cc-safety-net 2.4.13 → 2.4.15

package/dist/amp/cc-safety-net/index.ts

@@ -1,49 +1,49 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.13
+// version: 2.4.15
 // @bun
-var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Dn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Mn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Mn},trackedHeredocFiles:{cap:64,...Mn},controlFlowStates:{cap:64,...Mn},wrapperPeelIterations:{cap:20,...Mn},derivedCommandShape:Mn});class D extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new D(t)}}}var Fp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function mt(e){return zp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function zp(e){return Fp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Bp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function $p(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Bp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
+var Ei="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ve="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Ln="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var vi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Nn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},K=Object.freeze({realpathAttempts:{cap:16384,...vi},processedCandidateBytes:{cap:4194304,...vi},pathEnvironmentExpansion:{cap:64,...vi},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Nn},trackedHeredocFiles:{cap:64,...Nn},controlFlowStates:{cap:64,...Nn},wrapperPeelIterations:{cap:20,...Nn},derivedCommandShape:Nn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(K[e].reason);this.kind=e}}function Se(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>K[t].cap)throw new N(t)}}}var Bp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function dt(e){return $p(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function $p(e){return Bp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Up={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Hp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Up[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
-`)}function xl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Nn(e={}){return{reason:Dn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var Up={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...Up[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Rl(e){return $p({...e,redact:mt})}function _l(e){return mt(e instanceof Error?e.message:String(e))}import{types as Hp}from"util";var jp=new Set(["applypatch","patch"]),Vp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Kp=new Set(["grep","grepsearch","rg"]),qp=new Set(["find","findbyname","glob"]),Yp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Zp=new Set(["command","diff","input","patch","patchtext"]),wl=new TextEncoder,Xp=new TextDecoder,Jp=/\s/,Qp=64;class Qe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Ln=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function kl(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Nr(e){return Yp.has(kl(e))}function Ai(e){let t=kl(e);if(jp.has(t))return"patch";if(Kp.has(t))return"grep";if(qp.has(t))return"glob";if(Vp.has(t))return"path";return"unknown"}function Gn(e){if(!e||typeof e!=="object")return;Gl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ol(e,t){return Ml(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Ml(e,t,n,r,o){let i=Wl(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>Ml(l,t,i.array?n:t.has(Dl(a)),r,o+1));return r.ancestors.delete(i.object),s}function Dl(e){return e.replace(/-/g,"_").toLowerCase()}function Nl(e){return Ll(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(tg)}function Ll(e,t,n,r){let o=Wl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Ll(a,o.array?t:Zp.has(Dl(s)),n,r+1));return n.ancestors.delete(o.object),i}function eg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Ln.maxDepth||t.nodes>Ln.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Ln.maxStringBytes||t.stringBytes>Ln.maxAggregateStringBytes)Ke()}function Wl(e,t,n){if(eg(e,t,n),!e||typeof e!=="object")return null;let r=Gl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Ln.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Gl(e){if(Hp.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new Qe}function tg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=ng(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(...wi(Dr(c.slice(4),!0),Dr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function ng(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Il(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Il(n[1]);if(e.startsWith("diff --git "))return rg(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Tl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Tl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return ug(i[1]);return[]}function rg(e){let t=og(e);if(t.length===2&&t[0]&&t[1])return wi(t[0],t[1]);let n=ig(e);return n?wi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function og(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Pt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Pt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Fl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Pt(e[n]))n++;return n===e.length?t:[]}function ig(e){let t=0;while(t<e.length&&Pt(e[t]))t++;let n=e.length;while(n>t&&Pt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Pt(e[o])){o++;continue}let i=o;while(o<n&&Pt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Qp)Ke();if(sg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function sg(e,t,n,r,o){if(_i(e,t,n,r,o))return!0;let i=Al(e,"/",t,n),s=Al(e,"/",r,o);if(i<=t||s<=r)return!1;if(_i(e,t,i,r,s))return!1;return _i(e,i+1,n,s+1,o)}function _i(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Al(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Pt(e){return e!==void 0&&Jp.test(e)}function Fl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Xp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...wl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...wl.encode(ag(s[0]??""))),o+=2}return null}function ag(e){return{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[e]??e}function lg(e){return Wn(dg(e))}function wi(e,t){if(e==="/dev/null")return Pl(t);if(t==="/dev/null")return Pl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Wn);let n=cg(e,t)??(e===t?zl(e):null);return[e,t,...n?[n]:[]].flatMap(Wn)}function Pl(e){let t=zl(e);return[e,...t?[t]:[]].flatMap(Wn)}function zl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function cg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Tl(e){return lg(Dr(e,!0))}function ug(e){return Wn(Dr(e,!1))}function Dr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=Fl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function dg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Wn(e){return e===""||e==="/dev/null"?[]:[e]}function Il(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Mi,relative as Sg,resolve as Kl,sep as vg}from"path";import{basename as Ul,dirname as mg,isAbsolute as fg,join as pg,normalize as gg,resolve as Bl}from"path";var hg=256,Lr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function Se(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function et(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ki(e,t){return Pi(e,0,t)}function Pi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ti(e,o+2),a=yg(e,o,t);if(a===null){if(Lr.has(s))throw new D("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=bg(l,t,n),o=a+1;continue}let i=Ti(e,o+1);if(!i){r+="$",o++;continue}r+=Ii(i,n)??`$${i}`,o+=i.length+1}return r}function yg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new D("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function bg(e,t,n){let r=e.slice(2,-1),o=Ti(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ii(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Lr.has(o))throw new D("pathEnvironmentExpansion");return e}if(!Lr.has(o))return e;if(s.endsWith("="))throw new D("pathEnvironmentExpansion");let a=Ii(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new D("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Pi(i.slice(s.length),t+1,n);return l?Pi(i.slice(s.length),t+1,n):""}function Ti(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ii(e,t){if(!Lr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function N(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Hl(n,i);let s=t.realpath(i);if(s!==null)return $l(n,e,s,o);let a=mg(i);if(a===i||o.length>=hg)return $l(n,e,i,o);o.push(Ul(i)),i=a}}function $l(e,t,n,r){let o=r.length===0?n:pg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Cg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Hl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Hl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ae(e,t,n,r){let o=Vl(e,t,n);if(!o)return"";return N(o,n.paths,r).replace(/\\/g,"/")}function jl(e,t,n,r,o){let i=Vl(e,t,n);if(!i)return null;if(o(Ul(i)))return N(i,n.paths,r).replace(/\\/g,"/");let s=Cg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Vl(e,t,n){let r=n.home,o=ki(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?Bl(r,o.slice(2)):o,s=Se(i);return gg(fg(s)?s:Bl(t,s))}function ql(e,t,n){if(et(e))return;let r=t.flatMap((i)=>Oi(i,n));if(!r[0])return;let o=Oi(Mi(e)?e:Kl(r[0],e),n)[0];if(!o)return;return r.some((i)=>Eg(o,i))?o:void 0}function Yl(e,t,n){if(et(e))return;return Oi(Mi(e)?e:Kl(t,e),n)[0]}function Oi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Eg(e,t){let n=Sg(t,e);return n===""||n!==".."&&!n.startsWith(`..${vg}`)&&!Mi(n)}function en(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Zg,realpathSync as Xg,statSync as Jg}from"fs";import{homedir as Qg,tmpdir as eh}from"os";import{statSync as Kg}from"fs";import{join as qg}from"path";import{spawnSync as xg}from"child_process";import{existsSync as zn,lstatSync as Rg,readFileSync as Bn,realpathSync as tn,statSync as Fn}from"fs";import{dirname as Di,isAbsolute as Ni,join as nn,resolve as Wr}from"path";var _g=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],wg=5000;function Xl(e,t=Ug(),n=wg){let r=Ag(e),o=r===null?null:Pg(r);if(r===null||o===null)return null;let i=Bg(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Ag(e){try{let t=tn(Wr(e));return Fn(t).isDirectory()?t:null}catch{return null}}function Pg(e){let t=zg(e);if(!t)return null;try{let n=Rg(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Li(t);if(!r?.commonDir)return null;if(!kg(r.gitDir,t))return null;return Og(r.gitDir,Di(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Li(e){try{let t=Tg(e);if(!t)return null;let n=tn(Ni(t)?t:Wr(Di(e),t));if(!Fn(n).isDirectory())return null;return{gitDir:n,commonDir:Ig(n)}}catch{return null}}function Tg(e){let t=Bn(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Ig(e){try{let t=Bn(nn(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=tn(Ni(t)?t:Wr(e,t));return Fn(n).isDirectory()?n:null}catch{return null}}function kg(e,t){let n=Mg(e);return n===null?!1:Jl(e,n,t)}function Og(e,t){let n=Dg(e);return n===null?!0:Jl(e,n,t)}function Mg(e){let t=nn(e,"gitdir");if(!zn(t))return null;let n=Bn(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Dg(e){let t=nn(e,"config.worktree");return zn(t)?Lg(t):null}function Jl(e,t,n){try{return Ng(Ni(t)?t:Wr(e,t),n)}catch{return!1}}function Ng(e,t){try{let n=Fn(e),r=Fn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Zl(tn.native(e))===Zl(tn.native(t))}function Zl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Lg(e){let t=Bn(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Wg(s[1]??"")}return r}function Wg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Fg(t.slice(1,-1))}var Gg={"\\":"\\",'"':'"',n:`
-`,t:"\t",b:"\b"};function Fg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:Gg[n]??t)}function zg(e){try{return Wi(tn(e))}catch{return null}}function Wi(e){let t=e;while(!0){let n=nn(t,".git");if(zn(n))return n;let r=Di(t);if(r===t)return null;t=r}}function Bg(e,t,n,r){if($g(t))return!0;if(n===null)return!0;let o=xg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Hg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&Ql(o.stdout.trim())}function $g(e){return[nn(e.commonDir,"config"),nn(e.gitDir,"config.worktree")].filter((t)=>zn(t)).some((t)=>jg(t))}function Ug(){return _g.find((e)=>zn(e))??null}function $n(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Hg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!$n(t)))}function jg(e){let t;try{t=Bn(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(Vg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=Ql(c)}return r}function Vg(e){return e==="include"||e.startsWith("includeif ")}function Ql(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function ec(e,t){if(e==="")return null;let n=Ce(),r=Wi(ae(e,e,t,n)),o=r?Yg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Yg(e,t,n,r){try{let o=ae(e,t,n,r),i=Kg(e),s=i.isFile()?o:null,a=i.isFile()?Li(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[rn(ae(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[rn(e.replace(/\\/g,"/")),...l]:l)];return{entry:rn(o),markerFile:s?rn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=rn(qg(d,"hooks").replace(/\\/g,"/"));return[m,rn(ae(m,t,n,r))]}))]}}catch{return null}}function rn(e){return process.platform==="win32"?e.toLowerCase():e}var th={realpath:(e)=>{try{return Xg(e)}catch{return null}},entryKind:(e)=>{let t=Zg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return Jg(e).isDirectory()}catch{return!1}}};function nc(){return nh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:Se(process.env.HOME||Qg()),tmpdir:eh(),paths:th})}function nh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>tc(n,i,()=>ec(i,o)),worktreeFacts:(i)=>tc(r,i,()=>Xl(i)),...t};return o}function tc(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var on=["fail_closed","paranoid_rm","paranoid_interpreters"],Gr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Fr=["standard","strict","paranoid"];function rh(e,t){if(!t)return e;return Fr.indexOf(t)>Fr.indexOf(e)?t:e}function oh(e){let t=Bi(ee.level,e);if(t===void 0||t==="")return;if(Fr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Fr.join(", ")}.`);return}function ih(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function rc(e){return ih(Bi(ee.auditScope,e))==="all"}function Fi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function zi(e={},t){let n=e.safety?.level??"standard",r=oh(t),o=rh(n,r),i=Gr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(Tt(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(Tt(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(Tt(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(Tt(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||Tt(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Fi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function Tt(e,t){let n=typeof e==="string"?Gi(e,t):Bi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Gi(e,t){return t.get(e)}function Bi(e,t){let n=Gi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Gi(e.legacyName,t);return}import{dirname as qr}from"path";import{closeSync as sh,constants as oc,fstatSync as ah,fsyncSync as jP,lstatSync as Hi,mkdirSync as VP,openSync as lh,readdirSync as KP,readFileSync as ch,realpathSync as ji,renameSync as qP,rmdirSync as YP,statSync as uh,unlinkSync as ZP,writeFileSync as XP}from"fs";import{isAbsolute as ic,join as Vi,normalize as dh,parse as Ui,relative as Ki,resolve as qi,sep as Yi}from"path";function $i(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var mh=Symbol("PolicyFilesystemScope"),fh=Symbol("PolicyFilesystemTarget"),ph=oc.O_NOFOLLOW??0;class le extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function It(e,t){return{[mh]:!0,root:qi(e),label:t}}function sc(e,t){let n=dh(t);if(t===""||ic(t)||n===".."||n.startsWith(`..${Yi}`))throw new le(e.label);return{[fh]:!0,scope:e,relativePath:n,path:Vi(e.root,n)}}function Un(e,t){return sc(e,Ki(e.root,qi(t)))}function ac(e,t="rules policy"){let n=qi(e),r=Ui(n).dir;return sc(It(r,t),Ki(r,n))}function Br(e){return cc(e.scope.label,()=>{if(!zr(e))return null;let t=lh(e.path,oc.O_RDONLY|ph);return gh(t,()=>{let n=ah(t);if(!n.isFile())throw new le(e.scope.label);let r=ch(t,"utf-8"),o=Hi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new le(e.scope.label);return zr(e),r})})}function lc(e,t){if(e.path===t.path)return!0;return cc(e.scope.label,()=>{if(!zr(e)||!zr(t))return!1;let n=(r)=>Vi(ji(Ui(r).dir),Ui(r).base);return n(e.path)===n(t.path)})}function cc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof le)throw r;throw new le(e)}}function gh(e,t){try{return t()}finally{sh(e)}}function zr(e,t="file"){let n=hh(e.scope);if(!n)return!1;let r=e.relativePath.split(Yi);for(let o of r.keys()){let i=Vi(e.scope.root,...r.slice(0,o+1)),s=Hi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new le(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new le(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new le(e.scope.label);yh(n,ji(i),e.scope.label)}return!0}function hh(e){if(!Hi(e.root,{throwIfNoEntry:!1}))return null;if(!uh(e.root).isDirectory())throw new le(e.label);return ji(e.root)}function yh(e,t,n){let r=Ki(e,t);if(r===".."||r.startsWith(`..${Yi}`)||ic(r))throw new le(n)}import{dirname as Ot,isAbsolute as Eh,join as Dt,relative as xh,resolve as Mt,sep as Rh}from"path";var kt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,uc="rulebook.json",dc=".cc-safety-net/rules";var mc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var bh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,Ch=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Sh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),tT=new RegExp(`^${Ch}/(${kt.source.slice(1,-1)})/${Sh}$`);function vh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function fc(e){if($r(e))try{return Zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return kt.test(e)?null:`Local rulebook sources must be bare names matching ${kt}: ${e}`}function Zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(mc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!bh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!kt.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:vh(o),name:o}}function $r(e){return mc.test(e)}var pc="rule.json",Ur="policy.json",gc=".cc-safety-net",_h="rules",wh="CC_SAFETY_NET_HOME",hc="`cc-safety-net rule update`";function Ah(e){return Mt(e,dc)}function Ph(e){return Dt(Ah(e),pc)}function Hn(e){return Dt(Mt(e),gc,Ur)}function Xi(e,t={}){return t.userConfigDir??(t.userConfigPath?Ot(t.userConfigPath):Dt(Th(e),_h))}function Th(e){let t=e.env.get(wh);return t?Mt(Se(t)):Dt(e.home,gc)}function Ih(e,t={}){return Dt(Xi(e,t),pc)}function sn(e,t={}){return Dt(Ot(Xi(e,t)),Ur)}function yc(e,t){let n=t.userConfigPath??Ih(e,t),r=t.projectConfigPath??Ph(t.cwd),o=kh(e,t),i=Oh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:Un(o,n),projectConfigTarget:Un(i,r)}}function kh(e,t){let n=t.userConfigPath?Ot(Ot(Mt(t.userConfigPath))):Ot(Mt(t.userConfigDir??Xi(e,t)));return It(n,"user policy")}function Oh(e,t){let n=Mt(t),r=Mt(e),o=xh(n,r);if(o!==".."&&!o.startsWith(`..${Rh}`)&&!Eh(o))return It(n,"project policy");return It(Ot(Ot(r)),"project policy")}function bc(e,t){return Dt(e,t,uc)}var ve=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),ft=/^[a-zA-Z][a-zA-Z0-9_-]*$/,pt=256,q=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Cc=new Set(["python","python3","python2","node","ruby","perl"]),Hr=/^python(?:[23](?:\.\d+)*)?$/,we=new Set(["awk","gawk","nawk","mawk"]),jr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var Sc="Rulebook exceeds CC Safety Net's safe validation limits.",vc="Additional rulebook validation errors were omitted.",Oe=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function Ec(e){if(Ji(e.allowed_commands,Oe.maxAllowedCommands)||Ji(e.rules,Oe.maxRules)||Ji(e.tests,Oe.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Oe,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Oe.maxStringCodeUnits||i&&o.length>Oe.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Oe.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ji(e,t){return Array.isArray(e)&&e.length>t}var Qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var es=64,ts="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return I(e).toLowerCase()}function I(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Mh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ns=new Set(["--init-file","--rcfile"]);function rs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!Mh[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function Ee(e){let t=I(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ns.has(l)&&!s.includes("="))i++;continue}let a=rs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function jn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Vr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Dh(e))jn(n,t);return t.inSingle||t.inDouble}function Dh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
-`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);jn(s,n)}return t}var os=new Set(["rm","find","xargs","parallel"]),Nh=new Set(["git","busybox",...os,...q,...Cc,...we]),Lh=new Set(["python","node","ruby","perl"]);function xc(e){let t=O(e);return Nh.has(t)||Me(t)}function Me(e){return Lh.has(Wh(e))}function Wh(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function is(e){try{let t=Br(Gh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Bh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof le)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function Gh(e){return typeof e==="string"?ac(e):e}var _=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function Rc(e){let t=new Set;return e.flatMap((n,r)=>{let o=an(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ss=`must be one of ${Qi.join(", ")}`,Fh=/^[^/]+\/[^/]+$/,zh=["version","rules","overrides","transparent_wrappers"];function Bh(e){let t=$h(e);return{errors:as(Xh(t,zh,(n)=>n.kind==="custom"),": "," "),sources:Zh(e,t)}}function $h(e){if(!an(e))return[_([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>es;return[...e.version===1?[]:[_(["version"],"must be 1")],...Uh(e.rules,t),...Vh(e.overrides),...qh(e.transparent_wrappers),...t?[]:jh(e.rules),...an(e.overrides)?Object.keys(e.overrides).filter((n)=>!Fh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Yh(e.transparent_wrappers)]}function Uh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[_(["rules"],"must be an array of rulebook source strings"),..._c(e,es)?[_(["rules"],ts)]:[]];if(t)return[{path:["rules"],message:ts,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[_(["rules",r],"must be a rulebook source string"),...Hh(n,1)?[_(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[_(["rules",r],"must be a non-empty rulebook source string")]:[]})}function _c(e,t){let n=wc(e);return n!==void 0&&!(n<=t)}function Hh(e,t){let n=wc(e);return n!==void 0&&!(n>=t)}function wc(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function jh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=fc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function Vh(e){if(e===void 0)return[];if(!an(e))return[_(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!an(n))return[_(["overrides",t],'must be "off" or an object')];return[...Kh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||cs(n.intent)?[]:[_(["overrides",t,"intent"],ss)]]})}function Kh(e,t){if(typeof e!=="string")return[_(t,"required non-empty string"),..._c(e,pt)?[_(t,`must be at most ${pt} characters`)]:[]];if(e==="")return[_(t,"required non-empty string")];return e.length>pt?[_(t,`must be at most ${pt} characters`)]:[]}function qh(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[_(["transparent_wrappers",n],"must be a command string")];return ft.test(t)?[]:[_(["transparent_wrappers",n],"must match command pattern")]})}function Yh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(xc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Zh(e,t){let n=an(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Xh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function as(e,t,n){return[...new Set(e.map((r)=>{let o=ls(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ls(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function cs(e){return Qi.includes(e)}function an(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Pc(e){let t=ey(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var Jh=`required non-empty string up to ${pt} characters`,Ac="must be a non-empty array of unique non-empty strings",Qh="required non-empty array of non-empty strings";function ey(e){if(!gt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!Ec(e))return{errors:[Sc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...as(ty(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Oe.maxValidationErrors?[...t.slice(0,Oe.maxValidationErrors),vc]:t,ruleNames:new Set(Tc(e).map((n)=>n.toLowerCase()))}}function Tc(e){let t=gt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=gt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function ty(e,t){return[...typeof e.name==="string"&&kt.test(e.name)?[]:[_(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[_(["version"],"required non-empty string")],...ny(e.allowed_commands),...ry(e.rules,t),...ay(e.tests),...ly(e),...cy(e)]}function ny(e){if(!Array.isArray(e))return[_(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&ft.test(n)?[]:[_(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!ft.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function ry(e,t){if(!Array.isArray(e))return[_(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!gt(n))return[_(["rules",r],"must be an object")];return t?iy(n,["rules",r]):oy(n,["rules",r])}),...Rc(e)]}function oy(e,t){return[...Ic(e.name,t),...kc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&ft.test(e.subcommand)?[]:[_([...t,"subcommand"],"must match command pattern")],...Kr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Oc(e.reason,t),...Mc(e.intent,t)]}function iy(e,t){return[...Ic(e.name,t),...kc(e.command,t),...Oc(e.reason,t),...Mc(e.intent,t),...sy(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[_([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[_([...t,"block_args"],"not supported in rulebook_version 2")]]}function Ic(e,t){if(typeof e!=="string")return[_([...t,"name"],"required string")];return kt.test(e)?[]:[_([...t,"name"],"must match rule name pattern")]}function kc(e,t){return typeof e==="string"&&ft.test(e)?[]:[_([...t,"command"],"required string matching command pattern")]}function Oc(e,t){return typeof e==="string"&&e!==""&&e.length<=pt?[]:[_([...t,"reason"],Jh)]}function Mc(e,t){return e===void 0||cs(e)?[]:[_([...t,"intent"],ss)]}function sy(e,t){if(!gt(e))return[_(t,"required object")];return[...Kr(e.command_path,[...t,"command_path"],Qh,!1),...e.any_args===void 0?[]:Kr(e.any_args,[...t,"any_args"],Ac,!0),...e.exclude_args===void 0?[]:Kr(e.exclude_args,[...t,"exclude_args"],Ac,!0)]}function Kr(e,t,n,r){if(!Array.isArray(e))return[_(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[_([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function ay(e){if(e===void 0)return[];if(!Array.isArray(e))return[_(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!gt(t))return[_(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[_(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[_(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[_(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function ly(e){if(!Array.isArray(e.tests))return[];let t=new Set(Tc(e));return[...new Set(e.tests.flatMap((n)=>gt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function cy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=gt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function gt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Fc(e,t){let n=yc(e,t),r;try{r=lc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof le)return by(n,f.message);throw f}let o=is(n.userConfigTarget),i=r?{config:null,errors:[]}:is(n.projectConfigTarget),s=Wc(n.userConfigPath,o.errors),a=Wc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Dc(o.config,qr(n.userConfigPath),"user",n.userScope,l):Gc(),d=i.config?Dc(i.config,qr(n.projectConfigPath),"project",n.projectScope,l):Gc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Nc(c.rules,m),...Nc(d.rules,u)],transparent_wrappers:hy(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?Lc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?yy(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?Lc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Dc(e,t,n,r=It(qr(qr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=dy(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:uy(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function uy(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function dy(e,t,n){let r=my(e),o=bc(t,r),i=py(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${fy(e)}`]};let s=gy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function my(e){return $r(e)?Zi(e).name:e}function fy(e){return $r(e)?`run ${hc} to vendor ${e}`:"create that file or remove that source from the rules config"}function py(e,t){try{return{content:Br(Un(t,e))}}catch(n){if(n instanceof le)return{error:n.message};throw n}}function gy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Pc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function hy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Nc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Lc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function yy(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Wc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function by(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Gc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Iy,readFileSync as ky}from"fs";var zc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],us=new Set(zc.map((e)=>e.id)),Yr=zc,Cy=new Map(Yr.map((e)=>[e.id,e.intent]));function S(e,t){return{id:e,reason:t,intent:Cy.get(e)??"manual_only"}}var ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Sy=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],vy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ms=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...vy.flatMap((e)=>Sy.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Xr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],Bc=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Ey=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],fs=Bc.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ps=Bc.flatMap((e)=>Ey.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),Vn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),hs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],xy=[...ds,Zr,...ms,...fs,...ps,Vn,...gs,...hs,...Xr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Jr=new Set(Xr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ys=new Set(xy.map((e)=>e.id));import{isAbsolute as bs,join as Ry,normalize as _y,sep as Qr}from"path";var eo=process.platform==="win32",$c=/[*?]/;function Cs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(eo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if($c.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Kn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Kn(e.trim(),t);if(!bs(n))return"must be an absolute path or start with ~/";return qn(n,t)}function vs(e,t){let n=Uc(e,t);if(n===null)return"must be a non-empty path string";if(!bs(n))return null;if(qn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var wy="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ay="cannot cover the guard's own configuration";function Uc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=eo?n.replaceAll("\\","/"):n;return Kn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=Uc(e,t);if(n===null)return"must be a non-empty path string";let r=Cs(n)?.root??n;if($c.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!bs(r))return null;if(qn(r,t)!==null)return wy;return Py(r,t)?Ay:null}function Py(e,t){let n=to(e),r=to(Ry(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Qr}`)}function qn(e,t){let n=to(e),r=to(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Qr)?n:`${n}${Qr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function to(e){let t=_y(e);if(eo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(eo?3:1)&&t.endsWith(Qr))t=t.slice(0,-1);return t}var Hc=30,no=1,ro=365;function jc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Vc=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function T(e,t){if(!e)return null;if(Vc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Vc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function Kc(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function qc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:Kc(e,t)})}var Yc={standard:0,strict:1,paranoid:2};function Jc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:xs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:xs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:xs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:Ty(e,t)}}function xs(e,t){return[...new Set([...e,...t??[]])]}function Ty(e,t){let n=t.safety?.level,r=Gr[e.safety.level];return[...n&&Yc[n]<Yc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...on.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Zc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Zc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Jr.has(o))),...e.destructive_command_protection.enabled?Xc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Xc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Zc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Xc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var ws=new Set(["standard","strict","paranoid"]),nu={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:Hc}};function ru(e,t){let n=By(sn(e,t),e.home),r=so(Hn(t.cwd),e.home),o=My(r.parsed,e.home),i=Object.keys(o.policy).length>0?Jc(n.gui??nu,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?_s(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Oy="project policy audit settings are ignored; audit is user scope only";function My(e,t){if(!xe(e))return{policy:{},diagnostics:[]};let n=xe(e.safety)?e.safety:{},r=xe(e.workflow)?e.workflow:{},o=xe(e.destructive_command_protection)?e.destructive_command_protection:{},i=xe(e.secret_protection)?e.secret_protection:{},s={...ws.has(n.level)?{level:n.level}:{},...xe(n.overrides)?Qc({overrides:ou(n.overrides,on,["safety","overrides"],Nt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:io(o.overrides,us,su,Nt)}:{},...o.allow_paths!==void 0?{allow_paths:cn(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Nt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:io(i.overrides,ys,au,Nt)}:{},...i.deny_paths!==void 0?{deny_paths:cn(i.deny_paths,vs,t,["secret_protection","deny_paths"],Nt)}:{},...i.allow_paths!==void 0?{allow_paths:cn(i.allow_paths,Es,t,["secret_protection","allow_paths"],Nt)}:{}};return{policy:Qc({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Oy]}}function ou(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(_([...n,o],As));return[]}))}function Qc(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Nt=()=>{return},As="must be a boolean",Ps="must be an object if provided",iu=`must be an integer between ${no} and ${ro}`,su={path:["destructive_command_protection","overrides"],label:"destructive command"},au={path:["secret_protection","overrides"],label:"secret protection"},Dy=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Ny(e,t){let n=[];return{policy:lu(e,t,(o)=>{n.push(o)}),issues:n}}function Ly(e,t){return lu(e,t,Nt)}function lu(e,t,n){if(!xe(e))return n(_([],"Config must be an object")),oo();if(e.version!==1)n(_(["version"],"must be 1"));let r=ln(e.safety,["safety"],["level","overrides"],n),o=ln(r.overrides,["safety","overrides"],on,n),i=ln(e.workflow,["workflow"],["worktree_mode"],n),s=ln(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=ln(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=ln(e.audit,["audit"],["retention_days"],n);return cu(e,Dy,[],n),{version:1,safety:{level:Wy(r.level,n),overrides:ou(o,on,["safety","overrides"],n)},workflow:{worktree_mode:Rs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Rs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:io(s.overrides,us,su,n),allow_paths:cn(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Rs(a.enabled,["secret_protection","enabled"],!0,n),overrides:io(a.overrides,ys,au,n),deny_paths:cn(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:cn(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:Gy(l.retention_days,n)}}}function ln(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(t,Ps)),{};return cu(e,n,t,r),e}function cu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Wy(e,t){if(e===void 0)return"standard";if(ws.has(e))return e;return t(_(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Rs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(_(t,As));return n}function Gy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=no&&e<=ro))t(_(["audit","retention_days"],iu));return jc(e)}function io(e,t,n,r){if(e===void 0)return{};if(!xe(e))return r(_(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(_([...n.path,o],'must be "on" or "off"')),[]}))}function cn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(_(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):_([...r,s],a)),[]})}function xe(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function oo(){return structuredClone(nu)}function so(e,t){if(!Iy(e))return{exists:!1,policy:oo(),errors:[]};try{let n=ky(e,"utf-8");if(!n.trim())return{exists:!0,policy:oo(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Ny(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${zy(i)}`),fallback:xe(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:oo(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var Fy=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[iu,`not an integer between ${no} and ${ro}`]]);function zy(e){let t=ls(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=Fy.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function By(e,t){let n=so(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!xe(r))return{policy:tu(),errors:[]};let o=Ly(r,t);return{policy:_s(o),gui:o,errors:[],levelPresent:eu(r)}}if(n.parsed===void 0)return{policy:tu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:_s(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:eu(n.parsed)}}function eu(e){let t=xe(e)&&xe(e.safety)?e.safety:{};return ws.has(t.level)}function uu(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Jr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function tu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:uu({}),denyPaths:[],allowPaths:[]}}}function _s(e){return{safety:$y(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:uu(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function $y(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function du(e,t){let n=Fc(e,t),r=ru(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...Vy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Ky(o,Uy(n,r),s,r.policyScopes)}function Uy(e,t){let n=jy(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:qy(e.errors.length>0?Hy(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function Hy(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function jy(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function Vy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Ky(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function qy(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function mu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:qc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Fi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as qR,isAbsolute as YR,join as ZR,parse as XR,resolve as JR,sep as QR}from"path";function Yn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Yy=/^[A-Za-z_][A-Za-z0-9_]*=/;function ao(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Zn(e){let t=ao(e.words[0],"time")?1:0,n=t===1&&ao(e.words[t],"-p")?t+1:t,r=t===1&&ao(e.words[n],"--")?n+1:n,o=ao(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Yy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var ht=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function lo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Zy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function co(e,t,n){e.push(n),t.reset()}function uo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function un(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Zy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||pu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!pu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=fu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=fu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
-`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Xy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?Jy(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function fu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
-`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function pu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Xy(e,t,n){let r=t;while(r<n&&e[r]!==`
-`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function Jy(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var bu=new Set(["&&","||","|","|&"]);function Cu(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=po(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:yo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function po(e,t,n,r,o,i,s){let a=[],l=[],c=lo(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},g=c.words.map((p)=>p.text);co(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):g.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),yu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(ho(f)){if(f===`
-`||f==="\r"){m();let b=f==="\r"&&e[u+1]===`
-`?u+2:u+1,P=a.at(-1);if(P?.kind!=="connector"||!bu.has(P.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,b),span:Object.freeze({start:u,end:b})}));if(d.length>0){let x=Ds(e,b,n,d.splice(0));l.push(...x.issues),u=x.next;continue}u=b;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
-`&&e[u]!=="\r")u++;continue}let g=c.start===-1?Cb(e,u,n):void 0;if(g){if(Ls(a,l),i>=r.maxDepth)return dn(a,l,u,"depth-limit",r.maxDepth);if(!Ns(o))return dn(a,l,u,"word-limit",r.maxWords);let b=po(e,g.braceIndex+1,n,r,o,i+1,"}"),P=b.next,x={start:g.braceIndex+1,end:b.closed?P-1:P},A=gu(e,x,b);if(a.push({kind:"function",name:g.name,span:{start:u,end:P},body:A}),l.push(...b.issues),b.pendingHeredocs.length>0||Jn(b.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...b.pendingHeredocs),b.limited)return fo(a,l,b.next);if(!b.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=P;continue}let p=go(e,u);if(p){if(m(),!Au(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${p} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:p,span:Object.freeze({start:u,end:u+p.length})})),u+=p.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&sb(e,u,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return dn(a,l,u,"depth-limit",r.maxDepth);let b=f==="("?")":"}",P=po(e,u+1,n,r,o,i+1,b),x=P.next,A={start:u+1,end:P.closed?x-1:x},Y=gu(e,A,P);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:x},body:Y}),l.push(...P.issues),P.pendingHeredocs.length>0||Jn(P.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...P.pendingHeredocs),P.limited)return fo(a,l,P.next);if(!P.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});u=x;continue}let h=(f==="<"||f===">")&&e[u+1]!=="("?nb(e,u):null;if(h){let b=c.words.at(-1),P=b&&b.span.end===u&&/^[0-9]+$/.test(b.raw)?Number(b.raw):void 0;if(P!==void 0)c.words.pop();let x=P===void 0?u:b?.span.start??u;c.start=c.start===-1?u:c.start;let A=u+h.length;while(A<n&&/[ \t]/.test(e[A]??""))A++;let Y=e[A],ke=A>u+h.length&&Y==="#",je=!Y||ho(Y)||!!go(e,A)||Y===s||Y===")"||ke||(Y==="<"||Y===">")&&e[A+1]!=="(",de=h==="<<"||h==="<<-",j=de?Ms(e,A,n):void 0,G=j?{word:un(e,A,j.next,j.delimiter,"literal",j.quoted),nested:[],issues:[],next:j.next,limited:!1}:!je?Ws(e,A,n,r,o,i):void 0;if(G){if(l.push(...G.issues),G.limited)return fo(a,l,G.next);if(!Ns(o))return dn(a,l,G.next,"word-limit",r.maxWords)}let J=G?.next??u+h.length,X={kind:"redirection",operator:h,span:{start:x,end:J},...P===void 0?{}:{fd:P},...G?{target:G.word}:{}};if(c.redirections.push(X),de&&!j)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(j){if(j.ambiguous||j.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let Q=c.nested;d.push({delimiter:j.delimiter,quotedDelimiter:j.quoted,stripTabs:h==="<<-",attach:(be)=>{if(X.heredoc=be,be.quotedDelimiter)return;Q.push(...eb(e,be.bodySpan.start,be.bodySpan.end,r,o,i+1))}})}if(!de&&!G)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(G)c.nested.push(...G.nested);c.end=J,u=J;continue}if(c.start===-1)Ls(a,l);let y=Ws(e,u,n,r,o,i);if(l.push(...y.issues),y.limited)return fo(a,l,y.next);let v=cb(c.words)?pb(e,y.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(v?.limitCode)return dn(a,l,y.next,v.limitCode,v.limitCode==="word-limit"?r.maxWords:v.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let E=v?.words??[y.word];for(let b of E){if(!Ns(o))return dn(a,l,y.next,"word-limit",r.maxWords);c.words.push(b)}c.start=c.start===-1?u:c.start,c.end=y.next,c.nested.push(...y.nested),u=y.next>u?y.next:u+1}return m(),yu(a,l),l.push(...Sb(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function gu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:yo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],g=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ho(f)||(f===";"||f==="|"||f==="&")&&go(e,a)||(f==="<"||f===">")&&!g)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=Qy(e,a,n,r,o,i);if(s+=h.text,d.push(...h.nested),m.push(...h.issues),u||=h.limited,c=Xn(c,h.provenance),a=h.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let h=rb(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
-`){a+=2;continue}s+=h,a+=2;continue}let p=f==="$"||f==="<"||f===">"||f==="`"?bo(e,a,n,r,o,i):null;if(p){let h=Su(p,d,m);if(u||=h.limited,c=Xn(c,h.provenance),a=h.next,u)break;continue}if(f==="$"){let h=xu(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Xn(c,"glob");s+=f,a++}return{word:un(e,t,a,s,c,l,c==="literal"?void 0:ib(e,t,a)),nested:d,issues:m,next:a,limited:u}}function Qy(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let g=e[m+1]??"";if(g===`
-`){m+=2;continue}if(g==="\r"&&e[m+2]===`
-`){m+=3;continue}s+=["$","`",'"',"\\"].includes(g)?g:`\\${g}`,m+=2;continue}if(e.startsWith("$((",m)){let g=Gs(e,m+3,n,"))"),p=g===-1?n:g+2;if(s+=e.slice(m,p),g===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=p;continue}let f=bo(e,m,n,r,o,i);if(f){let g=Su(f,l,c);if(m=g.next,d||=g.limited,a=Xn(a,g.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let g=xu(e,m,n,s,a);s=g.text,a=g.provenance,m=g.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function bo(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=Gs(e,t+d,n,m),f=u===-1?n:u,g=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:bb(e,t+d,f,"depth-limit"),next:g,provenance:s?"arithmetic":"command-substitution"};if(s){let v=[],E=[],b=!1,P=t+d;while(P<f){let x=bo(e,P,f,r,o,i+1);if(!x){P++;continue}if(v.push(...x.program.nodes),E.push(...x.program.issues),b||=x.program.status==="limited",P=x.next,b)break}if(u===-1)E.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo(E,b),issues:E,nodes:v}),next:g,provenance:"arithmetic"}}let p=po(e,t+d,f,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`}]:[],y=(c||l)&&Jn(p.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo([...p.issues,...h,...y],p.limited),issues:[...p.issues,...h,...y],nodes:p.nodes}),next:g,provenance:"command-substitution"}}function eb(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?bo(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function Su(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Gs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
+`)}function Rl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Wn(e={}){return{reason:Ln,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var jp={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative"}}};function xi(e,t={}){return{...jp[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function wl(e){return Hp({...e,redact:dt})}function _l(e){return dt(e instanceof Error?e.message:String(e))}import{types as Vp}from"util";var Kp=new Set(["applypatch","patch"]),qp=new Set(["create","edit","listdir","listpermissions","ls","multiedit","multireplacefilecontent","notebookedit","read","readfile","readurlcontent","replacefilecontent","searchweb","strreplaceeditor","view","viewfile","write","writefile","writetofile"]),Yp=new Set(["grep","grepsearch","rg"]),Zp=new Set(["find","findbyname","glob"]),Xp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Jp=new Set(["command","diff","input","patch","patchtext"]),Al=new TextEncoder,Qp=new TextDecoder,eg=/\s/,tg=64;class Qe extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Gn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Ol(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Nr(e){return Xp.has(Ol(e))}function Ai(e){let t=Ol(e);if(Kp.has(t))return"patch";if(Yp.has(t))return"grep";if(Zp.has(t))return"glob";if(qp.has(t))return"path";return"unknown"}function zn(e){if(!e||typeof e!=="object")return;Fl(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)Ke();return}if(t.get||t.set)Ke();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Ml(e,t){return Dl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Dl(e,t,n,r,o){let i=Gl(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>Dl(l,t,i.array?n:t.has(Nl(a)),r,o+1));return r.ancestors.delete(i.object),s}function Nl(e){return e.replace(/-/g,"_").toLowerCase()}function Ll(e){return Wl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(rg)}function Wl(e,t,n,r){let o=Gl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Wl(a,o.array?t:Jp.has(Nl(s)),n,r+1));return n.ancestors.delete(o.object),i}function ng(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Gn.maxDepth||t.nodes>Gn.maxNodes)Ke();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Gn.maxStringBytes||t.stringBytes>Gn.maxAggregateStringBytes)Ke()}function Gl(e,t,n){if(ng(e,t,n),!e||typeof e!=="object")return null;let r=Fl(e);if(t.ancestors.has(e))Ke();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Gn.maxKeys)Ke();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)Ke();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Fl(e){if(Vp.isProxy(e))Ke();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)Ke();return t}function Ke(){throw new Qe}function rg(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let d=og(c);if(o=!0,i=d?.oldLines??null,s=d?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let d=c.startsWith(" ")||c.startsWith("-")?1:0,m=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-d),s=Math.max(0,s-m),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let d=n[l+1]??"";if(!d.startsWith("+++ "))continue;t.push(..._i(Dr(c.slice(4),!0),Dr(d.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function og(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return kl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return kl(n[1]);if(e.startsWith("diff --git "))return ig(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Il(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Il(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return mg(i[1]);return[]}function ig(e){let t=sg(e);if(t.length===2&&t[0]&&t[1])return _i(t[0],t[1]);let n=ag(e);return n?_i(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function sg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Tt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Tt(e[n]))n++;t.push(e.slice(i,n));continue}let o=zl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Tt(e[n]))n++;return n===e.length?t:[]}function ag(e){let t=0;while(t<e.length&&Tt(e[t]))t++;let n=e.length;while(n>t&&Tt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Tt(e[o])){o++;continue}let i=o;while(o<n&&Tt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>tg)Ke();if(lg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function lg(e,t,n,r,o){if(wi(e,t,n,r,o))return!0;let i=Pl(e,"/",t,n),s=Pl(e,"/",r,o);if(i<=t||s<=r)return!1;if(wi(e,t,i,r,s))return!1;return wi(e,i+1,n,s+1,o)}function wi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Pl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Tt(e){return e!==void 0&&eg.test(e)}function zl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Qp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Al.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Al.encode(cg(s[0]??""))),o+=2}return null}function cg(e){return{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[e]??e}function ug(e){return Fn(fg(e))}function _i(e,t){if(e==="/dev/null")return Tl(t);if(t==="/dev/null")return Tl(e);if(e.startsWith("a/")&&t.startsWith("b/"))return[e.slice(2),t.slice(2)].flatMap(Fn);let n=dg(e,t)??(e===t?Bl(e):null);return[e,t,...n?[n]:[]].flatMap(Fn)}function Tl(e){let t=Bl(e);return[e,...t?[t]:[]].flatMap(Fn)}function Bl(e){let t=e.indexOf("/");return t>0&&t<e.length-1?e.slice(t+1):null}function dg(e,t){let n=e.indexOf("/"),r=t.indexOf("/");if(n<1||r<1)return null;if(e.slice(0,n)===t.slice(0,r))return null;let o=e.slice(n+1);return o===t.slice(r+1)?o:null}function Il(e){return ug(Dr(e,!0))}function mg(e){return Fn(Dr(e,!1))}function Dr(e,t){let n=e.trim(),r=n[0]==='"'||n[0]==="'"?n[0]:void 0;if(r){let o=zl(n,0,r);if(o&&(t||n.slice(o.end).trim()===""))return o.value}return t?n.split("\t",1)[0]?.trim()??"":n}function fg(e){return e.startsWith("a/")||e.startsWith("b/")?e.slice(2):e}function Fn(e){return e===""||e==="/dev/null"?[]:[e]}function kl(e){let t=e.split("\t",1)[0]?.trim().replace(/^['"]|['"]$/g,"")??"";return t===""||t==="/dev/null"?[]:[t]}import{isAbsolute as Mi,relative as Eg,resolve as ql,sep as xg}from"path";import{basename as Hl,dirname as pg,isAbsolute as gg,join as hg,normalize as yg,resolve as $l}from"path";var Cg=256,Lr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ve(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function et(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function ki(e,t){return Pi(e,0,t)}function Pi(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ti(e,o+2),a=bg(e,o,t);if(a===null){if(Lr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Sg(l,t,n),o=a+1;continue}let i=Ti(e,o+1);if(!i){r+="$",o++;continue}r+=Ii(i,n)??`$${i}`,o+=i.length+1}return r}function bg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>K.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Sg(e,t,n){let r=e.slice(2,-1),o=Ti(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ii(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Lr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!Lr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=Ii(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Pi(i.slice(s.length),t+1,n);return l?Pi(i.slice(s.length),t+1,n):""}function Ti(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ii(e,t){if(!Lr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function L(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){jl(n,i);let s=t.realpath(i);if(s!==null)return Ul(n,e,s,o);let a=pg(i);if(a===i||o.length>=Cg)return Ul(n,e,i,o);o.push(Hl(i)),i=a}}function Ul(e,t,n,r){let o=r.length===0?n:hg(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function vg(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;jl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function jl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function le(e,t,n,r){let o=Kl(e,t,n);if(!o)return"";return L(o,n.paths,r).replace(/\\/g,"/")}function Vl(e,t,n,r,o){let i=Kl(e,t,n);if(!i)return null;if(o(Hl(i)))return L(i,n.paths,r).replace(/\\/g,"/");let s=vg(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Kl(e,t,n){let r=n.home,o=ki(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?$l(r,o.slice(2)):o,s=ve(i);return yg(gg(s)?s:$l(t,s))}function Yl(e,t,n){if(et(e))return;let r=t.flatMap((i)=>Oi(i,n));if(!r[0])return;let o=Oi(Mi(e)?e:ql(r[0],e),n)[0];if(!o)return;return r.some((i)=>Rg(o,i))?o:void 0}function Zl(e,t,n){if(et(e))return;return Oi(Mi(e)?e:ql(t,e),n)[0]}function Oi(e,t){let n=t.realpath(e);if(n===null)return[];return t.isDirectory(n)?[n]:[]}function Rg(e,t){let n=Eg(t,e);return n===""||n!==".."&&!n.startsWith(`..${xg}`)&&!Mi(n)}function nn(e,t,n,r,o){if(n.kind!=="command")return{toolName:e,input:t,route:n,context:r};return{toolName:e,input:t,route:n,context:r,command:o}}import{lstatSync as Jg,realpathSync as Qg,statSync as eh}from"fs";import{homedir as th,tmpdir as nh}from"os";import{statSync as Yg}from"fs";import{join as Zg}from"path";import{spawnSync as wg}from"child_process";import{existsSync as $n,lstatSync as _g,readFileSync as Un,realpathSync as rn,statSync as Bn}from"fs";import{dirname as Di,isAbsolute as Ni,join as on,resolve as Wr}from"path";var Ag=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Pg=5000;function Jl(e,t=jg(),n=Pg){let r=Tg(e),o=r===null?null:Ig(r);if(r===null||o===null)return null;let i=Ug(r,o,t,n);return i===null?null:{recursiveSubmodules:i}}function Tg(e){try{let t=rn(Wr(e));return Bn(t).isDirectory()?t:null}catch{return null}}function Ig(e){let t=$g(e);if(!t)return null;try{let n=_g(t);if(n.isSymbolicLink()||!n.isFile())return null;let r=Li(t);if(!r?.commonDir)return null;if(!Mg(r.gitDir,t))return null;return Dg(r.gitDir,Di(t))?{gitDir:r.gitDir,commonDir:r.commonDir}:null}catch{return null}}function Li(e){try{let t=kg(e);if(!t)return null;let n=rn(Ni(t)?t:Wr(Di(e),t));if(!Bn(n).isDirectory())return null;return{gitDir:n,commonDir:Og(n)}}catch{return null}}function kg(e){let t=Un(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Og(e){try{let t=Un(on(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=rn(Ni(t)?t:Wr(e,t));return Bn(n).isDirectory()?n:null}catch{return null}}function Mg(e,t){let n=Ng(e);return n===null?!1:Ql(e,n,t)}function Dg(e,t){let n=Lg(e);return n===null?!0:Ql(e,n,t)}function Ng(e){let t=on(e,"gitdir");if(!$n(t))return null;let n=Un(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function Lg(e){let t=on(e,"config.worktree");return $n(t)?Gg(t):null}function Ql(e,t,n){try{return Wg(Ni(t)?t:Wr(e,t),n)}catch{return!1}}function Wg(e,t){try{let n=Bn(e),r=Bn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Xl(rn.native(e))===Xl(rn.native(t))}function Xl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Gg(e){let t=Un(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=Fg(s[1]??"")}return r}function Fg(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Bg(t.slice(1,-1))}var zg={"\\":"\\",'"':'"',n:`
