Fb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=C(e,c)??"",m=(d==="r"||d==="f")&&nt(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Fu(e,t,n){return tr(e,"reset",fn,!0,(r)=>C(e,r)==="-"&&pn(e,r,t,n)?!0:r)}function zb(e){return tr(e,"clean",fn,!0,(t)=>{if(C(e,t)!=="-")return t;if(pn(e,t,"--fo","rce"))return!0;let n=er(e,t,fn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!U(C(e,r)))return{commandEnd:-1,next:r};while(U(C(e,r)))r++;while(r<Z(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=er(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&H(e,r,"--"),s=Bb(e,r,o);r=o;while(U(C(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:er(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=er(e,r,oe);while(U(C(e,r)))r++}return{commandEnd:-1,next:r}}function Bb(e,t,n){for(let r of ve)if(n-t===r.length&&H(e,t,r))return!0;return!1}function $b(e){return zu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Ub(e){return tr(e,"push",fn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Lt(C(e,t+2))&&!H(e,t+2,"-with-lease"))return!0;let n=$u(e,t,"--fo","rce");if(n>=0&&!H(e,n,"-with-lease"))return!0;return t})}function Hb(e){return tr(e,"push",oe,!1,(t)=>{if(U(C(e,t))&&C(e,t+1)==="+"&&t+2<Z(e)&&!oe(C(e,t+2))&&!U(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function jb(e){return tr(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&pn(e,t,"--de","lete"))return!0;if(U(C(e,t))&&C(e,t+1)===":"&&t+2<Z(e)&&!U(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function Vb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=er(e,o,oe),s=Kb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function Kb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(pn(e,i,"--de","lete"))r=!0;if(pn(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&qb(C(e,s))){let d=C(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function qb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Yb(e){return zu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function zu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(U(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&U(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(pn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(fn(o))i.outerActive=!1}return!1}function tr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||U(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(C(e,d)))i=!1;s=c}if(l)i=!1}return!1}function Zb(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(H(e,n+2,"staged")||H(e,n+2,"help")))t=!1}return t}function Bu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=C(e,r),i=t?js(o):oe(o);if(n&&U(o)&&C(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function er(e,t,n){let r=t;while(r<Z(e)&&!U(C(e,r))&&!n(C(e,r)))r++;return r}function $u(e,t,n,r){if(!H(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function pn(e,t,n,r){return $u(e,t,n,r)>=0}function Ae(e,t){Qn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Re(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Xb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Hu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Qn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return ju(t.nodes,r,i)}function ju(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return ju(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return Jb(r,t,n)})}function Jb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Xb.test(o.text));return e.words.every((o,i)=>o===t||Uu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Uu(o.target.raw,n.anchored,!0)))}function Uu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Qb,resolve as Vu}from"path";function nr(e,t,n,r){let o=Qb(e)?Vu(e):t?Vu(t,e):void 0;if(!o)return;try{return N(o,n,r)}catch{return o}}function Ku(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var gn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",rr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),eC=new Set(["-p","--print"]),tC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),nC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),rC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),oC=new Map([["python",new Set(["m"])]]),iC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),sC=new Set(["always","default","never"]),aC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),lC=/\\\r?\n/g,cC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function qu(e){return Ro(e).code}function xo(e){return Ro(e).sources}function Yu(e){return cC.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&eC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(dC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(mC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=uC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(iC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&aC.has(s))||t==="python"&&!sC.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(oC.get(t)?.has(u)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return Ne(t,n,r,o)}if(tC.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(nC.get(t)?.has(u)){if(m+1===s.length)i++;break}if(rC.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function uC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function dC(e,t){return qs.get(e)?.has(t)??!1}function mC(e){return qs.get(e)?.has("--eval")??!1}function or(e,t,n=!1){let r=gC(e,t);if(!Ks(r,t))return!1;Re(t,r);let o=pC(r);if(Ks(o,t))return!0;if(Re(t,o),!Zu.test(o))return!1;return!n||fC(r,t)}function fC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+d.length,u=m;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:m,text:e.slice(m,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Zu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||d)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Zu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function pC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Re(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Re(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Re(t,e),n.some((o)=>vo(o,r))))}function gC(e,t){return Re(t,e),e.replace(lC,"")}import{lstatSync as mS,readdirSync as fS}from"fs";import{basename as pS,isAbsolute as vd,join as gS,relative as Ed}from"path";import{isAbsolute as rd,parse as _C}from"path";import{dirname as hC,isAbsolute as yC,parse as bC,sep as CC}from"path";function yt(e,t,n){if(et(t))throw Error("Unsupported Windows namespace path");let r=yC(t)?bC(t).root:"",o=r||e;for(let i of vC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=hC(o);continue}let s=SC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function SC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${CC}${t}`}function vC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],EC=new Set(Qs),xC=1024,Xu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Ju=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),RC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function _o(e){return EC.has(e)}function ea(e){return _o(e)||Xu.has(e)||Ju.has(e)||$n(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Qu(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=xC?{state:"valid",count:r}:{state:"invalid"}}function wo(e,t,n){let o=e.match(RC)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function ed(e){return nd(e,Ju)}function td(e){return nd(e,Xu)}function nd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var id=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!id.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function sd(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!sd(hn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let u=od(i),f=Ao(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&hn(i).includes("=")&&!AC(i)){let p=PC(hn(i),a,t.env)??wo(hn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=O(hn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=IC(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=MC(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,y]of p.envAssignments)s.set(h,y),a.set(h,y)}if(g==="command")i=DC(i);if(g==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(od(i)===u)break}let d=Ao(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:wC(d.words,o)}}function wC(e,t){return e.some((n)=>!t.has(n))}function od(e){return e.map(w).join(" ")}function hn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function AC(e){return id.test(hn(e))}function PC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var TC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function IC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?ir(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ir(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ir(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(TC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var kC=new Set(["-i","-0","--null"]),OC=new Set(["-u","--unset","-C","--chdir","-P"]);function MC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(kC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(OC.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?ir(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ir(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function ir(e,t,n){if(t==="")return null;if(!e&&!rd(t))return null;let r=rd(t)?_C(t).root:n.realpath(e??"/");if(r===null)return null;try{return yt(r,t,n)}catch{return null}}function DC(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var NC=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>NC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function bt(e,t,n){return To(e,t,n).tokens}function LC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(LC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function To(e,t,n,r){if(!sd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),WC=new Set(["env","sudo","command","builtin"]),GC=new Set(["&&","||","|&","|","&",";"]),FC=new Set(["<<","<<<",">|"]),zC=new Set(["|","|&"]),BC=/[*@#?$!_-]/,$C=/^\w+(?::\w+)*/,UC=Object.freeze([]),sr=Object.freeze({kind:"scope",edge:"enter"}),ar=Object.freeze({kind:"scope",edge:"exit"}),HC=Object.freeze([]),jC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),lr=new Set(["bash","sh","zsh","dash","ksh"]),VC=256,dd=new WeakMap;function md(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=YC(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Gt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return dd.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[];for(let m of fd(e)){if(m.kind==="scope"){if(m.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=d.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let u=o.segment(a,s,c,m.operator,l);if(u)return u;s=KC(a,s,n,r),c=a.length>0&&zC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let u=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(u===oa){l.add(a.length),a.push(i(m.target));continue}if(u)return u;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Mo(e){return fd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function cr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function KC(e,t,n,r){let o=cr(e)?new Map([...t.variables,...qC(e,t.variables)]):t.variables,i=bt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ae(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function qC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function fd(e){return dd.get(e)??UC}function YC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=HC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Gt(e,t){return e.nodes.flatMap((n,r)=>ZC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function ZC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(tS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...Gt(e.body,a),...s?[ko("}")]:[]]:[sr,We("("),...Gt(e.body,a),...s?[We(")")]:[],ar]}]}let o=iS(e,r.functions);if(o){if(r.depth>=ht.maxDepth||++r.flags.expansions>VC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ad(e,r),ko(";"),...Gt(o,{...r,depth:r.depth+1}),ko(";")]},...ld(e,t,n,r)]}return[{start:e.span.start,events:ad(e,r)},...ld(e,t,n,r)]}function ad(e,t){return[...e.words.map((n)=>({start:n.span.start,events:gd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:XC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function XC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?gd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:nS(r),targetOrder:FC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:yd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ld(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...pd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?JC(t,n,r):[]]}function JC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:pd(n.source.slice(r.span.end,e.span.end),n)}]}function pd(e,t){if(t.depth>=ht.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Gt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function gd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=d?Gt(d,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(sr,...g,ar);continue}let m=d?Gt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(sr,...m,ar);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),sr,...m,...c.raw.endsWith(")")?[We(")")]:[],ar);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>We("(")),...u===1?[sr]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>We(")")):[],...u===1?[ar]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=cd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=cd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function cd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=eS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return QC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&BC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?$C:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function QC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function eS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function tS(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:GC.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function nS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function ur(e){return jC.has(e)||/^python\d/.test(e)}var rS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function hd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=rS.get(e)?.has(n)??!1;return hd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!WC.has(t))return[...e];return na(hd(t,e.slice(1)))}function yd(e){let t=Zn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function oS(e){let t=yd(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return ur(n)&&!lr.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(oS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!aS(t))return r;return[...r,...o]})}function iS(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function St(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function sS(e){if(St(e.words[0],"git"))return St(e.words[1],"commit");if(!St(e.words[0],"gh")||!St(e.words[2],"create"))return!1;return St(e.words[1],"pr")||St(e.words[1],"issue")}function aS(e){return(St(e.words[0],"cat")||St(e.words[0],"tee")||sS(e))&&!e.words.some(ud)&&!e.redirections.some((n)=>ud(n.target))}function ud(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var bd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Cd=new Set([...bd,"glob"]),lS=new Set([...Cd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function dr(e){let t=cS(),n=Gn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:uS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return ki(e,t)}function cS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let d=n.get(a);if(d)return d;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=md(i,a);return e.set(i,c),c},getCommandProgram:r}}function uS(e){let t=e.route.kind==="grep"?Cd:e.route.kind==="glob"?lS:bd;return[...Ol(e.input,t),...e.route.kind==="patch"?Nl(e.input):[]]}var dS=new Set(["-S","--suffix"]);function yn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&dS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function xd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Nr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Sd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=yn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>vS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Sd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Ft(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(ae(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?No(m,l):hS(m,l);if(n.markerFiles.some(d))return!0;return r&&aa(n).some(d)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function hS(e,t){let n=Ed(t,e);if(n===""||n.startsWith("..")||vd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function yS(e,t,n,r,o){return Ft(e,t,n,!0,r,o)}function bS(e,t,n,r,o){if(!n)return!1;return sa(Lo(ae(e,t,r,o)),n)}function Sd(e,t,n,r,o,i){let s=Lo(ae(e,t,r,o));return i.includes(s)||_d(s,n)}function Rd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(ae(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||_d(e,t)}function _d(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var CS=50000;function wd(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(pS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=SS(o);if(!i)return!0;if(r+=i.length,r>CS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>gS(o,s.name)))}return!1}function SS(e){try{let t=mS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return fS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=Ed(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!vd(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function vS(e,t,n,r,o){if(cr(e))return null;let i=Ct([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>yS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&bS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as TS,parse as IS,posix as Dd,resolve as Bt,sep as da}from"path";import{isAbsolute as ES,join as Ad,normalize as Id,parse as xS,sep as Pd}from"path";var RS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],_S=` 	
+`;function mr(e,t){if(vt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function zt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Od(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(AS(e))return!1;return bn(e,t)}function vt(e,t){let n=Od(e,t,"IFS");return n!==void 0&&n!==""&&n!==_S}function bn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return kd(t).some((r)=>Cn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return kd(t).some((r)=>Go(r)===Go(n))}var Td=new WeakMap;function kd(e){let t=Td.get(e);if(t)return t;let n=wS(e);return Td.set(e,n),n}function wS(e){let t=RS.map((r)=>Wo(r,e.paths)??Id(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&PS(n))return[...t,n];return t}function AS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Od(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function PS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Id(e);if(!ES(n))return n;let r=xS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Ad(i,o[s]??"");if(t.entryKind(a)==="missing")return Ad(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Cn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Pd)?r:`${r}${Pd}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var kS=process.platform==="win32",Md=64,OS=16384;function fr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return S(o.id,o.reason)}function pr(e){let t=Ru(e,Md,Md,OS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:MS(e)}}function MS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>DS(e.raw,n.span.start-e.span.start))}function DS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Et(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:zS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&$S(e))return{kind:"outside_anchored_cwd"};let o=!r&&Ld(e,t.posixShell);if(et(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(LS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Ft(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(WS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(BS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&VS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>KS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(qS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(NS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function NS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Wd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return bn(Bt(t.resolvedCwd,r),t.environment)}function Nd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(FS(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Wd(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Dd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function LS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?Bt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(N(i,t.environment.paths,t.budget));if(s===IS(s).root)return!0;return s===he(N(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=TS(e);if(kS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function WS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&bn(l,a))return!0;return(t||i&&s)&&n&&!o&&GS(l,n)}function GS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Ld(e.slice(n.length+1),t)})}function FS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Dd.