cc-safety-net 2.4.11 → 2.4.12

package/dist/openclaw/cc-safety-net/index.js

@@ -1,48 +1,48 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.11
-var yl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Si="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",An="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var bi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},wn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...bi},processedCandidateBytes:{cap:4194304,...bi},pathEnvironmentExpansion:{cap:64,...bi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...wn},trackedHeredocFiles:{cap:64,...wn},controlFlowStates:{cap:64,...wn},wrapperPeelIterations:{cap:20,...wn},derivedCommandShape:wn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var kp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function lt(e){return Op(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Op(e){return kp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Mp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Np(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Mp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+// version: 2.4.12
+var xl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Mn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},On={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...On},trackedHeredocFiles:{cap:64,...On},controlFlowStates:{cap:64,...On},wrapperPeelIterations:{cap:20,...On},derivedCommandShape:On});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function be(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Fp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function mt(e){return zp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function zp(e){return Fp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Bp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function $p(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Bp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function Cl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function Pn(e={}){return{reason:An,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function bl(e){return Np({...e,redact:lt})}function Sl(e){return lt(e instanceof Error?e.message:String(e))}import{isAbsolute as $l,relative as lg,resolve as cg,sep as ug}from"node:path";import{basename as xl,dirname as Dp,isAbsolute as Lp,join as Wp,normalize as Gp,resolve as vl}from"node:path";var Fp=256,Pr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function ct(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ri(e,t){return vi(e,0,t)}function vi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ei(e,o+2),a=zp(e,o,t);if(a===null){if(Pr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Bp(l,t,n),o=a+1;continue}let i=Ei(e,o+1);if(!i){r+="$",o++;continue}r+=xi(i,n)??`$${i}`,o+=i.length+1}return r}function zp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Bp(e,t,n){let r=e.slice(2,-1),o=Ei(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return xi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Pr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Pr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=xi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":vi(i.slice(s.length),t+1,n);return l?vi(i.slice(s.length),t+1,n):""}function Ei(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function xi(e,t){if(!Pr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Rl(n,i);let s=t.realpath(i);if(s!==null)return El(n,e,s,o);let a=Dp(i);if(a===i||o.length>=Fp)return El(n,e,i,o);o.push(xl(i)),i=a}}function El(e,t,n,r){let o=r.length===0?n:Wp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function $p(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Rl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Rl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=wl(e,t,n);if(!o)return"";return z(o,n.paths,r).replace(/\\/g,"/")}function _l(e,t,n,r,o){let i=wl(e,t,n);if(!i)return null;if(o(xl(i)))return z(i,n.paths,r).replace(/\\/g,"/");let s=$p(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function wl(e,t,n){let r=n.home,o=Ri(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?vl(r,o.slice(2)):o,s=be(i);return Gp(Lp(s)?s:vl(t,s))}import{types as Up}from"node:util";var Hp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),jp=new Set(["command","diff","input","patch","patchtext"]),Al=new TextEncoder,Vp=new TextDecoder,Kp=/\s/,qp=64;class Xe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Tn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Yp(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Ir(e){return Hp.has(Yp(e))}function kn(e){if(!e||typeof e!=="object")return;Gl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ve();return}if(t.get||t.set)Ve();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ol(e,t){return Ml(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Ml(e,t,n,r){let o=Wl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Ml(a,t,n,r+1);return typeof a==="string"&&t.has(Nl(s))?[a]:l});return n.ancestors.delete(o.object),i}function Nl(e){return e.replace(/-/g,"_").toLowerCase()}function Dl(e){return Ll(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Xp)}function Ll(e,t,n,r){let o=Wl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ll(a,o.array?t:jp.has(Nl(s)),n,r+1));return n.ancestors.delete(o.object),i}function Zp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Tn.maxDepth||t.nodes>Tn.maxNodes)Ve();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Tn.maxStringBytes||t.stringBytes>Tn.maxAggregateStringBytes)Ve()}function Wl(e,t,n){if(Zp(e,t,n),!e||typeof e!=="object")return null;let r=Gl(e);if(t.ancestors.has(e))Ve();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Tn.maxKeys)Ve();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ve();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Gl(e){if(Up.isProxy(e))Ve();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ve();return t}function Ve(){throw new Xe}function Xp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Jp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(..._i(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(..._i(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ai(Tr(c.slice(4),!0),Tr(u.slice(4),!0))),l++;continue}if(!r)t.push(..._i(c))}return t}function Jp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function _i(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return kl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return kl(n[1]);if(e.startsWith("diff --git "))return Qp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Il(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Il(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return sg(i[1]);return[]}function Qp(e){let t=eg(e);if(t.length===2&&t[0]&&t[1])return Ai(t[0],t[1]);let n=tg(e);return n?Ai(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function eg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Rt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Rt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Fl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Rt(e[n]))n++;return n===e.length?t:[]}function tg(e){let t=0;while(t<e.length&&Rt(e[t]))t++;let n=e.length;while(n>t&&Rt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Rt(e[o])){o++;continue}let i=o;while(o<n&&Rt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>qp)Ve();if(ng(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function ng(e,t,n,r,o){if(wi(e,t,n,r,o))return!0;let i=Pl(e,"/",t,n),s=Pl(e,"/",r,o);if(i<=t||s<=r)return!1;if(wi(e,t,i,r,s))return!1;return wi(e,i+1,n,s+1,o)}function wi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Pl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Rt(e){return e!==void 0&&Kp.test(e)}function Fl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Vp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Al.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Al.encode(rg(s[0]??""))),o+=2}return null}function rg(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function og(e){return In(ag(e))}function Ai(e,t){if(e==="/dev/null")return Tl(t);if(t==="/dev/null")return Tl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(In);let n=ig(e,t)??(e===t?zl(e):null);return[e,t,...n?[n]:[]].flatMap(In)}function Tl(e){let t=zl(e);return[e,...t?[t]:[]].flatMap(In)}function zl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function ig(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Il(e){return og(Tr(e,!0))}function sg(e){return In(Tr(e,!1))}function Tr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Fl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function ag(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function In(e){return e===""||e==="/dev/null"?[]:[e]}function kl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Pi(e,t,n){if(ct(e))return;let r=t.flatMap((i)=>Bl(i,n));if(!r[0])return;let o=Bl($l(e)?e:cg(r[0],e),n)[0];if(!o)return;return r.some((i)=>dg(o,i))?o:void 0}function Bl(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function dg(e,t){let n=lg(t,e);return n===""||n!==".."&&!n.startsWith(`..${ug}`)&&!$l(n)}function On(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Fg,realpathSync as zg,statSync as Bg}from"node:fs";import{homedir as $g,tmpdir as Ug}from"node:os";import{statSync as Lg}from"node:fs";import{join as Wg}from"node:path";import{spawnSync as fg}from"node:child_process";import{existsSync as Nn,lstatSync as mg,readFileSync as Dn,realpathSync as Yt,statSync as Mn}from"node:fs";import{dirname as Ti,isAbsolute as Ii,join as Zt,resolve as kr}from"node:path";var pg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],gg=5000;function Hl(e,t=Og(),n=gg){let r=hg(e),o=r===null?null:yg(r);if(r===null||o===null)return null;let i=Ig(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function hg(e){try{let t=Yt(kr(e));return Mn(t).isDirectory()?t:null}catch{return null}}function yg(e){let t=Tg(e);if(!t)return null;try{let n=mg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=ki(t);if(!r?.commonDir)return null;if(!Sg(r.gitDir,t))return null;return vg(r.gitDir,Ti(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function ki(e){try{let t=Cg(e);if(!t)return null;let n=Yt(Ii(t)?t:kr(Ti(e),t));if(!Mn(n).isDirectory())return null;return{gitDir:n,commonDir:bg(n)}}catch{return null}}function Cg(e){let t=Dn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function bg(e){try{let t=Dn(Zt(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=Yt(Ii(t)?t:kr(e,t));return Mn(n).isDirectory()?n:null}catch{return null}}function Sg(e,t){let n=Eg(e);return n===null?!1:jl(e,n,t)}function vg(e,t){let n=xg(e);return n===null?!0:jl(e,n,t)}function Eg(e){let t=Zt(e,"gitdir");if(!Nn(t))return null;let n=Dn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function xg(e){let t=Zt(e,"config.worktree");return Nn(t)?_g(t):null}function jl(e,t,n){try{return Rg(Ii(t)?t:kr(e,t),n)}catch{return!1}}function Rg(e,t){try{let n=Mn(e),r=Mn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Ul(Yt.native(e))===Ul(Yt.native(t))}function Ul(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function _g(e){let t=Dn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=wg(s[1]??"")}return r}function wg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Pg(t.slice(1,-1))}var Ag={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Pg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Ag[n]??t)}function Tg(e){try{return Oi(Yt(e))}catch{return null}}function Oi(e){let t=e;while(!0){let n=Zt(t,".git");if(Nn(n))return n;let r=Ti(t);if(r===t)return null;t=r}}function Ig(e,t,n,r){if(kg(t))return!0;if(n===null)return!0;let o=fg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Mg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Vl(o.stdout.trim())}function kg(e){return[Zt(e.commonDir,"config"),Zt(e.gitDir,"config.worktree")].filter((t)=>Nn(t)).some((t)=>Ng(t))}function Og(){return pg.find((e)=>Nn(e))??null}function Ln(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Mg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Ln(t)))}function Ng(e){let t;try{t=Dn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Dg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Vl(c)}return r}function Dg(e){return e==="include"||e.startsWith("includeif ")}function Vl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Kl(e,t){if(e==="")return null;let n=Ce(),r=Oi(se(e,e,t,n)),o=r?Gg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Gg(e,t,n,r){try{let o=se(e,t,n,r),i=Lg(e),s=i.isFile()?o:null,a=i.isFile()?ki(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[Xt(se(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[Xt(e.replace(/\\/g,"/")),...l]:l)];return{entry:Xt(o),markerFile:s?Xt(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let f=Xt(Wg(u,"hooks").replace(/\\/g,"/"));return[f,Xt(se(f,t,n,r))]}))]}}catch{return null}}function Xt(e){return process.platform==="win32"?e.toLowerCase():e}var Hg={realpath:(e)=>{try{return zg(e)}catch{return null}},entryKind:(e)=>{let t=Fg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Bg(e).isDirectory()}catch{return!1}}};function Yl(){return jg({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:be(process.env.HOME||$g()),tmpdir:Ug(),paths:Hg})}function jg(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>ql(n,i,()=>Kl(i,o)),worktreeFacts:(i)=>ql(r,i,()=>Hl(i)),...t};return o}function ql(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var Jt=["fail_closed","paranoid_rm","paranoid_interpreters"],Or={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var Q={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Mr=["standard","strict","paranoid"];function Vg(e,t){if(!t)return e;return Mr.indexOf(t)>Mr.indexOf(e)?t:e}function Kg(e){let t=Li(Q.level,e);if(t===void 0||t==="")return;if(Mr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${Q.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Mr.join(", ")}.`);return}function qg(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function Zl(e){return qg(Li(Q.auditScope,e))==="all"}function Ni(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function Di(e={},t){let n=e.safety?.level??"standard",r=Kg(t),o=Vg(n,r),i=Or[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${Q.level.name}=${r}`),l.paranoidRm.push(`env ${Q.level.name}=${r}`),l.paranoidInterpreters.push(`env ${Q.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(_t(Q.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${Q.strict.name}`);if(_t(Q.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${Q.paranoid.name}`),l.paranoidInterpreters.push(`env ${Q.paranoid.name}`);if(_t(Q.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${Q.paranoidRm.name}`);if(_t(Q.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${Q.paranoidInterpreters.name}`);let c=!!e.worktreeMode||_t(Q.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Ni(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function _t(e,t){let n=typeof e==="string"?Mi(e,t):Li(e,t);return n==="1"||n?.toLowerCase()==="true"}function Mi(e,t){return t.get(e)}function Li(e,t){let n=Mi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Mi(e.legacyName,t);return}import{dirname as $r}from"node:path";import{closeSync as Yg,constants as Xl,fstatSync as Zg,fsyncSync as _P,lstatSync as Fi,mkdirSync as wP,openSync as Xg,readdirSync as AP,readFileSync as Jg,realpathSync as zi,renameSync as PP,rmdirSync as TP,statSync as Qg,unlinkSync as IP,writeFileSync as kP}from"node:fs";import{isAbsolute as Jl,join as Bi,normalize as eh,parse as Gi,relative as $i,resolve as Ui,sep as Hi}from"node:path";function Wi(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var th=Symbol("PolicyFilesystemScope"),nh=Symbol("PolicyFilesystemTarget"),rh=Xl.O_NOFOLLOW??0;class ae extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function wt(e,t){return{[th]:!0,root:Ui(e),label:t}}function Ql(e,t){let n=eh(t);if(t===""||Jl(t)||n===".."||n.startsWith(`..${Hi}`))throw new ae(e.label);return{[nh]:!0,scope:e,relativePath:n,path:Bi(e.root,n)}}function Wn(e,t){return Ql(e,$i(e.root,Ui(t)))}function ec(e,t="rules policy"){let n=Ui(e),r=Gi(n).dir;return Ql(wt(r,t),$i(r,n))}function Dr(e){return nc(e.scope.label,()=>{if(!Nr(e))return null;let t=Xg(e.path,Xl.O_RDONLY|rh);return oh(t,()=>{let n=Zg(t);if(!n.isFile())throw new ae(e.scope.label);let r=Jg(t,"utf-8"),o=Fi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ae(e.scope.label);return Nr(e),r})})}function tc(e,t){if(e.path===t.path)return!0;return nc(e.scope.label,()=>{if(!Nr(e)||!Nr(t))return!1;let n=(r)=>Bi(zi(Gi(r).dir),Gi(r).base);return n(e.path)===n(t.path)})}function nc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ae)throw r;throw new ae(e)}}function oh(e,t){try{return t()}finally{Yg(e)}}function Nr(e,t="file"){let n=ih(e.scope);if(!n)return!1;let r=e.relativePath.split(Hi);for(let o of r.keys()){let i=Bi(e.scope.root,...r.slice(0,o+1)),s=Fi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ae(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ae(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ae(e.scope.label);sh(n,zi(i),e.scope.label)}return!0}function ih(e){if(!Fi(e.root,{throwIfNoEntry:!1}))return null;if(!Qg(e.root).isDirectory())throw new ae(e.label);return zi(e.root)}function sh(e,t,n){let r=$i(e,t);if(r===".."||r.startsWith(`..${Hi}`)||Jl(r))throw new ae(n)}import{dirname as Pt,isAbsolute as dh,join as It,relative as fh,resolve as Tt,sep as mh}from"node:path";var At=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,rc="rulebook.json",oc=".cc-safety-net/rules";var ic=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var ah=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,lh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),ch="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),DP=new RegExp(`^${lh}/(${At.source.slice(1,-1)})/${ch}$`);function uh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function sc(e){if(Lr(e))try{return ji(e),null}catch(t){return t instanceof Error?t.message:String(t)}return At.test(e)?null:`Local rulebook sources must be bare names matching ${At}: ${e}`}function ji(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(ic);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!ah.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!At.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:uh(o),name:o}}function Lr(e){return ic.test(e)}var ac="rule.json",Wr="policy.json",lc=".cc-safety-net",ph="rules",gh="CC_SAFETY_NET_HOME",cc="`cc-safety-net rule update`";function hh(e){return Tt(e,oc)}function yh(e){return It(hh(e),ac)}function Gn(e){return It(Tt(e),lc,Wr)}function Vi(e,t={}){return t.userConfigDir??(t.userConfigPath?Pt(t.userConfigPath):It(Ch(e),ph))}function Ch(e){let t=e.env.get(gh);return t?Tt(be(t)):It(e.home,lc)}function bh(e,t={}){return It(Vi(e,t),ac)}function Qt(e,t={}){return It(Pt(Vi(e,t)),Wr)}function uc(e,t){let n=t.userConfigPath??bh(e,t),r=t.projectConfigPath??yh(t.cwd),o=Sh(e,t),i=vh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Wn(o,n),projectConfigTarget:Wn(i,r)}}function Sh(e,t){let n=t.userConfigPath?Pt(Pt(Tt(t.userConfigPath))):Pt(Tt(t.userConfigDir??Vi(e,t)));return wt(n,"user policy")}function vh(e,t){let n=Tt(t),r=Tt(e),o=fh(n,r);if(o!==".."&&!o.startsWith(`..${mh}`)&&!dh(o))return wt(n,"project policy");return wt(Pt(Pt(r)),"project policy")}function dc(e,t){return It(e,t,rc)}var Se=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ut=/^[a-zA-Z][a-zA-Z0-9_-]*$/,dt=256,Y=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),fc=new Set(["python","python3","python2","node","ruby","perl"]),Gr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),Fr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var mc="Rulebook exceeds CC Safety Net's safe validation limits.",pc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function gc(e){if(Ki(e.allowed_commands,Oe.maxAllowedCommands)||Ki(e.rules,Oe.maxRules)||Ki(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ki(e,t){return Array.isArray(e)&&e.length>t}var qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var Yi=64,Zi="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function fe(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Eh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},Xi=new Set(["--init-file","--rcfile"]);function Ji(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let f=t.slice(c+1);if(t[0]==="-"&&(f==="c"||f[0]==="-"&&f.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!Eh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function ve(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&Xi.has(l)&&!s.includes("="))i++;continue}let a=Ji(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Fn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function zr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of xh(e))Fn(n,t);return t.inSingle||t.inDouble}function xh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Fn(s,n)}return t}var Qi=new Set(["rm","find","xargs","parallel"]),Rh=new Set(["git","busybox",...Qi,...Y,...fc,...we]),_h=new Set(["python","node","ruby","perl"]);function hc(e){let t=O(e);return Rh.has(t)||Me(t)}function Me(e){return _h.has(wh(e))}function wh(e){let t=I(e).toLowerCase();return Gr.test(t)?"python":t}function es(e){try{let t=Dr(Ah(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Ih(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ae)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Ah(e){return typeof e==="string"?ec(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function yc(e){let t=new Set;return e.flatMap((n,r)=>{let o=en(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ts=`must be one of ${qi.join(", ")}`,Ph=/^[^/]+\/[^/]+$/,Th=["version","rules","overrides","transparent_wrappers"];function Ih(e){let t=kh(e);return{errors:ns(zh(t,Th,(n)=>n.kind==="custom"),": "," "),sources:Fh(e,t)}}function kh(e){if(!en(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>Yi;return[...e.version===1?[]:[_(["version"],"must be 1")],...Oh(e.rules,t),...Dh(e.overrides),...Wh(e.transparent_wrappers),...t?[]:Nh(e.rules),...en(e.overrides)?Object.keys(e.overrides).filter((n)=>!Ph.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Gh(e.transparent_wrappers)]}function Oh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...Cc(e,Yi)?[_(["rules"],Zi)]:[]];if(t)return[{path:["rules"],message:Zi,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Mh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Cc(e,t){let n=bc(e);return n!==void 0&&!(n<=t)}function Mh(e,t){let n=bc(e);return n!==void 0&&!(n>=t)}function bc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Nh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=sc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Dh(e){if(e===void 0)return[];if(!en(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!en(n))return[_(["overrides",t],'must be "off" or an object')];return[...Lh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||os(n.intent)?[]:[_(["overrides",t,"intent"],ts)]]})}function Lh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...Cc(e,dt)?[_(t,`must be at most ${dt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>dt?[_(t,`must be at most ${dt} characters`)]:[]}function Wh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ut.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Gh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(hc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Fh(e,t){let n=en(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function zh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function ns(e,t,n){return[...new Set(e.map((r)=>{let o=rs(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function rs(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function os(e){return qi.includes(e)}function en(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function vc(e){let t=Uh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Bh=`required non-empty string up to ${dt} characters`,Sc="must be a non-empty array of unique non-empty strings",$h="required non-empty array of non-empty strings";function Uh(e){if(!ft(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!gc(e))return{errors:[mc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...ns(Hh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),pc]:t,ruleNames:new Set(Ec(e).map((n)=>n.toLowerCase()))}}function Ec(e){let t=ft(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=ft(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Hh(e,t){return[...typeof e.name==="string"&&At.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...jh(e.allowed_commands),...Vh(e.rules,t),...Zh(e.tests),...Xh(e),...Jh(e)]}function jh(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ut.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ut.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function Vh(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!ft(n))return[_(["rules",r],"must be an object")];return t?qh(n,["rules",r]):Kh(n,["rules",r])}),...yc(e)]}function Kh(e,t){return[...xc(e.name,t),...Rc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ut.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Br(e.block_args,[...t,"block_args"],"required non-empty array",!1),..._c(e.reason,t),...wc(e.intent,t)]}function qh(e,t){return[...xc(e.name,t),...Rc(e.command,t),..._c(e.reason,t),...wc(e.intent,t),...Yh(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function xc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return At.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function Rc(e,t){return typeof e==="string"&&ut.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function _c(e,t){return typeof e==="string"&&e!==""&&e.length<=dt?[]:[_([...t,"reason"],Bh)]}function wc(e,t){return e===void 0||os(e)?[]:[_([...t,"intent"],ts)]}function Yh(e,t){if(!ft(e))return[_(t,"required object")];return[...Br(e.command_path,[...t,"command_path"],$h,!1),...e.any_args===void 0?[]:Br(e.any_args,[...t,"any_args"],Sc,!0),...e.exclude_args===void 0?[]:Br(e.exclude_args,[...t,"exclude_args"],Sc,!0)]}function Br(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function Zh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!ft(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function Xh(e){if(!Array.isArray(e.tests))return[];let t=new Set(Ec(e));return[...new Set(e.tests.flatMap((n)=>ft(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function Jh(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=ft(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function ft(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Oc(e,t){let n=uc(e,t),r;try{r=tc(n.userConfigTarget,n.projectConfigTarget)}catch(m){if(m instanceof ae)return ay(n,m.message);throw m}let o=es(n.userConfigTarget),i=r?{config:null,errors:[]}:es(n.projectConfigTarget),s=Ic(n.userConfigPath,o.errors),a=Ic(n.projectConfigPath,i.errors),l=new Set,c=o.config?Ac(o.config,$r(n.userConfigPath),"user",n.userScope,l):kc(),u=i.config?Ac(i.config,$r(n.projectConfigPath),"project",n.projectScope,l):kc(),f=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Pc(c.rules,f),...Pc(u.rules,d)],transparent_wrappers:iy(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Tc(f,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?sy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Tc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Ac(e,t,n,r=wt($r($r(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=ey(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let f=u.rulebook;if(o.has(f.name))return s.push(`duplicate active rulebook name "${f.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(f.name),[{rules:Qh(f),rulebook:{source:n,spec:c,name:f.name,version:f.version,rules:f.rules.map((d)=>`${f.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function Qh(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function ey(e,t,n){let r=ty(e),o=dc(t,r),i=ry(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${ny(e)}`]};let s=oy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function ty(e){return Lr(e)?ji(e).name:e}function ny(e){return Lr(e)?`run ${cc} to vendor ${e}`:"create that file or remove that source from the rules config"}function ry(e,t){try{return{content:Dr(Wn(t,e))}}catch(n){if(n instanceof ae)return{error:n.message};throw n}}function oy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:vc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function iy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Pc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Tc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function sy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Ic(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function ay(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function kc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as by,readFileSync as Sy}from"node:fs";var Mc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],is=new Set(Mc.map((e)=>e.id)),Ur=Mc,ly=new Map(Ur.map((e)=>[e.id,e.intent]));function b(e,t){return{id:e,reason:t,intent:ly.get(e)??"manual_only"}}var ss=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Hr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},cy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],uy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],as=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...uy.flatMap((e)=>cy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var jr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Nc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],dy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],ls=Nc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),cs=Nc.flatMap((e)=>dy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),zn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},us=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),ds=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],fy=[...ss,Hr,...as,...ls,...cs,zn,...us,...ds,...jr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Vr=new Set(jr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),fs=new Set(fy.map((e)=>e.id));import{isAbsolute as ms,join as my,normalize as py,sep as Kr}from"node:path";var qr=process.platform==="win32",Dc=/[*?]/;function ps(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(qr?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Dc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Bn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function gs(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Bn(e.trim(),t);if(!ms(n))return"must be an absolute path or start with ~/";return $n(n,t)}function hs(e,t){let n=Lc(e,t);if(n===null)return"must be a non-empty path string";if(!ms(n))return null;if($n(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var gy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",hy="cannot cover the guard's own configuration";function Lc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=qr?n.replaceAll("\\","/"):n;return Bn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function ys(e,t){let n=Lc(e,t);if(n===null)return"must be a non-empty path string";let r=ps(n)?.root??n;if(Dc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!ms(r))return null;if($n(r,t)!==null)return gy;return yy(r,t)?hy:null}function yy(e,t){let n=Yr(e),r=Yr(my(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Kr}`)}function $n(e,t){let n=Yr(e),r=Yr(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Kr)?n:`${n}${Kr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function Yr(e){let t=py(e);if(qr)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(qr?3:1)&&t.endsWith(Kr))t=t.slice(0,-1);return t}var Wc=30,Zr=1,Xr=365;function Gc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Fc=new Set(Ur.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Fc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Fc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function zc(e,t){return Object.freeze(Object.fromEntries(Ur.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Bc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:zc(e,t)})}var $c={standard:0,strict:1,paranoid:2};function jc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:Cs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:Cs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:Cs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Cy(e,t)}}function Cs(e,t){return[...new Set([...e,...t??[]])]}function Cy(e,t){let n=t.safety?.level,r=Or[e.safety.level];return[...n&&$c[n]<$c[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...Jt.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Uc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Uc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Vr.has(o))),...e.destructive_command_protection.enabled?Hc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Hc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Uc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Hc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var vs=new Set(["standard","strict","paranoid"]),Yc={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Wc}};function Zc(e,t){let n=Iy(Qt(e,t),e.home),r=eo(Gn(t.cwd),e.home),o=Ey(r.parsed,e.home),i=Object.keys(o.policy).length>0?jc(n.gui??Yc,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?Ss(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var vy="project policy audit settings are ignored; audit is user scope only";function Ey(e,t){if(!Ee(e))return{policy:{},diagnostics:[]};let n=Ee(e.safety)?e.safety:{},r=Ee(e.workflow)?e.workflow:{},o=Ee(e.destructive_command_protection)?e.destructive_command_protection:{},i=Ee(e.secret_protection)?e.secret_protection:{},s={...vs.has(n.level)?{level:n.level}:{},...Ee(n.overrides)?Vc({overrides:Xc(n.overrides,Jt,["safety","overrides"],kt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:Qr(o.overrides,is,Qc,kt)}:{},...o.allow_paths!==void 0?{allow_paths:nn(o.allow_paths,gs,t,["destructive_command_protection","allow_paths"],kt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:Qr(i.overrides,fs,eu,kt)}:{},...i.deny_paths!==void 0?{deny_paths:nn(i.deny_paths,hs,t,["secret_protection","deny_paths"],kt)}:{},...i.allow_paths!==void 0?{allow_paths:nn(i.allow_paths,ys,t,["secret_protection","allow_paths"],kt)}:{}};return{policy:Vc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[vy]}}function Xc(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],Es));return[]}))}function Vc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var kt=()=>{return},Es="must be a boolean",xs="must be an object if provided",Jc=`must be an integer between ${Zr} and ${Xr}`,Qc={path:["destructive_command_protection","overrides"],label:"destructive command"},eu={path:["secret_protection","overrides"],label:"secret protection"},xy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ry(e,t){let n=[];return{policy:tu(e,t,(o)=>{n.push(o)}),issues:n}}function _y(e,t){return tu(e,t,kt)}function tu(e,t,n){if(!Ee(e))return n(_([],"Config must be an object")),Jr();if(e.version!==1)n(_(["version"],"must be 1"));let r=tn(e.safety,["safety"],["level","overrides"],n),o=tn(r.overrides,["safety","overrides"],Jt,n),i=tn(e.workflow,["workflow"],["worktree_mode"],n),s=tn(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=tn(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=tn(e.audit,["audit"],["retention_days"],n);return nu(e,xy,[],n),{version:1,safety:{level:wy(r.level,n),overrides:Xc(o,Jt,["safety","overrides"],n)},workflow:{worktree_mode:bs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:bs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:Qr(s.overrides,is,Qc,n),allow_paths:nn(s.allow_paths,gs,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:bs(a.enabled,["secret_protection","enabled"],!0,n),overrides:Qr(a.overrides,fs,eu,n),deny_paths:nn(a.deny_paths,hs,t,["secret_protection","deny_paths"],n),allow_paths:nn(a.allow_paths,ys,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Ay(l.retention_days,n)}}}function tn(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(t,xs)),{};return nu(e,n,t,r),e}function nu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function wy(e,t){if(e===void 0)return"standard";if(vs.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function bs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,Es));return n}function Ay(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=Zr&&e<=Xr))t(_(["audit","retention_days"],Jc));return Gc(e)}function Qr(e,t,n,r){if(e===void 0)return{};if(!Ee(e))return r(_(n.path,xs)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function nn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function Ee(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Jr(){return structuredClone(Yc)}function eo(e,t){if(!by(e))return{exists:!1,policy:Jr(),errors:[]};try{let n=Sy(e,"utf-8");if(!n.trim())return{exists:!0,policy:Jr(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Ry(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Ty(i)}`),fallback:Ee(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:Jr(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Py=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[xs,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[Es,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[Jc,`not an integer between ${Zr} and ${Xr}`]]);function Ty(e){let t=rs(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Py.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Iy(e,t){let n=eo(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Ee(r))return{policy:qc(),errors:[]};let o=_y(r,t);return{policy:Ss(o),gui:o,errors:[],levelPresent:Kc(r)}}if(n.parsed===void 0)return{policy:qc(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:Ss(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Kc(n.parsed)}}function Kc(e){let t=Ee(e)&&Ee(e.safety)?e.safety:{};return vs.has(t.level)}function ru(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Vr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function qc(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:ru({}),denyPaths:[],allowPaths:[]}}}function Ss(e){return{safety:ky(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:ru(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function ky(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function ou(e,t){let n=Oc(e,t),r=Zc(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Dy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Ly(o,Oy(n,r),s,r.policyScopes)}function Oy(e,t){let n=Ny(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Wy(e.errors.length>0?My(e.errors):void 0,e.warnings.length>0?_s(e.warnings.join("; ")):void 0,n)}}function My(e){return`${_s(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Ny(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Dy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Ly(e,t,n=Object.freeze({}),r){let o=Rs(structuredClone(e)),i=r?{policyScopes:Rs(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Rs(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Rs(t);return Object.freeze(e)}function Wy(...e){return _s(e.filter((t)=>!!t).join("; "))}function _s(e){return/[.!?]$/.test(e)?e:`${e}.`}function iu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ws(t.fail_closed,e.strict,"strict"),paranoid_rm:ws(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ws(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Bc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Ni({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ws(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}function Un(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Gy=/^[A-Za-z_][A-Za-z0-9_]*=/;function to(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Hn(e){let t=to(e.words[0],"time")?1:0,n=t===1&&to(e.words[t],"-p")?t+1:t,r=t===1&&to(e.words[n],"--")?n+1:n,o=to(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Gy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var mt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function no(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Fy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>me(t)))})}function ro(e,t,n){e.push(n),t.reset()}function oo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function As(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function rn(e,t,n,r,o,i,s){return As({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function me(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Fy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:me(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ps(e,t,n){if(t>=n||au(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!au(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=su(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=su(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ts(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=zy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?By(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function su(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function au(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function zy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function By(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var du=new Set(["&&","||","|","|&"]);function fu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=ao(e,0,e.length,t,{used:0,max:t.maxWords},0);return me({kind:"program",dialect:"posix",source:e,span:n,status:uo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function ao(e,t,n,r,o,i,s){let a=[],l=[],c=no(),u=[],f=()=>{if(c.words.length===0&&c.redirections.length===0)return;let m={start:c.start,end:c.end},p=c.words.map((g)=>g.text);ro(a,c,{kind:"command",dialect:"posix",source:e.slice(m.start,m.end),span:m,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(s&&m===s)return f(),uu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(co(m)){if(m===`
-`||m==="\r"){f();let v=m==="\r"&&e[d+1]===`
-`?d+2:d+1,T=a.at(-1);if(T?.kind!=="connector"||!du.has(T.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,v),span:Object.freeze({start:d,end:v})}));if(u.length>0){let x=Ts(e,v,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=v;continue}d++;continue}if(m==="#"){while(d<n&&e[d]!==`
-`&&e[d]!=="\r")d++;continue}let p=c.start===-1?lC(e,d,n):void 0;if(p){if(ks(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);if(!Is(o))return on(a,l,d,"word-limit",r.maxWords);let v=ao(e,p.braceIndex+1,n,r,o,i+1,"}"),T=v.next,x={start:p.braceIndex+1,end:v.closed?T-1:T},A=lu(e,x,v);if(a.push({kind:"function",name:p.name,span:{start:d,end:T},body:A}),l.push(...v.issues),v.pendingHeredocs.length>0||Vn(v.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...v.pendingHeredocs),v.limited)return so(a,l,v.next);if(!v.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=T;continue}let g=lo(e,d);if(g){if(f(),!Su(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:d,end:d+g.length})})),d+=g.length;continue}if(m===")"){f(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:m,span:{start:d,end:d+1}}),d++;continue}if((m==="("||m==="{"&&Yy(e,d,n))&&c.start===-1){if(ks(a,l),i>=r.maxDepth)return on(a,l,d,"depth-limit",r.maxDepth);let v=m==="("?")":"}",T=ao(e,d+1,n,r,o,i+1,v),x=T.next,A={start:d+1,end:T.closed?x-1:x},q=lu(e,A,T);if(a.push({kind:"group",style:m==="("?"subshell":"brace",span:{start:d,end:x},body:q}),l.push(...T.issues),T.pendingHeredocs.length>0||Vn(T.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...T.pendingHeredocs),T.limited)return so(a,l,T.next);if(!T.closed)l.push({code:m==="("?"unclosed-subshell":"unclosed-brace-group",message:`${m} group is not closed`});d=x;continue}let h=(m==="<"||m===">")&&e[d+1]!=="("?jy(e,d):null;if(h){let v=c.words.at(-1),T=v&&v.span.end===d&&/^[0-9]+$/.test(v.raw)?Number(v.raw):void 0;if(T!==void 0)c.words.pop();let x=T===void 0?d:v?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let q=e[A],X=A>d+h.length&&q==="#",ee=!q||co(q)||!!lo(e,A)||q===s||q===")"||X||(q==="<"||q===">")&&e[A+1]!=="(",J=h==="<<"||h==="<<-",U=J?Ps(e,A,n):void 0,D=U?{word:rn(e,A,U.next,U.delimiter,"literal",U.quoted),nested:[],issues:[],next:U.next,limited:!1}:!ee?Os(e,A,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return so(a,l,D.next);if(!Is(o))return on(a,l,D.next,"word-limit",r.maxWords)}let ue=D?.next??d+h.length,_e={kind:"redirection",operator:h,span:{start:x,end:ue},...T===void 0?{}:{fd:T},...D?{target:D.word}:{}};if(c.redirections.push(_e),J&&!U)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(U){if(U.ambiguous||U.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Ze=c.nested;u.push({delimiter:U.delimiter,quotedDelimiter:U.quoted,stripTabs:h==="<<-",attach:(ke)=>{if(_e.heredoc=ke,ke.quotedDelimiter)return;Ze.push(...Uy(e,ke.bodySpan.start,ke.bodySpan.end,r,o,i+1))}})}if(!J&&!D)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ue,d=ue;continue}if(c.start===-1)ks(a,l);let y=Os(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return so(a,l,y.next);let S=Jy(c.words)?rC(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(S?.limitCode)return on(a,l,y.next,S.limitCode,S.limitCode==="word-limit"?r.maxWords:S.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=S?.words??[y.word];for(let v of E){if(!Is(o))return on(a,l,y.next,"word-limit",r.maxWords);c.words.push(v)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return f(),uu(a,l),l.push(...cC(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function lu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:uo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Os(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],f=[],d=!1;while(a<n){let m=e[a],p=(m==="<"||m===">")&&e[a+1]==="(";if(!m||co(m)||(m===";"||m==="|"||m==="&")&&lo(e,a)||(m==="<"||m===">")&&!p)break;if(m===")")break;if(m==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),f.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(m==='"'){l=!0;let h=$y(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),f.push(...h.issues),d||=h.limited,c=jn(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=Vy(e,a+2,n);if(s+=h.text,f.push(...h.issues),!h.closed)f.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(m==="\\"){let h=e[a+1];if(!h){f.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let g=m==="$"||m==="<"||m===">"||m==="`"?fo(e,a,n,r,o,i):null;if(g){let h=mu(g,u,f);if(d||=h.limited,c=jn(c,h.provenance),a=h.next,d)break;continue}if(m==="$"){let h=hu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(m==="*"||m==="?"||m==="[")c=jn(c,"glob");s+=m,a++}return{word:rn(e,t,a,s,c,l,c==="literal"?void 0:qy(e,t,a)),nested:u,issues:f,next:a,limited:d}}function $y(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,f=t+1;while(f<n){let d=e[f];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:f+1,limited:u};if(d==="\\"&&e[f+1]){let p=e[f+1]??"";if(p===`