+`,t:"\t",b:"\b"};function Bg(e){return e.replace(/\\(.?)/gs,(t,n)=>n===""?t:zg[n]??t)}function $g(e){try{return Wi(rn(e))}catch{return null}}function Wi(e){let t=e;while(!0){let n=on(t,".git");if($n(n))return n;let r=Di(t);if(r===t)return null;t=r}}function Ug(e,t,n,r){if(Hg(t))return!0;if(n===null)return!0;let o=wg(n,["config","--get","submodule.recurse"],{cwd:e,encoding:"utf8",env:Vg(process.env),stdio:["ignore","pipe","ignore"],timeout:r});if(o.error!==void 0||o.status!==0&&o.status!==1)return null;return o.status===0&&ec(o.stdout.trim())}function Hg(e){return[on(e.commonDir,"config"),on(e.gitDir,"config.worktree")].filter((t)=>$n(t)).some((t)=>Kg(t))}function jg(){return Ag.find((e)=>$n(e))??null}function Hn(e){return e==="GIT_CONFIG_COUNT"||e==="GIT_CONFIG_PARAMETERS"||/^GIT_CONFIG_(KEY|VALUE)_\d+$/.test(e)}function Vg(e){return Object.fromEntries(Object.entries(e).filter(([t])=>!Hn(t)))}function Kg(e){let t;try{t=Un(e,"utf-8")}catch{return!0}let n="",r=!1;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;let s=i.match(/^\[([^\]]+)\]$/);if(s){n=s[1]?.trim().toLowerCase()??"";continue}let a=i.indexOf("="),l=(a===-1?i:i.slice(0,a)).trim().toLowerCase(),c=a===-1?"true":i.slice(a+1).trim();if(qg(n)&&l==="path")return!0;if(n==="submodule"&&l==="recurse")r=ec(c)}return r}function qg(e){return e==="include"||e.startsWith("includeif ")}function ec(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function tc(e,t){if(e==="")return null;let n=Se(),r=Wi(le(e,e,t,n)),o=r?Xg(r,e,t,n):null;if(!o)return null;return Object.freeze({entries:Object.freeze([o.entry]),markerFiles:Object.freeze(o.markerFile?[o.markerFile]:[]),directories:Object.freeze(o.directories),hooksDirectories:Object.freeze(o.hooksDirectories)})}function Xg(e,t,n,r){try{let o=le(e,t,n,r),i=Yg(e),s=i.isFile()?o:null,a=i.isFile()?Li(e):null,l=(i.isDirectory()?[o]:[a?.gitDir,a?.commonDir]).flatMap((d)=>d?[sn(le(d,t,n,r))]:[]),c=[...new Set(i.isDirectory()?[sn(e.replace(/\\/g,"/")),...l]:l)];return{entry:sn(o),markerFile:s?sn(s):null,directories:c,hooksDirectories:[...new Set(c.flatMap((d)=>{let m=sn(Zg(d,"hooks").replace(/\\/g,"/"));return[m,sn(le(m,t,n,r))]}))]}}catch{return null}}function sn(e){return process.platform==="win32"?e.toLowerCase():e}var rh={realpath:(e)=>{try{return Qg(e)}catch{return null}},entryKind:(e)=>{let t=Jg(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"},isDirectory:(e)=>{try{return eh(e).isDirectory()}catch{return!1}}};function rc(){return oh({env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ve(process.env.HOME||th()),tmpdir:nh(),paths:rh})}function oh(e,t={}){let n=new Map,r=new Map,o={...e,gitMetadata:(i)=>nc(n,i,()=>tc(i,o)),worktreeFacts:(i)=>nc(r,i,()=>Jl(i)),...t};return o}function nc(e,t,n){let r=e.get(t);if(r!==void 0)return r;let o=n();return e.set(t,o),o}var an=["fail_closed","paranoid_rm","paranoid_interpreters"],Gr={standard:{fail_closed:!1,paranoid_rm:!1,paranoid_interpreters:!1},strict:{fail_closed:!0,paranoid_rm:!1,paranoid_interpreters:!1},paranoid:{fail_closed:!0,paranoid_rm:!0,paranoid_interpreters:!0}};var ee={level:{name:"CC_SAFETY_NET_LEVEL"},strict:{name:"CC_SAFETY_NET_STRICT",legacyName:"SAFETY_NET_STRICT"},paranoid:{name:"CC_SAFETY_NET_PARANOID",legacyName:"SAFETY_NET_PARANOID"},paranoidRm:{name:"CC_SAFETY_NET_PARANOID_RM",legacyName:"SAFETY_NET_PARANOID_RM"},paranoidInterpreters:{name:"CC_SAFETY_NET_PARANOID_INTERPRETERS",legacyName:"SAFETY_NET_PARANOID_INTERPRETERS"},worktree:{name:"CC_SAFETY_NET_WORKTREE",legacyName:"SAFETY_NET_WORKTREE"},debug:{name:"CC_SAFETY_NET_DEBUG"},auditScope:{name:"CC_SAFETY_NET_AUDIT_SCOPE"}},Fr=["standard","strict","paranoid"];function ih(e,t){if(!t)return e;return Fr.indexOf(t)>Fr.indexOf(e)?t:e}function sh(e){let t=Bi(ee.level,e);if(t===void 0||t==="")return;if(Fr.includes(t))return t;console.error(`CC Safety Net: ignored invalid ${ee.level.name}=${JSON.stringify(t.slice(0,40))}. Use ${Fr.join(", ")}.`);return}function ah(e){if(e===void 0||e==="all")return"all";if(e==="blocked")return"blocked";return"invalid"}function oc(e){return ah(Bi(ee.auditScope,e))==="all"}function Fi(e){if(e.failClosed&&e.paranoidRm&&e.paranoidInterpreters)return"paranoid";if(e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"strict";if(!e.failClosed&&!e.paranoidRm&&!e.paranoidInterpreters)return"standard";return"custom"}function zi(e={},t){let n=e.safety?.level??"standard",r=sh(t),o=ih(n,r),i=Gr[o],s={failClosed:i.fail_closed,paranoidRm:i.paranoid_rm,paranoidInterpreters:i.paranoid_interpreters},a={failClosed:o===n?"preset":"environment",paranoidRm:o===n?"preset":"environment",paranoidInterpreters:o===n?"preset":"environment"},l={failClosed:[`policy safety.level=${n}`],paranoidRm:[`policy safety.level=${n}`],paranoidInterpreters:[`policy safety.level=${n}`]};if(o!==n)l.failClosed.push(`env ${ee.level.name}=${r}`),l.paranoidRm.push(`env ${ee.level.name}=${r}`),l.paranoidInterpreters.push(`env ${ee.level.name}=${r}`);if(e.safety?.overrides?.failClosed!==void 0)s.failClosed=e.safety.overrides.failClosed,a.failClosed="capability_override",l.failClosed.push("policy safety.overrides.fail_closed");if(e.safety?.overrides?.paranoidRm!==void 0)s.paranoidRm=e.safety.overrides.paranoidRm,a.paranoidRm="capability_override",l.paranoidRm.push("policy safety.overrides.paranoid_rm");if(e.safety?.overrides?.paranoidInterpreters!==void 0)s.paranoidInterpreters=e.safety.overrides.paranoidInterpreters,a.paranoidInterpreters="capability_override",l.paranoidInterpreters.push("policy safety.overrides.paranoid_interpreters");if(It(ee.strict,t))s.failClosed=!0,a.failClosed="environment",l.failClosed.push(`env ${ee.strict.name}`);if(It(ee.paranoid,t))s.paranoidRm=!0,s.paranoidInterpreters=!0,a.paranoidRm="environment",a.paranoidInterpreters="environment",l.paranoidRm.push(`env ${ee.paranoid.name}`),l.paranoidInterpreters.push(`env ${ee.paranoid.name}`);if(It(ee.paranoidRm,t))s.paranoidRm=!0,a.paranoidRm="environment",l.paranoidRm.push(`env ${ee.paranoidRm.name}`);if(It(ee.paranoidInterpreters,t))s.paranoidInterpreters=!0,a.paranoidInterpreters="environment",l.paranoidInterpreters.push(`env ${ee.paranoidInterpreters.name}`);let c=!!e.worktreeMode||It(ee.worktree,t);return{strict:s.failClosed,paranoidRm:s.paranoidRm,paranoidInterpreters:s.paranoidInterpreters,worktreeMode:c,effectiveLevel:Fi(s),capabilities:{fail_closed:{enabled:s.failClosed,source:a.failClosed,sources:l.failClosed},paranoid_rm:{enabled:s.paranoidRm,source:a.paranoidRm,sources:l.paranoidRm},paranoid_interpreters:{enabled:s.paranoidInterpreters,source:a.paranoidInterpreters,sources:l.paranoidInterpreters}}}}function It(e,t){let n=typeof e==="string"?Gi(e,t):Bi(e,t);return n==="1"||n?.toLowerCase()==="true"}function Gi(e,t){return t.get(e)}function Bi(e,t){let n=Gi(e.name,t);if(n!==void 0)return n;if(e.legacyName)return Gi(e.legacyName,t);return}import{dirname as qr}from"path";import{closeSync as lh,constants as ic,fstatSync as ch,fsyncSync as eT,lstatSync as Hi,mkdirSync as tT,openSync as uh,readdirSync as nT,readFileSync as dh,realpathSync as ji,renameSync as rT,rmdirSync as oT,statSync as mh,unlinkSync as iT,writeFileSync as sT}from"fs";import{isAbsolute as sc,join as Vi,normalize as fh,parse as Ui,relative as Ki,resolve as qi,sep as Yi}from"path";function $i(){let e=()=>Math.floor(Math.random()*4294967296).toString(16).padStart(8,"0");return`${e()}${e()}`}var ph=Symbol("PolicyFilesystemScope"),gh=Symbol("PolicyFilesystemTarget"),hh=ic.O_NOFOLLOW??0;class ce extends Error{name="PolicyFilesystemError";constructor(e){super(`Unable to access ${e} filesystem safely.`)}}function kt(e,t){return{[ph]:!0,root:qi(e),label:t}}function ac(e,t){let n=fh(t);if(t===""||sc(t)||n===".."||n.startsWith(`..${Yi}`))throw new ce(e.label);return{[gh]:!0,scope:e,relativePath:n,path:Vi(e.root,n)}}function jn(e,t){return ac(e,Ki(e.root,qi(t)))}function lc(e,t="rules policy"){let n=qi(e),r=Ui(n).dir;return ac(kt(r,t),Ki(r,n))}function Br(e){return uc(e.scope.label,()=>{if(!zr(e))return null;let t=uh(e.path,ic.O_RDONLY|hh);return yh(t,()=>{let n=ch(t);if(!n.isFile())throw new ce(e.scope.label);let r=dh(t,"utf-8"),o=Hi(e.path);if(!o.isFile()||o.isSymbolicLink()||n.dev!==o.dev||n.ino!==o.ino)throw new ce(e.scope.label);return zr(e),r})})}function cc(e,t){if(e.path===t.path)return!0;return uc(e.scope.label,()=>{if(!zr(e)||!zr(t))return!1;let n=(r)=>Vi(ji(Ui(r).dir),Ui(r).base);return n(e.path)===n(t.path)})}function uc(e,t,n){try{return t()}catch(r){if(n?.(),r instanceof ce)throw r;throw new ce(e)}}function yh(e,t){try{return t()}finally{lh(e)}}function zr(e,t="file"){let n=Ch(e.scope);if(!n)return!1;let r=e.relativePath.split(Yi);for(let o of r.keys()){let i=Vi(e.scope.root,...r.slice(0,o+1)),s=Hi(i,{throwIfNoEntry:!1});if(!s)return!1;if(s.isSymbolicLink())throw new ce(e.scope.label);if(o<r.length-1&&!s.isDirectory())throw new ce(e.scope.label);if(o===r.length-1&&(t==="file"?!s.isFile():!s.isDirectory()))throw new ce(e.scope.label);bh(n,ji(i),e.scope.label)}return!0}function Ch(e){if(!Hi(e.root,{throwIfNoEntry:!1}))return null;if(!mh(e.root).isDirectory())throw new ce(e.label);return ji(e.root)}function bh(e,t,n){let r=Ki(e,t);if(r===".."||r.startsWith(`..${Yi}`)||sc(r))throw new ce(n)}import{dirname as Mt,isAbsolute as Rh,join as Nt,relative as wh,resolve as Dt,sep as _h}from"path";var Ot=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,dc="rulebook.json",mc=".cc-safety-net/rules";var fc=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Sh=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,vh=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Eh="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),uT=new RegExp(`^${vh}/(${Ot.source.slice(1,-1)})/${Eh}$`);function xh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function pc(e){if($r(e))try{return Zi(e),null}catch(t){return t instanceof Error?t.message:String(t)}return Ot.test(e)?null:`Local rulebook sources must be bare names matching ${Ot}: ${e}`}function Zi(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(fc);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!Sh.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!Ot.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:xh(o),name:o}}function $r(e){return fc.test(e)}var gc="rule.json",Ur="policy.json",hc=".cc-safety-net",Ah="rules",Ph="CC_SAFETY_NET_HOME",yc="`cc-safety-net rule update`";function Th(e){return Dt(e,mc)}function Ih(e){return Nt(Th(e),gc)}function Vn(e){return Nt(Dt(e),hc,Ur)}function Xi(e,t={}){return t.userConfigDir??(t.userConfigPath?Mt(t.userConfigPath):Nt(kh(e),Ah))}function kh(e){let t=e.env.get(Ph);return t?Dt(ve(t)):Nt(e.home,hc)}function Oh(e,t={}){return Nt(Xi(e,t),gc)}function ln(e,t={}){return Nt(Mt(Xi(e,t)),Ur)}function Cc(e,t){let n=t.userConfigPath??Oh(e,t),r=t.projectConfigPath??Ih(t.cwd),o=Mh(e,t),i=Dh(r,t.cwd);return{userConfigPath:n,projectConfigPath:r,userScope:o,projectScope:i,userConfigTarget:jn(o,n),projectConfigTarget:jn(i,r)}}function Mh(e,t){let n=t.userConfigPath?Mt(Mt(Dt(t.userConfigPath))):Mt(Dt(t.userConfigDir??Xi(e,t)));return kt(n,"user policy")}function Dh(e,t){let n=Dt(t),r=Dt(e),o=wh(n,r);if(o!==".."&&!o.startsWith(`..${_h}`)&&!Rh(o))return kt(n,"project policy");return kt(Mt(Mt(r)),"project policy")}function bc(e,t){return Nt(e,t,dc)}var Ee=new Set(["-c","-C","--git-dir","--work-tree","--namespace","--super-prefix","--config-env"]),mt=/^[a-zA-Z][a-zA-Z0-9_-]*$/,ft=256,Y=new Set(["bash","sh","zsh","ksh","dash","fish","csh","tcsh"]),Sc=new Set(["python","python3","python2","node","ruby","perl"]),Hr=/^python(?:[23](?:\.\d+)*)?$/,Pe=new Set(["awk","gawk","nawk","mawk"]),jr=new Set(["echo","printf","cat","head","tail","less","more","grep","rg","ag","ack","sed","awk","cut","tr","sort","uniq","wc","tee","man","help","info","type","which","whereis","whatis","apropos","file","stat","ls","ll","dir","tree","pwd","date","cal","uptime","whoami","id","groups","hostname","uname","env","printenv","set","export","alias","history","jobs","fg","bg","test","true","false","read","return","exit","break","continue","shift","wait","trap","basename","dirname","realpath","readlink","md5sum","sha256sum","base64","xxd","od","hexdump","strings","diff","cmp","comm","join","paste","column","fmt","fold","nl","pr","expand","unexpand","rev","tac","shuf","seq","yes","sleep","logger","write","wall","mesg","notify-send"]);var vc="Rulebook exceeds CC Safety Net's safe validation limits.",Ec="Additional rulebook validation errors were omitted.",Me=Object.freeze({maxAllowedCommands:1024,maxRules:1024,maxTests:2048,maxBlockArgsPerRule:1024,maxTotalBlockArgs:16384,maxStringCodeUnits:1048576,maxAggregateStringCodeUnits:4194304,maxFixtureCommandCodeUnits:131072,maxValidationErrors:64});function xc(e){if(Ji(e.allowed_commands,Me.maxAllowedCommands)||Ji(e.rules,Me.maxRules)||Ji(e.tests,Me.maxTests))return!1;let{maxAggregateStringCodeUnits:t,maxTotalBlockArgs:n}=Me,r=(o,i=!1)=>{if(typeof o!=="string")return!0;if(o.length>Me.maxStringCodeUnits||i&&o.length>Me.maxFixtureCommandCodeUnits||o.length>t)return!1;return t-=o.length,!0};if(!r(e.name)||!r(e.version)||!r(e.description)||!r(e.author)||!r(e.migrated_from))return!1;if(Array.isArray(e.allowed_commands)){for(let o of e.allowed_commands)if(!r(o))return!1}if(Array.isArray(e.rules))for(let o of e.rules){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.name)||!r(i.command)||!r(i.subcommand)||!r(i.reason)||!r(i.intent))return!1;let s=i.match&&typeof i.match==="object"?i.match:{};for(let a of[i.block_args,s.command_path,s.any_args,s.exclude_args]){if(!Array.isArray(a))continue;if(a.length>Me.maxBlockArgsPerRule||a.length>n)return!1;n-=a.length;for(let l of a)if(!r(l))return!1}}if(Array.isArray(e.tests))for(let o of e.tests){if(!o||typeof o!=="object")continue;let i=o;if(!r(i.command,!0)||!r(i.expect)||!r(i.rule))return!1}return!0}function Ji(e,t){return Array.isArray(e)&&e.length>t}var Qi=Object.freeze(["hard_stop","use_alternative","scope_down","manual_only","stop_and_explain"]);var es=64,ts="Rule config exceeds CC Safety Net's safe source limit.";function O(e){return T(e).toLowerCase()}function T(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}function me(e,t){let n=new Set,r=!1;for(let o of e){if(o==="--"){r=!0;continue}if(r)continue;if(o.startsWith("-")&&!o.startsWith("--")&&o.length>1)for(let i=1;i<o.length;i++){let s=o[i];if(!s||!/[a-zA-Z]/.test(s))break;let a=`-${s}`;if(n.add(a),t?.shortOptsWithValue?.has(a))break}}return n}var Nh={bash:["O","o"],dash:["o"],ksh:["o"],sh:["o"],zsh:["o"]},ns=new Set(["--init-file","--rcfile"]);function rs(e,t,n,r){let o=!1,i=0,s=!1,a=!1,l=!1;for(let c=1;c<t.length;c++){let d=t[c];if(d===void 0)break;if(e==="ksh"&&d==="o"&&c+1<t.length){if(r==="argv"){let m=t.slice(c+1);if(t[0]==="-"&&(m==="c"||m[0]==="-"&&m.endsWith("c")))s=!0}break}if(e==="ksh"&&d==="o"&&c+1===t.length&&(n?.startsWith("-")||n?.startsWith("+")))break;if(e==="zsh"&&d==="o"&&c+1<t.length)break;if(r==="startup"&&d==="i")o=t[0]==="-";if(r==="argv"&&t[0]==="-"&&d==="c")s=!0;if(r==="argv"&&d==="n")l=t[0]==="-";if(r==="argv"&&d==="s")a=t[0]==="-";if(!Nh[e]?.includes(d))continue;if(c+1===t.length)i++;break}return{interactive:o,followingValues:i,commandSelected:s,stdinMode:a,syntaxCheck:l}}function xe(e){let t=T(e[0]??"").toLowerCase(),n=!1,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--"){let l=n&&e[i+1]!==void 0?i+1:null;return{command:l===null?null:e[l]??null,commandIndex:l,scriptIndex:!n&&!r&&e[i+1]!==void 0?i+1:null,readsStdinAsCommands:!n&&(r||e[i+1]===void 0),syntaxCheck:o}}if(s==="-"||s[0]!=="-"&&s[0]!=="+")return{command:n?s:null,commandIndex:n?i:null,scriptIndex:!n&&!r&&s!=="-"?i:null,readsStdinAsCommands:!n&&(r||s==="-"),syntaxCheck:o};if(s.startsWith("--")){let l=s.split("=",1)[0]??s;if(t==="bash"&&ns.has(l)&&!s.includes("="))i++;continue}let a=rs(t,s,e[i+1],"argv");if(a.commandSelected)n=!0;if(a.syntaxCheck)o=!0;if(a.stdinMode)r=!0;i+=a.followingValues}return{command:null,commandIndex:null,scriptIndex:null,readsStdinAsCommands:!n,syntaxCheck:o}}function Kn(e,t){if(t.escaped)return t.escaped=!1,!0;if(e==="\\"&&!t.inSingle)return t.escaped=!0,!0;if(e==="'"&&!t.inDouble)return t.inSingle=!t.inSingle,!0;if(e==='"'&&!t.inSingle)return t.inDouble=!t.inDouble,!0;return!1}function Vr(e){let t={inSingle:!1,inDouble:!1,escaped:!1};for(let n of Lh(e))Kn(n,t);return t.inSingle||t.inDouble}function Lh(e){let t="",n={inSingle:!1,inDouble:!1,escaped:!1},r=!1,o=!0;for(let i=0;i<e.length;i++){let s=e[i];if(!s)break;if(r){if(s===`
+`||s==="\r")t+=s,r=!1,n.escaped=!1;continue}if(s==="#"&&!n.inSingle&&!n.inDouble&&o){r=!0;continue}if(t+=s,!n.inSingle&&!n.inDouble&&!n.escaped)o=/[\s;&|()<>]/.test(s);Kn(s,n)}return t}var os=new Set(["rm","find","xargs","parallel"]),Wh=new Set(["git","busybox",...os,...Y,...Sc,...Pe]),Gh=new Set(["python","node","ruby","perl"]);function Rc(e){let t=O(e);return Wh.has(t)||De(t)}function De(e){return Gh.has(Fh(e))}function Fh(e){let t=T(e).toLowerCase();return Hr.test(t)?"python":t}function is(e){try{let t=Br(zh(e));if(t===null)return{config:null,errors:[]};if(!t.trim())return{config:null,errors:["Config file is empty"]};let n=JSON.parse(t),r=Uh(n);if(r.errors.length>0)return{config:null,errors:r.errors};return{config:{version:1,rules:n.rules??[],overrides:n.overrides??{},transparent_wrappers:n.transparent_wrappers??[]},errors:[]}}catch(t){if(t instanceof ce)return{config:null,errors:[t.message]};let n=t instanceof Error?t.message:String(t);return{config:null,errors:[t instanceof SyntaxError?"Invalid JSON":n]}}}function zh(e){return typeof e==="string"?lc(e):e}var w=(e,t)=>({path:e,message:t,kind:"typed"}),ne=(e,t)=>({path:e,message:t,kind:"custom"});function wc(e){let t=new Set;return e.flatMap((n,r)=>{let o=cn(n)?n.name:void 0;if(typeof o!=="string")return[];if(t.has(o.toLowerCase()))return[ne(["rules",r,"name"],`duplicate rule name "${o}"`)];return t.add(o.toLowerCase()),[]})}var ss=`must be one of ${Qi.join(", ")}`,Bh=/^[^/]+\/[^/]+$/,$h=["version","rules","overrides","transparent_wrappers"];function Uh(e){let t=Hh(e);return{errors:as(Qh(t,$h,(n)=>n.kind==="custom"),": "," "),sources:Jh(e,t)}}function Hh(e){if(!cn(e))return[w([],"Config must be an object")];let t=Array.isArray(e.rules)&&e.rules.length>es;return[...e.version===1?[]:[w(["version"],"must be 1")],...jh(e.rules,t),...qh(e.overrides),...Zh(e.transparent_wrappers),...t?[]:Kh(e.rules),...cn(e.overrides)?Object.keys(e.overrides).filter((n)=>!Bh.test(n)).map((n)=>ne(["overrides",n],"must use <rulebook-name>/<rule-name>")):[],...Xh(e.transparent_wrappers)]}function jh(e,t){if(e===void 0)return[];if(!Array.isArray(e))return[w(["rules"],"must be an array of rulebook source strings"),..._c(e,es)?[w(["rules"],ts)]:[]];if(t)return[{path:["rules"],message:ts,kind:"limit"}];return e.flatMap((n,r)=>{if(typeof n!=="string")return[w(["rules",r],"must be a rulebook source string"),...Vh(n,1)?[w(["rules",r],"must be a non-empty rulebook source string")]:[]];return n===""?[w(["rules",r],"must be a non-empty rulebook source string")]:[]})}function _c(e,t){let n=Ac(e);return n!==void 0&&!(n<=t)}function Vh(e,t){let n=Ac(e);return n!==void 0&&!(n>=t)}function Ac(e){if(e===null||e===void 0)return;let t=e.length;return t===void 0?void 0:Number(t)}function Kh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||n==="")return[];if(n.trim()==="")return[ne(["rules",r],"must be a non-empty rulebook source string")];let o=pc(n);if(o)return[ne(["rules",r],o)];if(t.has(n))return[ne(["rules",r],`duplicate rulebook source "${n}"`)];return t.add(n),[]})}function qh(e){if(e===void 0)return[];if(!cn(e))return[w(["overrides"],"must be an object if provided")];return Object.keys(e).flatMap((t)=>{let n=e[t];if(n==="off")return[];if(!cn(n))return[w(["overrides",t],'must be "off" or an object')];return[...Yh(n.reason,["overrides",t,"reason"]),...n.intent===void 0||cs(n.intent)?[]:[w(["overrides",t,"intent"],ss)]]})}function Yh(e,t){if(typeof e!=="string")return[w(t,"required non-empty string"),..._c(e,ft)?[w(t,`must be at most ${ft} characters`)]:[]];if(e==="")return[w(t,"required non-empty string")];return e.length>ft?[w(t,`must be at most ${ft} characters`)]:[]}function Zh(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["transparent_wrappers"],"must be an array of command strings")];return e.flatMap((t,n)=>{if(typeof t!=="string")return[w(["transparent_wrappers",n],"must be a command string")];return mt.test(t)?[]:[w(["transparent_wrappers",n],"must match command pattern")]})}function Xh(e){if(!Array.isArray(e))return[];let t=new Set;return e.flatMap((n,r)=>{if(typeof n!=="string"||!mt.test(n))return[];if(t.has(n))return[ne(["transparent_wrappers",r],`duplicate command "${n}"`)];if(Rc(n))return[ne(["transparent_wrappers",r],`reserved command "${n}" cannot be a wrapper`)];return t.add(n),[]})}function Jh(e,t){let n=cn(e)?e.rules:void 0;if(!Array.isArray(n))return new Set;if(t.some((o)=>o.path.length===1&&o.path[0]==="rules"))return new Set;let r=new Set(t.filter((o)=>o.path[0]==="rules"&&typeof o.path[1]==="number").map((o)=>o.path[1]));return new Set(n.filter((o,i)=>typeof o==="string"&&!r.has(i)))}function Qh(e,t,n){let r=e.map((s)=>s.path[1]),o=[...new Set(r.filter((s)=>typeof s==="string"))],i=(s,a)=>[s.path.length===0?-1:t.indexOf(String(s.path[0])),typeof a==="number"?a:o.indexOf(String(a)),n(s)?0:1];return e.map((s,a)=>({issue:s,rank:i(s,r[a])})).sort((s,a)=>s.rank[0]-a.rank[0]||s.rank[1]-a.rank[1]||s.rank[2]-a.rank[2]).map((s)=>s.issue)}function as(e,t,n){return[...new Set(e.map((r)=>{let o=ls(r.path);if(r.kind==="unknownKeys")return`${o?`${o}.`:""}unknown field "${r.message}"`;if(r.kind==="key"||r.kind==="limit"||r.path.length===0)return r.message;return`${o}${r.path.length===1?n:t}${r.message}`}))]}function ls(e){return e.map((t,n)=>{if(typeof t==="number")return`[${t}]`;return n===0?String(t):`.${String(t)}`}).join("")}function cs(e){return Qi.includes(e)}function cn(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Tc(e){let t=ny(e);if(t.errors.length>0)throw Error(t.errors.join("; "));return e}var ey=`required non-empty string up to ${ft} characters`,Pc="must be a non-empty array of unique non-empty strings",ty="required non-empty array of non-empty strings";function ny(e){if(!pt(e))return{errors:["Rulebook must be an object"],ruleNames:new Set};if(!xc(e))return{errors:[vc],ruleNames:new Set};let t=[...e.rulebook_version===1||e.rulebook_version===2?[]:["rulebook_version must be 1 or 2"],...as(ry(e,e.rulebook_version===2),": ",": ")];return{errors:t.length>Me.maxValidationErrors?[...t.slice(0,Me.maxValidationErrors),Ec]:t,ruleNames:new Set(Ic(e).map((n)=>n.toLowerCase()))}}function Ic(e){let t=pt(e)?e.rules:void 0;return(Array.isArray(t)?t:[]).flatMap((n)=>{let r=pt(n)?n.name:void 0;return typeof r==="string"?[r]:[]})}function ry(e,t){return[...typeof e.name==="string"&&Ot.test(e.name)?[]:[w(["name"],"required string matching rule name pattern")],...typeof e.version==="string"&&e.version!==""?[]:[w(["version"],"required non-empty string")],...oy(e.allowed_commands),...iy(e.rules,t),...cy(e.tests),...uy(e),...dy(e)]}function oy(e){if(!Array.isArray(e))return[w(["allowed_commands"],"required array")];let t=new Set;return[...e.flatMap((n,r)=>typeof n==="string"&&mt.test(n)?[]:[w(["allowed_commands",r],"must match command pattern")]),...e.flatMap((n,r)=>{if(typeof n!=="string"||!mt.test(n))return[];if(t.has(n))return[ne(["allowed_commands",r],`duplicate command "${n}"`)];return t.add(n),[]})]}function iy(e,t){if(!Array.isArray(e))return[w(["rules"],"required array")];return[...e.flatMap((n,r)=>{if(!pt(n))return[w(["rules",r],"must be an object")];return t?ay(n,["rules",r]):sy(n,["rules",r])}),...wc(e)]}function sy(e,t){return[...kc(e.name,t),...Oc(e.command,t),...e.subcommand===void 0||typeof e.subcommand==="string"&&mt.test(e.subcommand)?[]:[w([...t,"subcommand"],"must match command pattern")],...Kr(e.block_args,[...t,"block_args"],"required non-empty array",!1),...Mc(e.reason,t),...Dc(e.intent,t)]}function ay(e,t){return[...kc(e.name,t),...Oc(e.command,t),...Mc(e.reason,t),...Dc(e.intent,t),...ly(e.match,[...t,"match"]),...e.subcommand===void 0?[]:[w([...t,"subcommand"],"not supported in rulebook_version 2")],...e.block_args===void 0?[]:[w([...t,"block_args"],"not supported in rulebook_version 2")]]}function kc(e,t){if(typeof e!=="string")return[w([...t,"name"],"required string")];return Ot.test(e)?[]:[w([...t,"name"],"must match rule name pattern")]}function Oc(e,t){return typeof e==="string"&&mt.test(e)?[]:[w([...t,"command"],"required string matching command pattern")]}function Mc(e,t){return typeof e==="string"&&e!==""&&e.length<=ft?[]:[w([...t,"reason"],ey)]}function Dc(e,t){return e===void 0||cs(e)?[]:[w([...t,"intent"],ss)]}function ly(e,t){if(!pt(e))return[w(t,"required object")];return[...Kr(e.command_path,[...t,"command_path"],ty,!1),...e.any_args===void 0?[]:Kr(e.any_args,[...t,"any_args"],Pc,!0),...e.exclude_args===void 0?[]:Kr(e.exclude_args,[...t,"exclude_args"],Pc,!0)]}function Kr(e,t,n,r){if(!Array.isArray(e))return[w(t,n)];let o=e.flatMap((i,s)=>{if(typeof i!=="string")return[w([...t,s],"must be a non-empty string")];return i===""?[ne([...t,s],"must be a non-empty string")]:[]});if(e.some((i)=>typeof i!=="string"))return o;return[...o,...e.length===0?[ne(t,n)]:[],...r&&new Set(e).size!==e.length?[ne(t,"must not contain duplicate values")]:[]]}function cy(e){if(e===void 0)return[];if(!Array.isArray(e))return[w(["tests"],"must be an array if provided")];return e.flatMap((t,n)=>{if(!pt(t))return[w(["tests",n],"must be an object")];return[...typeof t.command==="string"&&t.command.trim()!==""?[]:[w(["tests",n,"command"],"required non-empty string")],...t.expect==="blocked"||t.expect==="allowed"?[]:[w(["tests",n,"expect"],'must be "blocked" or "allowed"')],...t.rule===void 0||typeof t.rule==="string"?[]:[w(["tests",n,"rule"],"must be a string if provided")],...t.expect==="blocked"&&typeof t.rule!=="string"?[ne(["tests",n,"rule"],"required string for blocked fixtures")]:[]]})}function uy(e){if(!Array.isArray(e.tests))return[];let t=new Set(Ic(e));return[...new Set(e.tests.flatMap((n)=>pt(n)&&n.expect==="blocked"&&typeof n.rule==="string"?[n.rule]:[]))].filter((n)=>!t.has(n)).map((n)=>ne(["tests"],`blocked fixture references unknown rule "${n}"`))}function dy(e){if(!Array.isArray(e.allowed_commands)||!Array.isArray(e.rules))return[];let t=new Set(e.allowed_commands.filter((n)=>typeof n==="string"));return e.rules.flatMap((n,r)=>{let o=pt(n)?n.command:void 0;if(typeof o!=="string"||t.has(o))return[];return[ne(["rules",r,"command"],`"${o}" must be listed in allowed_commands`)]})}function pt(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function zc(e,t){let n=Cc(e,t),r;try{r=cc(n.userConfigTarget,n.projectConfigTarget)}catch(f){if(f instanceof ce)return Sy(n,f.message);throw f}let o=is(n.userConfigTarget),i=r?{config:null,errors:[]}:is(n.projectConfigTarget),s=Gc(n.userConfigPath,o.errors),a=Gc(n.projectConfigPath,i.errors),l=new Set,c=o.config?Nc(o.config,qr(n.userConfigPath),"user",n.userScope,l):Fc(),d=i.config?Nc(i.config,qr(n.projectConfigPath),"project",n.projectScope,l):Fc(),m=o.config?.overrides??{},u=i.config?.overrides??{};return{rules:[...Lc(c.rules,m),...Lc(d.rules,u)],transparent_wrappers:Cy(o.config,i.config),rulebooks:[...c.rulebooks,...d.rulebooks],errors:[...s,...a,...c.errors,...d.errors],warnings:[...c.warnings,...d.warnings,...c.canValidateOverrides?Wc(m,c.knownRuleIds,n.userConfigPath):[],...c.canValidateOverrides?by(u,c.knownRuleIds,n.projectConfigPath):[],...d.canValidateOverrides?Wc(u,d.knownRuleIds,n.projectConfigPath):[]],userConfig:o.config??void 0,projectConfig:i.config??void 0,...n}}function Nc(e,t,n,r=kt(qr(qr(t)),n==="user"?"user policy":"project policy"),o=new Set){let i=[],s=[],a=e.rules.flatMap((c)=>{let d=fy(c,t,r);if(d.errors.length>0||!d.rulebook)return i.push(...d.errors),[];let m=d.rulebook;if(o.has(m.name))return s.push(`duplicate active rulebook name "${m.name}" for ${c}; keeping the first and ignoring this one, so its rules are not active; rename one of them in its rulebook file and in the rules config that lists it`),[];return o.add(m.name),[{rules:my(m),rulebook:{source:n,spec:c,name:m.name,version:m.version,rules:m.rules.map((u)=>`${m.name}/${u.name}`)}}]}),l=a.flatMap((c)=>c.rules);return{rules:l,rulebooks:a.map((c)=>c.rulebook),knownRuleIds:new Set(l.map((c)=>c.name)),errors:i,warnings:s,canValidateOverrides:i.length===0}}function my(e){if(e.rulebook_version===2)return e.rules.map((t)=>({name:`${e.name}/${t.name}`,command:t.command,block_args:[],match:t.match,reason:t.reason,intent:t.intent}));return e.rules.map((t)=>({...t,name:`${e.name}/${t.name}`,match:void 0}))}function fy(e,t,n){let r=py(e),o=bc(t,r),i=hy(o,n);if("error"in i)return{rulebook:null,errors:[i.error]};if(i.content===null)return{rulebook:null,errors:[`missing rulebook file ${o} for ${e}; ${gy(e)}`]};let s=yy(i.content);if("problem"in s)return{rulebook:null,errors:[`invalid rulebook ${o}: ${s.problem}; fix that file`]};if(s.rulebook.name!==r)return{rulebook:null,errors:[`rulebook name "${s.rulebook.name}" in ${o} must match source "${e}"; fix that file`]};return{rulebook:s.rulebook,errors:[]}}function py(e){return $r(e)?Zi(e).name:e}function gy(e){return $r(e)?`run ${yc} to vendor ${e}`:"create that file or remove that source from the rules config"}function hy(e,t){try{return{content:Br(jn(t,e))}}catch(n){if(n instanceof ce)return{error:n.message};throw n}}function yy(e){let t;try{t=JSON.parse(e)}catch{return{problem:"Invalid JSON"}}try{return{rulebook:Tc(t)}}catch(n){return{problem:n instanceof Error?n.message:"invalid rulebook"}}}function Cy(e,t){return[...new Set([...e?.transparent_wrappers??[],...t?.transparent_wrappers??[]])]}function Lc(e,t){return e.flatMap((n)=>{let r=t[n.name];if(r==="off")return[];if(r&&typeof r==="object")return[{...n,intent:r.intent??n.intent,reason:r.reason}];return[n]})}function Wc(e,t,n){return Object.keys(e).filter((r)=>!t.has(r)).map((r)=>`unknown override key "${r}" in ${n}; only that override is ignored and other overrides and rules keep their configured state; correct or remove it in that file`)}function by(e,t,n){return Object.keys(e).filter((r)=>t.has(r)).map((r)=>`project override cannot target user-scoped rule "${r}" in ${n}; only that override is ignored and the rule keeps its user-configured state; remove it from that file`)}function Gc(e,t){return t.map((n)=>n.startsWith("Unable to access ")?n:`${e}: ${n}`)}function Sy(e,t){return{rules:[],transparent_wrappers:[],rulebooks:[],errors:[t],warnings:[],userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath}}function Fc(){return{rules:[],rulebooks:[],knownRuleIds:new Set,errors:[],warnings:[],canValidateOverrides:!0}}import{existsSync as Oy,readFileSync as My}from"fs";var Bc=[{id:"git.ssh-env",category:"Git",label:"Git SSH environment override",description:"Blocks Git network operations with SSH environment overrides.",example:'GIT_SSH_COMMAND="./ssh-wrapper" git push',intent:"manual_only"},{id:"git.alias-config",category:"Git",label:"Git command-line alias",description:"Blocks command-line Git aliases that cannot be safely resolved.",example:"git -c alias.wipe='!rm -rf /' wipe",intent:"manual_only"},{id:"git.checkout-force",category:"Git",label:"Git checkout force",description:"Blocks forced checkout operations that discard local changes.",example:"git checkout --force main",intent:"use_alternative"},{id:"git.checkout-double-dash",category:"Git",label:"Git checkout path restore",description:"Blocks checkout path restores, with or without --.",example:"git checkout -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-ref-path",category:"Git",label:"Git checkout ref and path",description:"Blocks checkout forms that mix a ref and path restore.",example:"git checkout HEAD -- src/app.ts",intent:"use_alternative"},{id:"git.checkout-pathspec-from-file",category:"Git",label:"Git checkout pathspec file",description:"Blocks checkout pathspec loading from a file.",example:"git checkout --pathspec-from-file=paths.txt",intent:"use_alternative"},{id:"git.checkout-ambiguous",category:"Git",label:"Git checkout ambiguous targets",description:"Blocks ambiguous checkout arguments that may restore paths.",example:"git checkout main src/app.ts",intent:"use_alternative"},{id:"git.switch-discard-changes",category:"Git",label:"Git switch discard changes",description:"Blocks branch switches that explicitly discard local changes.",example:"git switch --discard-changes main",intent:"use_alternative"},{id:"git.switch-force",category:"Git",label:"Git switch force",description:"Blocks forced branch switches.",example:"git switch --force main",intent:"use_alternative"},{id:"git.restore-worktree",category:"Git",label:"Git restore worktree",description:"Blocks worktree restore operations.",example:"git restore --worktree src/app.ts",intent:"use_alternative"},{id:"git.restore-unstaged",category:"Git",label:"Git restore unstaged",description:"Blocks unstaged restore operations.",example:"git restore src/app.ts",intent:"use_alternative"},{id:"git.reset-hard",category:"Git",label:"Git reset hard",description:"Blocks hard resets.",example:"git reset --hard",intent:"use_alternative"},{id:"git.reset-merge",category:"Git",label:"Git reset merge",description:"Blocks merge resets.",example:"git reset --merge",intent:"use_alternative"},{id:"git.clean-force",category:"Git",label:"Git clean force",description:"Blocks forced clean operations.",example:"git clean -fd",intent:"use_alternative"},{id:"git.rm-force",category:"Git",label:"Git rm force",description:"Blocks forced removal of tracked files from the working tree.",example:"git rm -rf .",intent:"use_alternative"},{id:"git.push-force",category:"Git",label:"Git push force",description:"Blocks force pushes.",example:"git push --force origin main",intent:"use_alternative"},{id:"git.push-delete",category:"Git",label:"Git push delete",description:"Blocks remote ref deletion through push.",example:"git push --delete origin old-branch",intent:"manual_only"},{id:"git.push-mirror",category:"Git",label:"Git push mirror",description:"Blocks mirror pushes that can force-update or delete remote refs.",example:"git push --mirror origin",intent:"manual_only"},{id:"git.branch-force-delete",category:"Git",label:"Git branch force delete",description:"Blocks forced branch deletion.",example:"git branch -D old-branch",intent:"use_alternative"},{id:"git.rebase-abort",category:"Git",label:"Git rebase abort",description:"Blocks rebase abort operations.",example:"git rebase --abort",intent:"use_alternative"},{id:"git.merge-abort",category:"Git",label:"Git merge abort",description:"Blocks merge abort operations.",example:"git merge --abort",intent:"use_alternative"},{id:"git.tag-delete",category:"Git",label:"Git tag delete",description:"Blocks tag deletion.",example:"git tag --delete v1.0.0",intent:"manual_only"},{id:"git.reflog-delete",category:"Git",label:"Git reflog delete",description:"Blocks reflog deletion.",example:"git reflog delete HEAD@{1}",intent:"manual_only"},{id:"git.stash-drop",category:"Git",label:"Git stash drop",description:"Blocks dropping stash entries.",example:"git stash drop stash@{0}",intent:"use_alternative"},{id:"git.stash-clear",category:"Git",label:"Git stash clear",description:"Blocks clearing all stash entries.",example:"git stash clear",intent:"manual_only"},{id:"git.worktree-remove-force",category:"Git",label:"Git worktree force remove",description:"Blocks forced worktree removal.",example:"git worktree remove --force ../feature",intent:"use_alternative"},{id:"rm.recursive-force-root-or-home",category:"Filesystem",label:"rm -rf root or home",description:"Blocks recursive forced removal of root or home paths.",example:"rm -rf /",intent:"hard_stop",catastrophic:!0},{id:"rm.git-metadata",category:"Filesystem",label:"rm Git metadata",description:"Blocks removal of protected Git metadata and hooks.",example:"rm -rf .git",intent:"hard_stop",catastrophic:!0},{id:"rm.recursive-force-dynamic-target",category:"Filesystem",label:"rm -rf dynamic target",description:"Blocks recursive forced removal with dynamic targets in strict mode.",example:'rm -rf "$target"',intent:"scope_down",activationCapability:"fail_closed"},{id:"rm.recursive-force-home-cwd",category:"Filesystem",label:"rm -rf from home cwd",description:"Blocks recursive forced removal while working in home.",example:'cd "$HOME" && rm -rf build',intent:"scope_down"},{id:"rm.recursive-force-cwd-self",category:"Filesystem",label:"rm -rf current directory",description:"Blocks recursive forced removal of the current directory.",example:"rm -rf .",intent:"scope_down"},{id:"rm.recursive-force-outside-cwd",category:"Filesystem",label:"rm -rf outside cwd",description:"Blocks recursive forced removal outside the original cwd.",example:"rm -rf ../outside",intent:"scope_down"},{id:"rm.recursive-force-paranoid",category:"Filesystem",label:"rm -rf paranoid mode",description:"Blocks non-temp recursive forced removal when paranoid rm is enabled.",example:"rm -rf ./cache",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-root-or-home",category:"PowerShell",label:"Remove-Item root or home",description:"Blocks PowerShell Remove-Item targeting root or home paths.",example:"Remove-Item C:\\",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-root-or-home",category:"PowerShell",label:"Remove-Item recursive force root or home",description:"Blocks recursive forced PowerShell removal of root or home paths.",example:"Remove-Item C:\\ -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-git-metadata",category:"PowerShell",label:"Remove-Item Git metadata",description:"Blocks PowerShell removal of protected Git metadata and hooks.",example:"Remove-Item .git -Recurse -Force",intent:"hard_stop",catastrophic:!0},{id:"powershell.remove-item-recursive-force-dynamic-target",category:"PowerShell",label:"Remove-Item recursive force dynamic target",description:"Blocks recursive forced PowerShell removal with dynamic targets in strict mode.",example:"Remove-Item $target -Recurse -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"powershell.remove-item-recursive-force-home-cwd",category:"PowerShell",label:"Remove-Item recursive force from home cwd",description:"Blocks recursive forced PowerShell removal while working in home.",example:"Set-Location $HOME; Remove-Item ./build -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-cwd-self",category:"PowerShell",label:"Remove-Item recursive force current directory",description:"Blocks recursive forced PowerShell removal of the current directory.",example:"Remove-Item . -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-outside-cwd",category:"PowerShell",label:"Remove-Item recursive force outside cwd",description:"Blocks recursive forced PowerShell removal outside the original cwd.",example:"Remove-Item ../outside -Recurse -Force",intent:"scope_down"},{id:"powershell.remove-item-recursive-force-paranoid",category:"PowerShell",label:"Remove-Item recursive force paranoid mode",description:"Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.",example:"Remove-Item ./cache -Recurse -Force",intent:"scope_down",activationCapability:"paranoid_rm"},{id:"powershell.remove-item-pipeline-dynamic-target",category:"PowerShell",label:"Remove-Item pipeline dynamic target",description:"Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.",example:"Get-ChildItem . -Recurse | Remove-Item -Force",intent:"scope_down",activationCapability:"fail_closed"},{id:"find.delete",category:"Filesystem",label:"find delete",description:"Blocks unsafe find -delete operations.",example:"find . -delete",intent:"scope_down"},{id:"find.delete-git-metadata",category:"Filesystem",label:"find delete Git metadata",description:"Blocks find -delete operations selecting protected Git metadata and hooks.",example:"find .git -delete",intent:"hard_stop",catastrophic:!0},{id:"find.exec-rm-recursive-force",category:"Filesystem",label:"find exec rm -rf",description:"Blocks find -exec rm -rf operations.",example:"find . -exec rm -rf {} +",intent:"scope_down"},{id:"dd.device-write",category:"Filesystem",label:"dd device write",description:"Blocks dd writing to a /dev device.",example:"dd if=/dev/zero of=/dev/sda",intent:"manual_only"},{id:"mkfs.device",category:"Filesystem",label:"mkfs device format",description:"Blocks mkfs formatting a /dev device.",example:"mkfs.ext4 /dev/sda1",intent:"manual_only"},{id:"shred.target",category:"Filesystem",label:"shred target",description:"Blocks shred against any target, including shred --help and shred --version.",example:"shred -u secret.txt",intent:"use_alternative"},{id:"interpreter.dangerous-command",category:"Execution",label:"Interpreter dangerous command",description:"Blocks interpreter one-liners containing dangerous commands.",example:`python -c "import os; os.system('rm -rf /')"`,intent:"use_alternative"},{id:"interpreter.one-liner-paranoid",category:"Execution",label:"Interpreter one-liner paranoid mode",description:"Blocks interpreter one-liners when paranoid interpreters is enabled.",example:'python -c "print(1)"',intent:"use_alternative",activationCapability:"paranoid_interpreters"},{id:"awk.system-dynamic",category:"Execution",label:"Awk dynamic system call",description:"Blocks awk system calls that cannot be safely analyzed.",example:"awk '{ system($0) }'",intent:"stop_and_explain"},{id:"xargs.rm-recursive-force-dynamic",category:"Execution",label:"xargs dynamic rm -rf",description:"Blocks xargs rm -rf with dynamic input.",example:"printf / | xargs rm -rf",intent:"scope_down"},{id:"xargs.shell-dynamic",category:"Execution",label:"xargs dynamic shell",description:"Blocks xargs shell execution with dynamic input.",example:"xargs r$(printf m) -rf",intent:"scope_down"},{id:"parallel.rm-recursive-force-dynamic",category:"Execution",label:"parallel dynamic rm -rf",description:"Blocks parallel rm -rf with dynamic input.",example:"printf / | parallel rm -rf",intent:"scope_down"},{id:"parallel.shell-dynamic",category:"Execution",label:"parallel dynamic shell",description:"Blocks parallel shell execution with dynamic input.",example:"parallel r$(printf m) -rf ::: child",intent:"scope_down"},{id:"parallel.command-stream-dynamic",category:"Execution",label:"parallel dynamic command stream",description:"Blocks parallel command streams from dynamic input.",example:"parallel --dry-run",intent:"scope_down"},{id:"shell.dynamic-structure",category:"Execution",label:"Dynamic command structure",description:"Blocks guarded subcommands and options assembled from substitution output in strict mode.",example:"git reset $(printf --hard)",intent:"stop_and_explain",activationCapability:"fail_closed"},{id:"shell.dynamic-executable",category:"Execution",label:"Dynamic executable name",description:"Blocks executable names assembled from command substitution output in strict mode.",example:"$(printf r)m -rf /",intent:"manual_only",activationCapability:"fail_closed"},{id:"raw-text.dangerous-command",category:"Execution",label:"Raw text dangerous command",description:"Blocks dangerous commands detected in raw command text.",example:"git reset --hard 'unterminated",intent:"stop_and_explain"}],us=new Set(Bc.map((e)=>e.id)),Yr=Bc,vy=new Map(Yr.map((e)=>[e.id,e.intent]));function v(e,t){return{id:e,reason:t,intent:vy.get(e)??"manual_only"}}var ds=[{id:"secret.basename.env",category:"Basename",label:".env",description:"Blocks exact .env files.",basename:".env"},{id:"secret.basename.npmrc",category:"Basename",label:".npmrc",description:"Blocks npm credential config files.",basename:".npmrc"},{id:"secret.basename.pypirc",category:"Basename",label:".pypirc",description:"Blocks Python package index credential files.",basename:".pypirc"},{id:"secret.basename.netrc",category:"Basename",label:".netrc",description:"Blocks machine login credential files.",basename:".netrc"},{id:"secret.basename.git-credentials",category:"Basename",label:".git-credentials",description:"Blocks Git credential storage files.",basename:".git-credentials"},{id:"secret.basename.id-rsa",category:"Basename",label:"id_rsa",description:"Blocks RSA private key basenames.",basename:"id_rsa"},{id:"secret.basename.id-ed25519",category:"Basename",label:"id_ed25519",description:"Blocks Ed25519 private key basenames.",basename:"id_ed25519"},{id:"secret.basename.id-ecdsa",category:"Basename",label:"id_ecdsa",description:"Blocks ECDSA private key basenames.",basename:"id_ecdsa"},{id:"secret.basename.credentials",category:"Basename",label:"credentials",description:"Blocks generic credentials file basenames.",basename:"credentials"}],Zr={id:"secret.pattern.env-variant",category:"Pattern",label:".env.*",description:"Blocks environment-specific .env variants."},Ey=[".bak",".backup",".copy",".disabled",".old",".orig",".save",".tmp"],xy=[{idSlug:"kube-config",label:"~/.kube/config",directoryParts:[".kube"],basename:"config"},{idSlug:"docker-config",label:"~/.docker/config.json",directoryParts:[".docker"],basename:"config.json"}],ms=[{id:"secret.home.ssh",category:"Home path",label:"~/.ssh",description:"Blocks home SSH configuration and key paths.",suffixParts:[".ssh"]},{id:"secret.home.aws",category:"Home path",label:"~/.aws",description:"Blocks home AWS credential and config paths.",suffixParts:[".aws"]},{id:"secret.home.gcp",category:"Home path",label:"~/.gcp",description:"Blocks home GCP credential paths.",suffixParts:[".gcp"]},{id:"secret.home.gcloud-config",category:"Home path",label:"~/.config/gcloud",description:"Blocks home Google Cloud SDK credential paths.",suffixParts:[".config","gcloud"]},{id:"secret.home.kube-config",category:"Home path",label:"~/.kube/config",description:"Blocks home Kubernetes config files.",suffixParts:[".kube","config"]},{id:"secret.home.docker-config",category:"Home path",label:"~/.docker/config.json",description:"Blocks home Docker credential config files.",suffixParts:[".docker","config.json"]},...xy.flatMap((e)=>Ey.map((t)=>({id:["secret.home",e.idSlug,t.slice(1)].join("."),category:"Home path",label:[e.label,t].join(""),description:["Blocks home ",e.label,t," credential backup files."].join(""),suffixParts:[...e.directoryParts,[e.basename,t].join("")]}))),{id:"secret.home.gh-hosts",category:"Home path",label:"~/.config/gh/hosts.yml",description:"Blocks GitHub CLI host credential files.",suffixParts:[".config","gh","hosts.yml"]}];var Xr=[{id:"secret.cli.claude-code",category:"Coding CLI credential",label:"Claude Code credentials",paths:["~/.claude/.credentials.json"]},{id:"secret.cli.claude-code.config",category:"Coding CLI config",label:"Claude Code config",paths:["~/.claude/settings.json","~/.claude/settings.local.json","~/.claude.json","<project>/.claude/settings.local.json","<project>/.mcp.json"]},{id:"secret.cli.antigravity",category:"Coding CLI config",label:"Antigravity CLI hook config",paths:["~/.gemini/config/hooks.json","~/.gemini/config/mcp_config.json"]},{id:"secret.cli.codex",category:"Coding CLI credential",label:"Codex credentials",paths:["~/.codex/auth.json","~/.codex/.credentials.json","~/.codex/secrets","~/.codex/.sandbox-secrets"]},{id:"secret.cli.codex.config",category:"Coding CLI config",label:"Codex config",paths:["~/.codex/config.toml","~/.codex/<name>.config.toml"]},{id:"secret.cli.gemini",category:"Coding CLI credential",label:"Gemini CLI credentials",paths:["~/.gemini/oauth_creds.json","~/.gemini/mcp-oauth-tokens.json","~/.gemini/a2a-oauth-tokens.json","~/.gemini/gemini-credentials.json"]},{id:"secret.cli.gemini.config",category:"Coding CLI config",label:"Gemini CLI config",paths:["~/.gemini/settings.json","~/.gemini/google_accounts.json","<project>/.gemini/settings.json","/Library/Application Support/GeminiCli/settings.json","/etc/gemini-cli/settings.json"]},{id:"secret.cli.copilot-cli",category:"Coding CLI credential",label:"GitHub Copilot CLI credentials",paths:["~/.copilot/config.json","~/.copilot/mcp-oauth-config","~/.copilot/mcp-secrets"]},{id:"secret.cli.copilot-cli.config",category:"Coding CLI config",label:"GitHub Copilot CLI config",paths:["~/.copilot/mcp-config.json"]},{id:"secret.cli.kimi-code",category:"Coding CLI credential",label:"Kimi Code credentials",paths:["~/.kimi-code/server.token","~/.kimi-code/credentials","~/.kimi/credentials","~/.kimi/mcp-oauth"]},{id:"secret.cli.kimi-code.config",category:"Coding CLI config",label:"Kimi Code config",paths:["~/.kimi-code/config.toml","~/.kimi-code/mcp.json","~/.kimi/config.toml","~/.kimi/config.json","~/.kimi/config.json.bak","~/.kimi/mcp.json","<project>/.kimi-code/mcp.json"]},{id:"secret.cli.opencode",category:"Coding CLI credential",label:"OpenCode credentials",paths:["~/.local/share/opencode/auth.json","~/.local/share/opencode/mcp-auth.json","~/.local/share/opencode/opencode.db"]},{id:"secret.cli.opencode.config",category:"Coding CLI config",label:"OpenCode config",paths:["~/.config/opencode/opencode.json","~/.config/opencode/opencode.jsonc","~/.config/opencode/config.json","/Library/Application Support/opencode/opencode.json","/etc/opencode/opencode.json","<project>/opencode.json","<project>/opencode.jsonc"]},{id:"secret.cli.pi",category:"Coding CLI credential",label:"Pi credentials",paths:["~/.pi/agent/auth.json"]},{id:"secret.cli.pi.config",category:"Coding CLI config",label:"Pi config",paths:["~/.pi/agent/models.json"]},{id:"secret.cli.amp",category:"Coding CLI credential",label:"Amp Code credentials",paths:["~/.local/share/amp/secrets.json","~/.amp/oauth"]},{id:"secret.cli.amp.config",category:"Coding CLI config",label:"Amp Code config",paths:["~/.config/amp/settings.json","~/.config/amp/settings.jsonc","<project>/.amp/settings.json","<project>/.amp/settings.jsonc"]},{id:"secret.cli.cursor",category:"Coding CLI credential",label:"Cursor CLI credentials",paths:["~/.cursor/auth.json","~/.config/cursor/auth.json","~/.cursor/projects/<name>/mcp-auth.json"]},{id:"secret.cli.cursor.config",category:"Coding CLI config",label:"Cursor CLI config",paths:["~/.cursor/mcp.json","<project>/.cursor/mcp.json"]},{id:"secret.cli.grok-build",category:"Coding CLI credential",label:"Grok Build credentials",paths:["~/.grok/auth.json","~/.grok/mcp_credentials.json"]},{id:"secret.cli.grok-build.config",category:"Coding CLI config",label:"Grok Build config",paths:["~/.grok/config.toml","~/.grok/managed_config.toml","~/.grok/requirements.toml","<project>/.grok/config.toml","/etc/grok/managed_config.toml","/etc/grok/requirements.toml"]}],$c=[{prefix:"id_rsa",slug:"id-rsa",label:"id_rsa"},{prefix:"id_dsa",slug:"id-dsa",label:"id_dsa"},{prefix:"id_ed25519",slug:"id-ed25519",label:"id_ed25519"},{prefix:"id_ecdsa",slug:"id-ecdsa",label:"id_ecdsa"},{prefix:"credentials",slug:"credentials",label:"credentials"}],Ry=[".bak",".backup",".copy",".disabled",".key",".old",".orig",".pem",".save",".tmp"],fs=$c.map((e)=>({id:`secret.variant.${e.slug}.separator`,category:"Variant",label:`${e.label}-* / ${e.label}_*`,description:`Blocks ${e.label} variants with dash or underscore suffixes.`,prefix:e.prefix})),ps=$c.flatMap((e)=>Ry.map((t)=>({id:`secret.variant.${e.slug}.${t.slice(1)}`,category:"Variant",label:`${e.label}${t}`,description:`Blocks ${e.label}${t} private credential variants.`,prefix:e.prefix,suffix:t}))),qn={id:"secret.pattern.ssh-key-basename",category:"Pattern",label:"*_(rsa|dsa|ed25519|ecdsa)",description:"Blocks extensionless SSH private key-like basenames.",pattern:/^.*_(rsa|dsa|ed25519|ecdsa)$/},gs=["agilekeychain","asc","bek","cscfg","fve","gnucash","jks","keychain","kwallet","mdf","ovpn","p12","pcap","pem","pfx","pkcs12","psafe3","rdp","sdf","tblk","tpm"].map((e)=>({id:`secret.ext.${e}`,category:"Extension",label:`.${e}`,description:`Blocks files with the .${e} extension.`,extension:e})),hs=[{id:"secret.ext-pattern.key",category:"Extension pattern",label:".key / .keypair",description:"Blocks key and keypair extension patterns.",pattern:/^key(pair)?$/},{id:"secret.ext-pattern.keystore",category:"Extension pattern",label:".keystore / .keyring",description:"Blocks keystore and keyring extension patterns.",pattern:/^key(store|ring)$/},{id:"secret.ext-pattern.kdbx",category:"Extension pattern",label:".kdb / .kdbx",description:"Blocks KeePass database extension patterns.",pattern:/^kdbx?$/}],wy=[...ds,Zr,...ms,...fs,...ps,qn,...gs,...hs,...Xr].map((e)=>({id:e.id,category:e.category,label:e.label,...e.category==="Coding CLI config"?{defaultOff:!0}:{},..."paths"in e?{paths:e.paths}:{description:e.description}})),Jr=new Set(Xr.flatMap((e)=>e.category==="Coding CLI config"?[e.id]:[])),ys=new Set(wy.map((e)=>e.id));import{isAbsolute as Cs,join as _y,normalize as Ay,sep as Qr}from"path";var eo=process.platform==="win32",Uc=/[*?]/;function bs(e){let t=e.trim(),n=/^(.*)\/\*\*\/([^/*?\\]+)$/.exec(eo?t.replaceAll("\\","/"):t);if(!n)return null;let r=n[1]??"",o=n[2]??"";if(Uc.test(r)||o==="."||o==="..")return null;return{root:r||"/",name:o}}function Yn(e,t){if(e==="~")return t;if(e.startsWith("~/"))return`${t}${e.slice(1)}`;return e}function Ss(e,t){if(typeof e!=="string"||e.trim()==="")return"must be a non-empty path string";let n=Yn(e.trim(),t);if(!Cs(n))return"must be an absolute path or start with ~/";return Zn(n,t)}function vs(e,t){let n=Hc(e,t);if(n===null)return"must be a non-empty path string";if(!Cs(n))return null;if(Zn(n,t)===null)return null;return"cannot be the home directory or a path above it (this would block every command the agent runs)"}var Py="cannot cover the home directory or a path above it (this would disable secret protection everywhere)",Ty="cannot cover the guard's own configuration";function Hc(e,t){if(typeof e!=="string"||e.trim()==="")return null;let n=e.trim(),r=eo?n.replaceAll("\\","/"):n;return Yn(r.replace(/^\$(?:\{HOME\}|HOME(?=\/|$))/,"~"),t)}function Es(e,t){let n=Hc(e,t);if(n===null)return"must be a non-empty path string";let r=bs(n)?.root??n;if(Uc.test(r))return"supports only a folder followed by **/ and an exact file name, such as ~/code/**/.env.local";if(!Cs(r))return null;if(Zn(r,t)!==null)return Py;return Iy(r,t)?Ty:null}function Iy(e,t){let n=to(e),r=to(_y(t,".cc-safety-net"));return n===r||n.startsWith(`${r}${Qr}`)}function Zn(e,t){let n=to(e),r=to(t);if(n===r)return"cannot be the home directory";let o=n.endsWith(Qr)?n:`${n}${Qr}`;if(r.startsWith(o))return"cannot contain the home directory";return null}function to(e){let t=Ay(e);if(eo)t=t.replace(/\//g,"\\").toLowerCase();if(t.length>(eo?3:1)&&t.endsWith(Qr))t=t.slice(0,-1);return t}var jc=30,no=1,ro=365;function Vc(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}var Kc=new Set(Yr.filter((e)=>e.catastrophic).map((e)=>e.id));function P(e,t){if(!e)return null;if(Kc.has(e.id))return e;if(t?.destructiveCommandProtectionEnabled===!1)return null;let n=t?.effectiveDestructiveCommandRules[e.id];return n&&!n.enabled?null:e}function re(e,t,n){if(Kc.has(t))return!0;if(e?.destructiveCommandProtectionEnabled===!1)return!1;return e?.effectiveDestructiveCommandRules[t]?.enabled??n}function qc(e,t){return Object.freeze(Object.fromEntries(Yr.map((n)=>{let r=n.activationCapability?t[n.activationCapability]:void 0,o=r?.enabled??!0,i=e.destructiveCommandRuleOverrides[n.id],s=n.catastrophic?{enabled:!0,inheritedEnabled:!0,changesInherited:!1,source:"catastrophic",...i?{override:i}:{}}:e.destructiveCommandProtectionEnabled?i?{enabled:i==="on",inheritedEnabled:o,changesInherited:i==="on"!==o,source:"rule_override",...n.activationCapability?{activationCapability:n.activationCapability}:{},override:i}:{enabled:o,inheritedEnabled:o,changesInherited:!1,source:r?.source??"built_in_default",...n.activationCapability?{activationCapability:n.activationCapability}:{}}:{enabled:!1,inheritedEnabled:o,changesInherited:!1,source:"master_disabled",...n.activationCapability?{activationCapability:n.activationCapability}:{},...i?{override:i}:{}};return[n.id,Object.freeze(s)]})))}function Yc(e,t){return Object.freeze({...e,effectiveDestructiveCommandRules:qc(e,t)})}var Zc={standard:0,strict:1,paranoid:2};function Qc(e,t){return{policy:{version:1,safety:{level:t.safety?.level??e.safety.level,overrides:{...e.safety.overrides,...t.safety?.overrides}},workflow:{worktree_mode:t.workflow?.worktree_mode??e.workflow.worktree_mode},destructive_command_protection:{enabled:t.destructive_command_protection?.enabled??e.destructive_command_protection.enabled,overrides:{...e.destructive_command_protection.overrides,...t.destructive_command_protection?.overrides},allow_paths:xs(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths)},secret_protection:{enabled:t.secret_protection?.enabled??e.secret_protection.enabled,overrides:{...e.secret_protection.overrides,...t.secret_protection?.overrides},deny_paths:xs(e.secret_protection.deny_paths,t.secret_protection?.deny_paths),allow_paths:xs(e.secret_protection.allow_paths,t.secret_protection?.allow_paths)},audit:e.audit},weakenings:ky(e,t)}}function xs(e,t){return[...new Set([...e,...t??[]])]}function ky(e,t){let n=t.safety?.level,r=Gr[e.safety.level];return[...n&&Zc[n]<Zc[e.safety.level]?[`project policy lowers level: ${e.safety.level} -> ${n}`]:[],...an.flatMap((o)=>t.safety?.overrides?.[o]===!1&&(e.safety.overrides[o]??r[o])?[`project policy disables ${o}`]:[]),...t.workflow?.worktree_mode===!0&&!e.workflow.worktree_mode?["project policy enables worktree mode relaxations"]:[],...t.destructive_command_protection?.enabled===!1&&e.destructive_command_protection.enabled?["project policy disables destructive command protection"]:[],...t.secret_protection?.enabled===!1&&e.secret_protection.enabled?["project policy disables secret protection"]:[],...Xc(t.destructive_command_protection?.overrides,(o)=>e.destructive_command_protection.enabled&&e.destructive_command_protection.overrides[o]!=="off"),...Xc(t.secret_protection?.overrides,(o)=>e.secret_protection.enabled&&(e.secret_protection.overrides[o]==="on"?!0:e.secret_protection.overrides[o]!=="off"&&!Jr.has(o))),...e.destructive_command_protection.enabled?Jc(e.destructive_command_protection.allow_paths,t.destructive_command_protection?.allow_paths).map((o)=>`project policy adds destructive allow path: ${o}`):[],...e.secret_protection.enabled?Jc(e.secret_protection.allow_paths,t.secret_protection?.allow_paths).map((o)=>`project policy adds secret allow path: ${o}`):[]]}function Xc(e,t){return Object.entries(e??{}).flatMap(([n,r])=>r==="off"&&t(n)?[`project policy disables rule ${n}`]:[])}function Jc(e,t){return(t??[]).filter((n)=>!e.includes(n))}var _s=new Set(["standard","strict","paranoid"]),ru={version:1,safety:{level:"standard",overrides:{}},workflow:{worktree_mode:!1},destructive_command_protection:{enabled:!0,overrides:{},allow_paths:[]},secret_protection:{enabled:!0,overrides:{},deny_paths:[],allow_paths:[]},audit:{retention_days:jc}};function ou(e,t){let n=Uy(ln(e,t),e.home),r=so(Vn(t.cwd),e.home),o=Ny(r.parsed,e.home),i=Object.keys(o.policy).length>0?Qc(n.gui??ru,o.policy):void 0,s=[...n.errors,...r.errors,...o.diagnostics],a=(n.fallback==="defaults"&&i?"salvaged":n.fallback)??(n.gui?void 0:r.fallback)??(s.length>0?"salvaged":void 0),l=o.policy.safety?.level?"project":n.levelPresent?"user":"default";return{...i?ws(i.policy):n.policy,errors:s,...a?{fallback:a}:{},...r.exists?{policyScopes:{levelScope:l,weakenings:i?.weakenings??[]}}:{}}}var Dy="project policy audit settings are ignored; audit is user scope only";function Ny(e,t){if(!Re(e))return{policy:{},diagnostics:[]};let n=Re(e.safety)?e.safety:{},r=Re(e.workflow)?e.workflow:{},o=Re(e.destructive_command_protection)?e.destructive_command_protection:{},i=Re(e.secret_protection)?e.secret_protection:{},s={..._s.has(n.level)?{level:n.level}:{},...Re(n.overrides)?eu({overrides:iu(n.overrides,an,["safety","overrides"],Lt)}):{}},a={...typeof o.enabled==="boolean"?{enabled:o.enabled}:{},...o.overrides!==void 0?{overrides:io(o.overrides,us,au,Lt)}:{},...o.allow_paths!==void 0?{allow_paths:dn(o.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],Lt)}:{}},l={...typeof i.enabled==="boolean"?{enabled:i.enabled}:{},...i.overrides!==void 0?{overrides:io(i.overrides,ys,lu,Lt)}:{},...i.deny_paths!==void 0?{deny_paths:dn(i.deny_paths,vs,t,["secret_protection","deny_paths"],Lt)}:{},...i.allow_paths!==void 0?{allow_paths:dn(i.allow_paths,Es,t,["secret_protection","allow_paths"],Lt)}:{}};return{policy:eu({safety:s,workflow:typeof r.worktree_mode==="boolean"?{worktree_mode:r.worktree_mode}:{},destructive_command_protection:a,secret_protection:l}),diagnostics:e.audit===void 0?[]:[Dy]}}function iu(e,t,n,r){return Object.fromEntries(t.flatMap((o)=>{let i=e[o];if(typeof i==="boolean")return[[o,i]];if(i!==void 0)r(w([...n,o],As));return[]}))}function eu(e){return Object.fromEntries(Object.entries(e).flatMap((t)=>Object.keys(t[1]).length>0?[t]:[]))}var Lt=()=>{return},As="must be a boolean",Ps="must be an object if provided",su=`must be an integer between ${no} and ${ro}`,au={path:["destructive_command_protection","overrides"],label:"destructive command"},lu={path:["secret_protection","overrides"],label:"secret protection"},Ly=["version","safety","workflow","destructive_command_protection","secret_protection","audit"];function Wy(e,t){let n=[];return{policy:cu(e,t,(o)=>{n.push(o)}),issues:n}}function Gy(e,t){return cu(e,t,Lt)}function cu(e,t,n){if(!Re(e))return n(w([],"Config must be an object")),oo();if(e.version!==1)n(w(["version"],"must be 1"));let r=un(e.safety,["safety"],["level","overrides"],n),o=un(r.overrides,["safety","overrides"],an,n),i=un(e.workflow,["workflow"],["worktree_mode"],n),s=un(e.destructive_command_protection,["destructive_command_protection"],["enabled","overrides","allow_paths"],n),a=un(e.secret_protection,["secret_protection"],["enabled","overrides","deny_paths","allow_paths"],n),l=un(e.audit,["audit"],["retention_days"],n);return uu(e,Ly,[],n),{version:1,safety:{level:Fy(r.level,n),overrides:iu(o,an,["safety","overrides"],n)},workflow:{worktree_mode:Rs(i.worktree_mode,["workflow","worktree_mode"],!1,n)},destructive_command_protection:{enabled:Rs(s.enabled,["destructive_command_protection","enabled"],!0,n),overrides:io(s.overrides,us,au,n),allow_paths:dn(s.allow_paths,Ss,t,["destructive_command_protection","allow_paths"],n)},secret_protection:{enabled:Rs(a.enabled,["secret_protection","enabled"],!0,n),overrides:io(a.overrides,ys,lu,n),deny_paths:dn(a.deny_paths,vs,t,["secret_protection","deny_paths"],n),allow_paths:dn(a.allow_paths,Es,t,["secret_protection","allow_paths"],n)},audit:{retention_days:zy(l.retention_days,n)}}}function un(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(w(t,Ps)),{};return uu(e,n,t,r),e}function uu(e,t,n,r){for(let o of Object.keys(e).filter((i)=>!t.includes(i)))r({path:n,message:o,kind:"unknownKeys"})}function Fy(e,t){if(e===void 0)return"standard";if(_s.has(e))return e;return t(w(["safety","level"],'must be "standard", "strict", or "paranoid"')),"standard"}function Rs(e,t,n,r){if(typeof e==="boolean")return e;if(e!==void 0)r(w(t,As));return n}function zy(e,t){if(!(e===void 0||typeof e==="number"&&Number.isInteger(e)&&e>=no&&e<=ro))t(w(["audit","retention_days"],su));return Vc(e)}function io(e,t,n,r){if(e===void 0)return{};if(!Re(e))return r(w(n.path,Ps)),{};return Object.fromEntries(Object.entries(e).flatMap(([o,i])=>{if(!t.has(o))return r({path:[...n.path,o],message:`unknown ${n.label} rule id "${o}"`,kind:"key"}),[];if(i==="on"||i==="off")return[[o,i]];return r(w([...n.path,o],'must be "on" or "off"')),[]}))}function dn(e,t,n,r,o){if(e===void 0)return[];if(!Array.isArray(e))return o(w(r,"must be an array of paths")),[];return e.flatMap((i,s)=>{let a=t(i,n);if(a===null)return[i];return o(typeof i==="string"?ne([...r,s],a):w([...r,s],a)),[]})}function Re(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function oo(){return structuredClone(ru)}function so(e,t){if(!Oy(e))return{exists:!1,policy:oo(),errors:[]};try{let n=My(e,"utf-8");if(!n.trim())return{exists:!0,policy:oo(),errors:[`${e}: Config file is empty`],fallback:"defaults"};let r=JSON.parse(n),o=Wy(r,t);if(o.issues.length===0)return{exists:!0,parsed:r,policy:o.policy,errors:[]};return{exists:!0,parsed:r,policy:o.policy,errors:o.issues.map((i)=>`${e}: ${$y(i)}`),fallback:Re(r)?"salvaged":"defaults"}}catch(n){let r=n instanceof Error?n.message:String(n);return{exists:!0,policy:oo(),errors:[`${e}: ${n instanceof SyntaxError?"Invalid JSON":r}`],fallback:"defaults"}}}var By=new Map([["Config must be an object","not a JSON object"],["must be 1","not 1"],[Ps,"not an object"],['must be "standard", "strict", or "paranoid"',"not one of standard, strict, paranoid"],[As,"not a boolean"],['must be "on" or "off"','not "on" or "off"'],["must be an array of paths","not an array"],[su,`not an integer between ${no} and ${ro}`]]);function $y(e){let t=ls(e.path);if(e.kind==="unknownKeys")return`${t===""?"":`${t}.`}${e.message}: unknown field`;if(e.kind==="key")return`${t}: unknown rule id`;let n=By.get(e.message)??e.message;return t===""?n:`${t}: ${n}`}function Uy(e,t){let n=so(e,t);if(!n.exists){let r=globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__;if(!Re(r))return{policy:nu(),errors:[]};let o=Gy(r,t);return{policy:ws(o),gui:o,errors:[],levelPresent:tu(r)}}if(n.parsed===void 0)return{policy:nu(),errors:n.errors,...n.fallback?{fallback:n.fallback}:{}};return{policy:ws(n.policy),gui:n.policy,errors:n.errors,...n.fallback?{fallback:n.fallback}:{},levelPresent:tu(n.parsed)}}function tu(e){let t=Re(e)&&Re(e.safety)?e.safety:{};return _s.has(t.level)}function du(e){let t=Object.entries(e),n=new Set(t.flatMap(([r,o])=>o==="on"?[r]:[]));return[...new Set([...[...Jr].filter((r)=>!n.has(r)),...t.flatMap(([r,o])=>o==="off"?[r]:[])])]}function nu(){return{safety:{},worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{},destructiveCommandAllowPaths:[],secretProtection:{enabled:!0,disabledRules:du({}),denyPaths:[],allowPaths:[]}}}function ws(e){return{safety:Hy(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:du(e.secret_protection.overrides),denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}}}function Hy(e){let t={...e.overrides.fail_closed!==void 0?{failClosed:e.overrides.fail_closed}:{},...e.overrides.paranoid_rm!==void 0?{paranoidRm:e.overrides.paranoid_rm}:{},...e.overrides.paranoid_interpreters!==void 0?{paranoidInterpreters:e.overrides.paranoid_interpreters}:{}};return{level:e.level,...Object.keys(t).length>0?{overrides:t}:{}}}function mu(e,t){let n=zc(e,t),r=ou(e,t),o={rules:n.rules,transparentWrappers:n.transparent_wrappers,safety:r.safety,worktreeMode:r.worktreeMode,destructiveCommandProtectionEnabled:r.destructiveCommandProtectionEnabled,destructiveCommandRuleOverrides:r.destructiveCommandRuleOverrides,destructiveCommandAllowPaths:r.destructiveCommandAllowPaths,secretProtection:{enabled:r.secretProtection.enabled??!0,disabledRules:r.secretProtection.disabledRules??[],denyPaths:r.secretProtection.denyPaths,allowPaths:r.secretProtection.allowPaths??[]}},i={...n.userConfig?.overrides,...n.projectConfig?.overrides},s=Object.freeze(Object.fromEntries(o.rules.map((a)=>{let l=n.rulebooks.find((d)=>d.rules.includes(a.name)),c=i[a.name];return[a.name,Object.freeze({id:a.name,...l?{rulebook:Object.freeze({name:l.name,version:l.version}),...qy(l.spec)?{source:l.spec}:{}}:{},...c&&typeof c==="object"?{override:Object.freeze({type:"reason",reason:c.reason})}:{}})]})));return Yy(o,jy(n,r),s,r.policyScopes)}function jy(e,t){let n=Ky(t);if(e.errors.length===0&&e.warnings.length===0&&!n)return;return{diagnostics:[...e.errors,...e.warnings,...t.errors],reason:Zy(e.errors.length>0?Vy(e.errors):void 0,e.warnings.length>0?Is(e.warnings.join("; ")):void 0,n)}}function Vy(e){return`${Is(e.join("; "))} Those rule sources are not active; every other rule and all built-in protections still apply`}function Ky(e){if(e.errors.length===0)return;let t=e.fallback==="salvaged"?"the salvaged policy with protective defaults":"built-in protective defaults";return`invalid policy config: ${e.errors.join("; ")}. Enforcing ${t}; the invalid values are not active. Fix the policy file manually`}function qy(e){return/^(?:[A-Za-z0-9_.-]+$|https:\/\/github\.com\/|github:|gh:|[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:#|$))/.test(e)}function Yy(e,t,n=Object.freeze({}),r){let o=Ts(structuredClone(e)),i=r?{policyScopes:Ts(structuredClone(r))}:{};if(!t)return Object.freeze({state:"ready",policy:o,diagnostics:Object.freeze([]),ruleMetadata:n,...i});return Object.freeze({state:"degraded",policy:o,diagnostics:Object.freeze([...t.diagnostics]),reason:t.reason,ruleMetadata:n,...i})}function Ts(e){if(typeof e!=="object"||e===null)return e;for(let t of Object.values(e))Ts(t);return Object.freeze(e)}function Zy(...e){return Is(e.filter((t)=>!!t).join("; "))}function Is(e){return/[.!?]$/.test(e)?e:`${e}.`}function fu(e){let t=e.effectiveCapabilities,n=e.strict??t.fail_closed.enabled,r=e.paranoidRm??t.paranoid_rm.enabled,o=e.paranoidInterpreters??t.paranoid_interpreters.enabled,i={fail_closed:ks(t.fail_closed,e.strict,"strict"),paranoid_rm:ks(t.paranoid_rm,e.paranoidRm,"paranoidRm"),paranoid_interpreters:ks(t.paranoid_interpreters,e.paranoidInterpreters,"paranoidInterpreters")};return{policy:Yc(e.policySnapshot.policy,i),effectiveCapabilities:i,effectiveLevel:Fi({failClosed:n,paranoidRm:r,paranoidInterpreters:o}),strict:n,paranoidRm:r,paranoidInterpreters:o,worktreeMode:e.worktreeMode??!1}}function ks(e,t,n){if(t===void 0||t===e.enabled)return e;return{enabled:t,source:"capability_override",sources:[...e.sources,`analysis options.${n}`]}}import{dirname as QR,isAbsolute as ew,join as tw,parse as nw,resolve as rw,sep as ow}from"path";function Xn(e,t){if(e!=="powershell")return t[0]?.provenance==="command-substitution";let n=t[0]?.text==="&"||t[0]?.text==="."?1:0,r=t[n]?.provenance;return r!==void 0&&r!=="literal"}var Xy=/^[A-Za-z_][A-Za-z0-9_]*=/;function ao(e,t){return e?.provenance==="literal"&&!e.quoted&&e.raw===t&&e.text===t}function Jn(e){let t=ao(e.words[0],"time")?1:0,n=t===1&&ao(e.words[t],"-p")?t+1:t,r=t===1&&ao(e.words[n],"--")?n+1:n,o=ao(e.words[r],"!")?r+1:r,i=e.words.slice(o).find((s)=>!Xy.test(s.text));return i?.provenance==="literal"?i.text:void 0}var gt=Object.freeze({maxInputLength:131072,maxWords:16384,maxDepth:64});function lo(){return{words:[],redirections:[],nested:[],start:-1,end:-1,reset(){this.words=[],this.redirections=[],this.nested=[],this.start=-1,this.end=-1}}}function Jy(e){return Object.freeze({...e,span:Object.freeze(e.span),words:Object.freeze(e.words),redirections:Object.freeze(e.redirections.map((t)=>Object.freeze({...t,span:Object.freeze(t.span),...t.heredoc?{heredoc:Object.freeze({...t.heredoc,bodySpan:Object.freeze(t.heredoc.bodySpan),terminatorSpan:Object.freeze(t.heredoc.terminatorSpan)})}:{}}))),nested:Object.freeze(e.nested.map((t)=>fe(t)))})}function co(e,t,n){e.push(n),t.reset()}function uo(e){let t=[];return{parts:t,push:(n,r,o)=>{if(r<=n)return;t.push({raw:e.slice(n,r),span:{start:n,end:r},provenance:o})}}}function Os(e){let t=e.parts??[{raw:e.raw,span:e.span,provenance:e.provenance}];return Object.freeze({kind:"word",...e,span:Object.freeze(e.span),parts:Object.freeze(t.map((n)=>Object.freeze({...n,span:Object.freeze(n.span)})))})}function mn(e,t,n,r,o,i,s){return Os({text:r,raw:e.slice(t,n),span:{start:t,end:n},provenance:o,quoted:i,...s?{parts:s}:{}})}function fe(e){return Object.freeze({...e,span:Object.freeze(e.span),issues:Object.freeze(e.issues.map((t)=>Object.freeze({...t}))),nodes:Object.freeze(e.nodes.map((t)=>{if(t.kind==="command")return Jy(t);if(t.kind==="group"||t.kind==="function")return Object.freeze({...t,span:Object.freeze(t.span),body:fe(t.body)});return Object.freeze({...t,span:Object.freeze(t.span)})}))})}function Ms(e,t,n){if(t>=n||gu(e[t]??""))return null;let r="",o=!1,i=!1,s=t;while(s<n&&!gu(e[s]??"")){let a=e[s]??"";if(a==="'"){o=!0;let l=pu(e,s+1,n,"'");r+=l.text,i||=!l.closed,s=l.next;continue}if(a==='"'){o=!0;let l=pu(e,s+1,n,'"');r+=l.text,i||=!l.closed,s=l.next;continue}if(a==="\\"){o=!0;let l=e[s+1];if(!l||l===`