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function zS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Kn(o.trim(),t);if(!zo(i))return[];try{let s=N(i,n,r);if(qn(s,N(t,n,r)))return[];return[he(s)]}catch{return[]}})}function BS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Kn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?Bt(i,o):null;if(!s)return!1;try{let a=he(N(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function $S(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Ld(e,t=!1){return e.includes("$")||e.includes("`")||US(e)||t&&HS(e)}function US(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function HS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&jS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function jS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function VS(e,t,n,r){try{return he(N(e,n,r))===he(N(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function KS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(N(Bt(t,e),n,r))===he(N(o,n,r))}catch{try{return he(Bt(t,e))===he(o)}catch{return!1}}}function qS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua(Bt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua(Bt(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return Gd(N(e,n,r),N(t,n,r))}catch{return!1}}function Wd(e,t,n,r){if(!t)return!1;try{return Gd(N(t,n,r),N(e,n,r))}catch{return!0}}function Gd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var YS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Fd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ZS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",zd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Bd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",XS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",JS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",QS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Bd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:zd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:XS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Fd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:ZS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Fd}};function $d(e,t,n,r=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return ev(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function ev(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=nv(o),s=o[i];if(!s||!YS.has(dv(s.text)))return null;let a=tv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",JS);for(let l of a.targets)if(!et(l.text)&&ma(ga(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Bd);for(let l of a.targets)if(n.resolvedCwd&&Ft(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",zd);for(let l of a.targets){let c=fr(Fe(ga(l.text),n),n,r,QS);if(c)return c}return null}function tv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(rv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=iv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(sv(c.name)){let d=c.value?ov(c.value,l):e[++a];if(d?.kind==="word"){t.push(pa(d)),i=i||d.dynamic;continue}i=!0;continue}if(av(c.name)){n=!0;continue}if(lv(c.name)){r=!0;continue}if(cv(c.name))o=uv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function nv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function rv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function ov(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function iv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function sv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function av(e){return"recurse".startsWith(e)}function lv(e){return e.length>=2&&"force".startsWith(e)}function cv(e){return e==="wi"||"whatif".startsWith(e)}function uv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function dv(e){return e.toLowerCase()}var Sn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",gr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Ud="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var mv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),fv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),pv=new Set(["-o","--output","--query","--subscription"]),gv=new Set;function Hd(e){if(e==="aws")return mv;if(e==="gcloud")return fv;if(e==="az")return pv;return gv}var hv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),yv=new Set;function jd(e){if(e==="git")return ve;if(e==="docker")return hv;return yv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!Sv(n,o.command))continue;if(o.match){if(bv(n,e,o.match))return Vd(o);continue}if(!vv(n,e,o.subcommand))continue;if(xv(e,new Set(o.block_args),r))return Vd(o)}return null}function Vd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function bv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Cv(r,n.command_path,Hd(e))}function Cv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Sv(e,t){return e===O(t)}function vv(e,t,n){if(!n)return!0;return Kd(t,1,n,jd(e))}function Kd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Ev(e,i,n,r))return!0;continue}return s===n}return!1}function Ev(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Kd(e,t+2,n,r)}function xv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Rv=new Set(["-e","--source"]),_v=new Set(["-F","-v","--assign","--field-separator"]),qd=new Set(["-f","--file"]),wv=new Set(["print","printf","return"]),Yd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Av="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Zd(e,t,n){let r=!1;for(let o of Pv(e)){let i=Tv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",Av):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Rv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(_v.has(a)||qd.has(a))){let l=e[s+1];if(i&&=l!==void 0,qd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function yr(e){return ya(e).sources}function Pv(e){return yr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Tv(e,t){Re(t,e);let n=e.includes("system")?ba(e,t):null,r=Iv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ba(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Xd(e,i+1);continue}if(s==="/"&&Jd(e,i)){i=Qd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,hr(e[a-1])||hr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Uo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=$o(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Iv(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Uo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Xd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Jd(e,i)){let f=Qd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=$o(e,m);if(ha(e,u,"getline")){o=!0;let f=Mv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Nv(s,a)){o=!0;let f=Ov(e,u);if(!f){r=!0,c=m,i=m;continue}if(!kv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function hr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function kv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Dv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Ov(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function Mv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Dv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!hr(e[t-1])&&!hr(e[t+n.length])}function Nv(e,t){return t!==null&&t>=e}function Xd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Jd(e,t){let n=Lv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(hr(e[r-1]))r--;return wv.has(e.slice(r,n+1))}function Lv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Qd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Wv=new Set(["sudo","env","command","builtin"]);function Ho(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=Gv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Gv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Fv(a,r);if(l)i.push(s);if(!l&&jr.has(O(a)))break;if(o)break}return i}function Fv(e,t){let n=I(e),r=O(e);return r==="git"||n==="busybox"||$t(e)||os.has(n)||t.transparentWrappers.includes(n)||q.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return Wv.has(e.toLowerCase())}function Ut(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return jo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*jo(e,t,n,r,o,i,s,a,l){let c=To(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=Po(c.envSplitValues,d);if(!f)throw new D("derivedCommandShape");Ca(a),yield*jo(f,t,m,r,o,i,s,a,l);return}if($t(d[0]??""))throw new D("wrapperPeelIterations");let u=Ho(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])Ca(a),yield*jo(f===u.childIndex?u.tokens:d.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Bv(d)){Ca(a),yield*jo(d.slice(1),t,m,r,o,i,s,a,l);return}yield zv(d,m,r,o,i,l)}function zv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ca(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Bv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Sa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||va(r,"recursive")){t=!0;continue}if(r==="-f"||va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Vo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var $v=["--init-file","--rcfile"],Uv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function $e(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return em(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=em(e,t,!1);if(r!==null)return r}}return null}function st(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ee(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function em(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function tm(e){let t=I(e[0]??"").toLowerCase(),n=Hv(e,t),r=Uv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Hv(e,t){let n=Ee(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?$v.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ns.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=rs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var jv="find -delete permanently removes files. Use -print first to preview.",Vv="find -exec rm -rf is dangerous. Use explicit file list instead.",Kv=new Set(["-exec","-execdir","-ok","-okdir"]),qv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function nm(e,t){let n=e.map(w),r=Yv(e,n,t);if(r)return r;if(Ko(n,1)&&!tE(e,n,t)){let s=T(S("find.delete",jv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=at(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=vn(n,i);i=l.nextIndex;let c=rE(l.tokens,t.environment);if(c){let f=T(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:T(m,t.policy);if(u)return u}return null}function Yv(e,t,n){if(!Ko(t,1)&&!Ea(t,n.environment))return null;let o=br(e)??K(["."]),i=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=pr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!Zv(e,i.protectedGitMetadata,n.environment))return S("find.delete-git-metadata",Te)}}if(eE(t)&&i.resolvedCwd&&Rd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function Zv(e,t,n){if(!t)return!1;let r=e.map(w),o=[],i=!1,s=br(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=vn(r,a),d=Ct([...c.tokens],n),m=Vo(d),u=q.has(I(d[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||u||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(Jv(c.text,l==="-iname"));a+=2;continue}if(!Xv.has(l))return!1;a+=1+at(l)}return o.length>0&&!wd(t,(l)=>o.every((c)=>c.test(l)))}var Xv=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function Jv(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var Qv=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ea(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=vn(e,n),o=Ct([...r.tokens],t),i=I(o[0]??"").toLowerCase(),s=q.has(i)&&Qv.test(($e(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function eE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function tE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=br(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ca(o,n.environment),s=n.trustedTmpdirValue??zt(o,n.environment),a=n.allowTmpdirVar??!mr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??vt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=Et(l),d=Et({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&u&&!Cn(u,m)?n.cwd:void 0;return r.every((g)=>{let p=pr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[w(g)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,v=y??h;return Nd(v,y?d:c,{containmentTarget:nE(v,i),targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected})})})}function nE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function br(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function rE(e,t){let n=bt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&Be(n))return S("find.exec-rm-recursive-force",Vv);return null}function vn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Ko(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=vn(e,n).nextIndex;continue}let o=at(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function at(e){return qv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&Kv.has(e)}import{resolve as Tx}from"path";function Cr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var oE=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function om(e,t,n){let r=qo(e,t,n),o=iE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<oE;a++){let{subcommand:l,rest:c}=_e(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=uE(m);if(u===null||u.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function im(e,t,n){return qo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function _e(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function iE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=aE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...sE(e,t,n)]}}function sE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ra(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ra(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=rm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=rm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function aE(e,t){let n=lE(e,t),r=cE(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function lE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Cr(n);if(!o)return null;for(let i of o){let s=Ra(i);if(!s)return null;r.push(s)}return r}function cE(e,t){let n=Qu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ra(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function rm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function uE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Cr(t)}var dE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",fE="git checkout --force discards uncommitted changes. Use 'git stash' first.",pE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",gE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",hE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",yE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",bE="git switch --force discards uncommitted changes. Use 'git stash' first.",CE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",SE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",vE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",EE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",xE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",RE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",_E="git push --force destroys remote history. Use --force-with-lease for safer force push.",wE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",AE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",PE="git branch -D force-deletes without merge check. Use -d for safe delete.",TE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",IE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",kE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",OE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",ME="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",DE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",NE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",LE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),WE=new Set(["--recurse-submodules","--track","-t"]),_a=new Set(["-b","-B","-U"]),wa=new Set(["-c","-C"]),GE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function am(e,t){let{subcommand:n,rest:r}=_e(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return xt(FE(r,t));case"switch":return xt(BE(r));case"restore":return xt(UE(r));case"reset":return jE(r);case"clean":return xt(KE(r));case"rm":return xt(qE(r));case"push":return Ht(YE(r));case"branch":return Ht(JE(r));case"stash":return Ht(rx(r));case"worktree":return Ht(ox(r));case"rebase":return xt(QE(r));case"merge":return xt(ex(r));case"tag":return Ht(tx(r));case"reflog":return Ht(nx(r));default:return null}}function xt(e){return e?{...e,localDiscard:!0}:null}function Ht(e){return e?{...e,localDiscard:!1}:null}function FE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:_a});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return S("git.checkout-force",fE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",gE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return S("git.checkout-ref-path",pE);return S("git.checkout-double-dash",dE)}let i=$E(e);if(i.length>=2)return S("git.checkout-ambiguous",hE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(zE(s)||t(s))return S("git.checkout-double-dash",mE);return null}function zE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function BE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",yE);let n=me(t,{shortOptsWithValue:wa});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",bE);return null}function $E(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(LE.has(r)){n+=2;continue}if(WE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function UE(e){let t=HE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",SE):S("git.restore-unstaged",CE)}function HE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(GE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function jE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",vE);break}if(M(n,"--merge")){t=S("git.reset-merge",EE);break}}if(!t)return null;return VE(e)?Ht(t):xt(t)}function VE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function KE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",xE);return null}function qE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",RE):null}function YE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",AE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||sm(t,n).some(ZE))return S("git.push-force",_E);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||sm(t,n).some(XE))return S("git.push-delete",wE);return null}function sm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function ZE(e){return e.startsWith("+")||e.includes(":+")}function XE(e){return e.length>1&&e.startsWith(":")}function JE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",PE);return null}function QE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",TE):null}function ex(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",IE):null}function tx(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",kE):null}function nx(e){return e[0]==="delete"?S("git.reflog-delete",OE):null}function rx(e){for(let t of e){if(t==="drop")return S("git.stash-drop",ME);if(t==="clear")return S("git.stash-clear",DE)}return null}function ox(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",NE);return null}import{dirname as Rx,isAbsolute as _x,join as xm,resolve as wx}from"path";var Pa="TMPDIR",Ta="IFS",cm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,um=/^[A-Za-z_][A-Za-z0-9_]*$/,dm=new Set(["export","typeset","declare","readonly"]),ix=new Set(["builtin","command","time"]),mm=new Set(["do","then","else"]),sx=new Set(["do","then","case"]),lm=new Set(["done","fi","esac"]),ax=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function fm(e,t){return e.map((n)=>n.provenance==="variable"&&Sm(n.text)?pm(n.text,t.shellAssignments):w(n))}function pm(e,t){return e.replace(ax,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=pm(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function gm(e,t){return{env:e,effectiveEnvAssignments:dx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function hm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ia(e,t){let n=bm(e,t),r=e[0]??"";if(sx.has(r))t.bodyDepth+=1;if(r==="elif"||lm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(lm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ka(t,a)});let o=n.commandIndex;if(o!==-1&&dm.has(e[o]??""))e.filter((a)=>um.test(a)&&Aa(a)).forEach((a)=>{mx(t,a)});let i=o===-1?-1:Cm(e,o);if(i===-1||e[i]!=="unset")return;let s=px(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(mm.has(r)){t.shellAssignments.set(a,"");return}fx(t,a)})}function ym(e,t){let n=bm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function bm(e,t){let n=mm.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Sm(a)),o=r!==-1&&dm.has(e[Cm(e,r)]??""),i=ux(t);return{assignments:e.flatMap((a,l)=>{let c=lx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!_o(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Cm(e,t){let n=t;while(ix.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Sm(e){return Pe(e)!==null||cm.test(e)}function lx(e,t,n){return Pe(e)??cx(e,t,n)}function cx(e,t,n){let r=wo(e,n,t);if(r)return r;let o=e.match(cm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Aa(e){return e===Pa||e===Ta||ea(e)}function ux(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function dx(e,t){let n=[Pa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function mx(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function fx(e,t){if(!Aa(t)&&!um.test(t))return;if(e.shellAssignments.set(t,""),_o(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Aa(t)||t===Pa||t===Ta||$n(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function px(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as gx}from"path";function Yo(e,t){return Qs.some((n)=>t?.has(n)||e.has(n))}function xn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(gx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=vm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=vm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function vm(e,t,n){try{let r=yt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Em(e,t,n){if(!t.localDiscard||!n.worktreeMode||Yo(n.environment.env,n.envAssignments))return null;let r=xn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Oa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Oa(e,t,n){let{subcommand:r,rest:o}=_e(e),i=r?.toLowerCase();if(t.dynamicArguments||hx(o)||vx(e,t.environment.env,t.envAssignments,n)||Cx(o)||yx(i,o))return!0;return i==="clean"&&Sx(o)>1}function hx(e){return e.some((t)=>/[$*?