-`){f+=2;continue}if(p==="\r"&&e[f+2]===`
-`){f+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,f+=2;continue}if(e.startsWith("$((",f)){let p=Ms(e,f+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(f,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});f=g;continue}let m=fo(e,f,n,r,o,i);if(m){let p=mu(m,l,c);if(f=p.next,u||=p.limited,a=jn(a,p.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:f,limited:u};continue}if(d==="$"){let p=hu(e,f,n,s,a);s=p.text,a=p.provenance,f=p.next;continue}s+=d??"",f++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function fo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,f=s?"))":c?"`":")",d=Ms(e,t+u,n,f),m=d===-1?n:d,p=d===-1?n:d+f.length;if(i>=r.maxDepth)return{program:aC(e,t+u,m,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let S=[],E=[],v=!1,T=t+u;while(T<m){let x=fo(e,T,m,r,o,i+1);if(!x){T++;continue}if(S.push(...x.program.nodes),E.push(...x.program.issues),v||=x.program.status==="limited",T=x.next,v)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:uo(E,v),issues:E,nodes:S}),next:p,provenance:"arithmetic"}}let g=ao(e,t+u,m,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Vn(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:me({kind:"program",dialect:"posix",source:e.slice(t+u,m),span:{start:t+u,end:m},status:uo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function Uy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?fo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function mu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Ms(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`)}function Rl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Dn(e={}){return{reason:Mn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Up={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...Up[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function _l(e){return $p({...e,redact:mt})}function wl(e){return mt(e instanceof Error?e.message:String(e))}import{isAbsolute as Oi,relative as yg,resolve as Kl,sep as Cg}from"node:path";import{basename as Tl,dirname as Hp,isAbsolute as jp,join as Vp,normalize as Kp,resolve as Al}from"node:path";var qp=256,Dr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Se(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function Qe(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Ai(e,t){return Ri(e,0,t)}function Ri(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=_i(e,o+2),a=Yp(e,o,t);if(a===null){if(Dr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Zp(l,t,n),o=a+1;continue}let i=_i(e,o+1);if(!i){r+="$",o++;continue}r+=wi(i,n)??`$${i}`,o+=i.length+1}return r}function Yp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Zp(e,t,n){let r=e.slice(2,-1),o=_i(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return wi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Dr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Dr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=wi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ri(i.slice(s.length),t+1,n);return l?Ri(i.slice(s.length),t+1,n):""}function _i(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function wi(e,t){if(!Dr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function N(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Il(n,i);let s=t.realpath(i);if(s!==null)return Pl(n,e,s,o);let a=Hp(i);if(a===i||o.length>=qp)return Pl(n,e,i,o);o.push(Tl(i)),i=a}}function Pl(e,t,n,r){let o=r.length===0?n:Vp(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Xp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Il(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Il(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ae(e,t,n,r){let o=Ol(e,t,n);if(!o)return"";return N(o,n.paths,r).replace(/\\/g,"/")}function kl(e,t,n,r,o){let i=Ol(e,t,n);if(!i)return null;if(o(Tl(i)))return N(i,n.paths,r).replace(/\\/g,"/");let s=Xp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Ol(e,t,n){let r=n.home,o=Ai(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Al(r,o.slice(2)):o,s=Se(i);return Kp(jp(s)?s:Al(t,s))}import{types as Jp}from"node:util";var Qp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),eg=new Set(["command","diff","input","patch","patchtext"]),Ml=new TextEncoder,tg=new TextDecoder,ng=/\s/,rg=64;class et extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Nn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function og(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Lr(e){return Qp.has(og(e))}function Wn(e){if(!e||typeof e!=="object")return;Hl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Gl(e,t){return Fl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Fl(e,t,n,r){let o=Ul(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=Fl(a,t,n,r+1);return typeof a==="string"&&t.has(zl(s))?[a]:l});return n.ancestors.delete(o.object),i}function zl(e){return e.replace(/-/g,"_").toLowerCase()}function Bl(e){return $l(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(sg)}function $l(e,t,n,r){let o=Ul(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>$l(a,o.array?t:eg.has(zl(s)),n,r+1));return n.ancestors.delete(o.object),i}function ig(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Nn.maxDepth||t.nodes>Nn.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Nn.maxStringBytes||t.stringBytes>Nn.maxAggregateStringBytes)Ke()}function Ul(e,t,n){if(ig(e,t,n),!e||typeof e!=="object")return null;let r=Hl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Nn.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Hl(e){if(Jp.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new et}function sg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=ag(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Pi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Pi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...Ii(Nr(c.slice(4),!0),Nr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Pi(c))}return t}function ag(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Pi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Wl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Wl(n[1]);if(e.startsWith("diff --git "))return lg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Ll(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Ll(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return gg(i[1]);return[]}function lg(e){let t=cg(e);if(t.length===2&&t[0]&&t[1])return Ii(t[0],t[1]);let n=ug(e);return n?Ii(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function cg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Tt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Tt(e[n]))n++;t.push(e.slice(i,n));continue}let o=jl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Tt(e[n]))n++;return n===e.length?t:[]}function ug(e){let t=0;while(t<e.length&&Tt(e[t]))t++;let n=e.length;while(n>t&&Tt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Tt(e[o])){o++;continue}let i=o;while(o<n&&Tt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>rg)Ke();if(dg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function dg(e,t,n,r,o){if(Ti(e,t,n,r,o))return!0;let i=Dl(e,"/",t,n),s=Dl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Ti(e,t,i,r,s))return!1;return Ti(e,i+1,n,s+1,o)}function Ti(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Dl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Tt(e){return e!==void 0&&ng.test(e)}function jl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:tg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Ml.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Ml.encode(mg(s[0]??""))),o+=2}return null}function mg(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function fg(e){return Ln(hg(e))}function Ii(e,t){if(e==="/dev/null")return Nl(t);if(t==="/dev/null")return Nl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Ln);let n=pg(e,t)??(e===t?Vl(e):null);return[e,t,...n?[n]:[]].flatMap(Ln)}function Nl(e){let t=Vl(e);return[e,...t?[t]:[]].flatMap(Ln)}function Vl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function pg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Ll(e){return fg(Nr(e,!0))}function gg(e){return Ln(Nr(e,!1))}function Nr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=jl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function hg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Ln(e){return e===""||e==="/dev/null"?[]:[e]}function Wl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}function Mi(e,t,n){if(Qe(e))return;let r=t.flatMap((i)=>ki(i,n));if(!r[0])return;let o=ki(Oi(e)?e:Kl(r[0],e),n)[0];if(!o)return;return r.some((i)=>Sg(o,i))?o:void 0}function bg(e,t,n){if(Qe(e))return;return ki(Oi(e)?e:Kl(t,e),n)[0]}function ql(e,t,n){return bg(e,t,n)?"outside-workspace":"unusable"}function ki(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Sg(e,t){let n=yg(t,e);return n===""||n!==".."&&!n.startsWith(`..${Cg}`)&&!Oi(n)}function Gn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as qg,realpathSync as Yg,statSync as Zg}from"node:fs";import{homedir as Xg,tmpdir as Jg}from"node:os";import{statSync as jg}from"node:fs";import{join as Vg}from"node:path";import{spawnSync as vg}from"node:child_process";import{existsSync as zn,lstatSync as Eg,readFileSync as Bn,realpathSync as en,statSync as Fn}from"node:fs";import{dirname as Di,isAbsolute as Ni,join as tn,resolve as Wr}from"node:path";var xg=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Rg=5000;function Zl(e,t=Bg(),n=Rg){let r=_g(e),o=r===null?null:wg(r);if(r===null||o===null)return null;let i=Fg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function _g(e){try{let t=en(Wr(e));return Fn(t).isDirectory()?t:null}catch{return null}}function wg(e){let t=Gg(e);if(!t)return null;try{let n=Eg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Li(t);if(!r?.commonDir)return null;if(!Tg(r.gitDir,t))return null;return Ig(r.gitDir,Di(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Li(e){try{let t=Ag(e);if(!t)return null;let n=en(Ni(t)?t:Wr(Di(e),t));if(!Fn(n).isDirectory())return null;return{gitDir:n,commonDir:Pg(n)}}catch{return null}}function Ag(e){let t=Bn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Pg(e){try{let t=Bn(tn(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=en(Ni(t)?t:Wr(e,t));return Fn(n).isDirectory()?n:null}catch{return null}}function Tg(e,t){let n=kg(e);return n===null?!1:Xl(e,n,t)}function Ig(e,t){let n=Og(e);return n===null?!0:Xl(e,n,t)}function kg(e){let t=tn(e,"gitdir");if(!zn(t))return null;let n=Bn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Og(e){let t=tn(e,"config.worktree");return zn(t)?Dg(t):null}function Xl(e,t,n){try{return Mg(Ni(t)?t:Wr(e,t),n)}catch{return!1}}function Mg(e,t){try{let n=Fn(e),r=Fn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Yl(en.native(e))===Yl(en.native(t))}function Yl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Dg(e){let t=Bn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Ng(s[1]??"")}return r}function Ng(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Wg(t.slice(1,-1))}var Lg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Wg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Lg[n]??t)}function Gg(e){try{return Wi(en(e))}catch{return null}}function Wi(e){let t=e;while(!0){let n=tn(t,".git");if(zn(n))return n;let r=Di(t);if(r===t)return null;t=r}}function Fg(e,t,n,r){if(zg(t))return!0;if(n===null)return!0;let o=vg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:$g(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Jl(o.stdout.trim())}function zg(e){return[tn(e.commonDir,"config"),tn(e.gitDir,"config.worktree")].filter((t)=>zn(t)).some((t)=>Ug(t))}function Bg(){return xg.find((e)=>zn(e))??null}function $n(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function $g(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!$n(t)))}function Ug(e){let t;try{t=Bn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Hg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Jl(c)}return r}function Hg(e){return e==="include"||e.startsWith("includeif ")}function Jl(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function Ql(e,t){if(e==="")return null;let n=be(),r=Wi(ae(e,e,t,n)),o=r?Kg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Kg(e,t,n,r){try{let o=ae(e,t,n,r),i=jg(e),s=i.isFile()?o:null,a=i.isFile()?Li(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((u)=>u?[nn(ae(u,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[nn(e.replace(/\\/g,"/")),...l]:l)];return{entry:nn(o),markerFile:s?nn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((u)=>{let m=nn(Vg(u,"hooks").replace(/\\/g,"/"));return[m,nn(ae(m,t,n,r))]}))]}}catch{return null}}function nn(e){return process.platform==="win32"?e.toLowerCase():e}var Qg={realpath:(e)=>{try{return Yg(e)}catch{return null}},entryKind:(e)=>{let t=qg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Zg(e).isDirectory()}catch{return!1}}};function tc(){return eh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Se(process.env.HOME||Xg()),tmpdir:Jg(),paths:Qg})}function eh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>ec(n,i,()=>Ql(i,o)),worktreeFacts:(i)=>ec(r,i,()=>Zl(i)),...t};return o}function ec(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var rn=["fail_closed","paranoid_rm","paranoid_interpreters"],Gr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Fr=["standard","strict","paranoid"];function th(e,t){if(!t)return e;return Fr.indexOf(t)>Fr.indexOf(e)?t:e}function nh(e){let t=Bi(ee.level,e);if(t===void 0||t==="")return;if(Fr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Fr.join(", ")}.`);return}function rh(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function nc(e){return rh(Bi(ee.auditScope,e))==="all"}function Fi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function zi(e={},t){let n=e.safety?.level??"standard",r=nh(t),o=th(n,r),i=Gr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(It(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(It(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(It(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(It(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||It(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Fi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function It(e,t){let n=typeof e==="string"?Gi(e,t):Bi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Gi(e,t){return t.get(e)}function Bi(e,t){let n=Gi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Gi(e.legacyName,t);return}import{dirname as qr}from"node:path";import{closeSync as oh,constants as rc,fstatSync as ih,fsyncSync as $P,lstatSync as Hi,mkdirSync as UP,openSync as sh,readdirSync as HP,readFileSync as ah,realpathSync as ji,renameSync as jP,rmdirSync as VP,statSync as lh,unlinkSync as KP,writeFileSync as qP}from"node:fs";import{isAbsolute as oc,join as Vi,normalize as ch,parse as Ui,relative as Ki,resolve as qi,sep as Yi}from"node:path";function $i(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var uh=Symbol("PolicyFilesystemScope"),dh=Symbol("PolicyFilesystemTarget"),mh=rc.O_NOFOLLOW??0;class le extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function kt(e,t){return{[uh]:!0,root:qi(e),label:t}}function ic(e,t){let n=ch(t);if(t===""||oc(t)||n===".."||n.startsWith(`..${Yi}`))throw new le(e.label);return{[dh]:!0,scope:e,relativePath:n,path:Vi(e.root,n)}}function Un(e,t){return ic(e,Ki(e.root,qi(t)))}function sc(e,t="rules policy"){let n=qi(e),r=Ui(n).dir;return ic(kt(r,t),Ki(r,n))}function Br(e){return lc(e.scope.label,()=>{if(!zr(e))return null;let t=sh(e.path,rc.O_RDONLY|mh);return fh(t,()=>{let n=ih(t);if(!n.isFile())throw new le(e.scope.label);let r=ah(t,"utf-8"),o=Hi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new le(e.scope.label);return zr(e),r})})}function ac(e,t){if(e.path===t.path)return!0;return lc(e.scope.label,()=>{if(!zr(e)||!zr(t))return!1;let n=(r)=>Vi(ji(Ui(r).dir),Ui(r).base);return n(e.path)===n(t.path)})}function lc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof le)throw r;throw new le(e)}}function fh(e,t){try{return t()}finally{oh(e)}}function zr(e,t="file"){let n=ph(e.scope);if(!n)return!1;let r=e.relativePath.split(Yi);for(let o of r.keys()){let i=Vi(e.scope.root,...r.slice(0,o+1)),s=Hi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new le(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new le(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new le(e.scope.label);gh(n,ji(i),e.scope.label)}return!0}function ph(e){if(!Hi(e.root,{throwIfNoEntry:!1}))return null;if(!lh(e.root).isDirectory())throw new le(e.label);return ji(e.root)}function gh(e,t,n){let r=Ki(e,t);if(r===".."||r.startsWith(`..${Yi}`)||oc(r))throw new le(n)}import{dirname as Mt,isAbsolute as Sh,join as Nt,relative as vh,resolve as Dt,sep as Eh}from"node:path";var Ot=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,cc="rulebook.json",uc=".cc-safety-net/rules";var dc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var hh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,yh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Ch="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),JP=new RegExp(`^${yh}/(${Ot.source.slice(1,-1)})/${Ch}$`);function bh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function mc(e){if($r(e))try{return Zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Ot.test(e)?null:`Local rulebook sources must be bare names matching ${Ot}: ${e}`}function Zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(dc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!hh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Ot.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:bh(o),name:o}}function $r(e){return dc.test(e)}var fc="rule.json",Ur="policy.json",pc=".cc-safety-net",xh="rules",Rh="CC_SAFETY_NET_HOME",gc="`cc-safety-net rule update`";function _h(e){return Dt(e,uc)}function wh(e){return Nt(_h(e),fc)}function Hn(e){return Nt(Dt(e),pc,Ur)}function Xi(e,t={}){return t.userConfigDir??(t.userConfigPath?Mt(t.userConfigPath):Nt(Ah(e),xh))}function Ah(e){let t=e.env.get(Rh);return t?Dt(Se(t)):Nt(e.home,pc)}function Ph(e,t={}){return Nt(Xi(e,t),fc)}function on(e,t={}){return Nt(Mt(Xi(e,t)),Ur)}function hc(e,t){let n=t.userConfigPath??Ph(e,t),r=t.projectConfigPath??wh(t.cwd),o=Th(e,t),i=Ih(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Un(o,n),projectConfigTarget:Un(i,r)}}function Th(e,t){let n=t.userConfigPath?Mt(Mt(Dt(t.userConfigPath))):Mt(Dt(t.userConfigDir??Xi(e,t)));return kt(n,"user policy")}function Ih(e,t){let n=Dt(t),r=Dt(e),o=vh(n,r);if(o!==".."&&!o.startsWith(`..${Eh}`)&&!Sh(o))return kt(n,"project policy");return kt(Mt(Mt(r)),"project policy")}function yc(e,t){return Nt(e,t,cc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ft=/^[a-zA-Z][a-zA-Z0-9_-]*$/,pt=256,q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Cc=new Set(["python","python3","python2","node","ruby","perl"]),Hr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),jr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var bc="Rulebook exceeds CC Safety Net's safe validation limits.",Sc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function vc(e){if(Ji(e.allowed_commands,Oe.maxAllowedCommands)||Ji(e.rules,Oe.maxRules)||Ji(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ji(e,t){return Array.isArray(e)&&e.length>t}var Qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var es=64,ts="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var kh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ns=new Set(["--init-file","--rcfile"]);function rs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let u=t[c];if(u===void 0)break;if(e==="ksh"&&u==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&u==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&u==="o"&&c+1<t.length)break;if(r==="startup"&&u==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&u==="c")s=!0;if(r==="argv"&&u==="n")l=t[0]==="-";if(r==="argv"&&u==="s")a=t[0]==="-";if(!kh[e]?.includes(u))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ee(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ns.has(l)&&!s.includes("="))i++;continue}let a=rs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function jn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Vr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Oh(e))jn(n,t);return t.inSingle||t.inDouble}function Oh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);jn(s,n)}return t}var os=new Set(["rm","find","xargs","parallel"]),Mh=new Set(["git","busybox",...os,...q,...Cc,...we]),Dh=new Set(["python","node","ruby","perl"]);function Ec(e){let t=O(e);return Mh.has(t)||Me(t)}function Me(e){return Dh.has(Nh(e))}function Nh(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function is(e){try{let t=Br(Lh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Fh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof le)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Lh(e){return typeof e==="string"?sc(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function xc(e){let t=new Set;return e.flatMap((n,r)=>{let o=sn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ss=`must be one of ${Qi.join(", ")}`,Wh=/^[^/]+\/[^/]+$/,Gh=["version","rules","overrides","transparent_wrappers"];function Fh(e){let t=zh(e);return{errors:as(Yh(t,Gh,(n)=>n.kind==="custom"),": "," "),sources:qh(e,t)}}function zh(e){if(!sn(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>es;return[...e.version===1?[]:[_(["version"],"must be 1")],...Bh(e.rules,t),...Hh(e.overrides),...Vh(e.transparent_wrappers),...t?[]:Uh(e.rules),...sn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Wh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Kh(e.transparent_wrappers)]}function Bh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),...Rc(e,es)?[_(["rules"],ts)]:[]];if(t)return[{path:["rules"],message:ts,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...$h(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function Rc(e,t){let n=_c(e);return n!==void 0&&!(n<=t)}function $h(e,t){let n=_c(e);return n!==void 0&&!(n>=t)}function _c(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Uh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=mc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Hh(e){if(e===void 0)return[];if(!sn(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!sn(n))return[_(["overrides",t],'must be "off" or an object')];return[...jh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||cs(n.intent)?[]:[_(["overrides",t,"intent"],ss)]]})}function jh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),...Rc(e,pt)?[_(t,`must be at most ${pt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>pt?[_(t,`must be at most ${pt} characters`)]:[]}function Vh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ft.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Kh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Ec(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function qh(e,t){let n=sn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Yh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function as(e,t,n){return[...new Set(e.map((r)=>{let o=ls(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ls(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function cs(e){return Qi.includes(e)}function sn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Ac(e){let t=Jh(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Zh=`required non-empty string up to ${pt} characters`,wc="must be a non-empty array of unique non-empty strings",Xh="required non-empty array of non-empty strings";function Jh(e){if(!gt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!vc(e))return{errors:[bc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...as(Qh(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),Sc]:t,ruleNames:new Set(Pc(e).map((n)=>n.toLowerCase()))}}function Pc(e){let t=gt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=gt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function Qh(e,t){return[...typeof e.name==="string"&&Ot.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...ey(e.allowed_commands),...ty(e.rules,t),...iy(e.tests),...sy(e),...ay(e)]}function ey(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ft.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function ty(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!gt(n))return[_(["rules",r],"must be an object")];return t?ry(n,["rules",r]):ny(n,["rules",r])}),...xc(e)]}function ny(e,t){return[...Tc(e.name,t),...Ic(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ft.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Kr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...kc(e.reason,t),...Oc(e.intent,t)]}function ry(e,t){return[...Tc(e.name,t),...Ic(e.command,t),...kc(e.reason,t),...Oc(e.intent,t),...oy(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Tc(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return Ot.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function Ic(e,t){return typeof e==="string"&&ft.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function kc(e,t){return typeof e==="string"&&e!==""&&e.length<=pt?[]:[_([...t,"reason"],Zh)]}function Oc(e,t){return e===void 0||cs(e)?[]:[_([...t,"intent"],ss)]}function oy(e,t){if(!gt(e))return[_(t,"required object")];return[...Kr(e.command_path,[...t,"command_path"],Xh,!1),...e.any_args===void 0?[]:Kr(e.any_args,[...t,"any_args"],wc,!0),...e.exclude_args===void 0?[]:Kr(e.exclude_args,[...t,"exclude_args"],wc,!0)]}function Kr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function iy(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!gt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function sy(e){if(!Array.isArray(e.tests))return[];let t=new Set(Pc(e));return[...new Set(e.tests.flatMap((n)=>gt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function ay(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=gt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function gt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Gc(e,t){let n=hc(e,t),r;try{r=ac(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof le)return hy(n,f.message);throw f}let o=is(n.userConfigTarget),i=r?{config:null,errors:[]}:is(n.projectConfigTarget),s=Lc(n.userConfigPath,o.errors),a=Lc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Mc(o.config,qr(n.userConfigPath),"user",n.userScope,l):Wc(),u=i.config?Mc(i.config,qr(n.projectConfigPath),"project",n.projectScope,l):Wc(),m=o.config?.overrides??{},d=i.config?.overrides??{};return{rules:[...Dc(c.rules,m),...Dc(u.rules,d)],transparent_wrappers:py(o.config,i.config),rulebooks:[...c.rulebooks,...u.rulebooks],errors:[...s,...a,...c.errors,...u.errors],warnings:[...c.warnings,...u.warnings,...c.canValidateOverrides?Nc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?gy(d,c.knownRuleIds,n.projectConfigPath):[],...u.canValidateOverrides?Nc(d,u.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Mc(e,t,n,r=kt(qr(qr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let u=cy(c,t,r);if(u.errors.length>0||!u.rulebook)return i.push(...u.errors),[];let m=u.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:ly(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((d)=>`${m.name}/${d.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function ly(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function cy(e,t,n){let r=uy(e),o=yc(t,r),i=my(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${dy(e)}`]};let s=fy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function uy(e){return $r(e)?Zi(e).name:e}function dy(e){return $r(e)?`run ${gc} to vendor ${e}`:"create that file or remove that source from the rules config"}function my(e,t){try{return{content:Br(Un(t,e))}}catch(n){if(n instanceof le)return{error:n.message};throw n}}function fy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Ac(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function py(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Dc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Nc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function gy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Lc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function hy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Wc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Py,readFileSync as Ty}from"node:fs";var Fc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],us=new Set(Fc.map((e)=>e.id)),Yr=Fc,yy=new Map(Yr.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:yy.get(e)??"manual_only"}}var ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Cy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],by=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ms=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...by.flatMap((e)=>Cy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Xr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],zc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Sy=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],fs=zc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ps=zc.flatMap((e)=>Sy.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Vn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),hs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],vy=[...ds,Zr,...ms,...fs,...ps,Vn,...gs,...hs,...Xr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Jr=new Set(Xr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ys=new Set(vy.map((e)=>e.id));import{isAbsolute as Cs,join as Ey,normalize as xy,sep as Qr}from"node:path";var eo=process.platform==="win32",Bc=/[*?]/;function bs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(eo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Bc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Kn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Kn(e.trim(),t);if(!Cs(n))return"must be an absolute path or start with ~/";return qn(n,t)}function vs(e,t){let n=$c(e,t);if(n===null)return"must be a non-empty path string";if(!Cs(n))return null;if(qn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Ry="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",_y="cannot cover the guard's own configuration";function $c(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=eo?n.replaceAll("\\","/"):n;return Kn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=$c(e,t);if(n===null)return"must be a non-empty path string";let r=bs(n)?.root??n;if(Bc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Cs(r))return null;if(qn(r,t)!==null)return Ry;return wy(r,t)?_y:null}function wy(e,t){let n=to(e),r=to(Ey(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Qr}`)}function qn(e,t){let n=to(e),r=to(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Qr)?n:`${n}${Qr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function to(e){let t=xy(e);if(eo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(eo?3:1)&&t.endsWith(Qr))t=t.slice(0,-1);return t}var Uc=30,no=1,ro=365;function Hc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var jc=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(jc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(jc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Vc(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Kc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Vc(e,t)})}var qc={standard:0,strict:1,paranoid:2};function Xc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:xs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:xs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:xs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ay(e,t)}}function xs(e,t){return[...new Set([...e,...t??[]])]}function Ay(e,t){let n=t.safety?.level,r=Gr[e.safety.level];return[...n&&qc[n]<qc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...rn.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Yc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Yc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Jr.has(o))),...e.destructive_command_protection.enabled?Zc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Zc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Yc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Zc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var ws=new Set(["standard","strict","paranoid"]),tu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Uc}};function nu(e,t){let n=Fy(on(e,t),e.home),r=so(Hn(t.cwd),e.home),o=ky(r.parsed,e.home),i=Object.keys(o.policy).length>0?Xc(n.gui??tu,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?_s(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Iy="project policy audit settings are ignored; audit is user scope only";function ky(e,t){if(!xe(e))return{policy:{},diagnostics:[]};let n=xe(e.safety)?e.safety:{},r=xe(e.workflow)?e.workflow:{},o=xe(e.destructive_command_protection)?e.destructive_command_protection:{},i=xe(e.secret_protection)?e.secret_protection:{},s={...ws.has(n.level)?{level:n.level}:{},...xe(n.overrides)?Jc({overrides:ru(n.overrides,rn,["safety","overrides"],Lt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:io(o.overrides,us,iu,Lt)}:{},...o.allow_paths!==void 0?{allow_paths:ln(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Lt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:io(i.overrides,ys,su,Lt)}:{},...i.deny_paths!==void 0?{deny_paths:ln(i.deny_paths,vs,t,["secret_protection","deny_paths"],Lt)}:{},...i.allow_paths!==void 0?{allow_paths:ln(i.allow_paths,Es,t,["secret_protection","allow_paths"],Lt)}:{}};return{policy:Jc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Iy]}}function ru(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],As));return[]}))}function Jc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Lt=()=>{return},As="must be a boolean",Ps="must be an object if provided",ou=`must be an integer between ${no} and ${ro}`,iu={path:["destructive_command_protection","overrides"],label:"destructive command"},su={path:["secret_protection","overrides"],label:"secret protection"},Oy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function My(e,t){let n=[];return{policy:au(e,t,(o)=>{n.push(o)}),issues:n}}function Dy(e,t){return au(e,t,Lt)}function au(e,t,n){if(!xe(e))return n(_([],"Config must be an object")),oo();if(e.version!==1)n(_(["version"],"must be 1"));let r=an(e.safety,["safety"],["level","overrides"],n),o=an(r.overrides,["safety","overrides"],rn,n),i=an(e.workflow,["workflow"],["worktree_mode"],n),s=an(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=an(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=an(e.audit,["audit"],["retention_days"],n);return lu(e,Oy,[],n),{version:1,safety:{level:Ny(r.level,n),overrides:ru(o,rn,["safety","overrides"],n)},workflow:{worktree_mode:Rs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Rs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:io(s.overrides,us,iu,n),allow_paths:ln(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Rs(a.enabled,["secret_protection","enabled"],!0,n),overrides:io(a.overrides,ys,su,n),deny_paths:ln(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:ln(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Ly(l.retention_days,n)}}}function an(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(t,Ps)),{};return lu(e,n,t,r),e}function lu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Ny(e,t){if(e===void 0)return"standard";if(ws.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Rs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,As));return n}function Ly(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=no&&e<=ro))t(_(["audit","retention_days"],ou));return Hc(e)}function io(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function ln(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function xe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function oo(){return structuredClone(tu)}function so(e,t){if(!Py(e))return{exists:!1,policy:oo(),errors:[]};try{let n=Ty(e,"utf-8");if(!n.trim())return{exists:!0,policy:oo(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=My(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${Gy(i)}`),fallback:xe(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:oo(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Wy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[ou,`not an integer between ${no} and ${ro}`]]);function Gy(e){let t=ls(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Wy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Fy(e,t){let n=so(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!xe(r))return{policy:eu(),errors:[]};let o=Dy(r,t);return{policy:_s(o),gui:o,errors:[],levelPresent:Qc(r)}}if(n.parsed===void 0)return{policy:eu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:_s(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:Qc(n.parsed)}}function Qc(e){let t=xe(e)&&xe(e.safety)?e.safety:{};return ws.has(t.level)}function cu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Jr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function eu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:cu({}),denyPaths:[],allowPaths:[]}}}function _s(e){return{safety:zy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:cu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function zy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function uu(e,t){let n=Gc(e,t),r=nu(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((u)=>u.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Hy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return jy(o,By(n,r),s,r.policyScopes)}function By(e,t){let n=Uy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Vy(e.errors.length>0?$y(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function $y(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Uy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Hy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function jy(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function Vy(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function du(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Kc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Fi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as VR,isAbsolute as KR,join as qR,parse as YR,resolve as ZR,sep as XR}from"node:path";function Yn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Ky=/^[A-Za-z_][A-Za-z0-9_]*=/;function ao(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Zn(e){let t=ao(e.words[0],"time")?1:0,n=t===1&&ao(e.words[t],"-p")?t+1:t,r=t===1&&ao(e.words[n],"--")?n+1:n,o=ao(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Ky.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ht=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function lo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function qy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function co(e,t,n){e.push(n),t.reset()}function uo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function cn(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return qy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||fu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!fu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=mu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=mu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Yy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Zy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function mu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function fu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Yy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Zy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var yu=new Set(["&&","||","|","|&"]);function Cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=po(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:yo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function po(e,t,n,r,o,i,s){let a=[],l=[],c=lo(),u=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);co(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(s&&f===s)return m(),hu(a,l),{nodes:a,issues:l,next:d+1,closed:!0,limited:!1,pendingHeredocs:u};if(ho(f)){if(f===`
+`||f==="\r"){m();let C=f==="\r"&&e[d+1]===`
+`?d+2:d+1,P=a.at(-1);if(P?.kind!=="connector"||!yu.has(P.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(d,C),span:Object.freeze({start:d,end:C})}));if(u.length>0){let x=Ds(e,C,n,u.splice(0));l.push(...x.issues),d=x.next;continue}d=C;continue}d++;continue}if(f==="#"){while(d<n&&e[d]!==`
+`&&e[d]!=="\r")d++;continue}let g=c.start===-1?yC(e,d,n):void 0;if(g){if(Ls(a,l),i>=r.maxDepth)return un(a,l,d,"depth-limit",r.maxDepth);if(!Ns(o))return un(a,l,d,"word-limit",r.maxWords);let C=po(e,g.braceIndex+1,n,r,o,i+1,"}"),P=C.next,x={start:g.braceIndex+1,end:C.closed?P-1:P},A=pu(e,x,C);if(a.push({kind:"function",name:g.name,span:{start:d,end:P},body:A}),l.push(...C.issues),C.pendingHeredocs.length>0||Jn(C.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(u.push(...C.pendingHeredocs),C.limited)return fo(a,l,C.next);if(!C.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});d=P;continue}let p=go(e,d);if(p){if(m(),!wu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:d,end:d+p.length})})),d+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:d,end:d+1}}),d++;continue}if((f==="("||f==="{"&&oC(e,d,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return un(a,l,d,"depth-limit",r.maxDepth);let C=f==="("?")":"}",P=po(e,d+1,n,r,o,i+1,C),x=P.next,A={start:d+1,end:P.closed?x-1:x},Y=pu(e,A,P);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:d,end:x},body:Y}),l.push(...P.issues),P.pendingHeredocs.length>0||Jn(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(u.push(...P.pendingHeredocs),P.limited)return fo(a,l,P.next);if(!P.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});d=x;continue}let h=(f==="<"||f===">")&&e[d+1]!=="("?eC(e,d):null;if(h){let C=c.words.at(-1),P=C&&C.span.end===d&&/^[0-9]+$/.test(C.raw)?Number(C.raw):void 0;if(P!==void 0)c.words.pop();let x=P===void 0?d:C?.span.start??d;c.start=c.start===-1?d:c.start;let A=d+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let Y=e[A],ke=A>d+h.length&&Y==="#",je=!Y||ho(Y)||!!go(e,A)||Y===s||Y===")"||ke||(Y==="<"||Y===">")&&e[A+1]!=="(",de=h==="<<"||h==="<<-",j=de?Ms(e,A,n):void 0,G=j?{word:cn(e,A,j.next,j.delimiter,"literal",j.quoted),nested:[],issues:[],next:j.next,limited:!1}:!je?Ws(e,A,n,r,o,i):void 0;if(G){if(l.push(...G.issues),G.limited)return fo(a,l,G.next);if(!Ns(o))return un(a,l,G.next,"word-limit",r.maxWords)}let J=G?.next??d+h.length,X={kind:"redirection",operator:h,span:{start:x,end:J},...P===void 0?{}:{fd:P},...G?{target:G.word}:{}};if(c.redirections.push(X),de&&!j)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(j){if(j.ambiguous||j.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Q=c.nested;u.push({delimiter:j.delimiter,quotedDelimiter:j.quoted,stripTabs:h==="<<-",attach:(Ce)=>{if(X.heredoc=Ce,Ce.quotedDelimiter)return;Q.push(...Jy(e,Ce.bodySpan.start,Ce.bodySpan.end,r,o,i+1))}})}if(!de&&!G)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(G)c.nested.push(...G.nested);c.end=J,d=J;continue}if(c.start===-1)Ls(a,l);let y=Ws(e,d,n,r,o,i);if(l.push(...y.issues),y.limited)return fo(a,l,y.next);let v=aC(c.words)?mC(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return un(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let C of E){if(!Ns(o))return un(a,l,y.next,"word-limit",r.maxWords);c.words.push(C)}c.start=c.start===-1?d:c.start,c.end=y.next,c.nested.push(...y.nested),d=y.next>d?y.next:d+1}return m(),hu(a,l),l.push(...CC(u)),{nodes:a,issues:l,next:d,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function pu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:yo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",u=[],m=[],d=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ho(f)||(f===";"||f==="|"||f==="&")&&go(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=Xy(e,a,n,r,o,i);if(s+=h.text,u.push(...h.nested),m.push(...h.issues),d||=h.limited,c=Xn(c,h.provenance),a=h.next,d)break;continue}if(e.startsWith("$'",a)){l=!0;let h=tC(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let p=f==="$"||f==="<"||f===">"||f==="`"?Co(e,a,n,r,o,i):null;if(p){let h=bu(p,u,m);if(d||=h.limited,c=Xn(c,h.provenance),a=h.next,d)break;continue}if(f==="$"){let h=Eu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Xn(c,"glob");s+=f,a++}return{word:cn(e,t,a,s,c,l,c==="literal"?void 0:rC(e,t,a)),nested:u,issues:m,next:a,limited:d}}function Xy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],u=!1,m=t+1;while(m<n){let d=e[m];if(d==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:u};if(d==="\\"&&e[m+1]){let g=e[m+1]??"";if(g===`