+`||l==="\r"){i=!0;break}r+=l,s+=2;continue}if(a==="`"||e.startsWith("$(",s)||e.startsWith("${",s)||e.startsWith("<(",s)||e.startsWith(">(",s))i=!0;r+=a,s++}return{delimiter:r,quoted:o,next:s,ambiguous:i}}function Ds(e,t,n,r){let o=[],i=t;for(let s of r){let a=i,l=!1;while(i<n){let c=Qy(e,i,n);if((s.stripTabs?c.text.replace(/^\t+/,""):c.text)===s.delimiter){s.attach({body:s.stripTabs?eC(e.slice(a,i)):e.slice(a,i),delimiter:s.delimiter,quotedDelimiter:s.quotedDelimiter,bodySpan:{start:a,end:i},terminatorSpan:{start:i,end:c.contentEnd}}),i=c.next,l=!0;break}if(c.next<=i)break;i=c.next}if(l)continue;return o.push({code:"unterminated-heredoc",message:`heredoc delimiter ${s.delimiter} was not found`}),{next:n,issues:o,terminated:!1}}return{next:i,issues:o,terminated:!0}}function pu(e,t,n,r){let o="",i=t;while(i<n&&e[i]!==`
+`&&e[i]!=="\r"){let s=e[i]??"";if(s===r)return{text:o,next:i+1,closed:!0};if(r==='"'&&s==="\\"&&e[i+1]){let a=e[i+1]??"";o+=["$","`",'"',"\\"].includes(a)?a:`\\${a}`,i+=2;continue}o+=s,i++}return{text:o,next:i,closed:!1}}function gu(e){return e!=="\r"&&(/[\s;&|<>)]/u.test(e)||e==="`")}function Qy(e,t,n){let r=t;while(r<n&&e[r]!==`
+`)r++;let o=r>=n?n:r+1;return{text:e.slice(t,r),contentEnd:r,next:o}}function eC(e){return e.replace(/(^|\r\n?|\n)\t+/g,"$1")}var bu=new Set(["&&","||","|","|&"]),tC=new Set(["!","do","elif","else","if","then","until","while"]);function Su(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"posix",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=po(e,0,e.length,t,{used:0,max:t.maxWords},0);return fe({kind:"program",dialect:"posix",source:e,span:n,status:yo(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function po(e,t,n,r,o,i,s){let a=[],l=[],c=lo(),d=[],m=()=>{if(c.words.length===0&&c.redirections.length===0)return;let f={start:c.start,end:c.end},p=c.words.map((g)=>g.text);co(a,c,{kind:"command",dialect:"posix",source:e.slice(f.start,f.end),span:f,words:c.words,redirections:c.redirections,nested:c.nested,displayText:l.length>0&&a.length===0?e.slice(t,n):p.join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(s&&f===s)return m(),Cu(a,l),{nodes:a,issues:l,next:u+1,closed:!0,limited:!1,pendingHeredocs:d};if(ho(f)){if(f===`
+`||f==="\r"){m();let A=f==="\r"&&e[u+1]===`
+`?u+2:u+1,E=a.at(-1);if(E?.kind!=="connector"||!bu.has(E.operator))a.push(Object.freeze({kind:"connector",operator:e.slice(u,A),span:Object.freeze({start:u,end:A})}));if(d.length>0){let I=Ds(e,A,n,d.splice(0));l.push(...I.issues),u=I.next;continue}u=A;continue}u++;continue}if(f==="#"){while(u<n&&e[u]!==`
+`&&e[u]!=="\r")u++;continue}let p=c.start===-1?EC(e,u,n):void 0;if(p){if(Ls(a,l),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);if(!Ns(o))return fn(a,l,u,"word-limit",r.maxWords);let A=po(e,p.braceIndex+1,n,r,o,i+1,"}"),E=A.next,I={start:p.braceIndex+1,end:A.closed?E-1:E},W=hu(e,I,A);if(a.push({kind:"function",name:p.name,span:{start:u,end:E},body:W}),l.push(...A.issues),A.pendingHeredocs.length>0||er(A.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside function bodies are not supported safely"});if(d.push(...A.pendingHeredocs),A.limited)return fo(a,l,A.next);if(!A.closed)l.push({code:"unclosed-function-body",message:"function body is not closed"});u=E;continue}let g=go(e,u);if(g){if(m(),!Pu(a.at(-1)))l.push({code:"unexpected-connector",message:`connector ${g} has no preceding command`});a.push(Object.freeze({kind:"connector",operator:g,span:Object.freeze({start:u,end:u+g.length})})),u+=g.length;continue}if(f===")"){m(),l.push({code:"unexpected-closing-delimiter",message:"closing parenthesis has no matching opening parenthesis"}),a.push({kind:"unknown",source:f,span:{start:u,end:u+1}}),u++;continue}if((f==="("||f==="{"&&cC(e,u,n))&&c.start===-1){if(Ls(a,l),i>=r.maxDepth)return fn(a,l,u,"depth-limit",r.maxDepth);let A=f==="("?")":"}",E=po(e,u+1,n,r,o,i+1,A),I=E.next,W={start:u+1,end:E.closed?I-1:I},Q=hu(e,W,E);if(a.push({kind:"group",style:f==="("?"subshell":"brace",span:{start:u,end:I},body:Q}),l.push(...E.issues),E.pendingHeredocs.length>0||er(E.nodes))l.push({code:"unsupported-heredoc-context",message:"heredocs attached inside command groups are not supported safely"});if(d.push(...E.pendingHeredocs),E.limited)return fo(a,l,E.next);if(!E.closed)l.push({code:f==="("?"unclosed-subshell":"unclosed-brace-group",message:`${f} group is not closed`});u=I;continue}let h=(f==="<"||f===">")&&e[u+1]!=="("?iC(e,u):null;if(h){let A=c.words.at(-1),E=A&&A.span.end===u&&/^[0-9]+$/.test(A.raw)?Number(A.raw):void 0;if(E!==void 0)c.words.pop();let I=E===void 0?u:A?.span.start??u;c.start=c.start===-1?u:c.start;let W=u+h.length;while(W<n&&/[ \t]/.test(e[W]??""))W++;let Q=e[W],Je=W>u+h.length&&Q==="#",Ce=!Q||ho(Q)||!!go(e,W)||Q===s||Q===")"||Je||(Q==="<"||Q===">")&&e[W+1]!=="(",At=h==="<<"||h==="<<-",z=At?Ms(e,W,n):void 0,D=z?{word:mn(e,W,z.next,z.delimiter,"literal",z.quoted),nested:[],issues:[],next:z.next,limited:!1}:!Ce?Ws(e,W,n,r,o,i):void 0;if(D){if(l.push(...D.issues),D.limited)return fo(a,l,D.next);if(!Ns(o))return fn(a,l,D.next,"word-limit",r.maxWords)}let ae=D?.next??u+h.length,X={kind:"redirection",operator:h,span:{start:I,end:ae},...E===void 0?{}:{fd:E},...D?{target:D.word}:{}};if(c.redirections.push(X),At&&!z)l.push({code:"missing-heredoc-delimiter",message:"heredoc redirection requires a delimiter word"});if(z){if(z.ambiguous||z.delimiter.length===0)l.push({code:"ambiguous-heredoc-delimiter",message:"heredoc delimiter cannot be determined safely"});let J=c.nested;d.push({delimiter:z.delimiter,quotedDelimiter:z.quoted,stripTabs:h==="<<-",attach:(be)=>{if(X.heredoc=be,be.quotedDelimiter)return;J.push(...rC(e,be.bodySpan.start,be.bodySpan.end,r,o,i+1))}})}if(!At&&!D)l.push({code:"missing-redirection-target",message:`redirection ${h} requires a target word`});if(D)c.nested.push(...D.nested);c.end=ae,u=ae;continue}let y=c.start===-1;if(y)Ls(a,l);let b=Ws(e,u,n,r,o,i);if(l.push(...b.issues),b.limited)return fo(a,l,b.next);let C=mC(c.words)?yC(e,b.word,o.max-o.used,r.maxDepth,r.maxInputLength):void 0;if(C?.limitCode)return fn(a,l,b.next,C.limitCode,C.limitCode==="word-limit"?r.maxWords:C.limitCode==="depth-limit"?r.maxDepth:r.maxInputLength);let x=C?.words??[b.word];for(let A of x){if(!Ns(o))return fn(a,l,b.next,"word-limit",r.maxWords);c.words.push(A)}if(c.start=c.start===-1?u:c.start,c.end=b.next,c.nested.push(...b.nested),y&&Tu(b.word))m();u=b.next>u?b.next:u+1}return m(),Cu(a,l),l.push(...xC(d)),{nodes:a,issues:l,next:u,closed:s===void 0,limited:!1,pendingHeredocs:[]}}function hu(e,t,n){return{kind:"program",dialect:"posix",source:e.slice(t.start,t.end),span:t,status:yo(n.issues,n.limited),issues:n.issues,nodes:n.nodes}}function Ws(e,t,n,r,o,i){let s="",a=t,l=!1,c="literal",d=[],m=[],u=!1;while(a<n){let f=e[a],p=(f==="<"||f===">")&&e[a+1]==="(";if(!f||ho(f)||(f===";"||f==="|"||f==="&")&&go(e,a)||(f==="<"||f===">")&&!p)break;if(f===")")break;if(f==="'"){l=!0;let h=e.indexOf("'",a+1);if(h===-1||h>=n){s+=e.slice(a+1,n),m.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"}),a=n;break}s+=e.slice(a+1,h),a=h+1;continue}if(f==='"'){l=!0;let h=nC(e,a,n,r,o,i);if(s+=h.text,d.push(...h.nested),m.push(...h.issues),u||=h.limited,c=Qn(c,h.provenance),a=h.next,u)break;continue}if(e.startsWith("$'",a)){l=!0;let h=sC(e,a+2,n);if(s+=h.text,m.push(...h.issues),!h.closed)m.push({code:"unclosed-ansi-c-quote",message:"ANSI-C quoted word is not closed"});a=h.next;continue}if(f==="\\"){let h=e[a+1];if(!h){m.push({code:"trailing-escape",message:"escape has no following character"}),a++;break}if(h===`
+`){a+=2;continue}s+=h,a+=2;continue}let g=f==="$"||f==="<"||f===">"||f==="`"?Co(e,a,n,r,o,i):null;if(g){let h=vu(g,d,m);if(u||=h.limited,c=Qn(c,h.provenance),a=h.next,u)break;continue}if(f==="$"){let h=Ru(e,a,n,s,c);s=h.text,c=h.provenance,a=h.next;continue}if(f==="*"||f==="?"||f==="[")c=Qn(c,"glob");s+=f,a++}return{word:mn(e,t,a,s,c,l,c==="literal"?void 0:lC(e,t,a)),nested:d,issues:m,next:a,limited:u}}function nC(e,t,n,r,o,i){let s="",a="literal",l=[],c=[],d=!1,m=t+1;while(m<n){let u=e[m];if(u==='"')return{text:s,provenance:a,nested:l,issues:c,next:m+1,limited:d};if(u==="\\"&&e[m+1]){let p=e[m+1]??"";if(p===`
+`){m+=2;continue}if(p==="\r"&&e[m+2]===`
+`){m+=3;continue}s+=["$","`",'"',"\\"].includes(p)?p:`\\${p}`,m+=2;continue}if(e.startsWith("$((",m)){let p=Gs(e,m+3,n,"))"),g=p===-1?n:p+2;if(s+=e.slice(m,g),p===-1)c.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});m=g;continue}let f=Co(e,m,n,r,o,i);if(f){let p=vu(f,l,c);if(m=p.next,d||=p.limited,a=Qn(a,p.provenance),d)return{text:s,provenance:a,nested:l,issues:c,next:m,limited:d};continue}if(u==="$"){let p=Ru(e,m,n,s,a);s=p.text,a=p.provenance,m=p.next;continue}s+=u??"",m++}return c.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"}),{text:s,provenance:a,nested:l,issues:c,next:n,limited:d}}function Co(e,t,n,r,o,i){let s=e.startsWith("$((",t),a=e.startsWith("$(",t)&&!s,l=e.startsWith("<(",t)||e.startsWith(">(",t),c=e[t]==="`";if(!s&&!a&&!l&&!c)return null;let d=s?3:c?1:2,m=s?"))":c?"`":")",u=Gs(e,t+d,n,m),f=u===-1?n:u,p=u===-1?n:u+m.length;if(i>=r.maxDepth)return{program:vC(e,t+d,f,"depth-limit"),next:p,provenance:s?"arithmetic":"command-substitution"};if(s){let b=[],C=[],x=!1,A=t+d;while(A<f){let E=Co(e,A,f,r,o,i+1);if(!E){A++;continue}if(b.push(...E.program.nodes),C.push(...E.program.issues),x||=E.program.status==="limited",A=E.next,x)break}if(u===-1)C.push({code:"unclosed-arithmetic",message:"$(( substitution is not closed"});return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo(C,x),issues:C,nodes:b}),next:p,provenance:"arithmetic"}}let g=po(e,t+d,f,r,o,i+1),h=u===-1?[{code:"unclosed-command-substitution",message:`${e.slice(t,t+d)} substitution is not closed`}]:[],y=(c||l)&&er(g.nodes)?[{code:"unsupported-heredoc-context",message:"heredocs are supported only in ordinary commands and $(...) substitutions"}]:[];return{program:fe({kind:"program",dialect:"posix",source:e.slice(t+d,f),span:{start:t+d,end:f},status:yo([...g.issues,...h,...y],g.limited),issues:[...g.issues,...h,...y],nodes:g.nodes}),next:p,provenance:"command-substitution"}}function rC(e,t,n,r,o,i){let s=[],a=t;while(a<n){let l=e[a];if(l==="\\"){a+=2;continue}let c=l==="$"||l==="`"?Co(e,a,n,r,o,i):null;if(!c){a++;continue}if(s.push(c.program),a=c.next,c.program.status==="limited")break}return s}function vu(e,t,n){return t.push(e.program),n.push(...e.program.issues),{provenance:e.provenance,next:e.next,limited:e.program.status==="limited"}}function Gs(e,t,n,r){if(r==="`"){for(let a=t;a<n;a++){if(e[a]==="\\"){a++;continue}if(e[a]==="`")return a}return-1}let o=1,i={single:!1,double:!1},s=[];for(let a=t;a<n;a++){let l=e[a];if((l===`
 `||l==="\r")&&s.length>0){let d=l==="\r"&&e[a+1]===`
-`?a+2:a+1,m=Ds(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=vu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=tb(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=Ms(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function tb(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=vu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function vu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!vb(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
-`&&e[s+1]!=="\r")s++;return s}function go(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function nb(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ho(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function Eu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function rb(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=ob(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function ob(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
-`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return mo(e,t+1,n,16,2,t+1);if(r==="u")return mo(e,t+1,n,16,4,t+1);if(r==="U")return mo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return mo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function mo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function yo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function xu(e,t,n,r,o){let i=Eu(e,t,n);return{text:r+e.slice(t,i),provenance:Xn(o,"variable"),next:i}}function ib(e,t,n){let r=uo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,g=c?"))":u?"`":")",p=Gs(e,a+f,n,g),h=p===-1?n:p+g.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=Eu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Xn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function sb(e,t,n){return t+1>=n||ho(e[t+1]??"")||go(e,t+1)!==null}var ab=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),lb=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function cb(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=ub(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function ub(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return db(e,t);if(n==="env")return mb(e,t);if(n==="sudo")return fb(e,t);return}function db(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function mb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(ab.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function fb(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(lb.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function Ru(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=_u(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>wu(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function pb(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=_u(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>wu(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>un(e,t.span.start,t.span.end,a,"literal",!1))}}function _u(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>hu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=hu(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let m=d.start+c.length-d.end,u=d.alternatives.reduce((f,g)=>f+m+g.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...gb(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function hu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&yb(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:hb(e,r)}}function gb(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function hb(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function yb(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function wu(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function bb(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function dn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function fo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function Cb(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function Jn(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>Jn(n.nodes));return(t.kind==="group"||t.kind==="function")&&Jn(t.body.nodes)})}function Sb(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Au(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function yu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!bu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Ls(e,t){if(!Au(e.at(-1)))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function vb(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var Tu=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),Eb=new Set(["gc","cat","type","cp","mv","rm"]),Iu=["-rec","-for","-path","-literalpath","-whatif"],xb=/^\$env:\w/i,Rb=/^(?:\$\{?\w+\}?|~)\\./;function ku(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...Tu].some((o)=>n.includes(o))&&!(n.includes("rm")&&Iu.some((o)=>n.includes(o)))&&!n.includes("<#")&&!_b(n))return!1;let r=$s(e,t);if(Ou(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Bs(r).some(wb)}function Ou(e){return e.nodes.some((t)=>{if(t.kind==="group")return Ou(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function _b(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function wb(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&Tu.has(n))return!0;let r=e.slice(t+1);if(n&&Eb.has(n)&&r.some(Ab))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Iu.some((s)=>i.startsWith(s))})}function Ab(e){return xb.test(e)||Rb.test(e)}function $s(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:Ob(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=lo(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};co(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((g)=>g.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let g=kb(e,u,n,r.maxDepth);if(g){if(g.issue)a.push(g.issue);if(g.limited)return m(),{nodes:s,issues:a,next:g.next,closed:!1,words:c,limited:!0};u=g.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
+`?a+2:a+1,m=Ds(e,d,n,s.splice(0));if(!m.terminated)return-1;a=m.next-1;continue}let c=Eu(e,a,t,n,i);if(c!==null){a=c;continue}if(!i.double&&e.startsWith("$((",a)){let d=oC(e,a+3,n);if(d===-1)return-1;a=d+1;continue}if(r===")"&&!i.double&&l==="<"&&e[a+1]==="<"&&e[a+2]!=="<"){let d=e[a+2]==="-",m=a+(d?3:2);while(m<n&&/[ \t]/.test(e[m]??""))m++;let u=Ms(e,m,n);if(u){s.push({delimiter:u.delimiter,quotedDelimiter:u.quoted,stripTabs:d,attach:()=>{return}}),a=u.next-1;continue}}if(e.startsWith("$(",a)&&!e.startsWith("$((",a)){o++,a++;continue}if(l==="("&&!i.double)o++;if(l===")"&&!i.double){if(o--,o===0)return r==="))"&&e[a+1]!==")"?-1:a}}return-1}function oC(e,t,n){let r=1,o={single:!1,double:!1};for(let i=t;i<n;i++){let s=e[i],a=Eu(e,i,t,n,o);if(a!==null){i=a;continue}if(e.startsWith("$(",i)&&!e.startsWith("$((",i)){r++,i++;continue}if(s==="("&&!o.double)r++;if(s!==")"||o.double)continue;if(r--,r===0)return e[i+1]===")"?i:-1}return-1}function Eu(e,t,n,r,o){let i=e[t];if(i==="\\"&&!o.single)return t+1;if(!o.double&&i==="'")o.single=!o.single;if(!o.single&&i==='"')o.double=!o.double;if(o.single)return t;if(o.double||i!=="#"||!RC(e,t,n))return null;let s=t;while(s+1<r&&e[s+1]!==`
+`&&e[s+1]!=="\r")s++;return s}function go(e,t){let n=e[t];if(n===";")return";";if(n==="&")return e[t+1]==="&"?"&&":"&";if(n==="|")return e[t+1]==="|"?"||":e[t+1]==="&"?"|&":"|";return null}function iC(e,t){let n=e[t];if(n===">"){if(e[t+1]===">")return">>";if(e[t+1]==="&")return">&";return e[t+1]==="|"?">|":">"}if(n!=="<")return null;if(e.startsWith("<<<",t))return"<<<";if(e.startsWith("<<-",t))return"<<-";if(e[t+1]==="<")return"<<";if(e[t+1]==="&")return"<&";if(e[t+1]===">")return"<>";return"<"}function ho(e){let t=e.charCodeAt(0);if(t===32||t>=9&&t<=13)return!0;if(t<128)return!1;return/\s/u.test(e)}function xu(e,t,n){if(e[t+1]==="{"){let o=e.indexOf("}",t+2);return o===-1||o>=n?n:o+1}let r=t+1;while(r<n&&/[A-Za-z0-9_?@#$!*-]/.test(e[r]??""))r++;return r===t+1?t+1:r}function sC(e,t,n){let r="",o=[],i=t;while(i<n){let s=e[i];if(s==="'")return{text:r,next:i+1,closed:!0,issues:o};if(s!=="\\"){r+=s??"",i++;continue}let a=aC(e,i+1,n);if(r+=a.text,a.invalidCodePoint!==void 0)o.push({code:"invalid-ansi-c-code-point",message:`ANSI-C escape is not a valid Unicode scalar value: ${a.invalidCodePoint}`});i=a.next}return{text:r,next:n,closed:!1,issues:o}}function aC(e,t,n){let r=e[t];if(!r||t>=n)return{text:"\\",next:t};let o=new Map([["a","\x07"],["b","\b"],["e","\x1B"],["E","\x1B"],["f","\f"],["n",`
+`],["r","\r"],["t","\t"],["v","\v"],["\\","\\"],["'","'"],['"','"']]);if(o.has(r))return{text:o.get(r)??r,next:t+1};if(r==="x")return mo(e,t+1,n,16,2,t+1);if(r==="u")return mo(e,t+1,n,16,4,t+1);if(r==="U")return mo(e,t+1,n,16,8,t+1);if(/[0-7]/.test(r))return mo(e,t,n,8,3,t+1);return{text:r,next:t+1}}function mo(e,t,n,r,o,i){let s=r===16?/[0-9a-fA-F]/:/[0-7]/,a="",l=t;while(l<n&&a.length<o&&s.test(e[l]??""))a+=e[l],l++;if(!a)return{text:e[i-1]??"",next:i};let c=Number.parseInt(a,r);return c>1114111||c>=55296&&c<=57343?{text:"\uFFFD",next:l,invalidCodePoint:c}:{text:String.fromCodePoint(c),next:l}}function yo(e,t=!1){if(t)return"limited";if(e.some((n)=>n.code==="invalid-ansi-c-code-point"||n.code==="missing-heredoc-delimiter"||n.code==="ambiguous-heredoc-delimiter"||n.code==="unterminated-heredoc"||n.code==="unsupported-heredoc-context"))return"invalid";return e.length>0?"partial":"complete"}function Ru(e,t,n,r,o){let i=xu(e,t,n);return{text:r+e.slice(t,i),provenance:Qn(o,"variable"),next:i}}function lC(e,t,n){let r=uo(e),o=t,i=!1,s=!1,a=t;while(a<n){let l=e[a];if(l==="\\"&&!i){a+=2;continue}if(!s&&l==="'"){i=!i,a++;continue}if(!i&&l==='"'){s=!s,a++;continue}if(i){a++;continue}let c=e.startsWith("$((",a),d=e.startsWith("$(",a)&&!c,m=!s&&(e.startsWith("<(",a)||e.startsWith(">(",a)),u=l==="`";if(c||d||m||u){let f=c?3:u?1:2,p=c?"))":u?"`":")",g=Gs(e,a+f,n,p),h=g===-1?n:g+p.length;r.push(o,a,"literal"),r.push(a,h,c?"arithmetic":"command-substitution"),a=h,o=h;continue}if(l==="$"){let f=xu(e,a,n);if(f>a+1){r.push(o,a,"literal"),r.push(a,f,"variable"),a=f,o=f;continue}}if(!s&&(l==="*"||l==="?"||l==="[")){r.push(o,a,"literal"),r.push(a,a+1,"glob"),a++,o=a;continue}a++}return r.push(o,n,"literal"),r.parts}function Qn(e,t){if(t==="command-substitution"||e==="command-substitution")return"command-substitution";if(t==="arithmetic"||e==="arithmetic")return"arithmetic";if(t==="variable"||e==="variable")return"variable";if(t==="glob"||e==="glob")return"glob";return e}function cC(e,t,n){return t+1>=n||ho(e[t+1]??"")||go(e,t+1)!==null}var uC=new Set(["-u","--unset","-C","--chdir","-S","--split-string","-P"]),dC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function mC(e){let t=0;while(t<=e.length){while(/^[A-Za-z_][A-Za-z0-9_]*=/.test(e[t]?.text??""))t++;if(t===e.length)return!0;let n=fC(e,t);if(n===void 0||n===null)return!1;t=n}return!1}function fC(e,t){let n=e[t]?.text.toLowerCase();if(n==="command")return pC(e,t);if(n==="env")return gC(e,t);if(n==="sudo")return hC(e,t);return}function pC(e,t){if(e[t+1]?.text==="-v")return null;for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(r==="-p"||r==="-v"||r==="-V"||/^-[pvV]+$/.test(r))continue;return n}return e.length}function gC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(uC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-u=")||r.startsWith("--unset=")||r.startsWith("-C")&&r.length>2||r.startsWith("--chdir=")||r.startsWith("-S")&&r.length>2||r.startsWith("--split-string=")||r.startsWith("-P"))continue;if(r.startsWith("-")||/^[A-Za-z_][A-Za-z0-9_]*=/.test(r))continue;return n}return e.length}function hC(e,t){for(let n=t+1;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return n+1;if(dC.has(r)){if(e[n+1]===void 0)return null;n++;continue}if(r.startsWith("-"))continue;return n}return e.length}function wu(e,t,n,r){if(e.provenance!=="literal"||!e.raw.includes("{"))return;let o=_u(e.raw,t,n,r,!0);if(!o)return;if("limited"in o)return{limited:!0};let i=o.values.map((s)=>Au(s,n));if(i.some((s)=>s===null))return{limited:!0};return{words:[...new Set(i.filter((s)=>s!==null&&s!==""))]}}function yC(e,t,n,r,o){if(t.provenance!=="literal"||!t.raw.includes("{"))return;let i=_u(t.raw,n,r,o,!1);if(!i)return;if("limited"in i){if(i.limited==="expansions")return{limitCode:"depth-limit"};return{limitCode:i.limited==="length"?"brace-expansion-limit":"word-limit"}}let s=i.values.map((a)=>Au(a,r));if(s.some((a)=>a===null))return;return{words:s.filter((a)=>a!==null&&a!=="").map((a)=>mn(e,t.span.start,t.span.end,a,"literal",!1))}}function _u(e,t,n,r,o){let i=[e],s=e.length,a=0;while(!0){let l=i.findIndex((f)=>yu(f,o));if(l===-1)break;if(++a>n)return{limited:"expansions"};let c=i[l]??"",d=yu(c,o);if(!d||d.kind==="range")return{limited:"expansions"};let m=d.start+c.length-d.end,u=d.alternatives.reduce((f,p)=>f+m+p.length,0);if(s-c.length+u>r)return{limited:"length"};if(i.length-1+d.alternatives.length>t)return{limited:"words"};i.splice(l,1,...CC(c,d)),s+=u-c.length}return a===0?void 0:{values:i}}function yu(e,t){let n=[],r,o=null,i=!1;for(let s=0;s<e.length;s++){let a=e[s];if(i){i=!1;continue}if(a==="\\"&&o!=="'"){i=!0;continue}if(a===o){o=null;continue}if(o===null&&(a==="'"||a==='"')){o=a;continue}if(o!==null)continue;if(a==="{"){n.push({start:s,commas:[]});continue}if(a===","&&n.length>0){n.at(-1)?.commas.push(s);continue}if(a!=="}"||n.length===0)continue;let l=n.pop();if(!l)continue;let c=l.commas.length>0?{kind:"alternatives",start:l.start,end:s+1,commas:l.commas}:t&&SC(e.slice(l.start+1,s))?{kind:"range",start:l.start,end:s+1}:void 0;if(c&&(!r||c.start<r.start))r=c}if(!r||r.kind==="range")return r;return{kind:r.kind,start:r.start,end:r.end,alternatives:bC(e,r)}}function CC(e,t){return t.alternatives.map((n)=>`${e.slice(0,t.start)}${n}${e.slice(t.end)}`)}function bC(e,t){let n=[t.start,...t.commas,t.end-1];return n.slice(0,-1).map((r,o)=>e.slice(r+1,n[o+1]))}function SC(e){return/^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(e)||/^[A-Za-z]\.\.[A-Za-z](?:\.\.-?\d+)?$/.test(e)}function Au(e,t){let n=`x${e}`,r=Ws(n,0,n.length,{maxInputLength:n.length,maxWords:1,maxDepth:t},{used:0,max:1},0);if(r.limited||r.issues.length>0||r.next!==n.length||r.word.provenance!=="literal")return null;return r.word.text.slice(1)}function vC(e,t,n,r){return fe({kind:"program",dialect:"posix",source:e.slice(t,n),span:{start:t,end:n},status:"limited",issues:[{code:r,message:"command structure exceeds parser limit"}],nodes:[]})}function fn(e,t,n,r,o){return{nodes:e,issues:[...t,{code:r,message:`command structure exceeds parser limit ${o}`}],next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function fo(e,t,n){return{nodes:e,issues:t,next:n,closed:!1,limited:!0,pendingHeredocs:[]}}function Ns(e){return e.used++,e.used<=e.max}function EC(e,t,n){let r=e.slice(t,n),o=/^(?:function[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)[ \t]*\([ \t]*\)[ \t]*\{/.exec(r)??/^function[ \t]+([A-Za-z_][A-Za-z0-9_]*)[ \t]+\{/.exec(r),i=o?.[1];if(!o||!i)return;return{name:i,braceIndex:t+o[0].lastIndexOf("{")}}function er(e){return e.some((t)=>{if(t.kind==="command")return t.redirections.some((n)=>n.heredoc)||t.nested.some((n)=>er(n.nodes));return(t.kind==="group"||t.kind==="function")&&er(t.body.nodes)})}function xC(e){return e.map((t)=>({code:"unterminated-heredoc",message:`heredoc delimiter ${t.delimiter} was not found`}))}function Pu(e){return e?.kind==="command"||e?.kind==="group"||e?.kind==="function"}function Cu(e,t){let n=e.at(-1);if(n?.kind!=="connector"||!bu.has(n.operator))return;t.push({code:"missing-command-after-connector",message:`connector ${n.operator} requires a following command`})}function Tu(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&tC.has(e.text)}function Ls(e,t){let n=e.at(-1);if(!Pu(n))return;if(n?.kind==="command"&&Tu(n.words[0]))return;t.push({code:"missing-command-connector",message:"adjacent commands require a connector"})}function RC(e,t,n){return t===n||/[\s;&|()]/u.test(e[t-1]??"")}var ku=new Set(["remove-item","ri","del","erase","rd","rmdir","get-content","set-content","add-content","copy-item","move-item"]),wC=new Set(["gc","cat","type","cp","mv","rm"]),Ou=["-rec","-for","-path","-literalpath","-whatif"],_C=/^\$env:\w/i,AC=/^(?:\$\{?\w+\}?|~)\\./;function Mu(e,t){let n=e.toLowerCase().replaceAll("`","");if(![...ku].some((o)=>n.includes(o))&&!(n.includes("rm")&&Ou.some((o)=>n.includes(o)))&&!n.includes("<#")&&!PC(n))return!1;let r=$s(e,t);if(Du(r))return!1;return r.issues.some((o)=>o.code==="unclosed-block-comment"||o.code==="comment-depth-limit")||Bs(r).some(TC)}function Du(e){return e.nodes.some((t)=>{if(t.kind==="group")return Du(t.body);if(t.kind!=="command")return!1;return t.redirections.some((n)=>n.operator==="<<")})}function PC(e){if(e.includes("$env:"))return!0;return e.includes("\\")&&(e.includes("$")||e.includes("~"))}function TC(e){let t=e[0]==="&"||e[0]==="."?1:0,n=e[t]?.toLowerCase();if(n&&ku.has(n))return!0;let r=e.slice(t+1);if(n&&wC.has(n)&&r.some(IC))return!0;if(n!=="rm")return!1;return r.some((o)=>{let i=o.toLowerCase().split(":",1)[0]??"";return Ou.some((s)=>i.startsWith(s))})}function IC(e){return _C.test(e)||AC.test(e)}function $s(e,t){let n={start:0,end:e.length};if(e.length>t.maxInputLength)return fe({kind:"program",dialect:"powershell",source:e,span:n,status:"limited",issues:[{code:"input-limit",message:`command exceeds ${t.maxInputLength} UTF-16 code units`}],nodes:[]});let r=Us(e,0,e.length,t,0);return fe({kind:"program",dialect:"powershell",source:e,span:n,status:NC(r.issues,r.limited),issues:r.issues,nodes:r.nodes})}function Us(e,t,n,r,o,i=!1){let s=[],a=[],l=lo(),c=0,d=!1,m=()=>{if(l.words.length===0&&l.redirections.length===0)return;let f={start:l.start,end:l.end};co(s,l,{kind:"command",dialect:"powershell",source:e.slice(f.start,f.end),span:f,words:l.words,redirections:l.redirections,nested:l.nested,displayText:l.words.map((p)=>p.text).join(" ")})},u=t;while(u<n){let f=e[u];if(!f)break;if(i&&f==="}")return m(),{nodes:s,issues:a,next:u+1,closed:!0,words:c,limited:d};let p=DC(e,u,n,r.maxDepth);if(p){if(p.issue)a.push(p.issue);if(p.limited)return m(),{nodes:s,issues:a,next:p.next,closed:!1,words:c,limited:!0};u=p.next;continue}if(/\s/.test(f)){if(f==="\r"||f===`
 `){m();let y=f==="\r"&&e[u+1]===`
-`?u+2:u+1;s.push(Fs(e,u,y)),u=y;continue}u++;continue}let p=Nu(e,u);if(p){m(),s.push(Fs(e,u,u+p.length)),u+=p.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Du(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Us(e,u+1,n,r,o+1,!0),v=y.closed?y.next-1:y.next,E=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,v),span:{start:u+1,end:v},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:E})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(Fs(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,v=y;while(/[ \t]/.test(e[v]??""))v++;let E=v<n?Pu(e,v,n,r,o):void 0,b=E?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:b}),...E?{target:E.word}:{}})),E)a.push(...E.issues),l.nested.push(...E.nested),c+=E.words,d||=E.limited;l.end=b,u=b;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Os({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=Pu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function Pu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(g)=>{let p=Pb(e,g,n,r,o);return i+=e.slice(g,p.next),c.push(p.program),l.push(...p.program.issues),d+=zs(p.program),m||=p.program.status==="limited",s="command-substitution",p.next},f=t;while(f<n){let g=e[f];if(!g||/\s/.test(g)||Nu(e,f)||g===">"||g==="<"||g==="#")break;if(g===",")break;if(g==="`"){let p=e[f+1];if(!p){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=p,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(g==="'"){a=!0,f++;let p=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){p=!0,f++;break}i+=e[f]??"",f++}if(!p)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(g==='"'){a=!0,f++;let p=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){p=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!p)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(g==="$")s=e[f+1]==="("?"command-substitution":"variable";if(g==="@"&&f===t)s="variable";i+=g,f++}return{word:un(e,t,f,i,s,a,s==="literal"?void 0:Tb(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function Pb(e,t,n,r,o){let i=Mu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Du(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Mu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function Tb(e,t,n){let r=uo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Mu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=Ib(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function Ib(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Du(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Bs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Bs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Bs)]})}function Nu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function kb(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
-`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function Ob(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Fs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function De(e,t="auto",n=ht){if(t==="powershell"||t==="auto"&&ku(e.slice(0,n.maxInputLength),n))return $s(e,n);return Cu(e,n)}function w(e){return e.provenance==="command-substitution"?e.raw:e.text}function mn(e,t){return e==="posix"?t:K(t.map((n)=>n.text))}function Co(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function K(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Hs(e,t){return{value:e,work:t}}function C(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function Qn(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function Re(e,t){Qn(e,t)}function Lt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function B(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
-`||e==="\r"||e==="\u2028"||e==="\u2029"}function U(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(C(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!Lt(C(e,t-1))&&U(e,t,n)&&!Lt(C(e,t+n.length))}function nt(e,t){return Lt(C(e,t-1))!==Lt(C(e,t))}function oe(e){return e===`
-`||e===";"||e==="&"||e==="|"}function fn(e){return e==="|"||e===";"}function So(e,t,n){let r=Hs(e,n);if(t==="rm")return Mb(r);if(t==="dd")return Nb(r);return Bu(r,!0)}function vo(e,t,n){let r=Hs(e,n);if(t==="rm")return Lb(r);if(t==="reset-hard")return Fu(r,"--ha","rd");if(t==="reset-merge")return Fu(r,"--me","rge");if(t==="clean")return zb(r);if(t==="checkout")return $b(r);if(t==="push-force")return Ub(r);if(t==="push-refspec")return Hb(r);if(t==="push-delete")return jb(r);if(t==="branch")return Vb(r);if(t==="tag")return Yb(r);if(t==="restore")return Zb(r);return Bu(r,!1)}function Mb(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=C(e,i);if(!t){let l=C(e,i+2);if(tt(e,i,"rm")&&B(l)&&l!==`
-`)t=!0,i++;continue}let a=Db(e,i);if(s===`
-`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Lu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(B(s)){if(o<0)continue;if(U(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Lu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function Db(e,t){if(C(e,t)!=="\\"||C(e,t-1)==="\\")return-1;if(U(e,t,String.raw`\n`))return t+2;if(U(e,t,String.raw`\x0a`)||U(e,t,String.raw`\x0A`))return t+5;if(U(e,t,String.raw`\u000a`)||U(e,t,String.raw`\u000A`))return t+7;return U(e,t,String.raw`\012`)?t+4:-1}function Lu(e,t,n){if(Wu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Wu(e,t,n,"force"))return{recursive:!1,force:!0};if(C(e,t)!=="-"||C(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=C(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Wu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!U(e,t,"--"))return!1;for(let i=0;i<o;i++)if(C(e,t+i+2)!==r[i])return!1;return!0}function Nb(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(C(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!U(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!B(C(e,r))&&C(e,r)!=="'"&&C(e,r)!=='"')return!0}return!1}function Lb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=C(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=Gb(e,o);if(s>=0){if(Wb(e,s))return!0;let a=s,l=!1;while(B(C(e,a)))l||=C(e,a)===`
-`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(U(e,o,"--")&&(o===0||B(C(e,o-1)))&&(!C(e,o+2)||B(C(e,o+2))||oe(C(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=U(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=U(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!U(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=C(e,t+r+2);if(!o||B(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function Wb(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(B(C(e,n)))n++;let i=n;while(n<Z(e)&&!B(C(e,n)))n++;if(C(e,i)!=="-"||n-i===2&&U(e,i,"--"))return!1;let s=Gu(e,i,"recursive"),a=Gu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,C(e,i+1)==="-")continue;let l=Fb(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function Gu(e,t,n){return U(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function Gb(e,t){if(t>0&&Lt(C(e,t-1)))return-1;let n=t;if(C(e,n)==="\\")n++;if(C(e,n)!=="r")return-1;if(n++,C(e,n)==="\\")n++;if(C(e,n)!=="m"||!B(C(e,n+1)))return-1;return n+1}function Fb(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(C(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=C(e,c)??"",m=(d==="r"||d==="f")&&nt(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Fu(e,t,n){return tr(e,"reset",fn,!0,(r)=>C(e,r)==="-"&&pn(e,r,t,n)?!0:r)}function zb(e){return tr(e,"clean",fn,!0,(t)=>{if(C(e,t)!=="-")return t;if(pn(e,t,"--fo","rce"))return!0;let n=er(e,t,fn);for(let r=t+1;r<n;r++)if(C(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!B(C(e,r)))return{commandEnd:-1,next:r};while(B(C(e,r)))r++;while(r<Z(e)){if(oe(C(e,r)))return{commandEnd:-1,next:r};let o=er(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(C(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&U(e,r,"--"),s=Bb(e,r,o);r=o;while(B(C(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:er(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(C(e,r)))return{commandEnd:-1,next:r};r=er(e,r,oe);while(B(C(e,r)))r++}return{commandEnd:-1,next:r}}function Bb(e,t,n){for(let r of ve)if(n-t===r.length&&U(e,t,r))return!0;return!1}function $b(e){return zu(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function Ub(e){return tr(e,"push",fn,!0,(t)=>{if(C(e,t)!=="-")return t;if(C(e,t+1)==="f"&&!Lt(C(e,t+2))&&!U(e,t+2,"-with-lease"))return!0;let n=$u(e,t,"--fo","rce");if(n>=0&&!U(e,n,"-with-lease"))return!0;return t})}function Hb(e){return tr(e,"push",oe,!1,(t)=>{if(B(C(e,t))&&C(e,t+1)==="+"&&t+2<Z(e)&&!oe(C(e,t+2))&&!B(C(e,t+2)))return!0;if(C(e,t)===":"&&C(e,t+1)==="+")return!0;return t})}function jb(e){return tr(e,"push",oe,!1,(t)=>{if(C(e,t)==="-"&&pn(e,t,"--de","lete"))return!0;if(B(C(e,t))&&C(e,t+1)===":"&&t+2<Z(e)&&!B(C(e,t+2))&&!oe(C(e,t+2)))return!0;return t})}function Vb(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(C(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||C(e,o)!=="-")continue;let i=er(e,o,oe),s=Kb(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function Kb(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(C(e,i)!=="-")continue;if(pn(e,i,"--de","lete"))r=!0;if(pn(e,i,"--fo","rce"))o=!0;if(C(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&qb(C(e,s))){let d=C(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function qb(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function Yb(e){return zu(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function zu(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=C(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&C(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(B(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&B(C(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(pn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(C(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(fn(o))i.outerActive=!1}return!1}function tr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=C(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||B(C(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(C(e,d)))i=!1;s=c}if(l)i=!1}return!1}function Zb(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(C(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&C(e,n)==="-"&&C(e,n+1)==="-"&&(U(e,n+2,"staged")||U(e,n+2,"help")))t=!1}return t}function Bu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=C(e,r),i=t?js(o):oe(o);if(n&&B(o)&&C(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function er(e,t,n){let r=t;while(r<Z(e)&&!B(C(e,r))&&!n(C(e,r)))r++;return r}function $u(e,t,n,r){if(!U(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&C(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function pn(e,t,n,r){return $u(e,t,n,r)>=0}function Ae(e,t){Qn(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)Re(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return S("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var Xb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Hu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;Qn(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return ju(t.nodes,r,i)}function ju(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return ju(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return Jb(r,t,n)})}function Jb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!Xb.test(o.text));return e.words.every((o,i)=>o===t||Uu(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||Uu(o.target.raw,n.anchored,!0)))}function Uu(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as Qb,resolve as Vu}from"path";function nr(e,t,n,r){let o=Qb(e)?Vu(e):t?Vu(t,e):void 0;if(!o)return;try{return N(o,n,r)}catch{return o}}function Ku(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var gn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",rr="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),eC=new Set(["-p","--print"]),tC=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),nC=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),rC=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),oC=new Map([["python",new Set(["m"])]]),iC=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),sC=new Set(["always","default","never"]),aC=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),lC=/\\\r?\n/g,cC=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function qu(e){return Ro(e).code}function xo(e){return Ro(e).sources}function Yu(e){return cC.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Ne(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Ne(t,n,r,o,i,s);if(t==="node"&&eC.has(s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(dC(t,s)){let m=e[i+1];if(m===void 0)return Ne(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Ne(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(mC(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=uC(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Ne(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Ne(t,n,r,o);if(iC.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&aC.has(s))||t==="python"&&!sC.has(m))return Ne(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(oC.get(t)?.has(u)){let f=s.slice(m+1),g=f||e[i+1];if(g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});return Ne(t,n,r,o)}if(tC.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),g=f||e[i+1];if(o&&=g!==void 0,g!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:g});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(nC.get(t)?.has(u)){if(m+1===s.length)i++;break}if(rC.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Ne(t,n,r,o);if(c)i++}return Ne(t,n,r,o,void 0,void 0,!0)}function Ne(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
-`))||null,sources:r?c:[],optionsOpen:r&&s}}function uC(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=I(e).toLowerCase();return Hr.test(t)?"python":t}function dC(e,t){return qs.get(e)?.has(t)??!1}function mC(e){return qs.get(e)?.has("--eval")??!1}function or(e,t,n=!1){let r=gC(e,t);if(!Ks(r,t))return!1;Re(t,r);let o=pC(r);if(Ks(o,t))return!0;if(Re(t,o),!Zu.test(o))return!1;return!n||fC(r,t)}function fC(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+d.length,u=m;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:m,text:e.slice(m,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Zu.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||d)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Zu=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function pC(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(Re(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(Re(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(Re(t,e),n.some((o)=>vo(o,r))))}function gC(e,t){return Re(t,e),e.replace(lC,"")}import{lstatSync as mS,readdirSync as fS}from"fs";import{basename as pS,isAbsolute as vd,join as gS,relative as Ed}from"path";import{isAbsolute as rd,parse as _C}from"path";import{dirname as hC,isAbsolute as yC,parse as bC,sep as CC}from"path";function yt(e,t,n){if(et(t))throw Error("Unsupported Windows namespace path");let r=yC(t)?bC(t).root:"",o=r||e;for(let i of vC(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=hC(o);continue}let s=SC(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function SC(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${CC}${t}`}function vC(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],EC=new Set(Qs),xC=1024,Xu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),Ju=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),RC=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function _o(e){return EC.has(e)}function ea(e){return _o(e)||Xu.has(e)||Ju.has(e)||$n(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function Qu(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=xC?{state:"valid",count:r}:{state:"invalid"}}function wo(e,t,n){let o=e.match(RC)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function ed(e){return nd(e,Ju)}function td(e){return nd(e,Xu)}function nd(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var id=/^[A-Za-z_][A-Za-z0-9_]*=/;function Pe(e){if(!id.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Pe(w(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function sd(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Wt(e,t,n,r){if(!sd(hn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<V.wrapperPeelIterations.cap;m++){let u=od(i),f=Ao(i);for(let[p,h]of f.envAssignments)s.set(p,h),a.set(p,h);if(i=f.words,i.length===0)break;while(i.length>0&&hn(i).includes("=")&&!AC(i)){let p=PC(hn(i),a,t.env)??wo(hn(i),t.env,a);if(p)s.set(p.name,p.value),a.set(p.name,p.value);i=i.slice(1)}if(i.length===0)break;let g=O(hn(i));if(g!=="sudo"&&g!=="env"&&g!=="command"&&g!=="builtin")break;if(g==="sudo"){let p=IC(i,t.paths,c);if(i=p.words,p.cwd!==void 0)c=p.cwd}if(g==="env"){let p=MC(i,c,a,t);if(l.push(...p.envSplitValues??[]),i=p.words,p.cwd!==void 0)c=p.cwd;for(let[h,y]of p.envAssignments)s.set(h,y),a.set(h,y)}if(g==="command")i=DC(i);if(g==="builtin")i=i.slice(Le(i,1)==="--"?2:1);if(od(i)===u)break}let d=Ao(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:wC(d.words,o)}}function wC(e,t){return e.some((n)=>!t.has(n))}function od(e){return e.map(w).join(" ")}function hn(e){let t=e[0];return t?w(t):""}function Le(e,t){let n=e[t];return n?w(n):void 0}function AC(e){return id.test(hn(e))}function PC(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var TC=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function IC(e,t,n){let r=1,o=n;while(r<e.length){let i=Le(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=Le(e,r+1);o=s?ir(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ir(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ir(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(TC.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var kC=new Set(["-i","-0","--null"]),OC=new Set(["-u","--unset","-C","--chdir","-P"]);function MC(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=Le(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(kC.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=Le(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:Le(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(OC.has(c)){if(c==="-C"||c==="--chdir"){let m=Le(e,a+1);s=m?ir(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ir(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Pe(c))break;while(a<e.length){let m=Pe(Le(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(Le(e,a)==="--")a++;return l(a)}return l(a)}function ir(e,t,n){if(t==="")return null;if(!e&&!rd(t))return null;let r=rd(t)?_C(t).root:n.realpath(e??"/");if(r===null)return null;try{return yt(r,t,n)}catch{return null}}function DC(e){if(Le(e,1)==="-v")return[...K(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=Le(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var NC=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>NC.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function bt(e,t,n){return To(e,t,n).tokens}function LC(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(LC);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function To(e,t,n,r){if(!sd(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Wt(K(e),t,n,r);return{tokens:o.words.map(w),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),WC=new Set(["env","sudo","command","builtin"]),GC=new Set(["&&","||","|&","|","&",";"]),FC=new Set(["<<","<<<",">|"]),zC=new Set(["|","|&"]),BC=/[*@#?$!_-]/,$C=/^\w+(?::\w+)*/,UC=Object.freeze([]),sr=Object.freeze({kind:"scope",edge:"enter"}),ar=Object.freeze({kind:"scope",edge:"exit"}),HC=Object.freeze([]),jC=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),lr=new Set(["bash","sh","zsh","dash","ksh"]),VC=256,dd=new WeakMap;function md(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=YC(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Gt(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return dd.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[];for(let m of fd(e)){if(m.kind==="scope"){if(m.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=d.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let u=o.segment(a,s,c,m.operator,l);if(u)return u;s=KC(a,s,n,r),c=a.length>0&&zC.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let u=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(u===oa){l.add(a.length),a.push(i(m.target));continue}if(u)return u;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Mo(e){return fd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function cr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function KC(e,t,n,r){let o=cr(e)?new Map([...t.variables,...qC(e,t.variables)]):t.variables,i=bt([...e],n),s=I(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:ae(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function qC(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function fd(e){return dd.get(e)??UC}function YC(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=HC){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Gt(e,t){return e.nodes.flatMap((n,r)=>ZC(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function ZC(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[We(tS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[We(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...Gt(e.body,a),...s?[ko("}")]:[]]:[sr,We("("),...Gt(e.body,a),...s?[We(")")]:[],ar]}]}let o=iS(e,r.functions);if(o){if(r.depth>=ht.maxDepth||++r.flags.expansions>VC)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...ad(e,r),ko(";"),...Gt(o,{...r,depth:r.depth+1}),ko(";")]},...ld(e,t,n,r)]}return[{start:e.span.start,events:ad(e,r)},...ld(e,t,n,r)]}function ad(e,t){return[...e.words.map((n)=>({start:n.span.start,events:gd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:XC(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function XC(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?gd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:nS(r),targetOrder:FC.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:yd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ld(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[We(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...pd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?JC(t,n,r):[]]}function JC(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:pd(n.source.slice(r.span.end,e.span.end),n)}]}function pd(e,t){if(t.depth>=ht.maxDepth)return t.flags.limited=!0,[];let n=De(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Gt(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function gd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?We("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(We(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((p)=>typeof p==="string"?p:p.text).join("");let g=d?Gt(d,n).filter((p)=>p.kind==="redirection"&&p.body!==void 0):[];if(g.length>0)o.push(sr,...g,ar);continue}let m=d?Gt(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(sr,...m,ar);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?We("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),sr,...m,...c.raw.endsWith(")")?[We(")")]:[],ar);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>We("(")),...u===1?[sr]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>We(")")):[],...u===1?[ar]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=cd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=cd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function cd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=eS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return QC(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&BC.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?$C:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function QC(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function eS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function tS(e){return/^[\r\n]+$/.test(e)?";":e}function We(e){return Object.freeze({kind:"operator",operator:e,boundary:GC.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function nS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function ur(e){return jC.has(e)||/^python\d/.test(e)}var rS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function hd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=rS.get(e)?.has(n)??!1;return hd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!WC.has(t))return[...e];return na(hd(t,e.slice(1)))}function yd(e){let t=Zn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function oS(e){let t=yd(e)[0];if(t===void 0)return!1;let n=I(t).toLowerCase();return ur(n)&&!lr.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(oS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!aS(t))return r;return[...r,...o]})}function iS(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function St(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function sS(e){if(St(e.words[0],"git"))return St(e.words[1],"commit");if(!St(e.words[0],"gh")||!St(e.words[2],"create"))return!1;return St(e.words[1],"pr")||St(e.words[1],"issue")}function aS(e){return(St(e.words[0],"cat")||St(e.words[0],"tee")||sS(e))&&!e.words.some(ud)&&!e.redirections.some((n)=>ud(n.target))}function ud(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var bd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),Cd=new Set([...bd,"glob"]),lS=new Set([...Cd,"pattern"]);class Ge extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function dr(e){let t=cS(),n=Gn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:uS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return ki(e,t)}function cS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=De(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let d=n.get(a);if(d)return d;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=md(i,a);return e.set(i,c),c},getCommandProgram:r}}function uS(e){let t=e.route.kind==="grep"?Cd:e.route.kind==="glob"?lS:bd;return[...Ol(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?Nl(e.input):[]]}var dS=new Set(["-S","--suffix"]);function yn(e,t,n,r,o){if(e.status==="structural-limit")throw new Ge;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&dS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var Te="Git metadata and hooks are protected. Ask the user before modifying them.";function xd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Nr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Sd(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=yn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>vS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Sd(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function Ft(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(ae(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?No(m,l):hS(m,l);if(n.markerFiles.some(d))return!0;return r&&aa(n).some(d)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function hS(e,t){let n=Ed(t,e);if(n===""||n.startsWith("..")||vd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function yS(e,t,n,r,o){return Ft(e,t,n,!0,r,o)}function bS(e,t,n,r,o){if(!n)return!1;return sa(Lo(ae(e,t,r,o)),n)}function Sd(e,t,n,r,o,i){let s=Lo(ae(e,t,r,o));return i.includes(s)||_d(s,n)}function Rd(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(ae(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||_d(e,t)}function _d(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var CS=50000;function wd(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(pS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=SS(o);if(!i)return!0;if(r+=i.length,r>CS)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>gS(o,s.name)))}return!1}function SS(e){try{let t=mS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return fS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=Ed(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!vd(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function vS(e,t,n,r,o){if(cr(e))return null;let i=Ct([...e],r);if(I(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>yS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&bS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as TS,parse as IS,posix as Dd,resolve as Bt,sep as da}from"path";import{isAbsolute as ES,join as Ad,normalize as Id,parse as xS,sep as Pd}from"path";var RS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],_S=` 	