[]/.test(t))}function yx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:_a}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:wa}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||bx(s))||r.has("-C");return o&&i}return!1}function bx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function Cx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Sx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function vx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=qo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>xx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Ex(s.value);if(td(n))return!0;return r.recursiveSubmodules}function Ex(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function xx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Rm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??w(l)),o=n.environment.paths,i=xn(r,n.cwd,o),s=n.originalCwd?o.realpath(wx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Yo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Px(e,n.shellAssignments,o):_m(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!Ax(a,r,t,n)||!bn(a,n.environment)||Fo(a,n.environment)||Cn(s,a)||Cn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function Ax(e,t,n,r){let o=r.environment.paths,i=xm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Oa(t,r,a)}function Px(e,t,n){let r=_e(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Ye(l,t??new Map))??a;if(!_x(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function _m(e,t){if(t.entryKind(xm(e,".git"))!=="missing")return e;let n=Rx(e);return n===e?null:_m(n,t)}var Ix="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",kx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Zo(e,t){return wm(e,t)}function wm(e,t,n){let r=e.map(w),o=om(r,t.environment.env,t.envAssignments),i=o.blockedReason?T(S("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((ed(t.envAssignments)||im(r,t.environment.env,t.envAssignments))&&Ox(s))return S("git.ssh-env",Ix);let a=am(s,(c)=>{let d=xn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(Tx(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Em(r,a,t)??Rm(e,a,t);if(!l)return a;return n?.(l),null}function Am(e,t){let n=null;return{match:wm(e,t,(o)=>{n=o}),relaxation:n}}function Ox(e){let{subcommand:t,rest:n}=_e(e),r=t?.toLowerCase();if(!r)return!1;if(kx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&Mx(n)}function Mx(e){return e.find((t)=>!Dx(t))?.toLowerCase()==="update"}function Dx(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as cR}from"path";function Pm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Xo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Tm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Nx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Lx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",km="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Wx="rm -rf in home directory is dangerous. Change to a project directory first.",Im={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:km},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Lx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Wx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Tm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Nx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Tm}};function Jo(e,t){let n=Et({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Vo(r),s=Fx(e);for(let a of s){let l=pr(a.word);if(o&&l.unsafeBraceExpansion){let c=T(fr({kind:"outside_anchored_cwd"},n,t.policy,Im),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=Se(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Ft(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let u=Fe(d,n,m);if(u.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",km);if(u.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let u of Gx(d,n,m)){let f=fr(u,n,t.policy,Im),g=T(f,t.policy);if(g)return g}}}return null}function Gx(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Fx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Rt={kind:"none"},jt={kind:"dynamic"},zx=new Set(["<","<<","<<-","<<<","<&","<>"]),Mm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Bx=/^(?:[0-9]+|[@*])$/,$x=ht.maxWords,Dm=ht.maxInputLength;function Nm(e){if(!e||I(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Vo(e){let t=fr(e[1])==="--"?2:1;if(e.length<=t)return Ct;let n=e.slice(t);if(!n.every(qo))return Bt;return{kind:"literal",source:n.map(w).join(" ")}}function Am(e){let t=fr(e[1])==="--"?2:1,n=e[t],r=fr(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Ct;if(!qo(n))return Bt;return{kind:"literal",source:r}}function Ko(e,t){let n=Sx(e);if(n===-1)return Ct;let r=vx(t);if(!r)return Ct;let o=[],i=r.command?.length??0;for(let s of r.references){let a=xx(s,e,n,r.ifs);if(!a)return Bt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>yx||i>bx)return Bt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(_x)].filter((s)=>s!==null).join(" ")}}function Pm(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return Ct;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&gx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Ct;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Bt;return{kind:"literal",source:o.target.text}}if(!n)return Ct;return r===void 0?Bt:{kind:"literal",source:r}}function rt(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return Ct;let n=e[t],r=fr(n);return uo(n,r)?{kind:"literal",source:r}:Bt}var Cx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ka(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=k(O(s));return!Cx.has(a)&&!J.has(a)&&!Ft(a)}function Sx(e){return ve(e.map(w)).commandIndex??-1}function vx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Ex);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function Ex(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function xx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Pa(o):Rx(o,r);if(e.parameter==="*"){let a=Pa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ta(l,r)}let i=t[n+1+e.parameter];if(i&&!qo(i))return;let s=fr(i);return e.quoted?[s]:Ta(s,r)}function Pa(e){return e.every(qo)?e.map(w):void 0}function Rx(e,t){let n=Pa(e);if(!n)return;let r=n.map((o)=>Ta(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ta(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Qo(e){let t=Rn(e[1])==="--"?2:1;if(e.length<=t)return Rt;let n=e.slice(t);if(!n.every(vr))return jt;return{kind:"literal",source:n.map(w).join(" ")}}function Lm(e){let t=Rn(e[1])==="--"?2:1,n=e[t],r=Rn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Rt;if(!vr(n))return jt;return{kind:"literal",source:r}}function ei(e,t){let n=Fm(e);if(n===-1)return Rt;let r=Hx(t);if(!r)return Rt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Vx(s,e,n,r.ifs);if(!a)return jt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>$x||i>Dm)return jt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(zm)].filter((s)=>s!==null).join(" ")}}function Wm(e,t){let n=Fm(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(vr)||o)return t;let i=r.map(Rn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let m=d[1]??d[2],u=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&u.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?u.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):u.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?zm(p):"").join(" ")).join(" "),s.length>Dm)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function Gm(e,t,n,r){if(!Ee(e.map(w)).readsStdinAsCommands)return Rt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&zx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Rt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return jt;return{kind:"literal",source:o.target.text}}if(!n)return Rt;return r===void 0?jt:{kind:"literal",source:r}}function lt(e,t=new Map){let n=Ee(e.map(w)).scriptIndex;if(n===null)return Rt;let r=e[n],o=Rn(r);if(Co(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?jt:{kind:"literal",source:i}}var Ux=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function La(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(O(s));return!Ux.has(a)&&!q.has(a)&&!$t(a)}function Fm(e){return Ee(e.map(w)).commandIndex??-1}function Hx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(jx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function jx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Vx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ma(o):Kx(o,r);if(e.parameter==="*"){let a=Ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Da(l,r)}let i=t[n+1+e.parameter];if(i&&!vr(i))return;let s=Rn(i);return e.quoted?[s]:Da(s,r)}function Ma(e){return e.every(vr)?e.map(w):void 0}function Kx(e,t){let n=Ma(e);if(!n)return;let r=n.map((o)=>Da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function qo(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function fr(e){return e?w(e):""}function _x(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Oa(e,t){return Ia(De(e,"posix"),t)}function gr(e){return Oa(e,new Set(Array.from(e.matchAll(_m)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ia(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ia(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ia(o,n))||Tm(r.words,n))return!0;Ix(r,n)}return!1}function Tm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(pr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Rm(e[s],t)}if(J.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Rm(s[l],t)}let i=wx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Tm(e.slice(i),t)}function wx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Ax(e,t+1);if(r==="exec")return Px(e,t+1);if(r==="env")return Tx(e,t+1,n);return null}function Ax(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Px(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Tx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return pr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return pr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Ix(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(pr(n,t))t.add(r.name)}}function pr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(_m)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(hx.test(o)||t.has(o))}))}function Rm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||pr(e,t))}var kx=["--init-file","--rcfile"],Ox=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function ot(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Im(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Im(e,t,!1);if(r!==null)return r}}return null}function it(e){let t=k(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Im(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function km(e){let t=k(e[0]??"").toLowerCase(),n=Mx(e,t),r=Ox.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Mx(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?kx.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&Ji.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Qi(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Ma="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Da="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Dx="__CC_SAFETY_NET_XARGS_INPUT__",Yo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Zo="rm",Nx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Lx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,Wx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Fx=/^(?:[0-9]+|[@*])$/;function Dm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=$t(n),i=n.slice(r),s=C("xargs.shell-dynamic",Da);if(zx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=zm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Fm(l,o),d=t.analyzeChild(l,{...Gt(a,t),dynamicInput:u,dynamicSourceInput:m||Lm(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:C("xargs.rm-recursive-force-dynamic",Ma)});if(d)return d;let f=Gx(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,Dx]:l,h=o!==null&&(l.some((S)=>S.includes(o))||Array.from(a.envAssignments.values()).some((S)=>S.includes(o))),y=t.analyzeChild(g,{...Gt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=tt(l,t.policy?.rules??[]);if(p)return p}return null}function Gx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Nm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Sm(e,r,t.length,n);return o===null?[]:[o]}function Lm(e,t,n,r,o,i,s){if(J.has(t)){if(it(e))return!1;if(n!==null&&Bx(e,n,s))return!0;let a=ot(e);if(!a){let l=rt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Wm(a,n,s))return!0;if(Ae(a))return!0;return $x(a,n,r)}if(Me(t))return Om(e,n,ho,Uu(t));if(we.has(t))return Om(e,n,ma,Ud);if(t==="eval"){let a=Vo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Ux(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&gn.has(a.subcommand.toLowerCase())&&Gm(a.rest,n).some((l)=>l.includes(n))}return!1}function Wm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function Om(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Yo]).sources.some((a)=>a.value===Yo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Yo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Yo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Nm(l,t,a))));return Ho(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function zx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Zo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Zo));return Array.from(ze(o,n)).some((i)=>i.head===Zo&&!r.has(Zo))}function Fm(e,t){return Gm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Gm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function zm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Bx(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Wm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Nm(a,t,s).some((u)=>{let m=e.map((f,p)=>p===l?f.replaceAll(t,u):f),d=ve(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function $x(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Nx))if(Mm(o,r))return!0;for(let o of e.matchAll(Lx))for(let i of(o[1]??"").matchAll(Wx))if(Mm(i,r))return!0;return Oa(e,r)}function Mm(e,t){let n=e[1]??e[2];return n!==void 0&&(Fx.test(n)||t.has(n))}function Ux(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(nt(s)){let l=ur(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=zm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Fm(c.tokens,t)||Lm(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=yt(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function $t(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var hr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",yr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",jx="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",Vx="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Jo=/\{[^{}\s]*\}/g,Bm=/\{\}|\{-?\d+\}/g,Kx=["e","f","source","file","-e","-f","--source","--file"],qx=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],Yx=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),Zx=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),$m=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),Xx=new Set(["--workdir","--wd"]),Um="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function qm(e){return Ie([...e],(t)=>Ae(t))}function Ym(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=yn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=of(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let p=yn(t);if(p)return p;let g=qm(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=rR(t);if(p)return p}if(u!==void 0&&a){let p=yn(t);if(p)return p}let d=oR(u,t.cwd,t.environment.paths);if(d===null){let p=yn(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...ze(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some(Wa)){let g=yn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=Qm(f.envAssignments,f.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,f),(p)=>Jx(p,o,t,f))}function Jx(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(nf)){let h=yn(n);if(h)return h}let u=qm(c);if(u)return u;let m=c.some(F),d=i||m,f=a&&d,p=Qm(e.envAssignments,e.wrapperCwd,s||f);if(J.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Xo(l,E,n.budget),Gt(e,r)))};if(it(l))return h();let y=ot(l);if(y){if(rf(y)){let x=St(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(Vm(y,A,n.budget),p))}if(F(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(Vm(y,q,n.budget),p));let x=dr(y);if(x?.[0]&&O(x[0])==="rm"&&Be(x)){let q=jm(n);if(q)return q}let A=x?n.analyzeChild(x,{...Gt(e,r),dynamicInput:a,shellDynamicMatch:C("parallel.shell-dynamic",yr),rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Ko(K(x===void 0?l:i?l.map((A)=>ef(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=St(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(gr(y)){let x=St(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return St(n);return null}let S=rt(K(l));if(S.kind==="dynamic"||S.kind==="literal"&&F(S.source))return St(n)??h();if(S.kind==="literal")return h();if(o.length>0){let E=St(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return St(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>Na(Xo(l,y,n.budget,Bm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>Na(Km(l,y,n.budget),e.cwd,r));let h=Na(l.flatMap((y,S)=>{if(S===0||!F(y))return[y];return y.startsWith("-")?[y.replace(Bm,"")]:[]}),e.cwd,r);if(h)return h;return jm(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Xo(l,h,n.budget):Km(l,h,n.budget),S=C("parallel.shell-dynamic",yr),E=a&&e.head==="find"?nR(y,r):null,v=Xm(y,a,n)??E?.customResult??null,T=O(e.head),x=a&&(T==="rm"&&La(y)||T==="xargs"&&Jm(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&Zm(y,T)),q=n.analyzeChild(y,{...Gt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:S,dynamicSourceMatch:S,rmDynamicMatch:C("parallel.rm-recursive-force-dynamic",hr)});if(A){let Z=P(S,n.policy);if(Z)return Z}return q??v??tt(y,n.policy?.rules??[])})}function Zm(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(J.has(t))return tR(e);if(t==="git")return Qx(e);if(t==="find")return!0;if(we.has(t))return Hm(e,Kx,cr);if(Me(t))return Hm(e,qx,go);return!1}function La(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||rf(o)))}function Qx(e){if(eR(e))return!0;let t=Re(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!gn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function eR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function tR(e){if(it(e))return!1;let t=ot(e);if(t!==null)return F(t);let n=rt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function Hm(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Um]).some((o)=>o.value===Um);return Ho(r,t,(o)=>n(e.map((i)=>ef(i,[o]))))}function Xm(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return St(n);return Ie(o,(i)=>tt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function nR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=Zm(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&La(a.tokens)||a.head==="xargs"&&Jm(a.tokens),n.customResult??=Xm(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(nt(a)){i=[],n.executedSource||=F(a);continue}let l=yt(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function Jm(e){let t=e.slice($t(e).childStart);return O(t[0]??"")==="rm"&&La(t)}function Qo(e,t){return(n)=>P(C(e,t),n.policy)}var St=Qo("parallel.shell-dynamic",yr),rR=Qo("parallel.command-stream-dynamic",jx),yn=Qo("parallel.command-stream-dynamic",Vx),jm=Qo("parallel.rm-recursive-force-dynamic",hr);function Na(e,t,n){return P(jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Nt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function Qm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function ef(e,t){return e.replace(Jo,(n)=>tf(n,t))}function Xo(e,t,n,r=Jo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=tf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Vm(e,t,n){return Xo([e],t,n)[0]??""}function Km(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function tf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(Jo)!==-1}function nf(e){if(Wa(e))return!0;for(let t of e.matchAll(Jo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Wa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function rf(e){return/^\{[^{}\s]*\}$/.test(e)}function oR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Hx(e))return null;try{return ft(t??e,e,n)}catch{return null}}function of(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ga(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ga(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),S=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?S:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||Zx.has(y)){c=!0,t+=S===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=S===void 0?2:1;continue}if($m.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=$m.has(p)?2:1;continue}if(Xx.has(y)){c=!0;let E=S??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=S===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&S!==void 0){t++;continue}if(Yx.