+`){m+=2;continue}if(g==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,m+=2;continue}if(e.startsWith("$((",m)){let g=Gs(e,m+3,n,"))"),p=g===-1?n:g+2;if(s+=e.slice(m,p),g===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=p;continue}let f=Co(e,m,n,r,o,i);if(f){let g=bu(f,l,c);if(m=g.next,u||=g.limited,a=Xn(a,g.provenance),u)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:u};continue}if(d==="$"){let g=Eu(e,m,n,s,a);s=g.text,a=g.provenance,m=g.next;continue}s+=d??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:u}}function Co(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let u=s?3:c?1:2,m=s?"))":c?"`":")",d=Gs(e,t+u,n,m),f=d===-1?n:d,g=d===-1?n:d+m.length;if(i>=r.maxDepth)return{program:hC(e,t+u,f,"depth-limit"),next:g,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],C=!1,P=t+u;while(P<f){let x=Co(e,P,f,r,o,i+1);if(!x){P++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),C||=x.program.status==="limited",P=x.next,C)break}if(d===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:yo(E,C),issues:E,nodes:v}),next:g,provenance:"arithmetic"}}let p=po(e,t+u,f,r,o,i+1),h=d===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+u)} substitution is not closed`}]:[],y=(c||l)&&Jn(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+u,f),span:{start:t+u,end:f},status:yo([...p.issues,...h,...y],p.limited),issues:[...p.issues,...h,...y],nodes:p.nodes}),next:g,provenance:"command-substitution"}}function Jy(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?Co(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function bu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Gs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let u=l==="\r"&&e[a+1]===`
-`?a+2:a+1,f=Ts(e,u,n,s.splice(0));if(!f.terminated)return-1;a=f.next-1;continue}let c=pu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Hy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",f=a+(u?3:2);while(f<n&&/[ \t]/.test(e[f]??""))f++;let d=Ps(e,f,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Hy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=pu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function pu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!uC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function lo(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function jy(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function co(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function gu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function Vy(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=Ky(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function Ky(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return io(e,t+1,n,16,2,t+1);if(r==="u")return io(e,t+1,n,16,4,t+1);if(r==="U")return io(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return io(e,t,n,8,3,t+1);return{text:r,next:t+1}}function io(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function uo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function hu(e,t,n,r,o){let i=gu(e,t,n);return{text:r+e.slice(t,i),provenance:jn(o,"variable"),next:i}}function qy(e,t,n){let r=oo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,f=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||f||d){let m=c?3:d?1:2,p=c?"))":d?"`":")",g=Ms(e,a+m,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let m=gu(e,a,n);if(m>a+1){r.push(o,a,"literal"),r.push(a,m,"variable"),a=m,o=m;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function jn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function Yy(e,t,n){return t+1>=n||co(e[t+1]??"")||lo(e,t+1)!==null}var Zy=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),Xy=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Jy(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=Qy(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function Qy(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return eC(e,t);if(n==="env")return tC(e,t);if(n==="sudo")return nC(e,t);return}function eC(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function tC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Zy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function nC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(Xy.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function yu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Cu(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>bu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function rC(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Cu(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>bu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>rn(e,t.span.start,t.span.end,a,"literal",!1))}}function Cu(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((m)=>cu(m,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=cu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let f=u.start+c.length-u.end,d=u.alternatives.reduce((m,p)=>m+f+p.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...oC(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function cu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&sC(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:iC(e,r)}}function oC(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function iC(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function sC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function bu(e,t){let n=`x${e}`,r=Os(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function aC(e,t,n,r){return me({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function on(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function so(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Is(e){return e.used++,e.used<=e.max}function lC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Vn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Vn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Vn(t.body.nodes)})}function cC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Su(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function uu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!du.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function ks(e,t){if(!Su(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function uC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Eu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),dC=new Set(["gc","cat","type","cp","mv","rm"]),xu=["-rec","-for","-path","-literalpath","-whatif"],fC=/^\$env:\w/i,mC=/^(?:\$\{?\w+\}?|~)\\./;function Ru(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Eu].some((o)=>n.includes(o))&&!(n.includes("rm")&&xu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!pC(n))return!1;let r=Ws(e,t);if(_u(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Ls(r).some(gC)}function _u(e){return e.nodes.some((t)=>{if(t.kind==="group")return _u(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function pC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function gC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Eu.has(n))return!0;let r=e.slice(t+1);if(n&&dC.has(n)&&r.some(hC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return xu.some((s)=>i.startsWith(s))})}function hC(e){return fC.test(e)||mC.test(e)}function Ws(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return me({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Gs(e,0,e.length,t,0);return me({kind:"program",dialect:"powershell",source:e,span:n,status:vC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Gs(e,t,n,r,o,i=!1){let s=[],a=[],l=no(),c=0,u=!1,f=()=>{if(l.words.length===0&&l.redirections.length===0)return;let m={start:l.start,end:l.end};ro(s,l,{kind:"command",dialect:"powershell",source:e.slice(m.start,m.end),span:m,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},d=t;while(d<n){let m=e[d];if(!m)break;if(i&&m==="}")return f(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let p=SC(e,d,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return f(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};d=p.next;continue}if(/\s/.test(m)){if(m==="\r"||m===`
-`){f();let y=m==="\r"&&e[d+1]===`
-`?d+2:d+1;s.push(Ns(e,d,y)),d=y;continue}d++;continue}let g=Pu(e,d);if(g){f(),s.push(Ns(e,d,d+g.length)),d+=g.length;continue}if(m==="{"){if(f(),o>=r.maxDepth)return a.push(Au(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Gs(e,d+1,n,r,o+1,!0),S=y.closed?y.next-1:y.next,E=me({kind:"program",dialect:"powershell",source:e.slice(d+1,S),span:{start:d+1,end:S},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(m==="}"){f(),s.push(Ns(e,d,d+1)),d++;continue}if(m===">"||m==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===m?d+2:d+1,S=y;while(/[ \t]/.test(e[S]??""))S++;let E=S<n?vu(e,S,n,r,o):void 0,v=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:v}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=v,d=v;continue}if(m===","){l.start=l.start===-1?d:l.start,l.words.push(As({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=vu(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),f(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return f(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function vu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,f=!1,d=(p)=>{let g=yC(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),u+=Ds(g.program),f||=g.program.status==="limited",s="command-substitution",g.next},m=t;while(m<n){let p=e[m];if(!p||/\s/.test(p)||Pu(e,m)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[m+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),m++;break}i+=g,m+=2;continue}if(e.startsWith("$(",m)){m=d(m);continue}if(p==="'"){a=!0,m++;let g=!1;while(m<e.length){if(e[m]==="'"&&e[m+1]==="'"){i+="'",m+=2;continue}if(e[m]==="'"){g=!0,m++;break}i+=e[m]??"",m++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,m++;let g=!1;while(m<n){let h=e[m];if(h==="`"&&e[m+1]){i+=e[m+1],m+=2;continue}if(h==='"'){g=!0,m++;break}if(e.startsWith("$(",m)){m=d(m);continue}if(h==="$")s=e[m+1]==="("?"command-substitution":"variable";i+=h??"",m++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[m+1]==="("?"command-substitution":"variable";if(p==="@"&&m===t)s="variable";i+=p,m++}return{word:rn(e,t,m,i,s,a,s==="literal"?void 0:CC(e,t,m)),next:m,issues:l,nested:c,words:u,limited:f}}function yC(e,t,n,r,o){let i=wu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Au(r.maxDepth)],nodes:[]}),next:a};let l=Gs(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:me({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function wu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function Ds(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=Ds(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=Ds(r)}}return t}function CC(e,t,n){let r=oo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=wu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=bC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function bC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Au(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Ls(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Ls(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Ls)]})}function Pu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function SC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function vC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Ns(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ne(e,t="auto",n=mt){if(t==="powershell"||t==="auto"&&Ru(e.slice(0,n.maxInputLength),n))return Ws(e,n);return fu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function sn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function mo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Fs(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Kn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function xe(e,t){Kn(e,t)}function Ot(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function zs(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function Je(e,t,n){return!Ot(C(e,t-1))&&j(e,t,n)&&!Ot(C(e,t+n.length))}function Qe(e,t){return Ot(C(e,t-1))!==Ot(C(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function an(e){return e==="|"||e===";"}function po(e,t,n){let r=Fs(e,n);if(t==="rm")return EC(r);if(t==="dd")return RC(r);return Nu(r,!0)}function go(e,t,n){let r=Fs(e,n);if(t==="rm")return _C(r);if(t==="reset-hard")return Ou(r,"--ha","rd");if(t==="reset-merge")return Ou(r,"--me","rge");if(t==="clean")return TC(r);if(t==="checkout")return kC(r);if(t==="push-force")return OC(r);if(t==="push-refspec")return MC(r);if(t==="push-delete")return NC(r);if(t==="branch")return DC(r);if(t==="tag")return GC(r);if(t==="restore")return FC(r);return Nu(r,!1)}function EC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(Je(e,i,"rm")&&H(l)&&l!==`
-`)t=!0,i++;continue}let a=xC(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Tu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Tu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function xC(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Tu(e,t,n){if(Iu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Iu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Iu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function RC(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(C(e,n))){t=!1;continue}if(Je(e,n,"dd")){t=!0,n++;continue}if(!t||!Je(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!H(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function _C(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=C(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=AC(e,o);if(s>=0){if(wC(e,s))return!0;let a=s,l=!1;while(H(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(C(e,o-1)))&&(!C(e,o+2)||H(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&Qe(e,o+11)||Bs(e,o,"recursive"),r||=j(e,o,"--force")&&Qe(e,o+7)||Bs(e,o,"force"),n&&r)return!0;o++}return!1}function Bs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&Qe(e,t+r+2)}function wC(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(H(C(e,n)))n++;let i=n;while(n<Z(e)&&!H(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=ku(e,i,"recursive"),a=ku(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=PC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function ku(e,t,n){return j(e,t,`--${n}`)&&Qe(e,t+n.length+2)||Bs(e,t,n)}function AC(e,t){if(t>0&&Ot(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!H(C(e,n+1)))return-1;return n+1}function PC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=C(e,c)??"",f=(u==="r"||u==="f")&&Qe(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&f,s||=u==="f"&&f,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&f,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Ou(e,t,n){return Yn(e,"reset",an,!0,(r)=>C(e,r)==="-"&&ln(e,r,t,n)?!0:r)}function TC(e){return Yn(e,"clean",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(ln(e,t,"--fo","rce"))return!0;let n=qn(e,t,an);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function ho(e,t,n){if(!Je(e,t,"git"))return null;let r=t+3;if(!H(C(e,r)))return{commandEnd:-1,next:r};while(H(C(e,r)))r++;while(r<Z(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=qn(e,r,oe);if(Je(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=IC(e,r,o);r=o;while(H(C(e,r)))r++;if(i)return{commandEnd:Je(e,r,n)?r+n.length:-1,next:qn(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=qn(e,r,oe);while(H(C(e,r)))r++}return{commandEnd:-1,next:r}}function IC(e,t,n){for(let r of Se)if(n-t===r.length&&j(e,t,r))return!0;return!1}function kC(e){return Mu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function OC(e){return Yn(e,"push",an,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Ot(C(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Du(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function MC(e){return Yn(e,"push",oe,!1,(t)=>{if(H(C(e,t))&&C(e,t+1)==="+"&&t+2<Z(e)&&!oe(C(e,t+2))&&!H(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function NC(e){return Yn(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&ln(e,t,"--de","lete"))return!0;if(H(C(e,t))&&C(e,t+1)===":"&&t+2<Z(e)&&!H(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function DC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=ho(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=qn(e,o,oe),s=LC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function LC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(ln(e,i,"--de","lete"))r=!0;if(ln(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&WC(C(e,s))){let u=C(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!Qe(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function WC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function GC(e){return Mu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Mu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=ho(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(ln(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&Qe(e,r+1))return!0;if(an(o))i.outerActive=!1}return!1}function Yn(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=ho(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(C(e,u)))i=!1;s=c}if(l)i=!1}return!1}function FC(e){let t=!1;for(let n=0;n<Z(e);n++){if(zs(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=ho(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Nu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=C(e,r),i=t?zs(o):oe(o);if(n&&H(o)&&C(e,r+1)==="-"&&Je(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(Je(e,r,"find"))n=!0,r+=3}return!1}function qn(e,t,n){let r=t;while(r<Z(e)&&!H(C(e,r))&&!n(C(e,r)))r++;return r}function Du(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return Qe(e,o)?o:-1}function ln(e,t,n,r){return Du(e,t,n,r)>=0}function Ae(e,t){Kn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)xe(t,a);if((s.regex?.test(a)??!1)||s.scan&&go(a,s.scan,t))return b("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var zC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Wu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Kn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Gu(t.nodes,r,i)}function Gu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Gu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return BC(r,t,n)})}function BC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!zC.test(o.text));return e.words.every((o,i)=>o===t||Lu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Lu(o.target.raw,n.anchored,!0)))}function Lu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as $C,resolve as Fu}from"node:path";function Zn(e,t,n,r){let o=$C(e)?Fu(e):t?Fu(t,e):void 0;if(!o)return;try{return z(o,n,r)}catch{return o}}function zu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var cn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",Xn="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",Us=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),UC=new Set(["-p","--print"]),HC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),jC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),VC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),KC=new Map([["python",new Set(["m"])]]),qC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),YC=new Set(["always","default","never"]),ZC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),XC=/\\\r?\n/g,JC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Bu(e){return Co(e).code}function yo(e){return Co(e).sources}function $u(e){return JC.get(js(e))??[]}function Co(e){let t=js(e[0]??"");if(!Us.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return De(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return De(t,n,r,o,i,s);if(t==="node"&&UC.has(s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(f.startsWith("-"))continue;n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),i++;continue}if(eb(t,s)){let f=e[i+1];if(f===void 0)return De(t,n,r,o);if(n.push({tokenIndex:i+1,value:f}),r.push({tokenIndex:i+1,kind:"inline-code",value:f}),t==="python")return De(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(tb(t)&&a){let f=a[1]??"";n.push({tokenIndex:i,value:f}),r.push({tokenIndex:i,kind:"inline-code",value:f});continue}if(t==="node"){let f=QC(s);if(f){if(f.attached){if(o&&=f.value!=="",f.value!=="")r.push({tokenIndex:i,kind:"module-file",value:f.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,De(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return De(t,n,r,o);if(qC.get(t)?.has(s)){let f=e[i+1];if(f===void 0||f.startsWith("-")&&!(t==="ruby"&&ZC.has(s))||t==="python"&&!YC.has(f))return De(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let f=1;f<s.length;f++){let d=s[f];if(d===void 0)break;if(KC.get(t)?.has(d)){let m=s.slice(f+1),p=m||e[i+1];if(p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});return De(t,n,r,o)}if(HC.get(t)?.has(d)){l=s.slice(f+1)||e[i+1],c=f+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let m=e[i+1];if(o&&=m!==void 0&&!m.startsWith("-"),o&&m!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:m});i++}break}if(t==="ruby"&&d==="r"){let m=s.slice(f+1),p=m||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:m?i:i+1,kind:"module-file",value:p});if(!m)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let m=s.slice(f+1);if(!m){if(o=!1,f+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:m});break}if(jC.get(t)?.has(d)){if(f+1===s.length)i++;break}if(VC.get(t)?.has(d)&&f+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return De(t,n,r,o);if(c)i++}return De(t,n,r,o,void 0,void 0,!0)}function De(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function QC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Hs(e,t){return js(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function js(e){let t=I(e).toLowerCase();return Gr.test(t)?"python":t}function eb(e,t){return Us.get(e)?.has(t)??!1}function tb(e){return Us.get(e)?.has("--eval")??!1}function Jn(e,t,n=!1){let r=ob(e,t);if(!$s(r,t))return!1;xe(t,r);let o=rb(r);if($s(o,t))return!0;if(xe(t,o),!Uu.test(o))return!1;return!n||nb(r,t)}function nb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let n=e.split(""),r=[];for(let s=0;s<e.length;s++){let a=e[s];if(a!=="'"&&a!=='"')continue;let l=e.startsWith(a.repeat(3),s)?a.repeat(3):a,c=s+l.length,u=c;while(u<e.length&&!e.startsWith(l,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;r.push({start:c,text:e.slice(c,u)}),n.fill(" ",s,u+l.length),s=u+l.length-1}let o=n.join(""),i=Array.from(o.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((s)=>Uu.test(s[1]??"")).map((s)=>{let a=s.index+s[0].length;return{start:a,end:Vs(o,a)}});if(i.some((s)=>Ks(o,s.start)))return!0;return r.some((s)=>(/\b(?:system|exec|spawn|popen)\s*$/.test(o.slice(0,s.start))||i.some((a)=>s.start>=a.start&&s.start<a.end))&&$s(s.text,t))}function Vs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Ks(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Uu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function rb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function $s(e,t){if(po(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(xe(t,e),r.test(e))return!0;if(po(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(xe(t,e),r.test(e))return!0;if(po(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(xe(t,e),n.some((o)=>go(o,r))))}function ob(e,t){return xe(t,e),e.replace(XC,"")}import{lstatSync as tS,readdirSync as nS}from"node:fs";import{basename as rS,isAbsolute as pd,join as oS,relative as gd}from"node:path";import{isAbsolute as Zu,parse as pb}from"node:path";import{dirname as ib,isAbsolute as sb,parse as ab,sep as lb}from"node:path";function pt(e,t,n){if(ct(t))throw Error("Unsupported Windows namespace path");let r=sb(t)?ab(t).root:"",o=r||e;for(let i of ub(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=ib(o);continue}let s=cb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function cb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${lb}${t}`}function ub(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],db=new Set(qs),fb=1024,Hu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ju=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),mb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function bo(e){return db.has(e)}function Ys(e){return bo(e)||Hu.has(e)||ju.has(e)||Ln(e)}function et(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Vu(e,t){let n=et("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=fb?{state:"valid",count:r}:{state:"invalid"}}function So(e,t,n){let o=e.match(mb)?.[1];if(!o||!Ys(o))return null;let i=e.indexOf("=");return{name:o,value:`${et(o,t,n)??""}${e.slice(i+1)}`}}function Ku(e){return Yu(e,ju)}function qu(e){return Yu(e,Hu)}function Yu(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var Ju=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!Ju.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function vo(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function Qu(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Mt(e,t,n,r){if(!Qu(un(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let f=0;f<V.wrapperPeelIterations.cap;f++){let d=Xu(i),m=vo(i);for(let[g,h]of m.envAssignments)s.set(g,h),a.set(g,h);if(i=m.words,i.length===0)break;while(i.length>0&&un(i).includes("=")&&!hb(i)){let g=yb(un(i),a,t.env)??So(un(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(un(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=bb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Eb(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=xb(i);if(p==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(Xu(i)===d)break}let u=vo(i);for(let[f,d]of u.envAssignments)s.set(f,d),a.set(f,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:gb(u.words,o)}}function gb(e,t){return e.some((n)=>!t.has(n))}function Xu(e){return e.map(w).join(" ")}function un(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function hb(e){return Ju.test(un(e))}function yb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Cb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function bb(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?Qn(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=Qn(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=Qn(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Cb.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Sb=new Set(["-i","-0","--null"]),vb=new Set(["-u","--unset","-C","--chdir","-P"]);function Eb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let f of n.keys())o.set(f,"");o.set("TMPDIR",""),a++;continue}if(Sb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let f=Le(e,a+1);if(f!==void 0)o.set(f,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(vb.has(c)){if(c==="-C"||c==="--chdir"){let f=Le(e,a+1);s=f?Qn(s,f,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let f=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=Qn(s,f,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let f=Pe(Le(e,a)??"");if(!f)break;o.set(f.name,f.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function Qn(e,t,n){if(t==="")return null;if(!e&&!Zu(t))return null;let r=Zu(t)?pb(t).root:n.realpath(e??"/");if(r===null)return null;try{return pt(r,t,n)}catch{return null}}function xb(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Rb=/['"\\$`{}#]/;function Eo(e,t){if(e.some((r)=>Rb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function gt(e,t,n){return xo(e,t,n).tokens}function _b(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function ht(e,t,n,r=0){let o=xo(e,t,n),i=(o.envSplitValues??[]).flatMap(_b);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return ht(s,t,n,r+1)}function xo(e,t,n,r){if(!Qu(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Mt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var Qs=Symbol("adopt-as-operand"),wb=new Set(["env","sudo","command","builtin"]),Ab=new Set(["&&","||","|&","|","&",";"]),Pb=new Set(["<<","<<<",">|"]),Tb=new Set(["|","|&"]),Ib=/[*@#?$!_-]/,kb=/^\w+(?::\w+)*/,Ob=Object.freeze([]),er=Object.freeze({kind:"scope",edge:"enter"}),tr=Object.freeze({kind:"scope",edge:"exit"}),Mb=Object.freeze([]),Nb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),nr=new Set(["bash","sh","zsh","dash","ksh"]),Db=256,od=new WeakMap;function id(e,t){let n=t.status==="complete"?new Set(Js(t)):new Set,r=Gb(e,n);if(zr(r))return Ro("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Nt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Ro("structural-limit",r,t);if(o.invalid)return Ro("invalid",r,t);let s=Ro("complete",r,t,o.assignmentFallbacks);return od.set(s,Object.freeze(i)),s}function wo(e,t,n,r,o){let i=o.word??((f)=>f),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let f of sd(e)){if(f.kind==="scope"){if(f.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let m=u.pop();if(m===void 0)throw Error("scope exit without a matching enter");s=m.state,a=m.segment,l=m.shellWords,c=m.pipeProducer;continue}if(f.kind==="operator"){if(!f.boundary)continue;let d=o.segment(a,s,c,f.operator,l);if(d)return d;s=Lb(a,s,n,r),c=a.length>0&&Tb.has(f.operator)?a:null,a=[],l=new Set;continue}if(f.kind==="redirection"){if(f.fd!==void 0)l.add(a.length-1);if(f.target===void 0)continue;let d=o.redirection({operator:f.operator,role:f.role,targetOrder:f.targetOrder,target:f.target,...f.body===void 0?{}:{body:f.body,consumer:f.consumer}},s);if(d===Qs){l.add(a.length),a.push(i(f.target));continue}if(d)return d;continue}a.push(i(f.text))}return o.segment(a,s,c,null,l)}function Ao(e){return sd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function rr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Lb(e,t,n,r){let o=rr(e)?new Map([...t.variables,...Wb(e,t.variables)]):t.variables,i=gt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:se(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Wb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function sd(e){return od.get(e)??Ob}function Gb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Ro(e,t,n,r=Mb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Nt(e,t){return e.nodes.flatMap((n,r)=>Fb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Fb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(Hb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[_o("{"),...Nt(e.body,a),...s?[_o("}")]:[]]:[er,We("("),...Nt(e.body,a),...s?[We(")")]:[],tr]}]}let o=qb(e,r.functions);if(o){if(r.depth>=mt.maxDepth||++r.flags.expansions>Db)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ed(e,r),_o(";"),...Nt(o,{...r,depth:r.depth+1}),_o(";")]},...td(e,t,n,r)]}return[{start:e.span.start,events:ed(e,r)},...td(e,t,n,r)]}function ed(e,t){return[...e.words.map((n)=>({start:n.span.start,events:ld(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:zb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function zb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?ld(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ea(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:jb(r),targetOrder:Pb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:ud(t)}:{}}),...s===void 0?o:o.slice(1)]}function td(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ea(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...ad(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Bb(t,n,r):[]]}function Bb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:ad(n.source.slice(r.span.end,e.span.end),n)}]}function ad(e,t){if(t.depth>=mt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Nt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function ld(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ea(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let m of Zs(c.raw,i,n.flags,n.powershell)){if(typeof m==="string"){l(),o.push(We(m));continue}s+=m.text,a||=m.glob}continue}let u=t.nested.find((m)=>m.span.start>=c.span.start&&m.span.end<=c.span.end);if(i.double){let m=n.source.slice(c.span.start,c.span.end);s+=Zs(m,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=u?Nt(u,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(er,...p,tr);continue}let f=u?Nt(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(er,...f,tr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),er,...f,...c.raw.endsWith(")")?[We(")")]:[],tr);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[er]:[],...f,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[tr]:[])}return l(),o}function Zs(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=nd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=nd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function nd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Ub(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return $b(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Ib.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?kb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function $b(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=Zs(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Ub(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Hb(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:Ab.has(e)})}function _o(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ea(e){return Object.freeze({kind:"word",text:e})}function jb(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function or(e){return Nb.has(e)||/^python\d/.test(e)}var Vb=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function cd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=Vb.get(e)?.has(n)??!1;return cd(e,t.slice(r?2:1))}function Xs(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return Xs(e.slice(1));if(!wb.has(t))return[...e];return Xs(cd(t,e.slice(1)))}function ud(e){let t=Hn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return Xs(n<0?[]:e.words.slice(n).map((r)=>r.text))}function Kb(e){let t=ud(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return or(n)&&!nr.has(n)}function Js(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return Js(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>Js(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(Kb(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!Zb(t))return r;return[...r,...o]})}function qb(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function yt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function Yb(e){if(yt(e.words[0],"git"))return yt(e.words[1],"commit");if(!yt(e.words[0],"gh")||!yt(e.words[2],"create"))return!1;return yt(e.words[1],"pr")||yt(e.words[1],"issue")}function Zb(e){return(yt(e.words[0],"cat")||yt(e.words[0],"tee")||Yb(e))&&!e.words.some(rd)&&!e.redirections.some((n)=>rd(n.target))}function rd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var dd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),fd=new Set([...dd,"glob"]),Xb=new Set([...fd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function ir(e){let t=Jb(),n=kn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:Qb(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function tt(e,t){if(!e.includes("$"))return e;return Ri(e,t)}function Jb(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let f={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,f),f}let l=e.get(i);if(l)return l;let c=id(i,a);return e.set(i,c),c},getCommandProgram:r}}function Qb(e){let t=e.route.kind==="grep"?fd:e.route.kind==="glob"?Xb:dd;return[...Ol(e.input,t),...e.route.kind==="patch"?Dl(e.input):[]]}var eS=new Set(["-S","--suffix"]);function dn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return wo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Po(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&eS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function hd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Ir(e.invocation.toolName))return null;let a=e.paths.find((l)=>md(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=dn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>uS(a,l,t,n,r),isRedirectionTarget:(a,l)=>md(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Dt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Io(se(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(ta(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(f)=>c?To(f,l):iS(f,l);if(n.markerFiles.some(u))return!0;return r&&na(n).some(u)}if(ta(a,n))return!0;return r&&na(n).some((c)=>To(c,a))}function iS(e,t){let n=gd(t,e);if(n===""||n.startsWith("..")||pd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function sS(e,t,n,r,o){return Dt(e,t,n,!0,r,o)}function aS(e,t,n,r,o){if(!n)return!1;return ta(Io(se(e,t,r,o)),n)}function md(e,t,n,r,o,i){let s=Io(se(e,t,r,o));return i.includes(s)||Cd(s,n)}function yd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>To(i,Io(se(s,t,r,o)))))}function ta(e,t){return t.entries.includes(e)||t.directories.includes(e)||Cd(e,t)}function Cd(e,t){return t.hooksDirectories.some((n)=>To(e,n))}var lS=50000;function bd(e,t){let n=[...new Set(na(e))];if(n.some((o)=>t(rS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=cS(o);if(!i)return!0;if(r+=i.length,r>lS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>oS(o,s.name)))}return!1}function cS(e){try{let t=tS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return nS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function na(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function To(e,t){let n=gd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!pd(n)}function Io(e){return process.platform==="win32"?e.toLowerCase():e}function uS(e,t,n,r,o){if(rr(e))return null;let i=ht([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Po(i.slice(1)),a=s.sources.find((l)=>sS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&aS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as Do,normalize as CS,parse as bS,posix as Ad,resolve as Wt,sep as sa}from"node:path";import{isAbsolute as dS,join as Sd,normalize as xd,parse as fS,sep as vd}from"node:path";var mS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],pS=` 	
-`;function sr(e,t){if(Ct(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!ra(e.get("TMPDIR")??"",t)}function Lt(e,t){if(e.has("TMPDIR"))return ra(e.get("TMPDIR")??"",t);let n=oa(e,t);if(n===void 0)return!0;return ra(n,t)}function oa(e,t){return _d(e,t,"TMPDIR")}function ra(e,t){if(!e)return!1;if(hS(e))return!1;return fn(e,t)}function Ct(e,t){let n=_d(e,t,"IFS");return n!==void 0&&n!==""&&n!==pS}function fn(e,t){let n=ko(e,t.paths);if(n===null)return!1;return Rd(t).some((r)=>No(n,r))}function Mo(e,t){let n=ko(e,t.paths);if(n===null)return!1;return Rd(t).some((r)=>Oo(r)===Oo(n))}var Ed=new WeakMap;function Rd(e){let t=Ed.get(e);if(t)return t;let n=gS(e);return Ed.set(e,n),n}function gS(e){let t=mS.map((r)=>ko(r,e.paths)??xd(r)),n=ko(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&yS(n))return[...t,n];return t}function hS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function _d(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function yS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function ko(e,t){try{let n=xd(e);if(!dS(n))return n;let r=fS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Sd(i,o[s]??"");if(t.entryKind(a)==="missing")return Sd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function No(e,t){let n=Oo(e),r=Oo(t);if(n===r)return!0;let o=r.endsWith(vd)?r:`${r}${vd}`;return n.startsWith(o)}function Oo(e){return process.platform==="win32"?e.toLowerCase():e}var SS=process.platform==="win32",wd=64,vS=16384;function ar(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return b(o.id,o.reason)}function lr(e){let t=yu(e,wd,wd,vS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:ES(e)}}function ES(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>xS(e.raw,n.span.start-e.span.start))}function xS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Gt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:TS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&kS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Td(e,t.posixShell);if(ct(e))return{kind:"outside_anchored_cwd"};if(aa(e,r))return{kind:"root_or_home_target"};if(_S(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Dt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(wS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(IS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&DS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>LS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(WS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(RS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function RS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(Do(r)||r.startsWith("~"))return!1;if(la(r))return!1;if(Id(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return fn(Wt(t.resolvedCwd,r),t.environment)}function Pd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(PS(i))return!1;if(Mo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Id(r??i,s,t.environment.paths,t.budget))}function aa(e,t=!1){let n=e.trim(),r=Ad.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function _S(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=Do(o)?o:t.resolvedCwd?Wt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(z(i,t.environment.paths,t.budget));if(s===bS(s).root)return!0;return s===he(z(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=CS(e);if(SS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function wS(e,t,n,r,o,i,s,a){let l=e.trim();if(la(l))return!1;if(!r&&fn(l,a))return!0;return(t||i&&s)&&n&&!o&&AS(l,n)}function AS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Td(e.slice(n.length+1),t)})}function PS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Ad.normalize(`/${t[1]??""}`)==="/"}function la(e){return e.split(/[\\/]+/).includes("..")}function TS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Bn(o.trim(),t);if(!Do(i))return[];try{let s=z(i,n,r);if($n(s,z(t,n,r)))return[];return[he(s)]}catch{return[]}})}function IS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(la(r))return!1;let o=n?r:Bn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=Do(o)?o:i?Wt(i,o):null;if(!s)return!1;try{let a=he(z(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(sa)?l:`${l}${sa}`))}catch{return!1}}function kS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Td(e,t=!1){return e.includes("$")||e.includes("`")||OS(e)||t&&MS(e)}function OS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function MS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&NS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function NS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function DS(e,t,n,r){try{return he(z(e,n,r))===he(z(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function LS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(z(Wt(t,e),n,r))===he(z(o,n,r))}catch{try{return he(Wt(t,e))===he(o)}catch{return!1}}}function WS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ia(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ia(Wt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ia(Wt(a,e),t,i,s)}catch{return!1}}function ia(e,t,n,r){try{return kd(z(e,n,r),z(t,n,r))}catch{return!1}}function Id(e,t,n,r){if(!t)return!1;try{return kd(z(t,n,r),z(e,n,r))}catch{return!0}}function kd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${sa}`)||n===r}var GS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Od="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",FS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Md="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Nd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",zS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",BS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",$S={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Nd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Md},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:zS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Od},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:FS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Od}};function Dd(e,t,n,r=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return US(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function US(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=jS(o),s=o[i];if(!s||!GS.has(ev(s.text)))return null;let a=HS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return b("powershell.remove-item-pipeline-dynamic-target",BS);for(let l of a.targets)if(!ct(l.text)&&aa(ua(l.text)))return b(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Nd);for(let l of a.targets)if(n.resolvedCwd&&Dt(ua(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return b("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return b("powershell.remove-item-recursive-force-dynamic-target",Md);for(let l of a.targets){let c=ar(Fe(ua(l.text),n),n,r,$S);if(c)return c}return null}function HS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(VS(l))continue;if(s){t.push(ca(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=qS(l.text);if(!c){t.push(ca(l)),i=i||l.dynamic;continue}if(YS(c.name)){let u=c.value?KS(c.value,l):e[++a];if(u?.kind==="word"){t.push(ca(u)),i=i||u.dynamic;continue}i=!0;continue}if(ZS(c.name)){n=!0;continue}if(XS(c.name)){r=!0;continue}if(JS(c.name))o=QS(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function jS(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function ca(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function VS(e){return e.kind==="word"&&e.text===","}function ua(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function KS(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function qS(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function YS(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function ZS(e){return"recurse".startsWith(e)}function XS(e){return e.length>=2&&"force".startsWith(e)}function JS(e){return e==="wi"||"whatif".startsWith(e)}function QS(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function ev(e){return e.toLowerCase()}var mn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Lo="Unsupported heredoc syntax",cr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Ld="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var tv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),nv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),rv=new Set(["-o","--output","--query","--subscription"]),ov=new Set;function Wd(e){if(e==="aws")return tv;if(e==="gcloud")return nv;if(e==="az")return rv;return ov}var iv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),sv=new Set;function Gd(e){if(e==="git")return Se;if(e==="docker")return iv;return sv}function nt(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=fe(e);for(let o of t){if(!cv(n,o.command))continue;if(o.match){if(av(n,e,o.match))return Fd(o);continue}if(!uv(n,e,o.subcommand))continue;if(fv(e,new Set(o.block_args),r))return Fd(o)}return null}function Fd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function av(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return lv(r,n.command_path,Wd(e))}function lv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function cv(e,t){return e===O(t)}function uv(e,t,n){if(!n)return!0;return zd(t,1,n,Gd(e))}function zd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&dv(e,i,n,r))return!0;continue}return s===n}return!1}function dv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return zd(e,t+2,n,r)}function fv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var mv=new Set(["-e","--source"]),pv=new Set(["-F","-v","--assign","--field-separator"]),Bd=new Set(["-f","--file"]),gv=new Set(["print","printf","return"]),$d=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],hv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Ud(e,t,n){let r=!1;for(let o of yv(e)){let i=Cv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?b("awk.system-dynamic",hv):null}function fa(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&mv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(pv.has(a)||Bd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Bd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function dr(e){return fa(e).sources}function yv(e){return dr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Cv(e,t){xe(t,e);let n=e.includes("system")?ma(e,t):null,r=bv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ma(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Go(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Hd(e,i+1);continue}if(s==="/"&&jd(e,i)){i=Vd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,ur(e[a-1])||ur(e[i]))continue;let l=Wo(e,i);if(e[l]!=="(")continue;l=Wo(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Go(e,l,c);if(!u){r=!0,o=!0;continue}if(l=Wo(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function bv(e,t){xe(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let m=Go(e,i,u);if(m&&c===s)l={...m,startIndex:i};c=m?.endIndex??i+1,i=m?.endIndex??i+1;continue}if(u==="#"){i=Hd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&jd(e,i)){let m=Vd(e,i+1);c=m??i+1,i=m??i+1;continue}if(`;