-`;function mr(e,t){if(vt(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function zt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Od(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(AS(e))return!1;return bn(e,t)}function vt(e,t){let n=Od(e,t,"IFS");return n!==void 0&&n!==""&&n!==_S}function bn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return kd(t).some((r)=>Cn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return kd(t).some((r)=>Go(r)===Go(n))}var Td=new WeakMap;function kd(e){let t=Td.get(e);if(t)return t;let n=wS(e);return Td.set(e,n),n}function wS(e){let t=RS.map((r)=>Wo(r,e.paths)??Id(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&PS(n))return[...t,n];return t}function AS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Od(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function PS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Id(e);if(!ES(n))return n;let r=xS(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Ad(i,o[s]??"");if(t.entryKind(a)==="missing")return Ad(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function Cn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Pd)?r:`${r}${Pd}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var kS=process.platform==="win32",Md=64,OS=16384;function fr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return S(o.id,o.reason)}function pr(e){let t=Ru(e,Md,Md,OS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:MS(e)}}function MS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>DS(e.raw,n.span.start-e.span.start))}function DS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function Et(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Ce();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:zS(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function Fe(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&$S(e))return{kind:"outside_anchored_cwd"};let o=!r&&Ld(e,t.posixShell);if(et(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(LS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&Ft(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(WS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(BS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&VS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>KS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(qS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(NS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function NS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Wd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return bn(Bt(t.resolvedCwd,r),t.environment)}function Nd(e,t,n={}){let{containmentTarget:r,...o}=n;if(Fe(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if(FS(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Wd(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Dd.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function LS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?Bt(t.resolvedCwd,o):null;if(!i)return!1;let s=he(N(i,t.environment.paths,t.budget));if(s===IS(s).root)return!0;return s===he(N(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=TS(e);if(kS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function WS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&bn(l,a))return!0;return(t||i&&s)&&n&&!o&&GS(l,n)}function GS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Ld(e.slice(n.length+1),t)})}function FS(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Dd.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function zS(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Kn(o.trim(),t);if(!zo(i))return[];try{let s=N(i,n,r);if(qn(s,N(t,n,r)))return[];return[he(s)]}catch{return[]}})}function BS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Kn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?Bt(i,o):null;if(!s)return!1;try{let a=he(N(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function $S(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Ld(e,t=!1){return e.includes("$")||e.includes("`")||US(e)||t&&HS(e)}function US(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function HS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&jS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function jS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function VS(e,t,n,r){try{return he(N(e,n,r))===he(N(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function KS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(N(Bt(t,e),n,r))===he(N(o,n,r))}catch{try{return he(Bt(t,e))===he(o)}catch{return!1}}}function qS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua(Bt(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua(Bt(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return Gd(N(e,n,r),N(t,n,r))}catch{return!1}}function Wd(e,t,n,r){if(!t)return!1;try{return Gd(N(t,n,r),N(e,n,r))}catch{return!0}}function Gd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var YS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Fd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",ZS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",zd="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Bd="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",XS="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",JS="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",QS={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Bd},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:Te},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:zd},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:XS},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Fd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:ZS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Fd}};function $d(e,t,n,r=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return ev(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function ev(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=nv(o),s=o[i];if(!s||!YS.has(dv(s.text)))return null;let a=tv(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return S("powershell.remove-item-pipeline-dynamic-target",JS);for(let l of a.targets)if(!et(l.text)&&ma(ga(l.text)))return S(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Bd);for(let l of a.targets)if(n.resolvedCwd&&Ft(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return S("powershell.remove-item-git-metadata",Te);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return S("powershell.remove-item-recursive-force-dynamic-target",zd);for(let l of a.targets){let c=fr(Fe(ga(l.text),n),n,r,QS);if(c)return c}return null}function tv(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(rv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=iv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(sv(c.name)){let d=c.value?ov(c.value,l):e[++a];if(d?.kind==="word"){t.push(pa(d)),i=i||d.dynamic;continue}i=!0;continue}if(av(c.name)){n=!0;continue}if(lv(c.name)){r=!0;continue}if(cv(c.name))o=uv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function nv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function rv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function ov(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function iv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function sv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function av(e){return"recurse".startsWith(e)}function lv(e){return e.length>=2&&"force".startsWith(e)}function cv(e){return e==="wi"||"whatif".startsWith(e)}function uv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function dv(e){return e.toLowerCase()}var Sn="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",gr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",Ud="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var mv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),fv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),pv=new Set(["-o","--output","--query","--subscription"]),gv=new Set;function Hd(e){if(e==="aws")return mv;if(e==="gcloud")return fv;if(e==="az")return pv;return gv}var hv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),yv=new Set;function jd(e){if(e==="git")return ve;if(e==="docker")return hv;return yv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!Sv(n,o.command))continue;if(o.match){if(bv(n,e,o.match))return Vd(o);continue}if(!vv(n,e,o.subcommand))continue;if(xv(e,new Set(o.block_args),r))return Vd(o)}return null}function Vd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function bv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Cv(r,n.command_path,Hd(e))}function Cv(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function Sv(e,t){return e===O(t)}function vv(e,t,n){if(!n)return!0;return Kd(t,1,n,jd(e))}function Kd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&Ev(e,i,n,r))return!0;continue}return s===n}return!1}function Ev(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Kd(e,t+2,n,r)}function xv(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Rv=new Set(["-e","--source"]),_v=new Set(["-F","-v","--assign","--field-separator"]),qd=new Set(["-f","--file"]),wv=new Set(["print","printf","return"]),Yd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Av="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Zd(e,t,n){let r=!1;for(let o of Pv(e)){let i=Tv(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?S("awk.system-dynamic",Av):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Rv.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(_v.has(a)||qd.has(a))){let l=e[s+1];if(i&&=l!==void 0,qd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function yr(e){return ya(e).sources}function Pv(e){return yr(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Tv(e,t){Re(t,e);let n=e.includes("system")?ba(e,t):null,r=Iv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function ba(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Xd(e,i+1);continue}if(s==="/"&&Jd(e,i)){i=Qd(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,hr(e[a-1])||hr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Uo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=$o(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Iv(e,t){Re(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Uo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Xd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&Jd(e,i)){let f=Qd(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
-{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=$o(e,m);if(ha(e,u,"getline")){o=!0;let f=Mv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Nv(s,a)){o=!0;let f=Ov(e,u);if(!f){r=!0,c=m,i=m;continue}if(!kv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function hr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function kv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
-}#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Dv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Ov(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function Mv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Dv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
-`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!hr(e[t-1])&&!hr(e[t+n.length])}function Nv(e,t){return t!==null&&t>=e}function Xd(e,t){let n=e.indexOf(`
-`,t);return n===-1?e.length:n+1}function Jd(e,t){let n=Lv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(hr(e[r-1]))r--;return wv.has(e.slice(r,n+1))}function Lv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function Qd(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var Wv=new Set(["sudo","env","command","builtin"]);function Ho(e,t){let n=e[0];if(!n||!t.transparentWrappers.includes(I(n)))return null;let r=I(n),o=e[1]==="--"?2:1,i=Gv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function Gv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=I(a)!==n&&Fv(a,r);if(l)i.push(s);if(!l&&jr.has(O(a)))break;if(o)break}return i}function Fv(e,t){let n=I(e),r=O(e);return r==="git"||n==="busybox"||$t(e)||os.has(n)||t.transparentWrappers.includes(n)||q.has(r)||e==="$SHELL"||Me(r)||we.has(r)||t.rules.some((o)=>o.command===n)}function $t(e){return Wv.has(e.toLowerCase())}function Ut(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function ze(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return jo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*jo(e,t,n,r,o,i,s,a,l){let c=To(e,t,n,i);for(let[f,g]of c.envAssignments)i.set(f,g),o.set(f,g);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=Po(c.envSplitValues,d);if(!f)throw new D("derivedCommandShape");Ca(a),yield*jo(f,t,m,r,o,i,s,a,l);return}if($t(d[0]??""))throw new D("wrapperPeelIterations");let u=Ho(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])Ca(a),yield*jo(f===u.childIndex?u.tokens:d.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(Bv(d)){Ca(a),yield*jo(d.slice(1),t,m,r,o,i,s,a,l);return}yield zv(d,m,r,o,i,l)}function zv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:I(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function Ca(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function Bv(e){return I(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Sa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function Be(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||va(r,"recursive")){t=!0;continue}if(r==="-f"||va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Vo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var $v=["--init-file","--rcfile"],Uv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function $e(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return em(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=em(e,t,!1);if(r!==null)return r}}return null}function st(e){let t=I(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return Ee(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function em(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function tm(e){let t=I(e[0]??"").toLowerCase(),n=Hv(e,t),r=Uv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Hv(e,t){let n=Ee(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?$v.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ns.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=rs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var jv="find -delete permanently removes files. Use -print first to preview.",Vv="find -exec rm -rf is dangerous. Use explicit file list instead.",Kv=new Set(["-exec","-execdir","-ok","-okdir"]),qv=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function nm(e,t){let n=e.map(w),r=Yv(e,n,t);if(r)return r;if(Ko(n,1)&&!tE(e,n,t)){let s=T(S("find.delete",jv),t.policy);if(s)return s}let o=t.budget??Ce(),i=0;while(i<n.length){let s=n[i],a=at(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=vn(n,i);i=l.nextIndex;let c=rE(l.tokens,t.environment);if(c){let f=T(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:T(m,t.policy);if(u)return u}return null}function Yv(e,t,n){if(!Ko(t,1)&&!Ea(t,n.environment))return null;let o=br(e)??K(["."]),i=Et({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=pr(s);for(let l of a.expandedTargets??[w(s)]){let c=Fe(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!Zv(e,i.protectedGitMetadata,n.environment))return S("find.delete-git-metadata",Te)}}if(eE(t)&&i.resolvedCwd&&Rd(o.map(w),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return S("find.delete-git-metadata",Te);return null}function Zv(e,t,n){if(!t)return!1;let r=e.map(w),o=[],i=!1,s=br(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=vn(r,a),d=Ct([...c.tokens],n),m=Vo(d),u=q.has(I(d[0]??"").toLowerCase()),f=c.tokens.some((p)=>p!=="{}"&&p.includes("{}")),g=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((p)=>p!=="{}"&&!p.startsWith("-"));if(m||u||f||g)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(Jv(c.text,l==="-iname"));a+=2;continue}if(!Xv.has(l))return!1;a+=1+at(l)}return o.length>0&&!wd(t,(l)=>o.every((c)=>c.test(l)))}var Xv=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function Jv(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var Qv=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ea(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=vn(e,n),o=Ct([...r.tokens],t),i=I(o[0]??"").toLowerCase(),s=q.has(i)&&Qv.test(($e(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function eE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function tE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=br(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ca(o,n.environment),s=n.trustedTmpdirValue??zt(o,n.environment),a=n.allowTmpdirVar??!mr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??vt(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=Et(l),d=Et({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&u&&!Cn(u,m)?n.cwd:void 0;return r.every((g)=>{let p=pr(g);if(p.unsafeBraceExpansion)return!1;return(p.expandedTargets??[w(g)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,v=y??h;return Nd(v,y?d:c,{containmentTarget:nE(v,i),targetIsLiteral:p.expandedTargets!==void 0||p.targetIsLiteral,tmpdirWordSplittingProtected:p.tmpdirWordSplittingProtected})})})}function nE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function br(e){let t=(o)=>{let i=e[o];return i?w(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function rE(e,t){let n=bt([...e],t);if(n.length===0)return null;let r=I(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=I(n[0]??"");if(r==="rm"&&Be(n))return S("find.exec-rm-recursive-force",Vv);return null}function vn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Ko(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=vn(e,n).nextIndex;continue}let o=at(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function at(e){return qv.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&Kv.has(e)}import{resolve as Tx}from"path";function Cr(e){let t=De(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var oE=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function om(e,t,n){let r=qo(e,t,n),o=iE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<oE;a++){let{subcommand:l,rest:c}=_e(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=uE(m);if(u===null||u.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function im(e,t,n){return qo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function _e(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?I(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=ve.has(o)?2:1}return{subcommand:null,rest:[]}}function iE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?I(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=aE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...sE(e,t,n)]}}function sE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ra(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ra(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=rm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=rm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(ve.has(i)){o+=2;continue}o++}return r}function aE(e,t){let n=lE(e,t),r=cE(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function lE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=Cr(n);if(!o)return null;for(let i of o){let s=Ra(i);if(!s)return null;r.push(s)}return r}function cE(e,t){let n=Qu(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ra(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function rm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function uE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return Cr(t)}var dE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",mE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",fE="git checkout --force discards uncommitted changes. Use 'git stash' first.",pE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",gE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",hE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",yE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",bE="git switch --force discards uncommitted changes. Use 'git stash' first.",CE="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",SE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",vE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",EE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",xE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",RE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",_E="git push --force destroys remote history. Use --force-with-lease for safer force push.",wE="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",AE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",PE="git branch -D force-deletes without merge check. Use -d for safe delete.",TE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",IE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",kE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",OE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",ME="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",DE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",NE="git worktree remove --force can delete uncommitted changes. Remove --force flag.",LE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),WE=new Set(["--recurse-submodules","--track","-t"]),_a=new Set(["-b","-B","-U"]),wa=new Set(["-c","-C"]),GE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var En=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function am(e,t){let{subcommand:n,rest:r}=_e(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return xt(FE(r,t));case"switch":return xt(BE(r));case"restore":return xt(UE(r));case"reset":return jE(r);case"clean":return xt(KE(r));case"rm":return xt(qE(r));case"push":return Ht(YE(r));case"branch":return Ht(JE(r));case"stash":return Ht(rx(r));case"worktree":return Ht(ox(r));case"rebase":return xt(QE(r));case"merge":return xt(ex(r));case"tag":return Ht(tx(r));case"reflog":return Ht(nx(r));default:return null}}function xt(e){return e?{...e,localDiscard:!0}:null}function Ht(e){return e?{...e,localDiscard:!1}:null}function FE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:_a});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return S("git.checkout-force",fE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return S("git.checkout-pathspec-from-file",gE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return S("git.checkout-ref-path",pE);return S("git.checkout-double-dash",dE)}let i=$E(e);if(i.length>=2)return S("git.checkout-ambiguous",hE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(zE(s)||t(s))return S("git.checkout-double-dash",mE);return null}function zE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function BE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return S("git.switch-discard-changes",yE);let n=me(t,{shortOptsWithValue:wa});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return S("git.switch-force",bE);return null}function $E(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(LE.has(r)){n+=2;continue}if(WE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function UE(e){let t=HE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?S("git.restore-worktree",SE):S("git.restore-unstaged",CE)}function HE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(GE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function jE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=S("git.reset-hard",vE);break}if(M(n,"--merge")){t=S("git.reset-merge",EE);break}}if(!t)return null;return VE(e)?Ht(t):xt(t)}function VE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function KE(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return S("git.clean-force",xE);return null}function qE(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?S("git.rm-force",RE):null}function YE(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return S("git.push-mirror",AE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||sm(t,n).some(ZE))return S("git.push-force",_E);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||sm(t,n).some(XE))return S("git.push-delete",wE);return null}function sm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function ZE(e){return e.startsWith("+")||e.includes(":+")}function XE(e){return e.length>1&&e.startsWith(":")}function JE(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return S("git.branch-force-delete",PE);return null}function QE(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.rebase-abort",TE):null}function ex(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?S("git.merge-abort",IE):null}function tx(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?S("git.tag-delete",kE):null}function nx(e){return e[0]==="delete"?S("git.reflog-delete",OE):null}function rx(e){for(let t of e){if(t==="drop")return S("git.stash-drop",ME);if(t==="clear")return S("git.stash-clear",DE)}return null}function ox(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return S("git.worktree-remove-force",NE);return null}import{dirname as Rx,isAbsolute as _x,join as xm,resolve as wx}from"path";var Pa="TMPDIR",Ta="IFS",cm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,um=/^[A-Za-z_][A-Za-z0-9_]*$/,dm=new Set(["export","typeset","declare","readonly"]),ix=new Set(["builtin","command","time"]),mm=new Set(["do","then","else"]),sx=new Set(["do","then","case"]),lm=new Set(["done","fi","esac"]),ax=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function fm(e,t){return e.map((n)=>n.provenance==="variable"&&Sm(n.text)?pm(n.text,t.shellAssignments):w(n))}function pm(e,t){return e.replace(ax,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=pm(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function gm(e,t){return{env:e,effectiveEnvAssignments:dx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function hm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ia(e,t){let n=bm(e,t),r=e[0]??"";if(sx.has(r))t.bodyDepth+=1;if(r==="elif"||lm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(lm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ka(t,a)});let o=n.commandIndex;if(o!==-1&&dm.has(e[o]??""))e.filter((a)=>um.test(a)&&Aa(a)).forEach((a)=>{mx(t,a)});let i=o===-1?-1:Cm(e,o);if(i===-1||e[i]!=="unset")return;let s=px(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(mm.has(r)){t.shellAssignments.set(a,"");return}fx(t,a)})}function ym(e,t){let n=bm(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function bm(e,t){let n=mm.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Sm(a)),o=r!==-1&&dm.has(e[Cm(e,r)]??""),i=ux(t);return{assignments:e.flatMap((a,l)=>{let c=lx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!_o(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function Cm(e,t){let n=t;while(ix.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Sm(e){return Pe(e)!==null||cm.test(e)}function lx(e,t,n){return Pe(e)??cx(e,t,n)}function cx(e,t,n){let r=wo(e,n,t);if(r)return r;let o=e.match(cm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Aa(e){return e===Pa||e===Ta||ea(e)}function ux(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function dx(e,t){let n=[Pa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function mx(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function fx(e,t){if(!Aa(t)&&!um.test(t))return;if(e.shellAssignments.set(t,""),_o(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Aa(t)||t===Pa||t===Ta||$n(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function px(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as gx}from"path";function Yo(e,t){return Qs.some((n)=>t?.has(n)||e.has(n))}function xn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(gx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=vm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=vm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=ve.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function vm(e,t,n){try{let r=yt(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function Em(e,t,n){if(!t.localDiscard||!n.worktreeMode||Yo(n.environment.env,n.envAssignments))return null;let r=xn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Oa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Oa(e,t,n){let{subcommand:r,rest:o}=_e(e),i=r?.toLowerCase();if(t.dynamicArguments||hx(o)||vx(e,t.environment.env,t.envAssignments,n)||Cx(o)||yx(i,o))return!0;return i==="clean"&&Sx(o)>1}function hx(e){return e.some((t)=>/[$*?[]/.test(t))}function yx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:_a}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:wa}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||bx(s))||r.has("-C");return o&&i}return!1}function bx(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function Cx(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Sx(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function vx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=qo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>xx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Ex(s.value);if(td(n))return!0;return r.recursiveSubmodules}function Ex(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function xx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Rm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??w(l)),o=n.environment.paths,i=xn(r,n.cwd,o),s=n.originalCwd?o.realpath(wx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Yo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Px(e,n.shellAssignments,o):_m(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!Ax(a,r,t,n)||!bn(a,n.environment)||Fo(a,n.environment)||Cn(s,a)||Cn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function Ax(e,t,n,r){let o=r.environment.paths,i=xm(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Oa(t,r,a)}function Px(e,t,n){let r=_e(e.map(w)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Ye(l,t??new Map))??a;if(!_x(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function _m(e,t){if(t.entryKind(xm(e,".git"))!=="missing")return e;let n=Rx(e);return n===e?null:_m(n,t)}var Ix="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",kx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Zo(e,t){return wm(e,t)}function wm(e,t,n){let r=e.map(w),o=om(r,t.environment.env,t.envAssignments),i=o.blockedReason?T(S("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((ed(t.envAssignments)||im(r,t.environment.env,t.envAssignments))&&Ox(s))return S("git.ssh-env",Ix);let a=am(s,(c)=>{let d=xn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(Tx(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=Em(r,a,t)??Rm(e,a,t);if(!l)return a;return n?.(l),null}function Am(e,t){let n=null;return{match:wm(e,t,(o)=>{n=o}),relaxation:n}}function Ox(e){let{subcommand:t,rest:n}=_e(e),r=t?.toLowerCase();if(!r)return!1;if(kx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&Mx(n)}function Mx(e){return e.find((t)=>!Dx(t))?.toLowerCase()==="update"}function Dx(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as cR}from"path";function Pm(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Xo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Tm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Nx="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Lx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",km="rm -rf targeting root or home directory is extremely dangerous and always blocked.",Wx="rm -rf in home directory is dangerous. Change to a project directory first.",Im={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:km},git_metadata_target:{id:"rm.git-metadata",reason:Te},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Lx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:Wx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Tm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Nx},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Tm}};function Jo(e,t){let n=Et({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(w),o=Be(r),i=Vo(r),s=Fx(e);for(let a of s){let l=pr(a.word);if(o&&l.unsafeBraceExpansion){let c=T(fr({kind:"outside_anchored_cwd"},n,t.policy,Im),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=Se(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&Ft(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return S("rm.git-metadata",Te);if(i&&!o){let u=Fe(d,n,m);if(u.kind==="root_or_home_target")return S("rm.recursive-force-root-or-home",km);if(u.kind==="git_metadata_target")return S("rm.git-metadata",Te);continue}if(!o)continue;for(let u of Gx(d,n,m)){let f=fr(u,n,t.policy,Im),g=T(f,t.policy);if(g)return g}}}return null}function Gx(e,t,n){let r=Fe(e,t,n);if(r.kind==="cwd_self_target")return[r,Fe(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=Fe(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,Fe(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Fx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=w(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var Rt={kind:"none"},jt={kind:"dynamic"},zx=new Set(["<","<<","<<-","<<<","<&","<>"]),Mm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Bx=/^(?:[0-9]+|[@*])$/,$x=ht.maxWords,Dm=ht.maxInputLength;function Nm(e){if(!e||I(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
+`?u+2:u+1;s.push(Fs(e,u,y)),u=y;continue}u++;continue}let g=Wu(e,u);if(g){m(),s.push(Fs(e,u,u+g.length)),u+=g.length;continue}if(f==="{"){if(m(),o>=r.maxDepth)return a.push(Lu(r.maxDepth)),{nodes:s,issues:a,next:n,closed:!1,words:c,limited:!0};let y=Us(e,u+1,n,r,o+1,!0),b=y.closed?y.next-1:y.next,C=fe({kind:"program",dialect:"powershell",source:e.slice(u+1,b),span:{start:u+1,end:b},status:y.limited?"limited":y.issues.length>0?"partial":"complete",issues:y.issues,nodes:y.nodes});if(s.push(Object.freeze({kind:"group",style:"brace",span:Object.freeze({start:u,end:y.next}),body:C})),a.push(...y.issues),!y.closed)a.push({code:"unclosed-script-block",message:"PowerShell script block is not closed"});c+=y.words,d||=y.limited,u=y.next;continue}if(f==="}"){m(),s.push(Fs(e,u,u+1)),u++;continue}if(f===">"||f==="<"){l.start=l.start===-1?u:l.start;let y=e[u+1]===f?u+2:u+1,b=y;while(/[ \t]/.test(e[b]??""))b++;let C=b<n?Iu(e,b,n,r,o):void 0,x=C?.next??y;if(l.redirections.push(Object.freeze({kind:"redirection",operator:e.slice(u,y),span:Object.freeze({start:u,end:x}),...C?{target:C.word}:{}})),C)a.push(...C.issues),l.nested.push(...C.nested),c+=C.words,d||=C.limited;l.end=x,u=x;continue}if(f===","){l.start=l.start===-1?u:l.start,l.words.push(Os({text:",",raw:",",span:{start:u,end:u+1},provenance:"literal",quoted:!1})),l.end=++u;continue}let h=Iu(e,u,n,r,o);if(l.start=l.start===-1?u:l.start,l.end=h.next,l.words.push(h.word),a.push(...h.issues),l.nested.push(...h.nested),c+=1+h.words,d||=h.limited,c>r.maxWords)return a.push({code:"word-limit",message:`command exceeds ${r.maxWords} words`}),m(),{nodes:s,issues:a,next:h.next,closed:!1,words:c,limited:!0};u=h.next>u?h.next:u+1}return m(),{nodes:s,issues:a,next:u,closed:!i,words:c,limited:d}}function Iu(e,t,n,r,o){let i="",s="literal",a=!1,l=[],c=[],d=0,m=!1,u=(p)=>{let g=kC(e,p,n,r,o);return i+=e.slice(p,g.next),c.push(g.program),l.push(...g.program.issues),d+=zs(g.program),m||=g.program.status==="limited",s="command-substitution",g.next},f=t;while(f<n){let p=e[f];if(!p||/\s/.test(p)||Wu(e,f)||p===">"||p==="<"||p==="#")break;if(p===",")break;if(p==="`"){let g=e[f+1];if(!g){l.push({code:"trailing-escape",message:"PowerShell escape has no following character"}),f++;break}i+=g,f+=2;continue}if(e.startsWith("$(",f)){f=u(f);continue}if(p==="'"){a=!0,f++;let g=!1;while(f<e.length){if(e[f]==="'"&&e[f+1]==="'"){i+="'",f+=2;continue}if(e[f]==="'"){g=!0,f++;break}i+=e[f]??"",f++}if(!g)l.push({code:"unclosed-single-quote",message:"single-quoted word is not closed"});continue}if(p==='"'){a=!0,f++;let g=!1;while(f<n){let h=e[f];if(h==="`"&&e[f+1]){i+=e[f+1],f+=2;continue}if(h==='"'){g=!0,f++;break}if(e.startsWith("$(",f)){f=u(f);continue}if(h==="$")s=e[f+1]==="("?"command-substitution":"variable";i+=h??"",f++}if(!g)l.push({code:"unclosed-double-quote",message:"double-quoted word is not closed"});continue}if(p==="$")s=e[f+1]==="("?"command-substitution":"variable";if(p==="@"&&f===t)s="variable";i+=p,f++}return{word:mn(e,t,f,i,s,a,s==="literal"?void 0:OC(e,t,f)),next:f,issues:l,nested:c,words:d,limited:m}}function kC(e,t,n,r,o){let i=Nu(e,t+2,n),s=i===-1?n:i,a=i===-1?n:i+1;if(o>=r.maxDepth)return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:"limited",issues:[Lu(r.maxDepth)],nodes:[]}),next:a};let l=Us(e,t+2,s,r,o+1),c=i===-1?[{code:"unclosed-command-subexpression",message:"PowerShell command subexpression is not closed"}]:[];return{program:fe({kind:"program",dialect:"powershell",source:e.slice(t+2,s),span:{start:t+2,end:s},status:l.limited?"limited":l.issues.length+c.length>0?"partial":"complete",issues:[...l.issues,...c],nodes:l.nodes}),next:a}}function Nu(e,t,n){let r=1,o=!1,i=!1;for(let s=t;s<n;s++){let a=e[s];if(a==="`"){s++;continue}if(!i&&a==="'"){if(o&&e[s+1]==="'"){s++;continue}o=!o;continue}if(!o&&a==='"'){i=!i;continue}if(o)continue;if(e.startsWith("$(",s)){r++,s++;continue}if(!i&&a==="(")r++;if(a!==")")continue;if(r--,r===0)return s}return-1}function zs(e){let t=0;for(let n of e.nodes){if(n.kind==="group")t+=zs(n.body);if(n.kind==="command"){t+=n.words.length;for(let r of n.nested)t+=zs(r)}}return t}function OC(e,t,n){let r=uo(e),o=t,i=!1,s=t;while(s<n){let a=e[s];if(a==="`"){s+=2;continue}if(a==="'"){if(i&&e[s+1]==="'"){s+=2;continue}i=!i,s++;continue}if(i){s++;continue}if(e.startsWith("$(",s)){let l=Nu(e,s+2,n),c=l===-1?n:l+1;r.push(o,s,"literal"),r.push(s,c,"command-substitution"),s=c,o=c;continue}if(a==="$"||a==="@"&&s===t){let l=MC(e,s+1,n);r.push(o,s,"literal"),r.push(s,l,"variable"),s=l,o=l;continue}s++}return r.push(o,n,"literal"),r.parts}function MC(e,t,n){if(e[t]==="{"){let o=e.indexOf("}",t+1);return o===-1||o>=n?n:o+1}let r=t;while(r<n&&/[A-Za-z0-9_:?]/.test(e[r]??""))r++;return r}function Lu(e){return{code:"depth-limit",message:`command structure exceeds parser limit ${e}`}}function Bs(e){return e.nodes.flatMap((t)=>{if(t.kind==="group")return Bs(t.body);if(t.kind!=="command")return[];return[[...t.words,...t.redirections.flatMap((n)=>n.target?[n.target]:[])].sort((n,r)=>n.span.start-r.span.start).filter((n)=>n.text!==""&&n.raw!==",").map((n)=>n.text),...t.nested.flatMap(Bs)]})}function Wu(e,t){for(let n of["&&","||",";","|"])if(e.startsWith(n,t))return n;return null}function DC(e,t,n,r){if(e[t]==="#"&&e[t+1]!==">"){let s=t+1;while(s<n&&e[s]!=="\r"&&e[s]!==`
+`)s++;return{next:s,limited:!1}}if(!e.startsWith("<#",t))return null;let o=1,i=t+2;while(i<n){if(e.startsWith("<#",i)){if(o++,o>r)return{next:n,issue:{code:"comment-depth-limit",message:`PowerShell block comment exceeds nesting limit ${r}`},limited:!0};i+=2;continue}if(e.startsWith("#>",i)){if(o--,i+=2,o===0)return{next:i,limited:!1};continue}i++}return{next:n,issue:{code:"unclosed-block-comment",message:"PowerShell block comment is not closed"},limited:!1}}function NC(e,t){if(t)return"limited";if(e.some((n)=>n.code==="unclosed-block-comment"))return"invalid";return e.length>0?"partial":"complete"}function Fs(e,t,n){return Object.freeze({kind:"connector",operator:e.slice(t,n),span:Object.freeze({start:t,end:n})})}function Ne(e,t="auto",n=gt){if(t==="powershell"||t==="auto"&&Mu(e.slice(0,n.maxInputLength),n))return $s(e,n);return Su(e,n)}function _(e){return e.provenance==="command-substitution"?e.raw:e.text}function pn(e,t){return e==="posix"?t:q(t.map((n)=>n.text))}function bo(e,t){return e&&e.provenance!=="unknown"?e.provenance==="literal":!/[$`*?[\]]/.test(t)}function q(e){return e.map((t)=>({kind:"word",text:t,raw:t,span:{start:0,end:0},provenance:"unknown",quoted:!1,parts:[]}))}function Hs(e,t){return{value:e,work:t}}function S(e,t){if(e.work)e.work.units=Math.min(Number.MAX_SAFE_INTEGER,e.work.units+1);return e.value[t]}function Z(e){return e.value.length}function tr(e,t,n=1){if(e)e.units=Math.min(Number.MAX_SAFE_INTEGER,e.units+t.length*n)}function we(e,t){tr(e,t)}function Wt(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=48&&t<=57||t>=65&&t<=90||t===95||t>=97&&t<=122}function H(e){if(!e)return!1;let t=e.charCodeAt(0);return t===9||t===10||t===11||t===12||t===13||t===32||t===160||t===65279||t===5760||t>=8192&&t<=8202||t===8232||t===8233||t===8239||t===8287||t===12288}function js(e){return e===`
+`||e==="\r"||e==="\u2028"||e==="\u2029"}function j(e,t,n){if(t+n.length>Z(e))return!1;for(let r=0;r<n.length;r++)if(S(e,t+r)!==n[r])return!1;return!0}function tt(e,t,n){return!Wt(S(e,t-1))&&j(e,t,n)&&!Wt(S(e,t+n.length))}function nt(e,t){return Wt(S(e,t-1))!==Wt(S(e,t))}function oe(e){return e===`
+`||e===";"||e==="&"||e==="|"}function gn(e){return e==="|"||e===";"}function So(e,t,n){let r=Hs(e,n);if(t==="rm")return LC(r);if(t==="dd")return GC(r);return Uu(r,!0)}function vo(e,t,n){let r=Hs(e,n);if(t==="rm")return FC(r);if(t==="reset-hard")return Bu(r,"--ha","rd");if(t==="reset-merge")return Bu(r,"--me","rge");if(t==="clean")return UC(r);if(t==="checkout")return jC(r);if(t==="push-force")return VC(r);if(t==="push-refspec")return KC(r);if(t==="push-delete")return qC(r);if(t==="branch")return YC(r);if(t==="tag")return JC(r);if(t==="restore")return QC(r);return Uu(r,!1)}function LC(e){let t=!1,n=!1,r=!1,o=-1;for(let i=0;i<=Z(e);i++){let s=S(e,i);if(!t){let l=S(e,i+2);if(tt(e,i,"rm")&&H(l)&&l!==`
+`)t=!0,i++;continue}let a=WC(e,i);if(s===`
+`||a!==-1){if(t=!1,n=!1,r=!1,o=-1,a!==-1)i=a-1;continue}if(s===";"||s==="&"||s==="|"||i===Z(e)){if(o>=0){let l=Gu(e,o,i);n||=l.recursive,r||=l.force}if(n&&r)return!0;t=!1,n=!1,r=!1,o=-1;continue}if(H(s)){if(o<0)continue;if(j(e,o,"--")&&i-o===2){t=!1,n=!1,r=!1,o=-1;continue}let l=Gu(e,o,i);if(n||=l.recursive,r||=l.force,n&&r)return!0;o=-1;continue}if(o<0)o=i}return!1}function WC(e,t){if(S(e,t)!=="\\"||S(e,t-1)==="\\")return-1;if(j(e,t,String.raw`\n`))return t+2;if(j(e,t,String.raw`\x0a`)||j(e,t,String.raw`\x0A`))return t+5;if(j(e,t,String.raw`\u000a`)||j(e,t,String.raw`\u000A`))return t+7;return j(e,t,String.raw`\012`)?t+4:-1}function Gu(e,t,n){if(Fu(e,t,n,"recursive"))return{recursive:!0,force:!1};if(Fu(e,t,n,"force"))return{recursive:!1,force:!0};if(S(e,t)!=="-"||S(e,t+1)==="-")return{recursive:!1,force:!1};let r=!1,o=!1;for(let i=t+1;i<n;i++){let s=S(e,i);r||=s==="r"||s==="R",o||=s==="f"||s==="F"}return{recursive:r,force:o}}function Fu(e,t,n,r){let o=n-t-2;if(o<1||o>r.length||!j(e,t,"--"))return!1;for(let i=0;i<o;i++)if(S(e,t+i+2)!==r[i])return!1;return!0}function GC(e){let t=!1;for(let n=0;n<Z(e);n++){if(oe(S(e,n))){t=!1;continue}if(tt(e,n,"dd")){t=!0,n++;continue}if(!t||!tt(e,n,"of")||!j(e,n,"of=/dev/"))continue;let r=n+8;if(r<Z(e)&&!H(S(e,r))&&S(e,r)!=="'"&&S(e,r)!=='"')return!0}return!1}function FC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);){let i=S(e,o);if(o===Z(e)||oe(i)){t=!1,n=!1,r=!1,o++;continue}let s=BC(e,o);if(s>=0){if(zC(e,s))return!0;let a=s,l=!1;while(H(S(e,a)))l||=S(e,a)===`
+`,a++;if(l)n=!1,r=!1;t=!0,o=a;continue}if(!t){o++;continue}if(j(e,o,"--")&&(o===0||H(S(e,o-1)))&&(!S(e,o+2)||H(S(e,o+2))||oe(S(e,o+2)))){t=!1,n=!1,r=!1,o+=2;continue}if(n||=j(e,o,"--recursive")&&nt(e,o+11)||Vs(e,o,"recursive"),r||=j(e,o,"--force")&&nt(e,o+7)||Vs(e,o,"force"),n&&r)return!0;o++}return!1}function Vs(e,t,n){if(!j(e,t,"--"))return!1;let r=0;while(r<=n.length){let o=S(e,t+r+2);if(!o||H(o)||oe(o))break;if(o!==n[r])return!1;r++}return r>0&&nt(e,t+r+2)}function zC(e,t){let n=t,r=!1,o=!1;while(n<Z(e)){while(H(S(e,n)))n++;let i=n;while(n<Z(e)&&!H(S(e,n)))n++;if(S(e,i)!=="-"||n-i===2&&j(e,i,"--"))return!1;let s=zu(e,i,"recursive"),a=zu(e,i,"force");if(r&&a||o&&s)return!0;if(r||=s,o||=a,S(e,i+1)==="-")continue;let l=$C(e,i,n);if(l.combined||r&&l.forceAtBoundary||o&&l.recursiveAtBoundary)return!0;r||=l.recursive,o||=l.force}return!1}function zu(e,t,n){return j(e,t,`--${n}`)&&nt(e,t+n.length+2)||Vs(e,t,n)}function BC(e,t){if(t>0&&Wt(S(e,t-1)))return-1;let n=t;if(S(e,n)==="\\")n++;if(S(e,n)!=="r")return-1;if(n++,S(e,n)==="\\")n++;if(S(e,n)!=="m"||!H(S(e,n+1)))return-1;return n+1}function $C(e,t,n){let r=!1,o=!1,i=!1,s=!1,a=!1;if(S(e,t)!=="-")return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a};let l="";for(let c=t+1;c<n;c++){let d=S(e,c)??"",m=(d==="r"||d==="f")&&nt(e,c+1);r||=d==="r",o||=d==="f",i||=d==="r"&&m,s||=d==="f"&&m,a||=(l==="r"&&d==="f"||l==="f"&&d==="r")&&m,l=d}return{recursive:r,force:o,recursiveAtBoundary:i,forceAtBoundary:s,combined:a}}function Bu(e,t,n){return rr(e,"reset",gn,!0,(r)=>S(e,r)==="-"&&hn(e,r,t,n)?!0:r)}function UC(e){return rr(e,"clean",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(hn(e,t,"--fo","rce"))return!0;let n=nr(e,t,gn);for(let r=t+1;r<n;r++)if(S(e,r)==="f")return!0;return n-1})}function Eo(e,t,n){if(!tt(e,t,"git"))return null;let r=t+3;if(!H(S(e,r)))return{commandEnd:-1,next:r};while(H(S(e,r)))r++;while(r<Z(e)){if(oe(S(e,r)))return{commandEnd:-1,next:r};let o=nr(e,r,oe);if(tt(e,r,n))return{commandEnd:r+n.length,next:o};if(S(e,r)!=="-")return{commandEnd:-1,next:o};let i=o-r===2&&j(e,r,"--"),s=HC(e,r,o);r=o;while(H(S(e,r)))r++;if(i)return{commandEnd:tt(e,r,n)?r+n.length:-1,next:nr(e,r,oe)};if(!s)continue;if(r>=Z(e)||oe(S(e,r)))return{commandEnd:-1,next:r};r=nr(e,r,oe);while(H(S(e,r)))r++}return{commandEnd:-1,next:r}}function HC(e,t,n){for(let r of Ee)if(n-t===r.length&&j(e,t,r))return!0;return!1}function jC(e){return $u(e,{command:"checkout",longPrefix:"--fo",longOptional:"rce",shortFlag:"f",excludedShortStarts:"bBU"})}function VC(e){return rr(e,"push",gn,!0,(t)=>{if(S(e,t)!=="-")return t;if(S(e,t+1)==="f"&&!Wt(S(e,t+2))&&!j(e,t+2,"-with-lease"))return!0;let n=Hu(e,t,"--fo","rce");if(n>=0&&!j(e,n,"-with-lease"))return!0;return t})}function KC(e){return rr(e,"push",oe,!1,(t)=>{if(H(S(e,t))&&S(e,t+1)==="+"&&t+2<Z(e)&&!oe(S(e,t+2))&&!H(S(e,t+2)))return!0;if(S(e,t)===":"&&S(e,t+1)==="+")return!0;return t})}function qC(e){return rr(e,"push",oe,!1,(t)=>{if(S(e,t)==="-"&&hn(e,t,"--de","lete"))return!0;if(H(S(e,t))&&S(e,t+1)===":"&&t+2<Z(e)&&!H(S(e,t+2))&&!oe(S(e,t+2)))return!0;return t})}function YC(e){let t=!1,n=!1,r=!1;for(let o=0;o<=Z(e);o++){if(o===Z(e)||oe(S(e,o))){if(n&&r)return!0;t=!1,n=!1,r=!1;continue}if(!t){let a=Eo(e,o,"branch");if(a){t=a.commandEnd>=0,o=Math.max(o,(t?a.commandEnd:a.next)-1);continue}}if(!t||S(e,o)!=="-")continue;let i=nr(e,o,oe),s=ZC(e,o,i);if(n||=s.deletion,r||=s.force,n&&r)return!0;o=i-1}return!1}function ZC(e,t,n){let r=!1,o=!1;for(let i=t;i<n;i++){if(S(e,i)!=="-")continue;if(hn(e,i,"--de","lete"))r=!0;if(hn(e,i,"--fo","rce"))o=!0;if(S(e,i+1)==="-")continue;let s=i+1,a=!1,l=!1,c=!1;while(s<n&&XC(S(e,s))){let d=S(e,s);a||=d==="d"||d==="D",l||=d==="f",c||=d==="D",s++}if(!nt(e,s))continue;r||=a,o||=l||c}return{deletion:r,force:o}}function XC(e){if(!e)return!1;let t=e.charCodeAt(0);return t>=65&&t<=90||t>=97&&t<=122}function JC(e){return $u(e,{command:"tag",longPrefix:"--de",longOptional:"lete",shortFlag:"d",excludedShortStarts:""})}function $u(e,t){let n=[{outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:0,quote:"",escaped:!1}];for(let r=0;r<Z(e);r++){let o=S(e,r),i=n[n.length-1];if(!i)return!1;let s=i.escaped;if(i.escaped=!s&&i.quote!=="'"&&o==="\\",!s&&o==="'"&&i.quote!=='"')i.quote=i.quote==="'"?"":"'";if(!s&&o==='"'&&i.quote!=="'")i.quote=i.quote==='"'?"":'"';if(o==="$"&&S(e,r+1)==="("&&(n.length===1||!s&&i.quote!=="'")){n.push({outerActive:!1,shortActive:!1,hasShortFlag:!1,depth:1,quote:"",escaped:!1}),r++;continue}if(!s&&!i.quote&&n.length>1&&o==="("){i.depth++;continue}if(!s&&!i.quote&&n.length>1&&o===")"){if(i.depth--,i.depth===0)n.pop();continue}if(H(o))i.shortActive=!1,i.hasShortFlag=!1;if(!i.outerActive){let a=Eo(e,r,t.command);if(a){i.outerActive=a.commandEnd>=0&&H(S(e,a.commandEnd)),i.shortActive=!1,i.hasShortFlag=!1,r=Math.max(r,(i.outerActive?a.commandEnd:a.next)-1);continue}}if(i.outerActive&&o==="-"){if(hn(e,r,t.longPrefix,t.longOptional))return!0;i.shortActive||=!t.excludedShortStarts.includes(S(e,r+1)??"")}if(i.hasShortFlag||=i.shortActive&&o===t.shortFlag,i.hasShortFlag&&nt(e,r+1))return!0;if(gn(o))i.outerActive=!1}return!1}function rr(e,t,n,r,o){let i=!1;for(let s=0;s<Z(e);s++){let a=S(e,s),l=n(a);if(!i&&!l){let c=Eo(e,s,t);if(c){i=c.commandEnd>=0&&(!r||H(S(e,c.commandEnd))),s=Math.max(s,(i?c.commandEnd:c.next)-1);continue}}if(i){let c=o(s);if(c===!0)return!0;for(let d=s;d<=c;d++)if(n(S(e,d)))i=!1;s=c}if(l)i=!1}return!1}function QC(e){let t=!1;for(let n=0;n<Z(e);n++){if(js(S(e,n))){if(t)return!0;t=!1;continue}if(!t){let r=Eo(e,n,"restore");if(r){t=r.commandEnd>=0,n=Math.max(n,(t?r.commandEnd:r.next)-1);continue}}if(t&&S(e,n)==="-"&&S(e,n+1)==="-"&&(j(e,n+2,"staged")||j(e,n+2,"help")))t=!1}return t}function Uu(e,t){let n=!1;for(let r=0;r<Z(e);r++){let o=S(e,r),i=t?js(o):oe(o);if(n&&H(o)&&S(e,r+1)==="-"&&tt(e,r+2,"delete"))return!0;if(i){n=!1;continue}if(tt(e,r,"find"))n=!0,r+=3}return!1}function nr(e,t,n){let r=t;while(r<Z(e)&&!H(S(e,r))&&!n(S(e,r)))r++;return r}function Hu(e,t,n,r){if(!j(e,t,n))return-1;let o=t+n.length;for(let i=0;i<r.length&&S(e,o)===r[i];i++)o++;return nt(e,o)?o:-1}function hn(e,t,n,r){return Hu(e,t,n,r)>=0}function Te(e,t){tr(t,e,2);let n=e.toLowerCase(),r=n.trimStart(),o=r.startsWith("echo ")||r.startsWith("rg "),i=[{scan:"rm",label:"rm -rf"},{scan:"reset-hard",label:"git reset --hard"},{scan:"reset-merge",label:"git reset --merge"},{scan:"clean",label:"git clean -f"},{scan:"checkout",label:"git checkout --force"},{scan:"push-force",label:"git push --force"},{scan:"push-refspec",label:"git push --force"},{scan:"push-delete",label:"git push delete"},{scan:"branch",label:"git branch -D",caseSensitive:!0},{scan:"tag",label:"git tag -d"},{regex:/\bgit\s+stash\s+(drop|clear)\b/,label:"git stash drop/clear"},{regex:/\bgit\s+checkout\s+--\s/,label:"git checkout --"},{scan:"restore",label:"git restore without --staged"},{scan:"find",label:"find -delete",skipForEchoRg:!0},{regex:/\bdd\b[^\n|;&]*\bof=\/dev\/\S/,label:"dd of=/dev/",skipForEchoRg:!0},{regex:/\bmkfs(?:\.[a-z0-9_-]+)?\s+\/dev\/\S/,label:"mkfs /dev/",skipForEchoRg:!0},{regex:/\bshred\b\s+\S/,label:"shred",skipForEchoRg:!0},{regex:/\b(?:curl|wget|fetch|aria2c|https?|xhs?|ncat|netcat|nc)\b(?:[^\n|;&]|\\\n)*\|(?:\s|\\\n)*(?:(?:sudo|env|command|builtin)(?:\s+(?:-\S+|\w+=\S*))*\s+)?(?:[^\s|;&]*\/)?(?:ba|da|z|k)?sh(?![^\s;&|])/,label:"download piped to shell",skipForEchoRg:!0}];for(let s of i){if(s.skipForEchoRg&&o)continue;let a=s.caseSensitive?e:n;if(s.regex)we(t,a);if((s.regex?.test(a)??!1)||s.scan&&vo(a,s.scan,t))return v("raw-text.dangerous-command",`Unparseable command text contains a destructive pattern (${s.label}). Rewrite as a plain, parseable command so it can be analyzed.`)}return null}var eb=/^[A-Za-z_][A-Za-z0-9_]*=/;function Vu(e,t,n){let r=e.words[0];if(!t||!r||e.words.length!==1||e.dialect!=="posix")return!1;if(!r.quoted||r.provenance!=="literal")return!1;let o=/^([A-Za-z_][A-Za-z0-9_]*)=/.exec(r.text)?.[1];if(!o)return!1;tr(n,t.source,2);let i={anchored:new RegExp(`^\\$\\{?${o}(?![A-Za-z0-9_])`),loose:new RegExp(`\\$\\{?${o}(?![A-Za-z0-9_])`)};return Ku(t.nodes,r,i)}function Ku(e,t,n){return e.every((r)=>{if(r.kind==="connector")return!0;if(r.kind==="group"||r.kind==="function")return Ku(r.body.nodes,t,n);if(r.kind==="unknown")return!n.loose.test(r.source);return tb(r,t,n)})}function tb(e,t,n){if(e.nested.some((o)=>n.loose.test(o.source)))return!1;let r=e.words.findIndex((o)=>!eb.test(o.text));return e.words.every((o,i)=>o===t||ju(o.raw,n.anchored,i!==r))&&e.redirections.every((o)=>(!o.heredoc||o.heredoc.quotedDelimiter||!n.loose.test(o.heredoc.body))&&(!o.target||ju(o.target.raw,n.anchored,!0)))}function ju(e,t,n){let r=!1,o=!1;for(let i=0;i<e.length;i++){let s=e[i];if(s==="\\"&&!r){i++;continue}if(!o&&s==="'"){r=!r;continue}if(!r&&s==='"'){o=!o;continue}if(r||s!=="$")continue;if(!t.test(e.slice(i)))continue;if(!o||!n)return!1}return!0}import{isAbsolute as nb,resolve as qu}from"path";function or(e,t,n,r){let o=nb(e)?qu(e):t?qu(t,e):void 0;if(!o)return;try{return L(o,n,r)}catch{return o}}function Yu(e){return!["/dev","/proc","/sys"].some((t)=>e===t||e.startsWith(`${t}/`))}var yn="Interpreter code contains a dangerous command. Run the underlying command directly so it can be analyzed, or use the safer alternative for that command.",ir="Interpreter one-liners are blocked by the active safety policy. Write the code to a script file and run it, or run the equivalent shell command directly.",qs=new Map([["python",new Set(["-c"])],["node",new Set(["-e","--eval"])],["ruby",new Set(["-e"])],["perl",new Set(["-e","-E"])]]),rb=new Set(["-p","--print"]),ob=new Map([["python",new Set(["c"])],["node",new Set(["e"])],["ruby",new Set(["e"])],["perl",new Set(["e","E"])]]),ib=new Map([["python",new Set(["W","X"])],["node",new Set(["C","r"])],["ruby",new Set(["C","E","F","I","r"])],["perl",new Set(["F","I","M","m"])]]),sb=new Map([["ruby",new Set(["0","K","W","x"])],["perl",new Set(["0","C","D","V","d","i","l","x"])]]),ab=new Map([["python",new Set(["m"])]]),lb=new Map([["node",new Set(["--allow-fs-read","--allow-fs-write","--conditions","--cpu-prof-dir","--cpu-prof-interval","--cpu-prof-name","--debug-port","--diagnostic-dir","--disable-proto","--disable-warning","--dns-result-order","--env-file","--env-file-if-exists","--experimental-package-map","--experimental-test-isolation","--experimental-test-tag-filter","--heap-prof-dir","--heap-prof-interval","--heap-prof-name","--heapsnapshot-near-heap-limit","--heapsnapshot-signal","--icu-data-dir","--input-type","--inspect-port","--inspect-publish-uid","--localstorage-file","--max-http-header-size","--max-old-space-size-percentage","--network-family-autoselection-attempt-timeout","--openssl-config","--redirect-warnings","--report-dir","--report-directory","--report-filename","--report-signal","--secure-heap","--secure-heap-min","--test-concurrency","--test-coverage-branches","--test-coverage-exclude","--test-coverage-functions","--test-coverage-include","--test-coverage-lines","--test-global-setup","--test-isolation","--test-name-pattern","--test-random-seed","--test-reporter","--test-reporter-destination","--test-rerun-failures","--test-shard","--test-skip-pattern","--test-timeout","--title","--tls-cipher-list","--tls-keylog","--trace-event-categories","--trace-event-file-pattern","--trace-require-module","--unhandled-rejections","--use-largepages","--v8-pool-size","--watch-kill-signal"])],["python",new Set(["--check-hash-based-pycs"])],["ruby",new Set(["--backtrace-limit","--crash-report","--disable","--enable","--encoding","--external-encoding","--internal-encoding","--parser"])]]),cb=new Set(["always","default","never"]),ub=new Set(["--backtrace-limit","--crash-report","--disable","--enable"]),db=/\\\r?\n/g,mb=new Map([["python",[{selector:"-c",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-m",kind:"module-file",valueForm:"attached-or-separate"}]],["node",[{selector:"-e",kind:"inline-code",valueForm:"separate-only"},{selector:"--eval",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-p",kind:"inline-code",valueForm:"separate-only"},{selector:"--print",kind:"inline-code",valueForm:"separate-only"},{selector:"-r",kind:"module-file",valueForm:"separate-only"},{selector:"--require",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--import",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--loader",kind:"module-file",valueForm:"equals-or-separate"},{selector:"--experimental-loader",kind:"module-file",valueForm:"equals-or-separate"}]],["ruby",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-r",kind:"module-file",valueForm:"attached-or-separate"}]],["perl",[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-E",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"-M",kind:"module-file",valueForm:"attached-only"},{selector:"-m",kind:"module-file",valueForm:"attached-only"}]]]);function Zu(e){return Ro(e).code}function xo(e){return Ro(e).sources}function Xu(e){return mb.get(Zs(e))??[]}function Ro(e){let t=Zs(e[0]??"");if(!qs.has(t))return{code:null,sources:[],optionsOpen:!1};let n=[],r=[],o=!0;for(let i=1;i<e.length;i++){let s=e[i];if(s===void 0)break;if(s==="--")return Le(t,n,r,o,e[i+1]===void 0?void 0:i+1,e[i+1]);if(s===""||s==="-"||!s.startsWith("-"))return Le(t,n,r,o,i,s);if(t==="node"&&rb.has(s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(m.startsWith("-"))continue;n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),i++;continue}if(pb(t,s)){let m=e[i+1];if(m===void 0)return Le(t,n,r,o);if(n.push({tokenIndex:i+1,value:m}),r.push({tokenIndex:i+1,kind:"inline-code",value:m}),t==="python")return Le(t,n,r,o);i++;continue}let a=/^--eval=(.*)$/s.exec(s);if(gb(t)&&a){let m=a[1]??"";n.push({tokenIndex:i,value:m}),r.push({tokenIndex:i,kind:"inline-code",value:m});continue}if(t==="node"){let m=fb(s);if(m){if(m.attached){if(o&&=m.value!=="",m.value!=="")r.push({tokenIndex:i,kind:"module-file",value:m.value});continue}let u=e[i+1];if(u===void 0||u.startsWith("-"))return o=!1,Le(t,n,r,o);r.push({tokenIndex:i+1,kind:"module-file",value:u}),i++;continue}}if(t==="python"&&s.startsWith("--check-hash-based-pycs=")||t==="node"&&(s==="--conditions="||s==="--diagnostic-dir="||s==="--title=")||t==="ruby"&&(s==="--disable="||s==="--enable="))return Le(t,n,r,o);if(lb.get(t)?.has(s)){let m=e[i+1];if(m===void 0||m.startsWith("-")&&!(t==="ruby"&&ub.has(s))||t==="python"&&!cb.has(m))return Le(t,n,r,o);i++;continue}if(s.startsWith("--"))continue;let l,c=!1;for(let m=1;m<s.length;m++){let u=s[m];if(u===void 0)break;if(ab.get(t)?.has(u)){let f=s.slice(m+1),p=f||e[i+1];if(p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});return Le(t,n,r,o)}if(ob.get(t)?.has(u)){l=s.slice(m+1)||e[i+1],c=m+1===s.length;break}if(t==="node"&&u==="r"){if(o&&=s==="-r",s==="-r"){let f=e[i+1];if(o&&=f!==void 0&&!f.startsWith("-"),o&&f!==void 0)r.push({tokenIndex:i+1,kind:"module-file",value:f});i++}break}if(t==="ruby"&&u==="r"){let f=s.slice(m+1),p=f||e[i+1];if(o&&=p!==void 0,p!==void 0)r.push({tokenIndex:f?i:i+1,kind:"module-file",value:p});if(!f)i++;break}if(t==="perl"&&(u==="M"||u==="m")){let f=s.slice(m+1);if(!f){if(o=!1,m+1===s.length)i++;break}r.push({tokenIndex:i,kind:"module-file",value:f});break}if(ib.get(t)?.has(u)){if(m+1===s.length)i++;break}if(sb.get(t)?.has(u)&&m+1<s.length)break}if(l===void 0)continue;let d=c?i+1:i;if(n.push({tokenIndex:d,value:l}),r.push({tokenIndex:d,kind:"inline-code",value:l}),t==="python")return Le(t,n,r,o);if(c)i++}return Le(t,n,r,o,void 0,void 0,!0)}function Le(e,t,n,r,o,i,s=!1){let a=e==="node"?t.slice(-1):t,l=new Set(a.map((d)=>d.tokenIndex)),c=n.filter((d)=>d.kind!=="inline-code"||l.has(d.tokenIndex));if(r&&t.length===0&&o!==void 0&&i!==void 0)c.push({tokenIndex:o,kind:"main-script",value:i});return{code:(e==="node"?a[0]?.value:a.map((d)=>d.value).join(`