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Wa:nf);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let m=iR(u),d=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function iR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function sf(e){return of(e).childStart}var sR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ei="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ga(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Fa(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function lf(e,t,n,r,o=!1,i){let a=(Bn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?C("shell.dynamic-executable",sR):null;return P(a,i)??cf(e,t,n,o,i)}function cf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ga(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=an(e,t),l=lR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(C("shell.dynamic-structure",ei),o);if(P(Uo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&gn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return P(C("shell.dynamic-structure",ei),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&cR(t)?P(C("shell.dynamic-structure",ei),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(C("shell.dynamic-structure",ei),o):null}if(s==="xargs")return af(e,t.slice($t(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return af(e,t.slice(sf(t.map(w))),"parallel",n,r,o);return null}function af(e,t,n,r,o,i){if(t.length===0)return null;let s=aR(t,r);if(Bn(e,s)){let l=P(C(`${n}.shell-dynamic`,n==="xargs"?Da:yr),i);if(l)return l}let a=cf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ga(l)&&Fa(l)))return P(C(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ma:hr),i);return null}function aR(e,t){let n=kt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function lR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Se.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function cR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ga(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Fa(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Fa(s)))return!0;continue}if(t=!0,a)return!0;let l=yt(s.text);if(l>0){n=l;continue}if(nt(s.text))o=!0,r=!0}return!1}function za(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!uo(t[n.tokenIndex],n.value)})}var uR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",dR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",mR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function uf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return C("dd.device-write",uR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return C("mkfs.device",dR);if(e==="shred"&&n.length>0)return C("shred.target",mR);return null}var mf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Uo(e.words,Ba(e))},{heads:new Set(["find"]),analyze:(e)=>Yd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:ht(e.envAssignments,e.options.environment),trustedTmpdirValue:Nt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Dm(e.words,{...df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Ym(e.words,{...df(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ut(e.options.analyzeNested(t,n))})}];function df(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ut(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ba(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function hf(e){return mf.find((t)=>t.heads.has(e))?.analyze}function Cn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((I)=>o==="posix"?w(I):I.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=Co(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=kt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),I=Ae(R);if(I)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:I.reason}),de(I);if(n.strict)return ye(r);let L=So(p,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let g=f.rewritten?K(i(f.words)):an(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let S=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if(Ft(E))throw new D("wrapperPeelIterations");let v=O(E),T=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,q=s?s.allowTmpdirVar:!or(S,n.environment),Z=lf(o,f.words,n.environment,t===0,n.strict,n.policy);if(Z)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Z.reason}),de(Z);let ee=Wo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){ff(y.wrapperNormalizationBudget);let I=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(I)});let L=Cn(I,t,{...y,effectiveCwd:A,envAssignments:S});if(L)return L}return null}let X=l?void 0:v==="eval"?Vo(g):v==="trap"&&!a?Am(g):void 0;if(a&&s&&v==="eval"){if(X?.kind==="dynamic")return bn(s,n.policy);if(X?.kind==="literal"){let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S});if(R)return R}return Sn(s,n.policy)}if(X?.kind==="dynamic"&&(n.strict||!n.commandView||!ka(n.commandView)))return ye(r);if(X?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:X.source,depth:t+1});let R=n.analyzeNested(X.source,{effectiveCwd:A,envAssignments:S,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?J.has(v):bf(E,v)){if(it(h))return null;if(a&&s){let R=ot(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=bn(s,n.policy);if(L)return L}if(gr(R)){let L=bn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:S})}let I=rt(g);if(I.kind==="dynamic")return bn(s,n.policy);if(I.kind==="literal")return s.dynamicSourceInput?bn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?bn(s,n.policy):null}if(l){let R=ot(h),I=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:S}):rt(g).kind==="dynamic"?ye(r):null;if(I)return I}if(s===void 0){let R=hR(h,S,A,n,r,t);if(R)return R;let I=ot(h);if(I){let qt=Ko(g,I);if(qt.kind==="dynamic")return ye(r);let yi=qt.kind==="literal"?qt.source:I,gl=yR(yi);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:gl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:gl,depth:t+1});let hl=n.analyzeNested(yi,{effectiveCwd:A,envAssignments:S});if(hl)return hl;return gr(yi)?ye(r):null}let L=rt(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ti(L.source,A,S,n,r,t);let te=Pm(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:S})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let I=R===null?1:3,L=h[I]==="--"?I+1:I,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ti(te.text,A,S,n,r,t);if(n.strict||!n.commandView||!ka(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&za(cr(h),g))return ye(r);let R=Hd(h,(L)=>Ut(n.analyzeNested(L,{effectiveCwd:A,envAssignments:S}))),I=P(R,n.policy);if(I)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:I.reason}),de(I)}if(Me(v)&&!l){if(!s&&n.strict&&za(go(h),g))return ye(r);let R=$u(h);if(a&&s)return pR(v,R,A,S,n,s);if(R){let I=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:I}),I){let te=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(te)return de(te)}if(js(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:S});if(L&&!yf(L,R))return L;if(Zn(R,void 0,!n.strict)){let te=P(C("interpreter.dangerous-command",un),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:un}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return ff(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Cn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:S});let N=s?null:P(uf(v,h),n.policy);if(N)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:N.reason}),de(N);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:S,allowTmpdirVar:q,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,I)=>a&&s?$a(R,t,ue,{...s,cwd:I??void 0,effectiveCwd:I??void 0}):Ut(Cn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:I,envAssignments:S}))??tt(R,ue.policy.rules),analyzeChild:(R,I)=>$a(R,t,ue,I)},qe=s&&(v==="xargs"||v==="parallel")?void 0:hf(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:S.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?Cm(_e.words,Ba(_e)):void 0,gi=pf(ke?ke.match:qe?.(_e)??null,n.policy);if(r)bR(_e,gi,ke?.relaxation??null);if(gi)return de(gi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Sn(s,n.policy):null)??gR(s,n.policy)}let pl=!s&&qe===void 0&&!Wr.has(v),hi=r&&pl?[]:void 0;if(pl)for(let R=1;R<h.length;R++){let I=h[R];if(!I)continue;hi?.push(I);let L=pf(fR(h,R,t,ue,T,x,A,S),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[],embeddedCommandFound:O(I)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:hi??[]}),l&&s&&!s.wrappedByTransparent)return null;let _r=tt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!_r,reason:_r?.reason}),_r)return de(_r);return a&&s?Sn(s,n.policy):null}function $a(e,t,n,r){return Ut(Cn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function fR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(bf(c,u)||hf(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=$a(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!or(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function pR(e,t,n,r,o,i){if(!t)return Sn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(C("interpreter.one-liner-paranoid",Yn),o.policy);if(a)return de(a)}if(js(e,t))return Sn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!yf(s,t))return s;if(Zn(t,void 0,!o.strict)){let a=P(C("interpreter.dangerous-command",un),o.policy);if(a)return de(a)}return Sn(i,o.policy)}function yf(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Do)||e.reason===pn)&&!Fr(t)}function bn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function Sn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function gR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function hR(e,t,n,r,o,i){let s=km(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ti(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ti(a,n,t,r,o,i,!0)}function ti(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=qn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function yR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function bR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function ff(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:ar}),de(CR())}function CR(){return{id:"",reason:ar,intent:"stop_and_explain"}}function bf(e,t){return J.has(t)||e==="$SHELL"||e==="${SHELL}"||J.has(k(t))}function pf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var SR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,vR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function ER(e,t){let n=vf(e,t);if(n.length===0)return!1;let r=n[Sf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return SR.test(e.join(" "))}function Cf(e,t,n,r,o){if(e.dialect==="powershell"){let h=RR(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return gf(PR(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!ER(i,n))return s?null:void 0;if(!t)return null;let a=vf(i,n,t),l=Sf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let p=f[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?xR(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return gf(g,t,n.paths)}function xR(e,t){let n=mr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function gf(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return ft(t,e,n)}catch{return null}}function RR(e,t){let n=_R(e[0])?1:0,r=e[n];if(!wR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!vR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return AR(e.slice(n+1),t)}function _R(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function wR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function AR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function PR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Sf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function vf(e,t,n){let r=TR(e);return pt([...r],t,n)}function TR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var IR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Ht="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ka(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:He}),{reason:He,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Va(e,n);let u=`${Do}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Af(e,n),{reason:pn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Af(e,n),{reason:pn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Va(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=am(n.environment.env,n.envAssignments);return oi(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function oi(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],m=u?.kind==="connector"?u.operator:void 0,d=kR(e,l,c,a,m),f=a==="&&"||a==="||",p=f?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],S=f||En(m);if(c.kind==="function"){let Z=g.flatMap((X)=>{let U=xn(X);return U.functionDefinitions.set(c.name,c.body),Ua(X,[U],d,m==="&",En(m))}),ee=Ha(Z,[],h,y,a,m);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let Z=[],ee=[];for(let U of g){let N=oi(c.body,t,n,r,[xn(U)]);if(N.result)return N;if(Z.push(...Ua(U,N.states,d,m==="&",En(m))),S)ee.push(U,...d?N.states.map((ue)=>ni(U,ue)):N.states)}let X=Ha(Z,ee,h,y,a,m);i=X.states,s=X.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=ii(a)&&v?.kind==="command"?wm(v)??MR(v):void 0,x=[],A=[];for(let Z of g){let ee=DR(c,t,n,r,[xn(Z)]);if(ee.result)return{result:ee.result,states:i};let X=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ni(Z,U));for(let U of X){let N=xn(U),ue=WR(c,t,n.trace?{...n,trace:Pf(n.trace,E)}:n,r,N,ii(a),T);if(ue)return{result:ue,states:i};let _e=QR(c,N.functionDefinitions);if(_e)n.budget.charge("derivedTokens",si(_e));let qe=_e?t+1>=V.recursionDepth.cap?ja(c.displayText,n,[N]):oi(_e,t+1,n,r,[N]):{result:null,states:XR(c,N)};if(qe.result)return qe;if(x.push(...Ua(Z,qe.states,d,m==="&",En(m))),S)A.push(Z),A.push(...qe.states.map((ke)=>d?ni(Z,ke):ke))}}let q=Ha(x,A,h,y,a,m);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function kR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(ii(r)||ii(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&OR(e,t)}function Ua(e,t,n,r,o){let i=n?t.map((a)=>ni(e,a)):[...t],s=o?i.flatMap((a)=>vn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ni(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function OR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(NR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function ii(e){return e==="|"||e==="|&"}function MR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function En(e){return e==="&&"||e==="||"}function Ha(e,t,n,r,o,i){let s={success:ri([...n,...e]),failure:ri([...r,...t])},a=En(i)?s:void 0;return{states:En(o)||a?ri([...s.success,...s.failure]):s.success,conditionalStates:a}}function Pf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function DR(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=LR(e);if(s){if(t+1>=V.recursionDepth.cap)return ja(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return ja(s,n,o);if(a.status!=="complete")return Ef(i,n,r,o);n.budget.charge("derivedTokens",si(a)),i.push({program:a,depth:t+1})}}return Ef(i,n,r,o)}function NR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Ef(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=oi(i.program,i.depth,t,n,[xn(a)]);if(l.result)return l;s.push(...l.states)}o=ri(s)}return{result:null,states:o}}function LR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function si(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+si(o),0):n.kind==="group"||n.kind==="function"?si(n.body):0),0)}function ja(e,t,n){return t.trace?.recordSegment({type:"error",message:He}),{result:{reason:He,segment:e,intent:"stop_and_explain"},states:[...n]}}function WR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=HR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Tf(e,o,"before-consumer",a.environment.paths,a.budget);let c=an(e.dialect,e.words),u=c.map(w),m=e.displayText,d=sm(c,o.shellGitContextState),f=cm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Ld(e,i,t_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return e_(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!Bn(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Fu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let S=xf(e,l,o,f,s,a);if(S)return S;return _a(d,o.shellGitContextState),null}let p=Cn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let S=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Ka(h,t+1,{...a,effectiveCwd:S,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Pf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:m};let g=xf(e,l,o,f,s,a);if(g)return g;return _a(d,o.shellGitContextState),null}function xf(e,t,n,r,o,i){let s=jR(e,t,n,r??new Map,i);if(s)return s;return Tf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),zR(e,t,n,i.environment.paths,i.budget),qR(e,n,o,i.environment,i.trace),null}var FR=new Set([">>","<>"]);function Tf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?GR(s):FR.has(s.operator)))continue;Rf(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=If(e.words.slice(1));if(!i)return;for(let s of i.operands)Rf(s,t,r,o)}function GR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Rf(e,t,n,r){let o=e?.provenance==="literal"?qn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function zR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of BR(e)){let a=qn(s.text,n.effectiveCwd,r,o);if(!a||!Bu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function BR(e){let t=UR(e.redirections)?.target,n=_f(t)?[t]:[];if(le(e.words[0],"cat"))return $R(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=If(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(_f))return[];return[...r.operands,...n]}function $R(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function UR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function If(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function _f(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function qa(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function HR(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Ht;let r=n[0];if(!r?.heredoc)return Ht;if(!qa(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return IR;if(r.fd!==void 0&&r.fd!==0)return Ht;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return Ht;let o=e.redirections.some((a)=>a!==r&&wf(a.target));if(le(e.words[0],"cat"))return o?Ht:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(wf)?Ht:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return Ht}function wf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function jR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(KR(e,i,n,r,o))return null;let a=VR(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Va(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function VR(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!qa(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>le(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=P(C("interpreter.one-liner-paranoid",Yn),n.policy);if(m)return m}if(!Zn(l,void 0,!n.strict))return null;let u=P(C("interpreter.dangerous-command",un),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function KR(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!qa(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=kt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!J.has(l)&&!J.has(k(l)))return!1;return it(a)}function qR(e,t,n,r,o){let i=Cf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var YR=/^[A-Za-z_][A-Za-z0-9_]*$/,ZR=8;function XR(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!YR.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=ZR&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=xn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function xn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:lm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function ri(e){let t=[];for(let n of e){if(!t.some((r)=>JR(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function JR(e,t){return e.effectiveCwd===t.effectiveCwd&&vn(e.shellGitContextState.env,t.shellGitContextState.env)&&vn(e.literalHeredocFiles,t.literalHeredocFiles)&&vn(e.functionDefinitions,t.functionDefinitions)&&vn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&vn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function vn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function QR(e,t){let n=$n(e);return n===void 0?void 0:t.get(n)}function e_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function t_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Va(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Af(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:pn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var n_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function kf(e,t,n,r){let o=Ka(e,0,{...t,...su(t),budget:t.budget??be(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Of(e,t,n){try{return{decision:e()}}catch(r){let o=r_(r,t,n);if(!o)throw r;return o}}function r_(e,t,n){if(!(e instanceof D)||!n_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var o_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Za=new Set(["cc-safety-net","ccsn"]),i_=new Set(["bunx","npx","pnpx"]),s_=new Set(["pnpm","yarn"]),a_=new Set(["npm","pnpm","yarn"]),l_=new Set(["bun","node"]);function li(e,t,n={}){if(Za.has(e))return 0;if(i_.has(e)){if(n.broad)return Ya(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return ai(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&a_.has(e)&&n.broad&&t[r]==="exec"){let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(s_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&ai(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(l_.has(e)){let o=n.broad&&r!==-1?r:0;if(Mf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Mf(t[o+1]))return o+2}return null}function Ya(e){let t=e.findIndex((r)=>ai(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!ai(r))break;n++}return n}function ai(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Za.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Za.has(e.slice(0,t))}function Mf(e){let t=e?.replaceAll("\\","/");return[...o_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Df="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Nf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=mn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>c_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function c_(e,t){let n=pt([...e],t),r=n.slice(1),o=li(k(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ci}from"path";var Gf="This path contains the protected policy config and you must not modify or delete it.",u_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function zf(e,t,n){let r=h_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Lf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Wf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Wf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Lf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Ar(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Lf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>br(a,n,r,o,i));return s?