-{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(da(e,i,"print")||da(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let f=e[i+1]==="&"?i+2:i+1,d=Wo(e,f);if(da(e,d,"getline")){o=!0;let m=Ev(s,l,c);if(r||=m===null,m!==null)n.push(m);c=f,i=f;continue}if(Rv(s,a)){o=!0;let m=vv(e,d);if(!m){r=!0,c=f,i=f;continue}if(!Sv(e,m.endIndex)){r=!0,c=m.endIndex,i=m.endIndex;continue}n.push(m.value),c=m.endIndex,i=m.endIndex;continue}c=f,i++}if(!o)return null;return{dynamic:r,commands:n}}function ur(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function Wo(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Sv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Go(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=xv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function vv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Go(e,t,n)}function Ev(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function xv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function da(e,t,n){return e.startsWith(n,t)&&!ur(e[t-1])&&!ur(e[t+n.length])}function Rv(e,t){return t!==null&&t>=e}function Hd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function jd(e,t){let n=_v(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(ur(e[r-1]))r--;return gv.has(e.slice(r,n+1))}function _v(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Vd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var wv=new Set(["sudo","env","command","builtin"]);function Fo(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=Av(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Av(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Pv(a,r);if(l)i.push(s);if(!l&&Fr.has(O(a)))break;if(o)break}return i}function Pv(e,t){let n=I(e),r=O(e);return r==="git"||n==="busybox"||Ft(e)||Qi.has(n)||t.transparentWrappers.includes(n)||Y.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ft(e){return wv.has(e.toLowerCase())}function zt(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return zo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*zo(e,t,n,r,o,i,s,a,l){let c=xo(e,t,n,i);for(let[m,p]of c.envAssignments)i.set(m,p),o.set(m,p);let{tokens:u,cwd:f}=c;if(c.envSplitValues){let m=Eo(c.envSplitValues,u);if(!m)throw new N("derivedCommandShape");pa(a),yield*zo(m,t,f,r,o,i,s,a,l);return}if(Ft(u[0]??""))throw new N("wrapperPeelIterations");let d=Fo(u,s);if(d){for(let m of[d.childIndex,...d.alternativeChildIndices])pa(a),yield*zo(m===d.childIndex?d.tokens:u.slice(m),t,f,r,new Map(o),new Map(i),s,a,!0);return}if(Iv(u)){pa(a),yield*zo(u.slice(1),t,f,r,o,i,s,a,l);return}yield Tv(u,f,r,o,i,l)}function Tv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function pa(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function Iv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function ga(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||ha(r,"recursive")){t=!0;continue}if(r==="-f"||ha(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Bo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>ha(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function ha(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var kv=["--init-file","--rcfile"],Ov=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function $e(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Kd(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Kd(e,t,!1);if(r!==null)return r}}return null}function rt(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return ve(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Kd(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function qd(e){let t=I(e[0]??"").toLowerCase(),n=Mv(e,t),r=Ov.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Mv(e,t){let n=ve(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?kv.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let f=l.split("=",1)[0]??l;if(t==="bash"&&Xi.has(f)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=Ji(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Nv="find -delete permanently removes files. Use -print first to preview.",Dv="find -exec rm -rf is dangerous. Use explicit file list instead.",Lv=new Set(["-exec","-execdir","-ok","-okdir"]),Wv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function Yd(e,t){let n=e.map(w),r=Gv(e,n,t);if(r)return r;if($o(n,1)&&!Hv(e,n,t)){let s=P(b("find.delete",Nv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=ot(s??"");if(a>0){i+=a+1;continue}if(!Ke(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=pn(n,i);i=l.nextIndex;let c=Vv(l.tokens,t.environment);if(c){let m=P(c,t.policy);if(m)return m}let u=s==="-execdir"||s==="-okdir",f=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=f?.id.startsWith("custom.")?f:P(f,t.policy);if(d)return d}return null}function Gv(e,t,n){if(!$o(t,1)&&!ya(t,n.environment))return null;let o=fr(e)??K(["."]),i=Gt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=lr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!Fv(e,i.protectedGitMetadata,n.environment))return b("find.delete-git-metadata",Te)}}if(Uv(t)&&i.resolvedCwd&&yd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return b("find.delete-git-metadata",Te);return null}function Fv(e,t,n){if(!t)return!1;let r=e.map(w),o=[],i=!1,s=fr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(Ke(l)){let c=pn(r,a),u=ht([...c.tokens],n);if(Bo(u))return!1;if(Y.has(I(u[0]??"").toLowerCase()))return!1;if(c.tokens.some((d)=>d!=="{}"&&d.includes("{}")))return!1;if((l==="-execdir"||l==="-okdir")&&u.slice(1).some((d)=>d!=="{}"&&!d.startsWith("-")))return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(c?.provenance!=="literal"||/[[\\]/.test(c.text))return!1;if(!i)o.push(Bv(c.text,l==="-iname"));a+=2;continue}if(!zv.has(l))return!1;a+=1+ot(l)}return o.length>0&&!bd(t,(l)=>o.every((c)=>c.test(l)))}var zv=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function Bv(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var $v=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function ya(e,t){let n=0;while(n<e.length){if(!Ke(e[n])){n++;continue}let r=pn(e,n),o=ht([...r.tokens],t),i=I(o[0]??"").toLowerCase();if((i==="rm"||i==="rmdir"||Y.has(i)&&$v.test(($e(o)??"").replace(/["'\\]/g,"")))&&o.some((a)=>a.includes("{}")))return!0;n=r.nextIndex}return!1}function Uv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Hv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=fr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=oa(o,n.environment),s=n.trustedTmpdirValue??Lt(o,n.environment),a=n.allowTmpdirVar??!sr(o,n.environment),l=Gt({environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??Ct(o,n.environment),trustedTmpdirValue:s,budget:n.budget});return r.every((c)=>{let u=lr(c);if(u.unsafeBraceExpansion)return!1;return(u.expandedTargets??[w(c)]).every((f)=>Pd(f,l,{containmentTarget:jv(f,i),targetIsLiteral:u.expandedTargets!==void 0||u.targetIsLiteral,tmpdirWordSplittingProtected:u.tmpdirWordSplittingProtected}))})}function jv(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function fr(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function Vv(e,t){let n=gt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&Be(n))return b("find.exec-rm-recursive-force",Dv);return null}function pn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function $o(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(Ke(r)){n=pn(e,n).nextIndex;continue}let o=ot(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function ot(e){return Wv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function Ke(e){return e!==void 0&&Lv.has(e)}import{resolve as Cx}from"node:path";function mr(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var Kv=5,Ca="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function Xd(e,t,n){let r=Uo(e,t,n),o=qv(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<Kv;a++){let{subcommand:l,rest:c}=Re(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let f=o.get(u),d=Qv(f);if(d===null||d.length===0)return{blockedReason:Ca,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:Ca,expanded:!0,tokens:i}}function Jd(e,t,n){return Uo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function Re(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Se.has(o)?2:1}return{subcommand:null,rest:[]}}function qv(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function Uo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=Zv(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...Yv(e,t,n)]}}function Yv(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=ba(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=ba(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=Zd(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=Zd(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Se.has(i)){o+=2;continue}o++}return r}function Zv(e,t){let n=Xv(e,t),r=Jv(e,t);return{blockedReason:n===null||r===null?Ca:null,entries:[...n??[],...r??[]]}}function Xv(e,t){let n=et("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=mr(n);if(!o)return null;for(let i of o){let s=ba(i);if(!s)return null;r.push(s)}return r}function Jv(e,t){let n=Vu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=et(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=et(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function ba(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function Zd(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:et(e.slice(r+1),t,n)}}function Qv(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return mr(t)}var eE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",tE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",nE="git checkout --force discards uncommitted changes. Use 'git stash' first.",rE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",oE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",iE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",sE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",aE="git switch --force discards uncommitted changes. Use 'git stash' first.",lE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",cE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",uE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",dE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",fE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",mE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",pE="git push --force destroys remote history. Use --force-with-lease for safer force push.",gE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",hE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",yE="git branch -D force-deletes without merge check. Use -d for safe delete.",CE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",bE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",SE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",vE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",EE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",xE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",RE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",_E=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),wE=new Set(["--recurse-submodules","--track","-t"]),Sa=new Set(["-b","-B","-U"]),va=new Set(["-c","-C"]),AE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var gn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function ef(e,t){let{subcommand:n,rest:r}=Re(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return bt(PE(r,t));case"switch":return bt(IE(r));case"restore":return bt(OE(r));case"reset":return NE(r);case"clean":return bt(LE(r));case"rm":return bt(WE(r));case"push":return Bt(GE(r));case"branch":return Bt(BE(r));case"stash":return Bt(VE(r));case"worktree":return Bt(KE(r));case"rebase":return bt($E(r));case"merge":return bt(UE(r));case"tag":return Bt(HE(r));case"reflog":return Bt(jE(r));default:return null}}function bt(e){return e?{...e,localDiscard:!0}:null}function Bt(e){return e?{...e,localDiscard:!1}:null}function PE(e,t){let{index:n,before:r}=ie(e),o=fe(r,{shortOptsWithValue:Sa});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return b("git.checkout-force",nE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return b("git.checkout-pathspec-from-file",oE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return b("git.checkout-ref-path",rE);return b("git.checkout-double-dash",eE)}let i=kE(e);if(i.length>=2)return b("git.checkout-ambiguous",iE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(TE(s)||t(s))return b("git.checkout-double-dash",tE);return null}function TE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function IE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return b("git.switch-discard-changes",sE);let n=fe(t,{shortOptsWithValue:va});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return b("git.switch-force",aE);return null}function kE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(_E.has(r)){n+=2;continue}if(wE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function OE(e){let t=ME(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?b("git.restore-worktree",cE):b("git.restore-unstaged",lE)}function ME(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(AE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function NE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=b("git.reset-hard",uE);break}if(M(n,"--merge")){t=b("git.reset-merge",dE);break}}if(!t)return null;return DE(e)?Bt(t):bt(t)}function DE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function LE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=fe(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return b("git.clean-force",fE);return null}function WE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=fe([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?b("git.rm-force",mE):null}function GE(e){let{before:t,after:n}=ie(e),r=fe(t);if(t.some((s)=>M(s,"--mirror")))return b("git.push-mirror",hE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||Qd(t,n).some(FE))return b("git.push-force",pE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||Qd(t,n).some(zE))return b("git.push-delete",gE);return null}function Qd(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function FE(e){return e.startsWith("+")||e.includes(":+")}function zE(e){return e.length>1&&e.startsWith(":")}function BE(e){let{before:t}=ie(e),n=fe(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return b("git.branch-force-delete",yE);return null}function $E(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?b("git.rebase-abort",CE):null}function UE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?b("git.merge-abort",bE):null}function HE(e){let{before:t}=ie(e);return fe(t).has("-d")||t.some((r)=>M(r,"--delete"))?b("git.tag-delete",SE):null}function jE(e){return e[0]==="delete"?b("git.reflog-delete",vE):null}function VE(e){for(let t of e){if(t==="drop")return b("git.stash-drop",EE);if(t==="clear")return b("git.stash-clear",xE)}return null}function KE(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=fe(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return b("git.worktree-remove-force",RE);return null}import{dirname as mx,isAbsolute as px,join as hf,resolve as gx}from"node:path";var xa="TMPDIR",Ra="IFS",nf=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,rf=/^[A-Za-z_][A-Za-z0-9_]*$/,of=new Set(["export","typeset","declare","readonly"]),qE=new Set(["builtin","command","time"]),sf=new Set(["do","then","else"]),YE=new Set(["do","then","case"]),tf=new Set(["done","fi","esac"]),ZE=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function af(e,t){return e.map((n)=>n.provenance==="variable"&&mf(n.text)?pr(n.text,t.shellAssignments):w(n))}function pr(e,t){return e.replace(ZE,(n,r,o)=>t.get(r??o??"")??n)}function lf(e,t){return{env:e,effectiveEnvAssignments:ex(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function cf(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function _a(e,t){let n=df(e,t),r=e[0]??"";if(YE.has(r))t.bodyDepth+=1;if(r==="elif"||tf.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(tf.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);wa(t,a)});let o=n.commandIndex;if(o!==-1&&of.has(e[o]??""))e.filter((a)=>rf.test(a)&&Ea(a)).forEach((a)=>{tx(t,a)});let i=o===-1?-1:ff(e,o);if(i===-1||e[i]!=="unset")return;let s=rx(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(sf.has(r)){t.shellAssignments.set(a,"");return}nx(t,a)})}function uf(e,t){let n=df(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function df(e,t){let n=sf.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!mf(a)),o=r!==-1&&of.has(e[ff(e,r)]??""),i=QE(t);return{assignments:e.flatMap((a,l)=>{let c=XE(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!bo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function ff(e,t){let n=t;while(qE.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function mf(e){return Pe(e)!==null||nf.test(e)}function XE(e,t,n){return Pe(e)??JE(e,t,n)}function JE(e,t,n){let r=So(e,n,t);if(r)return r;let o=e.match(nf)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Ea(e){return e===xa||e===Ra||Ys(e)}function QE(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function ex(e,t){let n=[xa,Ra].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function wa(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function tx(e,t){wa(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function nx(e,t){if(!Ea(t)&&!rf.test(t))return;if(e.shellAssignments.set(t,""),bo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Ea(t)||t===xa||t===Ra||Ln(t)){wa(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function rx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as ox}from"node:path";function Ho(e,t){return qs.some((n)=>t?.has(n)||e.has(n))}function hn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(ox(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=pf(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=pf(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Se.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function pf(e,t,n){try{let r=pt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function gf(e,t,n){if(!t.localDiscard||!n.worktreeMode||Ho(n.environment.env,n.envAssignments))return null;let r=hn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Aa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Aa(e,t,n){let{subcommand:r,rest:o}=Re(e),i=r?.toLowerCase();if(t.dynamicArguments||ix(o)||ux(e,t.environment.env,t.envAssignments,n)||lx(o)||sx(i,o))return!0;return i==="clean"&&cx(o)>1}function ix(e){return e.some((t)=>/[$*?[]/.test(t))}function sx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=fe(n,{shortOptsWithValue:Sa}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=fe(n,{shortOptsWithValue:va}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||ax(s))||r.has("-C");return o&&i}return!1}function ax(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function lx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function cx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function ux(e,t,n,r){if(et("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=Uo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>fx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||dx(s.value);if(qu(n))return!0;return r.recursiveSubmodules}function dx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function fx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function yf(e,t,n){let r=e.map(w),o=n.environment.paths,i=hn(r,n.cwd,o),s=n.originalCwd?o.realpath(gx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Ho(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?yx(e,n.shellAssignments,o):Cf(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!hx(a,r,t,n)||!fn(a,n.environment)||Mo(a,n.environment)||No(s,a)||No(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function hx(e,t,n,r){let o=r.environment.paths,i=hf(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;let s=n.localDiscard?r.environment.worktreeFacts(e):null;return s!==null&&!Aa(t,r,s)}function yx(e,t,n){let r=Re(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=l?.provenance==="variable"&&l.parts.every((u)=>u.provenance!=="literal"||!/[$`]/.test(u.raw))?pr(a,t??new Map):a;if(!px(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function Cf(e,t){if(t.entryKind(hf(e,".git"))!=="missing")return e;let n=mx(e);return n===e?null:Cf(n,t)}var bx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Sx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function jo(e,t){return bf(e,t)}function bf(e,t,n){let r=e.map(w),o=Xd(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(b("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Ku(t.envAssignments)||Jd(r,t.environment.env,t.envAssignments))&&vx(s))return b("git.ssh-env",bx);let a=ef(s,(c)=>{let u=hn(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(Cx(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=gf(r,a,t)??yf(e,a,t);if(!l)return a;return n?.(l),null}function Sf(e,t){let n=null;return{match:bf(e,t,(o)=>{n=o}),relaxation:n}}function vx(e){let{subcommand:t,rest:n}=Re(e),r=t?.toLowerCase();if(!r)return!1;if(Sx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&Ex(n)}function Ex(e){return e.find((t)=>!xx(t))?.toLowerCase()==="update"}function xx(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as Jx}from"node:path";function vf(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Vo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Ef="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Rx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",_x="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Rf="rm -rf targeting root or home directory is extremely dangerous and always blocked.",wx="rm -rf in home directory is dangerous. Change to a project directory first.",xf={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Rf},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:_x},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:wx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Ef},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Rx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Ef}};function Ko(e,t){let n=Gt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Bo(r),s=Px(e);for(let a of s){let l=lr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(ar({kind:"outside_anchored_cwd"},n,t.policy,xf),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=be(c),f={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Dt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return b("rm.git-metadata",Te);if(i&&!o){let d=Fe(u,n,f);if(d.kind==="root_or_home_target")return b("rm.recursive-force-root-or-home",Rf);if(d.kind==="git_metadata_target")return b("rm.git-metadata",Te);continue}if(!o)continue;for(let d of Ax(u,n,f)){let m=ar(d,n,t.policy,xf),p=P(m,t.policy);if(p)return p}}}return null}function Ax(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Px(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var St={kind:"none"},$t={kind:"dynamic"},Tx=new Set(["<","<<","<<-","<<<","<&","<>"]),wf=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Ix=/^(?:[0-9]+|[@*])$/,kx=mt.maxWords,Af=mt.maxInputLength;function Pf(e){if(!e||I(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?a+2:a+1,m=Ds(e,u,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=Su(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let u=Qy(e,a+3,n);if(u===-1)return-1;a=u+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let u=e[a+2]==="-",m=a+(u?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let d=Ms(e,m,n);if(d){s.push({delimiter:d.delimiter,quotedDelimiter:d.quoted,stripTabs:u,attach:()=>{return}}),a=d.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function Qy(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Su(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Su(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!bC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function go(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function eC(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ho(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function vu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function tC(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=nC(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function nC(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return mo(e,t+1,n,16,2,t+1);if(r==="u")return mo(e,t+1,n,16,4,t+1);if(r==="U")return mo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return mo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function mo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"�",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function yo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Eu(e,t,n,r,o){let i=vu(e,t,n);return{text:r+e.slice(t,i),provenance:Xn(o,"variable"),next:i}}function rC(e,t,n){let r=uo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),u=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),d=l==="`";if(c||u||m||d){let f=c?3:d?1:2,g=c?"))":d?"`":")",p=Gs(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=vu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Xn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function oC(e,t,n){return t+1>=n||ho(e[t+1]??"")||go(e,t+1)!==null}var iC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),sC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function aC(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=lC(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function lC(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return cC(e,t);if(n==="env")return uC(e,t);if(n==="sudo")return dC(e,t);return}function cC(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function uC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(iC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function dC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(sC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function xu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=Ru(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>_u(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function mC(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=Ru(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>_u(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>cn(e,t.span.start,t.span.end,a,"literal",!1))}}function Ru(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>gu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",u=gu(c,o);if(!u||u.kind==="range")return{limited:"expansions"};let m=u.start+c.length-u.end,d=u.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+d>r)return{limited:"length"};if(i.length-1+u.alternatives.length>t)return{limited:"words"};i.splice(l,1,...fC(c,u)),s+=d-c.length}return a===0?void 0:{values:i}}function gu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&gC(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:pC(e,r)}}function fC(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function pC(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function gC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function _u(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function hC(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function un(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function fo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function yC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Jn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Jn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Jn(t.body.nodes)})}function CC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function wu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function hu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!yu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ls(e,t){if(!wu(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function bC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Pu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),SC=new Set(["gc","cat","type","cp","mv","rm"]),Tu=["-rec","-for","-path","-literalpath","-whatif"],vC=/^\$env:\w/i,EC=/^(?:\$\{?\w+\}?|~)\\./;function Iu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Pu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Tu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!xC(n))return!1;let r=$s(e,t);if(ku(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Bs(r).some(RC)}function ku(e){return e.nodes.some((t)=>{if(t.kind==="group")return ku(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function xC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function RC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Pu.has(n))return!0;let r=e.slice(t+1);if(n&&SC.has(n)&&r.some(_C))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Tu.some((s)=>i.startsWith(s))})}function _C(e){return vC.test(e)||EC.test(e)}function $s(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:IC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=lo(),c=0,u=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};co(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},d=t;while(d<n){let f=e[d];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:d+1,closed:!0,words:c,limited:u};let g=TC(e,d,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};d=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`){m();let y=f==="\r"&&e[d+1]===`
+`?d+2:d+1;s.push(Fs(e,d,y)),d=y;continue}d++;continue}let p=Du(e,d);if(p){m(),s.push(Fs(e,d,d+p.length)),d+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Mu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Us(e,d+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(d+1,v),span:{start:d+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:d,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,u||=y.limited,d=y.next;continue}if(f==="}"){m(),s.push(Fs(e,d,d+1)),d++;continue}if(f===">"||f==="<"){l.start=l.start===-1?d:l.start;let y=e[d+1]===f?d+2:d+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?Au(e,v,n,r,o):void 0,C=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(d,y),span:Object.freeze({start:d,end:C}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,u||=E.limited;l.end=C,d=C;continue}if(f===","){l.start=l.start===-1?d:l.start,l.words.push(Os({text:",",raw:",",span:{start:d,end:d+1},provenance:"literal",quoted:!1})),l.end=++d;continue}let h=Au(e,d,n,r,o);if(l.start=l.start===-1?d:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,u||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};d=h.next>d?h.next:d+1}return m(),{nodes:s,issues:a,next:d,closed:!i,words:c,limited:u}}function Au(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],u=0,m=!1,d=(g)=>{let p=wC(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),u+=zs(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||Du(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=d(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=d(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:cn(e,t,f,i,s,a,s==="literal"?void 0:AC(e,t,f)),next:f,issues:l,nested:c,words:u,limited:m}}function wC(e,t,n,r,o){let i=Ou(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Mu(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Ou(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function AC(e,t,n){let r=uo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Ou(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=PC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function PC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Mu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Bs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Bs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Bs)]})}function Du(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function TC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function IC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Fs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=ht){if(t==="powershell"||t==="auto"&&Iu(e.slice(0,n.maxInputLength),n))return $s(e,n);return Cu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function dn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function bo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Hs(e,t){return{value:e,work:t}}function b(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Qn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Re(e,t){Qn(e,t)}function Wt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function U(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function H(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(b(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!Wt(b(e,t-1))&&H(e,t,n)&&!Wt(b(e,t+n.length))}function nt(e,t){return Wt(b(e,t-1))!==Wt(b(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function mn(e){return e==="|"||e===";"}function So(e,t,n){let r=Hs(e,n);if(t==="rm")return kC(r);if(t==="dd")return MC(r);return zu(r,!0)}function vo(e,t,n){let r=Hs(e,n);if(t==="rm")return DC(r);if(t==="reset-hard")return Gu(r,"--ha","rd");if(t==="reset-merge")return Gu(r,"--me","rge");if(t==="clean")return GC(r);if(t==="checkout")return zC(r);if(t==="push-force")return BC(r);if(t==="push-refspec")return $C(r);if(t==="push-delete")return UC(r);if(t==="branch")return HC(r);if(t==="tag")return KC(r);if(t==="restore")return qC(r);return zu(r,!1)}function kC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=b(e,i);if(!t){let l=b(e,i+2);if(tt(e,i,"rm")&&U(l)&&l!==`
+`)t=!0,i++;continue}let a=OC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Nu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(U(s)){if(o<0)continue;if(H(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Nu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function OC(e,t){if(b(e,t)!=="\\"||b(e,t-1)==="\\")return-1;if(H(e,t,String.raw`\n`))return t+2;if(H(e,t,String.raw`\x0a`)||H(e,t,String.raw`\x0A`))return t+5;if(H(e,t,String.raw`\u000a`)||H(e,t,String.raw`\u000A`))return t+7;return H(e,t,String.raw`\012`)?t+4:-1}function Nu(e,t,n){if(Lu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Lu(e,t,n,"force"))return{recursive:!1,force:!0};if(b(e,t)!=="-"||b(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=b(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Lu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!H(e,t,"--"))return!1;for(let i=0;i<o;i++)if(b(e,t+i+2)!==r[i])return!1;return!0}function MC(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(b(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!H(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!U(b(e,r))&&b(e,r)!=="'"&&b(e,r)!=='"')return!0}return!1}function DC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=b(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=LC(e,o);if(s>=0){if(NC(e,s))return!0;let a=s,l=!1;while(U(b(e,a)))l||=b(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(H(e,o,"--")&&(o===0||U(b(e,o-1)))&&(!b(e,o+2)||U(b(e,o+2))||oe(b(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=H(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=H(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!H(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=b(e,t+r+2);if(!o||U(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function NC(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(U(b(e,n)))n++;let i=n;while(n<Z(e)&&!U(b(e,n)))n++;if(b(e,i)!=="-"||n-i===2&&H(e,i,"--"))return!1;let s=Wu(e,i,"recursive"),a=Wu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,b(e,i+1)==="-")continue;let l=WC(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Wu(e,t,n){return H(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function LC(e,t){if(t>0&&Wt(b(e,t-1)))return-1;let n=t;if(b(e,n)==="\\")n++;if(b(e,n)!=="r")return-1;if(n++,b(e,n)==="\\")n++;if(b(e,n)!=="m"||!U(b(e,n+1)))return-1;return n+1}function WC(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(b(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let u=b(e,c)??"",m=(u==="r"||u==="f")&&nt(e,c+1);r||=u==="r",o||=u==="f",i||=u==="r"&&m,s||=u==="f"&&m,a||=(l==="r"&&u==="f"||l==="f"&&u==="r")&&m,l=u}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Gu(e,t,n){return tr(e,"reset",mn,!0,(r)=>b(e,r)==="-"&&fn(e,r,t,n)?!0:r)}function GC(e){return tr(e,"clean",mn,!0,(t)=>{if(b(e,t)!=="-")return t;if(fn(e,t,"--fo","rce"))return!0;let n=er(e,t,mn);for(let r=t+1;r<n;r++)if(b(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!U(b(e,r)))return{commandEnd:-1,next:r};while(U(b(e,r)))r++;while(r<Z(e)){if(oe(b(e,r)))return{commandEnd:-1,next:r};let o=er(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(b(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&H(e,r,"--"),s=FC(e,r,o);r=o;while(U(b(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:er(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(b(e,r)))return{commandEnd:-1,next:r};r=er(e,r,oe);while(U(b(e,r)))r++}return{commandEnd:-1,next:r}}function FC(e,t,n){for(let r of ve)if(n-t===r.length&&H(e,t,r))return!0;return!1}function zC(e){return Fu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function BC(e){return tr(e,"push",mn,!0,(t)=>{if(b(e,t)!=="-")return t;if(b(e,t+1)==="f"&&!Wt(b(e,t+2))&&!H(e,t+2,"-with-lease"))return!0;let n=Bu(e,t,"--fo","rce");if(n>=0&&!H(e,n,"-with-lease"))return!0;return t})}function $C(e){return tr(e,"push",oe,!1,(t)=>{if(U(b(e,t))&&b(e,t+1)==="+"&&t+2<Z(e)&&!oe(b(e,t+2))&&!U(b(e,t+2)))return!0;if(b(e,t)===":"&&b(e,t+1)==="+")return!0;return t})}function UC(e){return tr(e,"push",oe,!1,(t)=>{if(b(e,t)==="-"&&fn(e,t,"--de","lete"))return!0;if(U(b(e,t))&&b(e,t+1)===":"&&t+2<Z(e)&&!U(b(e,t+2))&&!oe(b(e,t+2)))return!0;return t})}function HC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(b(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||b(e,o)!=="-")continue;let i=er(e,o,oe),s=jC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function jC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(b(e,i)!=="-")continue;if(fn(e,i,"--de","lete"))r=!0;if(fn(e,i,"--fo","rce"))o=!0;if(b(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&VC(b(e,s))){let u=b(e,s);a||=u==="d"||u==="D",l||=u==="f",c||=u==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function VC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function KC(e){return Fu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function Fu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=b(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&b(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(U(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&U(b(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(fn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(b(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(mn(o))i.outerActive=!1}return!1}function tr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=b(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||U(b(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let u=s;u<=c;u++)if(n(b(e,u)))i=!1;s=c}if(l)i=!1}return!1}function qC(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(b(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&b(e,n)==="-"&&b(e,n+1)==="-"&&(H(e,n+2,"staged")||H(e,n+2,"help")))t=!1}return t}function zu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=b(e,r),i=t?js(o):oe(o);if(n&&U(o)&&b(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function er(e,t,n){let r=t;while(r<Z(e)&&!U(b(e,r))&&!n(b(e,r)))r++;return r}function Bu(e,t,n,r){if(!H(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&b(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function fn(e,t,n,r){return Bu(e,t,n,r)>=0}function Ae(e,t){Qn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Re(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var YC=/^[A-Za-z_][A-Za-z0-9_]*=/;function Uu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Qn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Hu(t.nodes,r,i)}function Hu(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Hu(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return ZC(r,t,n)})}function ZC(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!YC.test(o.text));return e.words.every((o,i)=>o===t||$u(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||$u(o.target.raw,n.anchored,!0)))}function $u(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as XC,resolve as ju}from"node:path";function nr(e,t,n,r){let o=XC(e)?ju(e):t?ju(t,e):void 0;if(!o)return;try{return N(o,n,r)}catch{return o}}function Vu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var pn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",rr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),JC=new Set(["-p","--print"]),QC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),eb=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),tb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),nb=new Map([["python",new Set(["m"])]]),rb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),ob=new Set(["always","default","never"]),ib=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),sb=/\\\r?