+`))||null,sources:r?c:[],optionsOpen:r&&s}}function fb(e){for(let t of["--import","--loader","--experimental-loader","--require"]){if(e===t)return{attached:!1,value:""};if(e.startsWith(`${t}=`))return{attached:!0,value:e.slice(t.length+1)}}return}function Ys(e,t){return Zs(e)==="node"&&/^\s*console\.(?:log|info|warn|error)\(\s*(?:"(?:\\.|[^"\\\r\n])*"|'(?:\\.|[^'\\\r\n])*')\s*\)\s*;?\s*$/.test(t)}function Zs(e){let t=T(e).toLowerCase();return Hr.test(t)?"python":t}function pb(e,t){return qs.get(e)?.has(t)??!1}function gb(e){return qs.get(e)?.has("--eval")??!1}function sr(e,t,n=!1){let r=Cb(e,t);if(!Ks(r,t))return!1;we(t,r);let o=yb(r);if(Ks(o,t))return!0;if(we(t,o),!Ju.test(o))return!1;return!n||hb(r,t)}function hb(e,t){if(/`|%x|\bqx\b/.test(e))return!0;let r=e.split(""),o=[];for(let l=0;l<e.length;l++){let c=e[l];if(c!=="'"&&c!=='"')continue;let d=e.startsWith(c.repeat(3),l)?c.repeat(3):c,m=l+d.length,u=m;while(u<e.length&&!e.startsWith(d,u))u+=e[u]==="\\"?2:1;if(u>=e.length)return!0;o.push({start:m,text:e.slice(m,u)}),r.fill(" ",l,u+d.length),l=u+d.length-1}let i=r.join(""),s=Array.from(i.matchAll(/([\w$]+(?:\s*\.\s*[\w$]+)*)\s*\(/g)).filter((l)=>Ju.test(l[1]??"")).map((l)=>{let c=l.index+l[0].length;return{start:c,end:Xs(i,c)}});if(s.some((l)=>Js(i,l.start)))return!0;return o.some((l)=>{let c=/\b(?:system|exec|spawn|popen)\s*$/.test(i.slice(0,l.start)),d=s.some((m)=>l.start>=m.start&&l.start<m.end);return(c||d)&&Ks(l.text,t)})}function Xs(e,t){let n=1;for(let r=t;r<e.length;r++){if(e[r]==="(")n++;if(e[r]===")")n--;if(n===0)return r}return e.length}function Js(e,t){let n=0;for(let r=t;r<e.length;r++){let o=e[r]??"";if("([{".includes(o))n++;if(")]}".includes(o)&&n--===0)return!1;if(o===","&&n===0)return!1;if(/[A-Za-z_$]/.test(o))return!0}return!1}var Ju=/`|%x|\b(?:system|exec|spawn|popen|subprocess|child_process|open3|eval|fork|qx)/i;function yb(e){let t=[],n=0,r=0;while(r<e.length){let o=e[r];if(o!=="'"&&o!=='"'){r++;continue}let i=e.startsWith(o.repeat(3),r)?o.repeat(3):o,s=r+i.length;while(s<e.length&&!e.startsWith(i,s))s+=e[s]==="\\"?2:1;if(s>=e.length)break;t.push(e.slice(n,r)," "),r=s+i.length,n=r}return t.push(e.slice(n)),t.join("")}function Ks(e,t){if(So(e,"rm",t))return!0;for(let r of[/\bgit[^\S\n]+checkout[^\S\n]+--[^\S\n]/,/\bgit[^\S\n]+stash[^\S\n]+(drop|clear)\b/])if(we(t,e),r.test(e))return!0;if(So(e,"dd",t))return!0;for(let r of[/\bmkfs(?:\.[A-Za-z0-9_-]+)?\s+\/dev\/[^\s'"]+/,/\bshred\b\s+/])if(we(t,e),r.test(e))return!0;if(So(e,"find",t))return!0;let n=e.split(/[\n\r\u2028\u2029]/);return["reset-hard","reset-merge","clean","checkout","push-force","push-refspec","push-delete","branch","tag","restore"].some((r)=>(we(t,e),n.some((o)=>vo(o,r))))}function Cb(e,t){return we(t,e),e.replace(db,"")}import{lstatSync as gS,readdirSync as hS}from"fs";import{basename as yS,isAbsolute as xd,join as CS,relative as Rd}from"path";import{isAbsolute as id,parse as Pb}from"path";import{dirname as bb,isAbsolute as Sb,parse as vb,sep as Eb}from"path";function ht(e,t,n){if(et(t))throw Error("Unsupported Windows namespace path");let r=Sb(t)?vb(t).root:"",o=r||e;for(let i of Rb(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=bb(o);continue}let s=xb(o,i),a=n.entryKind(s),l=a==="symlink"?n.realpath(s):s;if(a==="missing"||l===null)throw Error(`Cannot resolve path component: ${s}`);o=l}return o}function xb(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${Eb}${t}`}function Rb(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}var Qs=["GIT_DIR","GIT_WORK_TREE","GIT_COMMON_DIR","GIT_INDEX_FILE"],wb=new Set(Qs),_b=1024,Qu=new Set(["GIT_CONFIG_GLOBAL","GIT_CONFIG_NOSYSTEM","GIT_CONFIG_SYSTEM","HOME","XDG_CONFIG_HOME"]),ed=new Set(["GIT_SSH_COMMAND","GIT_SSH","GIT_SSH_VARIANT"]),Ab=/^([A-Za-z_][A-Za-z0-9_]*)\+=/;function wo(e){return wb.has(e)}function ea(e){return wo(e)||Qu.has(e)||ed.has(e)||Hn(e)}function rt(e,t,n){return n?.has(e)?n.get(e):t.get(e)}function td(e,t){let n=rt("GIT_CONFIG_COUNT",e,t);if(n===void 0)return{state:"absent"};if(n==="")return{state:"valid",count:0};if(!/^\d+$/.test(n))return{state:"invalid"};let r=Number(n);return Number.isSafeInteger(r)&&r<=_b?{state:"valid",count:r}:{state:"invalid"}}function _o(e,t,n){let o=e.match(Ab)?.[1];if(!o||!ea(o))return null;let i=e.indexOf("=");return{name:o,value:`${rt(o,t,n)??""}${e.slice(i+1)}`}}function nd(e){return od(e,ed)}function rd(e){return od(e,Qu)}function od(e,t){if(!e)return!1;for(let n of e.keys())if(t.has(n))return!0;return!1}var ad=/^[A-Za-z_][A-Za-z0-9_]*=/;function Ie(e){if(!ad.test(e))return null;let t=e.indexOf("=");return{name:e.slice(0,t),value:e.slice(t+1)}}function Ao(e){let t=new Map,n=0;while(n<e.length){let r=e[n];if(!r)break;let o=Ie(_(r));if(!o)break;t.set(o.name,o.value),n++}return{words:e.slice(n),envAssignments:t}}function ld(e){let t=O(e);return e.includes("=")||t==="sudo"||t==="env"||t==="command"||t==="builtin"}function Gt(e,t,n,r){if(!ld(Cn(e)))return{words:e,envAssignments:new Map,cwd:n,rewritten:!1};let o=new Set(e),i=e,s=new Map,a=new Map(r??[]),l=[],c=n;for(let m=0;m<K.wrapperPeelIterations.cap;m++){let u=sd(i),f=Ao(i);for(let[g,h]of f.envAssignments)s.set(g,h),a.set(g,h);if(i=f.words,i.length===0)break;while(i.length>0&&Cn(i).includes("=")&&!Ib(i)){let g=kb(Cn(i),a,t.env)??_o(Cn(i),t.env,a);if(g)s.set(g.name,g.value),a.set(g.name,g.value);i=i.slice(1)}if(i.length===0)break;let p=O(Cn(i));if(p!=="sudo"&&p!=="env"&&p!=="command"&&p!=="builtin")break;if(p==="sudo"){let g=Mb(i,t.paths,c);if(i=g.words,g.cwd!==void 0)c=g.cwd}if(p==="env"){let g=Lb(i,c,a,t);if(l.push(...g.envSplitValues??[]),i=g.words,g.cwd!==void 0)c=g.cwd;for(let[h,y]of g.envAssignments)s.set(h,y),a.set(h,y)}if(p==="command")i=Wb(i);if(p==="builtin")i=i.slice(We(i,1)==="--"?2:1);if(sd(i)===u)break}let d=Ao(i);for(let[m,u]of d.envAssignments)s.set(m,u),a.set(m,u);return{words:d.words,envAssignments:s,cwd:c,envSplitValues:l.length>0?l:void 0,rewritten:Tb(d.words,o)}}function Tb(e,t){return e.some((n)=>!t.has(n))}function sd(e){return e.map(_).join(" ")}function Cn(e){let t=e[0];return t?_(t):""}function We(e,t){let n=e[t];return n?_(n):void 0}function Ib(e){return ad.test(Cn(e))}function kb(e,t,n){if(!e.startsWith("TMPDIR+="))return null;return{name:"TMPDIR",value:`${t.get("TMPDIR")??n.get("TMPDIR")??""}${e.slice(8)}`}}var Ob=new Set(["-u","-g","-C","-D","-h","-p","-r","-t","-T","-U"]);function Mb(e,t,n){let r=1,o=n;while(r<e.length){let i=We(e,r);if(!i)break;if(i==="--")return{words:e.slice(r+1),cwd:o};if(!i.startsWith("-"))break;if(i==="-D"||i==="--chdir"){let s=We(e,r+1);o=s?ar(o,s,t):null,r+=2;continue}if(i.startsWith("--chdir=")){o=ar(o,i.slice(8),t),r++;continue}if(i.startsWith("-D")&&i.length>2){o=ar(o,i.slice(2),t),r++;continue}if(i==="-i"||i==="--login"){o=null,r++;continue}if(Ob.has(i)){r+=2;continue}r++}return{words:e.slice(r),cwd:o}}var Db=new Set(["-i","-0","--null"]),Nb=new Set(["-u","--unset","-C","--chdir","-P"]);function Lb(e,t,n,r){let o=new Map,i=[],s=t,a=1,l=(c)=>({words:e.slice(c),envAssignments:o,cwd:s,envSplitValues:i.length>0?i:void 0});while(a<e.length){let c=We(e,a);if(!c)break;if(c==="--")return l(a+1);if(c==="-i"||c==="--ignore-environment"||c==="-"){o.clear();for(let m of n.keys())o.set(m,"");o.set("TMPDIR",""),a++;continue}if(Db.has(c)){a++;continue}if(c==="-u"||c==="--unset"){let m=We(e,a+1);if(m!==void 0)o.set(m,"");a+=2;continue}if(c.startsWith("-u")&&c.length>2&&!c.startsWith("-u=")){o.set(c.slice(2),""),a++;continue}if(c.startsWith("--unset=")){o.set(c.slice(8),""),a++;continue}let d=c==="-S"||c==="--split-string"?{value:We(e,a+1),consumed:2}:c.startsWith("-S")&&c.length>2?{value:c.slice(2),consumed:1}:c.startsWith("--split-string=")?{value:c.slice(15),consumed:1}:null;if(d){if(d.value!==void 0)i.push(d.value);return s=null,l(a+d.consumed)}if(Nb.has(c)){if(c==="-C"||c==="--chdir"){let m=We(e,a+1);s=m?ar(s,m,r.paths):null}a+=2;continue}if(c.startsWith("-u=")){a++;continue}if(c.startsWith("-C")&&c.length>2||c.startsWith("--chdir=")){let m=c.startsWith("--chdir=")?c.slice(8):c.startsWith("-C=")?c.slice(3):c.slice(2);s=ar(s,m,r.paths),a++;continue}if(c.startsWith("-P")){a++;continue}if(c.startsWith("-")){a++;continue}if(!Ie(c))break;while(a<e.length){let m=Ie(We(e,a)??"");if(!m)break;o.set(m.name,m.value),a++}if(We(e,a)==="--")a++;return l(a)}return l(a)}function ar(e,t,n){if(t==="")return null;if(!e&&!id(t))return null;let r=id(t)?Pb(t).root:n.realpath(e??"/");if(r===null)return null;try{return ht(r,t,n)}catch{return null}}function Wb(e){if(We(e,1)==="-v")return[...q(["type"]),...e.slice(2)];let t=1;while(t<e.length){let n=We(e,t);if(!n)break;if(n==="-p"||n==="-v"||n==="-V"){t++;continue}if(n==="--")return e.slice(t+1);if(n.startsWith("-")&&!n.startsWith("--")&&n.length>1){if(!/^[pvV]+$/.test(n.slice(1)))break;t++;continue}break}return e.slice(t)}var Gb=/['"\\$`{}#]/;function Po(e,t){if(e.some((r)=>Gb.test(r)))return null;let n=[...e.flatMap((r)=>r.split(/\s+/).filter((o)=>o.length>0)),...t];return n.length<=64?n:null}function yt(e,t,n){return To(e,t,n).tokens}function Fb(e){let t=[],n="",r=0;while(r<e.length){let o=e.charAt(r);if(o==='"'||o==="'"){let i=e.indexOf(o,r+1);if(i===-1)return e.split(/\s+/).map((s)=>s.replace(/["']/g,"")).filter((s)=>s.length>0);n+=e.slice(r+1,i),r=i+1;continue}if(/\s/.test(o)){if(n.length>0)t.push(n);n="",r++;continue}n+=o,r++}if(n.length>0)t.push(n);return t}function Ct(e,t,n,r=0){let o=To(e,t,n),i=(o.envSplitValues??[]).flatMap(Fb);if(i.length===0)return o.tokens;let s=[...i,...o.tokens];if(r>=8)return s;return Ct(s,t,n,r+1)}function To(e,t,n,r){if(!ld(e[0]??""))return{tokens:[...e],envAssignments:new Map,cwd:n};let o=Gt(q(e),t,n,r);return{tokens:o.words.map(_),envAssignments:o.envAssignments,cwd:o.cwd,envSplitValues:o.envSplitValues}}var oa=Symbol("adopt-as-operand"),zb=new Set(["env","sudo","command","builtin"]),Bb=new Set(["&&","||","|&","|","&",";"]),$b=new Set(["<<","<<<",">|"]),Ub=new Set(["|","|&"]),Hb=/[*@#?$!_-]/,jb=/^\w+(?::\w+)*/,Vb=Object.freeze([]),lr=Object.freeze({kind:"scope",edge:"enter"}),cr=Object.freeze({kind:"scope",edge:"exit"}),Kb=Object.freeze([]),qb=new Set(["python","python2","python3","node","deno","bun","ruby","perl","php","rscript","osascript","bash","sh","zsh","dash","ksh"]),ur=new Set(["bash","sh","zsh","dash","ksh"]),Yb=256,fd=new WeakMap;function pd(e,t){let n=t.status==="complete"?new Set(ra(t)):new Set,r=Jb(e,n);if(Vr(r))return Io("unclosed-quote",r,t);let o={invalid:!1,limited:!1,expansions:0,assignmentFallbacks:[]},i=Ft(t,{source:r,suppressed:n,flags:o,depth:0,functions:new Map,powershell:t.dialect==="powershell"});if(o.limited)return Io("structural-limit",r,t);if(o.invalid)return Io("invalid",r,t);let s=Io("complete",r,t,o.assignmentFallbacks);return fd.set(s,Object.freeze(i)),s}function Oo(e,t,n,r,o){let i=o.word??((m)=>m),s={cwd:t,variables:new Map,previous:null},a=[],l=new Set,c=null,d=[];for(let m of gd(e)){if(m.kind==="scope"){if(m.edge==="enter"){d.push({state:s,segment:[...a],shellWords:new Set(l),pipeProducer:c});continue}let u=o.segment(a,s,c,null,l);if(u)return u;let f=d.pop();if(f===void 0)throw Error("scope exit without a matching enter");s=f.state,a=f.segment,l=f.shellWords,c=f.pipeProducer;continue}if(m.kind==="operator"){if(!m.boundary)continue;let u=o.segment(a,s,c,m.operator,l);if(u)return u;s=Zb(a,s,n,r),c=a.length>0&&Ub.has(m.operator)?a:null,a=[],l=new Set;continue}if(m.kind==="redirection"){if(m.fd!==void 0)l.add(a.length-1);if(m.target===void 0)continue;let u=o.redirection({operator:m.operator,role:m.role,targetOrder:m.targetOrder,target:m.target,...m.body===void 0?{}:{body:m.body,consumer:m.consumer}},s);if(u===oa){l.add(a.length),a.push(i(m.target));continue}if(u)return u;continue}a.push(i(m.text))}return o.segment(a,s,c,null,l)}function Mo(e){return gd(e).flatMap((t)=>{if(t.kind==="word")return[{kind:"word",text:t.text}];if(t.kind==="operator")return[{kind:"operator",boundary:t.boundary}];if(t.kind==="redirection")return[{kind:"redirection",target:t.target}];return[]})}function pe(e,t){return e.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(:?[-+])([^}]*)\}/g,(n,r,o,i)=>{let s=t.get(r);if(s===void 0)return n;let a=o.startsWith(":")?s!=="":!0;if(o.endsWith("-"))return a?s:pe(i,t);return a?pe(i,t):""}).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g,(n,r)=>t.get(r)??n).replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(n,r)=>t.get(r)??n)}function dr(e){return e.length>0&&e.every((t)=>/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(t))}function Zb(e,t,n,r){let o=dr(e)?new Map([...t.variables,...Xb(e,t.variables)]):t.variables,i=yt([...e],n),s=T(i[0]??"").toLowerCase()==="cd"?i[1]:void 0;if(!s)return{...t,variables:o};if(s==="-"){if(t.previous===null)return{...t,variables:o};return{cwd:t.previous,variables:o,previous:t.cwd}}return{cwd:le(pe(s,o),t.cwd,n,r),variables:o,previous:t.cwd}}function Xb(e,t){return e.flatMap((n)=>{let r=/^([A-Za-z_][A-Za-z0-9_]*)(.*)$/.exec(n),o=r?.[2]?.startsWith("=")?r[2].slice(1):void 0;return r?.[1]!==void 0&&o!==void 0?[[r[1],pe(o,t)]]:[]})}function gd(e){return fd.get(e)??Vb}function Jb(e,t){return[...t].reduce((n,r)=>n.slice(0,r.start)+" ".repeat(r.end-r.start)+n.slice(r.end),e)}function Io(e,t,n,r=Kb){return Object.freeze({status:e,source:t,program:n,assignmentFallbacks:Object.freeze(r)})}function Ft(e,t){return e.nodes.flatMap((n,r)=>Qb(n,e,r,t)).sort((n,r)=>n.start-r.start).flatMap((n)=>[...n.events])}function Qb(e,t,n,r){if(e.kind==="connector")return[{start:e.span.start,events:[Ge(oS(e.operator))]}];if(e.kind==="unknown")return[{start:e.span.start,events:[Ge(e.source)]}];if(e.kind==="function")return r.functions.set(e.name,e.body),[];if(e.kind==="group"){let i=e.style!=="subshell",s=r.source[e.span.end-1]===(i?"}":")"),a=i?r:{...r,functions:new Map(r.functions)};return[{start:e.span.start,events:i?[ko("{"),...Ft(e.body,a),...s?[ko("}")]:[]]:[lr,Ge("("),...Ft(e.body,a),...s?[Ge(")")]:[],cr]}]}let o=lS(e,r.functions);if(o){if(r.depth>=gt.maxDepth||++r.flags.expansions>Yb)return r.flags.limited=!0,[];return[{start:e.span.start,events:[...cd(e,r),ko(";"),...Ft(o,{...r,depth:r.depth+1}),ko(";")]},...ud(e,t,n,r)]}return[{start:e.span.start,events:cd(e,r)},...ud(e,t,n,r)]}function cd(e,t){return[...e.words.map((n)=>({start:n.span.start,events:yd(n,e,t,!1)})),...e.redirections.map((n)=>({start:n.span.start,events:eS(n,e,t)}))].sort((n,r)=>n.start-r.start).flatMap((n)=>n.events)}function eS(e,t,n){let r=e.operator==="<<-"?"<<":e.operator,o=e.target?yd(e.target,t,n,!0):[],i=o[0],s=i?.kind==="word"?i.text:void 0;return[...e.fd===void 0?[]:[ia(String(e.fd))],Object.freeze({kind:"redirection",operator:r,...e.fd===void 0?{}:{fd:e.fd},role:iS(r),targetOrder:$b.has(r)?"legacy-segment":"immediate",...s===void 0?{}:{target:s},...e.heredoc&&n.suppressed.has(e.heredoc.bodySpan)?{body:e.heredoc.body,consumer:bd(t)}:{}}),...s===void 0?o:o.slice(1)]}function ud(e,t,n,r){let o=e.redirections.filter((i)=>i.operator==="<<"||i.operator==="<<-");return[...o.flatMap((i)=>{let s=i.heredoc;if(!s)return[];let a=[ia(s.delimiter),.../[\r\n]/.test(r.source[s.terminatorSpan.end]??"")?[Ge(";")]:[]];if(r.suppressed.has(s.bodySpan))return[{start:s.bodySpan.start,events:a}];return[{start:s.bodySpan.start,events:[...hd(r.source.slice(s.bodySpan.start,s.bodySpan.end),r),...a]}]}),...o.some((i)=>!i.heredoc&&i.target)?tS(t,n,r):[]]}function tS(e,t,n){let r=e.nodes.slice(t+1).find((o)=>o.kind==="connector");if(!r||r.span.end>=e.span.end)return[];return[{start:r.span.end,events:hd(n.source.slice(r.span.end,e.span.end),n)}]}function hd(e,t){if(t.depth>=gt.maxDepth)return t.flags.limited=!0,[];let n=Ne(e,"posix");if(n.status==="limited")return t.flags.limited=!0,[];let r={invalid:!1,limited:!1,expansions:t.flags.expansions,assignmentFallbacks:t.flags.assignmentFallbacks},o=Ft(n,{source:e,suppressed:new Set,flags:r,depth:t.depth+1,functions:new Map,powershell:!1});return t.flags.limited||=r.limited,t.flags.expansions=r.expansions,o}function yd(e,t,n,r){let o=[],i={single:!1,double:!1},s="",a=!1,l=()=>{let c=a&&!r?Ge("glob"):s!==""||e.quoted&&o.length===0?ia(s):void 0;if(c)o.push(c);s="",a=!1};for(let c of e.parts){if(c.provenance!=="command-substitution"&&c.provenance!=="arithmetic"){for(let f of ta(c.raw,i,n.flags,n.powershell)){if(typeof f==="string"){l(),o.push(Ge(f));continue}s+=f.text,a||=f.glob}continue}let d=t.nested.find((f)=>f.span.start>=c.span.start&&f.span.end<=c.span.end);if(i.double){let f=n.source.slice(c.span.start,c.span.end);s+=ta(f,{single:!1,double:!0},n.flags,n.powershell).map((g)=>typeof g==="string"?g:g.text).join("");let p=d?Ft(d,n).filter((g)=>g.kind==="redirection"&&g.body!==void 0):[];if(p.length>0)o.push(lr,...p,cr);continue}let m=d?Ft(d,n):[];if(c.raw.startsWith("`")){s+="${}",l(),o.push(lr,...m,cr);continue}if(c.raw.startsWith("<(")||c.raw.startsWith(">(")){l(),o.push(c.raw.startsWith("<(")?Ge("<("):Object.freeze({kind:"redirection",operator:">",role:"file-write",targetOrder:"immediate"}),lr,...m,...c.raw.endsWith(")")?[Ge(")")]:[],cr);continue}let u=c.raw.startsWith("$((")?2:1;s+="${}",l(),o.push(...Array.from({length:u},()=>Ge("(")),...u===1?[lr]:[],...m,...c.raw.endsWith(")".repeat(u))?Array.from({length:u},()=>Ge(")")):[],...u===1?[cr]:[])}return l(),o}function ta(e,t,n,r){let o=[],i="",s=!1,a=0;while(a<e.length){let l=e[a]??"";if(!t.single&&!t.double&&(l==="("||l===")")){o.push({text:i,glob:s},l),i="",s=!1,a++;continue}if(r&&l==="`"&&!t.single){i+=e[a+1]??"",a+=2;continue}if(t.single&&l==="'"){t.single=!1,a++;continue}if(t.single){i+=l,a++;continue}if(t.double){if(l==='"'){t.double=!1,a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";i+=['"',"\\","$"].includes(c)?c:`\\${c}`,a+=2;continue}if(l==="$"){let c=dd(e,a,t,n,r);i+=c.text,a=c.next;continue}i+=l,a++;continue}if(l==="'"||l==='"'){t.single=l==="'",t.double=l==='"',a++;continue}if(!r&&l==="\\"){let c=e[a+1]??"";s||=c==="*"||c==="?",i+=c,a+=2;continue}if(l==="$"){let c=dd(e,a,t,n,r);i+=c.text,a=c.next;continue}s||=l==="*"||l==="?",i+=l,a++}return[...o,{text:i,glob:s}]}function dd(e,t,n,r,o){let i=e[t+1];if(i==="{"){let a=rS(e,t+2);if(a===-1)return r.invalid=!0,{text:"",next:e.length};let l=e.slice(t,a+1);return nS(l,n,r,o),{text:l,next:a+1}}if(i!==void 0&&Hb.test(i))return{text:`\${${i}}`,next:t+2};let s=(o?jb:/^\w*/).exec(e.slice(t+1))?.[0]??"";return{text:`\${${s}}`,next:t+1+s.length}}function nS(e,t,n,r){let o=e.slice(2,-1),i=/^[A-Za-z_][A-Za-z0-9_]*/.exec(o)?.[0];if(!i)return;let s=o.slice(i.length),a=[":=","="].find((c)=>s.startsWith(c));if(!a)return;let l=ta(s.slice(a.length),{...t},n,r);n.assignmentFallbacks.push(...l.flatMap((c)=>typeof c==="string"||!c.text?[]:[c.text]))}function rS(e,t){let n=1,r=t;while(n>0&&r<e.length){if(e[r]==="{"&&e[r-1]==="$")n++;if(e[r]==="}")n--;r++}return n===0?r-1:-1}function oS(e){return/^[\r\n]+$/.test(e)?";":e}function Ge(e){return Object.freeze({kind:"operator",operator:e,boundary:Bb.has(e)})}function ko(e){return Object.freeze({kind:"operator",operator:e,boundary:!0})}function ia(e){return Object.freeze({kind:"word",text:e})}function iS(e){if(e==="<<"||e==="<<<")return"here-data";if(e==="<"||e==="<&")return"file-read";return"file-write"}function mr(e){return qb.has(e)||/^python\d/.test(e)}var sS=new Map([["sudo",new Set(["-u","-g","-h","-p","-C","-D","-r","-t","-T","-U","--user","--group","--host","--prompt","--chdir","--role","--type","--other-user"])],["env",new Set(["-u","-C","-P","-S","--unset","--chdir","--split-string"])]]);function Cd(e,t){let n=t[0];if(n===void 0||!n.startsWith("-"))return t;let r=sS.get(e)?.has(n)??!1;return Cd(e,t.slice(r?2:1))}function na(e){let t=e[0];if(t===void 0)return[];if(/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))return na(e.slice(1));if(!zb.has(t))return[...e];return na(Cd(t,e.slice(1)))}function bd(e){let t=Jn(e),n=e.words.findIndex((r)=>r.provenance==="literal"&&r.text===t);return na(n<0?[]:e.words.slice(n).map((r)=>r.text))}function aS(e){let t=bd(e)[0];if(t===void 0)return!1;let n=T(t).toLowerCase();return mr(n)&&!ur.has(n)}function ra(e){return e.nodes.flatMap((t,n)=>{if(t.kind==="group"||t.kind==="function")return ra(t.body);if(t.kind!=="command")return[];let r=t.nested.flatMap((a)=>ra(a)),o=t.redirections.flatMap((a)=>a.heredoc?.quotedDelimiter?[a.heredoc.bodySpan]:[]);if(aS(t))return[...r,...o];let i=e.nodes[n+1];if(i?.kind==="connector"&&(i.operator==="|"||i.operator==="|&")||!uS(t))return r;return[...r,...o]})}function lS(e,t){let n=Jn(e);return n===void 0?void 0:t.get(n)}function bt(e,t){return e!==void 0&&e.provenance==="literal"&&!e.quoted&&e.raw===e.text&&e.text===t}function cS(e){if(bt(e.words[0],"git"))return bt(e.words[1],"commit");if(!bt(e.words[0],"gh")||!bt(e.words[2],"create"))return!1;return bt(e.words[1],"pr")||bt(e.words[1],"issue")}function uS(e){return(bt(e.words[0],"cat")||bt(e.words[0],"tee")||cS(e))&&!e.words.some(md)&&!e.redirections.some((n)=>md(n.target))}function md(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}var Sd=new Set(["absolutepath","destination","directorypath","directory_path","file","file_path","filepath","include","notebook_path","path","paths","searchdirectory","search_directory","searchpath","targetfile","target_file"]),vd=new Set([...Sd,"glob"]),dS=new Set([...vd,"pattern"]);class Fe extends Error{name="StructuralShellSyntaxLimitError";constructor(){super("Structural command analysis limit exceeded.")}}function fr(e){let t=mS(),n=zn(e.input),r=[];if((e.route.kind==="command"||e.route.kind==="unknown")&&n)r.push({usage:"input-candidate",source:n});if(e.route.kind==="command"&&"command"in e&&e.command)r.push({usage:"declared-command",source:e.command});let o=r.reduce((i,s)=>{let a=i.findIndex((d)=>d.source===s.source);if(a!==-1){let d=i[a];if(!d)return i;return i[a]={...d,usages:[...d.usages,s.usage]},i}let l=e.route.kind==="command"?e.route.shell:process.platform==="win32"?"powershell":"posix",c=t.getCommandProgram(s.source,l);return i.push({usages:[s.usage],source:s.source,program:c,shell:t.getShellSyntax(s.source,c)}),i},[]);return{invocation:{toolName:e.toolName,route:e.route,context:e.context},commands:o,paths:fS(e),store:t}}function ge(e,t){return e.commands.find((n)=>n.usages.includes(t))}function ot(e,t){if(!e.includes("$"))return e;return ki(e,t)}function mS(){let e=new Map,t=new Map,n=new WeakMap,r=(i,s)=>{let a=`${s}\x00${i}`,l=t.get(a);if(l)return l;let c=Ne(i,s);return t.set(a,c),c};return{getShellSyntax:(i,s)=>{if(s&&s.source!==i)throw TypeError("Shell syntax source does not match command program source.");let a=s??r(i,"posix");if(a.status==="limited"){let d=n.get(a);if(d)return d;let m={status:"structural-limit",source:i,program:a,assignmentFallbacks:[]};return n.set(a,m),m}let l=e.get(i);if(l)return l;let c=pd(i,a);return e.set(i,c),c},getCommandProgram:r}}function fS(e){let t=e.route.kind==="grep"?vd:e.route.kind==="glob"?dS:Sd;return[...Ml(e.input,t),...e.route.kind==="patch"||typeof e.input==="string"?Ll(e.input):[]]}var pS=new Set(["-S","--suffix"]);function bn(e,t,n,r,o){if(e.status==="structural-limit")throw new Fe;if(e.status!=="complete")return o.findMalformedTarget(e.source);return Oo(e,t,n,r,{segment:(i,s)=>o.findSegmentTarget(i,s),redirection:(i,s)=>i.role==="file-write"&&o.isRedirectionTarget(pe(i.target,s.variables),s)?i.target:null})}function Do(e){let t=[],n=null,r=!1;for(let o=0;o<e.length;o++){let i=e[o];if(i===void 0)break;if(!r&&i==="--"){r=!0;continue}if(!r&&(i==="-t"||i==="--target-directory")){n=e[++o]??null;continue}if(!r&&i.startsWith("--target-directory=")){n=i.slice(19);continue}if(!r&&i.startsWith("-t")&&i.length>2){n=i.slice(2);continue}if(!r&&pS.has(i)){o++;continue}if(!r&&(i.startsWith("--suffix=")||i.startsWith("--backup=")))continue;if(!r&&i.startsWith("-"))continue;t.push(i)}return n?{sources:t,destination:n}:{sources:t.slice(0,-1),destination:t.at(-1)??null}}var ke="Git metadata and hooks are protected. Ask the user before modifying them.";function wd(e,t,n,r){let o=e.invocation.context.executionCwd;if(!t)return null;if(e.invocation.route.kind==="patch"||e.invocation.route.kind==="path"||e.invocation.route.kind==="unknown"){if(Nr(e.invocation.toolName))return null;let a=e.paths.find((l)=>Ed(l,o,t,n,r,t.entries));return a?{target:a}:null}if(e.invocation.route.kind!=="command")return null;let i=ge(e,"input-candidate");if(!i)return null;let s=bn(i.shell,o,n,r,{findSegmentTarget:(a,l)=>RS(a,l,t,n,r),isRedirectionTarget:(a,l)=>Ed(a,l.cwd,t,n,r,t.markerFiles),findMalformedTarget:()=>null});return s?{target:s}:null}function zt(e,t,n,r,o,i,s=!1){if(!n)return!1;let a=Lo(le(e,t,o,i)),l=a.replace(/(\/\.?\*+)+$/,"");if(l!==a&&l!==""){if(sa(l,n))return!0;let c=s||a.slice(l.length).includes("/."),d=(m)=>c?No(m,l):bS(m,l);if(n.markerFiles.some(d))return!0;return r&&aa(n).some(d)}if(sa(a,n))return!0;return r&&aa(n).some((c)=>No(c,a))}function bS(e,t){let n=Rd(t,e);if(n===""||n.startsWith("..")||xd(n))return!1;return!n.split(/[\\/]/)[0]?.startsWith(".")}function SS(e,t,n,r,o){return zt(e,t,n,!0,r,o)}function vS(e,t,n,r,o){if(!n)return!1;return sa(Lo(le(e,t,r,o)),n)}function Ed(e,t,n,r,o,i){let s=Lo(le(e,t,r,o));return i.includes(s)||Ad(s,n)}function _d(e,t,n,r,o){if(!n)return!1;return n.hooksDirectories.some((i)=>e.some((s)=>No(i,Lo(le(s,t,r,o)))))}function sa(e,t){return t.entries.includes(e)||t.directories.includes(e)||Ad(e,t)}function Ad(e,t){return t.hooksDirectories.some((n)=>No(e,n))}var ES=50000;function Pd(e,t){let n=[...new Set(aa(e))];if(n.some((o)=>t(yS(o))))return!0;let r=0;while(n.length>0){let o=n.pop()??"",i=xS(o);if(!i)return!0;if(r+=i.length,r>ES)return!0;if(i.some((s)=>t(s.name)))return!0;n.push(...i.filter((s)=>s.isDirectory()).map((s)=>CS(o,s.name)))}return!1}function xS(e){try{let t=gS(e,{throwIfNoEntry:!1});if(!t)return[];if(!t.isDirectory())return t.isSymbolicLink()?null:[];return hS(e,{withFileTypes:!0,encoding:"utf8"})}catch{return null}}function aa(e){return[...e.entries,...e.directories,...e.hooksDirectories]}function No(e,t){let n=Rd(t,e);return n===""||!/^\.\.(?:[\\/]|$)/.test(n)&&!xd(n)}function Lo(e){return process.platform==="win32"?e.toLowerCase():e}function RS(e,t,n,r,o){if(dr(e))return null;let i=Ct([...e],r);if(T(i[0]??"").toLowerCase()!=="mv")return null;let s=Do(i.slice(1)),a=s.sources.find((l)=>SS(pe(l,t.variables),t.cwd,n,r,o));if(a)return a;return s.destination&&vS(pe(s.destination,t.variables),t.cwd,n,r,o)?s.destination:null}import{isAbsolute as zo,normalize as OS,parse as MS,posix as Ld,resolve as $t,sep as da}from"path";import{isAbsolute as wS,join as Td,normalize as Od,parse as _S,sep as Id}from"path";var AS=["/tmp","/var/tmp","/private/tmp","/private/var/tmp"],PS=` 	
+`;function pr(e,t){if(St(e,t))return!0;if(!e.has("TMPDIR"))return!1;return!la(e.get("TMPDIR")??"",t)}function Bt(e,t){if(e.has("TMPDIR"))return la(e.get("TMPDIR")??"",t);let n=ca(e,t);if(n===void 0)return!0;return la(n,t)}function ca(e,t){return Dd(e,t,"TMPDIR")}function la(e,t){if(!e)return!1;if(IS(e))return!1;return Sn(e,t)}function St(e,t){let n=Dd(e,t,"IFS");return n!==void 0&&n!==""&&n!==PS}function Sn(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>vn(n,r))}function Fo(e,t){let n=Wo(e,t.paths);if(n===null)return!1;return Md(t).some((r)=>Go(r)===Go(n))}var kd=new WeakMap;function Md(e){let t=kd.get(e);if(t)return t;let n=TS(e);return kd.set(e,n),n}function TS(e){let t=AS.map((r)=>Wo(r,e.paths)??Od(r)),n=Wo(e.tmpdir,e.paths);if(!n)return t;if(process.platform==="win32")return[...t,n];if(process.platform==="darwin"&&kS(n))return[...t,n];return t}function IS(e){return/[\s$`*?[]/.test(e)||/\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(e)||/[+@!]\([^)]*\)/.test(e)}function Dd(e,t,n){return e.has(n)?e.get(n):t.env.get(n)}function kS(e){return/^\/(?:private\/)?var\/folders\/[^/]{2}\/[^/]+\/T$/.test(e)}function Wo(e,t){try{let n=Od(e);if(!wS(n))return n;let r=_S(n).root,o=n.slice(r.length).split(/[\\/]+/).filter(Boolean),i=r;for(let s=0;s<o.length;s++){let a=Td(i,o[s]??"");if(t.entryKind(a)==="missing")return Td(a,...o.slice(s+1));let l=t.realpath(a);if(l===null)return null;i=l}return i}catch{return null}}function vn(e,t){let n=Go(e),r=Go(t);if(n===r)return!0;let o=r.endsWith(Id)?r:`${r}${Id}`;return n.startsWith(o)}function Go(e){return process.platform==="win32"?e.toLowerCase():e}var DS=process.platform==="win32",Nd=64,NS=16384;function gr(e,t,n,r){if(e.kind==="temp_target")return null;let o=r[e.kind];if(e.kind==="dynamic_target"&&!re(n,o.id,t.strict))return null;if(e.kind==="within_anchored_cwd"&&!re(n,o.id,t.paranoid))return null;return v(o.id,o.reason)}function hr(e){let t=wu(e,Nd,Nd,NS);return{expandedTargets:t&&"words"in t?t.words:void 0,unsafeBraceExpansion:t!==void 0&&"limited"in t,targetIsLiteral:t===void 0&&e.provenance==="literal"&&(e.quoted||e.raw!==e.text),tmpdirWordSplittingProtected:LS(e)}}function LS(e){let t=e.parts.filter((n)=>n.provenance==="variable"&&/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(n.raw));return t.length>0&&t.every((n)=>WS(e.raw,n.span.start-e.span.start))}function WS(e,t){let n=null,r=!1;for(let o=0;o<t;o++){let i=e[o];if(r){r=!1;continue}if(i==="\\"&&n!=="'"){r=!0;continue}if(n===i){n=null;continue}if(n===null&&(i==="'"||i==='"'))n=i}return n==='"'}function vt(e){let t=e.environment.home,n=e.environment.paths,r=e.budget??Se();return{anchoredCwd:e.originalCwd??e.cwd??null,resolvedCwd:e.cwd??null,strict:e.strict??!1,paranoid:e.paranoid??!1,trustTmpdirVar:e.allowTmpdirVar??!0,posixShell:e.posixShell??!1,tmpdirWordSplittingUnsafe:e.tmpdirWordSplittingUnsafe??!1,trustedTmpdirValue:e.trustedTmpdirValue??e.allowTmpdirVar??!0,environment:e.environment,allowRoots:US(e.allowPaths,t,n,r),protectedGitMetadata:e.protectedGitMetadata,budget:r}}function ze(e,t,n={}){let r=n.targetIsLiteral??!1;if(!r&&t.tmpdirWordSplittingUnsafe&&!n.tmpdirWordSplittingProtected&&jS(e))return{kind:"outside_anchored_cwd"};let o=!r&&Gd(e,t.posixShell);if(et(e))return{kind:"outside_anchored_cwd"};if(ma(e,r))return{kind:"root_or_home_target"};if(FS(e,t,r))return{kind:"root_or_home_target"};if(t.resolvedCwd&&zt(e,t.resolvedCwd,t.protectedGitMetadata,!0,t.environment,t.budget,!t.posixShell))return{kind:"git_metadata_target"};if(zS(e,t.trustTmpdirVar,t.posixShell,o,r,n.tmpdirWordSplittingProtected??!1,t.trustedTmpdirValue,t.environment))return{kind:"temp_target"};if(o)return{kind:"dynamic_target"};if(HS(e,t,r))return{kind:"temp_target"};let i=t.anchoredCwd;if(i){if(!n.skipHomeCwd&&YS(i,t.environment.home,t.environment.paths,t.budget))return{kind:"home_cwd_target"};if(!n.skipCwdSelf&&[t.resolvedCwd??i,i].some((s)=>ZS(e,t.resolvedCwd??i,t.environment.paths,t.budget,s)))return{kind:"cwd_self_target"};if(XS(e,i,t.resolvedCwd??i,o,r,t.environment.paths,t.budget))return{kind:"within_anchored_cwd"}}if(GS(e,t,o))return{kind:"temp_target"};return{kind:"outside_anchored_cwd"}}function GS(e,t,n){let r=e.trim();if(n||!t.resolvedCwd||!t.anchoredCwd||!r)return!1;if(zo(r)||r.startsWith("~"))return!1;if(fa(r))return!1;if(Fd(t.resolvedCwd,t.anchoredCwd,t.environment.paths,t.budget))return!1;return Sn($t(t.resolvedCwd,r),t.environment)}function Wd(e,t,n={}){let{containmentTarget:r,...o}=n;if(ze(e,t,o).kind!=="temp_target")return!1;let i=e.trim();if($S(i))return!1;if(Fo(i,t.environment))return!1;return![t.anchoredCwd,t.resolvedCwd].some((s)=>Fd(r??i,s,t.environment.paths,t.budget))}function ma(e,t=!1){let n=e.trim(),r=Ld.normalize(n),o=n.replace(/\\/g,"/"),i=r==="/"?r:r.replace(/\/+$/,"");if(i==="/"||i.startsWith("/")&&i.slice(1).split("/").every((s)=>/^\*+$/.test(s)))return!0;if(/^[A-Za-z]:\/+\*?$/.test(o)||/^\/\/[^/]+\/+[^/]+(?:\/+\*?)?$/.test(o))return!0;if(!t&&(r==="~"||r==="~/"||r==="~/*"))return!0;if(!t&&(r==="$HOME"||r==="$HOME/"||r==="$HOME/*"))return!0;if(!t&&(r==="${HOME}"||r==="${HOME}/"||r==="${HOME}/*"))return!0;return!1}function FS(e,t,n){let r=e.trim(),o=n?r:r==="*"?".":r.endsWith("/*")?r.slice(0,-2):r;if(!o)return!1;try{let i=zo(o)?o:t.resolvedCwd?$t(t.resolvedCwd,o):null;if(!i)return!1;let s=he(L(i,t.environment.paths,t.budget));if(s===MS(s).root)return!0;return s===he(L(t.environment.home,t.environment.paths,t.budget))}catch{return!1}}function he(e){let t=OS(e);if(DS){if(t=t.replace(/\//g,"\\").toLowerCase(),t.length>3&&t.endsWith("\\"))t=t.slice(0,-1);return t}if(t.length>1&&t.endsWith("/"))t=t.slice(0,-1);return t}function zS(e,t,n,r,o,i,s,a){let l=e.trim();if(fa(l))return!1;if(!r&&Sn(l,a))return!0;return(t||i&&s)&&n&&!o&&BS(l,n)}function BS(e,t){return["$TMPDIR","${TMPDIR}"].some((n)=>{if(e===n)return!0;if(!e.startsWith(`${n}/`))return!1;return!Gd(e.slice(n.length+1),t)})}function $S(e){let t=/^(?:\$TMPDIR|\$\{TMPDIR\})(?:\/(.*))?$/.exec(e);if(!t)return!1;return Ld.normalize(`/${t[1]??""}`)==="/"}function fa(e){return e.split(/[\\/]+/).includes("..")}function US(e,t,n,r){if(!e?.length)return[];return e.flatMap((o)=>{let i=Yn(o.trim(),t);if(!zo(i))return[];try{let s=L(i,n,r);if(Zn(s,L(t,n,r)))return[];return[he(s)]}catch{return[]}})}function HS(e,t,n){if(t.allowRoots.length===0)return!1;let r=e.trim();if(fa(r))return!1;let o=n?r:Yn(r,t.environment.home),i=t.resolvedCwd??t.anchoredCwd,s=zo(o)?o:i?$t(i,o):null;if(!s)return!1;try{let a=he(L(s,t.environment.paths,t.budget));return t.allowRoots.some((l)=>a===l||a.startsWith(l.endsWith(da)?l:`${l}${da}`))}catch{return!1}}function jS(e){return/\$(?:TMPDIR(?![A-Za-z0-9_])|\{TMPDIR\})/.test(e)}function Gd(e,t=!1){return e.includes("$")||e.includes("`")||VS(e)||t&&KS(e)}function VS(e){let t=!1;for(let n of e){if(t){t=!1;continue}if(n==="\\"){t=!0;continue}if(n==="*"||n==="?"||n==="[")return!0}return!1}function KS(e){let t=!1;for(let n=0;n<e.length;n++){let r=e[n];if(t){t=!1;continue}if(r==="\\"){t=!0;continue}if(r==="{"&&qS(e,n)||(r==="+"||r==="@"||r==="!")&&e[n+1]==="(")return!0}return!1}function qS(e,t){let n=e.indexOf("}",t+1);if(n===-1)return!1;let r=e.slice(t+1,n);return r.includes(",")||r.includes("..")}function YS(e,t,n,r){try{return he(L(e,n,r))===he(L(t,n,r))}catch{try{return he(e)===he(t)}catch{return!1}}}function ZS(e,t,n,r,o=t){if(o===t&&(e==="."||e==="./"||e===".\\"))return!0;try{return he(L($t(t,e),n,r))===he(L(o,n,r))}catch{try{return he($t(t,e))===he(o)}catch{return!1}}}function XS(e,t,n,r,o,i,s){let a=n??t;if(!o&&(e.startsWith("~")||e.startsWith("$HOME")||e.startsWith("${HOME}")))return!1;if(r)return!1;if(e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e))try{return ua(e,t,i,s)}catch{return!1}if(e.startsWith("./")||e.startsWith(".\\")||!e.includes("/")&&!e.includes("\\"))try{return ua($t(a,e),t,i,s)}catch{return!1}if(e.startsWith("../"))return!1;try{return ua($t(a,e),t,i,s)}catch{return!1}}function ua(e,t,n,r){try{return zd(L(e,n,r),L(t,n,r))}catch{return!1}}function Fd(e,t,n,r){if(!t)return!1;try{return zd(L(t,n,r),L(e,n,r))}catch{return!0}}function zd(e,t){let n=he(e),r=he(t);return n.startsWith(`${r}${da}`)||n===r}var JS=new Set(["remove-item","ri","del","erase","rd","rm","rmdir"]),Bd="PowerShell Remove-Item -Recurse -Force outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",QS="PowerShell Remove-Item -Recurse -Force for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",$d="PowerShell Remove-Item target contains variables or pipeline input that cannot be verified safely. Use literal paths within cwd.",Ud="PowerShell Remove-Item targeting root or home directory is extremely dangerous and always blocked.",ev="PowerShell Remove-Item -Recurse -Force in home directory is dangerous. Change to a project directory first.",tv="PowerShell Remove-Item receives pipeline input that cannot be verified safely. Use explicit literal paths within cwd.",nv={root_or_home_target:{id:"powershell.remove-item-recursive-force-root-or-home",reason:Ud},git_metadata_target:{id:"powershell.remove-item-git-metadata",reason:ke},dynamic_target:{id:"powershell.remove-item-recursive-force-dynamic-target",reason:$d},home_cwd_target:{id:"powershell.remove-item-recursive-force-home-cwd",reason:ev},cwd_self_target:{id:"powershell.remove-item-recursive-force-cwd-self",reason:Bd},within_anchored_cwd:{id:"powershell.remove-item-recursive-force-paranoid",reason:QS},outside_anchored_cwd:{id:"powershell.remove-item-recursive-force-outside-cwd",reason:Bd}};function Hd(e,t,n,r=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths})){return rv(e.words.map((o)=>({kind:"word",text:o.text,dynamic:o.provenance!=="literal"})),t,r,n.policy)}function rv(e,t,n,r){let o=e.filter((l)=>l.kind==="word"),i=iv(o),s=o[i];if(!s||!JS.has(pv(s.text)))return null;let a=ov(o.slice(i+1));if(a.whatIfProtected)return null;if(re(r,"powershell.remove-item-pipeline-dynamic-target",n.strict)&&t&&(a.targets.length===0||a.recursive))return v("powershell.remove-item-pipeline-dynamic-target",tv);for(let l of a.targets)if(!et(l.text)&&ma(ga(l.text)))return v(a.recursive&&a.force?"powershell.remove-item-recursive-force-root-or-home":"powershell.remove-item-root-or-home",Ud);for(let l of a.targets)if(n.resolvedCwd&&zt(ga(l.text),n.resolvedCwd,n.protectedGitMetadata,a.recursive,n.environment,n.budget,!0))return v("powershell.remove-item-git-metadata",ke);if(!a.recursive||!a.force)return null;if(re(r,"powershell.remove-item-recursive-force-dynamic-target",n.strict)&&(a.hasDynamicTarget||a.targets.length===0))return v("powershell.remove-item-recursive-force-dynamic-target",$d);for(let l of a.targets){let c=gr(ze(ga(l.text),n),n,r,nv);if(c)return c}return null}function ov(e){let t=[],n=!1,r=!1,o=!1,i=!1,s=!1;for(let a=0;a<e.length;a++){let l=e[a];if(!l||l.kind!=="word")continue;if(sv(l))continue;if(s){t.push(pa(l)),i=i||l.dynamic;continue}if(l.text==="--"){s=!0;continue}let c=lv(l.text);if(!c){t.push(pa(l)),i=i||l.dynamic;continue}if(cv(c.name)){let d=c.value?av(c.value,l):e[++a];if(d?.kind==="word"){t.push(pa(d)),i=i||d.dynamic;continue}i=!0;continue}if(uv(c.name)){n=!0;continue}if(dv(c.name)){r=!0;continue}if(mv(c.name))o=fv(c.value)}return{targets:t,recursive:n,force:r,whatIfProtected:o,hasDynamicTarget:i}}function iv(e){let t=e[0];if(t?.kind==="word"&&t.text==="&"||t?.text===".")return e.length>1?1:0;return 0}function pa(e){return{text:e.kind==="word"?e.text:"",dynamic:e.kind==="word"&&e.dynamic}}function sv(e){return e.kind==="word"&&e.text===","}function ga(e){let t=e.replace(/\\/g,"/"),n=/^\$env:(?:userprofile|home)(?=$|\/)/i.exec(t);return n?`$HOME${t.slice(n[0].length)}`:t}function av(e,t){return{kind:"word",text:e,dynamic:t.kind==="word"&&(t.dynamic||e.includes("$"))}}function lv(e){if(!e.startsWith("-")||e==="-")return null;let t=e.slice(1),n=t.indexOf(":");if(n===-1)return{name:t.toLowerCase()};return{name:t.slice(0,n).toLowerCase(),value:t.slice(n+1)}}function cv(e){return"path".startsWith(e)||"literalpath".startsWith(e)}function uv(e){return"recurse".startsWith(e)}function dv(e){return e.length>=2&&"force".startsWith(e)}function mv(e){return e==="wi"||"whatif".startsWith(e)}function fv(e){if(e===void 0||e==="")return!0;let t=e.toLowerCase();return t==="$true"||t==="true"}function pv(e){return e.toLowerCase()}var En="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Bo="Unsupported heredoc syntax",yr="shell execution source cannot be verified safely. Use a literal command string or ask the user to run it manually.",jd="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.";var gv=new Set(["--ca-bundle","--cli-binary-format","--cli-connect-timeout","--cli-error-format","--cli-read-timeout","--color","--endpoint-url","--output","--profile","--query","--region"]),hv=new Set(["--access-token-file","--account","--billing-project","--configuration","--flags-file","--flatten","--format","--impersonate-service-account","--project","--trace-token","--verbosity"]),yv=new Set(["-o","--output","--query","--subscription"]),Cv=new Set;function Vd(e){if(e==="aws")return gv;if(e==="gcloud")return hv;if(e==="az")return yv;return Cv}var bv=new Set(["-c","-H","-l","--config","--context","--host","--log-level","--tlscacert","--tlscert","--tlskey"]),Sv=new Set;function Kd(e){if(e==="git")return Ee;if(e==="docker")return bv;return Sv}function it(e,t){if(e.length===0||t.length===0)return null;let n=O(e[0]??""),r=me(e);for(let o of t){if(!xv(n,o.command))continue;if(o.match){if(vv(n,e,o.match))return qd(o);continue}if(!Rv(n,e,o.subcommand))continue;if(_v(e,new Set(o.block_args),r))return qd(o)}return null}function qd(e){return{id:`custom.${e.name}`,reason:`[${e.name}] ${e.reason}`,intent:e.intent??"manual_only"}}function vv(e,t,n){let r=t.slice(1);if(n.exclude_args?.some((o)=>r.includes(o)))return!1;if(n.any_args&&!n.any_args.some((o)=>r.includes(o)))return!1;return Ev(r,n.command_path,Vd(e))}function Ev(e,t,n){let r=0,o=!1;for(let i of e){if(r>=t.length)return!0;if(o){o=!1;continue}if(i.startsWith("-")){o=!i.includes("=")&&n.has(i);continue}if(i!==t[r])return!1;r++}return r>=t.length}function xv(e,t){return e===O(t)}function Rv(e,t,n){if(!n)return!0;return Yd(t,1,n,Kd(e))}function Yd(e,t,n,r){let o=!1;for(let i=t;i<e.length;i++){let s=e[i];if(!s)continue;if(o){o=!1;continue}if(s==="--"){let a=e[i+1];if(a&&!a.startsWith("-"))return a===n;return!1}if(r.has(s)){o=!0;continue}if(s.startsWith("-")){if(!s.includes("=")&&wv(e,i,n,r))return!0;continue}return s===n}return!1}function wv(e,t,n,r){let o=e[t+1];if(!o||o.startsWith("-"))return!1;return Yd(e,t+2,n,r)}function _v(e,t,n){return e.some((r)=>t.has(r))||[...n].some((r)=>t.has(r))}var Av=new Set(["-e","--source"]),Pv=new Set(["-F","-v","--assign","--field-separator"]),Zd=new Set(["-f","--file"]),Tv=new Set(["print","printf","return"]),Xd=[{selector:"-e",kind:"inline-code",valueForm:"attached-or-separate"},{selector:"--source",kind:"inline-code",valueForm:"equals-or-separate"},{selector:"-f",kind:"program-file",valueForm:"attached-or-separate"},{selector:"--file",kind:"program-file",valueForm:"equals-or-separate"}],Iv="Detected awk system(), pipe, or getline command with dynamic command that cannot be safely analyzed. Use a literal command or process the data without system(), pipes, or getline.";function Jd(e,t,n){let r=!1;for(let o of kv(e)){let i=Ov(o,n);if(!i)continue;for(let s of i.commands){let a=t(s);if(a)return a;if(s.includes("{}")||/[$`]/.test(s))r=!0}r||=i.dynamic}return r?v("awk.system-dynamic",Iv):null}function ya(e){let t=[],n=!1,r=!1,o=!0,i=!0;for(let s=1;s<e.length;s++){let a=e[s];if(a===void 0)break;if(o&&a==="--"){o=!1;continue}if(o&&Av.has(a)){n=!0;let l=e[s+1];if(i&&=l!==void 0,l!==void 0)t.push({tokenIndex:s+1,kind:"inline-code",value:l});s++;continue}if(o&&a.startsWith("--source=")){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(9)});continue}if(o&&a.startsWith("-e")&&a.length>2){n=!0,t.push({tokenIndex:s,kind:"inline-code",value:a.slice(2)});continue}if(o&&(Pv.has(a)||Zd.has(a))){let l=e[s+1];if(i&&=l!==void 0,Zd.has(a)){if(r=!0,l!==void 0)t.push({tokenIndex:s+1,kind:"program-file",value:l})}s++;continue}if(o&&(a.startsWith("-F")||a.startsWith("-v")&&a.slice(2).includes("=")))continue;if(o&&a.startsWith("-f")&&a.length>2){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(2)});continue}if(o&&(a.startsWith("--assign=")||a.startsWith("--field-separator=")))continue;if(o&&a.startsWith("--file=")){r=!0,t.push({tokenIndex:s,kind:"program-file",value:a.slice(7)});continue}if(o&&a.startsWith("-")&&a!=="-")continue;if(!n&&!r)t.push({tokenIndex:s,kind:"main-program",value:a});return{sources:t,optionsOpen:!1}}return{sources:i?t:[],optionsOpen:o&&i}}function br(e){return ya(e).sources}function kv(e){return br(e).filter((t)=>t.kind!=="program-file").map((t)=>t.value)}function Ov(e,t){we(t,e);let n=e.includes("system")?Ca(e,t):null,r=Mv(e,t);if(!n&&!r)return null;return{dynamic:!!n?.dynamic||!!r?.dynamic,commands:[...n?.commands??[],...r?.commands??[]]}}function Ca(e,t){we(t,e);let n=[],r=!1,o=!1,i=0;while(i<e.length){let s=e[i];if(s==='"'||s==="'"){i=Uo(e,i,s)?.endIndex??i+1;continue}if(s==="#"){i=Qd(e,i+1);continue}if(s==="/"&&em(e,i)){i=tm(e,i+1)??i+1;continue}if(!e.startsWith("system",i)){i++;continue}let a=i;if(i+=6,Cr(e[a-1])||Cr(e[i]))continue;let l=$o(e,i);if(e[l]!=="(")continue;l=$o(e,l+1);let c=e[l];if(c!=='"'&&c!=="'"){r=!0,o=!0;continue}let d=Uo(e,l,c);if(!d){r=!0,o=!0;continue}if(l=$o(e,d.endIndex),r=!0,e[l]!==")"){o=!0,i=d.endIndex;continue}n.push(d.value),i=l+1}if(!r)return null;return{dynamic:o,commands:n}}function Mv(e,t){we(t,e);let n=[],r=!1,o=!1,i=0,s=0,a=null,l=null,c=0;while(i<e.length){let d=e[i];if(!d)break;if(d==='"'||d==="'"){let f=Uo(e,i,d);if(f&&c===s)l={...f,startIndex:i};c=f?.endIndex??i+1,i=f?.endIndex??i+1;continue}if(d==="#"){i=Qd(e,i+1),s=i,a=null,l=null,c=i;continue}if(d==="/"&&em(e,i)){let f=tm(e,i+1);c=f??i+1,i=f??i+1;continue}if(`;
+{}`.includes(d)){i++,s=i,a=null,l=null,c=i;continue}if(a===null&&(ha(e,i,"print")||ha(e,i,"printf")))a=i;if(d!=="|"||e[i-1]==="|"||e[i+1]==="|"){if(!/\s/.test(d))c=i+1;i++;continue}let m=e[i+1]==="&"?i+2:i+1,u=$o(e,m);if(ha(e,u,"getline")){o=!0;let f=Lv(s,l,c);if(r||=f===null,f!==null)n.push(f);c=m,i=m;continue}if(Gv(s,a)){o=!0;let f=Nv(e,u);if(!f){r=!0,c=m,i=m;continue}if(!Dv(e,f.endIndex)){r=!0,c=f.endIndex,i=f.endIndex;continue}n.push(f.value),c=f.endIndex,i=f.endIndex;continue}c=m,i++}if(!o)return null;return{dynamic:r,commands:n}}function Cr(e){return!!e&&/[A-Za-z0-9_]/.test(e)}function $o(e,t){let n=t;while(/\s/.test(e[n]??""))n++;return n}function Dv(e,t){let n=t;while(/[\t\f\v\r ]/.test(e[n]??""))n++;let r=e[n];return!r||`;
+}#`.includes(r)}function Uo(e,t,n){let r="",o=!1;for(let i=t+1;i<e.length;i++){let s=e[i];if(!s)break;if(o){let a=Wv(e,i);if(!a)return null;r+=a.value,i=a.endIndex,o=!1;continue}if(s==="\\"){o=!0;continue}if(s===n)return{value:r,endIndex:i+1};r+=s}return null}function Nv(e,t){let n=e[t];if(n!=='"'&&n!=="'")return null;return Uo(e,t,n)}function Lv(e,t,n){if(!t)return null;return t.startIndex>=e&&t.endIndex===n?t.value:null}function Wv(e,t){let n=e[t];if(!n)return null;if(n==="x"){let o=e.slice(t+1,t+3);if(!/^[0-9A-Fa-f]{2}$/.test(o))return null;return{value:String.fromCharCode(Number.parseInt(o,16)),endIndex:t+2}}if(/[0-7]/.test(n)){let o=/^[0-7]{1,3}/.exec(e.slice(t));if(!o)return null;return{value:String.fromCharCode(Number.parseInt(o[0],8)),endIndex:t+o[0].length-1}}return{value:{a:"\x07",b:"\b",f:"\f",n:`
+`,r:"\r",t:"\t",v:"\v"}[n]??n,endIndex:t}}function ha(e,t,n){return e.startsWith(n,t)&&!Cr(e[t-1])&&!Cr(e[t+n.length])}function Gv(e,t){return t!==null&&t>=e}function Qd(e,t){let n=e.indexOf(`
+`,t);return n===-1?e.length:n+1}function em(e,t){let n=Fv(e,t);if(n===-1)return!0;if("{([,;!~=".includes(e[n]??""))return!0;let r=n;while(Cr(e[r-1]))r--;return Tv.has(e.slice(r,n+1))}function Fv(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function tm(e,t){let n=!1;for(let r=t;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="/")return r+1}return null}var zv="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",Bv="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",$v="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function nm(e){return e==="dd"||e==="shred"||e==="mkfs"||e.startsWith("mkfs.")}function rm(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return v("dd.device-write",zv);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return v("mkfs.device",Bv);if(e==="shred"&&n.length>0)return v("shred.target",$v);return null}var Uv=new Set(["sudo","env","command","builtin"]),Hv=new Set(["exec","nice","nohup","setsid","stdbuf","time","timeout"]);function Ho(e,t){let n=e[0];if(!n||!om(T(n),t))return null;let r=T(n),o=e[1]==="--"?2:1,i=jv(e,o,r,t),s=i[0];if(s===void 0)return null;return{wrapper:r,tokens:e.slice(s),childIndex:s,alternativeChildIndices:i.slice(1)}}function jv(e,t,n,r){let o=e[1]==="--",i=[];for(let s=t;s<e.length;s++){let a=e[s];if(!a)continue;let l=T(a)!==n&&Vv(a,r);if(l)i.push(s);if(!l&&jr.has(O(a)))break;if(o)break}return i}function Vv(e,t){let n=T(e),r=O(e);return r==="git"||n==="busybox"||Ut(e)||os.has(n)||nm(r)||om(n,t)||Y.has(r)||e==="$SHELL"||De(r)||Pe.has(r)||t.rules.some((o)=>o.command===n)}function om(e,t){return Hv.has(e)||t.transparentWrappers.includes(e)}function Ut(e){return Uv.has(e.toLowerCase())}function Ht(e,t){return{embedded:!1,cwd:e.cwd,originalCwd:t.originalCwd,effectiveCwd:e.cwd,envAssignments:e.envAssignments,allowTmpdirVar:t.allowTmpdirVar,worktreeMode:t.worktreeMode,wrappedByTransparent:!1}}function Be(e,t){let n=t.policy??{rules:[],transparentWrappers:[]};return jo([...e],t.environment,t.cwd,t.cwd,new Map,new Map(t.envAssignments??[]),n,{iterations:0},!1)}function*jo(e,t,n,r,o,i,s,a,l){let c=To(e,t,n,i);for(let[f,p]of c.envAssignments)i.set(f,p),o.set(f,p);let{tokens:d,cwd:m}=c;if(c.envSplitValues){let f=Po(c.envSplitValues,d);if(!f)throw new N("derivedCommandShape");ba(a),yield*jo(f,t,m,r,o,i,s,a,l);return}if(Ut(d[0]??""))throw new N("wrapperPeelIterations");let u=Ho(d,s);if(u){for(let f of[u.childIndex,...u.alternativeChildIndices])ba(a),yield*jo(f===u.childIndex?u.tokens:d.slice(f),t,m,r,new Map(o),new Map(i),s,a,!0);return}if(qv(d)){ba(a),yield*jo(d.slice(1),t,m,r,o,i,s,a,l);return}yield Kv(d,m,r,o,i,l)}function Kv(e,t,n,r,o,i){return{tokens:e,cwd:t===null?void 0:t??n,wrapperCwd:t,wrapperEnvAssignments:r,envAssignments:o,head:T(e[0]??"").toLowerCase(),wrappedByTransparent:i}}function ba(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function qv(e){return T(e[0]??"").toLowerCase()==="busybox"&&e.length>1}function Sa(e,t){let n=[],r=t;while(r<e.length){let o=e[r];if(o===void 0||o===":::")break;n.push(o),r++}return{markerIndex:r<e.length&&e[r]===":::"?r:-1,templateTokens:n}}function $e(e){let t=!1,n=!1;for(let r of e){if(r==="--")break;if(r==="-r"||r==="-R"||va(r,"recursive")){t=!0;continue}if(r==="-f"||va(r,"force")){n=!0;continue}if(r.startsWith("-")&&!r.startsWith("--")){if(r.includes("r")||r.includes("R"))t=!0;if(r.includes("f"))n=!0}}return t&&n}function Vo(e){let t=e.indexOf("--");return e.slice(1,t===-1?void 0:t).some((n)=>va(n,"recursive")||/^-[A-Za-z]+$/.test(n)&&/[rR]/.test(n.slice(1)))}function va(e,t){return e.length>2&&e.startsWith("--")&&t.startsWith(e.slice(2))}var Yv=["--init-file","--rcfile"],Zv=new Map([["bash","BASH_ENV"],["dash","ENV"],["ksh","ENV"],["sh","ENV"]]);function Ue(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n)continue;if(n==="-c")return im(e,t,!0);if(n.startsWith("-")&&n.includes("c")&&!n.startsWith("--")){let r=im(e,t,!1);if(r!==null)return r}}return null}function st(e){let t=T(e[0]??"").toLowerCase();if(t==="zsh"||t==="ksh")return xe(e).syntaxCheck;let n=!1;for(let r of e.slice(1)){if(r==="--")return n;if(r.startsWith("+")&&!r.startsWith("++")){if(r.slice(1).includes("n"))n=!1;continue}if(!r.startsWith("-")||r.startsWith("--"))return n;let o=r.slice(1);if(o.includes("n"))n=!0;if(o.includes("c"))return n}return n}function im(e,t,n){if(e[t+1]==="--")return e[t+2]||null;let r=e[t+1];if(!r||!n&&r.startsWith("-"))return null;return r}function sm(e){let t=T(e[0]??"").toLowerCase(),n=Xv(e,t),r=Zv.get(t)??null,o=n.argvSource?.kind!=="absent";return{argvSource:t==="bash"?n.argvSource:null,argvSourceApplies:t==="bash"&&n.interactive&&n.argvSource?.kind==="literal",envName:r,envSourceApplies:o&&(r==="BASH_ENV"?!n.interactive:r==="ENV"&&n.interactive)}}function Xv(e,t){let n=xe(e),r=n.commandIndex??n.scriptIndex??e.length,o=[],i=!1,s=!0;for(let a=1;a<r;a++){let l=e[a];if(l===void 0||l==="--"||l==="-"||l[0]!=="-"&&l[0]!=="+")break;if(l.startsWith("--")){if(t==="bash"&&s?Yv.find((u)=>l===u):void 0){let u=e[a+1];o.push(u===void 0?{kind:"absent"}:{kind:"literal",value:u}),a++;continue}let m=l.split("=",1)[0]??l;if(t==="bash"&&ns.has(m)&&!l.includes("="))a++;continue}if(t==="bash")s=!1;let c=rs(t,l,e[a+1],"startup");if(c.interactive)i=l[0]==="-";a+=c.followingValues}return{argvSource:o.at(-1)??null,interactive:i}}var Jv="find -delete permanently removes files. Use -print first to preview.",Qv="find -exec rm -rf is dangerous. Use explicit file list instead.",eE=new Set(["-exec","-execdir","-ok","-okdir"]),tE=new Map([...["-Bmin","-Bnewer","-Btime","-amin","-anewer","-atime","-cmin","-cnewer","-context","-ctime","-f","-flags","-fprint","-fprint0","-fls","-fstype","-gid","-group","-ilname","-iname","-inum","-ipath","-iwholename","-iregex","-links","-lname","-maxdepth","-mindepth","-mmin","-mnewer","-mtime","-name","-newer","-newerXY","-newermt","-path","-perm","-printf","-regex","-samefile","-size","-type","-uid","-used","-user","-wholename","-xattrname","-xtype"].map((e)=>[e,1]),["-fprintf",2]]);function am(e,t){let n=e.map(_),r=nE(e,n,t);if(r)return r;if(Ko(n,1)&&!lE(e,n,t)){let s=P(v("find.delete",Jv),t.policy);if(s)return s}let o=t.budget??Se(),i=0;while(i<n.length){let s=n[i],a=at(s??"");if(a>0){i+=a+1;continue}if(!qe(s)){i++;continue}o.charge("derivedTokens",n.length-i-1);let l=xn(n,i);i=l.nextIndex;let c=uE(l.tokens,t.environment);if(c){let f=P(c,t.policy);if(f)return f}let d=s==="-execdir"||s==="-okdir",m=t.analyzeTokens?t.analyzeTokens(l.tokens,d?null:t.cwd):t.analyzeNested?t.analyzeNested(l.tokens.join(" "),{effectiveCwd:d?void 0:t.cwd,envAssignments:t.envAssignments}):null,u=m?.id.startsWith("custom.")?m:P(m,t.policy);if(u)return u}return null}function nE(e,t,n){if(!Ko(t,1)&&!Ea(t,n.environment))return null;let o=Sr(e)??q(["."]),i=vt({...n,allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0});for(let s of o){let a=hr(s);for(let l of a.expandedTargets??[_(s)]){let c=ze(l,i,{targetIsLiteral:a.expandedTargets!==void 0||a.targetIsLiteral,tmpdirWordSplittingProtected:a.tmpdirWordSplittingProtected});if(c.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home","rm -rf targeting root or home directory is extremely dangerous and always blocked.");if(c.kind==="git_metadata_target"&&!rE(e,i.protectedGitMetadata,n.environment))return v("find.delete-git-metadata",ke)}}if(aE(t)&&i.resolvedCwd&&_d(o.map(_),i.resolvedCwd,i.protectedGitMetadata,i.environment,i.budget))return v("find.delete-git-metadata",ke);return null}function rE(e,t,n){if(!t)return!1;let r=e.map(_),o=[],i=!1,s=Sr(e)?.at(-1),a=s?e.indexOf(s)+1:1;while(a<r.length){let l=r[a]??"";if(qe(l)){let c=xn(r,a),d=Ct([...c.tokens],n),m=Vo(d),u=Y.has(T(d[0]??"").toLowerCase()),f=c.tokens.some((g)=>g!=="{}"&&g.includes("{}")),p=(l==="-execdir"||l==="-okdir")&&d.slice(1).some((g)=>g!=="{}"&&!g.startsWith("-"));if(m||u||f||p)return!1;i=!0,a=c.nextIndex;continue}if(l==="-delete"){i=!0,a++;continue}if(l==="-name"||l==="-iname"){let c=e[a+1];if(!(c?.provenance==="literal"&&!/[[\\]/.test(c.text)))return!1;if(!i)o.push(iE(c.text,l==="-iname"));a+=2;continue}if(!oE.has(l))return!1;a+=1+at(l)}return o.length>0&&!Pd(t,(l)=>o.every((c)=>c.test(l)))}var oE=new Set(["-a","-and","-depth","-maxdepth","-mindepth","-mmin","-mtime","-newer","-size","-type"]);function iE(e,t){let n=e.replace(/[*?]|[.+^${}()|\]/]/g,(r)=>r==="*"?".*":r==="?"?".":`\\${r}`);return new RegExp(`^${n}$`,t?"isu":"su")}var sE=/(?:^|[\s;&|(`{])\\?(?:\S*\/)?rm(?:dir)?(?=[\s;&|)`}]|$)/;function Ea(e,t){let n=0;while(n<e.length){if(!qe(e[n])){n++;continue}let r=xn(e,n),o=Ct([...r.tokens],t),i=T(o[0]??"").toLowerCase(),s=Y.has(i)&&sE.test((Ue(o)??"").replace(/["'\\]/g,""));if((i==="rm"||i==="rmdir"||s)&&o.some((l)=>l.includes("{}")))return!0;n=r.nextIndex}return!1}function aE(e){return e.some((t,n)=>{if(!["-name","-iname"].includes(t))return!1;return e[n+1]?.toLowerCase()==="hooks"})}function lE(e,t,n){if(t.includes("-L")||t.includes("-f")||t.includes("-follow"))return!1;let r=Sr(e);if(!r)return!1;let o=n.envAssignments??new Map,i=ca(o,n.environment),s=n.trustedTmpdirValue??Bt(o,n.environment),a=n.allowTmpdirVar??!pr(o,n.environment),l={environment:n.environment,protectedGitMetadata:n.protectedGitMetadata,cwd:n.cwd,originalCwd:n.originalCwd,strict:n.strict,allowTmpdirVar:a&&s&&Boolean(i),allowPaths:n.policy?.destructiveCommandAllowPaths,posixShell:!0,tmpdirWordSplittingUnsafe:n.tmpdirWordSplittingUnsafe??St(o,n.environment),trustedTmpdirValue:s,budget:n.budget},c=vt(l),d=vt({...l,cwd:n.originalCwd??n.cwd}),m=n.originalCwd&&n.environment.paths.realpath(n.originalCwd),u=n.cwd&&n.environment.paths.realpath(n.cwd),f=m&&u&&!vn(u,m)?n.cwd:void 0;return r.every((p)=>{let g=hr(p);if(g.unsafeBraceExpansion)return!1;return(g.expandedTargets??[_(p)]).every((h)=>{let y=/^\.\/*$/.test(h)?f:void 0,b=y??h;return Wd(b,y?d:c,{containmentTarget:cE(b,i),targetIsLiteral:g.expandedTargets!==void 0||g.targetIsLiteral,tmpdirWordSplittingProtected:g.tmpdirWordSplittingProtected})})})}function cE(e,t){if(!t)return e;return e.replace(/^(?:\$TMPDIR|\$\{TMPDIR\})/,()=>t)}function Sr(e){let t=(o)=>{let i=e[o];return i?_(i):void 0},n=1;while(t(n)==="-H"||t(n)==="-P")n++;if(t(n)==="--")n++;let r=[];while(n<e.length){let o=t(n),i=e[n];if(!o||!i||o.startsWith("-")||["!","(",")"].includes(o))break;r.push(i),n++}return r.length>0?r:null}function uE(e,t){let n=yt([...e],t);if(n.length===0)return null;let r=T(n[0]??"");if(r==="busybox"&&n.length>1)n=n.slice(1),r=T(n[0]??"");if(r==="rm"&&$e(n))return v("find.exec-rm-recursive-force",Qv);return null}function xn(e,t){let n=t+1;while(n<e.length&&e[n]!==";"&&!(e[n]==="+"&&e[n-1]==="{}"))n++;return{tokens:e.slice(t+1,n),nextIndex:Math.min(n+1,e.length)}}function Ko(e,t){let n=t;while(n<e.length){let r=e[n];if(!r){n++;continue}if(qe(r)){n=xn(e,n).nextIndex;continue}let o=at(r);if(o>0){n+=o+1;continue}if(r==="-delete")return!0;n++}return!1}function at(e){return tE.get(e)??(/^-newer[A-Za-z]{2}$/.test(e)?1:0)}function qe(e){return e!==void 0&&eE.has(e)}import{resolve as Wx}from"path";function vr(e){let t=Ne(e,"posix");if(t.status!=="complete"||t.nodes.length!==1)return null;let n=t.nodes[0];if(n?.kind!=="command")return null;if(n.redirections.length>0||n.nested.length>0)return null;if(n.words.some((r)=>r.provenance==="command-substitution"))return null;return n.words.map((r)=>r.text)}var dE=5,xa="Git aliases supplied through command-line or environment config can hide or execute commands. Run git without Git alias overrides, or ask the user to run it manually.";function ie(e){let t=e.indexOf("--");if(t===-1)return{index:-1,before:e,after:[]};return{index:t,before:e.slice(0,t),after:e.slice(t+1)}}function cm(e,t,n){let r=qo(e,t,n),o=mE(r.entries);if(o.size===0)return{blockedReason:r.blockedReason,expanded:!1,tokens:e};let i=e,s=!1;for(let a=0;a<dE;a++){let{subcommand:l,rest:c}=_e(i),d=l?.toLowerCase();if(!d||!o.has(d))return{blockedReason:r.blockedReason,expanded:s,tokens:i};let m=o.get(d),u=yE(m);if(u===null||u.length===0)return{blockedReason:xa,expanded:!0,tokens:i};i=["git",...u,...c],s=!0}return{blockedReason:xa,expanded:!0,tokens:i}}function um(e,t,n){return qo(e,t,n).entries.some((r)=>r.key.toLowerCase()==="core.sshcommand")}function _e(e){if(e.length===0)return{subcommand:null,rest:[]};let t=e[0];if((t?T(t).toLowerCase():null)!=="git")return{subcommand:null,rest:[]};let r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--"){let i=e[r+1];if(i&&!i.startsWith("-"))return{subcommand:i,rest:e.slice(r+2)};return{subcommand:null,rest:e.slice(r+1)}}if(!o.startsWith("-"))return{subcommand:o,rest:e.slice(r+1)};r+=Ee.has(o)?2:1}return{subcommand:null,rest:[]}}function mE(e){let t=new Map;for(let n of e){let r=n.key.toLowerCase();if(!r.startsWith("alias."))continue;let o=r.slice(6);if(o!=="")t.set(o,n.value)}return t}function qo(e,t,n){if(e.length===0)return{blockedReason:null,entries:[]};let r=e[0];if((r?T(r).toLowerCase():null)!=="git")return{blockedReason:null,entries:[]};let i=pE(t,n);return{blockedReason:i.blockedReason,entries:[...i.entries,...fE(e,t,n)]}}function fE(e,t,n){let r=[],o=1;while(o<e.length){let i=e[o];if(!i||i==="--"||!i.startsWith("-"))return r;if(i==="-c"){let s=Ra(e[o+1]);if(s)r.push(s);o+=2;continue}if(i.startsWith("-c")&&i.length>2){let s=Ra(i.slice(2));if(s)r.push(s);o++;continue}if(i==="--config-env"){let s=lm(e[o+1],t,n);if(s)r.push(s);o+=2;continue}if(i.startsWith("--config-env=")){let s=lm(i.slice(13),t,n);if(s)r.push(s);o++;continue}if(Ee.has(i)){o+=2;continue}o++}return r}function pE(e,t){let n=gE(e,t),r=hE(e,t);return{blockedReason:n===null||r===null?xa:null,entries:[...n??[],...r??[]]}}function gE(e,t){let n=rt("GIT_CONFIG_PARAMETERS",e,t);if(n===void 0)return[];let r=[],o=vr(n);if(!o)return null;for(let i of o){let s=Ra(i);if(!s)return null;r.push(s)}return r}function hE(e,t){let n=td(e,t);if(n.state==="absent")return[];if(n.state==="invalid")return null;let r=[];for(let o=0;o<n.count;o++){let i=rt(`GIT_CONFIG_KEY_${o}`,e,t)?.trim(),s=rt(`GIT_CONFIG_VALUE_${o}`,e,t);if(!i||s===void 0)return null;r.push({key:i,value:s})}return r}function Ra(e){if(!e)return null;let t=e.indexOf("=");return{key:(t===-1?e:e.slice(0,t)).trim(),value:t===-1?void 0:e.slice(t+1)}}function lm(e,t,n){let r=e?.indexOf("=")??-1;if(!e||r===-1)return null;return{key:e.slice(0,r).trim(),value:rt(e.slice(r+1),t,n)}}function yE(e){let t=e?.trimStart();if(!t||t.startsWith("!"))return null;return vr(t)}var CE="git checkout -- discards uncommitted changes permanently. Use 'git stash' first.",bE="git checkout <path> discards uncommitted changes permanently. Use 'git stash' first, or 'git switch' to change branches.",SE="git checkout --force discards uncommitted changes. Use 'git stash' first.",vE="git checkout <ref> -- <path> overwrites working tree with ref version. Use 'git stash' first.",EE="git checkout --pathspec-from-file can overwrite multiple files. Use 'git stash' first.",xE="git checkout with multiple positional args may overwrite files. Use 'git switch' for branches or 'git restore' for files.",RE="git switch --discard-changes discards uncommitted changes. Use 'git stash' first.",wE="git switch --force discards uncommitted changes. Use 'git stash' first.",_E="git restore discards uncommitted changes. Use 'git stash' first, or use --staged to only unstage.",AE="git restore --worktree explicitly discards working tree changes. Use 'git stash' first.",PE="git reset --hard destroys all uncommitted changes permanently. Use 'git stash' first.",TE="git reset --merge can lose uncommitted changes. Use 'git stash' first.",IE="git clean -f removes untracked files permanently. Use 'git clean -n' to preview first.",kE="git rm --force removes tracked files from the working tree. Use 'git rm --cached' to keep the files, or 'git rm --dry-run' to preview first.",OE="git push --force destroys remote history. Use --force-with-lease for safer force push.",ME="git push deletes remote refs. Ask the user to run it manually if deletion is intended.",DE="git push --mirror can force-update and delete remote refs. Ask the user to run it manually if mirror push is intended.",NE="git branch -D force-deletes without merge check. Use -d for safe delete.",LE="git rebase --abort discards rebase conflict resolutions. Use 'git status' first.",WE="git merge --abort discards merge conflict resolutions. Use 'git status' first.",GE="git tag -d permanently deletes tags. Ask the user to run it manually if deletion is intended.",FE="git reflog delete removes recovery history. Ask the user to run it manually if deletion is intended.",zE="git stash drop permanently deletes stashed changes. Consider 'git stash list' first.",BE="git stash clear deletes ALL stashed changes permanently. Use 'git stash list' to review; ask the user to run it manually if intended.",$E="git worktree remove --force can delete uncommitted changes. Remove --force flag.",UE=new Set(["-b","-B","--orphan","--conflict","--inter-hunk-context","--pathspec-from-file","--unified"]),HE=new Set(["--recurse-submodules","--track","-t"]),wa=new Set(["-b","-B","-U"]),_a=new Set(["-c","-C"]),jE=new Set(["--source","--conflict","--unified","--inter-hunk-context"]);function M(e,t){let n=e.split("=",1)[0]??e;return n.length>=4&&t.startsWith(n)&&n.startsWith("--")&&n.slice(2).length>=2}var Rn=new Set(["branch","checkout","clean","merge","push","rebase","reflog","reset","restore","rm","stash","switch","tag","worktree"]);function mm(e,t){let{subcommand:n,rest:r}=_e(e);if(!n)return null;switch(n.toLowerCase()){case"checkout":return Et(VE(r,t));case"switch":return Et(qE(r));case"restore":return Et(ZE(r));case"reset":return JE(r);case"clean":return Et(ex(r));case"rm":return Et(tx(r));case"push":return jt(nx(r));case"branch":return jt(ix(r));case"stash":return jt(ux(r));case"worktree":return jt(dx(r));case"rebase":return Et(sx(r));case"merge":return Et(ax(r));case"tag":return jt(lx(r));case"reflog":return jt(cx(r));default:return null}}function Et(e){return e?