{target:s}:null}function Wf(e,t,n,r,o){let i=mn(e,t,r,o,{findSegmentTarget:(s,a)=>d_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>br(s,a.cwd,n,r,o),findMalformedTarget:(s)=>g_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function d_(e,t,n,r,o){if(tr(e))return null;let i=Ot([...e],r),s=k(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&m_(a)){let l=f_(a).find((c)=>Ff(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(zo(i,1)||ya(i,r)){let c=(Go(K(i))??K(["."])).find((u)=>{let m=pe(u.text,t.variables);return br(m,t.cwd,n,r,o)||Ff(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=wo(a).sources.find((c)=>y_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(p_(i,s))return null;for(let l of[...e,...i])for(let c of Bf(l))if(br(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function m_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function f_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function p_(e,t){if(!u_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function g_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Bf(i))if(br(s,t,n,r,o))return{target:s};return null}function Bf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function h_(e,t,n){let r=(a)=>Cr(se(a,e.executionCwd,t,n)),o=r(en(t)),i=[r(Ln(e.executionCwd)),r(Ln(e.configCwd))],s=new Set(i.map((a)=>ci(a)));for(let a=ci(o);;a=ci(a))if(s.add(a),ci(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function br(e,t,n,r,o){let i=Gl(e,t,r,o,(s)=>Cr(s)===Nr);return i!==null&&n.files.has(Cr(i))}function Ff(e,t,n,r,o){return n.directoriesAndAncestors.has(Cr(se(e,t,r,o)))}function y_(e,t,n,r,o){let i=Cr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Cr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as ui,posix as Qf,resolve as mi,win32 as b_}from"path";import{fileURLToPath as C_}from"url";var ep="Access to a sensitive path is not allowed.",tp=new Set(["echo","printf"]),S_=new Set(["find"]),v_=new Set(["!","do","elif","else","if","then","until","while"]),E_=new Set(["-exec","-execdir"]),x_=new Set([";","+"]),R_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),__=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),np=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),w_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),A_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),rp=new Set(["-c","-e","-r","-E","--eval","--exec"]),P_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),T_=new Set(["grep","rg"]),I_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),k_=new Set(["commit","merge","notes","stash","tag"]),O_=new Set(["-m","--message"]),M_=new Set(["--grep"]),$f=new Set(["jq","gojq","jaq"]),Uf="f",Hf="file",D_="files",N_=new Set(["e","f"]),L_=new Set(["regexp","file"]),W_=new Set(["e","f","A","B","C","m"]),F_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Xa="__CC_SAFETY_NET_PIPE_INPUT__",Qa=/[\w./~@+-]*[./~][\w./~@+-]*/g,G_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,z_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,B_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,jf=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,Vf=/\b(?:system|exec|spawn|popen)\s*$/,$_=/\b(?:eval|exec)\s*\(/g,U_=/\b(?:eval|exec)\s*$/,H_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Kf(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Bw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Gw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(up(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!tl(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!tl(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&$w(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function op(e,t,n,r,o={}){let i=qf(e,n,r),s=Kf(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Kf(i,t,e.invocation.context.configCwd,n,r,new Set(qf(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&j_(e,n)?null:a}function j_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of _o(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(et(s.text,t))}let o=at(r);if(o.length===0)return!1;let i=Ue(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return nl(i,o.slice(1))}function nl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>R_.has(n))}function qf(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?Rn(s.shell,e.store,r,t,o,n,V_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function V_(e){return e.program.dialect==="powershell"}function Rn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Ew(et(e.source,r),t,n,r,o,i)],l=(c)=>et(rw(c,s),r);return Ro(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...fi(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...q_(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...ip(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>Y_(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return ea;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function rl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?Rn(s,t,n,r,o,i):null}function fi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if($f.has(Ue(at(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...fi(g,t,n,r,o,i)]}let l=nw(e).map(a),c=at(e);if(c.length===0)return l;let u=c[0]??"",m=Ue(u).toLowerCase(),d=c.slice(1),f=c.findIndex((g)=>!v_.has(g));if(n.standard===!0&&f!==-1&&nl(Ue(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let p=K_(u,m,d);if(p)return[...l,...p.map(a)];if(tp.has(m))return n.capturedOutput===!0?[...l,...sp(e).map(a)]:l;if(m==="eval")return[...l,...rl(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ke(m,g)).map(a)];if(m==="git")return[...l,...iw(d).map(a)];if(m==="gh")return[...l,...el(m,d,I_).map(a)];if($f.has(m))return[...l,...ow(d).map(a)];if(T_.has(m))return[...l,...Iw(d).map(a)];if(S_.has(m))return[...l,...cw(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((g)=>Ke("awk",g)).map(a),...d.flatMap((g)=>dw(g,t,n,r,o,i)),...d.flatMap(mw).map(a)];if(m==="curl")return[...l,...d.flatMap((g)=>Ke(m,g)).map(a),...sw(d).map(a)];if(nr(m)){let g=er.has(m)?ve([m,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...Rn(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...uw(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ke(m,g)).map(a)]}function K_(e,t,n){let r=li(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function q_(e,t,n,r,o,i,s){if(Q_(t,n,r,o,i,s)){let a=at(e),l=nl(Ue(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...sp(e),...l].map((c)=>({target:c,cwd:i}))}return ip(t,Z_(e),n,r,o,i,s,()=>[])}function Y_(e,t,n,r,o,i,s){let a=at(e);if(!nr(Ue(a[0]??"").toLowerCase()))return[];return rl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function ip(e,t,n,r,o,i,s,a){let l=ew(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>er.has(l)?Rn(n.getShellSyntax(c),n,r,o,i,s):di(l,c,n,r,o,i,s))}function sp(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase();if(!tp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ol(r.replaceAll("%%","%"))];return t.slice(1)}function Z_(e){let t=at(e);if(t.length===0)return[];let n=Ue(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return X_(r);return[]}function X_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ol(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>J_(t,r.slice(i*n,(i+1)*n)))}function J_(e,t){let n=0;return ol(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ol(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Q_(e,t,n,r,o,i){let s=at(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=$t(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Xa]:l.map((m)=>m.split(c).join(Xa));return fi(u,t,n,r,o,i).some((m)=>m.target.includes(Xa))}function ew(e){let t=at(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!nr(n))return null;return tw(n,t.slice(1))?n:null}function tw(e,t){let n=il(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(rp.has(o)||ap(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(H_.get(n)?.has(o))r++;continue}return!1}return!0}function il(e){return/^python\d/.test(e)?"python":e}function nw(e){let t=[];for(let n of e){if(cp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Yf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function rw(e,t){if(!t||!Yf.test(e))return e;return`~${e.replace(Yf,"").replace(/\\/g,"/")}`}function Ke(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ke("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ke("jq",r))}function iw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...k_.has(r)?el("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),O_):el("git",e.slice(n),M_)];if(t.push(...Ke("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ke("git",o)),n++}return t}function el(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ke(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ke(e,i))}return r}function sw(e){return e.flatMap((t,n)=>{let r=lw(t);if(r!==null)return Zf(r.flag,r.value);let o=aw(e[n-1]);return o===null?[]:Zf(o,t)})}function Zf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ja(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ja(t.slice(n+1))}return t.startsWith("@")?Ja(t.slice(1)):[]}function aw(e){if(e===void 0)return null;if(np.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return np.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ja(e){return e===""||e==="-"?[]:[e]}function cw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!E_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>x_.has(f)),m=u===-1?c:c.slice(0,u),d=fi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!__.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(rp.has(c)||ap(e,c)){let m=t[l+1];if(m!==void 0)a.push(...di(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...di(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ap(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return P_.get(t[t.length-1]??"")?.has(il(e))??!1}function dw(e,t,n,r,o,i){if(!e.includes("system"))return[];return fa(e)?.commands.flatMap((s)=>Rn(t.getShellSyntax(s),t,n,r,o,i))??[]}function mw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(sl),...e.match(Qa)??[]]}function di(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=gw(t,pw(e));if(l===null)return fw(t).map(a);let c=l.masked.match(jf)!==null||l.literals.some((g)=>Vf.test(l.masked.slice(0,g.start))),u=l.masked.match($_)!==null||l.literals.some((g)=>U_.test(l.masked.slice(0,g.start))),m=r.standard===!0&&!er.has(e),d=m&&!(Cw(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(jf),(g)=>{let h=g.index+g[0].length;return{start:h,end:Ks(l.masked,h)}}):[],p=!m||f.some((g)=>qs(l.masked,g.start))?l.literals:l.literals.filter((g)=>Vf.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>sl(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(Qa)??[]).map(a),...c?p.flatMap((g)=>rl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>di(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
-`:y),n,r,o,i,s)):[],...(l.masked.match(Qa)??[]).map(a)]}function pw(e){let t=il(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function gw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(z_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&bw(e,o))return null;let a=t==="python"?hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=yw(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&B_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function hw(e,t){return G_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function yw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function bw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Cw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(w_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>A_.has(i)))continue;if(o.length>1)return!0;if(Sw(e,r)===".")return!0;if(vw(e,r+n.length)==="(")return!0}return!1}function Sw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function vw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t,n,r,o,i){return Aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Rn(a,t,{...n,capturedOutput:!0},r,o,i),...xw(a,r)?Rw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function xw(e,t){let n=_o(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(et(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=et(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Rw(e,t){return _o(e).flatMap((n)=>n.kind==="word"?[et(n.text,t)]:n.kind==="redirection"&&n.target?[et(n.target,t)]:[]).flatMap(sl)}function sl(e){let t=ww(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||_w(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function _w(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function ww(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(lp(e,r,n)){let i=Pw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Pw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(lp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function lp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===D_)o=!0;if(L_.has(m))r=!0;if(d!==void 0){if(m===Hf)t.push(d);continue}if(F_.has(m)){let f=e[l+1];if(m===Hf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(N_.has(h))r=!0;if(W_.has(h)){d=h,f=m.slice(g+1);break}}if(d==="")continue;if(f.length>0){if(d===Uf)t.push(f);continue}let p=e[l+1];if(d===Uf&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function at(e){let t=e.findIndex((n)=>!cp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function cp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var kw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Ow=".env.",Mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Dw=[".env.example.",".env.sample."];function Nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Lw(e){return e.length>0&&!/\s/.test(e)}function tl(e,t,n,r){let o=up(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function up(e,t,n,r){try{return Er(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var Ww=new Set(["node_modules","__pycache__"]),Fw=[["vendor","bundle"],["vendor","cache"]];function Gw(e,t,n,r,o){if(Nw(e))return null;let i=Ve(e,t,r,o);if(!i)return null;let s=G(i.split("/").pop()??""),a=G(i),l=()=>Lw(s)||tl(e,t,r,o);if(Mw.has(s)||Dw.some((d)=>s.startsWith(d)))return null;let c=G(jw(e,t,r,o));for(let d of ls){let f=`~/${d.suffixParts.join("/")}`;if((Jf(a,f)||Jf(c,f))&&st(d.id,n))return d.id}let u=zw(i,t,n,r,o);if(u)return u;if(kw.has(s))return null;for(let d of as)if(s===d.basename&&st(d.id,n))return d.id;if(s.startsWith(Ow)&&st($r.id,n)&&l())return $r.id;for(let d of cs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&st(d.id,n)&&l())return d.id}for(let d of us)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&st(d.id,n))return d.id}if(Uw(a))return null;if(!s.includes(".")&&Fn.pattern.test(s)&&st(Fn.id,n))return Fn.id;let m=Hw(s,n);if(m)return m;return null}function zw(e,t,n,r,o){return Ur.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=G(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ve("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Sr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=G(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=G(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ve(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Sr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Sr(e,s,["credentials"])||Sr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=G(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=G(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>vr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(G(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ve(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ve("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Sr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ve("~",t,r,o),".config","amp")],l=G(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ve("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||G(e).split("/").at(-1)==="mcp-auth.json"&&jt(G(e),G(a))}case"secret.cli.cursor.config":{let s=G(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=G(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ve("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Xf=new WeakMap;function B(e,t,n,r,o){let i=Xf.get(o)??new Map;Xf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ve(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>dp(e,ce(t,r)))}function Sr(e,t,n){return n.some((r)=>jt(G(e),G(ce(t,r))))}function vr(e,t,n,r,o){return dp(e,Ve(t,n,r,o))}function dp(e,t){return G(e)===G(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function Bw(e,t,n,r,o,i){if(n.length===0)return!1;let s=G(Er(e,t,o,i));return n.some((a)=>jt(s,G(Er(a,r,o,i))))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=G(Er(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(z(Ce(a),o.paths,i)):"",c=G(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=G(u?$e(z(mi(Ce(u)),o.paths,i)):l&&$e(z(`${l}/.cc-safety-net`,o.paths,i)));if(m&&jt(s,m))return!1;return n.some((d)=>{let f=gs(d);if(f&&Qf.basename(s)!==G(f.name))return!1;let p=G(Er(f?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return jt(s,p)&&!(f&&s===p)})}function Uw(e){let t=e.split("/");return t.some((n)=>Ww.has(n))||Fw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Hw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ds)if(r===o.extension&&st(o.id,t))return o.id;for(let o of ms)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function G(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function Ve(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";if(!o)return i;let s=ll(i,o),a=ui(s)?s:$e(mi(t,s)),l=$e(z(a,n.paths,r));if(!jt(l,o)){if(ui(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Jf(e,t){return e===t||e.startsWith(`${t}/`)}function jw(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i||!o)return"";let s=ll(i,o),a=Qf.normalize(ui(s)?s:$e(mi(t,s))),l=$e(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&jt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Er(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";let s=o?ll(i,o):i;return $e(z(ui(s)?s:mi(t,s),n.paths,r))}function al(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(z(Ce(r),t.paths,n)):"",i=$e(Ce(Vw(et(e,t))));return{home:o,normalized:i}}function Vw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return C_(e)}catch{return e}}function ll(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function Kw(e){if(process.platform==="win32")return!0;return b_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&Kw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Vt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var qw={findPolicyMutation:zf,findGitMetadataMutation:bd,resolveGitMetadata:Yw,loadPolicySnapshot:iu,findSensitiveTarget:op,analyzeCommand:kf,getModes:Li};function mp(e,t){let n={...qw,...t.dependencies},r=Jw(e),o=xr(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(xr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Wd,intent:"stop_and_explain"}};let l=be(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Gf,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=vt("policy-protection",o,()=>Nf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Df,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Zw(f)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:xr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:ep,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!xr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...cl("command-validation",o),...h};let S=vt("command-analysis",o,()=>Of(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Xw(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===ar&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function Yw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Zw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Xw(e){return ge(e,"declared-command")?.program}function Jw(e){try{return In(e.input)}catch(t){let n=xr(e)?e.command:void 0;throw new Vt("policy-protection",cl("policy-protection",t instanceof Ye?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Vt(e,cl(e,r instanceof Ye?void 0:t,r),r)}}function cl(e,t,n){let r=n instanceof D||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ci:wn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function xr(e){return e.route.kind==="command"}import{appendFileSync as dA,mkdirSync as mA}from"fs";import{isAbsolute as fA,join as ml}from"path";import{lstatSync as pp,readdirSync as Qw,readFileSync as eA,rmdirSync as tA,statSync as gp,unlinkSync as nA,utimesSync as rA,writeFileSync as oA}from"fs";import{join as Rr}from"path";function fp(e,t={}){return Jr(en(e,t),e.home).policy.audit.retention_days}var dl=86400000,iA=".last-prune",sA=/^\d{4}-\d{2}$/,aA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,hp=(e)=>Math.floor(e/dl);function bp(e,t,n=()=>new Date){try{let r=n().getTime();if(!gp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,iA),i=gp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&hp(i)===hp(r))return;let s=r-fp(e)*dl,a=new Date(r).toISOString().slice(0,7);for(let l of ul(t)){if(l.isDirectory()){lA(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))cA(Rr(t,l.name),s)}oA(o,"",{mode:384}),rA(o,r/1000,r/1000)}catch{}}function lA(e,t,n){for(let r of ul(e)){if(!r.isDirectory()||!sA.test(r.name))continue;let o=Rr(e,r.name);for(let i of ul(o)){if(!i.isFile())continue;let s=aA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+dl;if(!Number.isFinite(a)||a>=t)continue;Cp(Rr(o,i.name))}if(r.name!==n)yp(o)}yp(e)}function cA(e,t){try{let n=pp(e);if(n.mtimeMs>=t)return;let r=eA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(uA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(pp(e).mtimeMs!