\n/g,ab=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Ku(e){return Ro(e).code}function xo(e){return Ro(e).sources}function qu(e){return ab.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&JC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(cb(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(ub(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=lb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let d=e[i+1];if(d===void 0||d.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:d}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(rb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&ib.has(s))||t==="python"&&!ob.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let d=s[m];if(d===void 0)break;if(nb.get(t)?.has(d)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return Ne(t,n,r,o)}if(QC.get(t)?.has(d)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&d==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&d==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(d==="M"||d==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(eb.get(t)?.has(d)){if(m+1===s.length)i++;break}if(tb.get(t)?.has(d)&&m+1<s.length)break}if(l===void 0)continue;let u=c?i+1:i;if(n.push({tokenIndex:u,value:l}),r.push({tokenIndex:u,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((u)=>u.tokenIndex)),c=n.filter((u)=>u.kind!=="inline-code"||l.has(u.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((u)=>u.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function lb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function cb(e,t){return qs.get(e)?.has(t)??!1}function ub(e){return qs.get(e)?.has("--eval")??!1}function or(e,t,n=!1){let r=fb(e,t);if(!Ks(r,t))return!1;Re(t,r);let o=mb(r);if(Ks(o,t))return!0;if(Re(t,o),!Yu.test(o))return!1;return!n||db(r,t)}function db(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let u=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+u.length,d=m;while(d<e.length&&!e.startsWith(u,d))d+=e[d]==="\\"?2:1;if(d>=e.length)return!0;o.push({start:m,text:e.slice(m,d)}),r.fill(" ",l,d+u.length),l=d+u.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Yu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),u=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||u)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Yu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function mb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Re(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Re(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Re(t,e),n.some((o)=>vo(o,r))))}function fb(e,t){return Re(t,e),e.replace(sb,"")}import{lstatSync as uS,readdirSync as dS}from"node:fs";import{basename as mS,isAbsolute as Sd,join as fS,relative as vd}from"node:path";import{isAbsolute as nd,parse as xb}from"node:path";import{dirname as pb,isAbsolute as gb,parse as hb,sep as yb}from"node:path";function yt(e,t,n){if(Qe(t))throw Error("Unsupported Windows namespace path");let r=gb(t)?hb(t).root:"",o=r||e;for(let i of bb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=pb(o);continue}let s=Cb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function Cb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${yb}${t}`}function bb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],Sb=new Set(Qs),vb=1024,Zu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Xu=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Eb=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function _o(e){return Sb.has(e)}function ea(e){return _o(e)||Zu.has(e)||Xu.has(e)||$n(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Ju(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=vb?{state:"valid",count:r}:{state:"invalid"}}function wo(e,t,n){let o=e.match(Eb)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function Qu(e){return td(e,Xu)}function ed(e){return td(e,Zu)}function td(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var od=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!od.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function id(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Gt(e,t,n,r){if(!id(gn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let d=rd(i),f=Ao(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&gn(i).includes("=")&&!_b(i)){let p=wb(gn(i),a,t.env)??wo(gn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=O(gn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=Pb(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=kb(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,y]of p.envAssignments)s.set(h,y),a.set(h,y)}if(g==="command")i=Ob(i);if(g==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(rd(i)===d)break}let u=Ao(i);for(let[m,d]of u.envAssignments)s.set(m,d),a.set(m,d);return{words:u.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Rb(u.words,o)}}function Rb(e,t){return e.some((n)=>!t.has(n))}function rd(e){return e.map(w).join(" ")}function gn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function _b(e){return od.test(gn(e))}function wb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Ab=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Pb(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?ir(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ir(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ir(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Ab.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Tb=new Set(["-i","-0","--null"]),Ib=new Set(["-u","--unset","-C","--chdir","-P"]);function kb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Tb.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let u=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(u){if(u.value!==void 0)i.push(u.value);return s=null,l(a+u.consumed)}if(Ib.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?ir(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ir(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function ir(e,t,n){if(t==="")return null;if(!e&&!nd(t))return null;let r=nd(t)?xb(t).root:n.realpath(e??"/");if(r===null)return null;try{return yt(r,t,n)}catch{return null}}function Ob(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Mb=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>Mb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function Ct(e,t,n){return To(e,t,n).tokens}function Db(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function bt(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(Db);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return bt(s,t,n,r+1)}function To(e,t,n,r){if(!id(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Gt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),Nb=new Set(["env","sudo","command","builtin"]),Lb=new Set(["&&","||","|&","|","&",";"]),Wb=new Set(["<<","<<<",">|"]),Gb=new Set(["|","|&"]),Fb=/[*@#?$!_-]/,zb=/^\w+(?::\w+)*/,Bb=Object.freeze([]),sr=Object.freeze({kind:"scope",edge:"enter"}),ar=Object.freeze({kind:"scope",edge:"exit"}),$b=Object.freeze([]),Ub=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),lr=new Set(["bash","sh","zsh","dash","ksh"]),Hb=256,ud=new WeakMap;function dd(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=Kb(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return ud.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,u=[];for(let m of md(e)){if(m.kind==="scope"){if(m.edge==="enter"){u.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let d=o.segment(a,s,c,null,l);if(d)return d;let f=u.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let d=o.segment(a,s,c,m.operator,l);if(d)return d;s=jb(a,s,n,r),c=a.length>0&&Gb.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let d=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(d===oa){l.add(a.length),a.push(i(m.target));continue}if(d)return d;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Mo(e){return md(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function cr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function jb(e,t,n,r){let o=cr(e)?new Map([...t.variables,...Vb(e,t.variables)]):t.variables,i=Ct([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ae(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Vb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function md(e){return ud.get(e)??Bb}function Kb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=$b){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>qb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function qb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(Qb(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...Ft(e.body,a),...s?[ko("}")]:[]]:[sr,We("("),...Ft(e.body,a),...s?[We(")")]:[],ar]}]}let o=rS(e,r.functions);if(o){if(r.depth>=ht.maxDepth||++r.flags.expansions>Hb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...sd(e,r),ko(";"),...Ft(o,{...r,depth:r.depth+1}),ko(";")]},...ad(e,t,n,r)]}return[{start:e.span.start,events:sd(e,r)},...ad(e,t,n,r)]}function sd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:pd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:Yb(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function Yb(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?pd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:eS(r),targetOrder:Wb.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:hd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ad(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...fd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?Zb(t,n,r):[]]}function Zb(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:fd(n.source.slice(r.span.end,e.span.end),n)}]}function fd(e,t){if(t.depth>=ht.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function pd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let u=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=u?Ft(u,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(sr,...g,ar);continue}let m=u?Ft(u,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(sr,...m,ar);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),sr,...m,...c.raw.endsWith(")")?[We(")")]:[],ar);continue}let d=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:d},()=>We("(")),...d===1?[sr]:[],...m,...c.raw.endsWith(")".repeat(d))?Array.from({length:d},()=>We(")")):[],...d===1?[ar]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=ld(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=ld(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function ld(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=Jb(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return Xb(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Fb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?zb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function Xb(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function Jb(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function Qb(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:Lb.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function eS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function ur(e){return Ub.has(e)||/^python\d/.test(e)}var tS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function gd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=tS.get(e)?.has(n)??!1;return gd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!Nb.has(t))return[...e];return na(gd(t,e.slice(1)))}function hd(e){let t=Zn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function nS(e){let t=hd(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return ur(n)&&!lr.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(nS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!iS(t))return r;return[...r,...o]})}function rS(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function St(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function oS(e){if(St(e.words[0],"git"))return St(e.words[1],"commit");if(!St(e.words[0],"gh")||!St(e.words[2],"create"))return!1;return St(e.words[1],"pr")||St(e.words[1],"issue")}function iS(e){return(St(e.words[0],"cat")||St(e.words[0],"tee")||oS(e))&&!e.words.some(cd)&&!e.redirections.some((n)=>cd(n.target))}function cd(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var yd=new Set(["absolutepath","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Cd=new Set([...yd,"glob"]),sS=new Set([...Cd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function dr(e){let t=aS(),n=Wn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((u)=>u.source===s.source);if(a!==-1){let u=i[a];if(!u)return i;return i[a]={...u,usages:[...u.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:lS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return Ai(e,t)}function aS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let u=n.get(a);if(u)return u;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=dd(i,a);return e.set(i,c),c},getCommandProgram:r}}function lS(e){let t=e.route.kind==="grep"?Cd:e.route.kind==="glob"?sS:yd;return[...Gl(e.input,t),...e.route.kind==="patch"?Bl(e.input):[]]}var cS=new Set(["-S","--suffix"]);function hn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&cS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function Ed(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Lr(e.invocation.toolName))return null;let a=e.paths.find((l)=>bd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=hn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>bS(a,l,t,n,r),isRedirectionTarget:(a,l)=>bd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function zt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(ae(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),u=(m)=>c?No(m,l):pS(m,l);if(n.markerFiles.some(u))return!0;return r&&aa(n).some(u)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function pS(e,t){let n=vd(t,e);if(n===""||n.startsWith("..")||Sd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function gS(e,t,n,r,o){return zt(e,t,n,!0,r,o)}function hS(e,t,n,r,o){if(!n)return!1;return sa(Lo(ae(e,t,r,o)),n)}function bd(e,t,n,r,o,i){let s=Lo(ae(e,t,r,o));return i.includes(s)||Rd(s,n)}function xd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(ae(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||Rd(e,t)}function Rd(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var yS=50000;function _d(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(mS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=CS(o);if(!i)return!0;if(r+=i.length,r>yS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>fS(o,s.name)))}return!1}function CS(e){try{let t=uS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return dS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=vd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!Sd(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function bS(e,t,n,r,o){if(cr(e))return null;let i=bt([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>gS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&hS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as AS,parse as PS,posix as Md,resolve as $t,sep as da}from"node:path";import{isAbsolute as SS,join as wd,normalize as Td,parse as vS,sep as Ad}from"node:path";var ES=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],xS=` 	
+`;function mr(e,t){if(vt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function Bt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return kd(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(_S(e))return!1;return yn(e,t)}function vt(e,t){let n=kd(e,t,"IFS");return n!==void 0&&n!==""&&n!==xS}function yn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Id(t).some((r)=>Cn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Id(t).some((r)=>Go(r)===Go(n))}var Pd=new WeakMap;function Id(e){let t=Pd.get(e);if(t)return t;let n=RS(e);return Pd.set(e,n),n}function RS(e){let t=ES.map((r)=>Wo(r,e.paths)??Td(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&wS(n))return[...t,n];return t}function _S(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function kd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function wS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Td(e);if(!SS(n))return n;let r=vS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=wd(i,o[s]??"");if(t.entryKind(a)==="missing")return wd(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Cn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Ad)?r:`${r}${Ad}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var TS=process.platform==="win32",Od=64,IS=16384;function fr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return S(o.id,o.reason)}function pr(e){let t=xu(e,Od,Od,IS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:kS(e)}}function kS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>OS(e.raw,n.span.start-e.span.start))}function OS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Et(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??be();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:GS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&zS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Nd(e,t.posixShell);if(Qe(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(DS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&zt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(NS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(FS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&HS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>jS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(VS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(MS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function MS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Ld(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return yn($t(t.resolvedCwd,r),t.environment)}function Dd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(WS(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Ld(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Md.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function DS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?$t(t.resolvedCwd,o):null;if(!i)return!1;let s=he(N(i,t.environment.paths,t.budget));if(s===PS(s).root)return!0;return s===he(N(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=AS(e);if(TS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function NS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&yn(l,a))return!0;return(t||i&&s)&&n&&!o&&LS(l,n)}function LS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Nd(e.slice(n.length+1),t)})}function WS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Md.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function GS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Kn(o.trim(),t);if(!zo(i))return[];try{let s=N(i,n,r);if(qn(s,N(t,n,r)))return[];return[he(s)]}catch{return[]}})}function FS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Kn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?$t(i,o):null;if(!s)return!1;try{let a=he(N(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function zS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Nd(e,t=!1){return e.includes("$")||e.includes("`")||BS(e)||t&&$S(e)}function BS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function $S(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&US(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function US(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function HS(e,t,n,r){try{return he(N(e,n,r))===he(N(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function jS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(N($t(t,e),n,r))===he(N(o,n,r))}catch{try{return he($t(t,e))===he(o)}catch{return!1}}}function VS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua($t(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua($t(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return Wd(N(e,n,r),N(t,n,r))}catch{return!1}}function Ld(e,t,n,r){if(!t)return!1;try{return Wd(N(t,n,r),N(e,n,r))}catch{return!0}}function Wd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var KS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Gd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",qS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Fd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",zd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",YS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",ZS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",XS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:zd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:Fd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:YS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Gd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:qS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Gd}};function Bd(e,t,n,r=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return JS(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function JS(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=ev(o),s=o[i];if(!s||!KS.has(cv(s.text)))return null;let a=QS(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",ZS);for(let l of a.targets)if(!Qe(l.text)&&ma(ga(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",zd);for(let l of a.targets)if(n.resolvedCwd&&zt(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",Fd);for(let l of a.targets){let c=fr(Fe(ga(l.text),n),n,r,XS);if(c)return c}return null}function QS(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(tv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=rv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(ov(c.name)){let u=c.value?nv(c.value,l):e[++a];if(u?.kind==="word"){t.push(pa(u)),i=i||u.dynamic;continue}i=!0;continue}if(iv(c.name)){n=!0;continue}if(sv(c.name)){r=!0;continue}if(av(c.name))o=lv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function ev(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function tv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function nv(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function rv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function ov(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function iv(e){return"recurse".startsWith(e)}function sv(e){return e.length>=2&&"force".startsWith(e)}function av(e){return e==="wi"||"whatif".startsWith(e)}function lv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function cv(e){return e.toLowerCase()}var bn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",gr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",$d="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var uv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),dv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),mv=new Set(["-o","--output","--query","--subscription"]),fv=new Set;function Ud(e){if(e==="aws")return uv;if(e==="gcloud")return dv;if(e==="az")return mv;return fv}var pv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),gv=new Set;function Hd(e){if(e==="git")return ve;if(e==="docker")return pv;return gv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!Cv(n,o.command))continue;if(o.match){if(hv(n,e,o.match))return jd(o);continue}if(!bv(n,e,o.subcommand))continue;if(vv(e,new Set(o.block_args),r))return jd(o)}return null}function jd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function hv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return yv(r,n.command_path,Ud(e))}function yv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Cv(e,t){return e===O(t)}function bv(e,t,n){if(!n)return!0;return Vd(t,1,n,Hd(e))}function Vd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Sv(e,i,n,r))return!0;continue}return s===n}return!1}function Sv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Vd(e,t+2,n,r)}function vv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Ev=new Set(["-e","--source"]),xv=new Set(["-F","-v","--assign","--field-separator"]),Kd=new Set(["-f","--file"]),Rv=new Set(["print","printf","return"]),qd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],_v="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Yd(e,t,n){let r=!1;for(let o of wv(e)){let i=Av(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",_v):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Ev.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(xv.has(a)||Kd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Kd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function yr(e){return ya(e).sources}function wv(e){return yr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Av(e,t){Re(t,e);let n=e.includes("system")?Ca(e,t):null,r=Pv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ca(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Zd(e,i+1);continue}if(s==="/"&&Xd(e,i)){i=Jd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,hr(e[a-1])||hr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let u=Uo(e,l,c);if(!u){r=!0,o=!0;continue}if(l=$o(e,u.endIndex),r=!0,e[l]!==")"){o=!0,i=u.endIndex;continue}n.push(u.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Pv(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let u=e[i];if(!u)break;if(u==='"'||u==="'"){let f=Uo(e,i,u);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(u==="#"){i=Zd(e,i+1),s=i,a=null,l=null,c=i;continue}if(u==="/"&&Xd(e,i)){let f=Jd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(u)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(u!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(u))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,d=$o(e,m);if(ha(e,d,"getline")){o=!0;let f=kv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Mv(s,a)){o=!0;let f=Iv(e,d);if(!f){r=!0,c=m,i=m;continue}if(!Tv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function hr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Tv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Ov(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Iv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function kv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Ov(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!hr(e[t-1])&&!hr(e[t+n.length])}function Mv(e,t){return t!==null&&t>=e}function Zd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function Xd(e,t){let n=Dv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(hr(e[r-1]))r--;return Rv.has(e.slice(r,n+1))}function Dv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Jd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Nv=new Set(["sudo","env","command","builtin"]);function Ho(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=Lv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Lv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Wv(a,r);if(l)i.push(s);if(!l&&jr.has(O(a)))break;if(o)break}return i}function Wv(e,t){let n=I(e),r=O(e);return r==="git"||n==="busybox"||Ut(e)||os.has(n)||t.transparentWrappers.includes(n)||q.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function Ut(e){return Nv.has(e.toLowerCase())}function Ht(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return jo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*jo(e,t,n,r,o,i,s,a,l){let c=To(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:u,cwd:m}=c;if(c.envSplitValues){let f=Po(c.envSplitValues,u);if(!f)throw new D("derivedCommandShape");ba(a),yield*jo(f,t,m,r,o,i,s,a,l);return}if(Ut(u[0]??""))throw new D("wrapperPeelIterations");let d=Ho(u,s);if(d){for(let f of[d.childIndex,...d.alternativeChildIndices])ba(a),yield*jo(f===d.childIndex?d.tokens:u.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Fv(u)){ba(a),yield*jo(u.slice(1),t,m,r,o,i,s,a,l);return}yield Gv(u,m,r,o,i,l)}function Gv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ba(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Fv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Sa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||va(r,"recursive")){t=!0;continue}if(r==="-f"||va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Vo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var zv=["--init-file","--rcfile"],Bv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function $e(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return Qd(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=Qd(e,t,!1);if(r!==null)return r}}return null}function st(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ee(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function Qd(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function em(e){let t=I(e[0]??"").toLowerCase(),n=$v(e,t),r=Bv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function $v(e,t){let n=Ee(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?zv.find((d)=>l===d):void 0){let d=e[a+1];o.push(d===void 0?{kind:"absent"}:{kind:"literal",value:d}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ns.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=rs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Uv="find -delete permanently removes files. Use -print first to preview.",Hv="find -exec rm -rf is dangerous. Use explicit file list instead.",jv=new Set(["-exec","-execdir","-ok","-okdir"]),Vv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function tm(e,t){let n=e.map(w),r=Kv(e,n,t);if(r)return r;if(Ko(n,1)&&!Qv(e,n,t)){let s=T(S("find.delete",Uv),t.policy);if(s)return s}let o=t.budget??be(),i=0;while(i<n.length){let s=n[i],a=at(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=Sn(n,i);i=l.nextIndex;let c=tE(l.tokens,t.environment);if(c){let f=T(c,t.policy);if(f)return f}let u=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,u?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:u?void 0:t.cwd,envAssignments:t.envAssignments}):null,d=m?.id.startsWith("custom.")?m:T(m,t.policy);if(d)return d}return null}function Kv(e,t,n){if(!Ko(t,1)&&!Ea(t,n.environment))return null;let o=Cr(e)??K(["."]),i=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=pr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!qv(e,i.protectedGitMetadata,n.environment))return S("find.delete-git-metadata",Te)}}if(Jv(t)&&i.resolvedCwd&&xd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function qv(e,t,n){if(!t)return!1;let r=e.map(w),o=[],i=!1,s=Cr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=Sn(r,a),u=bt([...c.tokens],n),m=Vo(u),d=q.has(I(u[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&u.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||d||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(Zv(c.text,l==="-iname"));a+=2;continue}if(!Yv.has(l))return!1;a+=1+at(l)}return o.length>0&&!_d(t,(l)=>o.every((c)=>c.test(l)))}var Yv=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function Zv(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var Xv=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ea(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=Sn(e,n),o=bt([...r.tokens],t),i=I(o[0]??"").toLowerCase(),s=q.has(i)&&Xv.test(($e(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function Jv(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function Qv(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Cr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ca(o,n.environment),s=n.trustedTmpdirValue??Bt(o,n.environment),a=n.allowTmpdirVar??!mr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??vt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=Et(l),u=Et({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),d=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&d&&!Cn(d,m)?n.cwd:void 0;return r.every((g)=>{let p=pr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[w(g)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,v=y??h;return Dd(v,y?u:c,{containmentTarget:eE(v,i),targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected})})})}function eE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Cr(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function tE(e,t){let n=Ct([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&Be(n))return S("find.exec-rm-recursive-force",Hv);return null}function Sn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Ko(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=Sn(e,n).nextIndex;continue}let o=at(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function at(e){return Vv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&jv.has(e)}import{resolve as Ax}from"node:path";function br(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var nE=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function rm(e,t,n){let r=qo(e,t,n),o=rE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<nE;a++){let{subcommand:l,rest:c}=_e(i),u=l?.toLowerCase();if(!u||!o.has(u))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(u),d=lE(m);if(d===null||d.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...d,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function om(e,t,n){return qo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function _e(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function rE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=iE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...oE(e,t,n)]}}function oE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ra(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ra(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=nm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=nm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function iE(e,t){let n=sE(e,t),r=aE(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function sE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=br(n);if(!o)return null;for(let i of o){let s=Ra(i);if(!s)return null;r.push(s)}return r}function aE(e,t){let n=Ju(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ra(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function nm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function lE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return br(t)}var cE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",uE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",dE="git checkout --force discards uncommitted changes. Use 'git stash' first.",mE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",fE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",pE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",gE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",hE="git switch --force discards uncommitted changes. Use 'git stash' first.",yE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",CE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",bE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",SE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",vE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",EE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",xE="git push --force destroys remote history. Use --force-with-lease for safer force push.",RE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",_E="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",wE="git branch -D force-deletes without merge check. Use -d for safe delete.",AE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",PE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",TE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",IE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",kE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",OE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",ME="git worktree remove --force can delete uncommitted changes. Remove --force flag.",DE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),NE=new Set(["--recurse-submodules","--track","-t"]),_a=new Set(["-b","-B","-U"]),wa=new Set(["-c","-C"]),LE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var vn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function sm(e,t){let{subcommand:n,rest:r}=_e(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return xt(WE(r,t));case"switch":return xt(FE(r));case"restore":return xt(BE(r));case"reset":return UE(r);case"clean":return xt(jE(r));case"rm":return xt(VE(r));case"push":return jt(KE(r));case"branch":return jt(ZE(r));case"stash":return jt(tx(r));case"worktree":return jt(nx(r));case"rebase":return xt(XE(r));case"merge":return xt(JE(r));case"tag":return jt(QE(r));case"reflog":return jt(ex(r));default:return null}}function xt(e){return e?{...e,localDiscard:!0}:null}function jt(e){return e?{...e,localDiscard:!1}:null}function WE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:_a});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return S("git.checkout-force",dE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",fE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return S("git.checkout-ref-path",mE);return S("git.checkout-double-dash",cE)}let i=zE(e);if(i.length>=2)return S("git.checkout-ambiguous",pE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(GE(s)||t(s))return S("git.checkout-double-dash",uE);return null}function GE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function FE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",gE);let n=me(t,{shortOptsWithValue:wa});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",hE);return null}function zE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(DE.has(r)){n+=2;continue}if(NE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function BE(e){let t=$E(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",CE):S("git.restore-unstaged",yE)}function $E(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(LE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function UE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",bE);break}if(M(n,"--merge")){t=S("git.reset-merge",SE);break}}if(!t)return null;return HE(e)?jt(t):xt(t)}function HE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function jE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",vE);return null}function VE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",EE):null}function KE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",_E);if(t.some((s)=>M(s,"--force"))||r.has("-f")||im(t,n).some(qE))return S("git.push-force",xE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||im(t,n).some(YE))return S("git.push-delete",RE);return null}function im(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function qE(e){return e.startsWith("+")||e.includes(":+")}function YE(e){return e.length>1&&e.startsWith(":")}function ZE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",wE);return null}function XE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",AE):null}function JE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",PE):null}function QE(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",TE):null}function ex(e){return e[0]==="delete"?S("git.reflog-delete",IE):null}function tx(e){for(let t of e){if(t==="drop")return S("git.stash-drop",kE);if(t==="clear")return S("git.stash-clear",OE)}return null}function nx(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",ME);return null}import{dirname as Ex,isAbsolute as xx,join as Em,resolve as Rx}from"node:path";var Pa="TMPDIR",Ta="IFS",lm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,cm=/^[A-Za-z_][A-Za-z0-9_]*$/,um=new Set(["export","typeset","declare","readonly"]),rx=new Set(["builtin","command","time"]),dm=new Set(["do","then","else"]),ox=new Set(["do","then","case"]),am=new Set(["done","fi","esac"]),ix=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function mm(e,t){return e.map((n)=>n.provenance==="variable"&&bm(n.text)?fm(n.text,t.shellAssignments):w(n))}function fm(e,t){return e.replace(ix,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=fm(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function pm(e,t){return{env:e,effectiveEnvAssignments:cx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function gm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ia(e,t){let n=ym(e,t),r=e[0]??"";if(ox.has(r))t.bodyDepth+=1;if(r==="elif"||am.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(am.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ka(t,a)});let o=n.commandIndex;if(o!==-1&&um.has(e[o]??""))e.filter((a)=>cm.test(a)&&Aa(a)).forEach((a)=>{ux(t,a)});let i=o===-1?-1:Cm(e,o);if(i===-1||e[i]!=="unset")return;let s=mx(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(dm.has(r)){t.shellAssignments.set(a,"");return}dx(t,a)})}function hm(e,t){let n=ym(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function ym(e,t){let n=dm.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!bm(a)),o=r!==-1&&um.has(e[Cm(e,r)]??""),i=lx(t);return{assignments:e.flatMap((a,l)=>{let c=sx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!_o(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Cm(e,t){let n=t;while(rx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function bm(e){return Pe(e)!==null||lm.test(e)}function sx(e,t,n){return Pe(e)??ax(e,t,n)}function ax(e,t,n){let r=wo(e,n,t);if(r)return r;let o=e.match(lm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Aa(e){return e===Pa||e===Ta||ea(e)}function lx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function cx(e,t){let n=[Pa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function ux(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function dx(e,t){if(!Aa(t)&&!cm.test(t))return;if(e.shellAssignments.set(t,""),_o(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Aa(t)||t===Pa||t===Ta||$n(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function mx(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as fx}from"node:path";function Yo(e,t){return Qs.some((n)=>t?.has(n)||e.has(n))}function En(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(fx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=Sm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=Sm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function Sm(e,t,n){try{let r=yt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function vm(e,t,n){if(!t.localDiscard||!n.worktreeMode||Yo(n.environment.env,n.envAssignments))return null;let r=En(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Oa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Oa(e,t,n){let{subcommand:r,rest:o}=_e(e),i=r?.toLowerCase();if(t.dynamicArguments||px(o)||bx(e,t.environment.env,t.envAssignments,n)||yx(o)||gx(i,o))return!0;return i==="clean"&&Cx(o)>1}function px(e){return e.some((t)=>/[$*?[]/.test(t))}function gx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:_a}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:wa}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||hx(s))||r.has("-C");return o&&i}return!1}function hx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function yx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Cx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function bx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=qo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>vx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Sx(s.value);if(ed(n))return!0;return r.recursiveSubmodules}function Sx(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function vx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function xm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??w(l)),o=n.environment.paths,i=En(r,n.cwd,o),s=n.originalCwd?o.realpath(Rx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Yo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?wx(e,n.shellAssignments,o):Rm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!_x(a,r,t,n)||!yn(a,n.environment)||Fo(a,n.environment)||Cn(s,a)||Cn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function _x(e,t,n,r){let o=r.environment.paths,i=Em(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Oa(t,r,a)}function wx(e,t,n){let r=_e(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((u)=>!u.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((u)=>u.text===a),c=(l&&Ye(l,t??new Map))??a;if(!xx(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function Rm(e,t){if(t.entryKind(Em(e,".git"))!=="missing")return e;let n=Ex(e);return n===e?null:Rm(n,t)}var Px="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Tx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Zo(e,t){return _m(e,t)}function _m(e,t,n){let r=e.map(w),o=rm(r,t.environment.env,t.envAssignments),i=o.blockedReason?T(S("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((Qu(t.envAssignments)||om(r,t.environment.env,t.envAssignments))&&Ix(s))return S("git.ssh-env",Px);let a=sm(s,(c)=>{let u=En(r,t.cwd,t.environment.paths).gitCwd;return u!==null&&t.environment.paths.entryKind(Ax(u,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=vm(r,a,t)??xm(e,a,t);if(!l)return a;return n?.