{...e,localDiscard:!0}:null}function jt(e){return e?{...e,localDiscard:!1}:null}function VE(e,t){let{index:n,before:r}=ie(e),o=me(r,{shortOptsWithValue:wa});if(r.some((a)=>M(a,"--force"))||o.has("-f"))return v("git.checkout-force",SE);for(let a of e){if(a==="-b"||a==="-B"||a==="--orphan")return null;if(M(a,"--pathspec-from-file"))return v("git.checkout-pathspec-from-file",EE)}if(n!==-1){if(r.some((l)=>!l.startsWith("-")))return v("git.checkout-ref-path",vE);return v("git.checkout-double-dash",CE)}let i=YE(e);if(i.length>=2)return v("git.checkout-ambiguous",xE);let s=i[0];if(s===void 0||o.has("-d")||o.has("-t")||e.some((a)=>M(a,"--detach")||M(a,"--track")))return null;if(KE(s)||t(s))return v("git.checkout-double-dash",bE);return null}function KE(e){return e==="."||e===".."||/^\.\.?[/\\]/.test(e)||/^([/\\]|[A-Za-z]:[/\\])/.test(e)||e.endsWith("/")||e.startsWith(":")||/[*?[]/.test(e)}function qE(e){let{before:t}=ie(e);if(t.some((r)=>M(r,"--discard-changes")))return v("git.switch-discard-changes",RE);let n=me(t,{shortOptsWithValue:_a});if(t.some((r)=>M(r,"--force"))||n.has("-f"))return v("git.switch-force",wE);return null}function YE(e){let t=[],n=0;while(n<e.length){let r=e[n];if(!r)break;if(r==="--")break;if(!r.startsWith("-")){t.push(r),n++;continue}if(UE.has(r)){n+=2;continue}if(HE.has(r)){let o=e[n+1],i=r==="--recurse-submodules"?["checkout","on-demand"]:["direct","inherit"];n+=o&&!o.startsWith("-")&&i.includes(o)?2:1;continue}n++}return t}function ZE(e){let t=XE(e);if(t.isTerminal||!t.hasPathspec&&!t.hasPatch||!t.hasWorktree)return null;return t.hasExplicitLocation?v("git.restore-worktree",AE):v("git.restore-unstaged",_E)}function XE(e){let t=!1,n=!1,r=!0,o=!1,i=(s)=>{if(!o)r=!1,o=!0;if(s!==void 0)r=s};for(let s=0;s<e.length;s++){let a=e[s];if(a===void 0)break;if(a==="--"){t||=s+1<e.length;break}if(a==="--pathspec-from-file"){t=!0,s++;continue}if(a.startsWith("--pathspec-from-file=")){t=!0;continue}if(a==="-h"||a==="--help"||a==="--version")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(a==="--staged"){i();continue}if(a==="--no-staged"){i();continue}if(a==="--worktree"){i(!0);continue}if(a==="--no-worktree"){i(!1);continue}if(a==="--patch"){n=!0;continue}if(a==="--no-patch"){n=!1;continue}if(jE.has(a)){s++;continue}if(a.startsWith("--"))continue;if(a==="-"){t=!0;continue}if(!a.startsWith("-")){t=!0;continue}for(let l=1;l<a.length;l++){let c=a.charAt(l);if(c==="h")return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!0};if(c==="S"){i();continue}if(c==="W"){i(!0);continue}if(c==="p"){n=!0;continue}if(c==="s"||c==="U"){if(l===a.length-1)s++;break}}}return{hasPathspec:t,hasPatch:n,hasWorktree:r,hasExplicitLocation:o,isTerminal:!1}}function JE(e){let t=null;for(let n of e){if(M(n,"--hard")){t=v("git.reset-hard",PE);break}if(M(n,"--merge")){t=v("git.reset-merge",TE);break}}if(!t)return null;return QE(e)?jt(t):Et(t)}function QE(e){for(let t of e){if(t==="--")return!1;if(!t.startsWith("-"))return!0}return!1}function ex(e){for(let n of e)if(n==="-n"||M(n,"--dry-run"))return null;let t=me(e.filter((n)=>n!=="--"));if(e.some((n)=>M(n,"--force"))||t.has("-f"))return v("git.clean-force",IE);return null}function tx(e){let t=!1,n=!1,r=!1;for(let o of ie(e).before){if(M(o,"--no-force")){t=!1;continue}if(M(o,"--force")){t=!0;continue}if(M(o,"--no-cached")){n=!1;continue}if(M(o,"--cached")){n=!0;continue}if(M(o,"--no-dry-run")){r=!1;continue}if(M(o,"--dry-run")){r=!0;continue}let i=me([o]);t||=i.has("-f"),r||=i.has("-n")}return t&&!n&&!r?v("git.rm-force",kE):null}function nx(e){let{before:t,after:n}=ie(e),r=me(t);if(t.some((s)=>M(s,"--mirror")))return v("git.push-mirror",DE);if(t.some((s)=>M(s,"--force"))||r.has("-f")||dm(t,n).some(rx))return v("git.push-force",OE);if(t.some((s)=>M(s,"--delete"))||r.has("-d")||dm(t,n).some(ox))return v("git.push-delete",ME);return null}function dm(e,t){return[...e.filter((n)=>n!==""&&!n.startsWith("-")),...t]}function rx(e){return e.startsWith("+")||e.includes(":+")}function ox(e){return e.length>1&&e.startsWith(":")}function ix(e){let{before:t}=ie(e),n=me(t),r=n.has("-D")||n.has("-d")||t.some((i)=>M(i,"--delete")),o=n.has("-D")||n.has("-f")||t.some((i)=>M(i,"--force"));if(r&&o)return v("git.branch-force-delete",NE);return null}function sx(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.rebase-abort",LE):null}function ax(e){let{before:t}=ie(e);return t.some((n)=>M(n,"--abort"))?v("git.merge-abort",WE):null}function lx(e){let{before:t}=ie(e);return me(t).has("-d")||t.some((r)=>M(r,"--delete"))?v("git.tag-delete",GE):null}function cx(e){return e[0]==="delete"?v("git.reflog-delete",FE):null}function ux(e){for(let t of e){if(t==="drop")return v("git.stash-drop",zE);if(t==="clear")return v("git.stash-clear",BE)}return null}function dx(e){let{before:t}=ie(e);if(!t.includes("remove"))return null;let r=me(t);if(t.some((o)=>M(o,"--force"))||r.has("-f"))return v("git.worktree-remove-force",$E);return null}import{dirname as Ox,isAbsolute as Mx,join as Am,resolve as Dx}from"path";var Pa="TMPDIR",Ta="IFS",pm=/^([A-Za-z_][A-Za-z0-9_]*)\+=/,gm=/^[A-Za-z_][A-Za-z0-9_]*$/,hm=new Set(["export","typeset","declare","readonly"]),mx=new Set(["builtin","command","time"]),fx=new Set(["do","then","else"]),px=new Set(["do","then","case"]),fm=new Set(["done","fi","esac"]),gx=/\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;function ym(e,t){return e.map((n)=>n.provenance==="variable"&&Rm(n.text)?Cm(n.text,t.shellAssignments):_(n))}function Cm(e,t){return e.replace(gx,(n,r,o)=>t.get(r??o??"")??n)}function Ye(e,t){let n=e.parts.every((o)=>o.provenance!=="literal"||!/[$`]/.test(o.raw));if(e.provenance!=="variable"||!n)return null;let r=Cm(e.text,t);return/^[~-]/.test(r)||/[\s$`*?[]/.test(r)?null:r}function bm(e,t){return{env:e,effectiveEnvAssignments:bx(e,t),shellAssignments:new Map,bodyDepth:0,bodyAssignments:new Set}}function Sm(e){return{env:e.env,effectiveEnvAssignments:e.effectiveEnvAssignments?new Map(e.effectiveEnvAssignments):void 0,shellAssignments:new Map(e.shellAssignments),bodyDepth:e.bodyDepth,bodyAssignments:new Set(e.bodyAssignments)}}function Ia(e,t){let n=Em(e,t),r=e[0]??"";if(px.has(r))t.bodyDepth+=1;if(r==="elif"||fm.has(r))t.bodyDepth=Math.max(0,t.bodyDepth-1);if(fm.has(r)&&t.bodyDepth===0)t.bodyAssignments.forEach((a)=>{t.shellAssignments.delete(a)}),t.bodyAssignments.clear();n.assignments.filter((a)=>a.persists).forEach((a)=>{if(t.shellAssignments.set(a.name,a.value),t.bodyDepth>0)t.bodyAssignments.add(a.name);ka(t,a)});let o=n.commandIndex;if(o!==-1&&hm.has(e[o]??""))e.filter((a)=>gm.test(a)&&Aa(a)).forEach((a)=>{Sx(t,a)});let i=o===-1?-1:xm(e,o);if(i===-1||e[i]!=="unset")return;let s=Ex(e,i);if(s===null)return;e.slice(s).forEach((a)=>{if(t.bodyDepth>0){t.shellAssignments.set(a,"");return}vx(t,a)})}function vm(e,t){let n=Em(e,t).assignments;if(n.length===0)return t.effectiveEnvAssignments;let r=new Map(t.effectiveEnvAssignments??[]);return n.forEach((o)=>{r.set(o.name,o.value)}),r}function Em(e,t){let n=fx.has(e[0]??"")?1:0,r=e.findIndex((a,l)=>l>=n&&!Rm(a)),o=r!==-1&&hm.has(e[xm(e,r)]??""),i=Cx(t);return{assignments:e.flatMap((a,l)=>{let c=hx(a,i,t.env);if(!c)return[];if(r!==-1&&l>r&&!o&&!wo(c.name))return[];return i.set(c.name,c.value),[{...c,persists:r===-1||o}]}),commandIndex:r}}function xm(e,t){let n=t;while(mx.has(e[n]??"")){n+=1;while(e[n]?.startsWith("-")){if(/^-p*[vV][pvV]*$/.test(e[n]??""))return t;n+=1}}return n}function Rm(e){return Ie(e)!==null||pm.test(e)}function hx(e,t,n){return Ie(e)??yx(e,t,n)}function yx(e,t,n){let r=_o(e,n,t);if(r)return r;let o=e.match(pm)?.[1];if(!o)return null;let i=e.indexOf("=");return{name:o,value:`${t.has(o)?t.get(o):n.get(o)??""}${e.slice(i+1)}`}}function Aa(e){return e===Pa||e===Ta||ea(e)}function Cx(e){return new Map([...e.effectiveEnvAssignments??[],...e.shellAssignments])}function bx(e,t){let n=[Pa,Ta].map((r)=>{let o=e.get(r);return o===void 0?null:[r,o]}).filter((r)=>r!==null);if(n.length===0)return t;return new Map([...n,...t??[]])}function ka(e,t){let n=new Map(e.effectiveEnvAssignments??[]);n.set(t.name,t.value),e.effectiveEnvAssignments=n}function Sx(e,t){ka(e,{name:t,value:e.shellAssignments.get(t)??e.effectiveEnvAssignments?.get(t)??e.env.get(t)??""})}function vx(e,t){if(!Aa(t)&&!gm.test(t))return;if(e.shellAssignments.set(t,""),wo(t)&&e.env.has(t)){let r=new Map(e.env);r.delete(t),e.env=r}if(!Aa(t)||t===Pa||t===Ta||Hn(t)){ka(e,{name:t,value:""});return}if(!e.effectiveEnvAssignments?.has(t))return;let n=new Map(e.effectiveEnvAssignments);n.delete(t),e.effectiveEnvAssignments=n.size===0?void 0:n}function Ex(e,t){let n=t+1;while(n<e.length){let r=e[n];if(!r)return null;if(r==="--")return n+1;if(r==="-v"){n++;continue}if(r.startsWith("-"))return null;return n}return n}import{resolve as xx}from"path";function Yo(e,t){return Qs.some((n)=>t?.has(n)||e.has(n))}function wn(e,t,n){if(!t)return{gitCwd:null,hasExplicitGitContext:!1};let r=n.realpath(xx(t));if(r===null||!n.isDirectory(r))return{gitCwd:null,hasExplicitGitContext:!1};let o=r,i=!1,s=1;while(s<e.length){let a=e[s];if(!a)break;if(a==="--")break;if(!a.startsWith("-"))break;if(a==="-C"){let l=e[s+1];if(!l)return{gitCwd:null,hasExplicitGitContext:i};let c=wm(o,l,n);if(!c)return{gitCwd:null,hasExplicitGitContext:i};o=c,s+=2;continue}if(a.startsWith("-C")&&a.length>2){let l=wm(o,a.slice(2),n);if(!l)return{gitCwd:null,hasExplicitGitContext:i};o=l,s++;continue}if(a==="--git-dir"||a==="--work-tree"){i=!0,s+=2;continue}if(a.startsWith("--git-dir=")||a.startsWith("--work-tree=")){i=!0,s++;continue}s+=Ee.has(a)?2:1}return{gitCwd:o,hasExplicitGitContext:i}}function wm(e,t,n){try{let r=ht(e,t,n);return n.isDirectory(r)?r:null}catch{return null}}function _m(e,t,n){if(!t.localDiscard||!n.worktreeMode||Yo(n.environment.env,n.envAssignments))return null;let r=wn(e,n.cwd,n.environment.paths);if(!r.gitCwd||r.hasExplicitGitContext)return null;let o=n.environment.worktreeFacts(r.gitCwd);if(!o)return null;if(Oa(e,n,o))return null;return{kind:"worktree",originalReason:t.reason,gitCwd:r.gitCwd}}function Oa(e,t,n){let{subcommand:r,rest:o}=_e(e),i=r?.toLowerCase();if(t.dynamicArguments||Rx(o)||Tx(e,t.environment.env,t.envAssignments,n)||Ax(o)||wx(i,o))return!0;return i==="clean"&&Px(o)>1}function Rx(e){return e.some((t)=>/[$*?[]/.test(t))}function wx(e,t){if(e==="checkout"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:wa}),o=n.some((s)=>M(s,"--force"))||r.has("-f"),i=r.has("-B")||n.some((s)=>s==="-B"||s.startsWith("-B"));return o&&i}if(e==="switch"){let{before:n}=ie(t),r=me(n,{shortOptsWithValue:_a}),o=n.some((s)=>M(s,"--force"))||n.some((s)=>M(s,"--discard-changes"))||r.has("-f"),i=n.some((s)=>s==="-C"||s.startsWith("-C")||_x(s))||r.has("-C");return o&&i}return!1}function _x(e){let t=e.split("=",1)[0]??e;return t==="--force-create"||t.length>=9&&"--force-create".startsWith(t)}function Ax(e){return e.some((t)=>t.startsWith("--recurse-sub"))}function Px(e){let t=0;for(let n of e){if(n==="--force"){t++;continue}if(n.startsWith("-")&&!n.startsWith("--")){for(let r of n.slice(1))if(r==="f")t++}}return t}function Tx(e,t,n,r){if(rt("GIT_CONFIG_PARAMETERS",t,n)!==void 0)return!0;let o=qo(e,t,n);if(o.blockedReason!==null)return!0;let i=o.entries.map((a)=>({key:a.key.toLowerCase(),value:a.value}));if(i.some((a)=>kx(a.key)))return!0;let s=i.filter((a)=>a.key==="submodule.recurse").at(-1);if(s)return s.value===void 0||Ix(s.value);if(rd(n))return!0;return r.recursiveSubmodules}function Ix(e){let t=e.toLowerCase();return t!=="false"&&t!=="no"&&t!=="off"&&t!=="0"}function kx(e){return e==="include.path"||e.startsWith("includeif.")&&e.endsWith(".path")}function Pm(e,t,n){let r=e.map((l)=>Ye(l,n.shellAssignments??new Map)??_(l)),o=n.environment.paths,i=wn(r,n.cwd,o),s=n.originalCwd?o.realpath(Dx(n.originalCwd)):null;if(t.id.startsWith("git.push-")||s===null||i.gitCwd===null||i.hasExplicitGitContext||Yo(n.environment.env,n.envAssignments))return null;let a=t.id==="git.worktree-remove-force"?Lx(e,n.shellAssignments,o):Tm(i.gitCwd,o);if(a===null||t.id!=="git.worktree-remove-force"&&!Nx(a,r,t,n)||!Sn(a,n.environment)||Fo(a,n.environment)||vn(s,a)||vn(a,s))return null;return{kind:"temp-root",originalReason:t.reason,gitCwd:i.gitCwd}}function Nx(e,t,n,r){let o=r.environment.paths,i=Am(e,".git");if(o.entryKind(i)!=="present")return!1;if(o.isDirectory(i))return!0;if(!n.localDiscard)return!1;let a=r.environment.worktreeFacts(e);return a!==null&&!Oa(t,r,a)}function Lx(e,t,n){let r=_e(e.map(_)).rest,{before:o,after:i}=ie(r.slice(r.indexOf("remove")+1)),s=[...o.filter((d)=>!d.startsWith("-")),...i],a=s.length===1?s[0]??"":"",l=e.find((d)=>d.text===a),c=(l&&Ye(l,t??new Map))??a;if(!Mx(c)||/[\s$`*?[]/.test(c)||n.entryKind(c)!=="present"||!n.isDirectory(c))return null;return n.realpath(c)}function Tm(e,t){if(t.entryKind(Am(e,".git"))!=="missing")return e;let n=Ox(e);return n===e?null:Tm(n,t)}var Gx="Git SSH environment overrides can execute arbitrary commands during network operations. Run git without GIT_SSH/GIT_SSH_COMMAND overrides, or ask the user to run it manually.",Fx=new Set(["clone","fetch","pull","push","ls-remote","submodule"]);function Zo(e,t){return Im(e,t)}function Im(e,t,n){let r=e.map(_),o=cm(r,t.environment.env,t.envAssignments),i=o.blockedReason?P(v("git.alias-config",o.blockedReason),t.policy):null;if(i)return i;let s=o.tokens;if((nd(t.envAssignments)||um(r,t.environment.env,t.envAssignments))&&zx(s))return v("git.ssh-env",Gx);let a=mm(s,(c)=>{let d=wn(r,t.cwd,t.environment.paths).gitCwd;return d!==null&&t.environment.paths.entryKind(Wx(d,c))!=="missing"});if(!a)return null;if(o.expanded||o.blockedReason)return a;let l=_m(r,a,t)??Pm(e,a,t);if(!l)return a;return n?.(l),null}function km(e,t){let n=null;return{match:Im(e,t,(o)=>{n=o}),relaxation:n}}function zx(e){let{subcommand:t,rest:n}=_e(e),r=t?.toLowerCase();if(!r)return!1;if(Fx.has(r))return!0;if(r==="archive")return ie(n).before.some((o)=>M(o,"--remote"));return r==="remote"&&Bx(n)}function Bx(e){return e.find((t)=>!$x(t))?.toLowerCase()==="update"}function $x(e){return e==="-v"||M(e,"--verbose")||M(e,"--no-verbose")}import{isAbsolute as yR}from"path";function Om(e,t,n,r){let o=e.slice(0,t),i=e.slice(t+n);return r.startsWith(o)&&r.endsWith(i)?r.slice(o.length,r.length-i.length):null}function Xo(e,t,n){let r=(i)=>`${i.tokenIndex}\x00${i.kind}\x00${i.value}`,o=new Set(e.map(r));return Array.from(t).some((i)=>n(i).some((s)=>!o.has(r(s))))}var Mm="rm -rf outside cwd is blocked. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Ux="rm -rf for non-temporary paths is blocked by the active safety policy. Retry deleting only explicit paths inside the current directory; escalate for anything outside it.",Hx="rm -rf target contains shell variables that cannot be verified safely. Use literal paths within cwd, /tmp, /var/tmp, or $TMPDIR.",Nm="rm -rf targeting root or home directory is extremely dangerous and always blocked.",jx="rm -rf in home directory is dangerous. Change to a project directory first.",Dm={root_or_home_target:{id:"rm.recursive-force-root-or-home",reason:Nm},git_metadata_target:{id:"rm.git-metadata",reason:ke},dynamic_target:{id:"rm.recursive-force-dynamic-target",reason:Hx},home_cwd_target:{id:"rm.recursive-force-home-cwd",reason:jx},cwd_self_target:{id:"rm.recursive-force-cwd-self",reason:Mm},within_anchored_cwd:{id:"rm.recursive-force-paranoid",reason:Ux},outside_anchored_cwd:{id:"rm.recursive-force-outside-cwd",reason:Mm}};function Jo(e,t){let n=vt({...t,allowPaths:t.policy?.destructiveCommandAllowPaths,posixShell:!0}),r=e.map(_),o=$e(r),i=Vo(r),s=Kx(e);for(let a of s){let l=hr(a.word);if(o&&l.unsafeBraceExpansion){let c=P(gr({kind:"outside_anchored_cwd"},n,t.policy,Dm),t.policy);if(c)return c;continue}for(let c of l.expandedTargets??[a.text]){let d=ve(c),m={targetIsLiteral:l.expandedTargets!==void 0||l.targetIsLiteral,tmpdirWordSplittingProtected:l.tmpdirWordSplittingProtected};if(!i&&n.resolvedCwd&&zt(d,n.resolvedCwd,n.protectedGitMetadata,i,n.environment,n.budget))return v("rm.git-metadata",ke);if(i&&!o){let u=ze(d,n,m);if(u.kind==="root_or_home_target")return v("rm.recursive-force-root-or-home",Nm);if(u.kind==="git_metadata_target")return v("rm.git-metadata",ke);continue}if(!o)continue;for(let u of Vx(d,n,m)){let f=gr(u,n,t.policy,Dm),p=P(f,t.policy);if(p)return p}}}return null}function Vx(e,t,n){let r=ze(e,t,n);if(r.kind==="cwd_self_target")return[r,ze(e,t,{...n,skipCwdSelf:!0})];if(r.kind!=="home_cwd_target")return[r];let o=ze(e,t,{...n,skipHomeCwd:!0});if(o.kind!=="cwd_self_target")return[r,o];return[r,o,ze(e,t,{...n,skipHomeCwd:!0,skipCwdSelf:!0})]}function Kx(e){let t=[],n=!1;for(let r of e.slice(1)){let o=_(r);if(!o)continue;if(o==="--"){n=!0;continue}if(n){t.push({text:o,word:r});continue}if(!o.startsWith("-"))t.push({text:o,word:r})}return t}var xt={kind:"none"},Vt={kind:"dynamic"},qx=new Set(["<","<<","<<-","<<<","<&","<>"]),Wm=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*))/g,Yx=/^(?:[0-9]+|[@*])$/,Zx=gt.maxWords,Gm=gt.maxInputLength;function Fm(e){if(!e||T(O(e.words[0]?.text??""))!=="printf")return;if(e.words.some((o)=>o.provenance!=="literal"))return;let t=e.words.slice(e.words[1]?.text==="--"?2:1),n=t[0]?.text;if(n===void 0)return"";let r=t.slice(1).map((o)=>o.text);if(n==="%s")return r.join("");if(n==="%s\\n"||n===`%s
 `)return`${r.join(`
 `)}
 `;if(n.includes("%")||/\\(?![\\nrt])/.test(n))return;return n.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Qo(e){let t=Rn(e[1])==="--"?2:1;if(e.length<=t)return Rt;let n=e.slice(t);if(!n.every(vr))return jt;return{kind:"literal",source:n.map(w).join(" ")}}function Lm(e){let t=Rn(e[1])==="--"?2:1,n=e[t],r=Rn(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return Rt;if(!vr(n))return jt;return{kind:"literal",source:r}}function ei(e,t){let n=Fm(e);if(n===-1)return Rt;let r=Hx(t);if(!r)return Rt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=Vx(s,e,n,r.ifs);if(!a)return jt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>$x||i>Dm)return jt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(zm)].filter((s)=>s!==null).join(" ")}}function Wm(e,t){let n=Fm(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(vr)||o)return t;let i=r.map(Rn),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let m=d[1]??d[2],u=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&u.some((g)=>/[*?[]/.test(g)))return t;if(s+=a==='"'?u.map((g)=>g.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):u.map((g)=>g.split(/[ \t\n]+/).map((p)=>p?zm(p):"").join(" ")).join(" "),s.length>Dm)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function Gm(e,t,n,r){if(!Ee(e.map(w)).readsStdinAsCommands)return Rt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&zx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return Rt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return jt;return{kind:"literal",source:o.target.text}}if(!n)return Rt;return r===void 0?jt:{kind:"literal",source:r}}function lt(e,t=new Map){let n=Ee(e.map(w)).scriptIndex;if(n===null)return Rt;let r=e[n],o=Rn(r);if(Co(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?jt:{kind:"literal",source:i}}var Ux=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function La(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Pe(s)!==null)return!1;let a=I(O(s));return!Ux.has(a)&&!q.has(a)&&!$t(a)}function Fm(e){return Ee(e.map(w)).commandIndex??-1}function Hx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(jx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
-`}}function jx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function Vx(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ma(o):Kx(o,r);if(e.parameter==="*"){let a=Ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Da(l,r)}let i=t[n+1+e.parameter];if(i&&!vr(i))return;let s=Rn(i);return e.quoted?[s]:Da(s,r)}function Ma(e){return e.every(vr)?e.map(w):void 0}function Kx(e,t){let n=Ma(e);if(!n)return;let r=n.map((o)=>Da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
+`).replaceAll("\\r","\r").replaceAll("\\t","\t").replaceAll("\\\\","\\")}function Qo(e){let t=_n(e[1])==="--"?2:1;if(e.length<=t)return xt;let n=e.slice(t);if(!n.every(xr))return Vt;return{kind:"literal",source:n.map(_).join(" ")}}function zm(e){let t=_n(e[1])==="--"?2:1,n=e[t],r=_n(n);if(n===void 0||e.length<=t+1||r==="-"||r===""||r==="-l"||r==="-p")return xt;if(!xr(n))return Vt;return{kind:"literal",source:r}}function ei(e,t){let n=Um(e);if(n===-1)return xt;let r=Jx(t);if(!r)return xt;let o=[],i=r.command?.length??0;for(let s of r.references){let a=eR(s,e,n,r.ifs);if(!a)return Vt;if(i+=a.reduce((l,c)=>l+c.length+3,0),o.length+a.length>Zx||i>Gm)return Vt;o.push(...a)}if(r.command==="eval")return{kind:"literal",source:o.join(" ")};if(o.length===0||/\s/.test(o[0]??""))return{kind:"literal",source:""};return{kind:"literal",source:[r.command,r.command&&r.optionTerminator?"--":null,...o.map(Hm)].filter((s)=>s!==null).join(" ")}}function Bm(e,t){let n=Um(e),r=e.slice(n+1),o=/\bIFS\b/.test(t);if(n===-1||!r.every(xr)||o)return t;let i=r.map(_n),s="",a=null,l=0;while(l<t.length){let c=t[l]??"",d=a==="'"?null:/^\$(?:\{([0-9]+|[@*])\}|([0-9@*]))/.exec(t.slice(l));if(d){let m=d[1]??d[2],u=m==="@"||m==="*"?i.slice(1):[i[Number(m)]??""];if(a!=='"'&&u.some((p)=>/[*?[]/.test(p)))return t;if(s+=a==='"'?u.map((p)=>p.replace(/["$`\\]/g,"\\$&")).join(m==="@"?'" "':" "):u.map((p)=>p.split(/[ \t\n]+/).map((g)=>g?Hm(g):"").join(" ")).join(" "),s.length>Gm)return t;l+=d[0].length;continue}if(c==="\\"&&a!=="'"){s+=t.slice(l,l+2),l+=2;continue}if(c==="'"&&a!=='"'||c==='"'&&a!=="'")a=a?null:c;s+=c,l++}return s}function $m(e,t,n,r){if(!xe(e.map(_)).readsStdinAsCommands)return xt;let o=t.filter((i)=>(i.fd===void 0||i.fd===0)&&qx.has(i.operator)).at(-1);if(o){if(o.operator==="<<"||o.operator==="<<-")return xt;if(o.operator!=="<<<"||o.target?.provenance!=="literal")return Vt;return{kind:"literal",source:o.target.text}}if(!n)return xt;return r===void 0?Vt:{kind:"literal",source:r}}function lt(e,t=new Map){let n=xe(e.map(_)).scriptIndex;if(n===null)return xt;let r=e[n],o=_n(r);if(bo(r,o))return{kind:"literal",source:o};let i=r?Ye(r,t):null;return i===null?Vt:{kind:"literal",source:i}}var Xx=new Set(["curl","wget","fetch","aria2c","http","https","xh","xhs","nc","ncat","netcat"]);function La(e){if(e.words.length!==2||e.redirections.length!==0||e.nested.length!==1)return!1;let t=e.words[0],n=e.words[1];if(!t||t.provenance!=="literal"||t.quoted||t.raw!==t.text||!n)return!1;if(!(t.text==="eval"&&n.quoted&&n.parts.length===3&&n.parts[0]?.raw==='"'&&n.parts[1]?.provenance==="command-substitution"&&n.parts[1].raw.startsWith("$(")&&n.parts[2]?.raw==='"'||t.text==="eval"&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("$(")||(t.text==="source"||t.text===".")&&!n.quoted&&n.parts.length===1&&n.parts[0]?.provenance==="command-substitution"&&n.parts[0].raw.startsWith("<(")))return!1;let o=e.nested[0];if(o?.status!=="complete"||o.nodes.length!==1)return!1;let i=o.nodes[0];if(i?.kind!=="command"||i.redirections.length!==0||i.nested.length!==0||i.words.some((l)=>l.provenance!=="literal"||l.parts.some((c)=>c.provenance!=="literal")))return!1;let s=i.words[0]?.text;if(s===void 0||Ie(s)!==null)return!1;let a=T(O(s));return!Xx.has(a)&&!Y.has(a)&&!Ut(a)}function Um(e){return xe(e.map(_)).commandIndex??-1}function Jx(e){let t=/^IFS=(?:'([^']*)'|"([^"]*)"|([^;\s]*))\s*;\s*(.+)$/.exec(e.trim()),n=t?.[4]??e.trim(),r=/^(\.|bash|command|dash|exec|eval|ksh|sh|source|zsh)(?:\s+(--))?\s+(.+)$/.exec(n),o=(r?.[3]??n).split(/\s+/).map(Qx);if(o.length===0||o.some((i)=>i===null))return null;return{command:r?.[1]??null,optionTerminator:r?.[2]!==void 0,references:o.filter((i)=>!!i),ifs:t?t[1]??t[2]??t[3]??"":` 	
+`}}function Qx(e){let t=/^"\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})"$/.exec(e),n=/^\$(?:([0-9]+|[@*])|\{([0-9]+|[@*])\})$/.exec(e),r=t??n;if(!r)return null;let o=r[1]??r[2];return{parameter:o==="@"||o==="*"?o:Number(o),quoted:t!==null}}function eR(e,t,n,r){let o=t.slice(n+2);if(e.parameter==="@")return e.quoted?Ma(o):tR(o,r);if(e.parameter==="*"){let a=Ma(o);if(!a)return;let l=a.join(r[0]??"");return e.quoted?[l]:Da(l,r)}let i=t[n+1+e.parameter];if(i&&!xr(i))return;let s=_n(i);return e.quoted?[s]:Da(s,r)}function Ma(e){return e.every(xr)?e.map(_):void 0}function tR(e,t){let n=Ma(e);if(!n)return;let r=n.map((o)=>Da(o,t));return r.some((o)=>o===void 0)?void 0:r.flatMap((o)=>o??[])}function Da(e,t){if(["*","?","[","]"].some((n)=>e.includes(n)))return;if(t==="")return e===""?[]:[e];if(t===` 	
 `)return e.trim().split(/\s+/).filter(Boolean);if(t.length!==1)return;return t===" "||t==="\t"||t===`
-`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function vr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(w(e)):e.provenance==="literal"}function Rn(e){return e?w(e):""}function zm(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Wa(e,t){return Na(De(e,"posix"),t)}function Er(e){return Wa(e,new Set(Array.from(e.matchAll(Mm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Na(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Na(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Na(o,n))||Bm(r.words,n))return!0;Jx(r,n)}return!1}function Bm(e,t){let n=e.findIndex((s)=>Pe(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Sr(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Om(e[s],t)}if(q.has(o)){let s=e.slice(n),a=Ee(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Om(s[l],t)}let i=qx(e,n,t);if(i===null)return!1;if(i===-1)return!0;return Bm(e.slice(i),t)}function qx(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return Yx(e,t+1);if(r==="exec")return Zx(e,t+1);if(r==="env")return Xx(e,t+1,n);return null}function Yx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function Zx(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function Xx(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Sr(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Sr(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Pe(i))continue;return r}return null}function Jx(e,t){if(!e.words.every((n)=>Pe(n.text)!==null))return;for(let n of e.words){let r=Pe(n.text);if(!r)continue;if(Sr(n,t))t.add(r.name)}}function Sr(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Mm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Bx.test(o)||t.has(o))}))}function Om(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Sr(e,t))}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Fa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",Qx="__CC_SAFETY_NET_XARGS_INPUT__",ti="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ni="rm",eR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,tR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,nR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,rR=/^(?:[0-9]+|[@*])$/;function Hm(e,t){let n=e.map(w),{childStart:r,replacementToken:o}=Vt(n),i=n.slice(r),s=S("xargs.shell-dynamic",Fa);if(iR(i,o,t)&&T(s,t.policy))return T(s,t.policy);for(let a of ze(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?T(s,t.policy):null;if(c)return c;let d=Zm(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&qm(l,o),u=t.analyzeChild(l,{...Ut(a,t),dynamicInput:d,dynamicSourceInput:m||Vm(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:S("xargs.rm-recursive-force-dynamic",Ga)});if(u)return u;let f=oR(l,o,t.policy?.rules??[],T(s,t.policy));if(f)return f;if(a.head==="git"){let p=o===null?[...l,Qx]:l,h=o!==null&&(l.some((v)=>v.includes(o))||Array.from(a.envAssignments.values()).some((v)=>v.includes(o))),y=t.analyzeChild(p,{...Ut(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let g=it(l,t.policy?.rules??[]);if(g)return g}return null}function oR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function jm(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Pm(e,r,t.length,n);return o===null?[]:[o]}function Vm(e,t,n,r,o,i,s){if(q.has(t)){if(st(e))return!1;if(n!==null&&sR(e,n,s))return!0;let a=$e(e);if(!a){let l=lt(K(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Km(a,n,s))return!0;if(Ae(a))return!0;return aR(a,n,r)}if(Me(t))return $m(e,n,Ro,Yu(t));if(we.has(t))return $m(e,n,ya,Yd);if(t==="eval"){let a=Qo(K(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return lR(e,n,i);if(t==="git"){let a=_e(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&En.has(a.subcommand.toLowerCase())&&Ym(a.rest,n).some((l)=>l.includes(n))}return!1}function Km(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Ae(i)===null&&n(i)===null}function $m(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ti]).sources.some((a)=>a.value===ti);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ti}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ti}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>jm(l,t,a))));return Xo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function iR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(ze(e,n),(i)=>i.head)),o=t===null?[...e,ni]:e.map((i,s)=>s===0?i:i.replaceAll(t,ni));return Array.from(ze(o,n)).some((i)=>i.head===ni&&!r.has(ni))}function qm(e,t){return Ym(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Ym(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function Zm(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function sR(e,t,n){let r=Ee(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Km(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return jm(a,t,s).some((d)=>{let m=e.map((f,g)=>g===l?f.replaceAll(t,d):f),u=Ee(m);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(m[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(m[u.scriptIndex]??"").includes(d)})}))}function aR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(eR))if(Um(o,r))return!0;for(let o of e.matchAll(tR))for(let i of(o[1]??"").matchAll(nR))if(Um(i,r))return!0;return Wa(e,r)}function Um(e,t){let n=e[1]??e[2];return n!==void 0&&(rR.test(n)||t.has(n))}function lR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=vn(e,i);i=l.nextIndex-1;for(let c of ze(l.tokens,{environment:n,cwd:void 0})){let d=Zm(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&qm(c.tokens,t)||Vm(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=at(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Vt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var xr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",Rr="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",uR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",dR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",oi=/\{[^{}\s]*\}/g,Xm=/\{\}|\{-?\d+\}/g,mR=["e","f","source","file","-e","-f","--source","--file"],fR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],pR=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),gR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),Jm=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),hR=new Set(["--workdir","--wd"]),Qm="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Ie(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function of(e){return Ie([...e],(t)=>Ae(t))}function sf(e,t){let n=e.map(w);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let g=_n(t);if(g)return g}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=gf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let g=_n(t);if(g)return g;let p=of(t.envAssignments?.values()??[]);if(p)return p}if(l){let g=ER(t);if(g)return g}if(d!==void 0&&a){let g=_n(t);if(g)return g}let u=xR(d,t.cwd,t.environment.paths);if(u===null){let g=_n(t);if(g)return g}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...ze(i,f)].flatMap((p)=>[...p.envAssignments.values()]).some($a)){let p=_n(t);if(p)return p}return null}if(i.length===0){let g=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",g.length);let p=uf(f.envAssignments,f.cwd,a);return Ie(g,(h)=>t.analyzeNested(h,p))}return Ie(ze(i,f),(g)=>yR(g,o,t,f))}function yR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(ff)){let h=_n(n);if(h)return h}let d=of(c);if(d)return d;let m=c.some(F),u=i||m,f=a&&u,g=uf(e.envAssignments,e.wrapperCwd,s||f);if(q.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Ie(o,(E)=>n.analyzeChild(ri(l,E,n.budget),Ut(e,r)))};if(st(l))return h();let y=$e(l);if(y){if(pf(y)){let x=_t(n);if(x)return x;if(o.length===0)return null;return Ie(o,(A)=>n.analyzeNested(nf(y,A,n.budget),g))}if(F(y)){if(o.length>0)return Ie(o,(Y)=>n.analyzeNested(nf(y,Y,n.budget),g));let x=Cr(y);if(x?.[0]&&O(x[0])==="rm"&&Be(x)){let Y=tf(n);if(Y)return Y}let A=x?n.analyzeChild(x,{...Ut(e,r),dynamicInput:a,shellDynamicMatch:S("parallel.shell-dynamic",Rr),rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)}):null;if(A)return A;return n.analyzeNested(y,g)}let E=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((x)=>ei(K(x===void 0?l:i?l.map((A)=>df(A,x)):[...l,...x]),y)):[];if(E.some((x)=>x.kind==="dynamic")){let x=_t(n);if(x)return x}let b=E.flatMap((x)=>x.kind==="literal"?[x.source]:[]);if(b.length>0)return n.budget.charge("derivedTokens",b.length),Ie(b,(x)=>n.analyzeNested(x,g));if(Er(y)){let x=_t(n);if(x)return x}let P=n.analyzeNested(y,g);if(P)return P;if(u)return _t(n);return null}let v=lt(K(l));if(v.kind==="dynamic"||v.kind==="literal"&&F(v.source))return _t(n)??h();if(v.kind==="literal")return h();if(o.length>0){let E=_t(n);if(E)return E;let b=h();if(b)return b;if(i)return null;let P=o.flatMap((x)=>x[0]===void 0?[]:[x[0]]);return n.budget.charge("derivedTokens",P.length),Ie(P,(x)=>n.analyzeNested(x,g))}if(u||a)return _t(n)??h();return null}if(e.head==="rm"&&Be(l)){if(i&&o.length>0)return Ie(o,(y)=>za(ri(l,y,n.budget,Xm),e.cwd,r));if(o.length>0)return Ie(o,(y)=>za(rf(l,y,n.budget),e.cwd,r));let h=za(l.flatMap((y,v)=>{if(v===0||!F(y))return[y];return y.startsWith("-")?[y.replace(Xm,"")]:[]}),e.cwd,r);if(h)return h;return tf(n)}let p=o.length>0?o:[void 0];return Ie(p,(h)=>{let y=h===void 0?l:i?ri(l,h,n.budget):rf(l,h,n.budget),v=S("parallel.shell-dynamic",Rr),E=a&&e.head==="find"?vR(y,r):null,b=lf(y,a,n)??E?.customResult??null,P=O(e.head),x=a&&(P==="rm"&&Ba(y)||P==="xargs"&&cf(y)||E?.rmOptions===!0),A=a&&(x||E?.executedSource===!0||E===null&&af(y,P)),Y=n.analyzeChild(y,{...Ut(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:x,dynamicSourceInput:b!==null||A,shellDynamicMatch:v,dynamicSourceMatch:v,rmDynamicMatch:S("parallel.rm-recursive-force-dynamic",xr)});if(A){let ke=T(v,n.policy);if(ke)return ke}return Y??b??it(y,n.policy?.rules??[])})}function af(e,t){if(F(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(q.has(t))return SR(e);if(t==="git")return bR(e);if(t==="find")return!0;if(we.has(t))return ef(e,mR,yr);if(Me(t))return ef(e,fR,xo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(F))return t===-1;return n.some((o)=>F(o)&&(o.startsWith("-")||pf(o)))}function bR(e){if(CR(e))return!0;let t=_e(e);if(t.subcommand===null||F(t.subcommand))return!0;if(!En.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(F))return n===-1;return r.some(F)}function CR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(F(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(F(n))return!0;continue}if(F(n))return!0}return!1}function SR(e){if(st(e))return!1;let t=$e(e);if(t!==null)return F(t);let n=lt(K(e));if(n.kind==="literal")return F(n.source);if(n.kind==="dynamic")return!0;return!e.some(F)}function ef(e,t,n){let r=n(e);if(r.some((o)=>F(o.value)))return!0;if(!e.some(F))return n([...e,Qm]).some((o)=>o.value===Qm);return Xo(r,t,(o)=>n(e.map((i)=>df(i,[o]))))}function lf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(F))return _t(n);return Ie(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function vR(e,t){let n={customResult:null,executedSource:!e.some(F),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(F))return;for(let a of ze(i,t))n.executedSource||=af(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&cf(a.tokens),n.customResult??=lf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=F(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=F(a);continue}let l=at(a);if(l>0){o=l,n.executedSource||=F(a);continue}n.executedSource||=F(a)}return s(),n}function cf(e){let t=e.slice(Vt(e).childStart);return O(t[0]??"")==="rm"&&Ba(t)}function ii(e,t){return(n)=>T(S(e,t),n.policy)}var _t=ii("parallel.shell-dynamic",Rr),ER=ii("parallel.command-stream-dynamic",uR),_n=ii("parallel.command-stream-dynamic",dR),tf=ii("parallel.rm-recursive-force-dynamic",xr);function za(e,t,n){return T(Jo(K(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(n.envAssignments??new Map,n.environment),trustedTmpdirValue:zt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function uf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function df(e,t){return e.replace(oi,(n)=>mf(n,t))}function ri(e,t,n,r=oi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=mf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function nf(e,t,n){return ri([e],t,n)[0]??""}function rf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function mf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function F(e){return e.search(oi)!==-1}function ff(e){if($a(e))return!0;for(let t of e.matchAll(oi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function $a(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function pf(e){return/^\{[^{}\s]*\}$/.test(e)}function xR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!cR(e))return null;try{return yt(t??e,e,n)}catch{return null}}function gf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((g)=>g==="::::"||g==="::::+"||g===":::+");while(t<e.length){let g=e[t];if(g===void 0)break;if(g===":::"){o=t;break}if(g==="--"){let E=Sa(e,t+1);n.push(...E.templateTokens),r=t+1,o=E.markerIndex;break}if(!g.startsWith("-")){let E=Sa(e,t);n.push(...E.templateTokens),r=t,o=E.markerIndex;break}let p=e[t+1],h=g.indexOf("="),y=h===-1?g:g.slice(0,h),v=h===-1?void 0:g.slice(h+1);if(g==="--dry-run"){l=!0,t++;continue}if(g==="-I"||g.startsWith("-I")&&g.length>2){c||=(g==="-I"?p:g.slice(2))!=="{}",t+=g==="-I"?2:1;continue}if(g==="--replace"||g==="-i"){c=!0,t+=2;continue}if(y==="--replace"||g.startsWith("-i")&&g.length>2){let E=y==="--replace"?v:g.slice(2);c||=E!==""&&E!=="{}",t++;continue}if(g==="-a"||gR.has(y)){c=!0,t+=v===void 0?2:1;continue}if(g==="--pipe"||g==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=v===void 0?2:1;continue}if(Jm.has(y)||g.startsWith("-S")&&g.length>2){i=!0,t+=Jm.has(g)?2:1;continue}if(hR.has(y)){c=!0;let E=v??p;if(E===void 0||E===":::"||E==="--"){t++;continue}a=E,t+=v===void 0?2:1;continue}if(g.startsWith("-j")&&g.length>2&&/^\d+$/.test(g.slice(2))){t++;continue}if(g.startsWith("--")&&v!==void 0){t++;continue}if(pR.has(g)){if(p===void 0||p===":::"||p==="--"){c=!0,t++;continue}t+=2;continue}t+=g==="-j"||g==="--jobs"?2:1}c||=n.some(l?$a:ff);let d=[];if(o!==-1){let g=[];for(let p=o+1;p<e.length;p++){let h=e[p];if(h===":::"){d.push(g),g=[];continue}if(h!==void 0)g.push(h)}d.push(g)}c||=d.length>1;let m=RR(d),u=n.some(F),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function RR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>V.derivedTokens.cap)throw new D("derivedTokens");o.push([...i,s])}t=o}return t}function hf(e){return gf(e).childStart}var _R="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",si="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ha(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ua(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function bf(e,t,n,r,o=!1,i){let a=(Yn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?S("shell.dynamic-executable",_R):null;return T(a,i)??Cf(e,t,n,o,i)}function Cf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ha(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=mn(e,t),l=AR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return T(S("shell.dynamic-structure",si),o);if(T(Zo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&w(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&En.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return T(S("shell.dynamic-structure",si),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&PR(t)?T(S("shell.dynamic-structure",si),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&w(c)==="--"),l=Be(t.map(w));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?T(S("shell.dynamic-structure",si),o):null}if(s==="xargs")return yf(e,t.slice(Vt(t.map(w)).childStart),"xargs",n,r,o);if(s==="parallel")return yf(e,t.slice(hf(t.map(w))),"parallel",n,r,o);return null}function yf(e,t,n,r,o,i){if(t.length===0)return null;let s=wR(t,r);if(Yn(e,s)){let l=T(S(`${n}.shell-dynamic`,n==="xargs"?Fa:Rr),i);if(l)return l}let a=Cf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ha(l)&&Ua(l)))return T(S(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:xr),i);return null}function wR(e,t){let n=Wt(e,t),r=n.rewritten?K(n.words.map(w)):n.words,o=r[0];return o&&w(o)==="busybox"?r.slice(1):r}function AR(e){let t=1;while(t<e.length){let n=e[t],r=n?w(n):"";if(ve.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function PR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ha(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ua(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ua(s)))return!0;continue}if(t=!0,a)return!0;let l=at(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function ja(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!Co(t[n.tokenIndex],n.value)})}var TR="dd writing to a /dev device can destroy a disk or partition. Run device writes manually after confirming the target.",IR="mkfs formatting a /dev device erases everything on it. Run the format manually after confirming the target.",kR="shred permanently destroys the given target. Use rm for ordinary deletes, or run shred manually.";function Sf(e,t){let n=t.slice(1);if(e==="dd"&&n.some((r)=>/^of=\/dev\/.+/.test(r)))return S("dd.device-write",TR);if((e==="mkfs"||e.startsWith("mkfs."))&&n.some((r)=>r.startsWith("/dev/")))return S("mkfs.device",IR);if(e==="shred"&&n.length>0)return S("shred.target",kR);return null}var Ef=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Zo(e.words,Va(e))},{heads:new Set(["find"]),analyze:(e)=>nm(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:vt(e.envAssignments,e.options.environment),trustedTmpdirValue:zt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>Hm(e.words,{...vf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>sf(e.words,{...vf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>Kt(e.options.analyzeNested(t,n))})}];function vf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function Kt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Va(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function wf(e){return Ef.find((t)=>t.heads.has(e))?.analyze}function An(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?w(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=Ao(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Wt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),g=f.envSplitValues??[];if(g.length>0){let R=[...g,...i(f.words)].join(" "),k=Ae(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),ue(k);if(n.strict)return ye(r);let L=Po(g,i(f.words));if(L){n.budget.charge("derivedTokens",L.length);let te=n.analyzeNested(L.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(te)return te}}let p=f.rewritten?K(i(f.words)):mn(o,f.words),h=i(p),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>p.length){let R=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-p.length),output:h})}let v=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),E=h[0];if(!E)return null;if($t(E))throw new D("wrapperPeelIterations");let b=O(E),P=f.cwd===null?void 0:f.cwd??d,x=f.cwd===null?void 0:m,A=f.cwd===void 0?n.effectiveCwd:f.cwd,Y=s?s.allowTmpdirVar:!mr(v,n.environment),ke=bf(o,f.words,n.environment,t===0,n.strict,n.policy);if(ke)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:ke.reason}),ue(ke);let je=Ho(h,n.policy);if(je){for(let R of[je.childIndex,...je.alternativeChildIndices]){xf(y.wrapperNormalizationBudget);let k=p.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:je.wrapper,output:i(k)});let L=An(k,t,{...y,effectiveCwd:A,envAssignments:v});if(L)return L}return null}let de=l?void 0:b==="eval"?Qo(p):b==="trap"&&!a?Lm(p):void 0;if(a&&s&&b==="eval"){if(de?.kind==="dynamic")return wn(s,n.policy);if(de?.kind==="literal"){let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v});if(R)return R}return Pn(s,n.policy)}if(de?.kind==="dynamic"&&(n.strict||!n.commandView||!La(n.commandView)))return ye(r);if(de?.kind==="literal"){r?.recordSegment({type:"recurse",reason:b==="eval"?"shell-eval":"shell-trap",innerCommand:de.source,depth:t+1});let R=n.analyzeNested(de.source,{effectiveCwd:A,envAssignments:v,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?q.has(b):Pf(E,b)){if(st(h))return null;if(a&&s){let R=$e(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let L=wn(s,n.policy);if(L)return L}if(Er(R)){let L=wn(s,n.policy);if(L)return L}return n.analyzeNested(R,{effectiveCwd:A,envAssignments:v})}let k=lt(p);if(k.kind==="dynamic")return wn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?wn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?wn(s,n.policy):null}if(l){let R=$e(h),k=R?n.analyzeNested(R,{effectiveCwd:A,envAssignments:v}):lt(p).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=NR(h,v,A,n,r,t);if(R)return R;let k=$e(h);if(k){let Qt=ei(p,k);if(Qt.kind==="dynamic")return ye(r);let Si=Qt.kind==="literal"?Qt.source:Wm(p,k),vl=LR(Si);r?.recordSegment({type:"shell-wrapper",wrapper:b,innerCommand:vl}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:vl,depth:t+1});let El=n.analyzeNested(Si,{effectiveCwd:A,envAssignments:v});if(El)return El;return Er(Si)?ye(r):null}let L=lt(p,n.strict?void 0:n.shellAssignments);if(L.kind==="dynamic")return ye(r);if(L.kind==="literal")return ai(L.source,A,v,n,r,t);let te=Gm(p,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:A,envAssignments:v})}}if(!s&&(b==="source"||b===".")){let R=h[1]==="-p"?2:null;if(R!==null){let Qt=n.commandView?p[R]:void 0;if(!Qt)return null;if(Qt.provenance!=="literal")return ye(r)}let k=R===null?1:3,L=h[k]==="--"?k+1:k,te=n.commandView?p[L]:void 0;if(!te)return null;if(te.provenance==="literal")return ai(te.text,A,v,n,r,t);if(n.strict||!n.commandView||!La(n.commandView))return ye(r)}if(we.has(b)&&!l){if(!s&&n.strict&&ja(yr(h),p))return ye(r);let R=Zd(h,(L)=>Kt(n.analyzeNested(L,{effectiveCwd:A,envAssignments:v}))),k=T(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),ue(k)}if(Me(b)&&!l){if(!s&&n.strict&&ja(xo(h),p))return ye(r);let R=qu(h);if(a&&s)return MR(b,R,A,v,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:b,codeArg:R,paranoidBlocked:k}),k){let te=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(te)return ue(te)}if(Ys(b,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let L=n.analyzeNested(R,{effectiveCwd:A,envAssignments:v});if(L&&!Af(L,R))return L;if(or(R,void 0,!n.strict)){let te=T(S("interpreter.dangerous-command",gn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:gn}),ue(te)}r=void 0}}if(b==="busybox"&&h.length>1)return xf(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),An(p.slice(1),t,{...y,effectiveCwd:A,envAssignments:v});let G=s?null:T(Sf(b,h),n.policy);if(G)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:G.reason}),ue(G);let J=r===y.trace?y:{...y,trace:r},X={words:p,head:b,cwd:P,originalCwd:x,envAssignments:v,allowTmpdirVar:Y,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:A,options:J,analyzeChildTokens:(R,k)=>a&&s?Ka(R,t,J,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):Kt(An(K(R),t+1,{...J,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:v}))??it(R,J.policy.rules),analyzeChild:(R,k)=>Ka(R,t,J,k)},Q=s&&(b==="xargs"||b==="parallel")?void 0:wf(b);if(b==="rm"||b==="xargs"||b==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:v.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:Y});let be=r&&b==="git"?Am(X.words,Va(X)):void 0,dt=Rf(be?be.match:Q?.(X)??null,n.policy);if(r)WR(X,dt,be?.relaxation??null);if(dt)return ue(dt);if(a&&s&&(b==="rm"||b==="rmdir")){if(!(b==="rm"&&(Be(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?Pn(s,n.policy):null)??DR(s,n.policy)}let Or=!s&&Q===void 0&&!jr.has(b),Je=r&&Or?[]:void 0;if(Or)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;Je?.push(k);let L=Rf(OR(h,R,t,J,P,x,A,v),n.policy);if(L)return r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[],embeddedCommandFound:O(k)}),ue(L)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Je??[]}),l&&s&&!s.wrappedByTransparent)return null;let Mr=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Mr,reason:Mr?.reason}),Mr)return ue(Mr);return a&&s?Pn(s,n.policy):null}function Ka(e,t,n,r){return Kt(An(K(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function OR(e,t,n,r,o,i,s,a){for(let l of ze(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=O(c);if(Pf(c,d)||wf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=Ka(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!mr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function MR(e,t,n,r,o,i){if(!t)return Pn(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=T(S("interpreter.one-liner-paranoid",rr),o.policy);if(a)return ue(a)}if(Ys(e,t))return Pn(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Af(s,t))return s;if(or(t,void 0,!o.strict)){let a=T(S("interpreter.dangerous-command",gn),o.policy);if(a)return ue(a)}return Pn(i,o.policy)}function Af(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Bo)||e.reason===Sn)&&!Vr(t);return n||r}function wn(e,t){let n=e.shellDynamicMatch?T(e.shellDynamicMatch,t):null;return n?ue(n):null}function Pn(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?T(e.dynamicSourceMatch,t):null;return n?ue(n):null}function DR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?T(e.rmDynamicMatch,t):null;return n?ue(n):null}function NR(e,t,n,r,o,i){let s=tm(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=nr(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function LR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function WR(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function xf(e){if(e.iterations>=V.wrapperPeelIterations.cap)throw new D("wrapperPeelIterations");e.iterations++}function ue(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:gr}),ue(GR())}function GR(){return{id:"",reason:gr,intent:"stop_and_explain"}}function Pf(e,t){return q.has(t)||e==="$SHELL"||e==="${SHELL}"||q.has(I(t))}function Rf(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:T(e,t)}var FR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,zR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function BR(e,t){let n=kf(e,t);if(n.length===0)return!1;let r=n[If(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return FR.test(e.join(" "))}function Tf(e,t,n,r,o){if(e.dialect==="powershell"){let y=$R(e.words,o);if(y.kind==="none")return;if(!t||y.kind==="unknown")return null;return _f(VR(y.target),t,n.paths)}let i=e.words.map(w),s=i.some((y)=>/^CDPATH\+?=/.test(y));if(!BR(i,n))return s?null:void 0;if(!t)return null;let a=kf(i,n,t),l=If(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((y)=>y.length<=1||!y.startsWith("-")||y==="--");if((d===-1?c:c.slice(0,d)).some((y)=>!/^-[LP]+$/.test(y)))return null;let u=d===-1?[]:c.slice(d),f=u[0]==="--"?u.slice(1):u;if(f.length!==1)return null;let g=f[0]??"",p=e.words.find((y)=>y.provenance==="variable"&&y.text===g),h=p?Ye(p,r):g;if(h===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(h)&&(s||n.env.has("CDPATH")))return null;return _f(h,t,n.paths)}function _f(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=yt(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function $R(e,t){let n=UR(e[0])?1:0,r=e[n];if(!HR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!zR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return jR(e.slice(n+1),t)}function UR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function HR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function jR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function VR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function If(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function kf(e,t,n){let r=KR(e);return bt([...r],t,n)}function KR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var e_="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",qt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function Qa(e,t,n,r){if(t>=V.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??De(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return Ja(e,n);let d=`${Bo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Wf(e,n),{reason:Sn,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Wf(e,n),{reason:Sn,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Ja(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=gm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set}]).result}function ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let m=e.nodes[c+1],u=m?.kind==="connector"?m.operator:void 0,f=t_(e,c,d,a,u),p=a==="&&"||a==="||"?s:void 0,h=a==="&&"?p?.success??i:a==="||"?p?.failure??i:i,y=a==="||"?p?.success??[]:[],v=a==="&&"?p?.failure??[]:[],E={connector:a,skippedSuccessStates:y,skippedFailureStates:v};if(wt(u)&&!wt(a))l=E;let b=wt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:wt(a)?l??E:E,P=Yt(b.connector)||Yt(u);if(d.kind==="function"){let j=h.flatMap((J)=>{let X=In(J);return X.functionDefinitions.set(d.name,d.body),qa(J,[X],f,u==="&",Yt(u))}),G=Ya(j,[],b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=G.states,s=G.conditionalStates,a=void 0;continue}if(d.kind==="group"){let j=[],G=[];for(let X of h){let Q=ui(d.body,t,n,r,[In(X)]);if(Q.result)return Q;if(j.push(...qa(X,Q.states,f,u==="&",Yt(u))),P)G.push(X,...f?Q.states.map((be)=>li(X,be)):Q.states)}let J=Ya(j,G,b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=J.states,s=J.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let x=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),A=e.nodes[c-2],Y=wt(a)&&A?.kind==="command"?Nm(A)??r_(A):void 0,ke=[],je=[];for(let j of h){let G=o_(d,t,n,r,[In(j)]);if(G.result)return{result:G.result,states:i};let J=e.dialect==="powershell"?G.states:G.states.map((X)=>li(j,X));for(let X of J){let Q=In(X),be=a_(d,t,n.trace?{...n,trace:Gf(n.trace,x)}:n,r,Q,wt(a),Y);if(be)return{result:be,states:i};let dt=A_(d,Q.functionDefinitions);if(dt)n.budget.charge("derivedTokens",di(dt));let On=dt?t+1>=V.recursionDepth.cap?Za(d.displayText,n,[Q]):ui(dt,t+1,n,r,[Q]):{result:null,states:__(d,Q)};if(On.result)return On;ke.push(...qa(j,On.states,f,u==="&",Yt(u)));let Or=typeof Q.effectiveCwd==="string"&&Q.effectiveCwd!==X.effectiveCwd&&d.redirections.every((Je)=>["<",">",">>",">|"].includes(Je.operator)&&Je.target?.text==="/dev/null");if(P&&!Or)je.push(j),je.push(...On.states.map((Je)=>f?li(j,Je):Je))}}let de=Ya(ke,je,b.skippedSuccessStates,b.skippedFailureStates,b.connector,u);i=de.states,s=de.conditionalStates,a=void 0}return{result:null,states:i}}function t_(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wt(r)||wt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&n_(e,t)}function qa(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>Tn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function n_(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(i_(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wt(e){return e==="|"||e==="|&"}function r_(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Yt(e){return e==="&&"||e==="||"}function Ya(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=Yt(i)?s:void 0;return{states:Yt(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function Gf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function o_(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=s_(e);if(s){if(t+1>=V.recursionDepth.cap)return Za(s,n,o);let a=De(s,"powershell");if(a.status==="limited")return Za(s,n,o);if(a.status!=="complete")return Of(i,n,r,o);n.budget.charge("derivedTokens",di(a)),i.push({program:a,depth:t+1})}}return Of(i,n,r,o)}function i_(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Of(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[In(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function s_(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Za(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,intent:"stop_and_explain"},states:[...n]}}function a_(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:m_(n.environment.paths,o.createdDirectories,n.budget)}},l=b_(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Ff(e,o,"before-consumer",a.environment.paths,a.budget);let c=mn(e.dialect,e.words),d=c.map(w),m=e.displayText,u=fm(c,o.shellGitContextState),f=ym(u,o.shellGitContextState);if(e.dialect==="powershell"){let h=T($d(e,i,T_(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return P_(m,h)}if(d.length===1&&d[0]?.includes(" ")&&!Yn(e.dialect,e.words)){let h=T(Ae(d[0]),a.policy),y=h!==null&&!a.strict&&Hu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let v=Mf(e,l,o,f,s,a);if(v)return v;return Ia(u,o.shellGitContextState),null}let g=An(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let v=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,E=Qa(h,t+1,{...a,effectiveCwd:v,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?Gf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return E?{reason:E.reason,ruleId:E.ruleId,intent:E.intent}:null}});if(g)return{...g,segment:m};let p=Mf(e,l,o,f,s,a);if(p)return p;return Ia(u,o.shellGitContextState),null}function Mf(e,t,n,r,o,i){let s=C_(e,t,n,r??new Map,i);if(s)return s;return Ff(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),u_(e,t,n,i.environment.paths,i.budget),f_(e,n,i.environment.paths,i.budget),E_(e,n,o,i.environment,i.trace),null}var l_=new Set([">>","<>"]);function Ff(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?c_(s):l_.has(s.operator)))continue;Df(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=Bf(e.words.slice(1));if(!i)return;for(let s of i.operands)Df(s,t,r,o)}function c_(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Df(e,t,n,r){let o=e?.provenance==="literal"?nr(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function u_(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of d_(e,n.shellGitContextState.shellAssignments)){let a=nr(s,n.effectiveCwd,r,o);if(!a||!Ku(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=V.trackedHeredocFiles.cap)throw new D("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function d_(e,t){let n=Xa(h_(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return g_(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=Bf(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>Xa(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function Xa(e,t){if(y_(e))return e.text;return(e&&Ye(e,t))??void 0}function m_(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=N(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${QR}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?N(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function f_(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>Xa(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!YR(c)&&!l)continue;let d=N(JR(l??"",c),n,r);if(a?p_(d,n):n.isDirectory(qR(d))&&zf(d,n))t.createdDirectories.add(d)}}function p_(e,t){let n=XR(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>ZR(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||zf(o(i),t)}function zf(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function g_(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function h_(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Bf(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function y_(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function el(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function b_(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return qt;let r=n[0];if(!r?.heredoc)return qt;let o=/\$\(|`/.test(r.heredoc.body);if(!el(r.heredoc)&&(!t||o))return e_;if(r.fd!==void 0&&r.fd!==0)return qt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return qt;let i=e.redirections.some((l)=>l!==r&&Nf(l.target));if(se(e.words[0],"cat"))return i?qt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Nf)?qt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return qt}function Nf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function C_(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(v_(e,i,n,r,o))return null;let a=S_(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Ja(s.length===i.length?s.join(`