==n.mtimeMs)return;Cp(e)}catch{}}function uA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ul(e){try{return Qw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Cp(e){try{nA(e)}catch{}}function yp(e){try{tA(e)}catch{}}var pA="2.4.10",gA=1e4,hA=2000,yA=256,bA=32768;function CA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function SA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function fl(e,t,n,r,o,i,s={}){let a=CA(t);if(!a)return;let l=EA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=pi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:gA),m=pi(lt(r),hA),d=s.toolName?pi(lt(s.toolName),yA):void 0,f=i===null?void 0:pi(lt(i),bA),p=ml(l,SA(f?.value??null),c.slice(0,7));mA(p,{recursive:!0,mode:448});let g=ml(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Fi)(),v:pA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};dA(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),bp(e,l,s.now)}catch{}}function pi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function vA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&fA(n)?n:null}function EA(e){let t=vA(e);return t?ml(t,".cc-safety-net","logs"):null}function vp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Sp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Sp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Sp(e){return"command"in e?e.command??"":""}function Ep(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;fl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function xp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;fl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function _p(e,t,n){try{let r=mp(t,{environment:e,...n.guard});return Rp(e,t,r,n),r}catch(r){if(!(r instanceof Vt))throw r;throw Rp(e,t,r.evaluation,n,!(r.cause instanceof Ye),{stage:r.stage,errorCode:xA(r.cause)}),r}}function Rp(e,t,n,r,o=!0,i){Ep(e,vp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function xA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Ye)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function Kt(e,t={}){return{malformed:!0,denial:An(t),cwd:e}}function wp(e,t={}){return(n,r)=>{try{return RA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(An())}}}function RA(e,t,n,r){let o=Zl();if(n.cancelled?.(t))return n.block(An());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return xp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=yl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=_p(o,i,{guard:{auditAllowed:Xl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Vt))throw l;if(xt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Cl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var _A={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>AA(e,t,n),getSessionId:(e)=>IA(e),allow:{action:"allow"},block:(e)=>kA(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},Ap=wA();function wA(e={}){return wp(_A,e)}function AA(e,t,n){if(!e||typeof e!=="object")return Kt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Kt(null);if(!r.input||typeof r.input!=="object")return Kt(null,{toolName:r.tool});let o=PA(t,n);if(!o)return Kt(null,{toolName:r.tool});let i=TA(t,e);if(!i.ok)return Kt(o,{toolName:r.tool});if(!i.command)return Yt(r.tool,r.input,{kind:xi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Kt(o,{toolName:r.tool});let s=typeof i.command.dir==="string"?Ul(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return Yt(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function PA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return $l(".",[r],t)}catch{return}}function TA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function IA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function kA(e){return{action:"reject-and-continue",message:bl(e)}}function OA(e){e.on("tool.call",(t)=>Ap(t,e))}export{OA as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function vr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function Rn(e){return e?w(e):""}function zm(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Wa(e,t){return Na(De(e,"posix"),t)}function Er(e){return Wa(e,new Set(Array.from(e.matchAll(Mm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Na(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Na(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Na(o,n))||Bm(r.words,n))return!0;Jx(r,n)}return!1}function Bm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Sr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Om(e[s],t)}if(q.has(o)){let s=e.slice(n),a=Ee(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Om(s[l],t)}let i=qx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Bm(e.slice(i),t)}function qx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Yx(e,t+1);if(r==="exec")return Zx(e,t+1);if(r==="env")return Xx(e,t+1,n);return null}function Yx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Zx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Xx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Sr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Sr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Jx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(Sr(n,t))t.add(r.name)}}function Sr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Mm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Bx.test(o)||t.has(o))}))}function Om(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Sr(e,t))}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Fa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Qx="__CC_SAFETY_NET_XARGS_INPUT__",ti="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ni="rm",eR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,tR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,nR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,rR=/^(?:[0-9]+|[@*])$/;function Hm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Vt(n),i=n.slice(r),s=S("xargs.shell-dynamic",Fa);if(iR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=Zm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&qm(l,o),u=t.analyzeChild(l,{...Ut(a,t),dynamicInput:d,dynamicSourceInput:m||Vm(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Ga)});if(u)return u;let f=oR(l,o,t.policy?.rules??[],T(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,Qx]:l,h=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(p,{...Ut(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let g=it(l,t.policy?.rules??[]);if(g)return g}return null}function oR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function jm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Pm(e,r,t.length,n);return o===null?[]:[o]}function Vm(e,t,n,r,o,i,s){if(q.has(t)){if(st(e))return!1;if(n!==null&&sR(e,n,s))return!0;let a=$e(e);if(!a){let l=lt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Km(a,n,s))return!0;if(Ae(a))return!0;return aR(a,n,r)}if(Me(t))return $m(e,n,Ro,Yu(t));if(we.has(t))return $m(e,n,ya,Yd);if(t==="eval"){let a=Qo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return lR(e,n,i);if(t==="git"){let a=_e(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&Ym(a.rest,n).some((l)=>l.includes(n))}return!1}function Km(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function $m(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ti]).sources.some((a)=>a.value===ti);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ti}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ti}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>jm(l,t,a))));return Xo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function iR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,ni]:e.map((i,s)=>s===0?i:i.replaceAll(t,ni));return Array.from(ze(o,n)).some((i)=>i.head===ni&&!r.has(ni))}function qm(e,t){return Ym(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Ym(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Zm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function sR(e,t,n){let r=Ee(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Km(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return jm(a,t,s).some((d)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,d):f),u=Ee(m);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(m[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(m[u.scriptIndex]??"").includes(d)})}))}function aR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(eR))if(Um(o,r))return!0;for(let o of e.matchAll(tR))for(let i of(o[1]??"").matchAll(nR))if(Um(i,r))return!0;return Wa(e,r)}function Um(e,t){let n=e[1]??e[2];return n!==void 0&&(rR.test(n)||t.has(n))}function lR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=vn(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let d=Zm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&qm(c.tokens,t)||Vm(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=at(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Vt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var xr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Rr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",uR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",dR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",oi=/\{[^{}\s]*\}/g,Xm=/\{\}|\{-?\d+\}/g,mR=["e","f","source","file","-e","-f","--source","--file"],fR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],pR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),gR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Jm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),hR=new Set(["--workdir","--wd"]),Qm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function of(e){return Ie([...e],(t)=>Ae(t))}function sf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=_n(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=gf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let g=_n(t);if(g)return g;let p=of(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=ER(t);if(g)return g}if(d!==void 0&&a){let g=_n(t);if(g)return g}let u=xR(d,t.cwd,t.environment.paths);if(u===null){let g=_n(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...ze(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some($a)){let p=_n(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=uf(f.envAssignments,f.cwd,a);return Ie(g,(h)=>t.analyzeNested(h,p))}return Ie(ze(i,f),(g)=>yR(g,o,t,f))}function yR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(ff)){let h=_n(n);if(h)return h}let d=of(c);if(d)return d;let m=c.some(F),u=i||m,f=a&&u,g=uf(e.envAssignments,e.wrapperCwd,s||f);if(q.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(ri(l,E,n.budget),Ut(e,r)))};if(st(l))return h();let y=$e(l);if(y){if(pf(y)){let x=_t(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(nf(y,A,n.budget),g))}if(F(y)){if(o.length>0)return Ie(o,(Y)=>n.analyzeNested(nf(y,Y,n.budget),g));let x=Cr(y);if(x?.[0]&&O(x[0])==="rm"&&Be(x)){let Y=tf(n);if(Y)return Y}let A=x?n.analyzeChild(x,{...Ut(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",Rr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)}):null;if(A)return A;return n.analyzeNested(y,g)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>ei(K(x===void 0?l:i?l.map((A)=>df(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=_t(n);if(x)return x}let b=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(b.length>0)return n.budget.charge("derivedTokens",b.length),Ie(b,(x)=>n.analyzeNested(x,g));if(Er(y)){let x=_t(n);if(x)return x}let P=n.analyzeNested(y,g);if(P)return P;if(u)return _t(n);return null}let v=lt(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return _t(n)??h();if(v.kind==="literal")return h();if(o.length>0){let E=_t(n);if(E)return E;let b=h();if(b)return b;if(i)return null;let P=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",P.length),Ie(P,(x)=>n.analyzeNested(x,g))}if(u||a)return _t(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>za(ri(l,y,n.budget,Xm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>za(rf(l,y,n.budget),e.cwd,r));let h=za(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(Xm,"")]:[]}),e.cwd,r);if(h)return h;return tf(n)}let p=o.length>0?o:[void 0];return Ie(p,(h)=>{let y=h===void 0?l:i?ri(l,h,n.budget):rf(l,h,n.budget),v=S("parallel.shell-dynamic",Rr),E=a&&e.head==="find"?vR(y,r):null,b=lf(y,a,n)??E?.customResult??null,P=O(e.head),x=a&&(P==="rm"&&Ba(y)||P==="xargs"&&cf(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&af(y,P)),Y=n.analyzeChild(y,{...Ut(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:x,dynamicSourceInput:b!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)});if(A){let ke=T(v,n.policy);if(ke)return ke}return Y??b??it(y,n.policy?.rules??[])})}function af(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(q.has(t))return SR(e);if(t==="git")return bR(e);if(t==="find")return!0;if(we.has(t))return ef(e,mR,yr);if(Me(t))return ef(e,fR,xo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||pf(o)))}function bR(e){if(CR(e))return!0;let t=_e(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function CR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function SR(e){if(st(e))return!1;let t=$e(e);if(t!==null)return F(t);let n=lt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function ef(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Qm]).some((o)=>o.value===Qm);return Xo(r,t,(o)=>n(e.map((i)=>df(i,[o]))))}function lf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return _t(n);return Ie(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function vR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=af(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&cf(a.tokens),n.customResult??=lf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=F(a);continue}let l=at(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function cf(e){let t=e.slice(Vt(e).childStart);return O(t[0]??"")==="rm"&&Ba(t)}function ii(e,t){return(n)=>T(S(e,t),n.policy)}var _t=ii("parallel.shell-dynamic",Rr),ER=ii("parallel.command-stream-dynamic",uR),_n=ii("parallel.command-stream-dynamic",dR),tf=ii("parallel.rm-recursive-force-dynamic",xr);function za(e,t,n){return T(Jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:zt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function uf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function df(e,t){return e.replace(oi,(n)=>mf(n,t))}function ri(e,t,n,r=oi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=mf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function nf(e,t,n){return ri([e],t,n)[0]??""}function rf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function mf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(oi)!==-1}function ff(e){if($a(e))return!0;for(let t of e.matchAll(oi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function $a(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function pf(e){return/^\{[^{}\s]*\}$/.test(e)}function xR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!cR(e))return null;try{return yt(t??e,e,n)}catch{return null}}function gf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=Sa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=Sa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let p=e[t+1],h=g.indexOf("="),y=h===-1?g:g.slice(0,h),v=h===-1?void 0:g.slice(h+1);if(g==="--dry-run"){l=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){c||=(g==="-I"?p:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){c=!0,t+=2;continue}if(y==="--replace"||g.startsWith("-i")&&g.length>2){let E=y==="--replace"?v:g.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||gR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(g==="--pipe"||g==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Jm.has(y)||g.startsWith("-S")&&g.length>2){i=!0,t+=Jm.has(g)?2:1;continue}if(hR.has(y)){c=!0;let E=v??p;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&v!==void 0){t++;continue}if(pR.has(g)){if(p===void 0||p===":::"||p==="--"){c=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}c||=n.some(l?$a:ff);let d=[];if(o!==-1){let g=[];for(let p=o+1;p<e.length;p++){let h=e[p];if(h===":::"){d.push(g),g=[];continue}if(h!==void 0)g.push(h)}d.push(g)}c||=d.length>1;let m=RR(d),u=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function RR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function hf(e){return gf(e).childStart}var _R="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",si="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ha(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ua(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function bf(e,t,n,r,o=!1,i){let a=(Yn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",_R):null;return T(a,i)??Cf(e,t,n,o,i)}function Cf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ha(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=mn(e,t),l=AR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return T(S("shell.dynamic-structure",si),o);if(T(Zo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return T(S("shell.dynamic-structure",si),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&PR(t)?T(S("shell.dynamic-structure",si),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(S("shell.dynamic-structure",si),o):null}if(s==="xargs")return yf(e,t.slice(Vt(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return yf(e,t.slice(hf(t.map(w))),"parallel",n,r,o);return null}function yf(e,t,n,r,o,i){if(t.length===0)return null;let s=wR(t,r);if(Yn(e,s)){let l=T(S(`${n}.shell-dynamic`,n==="xargs"?Fa:Rr),i);if(l)return l}let a=Cf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ha(l)&&Ua(l)))return T(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:xr),i);return null}function wR(e,t){let n=Wt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function AR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function PR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ha(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ua(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ua(s)))return!0;continue}if(t=!0,a)return!0;let l=at(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function ja(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Co(t[n.tokenIndex],n.value)})}var TR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",IR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",kR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Sf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",TR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",IR);if(e==="shred"&&n.length>0)return S("shred.target",kR);return null}var Ef=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Zo(e.words,Va(e))},{heads:new Set(["find"]),analyze:(e)=>nm(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Hm(e.words,{...vf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>sf(e.words,{...vf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})}];function vf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Kt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Va(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function wf(e){return Ef.find((t)=>t.heads.has(e))?.analyze}function An(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?w(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=Ao(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Wt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let R=[...g,...i(f.words)].join(" "),k=Ae(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),ue(k);if(n.strict)return ye(r);let L=Po(g,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(te)return te}}let p=f.rewritten?K(i(f.words)):mn(o,f.words),h=i(p),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>p.length){let R=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-p.length),output:h})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if($t(E))throw new D("wrapperPeelIterations");let b=O(E),P=f.cwd===null?void 0:f.cwd??d,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,Y=s?s.allowTmpdirVar:!mr(v,n.environment),ke=bf(o,f.words,n.environment,t===0,n.strict,n.policy);if(ke)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:ke.reason}),ue(ke);let je=Ho(h,n.policy);if(je){for(let R of[je.childIndex,...je.alternativeChildIndices]){xf(y.wrapperNormalizationBudget);let k=p.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:je.wrapper,output:i(k)});let L=An(k,t,{...y,effectiveCwd:A,envAssignments:v});if(L)return L}return null}let de=l?void 0:b==="eval"?Qo(p):b==="trap"&&!a?Lm(p):void 0;if(a&&s&&b==="eval"){if(de?.kind==="dynamic")return wn(s,n.policy);if(de?.kind==="literal"){let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v});if(R)return R}return Pn(s,n.policy)}if(de?.kind==="dynamic"&&(n.strict||!n.commandView||!La(n.commandView)))return ye(r);if(de?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:de.source,depth:t+1});let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?q.has(b):Pf(E,b)){if(st(h))return null;if(a&&s){let R=$e(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=wn(s,n.policy);if(L)return L}if(Er(R)){let L=wn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:v})}let k=lt(p);if(k.kind==="dynamic")return wn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?wn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?wn(s,n.policy):null}if(l){let R=$e(h),k=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:v}):lt(p).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=NR(h,v,A,n,r,t);if(R)return R;let k=$e(h);if(k){let Qt=ei(p,k);if(Qt.kind==="dynamic")return ye(r);let Si=Qt.kind==="literal"?Qt.source:Wm(p,k),vl=LR(Si);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:vl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:vl,depth:t+1});let El=n.analyzeNested(Si,{effectiveCwd:A,envAssignments:v});if(El)return El;return Er(Si)?ye(r):null}let L=lt(p,n.strict?void 0:n.shellAssignments);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ai(L.source,A,v,n,r,t);let te=Gm(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let R=h[1]==="-p"?2:null;if(R!==null){let Qt=n.commandView?p[R]:void 0;if(!Qt)return null;if(Qt.provenance!