(l),null}function wm(e,t){let n=null;return{match:_m(e,t,(o)=>{n=o}),relaxation:n}}function Ix(e){let{subcommand:t,rest:n}=_e(e),r=t?.toLowerCase();if(!r)return!1;if(Tx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&kx(n)}function kx(e){return e.find((t)=>!Ox(t))?.toLowerCase()==="update"}function Ox(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as aR}from"node:path";function Am(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Xo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Pm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Mx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Dx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Im="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Nx="rm -rf in home directory is dangerous. Change to a project directory first.",Tm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Im},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Dx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Nx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Pm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Mx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Pm}};function Jo(e,t){let n=Et({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Vo(r),s=Wx(e);for(let a of s){let l=pr(a.word);if(o&&l.unsafeBraceExpansion){let c=T(fr({kind:"outside_anchored_cwd"},n,t.policy,Tm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let u=Se(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&zt(u,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let d=Fe(u,n,m);if(d.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",Im);if(d.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let d of Lx(u,n,m)){let f=fr(d,n,t.policy,Tm),g=T(f,t.policy);if(g)return g}}}return null}function Lx(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Wx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Rt={kind:"none"},Vt={kind:"dynamic"},Gx=new Set(["<","<<","<<-","<<<","<&","<>"]),Om=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Fx=/^(?:[0-9]+|[@*])$/,zx=ht.maxWords,Mm=ht.maxInputLength;function Dm(e){if(!e||I(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function qo(e){let t=yn(e[1])==="--"?2:1;if(e.length<=t)return St;let n=e.slice(t);if(!n.every(hr))return $t;return{kind:"literal",source:n.map(w).join(" ")}}function Tf(e){let t=yn(e[1])==="--"?2:1,n=e[t],r=yn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return St;if(!hr(n))return $t;return{kind:"literal",source:r}}function Yo(e,t){let n=Of(e);if(n===-1)return St;let r=Mx(t);if(!r)return St;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Dx(s,e,n,r.ifs);if(!a)return $t;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>kx||i>Af)return $t;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Mf)].filter((s)=>s!==null).join(" ")}}function If(e,t){let n=Of(e),r=e.slice(n+1);if(n===-1||!r.every(hr)||/\bIFS\b/.test(t))return t;let o=r.map(yn),i="",s=null,a=0;while(a<t.length){let l=t[a]??"",c=s==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(a));if(c){let u=c[1]??c[2],f=u==="@"||u==="*"?o.slice(1):[o[Number(u)]??""];if(s!=='"'&&f.some((d)=>/[*?[]/.test(d)))return t;if(i+=s==='"'?f.map((d)=>d.replace(/["$`\\]/g,"\\$&")).join(u==="@"?'" "':" "):f.map((d)=>d.split(/[ \t\n]+/).map((m)=>m?Mf(m):"").join(" ")).join(" "),i.length>Af)return t;a+=c[0].length;continue}if(l==="\\"&&s!=="'"){i+=t.slice(a,a+2),a+=2;continue}if(l==="'"&&s!=='"'||l==='"'&&s!=="'")s=s?null:l;i+=l,a++}return i}function kf(e,t,n,r){if(!ve(e.map(w)).readsStdinAsCommands)return St;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&Tx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return St;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return $t;return{kind:"literal",source:o.target.text}}if(!n)return St;return r===void 0?$t:{kind:"literal",source:r}}function it(e){let t=ve(e.map(w)).scriptIndex;if(t===null)return St;let n=e[t],r=yn(n);return mo(n,r)?{kind:"literal",source:r}:$t}var Ox=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function ka(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(O(s));return!Ox.has(a)&&!Y.has(a)&&!Ft(a)}function Of(e){return ve(e.map(w)).commandIndex??-1}function Mx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Nx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function Nx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Dx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Pa(o):Lx(o,r);if(e.parameter==="*"){let a=Pa(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Ta(l,r)}let i=t[n+1+e.parameter];if(i&&!hr(i))return;let s=yn(i);return e.quoted?[s]:Ta(s,r)}function Pa(e){return e.every(hr)?e.map(w):void 0}function Lx(e,t){let n=Pa(e);if(!n)return;let r=n.map((o)=>Ta(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Ta(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Qo(e){let t=xn(e[1])==="--"?2:1;if(e.length<=t)return Rt;let n=e.slice(t);if(!n.every(vr))return Vt;return{kind:"literal",source:n.map(w).join(" ")}}function Nm(e){let t=xn(e[1])==="--"?2:1,n=e[t],r=xn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Rt;if(!vr(n))return Vt;return{kind:"literal",source:r}}function ei(e,t){let n=Gm(e);if(n===-1)return Rt;let r=$x(t);if(!r)return Rt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Hx(s,e,n,r.ifs);if(!a)return Vt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>zx||i>Mm)return Vt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Fm)].filter((s)=>s!==null).join(" ")}}function Lm(e,t){let n=Gm(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(vr)||o)return t;let i=r.map(xn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",u=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(u){let m=u[1]??u[2],d=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&d.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?d.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):d.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?Fm(p):"").join(" ")).join(" "),s.length>Mm)return t;l+=u[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function Wm(e,t,n,r){if(!Ee(e.map(w)).readsStdinAsCommands)return Rt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&Gx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Rt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Vt;return{kind:"literal",source:o.target.text}}if(!n)return Rt;return r===void 0?Vt:{kind:"literal",source:r}}function lt(e,t=new Map){let n=Ee(e.map(w)).scriptIndex;if(n===null)return Rt;let r=e[n],o=xn(r);if(bo(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?Vt:{kind:"literal",source:i}}var Bx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function La(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(O(s));return!Bx.has(a)&&!q.has(a)&&!Ut(a)}function Gm(e){return Ee(e.map(w)).commandIndex??-1}function $x(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Ux);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function Ux(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Hx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ma(o):jx(o,r);if(e.parameter==="*"){let a=Ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Da(l,r)}let i=t[n+1+e.parameter];if(i&&!vr(i))return;let s=xn(i);return e.quoted?[s]:Da(s,r)}function Ma(e){return e.every(vr)?e.map(w):void 0}function jx(e,t){let n=Ma(e);if(!n)return;let r=n.map((o)=>Da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function hr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function yn(e){return e?w(e):""}function Mf(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Oa(e,t){return Ia(Ne(e,"posix"),t)}function yr(e){return Oa(e,new Set(Array.from(e.matchAll(wf)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Ia(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Ia(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Ia(o,n))||Nf(r.words,n))return!0;Bx(r,n)}return!1}function Nf(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(gr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return _f(e[s],t)}if(Y.has(o)){let s=e.slice(n),a=ve(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&_f(s[l],t)}let i=Wx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Nf(e.slice(i),t)}function Wx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Gx(e,t+1);if(r==="exec")return Fx(e,t+1);if(r==="env")return zx(e,t+1,n);return null}function Gx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Fx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function zx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return gr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return gr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Bx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(gr(n,t))t.add(r.name)}}function gr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(wf)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Ix.test(o)||t.has(o))}))}function _f(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||gr(e,t))}var Ma="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Na="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",$x="__CC_SAFETY_NET_XARGS_INPUT__",Zo="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",Xo="rm",Ux=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Hx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,jx=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Vx=/^(?:[0-9]+|[@*])$/;function Wf(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Ut(n),i=n.slice(r),s=b("xargs.shell-dynamic",Na);if(qx(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let u=Uf(l,o,a.wrapperEnvAssignments),f=a.head==="rm"&&o!==null&&Bf(l,o),d=t.analyzeChild(l,{...zt(a,t),dynamicInput:u,dynamicSourceInput:f||Ff(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:f,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:b("xargs.rm-recursive-force-dynamic",Ma)});if(d)return d;let m=Kx(l,o,t.policy?.rules??[],P(s,t.policy));if(m)return m;if(a.head==="git"){let g=o===null?[...l,$x]:l,h=o!==null&&(l.some((S)=>S.includes(o))||Array.from(a.envAssignments.values()).some((S)=>S.includes(o))),y=t.analyzeChild(g,{...zt(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=nt(l,t.policy?.rules??[]);if(p)return p}return null}function Kx(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=nt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Gf(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=vf(e,r,t.length,n);return o===null?[]:[o]}function Ff(e,t,n,r,o,i,s){if(Y.has(t)){if(rt(e))return!1;if(n!==null&&Yx(e,n,s))return!0;let a=$e(e);if(!a){let l=it(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!zf(a,n,s))return!0;if(Ae(a))return!0;return Zx(a,n,r)}if(Me(t))return Df(e,n,Co,$u(t));if(we.has(t))return Df(e,n,fa,$d);if(t==="eval"){let a=qo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return Xx(e,n,i);if(t==="git"){let a=Re(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&gn.has(a.subcommand.toLowerCase())&&$f(a.rest,n).some((l)=>l.includes(n))}return!1}function zf(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function Df(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,Zo]).sources.some((a)=>a.value===Zo);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${Zo}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${Zo}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Gf(l,t,a))));return Vo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function qx(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,Xo]:e.map((i,s)=>s===0?i:i.replaceAll(t,Xo));return Array.from(ze(o,n)).some((i)=>i.head===Xo&&!r.has(Xo))}function Bf(e,t){return $f(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function $f(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Uf(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function Yx(e,t,n){let r=ve(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!zf(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Gf(a,t,s).some((u)=>{let f=e.map((m,p)=>p===l?m.replaceAll(t,u):m),d=ve(f);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(f[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(f[d.scriptIndex]??"").includes(u)})}))}function Zx(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Ux))if(Lf(o,r))return!0;for(let o of e.matchAll(Hx))for(let i of(o[1]??"").matchAll(jx))if(Lf(i,r))return!0;return Oa(e,r)}function Lf(e,t){let n=e[1]??e[2];return n!==void 0&&(Vx.test(n)||t.has(n))}function Xx(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(Ke(s)){let l=pn(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=Uf(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Bf(c.tokens,t)||Ff(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=ot(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Ut(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var Cr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",br="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",Qx="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",eR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",Qo=/\{[^{}\s]*\}/g,Hf=/\{\}|\{-?\d+\}/g,tR=["e","f","source","file","-e","-f","--source","--file"],nR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],rR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),oR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),jf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),iR=new Set(["--workdir","--wd"]),Vf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function Xf(e){return Ie([...e],(t)=>Ae(t))}function Jf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=Cn(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=am(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:f}=o;if(c){let p=Cn(t);if(p)return p;let g=Xf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=dR(t);if(p)return p}if(u!==void 0&&a){let p=Cn(t);if(p)return p}let d=fR(u,t.cwd,t.environment.paths);if(d===null){let p=Cn(t);if(p)return p}let m=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(f){if([...ze(i,m)].flatMap((g)=>[...g.envAssignments.values()]).some(Wa)){let g=Cn(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=nm(m.envAssignments,m.cwd,a);return Ie(p,(h)=>t.analyzeNested(h,g))}return Ie(ze(i,m),(p)=>sR(p,o,t,m))}function sR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(im)){let h=Cn(n);if(h)return h}let u=Xf(c);if(u)return u;let f=c.some(G),d=i||f,m=a&&d,p=nm(e.envAssignments,e.wrapperCwd,s||m);if(Y.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(Jo(l,E,n.budget),zt(e,r)))};if(rt(l))return h();let y=$e(l);if(y){if(sm(y)){let x=vt(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(Yf(y,A,n.budget),p))}if(G(y)){if(o.length>0)return Ie(o,(q)=>n.analyzeNested(Yf(y,q,n.budget),p));let x=mr(y);if(x?.[0]&&O(x[0])==="rm"&&Be(x)){let q=qf(n);if(q)return q}let A=x?n.analyzeChild(x,{...zt(e,r),dynamicInput:a,shellDynamicMatch:b("parallel.shell-dynamic",br),rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",Cr)}):null;if(A)return A;return n.analyzeNested(y,p)}let E=!f&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>Yo(K(x===void 0?l:i?l.map((A)=>rm(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=vt(n);if(x)return x}let v=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(v.length>0)return n.budget.charge("derivedTokens",v.length),Ie(v,(x)=>n.analyzeNested(x,p));if(yr(y)){let x=vt(n);if(x)return x}let T=n.analyzeNested(y,p);if(T)return T;if(d)return vt(n);return null}let S=it(K(l));if(S.kind==="dynamic"||S.kind==="literal"&&G(S.source))return vt(n)??h();if(S.kind==="literal")return h();if(o.length>0){let E=vt(n);if(E)return E;let v=h();if(v)return v;if(i)return null;let T=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",T.length),Ie(T,(x)=>n.analyzeNested(x,p))}if(d||a)return vt(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>Da(Jo(l,y,n.budget,Hf),e.cwd,r));if(o.length>0)return Ie(o,(y)=>Da(Zf(l,y,n.budget),e.cwd,r));let h=Da(l.flatMap((y,S)=>{if(S===0||!G(y))return[y];return y.startsWith("-")?[y.replace(Hf,"")]:[]}),e.cwd,r);if(h)return h;return qf(n)}let g=o.length>0?o:[void 0];return Ie(g,(h)=>{let y=h===void 0?l:i?Jo(l,h,n.budget):Zf(l,h,n.budget),S=b("parallel.shell-dynamic",br),E=a&&e.head==="find"?uR(y,r):null,v=em(y,a,n)??E?.customResult??null,T=O(e.head),x=a&&(T==="rm"&&La(y)||T==="xargs"&&tm(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&Qf(y,T)),q=n.analyzeChild(y,{...zt(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:v!==null||A,shellDynamicMatch:S,dynamicSourceMatch:S,rmDynamicMatch:b("parallel.rm-recursive-force-dynamic",Cr)});if(A){let X=P(S,n.policy);if(X)return X}return q??v??nt(y,n.policy?.rules??[])})}function Qf(e,t){if(G(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Y.has(t))return cR(e);if(t==="git")return aR(e);if(t==="find")return!0;if(we.has(t))return Kf(e,tR,dr);if(Me(t))return Kf(e,nR,yo);return!1}function La(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(G))return t===-1;return n.some((o)=>G(o)&&(o.startsWith("-")||sm(o)))}function aR(e){if(lR(e))return!0;let t=Re(e);if(t.subcommand===null||G(t.subcommand))return!0;if(!gn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(G))return n===-1;return r.some(G)}function lR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(G(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(G(n))return!0;continue}if(G(n))return!0}return!1}function cR(e){if(rt(e))return!1;let t=$e(e);if(t!==null)return G(t);let n=it(K(e));if(n.kind==="literal")return G(n.source);if(n.kind==="dynamic")return!0;return!e.some(G)}function Kf(e,t,n){let r=n(e);if(r.some((o)=>G(o.value)))return!0;if(!e.some(G))return n([...e,Vf]).some((o)=>o.value===Vf);return Vo(r,t,(o)=>n(e.map((i)=>rm(i,[o]))))}function em(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(G))return vt(n);return Ie(o,(i)=>nt([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function uR(e,t){let n={customResult:null,executedSource:!e.some(G),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(G))return;for(let a of ze(i,t))n.executedSource||=Qf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&La(a.tokens)||a.head==="xargs"&&tm(a.tokens),n.customResult??=em(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=G(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(Ke(a)){i=[],n.executedSource||=G(a);continue}let l=ot(a);if(l>0){o=l,n.executedSource||=G(a);continue}n.executedSource||=G(a)}return s(),n}function tm(e){let t=e.slice(Ut(e).childStart);return O(t[0]??"")==="rm"&&La(t)}function ei(e,t){return(n)=>P(b(e,t),n.policy)}var vt=ei("parallel.shell-dynamic",br),dR=ei("parallel.command-stream-dynamic",Qx),Cn=ei("parallel.command-stream-dynamic",eR),qf=ei("parallel.rm-recursive-force-dynamic",Cr);function Da(e,t,n){return P(Ko(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ct(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Lt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function nm(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function rm(e,t){return e.replace(Qo,(n)=>om(n,t))}function Jo(e,t,n,r=Qo){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=om(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function Yf(e,t,n){return Jo([e],t,n)[0]??""}function Zf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function om(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function G(e){return e.search(Qo)!==-1}function im(e){if(Wa(e))return!0;for(let t of e.matchAll(Qo))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function Wa(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function sm(e){return/^\{[^{}\s]*\}$/.test(e)}function fR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!Jx(e))return null;try{return pt(t??e,e,n)}catch{return null}}function am(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let E=ga(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!p.startsWith("-")){let E=ga(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),S=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let E=y==="--replace"?S:p.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(p==="-a"||oR.has(y)){c=!0,t+=S===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=S===void 0?2:1;continue}if(jf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=jf.has(p)?2:1;continue}if(iR.has(y)){c=!0;let E=S??g;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=S===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&S!==void 0){t++;continue}if(rR.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?Wa:im);let u=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){u.push(p),p=[];continue}if(h!==void 0)p.push(h)}u.push(p)}c||=u.length>1;let f=mR(u),d=n.some(G),m=n.length===0&&o===-1;return{template:n,jobs:f,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:m,unsupported:c,workdir:a,dryRun:l}}function mR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function lm(e){return am(e).childStart}var pR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",ti="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Fa(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ga(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function um(e,t,n,r,o=!1,i){let a=(Un(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?b("shell.dynamic-executable",pR):null;return P(a,i)??dm(e,t,n,o,i)}function dm(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Fa(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=sn(e,t),l=hR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((f)=>f<=l))return P(b("shell.dynamic-structure",ti),o);if(P(jo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((f,d)=>d>l&&w(f)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&gn.has(c)&&i.some((f)=>f>l&&(u===-1||f<u)))return P(b("shell.dynamic-structure",ti),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&yR(t)?P(b("shell.dynamic-structure",ti),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(b("shell.dynamic-structure",ti),o):null}if(s==="xargs")return cm(e,t.slice(Ut(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return cm(e,t.slice(lm(t.map(w))),"parallel",n,r,o);return null}function cm(e,t,n,r,o,i){if(t.length===0)return null;let s=gR(t,r);if(Un(e,s)){let l=P(b(`${n}.shell-dynamic`,n==="xargs"?Na:br),i);if(l)return l}let a=dm(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Fa(l)&&Ga(l)))return P(b(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ma:Cr),i);return null}function gR(e,t){let n=Mt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function hR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(Se.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function yR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Fa(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ga(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ga(s)))return!0;continue}if(t=!0,a)return!0;let l=ot(s.text);if(l>0){n=l;continue}if(Ke(s.text))o=!0,r=!0}return!1}function za(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!mo(t[n.tokenIndex],n.value)})}var CR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",bR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",SR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function fm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return b("dd.device-write",CR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return b("mkfs.device",bR);if(e==="shred"&&n.length>0)return b("shred.target",SR);return null}var pm=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Ko(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ct(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>jo(e.words,Ba(e))},{heads:new Set(["find"]),analyze:(e)=>Yd(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:Ct(e.envAssignments,e.options.environment),trustedTmpdirValue:Lt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Wf(e.words,{...mm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>Jf(e.words,{...mm(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Ht(e.options.analyzeNested(t,n))})}];function mm(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Ht(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Ba(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function Cm(e){return pm.find((t)=>t.heads.has(e))?.analyze}function Sn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?w(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,f=s?s.originalCwd:c?void 0:n.cwd,d=vo(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let m=Mt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),p=m.envSplitValues??[];if(p.length>0){let R=[...p,...i(m.words)].join(" "),k=Ae(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),de(k);if(n.strict)return ye(r);let L=Eo(p,i(m.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:m.cwd===void 0?n.effectiveCwd:m.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments])});if(te)return te}}let g=m.rewritten?K(i(m.words)):sn(o,m.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>g.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let S=new Map([...n.envAssignments??[],...d.envAssignments,...m.envAssignments]),E=h[0];if(!E)return null;if(Ft(E))throw new N("wrapperPeelIterations");let v=O(E),T=m.cwd===null?void 0:m.cwd??u,x=m.cwd===null?void 0:f,A=m.cwd===void 0?n.effectiveCwd:m.cwd,q=s?s.allowTmpdirVar:!sr(S,n.environment),X=um(o,m.words,n.environment,t===0,n.strict,n.policy);if(X)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:X.reason}),de(X);let ee=Fo(h,n.policy);if(ee){for(let R of[ee.childIndex,...ee.alternativeChildIndices]){gm(y.wrapperNormalizationBudget);let k=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:ee.wrapper,output:i(k)});let L=Sn(k,t,{...y,effectiveCwd:A,envAssignments:S});if(L)return L}return null}let J=l?void 0:v==="eval"?qo(g):v==="trap"&&!a?Tf(g):void 0;if(a&&s&&v==="eval"){if(J?.kind==="dynamic")return bn(s,n.policy);if(J?.kind==="literal"){let R=n.analyzeNested(J.source,{effectiveCwd:A,envAssignments:S});if(R)return R}return vn(s,n.policy)}if(J?.kind==="dynamic"&&(n.strict||!n.commandView||!ka(n.commandView)))return ye(r);if(J?.kind==="literal"){r?.recordSegment({type:"recurse",reason:v==="eval"?"shell-eval":"shell-trap",innerCommand:J.source,depth:t+1});let R=n.analyzeNested(J.source,{effectiveCwd:A,envAssignments:S,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?Y.has(v):Sm(E,v)){if(rt(h))return null;if(a&&s){let R=$e(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=bn(s,n.policy);if(L)return L}if(yr(R)){let L=bn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:S})}let k=it(g);if(k.kind==="dynamic")return bn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?bn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?bn(s,n.policy):null}if(l){let R=$e(h),k=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:S}):it(g).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=RR(h,S,A,n,r,t);if(R)return R;let k=$e(h);if(k){let qt=Yo(g,k);if(qt.kind==="dynamic")return ye(r);let Ci=qt.kind==="literal"?qt.source:If(g,k),gl=_R(Ci);r?.recordSegment({type:"shell-wrapper",wrapper:v,innerCommand:gl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:gl,depth:t+1});let hl=n.analyzeNested(Ci,{effectiveCwd:A,envAssignments:S});if(hl)return hl;return yr(Ci)?ye(r):null}let L=it(g);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ni(L.source,A,S,n,r,t);let te=kf(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:S})}}if(!s&&(v==="source"||v===".")){let R=h[1]==="-p"?2:null;if(R!==null){let qt=n.commandView?g[R]:void 0;if(!qt)return null;if(qt.provenance!=="literal")return ye(r)}let k=R===null?1:3,L=h[k]==="--"?k+1:k,te=n.commandView?g[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ni(te.text,A,S,n,r,t);if(n.strict||!n.commandView||!ka(n.commandView))return ye(r)}if(we.has(v)&&!l){if(!s&&n.strict&&za(dr(h),g))return ye(r);let R=Ud(h,(L)=>Ht(n.analyzeNested(L,{effectiveCwd:A,envAssignments:S}))),k=P(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),de(k)}if(Me(v)&&!l){if(!s&&n.strict&&za(yo(h),g))return ye(r);let R=Bu(h);if(a&&s)return ER(v,R,A,S,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:v,codeArg:R,paranoidBlocked:k}),k){let te=P(b("interpreter.one-liner-paranoid",Xn),n.policy);if(te)return de(te)}if(Hs(v,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:S});if(L&&!bm(L,R))return L;if(Jn(R,void 0,!n.strict)){let te=P(b("interpreter.dangerous-command",cn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:cn}),de(te)}r=void 0}}if(v==="busybox"&&h.length>1)return gm(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Sn(g.slice(1),t,{...y,effectiveCwd:A,envAssignments:S});let D=s?null:P(fm(v,h),n.policy);if(D)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:D.reason}),de(D);let ue=r===y.trace?y:{...y,trace:r},_e={words:g,head:v,cwd:T,originalCwd:x,envAssignments:S,allowTmpdirVar:q,dynamicArguments:m.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:ue,analyzeChildTokens:(R,k)=>a&&s?$a(R,t,ue,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Ht(Sn(K(R),t+1,{...ue,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:S}))??nt(R,ue.policy.rules),analyzeChild:(R,k)=>$a(R,t,ue,k)},Ze=s&&(v==="xargs"||v==="parallel")?void 0:Cm(v);if(v==="rm"||v==="xargs"||v==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:S.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:q});let ke=r&&v==="git"?Sf(_e.words,Ba(_e)):void 0,hi=hm(ke?ke.match:Ze?.(_e)??null,n.policy);if(r)wR(_e,hi,ke?.relaxation??null);if(hi)return de(hi);if(a&&s&&(v==="rm"||v==="rmdir")){if(!(v==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?vn(s,n.policy):null)??xR(s,n.policy)}let pl=!s&&Ze===void 0&&!Fr.has(v),yi=r&&pl?[]:void 0;if(pl)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;yi?.push(k);let L=hm(vR(h,R,t,ue,T,x,A,S),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[],embeddedCommandFound:O(k)}),de(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:yi??[]}),l&&s&&!s.wrappedByTransparent)return null;let Ar=nt(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ar,reason:Ar?.reason}),Ar)return de(Ar);return a&&s?vn(s,n.policy):null}function $a(e,t,n,r){return Ht(Sn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function vR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(Sm(c,u)||Cm(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=$a(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!sr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function ER(e,t,n,r,o,i){if(!t)return vn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(b("interpreter.one-liner-paranoid",Xn),o.policy);if(a)return de(a)}if(Hs(e,t))return vn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!bm(s,t))return s;if(Jn(t,void 0,!o.strict)){let a=P(b("interpreter.dangerous-command",cn),o.policy);if(a)return de(a)}return vn(i,o.policy)}function bm(e,t){if(e.ruleId==="raw-text.dangerous-command")return!0;return(e.reason.startsWith(Lo)||e.reason===mn)&&!zr(t)}function bn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function vn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function xR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function RR(e,t,n,r,o,i){let s=qd(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ni(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ni(a,n,t,r,o,i,!0)}function ni(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=Zn(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function _R(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function wR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function gm(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:cr}),de(AR())}function AR(){return{id:"",reason:cr,intent:"stop_and_explain"}}function Sm(e,t){return Y.has(t)||e==="$SHELL"||e==="${SHELL}"||Y.has(I(t))}function hm(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var PR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,TR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function IR(e,t){let n=xm(e,t);if(n.length===0)return!1;let r=n[Em(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return PR.test(e.join(" "))}function vm(e,t,n,r,o){if(e.dialect==="powershell"){let h=OR(e.words,o);if(h.kind==="none")return;if(!t||h.kind==="unknown")return null;return ym(LR(h.target),t,n.paths)}let i=e.words.map(w),s=i.some((h)=>/^CDPATH\+?=/.test(h));if(!IR(i,n))return s?null:void 0;if(!t)return null;let a=xm(i,n,t),l=Em(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((h)=>h.length<=1||!h.startsWith("-")||h==="--");if((u===-1?c:c.slice(0,u)).some((h)=>!/^-[LP]+$/.test(h)))return null;let d=u===-1?[]:c.slice(u),m=d[0]==="--"?d.slice(1):d;if(m.length!==1)return null;let p=m[0]??"",g=e.words.some((h)=>h.provenance==="variable"&&h.text===p)?kR(p,r):p;if(g===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(g)&&(s||n.env.has("CDPATH")))return null;return ym(g,t,n.paths)}function kR(e,t){let n=pr(e,t);return n.startsWith("~")||/[\s$`*?[]/.test(n)?null:n}function ym(e,t,n){if(!e||e==="-"||e.includes("$")||e.includes("`"))return null;try{return pt(t,e,n)}catch{return null}}function OR(e,t){let n=MR(e[0])?1:0,r=e[n];if(!NR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!TR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return DR(e.slice(n+1),t)}function MR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function NR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function DR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function LR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Em(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function xm(e,t,n){let r=WR(e);return gt([...r],t,n)}function WR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var GR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",jt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Ka(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:je}),{reason:je,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Va(e,n);let u=`${Lo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Tm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Tm(e,n),{reason:mn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Va(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=lf(n.environment.env,n.envAssignments);return ii(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions)}]).result}function ii(e,t,n,r,o){let i=[...o],s,a;for(let[l,c]of e.nodes.entries()){if(c.kind==="connector"){a=c.operator;continue}let u=e.nodes[l+1],f=u?.kind==="connector"?u.operator:void 0,d=FR(e,l,c,a,f),m=a==="&&"||a==="||",p=m?s:void 0,g=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,h=a==="||"?p?.success??[]:[],y=a==="&&"?p?.failure??[]:[],S=m||xn(f);if(c.kind==="function"){let X=g.flatMap((J)=>{let U=Rn(J);return U.functionDefinitions.set(c.name,c.body),Ua(J,[U],d,f==="&",xn(f))}),ee=Ha(X,[],h,y,a,f);i=ee.states,s=ee.conditionalStates,a=void 0;continue}if(c.kind==="group"){let X=[],ee=[];for(let U of g){let D=ii(c.body,t,n,r,[Rn(U)]);if(D.result)return D;if(X.push(...Ua(U,D.states,d,f==="&",xn(f))),S)ee.push(U,...d?D.states.map((ue)=>ri(U,ue)):D.states)}let J=Ha(X,ee,h,y,a,f);i=J.states,s=J.conditionalStates,a=void 0;continue}if(c.kind!=="command")continue;let E=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),v=e.nodes[l-2],T=si(a)&&v?.kind==="command"?Pf(v)??BR(v):void 0,x=[],A=[];for(let X of g){let ee=$R(c,t,n,r,[Rn(X)]);if(ee.result)return{result:ee.result,states:i};let J=e.dialect==="powershell"?ee.states:ee.states.map((U)=>ri(X,U));for(let U of J){let D=Rn(U),ue=jR(c,t,n.trace?{...n,trace:Im(n.trace,E)}:n,r,D,si(a),T);if(ue)return{result:ue,states:i};let _e=a_(c,D.functionDefinitions);if(_e)n.budget.charge("derivedTokens",ai(_e));let Ze=_e?t+1>=V.recursionDepth.cap?ja(c.displayText,n,[D]):ii(_e,t+1,n,r,[D]):{result:null,states:i_(c,D)};if(Ze.result)return Ze;if(x.push(...Ua(X,Ze.states,d,f==="&",xn(f))),S)A.push(X),A.push(...Ze.states.map((ke)=>d?ri(X,ke):ke))}}let q=Ha(x,A,h,y,a,f);i=q.states,s=q.conditionalStates,a=void 0}return{result:null,states:i}}function FR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(si(r)||si(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&zR(e,t)}function Ua(e,t,n,r,o){let i=n?t.map((a)=>ri(e,a)):[...t],s=o?i.flatMap((a)=>En(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function ri(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles)}}function zR(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(UR(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function si(e){return e==="|"||e==="|&"}function BR(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function xn(e){return e==="&&"||e==="||"}function Ha(e,t,n,r,o,i){let s={success:oi([...n,...e]),failure:oi([...r,...t])},a=xn(i)?s:void 0;return{states:xn(o)||a?oi([...s.success,...s.failure]):s.success,conditionalStates:a}}function Im(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function $R(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=HR(e);if(s){if(t+1>=V.recursionDepth.cap)return ja(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return ja(s,n,o);if(a.status!=="complete")return Rm(i,n,r,o);n.budget.charge("derivedTokens",ai(a)),i.push({program:a,depth:t+1})}}return Rm(i,n,r,o)}function UR(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Rm(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ii(i.program,i.depth,t,n,[Rn(a)]);if(l.result)return l;s.push(...l.states)}o=oi(s)}return{result:null,states:o}}function HR(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function ai(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+ai(o),0):n.kind==="group"||n.kind==="function"?ai(n.body):0),0)}function ja(e,t,n){return t.trace?.recordSegment({type:"error",message:je}),{result:{reason:je,segment:e,intent:"stop_and_explain"},states:[...n]}}function jR(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env}},l=JR(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};km(e,o,"before-consumer",a.environment.paths,a.budget);let c=sn(e.dialect,e.words),u=c.map(w),f=e.displayText,d=af(c,o.shellGitContextState),m=uf(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Dd(e,i,c_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return l_(f,h)}if(u.length===1&&u[0]?.includes(" ")&&!Un(e.dialect,e.words)){let h=P(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Wu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:f,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let S=_m(e,l,o,m,s,a);if(S)return S;return _a(d,o.shellGitContextState),null}let p=Sn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:m,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let S=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Ka(h,t+1,{...a,effectiveCwd:S,envAssignments:y?.envAssignments??m,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Im(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(p)return{...p,segment:f};let g=_m(e,l,o,m,s,a);if(g)return g;return _a(d,o.shellGitContextState),null}function _m(e,t,n,r,o,i){let s=QR(e,t,n,r??new Map,i);if(s)return s;return km(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),qR(e,t,n,i.environment.paths,i.budget),n_(e,n,o,i.environment,i.trace),null}var VR=new Set([">>","<>"]);function km(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?KR(s):VR.has(s.operator)))continue;wm(s.target,t,r,o)}if(n!=="before-consumer"||!le(e.words[0],"tee"))return;let i=Om(e.words.slice(1));if(!i)return;for(let s of i.operands)wm(s,t,r,o)}function KR(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function wm(e,t,n,r){let o=e?.provenance==="literal"?Zn(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function qR(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of YR(e)){let a=Zn(s.text,n.effectiveCwd,r,o);if(!a||!zu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function YR(e){let t=XR(e.redirections)?.target,n=Am(t)?[t]:[];if(le(e.words[0],"cat"))return ZR(e.words)?n:[];if(!le(e.words[0],"tee"))return[];let r=Om(e.words.slice(1));if(!r||r.append||r.hasUnsupportedOptions||!r.operands.every(Am))return[];return[...r.operands,...n]}function ZR(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function XR(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Om(e){let t=[],n=!0,r=!1,o=!1;for(let i of e){if(i.provenance!=="literal")return;if(n&&le(i,"--")){n=!1;continue}if(n&&!i.quoted&&i.raw===i.text&&/^-[^-]/.test(i.text)){r||=i.text.slice(1).includes("a"),o||=Array.from(i.text.slice(1)).some((s)=>s!=="a"&&s!=="i");continue}if(n&&!i.quoted&&i.raw===i.text&&i.text.startsWith("--")){r||=i.text==="--append",o||=i.text!=="--append"&&i.text!=="--ignore-interrupts";continue}t.push(i)}return{operands:t,append:r,hasUnsupportedOptions:o}}function Am(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function le(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function qa(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function JR(e,t){let n=e.redirections.filter((a)=>a.operator==="<<"||a.operator==="<<-");if(n.length===0)return;if(n.length!==1)return jt;let r=n[0];if(!r?.heredoc)return jt;if(!qa(r.heredoc)&&!(t&&!/\$\(|`/.test(r.heredoc.body)))return GR;if(r.fd!==void 0&&r.fd!==0)return jt;if(e.redirections.some((a)=>a!==r&&["<","<<","<<-","<<<","<&","<>"].includes(a.operator)))return jt;let o=e.redirections.some((a)=>a!==r&&Pm(a.target));if(le(e.words[0],"cat"))return o?jt:void 0;if(le(e.words[0],"tee"))return o||e.words.slice(1).some(Pm)?jt:void 0;let i=e.words[0],s=e.words[1];if(le(i,"git")&&(le(s,"apply")||le(s,"commit")))return;if(le(i,"gh")&&(le(s,"pr")||le(s,"issue"))&&le(e.words[2],"create"))return;return jt}function Pm(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function QR(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(t_(e,i,n,r,o))return null;let a=e_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Va(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function e_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!qa(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=le(e.words[0],"uv")&&le(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((f)=>le(f,"-"));if(!o.slice(1,s===-1?void 0:s).every((f)=>f.provenance==="literal"&&f.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let f=P(b("interpreter.one-liner-paranoid",Xn),n.policy);if(f)return f}if(!Jn(l,void 0,!n.strict))return null;let u=P(b("interpreter.dangerous-command",cn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function t_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!qa(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Mt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!Y.has(l)&&!Y.has(I(l)))return!1;return rt(a)}function n_(e,t,n,r,o){let i=vm(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var r_=/^[A-Za-z_][A-Za-z0-9_]*$/,o_=8;function i_(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!r_.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=o_&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Rn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Rn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:cf(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions)}}function oi(e){let t=[];for(let n of e){if(!t.some((r)=>s_(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function s_(e,t){return e.effectiveCwd===t.effectiveCwd&&En(e.shellGitContextState.env,t.shellGitContextState.env)&&En(e.literalHeredocFiles,t.literalHeredocFiles)&&En(e.functionDefinitions,t.functionDefinitions)&&En(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&En(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&e.shellGitContextState.bodyAssignments.size===t.shellGitContextState.bodyAssignments.size&&[...e.shellGitContextState.bodyAssignments].every((n)=>t.shellGitContextState.bodyAssignments.has(n))}function En(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function a_(e,t){let n=Hn(e);return n===void 0?void 0:t.get(n)}function l_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function c_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Va(e,t){let n=P(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Tm(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:mn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var u_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Mm(e,t,n,r){let o=Ka(e,0,{...t,...iu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Nm(e,t,n){try{return{decision:e()}}catch(r){let o=d_(r,t,n);if(!o)throw r;return o}}function d_(e,t,n){if(!(e instanceof N)||!u_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var f_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),Za=new Set(["cc-safety-net","ccsn"]),m_=new Set(["bunx","npx","pnpx"]),p_=new Set(["pnpm","yarn"]),g_=new Set(["npm","pnpm","yarn"]),h_=new Set(["bun","node"]);function ci(e,t,n={}){if(Za.has(e))return 0;if(m_.has(e)){if(n.broad)return Ya(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return li(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&g_.has(e)&&n.broad&&t[r]==="exec"){let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(p_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&li(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=Ya(t.slice(r+1));return o===null?null:r+1+o}if(h_.has(e)){let o=n.broad&&r!==-1?r:0;if(Dm(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Dm(t[o+1]))return o+2}return null}function Ya(e){let t=e.findIndex((r)=>li(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!li(r))break;n++}return n}function li(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return Za.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return Za.has(e.slice(0,t))}function Dm(e){let t=e?.replaceAll("\\","/");return[...f_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Lm="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Wm(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=dn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>y_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function y_(e,t){let n=gt([...e],t),r=n.slice(1),o=ci(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as ui}from"node:path";var Bm="This path contains the protected policy config and you must not modify or delete it.",C_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function $m(e,t,n){let r=R_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Gm(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Fm(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Fm(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Gm(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Ir(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Gm(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Sr(a,n,r,o,i));return s?