-`):e.source,o);return l?{...l,segment:e.displayText}:null}function S_(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!el(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!Me(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=T(S("interpreter.one-liner-paranoid",rr),n.policy);if(m)return m}if(!or(l,void 0,!n.strict))return null;let d=T(S("interpreter.dangerous-command",gn),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function v_(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!el(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Wt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(w),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!q.has(l)&&!q.has(I(l)))return!1;return st(a)}function E_(e,t,n,r,o){let i=Tf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(w).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var x_=/^[A-Za-z_][A-Za-z0-9_]*$/,R_=8;function __(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!x_.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=R_&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=In(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function In(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:hm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories)}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>w_(r,n)))t.push(n);if(t.length>V.controlFlowStates.cap)throw new D("controlFlowStates")}return t}function w_(e,t){return e.effectiveCwd===t.effectiveCwd&&Tn(e.shellGitContextState.env,t.shellGitContextState.env)&&Tn(e.literalHeredocFiles,t.literalHeredocFiles)&&Tn(e.functionDefinitions,t.functionDefinitions)&&Tn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&Tn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Lf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Lf(e.createdDirectories,t.createdDirectories)}function Lf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function Tn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function A_(e,t){let n=Zn(e);return n===void 0?void 0:t.get(n)}function P_(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function T_(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Ja(e,t){let n=T(Ae(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Wf(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:Sn},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var I_=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function $f(e,t,n,r){let o=Qa(e,0,{...t,...mu(t),budget:t.budget??Ce(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function Uf(e,t,n){try{return{decision:e()}}catch(r){let o=k_(r,t,n);if(!o)throw r;return o}}function k_(e,t,n){if(!(e instanceof D)||!I_.has(e.kind))return null;let r=V[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var O_=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),nl=new Set(["cc-safety-net","ccsn"]),M_=new Set(["bunx","npx","pnpx"]),D_=new Set(["pnpm","yarn"]),N_=new Set(["npm","pnpm","yarn"]),L_=new Set(["bun","node"]);function fi(e,t,n={}){if(nl.has(e))return 0;if(M_.has(e)){if(n.broad)return tl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&N_.has(e)&&n.broad&&t[r]==="exec"){let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(D_.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=tl(t.slice(r+1));return o===null?null:r+1+o}if(L_.has(e)){let o=n.broad&&r!==-1?r:0;if(Hf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Hf(t[o+1]))return o+2}return null}function tl(e){let t=e.findIndex((r)=>mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!mi(r))break;n++}return n}function mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return nl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return nl.has(e.slice(0,t))}function Hf(e){let t=e?.replaceAll("\\","/");return[...O_].some((n)=>t===n||t?.endsWith(`/${n}`))}var jf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function Vf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=yn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>W_(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function W_(e,t){let n=bt([...e],t),r=n.slice(1),o=fi(I(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as pi}from"path";var Zf="This path contains the protected policy config and you must not modify or delete it.",G_=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Xf(e,t,n){let r=H_(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Kf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?qf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=qf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Kf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Nr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Kf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>_r(a,n,r,o,i));return s?{target:s}:null}function qf(e,t,n,r,o){let i=yn(e,t,r,o,{findSegmentTarget:(s,a)=>F_(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>_r(s,a.cwd,n,r,o),findMalformedTarget:(s)=>U_(s,t,n,r,o)?.target??null});return i?{target:i}:null}function F_(e,t,n,r,o){if(cr(e))return null;let i=Ct([...e],r),s=I(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&z_(a)){let l=B_(a).find((c)=>Yf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Ko(i,1)||Ea(i,r)){let c=(br(K(i))??K(["."])).find((d)=>{let m=pe(d.text,t.variables);return _r(m,t.cwd,n,r,o)||Yf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Do(a).sources.find((c)=>j_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if($_(i,s))return null;for(let l of[...e,...i])for(let c of Jf(l))if(_r(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function z_(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function B_(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function $_(e,t){if(!G_.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function U_(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of Jf(i))if(_r(s,t,n,r,o))return{target:s};return null}function Jf(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function H_(e,t,n){let r=(a)=>wr(ae(a,e.executionCwd,t,n)),o=r(sn(t)),i=[r(Hn(e.executionCwd)),r(Hn(e.configCwd))],s=new Set(i.map((a)=>pi(a)));for(let a=pi(o);;a=pi(a))if(s.add(a),pi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function _r(e,t,n,r,o){let i=jl(e,t,r,o,(s)=>wr(s)===Ur);return i!==null&&n.files.has(wr(i))}function Yf(e,t,n,r,o){return n.directoriesAndAncestors.has(wr(ae(e,t,r,o)))}function j_(e,t,n,r,o){let i=wr(ae(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function wr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as gi,posix as up,resolve as yi,win32 as V_}from"path";import{fileURLToPath as K_}from"url";var dp="Access to a sensitive path is not allowed.",mp=new Set(["echo","printf"]),q_=new Set(["find"]),Y_=new Set(["!","do","elif","else","if","then","until","while"]),Z_=new Set(["-exec","-execdir"]),X_=new Set([";","+"]),J_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),Q_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),fp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),ew=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),tw=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),pp=new Set(["-c","-e","-r","-E","--eval","--exec"]),nw=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),rw=new Set(["grep","rg"]),ow=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),iw=new Set(["commit","merge","notes","stash","tag"]),sw=new Set(["-m","--message"]),aw=new Set(["--grep"]),Qf=new Set(["jq","gojq","jaq"]),ep="f",tp="file",lw="files",cw=new Set(["e","f"]),uw=new Set(["regexp","file"]),dw=new Set(["e","f","A","B","C","m"]),mw=new Set(["regexp","file","after-context","before-context","context","max-count"]),rl="__CC_SAFETY_NET_PIPE_INPUT__",il=/[\w./~@+-]*[./~][\w./~@+-]*/g,fw=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,pw=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,gw=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,np=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,rp=/\b(?:system|exec|spawn|popen)\s*$/,hw=/\b(?:eval|exec)\s*\(/g,yw=/\b(?:eval|exec)\s*$/,bw=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function op(e,t,n,r,o,i){for(let s of e){let a=s.target;if(gA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=fA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(vp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!al(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!al(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&hA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function gp(e,t,n,r,o={}){let i=ip(e,n,r),s=op(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=op(i,t,e.invocation.context.configCwd,n,r,new Set(ip(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&Cw(e,n)?null:a}function Cw(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Mo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=ut(r);if(o.length===0)return!1;let i=He(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return ll(i,o.slice(1))}function ll(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>J_.has(n))}function ip(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?kn(s.shell,e.store,r,t,o,n,Sw(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function Sw(e){return e.program.dialect==="powershell"}function kn(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Ge;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...Zw(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(kw(c,s),r);return Oo(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...bi(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...Ew(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...hp(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>xw(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return oa;return a.push({target:l(c.target),cwd:d.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function cl(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Ge;return s.status==="complete"?kn(s,t,n,r,o,i):null}function bi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:o});if(s?.size){let p=e.filter((h,y)=>!s.has(y));if(Qf.has(He(ut(p)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...bi(p,t,n,r,o,i)]}let l=Iw(e).map(a),c=ut(e);if(c.length===0)return l;let d=c[0]??"",m=He(d).toLowerCase(),u=c.slice(1),f=c.findIndex((p)=>!Y_.has(p));if(n.skipMetadataOnlySegments===!0&&f!==-1&&ll(He(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let g=vw(d,m,u);if(g)return[...l,...g.map(a)];if(mp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...yp(e).map(a)]:l;if(m==="eval")return[...l,...cl(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((p)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(p)?[p.slice(p.indexOf("=")+1)]:Xe(m,p)).map(a)];if(m==="git")return[...l,...Mw(u).map(a)];if(m==="gh")return[...l,...sl(m,u,ow).map(a)];if(Qf.has(m))return[...l,...Ow(u).map(a)];if(rw.has(m))return[...l,...oA(u).map(a)];if(q_.has(m))return[...l,...Ww(u,t,n,r,o,i).map(a)];if(we.has(m))return[...l,...u.flatMap((p)=>Xe("awk",p)).map(a),...u.flatMap((p)=>Fw(p,t,n,r,o,i)),...u.flatMap(zw).map(a)];if(m==="curl")return[...l,...u.flatMap((p)=>Xe(m,p)).map(a),...Dw(u).map(a)];if(ur(m)){let p=lr.has(m)?Ee([m,...u]):null;if(p!==null&&p.command!==null&&p.commandIndex!==null){let h=t.getShellSyntax(p.command);if(h.status==="structural-limit")throw new Ge;if(h.status==="complete")return[...l,...kn(h,t,n,r,o,i),...u.slice(p.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...Gw(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((p)=>Xe(m,p)).map(a)]}function vw(e,t,n){let r=fi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function Ew(e,t,n,r,o,i,s){if(Aw(t,n,r,o,i,s)){let a=ut(e),l=ll(He(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...yp(e),...l].map((c)=>({target:c,cwd:i}))}return hp(t,Rw(e),n,r,o,i,s,()=>[])}function xw(e,t,n,r,o,i,s){let a=ut(e);if(!ur(He(a[0]??"").toLowerCase()))return[];return cl(t,n,r,o,i,s)??[{target:t,cwd:i}]}function hp(e,t,n,r,o,i,s,a){let l=Pw(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>lr.has(l)?kn(n.getShellSyntax(c),n,r,o,i,s):hi(l,c,n,r,o,i,s))}function yp(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase();if(!mp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[ul(r.replaceAll("%%","%"))];return t.slice(1)}function Rw(e){let t=ut(e);if(t.length===0)return[];let n=He(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return _w(r);return[]}function _w(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[ul(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>ww(t,r.slice(i*n,(i+1)*n)))}function ww(e,t){let n=0;return ul(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function ul(e){return e.replace(/\\n/g,`
-`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Aw(e,t,n,r,o,i){let s=ut(e);if(s.length===0||He(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Vt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,rl]:l.map((m)=>m.split(c).join(rl));return bi(d,t,n,r,o,i).some((m)=>m.target.includes(rl))}function Pw(e){let t=ut(e);if(t.length===0)return null;let n=He(t[0]??"").toLowerCase();if(!ur(n))return null;return Tw(n,t.slice(1))?n:null}function Tw(e,t){let n=dl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(pp.has(o)||bp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(bw.get(n)?.has(o))r++;continue}return!1}return!0}function dl(e){return/^python\d/.test(e)?"python":e}function Iw(e){let t=[];for(let n of e){if(Sp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var sp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function kw(e,t){if(!t||!sp.test(e))return e;return`~${e.replace(sp,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function Ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function Mw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...iw.has(r)?sl("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),sw):sl("git",e.slice(n),aw)];if(t.push(...Xe("git",r)),!ve.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function sl(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function Dw(e){return e.flatMap((t,n)=>{let r=Lw(t);if(r!==null)return ap(r.flag,r.value);let o=Nw(e[n-1]);return o===null?[]:ap(o,t)})}function ap(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return ol(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return ol(t.slice(n+1))}return t.startsWith("@")?ol(t.slice(1)):[]}function Nw(e){if(e===void 0)return null;if(fp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function Lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return fp.has(r)?{flag:r,value:e.slice(n+1)}:null}function ol(e){return e===""||e==="-"?[]:[e]}function Ww(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!Z_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>X_.has(f)),m=d===-1?c:c.slice(0,d),u=bi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,g,p)=>{if(!Q_.has(f))return[];let h=p[g+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function Gw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(pp.has(c)||bp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...hi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function bp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return nw.get(t[t.length-1]??"")?.has(dl(e))??!1}function Fw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ba(e)?.commands.flatMap((s)=>kn(t.getShellSyntax(s),t,n,r,o,i))??[]}function zw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Bw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ml),...e.match(il)??[]]}function hi(e,t,n,r,o,i,s){let a=(p)=>({target:p,cwd:i}),l=Uw(t,$w(e));if(l.kind==="unmaskable")return Bw(t).map(a);let c=l.masked.match(np)!==null||l.literals.some((p)=>rp.test(l.masked.slice(0,p.start))),d=l.masked.match(hw)!==null||l.literals.some((p)=>yw.test(l.masked.slice(0,p.start))),m=r.inlineLiteralsPresumedData===!0&&!lr.has(e),u=m&&!(Kw(l.masked)||c||d)?[]:l.literals,f=m?Array.from(l.masked.matchAll(np),(p)=>{let h=p.index+p[0].length;return{start:h,end:Xs(l.masked,h)}}):[],g=!m||f.some((p)=>Js(l.masked,p.start))?l.literals:l.literals.filter((p)=>rp.test(l.masked.slice(0,p.start))||f.some((h)=>p.start>=h.start&&p.start<h.end));return[...u.map((p)=>p.text).filter((p)=>p!=="").map(a),...u.flatMap((p)=>ml(p.text)).map(a),...m?[]:l.literals.flatMap((p)=>p.text.match(il)??[]).map(a),...c?g.flatMap((p)=>cl(p.text,n,r,o,i,s)??[a(p.text)]):[],...d?l.literals.flatMap((p)=>hi(e,p.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
-`:y),n,r,o,i,s)):[],...(l.masked.match(il)??[]).map(a)]}function $w(e){let t=dl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function Uw(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(pw.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Vw(e,o))return{kind:"unmaskable"};let a=t==="python"?Hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=jw(e,c,l);if(d===null)return{kind:"unmaskable"};let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&gw.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function Hw(e,t){return fw.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function jw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
-`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Vw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Kw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(ew.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>tw.has(i)))continue;if(o.length>1)return!0;if(qw(e,r)===".")return!0;if(Yw(e,r+n.length)==="(")return!0}return!1}function qw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Yw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Zw(e,t,n,r,o,i){return tA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...kn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...Xw(a,r)?Jw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Xw(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||He(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Jw(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(ml)}function ml(e){let t=eA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Qw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Qw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function eA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function tA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(jn(o,n))continue;if(Cp(e,r,n)){let i=nA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=rA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function nA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(jn(i,n))continue;if(Cp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function rA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Cp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function oA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===lw)o=!0;if(uw.has(m))r=!0;if(u!==void 0){if(m===tp)t.push(u);continue}if(mw.has(m)){let f=e[l+1];if(m===tp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let p=0;p<m.length;p++){let h=m[p]??"";if(cw.has(h))r=!0;if(dw.has(h)){u=h,f=m.slice(p+1);break}}if(u==="")continue;if(f.length>0){if(u===ep)t.push(f);continue}let g=e[l+1];if(u===ep&&g!==void 0)t.push(g);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!Sp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Sp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var iA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),sA=".env.",aA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),lA=[".env.example.",".env.sample."];function cA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function uA(e){return e.length>0&&!/\s/.test(e)}function al(e,t,n,r){let o=vp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function vp(e,t,n,r){try{return Tr(e,t,n,r)}catch(o){if(o instanceof D)throw o;return""}}var dA=new Set(["node_modules","__pycache__"]),mA=[["vendor","bundle"],["vendor","cache"]];function fA(e,t,n,r,o){if(cA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=z(i.split("/").pop()??""),a=z(i),l=()=>uA(s)||al(e,t,r,o);if(aA.has(s)||lA.some((u)=>s.startsWith(u)))return null;let c=z(CA(e,t,r,o));for(let u of ms){let f=`~/${u.suffixParts.join("/")}`;if((cp(a,f)||cp(c,f))&&ct(u.id,n))return u.id}let d=pA(i,t,n,r,o);if(d)return d;if(iA.has(s))return null;for(let u of ds)if(s===u.basename&&ct(u.id,n))return u.id;if(s.startsWith(sA)&&ct(Zr.id,n)&&l())return Zr.id;for(let u of fs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&ct(u.id,n)&&l())return u.id}for(let u of ps)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&ct(u.id,n))return u.id}if(yA(a))return null;if(!s.includes(".")&&Vn.pattern.test(s)&&ct(Vn.id,n))return Vn.id;let m=bA(s,n);if(m)return m;return null}function pA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=z(e).split("/");return W(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Pr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Ar(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=z(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=z(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(H(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Pr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Ar(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Ar(e,s,["credentials"])||Ar(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=z(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=z(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>Pr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=ce(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(H(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(z(e).split("/").at(-1)??"")||W(e,s,["config.json"])||(c?.trim()?Pr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,Ze(d,t,r,o),l))}case"secret.cli.pi":return W(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ce(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Ar(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ze("~",t,r,o),".config","amp")],l=z(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Pr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(H(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ze("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||z(e).split("/").at(-1)==="mcp-auth.json"&&Zt(z(e),z(a))}case"secret.cli.cursor.config":{let s=z(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=z(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var lp=new WeakMap;function H(e,t,n,r,o){let i=lp.get(o)??new Map;lp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>Ep(e,ce(t,r)))}function Ar(e,t,n){return n.some((r)=>Zt(z(e),z(ce(t,r))))}function Pr(e,t,n,r,o){return Ep(e,Ze(t,n,r,o))}function Ep(e,t){return z(e)===z(t)}function ce(e,...t){return Ue([e,...t].filter(Boolean).join("/"))}function gA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));return n.some((a)=>Zt(s,z(Tr(a,r,o,i))))}function hA(e,t,n,r,o,i){if(n.length===0)return!1;let s=z(Tr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ue(N(Se(a),o.paths,i)):"",c=z(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=z(d?Ue(N(yi(Se(d)),o.paths,i)):l&&Ue(N(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Zt(s,m))return!1;return n.some((u)=>{let f=Cs(u);if(f&&up.basename(s)!==z(f.name))return!1;let g=z(Tr(f?.root??u,r,o,i));if(!g)return!1;if(c&&(c===g||c.startsWith(g.endsWith("/")?g:`${g}/`)))return!1;return Zt(s,g)&&!(f&&s===g)})}function yA(e){let t=e.split("/");return t.some((n)=>dA.has(n))||mA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function bA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function z(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";if(!o)return i;let s=pl(i,o),a=gi(s)?s:Ue(yi(t,s)),l=Ue(N(a,n.paths,r));if(!Zt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function cp(e,t){return e===t||e.startsWith(`${t}/`)}function CA(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i||!o)return"";let s=pl(i,o),a=up.normalize(gi(s)?s:Ue(yi(t,s))),l=Ue(Se(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Zt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function Tr(e,t,n,r){let{home:o,normalized:i}=fl(e,n,r);if(!i)return"";let s=o?pl(i,o):i;return Ue(N(gi(s)?s:yi(t,s),n.paths,r))}function fl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ue(N(Se(r),t.paths,n)):"",i=Ue(Se(SA(ot(e,t))));return{home:o,normalized:i}}function SA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return K_(e)}catch{return e}}function pl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function vA(e){if(process.platform==="win32")return!0;return V_.parse(e).root.length>1}function Ue(e){let t=e.trim(),n=(t.includes("\\")&&vA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Zt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function He(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Xt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var EA={findPolicyMutation:Xf,findGitMetadataMutation:xd,resolveGitMetadata:RA,loadPolicySnapshot:du,findSensitiveTarget:gp,analyzeCommand:$f,getModes:zi},xA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function xp(e,t){let n={...EA,...t.dependencies},r=AA(e),o=Ir(e)?e.command:r,i=At("policy-protection",o,()=>dr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Ir(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Ud,intent:"stop_and_explain"}};let l=Ce(),c=At("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=At("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Zf,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=At("policy-protection",o,()=>Vf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:jf,intent:"hard_stop",evidence:{command:E,segment:m.target}}}}let u=At("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=At("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),g=f.policy,p=n.getModes(g,t.environment.env),h={level:p.effectiveLevel,..._A(f)},y=g.secretProtection.enabled===!1?null:At("secret-protection",o,()=>n.findSensitiveTarget(i,g.secretProtection,t.environment,l,{strict:Ir(e)||s?.program.dialect==="powershell"?p.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:dp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!Ir(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...gl("command-validation",o),...h};let v=At("command-analysis",o,()=>Uf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:p.capabilities,strict:p.strict,paranoidRm:p.paranoidRm,paranoidInterpreters:p.paranoidInterpreters,worktreeMode:p.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},wA(i),i.store),e.command,t.trace));if(v.decision){let E=!p.strict&&(v.decision.ruleId==="raw-text.dangerous-command"||v.decision.reason===gr&&!xA.test(v.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:E?{...v.decision,unverifiedByStandardMode:!0}:v.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function RA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function _A(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function wA(e){return ge(e,"declared-command")?.program}function AA(e){try{return Gn(e.input)}catch(t){let n=Ir(e)?e.command:void 0;throw new Xt("policy-protection",gl("policy-protection",t instanceof Qe?void 0:n,t),t)}}function At(e,t,n){try{return n()}catch(r){throw new Xt(e,gl(e,r instanceof Qe?void 0:t,r),r)}}function gl(e,t,n){let r=n instanceof D||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?Ei:Dn,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Ir(e){return e.route.kind==="command"}import{appendFileSync as zA,mkdirSync as BA}from"fs";import{isAbsolute as $A,join as bl}from"path";import{lstatSync as _p,readdirSync as PA,readFileSync as TA,rmdirSync as IA,statSync as wp,unlinkSync as kA,utimesSync as OA,writeFileSync as MA}from"fs";import{join as kr}from"path";function Rp(e,t={}){return so(sn(e,t),e.home).policy.audit.retention_days}var yl=86400000,DA=".last-prune",NA=/^\d{4}-\d{2}$/,LA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Ap=(e)=>Math.floor(e/yl);function Tp(e,t,n=()=>new Date){try{let r=n().getTime();if(!wp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=kr(t,DA),i=wp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Ap(i)===Ap(r))return;let s=r-Rp(e)*yl,a=new Date(r).toISOString().slice(0,7);for(let l of hl(t)){if(l.isDirectory()){WA(kr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))GA(kr(t,l.name),s)}MA(o,"",{mode:384}),OA(o,r/1000,r/1000)}catch{}}function WA(e,t,n){for(let r of hl(e)){if(!r.isDirectory()||!NA.test(r.name))continue;let o=kr(e,r.name);for(let i of hl(o)){if(!i.isFile())continue;let s=LA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+yl;if(!Number.isFinite(a)||a>=t)continue;Ip(kr(o,i.name))}if(r.name!==n)Pp(o)}Pp(e)}function GA(e,t){try{let n=_p(e);if(n.mtimeMs>=t)return;let r=TA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(FA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(_p(e).mtimeMs!==n.mtimeMs)return;Ip(e)}catch{}}function FA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function hl(e){try{return PA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Ip(e){try{kA(e)}catch{}}function Pp(e){try{IA(e)}catch{}}var UA="2.4.13",HA=1e4,jA=2000,VA=256,KA=32768;function qA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function YA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Cl(e,t,n,r,o,i,s={}){let a=qA(t);if(!a)return;let l=XA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=Ci(mt(n),s.failureStage?Number.POSITIVE_INFINITY:HA),m=Ci(mt(r),jA),u=s.toolName?Ci(mt(s.toolName),VA):void 0,f=i===null?void 0:Ci(mt(i),KA),g=bl(l,YA(f?.value??null),c.slice(0,7));BA(g,{recursive:!0,mode:448});let p=bl(g,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:UA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};zA(p,`${JSON.stringify(h)}
-`,{encoding:"utf-8",mode:384}),Tp(e,l,s.now)}catch{}}function Ci(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function ZA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&$A(n)?n:null}function XA(e){let t=ZA(e);return t?bl(t,".cc-safety-net","logs"):null}function Op(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=kp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?kp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function kp(e){return"command"in e?e.command??"":""}function Mp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Cl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Dp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Cl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Lp(e,t,n){try{let r=xp(t,{environment:e,...n.guard});return Np(e,t,r,n),r}catch(r){if(!(r instanceof Xt))throw r;throw Np(e,t,r.evaluation,n,!(r.cause instanceof Qe),{stage:r.stage,errorCode:JA(r.cause)}),r}}function Np(e,t,n,r,o=!0,i){Mp(e,Op(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function JA(e){if(e instanceof D)return V[e.kind].errorCode;if(e instanceof Qe)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Jt(e,t={}){return{malformed:!0,denial:Nn(t),cwd:e}}function Sl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Wp(e,t={}){return(n,r)=>{try{return QA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Nn())}}}function QA(e,t,n,r){let o=nc();if(n.cancelled?.(t))return n.block(Nn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Dp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=xl(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Lp(o,i,{guard:{auditAllowed:rc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Xt))throw l;if(Tt(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${_l(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var eP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>nP(e,t,n),getSessionId:(e)=>iP(e),allow:{action:"allow"},block:(e)=>sP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},Gp=tP();function tP(e={}){return Wp(eP,e)}function nP(e,t,n){if(!e||typeof e!=="object")return Jt(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Jt(null);if(!r.input||typeof r.input!=="object")return Jt(null,{toolName:r.tool});let o=rP(t);if(!o)return Jt(null,{toolName:r.tool});let i=ql(".",[o],n);if(!i)return Sl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=oP(t,e);if(!s.ok)return Jt(i,{toolName:r.tool});if(!s.command)return en(r.tool,r.input,{kind:Ai(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return Jt(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=Yl(a,i,n);if(!l)return Sl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return en(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function rP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function oP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function iP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function sP(e){return{action:"reject-and-continue",message:Rl(e)}}function aP(e){e.on("tool.call",(t)=>Gp(t,e))}export{aP as default};
+`?e.trim().split(/\s+/).filter(Boolean):e.split(t).filter(Boolean)}function xr(e){if(!e)return!0;return e.provenance==="unknown"?!/[$`]/.test(_(e)):e.provenance==="literal"}function _n(e){return e?_(e):""}function Hm(e){return`'${e.replaceAll("'",`'"'"'`)}'`}function Wa(e,t){return Na(Ne(e,"posix"),t)}function Rr(e){return Wa(e,new Set(Array.from(e.matchAll(Wm)).flatMap((t)=>{let n=t[1]??t[2];return n===void 0?[]:[n]})))}function Na(e,t){if(e.status==="invalid"||e.status==="limited")return!1;let n=new Set(t);for(let r of e.nodes){if(r.kind==="group"){if(Na(r.body,n))return!0;continue}if(r.kind!=="command")continue;if(r.nested.some((o)=>Na(o,n))||jm(r.words,n))return!0;sR(r,n)}return!1}function jm(e,t){let n=e.findIndex((s)=>Ie(s.text)===null);if(n===-1)return!1;let r=e[n];if(!r)return!1;if(Er(r,t))return!0;let o=O(r.text);if(o==="source"||o==="."){let s=e[n+1]?.text==="--"?n+2:n+1;return Lm(e[s],t)}if(Y.has(o)){let s=e.slice(n),a=xe(s.map((c)=>c.text)),l=a.commandIndex??a.scriptIndex;return!a.syntaxCheck&&l!==null&&Lm(s[l],t)}let i=nR(e,n,t);if(i===null)return!1;if(i===-1)return!0;return jm(e.slice(i),t)}function nR(e,t,n){let r=O(e[t]?.text??"");if(r==="command")return rR(e,t+1);if(r==="exec")return oR(e,t+1);if(r==="env")return iR(e,t+1,n);return null}function rR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(/^-[p]*[vV][pvV]*$/.test(r))return null;if(/^-p+$/.test(r))continue;return n}return null}function oR(e,t){for(let n=t;n<e.length;n++){let r=e[n]?.text??"";if(r==="--")return e[n+1]?n+1:null;if(r==="-a"){n++;continue}if(/^-a.+/.test(r)||/^-[cl]+$/.test(r))continue;return n}return null}function iR(e,t,n){for(let r=t;r<e.length;r++){let o=e[r],i=o?.text??"";if(i==="--")return e[r+1]?r+1:null;if(i==="-S"||i==="--split-string")return Er(e[r+1],n)?-1:r+2;if(i.startsWith("-S")||i.startsWith("--split-string="))return Er(o,n)?-1:r+1;if(i==="-u"||i==="--unset"||i==="-C"||i==="--chdir"||i==="-P"){r++;continue}if(i==="-i"||i==="-0"||i==="--null"||i.startsWith("-u=")||i.startsWith("--unset=")||i.startsWith("-C")||i.startsWith("--chdir=")||i.startsWith("-P"))continue;if(i.startsWith("-"))continue;if(Ie(i))continue;return r}return null}function sR(e,t){if(!e.words.every((n)=>Ie(n.text)!==null))return;for(let n of e.words){let r=Ie(n.text);if(!r)continue;if(Er(n,t))t.add(r.name)}}function Er(e,t){if(!e)return!1;return e.parts.filter((n)=>n.provenance==="variable").some((n)=>Array.from(n.raw.matchAll(Wm)).some((r)=>{let o=r[1]??r[2];return o!==void 0&&(Yx.test(o)||t.has(o))}))}function Lm(e,t){return!!e&&(e.parts.some((n)=>n.provenance!=="literal"&&n.provenance!=="variable")||Er(e,t))}var Ga="xargs rm -rf with dynamic input is dangerous. Use explicit file list instead.",Fa="xargs dynamic input can supply arbitrary executable command source. Use an explicit child command and arguments instead.",aR="__CC_SAFETY_NET_XARGS_INPUT__",ti="__CC_SAFETY_NET_XARGS_INTERPRETER_INPUT__",ni="rm",lR=/(?:^|[;&|]\s*|\b(?:eval|source)\s+|\b(?:ba|da|z|k)?sh\s+-c\s+)\s*["']?\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,cR=/(?:^|[;&|]\s*)\s*eval\b((?:\\.|"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\\'";&|\r\n])*)/g,uR=/\$(?:([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)|\{!?([0-9]+|[@*]|[A-Za-z_][A-Za-z0-9_]*)(?:[^}]*)\})/g,dR=/^(?:[0-9]+|[@*])$/;function qm(e,t){let n=e.map(_),{childStart:r,replacementToken:o}=Kt(n),i=n.slice(r),s=v("xargs.shell-dynamic",Fa);if(fR(i,o,t)&&P(s,t.policy))return P(s,t.policy);for(let a of Be(i,t)){let l=a.tokens,c=o!==null&&l[0]!==i[0]&&(l[0]?.includes(o)??!1)?P(s,t.policy):null;if(c)return c;let d=ef(l,o,a.wrapperEnvAssignments),m=a.head==="rm"&&o!==null&&Jm(l,o),u=t.analyzeChild(l,{...Ht(a,t),dynamicInput:d,dynamicSourceInput:m||Zm(l,a.head,o,a.wrapperEnvAssignments,d,t.environment,t.strict?void 0:t.analyzeNested),dynamicRmInput:m,shellDynamicMatch:s,dynamicSourceMatch:s,rmDynamicMatch:v("xargs.rm-recursive-force-dynamic",Ga)});if(u)return u;let f=mR(l,o,t.policy?.rules??[],P(s,t.policy));if(f)return f;if(a.head==="git"){let g=o===null?[...l,aR]:l,h=o!==null&&(l.some((b)=>b.includes(o))||Array.from(a.envAssignments.values()).some((b)=>b.includes(o))),y=t.analyzeChild(g,{...Ht(a,t),worktreeMode:o===null||h?!1:t.worktreeMode});if(y)return y}let p=it(l,t.policy?.rules??[]);if(p)return p}return null}function mR(e,t,n,r){if(n.length===0)return null;if(t===null){for(let i of n){let s=it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],n);if(s)return s}return null}let o=O(e[0]??"");if(!n.some((i)=>O(i.command)===o))return null;return e.slice(1).some((i)=>i.includes(t))?r:null}function Ym(e,t,n){let r=e.indexOf(t);if(r===-1||e.indexOf(t,r+t.length)!==-1)return[];let o=Om(e,r,t.length,n);return o===null?[]:[o]}function Zm(e,t,n,r,o,i,s){if(Y.has(t)){if(st(e))return!1;if(n!==null&&pR(e,n,s))return!0;let a=Ue(e);if(!a){let l=lt(q(e));if(l.kind==="literal")return n!==null&&l.source.includes(n);return l.kind==="none"&&o}if(n!==null&&a.includes(n)&&!Xm(a,n,s))return!0;if(Te(a))return!0;return gR(a,n,r)}if(De(t))return Vm(e,n,Ro,Xu(t));if(Pe.has(t))return Vm(e,n,ya,Xd);if(t==="eval"){let a=Qo(q(e));if(a.kind==="dynamic")return!0;if(n!==null)return a.kind==="literal"&&a.source.includes(n);return o}if(t==="find")return hR(e,n,i);if(t==="git"){let a=_e(e);return n===null?a.subcommand===null:(a.subcommand?.includes(n)??!1)||a.subcommand!==null&&Rn.has(a.subcommand.toLowerCase())&&Qm(a.rest,n).some((l)=>l.includes(n))}return!1}function Xm(e,t,n){if(n===void 0)return!1;let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");if(new RegExp(`(?:^|[;&|({!\`\\n]|\\b(?:then|do|else|elif|if|while|until|time|command|builtin|nohup|eval|exec|source))\\s*(?:[A-Za-z_][A-Za-z0-9_]*=\\S*\\s+)*["']?${r}`).test(e)||/\bcase\b/.test(e))return!1;let i=e.replaceAll(t,"/");return Te(i)===null&&n(i)===null}function Vm(e,t,n,r){let o=n(e);if(t===null)return o.optionsOpen||n([...e,ti]).sources.some((a)=>a.value===ti);if(o.sources.some((a)=>a.value.includes(t)))return!0;let i=r.flatMap((a)=>[a.selector,...a.valueForm==="attached-only"||a.valueForm==="attached-or-separate"?[`${a.selector}${ti}`]:[],...a.valueForm==="equals-or-separate"?[`${a.selector}=${ti}`]:[]]),s=new Set(i.flatMap((a)=>e.flatMap((l)=>Ym(l,t,a))));return Xo(o.sources,s,(a)=>n(e.map((l)=>l.replaceAll(t,a))).sources)}function fR(e,t,n){if(e.length===0||(e[0]??"").toLowerCase()==="command")return!1;let r=new Set(Array.from(Be(e,n),(i)=>i.head)),o=t===null?[...e,ni]:e.map((i,s)=>s===0?i:i.replaceAll(t,ni));return Array.from(Be(o,n)).some((i)=>i.head===ni&&!r.has(ni))}function Jm(e,t){return Qm(e.slice(1),t).some((n)=>n.includes(t)&&(n.startsWith("-")||n.startsWith(t)))}function Qm(e,t){let n=e.findIndex((r)=>r==="--"&&!r.includes(t));return n===-1?e:e.slice(0,n)}function ef(e,t,n){if(t===null)return!0;return e.some((r)=>r.includes(t))||Array.from(n.values()).some((r)=>r.includes(t))}function pR(e,t,n){let r=xe(e),o=r.commandIndex===null?"":e[r.commandIndex]??"";if(o.includes(t)&&!Xm(o,t,n)||r.scriptIndex!==null&&(e[r.scriptIndex]??"").includes(t))return!0;return["-c","-nc","-cn",`--${t}`,t].some((s)=>e.some((a,l)=>{if(l===0||!a.includes(t))return!1;return Ym(a,t,s).some((d)=>{let m=e.map((f,p)=>p===l?f.replaceAll(t,d):f),u=xe(m);if(u.commandIndex===null&&u.scriptIndex===null)return!1;if(r.commandIndex===null&&u.commandIndex!==null)return!0;if(r.scriptIndex===null&&u.scriptIndex!==null)return!0;if(u.commandIndex!==null&&(m[u.commandIndex]??"").includes(d))return!0;return u.scriptIndex!==null&&(m[u.scriptIndex]??"").includes(d)})}))}function gR(e,t,n){let r=new Set(t===null?[]:Array.from(n).filter(([,o])=>o.includes(t)).map(([o])=>o));for(let o of e.matchAll(lR))if(Km(o,r))return!0;for(let o of e.matchAll(cR))for(let i of(o[1]??"").matchAll(uR))if(Km(i,r))return!0;return Wa(e,r)}function Km(e,t){let n=e[1]??e[2];return n!==void 0&&(dR.test(n)||t.has(n))}function hR(e,t,n){if(t===null)return!0;let r=!1,o=0;for(let i=1;i<e.length;i++){let s=e[i]??"";if(!r&&!s.startsWith("-")&&s!=="!"&&s!=="("){if(s.indexOf(t)===0)return!0;continue}if(r=!0,o>0){o--;continue}if(qe(s)){let l=xn(e,i);i=l.nextIndex-1;for(let c of Be(l.tokens,{environment:n,cwd:void 0})){let d=ef(c.tokens,t,c.wrapperEnvAssignments);if(c.head==="rm"&&Jm(c.tokens,t)||Zm(c.tokens,c.head,t,c.wrapperEnvAssignments,d,n))return!0}continue}let a=at(s);if(a>0){if(o=a,s.includes(t))return!0;continue}if(s.includes(t))return!0}return!1}function Kt(e){let t=new Set(["-L","-n","-P","-s","-a","-E","-R","-S","-e","-d","-J","--max-args","--max-procs","--max-chars","--arg-file","--eof","--delimiter","--max-lines","--process-slot-var"]),n=null,r=1;while(r<e.length){let o=e[r];if(!o)break;if(o==="--")return{childStart:r+1,replacementToken:n};if(!o.startsWith("-"))return{childStart:r,replacementToken:n};if(o==="-I"){n=e[r+1]??"{}",r+=2;continue}if(o.startsWith("-I")&&o.length>2){n=o.slice(2),r++;continue}if(o==="--replace"){n="{}",r++;continue}if(o.startsWith("--replace=")){let i=o.slice(10);n=i===""?"{}":i,r++;continue}if(o==="-J"){n=e[r+1]??"{}",r+=2;continue}r+=t.has(o)?2:1}return{childStart:e.length,replacementToken:n}}var wr="parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.",_r="parallel with shell -c can execute arbitrary commands from dynamic input. Run the inner command directly on an explicit file list instead.",CR="parallel without a command reads executable commands from dynamic input. Use an explicit command template or ::: arguments instead.",bR="parallel command construction cannot be verified safely. Use the default ::: separator, literal arguments, and built-in replacement strings.",oi=/\{[^{}\s]*\}/g,tf=/\{\}|\{-?\d+\}/g,SR=["e","f","source","file","-e","-f","--source","--file"],vR=["c","e","eval","m","r","Mmodule","import","require","-c","-e","-m","-r","--eval","--import","--require"],ER=new Set(["-L","-d","-n","--delay","--delimiter","--header","--joblog","--jl","--max-args","--max-lines","--nice","--results","--result","--res","--tagstring","--timeout"]),xR=new Set(["--arg-file","--colsep","--rpl","--arg-sep","--arg-file-sep"]),nf=new Set(["-S","--sshlogin","--slf","--sshloginfile"]),RR=new Set(["--workdir","--wd"]),rf="__CC_SAFETY_NET_PARALLEL_SOURCE__";function Oe(e,t){for(let n of e){let r=t(n);if(r)return r}return null}function cf(e){return Oe([...e],(t)=>Te(t))}function uf(e,t){let n=e.map(_);if((t.envAssignments?.has("PARALLEL")?t.envAssignments.get("PARALLEL"):t.environment.env.get("PARALLEL"))?.trim()){let p=An(t);if(p)return p}if(n.length===2&&(n[1]==="--version"||n[1]==="--help"))return null;let o=bf(n),{template:i,jobs:s,runsRemotely:a,readsCommandsFromInput:l,unsupported:c,workdir:d,dryRun:m}=o;if(c){let p=An(t);if(p)return p;let g=cf(t.envAssignments?.values()??[]);if(g)return g}if(l){let p=IR(t);if(p)return p}if(d!==void 0&&a){let p=An(t);if(p)return p}let u=kR(d,t.cwd,t.environment.paths);if(u===null){let p=An(t);if(p)return p}let f=a?{...t,cwd:void 0,originalCwd:void 0}:u===null||u===void 0||u===t.cwd?t:{...t,cwd:u};if(m){if([...Be(i,f)].flatMap((g)=>[...g.envAssignments.values()]).some($a)){let g=An(t);if(g)return g}return null}if(i.length===0){let p=s.map((h)=>h[0]??"");t.budget.charge("derivedTokens",p.length);let g=pf(f.envAssignments,f.cwd,a);return Oe(p,(h)=>t.analyzeNested(h,g))}return Oe(Be(i,f),(p)=>wR(p,o,t,f))}function wR(e,t,n,r){let{jobs:o,templateHasPlaceholder:i,runsRemotely:s,usesStdin:a}=t,l=e.tokens,c=[...e.envAssignments.values()];if(c.some(yf)){let h=An(n);if(h)return h}let d=cf(c);if(d)return d;let m=c.some(B),u=i||m,f=a&&u,p=pf(e.envAssignments,e.wrapperCwd,s||f);if(Y.has(e.head)){let h=()=>{if(!i||o.length===0)return null;return Oe(o,(C)=>n.analyzeChild(ri(l,C,n.budget),Ht(e,r)))};if(st(l))return h();let y=Ue(l);if(y){if(Cf(y)){let E=Rt(n);if(E)return E;if(o.length===0)return null;return Oe(o,(I)=>n.analyzeNested(af(y,I,n.budget),p))}if(B(y)){if(o.length>0)return Oe(o,(W)=>n.analyzeNested(af(y,W,n.budget),p));let E=vr(y);if(E?.[0]&&O(E[0])==="rm"&&$e(E)){let W=sf(n);if(W)return W}let I=E?n.analyzeChild(E,{...Ht(e,r),dynamicInput:a,shellDynamicMatch:v("parallel.shell-dynamic",_r),rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",wr)}):null;if(I)return I;return n.analyzeNested(y,p)}let C=!m&&(!i||o.length>0)?(o.length>0?o:[void 0]).map((E)=>ei(q(E===void 0?l:i?l.map((I)=>gf(I,E)):[...l,...E]),y)):[];if(C.some((E)=>E.kind==="dynamic")){let E=Rt(n);if(E)return E}let x=C.flatMap((E)=>E.kind==="literal"?[E.source]:[]);if(x.length>0)return n.budget.charge("derivedTokens",x.length),Oe(x,(E)=>n.analyzeNested(E,p));if(Rr(y)){let E=Rt(n);if(E)return E}let A=n.analyzeNested(y,p);if(A)return A;if(u)return Rt(n);return null}let b=lt(q(l));if(b.kind==="dynamic"||b.kind==="literal"&&B(b.source))return Rt(n)??h();if(b.kind==="literal")return h();if(o.length>0){let C=Rt(n);if(C)return C;let x=h();if(x)return x;if(i)return null;let A=o.flatMap((E)=>E[0]===void 0?[]:[E[0]]);return n.budget.charge("derivedTokens",A.length),Oe(A,(E)=>n.analyzeNested(E,p))}if(u||a)return Rt(n)??h();return null}if(e.head==="rm"&&$e(l)){if(i&&o.length>0)return Oe(o,(y)=>za(ri(l,y,n.budget,tf),e.cwd,r));if(o.length>0)return Oe(o,(y)=>za(lf(l,y,n.budget),e.cwd,r));let h=za(l.flatMap((y,b)=>{if(b===0||!B(y))return[y];return y.startsWith("-")?[y.replace(tf,"")]:[]}),e.cwd,r);if(h)return h;return sf(n)}let g=o.length>0?o:[void 0];return Oe(g,(h)=>{let y=h===void 0?l:i?ri(l,h,n.budget):lf(l,h,n.budget),b=v("parallel.shell-dynamic",_r),C=a&&e.head==="find"?TR(y,r):null,x=mf(y,a,n)??C?.customResult??null,A=O(e.head),E=a&&(A==="rm"&&Ba(y)||A==="xargs"&&ff(y)||C?.rmOptions===!0),I=a&&(E||C?.executedSource===!0||C===null&&df(y,A)),W=n.analyzeChild(y,{...Ht(e,r),worktreeMode:s||a||u?!1:n.worktreeMode,dynamicInput:a||u,dynamicRmInput:E,dynamicSourceInput:x!==null||I,shellDynamicMatch:b,dynamicSourceMatch:b,rmDynamicMatch:v("parallel.rm-recursive-force-dynamic",wr)});if(I){let Q=P(b,n.policy);if(Q)return Q}return W??x??it(y,n.policy?.rules??[])})}function df(e,t){if(B(e[0]??""))return!0;if(t==="eval"||t==="source"||t===".")return!0;if(t==="parallel"||t==="xargs")return!0;if(Y.has(t))return PR(e);if(t==="git")return _R(e);if(t==="find")return!0;if(Pe.has(t))return of(e,SR,br);if(De(t))return of(e,vR,xo);return!1}function Ba(e){let t=e.indexOf("--"),n=e.slice(1,t===-1?void 0:t);if(!e.some(B))return t===-1;return n.some((o)=>B(o)&&(o.startsWith("-")||Cf(o)))}function _R(e){if(AR(e))return!0;let t=_e(e);if(t.subcommand===null||B(t.subcommand))return!0;if(!Rn.has(t.subcommand.toLowerCase()))return!1;let n=t.rest.indexOf("--"),r=t.rest.slice(0,n===-1?void 0:n);if(!e.some(B))return n===-1;return r.some(B)}function AR(e){for(let t=1;t<e.length;t++){let n=e[t];if(!n||n==="--"||!n.startsWith("-"))return!1;if(n==="-c"||n==="--config-env"){if(B(e[t+1]??""))return!0;t++;continue}if(n.startsWith("-c")&&n.length>2||n.startsWith("--config-env=")){if(B(n))return!0;continue}if(B(n))return!0}return!1}function PR(e){if(st(e))return!1;let t=Ue(e);if(t!==null)return B(t);let n=lt(q(e));if(n.kind==="literal")return B(n.source);if(n.kind==="dynamic")return!0;return!e.some(B)}function of(e,t,n){let r=n(e);if(r.some((o)=>B(o.value)))return!0;if(!e.some(B))return n([...e,rf]).some((o)=>o.value===rf);return Xo(r,t,(o)=>n(e.map((i)=>gf(i,[o]))))}function mf(e,t,n){let r=n.policy?.rules??[];if(!t||r.length===0)return null;let o=r.filter((i)=>O(i.command)===O(e[0]??""));if(o.length===0)return null;if(e.slice(1).some(B))return Rt(n);return Oe(o,(i)=>it([...e,...i.subcommand?[i.subcommand]:[],...i.block_args],[i]))}function TR(e,t){let n={customResult:null,executedSource:!e.some(B),rmOptions:!1},r=!1,o=0,i=null,s=()=>{if(!i?.some(B))return;for(let a of Be(i,t))n.executedSource||=df(a.tokens,a.head),n.rmOptions||=a.head==="rm"&&Ba(a.tokens)||a.head==="xargs"&&ff(a.tokens),n.customResult??=mf(a.tokens,!0,t)};for(let a of e.slice(1)){if(!r&&!a.startsWith("-")&&a!=="!"&&a!=="("){n.executedSource||=B(a);continue}if(r=!0,i){if(a===";"||a==="+"){s(),i=null;continue}i.push(a);continue}if(o>0){o--;continue}if(qe(a)){i=[],n.executedSource||=B(a);continue}let l=at(a);if(l>0){o=l,n.executedSource||=B(a);continue}n.executedSource||=B(a)}return s(),n}function ff(e){let t=e.slice(Kt(e).childStart);return O(t[0]??"")==="rm"&&Ba(t)}function ii(e,t){return(n)=>P(v(e,t),n.policy)}var Rt=ii("parallel.shell-dynamic",_r),IR=ii("parallel.command-stream-dynamic",CR),An=ii("parallel.command-stream-dynamic",bR),sf=ii("parallel.rm-recursive-force-dynamic",wr);function za(e,t,n){return P(Jo(q(e),{environment:n.environment,cwd:t,budget:n.budget,originalCwd:n.originalCwd,strict:n.strict,paranoid:n.paranoidRm,allowTmpdirVar:n.allowTmpdirVar,tmpdirWordSplittingUnsafe:St(n.envAssignments??new Map,n.environment),trustedTmpdirValue:Bt(n.envAssignments??new Map,n.environment),protectedGitMetadata:n.protectedGitMetadata,policy:n.policy}),n.policy)}function pf(e,t,n){let r={};if(e)r.envAssignments=e;if(n)return r.effectiveCwd=null,r.worktreeMode=!1,r;if(t!==void 0)r.effectiveCwd=t;return Object.keys(r).length>0?r:void 0}function gf(e,t){return e.replace(oi,(n)=>hf(n,t))}function ri(e,t,n,r=oi){return n.charge("derivedTokens",e.reduce((o,i)=>o+1+Math.floor(i.length/64),0)),e.map((o)=>o.replace(r,(i)=>{let s=hf(i,t);return n.charge("derivedTokens",Math.max(1,Math.ceil(s.length/64))),s}))}function af(e,t,n){return ri([e],t,n)[0]??""}function lf(e,t,n){return n.charge("derivedTokens",e.length+t.length),[...e,...t]}function hf(e,t){let n=/^\{(-?\d+)[^{}\s]*\}$/.exec(e)?.[1];if(n===void 0)return t[0]??"";let r=Number(n);return t[r>0?r-1:t.length+r]??""}function B(e){return e.search(oi)!==-1}function yf(e){if($a(e))return!0;for(let t of e.matchAll(oi))if(!/^(?:\{\}|\{\d+\})$/.test(t[0]))return!0;return!1}function $a(e){let t=e.indexOf("{=");return t!==-1&&e.indexOf("=}",t+2)!==-1}function Cf(e){return/^\{[^{}\s]*\}$/.test(e)}function kR(e,t,n){if(e===void 0)return;if(e==="..."||/^~|[{}$`*?[]/.test(e))return null;if(!t&&!yR(e))return null;try{return ht(t??e,e,n)}catch{return null}}function bf(e){let t=1,n=[],r=e.length,o=-1,i=!1,s=!1,a,l=!1,c=e.some((p)=>p==="::::"||p==="::::+"||p===":::+");while(t<e.length){let p=e[t];if(p===void 0)break;if(p===":::"){o=t;break}if(p==="--"){let C=Sa(e,t+1);n.push(...C.templateTokens),r=t+1,o=C.markerIndex;break}if(!p.startsWith("-")){let C=Sa(e,t);n.push(...C.templateTokens),r=t,o=C.markerIndex;break}let g=e[t+1],h=p.indexOf("="),y=h===-1?p:p.slice(0,h),b=h===-1?void 0:p.slice(h+1);if(p==="--dry-run"){l=!0,t++;continue}if(p==="-I"||p.startsWith("-I")&&p.length>2){c||=(p==="-I"?g:p.slice(2))!=="{}",t+=p==="-I"?2:1;continue}if(p==="--replace"||p==="-i"){c=!0,t+=2;continue}if(y==="--replace"||p.startsWith("-i")&&p.length>2){let C=y==="--replace"?b:p.slice(2);c||=C!==""&&C!=="{}",t++;continue}if(p==="-a"||xR.has(y)){c=!0,t+=b===void 0?2:1;continue}if(p==="--pipe"||p==="--pipepart"){s=!0,t++;continue}if(y==="--env"){c=!0,t+=b===void 0?2:1;continue}if(nf.has(y)||p.startsWith("-S")&&p.length>2){i=!0,t+=nf.has(p)?2:1;continue}if(RR.has(y)){c=!0;let C=b??g;if(C===void 0||C===":::"||C==="--"){t++;continue}a=C,t+=b===void 0?2:1;continue}if(p.startsWith("-j")&&p.length>2&&/^\d+$/.test(p.slice(2))){t++;continue}if(p.startsWith("--")&&b!==void 0){t++;continue}if(ER.has(p)){if(g===void 0||g===":::"||g==="--"){c=!0,t++;continue}t+=2;continue}t+=p==="-j"||p==="--jobs"?2:1}c||=n.some(l?$a:yf);let d=[];if(o!==-1){let p=[];for(let g=o+1;g<e.length;g++){let h=e[g];if(h===":::"){d.push(p),p=[];continue}if(h!==void 0)p.push(h)}d.push(p)}c||=d.length>1;let m=OR(d),u=n.some(B),f=n.length===0&&o===-1;return{template:n,jobs:m,childStart:r,templateHasPlaceholder:u,runsRemotely:i,usesStdin:s||o===-1,readsCommandsFromInput:f,unsupported:c,workdir:a,dryRun:l}}function OR(e){if(e.length===0||e.some((n)=>n.length===0))return[];let t=[[]];for(let[n,r]of e.entries()){if(r.length===1){let i=r[0];if(i===void 0)return[];for(let s of t)s.push(i);if(t.length*(n+1)>K.derivedTokens.cap)throw new N("derivedTokens");continue}let o=[];for(let i of t)for(let s of r){if((o.length+1)*(n+1)>K.derivedTokens.cap)throw new N("derivedTokens");o.push([...i,s])}t=o}return t}function Sf(e){return bf(e).childStart}var MR="dynamic command name contains shell substitution output and cannot be verified safely. Use a literal executable name.",si="shell substitution output can change guarded command structure and cannot be verified safely. Use literal subcommands and options.";function Ha(e){return e?.parts.some((t)=>t.provenance==="command-substitution")??!1}function Ua(e){return e?.parts.some((t)=>t.provenance==="literal"&&t.raw.replace(/^["']/,"").startsWith("-"))??!1}function Ef(e,t,n,r,o=!1,i){let a=(Xn(e,t)||r&&e!=="powershell"&&t[0]?.provenance==="variable")&&re(i,"shell.dynamic-executable",o)?v("shell.dynamic-executable",MR):null;return P(a,i)??xf(e,t,n,o,i)}function xf(e,t,n,r,o){if(t.length<2)return null;let i=t.flatMap((a,l)=>Ha(a)?[l]:[]);if(i.length===0)return null;let s=O(t[0]?.text??"");if(s==="git"){let a=pn(e,t),l=NR(a);if(re(o,"shell.dynamic-structure",r)&&i.some((m)=>m<=l))return P(v("shell.dynamic-structure",si),o);if(P(Zo(a,{environment:n}),o))return null;let c=t[l]?.text.toLowerCase(),d=a.findIndex((m,u)=>u>l&&_(m)==="--");if(re(o,"shell.dynamic-structure",r)&&c&&Rn.has(c)&&i.some((m)=>m>l&&(d===-1||m<d)))return P(v("shell.dynamic-structure",si),o);return null}if(s==="find")return re(o,"shell.dynamic-structure",r)&&LR(t)?P(v("shell.dynamic-structure",si),o):null;if(s==="rm"){let a=t.findIndex((c,d)=>d>0&&_(c)==="--"),l=$e(t.map(_));return re(o,"shell.dynamic-structure",r)&&i.some((c)=>(a===-1||c<a)&&(c<t.length-1||!l))?P(v("shell.dynamic-structure",si),o):null}if(s==="xargs")return vf(e,t.slice(Kt(t.map(_)).childStart),"xargs",n,r,o);if(s==="parallel")return vf(e,t.slice(Sf(t.map(_))),"parallel",n,r,o);return null}function vf(e,t,n,r,o,i){if(t.length===0)return null;let s=DR(t,r);if(Xn(e,s)){let l=P(v(`${n}.shell-dynamic`,n==="xargs"?Fa:_r),i);if(l)return l}let a=xf(e,s,r,o,i);if(a)return a;if(s[0]?.text==="rm"&&s.slice(1).some((l)=>Ha(l)&&Ua(l)))return P(v(`${n}.rm-recursive-force-dynamic`,n==="xargs"?Ga:wr),i);return null}function DR(e,t){let n=Gt(e,t),r=n.rewritten?q(n.words.map(_)):n.words,o=r[0];return o&&_(o)==="busybox"?r.slice(1):r}function NR(e){let t=1;while(t<e.length){let n=e[t],r=n?_(n):"";if(Ee.has(r)){t+=2;continue}if(r.startsWith("-")){t++;continue}return t}return t}function LR(e){let t=!1,n=0,r=!1,o=!1;for(let i=1;i<e.length;i++){let s=e[i];if(!s)continue;let a=Ha(s);if(n>0){n--;continue}if(o){if(s.text===";"||s.text==="+"){o=!1,t=!0,r=!1;continue}if(a&&(r||Ua(s)))return!0;r=!1;continue}if(!t&&!s.text.startsWith("-")){if(a&&(i>1||Ua(s)))return!0;continue}if(t=!0,a)return!0;let l=at(s.text);if(l>0){n=l;continue}if(qe(s.text))o=!0,r=!0}return!1}function ja(e,t){return e.some((n)=>{if(n.value==="-"&&(n.kind==="main-script"||n.kind==="program-file"))return!0;return!bo(t[n.tokenIndex],n.value)})}var wf=[{heads:new Set(["rm","rmdir"]),analyze:(e)=>Jo(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoid:e.options.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:St(e.envAssignments,e.options.environment),trustedTmpdirValue:Bt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,policy:e.options.policy,budget:e.options.budget})},{heads:new Set(["git"]),analyze:(e)=>Zo(e.words,Va(e))},{heads:new Set(["find"]),analyze:(e)=>am(e.words,{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,allowTmpdirVar:e.allowTmpdirVar,tmpdirWordSplittingUnsafe:St(e.envAssignments,e.options.environment),trustedTmpdirValue:Bt(e.envAssignments,e.options.environment),protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,policy:e.options.policy,analyzeTokens:e.analyzeChildTokens,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["xargs"]),analyze:(e)=>qm(e.words,{...Rf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})},{heads:new Set(["parallel"]),analyze:(e)=>uf(e.words,{...Rf(e),analyzeChild:e.analyzeChild,analyzeNested:(t,n)=>qt(e.options.analyzeNested(t,n))})}];function Rf(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,strict:e.options.strict,paranoidRm:e.options.paranoidRm,paranoidInterpreters:e.options.paranoidInterpreters,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.options.protectedGitMetadata,budget:e.options.budget,envAssignments:e.envAssignments,worktreeMode:e.options.worktreeMode,policy:e.options.policy}}function qt(e){return e?{id:e.ruleId??"",reason:e.reason,intent:e.intent??"manual_only"}:null}function Va(e){return{environment:e.options.environment,cwd:e.cwd,originalCwd:e.originalCwd,dynamicArguments:e.dynamicArguments,envAssignments:e.envAssignments,shellAssignments:e.options.shellAssignments,policy:e.options.policy,worktreeMode:e.options.worktreeMode}}function Pf(e){return wf.find((t)=>t.heads.has(e))?.analyze}function Tn(e,t,n){let r=n.trace;if(e.length===0)return null;let o=n.commandView?.dialect??"posix",i=(R)=>R.map((k)=>o==="posix"?_(k):k.text),s=n.child,a=s!==void 0&&!s.embedded,l=s?.embedded===!0,c=n.effectiveCwd===null,d=s?s.cwd:c?void 0:n.effectiveCwd??n.cwd,m=s?s.originalCwd:c?void 0:n.cwd,u=Ao(e);if(u.envAssignments.size>0)r?.recordSegment({type:"env-strip",input:i(e),envVars:[...u.envAssignments.keys()],output:i(u.words)});let f=Gt(u.words,n.environment,d,new Map([...n.envAssignments??[],...u.envAssignments])),p=f.envSplitValues??[];if(p.length>0){let R=[...p,...i(f.words)].join(" "),k=Te(R);if(k)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:k.reason}),de(k);if(n.strict)return ye(r);let G=Po(p,i(f.words));if(G){n.budget.charge("derivedTokens",G.length);let te=n.analyzeNested(G.join(" "),{effectiveCwd:f.cwd===void 0?n.effectiveCwd:f.cwd,envAssignments:new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments])});if(te)return te}}let g=f.rewritten?q(i(f.words)):pn(o,f.words),h=i(g),y={...n,wrapperNormalizationBudget:n.wrapperNormalizationBudget??{iterations:0}};if(r&&u.words.length>g.length){let R=i(u.words);r.recordSegment({type:"leading-tokens-stripped",input:R,removed:R.slice(0,R.length-g.length),output:h})}let b=new Map([...n.envAssignments??[],...u.envAssignments,...f.envAssignments]),C=h[0];if(!C)return null;if(Ut(C))throw new N("wrapperPeelIterations");let x=O(C),A=f.cwd===null?void 0:f.cwd??d,E=f.cwd===null?void 0:m,I=f.cwd===void 0?n.effectiveCwd:f.cwd,W=s?s.allowTmpdirVar:!pr(b,n.environment),Q=Ef(o,f.words,n.environment,t===0,n.strict,n.policy);if(Q)return r?.recordSegment({type:"rule-check",rule:"analyzer/segment.ts:analyzeDynamicCommandStructure",matched:!0,reason:Q.reason}),de(Q);let Je=Ho(h,n.policy);if(Je){for(let R of[Je.childIndex,...Je.alternativeChildIndices]){_f(y.wrapperNormalizationBudget);let k=g.slice(R);r?.recordSegment({type:"transparent-wrapper",wrapper:Je.wrapper,output:i(k)});let G=Tn(k,t,{...y,effectiveCwd:I,envAssignments:b});if(G)return G}return null}let Ce=l?void 0:x==="eval"?Qo(g):x==="trap"&&!a?zm(g):void 0;if(a&&s&&x==="eval"){if(Ce?.kind==="dynamic")return Pn(s,n.policy);if(Ce?.kind==="literal"){let R=n.analyzeNested(Ce.source,{effectiveCwd:I,envAssignments:b});if(R)return R}return In(s,n.policy)}if(Ce?.kind==="dynamic"&&(n.strict||!n.commandView||!La(n.commandView)))return ye(r);if(Ce?.kind==="literal"){r?.recordSegment({type:"recurse",reason:x==="eval"?"shell-eval":"shell-trap",innerCommand:Ce.source,depth:t+1});let R=n.analyzeNested(Ce.source,{effectiveCwd:I,envAssignments:b,functionDefinitions:n.functionDefinitions});if(R)return R}if(a?Y.has(x):If(C,x)){if(st(h))return null;if(a&&s){let R=Ue(h);if(R){if(s.dynamicSourceInput??s.dynamicInput){let G=Pn(s,n.policy);if(G)return G}if(Rr(R)){let G=Pn(s,n.policy);if(G)return G}return n.analyzeNested(R,{effectiveCwd:I,envAssignments:b})}let k=lt(g);if(k.kind==="dynamic")return Pn(s,n.policy);if(k.kind==="literal")return s.dynamicSourceInput?Pn(s,n.policy):null;return s.dynamicSourceInput??s.dynamicInput?Pn(s,n.policy):null}if(l){let R=Ue(h),k=R?n.analyzeNested(R,{effectiveCwd:I,envAssignments:b}):lt(g).kind==="dynamic"?ye(r):null;if(k)return k}if(s===void 0){let R=zR(h,b,I,n,r,t);if(R)return R;let k=Ue(h);if(k){let tn=ei(g,k);if(tn.kind==="dynamic")return ye(r);let Si=tn.kind==="literal"?tn.source:Bm(g,k),El=BR(Si);r?.recordSegment({type:"shell-wrapper",wrapper:x,innerCommand:El}),r?.recordSegment({type:"recurse",reason:"shell-wrapper",innerCommand:El,depth:t+1});let xl=n.analyzeNested(Si,{effectiveCwd:I,envAssignments:b});if(xl)return xl;return Rr(Si)?ye(r):null}let G=lt(g,n.strict?void 0:n.shellAssignments);if(G.kind==="dynamic")return ye(r);if(G.kind==="literal")return ai(G.source,I,b,n,r,t);let te=$m(g,n.commandView?.redirections??[],n.hasPipelineInput??!1,n.literalShellInput);if(te.kind==="dynamic")return ye(r);if(te.kind==="literal")return r?.recordSegment({type:"recurse",reason:"shell-stdin",innerCommand:te.source,depth:t+1}),n.analyzeNested(te.source,{effectiveCwd:I,envAssignments:b})}}if(!s&&(x==="source"||x===".")){let R=h[1]==="-p"?2:null;if(R!==null){let tn=n.commandView?g[R]:void 0;if(!tn)return null;if(tn.provenance!=="literal")return ye(r)}let k=R===null?1:3,G=h[k]==="--"?k+1:k,te=n.commandView?g[G]:void 0;if(!te)return null;if(te.provenance==="literal")return ai(te.text,I,b,n,r,t);if(n.strict||!n.commandView||!La(n.commandView))return ye(r)}if(Pe.has(x)&&!l){if(!s&&n.strict&&ja(br(h),g))return ye(r);let R=Jd(h,(G)=>qt(n.analyzeNested(G,{effectiveCwd:I,envAssignments:b}))),k=P(R,n.policy);if(k)return r?.recordSegment({type:"rule-check",rule:"awk:analyzeAwkSystemCallMatch",matched:!0,reason:k.reason}),de(k)}if(De(x)&&!l){if(!s&&n.strict&&ja(xo(h),g))return ye(r);let R=Zu(h);if(a&&s)return GR(x,R,I,b,n,s);if(R){let k=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(r?.recordSegment({type:"interpreter",interpreter:x,codeArg:R,paranoidBlocked:k}),k){let te=P(v("interpreter.one-liner-paranoid",ir),n.policy);if(te)return de(te)}if(Ys(x,R))return null;r?.recordSegment({type:"recurse",reason:"interpreter",innerCommand:R,depth:t+1});let G=n.analyzeNested(R,{effectiveCwd:I,envAssignments:b});if(G&&!Tf(G,R))return G;if(sr(R,void 0,!n.strict)){let te=P(v("interpreter.dangerous-command",yn),n.policy);if(te)return r?.recordSegment({type:"dangerous-text",token:R,matched:!0,reason:yn}),de(te)}r=void 0}}if(x==="busybox"&&h.length>1)return _f(y.wrapperNormalizationBudget),r?.recordSegment({type:"busybox",subcommand:h[1]??"unknown"}),r?.recordSegment({type:"recurse",reason:"busybox",innerCommand:h.slice(1).join(" "),depth:t+1}),Tn(g.slice(1),t,{...y,effectiveCwd:I,envAssignments:b});let z=s?null:P(rm(x,h),n.policy);if(z)return r?.recordSegment({type:"rule-check",rule:"analyzer/device.ts:analyzeDeviceCommandMatch",matched:!0,reason:z.reason}),de(z);let D=r===y.trace?y:{...y,trace:r},ae={words:g,head:x,cwd:A,originalCwd:E,envAssignments:b,allowTmpdirVar:W,dynamicArguments:f.words.some((R)=>R.provenance==="command-substitution"),depth:t,effectiveCwd:I,options:D,analyzeChildTokens:(R,k)=>a&&s?qa(R,t,D,{...s,cwd:k??void 0,effectiveCwd:k??void 0}):qt(Tn(q(R),t+1,{...D,child:void 0,commandView:void 0,effectiveCwd:k,envAssignments:b}))??it(R,D.policy.rules),analyzeChild:(R,k)=>qa(R,t,D,k)},X=s&&(x==="xargs"||x==="parallel")?void 0:Pf(x);if(x==="rm"||x==="xargs"||x==="parallel")r?.recordSegment({type:"tmpdir-check",tmpdirValue:b.has("TMPDIR")||n.environment.env.has("TMPDIR")?"