=="literal")return ye(r)}let k=R===null?1:3,L=h[k]==="--"?k+1:k,te=n.commandView?p[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ai(te.text,A,v,n,r,t);if(n.strict||!n.commandView||!La(n.commandView))return ye(r)}if(we.has(b)&&!l){if(!s&&n.strict&&ja(yr(h),p))return ye(r);let R=Zd(h,(L)=>Kt(n.analyzeNested(L,{effectiveCwd:A,envAssignments:v}))),k=T(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),ue(k)}if(Me(b)&&!l){if(!s&&n.strict&&ja(xo(h),p))return ye(r);let R=qu(h);if(a&&s)return MR(b,R,A,v,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:R,paranoidBlocked:k}),k){let te=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(te)return ue(te)}if(Ys(b,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:v});if(L&&!Af(L,R))return L;if(or(R,void 0,!n.strict)){let te=T(S("interpreter.dangerous-command",gn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:gn}),ue(te)}r=void 0}}if(b==="busybox"&&h.length>1)return xf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),An(p.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let G=s?null:T(Sf(b,h),n.policy);if(G)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:G.reason}),ue(G);let J=r===y.trace?y:{...y,trace:r},X={words:p,head:b,cwd:P,originalCwd:x,envAssignments:v,allowTmpdirVar:Y,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:J,analyzeChildTokens:(R,k)=>a&&s?Ka(R,t,J,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Kt(An(K(R),t+1,{...J,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??it(R,J.policy.rules),analyzeChild:(R,k)=>Ka(R,t,J,k)},Q=s&&(b==="xargs"||b==="parallel")?void 0:wf(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Y});let be=r&&b==="git"?Am(X.words,Va(X)):void 0,dt=Rf(be?be.match:Q?.(X)??null,n.policy);if(r)WR(X,dt,be?.relaxation??null);if(dt)return ue(dt);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Pn(s,n.policy):null)??DR(s,n.policy)}let Or=!s&&Q===void 0&&!jr.has(b),Je=r&&Or?[]:void 0;if(Or)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;Je?.push(k);let L=Rf(OR(h,R,t,J,P,x,A,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[],embeddedCommandFound:O(k)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[]}),l&&s&&!s.wrappedByTransparent)return null;let Mr=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Mr,reason:Mr?.reason}),Mr)return ue(Mr);return a&&s?Pn(s,n.policy):null}function Ka(e,t,n,r){return Kt(An(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function OR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=O(c);if(Pf(c,d)||wf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=Ka(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!mr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function MR(e,t,n,r,o,i){if(!t)return Pn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(S("interpreter.one-liner-paranoid",rr),o.policy);if(a)return ue(a)}if(Ys(e,t))return Pn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Af(s,t))return s;if(or(t,void 0,!o.strict)){let a=T(S("interpreter.dangerous-command",gn),o.policy);if(a)return ue(a)}return Pn(i,o.policy)}function Af(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Bo)||e.reason===Sn)&&!Vr(t);return n||r}function wn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?ue(n):null}function Pn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?ue(n):null}function DR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?ue(n):null}function NR(e,t,n,r,o,i){let s=tm(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=nr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function LR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function WR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function xf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:gr}),ue(GR())}function GR(){return{id:"",reason:gr,intent:"stop_and_explain"}}function Pf(e,t){return q.has(t)||e==="$SHELL"||e==="${SHELL}"||q.has(I(t))}function Rf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var FR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,zR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function BR(e,t){let n=kf(e,t);if(n.length===0)return!1;let r=n[If(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return FR.test(e.join(" "))}function Tf(e,t,n,r,o){if(e.dialect==="powershell"){let y=$R(e.words,o);if(y.kind==="none")return;if(!t||y.kind==="unknown")return null;return _f(VR(y.target),t,n.paths)}let i=e.words.map(w),s=i.some((y)=>/^CDPATH\+?=/.test(y));if(!BR(i,n))return s?null:void 0;if(!t)return null;let a=kf(i,n,t),l=If(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((y)=>y.length<=1||!y.startsWith("-")||y==="--");if((d===-1?c:c.slice(0,d)).some((y)=>!/^-[LP]+$/.test(y)))return null;let u=d===-1?[]:c.slice(d),f=u[0]==="--"?u.slice(1):u;if(f.length!==1)return null;let g=f[0]??"",p=e.words.find((y)=>y.provenance==="variable"&&y.text===g),h=p?Ye(p,r):g;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return _f(h,t,n.paths)}function _f(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=yt(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function $R(e,t){let n=UR(e[0])?1:0,r=e[n];if(!HR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!zR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return jR(e.slice(n+1),t)}function UR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function HR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function jR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function VR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function If(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function kf(e,t,n){let r=KR(e);return bt([...r],t,n)}function KR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var e_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",qt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Qa(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return Ja(e,n);let d=`${Bo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Wf(e,n),{reason:Sn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Wf(e,n),{reason:Sn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ja(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=gm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set}]).result}function ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let m=e.nodes[c+1],u=m?.kind==="connector"?m.operator:void 0,f=t_(e,c,d,a,u),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],v=a==="&&"?p?.failure??[]:[],E={connector:a,skippedSuccessStates:y,skippedFailureStates:v};if(wt(u)&&!wt(a))l=E;let b=wt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:wt(a)?l??E:E,P=Yt(b.connector)||Yt(u);if(d.kind==="function"){let j=h.flatMap((J)=>{let X=In(J);return X.functionDefinitions.set(d.name,d.body),qa(J,[X],f,u==="&",Yt(u))}),G=Ya(j,[],b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=G.states,s=G.conditionalStates,a=void 0;continue}if(d.kind==="group"){let j=[],G=[];for(let X of h){let Q=ui(d.body,t,n,r,[In(X)]);if(Q.result)return Q;if(j.push(...qa(X,Q.states,f,u==="&",Yt(u))),P)G.push(X,...f?Q.states.map((be)=>li(X,be)):Q.states)}let J=Ya(j,G,b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=J.states,s=J.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let x=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),A=e.nodes[c-2],Y=wt(a)&&A?.kind==="command"?Nm(A)??r_(A):void 0,ke=[],je=[];for(let j of h){let G=o_(d,t,n,r,[In(j)]);if(G.result)return{result:G.result,states:i};let J=e.dialect==="powershell"?G.states:G.states.map((X)=>li(j,X));for(let X of J){let Q=In(X),be=a_(d,t,n.trace?{...n,trace:Gf(n.trace,x)}:n,r,Q,wt(a),Y);if(be)return{result:be,states:i};let dt=A_(d,Q.functionDefinitions);if(dt)n.budget.charge("derivedTokens",di(dt));let On=dt?t+1>=V.recursionDepth.cap?Za(d.displayText,n,[Q]):ui(dt,t+1,n,r,[Q]):{result:null,states:__(d,Q)};if(On.result)return On;ke.push(...qa(j,On.states,f,u==="&",Yt(u)));let Or=typeof Q.effectiveCwd==="string"&&Q.effectiveCwd!==X.effectiveCwd&&d.redirections.every((Je)=>["<",">",">>",">|"].includes(Je.operator)&&Je.target?.text==="/dev/null");if(P&&!Or)je.push(j),je.push(...On.states.map((Je)=>f?li(j,Je):Je))}}let de=Ya(ke,je,b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=de.states,s=de.conditionalStates,a=void 0}return{result:null,states:i}}function t_(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wt(r)||wt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&n_(e,t)}function qa(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>Tn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function n_(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(i_(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wt(e){return e==="|"||e==="|&"}function r_(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Yt(e){return e==="&&"||e==="||"}function Ya(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=Yt(i)?s:void 0;return{states:Yt(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function Gf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function o_(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=s_(e);if(s){if(t+1>=V.recursionDepth.cap)return Za(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Za(s,n,o);if(a.status!=="complete")return Of(i,n,r,o);n.budget.charge("derivedTokens",di(a)),i.push({program:a,depth:t+1})}}return Of(i,n,r,o)}function i_(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Of(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[In(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function s_(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Za(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,intent:"stop_and_explain"},states:[...n]}}function a_(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:m_(n.environment.paths,o.createdDirectories,n.budget)}},l=b_(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Ff(e,o,"before-consumer",a.environment.paths,a.budget);let c=mn(e.dialect,e.words),d=c.map(w),m=e.displayText,u=fm(c,o.shellGitContextState),f=ym(u,o.shellGitContextState);if(e.dialect==="powershell"){let h=T($d(e,i,T_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return P_(m,h)}if(d.length===1&&d[0]?.includes(" ")&&!Yn(e.dialect,e.words)){let h=T(Ae(d[0]),a.policy),y=h!==null&&!a.strict&&Hu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let v=Mf(e,l,o,f,s,a);if(v)return v;return Ia(u,o.shellGitContextState),null}let g=An(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Qa(h,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Gf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:m};let p=Mf(e,l,o,f,s,a);if(p)return p;return Ia(u,o.shellGitContextState),null}function Mf(e,t,n,r,o,i){let s=C_(e,t,n,r??new Map,i);if(s)return s;return Ff(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),u_(e,t,n,i.environment.paths,i.budget),f_(e,n,i.environment.paths,i.budget),E_(e,n,o,i.environment,i.trace),null}var l_=new Set([">>","<>"]);function Ff(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?c_(s):l_.has(s.operator)))continue;Df(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=Bf(e.words.slice(1));if(!i)return;for(let s of i.operands)Df(s,t,r,o)}function c_(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Df(e,t,n,r){let o=e?.provenance==="literal"?nr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function u_(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of d_(e,n.shellGitContextState.shellAssignments)){let a=nr(s,n.effectiveCwd,r,o);if(!a||!Ku(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function d_(e,t){let n=Xa(h_(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return g_(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=Bf(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>Xa(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function Xa(e,t){if(y_(e))return e.text;return(e&&Ye(e,t))??void 0}function m_(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=N(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${QR}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?N(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function f_(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>Xa(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!YR(c)&&!l)continue;let d=N(JR(l??"",c),n,r);if(a?p_(d,n):n.isDirectory(qR(d))&&zf(d,n))t.createdDirectories.add(d)}}function p_(e,t){let n=XR(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>ZR(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||zf(o(i),t)}function zf(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function g_(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function h_(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Bf(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function y_(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function el(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function b_(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return qt;let r=n[0];if(!r?.heredoc)return qt;let o=/\$\(|`/.test(r.heredoc.body);if(!el(r.heredoc)&&(!t||o))return e_;if(r.fd!==void 0&&r.fd!==0)return qt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return qt;let i=e.redirections.some((l)=>l!==r&&Nf(l.target));if(se(e.words[0],"cat"))return i?qt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Nf)?qt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return qt}function Nf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function C_(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(v_(e,i,n,r,o))return null;let a=S_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ja(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function S_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!el(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(m)return m}if(!or(l,void 0,!n.strict))return null;let d=T(S("interpreter.dangerous-command",gn),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function v_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!el(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!q.has(l)&&!q.has(I(l)))return!1;return st(a)}function E_(e,t,n,r,o){let i=Tf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var x_=/^[A-Za-z_][A-Za-z0-9_]*$/,R_=8;function __(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!x_.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=R_&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=In(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function In(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:hm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories)}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>w_(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function w_(e,t){return e.effectiveCwd===t.effectiveCwd&&Tn(e.shellGitContextState.env,t.shellGitContextState.env)&&Tn(e.literalHeredocFiles,t.literalHeredocFiles)&&Tn(e.functionDefinitions,t.functionDefinitions)&&Tn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Tn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Lf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Lf(e.createdDirectories,t.createdDirectories)}function Lf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Tn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function A_(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function P_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function T_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ja(e,t){let n=T(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Wf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Sn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var I_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function $f(e,t,n,r){let o=Qa(e,0,{...t,...mu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Uf(e,t,n){try{return{decision:e()}}catch(r){let o=k_(r,t,n);if(!o)throw r;return o}}function k_(e,t,n){if(!(e instanceof D)||!I_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var O_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),nl=new Set(["cc-safety-net","ccsn"]),M_=new Set(["bunx","npx","pnpx"]),D_=new Set(["pnpm","yarn"]),N_=new Set(["npm","pnpm","yarn"]),L_=new Set(["bun","node"]);function fi(e,t,n={}){if(nl.has(e))return 0;if(M_.has(e)){if(n.broad)return tl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&N_.has(e)&&n.broad&&t[r]==="exec"){let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(D_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(L_.has(e)){let o=n.broad&&r!==-1?r:0;if(Hf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Hf(t[o+1]))return o+2}return null}function tl(e){let t=e.findIndex((r)=>mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!mi(r))break;n++}return n}function mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return nl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return nl.has(e.slice(0,t))}function Hf(e){let t=e?.replaceAll("\\","/");return[...O_].some((n)=>t===n||t?.endsWith(`/${n}`))}var jf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Vf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=yn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>W_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function W_(e,t){let n=bt([...e],t),r=n.slice(1),o=fi(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as pi}from"path";var Zf="This path contains the protected policy config and you must not modify or delete it.",G_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Xf(e,t,n){let r=H_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Kf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?qf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=qf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Kf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Nr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Kf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>_r(a,n,r,o,i));return s?{target:s}:null}function qf(e,t,n,r,o){let i=yn(e,t,r,o,{findSegmentTarget:(s,a)=>F_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>_r(s,a.cwd,n,r,o),findMalformedTarget:(s)=>U_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function F_(e,t,n,r,o){if(cr(e))return null;let i=Ct([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&z_(a)){let l=B_(a).find((c)=>Yf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Ko(i,1)||Ea(i,r)){let c=(br(K(i))??K(["."])).find((d)=>{let m=pe(d.text,t.variables);return _r(m,t.cwd,n,r,o)||Yf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Do(a).sources.find((c)=>j_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if($_(i,s))return null;for(let l of[...e,...i])for(let c of Jf(l))if(_r(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function z_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function B_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function $_(e,t){if(!G_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function U_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Jf(i))if(_r(s,t,n,r,o))return{target:s};return null}function Jf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function H_(e,t,n){let r=(a)=>wr(ae(a,e.executionCwd,t,n)),o=r(sn(t)),i=[r(Hn(e.executionCwd)),r(Hn(e.configCwd))],s=new Set(i.map((a)=>pi(a)));for(let a=pi(o);;a=pi(a))if(s.add(a),pi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function _r(e,t,n,r,o){let i=jl(e,t,r,o,(s)=>wr(s)===Ur);return i!==null&&n.files.has(wr(i))}function Yf(e,t,n,r,o){return n.directoriesAndAncestors.has(wr(ae(e,t,r,o)))}function j_(e,t,n,r,o){let i=wr(ae(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function wr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as gi,posix as up,resolve as yi,win32 as V_}from"path";import{fileURLToPath as K_}from"url";var dp="Access to a sensitive path is not allowed.",mp=new Set(["echo","printf"]),q_=new Set(["find"]),Y_=new Set(["!","do","elif","else","if","then","until","while"]),Z_=new Set(["-exec","-execdir"]),X_=new Set([";","+"]),J_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Q_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),fp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),ew=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),tw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),pp=new Set(["-c","-e","-r","-E","--eval","--exec"]),nw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),rw=new Set(["grep","rg"]),ow=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),iw=new Set(["commit","merge","notes","stash","tag"]),sw=new Set(["-m","--message"]),aw=new Set(["--grep"]),Qf=new Set(["jq","gojq","jaq"]),ep="f",tp="file",lw="files",cw=new Set(["e","f"]),uw=new Set(["regexp","file"]),dw=new Set(["e","f","A","B","C","m"]),mw=new Set(["regexp","file","after-context","before-context","context","max-count"]),rl="__CC_SAFETY_NET_PIPE_INPUT__",il=/[\w./~@+-]*[./~][\w./~@+-]*/g,fw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,pw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,gw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,np=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,rp=/\b(?:system|exec|spawn|popen)\s*$/,hw=/\b(?:eval|exec)\s*\(/g,yw=/\b(?:eval|exec)\s*$/,bw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function op(e,t,n,r,o,i){for(let s of e){let a=s.target;if(gA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=fA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(vp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!al(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!al(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&hA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function gp(e,t,n,r,o={}){let i=ip(e,n,r),s=op(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=op(i,t,e.invocation.context.configCwd,n,r,new Set(ip(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&Cw(e,n)?null:a}function Cw(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Mo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=ut(r);if(o.length===0)return!1;let i=He(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return ll(i,o.slice(1))}function ll(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>J_.has(n))}function ip(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?kn(s.shell,e.store,r,t,o,n,Sw(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function Sw(e){return e.program.dialect==="powershell"}function kn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Zw(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(kw(c,s),r);return Oo(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...bi(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...Ew(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...hp(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>xw(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return oa;return a.push({target:l(c.target),cwd:d.