{target:s}:null}function Fm(e,t,n,r,o){let i=dn(e,t,r,o,{findSegmentTarget:(s,a)=>b_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Sr(s,a.cwd,n,r,o),findMalformedTarget:(s)=>x_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function b_(e,t,n,r,o){if(rr(e))return null;let i=ht([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&S_(a)){let l=v_(a).find((c)=>zm(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if($o(i,1)||ya(i,r)){let c=(fr(K(i))??K(["."])).find((u)=>{let f=pe(u.text,t.variables);return Sr(f,t.cwd,n,r,o)||zm(f,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Po(a).sources.find((c)=>__(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(E_(i,s))return null;for(let l of[...e,...i])for(let c of Um(l))if(Sr(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function S_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function v_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function E_(e,t){if(!C_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function x_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Um(i))if(Sr(s,t,n,r,o))return{target:s};return null}function Um(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function R_(e,t,n){let r=(a)=>vr(se(a,e.executionCwd,t,n)),o=r(Qt(t)),i=[r(Gn(e.executionCwd)),r(Gn(e.configCwd))],s=new Set(i.map((a)=>ui(a)));for(let a=ui(o);;a=ui(a))if(s.add(a),ui(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Sr(e,t,n,r,o){let i=_l(e,t,r,o,(s)=>vr(s)===Wr);return i!==null&&n.files.has(vr(i))}function zm(e,t,n,r,o){return n.directoriesAndAncestors.has(vr(se(e,t,r,o)))}function __(e,t,n,r,o){let i=vr(se(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function vr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as di,posix as tp,resolve as mi,win32 as w_}from"node:path";import{fileURLToPath as A_}from"node:url";var np="Access to a sensitive path is not allowed.",rp=new Set(["echo","printf"]),P_=new Set(["find"]),T_=new Set(["!","do","elif","else","if","then","until","while"]),I_=new Set(["-exec","-execdir"]),k_=new Set([";","+"]),O_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),M_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),op=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),N_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),D_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),ip=new Set(["-c","-e","-r","-E","--eval","--exec"]),L_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),W_=new Set(["grep","rg"]),G_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),F_=new Set(["commit","merge","notes","stash","tag"]),z_=new Set(["-m","--message"]),B_=new Set(["--grep"]),Hm=new Set(["jq","gojq","jaq"]),jm="f",Vm="file",$_="files",U_=new Set(["e","f"]),H_=new Set(["regexp","file"]),j_=new Set(["e","f","A","B","C","m"]),V_=new Set(["regexp","file","after-context","before-context","context","max-count"]),Xa="__CC_SAFETY_NET_PIPE_INPUT__",Qa=/[\w./~@+-]*[./~][\w./~@+-]*/g,K_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,q_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,Y_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,Km=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,qm=/\b(?:system|exec|spawn|popen)\s*$/,Z_=/\b(?:eval|exec)\s*\(/g,X_=/\b(?:eval|exec)\s*$/,J_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function Ym(e,t,n,r,o,i){for(let s of e){let a=s.target;if(Yw(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=Kw(a,s.cwd,t,r,o);if(l){let c=!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(i&&(c&&r.paths.isDirectory(fp(a,s.cwd,r,o))||c&&s.written===!0&&!a.includes("$")&&!tl(a,s.cwd,r,o)||c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!tl(a,s.cwd,r,o)))continue;if(!l.startsWith("secret.cli.")&&Zw(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function sp(e,t,n,r,o={}){let i=Zm(e,n,r),s=Ym(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=Ym(i,t,e.invocation.context.configCwd,n,r,new Set(Zm(e,n,r,{standard:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&Q_(e,n)?null:a}function Q_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Ao(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(tt(s.text,t))}let o=at(r);if(o.length===0)return!1;let i=He(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return nl(i,o.slice(1))}function nl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>O_.has(n))}function Zm(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?_n(s.shell,e.store,r,t,o,n,ew(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function ew(e){return e.program.dialect==="powershell"}function _n(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Iw(tt(e.source,r),t,n,r,o,i)],l=(c)=>tt(dw(c,s),r);return wo(e,o,r,i,{word:l,segment:(c,u,f,d,m)=>{if(c.length===0)return null;if(a.push(...pi(c,t,n,r,u.cwd,i,m)),f!==null)a.push(...nw(f,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...ap(c.consumer,[c.body],t,n,r,u.cwd,i,(f)=>rw(c.consumer??[],f,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return Qs;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{written:!0}:{}}),null}}),a}function rl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?_n(s,t,n,r,o,i):null}function pi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(Hm.has(He(at(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...pi(g,t,n,r,o,i)]}let l=uw(e).map(a),c=at(e);if(c.length===0)return l;let u=c[0]??"",f=He(u).toLowerCase(),d=c.slice(1),m=c.findIndex((g)=>!T_.has(g));if(n.standard===!0&&m!==-1&&nl(He(c[m]??"").toLowerCase(),c.slice(m+1)))return l;let p=tw(u,f,d);if(p)return[...l,...p.map(a)];if(rp.has(f))return n.capturedOutput===!0?[...l,...lp(e).map(a)]:l;if(f==="eval")return[...l,...rl(d.join(" "),t,n,r,o,i)??d.map(a)];if(f==="export")return[...l,...d.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Ye(f,g)).map(a)];if(f==="git")return[...l,...mw(d).map(a)];if(f==="gh")return[...l,...el(f,d,G_).map(a)];if(Hm.has(f))return[...l,...fw(d).map(a)];if(W_.has(f))return[...l,...Gw(d).map(a)];if(P_.has(f))return[...l,...yw(d,t,n,r,o,i).map(a)];if(we.has(f))return[...l,...d.flatMap((g)=>Ye("awk",g)).map(a),...d.flatMap((g)=>bw(g,t,n,r,o,i)),...d.flatMap(Sw).map(a)];if(f==="curl")return[...l,...d.flatMap((g)=>Ye(f,g)).map(a),...pw(d).map(a)];if(or(f)){let g=nr.has(f)?ve([f,...d]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,..._n(h,t,n,r,o,i),...d.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...Cw(f,d,t,n,r,o,i)]}return[...l,...d.flatMap((g)=>Ye(f,g)).map(a)]}function tw(e,t,n){let r=ci(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function nw(e,t,n,r,o,i,s){if(aw(t,n,r,o,i,s)){let a=at(e),l=nl(He(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...lp(e),...l].map((c)=>({target:c,cwd:i}))}return ap(t,ow(e),n,r,o,i,s,()=>[])}function rw(e,t,n,r,o,i,s){let a=at(e);if(!or(He(a[0]??"").toLowerCase()))return[];return rl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function ap(e,t,n,r,o,i,s,a){let l=lw(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>nr.has(l)?_n(n.getShellSyntax(c),n,r,o,i,s):fi(l,c,n,r,o,i,s))}function lp(e){let t=at(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase();if(!rp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ol(r.replaceAll("%%","%"))];return t.slice(1)}function ow(e){let t=at(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return iw(r);return[]}function iw(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ol(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>sw(t,r.slice(i*n,(i+1)*n)))}function sw(e,t){let n=0;return ol(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ol(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function aw(e,t,n,r,o,i){let s=at(e);if(s.length===0||He(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Xa]:l.map((f)=>f.split(c).join(Xa));return pi(u,t,n,r,o,i).some((f)=>f.target.includes(Xa))}function lw(e){let t=at(e);if(t.length===0)return null;let n=He(t[0]??"").toLowerCase();if(!or(n))return null;return cw(n,t.slice(1))?n:null}function cw(e,t){let n=il(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(ip.has(o)||cp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(J_.get(n)?.has(o))r++;continue}return!1}return!0}function il(e){return/^python\d/.test(e)?"python":e}function uw(e){let t=[];for(let n of e){if(dp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Xm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function dw(e,t){if(!t||!Xm.test(e))return e;return`~${e.replace(Xm,"").replace(/\\/g,"/")}`}function Ye(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function fw(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ye("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ye("jq",r))}function mw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...F_.has(r)?el("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),z_):el("git",e.slice(n),B_)];if(t.push(...Ye("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ye("git",o)),n++}return t}function el(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ye(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ye(e,i))}return r}function pw(e){return e.flatMap((t,n)=>{let r=hw(t);if(r!==null)return Jm(r.flag,r.value);let o=gw(e[n-1]);return o===null?[]:Jm(o,t)})}function Jm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ja(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ja(t.slice(n+1))}return t.startsWith("@")?Ja(t.slice(1)):[]}function gw(e){if(e===void 0)return null;if(op.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function hw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return op.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ja(e){return e===""||e==="-"?[]:[e]}function yw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!I_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>k_.has(m)),f=u===-1?c:c.slice(0,u),d=pi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!M_.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function Cw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(ip.has(c)||cp(e,c)){let f=t[l+1];if(f!==void 0)a.push(...fi(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...fi(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function cp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return L_.get(t[t.length-1]??"")?.has(il(e))??!1}function bw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ma(e)?.commands.flatMap((s)=>_n(t.getShellSyntax(s),t,n,r,o,i))??[]}function Sw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function vw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(sl),...e.match(Qa)??[]]}function fi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=xw(t,Ew(e));if(l===null)return vw(t).map(a);let c=l.masked.match(Km)!==null||l.literals.some((g)=>qm.test(l.masked.slice(0,g.start))),u=l.masked.match(Z_)!==null||l.literals.some((g)=>X_.test(l.masked.slice(0,g.start))),f=r.standard===!0&&!nr.has(e),d=f&&!(Aw(l.masked)||c||u)?[]:l.literals,m=f?Array.from(l.masked.matchAll(Km),(g)=>{let h=g.index+g[0].length;return{start:h,end:Vs(l.masked,h)}}):[],p=!f||m.some((g)=>Ks(l.masked,g.start))?l.literals:l.literals.filter((g)=>qm.test(l.masked.slice(0,g.start))||m.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>sl(g.text)).map(a),...f?[]:l.literals.flatMap((g)=>g.text.match(Qa)??[]).map(a),...c?p.flatMap((g)=>rl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>fi(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
-`:y),n,r,o,i,s)):[],...(l.masked.match(Qa)??[]).map(a)]}function Ew(e){let t=il(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function xw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(q_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&ww(e,o))return null;let a=t==="python"?Rw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=_w(e,c,l);if(u===null)return null;let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&Y_.test(f))return null;r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function Rw(e,t){return K_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function _w(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function ww(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Aw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(N_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>D_.has(i)))continue;if(o.length>1)return!0;if(Pw(e,r)===".")return!0;if(Tw(e,r+n.length)==="(")return!0}return!1}function Pw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Tw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Iw(e,t,n,r,o,i){return Dw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[..._n(a,t,{...n,capturedOutput:!0},r,o,i),...kw(a,r)?Ow(a,r).map((l)=>({target:l,cwd:o})):[]]})}function kw(e,t){let n=Ao(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||He(tt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=tt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Ow(e,t){return Ao(e).flatMap((n)=>n.kind==="word"?[tt(n.text,t)]:n.kind==="redirection"&&n.target?[tt(n.target,t)]:[]).flatMap(sl)}function sl(e){let t=Nw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Mw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Mw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function Nw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Dw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Fn(o,n))continue;if(up(e,r,n)){let i=Lw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Ww(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Lw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Fn(i,n))continue;if(up(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Ww(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function up(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Gw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===$_)o=!0;if(H_.has(f))r=!0;if(d!==void 0){if(f===Vm)t.push(d);continue}if(V_.has(f)){let m=e[l+1];if(f===Vm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(U_.has(h))r=!0;if(j_.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===jm)t.push(m);continue}let p=e[l+1];if(d===jm&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function at(e){let t=e.findIndex((n)=>!dp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function dp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var Fw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),zw=".env.",Bw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),$w=[".env.example.",".env.sample."];function Uw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Hw(e){return e.length>0&&!/\s/.test(e)}function tl(e,t,n,r){let o=fp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function fp(e,t,n,r){try{return Rr(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var jw=new Set(["node_modules","__pycache__"]),Vw=[["vendor","bundle"],["vendor","cache"]];function Kw(e,t,n,r,o){if(Uw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=F(i.split("/").pop()??""),a=F(i),l=()=>Hw(s)||tl(e,t,r,o);if(Bw.has(s)||$w.some((d)=>s.startsWith(d)))return null;let c=F(Qw(e,t,r,o));for(let d of as){let m=`~/${d.suffixParts.join("/")}`;if((ep(a,m)||ep(c,m))&&st(d.id,n))return d.id}let u=qw(i,t,n,r,o);if(u)return u;if(Fw.has(s))return null;for(let d of ss)if(s===d.basename&&st(d.id,n))return d.id;if(s.startsWith(zw)&&st(Hr.id,n)&&l())return Hr.id;for(let d of ls)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&st(d.id,n)&&l())return d.id}for(let d of cs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&st(d.id,n))return d.id}if(Xw(a))return null;if(!s.includes(".")&&zn.pattern.test(s)&&st(zn.id,n))return zn.id;let f=Jw(s,n);if(f)return f;return null}function qw(e,t,n,r,o){return jr.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=F(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||xr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Er(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=F(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=F(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?xr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Er(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Er(e,s,["credentials"])||Er(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=F(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=F(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>xr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(F(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?xr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,qe(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Er(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(qe("~",t,r,o),".config","amp")],l=F(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?xr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||F(e).split("/").at(-1)==="mcp-auth.json"&&Vt(F(e),F(a))}case"secret.cli.cursor.config":{let s=F(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=F(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var Qm=new WeakMap;function B(e,t,n,r,o){let i=Qm.get(o)??new Map;Qm.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>mp(e,ce(t,r)))}function Er(e,t,n){return n.some((r)=>Vt(F(e),F(ce(t,r))))}function xr(e,t,n,r,o){return mp(e,qe(t,n,r,o))}function mp(e,t){return F(e)===F(t)}function ce(e,...t){return Ue([e,...t].filter(Boolean).join("/"))}function Yw(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Rr(e,t,o,i));return n.some((a)=>Vt(s,F(Rr(a,r,o,i))))}function Zw(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Rr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ue(z(be(a),o.paths,i)):"",c=F(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=F(u?Ue(z(mi(be(u)),o.paths,i)):l&&Ue(z(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Vt(s,f))return!1;return n.some((d)=>{let m=ps(d);if(m&&tp.basename(s)!==F(m.name))return!1;let p=F(Rr(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Vt(s,p)&&!(m&&s===p)})}function Xw(e){let t=e.split("/");return t.some((n)=>jw.has(n))||Vw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Jw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of us)if(r===o.extension&&st(o.id,t))return o.id;for(let o of ds)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function F(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";if(!o)return i;let s=ll(i,o),a=di(s)?s:Ue(mi(t,s)),l=Ue(z(a,n.paths,r));if(!Vt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function ep(e,t){return e===t||e.startsWith(`${t}/`)}function Qw(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i||!o)return"";let s=ll(i,o),a=tp.normalize(di(s)?s:Ue(mi(t,s))),l=Ue(be(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function Rr(e,t,n,r){let{home:o,normalized:i}=al(e,n,r);if(!i)return"";let s=o?ll(i,o):i;return Ue(z(di(s)?s:mi(t,s),n.paths,r))}function al(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ue(z(be(r),t.paths,n)):"",i=Ue(be(eA(tt(e,t))));return{home:o,normalized:i}}function eA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return A_(e)}catch{return e}}function ll(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function tA(e){if(process.platform==="win32")return!0;return w_.parse(e).root.length>1}function Ue(e){let t=e.trim(),n=(t.includes("\\")&&tA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function He(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var nA={findPolicyMutation:$m,findGitMetadataMutation:hd,resolveGitMetadata:rA,loadPolicySnapshot:ou,findSensitiveTarget:sp,analyzeCommand:Mm,getModes:Di};function pp(e,t){let n={...nA,...t.dependencies},r=sA(e),o=_r(e)?e.command:r,i=Et("policy-protection",o,()=>ir(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(_r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Ld,intent:"stop_and_explain"}};let l=Ce(),c=Et("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Et("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Bm,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=Et("policy-protection",o,()=>Wm(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Lm,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=Et("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=Et("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...oA(m)},y=p.secretProtection.enabled===!1?null:Et("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:_r(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:np,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!_r(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...cl("command-validation",o),...h};let S=Et("command-analysis",o,()=>Nm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},iA(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===cr&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function rA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function oA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function iA(e){return ge(e,"declared-command")?.program}function sA(e){try{return kn(e.input)}catch(t){let n=_r(e)?e.command:void 0;throw new Kt("policy-protection",cl("policy-protection",t instanceof Xe?void 0:n,t),t)}}function Et(e,t,n){try{return n()}catch(r){throw new Kt(e,cl(e,r instanceof Xe?void 0:t,r),r)}}function cl(e,t,n){let r=n instanceof N||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?Si:An,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function _r(e){return e.route.kind==="command"}import{appendFileSync as bA,mkdirSync as SA}from"node:fs";import{isAbsolute as vA,join as fl}from"node:path";import{lstatSync as hp,readdirSync as aA,readFileSync as lA,rmdirSync as cA,statSync as yp,unlinkSync as uA,utimesSync as dA,writeFileSync as fA}from"node:fs";import{join as wr}from"node:path";function gp(e,t={}){return eo(Qt(e,t),e.home).policy.audit.retention_days}var dl=86400000,mA=".last-prune",pA=/^\d{4}-\d{2}$/,gA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Cp=(e)=>Math.floor(e/dl);function Sp(e,t,n=()=>new Date){try{let r=n().getTime();if(!yp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=wr(t,mA),i=yp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Cp(i)===Cp(r))return;let s=r-gp(e)*dl,a=new Date(r).toISOString().slice(0,7);for(let l of ul(t)){if(l.isDirectory()){hA(wr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))yA(wr(t,l.name),s)}fA(o,"",{mode:384}),dA(o,r/1000,r/1000)}catch{}}function hA(e,t,n){for(let r of ul(e)){if(!r.isDirectory()||!pA.test(r.name))continue;let o=wr(e,r.name);for(let i of ul(o)){if(!i.isFile())continue;let s=gA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+dl;if(!Number.isFinite(a)||a>=t)continue;vp(wr(o,i.name))}if(r.name!==n)bp(o)}bp(e)}function yA(e,t){try{let n=hp(e);if(n.mtimeMs>=t)return;let r=lA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(CA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(hp(e).mtimeMs!==n.mtimeMs)return;vp(e)}catch{}}function CA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ul(e){try{return aA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function vp(e){try{uA(e)}catch{}}function bp(e){try{cA(e)}catch{}}var EA="2.4.11",xA=1e4,RA=2000,_A=256,wA=32768;function AA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function PA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function ml(e,t,n,r,o,i,s={}){let a=AA(t);if(!a)return;let l=IA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=gi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:xA),f=gi(lt(r),RA),d=s.toolName?gi(lt(s.toolName),_A):void 0,m=i===null?void 0:gi(lt(i),wA),p=fl(l,PA(m?.value??null),c.slice(0,7));SA(p,{recursive:!0,mode:448});let g=fl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Wi)(),v:EA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};bA(g,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Sp(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function TA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&vA(n)?n:null}function IA(e){let t=TA(e);return t?fl(t,".cc-safety-net","logs"):null}function xp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Ep(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Ep(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Ep(e){return"command"in e?e.command??"":""}function Rp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ml(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function _p(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ml(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Ap(e,t,n){try{let r=pp(t,{environment:e,...n.guard});return wp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw wp(e,t,r.evaluation,n,!(r.cause instanceof Xe),{stage:r.stage,errorCode:kA(r.cause)}),r}}function wp(e,t,n,r,o=!0,i){Rp(e,xp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function kA(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Xe)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function xt(e,t={}){return{malformed:!0,denial:Pn(t),cwd:e}}function Pp(e,t={}){return(n,r)=>{try{return OA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Pn())}}}function OA(e,t,n,r){let o=Yl();if(n.cancelled?.(t))return n.block(Pn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return _p(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Cl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Ap(o,i,{guard:{auditAllowed:Zl(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(_t(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Sl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Tp="exec",MA=new Set(["auto","gateway"]);function Ip(e){e.on("before_tool_call",NA(e),{matcher:[Tp],priority:50})}function NA(e,t={}){return Pp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>DA(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>GA(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function DA(e,t,n,r){if(!e||typeof e!=="object")return xt(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return xt(null);if(o!==Tp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return xt(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return xt(null,{toolName:o});if(s.host!==void 0&&!MA.has(s.host))return xt(null,{command:a,toolName:o});let l=LA(n,t.agentId,r);if(!l)return xt(null,{command:a,toolName:o});let c=WA(l,s,r);if(!c)return xt(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return On(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function LA(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Pi(".",[r],n)}catch{return}}function WA(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Pi(r,[e],n)}function GA(e){return{block:!0,blockReason:bl(e)}}var t1={...yl,register:Ip};export{t1 as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function vr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function xn(e){return e?w(e):""}function Fm(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Wa(e,t){return Na(De(e,"posix"),t)}function Er(e){return Wa(e,new Set(Array.from(e.matchAll(Om)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Na(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Na(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Na(o,n))||zm(r.words,n))return!0;Zx(r,n)}return!1}function zm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Sr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return km(e[s],t)}if(q.has(o)){let s=e.slice(n),a=Ee(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&km(s[l],t)}let i=Vx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return zm(e.slice(i),t)}function Vx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Kx(e,t+1);if(r==="exec")return qx(e,t+1);if(r==="env")return Yx(e,t+1,n);return null}function Kx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function qx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Yx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Sr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Sr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Zx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(Sr(n,t))t.add(r.name)}}function Sr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Om)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Fx.test(o)||t.has(o))}))}function km(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Sr(e,t))}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Fa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Xx="__CC_SAFETY_NET_XARGS_INPUT__",ti="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ni="rm",Jx=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,Qx=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,eR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,tR=/^(?:[0-9]+|[@*])$/;function Um(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Kt(n),i=n.slice(r),s=S("xargs.shell-dynamic",Fa);if(rR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let u=Ym(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Km(l,o),d=t.analyzeChild(l,{...Ht(a,t),dynamicInput:u,dynamicSourceInput:m||jm(l,a.head,o,a.wrapperEnvAssignments,u,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Ga)});if(d)return d;let f=nR(l,o,t.policy?.rules??[],T(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,Xx]:l,h=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(p,{...Ht(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let g=it(l,t.policy?.rules??[]);if(g)return g}return null}function nR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Hm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Am(e,r,t.length,n);return o===null?[]:[o]}function jm(e,t,n,r,o,i,s){if(q.has(t)){if(st(e))return!1;if(n!==null&&oR(e,n,s))return!0;let a=$e(e);if(!a){let l=lt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Vm(a,n,s))return!0;if(Ae(a))return!0;return iR(a,n,r)}if(Me(t))return Bm(e,n,Ro,qu(t));if(we.has(t))return Bm(e,n,ya,qd);if(t==="eval"){let a=Qo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return sR(e,n,i);if(t==="git"){let a=_e(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&vn.has(a.subcommand.toLowerCase())&&qm(a.rest,n).some((l)=>l.includes(n))}return!1}function Vm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function Bm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ti]).sources.some((a)=>a.value===ti);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ti}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ti}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Hm(l,t,a))));return Xo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function rR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,ni]:e.map((i,s)=>s===0?i:i.replaceAll(t,ni));return Array.from(ze(o,n)).some((i)=>i.head===ni&&!r.has(ni))}function Km(e,t){return qm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function qm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Ym(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function oR(e,t,n){let r=Ee(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Vm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Hm(a,t,s).some((u)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,u):f),d=Ee(m);if(d.commandIndex===null&&d.scriptIndex===null)return!1;if(r.commandIndex===null&&d.commandIndex!==null)return!0;if(r.scriptIndex===null&&d.scriptIndex!==null)return!0;if(d.commandIndex!==null&&(m[d.commandIndex]??"").includes(u))return!0;return d.scriptIndex!==null&&(m[d.scriptIndex]??"").includes(u)})}))}function iR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(Jx))if($m(o,r))return!0;for(let o of e.matchAll(Qx))for(let i of(o[1]??"").matchAll(eR))if($m(i,r))return!0;return Wa(e,r)}function $m(e,t){let n=e[1]??e[2];return n!==void 0&&(tR.test(n)||t.has(n))}function sR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=Sn(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let u=Ym(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Km(c.tokens,t)||jm(c.tokens,c.head,t,c.wrapperEnvAssignments,u,n))return!0}continue}let a=at(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Kt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var xr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Rr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",lR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",cR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",oi=/\{[^{}\s]*\}/g,Zm=/\{\}|\{-?\d+\}/g,uR=["e","f","source","file","-e","-f","--source","--file"],dR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],mR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),fR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Xm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),pR=new Set(["--workdir","--wd"]),Jm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function rf(e){return Ie([...e],(t)=>Ae(t))}function of(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=Rn(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=pf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:u,dryRun:m}=o;if(c){let g=Rn(t);if(g)return g;let p=rf(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=SR(t);if(g)return g}if(u!==void 0&&a){let g=Rn(t);if(g)return g}let d=vR(u,t.cwd,t.environment.paths);if(d===null){let g=Rn(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:d===null||d===void 0||d===t.cwd?t:{...t,cwd:d};if(m){if([...ze(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some($a)){let p=Rn(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=cf(f.envAssignments,f.cwd,a);return Ie(g,(h)=>t.analyzeNested(h,p))}return Ie(ze(i,f),(g)=>gR(g,o,t,f))}function gR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(mf)){let h=Rn(n);if(h)return h}let u=rf(c);if(u)return u;let m=c.some(F),d=i||m,f=a&&d,g=cf(e.envAssignments,e.wrapperCwd,s||f);if(q.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(ri(l,E,n.budget),Ht(e,r)))};if(st(l))return h();let y=$e(l);if(y){if(ff(y)){let x=_t(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(tf(y,A,n.budget),g))}if(F(y)){if(o.length>0)return Ie(o,(Y)=>n.analyzeNested(tf(y,Y,n.budget),g));let x=br(y);if(x?.[0]&&O(x[0])==="rm"&&Be(x)){let Y=ef(n);if(Y)return Y}let A=x?n.analyzeChild(x,{...Ht(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",Rr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)}):null;if(A)return A;return n.analyzeNested(y,g)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>ei(K(x===void 0?l:i?l.map((A)=>uf(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=_t(n);if(x)return x}let C=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(C.length>0)return n.budget.charge("derivedTokens",C.length),Ie(C,(x)=>n.analyzeNested(x,g));if(Er(y)){let x=_t(n);if(x)return x}let P=n.analyzeNested(y,g);if(P)return P;if(d)return _t(n);return null}let v=lt(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return _t(n)??h();if(v.kind==="literal")return h();if(o.length>0){let E=_t(n);if(E)return E;let C=h();if(C)return C;if(i)return null;let P=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",P.length),Ie(P,(x)=>n.analyzeNested(x,g))}if(d||a)return _t(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>za(ri(l,y,n.budget,Zm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>za(nf(l,y,n.budget),e.cwd,r));let h=za(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(Zm,"")]:[]}),e.cwd,r);if(h)return h;return ef(n)}let p=o.length>0?o:[void 0];return Ie(p,(h)=>{let y=h===void 0?l:i?ri(l,h,n.budget):nf(l,h,n.budget),v=S("parallel.shell-dynamic",Rr),E=a&&e.head==="find"?bR(y,r):null,C=af(y,a,n)??E?.customResult??null,P=O(e.head),x=a&&(P==="rm"&&Ba(y)||P==="xargs"&&lf(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&sf(y,P)),Y=n.analyzeChild(y,{...Ht(e,r),worktreeMode:s||a||d?!1:n.worktreeMode,dynamicInput:a||d,dynamicRmInput:x,dynamicSourceInput:C!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)});if(A){let ke=T(v,n.policy);if(ke)return ke}return Y??C??it(y,n.policy?.rules??[])})}function sf(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(q.has(t))return CR(e);if(t==="git")return hR(e);if(t==="find")return!0;if(we.has(t))return Qm(e,uR,yr);if(Me(t))return Qm(e,dR,xo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||ff(o)))}function hR(e){if(yR(e))return!0;let t=_e(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!vn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function yR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function CR(e){if(st(e))return!1;let t=$e(e);if(t!==null)return F(t);let n=lt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function Qm(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Jm]).some((o)=>o.value===Jm);return Xo(r,t,(o)=>n(e.map((i)=>uf(i,[o]))))}function af(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return _t(n);return Ie(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function bR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=sf(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&lf(a.tokens),n.customResult??=af(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=F(a);continue}let l=at(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function lf(e){let t=e.slice(Kt(e).childStart);return O(t[0]??"")==="rm"&&Ba(t)}function ii(e,t){return(n)=>T(S(e,t),n.policy)}var _t=ii("parallel.shell-dynamic",Rr),SR=ii("parallel.command-stream-dynamic",lR),Rn=ii("parallel.command-stream-dynamic",cR),ef=ii("parallel.rm-recursive-force-dynamic",xr);function za(e,t,n){return T(Jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Bt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function cf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function uf(e,t){return e.replace(oi,(n)=>df(n,t))}function ri(e,t,n,r=oi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=df(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function tf(e,t,n){return ri([e],t,n)[0]??""}function nf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function df(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(oi)!==-1}function mf(e){if($a(e))return!0;for(let t of e.matchAll(oi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function $a(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function ff(e){return/^\{[^{}\s]*\}$/.test(e)}function vR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!aR(e))return null;try{return yt(t??e,e,n)}catch{return null}}function pf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=Sa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=Sa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let p=e[t+1],h=g.indexOf("="),y=h===-1?g:g.slice(0,h),v=h===-1?void 0:g.slice(h+1);if(g==="--dry-run"){l=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){c||=(g==="-I"?p:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){c=!0,t+=2;continue}if(y==="--replace"||g.startsWith("-i")&&g.length>2){let E=y==="--replace"?v:g.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||fR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(g==="--pipe"||g==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Xm.has(y)||g.startsWith("-S")&&g.length>2){i=!0,t+=Xm.has(g)?2:1;continue}if(pR.has(y)){c=!0;let E=v??p;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&v!==void 0){t++;continue}if(mR.has(g)){if(p===void 0||p===":::"||p==="--"){c=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}c||=n.some(l?$a:mf);let u=[];if(o!==-1){let g=[];for(let p=o+1;p<e.length;p++){let h=e[p];if(h===":::"){u.push(g),g=[];continue}if(h!==void 0)g.push(h)}u.push(g)}c||=u.length>1;let m=ER(u),d=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:d,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function ER(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function gf(e){return pf(e).childStart}var xR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",si="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ha(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ua(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function yf(e,t,n,r,o=!1,i){let a=(Yn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",xR):null;return T(a,i)??Cf(e,t,n,o,i)}function Cf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ha(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=dn(e,t),l=_R(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return T(S("shell.dynamic-structure",si),o);if(T(Zo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),u=a.findIndex((m,d)=>d>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&vn.has(c)&&i.some((m)=>m>l&&(u===-1||m<u)))return T(S("shell.dynamic-structure",si),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&wR(t)?T(S("shell.dynamic-structure",si),o):null;if(s==="rm"){let a=t.findIndex((c,u)=>u>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(S("shell.dynamic-structure",si),o):null}if(s==="xargs")return hf(e,t.slice(Kt(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return hf(e,t.slice(gf(t.map(w))),"parallel",n,r,o);return null}function hf(e,t,n,r,o,i){if(t.length===0)return null;let s=RR(t,r);if(Yn(e,s)){let l=T(S(`${n}.shell-dynamic`,n==="xargs"?Fa:Rr),i);if(l)return l}let a=Cf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ha(l)&&Ua(l)))return T(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:xr),i);return null}function RR(e,t){let n=Gt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function _R(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function wR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ha(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ua(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ua(s)))return!0;continue}if(t=!0,a)return!0;let l=at(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function ja(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!bo(t[n.tokenIndex],n.value)})}var AR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",PR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",TR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function bf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",AR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",PR);if(e==="shred"&&n.length>0)return S("shred.target",TR);return null}var vf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:Bt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Zo(e.words,Va(e))},{heads:new Set(["find"]),analyze:(e)=>tm(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:Bt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Um(e.words,{...Sf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>of(e.words,{...Sf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})}];function Sf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function qt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Va(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function _f(e){return vf.find((t)=>t.heads.has(e))?.analyze}function wn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?w(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,u=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,d=Ao(e);if(d.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...d.envAssignments.keys()],output:i(d.words)});let f=Gt(d.words,n.environment,u,new Map([...n.envAssignments??[],...d.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let R=[...g,...i(f.words)].join(" "),k=Ae(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),ue(k);if(n.strict)return ye(r);let L=Po(g,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments])});if(te)return te}}let p=f.rewritten?K(i(f.words)):dn(o,f.words),h=i(p),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&d.words.length>p.length){let R=i(d.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-p.length),output:h})}let v=new Map([...n.envAssignments??[],...d.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if(Ut(E))throw new D("wrapperPeelIterations");let C=O(E),P=f.cwd===null?void 0:f.cwd??u,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,Y=s?s.allowTmpdirVar:!mr(v,n.environment),ke=yf(o,f.words,n.environment,t===0,n.strict,n.policy);if(ke)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:ke.reason}),ue(ke);let je=Ho(h,n.policy);if(je){for(let R of[je.childIndex,...je.alternativeChildIndices]){Ef(y.wrapperNormalizationBudget);let k=p.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:je.wrapper,output:i(k)});let L=wn(k,t,{...y,effectiveCwd:A,envAssignments:v});if(L)return L}return null}let de=l?void 0:C==="eval"?Qo(p):C==="trap"&&!a?Nm(p):void 0;if(a&&s&&C==="eval"){if(de?.kind==="dynamic")return _n(s,n.policy);if(de?.kind==="literal"){let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v});if(R)return R}return An(s,n.policy)}if(de?.kind==="dynamic"&&(n.strict||!n.commandView||!La(n.commandView)))return ye(r);if(de?.kind==="literal"){r?.recordSegment({type:"recurse",reason:C==="eval"?"shell-eval":"shell-trap",innerCommand:de.source,depth:t+1});let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?q.has(C):Af(E,C)){if(st(h))return null;if(a&&s){let R=$e(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=_n(s,n.policy);if(L)return L}if(Er(R)){let L=_n(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:v})}let k=lt(p);if(k.kind==="dynamic")return _n(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?_n(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?_n(s,n.policy):null}if(l){let R=$e(h),k=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:v}):lt(p).