<redacted>":null,allowTmpdirVar:W});let J=r&&x==="git"?km(ae.words,Va(ae)):void 0,be=Af(J?J.match:X?.(ae)??null,n.policy);if(r)$R(ae,be,J?.relaxation??null);if(be)return de(be);if(a&&s&&(x==="rm"||x==="rmdir")){if(!(x==="rm"&&($e(h)||s.dynamicRmInput)))return null;return(s.dynamicRmInput?In(s,n.policy):null)??FR(s,n.policy)}let Pt=!s&&X===void 0&&!jr.has(x),Dn=r&&Pt?[]:void 0;if(Pt)for(let R=1;R<h.length;R++){let k=h[R];if(!k)continue;Dn?.push(k);let G=Af(WR(h,R,t,D,A,E,I,b),n.policy);if(G)return r?.recordSegment({type:"fallback-scan",tokensScanned:Dn??[],embeddedCommandFound:O(k)}),de(G)}if(r?.recordSegment({type:"fallback-scan",tokensScanned:Dn??[]}),l&&s&&!s.wrappedByTransparent)return null;let Ae=it(h,n.policy.rules);if(r?.recordSegment({type:"custom-rules-check",rulesChecked:n.policy.rules.length>0,matched:!!Ae,reason:Ae?.reason}),Ae)return de(Ae);return a&&s?In(s,n.policy):null}function qa(e,t,n,r){return qt(Tn(q(e),t+1,{...n,trace:void 0,commandView:void 0,hasPipelineInput:void 0,literalShellInput:void 0,functionDefinitions:void 0,cwd:r.originalCwd,effectiveCwd:r.effectiveCwd,envAssignments:r.envAssignments,worktreeMode:r.dynamicInput?!1:r.worktreeMode,wrapperNormalizationBudget:{iterations:0},child:r}))}function WR(e,t,n,r,o,i,s,a){for(let l of Be(e.slice(t),{environment:r.environment,cwd:o,envAssignments:a,policy:r.policy})){let c=l.tokens[0];if(!c)continue;let d=O(c);if(If(c,d)||Pf(d)!==void 0&&d!=="xargs"&&d!=="parallel"||l.wrappedByTransparent&&r.policy.rules.length>0)r.budget.charge("derivedTokens",e.length-t);let u=qa(l.tokens,n,r,{embedded:!0,cwd:l.cwd,originalCwd:l.wrapperCwd===null?void 0:i,effectiveCwd:l.wrapperCwd===void 0?s:l.wrapperCwd,envAssignments:l.envAssignments,allowTmpdirVar:!pr(l.envAssignments,r.environment),worktreeMode:!1,wrappedByTransparent:l.wrappedByTransparent});if(u)return u}return null}function GR(e,t,n,r,o,i){if(!t)return In(i,o.policy);if(re(o.policy,"interpreter.one-liner-paranoid",!!o.paranoidInterpreters)){let a=P(v("interpreter.one-liner-paranoid",ir),o.policy);if(a)return de(a)}if(Ys(e,t))return In(i,o.policy);let s=o.analyzeNested(t,{effectiveCwd:n,envAssignments:r});if(s&&!Tf(s,t))return s;if(sr(t,void 0,!o.strict)){let a=P(v("interpreter.dangerous-command",yn),o.policy);if(a)return de(a)}return In(i,o.policy)}function Tf(e,t){let n=e.ruleId==="raw-text.dangerous-command",r=(e.reason.startsWith(Bo)||e.reason===En)&&!Vr(t);return n||r}function Pn(e,t){let n=e.shellDynamicMatch?P(e.shellDynamicMatch,t):null;return n?de(n):null}function In(e,t){let n=e.dynamicSourceInput&&e.dynamicSourceMatch?P(e.dynamicSourceMatch,t):null;return n?de(n):null}function FR(e,t){let n=e.dynamicInput&&e.rmDynamicMatch?P(e.rmDynamicMatch,t):null;return n?de(n):null}function zR(e,t,n,r,o,i){let s=sm(e);if(s.argvSource?.kind==="absent")return ye(o);if(s.argvSourceApplies&&s.argvSource){let l=ai(s.argvSource.value,n,t,r,o,i,!0);if(l)return l}if(!s.envSourceApplies||!s.envName)return null;let a=t.get(s.envName);if(!a)return null;return ai(a,n,t,r,o,i,!0)}function ai(e,t,n,r,o,i,s=!1){if(s&&/[$`*?[\]]/.test(e))return ye(o);let a=or(e,t,r.environment.paths,r.budget),l=a?r.literalHeredocFiles?.get(a):void 0;if(l===void 0)return s?ye(o):null;return r.budget.charge("derivedTokens",1),o?.recordSegment({type:"recurse",reason:"heredoc-file",innerCommand:l,depth:i+1}),r.analyzeNested(l,{effectiveCwd:t,envAssignments:n})}function BR(e){let t=e[0];return e.length>=2&&(t==='"'||t==="'")&&e.at(-1)===t?e.slice(1,-1):e}function $R(e,t,n){let r={git:"git:analyzeGitMatch",rm:"analyzer/rm.ts:analyzeRmMatch",find:"analyzer/find.ts:analyzeFindMatch",xargs:"analyzer/xargs.ts:analyzeXargs",parallel:"analyzer/parallel.ts:analyzeParallel"}[e.head];if(!r)return;if(e.options.trace?.recordSegment({type:"rule-check",rule:r,matched:!!t||!!n,reason:t?.reason??n?.originalReason}),n)e.options.trace?.recordSegment({type:n.kind==="worktree"?"worktree-relaxation":"temp-root-relaxation",originalReason:n.originalReason,gitCwd:n.gitCwd})}function _f(e){if(e.iterations>=K.wrapperPeelIterations.cap)throw new N("wrapperPeelIterations");e.iterations++}function de(e){return{reason:e.reason,ruleId:e.id||void 0,intent:e.intent}}function ye(e){return e?.recordSegment({type:"error",message:yr}),de(UR())}function UR(){return{id:"",reason:yr,intent:"stop_and_explain"}}function If(e,t){return Y.has(t)||e==="$SHELL"||e==="${SHELL}"||Y.has(T(t))}function Af(e,t){return e?.id.startsWith("custom.")||e?.id==="raw-text.dangerous-command"?e:P(e,t)}var HR=/^\s*(?:\$\(\s*)?[({]*\s*(?:command\s+|builtin\s+)?(?:cd|pushd|popd)(?:\s|$)/,jR=new Set(["cd","chdir","pop-location","popd","push-location","pushd","set-location","sl"]);function VR(e,t){let n=Mf(e,t);if(n.length===0)return!1;let r=n[Of(n)];if(r==="cd"||r==="pushd"||r==="popd")return!0;return HR.test(e.join(" "))}function kf(e,t,n,r,o){if(e.dialect==="powershell"){let C=KR(e.words,o);if(C.kind==="none")return;if(!t||C.kind==="unknown")return null;return Ka(XR(C.target),t,n.paths)}let i=e.words.map(_),s=i.some((C)=>/^CDPATH\+?=/.test(C));if(!VR(i,n))return s?null:void 0;if(!t)return null;let a=Mf(i,n,t),l=Of(a);if(l===-1||a[l]!=="cd")return null;let c=a.slice(l+1),d=c.findIndex((C)=>C.length<=1||!C.startsWith("-")||C==="--");if((d===-1?c:c.slice(0,d)).some((C)=>!/^-[LP]+$/.test(C)))return null;let u=d===-1?[]:c.slice(d),f=u[0]==="--"?u.slice(1):u;if(f.length>1)return null;let p=f[0],g=r.get("HOME")||n.home;if(p===void 0)return Ka(g,t,n.paths);let h=e.words.find((C)=>C.provenance==="variable"&&C.text===p),y=e.words.find((C)=>C.text===p&&/^~(?:\/|$)/.test(C.raw)),b=h?Ye(h,new Map([...r,["HOME",g]])):y?`${g}${p.slice(1)}`:p;if(b===null)return null;if(!/^(?:[./]|[A-Za-z]:[\\/])/.test(b)&&(s||n.env.has("CDPATH")))return null;return Ka(b,t,n.paths)}function Ka(e,t,n){if(!e||e==="-"||e.startsWith("~")||e.includes("$")||e.includes("`"))return null;try{let r=ht(t,e,n);return n.isDirectory(r)?r:null}catch{return null}}function KR(e,t){let n=qR(e[0])?1:0,r=e[n];if(!YR(r,n===1))return{kind:"none"};let o=r.text.toLowerCase(),i=o.split(/[\\/]/).pop()??o;if(!jR.has(i))return{kind:"none"};if(o!==i||i==="pop-location"||i==="popd")return{kind:"unknown"};return ZR(e.slice(n+1),t)}function qR(e){return e?.provenance==="literal"&&!e.quoted&&e.raw===e.text&&(e.text==="&"||e.text===".")}function YR(e,t){return e?.provenance==="literal"&&(t||!e.quoted&&e.raw===e.text)}function ZR(e,t){let n;for(let r of e){if(r.provenance!=="literal"||n!==void 0)return{kind:"unknown"};n=r.text}if(n!==void 0)return{kind:"target",target:n};return t===void 0?{kind:"unknown"}:{kind:"target",target:t}}function XR(e){return e.includes("::")?void 0:e.replaceAll("\\","/")}function Of(e){let t=0;if(e[0]==="builtin"&&e.length>1)t=1;if(e[t]!=="time")return t;let n=t+1;while(e[n]?.startsWith("-"))n++;return n}function Mf(e,t,n){let r=JR(e);return yt([...r],t,n)}function JR(e){let t=0;while(t<e.length){let n=e[t];if(n!=="{"&&n!=="("&&n!=="$(")break;t++}return e.slice(t)}var iw="Unquoted heredoc input is not supported safely. Quote the delimiter or ask the user to verify.",Yt="This heredoc form or stdin consumer is not supported safely. Use a quoted heredoc with a supported consumer (cat, tee, git apply, git commit, gh pr create, gh issue create), or ask the user to verify.";function el(e,t,n,r){if(t>=K.recursionDepth.cap)return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};let o=r??n.factStore?.getCommandProgram(e,n.shell??"auto")??Ne(e,n.shell);if(o.status==="limited")return n.trace?.recordSegment({type:"error",message:Ve}),{reason:Ve,segment:e,intent:"stop_and_explain"};if(o.status==="invalid"){let c=o.issues.find((d)=>d.code.includes("heredoc"));if(c){if(!n.strict)return Qa(e,n);let d=`${Bo}: ${c.message}`;return n.trace?.recordGlobal({type:"error",message:d}),{reason:d,segment:e,intent:"stop_and_explain"}}return Ff(e,n),{reason:En,segment:e,intent:"stop_and_explain"}}if(n.strict&&o.status==="partial")return Ff(e,n),{reason:En,segment:e,intent:"stop_and_explain"};if(o.issues.some((c)=>c.code.includes("quote")))return Qa(e,n);let s=n.cwd,a=n.effectiveCwd!==void 0?n.effectiveCwd:n.cwd,l=bm(n.environment.env,n.envAssignments);return ui(o,t,{...n,rootProgram:o},s,[{effectiveCwd:a,shellGitContextState:l,literalHeredocFiles:new Map(n.literalHeredocFiles),functionDefinitions:new Map(n.functionDefinitions),createdDirectories:new Set,compoundBodies:[]}]).result}function ui(e,t,n,r,o){let i=[...o],s,a,l;for(let[c,d]of e.nodes.entries()){if(d.kind==="connector"){a=d.operator;continue}let m=e.nodes[c+1],u=m?.kind==="connector"?m.operator:void 0,f=sw(e,c,d,a,u),g=a==="&&"||a==="||"?s:void 0,h=a==="&&"?g?.success??i:a==="||"?g?.failure??i:i,y=a==="||"?g?.success??[]:[],b=a==="&&"?g?.failure??[]:[],C={connector:a,skippedSuccessStates:y,skippedFailureStates:b};if(wt(u)&&!wt(a))l=C;let x=wt(u)?{connector:void 0,skippedSuccessStates:[],skippedFailureStates:[]}:wt(a)?l??C:C,A=Zt(x.connector)||Zt(u);if(d.kind==="function"){let z=h.flatMap((ae)=>{let X=Xt(ae);return X.functionDefinitions.set(d.name,d.body),Ya(ae,[X],f,u==="&",Zt(u))}),D=Za(z,[],x.skippedSuccessStates,x.skippedFailureStates,x.connector,u);i=D.states,s=D.conditionalStates,a=void 0;continue}if(d.kind==="group"){let z=[],D=[];for(let X of h){let J=ui(d.body,t,n,r,[Xt(X)]);if(J.result)return J;if(z.push(...Ya(X,J.states,f,u==="&",Zt(u))),A)D.push(X,...f?J.states.map((be)=>li(X,be)):J.states)}let ae=Za(z,D,x.skippedSuccessStates,x.skippedFailureStates,x.connector,u);i=ae.states,s=ae.conditionalStates,a=void 0;continue}if(d.kind!=="command")continue;let E=Tw(e.nodes[c-1]),I=n.trace?.flattenNested?n.trace.currentSegmentIndex:n.trace?.allocateSegment(),W=e.nodes[c-2],Q=wt(a)&&W?.kind==="command"?Fm(W)??lw(W):void 0,Je=[],Ce=[];for(let z of h){let D=cw(d,t,n,r,[Xt(z)]);if(D.result)return{result:D.result,states:i};let ae=e.dialect==="powershell"?D.states:D.states.map((X)=>li(z,X));for(let X of ae){let J=Xt(X),be=mw(d,t,n.trace?{...n,trace:zf(n.trace,I)}:n,r,J,wt(a),Q);if(be)return{result:be,states:i};let Mn=Lw(d,J.functionDefinitions);if(Mn)n.budget.charge("derivedTokens",di(Mn));let Pt=Mn?t+1>=K.recursionDepth.cap?Xa(d.displayText,n,[J]):ui(Mn,t+1,n,r,[J]):{result:null,states:Dw(d,J).flatMap((Ae)=>Iw(d,X,Ae,E))};if(Pt.result)return Pt;Je.push(...Ya(z,Pt.states,f,u==="&",Zt(u)));let Dn=typeof J.effectiveCwd==="string"&&J.effectiveCwd!==X.effectiveCwd&&d.redirections.every((Ae)=>["<",">",">>",">|"].includes(Ae.operator)&&Ae.target?.text==="/dev/null");if(A&&(E||!Dn))Ce.push(z),Ce.push(...Pt.states.map((Ae)=>f?li(z,Ae):Ae))}}let At=Za(Je,Ce,x.skippedSuccessStates,x.skippedFailureStates,x.connector,u);i=At.states,s=At.conditionalStates,a=void 0}return{result:null,states:i}}function sw(e,t,n,r,o){if(n.kind==="group"&&n.style==="subshell")return!0;if(e.dialect==="posix"&&(wt(r)||wt(o)))return!0;if(o==="&")return!0;return e.dialect==="powershell"&&n.kind==="group"&&n.style==="brace"&&aw(e,t)}function Ya(e,t,n,r,o){let i=n?t.map((a)=>li(e,a)):[...t],s=o?i.flatMap((a)=>kn(e.literalHeredocFiles,a.literalHeredocFiles)?[a]:[{...a,literalHeredocFiles:new Map(e.literalHeredocFiles)},a]):i;return r?[e,...s]:s}function li(e,t){return{...e,literalHeredocFiles:new Map(t.literalHeredocFiles),createdDirectories:new Set(t.createdDirectories)}}function aw(e,t){let n=e.nodes.slice(0,t).reverse().find((o)=>o.kind==="command"||o.kind==="connector");if(!n||n.kind!=="command")return!0;let r=n.words[0]?.text.toLowerCase();if(r==="&"||r===".")return!1;if(r==="write-output"||r==="function"||r==="start-job")return!0;if(uw(n))return!0;return n.source.replaceAll(/\s/g,"").toLowerCase()==="if($false)"}function wt(e){return e==="|"||e==="|&"}function lw(e){if(e?.dialect!=="powershell")return;if(e.words.length===1&&e.words[0]?.quoted&&e.words[0].provenance==="literal")return e.words[0].text;if(e.words[0]?.text.toLowerCase()==="write-output"&&e.words.length===2&&e.words[1]?.provenance==="literal")return e.words[1].text;return}function Zt(e){return e==="&&"||e==="||"}function Za(e,t,n,r,o,i){let s={success:ci([...n,...e]),failure:ci([...r,...t])},a=Zt(i)?s:void 0;return{states:Zt(o)||a?ci([...s.success,...s.failure]):s.success,conditionalStates:a}}function zf(e,t,n=e.flattenNested){return{currentSegmentIndex:t,flattenNested:n,allocateSegment:e.allocateSegment,getNextSegmentIndex:e.getNextSegmentIndex,recordGlobal:e.recordGlobal,recordSegment:(r,o=t)=>e.recordSegment(r,o)}}function cw(e,t,n,r,o){let i=e.nested.map((s)=>({program:s,depth:t}));if(e.dialect==="powershell"){let s=dw(e);if(s){if(t+1>=K.recursionDepth.cap)return Xa(s,n,o);let a=Ne(s,"powershell");if(a.status==="limited")return Xa(s,n,o);if(a.status!=="complete")return Df(i,n,r,o);n.budget.charge("derivedTokens",di(a)),i.push({program:a,depth:t+1})}}return Df(i,n,r,o)}function uw(e){let t=e.words[0];return t?.provenance==="variable"&&e.words.at(-1)?.text==="="?t.text.toLowerCase():void 0}function Df(e,t,n,r){let o=[...r];for(let i of e){let s=[];for(let a of o){let l=ui(i.program,i.depth,t,n,[Xt(a)]);if(l.result)return l;s.push(...l.states)}o=ci(s)}return{result:null,states:o}}function dw(e){let t=e.words[0]?.provenance==="literal"&&!e.words[0].quoted&&e.words[0].raw===e.words[0].text&&(e.words[0].text==="&"||e.words[0].text==="."),n=t?1:0,r=e.words[n];if(r?.provenance!=="literal"||!t&&(r.quoted||r.raw!==r.text)||!["iex","invoke-expression"].includes(r.text.toLowerCase()))return;let o=e.words.slice(n+1),i=o[0]&&!o[0].quoted&&o[0].raw===o[0].text&&["-c","-command"].includes(o[0].text.toLowerCase())?1:0,s=o[i];return o.length===i+1&&s?.quoted&&s.provenance==="literal"?s.text:void 0}function di(e){return e.nodes.reduce((t,n)=>t+(n.kind==="command"?n.words.length+n.nested.reduce((r,o)=>r+di(o),0):n.kind==="group"||n.kind==="function"?di(n.body):0),0)}function Xa(e,t,n){return t.trace?.recordSegment({type:"error",message:Ve}),{result:{reason:Ve,segment:e,intent:"stop_and_explain"},states:[...n]}}function mw(e,t,n,r,o,i,s){let a={...n,environment:{...n.environment,env:o.shellGitContextState.env,paths:yw(n.environment.paths,o.createdDirectories,n.budget)}},l=xw(e,!a.strict);if(l&&a.strict)return a.trace?.recordSegment({type:"error",message:l}),{reason:l,segment:e.source,intent:"stop_and_explain"};Bf(e,o,"before-consumer",a.environment.paths,a.budget);let c=pn(e.dialect,e.words),d=c.map(_),m=e.displayText,u=ym(c,o.shellGitContextState),f=vm(u,o.shellGitContextState);if(e.dialect==="powershell"){let h=P(Hd(e,i,Gw(a,o.effectiveCwd)),a.policy);if(a.trace?.recordSegment({type:"rule-check",rule:"analyzer/powershell/remove-item.ts:analyzePowerShellCommandViewMatch",matched:!!h,reason:h?.reason}),h)return Ww(m,h)}if(d.length===1&&d[0]?.includes(" ")&&!Xn(e.dialect,e.words)){let h=P(Te(d[0]),a.policy),y=h!==null&&!a.strict&&Vu(e,a.rootProgram);if(h&&!y)return a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!0,reason:h.reason}),{reason:h.reason,segment:m,ruleId:h.id,intent:h.intent};a.trace?.recordSegment({type:"dangerous-text",token:d[0],matched:!1});let b=Nf(e,l,o,f,s,a);if(b)return b;return Ia(u,o.shellGitContextState),null}let p=Tn(e.words,t,{...a,commandView:e,cwd:r,effectiveCwd:o.effectiveCwd,envAssignments:f,shellAssignments:o.shellGitContextState.shellAssignments,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:o.functionDefinitions,hasPipelineInput:i,literalShellInput:s,analyzeNested:(h,y)=>{let b=y&&Object.hasOwn(y,"effectiveCwd")?y.effectiveCwd:o.effectiveCwd,C=el(h,t+1,{...a,effectiveCwd:b,envAssignments:y?.envAssignments??f,literalHeredocFiles:o.literalHeredocFiles,functionDefinitions:y?.functionDefinitions,worktreeMode:y?.worktreeMode??a.worktreeMode,trace:a.trace?zf(a.trace,a.trace.currentSegmentIndex,!0):void 0});return C?{reason:C.reason,ruleId:C.ruleId,intent:C.intent}:null}});if(p)return{...p,segment:m};let g=Nf(e,l,o,f,s,a);if(g)return g;return Ia(u,o.shellGitContextState),null}function Nf(e,t,n,r,o,i){let s=Rw(e,t,n,r??new Map,i);if(s)return s;return Bf(e,n,"after-consumer",i.environment.paths,i.budget),n.literalHeredocFiles.clear(),gw(e,t,n,i.environment.paths,i.budget),Cw(e,n,i.environment.paths,i.budget),Aw(e,n,o,i.environment,i.trace),null}var fw=new Set([">>","<>"]);function Bf(e,t,n,r,o){for(let s of e.redirections){if(!(n==="before-consumer"?pw(s):fw.has(s.operator)))continue;Lf(s.target,t,r,o)}if(n!=="before-consumer"||!se(e.words[0],"tee"))return;let i=Uf(e.words.slice(1));if(!i)return;for(let s of i.operands)Lf(s,t,r,o)}function pw(e){if(e.operator===">"||e.operator===">|")return!0;return e.operator===">&"&&e.fd===void 0&&e.target?.provenance==="literal"&&!/^(?:[0-9]+|-)$/.test(e.target.text)}function Lf(e,t,n,r){let o=e?.provenance==="literal"?or(e.text,t.effectiveCwd,n,r):void 0;if(!o)return;t.literalHeredocFiles.delete(o)}function gw(e,t,n,r,o){if(t)return;let i=e.redirections.find((s)=>s.operator==="<<"||s.operator==="<<-")?.heredoc;if(!i)return;for(let s of hw(e,n.shellGitContextState.shellAssignments)){let a=or(s,n.effectiveCwd,r,o);if(!a||!Yu(a))continue;if(!n.literalHeredocFiles.has(a)&&n.literalHeredocFiles.size>=K.trackedHeredocFiles.cap)throw new N("trackedHeredocFiles");n.literalHeredocFiles.set(a,i.body)}}function hw(e,t){let n=Ja(vw(e.redirections)?.target,t),r=n===void 0?[]:[n];if(se(e.words[0],"cat"))return Sw(e.words)?r:[];if(!se(e.words[0],"tee"))return[];let o=Uf(e.words.slice(1),t);if(!o||o.append||o.hasUnsupportedOptions)return[];let i=o.operands.map((s)=>Ja(s,t));if(!i.every((s)=>s!==void 0))return[];return[...i,...r]}function Ja(e,t){if(Ew(e))return e.text;return(e&&Ye(e,t))??void 0}function yw(e,t,n){if(t.size===0)return e;let r=(o)=>{let i=L(o,e,n);return[...t].some((s)=>s===i||s.startsWith(`${i}${ow}`))};return{realpath:(o)=>e.realpath(o)??(r(o)?L(o,e,n):null),entryKind:(o)=>{let i=e.entryKind(o);return i==="missing"&&r(o)?"present":i},isDirectory:(o)=>e.isDirectory(o)||r(o)}}function Cw(e,t,n,r){if(t.shellGitContextState.bodyDepth>0||!se(e.words[0],"mkdir"))return;let o=e.words.slice(1).map((c)=>Ja(c,t.shellGitContextState.shellAssignments));if(!o.every((c)=>c!==void 0))return;let i=o.findIndex((c)=>c==="--"||c==="-"||!c.startsWith("-")),s=o.slice(0,i);if(i===-1||!s.every((c)=>/^(?:-[pv]+|--parents|--verbose)$/.test(c)))return;let a=s.some((c)=>c==="--parents"||/^-v*p/.test(c)),l=t.effectiveCwd;for(let c of o.slice(o[i]==="--"?i+1:i)){if(c.split(/[\\/]/).includes("..")||!ew(c)&&!l)continue;let d=L(rw(l??"",c),n,r);if(a?bw(d,n):n.isDirectory(QR(d))&&$f(d,n))t.createdDirectories.add(d)}}function bw(e,t){let n=nw(e).root,r=e.slice(n.length).split(/[\\/]+/).filter(Boolean),o=(s)=>tw(n,...r.slice(0,s+1)),i=r.findIndex((s,a)=>!t.isDirectory(o(a)));return i===-1||$f(o(i),t)}function $f(e,t){try{return t.entryKind(e)==="missing"}catch{return!1}}function Sw(e){let t=!1;for(let n of e.slice(1)){if(t||n.provenance!=="literal")return!1;if(n.text==="--"){t=!0;continue}if(!/^-u+$/.test(n.text))return!1}return!0}function vw(e){let t=e.findLast((n)=>(n.fd??([">",">|",">>",">&"].includes(n.operator)?1:0))===1);return t?.operator===">"||t?.operator===">|"?t:void 0}function Uf(e,t=new Map){let n=[],r=!0,o=!1,i=!1;for(let s of e){if(s.provenance!=="literal"&&Ye(s,t)===null)return;if(r&&se(s,"--")){r=!1;continue}if(r&&!s.quoted&&s.raw===s.text&&/^-[^-]/.test(s.text)){o||=s.text.slice(1).includes("a"),i||=Array.from(s.text.slice(1)).some((a)=>a!=="a"&&a!=="i");continue}if(r&&!s.quoted&&s.raw===s.text&&s.text.startsWith("--")){o||=s.text==="--append",i||=s.text!=="--append"&&s.text!=="--ignore-interrupts";continue}n.push(s)}return{operands:n,append:o,hasUnsupportedOptions:i}}function Ew(e){if(!e||e.provenance!=="literal"||e.text.length===0)return!1;if(e.quoted||e.raw!==e.text)return!0;return!e.raw.startsWith("~")&&!/[{}]/.test(e.raw)}function se(e,t){return e?.text===t&&e.raw===t&&e.provenance==="literal"&&!e.quoted}function tl(e){return e.quotedDelimiter||!/[$`\\]/.test(e.body)}function xw(e,t){let n=e.redirections.filter((l)=>l.operator==="<<"||l.operator==="<<-");if(n.length===0)return;if(n.length!==1)return Yt;let r=n[0];if(!r?.heredoc)return Yt;let o=/\$\(|`/.test(r.heredoc.body);if(!tl(r.heredoc)&&(!t||o))return iw;if(r.fd!==void 0&&r.fd!==0)return Yt;if(e.redirections.some((l)=>l!==r&&["<","<<","<<-","<<<","<&","<>"].includes(l.operator)))return Yt;let i=e.redirections.some((l)=>l!==r&&Wf(l.target));if(se(e.words[0],"cat"))return i?Yt:void 0;if(se(e.words[0],"tee"))return i||e.words.slice(1).some(Wf)?Yt:void 0;let s=e.words[0],a=e.words[1];if(se(s,"git")&&(se(a,"apply")||se(a,"commit")))return;if(se(s,"gh")&&(se(a,"pr")||se(a,"issue"))&&se(e.words[2],"create"))return;return Yt}function Wf(e){return e?.parts.some((t)=>t.provenance==="command-substitution"&&t.raw.startsWith(">("))??!1}function Rw(e,t,n,r,o){if(!t)return null;let i=e.redirections.filter((c)=>c.operator==="<<"||c.operator==="<<-"),s=i.flatMap((c)=>c.heredoc?[c.heredoc.body]:[]);if(_w(e,i,n,r,o))return null;let a=ww(e,i,o);if(a!==void 0)return a?{reason:a.reason,segment:e.displayText,ruleId:a.id,intent:a.intent}:null;let l=Qa(s.length===i.length?s.join(`
+`):e.source,o);return l?{...l,segment:e.displayText}:null}function ww(e,t,n){let r=t.length===1?t[0]:void 0;if(!r?.heredoc||!tl(r.heredoc)||r.fd!==void 0&&r.fd!==0)return;let o=se(e.words[0],"uv")&&se(e.words[1],"run")?e.words.slice(2):e.words,i=o[0];if(i?.provenance!=="literal"||!De(i.text))return;let s=o.findIndex((m)=>se(m,"-"));if(!o.slice(1,s===-1?void 0:s).every((m)=>m.provenance==="literal"&&m.text.startsWith("-")))return;let l=r.heredoc.body,c=re(n.policy,"interpreter.one-liner-paranoid",!!n.paranoidInterpreters);if(n.trace?.recordSegment({type:"interpreter",interpreter:i.text,codeArg:l,paranoidBlocked:c}),c){let m=P(v("interpreter.one-liner-paranoid",ir),n.policy);if(m)return m}if(!sr(l,void 0,!n.strict))return null;let d=P(v("interpreter.dangerous-command",yn),n.policy);if(!d)return null;return n.trace?.recordSegment({type:"dangerous-text",token:l,matched:!0,reason:d.reason}),d}function _w(e,t,n,r,o){let i=t.length===1?t[0]:void 0;if(!i?.heredoc||!tl(i.heredoc)||i.fd!==void 0&&i.fd!==0)return!1;let s=Gt(e.words,o.environment,n.effectiveCwd,r),a=s.words.map(_),l=O(a[0]??"");if((s.envSplitValues?.length??0)>0||!Y.has(l)&&!Y.has(T(l)))return!1;return st(a)}function Aw(e,t,n,r,o){let i=kf(e,t.effectiveCwd,r,t.shellGitContextState.shellAssignments,n);if(i===null)o?.recordSegment({type:"cwd-change",segment:e.words.map(_).join(" "),effectiveCwdNowUnknown:!0});if(i!==void 0)t.effectiveCwd=i}var Pw=new Set(["fi","done","esac"]);function Tw(e){return e?.kind==="command"&&e.words.length===1&&e.words[0]?.raw==="!"}function Iw(e,t,n,r){let o=e.words[0]?.text??"",i=t.shellGitContextState.bodyDepth,s=n.shellGitContextState.bodyDepth,a=n.compoundBodies;if(s>i)return n.compoundBodies=[...a.slice(0,i),{entryCwd:t.effectiveCwd,branchCwds:a[i]?.branchCwds??[],hasElse:!1}],[n];let l=i>0?a[i-1]:void 0;if(l&&(o==="else"||o==="elif"))return n.compoundBodies=[...a.slice(0,i-1),{entryCwd:l.entryCwd,branchCwds:[...l.branchCwds,n.effectiveCwd],hasElse:o==="else"}],n.effectiveCwd=l.entryCwd,[n];let c=l!==void 0&&Pw.has(o);if(c)n.compoundBodies=a.slice(0,s);return[...new Set([n.effectiveCwd,...c?l.branchCwds:[],...c&&!l.hasElse?[l.entryCwd]:[],...r?[t.effectiveCwd]:[]])].map((m)=>{if(m===n.effectiveCwd)return n;let u=Xt(n);return u.effectiveCwd=m,u})}function kw(e,t){return e.length===t.length&&e.every((n,r)=>{let o=t[r];return o!==void 0&&n.entryCwd===o.entryCwd&&n.hasElse===o.hasElse&&n.branchCwds.length===o.branchCwds.length&&n.branchCwds.every((i,s)=>i===o.branchCwds[s])})}var Ow=/^[A-Za-z_][A-Za-z0-9_]*$/,Mw=8;function Dw(e,t){let n=e.words[1]?.text;if(e.dialect!=="posix"||e.words[0]?.text!=="for"||n===void 0||!Ow.test(n))return[t];let r=e.words.slice(3);if(!(e.words[2]?.text==="in"&&r.length>=1&&r.length<=Mw&&r.every((i)=>i.provenance==="literal"&&!/[\s$`*?[{}~'"\\]/.test(i.text))))return t.shellGitContextState.shellAssignments.delete(n),[t];return r.map((i)=>{let s=Xt(t);return s.shellGitContextState.shellAssignments.set(n,i.text),s})}function Xt(e){return{effectiveCwd:e.effectiveCwd,shellGitContextState:Sm(e.shellGitContextState),literalHeredocFiles:new Map(e.literalHeredocFiles),functionDefinitions:new Map(e.functionDefinitions),createdDirectories:new Set(e.createdDirectories),compoundBodies:e.compoundBodies}}function ci(e){let t=[];for(let n of e){if(!t.some((r)=>Nw(r,n)))t.push(n);if(t.length>K.controlFlowStates.cap)throw new N("controlFlowStates")}return t}function Nw(e,t){return e.effectiveCwd===t.effectiveCwd&&kw(e.compoundBodies,t.compoundBodies)&&kn(e.shellGitContextState.env,t.shellGitContextState.env)&&kn(e.literalHeredocFiles,t.literalHeredocFiles)&&kn(e.functionDefinitions,t.functionDefinitions)&&kn(e.shellGitContextState.effectiveEnvAssignments,t.shellGitContextState.effectiveEnvAssignments)&&kn(e.shellGitContextState.shellAssignments,t.shellGitContextState.shellAssignments)&&e.shellGitContextState.bodyDepth===t.shellGitContextState.bodyDepth&&Gf(e.shellGitContextState.bodyAssignments,t.shellGitContextState.bodyAssignments)&&Gf(e.createdDirectories,t.createdDirectories)}function Gf(e,t){return e.size===t.size&&[...e].every((n)=>t.has(n))}function kn(e,t){if(e===t)return!0;if(!e||!t||e.size!==t.size)return!1;return[...e].every(([n,r])=>t.get(n)===r&&t.has(n))}function Lw(e,t){let n=Jn(e);return n===void 0?void 0:t.get(n)}function Ww(e,t){if(!t)return null;return{reason:t.reason,segment:e,ruleId:t.id,intent:t.intent}}function Gw(e,t=e.effectiveCwd){let n=t===null;return{environment:e.environment,cwd:n?void 0:t??e.cwd,originalCwd:n?void 0:e.cwd,strict:e.strict,paranoid:e.paranoidRm,allowTmpdirVar:e.allowTmpdirVar,protectedGitMetadata:e.protectedGitMetadata,policy:e.policy,budget:e.budget}}function Qa(e,t){let n=P(Te(e),t.policy),r=t.trace?.currentSegmentIndex??t.trace?.allocateSegment(),o={type:"dangerous-text",token:e,matched:!!n,reason:n?.reason};if(t.trace?.recordSegment(o,r),!n&&/^(?:cd|pushd)\s/.test(e))t.trace?.recordSegment({type:"cwd-change",segment:e,effectiveCwdNowUnknown:!0},r);return n?{reason:n.reason,segment:e,ruleId:n.id,intent:n.intent}:null}function Ff(e,t){let n={type:"strict-unparseable",rawCommand:e,reason:En},r=t.trace?.currentSegmentIndex;if(r===void 0)t.trace?.recordGlobal(n);if(r!==void 0)t.trace?.recordSegment(n)}var Fw=new Set(["derivedTokens","trackedHeredocFiles","controlFlowStates","wrapperPeelIterations","derivedCommandShape"]);function Hf(e,t,n,r){let o=el(e,0,{...t,...fu(t),budget:t.budget??Se(),factStore:r},n);if(!o)return null;return{kind:"deny",reason:o.reason,intent:o.intent??"manual_only",...o.ruleId?{ruleId:o.ruleId}:{},evidence:{command:e,segment:o.segment}}}function jf(e,t,n){try{return{decision:e()}}catch(r){let o=zw(r,t,n);if(!o)throw r;return o}}function zw(e,t,n){if(!(e instanceof N)||!Fw.has(e.kind))return null;let r=K[e.kind];if(n?.currentSegmentIndex!==void 0)n.recordSegment({type:"error",message:r.reason});if(n?.currentSegmentIndex===void 0)n?.recordGlobal({type:"error",message:r.reason});return{decision:{kind:"deny",reason:r.reason,intent:"stop_and_explain",evidence:{command:t,segment:t}},errorCode:r.errorCode}}var Bw=new Set(["src/entries/bin.ts","src/cli/cc-safety-net.ts","dist/bin/cc-safety-net.js","dist/bin/hook.js"]),rl=new Set(["cc-safety-net","ccsn"]),$w=new Set(["bunx","npx","pnpx"]),Uw=new Set(["pnpm","yarn"]),Hw=new Set(["npm","pnpm","yarn"]),jw=new Set(["bun","node"]);function fi(e,t,n={}){if(rl.has(e))return 0;if($w.has(e)){if(n.broad)return nl(t);let o=t[0]==="-y"||t[0]==="--yes"?1:0;return mi(t[o])?o+1:null}let r=n.broad?t.findIndex((o)=>!o.startsWith("-")):0;if(r!==-1&&Hw.has(e)&&n.broad&&t[r]==="exec"){let o=nl(t.slice(r+1));return o===null?null:r+1+o}if(Uw.has(e)){if(e==="yarn"&&!n.broad)return null;if(!n.broad)return t[0]==="dlx"&&mi(t[1])?2:null;if(r===-1||t[r]!=="dlx")return null;let o=nl(t.slice(r+1));return o===null?null:r+1+o}if(jw.has(e)){let o=n.broad&&r!==-1?r:0;if(Vf(t[o]))return o+1;if(e==="bun"&&t[o]==="run"&&Vf(t[o+1]))return o+2}return null}function nl(e){let t=e.findIndex((r)=>mi(r));if(t===-1)return null;let n=t;while(n<e.length){let r=e[n]??"";if(!r.startsWith("-")&&!mi(r))break;n++}return n}function mi(e){if(!e)return!1;let t=e.indexOf("@");if(t===-1)return rl.has(e);if(t===0)return!1;let n=e.slice(t+1);if(n===""||n.includes("/")||n.includes(":"))return!1;return rl.has(e.slice(0,t))}function Vf(e){let t=e?.replaceAll("\\","/");return[...Bw].some((n)=>t===n||t?.endsWith(`/${n}`))}var Kf="Only the user may apply a policy proposal, because it rewrites the configuration CC Safety Net enforces. Ask them to run `cc-safety-net policy apply <file>` themselves in a terminal; you can run `cc-safety-net policy check <file>` to show them what it would change.";function qf(e,t,n){let r=ge(e,"input-candidate");if(!r)return null;let o=bn(r.shell,e.invocation.context.executionCwd,t,n,{findSegmentTarget:(i)=>Vw(i,t),isRedirectionTarget:()=>!1,findMalformedTarget:()=>null});return o?{target:o}:null}function Vw(e,t){let n=yt([...e],t),r=n.slice(1),o=fi(T(n[0]??"").toLowerCase(),r,{broad:!0});if(o===null)return null;let i=r.slice(o).filter((s)=>s!=="-g"&&s!=="--global");return i[0]==="policy"&&i[1]==="apply"?n.join(" "):null}import{dirname as pi}from"path";var Jf="This path contains the protected policy config and you must not modify or delete it.",Kw=new Set(["[","cat","file","grep","head","jq","less","ls","more","rg","sed","stat","tail","test","wc"]);function Qf(e,t,n){let r=Qw(e.invocation.context,t,n);if(e.invocation.route.kind==="patch")return Yf(e.paths,!1,e.invocation.context.executionCwd,r,t,n);let o=ge(e,"input-candidate");if(e.invocation.route.kind==="command")return o?Zf(o.shell,e.invocation.context.executionCwd,r,t,n):null;if(e.invocation.route.kind==="unknown"&&o){let i=Zf(o.shell,e.invocation.context.executionCwd,r,t,n);if(i)return i}return Yf(e.paths,e.invocation.route.kind==="grep"||e.invocation.route.kind==="glob"||Nr(e.invocation.toolName),e.invocation.context.executionCwd,r,t,n)}function Yf(e,t,n,r,o,i){if(t)return null;let s=e.find((a)=>Ar(a,n,r,o,i));return s?{target:s}:null}function Zf(e,t,n,r,o){let i=bn(e,t,r,o,{findSegmentTarget:(s,a)=>qw(s,a,n,r,o)?.target??null,isRedirectionTarget:(s,a)=>Ar(s,a.cwd,n,r,o),findMalformedTarget:(s)=>Jw(s,t,n,r,o)?.target??null});return i?{target:i}:null}function qw(e,t,n,r,o){if(dr(e))return null;let i=Ct([...e],r),s=T(i[0]??"").toLowerCase(),a=i.slice(1);if(s==="rm"&&Yw(a)){let l=Zw(a).find((c)=>Xf(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(s==="find"){if(Ko(i,1)||Ea(i,r)){let c=(Sr(q(i))??q(["."])).find((d)=>{let m=pe(d.text,t.variables);return Ar(m,t.cwd,n,r,o)||Xf(m,t.cwd,n,r,o)})?.text;if(c)return{target:c}}}if(s==="mv"){let l=Do(a).sources.find((c)=>e_(pe(c,t.variables),t.cwd,n,r,o));if(l)return{target:l}}if(Xw(i,s))return null;for(let l of[...e,...i])for(let c of ep(l))if(Ar(pe(c,t.variables),t.cwd,n,r,o))return{target:c};return null}function Yw(e){return e.some((t)=>t==="--recursive"||t.startsWith("-")&&!t.startsWith("--")&&/[rR]/.test(t.slice(1)))}function Zw(e){let t=e.indexOf("--");if(t!==-1)return[...e.slice(0,t).filter((n)=>!n.startsWith("-")),...e.slice(t+1)];return e.filter((n)=>!n.startsWith("-"))}function Xw(e,t){if(!Kw.has(t))return!1;if(t!=="sed")return!0;return!e.slice(1).some((n)=>n.startsWith("-i")||n==="--in-place"||n.startsWith("--in-place="))}function Jw(e,t,n,r,o){for(let i of e.split(/\s+/))for(let s of ep(i))if(Ar(s,t,n,r,o))return{target:s};return null}function ep(e){let t=e.trim().replace(/^['"]|['"]$/g,""),n=t.indexOf("=");return n===-1||n===t.length-1?[t]:[t,t.slice(n+1)]}function Qw(e,t,n){let r=(a)=>Pr(le(a,e.executionCwd,t,n)),o=r(ln(t)),i=[r(Vn(e.executionCwd)),r(Vn(e.configCwd))],s=new Set(i.map((a)=>pi(a)));for(let a=pi(o);;a=pi(a))if(s.add(a),pi(a)===a)break;return{files:new Set([o,...i]),directoriesAndAncestors:s}}function Ar(e,t,n,r,o){let i=Vl(e,t,r,o,(s)=>Pr(s)===Ur);return i!==null&&n.files.has(Pr(i))}function Xf(e,t,n,r,o){return n.directoriesAndAncestors.has(Pr(le(e,t,r,o)))}function e_(e,t,n,r,o){let i=Pr(le(e,t,r,o));return n.files.has(i)||n.directoriesAndAncestors.has(i)}function Pr(e){return process.platform==="win32"?e.toLowerCase():e}import{isAbsolute as gi,posix as mp,resolve as yi,win32 as t_}from"path";import{fileURLToPath as n_}from"url";var fp="Access to a sensitive path is not allowed.",pp=new Set(["echo","printf"]),r_=new Set(["find"]),o_=new Set(["!","do","elif","else","if","then","until","while"]),i_=new Set(["-exec","-execdir"]),s_=new Set([";","+"]),a_=new Set(["-delete","-files0-from","-exec","-execdir","-fls","-fprint","-fprint0","-fprintf","-ok","-okdir"]),l_=new Set(["-name","-iname","-path","-ipath","-wholename","-iwholename","-samefile"]),gp=new Set(["-d","--data","--data-ascii","--data-binary","--data-urlencode","-F","--form"]),c_=new Set(["bun","child_process","deno","dotenv","fs","subprocess"]),u_=new Set(["append","awk","base64","cat","chmod","chown","connect","copy","cp","database","dd","eval","exec","fetch","file","function","grep","head","include","load","move","mv","open","fopen","popen","read","readfile","remove","rename","require","rg","rm","sed","shell","source","spawn","strings","system","tail","tar","truncate","unlink","write","xxd","zip"]),hp=new Set(["-c","-e","-r","-E","--eval","--exec"]),d_=new Map([["c",new Set(["bash","sh","zsh","dash","ksh","python"])],["e",new Set(["node","deno","bun","ruby","perl","rscript","osascript"])],["E",new Set(["perl"])],["r",new Set(["php"])]]),m_=new Set(["grep","rg"]),f_=new Set(["--search","-S","--title","-t","--body","-b","--jq","-q"]),p_=new Set(["commit","merge","notes","stash","tag"]),g_=new Set(["-m","--message"]),h_=new Set(["--grep"]),tp=new Set(["jq","gojq","jaq"]),np="f",rp="file",y_="files",C_=new Set(["e","f"]),b_=new Set(["regexp","file"]),S_=new Set(["e","f","A","B","C","m"]),v_=new Set(["regexp","file","after-context","before-context","context","max-count"]),ol="__CC_SAFETY_NET_PIPE_INPUT__",sl=/[\w./~@+-]*[./~][\w./~@+-]*/g,E_=/(?:^|[^\w])([rRbBuUfF]{1,2})$/,x_=/^(?:`|%[qQwWiIxX]?[([{<|!/]|<<<?[~-]?['"]?[A-Za-z_])/,R_=/#\{|\$\{|\{\$|[$@][A-Za-z_]/,op=/\b(?:subprocess\s*\.\s*(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|(?:[\w$]+\s*\.\s*)*(?:exec(?:File)?(?:Sync)?|spawn(?:File)?(?:Sync)?|system|popen|shell_exec|passthru|child_process|eval))\s*\(/g,ip=/\b(?:system|exec|spawn|popen)\s*$/,w_=/\b(?:eval|exec)\s*\(/g,__=/\b(?:eval|exec)\s*$/,A_=new Map([["bash",new Set(["-O"])],["sh",new Set(["-O"])],["zsh",new Set(["-o"])],["dash",new Set(["-o"])],["ksh",new Set(["-o"])],["python",new Set(["-W","-X"])],["node",new Set(["-r","--require","--loader","--import","--input-type"])]]);function sp(e,t,n,r,o,i){for(let s of e){let a=s.target;if(RA(a,s.cwd,t?.denyPaths??[],n,r,o))return{target:a,ruleId:"secret.deny-path"};if(i&&!i.has(a))continue;let l=EA(a,s.cwd,t,r,o);if(l){let c=i!==void 0&&!l.startsWith("secret.home.")&&!l.startsWith("secret.cli.");if(c&&r.paths.isDirectory(xp(a,s.cwd,r,o)))continue;if(c&&s.isRedirectionWriteTarget===!0&&!a.includes("$")&&!ll(a,s.cwd,r,o))continue;if(c&&/\s/.test(a)&&!a.includes("$")&&!/^(?:[~./]|[A-Za-z]:[\\/])/.test(a)&&!ll(a,s.cwd,r,o))continue;if(!l.startsWith("secret.cli.")&&wA(a,s.cwd,t?.allowPaths??[],n,r,o))continue;return{target:a,ruleId:l}}}return null}function yp(e,t,n,r,o={}){let i=ap(e,n,r),s=sp(i,t,e.invocation.context.configCwd,n,r);if(s===null||s.ruleId==="secret.deny-path"||o.strict!==!1)return s;let a=sp(i,t,e.invocation.context.configCwd,n,r,new Set(ap(e,n,r,{skipMetadataOnlySegments:!0,inlineLiteralsPresumedData:!0}).map((l)=>l.target)));return a?.ruleId!=="secret.deny-path"&&P_(e,n)?null:a}function P_(e,t){let n=ge(e,"input-candidate")??ge(e,"declared-command");if(!n)return!1;if(n.program.nodes.some((s)=>s.kind==="command"&&s.nested.length>0))return!1;let r=[];for(let s of Mo(n.shell)){if(s.kind==="operator"&&s.boundary)return!1;if(s.kind==="redirection")return!1;if(s.kind==="operator")continue;r.push(ot(s.text,t))}let o=ut(r);if(o.length===0)return!1;let i=je(o[0]??"").toLowerCase();if(e.invocation.route.kind==="unknown")return n.program.dialect==="powershell"&&(i==="ls"||i==="stat");return cl(i,o.slice(1))}function cl(e,t){if(e==="ls"||e==="stat")return!0;if(e==="test")return t.length===2&&(t[0]==="-e"||t[0]==="-f");if(e==="[")return t.length===3&&(t[0]==="-e"||t[0]==="-f")&&t[2]==="]";if(e==="git")return t[0]==="check-ignore";if(e!=="find")return!1;return!t.some((n)=>a_.has(n))}function ap(e,t,n,r={}){let o=e.invocation.context.executionCwd,i=e.invocation.route.kind;if(i!=="command"&&i!=="unknown")return e.paths.map((a)=>({target:a,cwd:o}));let s=ge(e,"input-candidate");return[...s?On(s.shell,e.store,r,t,o,n,T_(s)):[],...i==="unknown"?e.paths.map((a)=>({target:a,cwd:o})):[]]}function T_(e){return e.program.dialect==="powershell"}function On(e,t,n,r,o,i,s=!1){if(e.status==="structural-limit")throw new Fe;if(e.status==="unclosed-quote")return[];if(e.status==="invalid")throw Error("Unable to parse command for secret protection");let a=[...e.assignmentFallbacks.map((c)=>({target:c,cwd:o})),...iA(ot(e.source,r),t,n,r,o,i)],l=(c)=>ot(z_(c,s),r);return Oo(e,o,r,i,{word:l,segment:(c,d,m,u,f)=>{if(c.length===0)return null;if(a.push(...Ci(c,t,n,r,d.cwd,i,f)),m!==null)a.push(...k_(m,c,t,n,r,d.cwd,i));return null},redirection:(c,d)=>{if(c.body!==void 0&&c.consumer!==void 0)a.push(...Cp(c.consumer,[c.body],t,n,r,d.cwd,i,(m)=>O_(c.consumer??[],m,t,n,r,d.cwd,i)));if(c.targetOrder==="legacy-segment")return oa;return a.push({target:l(c.target),cwd:d.cwd,...c.role==="file-write"?{isRedirectionWriteTarget:!0}:{}}),null}}),a}function ul(e,t,n,r,o,i){let s=t.getShellSyntax(e);if(s.status==="structural-limit")throw new Fe;return s.status==="complete"?On(s,t,n,r,o,i):null}function Ci(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:o});if(s?.size){let g=e.filter((h,y)=>!s.has(y));if(tp.has(je(ut(g)[0]??"").toLowerCase()))return[...e.filter((h,y)=>s.has(y)).map(a),...Ci(g,t,n,r,o,i)]}let l=F_(e).map(a),c=ut(e);if(c.length===0)return l;let d=c[0]??"",m=je(d).toLowerCase(),u=c.slice(1),f=c.findIndex((g)=>!o_.has(g));if(n.skipMetadataOnlySegments===!0&&f!==-1&&cl(je(c[f]??"").toLowerCase(),c.slice(f+1)))return l;let p=I_(d,m,u);if(p)return[...l,...p.map(a)];if(pp.has(m))return n.displayOperandsAreCapturedOutput===!0?[...l,...bp(e).map(a)]:l;if(m==="eval")return[...l,...ul(u.join(" "),t,n,r,o,i)??u.map(a)];if(m==="export")return[...l,...u.flatMap((g)=>/^[A-Za-z_][A-Za-z0-9_]*=/.test(g)?[g.slice(g.indexOf("=")+1)]:Xe(m,g)).map(a)];if(m==="git")return[...l,...$_(u).map(a)];if(m==="gh")return[...l,...al(m,u,f_).map(a)];if(tp.has(m))return[...l,...B_(u).map(a)];if(m_.has(m))return[...l,...fA(u).map(a)];if(r_.has(m))return[...l,...V_(u,t,n,r,o,i).map(a)];if(Pe.has(m))return[...l,...u.flatMap((g)=>Xe("awk",g)).map(a),...u.flatMap((g)=>q_(g,t,n,r,o,i)),...u.flatMap(Y_).map(a)];if(m==="curl")return[...l,...u.flatMap((g)=>Xe(m,g)).map(a),...U_(u).map(a)];if(mr(m)){let g=ur.has(m)?xe([m,...u]):null;if(g!==null&&g.command!==null&&g.commandIndex!==null){let h=t.getShellSyntax(g.command);if(h.status==="structural-limit")throw new Fe;if(h.status==="complete")return[...l,...On(h,t,n,r,o,i),...u.slice(g.commandIndex).filter((y)=>!y.startsWith("-")).map(a)]}return[...l,...K_(m,u,t,n,r,o,i)]}return[...l,...u.flatMap((g)=>Xe(m,g)).map(a)]}function I_(e,t,n){let r=fi(t,n);if(r===null||n[r]!=="explain")return null;let o=[e,...n.slice(0,r)],i=n.slice(r+1);for(let s=0;s<i.length;s++){let a=i[s];if(a==="--json"||a==="--help"||a==="-h")continue;if(a==="--cwd"){let l=i[s+1];if(l&&!l.startsWith("--"))o.push(l);s++;continue}return o}return o}function k_(e,t,n,r,o,i,s){if(L_(t,n,r,o,i,s)){let a=ut(e),l=cl(je(a[0]??"").toLowerCase(),a.slice(1))?a.slice(1).filter((c)=>!c.startsWith("-")):[];return[...bp(e),...l].map((c)=>({target:c,cwd:i}))}return Cp(t,M_(e),n,r,o,i,s,()=>[])}function O_(e,t,n,r,o,i,s){let a=ut(e);if(!mr(je(a[0]??"").toLowerCase()))return[];return ul(t,n,r,o,i,s)??[{target:t,cwd:i}]}function Cp(e,t,n,r,o,i,s,a){let l=W_(e);if(l===null)return t.flatMap(a);return t.flatMap((c)=>ur.has(l)?On(n.getShellSyntax(c),n,r,o,i,s):hi(l,c,n,r,o,i,s))}function bp(e){let t=ut(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase();if(!pp.has(n))return[];let r=t[t[1]==="--"?2:1];if(n==="printf"&&r!==void 0&&!r.startsWith("-")&&!r.replaceAll("%%","").includes("%"))return[dl(r.replaceAll("%%","%"))];return t.slice(1)}function M_(e){let t=ut(e);if(t.length===0)return[];let n=je(t[0]??"").toLowerCase(),r=t.slice(1);if(n==="echo"){let o=r.findIndex((i)=>!/^-[neE]+$/.test(i));return[(o===-1?[]:r.slice(o)).join(" ")]}if(n==="printf")return D_(r);return[]}function D_(e){let t=e[0];if(t===void 0)return[];let n=(t.match(/%%|%[bqs]/g)??[]).filter((o)=>o!=="%%").length;if(n===0||e.length===1)return[dl(t)];let r=e.slice(1);return Array.from({length:Math.ceil(r.length/n)},(o,i)=>N_(t,r.slice(i*n,(i+1)*n)))}function N_(e,t){let n=0;return dl(e.replace(/%%|%[bqs]/g,(r)=>{if(r==="%%")return"%";let o=t[n]??"";return n++,o}))}function dl(e){return e.replace(/\\n/g,`
+`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function L_(e,t,n,r,o,i){let s=ut(e);if(s.length===0||je(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Kt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,ol]:l.map((m)=>m.split(c).join(ol));return Ci(d,t,n,r,o,i).some((m)=>m.target.includes(ol))}function W_(e){let t=ut(e);if(t.length===0)return null;let n=je(t[0]??"").toLowerCase();if(!mr(n))return null;return G_(n,t.slice(1))?n:null}function G_(e,t){let n=ml(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(hp.has(o)||Sp(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(A_.get(n)?.has(o))r++;continue}return!1}return!0}function ml(e){return/^python\d/.test(e)?"python":e}function F_(e){let t=[];for(let n of e){if(Ep(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var lp=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function z_(e,t){if(!t||!lp.test(e))return e;return`~${e.replace(lp,"").replace(/\\/g,"/")}`}function Xe(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function B_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Xe("jq",i))}return e.flatMap((r,o)=>o===t?[]:Xe("jq",r))}function $_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...p_.has(r)?al("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),g_):al("git",e.slice(n),h_)];if(t.push(...Xe("git",r)),!Ee.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Xe("git",o)),n++}return t}function al(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Xe(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Xe(e,i))}return r}function U_(e){return e.flatMap((t,n)=>{let r=j_(t);if(r!==null)return cp(r.flag,r.value);let o=H_(e[n-1]);return o===null?[]:cp(o,t)})}function cp(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return il(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return il(t.slice(n+1))}return t.startsWith("@")?il(t.slice(1)):[]}function H_(e){if(e===void 0)return null;if(gp.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function j_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return gp.has(r)?{flag:r,value:e.slice(n+1)}:null}function il(e){return e===""||e==="-"?[]:[e]}function V_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!i_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>s_.has(f)),m=d===-1?c:c.slice(0,d),u=Ci(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,g)=>{if(!l_.has(f))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function K_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(hp.has(c)||Sp(e,c)){let m=t[l+1];if(m!==void 0)a.push(...hi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...hi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Sp(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return d_.get(t[t.length-1]??"")?.has(ml(e))??!1}function q_(e,t,n,r,o,i){if(!e.includes("system"))return[];return Ca(e)?.commands.flatMap((s)=>On(t.getShellSyntax(s),t,n,r,o,i))??[]}function Y_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function Z_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(fl),...e.match(sl)??[]]}function hi(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=J_(t,X_(e));if(l.kind==="unmaskable")return Z_(t).map(a);let c=l.masked.match(op)!==null||l.literals.some((g)=>ip.test(l.masked.slice(0,g.start))),d=l.masked.match(w_)!==null||l.literals.some((g)=>__.test(l.masked.slice(0,g.start))),m=r.inlineLiteralsPresumedData===!0&&!ur.has(e),u=m&&!(nA(l.masked)||c||d)?[]:l.literals,f=m?Array.from(l.masked.matchAll(op),(g)=>{let h=g.index+g[0].length;return{start:h,end:Xs(l.masked,h)}}):[],p=!m||f.some((g)=>Js(l.masked,g.start))?l.literals:l.literals.filter((g)=>ip.test(l.masked.slice(0,g.start))||f.some((h)=>g.start>=h.start&&g.start<h.end));return[...u.map((g)=>g.text).filter((g)=>g!=="").map(a),...u.flatMap((g)=>fl(g.text)).map(a),...m?[]:l.literals.flatMap((g)=>g.text.match(sl)??[]).map(a),...c?p.flatMap((g)=>ul(g.text,n,r,o,i,s)??[a(g.text)]):[],...d?l.literals.flatMap((g)=>hi(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
+`:y),n,r,o,i,s)):[],...(l.masked.match(sl)??[]).map(a)]}function X_(e){let t=ml(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function J_(e,t){if(t==="opaque")return{kind:"unmaskable"};let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(x_.test(e.slice(o)))return{kind:"unmaskable"}}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&tA(e,o))return{kind:"unmaskable"};let a=t==="python"?Q_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=eA(e,c,l);if(d===null)return{kind:"unmaskable"};let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return{kind:"unmaskable"};if(t==="simple"&&s==='"'&&R_.test(m))return{kind:"unmaskable"};r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{kind:"masked",masked:n.join(""),literals:r}}function Q_(e,t){return E_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function eA(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
+`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function tA(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function nA(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(c_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>u_.has(i)))continue;if(o.length>1)return!0;if(rA(e,r)===".")return!0;if(oA(e,r+n.length)==="(")return!0}return!1}function rA(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function oA(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function iA(e,t,n,r,o,i){return uA(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...On(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...sA(a,r)?aA(a,r).map((l)=>({target:l,cwd:o})):[]]})}function sA(e,t){let n=Mo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||je(ot(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=ot(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function aA(e,t){return Mo(e).flatMap((n)=>n.kind==="word"?[ot(n.text,t)]:n.kind==="redirection"&&n.target?[ot(n.target,t)]:[]).flatMap(fl)}function fl(e){let t=cA(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||lA(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function lA(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function cA(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function uA(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Kn(o,n))continue;if(vp(e,r,n)){let i=dA(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=mA(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function dA(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Kn(i,n))continue;if(vp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function mA(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function vp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function fA(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===y_)o=!0;if(b_.has(m))r=!0;if(u!==void 0){if(m===rp)t.push(u);continue}if(v_.has(m)){let f=e[l+1];if(m===rp&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let g=0;g<m.length;g++){let h=m[g]??"";if(C_.has(h))r=!0;if(S_.has(h)){u=h,f=m.slice(g+1);break}}if(u==="")continue;if(f.length>0){if(u===np)t.push(f);continue}let p=e[l+1];if(u===np&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function ut(e){let t=e.findIndex((n)=>!Ep(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function Ep(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var pA=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),gA=".env.",hA=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),yA=[".env.example.",".env.sample."];function CA(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function bA(e){return e.length>0&&!/\s/.test(e)}function ll(e,t,n,r){let o=xp(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function xp(e,t,n,r){try{return kr(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var SA=new Set(["node_modules","__pycache__"]),vA=[["vendor","bundle"],["vendor","cache"]];function EA(e,t,n,r,o){if(CA(e))return null;let i=Ze(e,t,r,o);if(!i)return null;let s=U(i.split("/").pop()??""),a=U(i),l=()=>bA(s)||ll(e,t,r,o);if(hA.has(s)||yA.some((u)=>s.startsWith(u)))return null;let c=U(PA(e,t,r,o));for(let u of ms){let f=`~/${u.suffixParts.join("/")}`;if((dp(a,f)||dp(c,f))&&ct(u.id,n))return u.id}let d=xA(i,t,n,r,o);if(d)return d;if(pA.has(s))return null;for(let u of ds)if(s===u.basename&&ct(u.id,n))return u.id;if(s.startsWith(gA)&&ct(Zr.id,n)&&l())return Zr.id;for(let u of fs)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&ct(u.id,n)&&l())return u.id}for(let u of ps)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&ct(u.id,n))return u.id}if(_A(a))return null;if(!s.includes(".")&&qn.pattern.test(s)&&ct(qn.id,n))return qn.id;let m=AA(s,n);if(m)return m;return null}function xA(e,t,n,r,o){return Xr.find((i)=>{if(!ct(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=U(e).split("/");return F(e,V(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ir(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,Ze("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||Tr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=V(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=U(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=U(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,ue(V(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ir(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,Ze(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||Tr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,V(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||Tr(e,s,["credentials"])||Tr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=U(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,V(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,V(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=U(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((d)=>Ir(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ue(V(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(U(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?Ir(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>F(e,Ze(d,t,r,o),l))}case"secret.cli.pi":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,V(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ze("~",t,r,o);return[ue(V(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ue(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||Tr(e,ue(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ue(Ze("~",t,r,o),".config","amp")],l=U(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>F(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ir(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ue(V(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ue(V(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,Ze("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||U(e).split("/").at(-1)==="mcp-auth.json"&&Jt(U(e),U(a))}case"secret.cli.cursor.config":{let s=U(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=U(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,V(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,Ze("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var up=new WeakMap;function V(e,t,n,r,o){let i=up.get(o)??new Map;up.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ze(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>Rp(e,ue(t,r)))}function Tr(e,t,n){return n.some((r)=>Jt(U(e),U(ue(t,r))))}function Ir(e,t,n,r,o){return Rp(e,Ze(t,n,r,o))}function Rp(e,t){return U(e)===U(t)}function ue(e,...t){return He([e,...t].filter(Boolean).join("/"))}function RA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));return n.some((a)=>Jt(s,U(kr(a,r,o,i))))}function wA(e,t,n,r,o,i){if(n.length===0)return!1;let s=U(kr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(L(ve(a),o.paths,i)):"",c=U(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=U(d?He(L(yi(ve(d)),o.paths,i)):l&&He(L(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Jt(s,m))return!1;return n.some((u)=>{let f=bs(u);if(f&&mp.basename(s)!==U(f.name))return!1;let p=U(kr(f?.root??u,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Jt(s,p)&&!(f&&s===p)})}function _A(e){let t=e.split("/");return t.some((n)=>SA.has(n))||vA.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function AA(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of gs)if(r===o.extension&&ct(o.id,t))return o.id;for(let o of hs)if(o.pattern.test(r)&&ct(o.id,t))return o.id;return null}function U(e){return e.toLowerCase()}function ct(e,t){return!t?.disabledRules?.includes(e)}function Ze(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";if(!o)return i;let s=gl(i,o),a=gi(s)?s:He(yi(t,s)),l=He(L(a,n.paths,r));if(!Jt(l,o)){if(gi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function dp(e,t){return e===t||e.startsWith(`${t}/`)}function PA(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i||!o)return"";let s=gl(i,o),a=mp.normalize(gi(s)?s:He(yi(t,s))),l=He(ve(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function kr(e,t,n,r){let{home:o,normalized:i}=pl(e,n,r);if(!i)return"";let s=o?gl(i,o):i;return He(L(gi(s)?s:yi(t,s),n.paths,r))}function pl(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(L(ve(r),t.paths,n)):"",i=He(ve(TA(ot(e,t))));return{home:o,normalized:i}}function TA(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return n_(e)}catch{return e}}function gl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ue(t,e.slice(2));return e}function IA(e){if(process.platform==="win32")return!0;return t_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&IA(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function je(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var kA={findPolicyMutation:Qf,findGitMetadataMutation:wd,resolveGitMetadata:MA,loadPolicySnapshot:mu,findSensitiveTarget:yp,analyzeCommand:Hf,getModes:zi},OA=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function wp(e,t){let n={...kA,...t.dependencies},r=LA(e),o=Or(e)?e.command:r,i=_t("policy-protection",o,()=>fr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(Or(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ve,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:jd,intent:"stop_and_explain"}};let l=Se(),c=_t("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=_t("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Jf,intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=_t("policy-protection",o,()=>qf(i,t.environment,l));if(m){let C=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Kf,intent:"hard_stop",evidence:{command:C,segment:m.target}}}}let u=_t("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:ke,intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=_t("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...DA(f)},y=p.secretProtection.enabled===!1?null:_t("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:Or(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:fp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!Or(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...hl("command-validation",o),...h};let b=_t("command-analysis",o,()=>jf(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},NA(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===yr&&!OA.test(b.decision.evidence?.segment??"")&&Te(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function MA(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function DA(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function NA(e){return ge(e,"declared-command")?.program}function LA(e){try{return zn(e.input)}catch(t){let n=Or(e)?e.command:void 0;throw new Qt("policy-protection",hl("policy-protection",t instanceof Qe?void 0:n,t),t)}}function _t(e,t,n){try{return n()}catch(r){throw new Qt(e,hl(e,r instanceof Qe?void 0:t,r),r)}}function hl(e,t,n){let r=n instanceof N||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?Ei:Ln,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function Or(e){return e.route.kind==="command"}import{appendFileSync as YA,mkdirSync as ZA}from"fs";import{isAbsolute as XA,join as bl}from"path";import{lstatSync as Ap,readdirSync as WA,readFileSync as GA,rmdirSync as FA,statSync as Pp,unlinkSync as zA,utimesSync as BA,writeFileSync as $A}from"fs";import{join as Mr}from"path";function _p(e,t={}){return so(ln(e,t),e.home).policy.audit.retention_days}var Cl=86400000,UA=".last-prune",HA=/^\d{4}-\d{2}$/,jA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Tp=(e)=>Math.floor(e/Cl);function kp(e,t,n=()=>new Date){try{let r=n().getTime();if(!Pp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Mr(t,UA),i=Pp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Tp(i)===Tp(r))return;let s=r-_p(e)*Cl,a=new Date(r).toISOString().slice(0,7);for(let l of yl(t)){if(l.isDirectory()){VA(Mr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))KA(Mr(t,l.name),s)}$A(o,"",{mode:384}),BA(o,r/1000,r/1000)}catch{}}function VA(e,t,n){for(let r of yl(e)){if(!r.isDirectory()||!HA.test(r.name))continue;let o=Mr(e,r.name);for(let i of yl(o)){if(!i.isFile())continue;let s=jA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Cl;if(!Number.isFinite(a)||a>=t)continue;Op(Mr(o,i.name))}if(r.name!==n)Ip(o)}Ip(e)}function KA(e,t){try{let n=Ap(e);if(n.mtimeMs>=t)return;let r=GA(e,"utf-8").split(`
+`).filter((o)=>o.trim()).map(qA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Ap(e).mtimeMs!==n.mtimeMs)return;Op(e)}catch{}}function qA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function yl(e){try{return WA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function Op(e){try{zA(e)}catch{}}function Ip(e){try{FA(e)}catch{}}var JA="2.4.15",QA=1e4,eP=2000,tP=256,nP=32768;function rP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Sl(e,t,n,r,o,i,s={}){let a=rP(t);if(!a)return;let l=sP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=bi(dt(n),s.failureStage?Number.POSITIVE_INFINITY:QA),m=bi(dt(r),eP),u=s.toolName?bi(dt(s.toolName),tP):void 0,f=i===null?void 0:bi(dt(i),nP),p=bl(l,oP(f?.value??null),c.slice(0,7));ZA(p,{recursive:!0,mode:448});let g=bl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??$i)(),v:JA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};YA(g,`${JSON.stringify(h)}
+`,{encoding:"utf-8",mode:384}),kp(e,l,s.now)}catch{}}function bi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&XA(n)?n:null}function sP(e){let t=iP(e);return t?bl(t,".cc-safety-net","logs"):null}function Dp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Mp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Mp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Mp(e){return"command"in e?e.command??"":""}function Np(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Lp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Sl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Gp(e,t,n){try{let r=wp(t,{environment:e,...n.guard});return Wp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw Wp(e,t,r.evaluation,n,!(r.cause instanceof Qe),{stage:r.stage,errorCode:aP(r.cause)}),r}}function Wp(e,t,n,r,o=!0,i){Np(e,Dp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aP(e){if(e instanceof N)return K[e.kind].errorCode;if(e instanceof Qe)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}function en(e,t={}){return{malformed:!0,denial:Wn(t),cwd:e}}function vl(e,t){return{malformed:!0,denial:xi(e,t),cwd:e.cwd}}function Fp(e,t={}){return(n,r)=>{try{return lP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Wn())}}}function lP(e,t,n,r){let o=rc();if(n.cancelled?.(t))return n.block(Wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Lp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let d=Rl(l,{includeEvidence:c});return d?n.block(d):n.allow};try{let l=Gp(o,i,{guard:{auditAllowed:oc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Qt))throw l;if(It(ee.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${_l(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var cP={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>dP(e,t,n),getSessionId:(e)=>pP(e),allow:{action:"allow"},block:(e)=>gP(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},zp=uP();function uP(e={}){return Fp(cP,e)}function dP(e,t,n){if(!e||typeof e!=="object")return en(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return en(null);if(!r.input||typeof r.input!=="object")return en(null,{toolName:r.tool});let o=mP(t);if(!o)return en(null,{toolName:r.tool});let i=Yl(".",[o],n);if(!i)return vl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=fP(t,e);if(!s.ok)return en(i,{toolName:r.tool});if(!s.command)return nn(r.tool,r.input,{kind:Ai(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return en(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=Zl(a,i,n);if(!l)return vl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return nn(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function mP(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function fP(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function pP(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function gP(e){return{action:"reject-and-continue",message:wl(e)}}function hP(e){e.on("tool.call",(t)=>zp(t,e))}export{hP as default};