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function cl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?kn(s,t,n,r,o,i):null}function bi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,y)=>!s.has(y));if(Qf.has(He(ut(p)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...bi(p,t,n,r,o,i)]}let l=Iw(e).map(a),c=ut(e);if(c.length===0)return l;let d=c[0]??"",m=He(d).toLowerCase(),u=c.slice(1),f=c.findIndex((p)=>!Y_.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&ll(He(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=vw(d,m,u);if(g)return[...l,...g.map(a)];if(mp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...yp(e).map(a)]:l;if(m==="eval")return[...l,...cl(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Xe(m,p)).map(a)];if(m==="git")return[...l,...Mw(u).map(a)];if(m==="gh")return[...l,...sl(m,u,ow).map(a)];if(Qf.has(m))return[...l,...Ow(u).map(a)];if(rw.has(m))return[...l,...oA(u).map(a)];if(q_.has(m))return[...l,...Ww(u,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...u.flatMap((p)=>Xe("awk",p)).map(a),...u.flatMap((p)=>Fw(p,t,n,r,o,i)),...u.flatMap(zw).map(a)];if(m==="curl")return[...l,...u.flatMap((p)=>Xe(m,p)).map(a),...Dw(u).map(a)];if(ur(m)){let p=lr.has(m)?Ee([m,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,...kn(h,t,n,r,o,i),...u.slice(p.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...Gw(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>Xe(m,p)).map(a)]}function vw(e,t,n){let r=fi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Ew(e,t,n,r,o,i,s){if(Aw(t,n,r,o,i,s)){let a=ut(e),l=ll(He(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...yp(e),...l].map((c)=>({target:c,cwd:i}))}return hp(t,Rw(e),n,r,o,i,s,()=>[])}function xw(e,t,n,r,o,i,s){let a=ut(e);if(!ur(He(a[0]??"").toLowerCase()))return[];return cl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function hp(e,t,n,r,o,i,s,a){let l=Pw(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>lr.has(l)?kn(n.getShellSyntax(c),n,r,o,i,s):hi(l,c,n,r,o,i,s))}function yp(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase();if(!mp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ul(r.replaceAll("%%","%"))];return t.slice(1)}function Rw(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return _w(r);return[]}function _w(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ul(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>ww(t,r.slice(i*n,(i+1)*n)))}function ww(e,t){let n=0;return ul(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ul(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Aw(e,t,n,r,o,i){let s=ut(e);if(s.length===0||He(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Vt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,rl]:l.map((m)=>m.split(c).join(rl));return bi(d,t,n,r,o,i).some((m)=>m.target.includes(rl))}function Pw(e){let t=ut(e);if(t.length===0)return null;let n=He(t[0]??"").toLowerCase();if(!ur(n))return null;return Tw(n,t.slice(1))?n:null}function Tw(e,t){let n=dl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(pp.has(o)||bp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(bw.get(n)?.has(o))r++;continue}return!1}return!0}function dl(e){return/^python\d/.test(e)?"python":e}function Iw(e){let t=[];for(let n of e){if(Sp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var sp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function kw(e,t){if(!t||!sp.test(e))return e;return`~${e.replace(sp,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function Ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function Mw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...iw.has(r)?sl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),sw):sl("git",e.slice(n),aw)];if(t.push(...Xe("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function sl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function Dw(e){return e.flatMap((t,n)=>{let r=Lw(t);if(r!==null)return ap(r.flag,r.value);let o=Nw(e[n-1]);return o===null?[]:ap(o,t)})}function ap(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return ol(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return ol(t.slice(n+1))}return t.startsWith("@")?ol(t.slice(1)):[]}function Nw(e){if(e===void 0)return null;if(fp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return fp.has(r)?{flag:r,value:e.slice(n+1)}:null}function ol(e){return e===""||e==="-"?[]:[e]}function Ww(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!Z_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>X_.has(f)),m=d===-1?c:c.slice(0,d),u=bi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!Q_.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function Gw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(pp.has(c)||bp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...hi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function bp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return nw.get(t[t.length-1]??"")?.has(dl(e))??!1}function Fw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ba(e)?.commands.flatMap((s)=>kn(t.getShellSyntax(s),t,n,r,o,i))??[]}function zw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Bw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ml),...e.match(il)??[]]}function hi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=Uw(t,$w(e));if(l.kind==="unmaskable")return Bw(t).map(a);let c=l.masked.match(np)!==null||l.literals.some((p)=>rp.test(l.masked.slice(0,p.start))),d=l.masked.match(hw)!==null||l.literals.some((p)=>yw.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!lr.has(e),u=m&&!(Kw(l.masked)||c||d)?[]:l.literals,f=m?Array.from(l.masked.matchAll(np),(p)=>{let h=p.index+p[0].length;return{start:h,end:Xs(l.masked,h)}}):[],g=!m||f.some((p)=>Js(l.masked,p.start))?l.literals:l.literals.filter((p)=>rp.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...u.map((p)=>p.text).filter((p)=>p!=="").map(a),...u.flatMap((p)=>ml(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(il)??[]).map(a),...c?g.flatMap((p)=>cl(p.text,n,r,o,i,s)??[a(p.text)]):[],...d?l.literals.flatMap((p)=>hi(e,p.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(il)??[]).map(a)]}function $w(e){let t=dl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Uw(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(pw.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Vw(e,o))return{kind:"unmaskable"};let a=t==="python"?Hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=jw(e,c,l);if(d===null)return{kind:"unmaskable"};let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&gw.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function Hw(e,t){return fw.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function jw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Vw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Kw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(ew.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>tw.has(i)))continue;if(o.length>1)return!0;if(qw(e,r)===".")return!0;if(Yw(e,r+n.length)==="(")return!0}return!1}function qw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Yw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Zw(e,t,n,r,o,i){return tA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...kn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...Xw(a,r)?Jw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Xw(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||He(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Jw(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(ml)}function ml(e){let t=eA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Qw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Qw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function eA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function tA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(jn(o,n))continue;if(Cp(e,r,n)){let i=nA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=rA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function nA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(jn(i,n))continue;if(Cp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function rA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Cp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function oA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===lw)o=!0;if(uw.has(m))r=!0;if(u!==void 0){if(m===tp)t.push(u);continue}if(mw.has(m)){let f=e[l+1];if(m===tp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(cw.has(h))r=!0;if(dw.has(h)){u=h,f=m.slice(p+1);break}}if(u==="")continue;if(f.length>0){if(u===ep)t.push(f);continue}let g=e[l+1];if(u===ep&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!Sp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Sp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var iA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),sA=".env.",aA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),lA=[".env.example.",".env.sample."];function cA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function uA(e){return e.length>0&&!/\s/.test(e)}function al(e,t,n,r){let o=vp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function vp(e,t,n,r){try{return Tr(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var dA=new Set(["node_modules","__pycache__"]),mA=[["vendor","bundle"],["vendor","cache"]];function fA(e,t,n,r,o){if(cA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=z(i.split("/").pop()??""),a=z(i),l=()=>uA(s)||al(e,t,r,o);if(aA.has(s)||lA.some((u)=>s.startsWith(u)))return null;let c=z(CA(e,t,r,o));for(let u of ms){let f=`~/${u.suffixParts.join("/")}`;if((cp(a,f)||cp(c,f))&&ct(u.id,n))return u.id}let d=pA(i,t,n,r,o);if(d)return d;if(iA.has(s))return null;for(let u of ds)if(s===u.basename&&ct(u.id,n))return u.id;if(s.startsWith(sA)&&ct(Zr.id,n)&&l())return Zr.id;for(let u of fs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&ct(u.id,n)&&l())return u.id}for(let u of ps)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&ct(u.id,n))return u.id}if(yA(a))return null;if(!s.includes(".")&&Vn.pattern.test(s)&&ct(Vn.id,n))return Vn.id;let m=bA(s,n);if(m)return m;return null}function pA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=z(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Pr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Ar(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=z(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=z(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Pr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Ar(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Ar(e,s,["credentials"])||Ar(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=z(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=z(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>Pr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(z(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Pr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,Ze(d,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Ar(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ze("~",t,r,o),".config","amp")],l=z(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Pr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ze("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||z(e).split("/").at(-1)==="mcp-auth.json"&&Zt(z(e),z(a))}case"secret.cli.cursor.config":{let s=z(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=z(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var lp=new WeakMap;function B(e,t,n,r,o){let i=lp.get(o)??new Map;lp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Ep(e,ce(t,r)))}function Ar(e,t,n){return n.some((r)=>Zt(z(e),z(ce(t,r))))}function Pr(e,t,n,r,o){return Ep(e,Ze(t,n,r,o))}function Ep(e,t){return z(e)===z(t)}function ce(e,...t){return Ue([e,...t].filter(Boolean).join("/"))}function gA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));return n.some((a)=>Zt(s,z(Tr(a,r,o,i))))}function hA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ue(N(Se(a),o.paths,i)):"",c=z(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=z(d?Ue(N(yi(Se(d)),o.paths,i)):l&&Ue(N(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Zt(s,m))return!1;return n.some((u)=>{let f=Cs(u);if(f&&up.basename(s)!==z(f.name))return!1;let g=z(Tr(f?.root??u,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return Zt(s,g)&&!(f&&s===g)})}function yA(e){let t=e.split("/");return t.some((n)=>dA.has(n))||mA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function bA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function z(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";if(!o)return i;let s=pl(i,o),a=gi(s)?s:Ue(yi(t,s)),l=Ue(N(a,n.paths,r));if(!Zt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function cp(e,t){return e===t||e.startsWith(`${t}/`)}function CA(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i||!o)return"";let s=pl(i,o),a=up.normalize(gi(s)?s:Ue(yi(t,s))),l=Ue(Se(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Zt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function Tr(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";let s=o?pl(i,o):i;return Ue(N(gi(s)?s:yi(t,s),n.paths,r))}function fl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ue(N(Se(r),t.paths,n)):"",i=Ue(Se(SA(ot(e,t))));return{home:o,normalized:i}}function SA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return K_(e)}catch{return e}}function pl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function vA(e){if(process.platform==="win32")return!0;return V_.parse(e).root.length>1}function Ue(e){let t=e.trim(),n=(t.includes("\\")&&vA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Zt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function He(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Xt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var EA={findPolicyMutation:Xf,findGitMetadataMutation:xd,resolveGitMetadata:RA,loadPolicySnapshot:du,findSensitiveTarget:gp,analyzeCommand:$f,getModes:zi},xA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function xp(e,t){let n={...EA,...t.dependencies},r=AA(e),o=Ir(e)?e.command:r,i=At("policy-protection",o,()=>dr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Ir(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Ud,intent:"stop_and_explain"}};let l=Ce(),c=At("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=At("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Zf,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=At("policy-protection",o,()=>Vf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:jf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let u=At("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=At("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,..._A(f)},y=g.secretProtection.enabled===!1?null:At("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:Ir(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:dp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Ir(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...gl("command-validation",o),...h};let v=At("command-analysis",o,()=>Uf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},wA(i),i.store),e.command,t.trace));if(v.decision){let E=!p.strict&&(v.decision.ruleId==="raw-text.dangerous-command"||v.decision.reason===gr&&!xA.test(v.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:E?{...v.decision,unverifiedByStandardMode:!0}:v.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function RA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function _A(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function wA(e){return ge(e,"declared-command")?.program}function AA(e){try{return Gn(e.input)}catch(t){let n=Ir(e)?e.command:void 0;throw new Xt("policy-protection",gl("policy-protection",t instanceof Qe?void 0:n,t),t)}}function At(e,t,n){try{return n()}catch(r){throw new Xt(e,gl(e,r instanceof Qe?void 0:t,r),r)}}function gl(e,t,n){let r=n instanceof D||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?Ei:Dn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Ir(e){return e.route.kind==="command"}import{appendFileSync as zA,mkdirSync as BA}from"fs";import{isAbsolute as $A,join as bl}from"path";import{lstatSync as _p,readdirSync as PA,readFileSync as TA,rmdirSync as IA,statSync as wp,unlinkSync as kA,utimesSync as OA,writeFileSync as MA}from"fs";import{join as kr}from"path";function Rp(e,t={}){return so(sn(e,t),e.home).policy.audit.retention_days}var yl=86400000,DA=".last-prune",NA=/^\d{4}-\d{2}$/,LA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Ap=(e)=>Math.floor(e/yl);function Tp(e,t,n=()=>new Date){try{let r=n().getTime();if(!wp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=kr(t,DA),i=wp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Ap(i)===Ap(r))return;let s=r-Rp(e)*yl,a=new Date(r).toISOString().slice(0,7);for(let l of hl(t)){if(l.isDirectory()){WA(kr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))GA(kr(t,l.name),s)}MA(o,"",{mode:384}),OA(o,r/1000,r/1000)}catch{}}function WA(e,t,n){for(let r of hl(e)){if(!r.isDirectory()||!NA.test(r.name))continue;let o=kr(e,r.name);for(let i of hl(o)){if(!i.isFile())continue;let s=LA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+yl;if(!Number.isFinite(a)||a>=t)continue;Ip(kr(o,i.name))}if(r.name!==n)Pp(o)}Pp(e)}function GA(e,t){try{let n=_p(e);if(n.mtimeMs>=t)return;let r=TA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(FA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(_p(e).mtimeMs!==n.mtimeMs)return;Ip(e)}catch{}}function FA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function hl(e){try{return PA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Ip(e){try{kA(e)}catch{}}function Pp(e){try{IA(e)}catch{}}var UA="2.4.12",HA=1e4,jA=2000,VA=256,KA=32768;function qA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function YA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Cl(e,t,n,r,o,i,s={}){let a=qA(t);if(!a)return;let l=XA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=Ci(mt(n),s.failureStage?Number.POSITIVE_INFINITY:HA),m=Ci(mt(r),jA),u=s.toolName?Ci(mt(s.toolName),VA):void 0,f=i===null?void 0:Ci(mt(i),KA),g=bl(l,YA(f?.value??null),c.slice(0,7));BA(g,{recursive:!0,mode:448});let p=bl(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:UA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};zA(p,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Tp(e,l,s.now)}catch{}}function Ci(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function ZA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&$A(n)?n:null}function XA(e){let t=ZA(e);return t?bl(t,".cc-safety-net","logs"):null}function Op(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=kp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?kp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function kp(e){return"command"in e?e.command??"":""}function Mp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Cl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Dp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Cl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Lp(e,t,n){try{let r=xp(t,{environment:e,...n.guard});return Np(e,t,r,n),r}catch(r){if(!(r instanceof Xt))throw r;throw Np(e,t,r.evaluation,n,!(r.cause instanceof Qe),{stage:r.stage,errorCode:JA(r.cause)}),r}}function Np(e,t,n,r,o=!0,i){Mp(e,Op(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function JA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Qe)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Jt(e,t={}){return{malformed:!0,denial:Nn(t),cwd:e}}function Sl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Wp(e,t={}){return(n,r)=>{try{return QA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Nn())}}}function QA(e,t,n,r){let o=nc();if(n.cancelled?.(t))return n.block(Nn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Dp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=xl(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Lp(o,i,{guard:{auditAllowed:rc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Xt))throw l;if(Tt(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${_l(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var eP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>nP(e,t,n),getSessionId:(e)=>iP(e),allow:{action:"allow"},block:(e)=>sP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},Gp=tP();function tP(e={}){return Wp(eP,e)}function nP(e,t,n){if(!e||typeof e!=="object")return Jt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Jt(null);if(!r.input||typeof r.input!=="object")return Jt(null,{toolName:r.tool});let o=rP(t);if(!o)return Jt(null,{toolName:r.tool});let i=ql(".",[o],n);if(!i)return Sl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=oP(t,e);if(!s.ok)return Jt(i,{toolName:r.tool});if(!s.command)return en(r.tool,r.input,{kind:Ai(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return Jt(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=Yl(a,i,n);if(!l)return Sl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return en(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function rP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function oP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function iP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function sP(e){return{action:"reject-and-continue",message:Rl(e)}}function aP(e){e.on("tool.call",(t)=>Gp(t,e))}export{aP as default};