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=MR(h,v,A,n,r,t);if(R)return R;let k=$e(h);if(k){let Qt=ei(p,k);if(Qt.kind==="dynamic")return ye(r);let Si=Qt.kind==="literal"?Qt.source:Lm(p,k),vl=DR(Si);r?.recordSegment({type:"shell-wrapper",wrapper:C,innerCommand:vl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:vl,depth:t+1});let El=n.analyzeNested(Si,{effectiveCwd:A,envAssignments:v});if(El)return El;return Er(Si)?ye(r):null}let L=lt(p,n.strict?void 0:n.shellAssignments);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ai(L.source,A,v,n,r,t);let te=Wm(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(C==="source"||C===".")){let R=h[1]==="-p"?2:null;if(R!==null){let Qt=n.commandView?p[R]:void 0;if(!Qt)return null;if(Qt.provenance!=="literal")return ye(r)}let k=R===null?1:3,L=h[k]==="--"?k+1:k,te=n.commandView?p[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ai(te.text,A,v,n,r,t);if(n.strict||!n.commandView||!La(n.commandView))return ye(r)}if(we.has(C)&&!l){if(!s&&n.strict&&ja(yr(h),p))return ye(r);let R=Yd(h,(L)=>qt(n.analyzeNested(L,{effectiveCwd:A,envAssignments:v}))),k=T(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),ue(k)}if(Me(C)&&!l){if(!s&&n.strict&&ja(xo(h),p))return ye(r);let R=Ku(h);if(a&&s)return kR(C,R,A,v,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:C,codeArg:R,paranoidBlocked:k}),k){let te=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(te)return ue(te)}if(Ys(C,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:v});if(L&&!wf(L,R))return L;if(or(R,void 0,!n.strict)){let te=T(S("interpreter.dangerous-command",pn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:pn}),ue(te)}r=void 0}}if(C==="busybox"&&h.length>1)return Ef(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),wn(p.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let G=s?null:T(bf(C,h),n.policy);if(G)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:G.reason}),ue(G);let J=r===y.trace?y:{...y,trace:r},X={words:p,head:C,cwd:P,originalCwd:x,envAssignments:v,allowTmpdirVar:Y,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:J,analyzeChildTokens:(R,k)=>a&&s?Ka(R,t,J,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):qt(wn(K(R),t+1,{...J,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??it(R,J.policy.rules),analyzeChild:(R,k)=>Ka(R,t,J,k)},Q=s&&(C==="xargs"||C==="parallel")?void 0:_f(C);if(C==="rm"||C==="xargs"||C==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Y});let Ce=r&&C==="git"?wm(X.words,Va(X)):void 0,dt=xf(Ce?Ce.match:Q?.(X)??null,n.policy);if(r)NR(X,dt,Ce?.relaxation??null);if(dt)return ue(dt);if(a&&s&&(C==="rm"||C==="rmdir")){if(!(C==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?An(s,n.policy):null)??OR(s,n.policy)}let Or=!s&&Q===void 0&&!jr.has(C),Je=r&&Or?[]:void 0;if(Or)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;Je?.push(k);let L=xf(IR(h,R,t,J,P,x,A,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[],embeddedCommandFound:O(k)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[]}),l&&s&&!s.wrappedByTransparent)return null;let Mr=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Mr,reason:Mr?.reason}),Mr)return ue(Mr);return a&&s?An(s,n.policy):null}function Ka(e,t,n,r){return qt(wn(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function IR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let u=O(c);if(Af(c,u)||_f(u)!==void 0&&u!=="xargs"&&u!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let d=Ka(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!mr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(d)return d}return null}function kR(e,t,n,r,o,i){if(!t)return An(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(S("interpreter.one-liner-paranoid",rr),o.policy);if(a)return ue(a)}if(Ys(e,t))return An(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!wf(s,t))return s;if(or(t,void 0,!o.strict)){let a=T(S("interpreter.dangerous-command",pn),o.policy);if(a)return ue(a)}return An(i,o.policy)}function wf(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Bo)||e.reason===bn)&&!Vr(t);return n||r}function _n(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?ue(n):null}function An(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?ue(n):null}function OR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?ue(n):null}function MR(e,t,n,r,o,i){let s=em(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=nr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function DR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function NR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function Ef(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:gr}),ue(LR())}function LR(){return{id:"",reason:gr,intent:"stop_and_explain"}}function Af(e,t){return q.has(t)||e==="$SHELL"||e==="${SHELL}"||q.has(I(t))}function xf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var WR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,GR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function FR(e,t){let n=If(e,t);if(n.length===0)return!1;let r=n[Tf(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return WR.test(e.join(" "))}function Pf(e,t,n,r,o){if(e.dialect==="powershell"){let y=zR(e.words,o);if(y.kind==="none")return;if(!t||y.kind==="unknown")return null;return Rf(HR(y.target),t,n.paths)}let i=e.words.map(w),s=i.some((y)=>/^CDPATH\+?=/.test(y));if(!FR(i,n))return s?null:void 0;if(!t)return null;let a=If(i,n,t),l=Tf(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),u=c.findIndex((y)=>y.length<=1||!y.startsWith("-")||y==="--");if((u===-1?c:c.slice(0,u)).some((y)=>!/^-[LP]+$/.test(y)))return null;let d=u===-1?[]:c.slice(u),f=d[0]==="--"?d.slice(1):d;if(f.length!==1)return null;let g=f[0]??"",p=e.words.find((y)=>y.provenance==="variable"&&y.text===g),h=p?Ye(p,r):g;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return Rf(h,t,n.paths)}function Rf(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=yt(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function zR(e,t){let n=BR(e[0])?1:0,r=e[n];if(!$R(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!GR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return UR(e.slice(n+1),t)}function BR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function $R(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function UR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function HR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Tf(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function If(e,t,n){let r=jR(e);return Ct([...r],t,n)}function jR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var JR="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Yt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Qa(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((u)=>u.code.includes("heredoc"));if(c){if(!n.strict)return Ja(e,n);let u=`${Bo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:u}),{reason:u,segment:e,intent:"stop_and_explain"}}return Lf(e,n),{reason:bn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Lf(e,n),{reason:bn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ja(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=pm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set}]).result}function ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,u]of e.nodes.entries()){if(u.kind==="connector"){a=u.operator;continue}let m=e.nodes[c+1],d=m?.kind==="connector"?m.operator:void 0,f=QR(e,c,u,a,d),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],v=a==="&&"?p?.failure??[]:[],E={connector:a,skippedSuccessStates:y,skippedFailureStates:v};if(wt(d)&&!wt(a))l=E;let C=wt(d)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:wt(a)?l??E:E,P=Zt(C.connector)||Zt(d);if(u.kind==="function"){let j=h.flatMap((J)=>{let X=Tn(J);return X.functionDefinitions.set(u.name,u.body),qa(J,[X],f,d==="&",Zt(d))}),G=Ya(j,[],C.skippedSuccessStates,C.skippedFailureStates,C.connector,d);i=G.states,s=G.conditionalStates,a=void 0;continue}if(u.kind==="group"){let j=[],G=[];for(let X of h){let Q=ui(u.body,t,n,r,[Tn(X)]);if(Q.result)return Q;if(j.push(...qa(X,Q.states,f,d==="&",Zt(d))),P)G.push(X,...f?Q.states.map((Ce)=>li(X,Ce)):Q.states)}let J=Ya(j,G,C.skippedSuccessStates,C.skippedFailureStates,C.connector,d);i=J.states,s=J.conditionalStates,a=void 0;continue}if(u.kind!=="command")continue;let x=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),A=e.nodes[c-2],Y=wt(a)&&A?.kind==="command"?Dm(A)??t_(A):void 0,ke=[],je=[];for(let j of h){let G=n_(u,t,n,r,[Tn(j)]);if(G.result)return{result:G.result,states:i};let J=e.dialect==="powershell"?G.states:G.states.map((X)=>li(j,X));for(let X of J){let Q=Tn(X),Ce=i_(u,t,n.trace?{...n,trace:Wf(n.trace,x)}:n,r,Q,wt(a),Y);if(Ce)return{result:Ce,states:i};let dt=__(u,Q.functionDefinitions);if(dt)n.budget.charge("derivedTokens",di(dt));let kn=dt?t+1>=V.recursionDepth.cap?Za(u.displayText,n,[Q]):ui(dt,t+1,n,r,[Q]):{result:null,states:x_(u,Q)};if(kn.result)return kn;ke.push(...qa(j,kn.states,f,d==="&",Zt(d)));let Or=typeof Q.effectiveCwd==="string"&&Q.effectiveCwd!==X.effectiveCwd&&u.redirections.every((Je)=>["<",">",">>",">|"].includes(Je.operator)&&Je.target?.text==="/dev/null");if(P&&!Or)je.push(j),je.push(...kn.states.map((Je)=>f?li(j,Je):Je))}}let de=Ya(ke,je,C.skippedSuccessStates,C.skippedFailureStates,C.connector,d);i=de.states,s=de.conditionalStates,a=void 0}return{result:null,states:i}}function QR(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wt(r)||wt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&e_(e,t)}function qa(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>Pn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function e_(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(r_(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wt(e){return e==="|"||e==="|&"}function t_(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Zt(e){return e==="&&"||e==="||"}function Ya(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=Zt(i)?s:void 0;return{states:Zt(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function Wf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function n_(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=o_(e);if(s){if(t+1>=V.recursionDepth.cap)return Za(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Za(s,n,o);if(a.status!=="complete")return kf(i,n,r,o);n.budget.charge("derivedTokens",di(a)),i.push({program:a,depth:t+1})}}return kf(i,n,r,o)}function r_(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function kf(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[Tn(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function o_(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Za(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,intent:"stop_and_explain"},states:[...n]}}function i_(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:u_(n.environment.paths,o.createdDirectories,n.budget)}},l=h_(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Gf(e,o,"before-consumer",a.environment.paths,a.budget);let c=dn(e.dialect,e.words),u=c.map(w),m=e.displayText,d=mm(c,o.shellGitContextState),f=hm(d,o.shellGitContextState);if(e.dialect==="powershell"){let h=T(Bd(e,i,A_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return w_(m,h)}if(u.length===1&&u[0]?.includes(" ")&&!Yn(e.dialect,e.words)){let h=T(Ae(u[0]),a.policy),y=h!==null&&!a.strict&&Uu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:u[0],matched:!1});let v=Of(e,l,o,f,s,a);if(v)return v;return Ia(d,o.shellGitContextState),null}let g=wn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Qa(h,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Wf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:m};let p=Of(e,l,o,f,s,a);if(p)return p;return Ia(d,o.shellGitContextState),null}function Of(e,t,n,r,o,i){let s=y_(e,t,n,r??new Map,i);if(s)return s;return Gf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),l_(e,t,n,i.environment.paths,i.budget),d_(e,n,i.environment.paths,i.budget),S_(e,n,o,i.environment,i.trace),null}var s_=new Set([">>","<>"]);function Gf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?a_(s):s_.has(s.operator)))continue;Mf(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=zf(e.words.slice(1));if(!i)return;for(let s of i.operands)Mf(s,t,r,o)}function a_(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Mf(e,t,n,r){let o=e?.provenance==="literal"?nr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function l_(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of c_(e,n.shellGitContextState.shellAssignments)){let a=nr(s,n.effectiveCwd,r,o);if(!a||!Vu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function c_(e,t){let n=Xa(p_(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return f_(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=zf(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>Xa(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function Xa(e,t){if(g_(e))return e.text;return(e&&Ye(e,t))??void 0}function u_(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=N(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${XR}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?N(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function d_(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>Xa(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!KR(c)&&!l)continue;let u=N(ZR(l??"",c),n,r);if(a?m_(u,n):n.isDirectory(VR(u))&&Ff(u,n))t.createdDirectories.add(u)}}function m_(e,t){let n=YR(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>qR(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||Ff(o(i),t)}function Ff(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function f_(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function p_(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function zf(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function g_(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function el(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function h_(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Yt;let r=n[0];if(!r?.heredoc)return Yt;let o=/\$\(|`/.test(r.heredoc.body);if(!el(r.heredoc)&&(!t||o))return JR;if(r.fd!==void 0&&r.fd!==0)return Yt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return Yt;let i=e.redirections.some((l)=>l!==r&&Df(l.target));if(se(e.words[0],"cat"))return i?Yt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Df)?Yt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return Yt}function Df(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function y_(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(b_(e,i,n,r,o))return null;let a=C_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ja(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function C_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!el(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(m)return m}if(!or(l,void 0,!n.strict))return null;let u=T(S("interpreter.dangerous-command",pn),n.policy);if(!u)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:u.reason}),u}function b_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!el(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Gt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!q.has(l)&&!q.has(I(l)))return!1;return st(a)}function S_(e,t,n,r,o){let i=Pf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var v_=/^[A-Za-z_][A-Za-z0-9_]*$/,E_=8;function x_(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!v_.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=E_&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Tn(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Tn(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:gm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories)}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>R_(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function R_(e,t){return e.effectiveCwd===t.effectiveCwd&&Pn(e.shellGitContextState.env,t.shellGitContextState.env)&&Pn(e.literalHeredocFiles,t.literalHeredocFiles)&&Pn(e.functionDefinitions,t.functionDefinitions)&&Pn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Pn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Nf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Nf(e.createdDirectories,t.createdDirectories)}function Nf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Pn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function __(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function w_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function A_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ja(e,t){let n=T(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Lf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:bn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var P_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Bf(e,t,n,r){let o=Qa(e,0,{...t,...du(t),budget:t.budget??be(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function $f(e,t,n){try{return{decision:e()}}catch(r){let o=T_(r,t,n);if(!o)throw r;return o}}function T_(e,t,n){if(!(e instanceof D)||!P_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var I_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),nl=new Set(["cc-safety-net","ccsn"]),k_=new Set(["bunx","npx","pnpx"]),O_=new Set(["pnpm","yarn"]),M_=new Set(["npm","pnpm","yarn"]),D_=new Set(["bun","node"]);function fi(e,t,n={}){if(nl.has(e))return 0;if(k_.has(e)){if(n.broad)return tl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&M_.has(e)&&n.broad&&t[r]==="exec"){let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(O_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(D_.has(e)){let o=n.broad&&r!==-1?r:0;if(Uf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Uf(t[o+1]))return o+2}return null}function tl(e){let t=e.findIndex((r)=>mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!mi(r))break;n++}return n}function mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return nl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return nl.has(e.slice(0,t))}function Uf(e){let t=e?.replaceAll("\\","/");return[...I_].some((n)=>t===n||t?.endsWith(`/${n}`))}var Hf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function jf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=hn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>N_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function N_(e,t){let n=Ct([...e],t),r=n.slice(1),o=fi(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as pi}from"node:path";var Yf="This path contains the protected policy config and you must not modify or delete it.",L_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Zf(e,t,n){let r=$_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Vf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Kf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Kf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Vf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Lr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Vf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>_r(a,n,r,o,i));return s?{target:s}:null}function Kf(e,t,n,r,o){let i=hn(e,t,r,o,{findSegmentTarget:(s,a)=>W_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>_r(s,a.cwd,n,r,o),findMalformedTarget:(s)=>B_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function W_(e,t,n,r,o){if(cr(e))return null;let i=bt([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&G_(a)){let l=F_(a).find((c)=>qf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Ko(i,1)||Ea(i,r)){let c=(Cr(K(i))??K(["."])).find((u)=>{let m=pe(u.text,t.variables);return _r(m,t.cwd,n,r,o)||qf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Do(a).sources.find((c)=>U_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(z_(i,s))return null;for(let l of[...e,...i])for(let c of Xf(l))if(_r(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function G_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function F_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function z_(e,t){if(!L_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function B_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Xf(i))if(_r(s,t,n,r,o))return{target:s};return null}function Xf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function $_(e,t,n){let r=(a)=>wr(ae(a,e.executionCwd,t,n)),o=r(on(t)),i=[r(Hn(e.executionCwd)),r(Hn(e.configCwd))],s=new Set(i.map((a)=>pi(a)));for(let a=pi(o);;a=pi(a))if(s.add(a),pi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function _r(e,t,n,r,o){let i=kl(e,t,r,o,(s)=>wr(s)===Ur);return i!==null&&n.files.has(wr(i))}function qf(e,t,n,r,o){return n.directoriesAndAncestors.has(wr(ae(e,t,r,o)))}function U_(e,t,n,r,o){let i=wr(ae(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function wr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as gi,posix as cp,resolve as yi,win32 as H_}from"node:path";import{fileURLToPath as j_}from"node:url";var up="Access to a sensitive path is not allowed.",dp=new Set(["echo","printf"]),V_=new Set(["find"]),K_=new Set(["!","do","elif","else","if","then","until","while"]),q_=new Set(["-exec","-execdir"]),Y_=new Set([";","+"]),Z_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),X_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),mp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),J_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),Q_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),fp=new Set(["-c","-e","-r","-E","--eval","--exec"]),ew=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),tw=new Set(["grep","rg"]),nw=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),rw=new Set(["commit","merge","notes","stash","tag"]),ow=new Set(["-m","--message"]),iw=new Set(["--grep"]),Jf=new Set(["jq","gojq","jaq"]),Qf="f",ep="file",sw="files",aw=new Set(["e","f"]),lw=new Set(["regexp","file"]),cw=new Set(["e","f","A","B","C","m"]),uw=new Set(["regexp","file","after-context","before-context","context","max-count"]),rl="__CC_SAFETY_NET_PIPE_INPUT__",il=/[\w./~@+-]*[./~][\w./~@+-]*/g,dw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,mw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,fw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,tp=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,np=/\b(?:system|exec|spawn|popen)\s*$/,pw=/\b(?:eval|exec)\s*\(/g,gw=/\b(?:eval|exec)\s*$/,hw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function rp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(fA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=dA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(Sp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!al(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!al(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&pA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function pp(e,t,n,r,o={}){let i=op(e,n,r),s=rp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=rp(i,t,e.invocation.context.configCwd,n,r,new Set(op(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&yw(e,n)?null:a}function yw(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Mo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=ut(r);if(o.length===0)return!1;let i=He(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return ll(i,o.slice(1))}function ll(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>Z_.has(n))}function op(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?In(s.shell,e.store,r,t,o,n,Cw(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function Cw(e){return e.program.dialect==="powershell"}function In(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...qw(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(Tw(c,s),r);return Oo(e,o,r,i,{word:l,segment:(c,u,m,d,f)=>{if(c.length===0)return null;if(a.push(...Ci(c,t,n,r,u.cwd,i,f)),m!==null)a.push(...Sw(m,c,t,n,r,u.cwd,i));return null},redirection:(c,u)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...gp(c.consumer,[c.body],t,n,r,u.cwd,i,(m)=>vw(c.consumer??[],m,t,n,r,u.cwd,i)));if(c.targetOrder==="legacy-segment")return oa;return a.push({target:l(c.target),cwd:u.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function cl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?In(s,t,n,r,o,i):null}function Ci(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,y)=>!s.has(y));if(Jf.has(He(ut(p)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...Ci(p,t,n,r,o,i)]}let l=Pw(e).map(a),c=ut(e);if(c.length===0)return l;let u=c[0]??"",m=He(u).toLowerCase(),d=c.slice(1),f=c.findIndex((p)=>!K_.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&ll(He(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=bw(u,m,d);if(g)return[...l,...g.map(a)];if(dp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...hp(e).map(a)]:l;if(m==="eval")return[...l,...cl(d.join(" "),t,n,r,o,i)??d.map(a)];if(m==="export")return[...l,...d.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Xe(m,p)).map(a)];if(m==="git")return[...l,...kw(d).map(a)];if(m==="gh")return[...l,...sl(m,d,nw).map(a)];if(Jf.has(m))return[...l,...Iw(d).map(a)];if(tw.has(m))return[...l,...nA(d).map(a)];if(V_.has(m))return[...l,...Nw(d,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...d.flatMap((p)=>Xe("awk",p)).map(a),...d.flatMap((p)=>Ww(p,t,n,r,o,i)),...d.flatMap(Gw).map(a)];if(m==="curl")return[...l,...d.flatMap((p)=>Xe(m,p)).map(a),...Ow(d).map(a)];if(ur(m)){let p=lr.has(m)?Ee([m,...d]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,...In(h,t,n,r,o,i),...d.slice(p.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...Lw(m,d,t,n,r,o,i)]}return[...l,...d.flatMap((p)=>Xe(m,p)).map(a)]}function bw(e,t,n){let r=fi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Sw(e,t,n,r,o,i,s){if(_w(t,n,r,o,i,s)){let a=ut(e),l=ll(He(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...hp(e),...l].map((c)=>({target:c,cwd:i}))}return gp(t,Ew(e),n,r,o,i,s,()=>[])}function vw(e,t,n,r,o,i,s){let a=ut(e);if(!ur(He(a[0]??"").toLowerCase()))return[];return cl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function gp(e,t,n,r,o,i,s,a){let l=ww(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>lr.has(l)?In(n.getShellSyntax(c),n,r,o,i,s):hi(l,c,n,r,o,i,s))}function hp(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase();if(!dp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ul(r.replaceAll("%%","%"))];return t.slice(1)}function Ew(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return xw(r);return[]}function xw(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ul(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>Rw(t,r.slice(i*n,(i+1)*n)))}function Rw(e,t){let n=0;return ul(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ul(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function _w(e,t,n,r,o,i){let s=ut(e);if(s.length===0||He(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Kt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,rl]:l.map((m)=>m.split(c).join(rl));return Ci(u,t,n,r,o,i).some((m)=>m.target.includes(rl))}function ww(e){let t=ut(e);if(t.length===0)return null;let n=He(t[0]??"").toLowerCase();if(!ur(n))return null;return Aw(n,t.slice(1))?n:null}function Aw(e,t){let n=dl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(fp.has(o)||yp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(hw.get(n)?.has(o))r++;continue}return!1}return!0}function dl(e){return/^python\d/.test(e)?"python":e}function Pw(e){let t=[];for(let n of e){if(bp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var ip=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function Tw(e,t){if(!t||!ip.test(e))return e;return`~${e.replace(ip,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function Iw(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function kw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...rw.has(r)?sl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),ow):sl("git",e.slice(n),iw)];if(t.push(...Xe("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function sl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function Ow(e){return e.flatMap((t,n)=>{let r=Dw(t);if(r!==null)return sp(r.flag,r.value);let o=Mw(e[n-1]);return o===null?[]:sp(o,t)})}function sp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return ol(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return ol(t.slice(n+1))}return t.startsWith("@")?ol(t.slice(1)):[]}function Mw(e){if(e===void 0)return null;if(mp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Dw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return mp.has(r)?{flag:r,value:e.slice(n+1)}:null}function ol(e){return e===""||e==="-"?[]:[e]}function Nw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!q_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>Y_.has(f)),m=u===-1?c:c.slice(0,u),d=Ci(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!X_.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function Lw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(fp.has(c)||yp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...hi(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function yp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return ew.get(t[t.length-1]??"")?.has(dl(e))??!1}function Ww(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ca(e)?.commands.flatMap((s)=>In(t.getShellSyntax(s),t,n,r,o,i))??[]}function Gw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ml),...e.match(il)??[]]}function hi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=Bw(t,zw(e));if(l.kind==="unmaskable")return Fw(t).map(a);let c=l.masked.match(tp)!==null||l.literals.some((p)=>np.test(l.masked.slice(0,p.start))),u=l.masked.match(pw)!==null||l.literals.some((p)=>gw.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!lr.has(e),d=m&&!(jw(l.masked)||c||u)?[]:l.literals,f=m?Array.from(l.masked.matchAll(tp),(p)=>{let h=p.index+p[0].length;return{start:h,end:Xs(l.masked,h)}}):[],g=!m||f.some((p)=>Js(l.masked,p.start))?l.literals:l.literals.filter((p)=>np.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...d.map((p)=>p.text).filter((p)=>p!=="").map(a),...d.flatMap((p)=>ml(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(il)??[]).map(a),...c?g.flatMap((p)=>cl(p.text,n,r,o,i,s)??[a(p.text)]):[],...u?l.literals.flatMap((p)=>hi(e,p.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(il)??[]).map(a)]}function zw(e){let t=dl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Bw(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(mw.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Hw(e,o))return{kind:"unmaskable"};let a=t==="python"?$w(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=Uw(e,c,l);if(u===null)return{kind:"unmaskable"};let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&fw.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function $w(e,t){return dw.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function Uw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Hw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function jw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(J_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>Q_.has(i)))continue;if(o.length>1)return!0;if(Vw(e,r)===".")return!0;if(Kw(e,r+n.length)==="(")return!0}return!1}function Vw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Kw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function qw(e,t,n,r,o,i){return Qw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...In(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...Yw(a,r)?Zw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Yw(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||He(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Zw(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(ml)}function ml(e){let t=Jw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Xw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Xw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function Jw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Qw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(jn(o,n))continue;if(Cp(e,r,n)){let i=eA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=tA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function eA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(jn(i,n))continue;if(Cp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function tA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Cp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function nA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===sw)o=!0;if(lw.has(m))r=!0;if(d!==void 0){if(m===ep)t.push(d);continue}if(uw.has(m)){let f=e[l+1];if(m===ep&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(aw.has(h))r=!0;if(cw.has(h)){d=h,f=m.slice(p+1);break}}if(d==="")continue;if(f.length>0){if(d===Qf)t.push(f);continue}let g=e[l+1];if(d===Qf&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!bp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function bp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var rA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),oA=".env.",iA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),sA=[".env.example.",".env.sample."];function aA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function lA(e){return e.length>0&&!/\s/.test(e)}function al(e,t,n,r){let o=Sp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function Sp(e,t,n,r){try{return Tr(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var cA=new Set(["node_modules","__pycache__"]),uA=[["vendor","bundle"],["vendor","cache"]];function dA(e,t,n,r,o){if(aA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=z(i.split("/").pop()??""),a=z(i),l=()=>lA(s)||al(e,t,r,o);if(iA.has(s)||sA.some((d)=>s.startsWith(d)))return null;let c=z(yA(e,t,r,o));for(let d of ms){let f=`~/${d.suffixParts.join("/")}`;if((lp(a,f)||lp(c,f))&&ct(d.id,n))return d.id}let u=mA(i,t,n,r,o);if(u)return u;if(rA.has(s))return null;for(let d of ds)if(s===d.basename&&ct(d.id,n))return d.id;if(s.startsWith(oA)&&ct(Zr.id,n)&&l())return Zr.id;for(let d of fs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&ct(d.id,n)&&l())return d.id}for(let d of ps)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ct(d.id,n))return d.id}if(gA(a))return null;if(!s.includes(".")&&Vn.pattern.test(s)&&ct(Vn.id,n))return Vn.id;let m=hA(s,n);if(m)return m;return null}function mA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=z(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Pr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Ar(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=z(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=z(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Pr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Ar(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Ar(e,s,["credentials"])||Ar(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=z(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=z(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>Pr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(z(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Pr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ze(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Ar(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ze("~",t,r,o),".config","amp")],l=z(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Pr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ze("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||z(e).split("/").at(-1)==="mcp-auth.json"&&Xt(z(e),z(a))}case"secret.cli.cursor.config":{let s=z(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=z(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var ap=new WeakMap;function B(e,t,n,r,o){let i=ap.get(o)??new Map;ap.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>vp(e,ce(t,r)))}function Ar(e,t,n){return n.some((r)=>Xt(z(e),z(ce(t,r))))}function Pr(e,t,n,r,o){return vp(e,Ze(t,n,r,o))}function vp(e,t){return z(e)===z(t)}function ce(e,...t){return Ue([e,...t].filter(Boolean).join("/"))}function fA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));return n.some((a)=>Xt(s,z(Tr(a,r,o,i))))}function pA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ue(N(Se(a),o.paths,i)):"",c=z(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=z(u?Ue(N(yi(Se(u)),o.paths,i)):l&&Ue(N(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Xt(s,m))return!1;return n.some((d)=>{let f=bs(d);if(f&&cp.basename(s)!==z(f.name))return!1;let g=z(Tr(f?.root??d,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return Xt(s,g)&&!(f&&s===g)})}function gA(e){let t=e.split("/");return t.some((n)=>cA.has(n))||uA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function hA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function z(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";if(!o)return i;let s=pl(i,o),a=gi(s)?s:Ue(yi(t,s)),l=Ue(N(a,n.paths,r));if(!Xt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function lp(e,t){return e===t||e.startsWith(`${t}/`)}function yA(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i||!o)return"";let s=pl(i,o),a=cp.normalize(gi(s)?s:Ue(yi(t,s))),l=Ue(Se(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Xt(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function Tr(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";let s=o?pl(i,o):i;return Ue(N(gi(s)?s:yi(t,s),n.paths,r))}function fl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ue(N(Se(r),t.paths,n)):"",i=Ue(Se(CA(ot(e,t))));return{home:o,normalized:i}}function CA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return j_(e)}catch{return e}}function pl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function bA(e){if(process.platform==="win32")return!0;return H_.parse(e).root.length>1}function Ue(e){let t=e.trim(),n=(t.includes("\\")&&bA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Xt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function He(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Jt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var SA={findPolicyMutation:Zf,findGitMetadataMutation:Ed,resolveGitMetadata:EA,loadPolicySnapshot:uu,findSensitiveTarget:pp,analyzeCommand:Bf,getModes:zi},vA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function Ep(e,t){let n={...SA,...t.dependencies},r=_A(e),o=Ir(e)?e.command:r,i=At("policy-protection",o,()=>dr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Ir(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:$d,intent:"stop_and_explain"}};let l=be(),c=At("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=At("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Yf,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let m=At("policy-protection",o,()=>jf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Hf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let d=At("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let f=At("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,...xA(f)},y=g.secretProtection.enabled===!1?null:At("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:Ir(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:up,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Ir(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...gl("command-validation",o),...h};let v=At("command-analysis",o,()=>$f(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},RA(i),i.store),e.command,t.trace));if(v.decision){let E=!p.strict&&(v.decision.ruleId==="raw-text.dangerous-command"||v.decision.reason===gr&&!vA.test(v.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:E?{...v.decision,unverifiedByStandardMode:!0}:v.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function EA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function xA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function RA(e){return ge(e,"declared-command")?.program}function _A(e){try{return Wn(e.input)}catch(t){let n=Ir(e)?e.command:void 0;throw new Jt("policy-protection",gl("policy-protection",t instanceof et?void 0:n,t),t)}}function At(e,t,n){try{return n()}catch(r){throw new Jt(e,gl(e,r instanceof et?void 0:t,r),r)}}function gl(e,t,n){let r=n instanceof D||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?Ei:Mn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Ir(e){return e.route.kind==="command"}import{appendFileSync as GA,mkdirSync as FA}from"node:fs";import{isAbsolute as zA,join as Cl}from"node:path";import{lstatSync as Rp,readdirSync as wA,readFileSync as AA,rmdirSync as PA,statSync as _p,unlinkSync as TA,utimesSync as IA,writeFileSync as kA}from"node:fs";import{join as kr}from"node:path";function xp(e,t={}){return so(on(e,t),e.home).policy.audit.retention_days}var yl=86400000,OA=".last-prune",MA=/^\d{4}-\d{2}$/,DA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,wp=(e)=>Math.floor(e/yl);function Pp(e,t,n=()=>new Date){try{let r=n().getTime();if(!_p(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=kr(t,OA),i=_p(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&wp(i)===wp(r))return;let s=r-xp(e)*yl,a=new Date(r).toISOString().slice(0,7);for(let l of hl(t)){if(l.isDirectory()){NA(kr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))LA(kr(t,l.name),s)}kA(o,"",{mode:384}),IA(o,r/1000,r/1000)}catch{}}function NA(e,t,n){for(let r of hl(e)){if(!r.isDirectory()||!MA.test(r.name))continue;let o=kr(e,r.name);for(let i of hl(o)){if(!i.isFile())continue;let s=DA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+yl;if(!Number.isFinite(a)||a>=t)continue;Tp(kr(o,i.name))}if(r.name!==n)Ap(o)}Ap(e)}function LA(e,t){try{let n=Rp(e);if(n.mtimeMs>=t)return;let r=AA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(WA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Rp(e).mtimeMs!==n.mtimeMs)return;Tp(e)}catch{}}function WA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function hl(e){try{return wA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Tp(e){try{TA(e)}catch{}}function Ap(e){try{PA(e)}catch{}}var BA="2.4.12",$A=1e4,UA=2000,HA=256,jA=32768;function VA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function KA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function bl(e,t,n,r,o,i,s={}){let a=VA(t);if(!a)return;let l=YA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=bi(mt(n),s.failureStage?Number.POSITIVE_INFINITY:$A),m=bi(mt(r),UA),d=s.toolName?bi(mt(s.toolName),HA):void 0,f=i===null?void 0:bi(mt(i),jA),g=Cl(l,KA(f?.value??null),c.slice(0,7));FA(g,{recursive:!0,mode:448});let p=Cl(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:BA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};GA(p,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),Pp(e,l,s.now)}catch{}}function bi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function qA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&zA(n)?n:null}function YA(e){let t=qA(e);return t?Cl(t,".cc-safety-net","logs"):null}function kp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Ip(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Ip(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Ip(e){return"command"in e?e.command??"":""}function Op(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;bl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Mp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;bl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Np(e,t,n){try{let r=Ep(t,{environment:e,...n.guard});return Dp(e,t,r,n),r}catch(r){if(!(r instanceof Jt))throw r;throw Dp(e,t,r.evaluation,n,!(r.cause instanceof et),{stage:r.stage,errorCode:ZA(r.cause)}),r}}function Dp(e,t,n,r,o=!0,i){Op(e,kp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function ZA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof et)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Pt(e,t={}){return{malformed:!0,denial:Dn(t),cwd:e}}function Sl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Lp(e,t={}){return(n,r)=>{try{return XA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Dn())}}}function XA(e,t,n,r){let o=tc();if(n.cancelled?.(t))return n.block(Dn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Mp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Rl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Np(o,i,{guard:{auditAllowed:nc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Jt))throw l;if(It(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${wl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Wp="exec",JA=new Set(["auto","gateway"]);function Gp(e){e.on("before_tool_call",QA(e),{matcher:[Wp],priority:50})}function QA(e,t={}){return Lp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>eP(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>nP(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function eP(e,t,n,r){if(!e||typeof e!=="object")return Pt(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Pt(null);if(o!==Wp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Pt(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Pt(null,{toolName:o});if(s.host!==void 0&&!JA.has(s.host))return Pt(null,{command:a,toolName:o});let l=tP(n,t.agentId);if(!l)return Pt(null,{command:a,toolName:o});let c=Mi(".",[l],r);if(!c)return Sl({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let u=s.workdir;if(u!==void 0&&(typeof u!=="string"||u.trim()===""))return Pt(c,{command:a,toolName:o});let m=typeof u==="string"?u:".",d=Mi(m,[c],r);if(!d)return Sl({directory:"requested",problem:ql(m,c,r),cwd:m},{command:a,toolName:o});return Gn(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:d},a)}function tP(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function nP(e){return{block:!0,blockReason:_l(e)}}var v1={...xl,register:Gp};export{v1 as default};